@absolutejs/auth 0.75.0 → 0.75.2

package/dist/nativePush.d.ts

@@ -1,8 +1,8 @@
 import type { AuthSessionSource } from './session/types';
 import { type AccessTokenPrincipalConfig, type AuthPrincipal } from './principal';
-export declare const DEFAULT_PUSH_ROUTE: "/auth/push";
-/** @deprecated Use DEFAULT_PUSH_ROUTE. Kept for installed beta clients. */
 export declare const DEFAULT_NATIVE_PUSH_ROUTE: "/auth/mobile/push";
+/** Canonical cross-platform push route. */
+export declare const DEFAULT_PUSH_ROUTE: "/auth/push";
 export type PushPlatform = 'apns' | 'fcm' | 'webpush';
 /** @deprecated Use PushPlatform. */
 export type NativePushPlatform = PushPlatform;
@@ -217,13 +217,13 @@ export declare const pushRoutes: <UserType>({ accessTokens, authSessionStore, co
     }>;
     error: [];
 }, "delete", "/auth/mobile/push", import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
-    body: import("typebox").TObject<{
-        installationId: import("typebox").TString;
-    }>;
     beforeHandle: ({ pushPrincipal, status }: {
         pushPrincipal: AuthPrincipal<UserType> | undefined;
         status: (code: "Unauthorized", body: string) => unknown;
     }) => unknown;
+    body: import("typebox").TObject<{
+        installationId: import("typebox").TString;
+    }>;
 }, {}, "/auth/mobile/push">, import("elysia/types").MergeScopedSchemas<{}, {}, import("elysia").UnwrapRoute<{
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
@@ -372,13 +372,13 @@ export declare const pushRoutes: <UserType>({ accessTokens, authSessionStore, co
         readonly "Network Authentication Required": 511;
     }[Code] : Code>;
     defer: (fn: import("elysia/types").AfterResponseHandler<NoInfer<import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
-        body: import("typebox").TObject<{
-            installationId: import("typebox").TString;
-        }>;
         beforeHandle: ({ pushPrincipal, status }: {
             pushPrincipal: AuthPrincipal<UserType> | undefined;
             status: (code: "Unauthorized", body: string) => unknown;
         }) => unknown;
+        body: import("typebox").TObject<{
+            installationId: import("typebox").TString;
+        }>;
     }, {}, "/auth/mobile/push">, import("elysia/types").MergeScopedSchemas<{}, {}, import("elysia").UnwrapRoute<{
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
@@ -572,13 +572,13 @@ export declare const nativePushRoutes: <UserType>({ accessTokens, authSessionSto
     }>;
     error: [];
 }, "delete", "/auth/mobile/push", import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
-    body: import("typebox").TObject<{
-        installationId: import("typebox").TString;
-    }>;
     beforeHandle: ({ pushPrincipal, status }: {
         pushPrincipal: AuthPrincipal<UserType> | undefined;
         status: (code: "Unauthorized", body: string) => unknown;
     }) => unknown;
+    body: import("typebox").TObject<{
+        installationId: import("typebox").TString;
+    }>;
 }, {}, "/auth/mobile/push">, import("elysia/types").MergeScopedSchemas<{}, {}, import("elysia").UnwrapRoute<{
     cookie: import("elysia").TCookieObject<{
         user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;
@@ -727,13 +727,13 @@ export declare const nativePushRoutes: <UserType>({ accessTokens, authSessionSto
         readonly "Network Authentication Required": 511;
     }[Code] : Code>;
     defer: (fn: import("elysia/types").AfterResponseHandler<NoInfer<import("elysia/types").IntersectIfObjectSchema<import("elysia").UnwrapRoute<{
-        body: import("typebox").TObject<{
-            installationId: import("typebox").TString;
-        }>;
         beforeHandle: ({ pushPrincipal, status }: {
             pushPrincipal: AuthPrincipal<UserType> | undefined;
             status: (code: "Unauthorized", body: string) => unknown;
         }) => unknown;
+        body: import("typebox").TObject<{
+            installationId: import("typebox").TString;
+        }>;
     }, {}, "/auth/mobile/push">, import("elysia/types").MergeScopedSchemas<{}, {}, import("elysia").UnwrapRoute<{
         cookie: import("elysia").TCookieObject<{
             user_session_id: import("typebox").TOptional<import("typebox").TTemplateLiteral<"^.*-.*-.*-.*-.*$">>;

package/dist/oidc/dpop.d.ts

@@ -10,10 +10,14 @@ export declare const verifyDpopNonce: ({ now, nonce, secret }: {
 }) => Promise<boolean>;
 export type DpopResult = {
     jkt: string;
-    jti?: string;
+    jti: string;
 };
-export declare const verifyDpopProof: ({ accessToken, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
+export type DpopJti = DpopResult & {
+    expiresAt: number;
+};
+export declare const verifyDpopProof: ({ accessToken, consumeJti, htm, htu, isUsedJti, maxAgeMs, now, proof }: {
     accessToken?: string;
+    consumeJti?: (jti: DpopJti) => boolean | Promise<boolean>;
     htm: string;
     htu: string;
     isUsedJti?: (jti: string) => boolean | Promise<boolean>;

package/dist/oidc/index.d.ts

@@ -6,6 +6,7 @@
  * through the package root.
  */
 export type { OidcProviderConfig } from './config';
+export { extractDpopNonceClaim, mintDpopNonce, verifyDpopNonce, verifyDpopProof, type DpopJti, type DpopResult } from './dpop';
 export { generateSigningKey, jwkThumbprint, signJwt, signingVerificationKeys, toPublicJwk, verifyJwt, verifyJwtWithKeys, type SigningKey, type SigningKeyIdentity } from './keys';
 export { revokeOAuthClientCredentials } from './operator';
 export { createNeonAuthorizationCodeStore, createNeonClientAssertionJtiStore, createNeonClientRegistrationTokenStore, createNeonDeviceAuthorizationStore, createNeonInitialAccessTokenStore, createNeonOAuthClientStore, createNeonOidcRefreshTokenStore, createNeonSocketTicketStore, createPostgresAuthorizationCodeStore, createPostgresClientAssertionJtiStore, createPostgresClientRegistrationTokenStore, createPostgresDeviceAuthorizationStore, createPostgresInitialAccessTokenStore, createPostgresOAuthClientStore, createPostgresOidcRefreshTokenStore, createPostgresSocketTicketStore } from './postgresStores';

package/dist/oidc/index.js

@@ -181,6 +181,9 @@ var init_crypto = __esm(() => {
   textDecoder3 = new TextDecoder;
 });
 
+// src/oidc/dpop.ts
+init_constants();
+
 // src/oidc/keys.ts
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
@@ -280,6 +283,128 @@ var verifyJwtWithKeys = async (token, keys) => {
     return;
   return verifyJwt(token, key.publicJwk);
 };
+
+// src/oidc/dpop.ts
+var DEFAULT_MAX_AGE_MS = 60000;
+var MAX_JTI_LENGTH = 128;
+var SECONDS_TO_MS = 1000;
+var NONCE_WINDOW_SECONDS = 120;
+var NONCE_WINDOW_MS = NONCE_WINDOW_SECONDS * MILLISECONDS_IN_A_SECOND;
+var NONCE_PREVIOUS_WINDOWS_ACCEPTED = 1;
+var hmacSha256 = async (secret, message) => {
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return Buffer.from(new Uint8Array(signature)).toString("base64url");
+};
+var extractDpopNonceClaim = (proof) => {
+  const [, payloadSegment] = proof.split(".");
+  if (payloadSegment === undefined)
+    return;
+  try {
+    const payload = JSON.parse(Buffer.from(payloadSegment, "base64url").toString("utf8"));
+    if (typeof payload !== "object" || payload === null)
+      return;
+    const value = Reflect.get(payload, "nonce");
+    return typeof value === "string" ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var mintDpopNonce = async ({
+  now = Date.now(),
+  secret
+}) => {
+  const window = Math.floor(now / NONCE_WINDOW_MS);
+  return hmacSha256(secret, String(window));
+};
+var verifyDpopNonce = async ({
+  now = Date.now(),
+  nonce,
+  secret
+}) => {
+  const currentWindow = Math.floor(now / NONCE_WINDOW_MS);
+  const candidates = await Promise.all(Array.from({ length: NONCE_PREVIOUS_WINDOWS_ACCEPTED + 1 }, (_, offset) => hmacSha256(secret, String(currentWindow - offset))));
+  return candidates.some((expected) => expected === nonce);
+};
+var decodeHeader = (segment) => {
+  try {
+    const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return;
+  }
+};
+var normalizeHtu = (value, proofClaim = false) => {
+  try {
+    const url = new URL(String(value));
+    if (url.username || url.password || proofClaim && (url.search.length > 0 || url.hash.length > 0))
+      return;
+    return `${url.origin}${url.pathname}`;
+  } catch {
+    return;
+  }
+};
+var isPublicEs256Jwk = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return false;
+  const kty = Reflect.get(value, "kty");
+  const crv = Reflect.get(value, "crv");
+  const xCoordinate = Reflect.get(value, "x");
+  const yCoordinate = Reflect.get(value, "y");
+  const privateComponent = Reflect.get(value, "d");
+  const alg = Reflect.get(value, "alg");
+  return kty === "EC" && crv === "P-256" && typeof xCoordinate === "string" && xCoordinate.length > 0 && typeof yCoordinate === "string" && yCoordinate.length > 0 && privateComponent === undefined && (alg === undefined || alg === "ES256");
+};
+var verifyDpopProof = async ({
+  accessToken,
+  consumeJti,
+  htm,
+  htu,
+  isUsedJti,
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  now = Date.now(),
+  proof
+}) => {
+  if (proof === undefined)
+    return;
+  const segments = proof.split(".");
+  if (segments.length !== 3)
+    return;
+  const [headerSegment] = segments;
+  if (headerSegment === undefined)
+    return;
+  const header = decodeHeader(headerSegment);
+  const publicJwk = header === undefined ? undefined : Reflect.get(header, "jwk");
+  if (header === undefined || Reflect.get(header, "typ") !== "dpop+jwt" || Reflect.get(header, "alg") !== "ES256" || !isPublicEs256Jwk(publicJwk)) {
+    return;
+  }
+  const verified = await verifyJwt(proof, publicJwk).catch(() => {
+    return;
+  });
+  if (verified === undefined)
+    return;
+  const { payload } = verified;
+  if (accessToken !== undefined) {
+    const expectedAth = Buffer.from(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken))).toString("base64url");
+    if (payload.ath !== expectedAth)
+      return;
+  }
+  const iatMs = typeof payload.iat === "number" ? payload.iat * SECONDS_TO_MS : 0;
+  const claimedHtu = normalizeHtu(payload.htu, true);
+  const expectedHtu = normalizeHtu(htu);
+  const jti = typeof payload.jti === "string" ? payload.jti : undefined;
+  if (payload.htm !== htm || claimedHtu === undefined || expectedHtu === undefined || claimedHtu !== expectedHtu || iatMs === 0 || Math.abs(now - iatMs) > maxAgeMs || jti === undefined || jti.length === 0 || jti.length > MAX_JTI_LENGTH) {
+    return;
+  }
+  const jkt = await jwkThumbprint(publicJwk);
+  if (isUsedJti !== undefined && await isUsedJti(jti)) {
+    return;
+  }
+  if (consumeJti !== undefined && !await consumeJti({ expiresAt: iatMs + maxAgeMs, jkt, jti }))
+    return;
+  return { jkt, jti };
+};
 // src/oidc/operator.ts
 var operatorDelete = (store, storeName) => {
   if (!store.deleteForClient)
@@ -12788,13 +12913,17 @@ var issueSocketTicket = async ({
 export {
   verifyJwtWithKeys,
   verifyJwt,
+  verifyDpopProof,
+  verifyDpopNonce,
   toPublicJwk,
   signingVerificationKeys,
   signJwt,
   revokeOAuthClientCredentials,
+  mintDpopNonce,
   jwkThumbprint,
   issueSocketTicket,
   generateSigningKey,
+  extractDpopNonceClaim,
   createPostgresSocketTicketStore,
   createPostgresOidcRefreshTokenStore,
   createPostgresOAuthClientStore,
@@ -12815,5 +12944,5 @@ export {
   consumeSocketTicket
 };
 
-//# debugId=B37CCAB8EEBB54A964756E2164756E21
+//# debugId=9914FF0D8636BBE564756E2164756E21
 //# sourceMappingURL=index.js.map