@absolutejs/auth 0.56.12 → 0.56.13

package/dist/oidc/keys.d.ts

@@ -1,4 +1,4 @@
-type SigningKeyIdentity = {
+export type SigningKeyIdentity = {
     kid: string;
     publicJwk: JsonWebKey;
 };
@@ -12,10 +12,10 @@ export type SigningKey = SigningKeyIdentity & ({
     privateJwk?: never;
     sign: (input: Uint8Array) => Promise<Uint8Array>;
 });
-export declare const generateSigningKey: () => Promise<SigningKey>;
-export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
-export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
-export declare const toPublicJwk: (key: SigningKey) => {
+declare const generateSigningKey: () => Promise<SigningKey>;
+declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
+declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
+declare const toPublicJwk: (key: SigningKeyIdentity) => {
     alg: string;
     crv: string | undefined;
     kid: string;
@@ -24,7 +24,7 @@ export declare const toPublicJwk: (key: SigningKey) => {
     x: string | undefined;
     y: string | undefined;
 };
-export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
+declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
     header: {
         [k: string]: any;
     };
@@ -32,4 +32,19 @@ export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promis
         [k: string]: any;
     };
 } | undefined>;
-export {};
+/** Resolves the active signing identity followed by still-valid previous
+ * public identities. Duplicate key IDs fail closed because a JWT `kid` must
+ * identify exactly one verification key during an overlap window. */
+declare const signingVerificationKeys: (active: SigningKeyIdentity, previous?: readonly SigningKeyIdentity[]) => SigningKeyIdentity[];
+/** Verifies an Absolute Auth JWT against the exact public identity named by
+ * its protected `kid` header. This keeps already-issued tokens valid while a
+ * previous public key remains in the configured overlap window. */
+declare const verifyJwtWithKeys: (token: string, keys: readonly SigningKeyIdentity[]) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;
+export { generateSigningKey, jwkThumbprint, signingVerificationKeys, signJwt, toPublicJwk, verifyJwt, verifyJwtWithKeys };

package/dist/server.js

@@ -3289,6 +3289,26 @@ var verifyJwt = async (token, publicJwk) => {
     payload
   };
 };
+var signingVerificationKeys = (active, previous = []) => {
+  const keys = [active, ...previous];
+  const keyIds = new Set(keys.map(({ kid }) => kid));
+  if (keyIds.size !== keys.length)
+    throw new Error("OIDC signing key IDs must be unique");
+  return keys;
+};
+var verifyJwtWithKeys = async (token, keys) => {
+  const [headerSegment] = token.split(".");
+  if (!headerSegment)
+    return;
+  const header = decodeSegment(headerSegment);
+  const kid = header?.kid;
+  if (typeof kid !== "string" || kid.length === 0)
+    return;
+  const key = keys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    return;
+  return verifyJwt(token, key.publicJwk);
+};
 
 // src/agents/registration.ts
 var AGENT_CLAIM_GRANT_TYPE = "urn:workos:agent-auth:grant-type:claim";
@@ -6086,7 +6106,7 @@ var exchangeToken = async ({
   requestedScopes,
   subjectToken
 }) => {
-  const verified = await verifyJwt(subjectToken, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(subjectToken, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   const payload = verified?.payload;
   if (payload === undefined || typeof payload.sub !== "string" || typeof payload.exp !== "number" || payload.exp <= nowSeconds(now)) {
     return { error: "invalid_grant", ok: false };
@@ -6207,7 +6227,7 @@ var introspectToken = async ({
   token
 }) => {
   if (hint !== "refresh_token") {
-    const verified = await verifyJwt(token, config.signingKey.publicJwk);
+    const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
     const payload = verified?.payload;
     if (payload !== undefined && typeof payload.sub === "string" && typeof payload.exp === "number" && payload.exp > nowSeconds(now)) {
       return {
@@ -7123,7 +7143,7 @@ var verifyIdTokenHint = async ({
   config,
   idTokenHint
 }) => {
-  const verified = await verifyJwt(idTokenHint, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(idTokenHint, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   const payload = verified?.payload;
   if (payload === undefined || typeof payload.sub !== "string" || typeof payload.aud !== "string" || payload.iss !== config.issuer) {
     return;
@@ -7353,7 +7373,7 @@ var fetchUserInfo = async ({
       ok: false
     };
   }
-  const verified = await verifyJwt(token, config.signingKey.publicJwk);
+  const verified = await verifyJwtWithKeys(token, signingVerificationKeys(config.signingKey, config.previousSigningKeys));
   if (verified === undefined) {
     return {
       body: { error: "invalid_token" },
@@ -8694,7 +8714,9 @@ var oidcProviderRoutes = (config) => {
     headers: t15.Object({
       authorization: t15.Optional(t15.String())
     })
-  }).get(jwksRoute, () => ({ keys: [toPublicJwk(signingKey)] })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
+  }).get(jwksRoute, () => ({
+    keys: signingVerificationKeys(signingKey, config.previousSigningKeys).map(toPublicJwk)
+  })).get("/.well-known/openid-configuration", () => discovery).get("/.well-known/oauth-authorization-server", () => discovery);
 };
 
 // src/organizations/routes.ts
@@ -27033,6 +27055,7 @@ var createOidcAgentCredentialVerifier = ({
   isUsedDpopJti,
   maxDpopAgeMs,
   publicJwk,
+  publicKeys,
   requireDpop = false,
   resource
 }) => {
@@ -27044,13 +27067,14 @@ var createOidcAgentCredentialVerifier = ({
     const token = authorization.slice(authorization.indexOf(" ") + 1).trim();
     if (token.length === 0)
       return;
-    const verified = await verifyJwt(token, publicJwk);
+    const verified = publicKeys ? await verifyJwtWithKeys(token, publicKeys) : await verifyJwt(token, publicJwk);
     const payload = verified?.payload;
     if (payload === undefined || payload.iss !== issuer || typeof payload.exp !== "number" || payload.exp <= Math.floor(Date.now() / MS_PER_SECOND7) || !readAudience(payload.aud).includes(resource) || typeof payload.client_id !== "string") {
       return;
     }
     const confirmation = payload.cnf;
-    const boundJkt = typeof confirmation === "object" && confirmation !== null && typeof confirmation.jkt === "string" ? confirmation.jkt : undefined;
+    const boundJktValue = typeof confirmation === "object" && confirmation !== null ? Reflect.get(confirmation, "jkt") : undefined;
+    const boundJkt = typeof boundJktValue === "string" ? boundJktValue : undefined;
     if (boundJkt !== undefined || requireDpop) {
       if (!authorization.startsWith("DPoP "))
         return;
@@ -30587,5 +30611,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=DC157A619FC3907564756E2164756E21
+//# debugId=B037EE5900B85A3664756E2164756E21
 //# sourceMappingURL=server.js.map