@absolutejs/auth 0.56.1 → 0.56.3

package/dist/oidc/postgresStores.d.ts

@@ -467,6 +467,21 @@ export declare const oauthCodesTable: import("drizzle-orm/pg-core").PgTableWithC
             identity: undefined;
             generated: undefined;
         }>;
+        audience: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_codes", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_oauth_codes";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         claims_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_codes", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
             name: string;
             tableName: "auth_oauth_codes";
@@ -1042,6 +1057,21 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }>;
+        audience: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
+            name: string;
+            tableName: "auth_oauth_refresh_tokens";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            identity: undefined;
+            generated: undefined;
+        }>;
         claims_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_oauth_refresh_tokens", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
             name: string;
             tableName: "auth_oauth_refresh_tokens";

package/dist/server.js

@@ -6123,6 +6123,7 @@ var exchangeToken = async ({
 };
 var issueTokenSet = async ({
   acr,
+  audience,
   claims,
   clientCertThumbprint,
   clientId,
@@ -6137,11 +6138,13 @@ var issueTokenSet = async ({
   const idTtl = config.idTokenTtlMs ?? DEFAULT_ID_TOKEN_TTL_MS;
   const refreshTtl = config.refreshTokenTtlMs ?? DEFAULT_REFRESH_TOKEN_TTL_MS;
   const accessExtra = await config.getAccessTokenClaims?.({
+    audience,
     clientId,
     scopes,
     sub
   });
   const accessPayload = buildAccessClaims({
+    audience,
     clientCertThumbprint,
     clientId,
     dpopJkt,
@@ -6167,6 +6170,7 @@ var issueTokenSet = async ({
   const refreshToken = generateSecureToken(TOKEN_BYTES3);
   await config.refreshTokenStore.saveToken({
     acr,
+    audience,
     claims,
     clientId,
     createdAt: now,
@@ -7784,6 +7788,9 @@ var oidcProviderRoutes = (config) => {
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId || record.redirectUri !== redirectUri || !await verifyPkce(codeVerifier, record.codeChallenge)) {
       return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
+    if (body.resource !== undefined && body.resource !== record.audience) {
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_target");
+    }
     const dpopResult = dpop === undefined ? undefined : await verifyDpopProof({
       htm: "POST",
       htu: tokenUrl,
@@ -7794,6 +7801,7 @@ var oidcProviderRoutes = (config) => {
     }
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
+      audience: record.audience,
       claims: record.claims,
       clientCertThumbprint,
       clientId: client.clientId,
@@ -7813,6 +7821,9 @@ var oidcProviderRoutes = (config) => {
     if (record === undefined || record.expiresAt < Date.now() || record.clientId !== client.clientId) {
       return oauthError2(HTTP_BAD_REQUEST3, "invalid_grant");
     }
+    if (body.resource !== undefined && body.resource !== record.audience) {
+      return oauthError2(HTTP_BAD_REQUEST3, "invalid_target");
+    }
     if (record.dpopJkt !== undefined) {
       const proof = await verifyDpopProof({
         htm: "POST",
@@ -7825,6 +7836,7 @@ var oidcProviderRoutes = (config) => {
     }
     return tokenResponse(await issueTokenSet({
       acr: record.acr,
+      audience: record.audience,
       claims: record.claims,
       clientCertThumbprint,
       clientId: client.clientId,
@@ -8183,6 +8195,7 @@ var oidcProviderRoutes = (config) => {
     const code = generateSecureToken(TOKEN_BYTES4);
     await authorizationCodeStore.saveCode({
       acr: userAcr,
+      audience: effectiveQuery.resource,
       claims: getClaims?.(userSession.user),
       clientId: client.clientId,
       codeChallenge,
@@ -8218,6 +8231,7 @@ var oidcProviderRoutes = (config) => {
       redirect_uri: t15.Optional(t15.String()),
       request: t15.Optional(t15.String()),
       request_uri: t15.Optional(t15.String()),
+      resource: t15.Optional(t15.String()),
       response_mode: t15.Optional(t15.String()),
       response_type: t15.Optional(t15.String()),
       scope: t15.Optional(t15.String()),
@@ -27114,6 +27128,16 @@ var createInMemoryOidcRefreshTokenStore = () => {
           tokens.delete(hash);
       }
     },
+    deleteForUserClient: async (userId, clientId) => {
+      let deleted = 0;
+      for (const [hash, token] of tokens) {
+        if (token.userId !== userId || token.clientId !== clientId)
+          continue;
+        tokens.delete(hash);
+        deleted += 1;
+      }
+      return deleted;
+    },
     getToken: async (tokenHash) => tokens.get(tokenHash),
     listClientIdsForUser: async (userId) => {
       const now = Date.now();
@@ -27146,6 +27170,28 @@ var createInMemoryPushedAuthorizationRequestStore = () => {
 var URL_LENGTH = 2048;
 var DEFAULT_LIST_LIMIT2 = 100;
 var ID_LENGTH9 = 255;
+var BACKCHANNEL_AUTH_STATUSES = new Set([
+  "approved",
+  "denied",
+  "pending"
+]);
+var DEVICE_AUTHORIZATION_STATUSES = new Set([
+  "approved",
+  "denied",
+  "pending"
+]);
+var backchannelAuthStatus = (value) => {
+  for (const status of BACKCHANNEL_AUTH_STATUSES)
+    if (status === value)
+      return status;
+  throw new Error(`Invalid persisted backchannel authorization status: ${value}`);
+};
+var deviceAuthorizationStatus = (value) => {
+  for (const status of DEVICE_AUTHORIZATION_STATUSES)
+    if (status === value)
+      return status;
+  throw new Error(`Invalid persisted device authorization status: ${value}`);
+};
 var oauthBackchannelAuthRequestsTable = pgTable("auth_oauth_backchannel_auth_requests", {
   auth_req_id: varchar("auth_req_id", { length: ID_LENGTH9 }).primaryKey(),
   binding_message: text("binding_message"),
@@ -27190,6 +27236,7 @@ var oauthClientsTable = pgTable("auth_oauth_clients", {
 });
 var oauthCodesTable = pgTable("auth_oauth_codes", {
   acr: varchar("acr", { length: ID_LENGTH9 }),
+  audience: varchar("audience", { length: URL_LENGTH }),
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   code_challenge: varchar("code_challenge", { length: ID_LENGTH9 }).notNull(),
@@ -27242,6 +27289,7 @@ var oauthPushedAuthorizationRequestsTable = pgTable("auth_oauth_pushed_authoriza
 });
 var oauthRefreshTokensTable = pgTable("auth_oauth_refresh_tokens", {
   acr: varchar("acr", { length: ID_LENGTH9 }),
+  audience: varchar("audience", { length: URL_LENGTH }),
   claims_json: jsonb("claims_json").$type(),
   client_id: varchar("client_id", { length: ID_LENGTH9 }).notNull(),
   created_at_ms: bigint("created_at_ms", { mode: "number" }).notNull(),
@@ -27277,6 +27325,7 @@ var toLogoutDelivery = (row) => ({
 });
 var toCode = (row) => ({
   acr: row.acr ?? undefined,
+  audience: row.audience ?? undefined,
   claims: row.claims_json ?? undefined,
   clientId: row.client_id,
   codeChallenge: row.code_challenge,
@@ -27291,6 +27340,7 @@ var toCode = (row) => ({
 });
 var toCodeValues = (code) => ({
   acr: code.acr ?? null,
+  audience: code.audience ?? null,
   claims_json: code.claims ?? null,
   client_id: code.clientId,
   code_challenge: code.codeChallenge,
@@ -27310,12 +27360,13 @@ var toDeviceAuth = (row) => ({
   expiresAt: row.expires_at_ms,
   intervalSeconds: row.interval_seconds,
   scopes: row.scopes,
-  status: row.status,
+  status: deviceAuthorizationStatus(row.status),
   userCode: row.user_code,
   userSub: row.user_sub ?? undefined
 });
 var toRefresh = (row) => ({
   acr: row.acr ?? undefined,
+  audience: row.audience ?? undefined,
   claims: row.claims_json ?? undefined,
   clientId: row.client_id,
   createdAt: row.created_at_ms,
@@ -27327,6 +27378,7 @@ var toRefresh = (row) => ({
 });
 var toRefreshValues = (token) => ({
   acr: token.acr ?? null,
+  audience: token.audience ?? null,
   claims_json: token.claims ?? null,
   client_id: token.clientId,
   created_at_ms: token.createdAt,
@@ -27490,6 +27542,10 @@ var createPostgresOidcRefreshTokenStore = (db) => ({
   deleteForUser: async (userId) => {
     await db.delete(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.user_id, userId));
   },
+  deleteForUserClient: async (userId, clientId) => {
+    const deleted = await db.delete(oauthRefreshTokensTable).where(and(eq(oauthRefreshTokensTable.user_id, userId), eq(oauthRefreshTokensTable.client_id, clientId))).returning({ tokenHash: oauthRefreshTokensTable.token_hash });
+    return deleted.length;
+  },
   getToken: async (tokenHash) => {
     const [row] = await db.select().from(oauthRefreshTokensTable).where(eq(oauthRefreshTokensTable.token_hash, tokenHash)).limit(1);
     return row ? toRefresh(row) : undefined;
@@ -27538,7 +27594,7 @@ var toBackchannelAuth = (row) => ({
   intervalSeconds: row.interval_seconds,
   lastPolledAt: row.last_polled_at_ms ?? undefined,
   scopes: row.scopes,
-  status: row.status,
+  status: backchannelAuthStatus(row.status),
   userSub: row.user_sub ?? undefined
 });
 var createNeonBackchannelAuthStore = (databaseUrl) => createPostgresBackchannelAuthStore(createNeonDatabase(databaseUrl));
@@ -28836,6 +28892,14 @@ var mfaTotpLockoutMigration = {
   id: "0003_totp_lockout",
   sql: 'ALTER TABLE "auth_mfa_enrollments" ADD COLUMN IF NOT EXISTS "totp_failed_attempts" smallint NOT NULL DEFAULT 0;'
 };
+var oidcResourceAudienceMigration = {
+  id: "0002_resource_audience",
+  sql: [
+    'ALTER TABLE "auth_oauth_codes" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);',
+    'ALTER TABLE "auth_oauth_refresh_tokens" ADD COLUMN IF NOT EXISTS "audience" varchar(2048);'
+  ].join(`
+`)
+};
 var blockMigrations = {
   adaptive: initMigration("adaptive", [knownDevicesTable, loginHistoryTable]),
   agents: {
@@ -28877,18 +28941,24 @@ var blockMigrations = {
       mfaTotpLockoutMigration
     ]
   },
-  oidc: initMigration("oidc", [
-    oauthBackchannelAuthRequestsTable,
-    oauthClientAssertionJtisTable,
-    oauthClientRegistrationTokensTable,
-    oauthClientsTable,
-    oauthCodesTable,
-    oauthDeviceAuthorizationsTable,
-    oauthInitialAccessTokensTable,
-    oauthLogoutDeliveriesTable,
-    oauthPushedAuthorizationRequestsTable,
-    oauthRefreshTokensTable
-  ]),
+  oidc: {
+    block: "oidc",
+    migrations: [
+      ...initMigration("oidc", [
+        oauthBackchannelAuthRequestsTable,
+        oauthClientAssertionJtisTable,
+        oauthClientRegistrationTokensTable,
+        oauthClientsTable,
+        oauthCodesTable,
+        oauthDeviceAuthorizationsTable,
+        oauthInitialAccessTokensTable,
+        oauthLogoutDeliveriesTable,
+        oauthPushedAuthorizationRequestsTable,
+        oauthRefreshTokensTable
+      ]).migrations,
+      oidcResourceAudienceMigration
+    ]
+  },
   organizations: initMigration("organizations", [
     organizationsTable,
     organizationMembershipsTable,
@@ -29671,5 +29741,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=15A591E91DD3DB9A64756E2164756E21
+//# debugId=7B0A9F15E54EDF1A64756E2164756E21
 //# sourceMappingURL=server.js.map