@absolutejs/auth 0.55.9 → 0.56.0

package/README.md

@@ -159,6 +159,12 @@ RFC 9728/RFC 8414 discovery, claim polling, and assertion exchange.
 See [the agent-auth interoperability and deployment guide](docs/AGENT-AUTH.md)
 for supported standards, security invariants, and the production checklist.
 
+OIDC and agent-registration signing accepts either a local ES256 `privateJwk`
+or a `sign(input)` adapter with the public JWK and key ID. Production adapters
+can therefore keep private key material non-exportable in a KMS or HSM. The
+adapter must return the 64-byte JOSE ES256 signature (`r || s`); DER conversion
+belongs at the KMS boundary.
+
 ### Features
 
 - **Authorization**: Handles the authorization process by generating the authorization URL and redirecting the user to the authentication provider.

package/dist/agents/index.js

@@ -199,6 +199,7 @@ init_crypto();
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
 var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var ES256_JOSE_SIGNATURE_BYTES = 64;
 var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
 var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
 var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -232,9 +233,18 @@ var jwkThumbprint = async (jwk) => {
   return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
 };
 var signJwt = async (payload, signing, typ = "JWT") => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
   const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  const encoded = ENCODER.encode(input);
+  let signature;
+  if (signing.sign !== undefined) {
+    signature = await signing.sign(encoded);
+  } else {
+    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+    signature = await crypto.subtle.sign(ES256, key, encoded);
+  }
+  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
+    throw new Error("ES256 signer must return a 64-byte JOSE signature");
+  }
   return `${input}.${toBase64Url(signature)}`;
 };
 var toPublicJwk = (key) => ({
@@ -12866,5 +12876,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=0C42692E8F64E63E64756E2164756E21
+//# debugId=B167D950C52D83A964756E2164756E21
 //# sourceMappingURL=index.js.map