@atlasauth/backend 0.15.0 → 0.16.0

package/dist/client/sso-connections.d.ts

@@ -1,5 +1,6 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
+import { type IdpInitiatedLoginSettings, type ProfileMapping, type ProfileMappingPreview, type ProfileMappingPreviewBody, type TokenEndpointAuthMethod, type UpstreamLogoutSettings, type UpstreamUrls } from './custom-oauth-providers';
 export interface ClaimRoleMapping {
     claim: string;
     value: string;
@@ -22,6 +23,21 @@ export interface SsoConnection {
     saml_allow_idp_initiated: boolean;
     saml_sign_authn_requests: boolean;
     saml_want_response_signed: boolean;
+    /** SAML Single Logout is on for the connection. */
+    saml_single_logout?: boolean;
+    /** The IdP SingleLogoutService Location / ResponseLocation and delivery binding. */
+    saml_idp_slo_url?: string | null;
+    saml_idp_slo_response_url?: string | null;
+    saml_idp_slo_binding?: 'redirect' | 'post';
+    /** The IdP SOAP SingleLogoutService — the back channel for sessions ended server-side. */
+    saml_idp_slo_soap_url?: string | null;
+    /** Assertions that are not encrypted to the connection's key are refused. */
+    saml_require_encrypted_assertions?: boolean;
+    /** An SP encryption key pair is set up (the private key is never returned). */
+    has_saml_encryption_key?: boolean;
+    /** A key rotation is in progress (the previous key is still accepted). */
+    has_previous_saml_encryption_key?: boolean;
+    saml_encryption_rotated_at?: number | null;
     has_discourse_secret: boolean;
     discourse_provider_url: string | null;
     allowed_domains: string[];
@@ -31,6 +47,14 @@ export interface SsoConnection {
     attribute_mapping?: SsoAttributeMapping;
     /** OIDC: extra scopes requested on top of openid email profile. */
     oidc_scopes?: string[];
+    /** OIDC relying-party settings (see custom OAuth providers). */
+    profile_mapping?: Required<ProfileMapping> | null;
+    token_endpoint_auth_method?: TokenEndpointAuthMethod | null;
+    client_assertion_audience?: string | null;
+    logout?: Required<UpstreamLogoutSettings>;
+    idp_initiated_login?: Required<IdpInitiatedLoginSettings>;
+    /** OIDC connections: the URLs to register at the IdP. */
+    upstream_urls?: UpstreamUrls | null;
     /** Routing domains of an org-owned connection that the org has not verified. */
     domain_warnings?: Array<{
         domain: string;
@@ -43,9 +67,23 @@ export interface SamlMetadata {
     object: 'sso_saml_metadata';
     sp_entity_id: string;
     acs_url: string;
+    /** Our SingleLogoutService URL (both bindings), when Single Logout is on. */
+    slo_url?: string | null;
     /** The SP EntityDescriptor XML, carried as a string inside this JSON envelope. */
     metadata_xml: string;
 }
+/** A SAML connection's SP encryption key pair — certificates only. */
+export interface SamlEncryptionKey {
+    object: 'sso_saml_encryption_key';
+    connection_id: string;
+    /** The current certificate (PEM), published in SP metadata; null when encryption is off. */
+    certificate: string | null;
+    /** The previous certificate during a rotation; null otherwise. */
+    previous_certificate: string | null;
+    /** When the current key was installed (epoch ms). */
+    rotated_at: number | null;
+    require_encrypted_assertions: boolean;
+}
 export interface CreateSsoConnectionBody {
     organization_id?: string | null;
     type?: 'oidc' | 'saml' | 'discourse' | 'discourse_consumer';
@@ -62,6 +100,16 @@ export interface CreateSsoConnectionBody {
     saml_allow_idp_initiated?: boolean;
     saml_sign_authn_requests?: boolean;
     saml_want_response_signed?: boolean;
+    /** SAML Single Logout on/off. */
+    saml_single_logout?: boolean;
+    /** https; null clears it. Filled by IdP metadata import when published. */
+    saml_idp_slo_url?: string | null;
+    saml_idp_slo_response_url?: string | null;
+    saml_idp_slo_binding?: 'redirect' | 'post' | null;
+    /** https; null clears it. The back channel for sessions ended server-side. */
+    saml_idp_slo_soap_url?: string | null;
+    /** Requires an encryption key (see `createSamlEncryptionKey`). */
+    saml_require_encrypted_assertions?: boolean;
     discourse_secret?: string;
     discourse_provider_url?: string;
     allowed_domains?: string[];
@@ -71,6 +119,15 @@ export interface CreateSsoConnectionBody {
     attribute_mapping?: SsoAttributeMapping | null;
     /** OIDC only; null clears them. */
     oidc_scopes?: string[] | null;
+    /** OIDC: declarative profile mapping; null clears it. */
+    profile_mapping?: ProfileMapping | null;
+    /** OIDC: token-endpoint client authentication (private_key_jwt needs no secret). */
+    token_endpoint_auth_method?: TokenEndpointAuthMethod | null;
+    client_assertion_audience?: string | null;
+    /** OIDC: RP-initiated and back-channel logout. */
+    logout?: UpstreamLogoutSettings | null;
+    /** OIDC: third-party initiated login. */
+    idp_initiated_login?: IdpInitiatedLoginSettings | null;
 }
 /** Claim (OIDC) or attribute (SAML) names for each profile field. */
 export interface SsoAttributeMapping {
@@ -93,6 +150,32 @@ export declare function ssoConnectionsResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** OIDC: run the connection's profile mapping (or the body's) against a pasted sample. */
+    previewProfileMapping(id: string, body: ProfileMappingPreviewBody): Promise<ProfileMappingPreview>;
+    /** OIDC: the connection's private_key_jwt signing keys. */
+    signingKeys(id: string): {
+        list(): Promise<ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+        rotate(body?: {
+            alg?: "RS256" | "PS256" | "ES256";
+        }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+        retire(kid: string): Promise<{
+            object: "upstream_signing_key";
+            kid: string;
+            status: "retired";
+        }>;
+    };
     /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
     samlMetadata(id: string): Promise<SamlMetadata>;
+    /** The SAML connection's SP encryption certificate(s). */
+    getSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
+    /**
+     * Generate the SP encryption key pair, or ROTATE it when one exists: the
+     * current pair becomes the previous one (still advertised and accepted until
+     * {@link retirePreviousSamlEncryptionKey}).
+     */
+    createSamlEncryptionKey(id: string, idempotencyKey?: string): Promise<SamlEncryptionKey>;
+    /** Finish a rotation: stop accepting the previous encryption key. */
+    retirePreviousSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
+    /** Turn assertion encryption off (refused while encrypted assertions are required). */
+    deleteSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
 };

package/dist/client/sso-connections.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ssoConnectionsResource = ssoConnectionsResource;
 const request_1 = require("./request");
+const custom_oauth_providers_1 = require("./custom-oauth-providers");
 function ssoConnectionsResource(request) {
     return {
         list() {
@@ -19,10 +20,38 @@ function ssoConnectionsResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}` });
         },
+        /** OIDC: run the connection's profile mapping (or the body's) against a pasted sample. */
+        previewProfileMapping(id, body) {
+            return request({ method: 'POST', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/profile_mapping/preview`, body });
+        },
+        /** OIDC: the connection's private_key_jwt signing keys. */
+        signingKeys(id) {
+            return (0, custom_oauth_providers_1.upstreamSigningKeys)(request, `/v1/sso_connections/${(0, request_1.enc)(id)}`);
+        },
         /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
         samlMetadata(id) {
             return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_metadata` });
         },
+        /** The SAML connection's SP encryption certificate(s). */
+        getSamlEncryptionKey(id) {
+            return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key` });
+        },
+        /**
+         * Generate the SP encryption key pair, or ROTATE it when one exists: the
+         * current pair becomes the previous one (still advertised and accepted until
+         * {@link retirePreviousSamlEncryptionKey}).
+         */
+        createSamlEncryptionKey(id, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key`, idempotencyKey });
+        },
+        /** Finish a rotation: stop accepting the previous encryption key. */
+        retirePreviousSamlEncryptionKey(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key/previous` });
+        },
+        /** Turn assertion encryption off (refused while encrypted assertions are required). */
+        deleteSamlEncryptionKey(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key` });
+        },
     };
 }
 //# sourceMappingURL=sso-connections.js.map

package/dist/client/sso-connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAyFA,wDAsBC;AA/GD,uCAAgD;AAyFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AA4JA,wDAkDC;AA9MD,uCAAgD;AAEhD,qEASkC;AAiJlC,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0FAA0F;QAC1F,qBAAqB,CAAC,EAAU,EAAE,IAA+B;YAC/D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,2DAA2D;QAC3D,WAAW,CAAC,EAAU;YACpB,OAAO,IAAA,4CAAmB,EAAC,OAAO,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,0DAA0D;QAC1D,oBAAoB,CAAC,EAAU;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;;WAIG;QACH,uBAAuB,CAAC,EAAU,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,cAAc,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,qEAAqE;QACrE,+BAA+B,CAAC,EAAU;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,uFAAuF;QACvF,uBAAuB,CAAC,EAAU;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidc
 export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './referrals';
+export * from './botid';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';
 export * from './client';
@@ -20,5 +21,5 @@ export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
 export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
-export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
-export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopReplayStore, ResourceRequestLike, } from './oauth-resource';
+export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
+export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -51,6 +51,8 @@ Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: funct
 __exportStar(require("./webhooks"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
+// Vercel BotID: sign checkBotId() verdicts on your Vercel route for Atlas's captcha gate.
+__exportStar(require("./botid"), exports);
 // The typed management client for the secret-key Backend API.
 var client_1 = require("./client");
 Object.defineProperty(exports, "createAtlasClient", { enumerable: true, get: function () { return client_1.createAtlasClient; } });
@@ -83,6 +85,9 @@ Object.defineProperty(exports, "ACCESS_TOKEN_CLOCK_SKEW_SECONDS", { enumerable:
 Object.defineProperty(exports, "DPOP_PROOF_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.DPOP_PROOF_MAX_AGE_SECONDS; } });
 Object.defineProperty(exports, "buildWwwAuthenticate", { enumerable: true, get: function () { return oauth_resource_1.buildWwwAuthenticate; } });
 Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return oauth_resource_1.createAccessTokenVerifier; } });
+Object.defineProperty(exports, "createIntrospector", { enumerable: true, get: function () { return oauth_resource_1.createIntrospector; } });
+Object.defineProperty(exports, "hmacDpopNonceSource", { enumerable: true, get: function () { return oauth_resource_1.hmacDpopNonceSource; } });
+Object.defineProperty(exports, "memoryDpopNonceSource", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopNonceSource; } });
 Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopReplayStore; } });
 Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
 Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAS0B;AARxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/oauth-resource.d.ts

@@ -16,6 +16,10 @@ import { type Jwks } from './jwks-cache';
  *    which is exactly what an MCP client needs to discover how to sign in;
  *  - builds the RFC 9728 protected-resource metadata document to serve at
  *    `/.well-known/oauth-protected-resource` on your API's host.
+ *  - accepts OPAQUE access tokens too (an API, client or instance set to the
+ *    `opaque` format): with `introspection` configured, a token that is not a
+ *    JWT is validated at Atlas's introspection endpoint (RFC 7662) with your
+ *    API's own client credentials, and the answer is cached briefly;
  * Framework-agnostic: hand it any request with `method`, `url` and `headers`.
  */
 /** Clock skew tolerated on `exp`/`nbf` and on DPoP proof `iat`. */
@@ -52,6 +56,37 @@ export interface DpopReplayStore {
     /** Record `jti` until `expiresAt` (ms); return false when it was already seen. */
     claim(jti: string, expiresAt: number): Promise<boolean> | boolean;
 }
+/**
+ * Server-provided DPoP nonces (RFC 9449 §8). `current()` is the nonce the API
+ * hands out in the `DPoP-Nonce` response header; `valid()` accepts the nonces
+ * still in force. A verifier given a source requires every DPoP proof to carry
+ * one, answering `use_dpop_nonce` (with a fresh nonce) otherwise.
+ */
+export interface DpopNonceSource {
+    current(): string | Promise<string>;
+    valid(nonce: string): boolean | Promise<boolean>;
+}
+/**
+ * An in-process nonce source: a random nonce per window; the current and the
+ * previous window's nonce are accepted. Use it when one process serves the API
+ * (or with sticky routing); behind several processes, use
+ * {@link hmacDpopNonceSource} with a shared secret.
+ */
+export declare function memoryDpopNonceSource(options?: {
+    windowSeconds?: number;
+    now?: () => number;
+}): DpopNonceSource;
+/**
+ * A stateless nonce source shared by every process holding the same secret (at
+ * least 32 bytes): the nonce for a window is base64url(HMAC-SHA256(secret,
+ * "atlas-dpop-nonce:" ‖ uint64-BE(window number))). A nonce is good in the window
+ * it was issued in and the next one. The derivation is the same in every Atlas
+ * server SDK, so services in different languages sharing the secret agree.
+ */
+export declare function hmacDpopNonceSource(secret: string | Uint8Array, options?: {
+    windowSeconds?: number;
+    now?: () => number;
+}): DpopNonceSource;
 export declare function memoryDpopReplayStore(max?: number): DpopReplayStore;
 export interface AccessTokenVerifierOptions {
     /** Your Atlas instance's issuer (frontend API origin), e.g. https://clerk.example.com. */
@@ -79,12 +114,53 @@ export interface AccessTokenVerifierOptions {
     /** The public origin of this API, for DPoP `htu` when `request.url` is a path. */
     publicOrigin?: string;
     dpopReplayStore?: DpopReplayStore;
+    /**
+     * Require a server-provided nonce in every DPoP proof (RFC 9449 §8). A proof
+     * without a valid one is refused with `use_dpop_nonce`; every result carries
+     * `dpopNonce`, to send as the `DPoP-Nonce` response header (the framework
+     * adapters do). See {@link memoryDpopNonceSource} / {@link hmacDpopNonceSource}.
+     */
+    dpopNonces?: DpopNonceSource;
     /** `WWW-Authenticate` realm. */
     realm?: string;
+    /**
+     * Validate opaque access tokens (and, with `introspectJwts`, JWTs too) at
+     * Atlas's introspection endpoint. The client must be a confidential client
+     * your API lists in its `introspection_client_ids` (or the client the tokens
+     * are issued to).
+     */
+    introspection?: IntrospectionOptions;
     fetchImpl?: typeof fetch;
     now?: () => number;
 }
-export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof';
+export interface IntrospectionOptions {
+    clientId: string;
+    clientSecret: string;
+    /** Default `${issuer}/oauth2/introspect`. */
+    endpoint?: string;
+    /** How long an active answer is reused, in seconds (default 60; never past the token's `exp`). */
+    cacheTtlSeconds?: number;
+    /** How long an inactive answer is reused, in seconds (default 10; 0 disables). */
+    negativeCacheTtlSeconds?: number;
+    /** Most answers kept (default 10 000). */
+    cacheMax?: number;
+    /**
+     * Also introspect JWT access tokens, so a revoked grant or a banned user is
+     * refused before the token expires (one cached call per token). Default false:
+     * JWTs are verified locally.
+     */
+    introspectJwts?: boolean;
+}
+/**
+ * RFC 7662 introspection with a small TTL cache keyed by the token's SHA-256
+ * (the token itself is never kept). Returns the claims of an active token, or
+ * null for an inactive one; throws when Atlas could not be reached.
+ */
+export declare function createIntrospector(issuer: string, options: IntrospectionOptions, deps?: {
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}): (token: string) => Promise<AccessTokenClaims | null>;
+export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce';
 export type AccessTokenResult = {
     ok: true;
     claims: AccessTokenClaims;
@@ -92,6 +168,8 @@ export type AccessTokenResult = {
     subject: string;
     clientId: string | null;
     dpopBound: boolean;
+    /** With `dpopNonces`: send as the `DPoP-Nonce` response header. */
+    dpopNonce?: string;
 } | {
     ok: false;
     status: 400 | 401 | 403;
@@ -99,6 +177,8 @@ export type AccessTokenResult = {
     description: string;
     /** Set this response header verbatim. */
     wwwAuthenticate: string;
+    /** With `dpopNonces`: send as the `DPoP-Nonce` response header (always, on `use_dpop_nonce`). */
+    dpopNonce?: string;
 };
 /**
  * Build an RFC 6750 / RFC 9449 / RFC 9728 `WWW-Authenticate` challenge.