@absolutejs/auth 0.75.0 → 0.75.2

package/dist/agents/oidcAdapter.d.ts

@@ -1,4 +1,5 @@
 import { type SigningKeyIdentity } from '../oidc/keys';
+import { type DpopJti } from '../oidc/dpop';
 import type { AgentCredentialVerifier } from './types';
 type OidcAgentCredentialVerifierKeys = {
     publicJwk: JsonWebKey;
@@ -10,8 +11,9 @@ type OidcAgentCredentialVerifierKeys = {
 /** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
  * signature, issuer, audience, expiry, and extracts the OAuth client as the
  * agent identity while retaining `sub` as the authorizing user. */
-export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
+export declare const createOidcAgentCredentialVerifier: ({ issuer, consumeDpopJti, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
     issuer: string;
+    consumeDpopJti?: (jti: DpopJti) => boolean | Promise<boolean>;
     isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
     maxDpopAgeMs?: number;
     requireDpop?: boolean;

package/dist/agents/routes.d.ts

@@ -35,6 +35,7 @@ export declare const agentAuthPlugin: (config?: AgentAuthConfig) => Elysia<"", "
                     scopes_supported: string[];
                     resource_name?: string | undefined;
                     resource_logo_uri?: string | undefined;
+                    dpop_bound_access_tokens_required?: boolean | undefined;
                     authorization_servers: string[];
                     bearer_methods_supported: string[];
                 };
@@ -149,6 +150,7 @@ export declare const agentAuthRoutes: (config?: AgentAuthConfig) => Elysia<"", "
                     scopes_supported: string[];
                     resource_name?: string | undefined;
                     resource_logo_uri?: string | undefined;
+                    dpop_bound_access_tokens_required?: boolean | undefined;
                     authorization_servers: string[];
                     bearer_methods_supported: string[];
                 };

package/dist/index.d.ts

@@ -3759,6 +3759,7 @@ export declare const createAuthApplications: <UserType>(configuration: AuthConfi
                         scopes_supported: string[];
                         resource_name?: string | undefined;
                         resource_logo_uri?: string | undefined;
+                        dpop_bound_access_tokens_required?: boolean | undefined;
                         authorization_servers: string[];
                         bearer_methods_supported: string[];
                     };
@@ -3991,7 +3992,7 @@ export { oidcProviderRoutes } from './oidc/routes';
 export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys } from './oidc/keys';
 export type { SigningKey, SigningKeyIdentity } from './oidc/keys';
 export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof } from './oidc/dpop';
-export type { DpopResult } from './oidc/dpop';
+export type { DpopJti, DpopResult } from './oidc/dpop';
 export { CLIENT_ASSERTION_TYPE, verifyClientAssertion, verifyJwtSignedByClient } from './oidc/clientAuth';
 export { parseSignedRequestObject } from './oidc/jar';
 export type { JarParseResult } from './oidc/jar';

package/dist/index.js

@@ -3260,6 +3260,7 @@ var DEFAULT_AGENT_RESOURCE_METADATA_ROUTE = "/.well-known/oauth-protected-resour
 var agentProtectedResourceMetadata = (config) => ({
   authorization_servers: [config.authorizationServer],
   bearer_methods_supported: ["header"],
+  ...config.dpopBoundAccessTokensRequired === true ? { dpop_bound_access_tokens_required: true } : {},
   ...config.logoUri === undefined ? {} : { resource_logo_uri: config.logoUri },
   ...config.resourceName === undefined ? {} : { resource_name: config.resourceName },
   resource: config.resource,
@@ -6191,8 +6192,8 @@ var createMfaGate = ({ getUserId, mfaStore }) => async (user) => isMfaEnrolled(a
 
 // src/nativePush.ts
 import { Elysia as Elysia17, t as t11 } from "elysia";
-var DEFAULT_PUSH_ROUTE = "/auth/push";
 var DEFAULT_NATIVE_PUSH_ROUTE = "/auth/mobile/push";
+var DEFAULT_PUSH_ROUTE = "/auth/push";
 var requireServerText = (value, field) => {
   const normalized = value.trim();
   if (!normalized)
@@ -6246,9 +6247,11 @@ var pushRoutes = ({
     }
     return true;
   };
+  const installationIdSchema = t11.Optional(t11.String({ maxLength: 128, minLength: 1 }));
+  const localeSchema = t11.Optional(t11.String({ maxLength: 64, minLength: 1 }));
   const commonRegistrationFields = {
-    installationId: t11.Optional(t11.String({ maxLength: 128, minLength: 1 })),
-    locale: t11.Optional(t11.String({ maxLength: 64, minLength: 1 }))
+    installationId: installationIdSchema,
+    locale: localeSchema
   };
   const registrationBody = t11.Union([
     t11.Object({
@@ -6268,18 +6271,20 @@ var pushRoutes = ({
       })
     })
   ]);
+  const requirePushPrincipal = ({
+    pushPrincipal,
+    status
+  }) => pushPrincipal ? undefined : status("Unauthorized", "User is not authenticated");
   const registrationOptions = {
-    body: registrationBody,
-    beforeHandle: ({
-      pushPrincipal,
-      status
-    }) => pushPrincipal ? undefined : status("Unauthorized", "User is not authenticated")
+    beforeHandle: requirePushPrincipal,
+    body: registrationBody
   };
+  const removalBody = t11.Object({
+    installationId: t11.String({ maxLength: 128, minLength: 1 })
+  });
   const removalOptions = {
-    body: t11.Object({
-      installationId: t11.String({ maxLength: 128, minLength: 1 })
-    }),
-    beforeHandle: registrationOptions.beforeHandle
+    beforeHandle: requirePushPrincipal,
+    body: removalBody
   };
   return new Elysia17({ name: "@absolutejs/auth/push" }).use(sessionStore()).guard({
     cookie: t11.Cookie({ user_session_id: userSessionIdTypebox }),
@@ -8086,6 +8091,7 @@ var verifyCertificateBoundToken = async ({
 // src/oidc/dpop.ts
 init_constants();
 var DEFAULT_MAX_AGE_MS = 60000;
+var MAX_JTI_LENGTH = 128;
 var SECONDS_TO_MS = 1000;
 var NONCE_WINDOW_SECONDS = 120;
 var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
@@ -8126,17 +8132,38 @@ var verifyDpopNonce = async ({
   const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha2562(secret, String(currentWindow - offset))));
   return candidates.some((expected) => expected === nonce);
 };
-var decodeHeader = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-var normalizeHtu = (value) => {
+var decodeHeader = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var normalizeHtu = (value, proofClaim = false) => {
   try {
     const url = new URL(String(value));
+    if (url.username || url.password || proofClaim && (url.search.length > 0 || url.hash.length > 0))
+      return;
     return `${url.origin}${url.pathname}`;
   } catch {
-    return "";
+    return;
   }
 };
+var isPublicEs256Jwk = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const kty = Reflect.get(value, "kty");
+  const crv = Reflect.get(value, "crv");
+  const xCoordinate = Reflect.get(value, "x");
+  const yCoordinate = Reflect.get(value, "y");
+  const privateComponent = Reflect.get(value, "d");
+  const alg = Reflect.get(value, "alg");
+  return kty === "EC" && crv === "P-256" && typeof xCoordinate === "string" && xCoordinate.length > 0 && typeof yCoordinate === "string" && yCoordinate.length > 0 && privateComponent === undefined && (alg === undefined || alg === "ES256");
+};
 var verifyDpopProof = async ({
   accessToken,
+  consumeJti,
   htm,
   htu,
   isUsedJti,
@@ -8146,14 +8173,20 @@ var verifyDpopProof = async ({
 }) => {
   if (proof === undefined)
     return;
-  const [headerSegment] = proof.split(".");
+  const segments = proof.split(".");
+  if (segments.length !== 3)
+    return;
+  const [headerSegment] = segments;
   if (headerSegment === undefined)
     return;
   const header = decodeHeader(headerSegment);
-  if (header?.typ !== "dpop+jwt" || header.alg !== "ES256" || header.jwk === undefined) {
+  const publicJwk = header === undefined ? undefined : Reflect.get(header, "jwk");
+  if (header === undefined || Reflect.get(header, "typ") !== "dpop+jwt" || Reflect.get(header, "alg") !== "ES256" || !isPublicEs256Jwk(publicJwk)) {
     return;
   }
-  const verified = await verifyJwt(proof, header.jwk);
+  const verified = await verifyJwt(proof, publicJwk).catch(() => {
+    return;
+  });
   if (verified === undefined)
     return;
   const { payload } = verified;
@@ -8163,14 +8196,19 @@ var verifyDpopProof = async ({
       return;
   }
   const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
-  if (payload.htm !== htm || normalizeHtu(payload.htu) !== normalizeHtu(htu) || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs) {
+  const claimedHtu = normalizeHtu(payload.htu, true);
+  const expectedHtu = normalizeHtu(htu);
+  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
+  if (payload.htm !== htm || claimedHtu === undefined || expectedHtu === undefined || claimedHtu !== expectedHtu || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs || jti === undefined || jti.length === 0 || jti.length > MAX_JTI_LENGTH) {
     return;
   }
-  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
-  if (jti !== undefined && isUsedJti !== undefined && await isUsedJti(jti)) {
+  const jkt = await jwkThumbprint(publicJwk);
+  if (isUsedJti !== undefined && await isUsedJti(jti)) {
     return;
   }
-  return { jkt: await jwkThumbprint(header.jwk), jti };
+  if (consumeJti !== undefined && !await consumeJti({ expiresAt: iatMs + maxAgeMs, jkt, jti }))
+    return;
+  return { jkt, jti };
 };
 
 // src/oidc/logout.ts
@@ -8909,7 +8947,7 @@ var oidcProviderRoutes = (config) => {
         "dpop-nonce": fresh,
         "www-authenticate": 'DPoP error="use_dpop_nonce"'
       },
-      status: HTTP_UNAUTHORIZED4
+      status: HTTP_BAD_REQUEST3
     });
   };
   const grantAuthorizationCode = async (client, body, dpop, clientCertThumbprint) => {
@@ -36606,6 +36644,7 @@ var readAudience = (audience) => {
 };
 var createOidcAgentCredentialVerifier = ({
   issuer,
+  consumeDpopJti,
   isUsedDpopJti,
   maxDpopAgeMs,
   publicJwk,
@@ -36634,6 +36673,7 @@ var createOidcAgentCredentialVerifier = ({
         return;
       const proof = await verifyDpopProof({
         accessToken: token,
+        consumeJti: consumeDpopJti,
         htm: request.method,
         htu: request.url,
         isUsedJti: isUsedDpopJti,
@@ -40973,5 +41013,5 @@ export {
   ABSOLUTE_NATIVE_AUTH_CLIENTS_ENV
 };
 
-//# debugId=A9E81CE91544BE6B64756E2164756E21
+//# debugId=6230674639E5BA6B64756E2164756E21
 //# sourceMappingURL=index.js.map