@absolutejs/auth 0.56.12 → 0.56.14

package/dist/oidc/config.d.ts

@@ -1,5 +1,5 @@
 import type { RouteString } from '../types';
-import { type SigningKey } from './keys';
+import { type SigningKey, type SigningKeyIdentity } from './keys';
 import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
 import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
@@ -107,6 +107,10 @@ export type OidcProviderConfig<UserType> = {
     pushedAuthorizationRequestTtlMs?: number;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
+    /** Previous public signing identities retained only for the bounded token
+     * overlap window after rotation. The active `signingKey` always signs new
+     * tokens and is published first. Private material does not belong here. */
+    previousSigningKeys?: readonly SigningKeyIdentity[];
     signingKey: SigningKey;
     strictFapi?: boolean;
     vciConfig?: VciConfig;

package/dist/oidc/index.d.ts

@@ -6,7 +6,7 @@
  * through the package root.
  */
 export type { OidcProviderConfig } from './config';
-export { generateSigningKey, jwkThumbprint, signJwt, toPublicJwk, verifyJwt, type SigningKey } from './keys';
+export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys, type SigningKey, type SigningKeyIdentity } from './keys';
 export { revokeOAuthClientCredentials } from './operator';
 export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore } from './postgresStores';
 export type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore, OidcRefreshTokenConnection, OidcRefreshTokenStore } from './types';

package/dist/oidc/index.js

@@ -125,6 +125,26 @@ var verifyJwt = async (token, publicJwk) => {
     payload
   };
 };
+var signingVerificationKeys = (active, previous = []) => {
+  const keys = [active, ...previous];
+  const keyIds = new Set(keys.map(({ kid }) => kid));
+  if (keyIds.size !== keys.length)
+    throw new Error("OIDC signing key IDs must be unique");
+  return keys;
+};
+var verifyJwtWithKeys = async (token, keys) => {
+  const [headerSegment] = token.split(".");
+  if (!headerSegment)
+    return;
+  const header = decodeSegment(headerSegment);
+  const kid = header?.kid;
+  if (typeof kid !== "string" || kid.length === 0)
+    return;
+  const key = keys.find((candidate) => candidate.kid === kid);
+  if (!key)
+    return;
+  return verifyJwt(token, key.publicJwk);
+};
 // src/oidc/operator.ts
 var operatorDelete = (store, storeName) => {
   if (!store.deleteForClient)
@@ -12188,8 +12208,10 @@ var createPostgresBackchannelAuthStore = (db) => ({
   }
 });
 export {
+  verifyJwtWithKeys,
   verifyJwt,
   toPublicJwk,
+  signingVerificationKeys,
   signJwt,
   revokeOAuthClientCredentials,
   jwkThumbprint,
@@ -12210,5 +12232,5 @@ export {
   createNeonAuthorizationCodeStore
 };
 
-//# debugId=3782E808539F50C164756E2164756E21
+//# debugId=09059391C2D6086264756E2164756E21
 //# sourceMappingURL=index.js.map