@atlasauth/backend 0.4.0 → 0.6.0

package/dist/client/webhooks.d.ts

@@ -5,6 +5,8 @@ export interface WebhookEndpoint {
     url: string;
     enabled_events: string[];
     active: boolean;
+    /** Start of the current failure streak (epoch ms), or null when the last delivery succeeded. */
+    failing_since?: number | null;
     disabled_at: number | null;
     created_at: number;
 }
@@ -16,7 +18,12 @@ export interface WebhookDelivery {
     object: 'webhook_delivery';
     id: string;
     event_id: string;
+    /** The event type, or null once the event has passed its retention. */
+    event_type?: string | null;
     attempt_number: number;
+    max_attempts?: number;
+    /** The payload that was sent (null once the event has passed its retention). */
+    payload?: unknown;
     status: string;
     http_status: number | null;
     response_snippet: string | null;
@@ -29,12 +36,56 @@ export interface CreateWebhookEndpointBody {
     /** Each entry is `"*"` or a known event name. */
     enabled_events?: string[];
 }
+/** Change an endpoint in place. The signing secret is kept. */
+export interface UpdateWebhookEndpointBody {
+    url?: string;
+    enabled_events?: string[];
+    active?: boolean;
+}
+/** The endpoint list plus the delivery settings that apply to every endpoint. */
+export interface WebhookEndpointList {
+    object?: 'list';
+    data: WebhookEndpoint[];
+    has_more: boolean;
+    next_cursor?: string | null;
+    /** Every event type an endpoint can subscribe to. */
+    available_events?: string[];
+    /** The delay before each retry, in milliseconds. */
+    retry_schedule_ms?: number[];
+    /** Delivery attempts per event before it is marked failed. */
+    max_attempts?: number;
+}
+export interface WebhookSigningSecret {
+    object: 'webhook_secret';
+    /** The `whsec_...` signing secret. */
+    secret: string;
+    warning?: string;
+}
+/** A queued delivery (from `test` or `redeliver`). */
+export interface WebhookDeliveryQueued {
+    object: 'webhook_delivery';
+    id: string;
+    event_id: string;
+    status: string;
+    note: string;
+}
+export interface ListWebhookDeliveriesParams {
+    /** How many deliveries to return (1–100, default 50). */
+    limit?: number;
+}
 export declare function webhooksResource(request: RequestFn): {
     endpoints: {
-        list(): Promise<{
-            data: WebhookEndpoint[];
-            has_more: false;
-        }>;
+        list(): Promise<WebhookEndpointList>;
+        /** Update url, enabled_events or active. The signing secret is kept. */
+        update(id: string, body: UpdateWebhookEndpointBody): Promise<WebhookEndpoint>;
+        /** Show the current signing secret again. Audited. */
+        revealSecret(id: string): Promise<WebhookSigningSecret>;
+        /** Rotate the signing secret; the new one is revealed exactly once. */
+        rotateSecret(id: string): Promise<WebhookSigningSecret>;
+        /** Send a synthetic `webhook.test` event to this endpoint only. */
+        test(id: string): Promise<WebhookDeliveryQueued>;
+        /** Redeliver a past event as a fresh attempt (409 once past its retention). */
+        redeliver(id: string, deliveryId: string): Promise<WebhookDeliveryQueued>;
         create(body: CreateWebhookEndpointBody, idempotencyKey?: string): Promise<WebhookEndpointWithSecret>;
         delete(id: string): Promise<{
             object: "webhook_endpoint";
@@ -43,8 +94,11 @@ export declare function webhooksResource(request: RequestFn): {
         }>;
     };
     /** Delivery log for an endpoint. */
-    deliveries(id: string): Promise<{
+    deliveries(id: string, params?: ListWebhookDeliveriesParams): Promise<{
         data: WebhookDelivery[];
-        has_more: false;
+        has_more: boolean;
+        next_cursor?: string | null;
     }>;
+    /** Redeliver a past event (same as `endpoints.redeliver`). */
+    redeliver(endpointId: string, deliveryId: string): Promise<WebhookDeliveryQueued>;
 };

package/dist/client/webhooks.js

@@ -8,6 +8,29 @@ function webhooksResource(request) {
             list() {
                 return request({ method: 'GET', path: '/v1/webhook_endpoints' });
             },
+            /** Update url, enabled_events or active. The signing secret is kept. */
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}`, body });
+            },
+            /** Show the current signing secret again. Audited. */
+            revealSecret(id) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/reveal_secret` });
+            },
+            /** Rotate the signing secret; the new one is revealed exactly once. */
+            rotateSecret(id) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/rotate_secret` });
+            },
+            /** Send a synthetic `webhook.test` event to this endpoint only. */
+            test(id) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/test` });
+            },
+            /** Redeliver a past event as a fresh attempt (409 once past its retention). */
+            redeliver(id, deliveryId) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/deliveries/${(0, request_1.enc)(deliveryId)}/redeliver`,
+                });
+            },
             create(body, idempotencyKey) {
                 return request({ method: 'POST', path: '/v1/webhook_endpoints', body, idempotencyKey });
             },
@@ -16,8 +39,19 @@ function webhooksResource(request) {
             },
         },
         /** Delivery log for an endpoint. */
-        deliveries(id) {
-            return request({ method: 'GET', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/deliveries` });
+        deliveries(id, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/deliveries`,
+                query: { ...params },
+            });
+        },
+        /** Redeliver a past event (same as `endpoints.redeliver`). */
+        redeliver(endpointId, deliveryId) {
+            return request({
+                method: 'POST',
+                path: `/v1/webhook_endpoints/${(0, request_1.enc)(endpointId)}/deliveries/${(0, request_1.enc)(deliveryId)}/redeliver`,
+            });
         },
     };
 }

package/dist/client/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAoCA,4CAuBC;AA3DD,uCAAgD;AAoChD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAqFA,4CA4DC;AAjJD,uCAAgD;AAqFhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,uEAAuE;YACvE,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/discovery.d.ts

@@ -0,0 +1,49 @@
+/**
+ * OIDC discovery of an instance's JWKS URL, so `new AtlasBackend({ issuer })`
+ * works without a `jwksUrl`.
+ *
+ * Where the document lives:
+ *   - an instance with its own frontend API host (every instance created from
+ *     the dashboard): `${issuer}/.well-known/openid-configuration`;
+ *   - an instance on the SHARED host: its tokens carry the shared issuer, and the
+ *     shared host's root discovery document describes a different instance's key
+ *     set. Such an instance must name itself (`instanceId`, or a `publishableKey`
+ *     it is derived from) so discovery uses the per-instance document at
+ *     `${issuer}/instances/${instanceId}/.well-known/openid-configuration`.
+ *
+ * Caching mirrors the JWKS cache: the discovered URL is reused for the JWKS TTL
+ * (an hour), a failed refresh keeps serving the last good URL, and a failing
+ * endpoint is retried at most once a minute — so a broken or hostile discovery
+ * endpoint cannot turn verification traffic into outbound request floods.
+ */
+export declare class DiscoveryError extends Error {
+    constructor(message: string);
+}
+export interface JwksDiscoveryDeps {
+    /** The `iss` tokens carry. The discovery document's `issuer` must equal it. */
+    issuer: string;
+    /** Per-instance discovery for shared-host instances. */
+    instanceId?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    ttlMs?: number;
+    refetchIntervalMs?: number;
+}
+/** The instance id inside a publishable key (`pk_live_ins_…` / `pk_test_ins_…`), if it has one. */
+export declare function instanceIdFromPublishableKey(publishableKey: string): string | undefined;
+/** The discovery document URL for an issuer (and optional instance id). */
+export declare function discoveryUrlFor(issuer: string, instanceId?: string): string;
+export declare class JwksDiscovery {
+    private readonly deps;
+    readonly url: string;
+    private cachedUri;
+    private fetchedAt;
+    private lastAttemptAt;
+    private lastError;
+    private inflight;
+    constructor(deps: JwksDiscoveryDeps);
+    private get now();
+    /** The JWKS URL, from cache when fresh. Throws {@link DiscoveryError} when none can be had. */
+    jwksUri(): Promise<string>;
+    private fetchUri;
+}

package/dist/discovery.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.instanceIdFromPublishableKey = instanceIdFromPublishableKey;
+exports.discoveryUrlFor = discoveryUrlFor;
+const jwks_cache_1 = require("./jwks-cache");
+/**
+ * OIDC discovery of an instance's JWKS URL, so `new AtlasBackend({ issuer })`
+ * works without a `jwksUrl`.
+ *
+ * Where the document lives:
+ *   - an instance with its own frontend API host (every instance created from
+ *     the dashboard): `${issuer}/.well-known/openid-configuration`;
+ *   - an instance on the SHARED host: its tokens carry the shared issuer, and the
+ *     shared host's root discovery document describes a different instance's key
+ *     set. Such an instance must name itself (`instanceId`, or a `publishableKey`
+ *     it is derived from) so discovery uses the per-instance document at
+ *     `${issuer}/instances/${instanceId}/.well-known/openid-configuration`.
+ *
+ * Caching mirrors the JWKS cache: the discovered URL is reused for the JWKS TTL
+ * (an hour), a failed refresh keeps serving the last good URL, and a failing
+ * endpoint is retried at most once a minute — so a broken or hostile discovery
+ * endpoint cannot turn verification traffic into outbound request floods.
+ */
+class DiscoveryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'DiscoveryError';
+    }
+}
+exports.DiscoveryError = DiscoveryError;
+const stripSlash = (value) => value.replace(/\/+$/, '');
+/** The instance id inside a publishable key (`pk_live_ins_…` / `pk_test_ins_…`), if it has one. */
+function instanceIdFromPublishableKey(publishableKey) {
+    const match = /^pk_(?:live|test)_(ins_[A-Za-z0-9]+)$/.exec(publishableKey.trim());
+    return match?.[1];
+}
+/** The discovery document URL for an issuer (and optional instance id). */
+function discoveryUrlFor(issuer, instanceId) {
+    const base = stripSlash(issuer);
+    return instanceId
+        ? `${base}/instances/${encodeURIComponent(instanceId)}/.well-known/openid-configuration`
+        : `${base}/.well-known/openid-configuration`;
+}
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+class JwksDiscovery {
+    deps;
+    url;
+    cachedUri = null;
+    fetchedAt = 0;
+    lastAttemptAt = 0;
+    lastError = null;
+    inflight = null;
+    constructor(deps) {
+        this.deps = deps;
+        this.url = discoveryUrlFor(deps.issuer, deps.instanceId);
+    }
+    get now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    /** The JWKS URL, from cache when fresh. Throws {@link DiscoveryError} when none can be had. */
+    async jwksUri() {
+        const now = this.now;
+        const ttl = this.deps.ttlMs ?? jwks_cache_1.DEFAULT_TTL_MS;
+        const interval = this.deps.refetchIntervalMs ?? jwks_cache_1.REFETCH_INTERVAL_MS;
+        if (this.cachedUri && now - this.fetchedAt < ttl)
+            return this.cachedUri;
+        // Throttle: inside the retry window, answer from what we have (or the last error).
+        if (this.lastAttemptAt && now - this.lastAttemptAt < interval) {
+            if (this.cachedUri)
+                return this.cachedUri;
+            if (this.lastError)
+                throw this.lastError;
+        }
+        if (this.inflight)
+            return this.inflight;
+        this.lastAttemptAt = now;
+        this.inflight = this.fetchUri()
+            .then((uri) => {
+            this.cachedUri = uri;
+            this.fetchedAt = now;
+            this.lastError = null;
+            return uri;
+        })
+            .catch((error) => {
+            this.lastError =
+                error instanceof DiscoveryError
+                    ? error
+                    : new DiscoveryError(`OIDC discovery at ${this.url} failed: ${error?.message ?? String(error)}`);
+            // Keep serving the last good URL through a discovery outage.
+            if (this.cachedUri)
+                return this.cachedUri;
+            throw this.lastError;
+        })
+            .finally(() => {
+            this.inflight = null;
+        });
+        return this.inflight;
+    }
+    async fetchUri() {
+        const fail = (why) => new DiscoveryError(`OIDC discovery at ${this.url} failed: ${why}. Pass \`jwksUrl\` explicitly` +
+            (this.deps.instanceId
+                ? '.'
+                : ', or — for an instance without its own frontend API domain — pass `instanceId` (or `publishableKey`).'));
+        const response = await (this.deps.fetchImpl ?? fetch)(this.url, {
+            headers: { accept: 'application/json' },
+        });
+        if (!response.ok)
+            throw fail(`HTTP ${response.status}`);
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw fail('the response is not JSON');
+        }
+        const doc = body;
+        if (!doc || typeof doc !== 'object')
+            throw fail('the response is not a discovery document');
+        // OIDC Discovery §4.3: the document's issuer MUST match the issuer it was
+        // fetched for — otherwise its keys belong to someone else.
+        if (typeof doc.issuer !== 'string' || stripSlash(doc.issuer) !== stripSlash(this.deps.issuer)) {
+            throw fail(`its issuer (${String(doc.issuer)}) does not match the configured issuer (${this.deps.issuer})`);
+        }
+        if (typeof doc.jwks_uri !== 'string')
+            throw fail('it has no jwks_uri');
+        let jwks;
+        try {
+            jwks = new URL(doc.jwks_uri);
+        }
+        catch {
+            throw fail('its jwks_uri is not an absolute URL');
+        }
+        if (jwks.protocol !== 'https:' && !(jwks.protocol === 'http:' && isLoopback(jwks.hostname))) {
+            throw fail('its jwks_uri is not https');
+        }
+        return jwks.toString();
+    }
+}
+exports.JwksDiscovery = JwksDiscovery;
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":";;;AA0CA,oEAGC;AAGD,0CAKC;AArDD,6CAAmE;AAEnE;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AALD,wCAKC;AAaD,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEhE,mGAAmG;AACnG,SAAgB,4BAA4B,CAAC,cAAsB;IACjE,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,SAAgB,eAAe,CAAC,MAAc,EAAE,UAAmB;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,UAAU;QACf,CAAC,CAAC,GAAG,IAAI,cAAc,kBAAkB,CAAC,UAAU,CAAC,mCAAmC;QACxF,CAAC,CAAC,GAAG,IAAI,mCAAmC,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,MAAa,aAAa;IAQK;IAPpB,GAAG,CAAS;IACb,SAAS,GAAkB,IAAI,CAAC;IAChC,SAAS,GAAG,CAAC,CAAC;IACd,aAAa,GAAG,CAAC,CAAC;IAClB,SAAS,GAA0B,IAAI,CAAC;IACxC,QAAQ,GAA2B,IAAI,CAAC;IAEhD,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;QAClD,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,2BAAc,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,gCAAmB,CAAC;QAEpE,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACxE,mFAAmF;QACnF,IAAI,IAAI,CAAC,aAAa,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC;YAC1C,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE;aAC5B,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,SAAS;gBACZ,KAAK,YAAY,cAAc;oBAC7B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,cAAc,CAAC,qBAAqB,IAAI,CAAC,GAAG,YAAa,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChH,6DAA6D;YAC7D,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC;YAC1C,MAAM,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAC3B,IAAI,cAAc,CAChB,qBAAqB,IAAI,CAAC,GAAG,YAAY,GAAG,+BAA+B;YACzE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;gBACnB,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,uGAAuG,CAAC,CAC/G,CAAC;QAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,IAAuD,CAAC;QACpE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAE5F,0EAA0E;QAC1E,2DAA2D;QAC3D,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,eAAe,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,2CAA2C,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvE,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AA5FD,sCA4FC"}

package/dist/index.d.ts

@@ -1,6 +1,9 @@
 export * from './jwks-cache';
+export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
 export * from './handshake';
+export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
+export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export * from './webhooks';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';

package/dist/index.js

@@ -14,11 +14,25 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.createTestIssuer = exports.createAtlasClient = void 0;
+exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.createTestIssuer = exports.createAtlasClient = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
+// OIDC discovery of the JWKS URL when only `issuer` is configured.
+var discovery_1 = require("./discovery");
+Object.defineProperty(exports, "DiscoveryError", { enumerable: true, get: function () { return discovery_1.DiscoveryError; } });
+Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: function () { return discovery_1.JwksDiscovery; } });
+Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
+Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
 __exportStar(require("./handshake"), exports);
+// OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
+var logout_token_1 = require("./logout-token");
+Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
+Object.defineProperty(exports, "LOGOUT_TOKEN_CLOCK_SKEW_SECONDS", { enumerable: true, get: function () { return logout_token_1.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS; } });
+Object.defineProperty(exports, "LOGOUT_TOKEN_MAX_AGE_SECONDS", { enumerable: true, get: function () { return logout_token_1.LOGOUT_TOKEN_MAX_AGE_SECONDS; } });
+Object.defineProperty(exports, "LogoutTokenVerifier", { enumerable: true, get: function () { return logout_token_1.LogoutTokenVerifier; } });
+Object.defineProperty(exports, "memoryLogoutReplayStore", { enumerable: true, get: function () { return logout_token_1.memoryLogoutReplayStore; } });
+Object.defineProperty(exports, "verifyLogoutToken", { enumerable: true, get: function () { return logout_token_1.verifyLogoutToken; } });
 // §12.2 inbound webhook verification for consumers.
 __exportStar(require("./webhooks"), exports);
 // The typed management client for the secret-key Backend API.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAE5B,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAGzB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,oDAAoD;AACpD,6CAA2B;AAE3B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAA6C;AAApC,2GAAA,gBAAgB,OAAA;AAGzB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA"}

package/dist/jwks-cache.d.ts

@@ -34,6 +34,12 @@ export interface JwksCacheDeps {
      * when both are given the static set wins and no network call is ever made.
      */
     staticJwks?: Jwks;
+    /**
+     * Resolve the JWKS URL lazily (OIDC discovery) when no fixed `url` is given.
+     * Called on each fetch attempt; it does its own caching. A rejection is
+     * recorded as {@link JwksCache.lastError} and treated like a failed fetch.
+     */
+    resolveUrl?: () => Promise<string>;
     fetchImpl?: typeof fetch;
     now?: () => number;
     ttlMs?: number;
@@ -47,6 +53,8 @@ export declare class JwksCache {
     private lastAttemptAt;
     /** Exposed so a caller can assert the rate limit actually bit. */
     lastOutcome: FetchOutcome;
+    /** Why the last attempt produced no keys (e.g. a discovery failure), for diagnostics. */
+    lastError: string | null;
     constructor(deps: JwksCacheDeps);
     private get now();
     private has;

package/dist/jwks-cache.js

@@ -29,6 +29,8 @@ class JwksCache {
     lastAttemptAt = 0;
     /** Exposed so a caller can assert the rate limit actually bit. */
     lastOutcome = 'fresh';
+    /** Why the last attempt produced no keys (e.g. a discovery failure), for diagnostics. */
+    lastError = null;
     constructor(deps) {
         this.deps = deps;
     }
@@ -62,13 +64,12 @@ class JwksCache {
             this.lastOutcome = 'cached';
             return this.deps.staticJwks;
         }
-        if (this.deps.url === undefined) {
+        if (this.deps.url === undefined && this.deps.resolveUrl === undefined) {
             // Neither a URL nor a static set: nothing to verify against. Report
             // "no keys" rather than attempting `fetch(undefined)`.
             this.lastOutcome = 'failed';
             return null;
         }
-        const url = this.deps.url;
         const now = this.now;
         const ttl = this.deps.ttlMs ?? exports.DEFAULT_TTL_MS;
         const interval = this.deps.refetchIntervalMs ?? exports.REFETCH_INTERVAL_MS;
@@ -88,6 +89,20 @@ class JwksCache {
             return this.cached;
         }
         this.lastAttemptAt = now;
+        let url;
+        if (this.deps.url !== undefined) {
+            url = this.deps.url;
+        }
+        else {
+            try {
+                url = await this.deps.resolveUrl();
+            }
+            catch (error) {
+                this.lastOutcome = 'failed';
+                this.lastError = error instanceof Error ? error.message : String(error);
+                return this.cached;
+            }
+        }
         try {
             const response = await (this.deps.fetchImpl ?? fetch)(url, {
                 headers: { accept: 'application/json' },
@@ -99,13 +114,15 @@ class JwksCache {
                 throw new Error('JWKS is malformed');
             this.cached = body;
             this.fetchedAt = now;
+            this.lastError = null;
             this.lastOutcome = kidMiss ? 'refetched' : 'fresh';
             return this.cached;
         }
-        catch {
+        catch (error) {
             // Keep serving what we have. A JWKS outage should degrade to "new keys
             // do not work yet", not "nobody can authenticate".
             this.lastOutcome = 'failed';
+            this.lastError = `JWKS fetch from ${url} failed: ${error instanceof Error ? error.message : String(error)}`;
             return this.cached;
         }
     }

package/dist/jwks-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAkIH,0BAWC;AA3ID,wEAAwE;AAC3D,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C,+EAA+E;AAClE,QAAA,cAAc,GAAG,SAAS,CAAC;AAwBxC,MAAa,SAAS;IAOS;IANrB,MAAM,GAAgB,IAAI,CAAC;IAC3B,SAAS,GAAG,CAAC,CAAC;IACd,aAAa,GAAG,CAAC,CAAC;IAC1B,kEAAkE;IAClE,WAAW,GAAiB,OAAO,CAAC;IAEpC,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,GAAG,CAAC,GAAuB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,GAAY;QACpB;;;;;WAKG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAc,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,2BAAmB,CAAC;QAEpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAS,CAAC;YAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAE7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;CACF;AAjGD,8BAiGC;AAED,mEAAmE;AACnE,SAAgB,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"jwks-cache.js","sourceRoot":"","sources":["../src/jwks-cache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAwJH,0BAWC;AAjKD,wEAAwE;AAC3D,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C,+EAA+E;AAClE,QAAA,cAAc,GAAG,SAAS,CAAC;AA8BxC,MAAa,SAAS;IASS;IARrB,MAAM,GAAgB,IAAI,CAAC;IAC3B,SAAS,GAAG,CAAC,CAAC;IACd,aAAa,GAAG,CAAC,CAAC;IAC1B,kEAAkE;IAClE,WAAW,GAAiB,OAAO,CAAC;IACpC,yFAAyF;IACzF,SAAS,GAAkB,IAAI,CAAC;IAEhC,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;IAAG,CAAC;IAEpD,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAEO,GAAG,CAAC,GAAuB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,GAAY;QACpB;;;;;WAKG;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC9B,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,oEAAoE;YACpE,uDAAuD;YACvD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,sBAAc,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,2BAAmB,CAAC;QAEpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,QAAQ,EAAE,CAAC;YAC/D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;QAEzB,IAAI,GAAW,CAAC;QAChB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAW,EAAE,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;gBAC5B,IAAI,CAAC,SAAS,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC,MAAM,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;gBACzD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAE5E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAS,CAAC;YAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAE7E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mDAAmD;YACnD,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC;YAC5B,IAAI,CAAC,SAAS,GAAG,mBAAmB,GAAG,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5G,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;CACF;AAjHD,8BAiHC;AAED,mEAAmE;AACnE,SAAgB,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjE,CAAC;QACtB,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/logout-token.d.ts

@@ -0,0 +1,97 @@
+import { JwksCache, type Jwks } from './jwks-cache';
+/**
+ * OpenID Connect Back-Channel Logout 1.0 — verifying the `logout_token` Atlas
+ * POSTs to your `backchannel_logout_uri` when a user's session ends.
+ *
+ * The checks are those of §2.6 of the spec: RS256 signature from the issuer's
+ * JWKS, `iss`, `aud` containing your client id, `iat` present (and not in the
+ * future), `exp` when present, a `jti`, the back-channel-logout event, a `sid`
+ * and/or `sub`, NO `nonce`, and a `typ` of `logout+jwt` when the header has one.
+ */
+/** The event a logout_token carries (and an id_token never does). */
+export declare const BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/** Seconds of clock skew tolerated on `iat` / `exp`. */
+export declare const LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = 5;
+/** Default maximum age of a logout_token (`iat`), in seconds. Atlas mints them with a 2-minute life. */
+export declare const LOGOUT_TOKEN_MAX_AGE_SECONDS = 300;
+/** What a verified logout_token tells you: whose session(s) to end. */
+export interface LogoutTokenClaims {
+    /** The user whose sessions end. At least one of `sub` / `sid` is present. */
+    sub?: string;
+    /** The session that ended — the same `sid` your id_token for it carried. */
+    sid?: string;
+    /** Unique token id; remember it to refuse a replay. */
+    jti: string;
+    /** Issued-at, epoch seconds. */
+    iat: number;
+}
+export type LogoutTokenResult = {
+    ok: true;
+    claims: LogoutTokenClaims;
+} | {
+    ok: false;
+    /**
+     * `malformed`: not a JWT. `no_keys`: the issuer's keys could not be loaded.
+     * `invalid`: a check failed (`detail` says which). `replayed`: the `jti`
+     * was already seen by the replay store.
+     */
+    reason: 'malformed' | 'no_keys' | 'invalid' | 'replayed';
+    detail?: string;
+};
+/**
+ * Remembers logout_token `jti`s so a captured token cannot be replayed. Return
+ * `true` the first time a jti is seen, `false` when it was seen before. Back it
+ * with a shared store (Redis `SET NX PX`, a DB unique key) when you run more
+ * than one server process.
+ */
+export interface LogoutReplayStore {
+    remember(jti: string, expiresAtMs: number): boolean | Promise<boolean>;
+}
+/** An in-process {@link LogoutReplayStore}; entries expire after the token's max age. */
+export declare function memoryLogoutReplayStore(now?: () => number): LogoutReplayStore;
+export interface LogoutTokenVerifierOptions {
+    /** Expected `iss`: your instance's issuer, or `https://atlasauth.net` for Sign in with Atlas apps. */
+    issuer: string;
+    /** Your client id (the `aud` the token must contain). One string or several accepted values. */
+    clientId: string | readonly string[];
+    /** The issuer's JWKS URL. Optional: discovered from the issuer when omitted. */
+    jwksUrl?: string;
+    /** A static key set, for offline verification (tests). Exclusive with `jwksUrl`. */
+    jwks?: Jwks;
+    /** For discovery on the shared host: the instance id (`ins_...`). */
+    instanceId?: string;
+    /** Alternative to `instanceId`: read it from the publishable key. */
+    publishableKey?: string;
+    /** Reject tokens whose `iat` is older than this many seconds. Default 300. */
+    maxAgeSeconds?: number;
+    /** Optional replay protection by `jti`. */
+    replayStore?: LogoutReplayStore;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+/** Per-call settings for checking a logout_token against already-loaded keys. */
+export interface LogoutTokenCheckOptions {
+    issuer: string;
+    clientId: string | readonly string[];
+    maxAgeSeconds?: number;
+    replayStore?: LogoutReplayStore;
+    now?: () => number;
+}
+/**
+ * Verifies logout_tokens. Create one and reuse it: it caches the issuer's keys
+ * (refetching at most once a minute on an unknown `kid`).
+ */
+export declare class LogoutTokenVerifier {
+    private readonly options;
+    private readonly cache;
+    constructor(options: LogoutTokenVerifierOptions);
+    /** Verify a logout_token (the `logout_token` form field of the POST). */
+    verify(token: string): Promise<LogoutTokenResult>;
+}
+/**
+ * One-off verification. Prefer a long-lived {@link LogoutTokenVerifier} on a
+ * server, so the issuer's keys are cached between requests.
+ */
+export declare function verifyLogoutToken(token: string, options: LogoutTokenVerifierOptions): Promise<LogoutTokenResult>;
+/** Shared by {@link LogoutTokenVerifier} and `AtlasBackend.verifyLogoutToken`. */
+export declare function checkLogoutToken(token: string, cache: JwksCache, options: LogoutTokenCheckOptions): Promise<LogoutTokenResult>;