@absolutejs/auth 0.56.12 → 0.56.13

package/README.md

@@ -167,6 +167,14 @@ can therefore keep private key material non-exportable in a KMS or HSM. The
 adapter must return the 64-byte JOSE ES256 signature (`r || s`); DER conversion
 belongs at the KMS boundary.
 
+OIDC providers can retain bounded `previousSigningKeys` containing public
+identity only. The JWKS endpoint publishes the active key first and the
+previous keys behind it, while every new token remains signed exclusively by
+the active key. Provider token exchange, introspection, userinfo, logout hints,
+and agent credential verification select the exact verification key named by
+the JWT `kid`. Remove each previous key only after the longest issued token
+using it has expired; duplicate key IDs fail closed.
+
 ### Features
 
 - **Authorization**: Handles the authorization process by generating the authorization URL and redirecting the user to the authentication provider.

package/dist/agents/index.js

@@ -274,6 +274,26 @@ var verifyJwt = async (token, publicJwk) => {
     payload
   };
 };
+var signingVerificationKeys = (active, previous = []) => {
+  const keys = [active, ...previous];
+  const keyIds = new Set(keys.map(({ kid }) => kid));
+  if (keyIds.size !== keys.length)
+    throw new Error("OIDC signing key IDs must be unique");
+  return keys;
+};
+var verifyJwtWithKeys = async (token, keys) => {
+  const [headerSegment] = token.split(".");
+  if (!headerSegment)
+    return;
+  const header = decodeSegment(headerSegment);
+  const kid = header?.kid;
+  if (typeof kid !== "string" || kid.length === 0)
+    return;
+  const key = keys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    return;
+  return verifyJwt(token, key.publicJwk);
+};
 
 // src/agents/registration.ts
 var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
@@ -1336,6 +1356,7 @@ var createOidcAgentCredentialVerifier = ({
   isUsedDpopJti,
   maxDpopAgeMs,
   publicJwk,
+  publicKeys,
   requireDpop = false,
   resource
 }) => {
@@ -1347,13 +1368,14 @@ var createOidcAgentCredentialVerifier = ({
     const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
     if (token.length === 0)
       return;
-    const verified = await verifyJwt(token, publicJwk);
+    const verified = publicKeys ? await verifyJwtWithKeys(token, publicKeys) : await verifyJwt(token, publicJwk);
     const payload = verified?.payload;
     if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
       return;
     }
     const confirmation = payload.cnf;
-    const boundJkt = typeof confirmation === "object" && confirmation !== null && typeof confirmation.jkt === "string" ? confirmation.jkt : undefined;
+    const boundJktValue = typeof confirmation === "object" && confirmation !== null ? Reflect.get(confirmation, "jkt") : undefined;
+    const boundJkt = typeof boundJktValue === "string" ? boundJktValue : undefined;
     if (boundJkt !== undefined || requireDpop) {
       if (!authorization.startsWith("DPoP "))
         return;
@@ -13598,5 +13620,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=5036CB994778D6CC64756E2164756E21
+//# debugId=3257C9C351E3F2FA64756E2164756E21
 //# sourceMappingURL=index.js.map