@absolutejs/auth 0.56.12 → 0.56.13

package/dist/agents/oidcAdapter.d.ts

@@ -1,12 +1,20 @@
+import { type SigningKeyIdentity } from '../oidc/keys';
 import type { AgentCredentialVerifier } from './types';
+type OidcAgentCredentialVerifierKeys = {
+    publicJwk: JsonWebKey;
+    publicKeys?: never;
+} | {
+    publicJwk?: never;
+    publicKeys: readonly SigningKeyIdentity[];
+};
 /** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
  * signature, issuer, audience, expiry, and extracts the OAuth client as the
  * agent identity while retaining `sub` as the authorizing user. */
-export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, requireDpop, resource }: {
+export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
     issuer: string;
     isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
     maxDpopAgeMs?: number;
-    publicJwk: JsonWebKey;
     requireDpop?: boolean;
     resource: string;
-}) => AgentCredentialVerifier;
+} & OidcAgentCredentialVerifierKeys) => AgentCredentialVerifier;
+export {};

package/dist/index.d.ts

@@ -3579,8 +3579,8 @@ export * from './oidc/config';
 export * from './oidc/clientIdMetadata';
 export * from './oidc/types';
 export { oidcProviderRoutes } from './oidc/routes';
-export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt } from './oidc/keys';
-export type { SigningKey } from './oidc/keys';
+export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys } from './oidc/keys';
+export type { SigningKey, SigningKeyIdentity } from './oidc/keys';
 export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof } from './oidc/dpop';
 export type { DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';

package/dist/index.js

@@ -3289,6 +3289,26 @@ var verifyJwt = async (token, publicJwk) => {
     payload
   };
 };
+var signingVerificationKeys = (active, previous = []) => {
+  const keys = [active, ...previous];
+  const keyIds = new Set(keys.map(({ kid }) => kid));
+  if (keyIds.size !== keys.length)
+    throw new Error("OIDC signing key IDs must be unique");
+  return keys;
+};
+var verifyJwtWithKeys = async (token, keys) => {
+  const [headerSegment] = token.split(".");
+  if (!headerSegment)
+    return;
+  const header = decodeSegment(headerSegment);
+  const kid = header?.kid;
+  if (typeof kid !== "string" || kid.length === 0)
+    return;
+  const key = keys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    return;
+  return verifyJwt(token, key.publicJwk);
+};
 
 // src/agents/registration.ts
 var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
@@ -6086,7 +6106,7 @@ var exchangeToken = async ({
   requestedScopes,
   subjectToken
 }) => {
-  const verified = await verifyJwt(subjectToken, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(subjectToken, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   const payload = verified?.payload;
   if (payload === undefined || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= nowSeconds(now)) {
     return { error: "invalid_grant", ok: false };
@@ -6207,7 +6227,7 @@ var introspectToken = async ({
   token
 }) => {
   if (hint !== "refresh_token") {
-    const verified = await verifyJwt(token, config.signingKey.publicJwk);
+    const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
     const payload = verified?.payload;
     if (payload !== undefined && typeof payload.sub === "string" && typeof payload.exp === "number" && payload.exp > nowSeconds(now)) {
       return {
@@ -7123,7 +7143,7 @@ var verifyIdTokenHint = async ({
   config,
   idTokenHint
 }) => {
-  const verified = await verifyJwt(idTokenHint, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(idTokenHint, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   const payload = verified?.payload;
   if (payload === undefined || typeof payload.sub !== "string" || typeof payload.aud !== "string" || payload.iss !== config.issuer) {
     return;
@@ -7353,7 +7373,7 @@ var fetchUserInfo = async ({
       ok: false
     };
   }
-  const verified = await verifyJwt(token, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   if (verified === undefined) {
     return {
       body: { error: "invalid_token" },
@@ -8694,7 +8714,9 @@ var oidcProviderRoutes = (config) => {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
+  }).get(jwksRoute, () => ({
+    keys: signingVerificationKeys(signingKey, config.previousSigningKeys).map(toPublicJwk)
+  })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
 };
 
 // src/organizations/routes.ts
@@ -27033,6 +27055,7 @@ var createOidcAgentCredentialVerifier = ({
   isUsedDpopJti,
   maxDpopAgeMs,
   publicJwk,
+  publicKeys,
   requireDpop = false,
   resource
 }) => {
@@ -27044,13 +27067,14 @@ var createOidcAgentCredentialVerifier = ({
     const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
     if (token.length === 0)
       return;
-    const verified = await verifyJwt(token, publicJwk);
+    const verified = publicKeys ? await verifyJwtWithKeys(token, publicKeys) : await verifyJwt(token, publicJwk);
     const payload = verified?.payload;
     if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND7) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
       return;
     }
     const confirmation = payload.cnf;
-    const boundJkt = typeof confirmation === "object" && confirmation !== null && typeof confirmation.jkt === "string" ? confirmation.jkt : undefined;
+    const boundJktValue = typeof confirmation === "object" && confirmation !== null ? Reflect.get(confirmation, "jkt") : undefined;
+    const boundJkt = typeof boundJktValue === "string" ? boundJktValue : undefined;
     if (boundJkt !== undefined || requireDpop) {
       if (!authorization.startsWith("DPoP "))
         return;
@@ -30590,6 +30614,7 @@ export {
   verifyPresentationResponse,
   verifyPkce,
   verifyPassword,
+  verifyJwtWithKeys,
   verifyJwtSignedByClient,
   verifyJwt,
   verifyIdTokenHint,
@@ -30624,6 +30649,7 @@ export {
   startAgentRegistration,
   ssoDiscoveryRoute,
   ssoConnectionsTable,
+  signingVerificationKeys,
   signWebhook,
   signStatusList,
   signJwt,
@@ -31057,5 +31083,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=CEE9F9BEA5B2A4F264756E2164756E21
+//# debugId=EF4CB146B3B9999C64756E2164756E21
 //# sourceMappingURL=index.js.map