@absolutejs/auth 0.56.11 → 0.56.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -0
- package/dist/agents/index.js +25 -3
- package/dist/agents/index.js.map +4 -4
- package/dist/agents/oidcAdapter.d.ts +11 -3
- package/dist/authContext.d.ts +3 -3
- package/dist/htmx/configuredRoutes.d.ts +10 -10
- package/dist/htmx/routes.d.ts +10 -10
- package/dist/index.d.ts +18 -18
- package/dist/index.js +34 -8
- package/dist/index.js.map +10 -10
- package/dist/oidc/config.d.ts +5 -1
- package/dist/oidc/index.d.ts +1 -1
- package/dist/oidc/index.js +23 -1
- package/dist/oidc/index.js.map +3 -3
- package/dist/oidc/keys.d.ts +22 -7
- package/dist/routes/protectRoute.d.ts +2 -2
- package/dist/server.js +32 -8
- package/dist/server.js.map +10 -10
- package/package.json +1 -1
|
@@ -1,12 +1,20 @@
|
|
|
1
|
+
import { type SigningKeyIdentity } from '../oidc/keys';
|
|
1
2
|
import type { AgentCredentialVerifier } from './types';
|
|
3
|
+
type OidcAgentCredentialVerifierKeys = {
|
|
4
|
+
publicJwk: JsonWebKey;
|
|
5
|
+
publicKeys?: never;
|
|
6
|
+
} | {
|
|
7
|
+
publicJwk?: never;
|
|
8
|
+
publicKeys: readonly SigningKeyIdentity[];
|
|
9
|
+
};
|
|
2
10
|
/** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
|
|
3
11
|
* signature, issuer, audience, expiry, and extracts the OAuth client as the
|
|
4
12
|
* agent identity while retaining `sub` as the authorizing user. */
|
|
5
|
-
export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, requireDpop, resource }: {
|
|
13
|
+
export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
|
|
6
14
|
issuer: string;
|
|
7
15
|
isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
|
|
8
16
|
maxDpopAgeMs?: number;
|
|
9
|
-
publicJwk: JsonWebKey;
|
|
10
17
|
requireDpop?: boolean;
|
|
11
18
|
resource: string;
|
|
12
|
-
}) => AgentCredentialVerifier;
|
|
19
|
+
} & OidcAgentCredentialVerifierKeys) => AgentCredentialVerifier;
|
|
20
|
+
export {};
|
package/dist/authContext.d.ts
CHANGED
|
@@ -16,7 +16,7 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
|
|
|
16
16
|
unregisteredSession: import("./types").UnregisteredSessionRecord;
|
|
17
17
|
};
|
|
18
18
|
derive: ({
|
|
19
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
19
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
20
20
|
readonly code: "Bad Request";
|
|
21
21
|
readonly message: "Cookies are missing";
|
|
22
22
|
} | {
|
|
@@ -34,7 +34,7 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
|
|
|
34
34
|
message: "Agent is not authenticated" | "Insufficient agent scopes";
|
|
35
35
|
}) => AuthFailReturn_2 | Promise<AuthFailReturn_2>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn_2>>>;
|
|
36
36
|
}) | ({
|
|
37
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
37
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
38
38
|
readonly code: "Bad Request";
|
|
39
39
|
readonly message: "Cookies are missing";
|
|
40
40
|
} | {
|
|
@@ -88,7 +88,7 @@ export declare const createAuthContext: <UserType>({ agentAuth, authSessionStore
|
|
|
88
88
|
macroFn: {};
|
|
89
89
|
parser: {};
|
|
90
90
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
91
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
91
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
92
92
|
readonly code: "Bad Request";
|
|
93
93
|
readonly message: "Cookies are missing";
|
|
94
94
|
} | {
|
|
@@ -38,7 +38,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
38
38
|
unregisteredSession: import("..").UnregisteredSessionRecord;
|
|
39
39
|
};
|
|
40
40
|
derive: {
|
|
41
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
41
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
42
42
|
readonly code: "Bad Request";
|
|
43
43
|
readonly message: "Cookies are missing";
|
|
44
44
|
} | {
|
|
@@ -68,7 +68,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
68
68
|
macroFn: {};
|
|
69
69
|
parser: {};
|
|
70
70
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
71
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
71
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
72
72
|
readonly code: "Bad Request";
|
|
73
73
|
readonly message: "Cookies are missing";
|
|
74
74
|
} | {
|
|
@@ -231,7 +231,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
231
231
|
response: {
|
|
232
232
|
400: "Cookies are missing";
|
|
233
233
|
401: "User is not authenticated";
|
|
234
|
-
200:
|
|
234
|
+
200: Response;
|
|
235
235
|
422: {
|
|
236
236
|
type: "validation";
|
|
237
237
|
on: string;
|
|
@@ -260,7 +260,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
260
260
|
response: {
|
|
261
261
|
400: "Cookies are missing";
|
|
262
262
|
401: "User is not authenticated";
|
|
263
|
-
200:
|
|
263
|
+
200: Response;
|
|
264
264
|
422: {
|
|
265
265
|
type: "validation";
|
|
266
266
|
on: string;
|
|
@@ -290,7 +290,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
290
290
|
response: {
|
|
291
291
|
400: "Cookies are missing";
|
|
292
292
|
401: "User is not authenticated";
|
|
293
|
-
200:
|
|
293
|
+
200: Response;
|
|
294
294
|
422: {
|
|
295
295
|
type: "validation";
|
|
296
296
|
on: string;
|
|
@@ -319,7 +319,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
319
319
|
response: {
|
|
320
320
|
400: "Cookies are missing";
|
|
321
321
|
401: "User is not authenticated";
|
|
322
|
-
200:
|
|
322
|
+
200: Response;
|
|
323
323
|
422: {
|
|
324
324
|
type: "validation";
|
|
325
325
|
on: string;
|
|
@@ -348,7 +348,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
348
348
|
response: {
|
|
349
349
|
400: "Cookies are missing";
|
|
350
350
|
401: "User is not authenticated";
|
|
351
|
-
200:
|
|
351
|
+
200: Response;
|
|
352
352
|
422: {
|
|
353
353
|
type: "validation";
|
|
354
354
|
on: string;
|
|
@@ -403,7 +403,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
403
403
|
response: {
|
|
404
404
|
400: "Cookies are missing";
|
|
405
405
|
401: "User is not authenticated";
|
|
406
|
-
200:
|
|
406
|
+
200: Response;
|
|
407
407
|
422: {
|
|
408
408
|
type: "validation";
|
|
409
409
|
on: string;
|
|
@@ -434,7 +434,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
434
434
|
response: {
|
|
435
435
|
400: "Cookies are missing";
|
|
436
436
|
401: "User is not authenticated";
|
|
437
|
-
200:
|
|
437
|
+
200: Response;
|
|
438
438
|
422: {
|
|
439
439
|
type: "validation";
|
|
440
440
|
on: string;
|
|
@@ -484,7 +484,7 @@ export declare const createConfiguredAuthHtmxRoutes: <UserType>({ authSessionSto
|
|
|
484
484
|
response: {
|
|
485
485
|
400: "Cookies are missing";
|
|
486
486
|
401: "User is not authenticated";
|
|
487
|
-
200:
|
|
487
|
+
200: Response;
|
|
488
488
|
422: {
|
|
489
489
|
type: "validation";
|
|
490
490
|
on: string;
|
package/dist/htmx/routes.d.ts
CHANGED
|
@@ -10,7 +10,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
10
10
|
unregisteredSession: import("..").UnregisteredSessionRecord;
|
|
11
11
|
};
|
|
12
12
|
derive: {
|
|
13
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
13
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
14
14
|
readonly code: "Bad Request";
|
|
15
15
|
readonly message: "Cookies are missing";
|
|
16
16
|
} | {
|
|
@@ -40,7 +40,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
40
40
|
macroFn: {};
|
|
41
41
|
parser: {};
|
|
42
42
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
43
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
43
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
44
44
|
readonly code: "Bad Request";
|
|
45
45
|
readonly message: "Cookies are missing";
|
|
46
46
|
} | {
|
|
@@ -203,7 +203,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
203
203
|
response: {
|
|
204
204
|
400: "Cookies are missing";
|
|
205
205
|
401: "User is not authenticated";
|
|
206
|
-
200:
|
|
206
|
+
200: Response;
|
|
207
207
|
422: {
|
|
208
208
|
type: "validation";
|
|
209
209
|
on: string;
|
|
@@ -232,7 +232,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
232
232
|
response: {
|
|
233
233
|
400: "Cookies are missing";
|
|
234
234
|
401: "User is not authenticated";
|
|
235
|
-
200:
|
|
235
|
+
200: Response;
|
|
236
236
|
422: {
|
|
237
237
|
type: "validation";
|
|
238
238
|
on: string;
|
|
@@ -262,7 +262,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
262
262
|
response: {
|
|
263
263
|
400: "Cookies are missing";
|
|
264
264
|
401: "User is not authenticated";
|
|
265
|
-
200:
|
|
265
|
+
200: Response;
|
|
266
266
|
422: {
|
|
267
267
|
type: "validation";
|
|
268
268
|
on: string;
|
|
@@ -291,7 +291,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
291
291
|
response: {
|
|
292
292
|
400: "Cookies are missing";
|
|
293
293
|
401: "User is not authenticated";
|
|
294
|
-
200:
|
|
294
|
+
200: Response;
|
|
295
295
|
422: {
|
|
296
296
|
type: "validation";
|
|
297
297
|
on: string;
|
|
@@ -320,7 +320,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
320
320
|
response: {
|
|
321
321
|
400: "Cookies are missing";
|
|
322
322
|
401: "User is not authenticated";
|
|
323
|
-
200:
|
|
323
|
+
200: Response;
|
|
324
324
|
422: {
|
|
325
325
|
type: "validation";
|
|
326
326
|
on: string;
|
|
@@ -375,7 +375,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
375
375
|
response: {
|
|
376
376
|
400: "Cookies are missing";
|
|
377
377
|
401: "User is not authenticated";
|
|
378
|
-
200:
|
|
378
|
+
200: Response;
|
|
379
379
|
422: {
|
|
380
380
|
type: "validation";
|
|
381
381
|
on: string;
|
|
@@ -406,7 +406,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
406
406
|
response: {
|
|
407
407
|
400: "Cookies are missing";
|
|
408
408
|
401: "User is not authenticated";
|
|
409
|
-
200:
|
|
409
|
+
200: Response;
|
|
410
410
|
422: {
|
|
411
411
|
type: "validation";
|
|
412
412
|
on: string;
|
|
@@ -456,7 +456,7 @@ export declare const createAuthHtmxRoutes: <UserType extends AuthHtmxUser>(confi
|
|
|
456
456
|
response: {
|
|
457
457
|
400: "Cookies are missing";
|
|
458
458
|
401: "User is not authenticated";
|
|
459
|
-
200:
|
|
459
|
+
200: Response;
|
|
460
460
|
422: {
|
|
461
461
|
type: "validation";
|
|
462
462
|
on: string;
|
package/dist/index.d.ts
CHANGED
|
@@ -7,7 +7,7 @@ export declare const auth: <UserType>(configuration: AuthConfig<UserType>) => Pr
|
|
|
7
7
|
unregisteredSession: import("./types").UnregisteredSessionRecord;
|
|
8
8
|
};
|
|
9
9
|
derive: ({
|
|
10
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
10
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
11
11
|
readonly code: "Bad Request";
|
|
12
12
|
readonly message: "Cookies are missing";
|
|
13
13
|
} | {
|
|
@@ -25,7 +25,7 @@ export declare const auth: <UserType>(configuration: AuthConfig<UserType>) => Pr
|
|
|
25
25
|
message: "Agent is not authenticated" | "Insufficient agent scopes";
|
|
26
26
|
}) => AuthFailReturn_2 | Promise<AuthFailReturn_2>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn_2>>>;
|
|
27
27
|
}) | ({
|
|
28
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
28
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
29
29
|
readonly code: "Bad Request";
|
|
30
30
|
readonly message: "Cookies are missing";
|
|
31
31
|
} | {
|
|
@@ -86,7 +86,7 @@ export declare const auth: <UserType>(configuration: AuthConfig<UserType>) => Pr
|
|
|
86
86
|
macroFn: {};
|
|
87
87
|
parser: {};
|
|
88
88
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
89
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
89
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
90
90
|
readonly code: "Bad Request";
|
|
91
91
|
readonly message: "Cookies are missing";
|
|
92
92
|
} | {
|
|
@@ -178,7 +178,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
178
178
|
unregisteredSession: import("./types").UnregisteredSessionRecord;
|
|
179
179
|
};
|
|
180
180
|
derive: ({
|
|
181
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
181
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
182
182
|
readonly code: "Bad Request";
|
|
183
183
|
readonly message: "Cookies are missing";
|
|
184
184
|
} | {
|
|
@@ -196,7 +196,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
196
196
|
message: "Agent is not authenticated" | "Insufficient agent scopes";
|
|
197
197
|
}) => AuthFailReturn_2 | Promise<AuthFailReturn_2>) => Promise<Response | AuthReturn | NonNullable<Awaited<AuthFailReturn_2>>>;
|
|
198
198
|
}) | ({
|
|
199
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
199
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
200
200
|
readonly code: "Bad Request";
|
|
201
201
|
readonly message: "Cookies are missing";
|
|
202
202
|
} | {
|
|
@@ -250,7 +250,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
250
250
|
macroFn: {};
|
|
251
251
|
parser: {};
|
|
252
252
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
253
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
253
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: UserType) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
254
254
|
readonly code: "Bad Request";
|
|
255
255
|
readonly message: "Cookies are missing";
|
|
256
256
|
} | {
|
|
@@ -665,7 +665,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
665
665
|
unregisteredSession: import("./types").UnregisteredSessionRecord;
|
|
666
666
|
};
|
|
667
667
|
derive: {} | {
|
|
668
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: import(".").AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
668
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: import(".").AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
669
669
|
readonly code: "Bad Request";
|
|
670
670
|
readonly message: "Cookies are missing";
|
|
671
671
|
} | {
|
|
@@ -719,7 +719,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
719
719
|
macroFn: {};
|
|
720
720
|
parser: {};
|
|
721
721
|
response: import("elysia").ExtractErrorFromHandle<{
|
|
722
|
-
readonly protectRoute: <AuthReturn, AuthFailReturn>(handleAuth: (user: import(".").AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
722
|
+
readonly protectRoute: <AuthReturn, AuthFailReturn = never>(handleAuth: (user: import(".").AuthHtmxUser) => AuthReturn | Promise<AuthReturn>, handleAuthFail?: ((error: {
|
|
723
723
|
readonly code: "Bad Request";
|
|
724
724
|
readonly message: "Cookies are missing";
|
|
725
725
|
} | {
|
|
@@ -3027,7 +3027,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3027
3027
|
response: {
|
|
3028
3028
|
400: "Cookies are missing";
|
|
3029
3029
|
401: "User is not authenticated";
|
|
3030
|
-
200:
|
|
3030
|
+
200: Response;
|
|
3031
3031
|
422: {
|
|
3032
3032
|
type: "validation";
|
|
3033
3033
|
on: string;
|
|
@@ -3056,7 +3056,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3056
3056
|
response: {
|
|
3057
3057
|
400: "Cookies are missing";
|
|
3058
3058
|
401: "User is not authenticated";
|
|
3059
|
-
200:
|
|
3059
|
+
200: Response;
|
|
3060
3060
|
422: {
|
|
3061
3061
|
type: "validation";
|
|
3062
3062
|
on: string;
|
|
@@ -3086,7 +3086,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3086
3086
|
response: {
|
|
3087
3087
|
400: "Cookies are missing";
|
|
3088
3088
|
401: "User is not authenticated";
|
|
3089
|
-
200:
|
|
3089
|
+
200: Response;
|
|
3090
3090
|
422: {
|
|
3091
3091
|
type: "validation";
|
|
3092
3092
|
on: string;
|
|
@@ -3115,7 +3115,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3115
3115
|
response: {
|
|
3116
3116
|
400: "Cookies are missing";
|
|
3117
3117
|
401: "User is not authenticated";
|
|
3118
|
-
200:
|
|
3118
|
+
200: Response;
|
|
3119
3119
|
422: {
|
|
3120
3120
|
type: "validation";
|
|
3121
3121
|
on: string;
|
|
@@ -3144,7 +3144,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3144
3144
|
response: {
|
|
3145
3145
|
400: "Cookies are missing";
|
|
3146
3146
|
401: "User is not authenticated";
|
|
3147
|
-
200:
|
|
3147
|
+
200: Response;
|
|
3148
3148
|
422: {
|
|
3149
3149
|
type: "validation";
|
|
3150
3150
|
on: string;
|
|
@@ -3199,7 +3199,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3199
3199
|
response: {
|
|
3200
3200
|
400: "Cookies are missing";
|
|
3201
3201
|
401: "User is not authenticated";
|
|
3202
|
-
200:
|
|
3202
|
+
200: Response;
|
|
3203
3203
|
422: {
|
|
3204
3204
|
type: "validation";
|
|
3205
3205
|
on: string;
|
|
@@ -3230,7 +3230,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3230
3230
|
response: {
|
|
3231
3231
|
400: "Cookies are missing";
|
|
3232
3232
|
401: "User is not authenticated";
|
|
3233
|
-
200:
|
|
3233
|
+
200: Response;
|
|
3234
3234
|
422: {
|
|
3235
3235
|
type: "validation";
|
|
3236
3236
|
on: string;
|
|
@@ -3280,7 +3280,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
|
|
|
3280
3280
|
response: {
|
|
3281
3281
|
400: "Cookies are missing";
|
|
3282
3282
|
401: "User is not authenticated";
|
|
3283
|
-
200:
|
|
3283
|
+
200: Response;
|
|
3284
3284
|
422: {
|
|
3285
3285
|
type: "validation";
|
|
3286
3286
|
on: string;
|
|
@@ -3579,8 +3579,8 @@ export * from './oidc/config';
|
|
|
3579
3579
|
export * from './oidc/clientIdMetadata';
|
|
3580
3580
|
export * from './oidc/types';
|
|
3581
3581
|
export { oidcProviderRoutes } from './oidc/routes';
|
|
3582
|
-
export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } from './oidc/keys';
|
|
3583
|
-
export type { SigningKey } from './oidc/keys';
|
|
3582
|
+
export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys } from './oidc/keys';
|
|
3583
|
+
export type { SigningKey, SigningKeyIdentity } from './oidc/keys';
|
|
3584
3584
|
export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof } from './oidc/dpop';
|
|
3585
3585
|
export type { DpopResult } from './oidc/dpop';
|
|
3586
3586
|
export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
|
package/dist/index.js
CHANGED
|
@@ -3289,6 +3289,26 @@ var verifyJwt = async (token, publicJwk) => {
|
|
|
3289
3289
|
payload
|
|
3290
3290
|
};
|
|
3291
3291
|
};
|
|
3292
|
+
var signingVerificationKeys = (active, previous = []) => {
|
|
3293
|
+
const keys = [active, ...previous];
|
|
3294
|
+
const keyIds = new Set(keys.map(({ kid }) => kid));
|
|
3295
|
+
if (keyIds.size !== keys.length)
|
|
3296
|
+
throw new Error("OIDC signing key IDs must be unique");
|
|
3297
|
+
return keys;
|
|
3298
|
+
};
|
|
3299
|
+
var verifyJwtWithKeys = async (token, keys) => {
|
|
3300
|
+
const [headerSegment] = token.split(".");
|
|
3301
|
+
if (!headerSegment)
|
|
3302
|
+
return;
|
|
3303
|
+
const header = decodeSegment(headerSegment);
|
|
3304
|
+
const kid = header?.kid;
|
|
3305
|
+
if (typeof kid !== "string" || kid.length === 0)
|
|
3306
|
+
return;
|
|
3307
|
+
const key = keys.find((candidate) => candidate.kid === kid);
|
|
3308
|
+
if (!key)
|
|
3309
|
+
return;
|
|
3310
|
+
return verifyJwt(token, key.publicJwk);
|
|
3311
|
+
};
|
|
3292
3312
|
|
|
3293
3313
|
// src/agents/registration.ts
|
|
3294
3314
|
var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
|
|
@@ -6086,7 +6106,7 @@ var exchangeToken = async ({
|
|
|
6086
6106
|
requestedScopes,
|
|
6087
6107
|
subjectToken
|
|
6088
6108
|
}) => {
|
|
6089
|
-
const verified = await
|
|
6109
|
+
const verified = await verifyJwtWithKeys(subjectToken, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
|
|
6090
6110
|
const payload = verified?.payload;
|
|
6091
6111
|
if (payload === undefined || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= nowSeconds(now)) {
|
|
6092
6112
|
return { error: "invalid_grant", ok: false };
|
|
@@ -6207,7 +6227,7 @@ var introspectToken = async ({
|
|
|
6207
6227
|
token
|
|
6208
6228
|
}) => {
|
|
6209
6229
|
if (hint !== "refresh_token") {
|
|
6210
|
-
const verified = await
|
|
6230
|
+
const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
|
|
6211
6231
|
const payload = verified?.payload;
|
|
6212
6232
|
if (payload !== undefined && typeof payload.sub === "string" && typeof payload.exp === "number" && payload.exp > nowSeconds(now)) {
|
|
6213
6233
|
return {
|
|
@@ -7123,7 +7143,7 @@ var verifyIdTokenHint = async ({
|
|
|
7123
7143
|
config,
|
|
7124
7144
|
idTokenHint
|
|
7125
7145
|
}) => {
|
|
7126
|
-
const verified = await
|
|
7146
|
+
const verified = await verifyJwtWithKeys(idTokenHint, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
|
|
7127
7147
|
const payload = verified?.payload;
|
|
7128
7148
|
if (payload === undefined || typeof payload.sub !== "string" || typeof payload.aud !== "string" || payload.iss !== config.issuer) {
|
|
7129
7149
|
return;
|
|
@@ -7353,7 +7373,7 @@ var fetchUserInfo = async ({
|
|
|
7353
7373
|
ok: false
|
|
7354
7374
|
};
|
|
7355
7375
|
}
|
|
7356
|
-
const verified = await
|
|
7376
|
+
const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
|
|
7357
7377
|
if (verified === undefined) {
|
|
7358
7378
|
return {
|
|
7359
7379
|
body: { error: "invalid_token" },
|
|
@@ -8694,7 +8714,9 @@ var oidcProviderRoutes = (config) => {
|
|
|
8694
8714
|
headers: t15.Object({
|
|
8695
8715
|
authorization: t15.Optional(t15.String())
|
|
8696
8716
|
})
|
|
8697
|
-
}).get(jwksRoute, () => ({
|
|
8717
|
+
}).get(jwksRoute, () => ({
|
|
8718
|
+
keys: signingVerificationKeys(signingKey, config.previousSigningKeys).map(toPublicJwk)
|
|
8719
|
+
})).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
|
|
8698
8720
|
};
|
|
8699
8721
|
|
|
8700
8722
|
// src/organizations/routes.ts
|
|
@@ -27033,6 +27055,7 @@ var createOidcAgentCredentialVerifier = ({
|
|
|
27033
27055
|
isUsedDpopJti,
|
|
27034
27056
|
maxDpopAgeMs,
|
|
27035
27057
|
publicJwk,
|
|
27058
|
+
publicKeys,
|
|
27036
27059
|
requireDpop = false,
|
|
27037
27060
|
resource
|
|
27038
27061
|
}) => {
|
|
@@ -27044,13 +27067,14 @@ var createOidcAgentCredentialVerifier = ({
|
|
|
27044
27067
|
const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
|
|
27045
27068
|
if (token.length === 0)
|
|
27046
27069
|
return;
|
|
27047
|
-
const verified = await verifyJwt(token, publicJwk);
|
|
27070
|
+
const verified = publicKeys ? await verifyJwtWithKeys(token, publicKeys) : await verifyJwt(token, publicJwk);
|
|
27048
27071
|
const payload = verified?.payload;
|
|
27049
27072
|
if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND7) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
|
|
27050
27073
|
return;
|
|
27051
27074
|
}
|
|
27052
27075
|
const confirmation = payload.cnf;
|
|
27053
|
-
const
|
|
27076
|
+
const boundJktValue = typeof confirmation === "object" && confirmation !== null ? Reflect.get(confirmation, "jkt") : undefined;
|
|
27077
|
+
const boundJkt = typeof boundJktValue === "string" ? boundJktValue : undefined;
|
|
27054
27078
|
if (boundJkt !== undefined || requireDpop) {
|
|
27055
27079
|
if (!authorization.startsWith("DPoP "))
|
|
27056
27080
|
return;
|
|
@@ -30590,6 +30614,7 @@ export {
|
|
|
30590
30614
|
verifyPresentationResponse,
|
|
30591
30615
|
verifyPkce,
|
|
30592
30616
|
verifyPassword,
|
|
30617
|
+
verifyJwtWithKeys,
|
|
30593
30618
|
verifyJwtSignedByClient,
|
|
30594
30619
|
verifyJwt,
|
|
30595
30620
|
verifyIdTokenHint,
|
|
@@ -30624,6 +30649,7 @@ export {
|
|
|
30624
30649
|
startAgentRegistration,
|
|
30625
30650
|
ssoDiscoveryRoute,
|
|
30626
30651
|
ssoConnectionsTable,
|
|
30652
|
+
signingVerificationKeys,
|
|
30627
30653
|
signWebhook,
|
|
30628
30654
|
signStatusList,
|
|
30629
30655
|
signJwt,
|
|
@@ -31057,5 +31083,5 @@ export {
|
|
|
31057
31083
|
AGENT_CLAIM_GRANT_TYPE
|
|
31058
31084
|
};
|
|
31059
31085
|
|
|
31060
|
-
//# debugId=
|
|
31086
|
+
//# debugId=EF4CB146B3B9999C64756E2164756E21
|
|
31061
31087
|
//# sourceMappingURL=index.js.map
|