@agenticprimitives/connect-auth 0.1.0-alpha.3 → 1.0.0-alpha.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -8
- package/dist/csrf.d.ts +72 -8
- package/dist/csrf.d.ts.map +1 -1
- package/dist/csrf.js +110 -19
- package/dist/csrf.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/methods/google.d.ts +30 -1
- package/dist/methods/google.d.ts.map +1 -1
- package/dist/methods/google.js +35 -6
- package/dist/methods/google.js.map +1 -1
- package/dist/methods/passkey.d.ts +0 -12
- package/dist/methods/passkey.d.ts.map +1 -1
- package/dist/methods/passkey.js +7 -12
- package/dist/methods/passkey.js.map +1 -1
- package/dist/methods/siwe.d.ts +6 -6
- package/dist/methods/siwe.d.ts.map +1 -1
- package/dist/methods/siwe.js +17 -7
- package/dist/methods/siwe.js.map +1 -1
- package/dist/methods/youversion.d.ts +10 -0
- package/dist/methods/youversion.d.ts.map +1 -0
- package/dist/methods/youversion.js +18 -0
- package/dist/methods/youversion.js.map +1 -0
- package/dist/salt.js +1 -1
- package/dist/salt.js.map +1 -1
- package/dist/sessions.d.ts +64 -6
- package/dist/sessions.d.ts.map +1 -1
- package/dist/sessions.js +117 -9
- package/dist/sessions.js.map +1 -1
- package/dist/types.d.ts +26 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +11 -7
package/dist/methods/passkey.js
CHANGED
|
@@ -177,18 +177,13 @@ export function parseAuthData(authData) {
|
|
|
177
177
|
flagUserVerified: flagUV,
|
|
178
178
|
};
|
|
179
179
|
}
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
throw new Error('connect-auth/passkey: beginLogin not implemented yet.');
|
|
188
|
-
}
|
|
189
|
-
export async function completeLogin(_req) {
|
|
190
|
-
throw new Error('connect-auth/passkey: completeLogin not implemented yet.');
|
|
191
|
-
}
|
|
180
|
+
// NOTE: the passkey signup/login CEREMONY (begin/complete) is deliberately NOT part of this
|
|
181
|
+
// package's surface — the canonical WebAuthn challenge verification is enforced ON-CHAIN by
|
|
182
|
+
// AgentAccount._verifyWebAuthn (binds challenge + rpIdHash + UV), and the ceremony orchestration
|
|
183
|
+
// (registration options, attestation transport, origin checks) is app/transport territory. This
|
|
184
|
+
// module provides only the pure cryptographic primitives above (DER/low-s, assertion build, attestation
|
|
185
|
+
// parse). Earlier non-functional `beginSignup/completeSignup/beginLogin/completeLogin` stubs that threw
|
|
186
|
+
// "not implemented" were removed (AUDIT N-1): a published package must not advertise an API that throws.
|
|
192
187
|
// ─── Private helpers ─────────────────────────────────────────────────
|
|
193
188
|
function bytesToBigInt(b) {
|
|
194
189
|
let n = 0n;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/methods/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGjD,wEAAwE;AAExE,qCAAqC;AACrC,MAAM,CAAC,MAAM,MAAM,GACjB,mEAAmE,CAAC;AAEtE,wEAAwE;AAExE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,CAAC,CAAC,8DAA8D;YAC7D,UAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,MAAM,GACV,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACd,CAAC,CAAC,8DAA8D;YAC7D,UAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC,EAAE,CAAC;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;IACrB,CAAC,EAAE,CAAC;IACJ,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC,EAAE,CAAC;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;IACrB,CAAC,EAAE,CAAC;IACJ,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,OAAO,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IAErC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEtD,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAChD,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;QACnB,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAS;IAC/C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,iBAA6B;IAE7B,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAA2B,CAAC;IACnE,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAoB;IAChD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,QAAQ,CAC5B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,EAAE,EACxB,CAAC,CACF,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC,IAAI,EAAE,CAAC;IACR,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;IACzD,CAAC,IAAI,CAAC,CAAC;IACP,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IACtD,CAAC,IAAI,SAAS,CAAC;IACf,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAA2B,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAA2B,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,YAAY;QACZ,qBAAqB,EAAE,kBAAkB,CAAC,YAAY,CAAC;QACvD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACzB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACzB,MAAM;QACN,SAAS;QACT,0BAA0B,EAAE,MAAM;QAClC,eAAe,EAAE,MAAM;QACvB,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAyB;IACzD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa;IAChD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAgC;IAC/D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAa;IAC/C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AAExE,SAAS,aAAa,CAAC,CAAa;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAa;IACvC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,QAAoB,EAAE,MAAkB;IACzD,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAgBD,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,CAAC,YAAY,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,CAAU,EAAE,GAAY;IACtC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;QACpE,GAAG,EAAE,CAAC;KACP,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAEzB,SAAS,SAAS,CAAC,CAAkC;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,CAAC;gBACJ,OAAO,GAAsB,CAAC;YAChC,KAAK,CAAC;gBACJ,OAAO,OAAO,GAAG,KAAK,QAAQ;oBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;oBACb,CAAC,CAAC,CAAE,GAAc,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAG,IAAI,UAAU,CACtB,CAAC,CAAC,IAAI,CAAC,MAAM,EACb,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,EACzB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;gBACF,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAG,IAAI,UAAU,CACtB,CAAC,CAAC,IAAI,CAAC,MAAM,EACb,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,EACzB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;gBACF,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,GAAG,GAAgB,EAAE,CAAC;gBAC5B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;oBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAY,IAAI,GAAG,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAY,CAAC;oBAClC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;oBACvB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,CAAC;gBACJ,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAC/B,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D;gBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CACjB,CAAkC,EAClC,KAAa;QAEb,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/methods/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAGjD,wEAAwE;AAExE,qCAAqC;AACrC,MAAM,CAAC,MAAM,MAAM,GACjB,mEAAmE,CAAC;AAEtE,wEAAwE;AAExE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,CAAC,CAAC,8DAA8D;YAC7D,UAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,MAAM,GACV,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,UAAU;QACxB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACd,CAAC,CAAC,8DAA8D;YAC7D,UAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC,EAAE,CAAC;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;IACrB,CAAC,EAAE,CAAC;IACJ,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC,EAAE,CAAC;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;IACrB,CAAC,EAAE,CAAC;IACJ,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,OAAO,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;IAErC,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEtD,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAChD,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QAC5B,CAAC;QACD,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;QACnB,kBAAkB,EAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAS;IAC/C,OAAO,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAgBD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,iBAA6B;IAE7B,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,UAAU,CAA2B,CAAC;IACnE,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAAoB;IAChD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,QAAQ,CAC5B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,UAAU,GAAG,EAAE,EACxB,CAAC,CACF,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC,IAAI,EAAE,CAAC;IACR,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;IACzD,CAAC,IAAI,CAAC,CAAC;IACP,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;IACtD,CAAC,IAAI,SAAS,CAAC;IACf,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAA2B,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAA2B,CAAC;IACxD,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,YAAY;QACZ,qBAAqB,EAAE,kBAAkB,CAAC,YAAY,CAAC;QACvD,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACzB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACzB,MAAM;QACN,SAAS;QACT,0BAA0B,EAAE,MAAM;QAClC,eAAe,EAAE,MAAM;QACvB,gBAAgB,EAAE,MAAM;KACzB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAChG,wGAAwG;AACxG,wGAAwG;AACxG,yGAAyG;AAEzG,wEAAwE;AAExE,SAAS,aAAa,CAAC,CAAa;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAa;IACvC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,SAAS,CAAC,QAAoB,EAAE,MAAkB;IACzD,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAgBD,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,CAAC,YAAY,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,CAAU,EAAE,GAAY;IACtC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;QACpE,GAAG,EAAE,CAAC;KACP,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAEzB,SAAS,SAAS,CAAC,CAAkC;QACnD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,IAAI,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjC,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,CAAC;gBACJ,OAAO,GAAsB,CAAC;YAChC,KAAK,CAAC;gBACJ,OAAO,OAAO,GAAG,KAAK,QAAQ;oBAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;oBACb,CAAC,CAAC,CAAE,GAAc,GAAG,CAAC,CAAC;YAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAG,IAAI,UAAU,CACtB,CAAC,CAAC,IAAI,CAAC,MAAM,EACb,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,EACzB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;gBACF,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAG,IAAI,UAAU,CACtB,CAAC,CAAC,IAAI,CAAC,MAAM,EACb,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,GAAG,EACzB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;gBACF,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,GAAG,GAAgB,EAAE,CAAC;gBAC5B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;oBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,GAAG,CAAC;YACb,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,CAAC;gBACP,MAAM,CAAC,GAAY,IAAI,GAAG,EAAE,CAAC;gBAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAY,CAAC;oBAClC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;oBACvB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,KAAK,CAAC;gBACJ,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAC/B,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,IAAI,KAAK,KAAK,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D;gBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CACjB,CAAkC,EAClC,KAAa;QAEb,IAAI,KAAK,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC"}
|
package/dist/methods/siwe.d.ts
CHANGED
|
@@ -46,10 +46,10 @@ export interface SiweVerifyError {
|
|
|
46
46
|
* (e.g. `UniversalSignatureValidator`) without re-implementing the SIWE
|
|
47
47
|
* field validation.
|
|
48
48
|
*/
|
|
49
|
-
export declare function parseAndValidate(message: string, opts
|
|
49
|
+
export declare function parseAndValidate(message: string, opts: {
|
|
50
50
|
now?: () => number;
|
|
51
51
|
allowedDomains?: string[];
|
|
52
|
-
expectedNonce
|
|
52
|
+
expectedNonce: string;
|
|
53
53
|
}): {
|
|
54
54
|
ok: true;
|
|
55
55
|
parsed: SiweParsed;
|
|
@@ -70,10 +70,10 @@ export declare function verifyOnchain(message: string, signature: Hex, signature
|
|
|
70
70
|
signer: Address;
|
|
71
71
|
hash: Hex;
|
|
72
72
|
signature: Hex;
|
|
73
|
-
}) => Promise<boolean>, opts
|
|
73
|
+
}) => Promise<boolean>, opts: {
|
|
74
74
|
now?: () => number;
|
|
75
75
|
allowedDomains?: string[];
|
|
76
|
-
expectedNonce
|
|
76
|
+
expectedNonce: string;
|
|
77
77
|
}): Promise<SiweVerifyResult | SiweVerifyError>;
|
|
78
78
|
/**
|
|
79
79
|
* Legacy ECDSA-only SIWE verifier. Recovers the signer address from the
|
|
@@ -84,9 +84,9 @@ export declare function verifyOnchain(message: string, signature: Hex, signature
|
|
|
84
84
|
* (passkey, multisig, etc.) signers. Kept here for backward compat with
|
|
85
85
|
* the existing `verify` tests and the EOA-only siwe verifier path.
|
|
86
86
|
*/
|
|
87
|
-
export declare function verify(message: string, signature: Hex, opts
|
|
87
|
+
export declare function verify(message: string, signature: Hex, opts: {
|
|
88
88
|
now?: () => number;
|
|
89
89
|
allowedDomains?: string[];
|
|
90
|
-
expectedNonce
|
|
90
|
+
expectedNonce: string;
|
|
91
91
|
}): SiweVerifyResult | SiweVerifyError;
|
|
92
92
|
//# sourceMappingURL=siwe.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"siwe.d.ts","sourceRoot":"","sources":["../../src/methods/siwe.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAoB5D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CA6CrD;AA0BD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB;AACD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,
|
|
1
|
+
{"version":3,"file":"siwe.d.ts","sourceRoot":"","sources":["../../src/methods/siwe.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAoB5D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CA6CrD;AA0BD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB;AACD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,eAAe,CAkCxE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,GAAG,EACd,iBAAiB,EAAE,CAAC,IAAI,EAAE;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,GAAG,CAAC;CAChB,KAAK,OAAO,CAAC,OAAO,CAAC,EAEtB,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,gBAAgB,GAAG,eAAe,CAAC,CAsB7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CACpB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,GAAG,EAEd,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC7E,gBAAgB,GAAG,eAAe,CAcpC"}
|
package/dist/methods/siwe.js
CHANGED
|
@@ -3,8 +3,8 @@
|
|
|
3
3
|
// Build is a string template. Verify parses the message, computes EIP-191
|
|
4
4
|
// digest, recovers signer address, and asserts it matches the address in
|
|
5
5
|
// the message.
|
|
6
|
-
import { secp256k1 } from '@noble/curves/secp256k1';
|
|
7
|
-
import { keccak_256 } from '@noble/hashes/sha3';
|
|
6
|
+
import { secp256k1 } from '@noble/curves/secp256k1.js';
|
|
7
|
+
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
8
8
|
/** Build an EIP-4361 message string from structured input. */
|
|
9
9
|
export function buildMessage(input) {
|
|
10
10
|
const issuedAt = input.issuedAt ?? new Date().toISOString();
|
|
@@ -98,7 +98,7 @@ function recoverAddress(digest, sigHex) {
|
|
|
98
98
|
const v = parseInt(sig.slice(128, 130), 16);
|
|
99
99
|
const recovery = v >= 27 ? v - 27 : v;
|
|
100
100
|
const signature = new secp256k1.Signature(r, s).addRecoveryBit(recovery);
|
|
101
|
-
const pub = signature.recoverPublicKey(digest).
|
|
101
|
+
const pub = signature.recoverPublicKey(digest).toBytes(false);
|
|
102
102
|
const hash = keccak_256(pub.slice(1));
|
|
103
103
|
let hex = '0x';
|
|
104
104
|
for (const b of hash.slice(12))
|
|
@@ -115,6 +115,12 @@ function recoverAddress(digest, sigHex) {
|
|
|
115
115
|
* field validation.
|
|
116
116
|
*/
|
|
117
117
|
export function parseAndValidate(message, opts) {
|
|
118
|
+
// CA-001 (audit 2026-06-09): the nonce is REQUIRED. Replay protection is void without it — a
|
|
119
|
+
// captured signature would replay for the message's whole validity window. The caller issues a
|
|
120
|
+
// one-shot nonce and consumes it from its own store (this package is stateless by design).
|
|
121
|
+
if (typeof opts?.expectedNonce !== 'string' || opts.expectedNonce.length === 0) {
|
|
122
|
+
return { ok: false, reason: 'expectedNonce is required (CA-001)' };
|
|
123
|
+
}
|
|
118
124
|
let parsed;
|
|
119
125
|
try {
|
|
120
126
|
parsed = parseMessage(message);
|
|
@@ -124,10 +130,10 @@ export function parseAndValidate(message, opts) {
|
|
|
124
130
|
}
|
|
125
131
|
if (parsed.version !== '1')
|
|
126
132
|
return { ok: false, reason: 'SIWE version not 1' };
|
|
127
|
-
if (opts
|
|
133
|
+
if (opts.allowedDomains && !opts.allowedDomains.includes(parsed.domain)) {
|
|
128
134
|
return { ok: false, reason: `domain "${parsed.domain}" not allowed` };
|
|
129
135
|
}
|
|
130
|
-
if (opts
|
|
136
|
+
if (opts.expectedNonce !== parsed.nonce) {
|
|
131
137
|
return { ok: false, reason: 'nonce mismatch' };
|
|
132
138
|
}
|
|
133
139
|
const nowMs = (opts?.now ?? Date.now)();
|
|
@@ -155,7 +161,9 @@ export function parseAndValidate(message, opts) {
|
|
|
155
161
|
* supporting EOA-owned, passkey-owned, and counterfactual accounts
|
|
156
162
|
* without the caller branching on signer type.
|
|
157
163
|
*/
|
|
158
|
-
export async function verifyOnchain(message, signature, signatureVerifier,
|
|
164
|
+
export async function verifyOnchain(message, signature, signatureVerifier,
|
|
165
|
+
// CA-001: `expectedNonce` is required (single-use, caller-consumed).
|
|
166
|
+
opts) {
|
|
159
167
|
const pre = parseAndValidate(message, opts);
|
|
160
168
|
if (!pre.ok)
|
|
161
169
|
return pre;
|
|
@@ -188,7 +196,9 @@ export async function verifyOnchain(message, signature, signatureVerifier, opts)
|
|
|
188
196
|
* (passkey, multisig, etc.) signers. Kept here for backward compat with
|
|
189
197
|
* the existing `verify` tests and the EOA-only siwe verifier path.
|
|
190
198
|
*/
|
|
191
|
-
export function verify(message, signature,
|
|
199
|
+
export function verify(message, signature,
|
|
200
|
+
// CA-001: `expectedNonce` is required (single-use, caller-consumed).
|
|
201
|
+
opts) {
|
|
192
202
|
const pre = parseAndValidate(message, opts);
|
|
193
203
|
if (!pre.ok)
|
|
194
204
|
return pre;
|
package/dist/methods/siwe.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"siwe.js","sourceRoot":"","sources":["../../src/methods/siwe.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,eAAe;AAEf,OAAO,EAAE,SAAS,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"siwe.js","sourceRoot":"","sources":["../../src/methods/siwe.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,eAAe;AAEf,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA0BnD,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,KAAuB;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAa;QACtB,GAAG,KAAK,CAAC,MAAM,mDAAmD;QAClE,KAAK,CAAC,OAAO;QACb,EAAE;KACH,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/F,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAY,CAAC;IACpC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3F,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAErF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,8DAA8D;IAC9D,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC7B,CAAC,EAAE,CAAC;QACJ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvF,CAAC,EAAE,CAAC;IACN,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAChF,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1D,cAAc,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS;QACT,GAAG,EAAE,MAAM,CAAC,GAAI;QAChB,OAAO,EAAE,MAAM,CAAC,OAAQ;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAM;QACpB,QAAQ,EAAE,MAAM,CAAC,QAAS;QAC1B,cAAc;KACf,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,MAAkB,EAAE,MAAW;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,GAAc,CAAC;AACxB,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,IAA8E;IAE9E,6FAA6F;IAC7F,+FAA+F;IAC/F,2FAA2F;IAC3F,IAAI,OAAO,IAAI,EAAE,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE/E,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC,MAAM,eAAe,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC/E,IAAI,MAAM,GAAG,KAAK,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAEvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,SAAc,EACd,iBAIsB;AACtB,qEAAqE;AACrE,IAA8E;IAE9E,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,gDAAgD;IAChD,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;QAAE,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEzE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,iBAAiB,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;YAC1B,IAAI,EAAE,SAAgB;YACtB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CACpB,OAAe,EACf,SAAc;AACd,qEAAqE;AACrE,IAA8E;IAE9E,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACvE,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
import { YOUVERSION_OIDC, oidcFacetId, type BeginLoginInput, type BeginLoginResult, type CompleteLoginInput, type CompleteLoginResult, type OidcPrincipal, type OidcTokens } from './google';
|
|
2
|
+
export { oidcFacetId, YOUVERSION_OIDC };
|
|
3
|
+
export type { BeginLoginResult, CompleteLoginResult, OidcPrincipal, OidcTokens };
|
|
4
|
+
/** Start the YouVersion login — forces the YouVersion provider config. */
|
|
5
|
+
export declare function beginLogin(input: Omit<BeginLoginInput, 'config'>): BeginLoginResult;
|
|
6
|
+
/** Complete the YouVersion login: public PKCE (no `client_secret`), no `email_verified` requirement, and
|
|
7
|
+
* no `nonce` requirement (YouVersion's multi-leg /authorize→/callback→/token flow doesn't round-trip the
|
|
8
|
+
* authorize nonce into the id_token; PKCE binds the exchange instead). */
|
|
9
|
+
export declare function completeLogin(input: Omit<CompleteLoginInput, 'config' | 'clientSecret' | 'requireEmailVerified' | 'requireNonce'>): Promise<CompleteLoginResult>;
|
|
10
|
+
//# sourceMappingURL=youversion.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"youversion.d.ts","sourceRoot":"","sources":["../../src/methods/youversion.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,UAAU,EAChB,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AAEjF,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,gBAAgB,CAEnF;AAED;;2EAE2E;AAC3E,wBAAgB,aAAa,CAC3B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,cAAc,GAAG,sBAAsB,GAAG,cAAc,CAAC,GACnG,OAAO,CAAC,mBAAmB,CAAC,CAE9B"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
// YouVersion Platform OIDC auth method — a thin binding over the generic OIDC implementation in
|
|
2
|
+
// `./google` (authorization-code + PKCE/S256 + state + nonce + RS256 id_token verification against the
|
|
3
|
+
// provider JWKS). YouVersion differs from Google in two ways, pre-set here so callers can't get them
|
|
4
|
+
// wrong: it is a PUBLIC PKCE client (NO client_secret) and it does not assert `email_verified`. The
|
|
5
|
+
// (iss, sub) facet model is identical. Endpoints: developers.youversion.com/sign-in-apis.
|
|
6
|
+
import { beginLogin as beginOidcLogin, completeLogin as completeOidcLogin, YOUVERSION_OIDC, oidcFacetId, } from './google';
|
|
7
|
+
export { oidcFacetId, YOUVERSION_OIDC };
|
|
8
|
+
/** Start the YouVersion login — forces the YouVersion provider config. */
|
|
9
|
+
export function beginLogin(input) {
|
|
10
|
+
return beginOidcLogin({ ...input, config: YOUVERSION_OIDC });
|
|
11
|
+
}
|
|
12
|
+
/** Complete the YouVersion login: public PKCE (no `client_secret`), no `email_verified` requirement, and
|
|
13
|
+
* no `nonce` requirement (YouVersion's multi-leg /authorize→/callback→/token flow doesn't round-trip the
|
|
14
|
+
* authorize nonce into the id_token; PKCE binds the exchange instead). */
|
|
15
|
+
export function completeLogin(input) {
|
|
16
|
+
return completeOidcLogin({ ...input, config: YOUVERSION_OIDC, requireEmailVerified: false, requireNonce: false });
|
|
17
|
+
}
|
|
18
|
+
//# sourceMappingURL=youversion.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"youversion.js","sourceRoot":"","sources":["../../src/methods/youversion.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,0FAA0F;AAC1F,OAAO,EACL,UAAU,IAAI,cAAc,EAC5B,aAAa,IAAI,iBAAiB,EAClC,eAAe,EACf,WAAW,GAOZ,MAAM,UAAU,CAAC;AAElB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;AAGxC,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,KAAsC;IAC/D,OAAO,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,KAAoG;IAEpG,OAAO,iBAAiB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;AACpH,CAAC"}
|
package/dist/salt.js
CHANGED
|
@@ -16,7 +16,7 @@
|
|
|
16
16
|
// the salt is still deterministic for the deployer (so address derivation
|
|
17
17
|
// stays reproducible), but external parties cannot enumerate addresses
|
|
18
18
|
// from emails alone.
|
|
19
|
-
import { keccak_256 } from '@noble/hashes/sha3';
|
|
19
|
+
import { keccak_256 } from '@noble/hashes/sha3.js';
|
|
20
20
|
function keccakHex(input) {
|
|
21
21
|
const hash = keccak_256(new TextEncoder().encode(input));
|
|
22
22
|
let hex = '0x';
|
package/dist/salt.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"salt.js","sourceRoot":"","sources":["../src/salt.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,qFAAqF;AACrF,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,gEAAgE;AAChE,2EAA2E;AAC3E,8CAA8C;AAC9C,4EAA4E;AAC5E,0DAA0D;AAC1D,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"salt.js","sourceRoot":"","sources":["../src/salt.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,qFAAqF;AACrF,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,gEAAgE;AAChE,2EAA2E;AAC3E,8CAA8C;AAC9C,4EAA4E;AAC5E,0DAA0D;AAC1D,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,QAAgB,EAChB,IAA6B;IAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC"}
|
package/dist/sessions.d.ts
CHANGED
|
@@ -2,14 +2,72 @@ import type { JwtClaims } from './types';
|
|
|
2
2
|
export declare const SESSION_COOKIE = "agentic-session";
|
|
3
3
|
export declare const SESSION_TTL_SECONDS = 86400;
|
|
4
4
|
/**
|
|
5
|
-
*
|
|
6
|
-
*
|
|
5
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
6
|
+
*
|
|
7
|
+
* Default clock-skew tolerance applied to `exp` (expiration) and `iat`
|
|
8
|
+
* (issued-at) checks. 30 s matches the OIDC reference + tolerates the
|
|
9
|
+
* typical cross-host NTP drift without opening a meaningful replay
|
|
10
|
+
* window. Override via `verifySession(..., { clockSkewSec })` when
|
|
11
|
+
* a deployment needs tighter or looser bounds.
|
|
7
12
|
*/
|
|
8
|
-
export declare
|
|
13
|
+
export declare const DEFAULT_SESSION_CLOCK_SKEW_SEC = 30;
|
|
14
|
+
export interface VerifySessionOpts {
|
|
15
|
+
/**
|
|
16
|
+
* Required for production deploys (R5.10 / P1-1). When provided,
|
|
17
|
+
* `claims.iss` MUST exactly match or the cookie is rejected. Prevents
|
|
18
|
+
* a sibling broker (same shape, different origin) from authenticating
|
|
19
|
+
* here. The production gate below throws if this is missing when
|
|
20
|
+
* `NODE_ENV=production` AND `developmentMode !== true`.
|
|
21
|
+
*/
|
|
22
|
+
expectedIss?: string;
|
|
23
|
+
/**
|
|
24
|
+
* Required for production deploys (R5.10 / P1-1). When provided,
|
|
25
|
+
* verifies `expectedAud` appears in `claims.aud` (which may be a
|
|
26
|
+
* string or string[] per RFC 7519 §4.1.3). Stops a session minted
|
|
27
|
+
* for relying app A from being replayed at relying app B even when
|
|
28
|
+
* they share the broker.
|
|
29
|
+
*/
|
|
30
|
+
expectedAud?: string;
|
|
31
|
+
/** Override default clock-skew tolerance (seconds). */
|
|
32
|
+
clockSkewSec?: number;
|
|
33
|
+
/**
|
|
34
|
+
* Opt out of the production gate (test code, dev-only flows). When
|
|
35
|
+
* unset, NODE_ENV=production triggers a throw if expectedIss/Aud are
|
|
36
|
+
* missing.
|
|
37
|
+
*/
|
|
38
|
+
developmentMode?: boolean;
|
|
39
|
+
}
|
|
9
40
|
/**
|
|
10
|
-
*
|
|
11
|
-
*
|
|
41
|
+
* Mint a JWT session cookie value from claims. Adds iat/exp + (if
|
|
42
|
+
* missing) sid automatically. Signs with the leftmost key in
|
|
43
|
+
* SESSION_JWT_SECRETS.
|
|
44
|
+
*
|
|
45
|
+
* R5.10 / PKG-CONNECT-AUTH-003 — `iss` + `aud` are required (no default).
|
|
46
|
+
* Pass the canonical broker URI as `iss` and the relying app's
|
|
47
|
+
* audience identifier(s) as `aud`. Without them the resulting session
|
|
48
|
+
* is unverifiable in production (see {@link verifySession}).
|
|
49
|
+
*/
|
|
50
|
+
export declare function mintSession(claims: Omit<JwtClaims, 'iat' | 'exp' | 'sid'> & {
|
|
51
|
+
sid?: string;
|
|
52
|
+
}): string;
|
|
53
|
+
/**
|
|
54
|
+
* Verify a JWT cookie value. Returns claims if valid, else null.
|
|
12
55
|
* Constant-time comparison; no info-leak on which key matched.
|
|
56
|
+
*
|
|
57
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1) — verifies:
|
|
58
|
+
* - HMAC signature against every kid in SESSION_JWT_SECRETS (rotation
|
|
59
|
+
* tolerant; constant-time)
|
|
60
|
+
* - `claims.exp + clockSkewSec >= now` (not expired)
|
|
61
|
+
* - `claims.iat - clockSkewSec <= now` (rejects future-iat tokens
|
|
62
|
+
* that could carry a wider replay window if a malicious mint server
|
|
63
|
+
* issued one)
|
|
64
|
+
* - `claims.iss === opts.expectedIss` when provided
|
|
65
|
+
* - `opts.expectedAud` ∈ `claims.aud` when provided (claims.aud may
|
|
66
|
+
* be a string or string[] per RFC 7519 §4.1.3)
|
|
67
|
+
*
|
|
68
|
+
* In `NODE_ENV=production` the helper THROWS if `expectedIss` /
|
|
69
|
+
* `expectedAud` are missing — they're required for any meaningful
|
|
70
|
+
* security boundary. Tests/dev opt out with `developmentMode: true`.
|
|
13
71
|
*/
|
|
14
|
-
export declare function verifySession(cookieValue: string): JwtClaims | null;
|
|
72
|
+
export declare function verifySession(cookieValue: string, opts?: VerifySessionOpts): JwtClaims | null;
|
|
15
73
|
//# sourceMappingURL=sessions.d.ts.map
|
package/dist/sessions.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAyE1C
|
|
1
|
+
{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAChD,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAyE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,KAAK,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,MAAM,CAgBR;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,iBAAiB,GACvB,SAAS,GAAG,IAAI,CAwFlB"}
|
package/dist/sessions.js
CHANGED
|
@@ -3,8 +3,8 @@
|
|
|
3
3
|
// Cookie value is a JWT: base64url(header).base64url(payload).base64url(hmac).
|
|
4
4
|
// Multiple signing secrets are supported via SESSION_JWT_SECRETS=kid:hex,kid:hex.
|
|
5
5
|
// The leftmost key signs; all keys can verify (rotation).
|
|
6
|
-
import { hmac } from '@noble/hashes/hmac';
|
|
7
|
-
import { sha256 } from '@noble/hashes/
|
|
6
|
+
import { hmac } from '@noble/hashes/hmac.js';
|
|
7
|
+
import { sha256 } from '@noble/hashes/sha2.js';
|
|
8
8
|
import { hexToBytes } from 'viem';
|
|
9
9
|
export const SESSION_COOKIE = 'agentic-session';
|
|
10
10
|
export const SESSION_TTL_SECONDS = 86_400; // 24h
|
|
@@ -76,14 +76,66 @@ function constantTimeEqual(a, b) {
|
|
|
76
76
|
return diff === 0;
|
|
77
77
|
}
|
|
78
78
|
/**
|
|
79
|
-
*
|
|
80
|
-
*
|
|
79
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
80
|
+
*
|
|
81
|
+
* Default clock-skew tolerance applied to `exp` (expiration) and `iat`
|
|
82
|
+
* (issued-at) checks. 30 s matches the OIDC reference + tolerates the
|
|
83
|
+
* typical cross-host NTP drift without opening a meaningful replay
|
|
84
|
+
* window. Override via `verifySession(..., { clockSkewSec })` when
|
|
85
|
+
* a deployment needs tighter or looser bounds.
|
|
86
|
+
*/
|
|
87
|
+
export const DEFAULT_SESSION_CLOCK_SKEW_SEC = 30;
|
|
88
|
+
function isProduction(opts) {
|
|
89
|
+
if (opts?.developmentMode === true)
|
|
90
|
+
return false;
|
|
91
|
+
try {
|
|
92
|
+
return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
|
|
93
|
+
}
|
|
94
|
+
catch {
|
|
95
|
+
/* SES / browsers may throw on process access */
|
|
96
|
+
return false;
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
function randomSid() {
|
|
100
|
+
// 128 bits is the canonical OAuth `state` / OIDC `nonce` size.
|
|
101
|
+
// Worker / Node 18+ / browsers all expose `crypto.getRandomValues`.
|
|
102
|
+
const bytes = new Uint8Array(16);
|
|
103
|
+
try {
|
|
104
|
+
crypto.getRandomValues(bytes);
|
|
105
|
+
}
|
|
106
|
+
catch {
|
|
107
|
+
// Fallback for environments without WebCrypto (vanishingly rare on
|
|
108
|
+
// the runtimes we support; Math.random is NOT a security boundary
|
|
109
|
+
// but the sid is one of multiple defense layers, so this is
|
|
110
|
+
// documentation-grade rather than load-bearing).
|
|
111
|
+
for (let i = 0; i < bytes.length; i++)
|
|
112
|
+
bytes[i] = Math.floor(Math.random() * 256);
|
|
113
|
+
}
|
|
114
|
+
let s = '';
|
|
115
|
+
for (const b of bytes)
|
|
116
|
+
s += b.toString(16).padStart(2, '0');
|
|
117
|
+
return s;
|
|
118
|
+
}
|
|
119
|
+
/**
|
|
120
|
+
* Mint a JWT session cookie value from claims. Adds iat/exp + (if
|
|
121
|
+
* missing) sid automatically. Signs with the leftmost key in
|
|
122
|
+
* SESSION_JWT_SECRETS.
|
|
123
|
+
*
|
|
124
|
+
* R5.10 / PKG-CONNECT-AUTH-003 — `iss` + `aud` are required (no default).
|
|
125
|
+
* Pass the canonical broker URI as `iss` and the relying app's
|
|
126
|
+
* audience identifier(s) as `aud`. Without them the resulting session
|
|
127
|
+
* is unverifiable in production (see {@link verifySession}).
|
|
81
128
|
*/
|
|
82
129
|
export function mintSession(claims) {
|
|
83
130
|
const keys = loadKeys();
|
|
84
131
|
const signer = keys[0];
|
|
85
132
|
const now = Math.floor(Date.now() / 1000);
|
|
86
|
-
const payload = {
|
|
133
|
+
const payload = {
|
|
134
|
+
...claims,
|
|
135
|
+
sid: claims.sid ?? randomSid(),
|
|
136
|
+
iat: now,
|
|
137
|
+
exp: now + SESSION_TTL_SECONDS,
|
|
138
|
+
};
|
|
87
139
|
const header = { ...JWT_HEADER, kid: signer.kid };
|
|
88
140
|
const headerEnc = base64urlEncode(JSON.stringify(header));
|
|
89
141
|
const payloadEnc = base64urlEncode(JSON.stringify(payload));
|
|
@@ -92,11 +144,39 @@ export function mintSession(claims) {
|
|
|
92
144
|
return `${signingInput}.${base64urlEncode(sig)}`;
|
|
93
145
|
}
|
|
94
146
|
/**
|
|
95
|
-
* Verify a JWT cookie value. Returns claims if valid
|
|
96
|
-
* Tries every kid in SESSION_JWT_SECRETS — rotation-safe.
|
|
147
|
+
* Verify a JWT cookie value. Returns claims if valid, else null.
|
|
97
148
|
* Constant-time comparison; no info-leak on which key matched.
|
|
149
|
+
*
|
|
150
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1) — verifies:
|
|
151
|
+
* - HMAC signature against every kid in SESSION_JWT_SECRETS (rotation
|
|
152
|
+
* tolerant; constant-time)
|
|
153
|
+
* - `claims.exp + clockSkewSec >= now` (not expired)
|
|
154
|
+
* - `claims.iat - clockSkewSec <= now` (rejects future-iat tokens
|
|
155
|
+
* that could carry a wider replay window if a malicious mint server
|
|
156
|
+
* issued one)
|
|
157
|
+
* - `claims.iss === opts.expectedIss` when provided
|
|
158
|
+
* - `opts.expectedAud` ∈ `claims.aud` when provided (claims.aud may
|
|
159
|
+
* be a string or string[] per RFC 7519 §4.1.3)
|
|
160
|
+
*
|
|
161
|
+
* In `NODE_ENV=production` the helper THROWS if `expectedIss` /
|
|
162
|
+
* `expectedAud` are missing — they're required for any meaningful
|
|
163
|
+
* security boundary. Tests/dev opt out with `developmentMode: true`.
|
|
98
164
|
*/
|
|
99
|
-
export function verifySession(cookieValue) {
|
|
165
|
+
export function verifySession(cookieValue, opts) {
|
|
166
|
+
if (isProduction(opts)) {
|
|
167
|
+
if (!opts?.expectedIss) {
|
|
168
|
+
throw new Error('[connect-auth] verifySession requires `expectedIss` in production. ' +
|
|
169
|
+
'Without it any session cookie minted by any broker passes the iss check, ' +
|
|
170
|
+
'defeating the R5.10 / P1-1 closure. Pass the canonical broker URI as ' +
|
|
171
|
+
'opts.expectedIss; for tests, pass `developmentMode: true`.');
|
|
172
|
+
}
|
|
173
|
+
if (!opts?.expectedAud) {
|
|
174
|
+
throw new Error('[connect-auth] verifySession requires `expectedAud` in production. ' +
|
|
175
|
+
'Without it a session minted for relying app A can be replayed at ' +
|
|
176
|
+
'relying app B even when they share the broker. Pass the relying app ' +
|
|
177
|
+
'audience id as opts.expectedAud; for tests, pass `developmentMode: true`.');
|
|
178
|
+
}
|
|
179
|
+
}
|
|
100
180
|
if (!cookieValue)
|
|
101
181
|
return null;
|
|
102
182
|
const parts = cookieValue.split('.');
|
|
@@ -136,8 +216,36 @@ export function verifySession(cookieValue) {
|
|
|
136
216
|
if (!ok)
|
|
137
217
|
return null;
|
|
138
218
|
const now = Math.floor(Date.now() / 1000);
|
|
139
|
-
|
|
219
|
+
const skew = opts?.clockSkewSec ?? DEFAULT_SESSION_CLOCK_SKEW_SEC;
|
|
220
|
+
// Expiration check with skew (canonical RFC 7519 §4.1.4).
|
|
221
|
+
if (typeof claims.exp !== 'number' || claims.exp + skew < now)
|
|
140
222
|
return null;
|
|
223
|
+
// R5.10: future-iat reject (defends against a misconfigured /
|
|
224
|
+
// malicious mint server emitting tokens with iat well in the future,
|
|
225
|
+
// which would otherwise outlive the TTL window).
|
|
226
|
+
if (typeof claims.iat !== 'number' || claims.iat - skew > now)
|
|
227
|
+
return null;
|
|
228
|
+
// R5.10: iss binding (when expected).
|
|
229
|
+
if (opts?.expectedIss !== undefined) {
|
|
230
|
+
if (typeof claims.iss !== 'string' || claims.iss !== opts.expectedIss)
|
|
231
|
+
return null;
|
|
232
|
+
}
|
|
233
|
+
// R5.10: aud binding (when expected). claims.aud may be a string or
|
|
234
|
+
// a string[]; expectedAud must appear (RFC 7519 §4.1.3).
|
|
235
|
+
if (opts?.expectedAud !== undefined) {
|
|
236
|
+
const aud = claims.aud;
|
|
237
|
+
if (typeof aud === 'string') {
|
|
238
|
+
if (aud !== opts.expectedAud)
|
|
239
|
+
return null;
|
|
240
|
+
}
|
|
241
|
+
else if (Array.isArray(aud)) {
|
|
242
|
+
if (!aud.includes(opts.expectedAud))
|
|
243
|
+
return null;
|
|
244
|
+
}
|
|
245
|
+
else {
|
|
246
|
+
return null;
|
|
247
|
+
}
|
|
248
|
+
}
|
|
141
249
|
return claims;
|
|
142
250
|
}
|
|
143
251
|
//# sourceMappingURL=sessions.js.map
|
package/dist/sessions.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,0DAA0D;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,0DAA0D;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAGlC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,MAAM;AAEjD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAOhD,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,wBAAwB,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAoB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,+BAA+B,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjF,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,sCAAsC;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,0DAA0D;QAC1D,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AA6BjD,SAAS,YAAY,CAAC,IAAwB;IAC5C,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,+DAA+D;IAC/D,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,kEAAkE;QAClE,4DAA4D;QAC5D,iDAAiD;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,MAAiE;IAEjE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAc;QACzB,GAAG,MAAM;QACT,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE;QAC9B,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,mBAAmB;KAC/B,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,IAAwB;IAExB,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,2EAA2E;gBAC3E,uEAAuE;gBACvE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,mEAAmE;gBACnE,sEAAsE;gBACtE,2EAA2E,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/H,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,IAAI,iBAAiB,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC9C,EAAE,GAAG,IAAI,CAAC;YACV,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,EAAE,YAAY,IAAI,8BAA8B,CAAC;IAElE,0DAA0D;IAC1D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3E,8DAA8D;IAC9D,qEAAqE;IACrE,iDAAiD;IACjD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAE3E,sCAAsC;IACtC,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IAED,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -11,6 +11,32 @@ export interface JwtClaims {
|
|
|
11
11
|
kind: 'session' | 'session-grant';
|
|
12
12
|
iat: number;
|
|
13
13
|
exp: number;
|
|
14
|
+
/**
|
|
15
|
+
* R5.10 / PKG-CONNECT-AUTH-003 (external audit P1-1).
|
|
16
|
+
*
|
|
17
|
+
* `iss` (issuer) — the origin / canonical URI of the Connect broker
|
|
18
|
+
* that minted this session. Verifiers MUST cross-check
|
|
19
|
+
* `claims.iss === expectedIss` to prevent a cookie minted by a
|
|
20
|
+
* different broker (or a malicious broker on a sibling origin) from
|
|
21
|
+
* authenticating against this app.
|
|
22
|
+
*
|
|
23
|
+
* `aud` (audience) — the relying app(s) this cookie is valid for.
|
|
24
|
+
* May be a single origin/URI or an array. Verifiers MUST cross-check
|
|
25
|
+
* `expectedAud` is in `claims.aud` so a session minted for app A
|
|
26
|
+
* cannot be replayed at app B even when both share the broker.
|
|
27
|
+
*
|
|
28
|
+
* `sid` (session id) — a high-entropy id for this specific session.
|
|
29
|
+
* Lets the broker revoke a single session (by adding `sid` to a
|
|
30
|
+
* revocation list) without invalidating all sessions for `sub`.
|
|
31
|
+
* Auto-generated by `mintSession` when not supplied by the caller.
|
|
32
|
+
*
|
|
33
|
+
* `nonce` — optional OIDC-style replay nonce, threaded through from
|
|
34
|
+
* an upstream authorize request when this cookie carries one.
|
|
35
|
+
*/
|
|
36
|
+
iss: string;
|
|
37
|
+
aud: string | string[];
|
|
38
|
+
sid: string;
|
|
39
|
+
nonce?: string;
|
|
14
40
|
}
|
|
15
41
|
export interface AuthenticatedUser {
|
|
16
42
|
id: string;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7B,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,SAAS,GAAG,eAAe,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,eAAe,CAAC;QACxB,KAAK,EAAE,cAAc,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,GAAG,CAAC;IACvB,cAAc,EAAE,GAAG,CAAC;IACpB,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,SAAU,SAAQ,MAAM;CAExC;AAED,MAAM,WAAW,SAAU,SAAQ,MAAM;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;CACxD"}
|