@atlasauth/emulator-core 0.2.0 → 0.3.0

package/dist/handlers/emu4-oauth-auth.d.ts

@@ -0,0 +1,83 @@
+import type { Engine, Reply, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+/**
+ * Client authentication with a signed assertion (`private_key_jwt`, RFC 7523), encryption keys for request objects,
+ * the response modes `form_post` and the JARM family (`jwt`, `query.jwt`, `fragment.jwt`, `form_post.jwt`), pairwise
+ * subject identifiers and software statements for dynamic registration.
+ */
+export declare const ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** The algorithms the OP signs ID tokens, user info and authorization responses (JARM) with. */
+export declare const OP_SIGNING_ALGS: string[];
+export declare const EXT_RESPONSE_MODES: string[];
+interface Issuer {
+    issuer: string;
+    jwks?: {
+        keys: Obj[];
+    };
+    jwks_uri?: string;
+}
+interface AuthState {
+    seen: Map<string, number>;
+    pairwiseSecret: Uint8Array;
+    dcr: {
+        require_software_statement: boolean;
+        software_statement_issuers: Issuer[];
+    };
+}
+export declare const dcrConfig: (e: Engine) => AuthState["dcr"];
+/** The client a `client_assertion` names (its `iss`), for requests that carry no client_id. */
+export declare function assertionClientId(body: Obj): string | undefined;
+/** Authenticate a `private_key_jwt` client; null on success, else the `invalid_client` description. Mirrors the real order of checks. */
+export declare function verifyClientAssertion(e: Engine, body: Obj, client: Obj): Promise<string | null>;
+/** The message when a keyed client authentication method has no key to authenticate with, else null. */
+export declare const keyedClientProblem: (method: unknown, jwks: unknown, jwksUri: unknown) => string | null;
+export declare const AUTH_METHODS: string[];
+/** Publish (make) the encryption key of every algorithm a client registered `request_object_encryption_alg` for. */
+export declare function ensureRegisteredEncryptionKeys(e: Engine): Promise<void>;
+/** The `sub` a client sees for a user: the user id, or for a pairwise client HMAC-SHA256(secret, sector NUL user id). */
+export declare function subjectFor(e: Engine, client: Obj | undefined, userId: string): Promise<string>;
+/**
+ * The subject settings of a registration (OIDC Registration section 2), as the real validator words them. Returns the
+ * fields to store, or a message and the parameter. `existing` is the stored client on an update.
+ */
+export declare function resolveSubject(e: Engine, input: {
+    subject_type?: unknown;
+    sector_identifier_uri?: unknown;
+    redirect_uris: string[];
+    redirectUrisChanged: boolean;
+    existing?: Obj;
+    publisherSector?: string | null;
+}): Promise<{
+    ok: true;
+    value: Obj;
+} | {
+    ok: false;
+    message: string;
+    param: string;
+}>;
+/** The claims of a software statement signed by an approved publisher, or the registration error. */
+export declare function verifySoftwareStatement(e: Engine, statement: string): Promise<{
+    ok: true;
+    claims: Obj;
+} | {
+    ok: false;
+    error: string;
+    message: string;
+}>;
+/**
+ * Deliver an authorization response. `location` is the redirect the plain modes use (parameters in its query or
+ * fragment); `form_post` answers an auto-submitting form instead and a JARM mode packs the parameters into one signed
+ * `response` (iss, aud, exp = ten minutes) in the client's `authorization_signed_response_alg`.
+ */
+export declare function authReply(e: Engine, client: Obj | undefined, redirectUri: string, location: string, mode: string | null): Promise<Reply>;
+export declare function clientExtras(c: Obj): Obj;
+/** Validate the fields this module adds to a client create/update body; only keys present are returned. */
+export declare function parseExtraClientFields(body: Obj): {
+    ok: true;
+    value: Obj;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function emu4AuthHandlers(): RouteDef[];
+export {};

package/dist/handlers/emu4-oauth-auth.js

@@ -0,0 +1,363 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_METHODS = exports.keyedClientProblem = exports.dcrConfig = exports.EXT_RESPONSE_MODES = exports.OP_SIGNING_ALGS = exports.ASSERTION_TYPE = void 0;
+exports.assertionClientId = assertionClientId;
+exports.verifyClientAssertion = verifyClientAssertion;
+exports.ensureRegisteredEncryptionKeys = ensureRegisteredEncryptionKeys;
+exports.subjectFor = subjectFor;
+exports.resolveSubject = resolveSubject;
+exports.verifySoftwareStatement = verifySoftwareStatement;
+exports.authReply = authReply;
+exports.clientExtras = clientExtras;
+exports.parseExtraClientFields = parseExtraClientFields;
+exports.emu4AuthHandlers = emu4AuthHandlers;
+const crypto_util_1 = require("../crypto-util");
+const errors_1 = require("../errors");
+const jws_1 = require("../jws");
+const jwe_1 = require("../jwe");
+const oauth_adv_1 = require("./oauth-adv");
+const emu4_oauth_audit_1 = require("./emu4-oauth-audit");
+const support_1 = require("./support");
+/**
+ * Client authentication with a signed assertion (`private_key_jwt`, RFC 7523), encryption keys for request objects,
+ * the response modes `form_post` and the JARM family (`jwt`, `query.jwt`, `fragment.jwt`, `form_post.jwt`), pairwise
+ * subject identifiers and software statements for dynamic registration.
+ */
+exports.ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+/** The algorithms the OP signs ID tokens, user info and authorization responses (JARM) with. */
+exports.OP_SIGNING_ALGS = ['RS256', 'PS256', 'ES256', 'ES384', 'EdDSA'];
+exports.EXT_RESPONSE_MODES = ['form_post', 'jwt', 'query.jwt', 'fragment.jwt', 'form_post.jwt'];
+const CLOCK_SKEW_S = 5;
+const authState = (0, support_1.engineState)(() => ({ seen: new Map(), pairwiseSecret: crypto.getRandomValues(new Uint8Array(32)), dcr: { require_software_statement: false, software_statement_issuers: [] } }));
+const dcrConfig = (e) => authState(e).dcr;
+exports.dcrConfig = dcrConfig;
+const fetchOf = (e) => e.options.fetch ?? fetch;
+/** The public keys of a client (inline `jwks`, else fetched from `jwks_uri`), narrowed to the signing keys named by `kid`. */
+async function signingKeysOf(e, holder, kid) {
+    let keys = Array.isArray(holder.jwks?.keys) ? holder.jwks.keys : [];
+    if (!keys.length && holder.jwks_uri) {
+        try {
+            const res = await fetchOf(e)(holder.jwks_uri);
+            keys = res.ok ? ((await res.json()).keys ?? []) : [];
+        }
+        catch {
+            keys = [];
+        }
+    }
+    return keys.filter((k) => k.use !== 'enc' && (!kid || k.kid === kid));
+}
+/** The client a `client_assertion` names (its `iss`), for requests that carry no client_id. */
+function assertionClientId(body) {
+    const a = typeof body.client_assertion === 'string' ? (0, jws_1.decodeJwt)(body.client_assertion) : null;
+    return typeof a?.payload.iss === 'string' ? a.payload.iss : undefined;
+}
+/** Authenticate a `private_key_jwt` client; null on success, else the `invalid_client` description. Mirrors the real order of checks. */
+async function verifyClientAssertion(e, body, client) {
+    const assertion = body.client_assertion;
+    if (body.client_assertion_type !== exports.ASSERTION_TYPE || typeof assertion !== 'string' || !assertion)
+        return 'This client must authenticate with a private_key_jwt client assertion.';
+    const jwt = (0, jws_1.decodeJwt)(assertion);
+    const alg = String(jwt?.header.alg ?? '');
+    if (!jwt || !oauth_adv_1.REQUEST_OBJECT_ALGS.includes(alg))
+        return 'The client assertion signature is invalid or expired.';
+    const keys = await signingKeysOf(e, client, typeof jwt.header.kid === 'string' ? jwt.header.kid : undefined);
+    if (!keys.length)
+        return 'The client has no resolvable keys for its assertion.';
+    let verified = false;
+    for (const k of keys)
+        if ((verified = await (0, jws_1.verifyJws)(jwt, k)))
+            break;
+    const nowS = e.clock.now() / 1000;
+    const c = jwt.payload;
+    if (!verified || (typeof c.exp === 'number' && c.exp + CLOCK_SKEW_S <= nowS) || (typeof c.nbf === 'number' && c.nbf - CLOCK_SKEW_S > nowS))
+        return 'The client assertion signature is invalid or expired.';
+    if (c.iss !== client.id || c.sub !== client.id)
+        return 'The client assertion iss and sub must equal the client_id.';
+    const auds = Array.isArray(c.aud) ? c.aud : [c.aud];
+    const accepted = [`${e.issuer}/oauth2/token`, `${e.issuer}/oauth2/par`, e.issuer];
+    if (!auds.some((a) => typeof a === 'string' && accepted.includes(a)))
+        return 'The client assertion audience does not match this endpoint.';
+    if (typeof c.exp !== 'number')
+        return 'The client assertion must carry an exp.';
+    if (typeof c.jti !== 'string' || !c.jti)
+        return 'The client assertion must carry a jti.';
+    // Single use until the assertion's own expiry.
+    const seen = authState(e).seen;
+    const now = e.clock.now();
+    for (const [k, until] of seen)
+        if (until <= now)
+            seen.delete(k);
+    const key = `${client.id}:${c.jti}`;
+    if (seen.has(key))
+        return 'The client assertion has already been used.';
+    seen.set(key, c.exp * 1000);
+    return null;
+}
+/** The message when a keyed client authentication method has no key to authenticate with, else null. */
+const keyedClientProblem = (method, jwks, jwksUri) => (method === 'private_key_jwt' && !jwks && !jwksUri ? 'private_key_jwt needs jwks or jwks_uri.' : null);
+exports.keyedClientProblem = keyedClientProblem;
+exports.AUTH_METHODS = ['none', 'client_secret_basic', 'client_secret_post', 'private_key_jwt'];
+// ── encryption keys for request objects ─────────────────────────────
+/** Publish (make) the encryption key of every algorithm a client registered `request_object_encryption_alg` for. */
+async function ensureRegisteredEncryptionKeys(e) {
+    for (const c of e.db.oauthClients.all()) {
+        if (!c.deleted && (0, jwe_1.isOpDecryptAlg)(c.request_object_encryption_alg))
+            await e.tokens.ensureEncryptionKey(c.request_object_encryption_alg);
+    }
+}
+// ── pairwise subject identifiers (OIDC Core section 8) ─────────────
+const pairwiseOf = (c) => c.subject_type === 'pairwise' && typeof c.sector_identifier === 'string' && !!c.sector_identifier;
+/** The `sub` a client sees for a user: the user id, or for a pairwise client HMAC-SHA256(secret, sector NUL user id). */
+async function subjectFor(e, client, userId) {
+    if (!client || !pairwiseOf(client))
+        return userId;
+    const key = await crypto.subtle.importKey('raw', authState(e).pairwiseSecret, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return (0, crypto_util_1.bytesToB64url)(new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${client.sector_identifier}\u0000${userId}`))));
+}
+const redirectSector = (uri) => {
+    try {
+        const u = new URL(uri);
+        return u.hostname ? u.hostname.toLowerCase() : u.protocol.replace(/:$/, '').toLowerCase() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * The subject settings of a registration (OIDC Registration section 2), as the real validator words them. Returns the
+ * fields to store, or a message and the parameter. `existing` is the stored client on an update.
+ */
+async function resolveSubject(e, input) {
+    const fail = (message, param) => ({ ok: false, message, param });
+    if (input.publisherSector) {
+        if (input.subject_type !== undefined || input.sector_identifier_uri !== undefined)
+            return fail(`This client belongs to a publisher that shares the sector ${input.publisherSector}. Detach it from the publisher before changing subject_type or sector_identifier_uri.`, input.subject_type !== undefined ? 'subject_type' : 'sector_identifier_uri');
+        return { ok: true, value: {} };
+    }
+    if (input.subject_type !== undefined && input.subject_type !== 'public' && input.subject_type !== 'pairwise')
+        return fail('subject_type must be public or pairwise.', 'subject_type');
+    let sectorUri;
+    if (input.sector_identifier_uri !== undefined) {
+        const raw = input.sector_identifier_uri;
+        if (raw === null || raw === '')
+            sectorUri = null;
+        else if (typeof raw !== 'string')
+            return fail('sector_identifier_uri must be an https URL.', 'sector_identifier_uri');
+        else {
+            let url;
+            try {
+                url = new URL(raw.trim());
+            }
+            catch {
+                return fail('sector_identifier_uri must be an https URL.', 'sector_identifier_uri');
+            }
+            if (url.protocol !== 'https:' || url.hash || url.username || url.password)
+                return fail('sector_identifier_uri must be an https URL with no fragment or credentials.', 'sector_identifier_uri');
+            sectorUri = url.toString();
+        }
+    }
+    if (input.subject_type === undefined && input.sector_identifier_uri === undefined && !input.redirectUrisChanged)
+        return { ok: true, value: {} };
+    const subjectType = input.subject_type ?? input.existing?.subject_type ?? 'public';
+    const effectiveUri = sectorUri !== undefined ? sectorUri : (input.existing?.sector_identifier_uri ?? null);
+    if (effectiveUri && (sectorUri !== undefined || input.redirectUrisChanged)) {
+        let listed;
+        try {
+            const res = await fetchOf(e)(effectiveUri, { method: 'GET', headers: { accept: 'application/json' }, redirect: 'manual' });
+            if (res.status !== 200)
+                return fail(`The sector_identifier_uri answered ${res.status}; it must answer 200 with a JSON array.`, 'sector_identifier_uri');
+            listed = JSON.parse(await res.text());
+        }
+        catch (err) {
+            return fail(err instanceof SyntaxError ? 'The sector_identifier_uri must serve a JSON array of redirect URIs.' : 'The sector_identifier_uri could not be fetched.', 'sector_identifier_uri');
+        }
+        if (!Array.isArray(listed) || !listed.every((u) => typeof u === 'string'))
+            return fail('The sector_identifier_uri must serve a JSON array of redirect URIs.', 'sector_identifier_uri');
+        const missing = input.redirect_uris.filter((u) => !listed.includes(u));
+        if (missing.length)
+            return fail(`The sector_identifier_uri does not list every redirect_uri (missing: ${missing.join(', ')}).`, 'sector_identifier_uri');
+    }
+    let sector = null;
+    if (subjectType === 'pairwise') {
+        if (effectiveUri)
+            sector = new URL(effectiveUri).hostname.toLowerCase();
+        else {
+            const hosts = [...new Set(input.redirect_uris.map(redirectSector))];
+            if (hosts.length !== 1 || !hosts[0])
+                return fail('A pairwise client whose redirect_uris span more than one host must register a sector_identifier_uri.', 'sector_identifier_uri');
+            sector = hosts[0];
+        }
+        const previous = input.existing?.subject_type === 'pairwise' ? input.existing.sector_identifier : null;
+        if (previous && previous !== sector)
+            return fail(`This change would move the client's sector from ${previous} to ${sector}, which changes every user's subject identifier. Register a sector_identifier_uri on ${previous} that lists the new redirect_uris instead.`, input.redirectUrisChanged && sectorUri === undefined ? 'redirect_uris' : 'sector_identifier_uri');
+    }
+    const value = { sector_identifier: sector };
+    if (input.subject_type !== undefined || !input.existing)
+        value.subject_type = subjectType;
+    if (sectorUri !== undefined)
+        value.sector_identifier_uri = sectorUri;
+    return { ok: true, value };
+}
+// ── software statements (RFC 7591 section 2.3) ─────────────────────
+const REGISTERED = new Set(['iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti']);
+/** The claims of a software statement signed by an approved publisher, or the registration error. */
+async function verifySoftwareStatement(e, statement) {
+    const jwt = (0, jws_1.decodeJwt)(statement);
+    if (!jwt)
+        return { ok: false, error: 'invalid_software_statement', message: 'The software statement is not a JWT.' };
+    const trusted = (0, exports.dcrConfig)(e).software_statement_issuers.find((i) => i.issuer === jwt.payload.iss);
+    if (!trusted)
+        return { ok: false, error: 'unapproved_software_statement', message: 'The software statement publisher is not approved on this server.' };
+    const keys = await signingKeysOf(e, trusted, typeof jwt.header.kid === 'string' ? jwt.header.kid : undefined);
+    if (!keys.length)
+        return { ok: false, error: 'invalid_software_statement', message: 'The software publisher keys could not be loaded.' };
+    let ok = false;
+    if (oauth_adv_1.REQUEST_OBJECT_ALGS.includes(String(jwt.header.alg)))
+        for (const k of keys)
+            if ((ok = await (0, jws_1.verifyJws)(jwt, k)))
+                break;
+    const nowS = e.clock.now() / 1000;
+    const p = jwt.payload;
+    if (!ok || (typeof p.exp === 'number' && p.exp + CLOCK_SKEW_S <= nowS) || (typeof p.nbf === 'number' && p.nbf - CLOCK_SKEW_S > nowS))
+        return { ok: false, error: 'invalid_software_statement', message: 'The software statement signature or claims are invalid.' };
+    return { ok: true, claims: Object.fromEntries(Object.entries(p).filter(([k]) => !REGISTERED.has(k))) };
+}
+// ── response modes ──────────────────────────────────────────────────
+const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+function formPost(redirectUri, params) {
+    const fields = Object.entries(params).map(([k, v]) => `<input type="hidden" name="${esc(k)}" value="${esc(v)}">`).join('\n');
+    const html = `<!doctype html>\n<html lang="en"><head><meta charset="utf-8"><title>Signing in...</title></head>\n<body><form method="post" action="${esc(redirectUri)}">\n${fields}\n<noscript><p>Your browser has JavaScript disabled. Continue to finish signing in.</p><button type="submit">Continue</button></noscript>\n</form><script>document.forms[0].submit();</script></body></html>`;
+    return { status: 200, raw: html, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', pragma: 'no-cache', 'referrer-policy': 'no-referrer', 'x-frame-options': 'DENY' } };
+}
+/**
+ * Deliver an authorization response. `location` is the redirect the plain modes use (parameters in its query or
+ * fragment); `form_post` answers an auto-submitting form instead and a JARM mode packs the parameters into one signed
+ * `response` (iss, aud, exp = ten minutes) in the client's `authorization_signed_response_alg`.
+ */
+async function authReply(e, client, redirectUri, location, mode) {
+    const plain = { status: 302, headers: { location, 'cache-control': 'no-store' } };
+    if (!mode || !exports.EXT_RESPONSE_MODES.includes(mode))
+        return plain;
+    const u = new URL(location);
+    const inFragment = u.hash.length > 1;
+    const found = new URLSearchParams(inFragment ? u.hash.slice(1) : u.search);
+    if (!inFragment)
+        for (const k of new URL(redirectUri).searchParams.keys())
+            found.delete(k);
+    const params = Object.fromEntries(found.entries());
+    if (mode === 'form_post')
+        return formPost(redirectUri, params);
+    const claims = { ...params, iss: e.issuer, aud: client?.id, sub: undefined, token_use: undefined };
+    const jwt = await e.tokens.signClaimsAs(client?.authorization_signed_response_alg ?? null, claims, 600);
+    const base = new URL(redirectUri);
+    if (mode === 'form_post.jwt')
+        return formPost(redirectUri, { response: jwt });
+    // A response that may carry tokens never rides in the query: `query.jwt` and `jwt` answer in the fragment then.
+    const fragment = mode === 'fragment.jwt' || (inFragment && (mode === 'jwt' || mode === 'query.jwt'));
+    if (fragment)
+        base.hash = new URLSearchParams({ response: jwt }).toString();
+    else
+        base.searchParams.set('response', jwt);
+    return { status: 302, headers: { location: base.toString(), 'cache-control': 'no-store' } };
+}
+// ── client fields this module adds to a client's view ──────────────
+function clientExtras(c) {
+    return {
+        ...(c.authorization_signed_response_alg ? { authorization_signed_response_alg: c.authorization_signed_response_alg } : {}),
+        ...(c.request_object_encryption_alg ? { request_object_encryption_alg: c.request_object_encryption_alg, request_object_encryption_enc: c.request_object_encryption_enc ?? 'A128CBC-HS256' } : {}),
+        ...(c.id_token_signed_response_alg ? { id_token_signed_response_alg: c.id_token_signed_response_alg } : {}),
+        homepage_url: c.homepage_url ?? null,
+        subject_type: c.subject_type ?? 'public',
+        sector_identifier_uri: c.sector_identifier_uri ?? null,
+        sector_identifier: c.sector_identifier ?? null,
+        publisher_id: c.publisher_id ?? null,
+    };
+}
+/** Validate the fields this module adds to a client create/update body; only keys present are returned. */
+function parseExtraClientFields(body) {
+    const out = {};
+    const bad = (message) => ({ ok: false, message });
+    if (body.authorization_signed_response_alg !== undefined) {
+        const v = body.authorization_signed_response_alg;
+        if (v === null)
+            out.authorization_signed_response_alg = null;
+        else if (typeof v !== 'string' || !exports.OP_SIGNING_ALGS.includes(v))
+            return bad(`authorization_signed_response_alg must be one of: ${exports.OP_SIGNING_ALGS.join(', ')}.`);
+        else
+            out.authorization_signed_response_alg = v;
+    }
+    if (body.id_token_signed_response_alg !== undefined) {
+        const v = body.id_token_signed_response_alg;
+        if (v === null)
+            out.id_token_signed_response_alg = null;
+        else if (typeof v !== 'string' || !exports.OP_SIGNING_ALGS.includes(v))
+            return bad(`id_token_signed_response_alg must be one of: ${exports.OP_SIGNING_ALGS.join(', ')}.`);
+        else
+            out.id_token_signed_response_alg = v;
+    }
+    if (body.request_object_encryption_alg !== undefined) {
+        const v = body.request_object_encryption_alg;
+        if (v === null)
+            out.request_object_encryption_alg = null;
+        else if (typeof v !== 'string' || !jwe_1.OP_DECRYPT_ALGS.includes(v))
+            return bad(`request_object_encryption_alg must be one of: ${jwe_1.OP_DECRYPT_ALGS.join(', ')}.`);
+        else
+            out.request_object_encryption_alg = v;
+    }
+    if (body.request_object_encryption_enc !== undefined) {
+        const v = body.request_object_encryption_enc;
+        if (v === null)
+            out.request_object_encryption_enc = null;
+        else if (typeof v !== 'string' || !jwe_1.JWE_ENCS.includes(v))
+            return bad(`request_object_encryption_enc must be one of: ${jwe_1.JWE_ENCS.join(', ')}.`);
+        else
+            out.request_object_encryption_enc = v;
+    }
+    if (body.homepage_url !== undefined) {
+        const v = body.homepage_url;
+        if (v === null || v === '')
+            out.homepage_url = null;
+        else {
+            let ok = typeof v === 'string' && v.length <= 2048;
+            try {
+                ok = ok && new URL(v).protocol === 'https:';
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok)
+                return bad('homepage_url must be an absolute https URL.');
+            out.homepage_url = v;
+        }
+    }
+    return { ok: true, value: out };
+}
+function emu4AuthHandlers() {
+    return [
+        {
+            // Which publishers may sign a software statement, and whether dynamic registration demands one.
+            method: 'POST',
+            pattern: '/__emulator/oauth/dcr',
+            public: true,
+            handler: (c) => {
+                const cfg = (0, exports.dcrConfig)(c.engine);
+                if (c.body.require_software_statement !== undefined) {
+                    if (typeof c.body.require_software_statement !== 'boolean')
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'require_software_statement must be true or false.', 'require_software_statement');
+                    cfg.require_software_statement = c.body.require_software_statement;
+                }
+                const issuers = c.body.software_statement_issuers;
+                if (issuers !== undefined) {
+                    if (!Array.isArray(issuers) || issuers.some((i) => !i || typeof i.issuer !== 'string' || (!i.jwks && !i.jwks_uri)))
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'software_statement_issuers must be a list of { issuer, jwks | jwks_uri }.', 'software_statement_issuers');
+                    cfg.software_statement_issuers = issuers;
+                }
+                return { body: { ...cfg } };
+            },
+        },
+        // The audit rows the signing-key, publisher and delivery routes wrote (newest last); `action` narrows them.
+        { method: 'GET', pattern: '/__emulator/oauth/audit', public: true, handler: (c) => ({ body: { object: 'list', data: (0, emu4_oauth_audit_1.auditOf)(c.engine).filter((r) => !c.query.get('action') || r.action === c.query.get('action')) } }) },
+        { method: 'GET', pattern: '/__emulator/oauth/dcr', public: true, handler: (c) => ({ body: { ...(0, exports.dcrConfig)(c.engine) } }) },
+    ];
+}
+//# sourceMappingURL=emu4-oauth-auth.js.map

package/dist/handlers/emu4-oauth-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emu4-oauth-auth.js","sourceRoot":"","sources":["../../src/handlers/emu4-oauth-auth.ts"],"names":[],"mappings":";;;AAoDA,8CAGC;AAGD,sDA2BC;AASD,wEAIC;AAOD,gCAIC;AAeD,wCAsDC;AAMD,0DAaC;AAgBD,8BAkBC;AAID,oCAWC;AAGD,wDA0CC;AAED,4CAyBC;AA5TD,gDAA+C;AAC/C,sCAA0C;AAC1C,gCAA8C;AAC9C,gCAAmE;AAEnE,2CAAkD;AAClD,yDAA6C;AAC7C,uCAAwC;AAExC;;;;GAIG;AACU,QAAA,cAAc,GAAG,wDAAwD,CAAC;AACvF,gGAAgG;AACnF,QAAA,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChE,QAAA,kBAAkB,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AACrG,MAAM,YAAY,GAAG,CAAC,CAAC;AAYvB,MAAM,SAAS,GAAG,IAAA,qBAAW,EAAC,GAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvM,MAAM,SAAS,GAAG,CAAC,CAAS,EAAoB,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAA9D,QAAA,SAAS,aAAqD;AAE3E,MAAM,OAAO,GAAG,CAAC,CAAS,EAAgB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;AAEtE,8HAA8H;AAC9H,KAAK,UAAU,aAAa,CAAC,CAAS,EAAE,MAAoE,EAAE,GAAY;IACxH,IAAI,IAAI,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAK,CAAC,IAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+FAA+F;AAC/F,SAAgB,iBAAiB,CAAC,IAAS;IACzC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,eAAS,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,OAAO,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,yIAAyI;AAClI,KAAK,UAAU,qBAAqB,CAAC,CAAS,EAAE,IAAS,EAAE,MAAW;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACxC,IAAI,IAAI,CAAC,qBAAqB,KAAK,sBAAc,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS;QAAE,OAAO,wEAAwE,CAAC;IAClL,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,SAAS,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,+BAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,uDAAuD,CAAC;IAC/G,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7G,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,sDAAsD,CAAC;IAChF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM;IACtE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,YAAY,GAAG,IAAI,CAAC;QAAE,OAAO,uDAAuD,CAAC;IAC3M,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO,4DAA4D,CAAC;IACpH,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,eAAe,EAAE,GAAG,CAAC,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,6DAA6D,CAAC;IACpJ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,yCAAyC,CAAC;IAChF,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;QAAE,OAAO,wCAAwC,CAAC;IACzF,+CAA+C;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI;QAAE,IAAI,KAAK,IAAI,GAAG;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACjG,MAAM,kBAAkB,GAAG,CAAC,MAAe,EAAE,IAAa,EAAE,OAAgB,EAAiB,EAAE,CAAC,CAAC,MAAM,KAAK,iBAAiB,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAAjM,QAAA,kBAAkB,sBAA+K;AACjM,QAAA,YAAY,GAAG,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;AAErG,uEAAuE;AAEvE,oHAAoH;AAC7G,KAAK,UAAU,8BAA8B,CAAC,CAAS;IAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,IAAA,oBAAc,EAAC,CAAC,CAAC,6BAA6B,CAAC;YAAE,MAAM,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;IACzI,CAAC;AACH,CAAC;AAED,sEAAsE;AAEtE,MAAM,UAAU,GAAG,CAAC,CAAM,EAAW,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAE1I,yHAAyH;AAClH,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,MAAuB,EAAE,MAAc;IACjF,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,cAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAClJ,OAAO,IAAA,2BAAa,EAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,iBAAiB,SAAS,MAAM,EAAE,CAAiB,CAAC,CAAC,CAAC,CAAC;AACtK,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,GAAW,EAAsB,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,CAAS,EAAE,KAA0K;IACxN,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,6DAA6D,KAAK,CAAC,eAAe,uFAAuF,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACvV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,0CAA0C,EAAE,cAAc,CAAC,CAAC;IACtL,IAAI,SAAoC,CAAC;IACzC,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,qBAAqB,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS,GAAG,IAAI,CAAC;aAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,uBAAuB,CAAC,CAAC;aACjH,CAAC;YACJ,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,6CAA6C,EAAE,uBAAuB,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,6EAA6E,EAAE,uBAAuB,CAAC,CAAC;YAC/L,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChJ,MAAM,WAAW,GAAI,KAAK,CAAC,YAAmC,IAAK,KAAK,CAAC,QAAQ,EAAE,YAAmC,IAAI,QAAQ,CAAC;IACnI,MAAM,YAAY,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,QAAQ,EAAE,qBAAmD,IAAI,IAAI,CAAC,CAAC;IAC1I,IAAI,YAAY,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3H,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,sCAAsC,GAAG,CAAC,MAAM,yCAAyC,EAAE,uBAAuB,CAAC,CAAC;YACxJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,qEAAqE,CAAC,CAAC,CAAC,iDAAiD,EAAE,uBAAuB,CAAC,CAAC;QAC/L,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC,qEAAqE,EAAE,uBAAuB,CAAC,CAAC;QACvL,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,MAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,wEAAwE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC3J,CAAC;IACD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,IAAI,YAAY;YAAE,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;aACnE,CAAC;YACJ,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,sGAAsG,EAAE,uBAAuB,CAAC,CAAC;YAClL,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,YAAY,KAAK,UAAU,CAAC,CAAC,CAAE,KAAK,CAAC,QAAQ,CAAC,iBAAmC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1H,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,mDAAmD,QAAQ,OAAO,MAAM,wFAAwF,QAAQ,4CAA4C,EAAE,KAAK,CAAC,mBAAmB,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC3W,CAAC;IACD,MAAM,KAAK,GAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,YAAY,GAAG,WAAW,CAAC;IAC1F,IAAI,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,qBAAqB,GAAG,SAAS,CAAC;IACrE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,sEAAsE;AAEtE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9E,qGAAqG;AAC9F,KAAK,UAAU,uBAAuB,CAAC,CAAS,EAAE,SAAiB;IACxE,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACrH,MAAM,OAAO,GAAG,IAAA,iBAAS,EAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACxJ,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9G,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IACzI,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,IAAI,+BAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,EAAE,GAAG,MAAM,IAAA,eAAS,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAE,MAAM;IAC1H,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,YAAY,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;IACpQ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,uEAAuE;AAEvE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvJ,SAAS,QAAQ,CAAC,WAAmB,EAAE,MAA8B;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,uIAAuI,GAAG,CAAC,WAAW,CAAC,OAAO,MAAM,8MAA8M,CAAC;IAChY,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC;AAC3M,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,CAAS,EAAE,MAAuB,EAAE,WAAmB,EAAE,QAAgB,EAAE,IAAmB;IAC5H,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC,IAAI,IAAI,CAAC,0BAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU;QAAE,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACxG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,iCAAiC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,gHAAgH;IAChH,MAAM,QAAQ,GAAG,IAAI,KAAK,cAAc,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;IACrG,IAAI,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;;QACvE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED,sEAAsE;AAEtE,SAAgB,YAAY,CAAC,CAAM;IACjC,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,EAAE,iCAAiC,EAAE,CAAC,CAAC,iCAAiC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,GAAG,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,6BAA6B,EAAE,CAAC,CAAC,6BAA6B,EAAE,6BAA6B,EAAE,CAAC,CAAC,6BAA6B,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjM,GAAG,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;QACpC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,QAAQ;QACxC,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,IAAI,IAAI;QACtD,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,SAAgB,sBAAsB,CAAC,IAAS;IAC9C,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,iCAAiC,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,iCAAiC,CAAC;QACjD,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,iCAAiC,GAAG,IAAI,CAAC;aACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,uBAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,qDAAqD,uBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC1J,GAAG,CAAC,iCAAiC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,4BAA4B,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,4BAA4B,GAAG,IAAI,CAAC;aACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,uBAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,gDAAgD,uBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YACrJ,GAAG,CAAC,4BAA4B,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,6BAA6B,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,6BAA6B,GAAG,IAAI,CAAC;aACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,qBAAe,CAAC,QAAQ,CAAC,CAAQ,CAAC;YAAE,OAAO,GAAG,CAAC,iDAAiD,qBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC7J,GAAG,CAAC,6BAA6B,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,6BAA6B,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,6BAA6B,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,6BAA6B,GAAG,IAAI,CAAC;aACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,cAAQ,CAAC,QAAQ,CAAC,CAAQ,CAAC;YAAE,OAAO,GAAG,CAAC,iDAAiD,cAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC/I,GAAG,CAAC,6BAA6B,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;aAC/C,CAAC;YACJ,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YACnD,IAAI,CAAC;gBACH,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,KAAK,CAAC;YACb,CAAC;YACD,IAAI,CAAC,EAAE;gBAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAC;YACnE,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC;AAED,SAAgB,gBAAgB;IAC9B,OAAO;QACL;YACE,gGAAgG;YAChG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,CAAe,EAAE,EAAE;gBAC3B,MAAM,GAAG,GAAG,IAAA,iBAAS,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAChC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;oBACpD,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,KAAK,SAAS;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,mDAAmD,EAAE,4BAA4B,CAAC,CAAC;oBAC5L,GAAG,CAAC,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;gBACrE,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;gBAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;wBAAE,MAAM,IAAI,sBAAa,CAAC,mBAAmB,EAAE,2EAA2E,EAAE,4BAA4B,CAAC,CAAC;oBAC5Q,GAAG,CAAC,0BAA0B,GAAG,OAAO,CAAC;gBAC3C,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC;YAC9B,CAAC;SACF;QACD,4GAA4G;QAC5G,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAA,0BAAO,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACtO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAA,iBAAS,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE;KACxI,CAAC;AACJ,CAAC"}

package/dist/handlers/emu4-oauth-delivery.d.ts

@@ -0,0 +1,68 @@
+import type { Engine, RouteDef } from '../engine';
+import type { Obj } from '../openapi';
+/**
+ * Queued, retried delivery of back-channel logout tokens and CIBA ping/push notifications, on the engine clock.
+ *
+ * The first attempt is made at once (the request that caused the delivery waits for it); a failure is retried on the
+ * real schedule (5 s, 5 min, 30 min, 2 h, 5 h, 10 h: six attempts in all) when the clock reaches it. Time moves with
+ * `POST /__emulator/time/advance` (which runs everything that came due) or `POST /__emulator/oauth/deliveries/run`;
+ * every attempt is kept so a test can read what the receiver saw. An OIDC relying party that answers and refuses
+ * (4xx other than 408 and 429) is not retried (back-channel logout section 2.5), nor is a test send.
+ */
+export declare const RETRY_SCHEDULE_MS: number[];
+export declare const MAX_ATTEMPTS: number;
+interface Attempt {
+    attempt: number;
+    at: number;
+    http_status: number | null;
+    error: string | null;
+    success: boolean;
+    location: string | null;
+}
+interface Delivery {
+    id: string;
+    kind: 'backchannel_logout' | 'ciba_ping' | 'ciba_push';
+    client_id: string;
+    endpoint: string;
+    /** Logout: the user and session the token names. */
+    user_id: string | null;
+    sid: string | null;
+    /** CIBA: the request, the bearer token and the JSON body. */
+    request_id: string | null;
+    bearer: string | null;
+    payload: Obj | null;
+    is_test: boolean;
+    status: 'pending' | 'success' | 'failed';
+    attempt_number: number;
+    http_status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+    location: string | null;
+    response_snippet: string | null;
+    next_retry_at: number | null;
+    attempted_at: number | null;
+    delivered_at: number | null;
+    created_at: number;
+    attempts: Attempt[];
+}
+/** Queue a back-channel logout for a client's session and make the first attempt. */
+export declare function enqueueBackchannelLogout(e: Engine, client: Obj, input: {
+    userId: string;
+    sid: string;
+}): Promise<Delivery>;
+/** Queue a CIBA ping (only the `auth_req_id`) or push (the token response or the refusal) and make the first attempt. */
+export declare function enqueueCiba(e: Engine, input: {
+    kind: 'ciba_ping' | 'ciba_push';
+    clientId: string;
+    requestId: string;
+    endpoint: string;
+    token: string;
+    payload: Obj;
+}): Promise<Delivery>;
+/**
+ * Everything the clock made due: push requests that expired undecided are announced (`expired_token`), then every
+ * delivery whose retry time has come is attempted, oldest first. Returns how many attempts ran.
+ */
+export declare function runDueDeliveries(e: Engine): Promise<number>;
+export declare function emu4DeliveryHandlers(): RouteDef[];
+export {};