@absolutejs/auth 0.56.3 → 0.56.5

package/dist/oidc/jar.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthClient } from './types';
+export type JarParseResult = {
+    error: 'invalid_request_object';
+    ok: false;
+} | {
+    ok: true;
+    params: Record<string, string>;
+};
+export declare const parseSignedRequestObject: ({ client, expectedIssuer, jwt, now }: {
+    client: OAuthClient;
+    expectedIssuer: string;
+    jwt: string;
+    now?: number;
+}) => Promise<JarParseResult>;

package/dist/oidc/keys.d.ts

@@ -0,0 +1,35 @@
+type SigningKeyIdentity = {
+    kid: string;
+    publicJwk: JsonWebKey;
+};
+/** ES256 signing material can remain local for development or be delegated to
+ * a non-exportable KMS/HSM adapter. External signers return the 64-byte JOSE
+ * ECDSA signature (r || s), not an ASN.1 DER envelope. */
+export type SigningKey = SigningKeyIdentity & ({
+    privateJwk: JsonWebKey;
+    sign?: never;
+} | {
+    privateJwk?: never;
+    sign: (input: Uint8Array) => Promise<Uint8Array>;
+});
+export declare const generateSigningKey: () => Promise<SigningKey>;
+export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
+export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
+export declare const toPublicJwk: (key: SigningKey) => {
+    alg: string;
+    crv: string | undefined;
+    kid: string;
+    kty: string | undefined;
+    use: string;
+    x: string | undefined;
+    y: string | undefined;
+};
+export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promise<{
+    header: {
+        [k: string]: any;
+    };
+    payload: {
+        [k: string]: any;
+    };
+} | undefined>;
+export {};

package/dist/oidc/logout.d.ts

@@ -0,0 +1,38 @@
+import type { OidcProviderConfig } from './config';
+import type { LogoutDelivery, OAuthClient } from './types';
+export declare const resolvePostLogoutRedirect: ({ client, requestedUri }: {
+    client: OAuthClient;
+    requestedUri: string | undefined;
+}) => string | undefined;
+export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
+    config: OidcProviderConfig<UserType>;
+    idTokenHint: string;
+}) => Promise<{
+    audClientId: string;
+    sub: string;
+} | undefined>;
+type DeliveryFetch = (url: string, init: {
+    body: string;
+    headers: Record<string, string>;
+    method: string;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+export declare const mintLogoutToken: <UserType>({ clientId, config, now, sub }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    sub: string;
+}) => Promise<string>;
+export declare const fanOutBackchannelLogout: <UserType>({ config, fetchImpl, now, onError, skipClientId, timeoutMs, userId }: {
+    config: OidcProviderConfig<UserType>;
+    fetchImpl?: DeliveryFetch;
+    now?: number;
+    onError?: (delivery: LogoutDelivery) => void | Promise<void>;
+    skipClientId?: string;
+    timeoutMs?: number;
+    userId: string;
+}) => Promise<string[]>;
+export {};

package/dist/oidc/mtls.d.ts

@@ -0,0 +1,11 @@
+export declare const computeCertThumbprint: (derBytes: Uint8Array) => Promise<string>;
+export declare const extractRfc9440ClientCert: (headers: Headers) => Uint8Array<ArrayBuffer> | undefined;
+export declare const resolveClientCert: ({ extract, headers }: {
+    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
+    headers: Headers;
+}) => Promise<Uint8Array<ArrayBufferLike> | undefined>;
+export declare const verifyCertificateBoundToken: ({ cnfThumbprint, extract, headers }: {
+    cnfThumbprint: string | undefined;
+    extract: ((headers: Headers) => Promise<Uint8Array | undefined> | Uint8Array | undefined) | undefined;
+    headers: Headers;
+}) => Promise<boolean>;

package/dist/oidc/par.d.ts

@@ -0,0 +1,28 @@
+import type { OAuthClient, PushedAuthorizationRequestStore } from './types';
+export declare const DEFAULT_PAR_TTL_MS: number;
+export declare const REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+export type PushAuthorizationResult = {
+    body: {
+        expires_in: number;
+        request_uri: string;
+    };
+    ok: true;
+} | {
+    body: {
+        error: string;
+    };
+    ok: false;
+    status: 400 | 401;
+};
+export declare const consumePushedRequest: ({ clientId, requestUri, store }: {
+    clientId: string;
+    requestUri: string;
+    store: PushedAuthorizationRequestStore;
+}) => Promise<Record<string, string> | undefined>;
+export declare const pushAuthorizationRequest: ({ client, now, params, store, ttlMs }: {
+    client: OAuthClient;
+    now?: number;
+    params: Record<string, string>;
+    store: PushedAuthorizationRequestStore;
+    ttlMs?: number;
+}) => Promise<PushAuthorizationResult>;

package/dist/oidc/registration.d.ts

@@ -0,0 +1,138 @@
+import type { ClientRegistrationTokenStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore } from './types';
+export type ClientRegistrationMetadata = {
+    backchannel_logout_uri?: string;
+    client_name?: string;
+    grant_types?: string[];
+    jwks?: JsonWebKey[];
+    jwks_uri?: string;
+    post_logout_redirect_uris?: string[];
+    redirect_uris?: string[];
+    scope?: string;
+};
+export type ClientRegistrationDecision = {
+    allow: false;
+    denyReason: string;
+} | {
+    allow: true;
+    transform?: Partial<OAuthClient>;
+};
+export type OnClientRegistration = (context: {
+    metadata: ClientRegistrationMetadata;
+}) => ClientRegistrationDecision | Promise<ClientRegistrationDecision>;
+export type OnClientRegistered = (context: {
+    client: OAuthClient;
+    metadata: ClientRegistrationMetadata;
+}) => void | Promise<void>;
+export type RegisterClientResult = {
+    body: {
+        error: string;
+        error_description?: string;
+    };
+    ok: false;
+    status: 400 | 401 | 403 | 501;
+} | {
+    body: ClientRegistrationMetadata & {
+        client_id: string;
+        registration_access_token: string;
+        registration_client_uri: string;
+    };
+    ok: true;
+};
+export declare const deleteRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly status: 204;
+    readonly body?: undefined;
+}>;
+export declare const getRegisteredClient: ({ authorization, clientId, clientStore, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "invalid_token";
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client";
+    };
+    readonly status: 404;
+} | {
+    readonly body: ClientRegistrationMetadata & {
+        client_id: string;
+    };
+    readonly status: 200;
+}>;
+export declare const registerClient: ({ clientStore, initialAccessTokenStore, metadata, onClientRegistration, onClientRegistered, presentedInitialAccessToken, registrationBaseUrl, registrationTokenStore }: {
+    clientStore: OAuthClientStore;
+    initialAccessTokenStore?: InitialAccessTokenStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    onClientRegistered?: OnClientRegistered;
+    presentedInitialAccessToken?: string;
+    registrationBaseUrl: string;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<RegisterClientResult>;
+export declare const updateRegisteredClient: ({ authorization, clientId, clientStore, metadata, onClientRegistration, registrationTokenStore }: {
+    authorization: string | undefined;
+    clientId: string;
+    clientStore: OAuthClientStore;
+    metadata: ClientRegistrationMetadata;
+    onClientRegistration?: OnClientRegistration;
+    registrationTokenStore: ClientRegistrationTokenStore;
+}) => Promise<{
+    readonly body: {
+        readonly error: "unsupported_response_type";
+        readonly error_description?: undefined;
+    };
+    readonly status: 501;
+} | {
+    readonly body: {
+        readonly error: "invalid_token";
+        readonly error_description?: undefined;
+    };
+    readonly status: 401;
+} | {
+    readonly body: {
+        readonly error: "invalid_client_metadata";
+        readonly error_description: string;
+    };
+    readonly status: 403;
+} | {
+    readonly body: {
+        readonly error: "invalid_redirect_uri";
+        readonly error_description?: undefined;
+    };
+    readonly status: 400;
+} | {
+    readonly body: {
+        readonly registration_access_token: string;
+        readonly backchannel_logout_uri?: string;
+        readonly client_name?: string;
+        readonly grant_types?: string[];
+        readonly jwks?: JsonWebKey[];
+        readonly jwks_uri?: string;
+        readonly post_logout_redirect_uris?: string[];
+        readonly redirect_uris?: string[];
+        readonly scope?: string;
+        readonly client_id: string;
+        readonly error?: undefined;
+        readonly error_description?: undefined;
+    };
+    readonly status: 200;
+}>;