@absolutejs/auth 0.74.0 → 0.75.1

package/README.md

@@ -118,13 +118,14 @@ stacked and reversible, and web/server runtimes never install the registry.
 When portable push is enabled, Auth also owns its authenticated installation
 boundary. Pass the existing Dispatch push lifecycle directly; the server derives
 the principal, tenant, and authorized topics and returns an opaque installation
-identity. The native shell is the only code that sees the APNs/FCM token, and
-ordinary application/page code cannot read it:
+identity. The native shell handles APNs/FCM tokens, while the generated PWA
+runtime handles structured browser subscriptions; ordinary page code reads
+neither provider credential:
 
 ```ts
 const authApplication = await auth({
 	// ...normal Auth + OIDC configuration
-	nativePush: {
+	push: {
 		registrar: pushLifecycle,
 		tenant: (principal) => principal.user.organizationId,
 		topics: (principal) => topicsFor(principal.user)
@@ -132,9 +133,10 @@ const authApplication = await auth({
 });
 ```
 
-The fixed `/auth/mobile/push` route accepts bearer-authenticated native clients
-and cookie-authenticated web clients, but never accepts user ID, tenant, or
-topics from either. Token rotation and deletion require the server-issued
+The fixed `/auth/push` route accepts bearer-authenticated native clients and
+cookie-authenticated web clients, but never accepts user ID, tenant, or topics
+from either. The prior `/auth/mobile/push` path remains an installed-client
+compatibility alias. Credential rotation and deletion require the server-issued
 installation identity and Dispatch verifies that it belongs to the current
 principal. Native sign-out attempts removal while credentials still exist and
 always clears the local provider registration even when the network is down.
@@ -279,8 +281,11 @@ const authPlugin = await auth({
 		resource: 'https://api.example.com',
 		scopes: ['documents:read', 'documents:write'],
 		verifyCredential: createOidcAgentCredentialVerifier({
+			// Atomically insert a hash of jkt + jti; return false on conflict.
+			consumeDpopJti: replayStore.consume,
 			issuer: 'https://auth.example.com',
 			publicJwk: signingKey.publicJwk,
+			requireDpop: true,
 			resource: 'https://api.example.com'
 		})
 	},
@@ -298,6 +303,16 @@ registration. Approval through the existing RFC 8628 device flow creates the
 user-to-agent delegation. The agent can then use RFC 8693 token exchange to get
 a narrowed, audience-bound access token for the protected API.
 
+When `requireDpop` is enabled, the adapter accepts only an RFC 9449-bound
+access token using the `DPoP` authorization scheme, verifies its per-request
+proof and `ath` token hash, and requires the proof key to match `cnf.jkt`.
+Provide `consumeDpopJti` as an atomic shared-store insertion in clustered
+deployments; returning `false` rejects a replay. Proofs without `jti`, proofs
+whose JWK contains private key material, oversized identifiers, and `htu`
+claims containing query or fragment components fail closed. Resource servers
+that require RFC 9449 nonces can use the nonce helpers exported by
+`@absolutejs/auth/oidc` to issue a separate resource nonce challenge.
+
 ```ts
 app.get('/documents', ({ protectAgent }) =>
 	protectAgent(['documents:read'], (agent) => ({

package/dist/agents/index.js

@@ -1349,6 +1349,7 @@ var validateClientIdMetadataDocument = (document, expectedClientId) => {
 // src/oidc/dpop.ts
 init_constants();
 var DEFAULT_MAX_AGE_MS = 60000;
+var MAX_JTI_LENGTH = 128;
 var SECONDS_TO_MS = 1000;
 var NONCE_WINDOW_SECONDS = 120;
 var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
@@ -1389,17 +1390,38 @@ var verifyDpopNonce = async ({
   const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha256(secret, String(currentWindow - offset))));
   return candidates.some((expected) => expected === nonce);
 };
-var decodeHeader = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-var normalizeHtu = (value) => {
+var decodeHeader = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var normalizeHtu = (value, proofClaim = false) => {
   try {
     const url = new URL(String(value));
+    if (url.username || url.password || proofClaim && (url.search.length > 0 || url.hash.length > 0))
+      return;
     return `${url.origin}${url.pathname}`;
   } catch {
-    return "";
+    return;
   }
 };
+var isPublicEs256Jwk = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const kty = Reflect.get(value, "kty");
+  const crv = Reflect.get(value, "crv");
+  const xCoordinate = Reflect.get(value, "x");
+  const yCoordinate = Reflect.get(value, "y");
+  const privateComponent = Reflect.get(value, "d");
+  const alg = Reflect.get(value, "alg");
+  return kty === "EC" && crv === "P-256" && typeof xCoordinate === "string" && xCoordinate.length > 0 && typeof yCoordinate === "string" && yCoordinate.length > 0 && privateComponent === undefined && (alg === undefined || alg === "ES256");
+};
 var verifyDpopProof = async ({
   accessToken,
+  consumeJti,
   htm,
   htu,
   isUsedJti,
@@ -1409,14 +1431,20 @@ var verifyDpopProof = async ({
 }) => {
   if (proof === undefined)
     return;
-  const [headerSegment] = proof.split(".");
+  const segments = proof.split(".");
+  if (segments.length !== 3)
+    return;
+  const [headerSegment] = segments;
   if (headerSegment === undefined)
     return;
   const header = decodeHeader(headerSegment);
-  if (header?.typ !== "dpop+jwt" || header.alg !== "ES256" || header.jwk === undefined) {
+  const publicJwk = header === undefined ? undefined : Reflect.get(header, "jwk");
+  if (header === undefined || Reflect.get(header, "typ") !== "dpop+jwt" || Reflect.get(header, "alg") !== "ES256" || !isPublicEs256Jwk(publicJwk)) {
     return;
   }
-  const verified = await verifyJwt(proof, header.jwk);
+  const verified = await verifyJwt(proof, publicJwk).catch(() => {
+    return;
+  });
   if (verified === undefined)
     return;
   const { payload } = verified;
@@ -1426,14 +1454,19 @@ var verifyDpopProof = async ({
       return;
   }
   const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
-  if (payload.htm !== htm || normalizeHtu(payload.htu) !== normalizeHtu(htu) || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs) {
+  const claimedHtu = normalizeHtu(payload.htu, true);
+  const expectedHtu = normalizeHtu(htu);
+  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
+  if (payload.htm !== htm || claimedHtu === undefined || expectedHtu === undefined || claimedHtu !== expectedHtu || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs || jti === undefined || jti.length === 0 || jti.length > MAX_JTI_LENGTH) {
     return;
   }
-  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
-  if (jti !== undefined && isUsedJti !== undefined && await isUsedJti(jti)) {
+  const jkt = await jwkThumbprint(publicJwk);
+  if (isUsedJti !== undefined && await isUsedJti(jti)) {
     return;
   }
-  return { jkt: await jwkThumbprint(header.jwk), jti };
+  if (consumeJti !== undefined && !await consumeJti({ expiresAt: iatMs + maxAgeMs, jkt, jti }))
+    return;
+  return { jkt, jti };
 };
 
 // src/agents/oidcAdapter.ts
@@ -1449,6 +1482,7 @@ var readAudience = (audience) => {
 };
 var createOidcAgentCredentialVerifier = ({
   issuer,
+  consumeDpopJti,
   isUsedDpopJti,
   maxDpopAgeMs,
   publicJwk,
@@ -1477,6 +1511,7 @@ var createOidcAgentCredentialVerifier = ({
         return;
       const proof = await verifyDpopProof({
         accessToken: token,
+        consumeJti: consumeDpopJti,
         htm: request.method,
         htu: request.url,
         isUsedJti: isUsedDpopJti,
@@ -13763,5 +13798,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=323598F91D83FA7764756E2164756E21
+//# debugId=801AFAC38E904B9A64756E2164756E21
 //# sourceMappingURL=index.js.map