@absolutejs/auth 0.74.0 → 0.75.1

package/dist/oidc/dpop.d.ts

@@ -10,10 +10,14 @@ export declare const verifyDpopNonce: ({ now, nonce, secret }: {
 }) => Promise<boolean>;
 export type DpopResult = {
     jkt: string;
-    jti?: string;
+    jti: string;
 };
-export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+export type DpopJti = DpopResult & {
+    expiresAt: number;
+};
+export declare const verifyDpopProof: ({ accessToken, consumeJti, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
     accessToken?: string;
+    consumeJti?: (jti: DpopJti) => boolean | Promise<boolean>;
     htm: string;
     htu: string;
     isUsedJti?: (jti: string) => boolean | Promise<boolean>;

package/dist/oidc/index.d.ts

@@ -6,6 +6,7 @@
  * through the package root.
  */
 export type { OidcProviderConfig } from './config';
+export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof, type DpopJti, type DpopResult } from './dpop';
 export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys, type SigningKey, type SigningKeyIdentity } from './keys';
 export { revokeOAuthClientCredentials } from './operator';
 export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonSocketTicketStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresSocketTicketStore } from './postgresStores';

package/dist/oidc/index.js

@@ -181,6 +181,9 @@ var init_crypto = __esm(() => {
   textDecoder3 = new TextDecoder;
 });
 
+// src/oidc/dpop.ts
+init_constants();
+
 // src/oidc/keys.ts
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
@@ -280,6 +283,128 @@ var verifyJwtWithKeys = async (token, keys) => {
     return;
   return verifyJwt(token, key.publicJwk);
 };
+
+// src/oidc/dpop.ts
+var DEFAULT_MAX_AGE_MS = 60000;
+var MAX_JTI_LENGTH = 128;
+var SECONDS_TO_MS = 1000;
+var NONCE_WINDOW_SECONDS = 120;
+var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
+var NONCE_PREVIOUS_WINDOWS_ACCEPTED = 1;
+var hmacSha256 = async (secret, message) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Buffer.from(new Uint8Array(signature)).toString("base64url");
+};
+var extractDpopNonceClaim = (proof) => {
+  const [, payloadSegment] = proof.split(".");
+  if (payloadSegment === undefined)
+    return;
+  try {
+    const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return;
+    const value = Reflect.get(payload, "nonce");
+    return typeof value === "string" ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var mintDpopNonce = async ({
+  now = Date.now(),
+  secret
+}) => {
+  const window = Math.floor(now / NONCE_WINDOW_MS);
+  return hmacSha256(secret, String(window));
+};
+var verifyDpopNonce = async ({
+  now = Date.now(),
+  nonce,
+  secret
+}) => {
+  const currentWindow = Math.floor(now / NONCE_WINDOW_MS);
+  const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha256(secret, String(currentWindow - offset))));
+  return candidates.some((expected) => expected === nonce);
+};
+var decodeHeader = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var normalizeHtu = (value, proofClaim = false) => {
+  try {
+    const url = new URL(String(value));
+    if (url.username || url.password || proofClaim && (url.search.length > 0 || url.hash.length > 0))
+      return;
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return;
+  }
+};
+var isPublicEs256Jwk = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const kty = Reflect.get(value, "kty");
+  const crv = Reflect.get(value, "crv");
+  const xCoordinate = Reflect.get(value, "x");
+  const yCoordinate = Reflect.get(value, "y");
+  const privateComponent = Reflect.get(value, "d");
+  const alg = Reflect.get(value, "alg");
+  return kty === "EC" && crv === "P-256" && typeof xCoordinate === "string" && xCoordinate.length > 0 && typeof yCoordinate === "string" && yCoordinate.length > 0 && privateComponent === undefined && (alg === undefined || alg === "ES256");
+};
+var verifyDpopProof = async ({
+  accessToken,
+  consumeJti,
+  htm,
+  htu,
+  isUsedJti,
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  now = Date.now(),
+  proof
+}) => {
+  if (proof === undefined)
+    return;
+  const segments = proof.split(".");
+  if (segments.length !== 3)
+    return;
+  const [headerSegment] = segments;
+  if (headerSegment === undefined)
+    return;
+  const header = decodeHeader(headerSegment);
+  const publicJwk = header === undefined ? undefined : Reflect.get(header, "jwk");
+  if (header === undefined || Reflect.get(header, "typ") !== "dpop+jwt" || Reflect.get(header, "alg") !== "ES256" || !isPublicEs256Jwk(publicJwk)) {
+    return;
+  }
+  const verified = await verifyJwt(proof, publicJwk).catch(() => {
+    return;
+  });
+  if (verified === undefined)
+    return;
+  const { payload } = verified;
+  if (accessToken !== undefined) {
+    const expectedAth = Buffer.from(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken))).toString("base64url");
+    if (payload.ath !== expectedAth)
+      return;
+  }
+  const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
+  const claimedHtu = normalizeHtu(payload.htu, true);
+  const expectedHtu = normalizeHtu(htu);
+  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
+  if (payload.htm !== htm || claimedHtu === undefined || expectedHtu === undefined || claimedHtu !== expectedHtu || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs || jti === undefined || jti.length === 0 || jti.length > MAX_JTI_LENGTH) {
+    return;
+  }
+  const jkt = await jwkThumbprint(publicJwk);
+  if (isUsedJti !== undefined && await isUsedJti(jti)) {
+    return;
+  }
+  if (consumeJti !== undefined && !await consumeJti({ expiresAt: iatMs + maxAgeMs, jkt, jti }))
+    return;
+  return { jkt, jti };
+};
 // src/oidc/operator.ts
 var operatorDelete = (store, storeName) => {
   if (!store.deleteForClient)
@@ -12788,13 +12913,17 @@ var issueSocketTicket = async ({
 export {
   verifyJwtWithKeys,
   verifyJwt,
+  verifyDpopProof,
+  verifyDpopNonce,
   toPublicJwk,
   signingVerificationKeys,
   signJwt,
   revokeOAuthClientCredentials,
+  mintDpopNonce,
   jwkThumbprint,
   issueSocketTicket,
   generateSigningKey,
+  extractDpopNonceClaim,
   createPostgresSocketTicketStore,
   createPostgresOidcRefreshTokenStore,
   createPostgresOAuthClientStore,
@@ -12815,5 +12944,5 @@ export {
   consumeSocketTicket
 };
 
-//# debugId=B37CCAB8EEBB54A964756E2164756E21
+//# debugId=9914FF0D8636BBE564756E2164756E21
 //# sourceMappingURL=index.js.map