@atlasauth/backend 0.29.0 → 0.31.0

package/dist/rp.d.ts

@@ -0,0 +1,253 @@
+/**
+ * `@atlasauth/backend/rp` (also published alone as `@atlasauth/rp`, whose
+ * only dependency is `jose`): the server-side relying party for the hosted
+ * redirect, as `(Request) => Response` handlers for any framework.
+ *
+ *   const rp = createRelyingParty({ ...settings, onSignedIn: (user, tokens) => yourSession(user) });
+ *   const response = await rp.handle(request); // sign-in, callback and sign-out; null for any other path
+ *
+ * Or route them yourself:
+ *
+ *   const rp = createRelyingParty({ issuer, clientId, clientSecret, redirectUri, secret, secretKey });
+ *   app.get('/auth/sign-in', (req) => rp.start(req));
+ *   app.get('/auth/callback', async (req) => {
+ *     const { user, response } = await rp.callback(req);
+ *     // create your session for user.sub, keep user.sid on it, then:
+ *     response.headers.append('set-cookie', yourSessionCookie);
+ *     return response;
+ *   });
+ *
+ * This entry point loads only Web standards (fetch, Web Crypto, Request,
+ * Response, URL) and `jose`, itself Web Crypto only: no `Buffer`, no
+ * `node:*`. It runs unchanged on Node 18+, Deno, Bun and Workers. The full
+ * `@atlasauth/backend` entry (management client, migration bridges, ...) is
+ * never pulled in.
+ *
+ * Everything here is a thin layer over `oidc.start` / `oidc.callback` (state,
+ * nonce and PKCE S256 in one sealed short-lived cookie; ID-token checks with the
+ * algorithm pinned, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`, `at_hash`) plus
+ * the Atlas session calls a relying party that keeps its own session needs:
+ * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
+ * (`POST /v1/sessions/{id}/revoke`, or with `serverSignOut` the one-call
+ * `POST /v1/oauth_clients/{id}/logout`).
+ */
+import { AtlasOidcError, type OidcClientAuth, type OidcIdentity, type OidcStartOptions } from './oidc';
+export { AtlasOidcError, isSafeReturnTo, oidcCallback, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches } from './oidc';
+export type { OidcIdentity, OidcStartOptions, OidcCallbackOptions, AtlasOidcErrorCode } from './oidc';
+export { AtlasApiError } from './client/error';
+export { BACKCHANNEL_LOGOUT_EVENT, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
+export type { LogoutReplayStore, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions } from './logout-token';
+export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, } from './backchannel-handlers';
+export type { BackchannelLogoutOptions } from './backchannel-handlers';
+export { ATLAS_WEBHOOK_HEADERS } from './webhook-common';
+export { verifyAtlasWebhook, verifyAtlasWebhookRequest } from './webhooks-web';
+export type { WebhookVerifyFailure, WebhookVerifyResult } from './webhook-common';
+export type { VerifyAtlasWebhookInput } from './webhooks-web';
+export { authenticatedWithin, usedMultiFactor } from './recent-auth';
+export interface RelyingPartyConfig {
+    /** Your instance's issuer: `https://` + its frontend API host. */
+    issuer: string;
+    /** The OAuth client id. */
+    clientId: string;
+    /** The client secret (a confidential client). */
+    clientSecret?: string;
+    /** Token-endpoint authentication. Default `client_secret_basic` with a secret. */
+    clientAuth?: OidcClientAuth;
+    /** The callback URL, registered on the client exactly. */
+    redirectUri: string;
+    /** At least 32 characters: seals the short-lived sign-in cookie. */
+    secret: string;
+    /** Scopes. Default `openid profile email`. */
+    scope?: string;
+    /** Where the callback response sends the browser when the sign-in carried no return path. Default `/`. */
+    afterSignInPath?: string;
+    /** Where Atlas sends the browser after sign-out. Must be registered on the client exactly. */
+    postLogoutRedirectUri?: string;
+    /** The instance secret key (`sk_...`, scope `sessions:write`). Needed for `touchIfDue` and server-side revoke. */
+    secretKey?: string;
+    /** The Backend API origin. Default `https://api.atlasauth.net`. */
+    apiUrl?: string;
+    /** Flow cookie name. Default `atlas_oidc`. */
+    cookieName?: string;
+    /**
+     * Sign out with ONE server call, `POST /v1/oauth_clients/{clientId}/logout`
+     * (the key needs `oauth_clients:write` as well as `sessions:write`): it
+     * revokes this app's grants and the Atlas session, so `signOut` redirects
+     * straight to the post-logout URI (or `/`) without the `/oauth2/logout` hop.
+     * Off by default: revoke via `/v1/sessions/{id}/revoke`, then `/oauth2/logout`.
+     */
+    serverSignOut?: boolean;
+    /** Minimum time between two keep-alive calls for one session. Default 5 minutes. */
+    touchIntervalMs?: number;
+    fetchImpl?: typeof fetch;
+    /** A clock in epoch milliseconds, for tests. */
+    now?: () => number;
+    /**
+     * More query parameters to pass from your sign-in URL to `/oauth2/authorize`
+     * unchanged, for example `['ref', 'utm_source']` for referral attribution.
+     * Only the names listed here are forwarded; a value over 512 characters is
+     * dropped. The parameters this helper owns (`state`, `nonce`, `redirect_uri`,
+     * `scope`, `return_to`, ...) are refused at setup.
+     */
+    forwardParams?: string[];
+    /**
+     * The paths {@link RelyingParty.handle} answers. Defaults: `signIn`
+     * `/auth/sign-in`, `callback` the path of `redirectUri`, `signOut` `/auth/sign-out`.
+     */
+    routes?: {
+        signIn?: string;
+        callback?: string;
+        signOut?: string;
+    };
+    /**
+     * Called by {@link RelyingParty.handle} after a verified sign-in: create your
+     * own session here. Return a `Response` to answer with it, or nothing to
+     * answer with `result.response` (a 302 to the return path) after appending
+     * your session cookie to it. The sign-in cookie is cleared either way.
+     */
+    onSignedIn?: (user: RelyingPartyUser, tokens: RelyingPartyTokens, request: Request, result: CallbackResult) => Promise<Response | void> | Response | void;
+    /**
+     * Called by {@link RelyingParty.handle} when the callback fails with an
+     * {@link AtlasOidcError}. Default: a plain `400`. The sign-in cookie is cleared either way.
+     */
+    onSignInError?: (error: AtlasOidcError, request: Request) => Promise<Response> | Response;
+    /**
+     * Called by {@link RelyingParty.handle} on the sign-out path: end your own
+     * session and return the Atlas `sid` and `idToken` you kept, plus the
+     * `setCookies` that clear your session cookie.
+     */
+    onSignOut?: (request: Request) => Promise<SignOutOptions | void> | SignOutOptions | void;
+}
+/** Who signed in: the ID-token claims an app needs, in the token's own names. */
+export interface RelyingPartyUser {
+    sub: string;
+    /** The Atlas session id. Keep it on your session: touch, revoke and back-channel logout all name it. */
+    sid: string | null;
+    email: string | null;
+    /** True only when the ID token says so. Never match accounts on an unverified email. */
+    email_verified: boolean;
+    name: string | null;
+    /** Your own id for the user, when the token carries one. */
+    external_id?: string;
+    /** The organization the sign-in was made in, when there was one. */
+    org_id?: string;
+    org_role?: string;
+    /** When the user last authenticated, epoch seconds. Store it for {@link RelyingParty.requireRecentAuth}. */
+    auth_time: number | null;
+}
+export interface RelyingPartyTokens {
+    id_token: string;
+    access_token: string;
+    refresh_token?: string;
+    /** When the access token expires, epoch milliseconds. */
+    expires_at: number;
+}
+export interface CallbackResult {
+    user: RelyingPartyUser;
+    tokens: RelyingPartyTokens;
+    /** Every verified claim and the organization / SSO context, as `oidc.callback` returns them. */
+    identity: OidcIdentity;
+    /**
+     * A 302 to the return path (or `afterSignInPath`) that already clears the
+     * sign-in cookie. Its headers are mutable: append your own session cookie.
+     */
+    response: Response;
+}
+/** Per-request overrides for {@link RelyingParty.start}. */
+export type StartOverrides = Pick<OidcStartOptions, 'prompt' | 'loginHint' | 'uiLocales' | 'maxAge' | 'organization' | 'returnTo' | 'expectedSub' | 'scope' | 'extraParams'>;
+export type TouchResult = 
+/** Touched less than `touchIntervalMs` ago: nothing sent. Keep your `lastTouchedAt`. */
+{
+    status: 'skipped';
+    lastTouchedAt: number;
+}
+/** Atlas slid the idle window. Store `lastTouchedAt`. */
+ | {
+    status: 'touched';
+    lastTouchedAt: number;
+    idleExpiresAt: string | null;
+}
+/**
+ * The Atlas session has ended (signed out, revoked, timed out, or unknown).
+ * End your own session: it is no longer backed by a live Atlas session.
+ */
+ | {
+    status: 'ended';
+    reason: 'revoked' | 'idle_expired' | 'expired' | 'not_found';
+};
+export interface SignOutOptions {
+    /** The ID token from sign-in: lets Atlas end the session without asking. */
+    idToken?: string;
+    /** The Atlas session id. With a `secretKey`, it is revoked server-side before the redirect. */
+    sid?: string | null;
+    /** Override the configured `postLogoutRedirectUri`. */
+    postLogoutRedirectUri?: string;
+    state?: string;
+    /** `Set-Cookie` values to send on the redirect, for example the one that clears your session cookie. */
+    setCookies?: string[];
+}
+export interface RecentAuthOptions {
+    /** The signed-in user's `sub`: the re-authentication must come back as the same user. */
+    sub: string;
+    /** The `auth_time` you stored at sign-in (or after the last step-up). */
+    authTime: number | null | undefined;
+    /** Where to come back to after confirming. Default: the request's own path and query. */
+    returnTo?: string;
+}
+export interface RelyingParty {
+    /**
+     * Begin sign-in: a 302 to `/oauth2/authorize` with the sign-in cookie set.
+     * `prompt`, `login_hint`, `ui_locales`, `max_age`, `organization` and
+     * `return_to` on the request's query are passed through, as are the
+     * `forwardParams` you configured; `overrides` win (`extraParams` merge).
+     */
+    start(request: Request, overrides?: StartOverrides): Promise<Response>;
+    /**
+     * Finish sign-in. Throws {@link AtlasOidcError} on any failure; send its
+     * `clearCookie` as `Set-Cookie` on your error response.
+     */
+    callback(request: Request): Promise<CallbackResult>;
+    /**
+     * Step-up: `null` when `authTime` is within `maxAgeSeconds`; otherwise a 302
+     * that asks the same user to authenticate again (`max_age`, plus
+     * `prompt=login` for 0). The callback then refuses another user or an old
+     * `auth_time`; store the new `user.auth_time` (and `user.sid`). `0` asks
+     * unless the user authenticated in the last {@link CONFIRM_NOW_WINDOW_SECONDS}
+     * seconds, so the request that returns from the confirmation goes through.
+     */
+    requireRecentAuth(request: Request, maxAgeSeconds: number, options: RecentAuthOptions): Promise<Response | null>;
+    /**
+     * Keep the Atlas session alive while the user is active in your app, at
+     * most once per `touchIntervalMs` per session. Call it on each authenticated
+     * request with the `sid` and the time you last touched (0 or null at first).
+     */
+    touchIfDue(sid: string, lastTouchedAt: number | null | undefined): Promise<TouchResult>;
+    /**
+     * End the Atlas session server-side (`POST /v1/sessions/{id}/revoke`); every
+     * app signed in through it gets a back-channel logout. An already-ended
+     * session is `revoked` too; `not_found` means this instance has no such
+     * session (check you use the same instance's secret key). Other failures throw.
+     */
+    revokeSession(sid: string): Promise<'revoked' | 'not_found'>;
+    /**
+     * Sign-out: with a `sid` and a `secretKey`, revokes the Atlas session
+     * server-side first, then 302s the browser to `/oauth2/logout`. With
+     * `serverSignOut`, one call ends this app's grants and the Atlas session and
+     * the 302 goes straight to the post-logout URI. End your own session (clear
+     * your cookie on this response) as well.
+     */
+    signOut(options?: SignOutOptions): Promise<Response>;
+    /**
+     * All three routes in one handler: `GET` on the sign-in path runs `start`,
+     * `GET` on the callback path runs `callback` then `onSignedIn`, and `POST`
+     * or `GET` on the sign-out path runs `onSignOut` then `signOut`. Any other
+     * request gets `null`, so your app answers it. Needs `onSignedIn`.
+     *
+     *   export default { fetch: async (req) => (await rp.handle(req)) ?? app(req) };
+     */
+    handle(request: Request): Promise<Response | null>;
+}
+/** How long a `requireRecentAuth(…, 0)` confirmation counts, in seconds. */
+export declare const CONFIRM_NOW_WINDOW_SECONDS = 60;
+/** Create the relying party once, at startup; reuse it for every request. */
+export declare function createRelyingParty(config: RelyingPartyConfig): RelyingParty;

package/dist/rp.js

@@ -0,0 +1,311 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIRM_NOW_WINDOW_SECONDS = exports.usedMultiFactor = exports.authenticatedWithin = exports.verifyAtlasWebhookRequest = exports.verifyAtlasWebhook = exports.ATLAS_WEBHOOK_HEADERS = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.BACKCHANNEL_LOGOUT_EVENT = exports.AtlasApiError = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcCallback = exports.isSafeReturnTo = exports.AtlasOidcError = void 0;
+exports.createRelyingParty = createRelyingParty;
+/**
+ * `@atlasauth/backend/rp` (also published alone as `@atlasauth/rp`, whose
+ * only dependency is `jose`): the server-side relying party for the hosted
+ * redirect, as `(Request) => Response` handlers for any framework.
+ *
+ *   const rp = createRelyingParty({ ...settings, onSignedIn: (user, tokens) => yourSession(user) });
+ *   const response = await rp.handle(request); // sign-in, callback and sign-out; null for any other path
+ *
+ * Or route them yourself:
+ *
+ *   const rp = createRelyingParty({ issuer, clientId, clientSecret, redirectUri, secret, secretKey });
+ *   app.get('/auth/sign-in', (req) => rp.start(req));
+ *   app.get('/auth/callback', async (req) => {
+ *     const { user, response } = await rp.callback(req);
+ *     // create your session for user.sub, keep user.sid on it, then:
+ *     response.headers.append('set-cookie', yourSessionCookie);
+ *     return response;
+ *   });
+ *
+ * This entry point loads only Web standards (fetch, Web Crypto, Request,
+ * Response, URL) and `jose`, itself Web Crypto only: no `Buffer`, no
+ * `node:*`. It runs unchanged on Node 18+, Deno, Bun and Workers. The full
+ * `@atlasauth/backend` entry (management client, migration bridges, ...) is
+ * never pulled in.
+ *
+ * Everything here is a thin layer over `oidc.start` / `oidc.callback` (state,
+ * nonce and PKCE S256 in one sealed short-lived cookie; ID-token checks with the
+ * algorithm pinned, `iss`, `aud`/`azp`, `exp`/`iat`, `nonce`, `at_hash`) plus
+ * the Atlas session calls a relying party that keeps its own session needs:
+ * keep-alive (`POST /v1/sessions/{id}/touch`) and server-side sign-out
+ * (`POST /v1/sessions/{id}/revoke`, or with `serverSignOut` the one-call
+ * `POST /v1/oauth_clients/{id}/logout`).
+ */
+const oidc_1 = require("./oidc");
+const error_1 = require("./client/error");
+const request_1 = require("./client/request");
+var oidc_2 = require("./oidc");
+Object.defineProperty(exports, "AtlasOidcError", { enumerable: true, get: function () { return oidc_2.AtlasOidcError; } });
+Object.defineProperty(exports, "isSafeReturnTo", { enumerable: true, get: function () { return oidc_2.isSafeReturnTo; } });
+Object.defineProperty(exports, "oidcCallback", { enumerable: true, get: function () { return oidc_2.oidcCallback; } });
+Object.defineProperty(exports, "oidcLogoutUrl", { enumerable: true, get: function () { return oidc_2.oidcLogoutUrl; } });
+Object.defineProperty(exports, "oidcStart", { enumerable: true, get: function () { return oidc_2.oidcStart; } });
+Object.defineProperty(exports, "oidcVerifyIdToken", { enumerable: true, get: function () { return oidc_2.oidcVerifyIdToken; } });
+Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: function () { return oidc_2.resetOidcCaches; } });
+var error_2 = require("./client/error");
+Object.defineProperty(exports, "AtlasApiError", { enumerable: true, get: function () { return error_2.AtlasApiError; } });
+// Back-channel logout: verify the logout_token (typ logout+jwt, events, no nonce, sid/sub, jti replay hook).
+var logout_token_1 = require("./logout-token");
+Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
+Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
+Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
+Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
+var backchannel_handlers_1 = require("./backchannel-handlers");
+Object.defineProperty(exports, "expressBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.expressBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogout; } });
+Object.defineProperty(exports, "fastifyBackchannelLogoutPlugin", { enumerable: true, get: function () { return backchannel_handlers_1.fastifyBackchannelLogoutPlugin; } });
+Object.defineProperty(exports, "fetchBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.fetchBackchannelLogout; } });
+Object.defineProperty(exports, "handleBackchannelLogout", { enumerable: true, get: function () { return backchannel_handlers_1.handleBackchannelLogout; } });
+// Webhooks, verified with Web Crypto.
+var webhook_common_1 = require("./webhook-common");
+Object.defineProperty(exports, "ATLAS_WEBHOOK_HEADERS", { enumerable: true, get: function () { return webhook_common_1.ATLAS_WEBHOOK_HEADERS; } });
+var webhooks_web_1 = require("./webhooks-web");
+Object.defineProperty(exports, "verifyAtlasWebhook", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhook; } });
+Object.defineProperty(exports, "verifyAtlasWebhookRequest", { enumerable: true, get: function () { return webhooks_web_1.verifyAtlasWebhookRequest; } });
+var recent_auth_1 = require("./recent-auth");
+Object.defineProperty(exports, "authenticatedWithin", { enumerable: true, get: function () { return recent_auth_1.authenticatedWithin; } });
+Object.defineProperty(exports, "usedMultiFactor", { enumerable: true, get: function () { return recent_auth_1.usedMultiFactor; } });
+const PASSTHROUGH = [
+    ['prompt', 'prompt'],
+    ['login_hint', 'loginHint'],
+    ['ui_locales', 'uiLocales'],
+    ['organization', 'organization'],
+    ['return_to', 'returnTo'],
+];
+/** Parameters `forwardParams` may not name: the helper sets them, or they mean something else here. */
+const NOT_FORWARDABLE = new Set([
+    'response_type',
+    'client_id',
+    'redirect_uri',
+    'state',
+    'nonce',
+    'code_challenge',
+    'code_challenge_method',
+    'scope',
+    'return_to',
+    'id_token_hint',
+    'request',
+    'request_uri',
+]);
+const MAX_FORWARDED_VALUE = 512;
+const DEFAULT_TOUCH_INTERVAL_MS = 5 * 60_000;
+/** How long a `requireRecentAuth(…, 0)` confirmation counts, in seconds. */
+exports.CONFIRM_NOW_WINDOW_SECONDS = 60;
+/** Create the relying party once, at startup; reuse it for every request. */
+function createRelyingParty(config) {
+    if (typeof config.secret !== 'string' || config.secret.length < 32) {
+        throw new TypeError('createRelyingParty: `secret` (at least 32 characters) is required to seal the sign-in cookie.');
+    }
+    const afterSignIn = config.afterSignInPath ?? '/';
+    if (!(0, oidc_1.isSafeReturnTo)(afterSignIn))
+        throw new TypeError('createRelyingParty: `afterSignInPath` must be a path starting with a single `/`.');
+    const forwardParams = config.forwardParams ?? [];
+    for (const name of forwardParams) {
+        if (typeof name !== 'string' || !/^[A-Za-z0-9_.-]{1,64}$/.test(name) || NOT_FORWARDABLE.has(name)) {
+            throw new TypeError(`createRelyingParty: \`forwardParams\` cannot forward ${JSON.stringify(name)}: use a plain parameter name the helper does not set itself.`);
+        }
+    }
+    const base = {
+        issuer: config.issuer,
+        clientId: config.clientId,
+        redirectUri: config.redirectUri,
+        secret: config.secret,
+        cookieName: config.cookieName ?? oidc_1.OIDC_FLOW_COOKIE,
+        fetchImpl: config.fetchImpl,
+        now: config.now,
+    };
+    const clock = () => (config.now ?? Date.now)();
+    const doFetch = (input, init) => (config.fetchImpl ?? fetch)(input, init);
+    const interval = config.touchIntervalMs ?? DEFAULT_TOUCH_INTERVAL_MS;
+    async function start(request, overrides = {}) {
+        const query = new URL(request.url).searchParams;
+        const fromQuery = {};
+        for (const [param, key] of PASSTHROUGH) {
+            const v = query.get(param);
+            // A bad return_to from the query is dropped, never an error page.
+            if (v && (key !== 'returnTo' || (0, oidc_1.isSafeReturnTo)(v)))
+                fromQuery[key] = v;
+        }
+        const maxAge = query.get('max_age');
+        if (maxAge !== null && /^\d{1,9}$/.test(maxAge))
+            fromQuery.maxAge = Number(maxAge);
+        const forwarded = {};
+        for (const name of forwardParams) {
+            const v = query.get(name);
+            if (v && v.length <= MAX_FORWARDED_VALUE)
+                forwarded[name] = v;
+        }
+        const extraParams = { ...forwarded, ...overrides.extraParams };
+        const { url, cookie } = await (0, oidc_1.oidcStart)({ ...base, scope: config.scope, ...fromQuery, ...overrides, extraParams });
+        return redirect(url, [cookie]);
+    }
+    async function callback(request) {
+        const identity = await (0, oidc_1.oidcCallback)({
+            ...base,
+            clientSecret: config.clientSecret,
+            clientAuth: config.clientAuth,
+            query: new URL(request.url).searchParams,
+            cookie: request.headers.get('cookie'),
+        });
+        const c = identity.claims;
+        const user = {
+            sub: identity.sub,
+            sid: identity.sid,
+            email: identity.email,
+            email_verified: identity.emailVerified,
+            name: identity.name,
+            ...(typeof c.external_id === 'string' && c.external_id ? { external_id: c.external_id } : {}),
+            ...(identity.organization ? { org_id: identity.organization.id, org_role: identity.organization.role } : {}),
+            auth_time: identity.authTime,
+        };
+        const tokens = {
+            id_token: identity.idToken,
+            access_token: identity.accessToken,
+            ...(identity.refreshToken ? { refresh_token: identity.refreshToken } : {}),
+            expires_at: identity.expiresAt,
+        };
+        return { user, tokens, identity, response: redirect(identity.returnTo ?? afterSignIn, [identity.clearCookie]) };
+    }
+    async function requireRecentAuth(request, maxAgeSeconds, options) {
+        if (!Number.isSafeInteger(maxAgeSeconds) || maxAgeSeconds < 0) {
+            throw new TypeError('requireRecentAuth: `maxAgeSeconds` must be a whole number of seconds, 0 or more.');
+        }
+        if (typeof options?.sub !== 'string' || !options.sub)
+            throw new TypeError('requireRecentAuth: `sub` is required.');
+        const at = options.authTime;
+        // 0 means "confirm now": it still passes for a minute after the confirmation,
+        // or the request that comes back from it would be sent to confirm again, forever.
+        const allowed = maxAgeSeconds === 0 ? exports.CONFIRM_NOW_WINDOW_SECONDS : maxAgeSeconds;
+        if (typeof at === 'number' && Number.isFinite(at) && clock() / 1000 - at <= allowed)
+            return null;
+        const here = new URL(request.url);
+        const returnTo = options.returnTo ?? `${here.pathname}${here.search}`;
+        const { url, cookie } = await (0, oidc_1.oidcStart)({
+            ...base,
+            scope: config.scope,
+            maxAge: maxAgeSeconds,
+            expectedSub: options.sub,
+            ...(maxAgeSeconds === 0 ? { prompt: 'login' } : {}),
+            ...((0, oidc_1.isSafeReturnTo)(returnTo) ? { returnTo } : {}),
+        });
+        return redirect(url, [cookie]);
+    }
+    function sessionCall(sid, action) {
+        if (!config.secretKey)
+            throw new TypeError(`${action === 'touch' ? 'touchIfDue' : 'revokeSession'}: \`secretKey\` is not configured.`);
+        if (typeof sid !== 'string' || !sid)
+            throw new TypeError('A session id (`sid`) is required.');
+        const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/sessions/${encodeURIComponent(sid)}/${action}`;
+        return doFetch(url, { method: 'POST', headers: { authorization: `Bearer ${config.secretKey}`, accept: 'application/json' } });
+    }
+    async function touchIfDue(sid, lastTouchedAt) {
+        const now = clock();
+        if (typeof lastTouchedAt === 'number' && now - lastTouchedAt < interval && now >= lastTouchedAt) {
+            return { status: 'skipped', lastTouchedAt };
+        }
+        const res = await sessionCall(sid, 'touch');
+        const body = (await res.json().catch(() => null));
+        if (res.ok) {
+            return { status: 'touched', lastTouchedAt: now, idleExpiresAt: typeof body?.idle_expires_at === 'string' ? body.idle_expires_at : null };
+        }
+        if (res.status === 404)
+            return { status: 'ended', reason: 'not_found' };
+        if (res.status === 409) {
+            const code = errorsOf(body)[0]?.code;
+            if (code === 'SESSION_REVOKED')
+                return { status: 'ended', reason: 'revoked' };
+            if (code === 'SESSION_IDLE_EXPIRED')
+                return { status: 'ended', reason: 'idle_expired' };
+            return { status: 'ended', reason: 'expired' };
+        }
+        // A key, scope or availability problem is not "signed out": say so loudly.
+        throw new error_1.AtlasApiError(res.status, errorsOf(body));
+    }
+    async function revokeSession(sid) {
+        const res = await sessionCall(sid, 'revoke');
+        if (res.ok)
+            return 'revoked';
+        if (res.status === 404)
+            return 'not_found';
+        throw new error_1.AtlasApiError(res.status, errorsOf(await res.json().catch(() => null)));
+    }
+    async function signOut(options = {}) {
+        if (config.serverSignOut && options.sid && config.secretKey) {
+            const url = `${(config.apiUrl ?? request_1.DEFAULT_API_URL).replace(/\/+$/, '')}/v1/oauth_clients/${encodeURIComponent(config.clientId)}/logout`;
+            const res = await doFetch(url, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${config.secretKey}`, accept: 'application/json', 'content-type': 'application/json' },
+                body: JSON.stringify({ sid: options.sid }),
+            });
+            // 404: this instance has no such session any more, so there is nothing left to end.
+            if (!res.ok && res.status !== 404)
+                throw new error_1.AtlasApiError(res.status, errorsOf(await res.json().catch(() => null)));
+            const target = new URL(options.postLogoutRedirectUri ?? config.postLogoutRedirectUri ?? '/', 'http://relative.invalid');
+            if (options.state)
+                target.searchParams.set('state', options.state);
+            return redirect(target.origin === 'http://relative.invalid' ? `${target.pathname}${target.search}` : target.toString(), []);
+        }
+        if (options.sid && config.secretKey)
+            await revokeSession(options.sid);
+        const url = await (0, oidc_1.oidcLogoutUrl)({
+            ...base,
+            postLogoutRedirectUri: options.postLogoutRedirectUri ?? config.postLogoutRedirectUri,
+            idTokenHint: options.idToken,
+            state: options.state,
+        });
+        return redirect(url, options.setCookies ?? []);
+    }
+    async function handle(request) {
+        if (!config.onSignedIn)
+            throw new TypeError('handle: `onSignedIn` is not configured; it is where your app creates its session.');
+        const { pathname } = new URL(request.url);
+        const method = request.method.toUpperCase();
+        const routes = config.routes ?? {};
+        if (method === 'GET' && pathname === (routes.signIn ?? '/auth/sign-in'))
+            return start(request);
+        if (method === 'GET' && pathname === (routes.callback ?? new URL(config.redirectUri).pathname)) {
+            let result;
+            try {
+                result = await callback(request);
+            }
+            catch (error) {
+                if (!(error instanceof oidc_1.AtlasOidcError))
+                    throw error;
+                const failed = config.onSignInError
+                    ? await config.onSignInError(error, request)
+                    : new Response('Sign-in failed. Please try again.', { status: 400, headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' } });
+                return withCookie(failed, error.clearCookie);
+            }
+            const own = await config.onSignedIn(result.user, result.tokens, request, result);
+            return own instanceof Response ? withCookie(own, result.identity.clearCookie) : result.response;
+        }
+        if ((method === 'POST' || method === 'GET') && pathname === (routes.signOut ?? '/auth/sign-out')) {
+            return signOut((await config.onSignOut?.(request)) ?? {});
+        }
+        return null;
+    }
+    return { start, callback, requireRecentAuth, touchIfDue, revokeSession, signOut, handle };
+}
+/** A copy of `response` with mutable headers and one more `Set-Cookie`. */
+function withCookie(response, cookie) {
+    const out = new Response(response.body, response);
+    if (cookie)
+        out.headers.append('set-cookie', cookie);
+    return out;
+}
+/** A 302 built with `new Response` (not `Response.redirect`), so its headers stay mutable. */
+function redirect(location, cookies) {
+    const headers = new Headers({ location, 'cache-control': 'no-store' });
+    for (const c of cookies)
+        headers.append('set-cookie', c);
+    return new Response(null, { status: 302, headers });
+}
+function errorsOf(body) {
+    const errors = body?.errors;
+    return Array.isArray(errors) ? errors : [];
+}
+//# sourceMappingURL=rp.js.map

package/dist/rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rp.js","sourceRoot":"","sources":["../src/rp.ts"],"names":[],"mappings":";;;AAqTA,gDAsLC;AA3eD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,iCAUgB;AAChB,0CAAoE;AACpE,8CAAmD;AAEnD,+BAAoI;AAA3H,sGAAA,cAAc,OAAA;AAAE,sGAAA,cAAc,OAAA;AAAE,oGAAA,YAAY,OAAA;AAAE,qGAAA,aAAa,OAAA;AAAE,iGAAA,SAAS,OAAA;AAAE,yGAAA,iBAAiB,OAAA;AAAE,uGAAA,eAAe,OAAA;AAEnH,wCAA+C;AAAtC,sGAAA,aAAa,OAAA;AACtB,6GAA6G;AAC7G,+CAKwB;AAJtB,wHAAA,wBAAwB,OAAA;AACxB,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAGnB,+DAMgC;AAL9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AAGzB,sCAAsC;AACtC,mDAAyD;AAAhD,uHAAA,qBAAqB,OAAA;AAC9B,+CAA+E;AAAtE,kHAAA,kBAAkB,OAAA;AAAE,yHAAA,yBAAyB,OAAA;AAGtD,6CAAqE;AAA5D,kHAAA,mBAAmB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAgN7C,MAAM,WAAW,GAAkD;IACjE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACpB,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,YAAY,EAAE,WAAW,CAAC;IAC3B,CAAC,cAAc,EAAE,cAAc,CAAC;IAChC,CAAC,WAAW,EAAE,UAAU,CAAC;CAC1B,CAAC;AAEF,uGAAuG;AACvG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;IACvB,OAAO;IACP,WAAW;IACX,eAAe;IACf,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC7C,4EAA4E;AAC/D,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,6EAA6E;AAC7E,SAAgB,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,+FAA+F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC;IAClD,IAAI,CAAC,IAAA,qBAAc,EAAC,WAAW,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;IAC1I,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClG,MAAM,IAAI,SAAS,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;QAClK,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,uBAAgB;QACjD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;KAChB,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAiB,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC;IAErE,KAAK,UAAU,KAAK,CAAC,OAAgB,EAAE,YAA4B,EAAE;QACnE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;QAChD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,IAAA,qBAAc,EAAC,CAAC,CAAC,CAAC;gBAAG,SAA+C,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,mBAAmB;gBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACnH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAY,EAAC;YAClC,GAAG,IAAI;YACP,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY;YACxC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC1B,MAAM,IAAI,GAAqB;YAC7B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,cAAc,EAAE,QAAQ,CAAC,aAAa;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5G,SAAS,EAAE,QAAQ,CAAC,QAAQ;SAC7B,CAAC;QACF,MAAM,MAAM,GAAuB;YACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO;YAC1B,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,UAAU,EAAE,QAAQ,CAAC,SAAS;SAC/B,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,OAAgB,EAAE,aAAqB,EAAE,OAA0B;QAClG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,kFAAkF,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnH,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5B,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,kCAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;QACjF,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QACjG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC;YACtC,GAAG,IAAI;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,IAAA,qBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0B;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,oCAAoC,CAAC,CAAC;QACvI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,kBAAkB,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACzH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,aAAwC;QAC7E,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,GAAG,GAAG,aAAa,GAAG,QAAQ,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;YAChG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC9E,IAAI,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;QACD,2EAA2E;QAC3E,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAW;QACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,UAA0B,EAAE;QACjD,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvI,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC7B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACxH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;aAC3C,CAAC,CAAC;YACH,oFAAoF;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,qBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,EAAE,yBAAyB,CAAC,CAAC;YACxH,IAAI,OAAO,CAAC,KAAK;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAA,oBAAa,EAAC;YAC9B,GAAG,IAAI;YACP,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,qBAAqB;YACpF,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAgB;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,IAAI,SAAS,CAAC,mFAAmF,CAAC,CAAC;QACjI,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/F,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/F,IAAI,MAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAc,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa;oBACjC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;oBAC5C,CAAC,CAAC,IAAI,QAAQ,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9J,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACjF,OAAO,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,CAAC;YACjG,OAAO,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5F,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,QAAkB,EAAE,MAA0B;IAChE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAiB;IACnD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,MAAM,MAAM,GAAI,IAAoC,EAAE,MAAM,CAAC;IAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/verify.d.ts

@@ -175,6 +175,14 @@ export interface AtlasBackendOptions {
     jwks?: Jwks;
     /** Expected `iss`. Required — an unchecked issuer accepts any Atlas instance. */
     issuer: string;
+    /**
+     * Earlier issuers of THIS instance, also accepted: its old sign-in host while
+     * the instance moves to a new one (a custom domain or a path mount going
+     * active). The keys are the instance's own, so nothing else changes. The
+     * instance's discovery document lists them in `atlas_previous_issuers` with
+     * an `accepted_until`; remove them after that.
+     */
+    previousIssuers?: readonly string[];
     /**
      * §7.3 optional azp allowlist. When set, a token minted for a different
      * origin is refused, which is what stops a token issued to one of the

package/dist/verify.js

@@ -181,7 +181,9 @@ class AtlasBackend {
                 // Pinned. Without this, a token whose header says `alg: none` — or any
                 // algorithm the key material can be coerced into — verifies.
                 algorithms: algs_1.ATLAS_SIGNING_ALGS,
-                issuer: this.options.issuer,
+                issuer: this.options.previousIssuers?.length
+                    ? [this.options.issuer, ...this.options.previousIssuers]
+                    : this.options.issuer,
                 // §S4 enforce `aud` ONLY when the caller configured an expected audience.
                 // Unset leaves `aud` unchecked, so a token carrying its default
                 // instance-id audience still verifies (backwards compatible).