@absolutejs/auth 0.68.2 → 0.69.1

package/dist/oidc/config.d.ts

@@ -2,7 +2,7 @@ import type { RouteString } from '../types';
 import { type SigningKey, type SigningKeyIdentity } from './keys';
 import type { OnClientRegistered, OnClientRegistration } from './registration';
 import type { VciConfig } from './vci';
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshToken, OidcRefreshTokenStore, PushedAuthorizationRequestStore, SocketTicketStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type PublicTokenGrantResult = {
     body: Record<string, unknown>;
@@ -107,6 +107,19 @@ export type OidcProviderConfig<UserType> = {
     pushedAuthorizationRequestTtlMs?: number;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;
+    /** Enables short-lived, single-use tickets for browser/native WebSocket
+     * authentication at `${oidcRoute}/socket-ticket`. */
+    socketTicketStore?: SocketTicketStore;
+    /** Ticket lifetime in milliseconds. Defaults to 30 seconds. */
+    socketTicketTtlMs?: number;
+    /** Restrict which WebSocket resource audiences may receive tickets. The
+     * issuer itself is always the default when the request omits `audience`. */
+    allowSocketTicketAudience?: (context: {
+        audience: string;
+        clientId: string;
+        scopes: string[];
+        subject: string;
+    }) => boolean | Promise<boolean>;
     /** Previous public signing identities retained only for the bounded token
      * overlap window after rotation. The active `signingKey` always signs new
      * tokens and is published first. Private material does not belong here. */
@@ -133,7 +146,7 @@ export declare const exchangeToken: <UserType>({ actorClientId, audience, config
     requestedScopes?: string[];
     subjectToken: string;
 }) => Promise<TokenExchangeResult>;
-export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCertThumbprint, clientId, config, dpopJkt, nonce, now, scopes, sub }: {
+export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCertThumbprint, clientId, config, dpopJkt, familyId, nonce, now, persistRefreshToken, scopes, sub }: {
     acr?: string;
     audience?: string;
     claims?: Record<string, unknown>;
@@ -141,8 +154,10 @@ export declare const issueTokenSet: <UserType>({ acr, audience, claims, clientCe
     clientId: string;
     config: OidcProviderConfig<UserType>;
     dpopJkt?: string;
+    familyId?: string;
     nonce?: string;
     now?: number;
+    persistRefreshToken?: (token: OidcRefreshToken) => Promise<void>;
     scopes: string[];
     sub: string;
 }) => Promise<{

package/dist/oidc/inMemoryStores.d.ts

@@ -1,4 +1,4 @@
-import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore } from './types';
+import type { AuthorizationCodeStore, BackchannelAuthStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore, PushedAuthorizationRequestStore, SocketTicketStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
 export declare const createInMemoryBackchannelAuthStore: () => BackchannelAuthStore;
 export declare const createInMemoryClientAssertionJtiStore: () => ClientAssertionJtiStore;
@@ -9,3 +9,4 @@ export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStor
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;
 export declare const createInMemoryPushedAuthorizationRequestStore: () => PushedAuthorizationRequestStore;
+export declare const createInMemorySocketTicketStore: () => SocketTicketStore;

package/dist/oidc/index.d.ts

@@ -8,5 +8,7 @@
 export type { OidcProviderConfig } from './config';
 export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys, type SigningKey, type SigningKeyIdentity } from './keys';
 export { revokeOAuthClientCredentials } from './operator';
-export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore } from './postgresStores';
-export type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore, OidcRefreshTokenConnection, OidcRefreshTokenStore } from './types';
+export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonSocketTicketStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresSocketTicketStore } from './postgresStores';
+export { createInMemorySocketTicketStore } from './inMemoryStores';
+export { consumeSocketTicket, issueSocketTicket } from './socketTickets';
+export type { AuthorizationCodeStore, ClientAssertionJtiStore, ClientRegistrationTokenStore, DeviceAuthorizationStore, InitialAccessTokenStore, OAuthClient, OAuthClientStore, OidcRefreshTokenConnection, OidcRefreshTokenStore, SocketTicket, SocketTicketStore } from './types';