@aooth/auth 0.1.17 → 0.1.19

package/dist/authz.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
-const require_auth_code_store = require("./auth-code-store-B_m51OSB.cjs");
+const require_dynamic_client_store = require("./dynamic-client-store-DAStgv2j.cjs");
 let node_crypto = require("node:crypto");
 let jose = require("jose");
 //#region src/authz/authz-errors.ts
@@ -116,9 +116,14 @@ var RegisteredClientPolicy = class {
 			idToken,
 			accessToken: client.accessToken === true,
 			tokenPolicy: client.tokenPolicy ? structuredClone(client.tokenPolicy) : {},
+			...client.clientName !== void 0 && { clientName: client.clientName },
 			...scope !== void 0 && { scope }
 		};
 	}
+	/** Known-ness probe for `CompositeClientPolicy` dispatch (static registry, sync). */
+	hasClient(clientId) {
+		return this.clients.has(clientId);
+	}
 	authenticateClient(args) {
 		const client = this.requireClient(args.clientId);
 		if ((client.type ?? "public") !== "confidential") return;
@@ -162,29 +167,290 @@ function timingSafeEqualStr(a, b) {
 //#endregion
 //#region src/authz/composite-client-policy.ts
 /**
-* Runs Tier-1 and Tier-2 side by side, dispatching on the **presence of
-* `client_id`** (AUTH-SERVER.md §10): a request with a `client_id` is a
-* registered client, one without is a loopback CLI. The split is the safety
-* boundary — a registered client is routed only to {@link RegisteredClientPolicy}
-* (which enforces ITS redirect allowlist, so it cannot smuggle a loopback
-* redirect), and a no-`client_id` request is routed only to the loopback policy
-* (so it cannot claim to be a registered client). Each sub-policy still owns its
-* own redirect validation; this only picks which one runs.
+* Runs the tiers side by side, dispatching on the **presence and ownership of
+* `client_id`** (AUTH-SERVER.md §10, OAUTH.md R2): a request without a
+* `client_id` is a loopback CLI; one with a `client_id` belongs to the static
+* registry when it knows the id (`hasClient`), else to the dynamic policy. The
+* split is the safety boundary — each sub-policy still enforces ITS OWN
+* redirect allowlist (so a registered client cannot smuggle a loopback
+* redirect and a no-`client_id` request cannot claim to be registered), and
+* static-first dispatch means a dynamic registration can never shadow a static
+* client id. `authenticateClient` routes through the SAME picker: a dynamic
+* `client_id` must be authenticated by the dynamic policy (existence check,
+* PKCE binds), never rejected by the static registry that doesn't know it.
 */
 var CompositeClientPolicy = class {
 	loopback;
 	registered;
+	dynamic;
 	constructor(opts) {
+		if (!opts.registered && !opts.dynamic) throw new Error("CompositeClientPolicy requires at least one of `registered` / `dynamic` — with only loopback there is nothing to compose");
+		if (opts.registered && opts.dynamic && typeof opts.registered.hasClient !== "function") throw new Error("CompositeClientPolicy: `registered` must implement hasClient() when composed with `dynamic`");
 		this.loopback = opts.loopback;
 		this.registered = opts.registered;
+		this.dynamic = opts.dynamic;
 	}
 	resolveClient(args) {
-		return args.clientId ? this.registered.resolveClient(args) : this.loopback.resolveClient(args);
+		if (!args.clientId) return this.loopback.resolveClient(args);
+		const picked = this.pickForClientId(args.clientId);
+		return picked instanceof Promise ? picked.then((p) => p.resolveClient(args)) : picked.resolveClient(args);
 	}
 	authenticateClient(args) {
-		if (args.clientId) return this.registered.authenticateClient?.(args);
+		if (!args.clientId) return;
+		const picked = this.pickForClientId(args.clientId);
+		return picked instanceof Promise ? picked.then((p) => p.authenticateClient?.(args)) : picked.authenticateClient?.(args);
+	}
+	/**
+	* Ownership dispatch for a presented `client_id` — static registry first
+	* (when it knows the id), dynamic otherwise. Sync when the probe is sync
+	* (the static registry's is), preserving the callers' sync fast path.
+	*/
+	pickForClientId(clientId) {
+		if (!this.registered) return this.dynamic;
+		if (!this.dynamic) return this.registered;
+		const known = this.registered.hasClient(clientId);
+		return known instanceof Promise ? known.then((k) => k ? this.registered : this.dynamic) : known ? this.registered : this.dynamic;
+	}
+};
+//#endregion
+//#region src/authz/client-registration.ts
+/** A typed RFC 7591 registration failure; `message` becomes `error_description`. */
+var ClientRegistrationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "ClientRegistrationError";
+		this.code = code;
+	}
+};
+/** Grant/response types the v1 authorization server supports (auth-code + PKCE only). */
+const SUPPORTED_GRANT_TYPES = ["authorization_code"];
+const SUPPORTED_RESPONSE_TYPES = ["code"];
+/** RFC 6749 §3.3 scope-token charset: printable ASCII minus space, `"` and `\`. */
+const SCOPE_TOKEN_RE = /^[\x21\x23-\x5B\x5D-\x7E]+$/u;
+const DEFAULT_MAX_REDIRECT_URIS = 5;
+const DEFAULT_MAX_REDIRECT_URI_LENGTH = 512;
+const DEFAULT_MAX_CLIENT_NAME_LENGTH = 128;
+const DEFAULT_MAX_SCOPE_LENGTH = 256;
+/**
+* `client_name` is attacker-supplied text that ends up on the consent prompt.
+* Strip every control (Cc) and format (Cf) character — that kills CR/LF, the
+* Unicode bidi overrides (U+202A–202E, U+2066–2069) used to visually reverse
+* a name, and zero-width characters used to forge lookalikes — then trim and
+* cap. Rendering it as a TEXT node (never markup) is the consent form's job;
+* this is defense in depth, not the whole defense.
+*/
+function sanitizeClientName(name, maxLength) {
+	const cleaned = name.replace(/[\p{Cc}\p{Cf}]/gu, "").trim();
+	if (cleaned.length === 0) return void 0;
+	return cleaned.slice(0, maxLength);
+}
+function asStringArray(value, field) {
+	if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new ClientRegistrationError("invalid_client_metadata", `${field} must be an array of strings`);
+	return value;
+}
+/**
+* `true` when `uri` is an acceptable dynamic-client redirect target (OAUTH.md
+* R2): an `https://` URL with an explicit host (stored for EXACT matching — no
+* wildcards, no prefixes) or a loopback literal per the Tier-1 RFC 8252 rules.
+* Custom schemes are rejected in v1. A fragment is rejected outright (RFC 6749
+* §3.1.2: the redirection endpoint URI MUST NOT include a fragment component).
+*/
+function isAcceptableRedirectUri(uri) {
+	let url;
+	try {
+		url = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (url.hash !== "") return false;
+	if (isLoopbackRedirectUri(uri)) return true;
+	return url.protocol === "https:" && url.hostname !== "" && url.username === "" && url.password === "";
+}
+/**
+* Validate + normalize an RFC 7591 registration request body into a
+* {@link NewDynamicClient}, or THROW a {@link ClientRegistrationError}.
+*
+* Normalization is allowed by RFC 7591 §2 (the server MAY replace requested
+* metadata with its own values) and is load-bearing for real connectors:
+* `grant_types` / `response_types` are INTERSECTED with what the server
+* supports (a connector requesting `["authorization_code", "refresh_token"]`
+* registers with `["authorization_code"]` — the 201 echo of the narrowed set
+* is the contract) rather than rejected. `token_endpoint_auth_method` defaults
+* to `"none"` when absent (v1 is public-clients-only, so the RFC's
+* `client_secret_basic` default is unsupported), but an EXPLICIT non-`"none"`
+* ask is rejected — never silently downgrade a client that asked for a secret.
+* Unknown fields are ignored and never echoed.
+*/
+function validateClientRegistration(body, opts) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) throw new ClientRegistrationError("invalid_client_metadata", "registration request must be a JSON object");
+	const req = body;
+	const maxUris = opts?.maxRedirectUris ?? DEFAULT_MAX_REDIRECT_URIS;
+	const maxUriLength = opts?.maxRedirectUriLength ?? DEFAULT_MAX_REDIRECT_URI_LENGTH;
+	if (req.redirect_uris === void 0) throw new ClientRegistrationError("invalid_redirect_uri", "redirect_uris is required");
+	const redirectUris = [...new Set(asStringArray(req.redirect_uris, "redirect_uris"))];
+	if (redirectUris.length === 0) throw new ClientRegistrationError("invalid_redirect_uri", "redirect_uris must be non-empty");
+	if (redirectUris.length > maxUris) throw new ClientRegistrationError("invalid_redirect_uri", `redirect_uris accepts at most ${maxUris} entries`);
+	for (const uri of redirectUris) if (uri.length > maxUriLength || !isAcceptableRedirectUri(uri)) throw new ClientRegistrationError("invalid_redirect_uri", "each redirect_uri must be an https URL with an explicit host or a loopback literal, without a fragment");
+	if ((req.token_endpoint_auth_method ?? "none") !== "none") throw new ClientRegistrationError("invalid_client_metadata", "only token_endpoint_auth_method \"none\" is supported");
+	const grantTypes = req.grant_types === void 0 ? [...SUPPORTED_GRANT_TYPES] : asStringArray(req.grant_types, "grant_types").filter((g) => SUPPORTED_GRANT_TYPES.includes(g));
+	if (grantTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "grant_types must include authorization_code");
+	const responseTypes = req.response_types === void 0 ? [...SUPPORTED_RESPONSE_TYPES] : asStringArray(req.response_types, "response_types").filter((r) => SUPPORTED_RESPONSE_TYPES.includes(r));
+	if (responseTypes.length === 0) throw new ClientRegistrationError("invalid_client_metadata", "response_types must include code");
+	let clientName;
+	if (req.client_name !== void 0) {
+		if (typeof req.client_name !== "string") throw new ClientRegistrationError("invalid_client_metadata", "client_name must be a string");
+		clientName = sanitizeClientName(req.client_name, opts?.maxClientNameLength ?? DEFAULT_MAX_CLIENT_NAME_LENGTH);
+	}
+	let scope;
+	if (req.scope !== void 0) {
+		if (typeof req.scope !== "string") throw new ClientRegistrationError("invalid_client_metadata", "scope must be a string");
+		if (req.scope.length > (opts?.maxScopeLength ?? DEFAULT_MAX_SCOPE_LENGTH)) throw new ClientRegistrationError("invalid_client_metadata", "scope is too long");
+		const tokens = req.scope.split(/\s+/u).filter(Boolean);
+		if (tokens.some((t) => !SCOPE_TOKEN_RE.test(t))) throw new ClientRegistrationError("invalid_client_metadata", "scope contains invalid characters");
+		const kept = opts?.allowedScopes ? tokens.filter((t) => opts.allowedScopes.includes(t)) : tokens;
+		if (kept.length > 0) scope = kept.join(" ");
+	}
+	return {
+		redirectUris,
+		tokenEndpointAuthMethod: "none",
+		grantTypes,
+		responseTypes,
+		...clientName !== void 0 && { clientName },
+		...scope !== void 0 && { scope }
+	};
+}
+const DEFAULT_MAX_CLIENTS = 1e3;
+/**
+* The RFC 7591 registration operation behind `POST {issuer}/register`
+* (OAUTH.md R2): validate → guard → lazy GC of never-used rows → hard cap →
+* persist. Framework-free — `@aooth/auth-moost`'s controller endpoint is a
+* thin HTTP adapter over `register()`, and non-moost servers can call it
+* directly.
+*/
+var DynamicClientRegistration = class {
+	store;
+	maxClients;
+	unusedClientTtlMs;
+	guard;
+	validation;
+	clock;
+	constructor(opts) {
+		this.store = opts.store;
+		this.maxClients = opts.maxClients ?? DEFAULT_MAX_CLIENTS;
+		this.unusedClientTtlMs = opts.unusedClientTtlMs;
+		this.guard = opts.guard;
+		this.validation = opts.validation;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+	}
+	/** Validate and persist a registration request body; returns the minted client. */
+	async register(body) {
+		const metadata = validateClientRegistration(body, this.validation);
+		await this.guard?.({ metadata });
+		if (this.unusedClientTtlMs !== void 0) await this.store.deleteUnusedBefore(this.clock.now() - this.unusedClientTtlMs);
+		if (await this.store.count() >= this.maxClients) throw new ClientRegistrationError("invalid_client_metadata", "registration limit reached");
+		return this.store.create(metadata);
+	}
+};
+//#endregion
+//#region src/authz/dynamic-client-policy.ts
+const DEFAULT_DYNAMIC_TOKEN_POLICY = {
+	kind: "dynamic-session",
+	ttl: 720 * 60 * 6e4
+};
+/**
+* Policy for RFC 7591 dynamically-registered public clients (OAUTH.md R2) on
+* the `ClientRedirectPolicy` seam. `resolveClient` authorizes the client +
+* `redirect_uri` against ITS registered allowlist and resolves the granted
+* scope + token policy; `authenticateClient` re-checks existence at `/token`
+* (`token_endpoint_auth_method: "none"` ⇒ no secret — PKCE is the binding, and
+* a registration garbage-collected mid-flight fails closed). Dynamic clients
+* receive an access token only — NO `id_token` in v1 (OAUTH.md R6).
+*
+* INVARIANT: the returned {@link ResolvedClient} always carries `clientId`, so
+* the minted code records it and the token endpoint's symmetric client binding
+* applies — a dynamic code redeemed without (or with another) `client_id` is
+* rejected exactly like a Tier-2 code.
+*/
+var DynamicClientPolicy = class {
+	store;
+	tokenPolicy;
+	allowedScopes;
+	clock;
+	constructor(opts) {
+		this.store = opts.store;
+		this.tokenPolicy = opts.tokenPolicy ?? DEFAULT_DYNAMIC_TOKEN_POLICY;
+		this.allowedScopes = opts.allowedScopes;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+	}
+	async resolveClient(args) {
+		const client = await this.requireClient(args.clientId);
+		if (!redirectAllowed(client, args.redirectUri)) throw new AuthorizeError("invalid_redirect", "redirect_uri is not registered for this client");
+		const scope = this.grantScope(client, args.scope);
+		try {
+			await this.store.touch(client.clientId, this.clock.now());
+		} catch {}
+		return {
+			clientId: client.clientId,
+			redirectUri: args.redirectUri,
+			accessToken: true,
+			tokenPolicy: structuredClone(this.tokenPolicy),
+			...client.clientName !== void 0 && { clientName: client.clientName },
+			...scope !== void 0 && { scope }
+		};
+	}
+	/**
+	* `/token`-side check: the client must still exist (fail closed when the
+	* registration was deleted/GC'd between authorize and redemption). No secret
+	* is checked — public client, PKCE is the binding; a spurious
+	* `client_secret` is ignored.
+	*/
+	async authenticateClient(args) {
+		await this.requireClient(args.clientId);
+	}
+	/** Known-ness probe for `CompositeClientPolicy` dispatch. */
+	async hasClient(clientId) {
+		return await this.store.get(clientId) !== null;
+	}
+	async requireClient(clientId) {
+		const client = clientId ? await this.store.get(clientId) : null;
+		if (!client) throw new AuthorizeError("invalid_client", "unknown client");
+		return client;
+	}
+	grantScope(client, requested) {
+		if (!requested) return void 0;
+		let granted = requested.split(/\s+/u).filter(Boolean);
+		if (this.allowedScopes) granted = granted.filter((s) => this.allowedScopes.includes(s));
+		if (client.scope !== void 0) {
+			const registered = new Set(client.scope.split(/\s+/u).filter(Boolean));
+			granted = granted.filter((s) => registered.has(s));
+		}
+		return granted.length > 0 ? granted.join(" ") : void 0;
 	}
 };
+/**
+* Exact match against the registered allowlist, with ONE relaxation: for a
+* loopback redirect the PORT is ignored (RFC 8252 §7.3 — native/CLI clients
+* bind an ephemeral port per run, so the AS MUST allow a variable port).
+* Scheme, host, path and query still must match a registered loopback entry
+* exactly; `https` entries never get the relaxation.
+*/
+function redirectAllowed(client, uri) {
+	if (client.redirectUris.includes(uri)) return true;
+	if (!isLoopbackRedirectUri(uri)) return false;
+	let presented;
+	try {
+		presented = new URL(uri);
+	} catch {
+		return false;
+	}
+	if (presented.hash !== "") return false;
+	return client.redirectUris.some((registered) => {
+		if (!isLoopbackRedirectUri(registered)) return false;
+		const reg = new URL(registered);
+		return reg.protocol === presented.protocol && reg.hostname === presented.hostname && reg.pathname === presented.pathname && reg.search === presented.search;
+	});
+}
 //#endregion
 //#region src/authz/id-token-signer.ts
 /**
@@ -253,17 +519,115 @@ var IdTokenSigner = class {
 	}
 };
 //#endregion
-exports.AuthCodeStore = require_auth_code_store.AuthCodeStore;
-exports.AuthCodeStoreMemory = require_auth_code_store.AuthCodeStoreMemory;
+//#region src/authz/server-metadata.ts
+/**
+* Strip a trailing slash from an issuer identifier. RFC 8414 mandates EXACT
+* (byte-identical) string comparison of issuer values, so every document that
+* spells the issuer must canonicalize it the same way — same rule as
+* `IdTokenSigner`. Shared by the AS metadata and protected-resource builders.
+*/
+function canonicalizeIssuer(issuer) {
+	return issuer.replace(/\/$/u, "");
+}
+/**
+* Build the RFC 8414 discovery document for this authorization server. Pure —
+* no I/O, no framework: mount the result on any HTTP stack (including the
+* RFC 8414 path-insertion form rooted at the HTTP origin,
+* `/.well-known/oauth-authorization-server/<issuer-path>`).
+*
+* Capability fields are fixed to what the server actually implements:
+* `response_types_supported` `["code"]`, `grant_types_supported`
+* `["authorization_code"]`, `code_challenge_methods_supported` `["S256"]`
+* (PKCE is mandatory — it is the binding for public clients). Optional fields
+* are omitted entirely (no `undefined` keys) so the serialized JSON carries
+* only what was configured.
+*/
+function buildAuthorizationServerMetadata(opts) {
+	const issuer = canonicalizeIssuer(opts.issuer);
+	const authMethods = opts.tokenEndpointAuthMethodsSupported ?? ["none", "client_secret_post"];
+	return {
+		issuer,
+		authorization_endpoint: opts.authorizationEndpoint ?? `${issuer}/authorize`,
+		token_endpoint: opts.tokenEndpoint ?? `${issuer}/token`,
+		...opts.registrationEndpoint !== void 0 && { registration_endpoint: opts.registrationEndpoint },
+		...opts.jwksUri !== void 0 && { jwks_uri: opts.jwksUri },
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: authMethods.includes("none") ? authMethods : ["none", ...authMethods],
+		...opts.scopesSupported !== void 0 && { scopes_supported: opts.scopesSupported }
+	};
+}
+//#endregion
+//#region src/authz/resource-metadata.ts
+/**
+* Build the RFC 9728 protected-resource document. Pure — no I/O, no framework;
+* mount it on any HTTP stack. Optional fields are omitted entirely (no
+* `undefined` keys) so the serialized JSON carries only what was configured.
+*/
+function buildProtectedResourceMetadata(opts) {
+	return {
+		resource: opts.resource,
+		authorization_servers: opts.authorizationServers.map((iss) => canonicalizeIssuer(iss)),
+		bearer_methods_supported: opts.bearerMethodsSupported ?? ["header"],
+		...opts.scopesSupported !== void 0 && { scopes_supported: opts.scopesSupported },
+		...opts.resourceName !== void 0 && { resource_name: opts.resourceName }
+	};
+}
+/**
+* Header-injection defense: challenge parameter values can carry
+* attacker-influenced input (an `error_description` echoing request data, a
+* scope from a token). A raw CR/LF would terminate the header and let that
+* input inject arbitrary response headers (response splitting), so CR/LF — and
+* every other C0 control char plus DEL — are STRIPPED outright. `\` and `"`
+* are then backslash-escaped per the RFC 7235 quoted-string grammar so a value
+* cannot close its quote and smuggle extra challenge params.
+*/
+function sanitizeQuotedStringValue(value) {
+	return value.replace(/[\u0000-\u001F\u007F]/gu, "").replace(/(["\\])/gu, "\\$1");
+}
+/**
+* Build the VALUE of an RFC 6750 `WWW-Authenticate` Bearer challenge, e.g.
+* `Bearer resource_metadata="https://...", error="invalid_token"`. With no
+* options (or all absent) it degrades to the bare scheme `Bearer`. Every
+* parameter is emitted as a quoted-string (RFC 6750 style) in a fixed order:
+* `realm`, `error`, `error_description`, `resource_metadata`, `scope`. All
+* values pass through {@link sanitizeQuotedStringValue} — see its security note.
+*/
+function buildWwwAuthenticateBearerChallenge(opts) {
+	const params = [];
+	const push = (name, value) => {
+		if (value !== void 0) params.push(`${name}="${sanitizeQuotedStringValue(value)}"`);
+	};
+	push("realm", opts?.realm);
+	push("error", opts?.error);
+	push("error_description", opts?.errorDescription);
+	push("resource_metadata", opts?.resourceMetadataUrl);
+	push("scope", opts?.scope);
+	return params.length === 0 ? "Bearer" : `Bearer ${params.join(", ")}`;
+}
+//#endregion
+exports.AuthCodeStore = require_dynamic_client_store.AuthCodeStore;
+exports.AuthCodeStoreMemory = require_dynamic_client_store.AuthCodeStoreMemory;
 exports.AuthorizeError = AuthorizeError;
+exports.ClientRegistrationError = ClientRegistrationError;
 exports.CompositeClientPolicy = CompositeClientPolicy;
-exports.DEFAULT_PENDING_TTL_MS = require_auth_code_store.DEFAULT_PENDING_TTL_MS;
+exports.DEFAULT_PENDING_TTL_MS = require_dynamic_client_store.DEFAULT_PENDING_TTL_MS;
+exports.DynamicClientPolicy = DynamicClientPolicy;
+exports.DynamicClientRegistration = DynamicClientRegistration;
+exports.DynamicClientStore = require_dynamic_client_store.DynamicClientStore;
+exports.DynamicClientStoreMemory = require_dynamic_client_store.DynamicClientStoreMemory;
 exports.IdTokenSigner = IdTokenSigner;
 exports.LoopbackClientPolicy = LoopbackClientPolicy;
 exports.NoopOidcClaimsResolver = NoopOidcClaimsResolver;
 exports.OidcClaimsResolver = OidcClaimsResolver;
-exports.PendingAuthorizationStore = require_auth_code_store.PendingAuthorizationStore;
-exports.PendingAuthorizationStoreMemory = require_auth_code_store.PendingAuthorizationStoreMemory;
+exports.PendingAuthorizationStore = require_dynamic_client_store.PendingAuthorizationStore;
+exports.PendingAuthorizationStoreMemory = require_dynamic_client_store.PendingAuthorizationStoreMemory;
 exports.RegisteredClientPolicy = RegisteredClientPolicy;
+exports.buildAuthorizationServerMetadata = buildAuthorizationServerMetadata;
+exports.buildProtectedResourceMetadata = buildProtectedResourceMetadata;
+exports.buildWwwAuthenticateBearerChallenge = buildWwwAuthenticateBearerChallenge;
+exports.canonicalizeIssuer = canonicalizeIssuer;
 exports.isLoopbackRedirectUri = isLoopbackRedirectUri;
 exports.scopeGrants = scopeGrants;
+exports.validateClientRegistration = validateClientRegistration;