@atlasauth/emulator-core 0.2.0 → 0.3.0

package/dist/handlers/oauth.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.splitScope = exports.fail = exports.resetOAuth = exports.st = void 0;
+exports.userClaims = exports.splitScope = exports.fail = exports.resetOAuth = exports.st = void 0;
 exports.discoveryDocument = discoveryDocument;
 exports.authenticateClient = authenticateClient;
 exports.mintAccess = mintAccess;
 exports.issueTokens = issueTokens;
+exports.idTokenFor = idTokenFor;
+exports.revokeGrant = revokeGrant;
+exports.checkResourceToken = checkResourceToken;
 exports.issueCode = issueCode;
 exports.oauthHandlers = oauthHandlers;
 const crypto_util_1 = require("../crypto-util");
@@ -13,7 +16,10 @@ const openapi_1 = require("../openapi");
 const store_1 = require("../store");
 const jws_1 = require("../jws");
 const oauth_flows_1 = require("./oauth-flows");
+const oauth_adv_1 = require("./oauth-adv");
 const util_1 = require("./util");
+const emu4_oauth_auth_1 = require("./emu4-oauth-auth");
+const emu4_oauth_pub_1 = require("./emu4-oauth-pub");
 /**
  * The OAuth 2.0 / OpenID Connect provider: client registry (`/v1/oauth_clients`), discovery, authorize (code + PKCE
  * S256), token (authorization_code, refresh_token with rotation and reuse detection, client_credentials, token
@@ -51,20 +57,39 @@ function discoveryDocument(e) {
         userinfo_endpoint: `${iss}/oauth2/userinfo`,
         revocation_endpoint: `${iss}/oauth2/revoke`,
         introspection_endpoint: `${iss}/oauth2/introspect`,
-        response_types_supported: ['code'],
-        response_modes_supported: ['query'],
-        grant_types_supported: ['authorization_code', 'refresh_token', 'client_credentials', EXCHANGE, 'urn:ietf:params:oauth:grant-type:device_code', 'urn:openid:params:grant-type:ciba'],
+        end_session_endpoint: `${iss}/oauth2/logout`,
+        backchannel_logout_supported: true,
+        backchannel_logout_session_supported: true,
+        frontchannel_logout_supported: true,
+        frontchannel_logout_session_supported: true,
+        grant_management_endpoint: `${iss}/oauth2/grants`,
+        grant_management_actions_supported: ['create', 'merge', 'replace'],
+        grant_management_action_required: false,
+        ...((0, oauth_adv_1.adv)(e).cfg.dynamic_registration ? { registration_endpoint: `${iss}/oauth2/register` } : {}),
+        response_types_supported: [...oauth_adv_1.RESPONSE_TYPES_SUPPORTED],
+        response_modes_supported: ['query', 'fragment', ...emu4_oauth_auth_1.EXT_RESPONSE_MODES],
+        authorization_signing_alg_values_supported: [...emu4_oauth_auth_1.OP_SIGNING_ALGS],
+        request_object_encryption_alg_values_supported: ['RSA-OAEP-256', 'ECDH-ES'],
+        request_object_encryption_enc_values_supported: ['A128GCM', 'A256GCM', 'A128CBC-HS256', 'A256CBC-HS512'],
+        request_parameter_supported: true,
+        request_uri_parameter_supported: true,
+        require_request_uri_registration: true,
+        request_object_signing_alg_values_supported: [...oauth_adv_1.REQUEST_OBJECT_ALGS],
+        authorization_details_types_supported: (0, oauth_adv_1.adv)(e).cfg.authorization_details_types,
+        grant_types_supported: ['authorization_code', 'implicit', 'refresh_token', 'client_credentials', EXCHANGE, 'urn:ietf:params:oauth:grant-type:device_code', 'urn:openid:params:grant-type:ciba', ...((0, oauth_adv_1.umaEnabled)(e) ? [oauth_adv_1.UMA_GRANT_TYPE] : [])],
         subject_types_supported: ['public'],
-        id_token_signing_alg_values_supported: ['RS256', 'ES256'],
-        token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],
+        id_token_signing_alg_values_supported: [...emu4_oauth_auth_1.OP_SIGNING_ALGS],
+        token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'private_key_jwt', 'none'],
+        token_endpoint_auth_signing_alg_values_supported: [...oauth_adv_1.REQUEST_OBJECT_ALGS],
         code_challenge_methods_supported: ['S256'],
         dpop_signing_alg_values_supported: ['ES256', 'ES384', 'RS256', 'PS256', 'EdDSA'],
         tls_client_certificate_bound_access_tokens: true,
         pushed_authorization_request_endpoint: `${iss}/oauth2/par`,
         device_authorization_endpoint: `${iss}/oauth2/device_authorization`,
         backchannel_authentication_endpoint: `${iss}/oauth2/backchannel_authentication`,
-        backchannel_token_delivery_modes_supported: ['poll', 'ping'],
-        scopes_supported: SCOPES,
+        backchannel_token_delivery_modes_supported: ['poll', 'ping', 'push'],
+        backchannel_user_code_parameter_supported: false,
+        scopes_supported: [...SCOPES, ...oauth_adv_1.GRANT_MANAGEMENT_SCOPES],
         claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'auth_time', 'nonce', 'email', 'email_verified', 'name', 'picture'],
         authorization_response_iss_parameter_supported: true,
         atlas_emulator: true,
@@ -72,7 +97,7 @@ function discoveryDocument(e) {
 }
 const FLOW_FLAGS = ['require_consent', 'dpop_bound_access_tokens', 'tls_client_certificate_bound_access_tokens', 'require_pushed_authorization_requests'];
 /** The client settings the consent, binding, PAR and CIBA flows read; validated here so a bad value never reaches a flow. */
-function pickFlowFields(body) {
+function pickFlowFields(body, existing) {
     const out = {};
     for (const k of FLOW_FLAGS) {
         if (body[k] === undefined)
@@ -82,12 +107,25 @@ function pickFlowFields(body) {
         out[k] = body[k];
     }
     if (body.backchannel_token_delivery_mode !== undefined) {
-        if (!['poll', 'ping'].includes(body.backchannel_token_delivery_mode))
-            throw new errors_1.EmulatorError('VALIDATION_FAILED', 'backchannel_token_delivery_mode must be poll or ping.', 'backchannel_token_delivery_mode');
+        if (!['poll', 'ping', 'push'].includes(body.backchannel_token_delivery_mode))
+            throw new errors_1.EmulatorError('VALIDATION_FAILED', 'backchannel_token_delivery_mode must be poll, ping or push.', 'backchannel_token_delivery_mode');
         out.backchannel_token_delivery_mode = body.backchannel_token_delivery_mode;
     }
     if (body.backchannel_client_notification_endpoint !== undefined)
         out.backchannel_client_notification_endpoint = body.backchannel_client_notification_endpoint;
+    if ((out.backchannel_token_delivery_mode ?? existing?.backchannel_token_delivery_mode) !== undefined && ['ping', 'push'].includes(out.backchannel_token_delivery_mode ?? existing?.backchannel_token_delivery_mode) && !(out.backchannel_client_notification_endpoint ?? existing?.backchannel_client_notification_endpoint)) {
+        throw new errors_1.EmulatorError('VALIDATION_FAILED', 'ping and push delivery need backchannel_client_notification_endpoint.', 'backchannel_client_notification_endpoint');
+    }
+    // Key, request-object and response-type metadata, validated like the real registry.
+    const meta = (0, oauth_adv_1.parseClientMeta)(body);
+    if (!meta.ok)
+        throw new errors_1.EmulatorError('VALIDATION_FAILED', meta.message);
+    Object.assign(out, meta.value);
+    for (const k of ['backchannel_logout_uri', 'frontchannel_logout_uri'])
+        if (body[k] !== undefined)
+            out[k] = body[k];
+    if (body.claims_redirect_uris !== undefined)
+        out.claims_redirect_uris = body.claims_redirect_uris;
     return out;
 }
 const clientShape = (e, c, secret) => {
@@ -111,6 +149,16 @@ const clientShape = (e, c, secret) => {
         require_pushed_authorization_requests: c.require_pushed_authorization_requests === true,
         backchannel_token_delivery_mode: c.backchannel_token_delivery_mode ?? 'poll',
         backchannel_client_notification_endpoint: c.backchannel_client_notification_endpoint ?? null,
+        response_types: (0, oauth_adv_1.clientResponseTypes)(c),
+        require_signed_request_object: c.require_signed_request_object === true,
+        ...(0, emu4_oauth_auth_1.clientExtras)(c),
+        request_object_signing_alg: c.request_object_signing_alg ?? null,
+        request_uris: c.request_uris ?? [],
+        jwks: c.jwks ?? null,
+        jwks_uri: c.jwks_uri ?? null,
+        backchannel_logout_uri: c.backchannel_logout_uri ?? null,
+        frontchannel_logout_uri: c.frontchannel_logout_uri ?? null,
+        claims_redirect_uris: c.claims_redirect_uris ?? [],
         created_at: c.created_at,
         updated_at: c.updated_at,
         ...(secret ? { client_secret: secret } : {}),
@@ -122,8 +170,8 @@ const liveClient = (e, id) => {
         throw (0, errors_1.notFound)('OAuth client');
     return c;
 };
-/** Client authentication: Basic, or client_id (+ client_secret) in the body. `none` clients are identified only. */
-function authenticateClient(e, c) {
+/** Client authentication with the method the client is REGISTERED for: Basic, `client_id` (+ `client_secret`) in the body, a signed `client_assertion` (private_key_jwt), or nothing for a public client. */
+async function authenticateClient(e, c) {
     let id = typeof c.body.client_id === 'string' ? c.body.client_id : undefined;
     let secret = typeof c.body.client_secret === 'string' ? c.body.client_secret : undefined;
     const basic = /^Basic\s+(.+)$/i.exec(c.request.headers.get('authorization') ?? '')?.[1];
@@ -132,10 +180,18 @@ function authenticateClient(e, c) {
         id = decodeURIComponent(i ?? '');
         secret = decodeURIComponent(rest.join(':'));
     }
+    // A client assertion names the client itself when no client_id was sent.
+    id ??= (0, emu4_oauth_auth_1.assertionClientId)(c.body);
     const client = e.db.oauthClients.get(id);
     if (!client || client.deleted)
         return { error: (0, exports.fail)(401, 'invalid_client', 'Unknown client.') };
+    if (client.auth_method === 'private_key_jwt') {
+        const problem = secret !== undefined ? 'This client must authenticate with a private_key_jwt client assertion.' : await (0, emu4_oauth_auth_1.verifyClientAssertion)(e, c.body, client);
+        return problem ? { error: (0, exports.fail)(401, 'invalid_client', problem) } : { client };
+    }
     const previousOk = client.previous_secret !== undefined && client.previous_secret === secret && e.clock.now() < client.previous_until;
+    if (client.auth_method !== 'none' && client.secret_expires_at && e.clock.now() >= client.secret_expires_at)
+        return { error: (0, exports.fail)(401, 'invalid_client', 'Client authentication failed.') };
     if (client.auth_method !== 'none' && client.secret !== secret && !previousOk)
         return { error: (0, exports.fail)(401, 'invalid_client', 'Client authentication failed.') };
     return { client };
@@ -143,9 +199,10 @@ function authenticateClient(e, c) {
 const splitScope = (s) => (typeof s === 'string' ? s.split(/\s+/).filter(Boolean) : []);
 exports.splitScope = splitScope;
 async function mintAccess(e, input) {
+    const ttl = input.ttl ?? ACCESS_TTL_S;
     const jti = e.db.newId('oat');
     const token = await e.tokens.signClaims({
-        sub: input.userId ?? input.client.id,
+        sub: input.userId ? await (0, emu4_oauth_auth_1.subjectFor)(e, input.client, input.userId) : input.client.id,
         aud: input.audience ?? input.client.id,
         client_id: input.client.id,
         scope: input.scope.join(' '),
@@ -153,9 +210,9 @@ async function mintAccess(e, input) {
         token_use: 'access_token',
         ...(input.cnf ? { cnf: input.cnf } : {}),
         ...(input.extra ?? {}),
-    }, ACCESS_TTL_S);
+    }, ttl);
     const s = (0, exports.st)(e);
-    s.access.set(jti, { clientId: input.client.id, userId: input.userId, scope: input.scope, exp: e.clock.now() + ACCESS_TTL_S * 1000, revoked: false, grantId: input.grant?.id ?? null, cnf: input.cnf });
+    s.access.set(jti, { clientId: input.client.id, userId: input.userId, scope: input.scope, exp: e.clock.now() + ttl * 1000, revoked: false, grantId: input.grant?.id ?? null, cnf: input.cnf });
     input.grant?.jtis.add(jti);
     return { token, jti };
 }
@@ -169,9 +226,14 @@ const userClaims = (e, userId, scope) => {
         ...(scope.includes('profile') ? { name: [u.first_name, u.last_name].filter(Boolean).join(' ') || undefined, picture: u.image_url ?? undefined, given_name: u.first_name ?? undefined, family_name: u.last_name ?? undefined } : {}),
     };
 };
+exports.userClaims = userClaims;
 async function issueTokens(e, client, grant, nonce, authTime, refreshRec, cnf) {
-    const access = await mintAccess(e, { client, userId: grant.userId, scope: grant.scope, grant, cnf });
+    const access = await mintAccess(e, { client, userId: grant.userId, scope: grant.scope, grant, cnf, extra: grant.managedId ? { grant_id: grant.managedId } : undefined });
     const out = { access_token: access.token, token_type: cnf?.jkt ? 'DPoP' : 'Bearer', expires_in: ACCESS_TTL_S, scope: grant.scope.join(' ') };
+    if (grant.managedId)
+        out.grant_id = grant.managedId;
+    if (grant.details?.length)
+        out.authorization_details = grant.details;
     if (grant.scope.includes('offline_access') || client.grant_types.includes('refresh_token')) {
         const rt = refreshRec ?? `ort_${(0, store_1.randomToken)(32)}`;
         if (!(0, exports.st)(e).refresh.has(rt))
@@ -179,17 +241,55 @@ async function issueTokens(e, client, grant, nonce, authTime, refreshRec, cnf) {
         out.refresh_token = rt;
     }
     if (grant.scope.includes('openid') && grant.userId) {
-        out.id_token = await e.tokens.signClaims({ sub: grant.userId, aud: client.id, azp: client.id, auth_time: Math.floor(authTime / 1000), ...(nonce ? { nonce } : {}), token_use: 'id_token', ...userClaims(e, grant.userId, grant.scope) }, ACCESS_TTL_S);
+        out.id_token = await idTokenFor(e, client, grant.userId, grant.scope, nonce, authTime, grant.sid);
+        (0, oauth_adv_1.recordRp)(e, grant.sid, client.id, grant.userId);
     }
     return out;
 }
+async function idTokenFor(e, client, userId, scope, nonce, authTime, sid, extra = {}) {
+    return e.tokens.signClaimsAs(client.id_token_signed_response_alg ?? null, { sub: await (0, emu4_oauth_auth_1.subjectFor)(e, client, userId), aud: client.id, azp: client.id, auth_time: Math.floor(authTime / 1000), ...(nonce ? { nonce } : {}), ...(sid ? { sid } : {}), token_use: 'id_token', ...(0, exports.userClaims)(e, userId, scope), ...extra }, ACCESS_TTL_S);
+}
+/** End a grant and every access token minted from it. */
+function revokeGrant(e, g) {
+    g.revoked = true;
+    for (const j of g.jtis) {
+        const a = (0, exports.st)(e).access.get(j);
+        if (a)
+            a.revoked = true;
+    }
+}
+/** A presented access token for a resource of this provider: signature, revocation and its sender constraint (DPoP proof or client certificate). */
+async function checkResourceToken(c, bearer, scheme) {
+    const e = c.engine;
+    const v = await e.tokens.verifyAny(bearer);
+    const rec = v.ok ? (0, exports.st)(e).access.get(String(v.claims.jti)) : undefined;
+    if (!v.ok || v.claims.token_use !== 'access_token' || !rec || rec.revoked || (rec.grantId && (0, exports.st)(e).grants.get(rec.grantId)?.revoked))
+        return { error: true, message: 'The access token is invalid or expired.' };
+    const bad = { error: true, message: 'A valid DPoP proof for this token is required.' };
+    if (rec.cnf?.jkt) {
+        const proof = c.request.headers.get('dpop');
+        if (scheme.toLowerCase() !== 'dpop' || !proof)
+            return bad;
+        try {
+            const r = await (0, jws_1.verifyDpopProof)({ proof, htm: c.request.method, htu: c.request.url, nowMs: e.clock.now(), accessToken: bearer });
+            if (r.jkt !== rec.cnf.jkt || !(0, oauth_flows_1.claimDpopJti)(e, r.jkt, r.jti, (jws_1.DPOP_IAT_WINDOW_S + 5) * 1000))
+                return bad;
+        }
+        catch {
+            return bad;
+        }
+    }
+    else if (rec.cnf?.['x5t#S256'] && (await (0, jws_1.forwardedCertThumbprint)(c.request.headers)) !== rec.cnf['x5t#S256'])
+        return { error: true, message: 'The token is bound to a client certificate that was not presented.' };
+    return { rec };
+}
 /** Create the grant and the single-use authorization code for an approved request (after login and, when needed, consent). */
 function issueCode(e, a) {
-    const grant = { id: e.db.newId('oag'), clientId: a.client.id, userId: a.userId, scope: a.scope, revoked: false, jtis: new Set() };
+    const grant = { id: e.db.newId('oag'), clientId: a.client.id, userId: a.userId, scope: a.scope, revoked: false, jtis: new Set(), sid: (0, oauth_adv_1.sidFor)(e, a.userId), details: a.ext?.details ?? null };
     (0, exports.st)(e).grants.set(grant.id, grant);
     const code = `oc_${(0, store_1.randomToken)(24)}`;
     const now = e.clock.now();
-    (0, exports.st)(e).codes.set(code, { grantId: grant.id, redirectUri: a.redirectUri, challenge: a.challenge, nonce: a.nonce, authTime: now, expiresAt: now + CODE_TTL_MS, used: false });
+    (0, exports.st)(e).codes.set(code, { grantId: grant.id, redirectUri: a.redirectUri, challenge: a.challenge, nonce: a.nonce, authTime: now, expiresAt: now + CODE_TTL_MS, used: false, ext: a.ext });
     return code;
 }
 /** What one token request proved: a DPoP key (single-use proof) and, for clients that ask for it, a client certificate. */
@@ -221,27 +321,32 @@ async function provedOf(c, client) {
 }
 const cnfFor = (p) => (p.jkt || p.x5t ? { ...(p.jkt ? { jkt: p.jkt } : {}), ...(p.x5t ? { 'x5t#S256': p.x5t } : {}) } : undefined);
 function oauthHandlers() {
-    const redirect = (uri, params) => {
-        const u = new URL(uri);
-        for (const [k, v] of Object.entries(params))
-            if (v !== undefined)
-                u.searchParams.set(k, v);
-        return { status: 302, headers: { location: u.toString(), 'cache-control': 'no-store' } };
-    };
     return [
         // ── client registry ──
         {
             method: 'POST',
             pattern: '/v1/oauth_clients',
-            handler: (c) => {
+            handler: async (c) => {
                 const e = c.engine;
                 const name = String((0, util_1.need)(c.body, 'name'));
                 const uris = c.body.redirect_uris;
                 if (!Array.isArray(uris) || !uris.length || !uris.every((u) => typeof u === 'string'))
                     throw new errors_1.EmulatorError('VALIDATION_FAILED', 'redirect_uris needs at least one URI.', 'redirect_uris');
                 const method = c.body.token_endpoint_auth_method ?? 'client_secret_basic';
+                if (!emu4_oauth_auth_1.AUTH_METHODS.includes(method))
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', `token_endpoint_auth_method must be one of: ${emu4_oauth_auth_1.AUTH_METHODS.join(', ')}.`, 'token_endpoint_auth_method');
+                const flowFields = pickFlowFields(c.body);
+                const keyedProblem = (0, emu4_oauth_auth_1.keyedClientProblem)(method, flowFields.jwks, flowFields.jwks_uri);
+                if (keyedProblem)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', keyedProblem, 'jwks');
+                const subject = await (0, emu4_oauth_auth_1.resolveSubject)(e, { subject_type: c.body.subject_type, sector_identifier_uri: c.body.sector_identifier_uri, redirect_uris: uris, redirectUrisChanged: true });
+                if (!subject.ok)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', subject.message, subject.param);
+                const rtProblem = (0, oauth_adv_1.responseTypeProblem)((0, oauth_adv_1.clientResponseTypes)(c.body), c.body.grant_types ?? ['authorization_code', 'refresh_token']);
+                if (rtProblem)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', rtProblem, 'response_types');
                 const now = e.clock.now();
-                const secret = method === 'none' ? undefined : `oacs_${(0, store_1.randomToken)(32)}`;
+                const secret = method === 'none' || method === 'private_key_jwt' ? undefined : `oacs_${(0, store_1.randomToken)(32)}`;
                 const row = e.db.oauthClients.insert({
                     name,
                     redirect_uris: uris,
@@ -250,7 +355,8 @@ function oauthHandlers() {
                     auth_method: method,
                     first_party: c.body.first_party === true,
                     post_logout_redirect_uris: c.body.post_logout_redirect_uris ?? [],
-                    ...pickFlowFields(c.body),
+                    ...flowFields,
+                    ...subject.value,
                     secret,
                     created_at: now,
                     updated_at: now,
@@ -264,13 +370,27 @@ function oauthHandlers() {
         {
             method: 'PATCH',
             pattern: '/v1/oauth_clients/:id',
-            handler: (c) => {
+            handler: async (c) => {
                 const e = c.engine;
                 const row = liveClient(e, c.params.id);
-                for (const [k, to] of [['name', 'name'], ['redirect_uris', 'redirect_uris'], ['allowed_scopes', 'allowed_scopes'], ['grant_types', 'grant_types'], ['first_party', 'first_party'], ['post_logout_redirect_uris', 'post_logout_redirect_uris']])
+                const next = { ...row };
+                for (const k of ['name', 'redirect_uris', 'allowed_scopes', 'grant_types', 'first_party', 'post_logout_redirect_uris'])
                     if (k in c.body)
-                        row[to] = c.body[k];
-                Object.assign(row, pickFlowFields(c.body));
+                        next[k] = c.body[k];
+                Object.assign(next, pickFlowFields(c.body, row));
+                const keyedProblem = (0, emu4_oauth_auth_1.keyedClientProblem)(next.auth_method, next.jwks, next.jwks_uri);
+                if (keyedProblem)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', keyedProblem, 'jwks');
+                if (c.body.subject_type !== undefined || c.body.sector_identifier_uri !== undefined || c.body.redirect_uris !== undefined) {
+                    const subject = await (0, emu4_oauth_auth_1.resolveSubject)(e, { subject_type: c.body.subject_type, sector_identifier_uri: c.body.sector_identifier_uri, redirect_uris: next.redirect_uris, redirectUrisChanged: c.body.redirect_uris !== undefined, existing: row, publisherSector: (0, emu4_oauth_pub_1.publisherSectorOf)(e, row) });
+                    if (!subject.ok)
+                        throw new errors_1.EmulatorError('VALIDATION_FAILED', subject.message, subject.param);
+                    Object.assign(next, subject.value);
+                }
+                const rtProblem = (0, oauth_adv_1.responseTypeProblem)((0, oauth_adv_1.clientResponseTypes)(next), next.grant_types);
+                if (rtProblem)
+                    throw new errors_1.EmulatorError('VALIDATION_FAILED', rtProblem, 'response_types');
+                Object.assign(row, next); // validated first: a refused PATCH changes nothing
                 row.updated_at = e.clock.now();
                 e.changed({ type: 'oauth_client.updated', data: clientShape(e, row) });
                 return { body: clientShape(e, row) };
@@ -322,33 +442,76 @@ function oauthHandlers() {
             method: 'GET',
             pattern: '/oauth2/authorize',
             public: true,
-            handler: (c) => {
+            handler: async (c) => {
                 const e = c.engine;
-                const resolved = (0, oauth_flows_1.resolveRequestUri)(e, c.query);
+                const rawUri = c.query.get('request_uri');
+                // An https request_uri names a request object to fetch (RFC 9101); anything else is a pushed request (RFC 9126).
+                const jarUri = rawUri && /^https:\/\//i.test(rawUri) ? rawUri : null;
+                const resolved = jarUri ? { query: c.query } : (0, oauth_flows_1.resolveRequestUri)(e, c.query);
                 if ('error' in resolved)
                     return (0, exports.fail)(400, resolved.error.code, resolved.error.description);
+                const parUsed = !!rawUri && !jarUri;
                 const q = resolved.query;
                 const client = e.db.oauthClients.get(q.get('client_id') ?? undefined);
                 if (!client || client.deleted)
                     return (0, exports.fail)(400, 'invalid_request', 'Unknown client_id.');
-                const redirectUri = q.get('redirect_uri') ?? (client.redirect_uris.length === 1 ? client.redirect_uris[0] : null);
+                if (client.require_pushed_authorization_requests && !parUsed)
+                    return (0, exports.fail)(400, 'invalid_request', 'This client must push its authorization request (POST /oauth2/par) and send the request_uri.');
+                const p = Object.fromEntries(q.entries());
+                let rarRaw = p.authorization_details;
+                if (client.require_signed_request_object === true && !parUsed && !p.request && !jarUri)
+                    return (0, exports.fail)(400, 'invalid_request', 'This client must send a signed request object.');
+                // A signed request object supersedes the query parameters; it is verified BEFORE the redirect_uri is trusted.
+                if (p.request || jarUri) {
+                    const loaded = await (0, oauth_adv_1.loadRequestObject)(e, client, { request: p.request, requestUri: jarUri ?? undefined });
+                    if (!loaded.ok)
+                        return (0, exports.fail)(400, loaded.error, loaded.description);
+                    for (const k of oauth_adv_1.REQUEST_OBJECT_PARAMS)
+                        if (typeof loaded.claims[k] === 'string')
+                            p[k] = loaded.claims[k];
+                    if (loaded.claims.authorization_details !== undefined)
+                        rarRaw = loaded.claims.authorization_details;
+                    delete p.request;
+                }
+                const redirectUri = p.redirect_uri ?? (client.redirect_uris.length === 1 ? client.redirect_uris[0] : null);
                 if (!redirectUri || !client.redirect_uris.includes(redirectUri))
                     return (0, exports.fail)(400, 'invalid_request', 'redirect_uri is not registered for this client.');
-                if (client.require_pushed_authorization_requests && !c.query.get('request_uri'))
-                    return (0, exports.fail)(400, 'invalid_request', 'This client must push its authorization request (POST /oauth2/par) and send the request_uri.');
-                const state = q.get('state') ?? undefined;
-                const back = (params) => redirect(redirectUri, { ...params, state, iss: e.issuer });
-                if (q.get('response_type') !== 'code')
-                    return back({ error: 'unsupported_response_type', error_description: 'Only response_type=code is supported.' });
-                const scope = (0, exports.splitScope)(q.get('scope') ?? 'openid');
+                const state = p.state;
+                const rt = (0, oauth_adv_1.parseResponseType)(p.response_type);
+                const mode = p.response_mode ?? null;
+                const back = (params) => (0, emu4_oauth_auth_1.authReply)(e, client, redirectUri, (0, oauth_adv_1.authUrl)(e, redirectUri, { ...params, state, iss: e.issuer }, !!rt?.frontChannelTokens, mode), mode);
+                if (!rt)
+                    return back({ error: 'unsupported_response_type', error_description: 'The response_type is not supported.' });
+                if (!(0, oauth_adv_1.clientResponseTypes)(client).includes(rt.canonical))
+                    return back({ error: 'unauthorized_client', error_description: 'This client is not registered for this response_type.' });
+                if (mode && !['query', 'fragment', ...emu4_oauth_auth_1.EXT_RESPONSE_MODES].includes(mode))
+                    return back({ error: 'invalid_request', error_description: 'The response_mode is not supported.' });
+                if (mode && !(0, oauth_adv_1.responseModeAllowed)(rt, mode))
+                    return back({ error: 'invalid_request', error_description: 'A response_type that returns tokens cannot use the query response mode.' });
+                // OIDC Core 3.2.2.1 / 3.3.2.1: the nonce is required whenever an ID token comes back from the authorization endpoint.
+                if (rt.idToken && !p.nonce)
+                    return back({ error: 'invalid_request', error_description: 'The nonce parameter is required for this response_type.' });
+                const gmParsed = (0, oauth_adv_1.parseGrantManagement)(p.grant_management_action, p.grant_id);
+                if (!gmParsed.ok)
+                    return back({ error: 'invalid_request', error_description: gmParsed.message });
+                const gm = gmParsed.value;
+                if (rt.code && !client.grant_types.includes('authorization_code'))
+                    return back({ error: 'unauthorized_client', error_description: 'This client is not permitted the authorization_code grant.' });
+                if (rt.frontChannelTokens && !client.grant_types.includes('implicit'))
+                    return back({ error: 'unauthorized_client', error_description: 'This client is not permitted the implicit grant.' });
+                const scope = (0, exports.splitScope)(p.scope ?? 'openid');
                 const outside = scope.filter((s) => !client.allowed_scopes.includes(s) && !SCOPES.includes(s));
                 if (outside.length)
                     return back({ error: 'invalid_scope', error_description: `Scope not allowed: ${outside.join(' ')}.` });
-                const challenge = q.get('code_challenge');
-                if (challenge && (q.get('code_challenge_method') ?? 'plain') !== 'S256')
+                const challenge = p.code_challenge ?? null;
+                if (challenge && (p.code_challenge_method ?? 'plain') !== 'S256')
                     return back({ error: 'invalid_request', error_description: 'code_challenge_method must be S256.' });
-                if (!challenge && client.auth_method === 'none')
+                if (!challenge && rt.code && client.auth_method === 'none')
                     return back({ error: 'invalid_request', error_description: 'A public client must use PKCE (code_challenge).' });
+                // RFC 9396: authorization_details against the instance's type allowlist (an empty allowlist refuses any type).
+                const rar = (0, oauth_adv_1.validateAuthorizationDetails)(rarRaw, (0, oauth_adv_1.adv)(e).cfg.authorization_details_types);
+                if (!rar.ok)
+                    return back({ error: 'invalid_authorization_details', error_description: rar.message });
                 if (q.get('emulator_decision') === 'deny')
                     return back({ error: 'access_denied', error_description: 'The user denied the request.' });
                 const hint = q.get('login_hint');
@@ -361,10 +524,17 @@ function oauthHandlers() {
                     return back({ error: 'login_required', error_description: 'No user to sign in. Pass login_hint or POST /__emulator/oauth/login.' });
                 if (user.banned)
                     return back({ error: 'access_denied', error_description: 'The user is banned.' });
-                const gate = (0, oauth_flows_1.consentGate)(e, { client, user, scope, redirectUri, challenge, nonce: q.get('nonce'), state, prompt: q.get('prompt') });
+                const details = rar.value ?? null;
+                // Grant management: a merge or replace names this client's and this user's active grant; adding anything to it asks the user again.
+                const gmProblem = (0, oauth_adv_1.gmValid)(e, gm, client.id, user.id);
+                if (gmProblem)
+                    return back({ error: 'invalid_grant', error_description: gmProblem });
+                const widens = !!gm && gm.action !== 'create' && (0, oauth_adv_1.gmWidens)(gm, (0, oauth_adv_1.managedFor)(e, gm.grantId, client.id, user.id), scope, details);
+                const ext = { rt: rt.canonical, mode, details, gm };
+                const gate = await (0, oauth_flows_1.consentGate)(e, { client, user, scope, redirectUri, challenge, nonce: p.nonce ?? null, state, prompt: q.get('prompt'), ext, force: widens });
                 if (gate)
                     return gate;
-                return back({ code: issueCode(e, { client, userId: user.id, scope, redirectUri, challenge, nonce: q.get('nonce') }) });
+                return (0, emu4_oauth_auth_1.authReply)(e, client, redirectUri, await (0, oauth_adv_1.completeAuth)(e, { client, userId: user.id, scope, redirectUri, challenge, nonce: p.nonce ?? null, state, ext }), mode);
             },
         },
         { method: 'POST', pattern: '/__emulator/oauth/login', public: true, handler: (c) => (((0, exports.st)(c.engine).autoUser = typeof c.body.user_id === 'string' ? c.body.user_id : null), { body: { ok: true } }) },
@@ -375,14 +545,15 @@ function oauthHandlers() {
             public: true,
             handler: async (c) => {
                 const e = c.engine;
-                const auth = authenticateClient(e, c);
+                const auth = await authenticateClient(e, c);
                 if ('error' in auth)
                     return auth.error;
                 const client = auth.client;
                 const type = String(c.body.grant_type ?? '');
                 if (!type)
                     return (0, exports.fail)(400, 'invalid_request', 'grant_type is required.');
-                if (type !== EXCHANGE && !client.grant_types.includes(type) && !(type === 'refresh_token'))
+                const umaPat = type === 'client_credentials' && !c.body.audience && (0, exports.splitScope)(c.body.scope).includes('uma_protection') && (0, oauth_adv_1.umaEnabled)(e);
+                if (type !== EXCHANGE && type !== oauth_adv_1.UMA_GRANT_TYPE && !umaPat && !client.grant_types.includes(type) && !(type === 'refresh_token'))
                     return (0, exports.fail)(400, 'unauthorized_client', `This client may not use ${type}.`);
                 const s = (0, exports.st)(e);
                 const now = e.clock.now();
@@ -393,6 +564,10 @@ function oauthHandlers() {
                 const ext = await (0, oauth_flows_1.extensionGrant)(c, client, type, cnf);
                 if (ext)
                     return ext;
+                if (umaPat)
+                    return client.auth_method === 'none' ? (0, exports.fail)(401, 'invalid_client', 'A protection API token requires a confidential client.') : (0, oauth_adv_1.umaProtectionToken)(c, client);
+                if (type === oauth_adv_1.UMA_GRANT_TYPE && (0, oauth_adv_1.umaEnabled)(e))
+                    return (0, oauth_adv_1.umaTicketGrant)(c, client);
                 if (type === 'authorization_code') {
                     const rec = s.codes.get(String(c.body.code ?? ''));
                     if (!rec)
@@ -422,6 +597,12 @@ function oauthHandlers() {
                     rec.used = true;
                     if (pr.proved.jkt)
                         grant.jkt = pr.proved.jkt;
+                    // OpenID grant management: apply the create / merge / replace the code carried; the tokens are for the grant as it stands afterwards.
+                    if (rec.ext?.gm) {
+                        const applied = (0, oauth_adv_1.applyGrantManagement)(e, grant, rec.ext.gm);
+                        if (applied)
+                            return (0, exports.fail)(400, applied.error, applied.message);
+                    }
                     return { body: await issueTokens(e, client, grant, rec.nonce, rec.authTime, undefined, cnf), headers: { 'cache-control': 'no-store', pragma: 'no-cache' } };
                 }
                 if (type === 'refresh_token') {
@@ -430,7 +611,7 @@ function oauthHandlers() {
                     const grant = rec ? s.grants.get(rec.grantId) : undefined;
                     if (!rec || !grant || grant.clientId !== client.id)
                         return (0, exports.fail)(400, 'invalid_grant', 'The refresh token is invalid.');
-                    if (grant.revoked)
+                    if (grant.revoked || (grant.managedId && (0, oauth_adv_1.adv)(e).managed.get(grant.managedId)?.status !== 'active'))
                         return (0, exports.fail)(400, 'invalid_grant', 'The grant was revoked.');
                     // A DPoP-bound refresh token is usable only with the key it was bound to (RFC 9449 section 8).
                     if (grant.jkt && pr.proved.jkt !== grant.jkt)
@@ -466,6 +647,8 @@ function oauthHandlers() {
                     const a = await mintAccess(e, { client, userId: null, scope, grant: null, audience: typeof c.body.audience === 'string' ? c.body.audience : undefined, cnf });
                     return { body: { access_token: a.token, token_type: cnf?.jkt ? 'DPoP' : 'Bearer', expires_in: ACCESS_TTL_S, scope: scope.join(' ') }, headers: { 'cache-control': 'no-store' } };
                 }
+                if (type === EXCHANGE && c.body.subject_token_type === emu4_oauth_pub_1.GOOGLE_ACCESS_TOKEN_TYPE)
+                    return (0, emu4_oauth_pub_1.googleTokenExchange)(c, client);
                 if (type === EXCHANGE) {
                     const subject = String(c.body.subject_token ?? '');
                     if (!subject)
@@ -501,9 +684,9 @@ function oauthHandlers() {
             method: 'POST',
             pattern: '/oauth2/revoke',
             public: true,
-            handler: (c) => {
+            handler: async (c) => {
                 const e = c.engine;
-                const auth = authenticateClient(e, c);
+                const auth = await authenticateClient(e, c);
                 if ('error' in auth)
                     return auth.error;
                 const token = String(c.body.token ?? '');
@@ -541,7 +724,7 @@ function oauthHandlers() {
             public: true,
             handler: async (c) => {
                 const e = c.engine;
-                const auth = authenticateClient(e, c);
+                const auth = await authenticateClient(e, c);
                 if ('error' in auth)
                     return auth.error;
                 const token = String(c.body.token ?? '');
@@ -552,7 +735,7 @@ function oauthHandlers() {
                     const g = s.grants.get(rt.grantId);
                     if (!g || g.revoked || rt.rotatedAt !== undefined || g.clientId !== auth.client.id)
                         return inactive;
-                    return { body: { active: true, token_use: 'refresh_token', client_id: g.clientId, sub: g.userId, scope: g.scope.join(' ') }, headers: { 'cache-control': 'no-store' } };
+                    return { body: { active: true, token_use: 'refresh_token', client_id: g.clientId, ...(g.userId ? { sub: await (0, emu4_oauth_auth_1.subjectFor)(e, auth.client, g.userId) } : {}), scope: g.scope.join(' '), ...(g.details?.length ? { authorization_details: g.details } : {}), ...(g.managedId ? { grant_id: g.managedId } : {}) }, headers: { 'cache-control': 'no-store' } };
                 }
                 const v = await e.tokens.verifyAny(token);
                 if (!v.ok || v.claims.token_use !== 'access_token')
@@ -560,9 +743,11 @@ function oauthHandlers() {
                 const rec = s.access.get(String(v.claims.jti));
                 if (!rec || rec.revoked || (rec.grantId && s.grants.get(rec.grantId)?.revoked))
                     return inactive;
-                if (rec.clientId !== auth.client.id)
-                    return inactive; // another client's token: do not leak
-                return { body: { active: true, token_type: rec.cnf?.jkt ? 'DPoP' : 'Bearer', ...(rec.cnf ? { cnf: rec.cnf } : {}), token_use: 'access_token', client_id: rec.clientId, sub: v.claims.sub, aud: v.claims.aud, iss: v.claims.iss, scope: rec.scope.join(' '), exp: v.claims.exp, iat: v.claims.iat, jti: v.claims.jti, ...(v.claims.act ? { act: v.claims.act } : {}) }, headers: { 'cache-control': 'no-store' } };
+                // another client's token: do not leak (a resource server may introspect the tokens issued for it)
+                if (rec.clientId !== auth.client.id && v.claims.uma_rs !== auth.client.id)
+                    return inactive;
+                const granted = rec.grantId ? s.grants.get(rec.grantId) : undefined;
+                return { body: { active: true, token_type: rec.cnf?.jkt ? 'DPoP' : 'Bearer', ...(granted?.details?.length ? { authorization_details: granted.details } : {}), ...(v.claims.grant_id ? { grant_id: v.claims.grant_id } : {}), ...(v.claims.permissions ? { permissions: v.claims.permissions, uma_rs: v.claims.uma_rs } : {}), ...(rec.cnf ? { cnf: rec.cnf } : {}), token_use: 'access_token', client_id: rec.clientId, sub: v.claims.sub, aud: v.claims.aud, iss: v.claims.iss, scope: rec.scope.join(' '), exp: v.claims.exp, iat: v.claims.iat, jti: v.claims.jti, ...(v.claims.act ? { act: v.claims.act } : {}) }, headers: { 'cache-control': 'no-store' } };
             },
         },
         ...['GET', 'POST'].map((method) => ({
@@ -600,7 +785,7 @@ function oauthHandlers() {
                 }
                 if (!rec.scope.includes('openid'))
                     return { status: 403, headers: { 'www-authenticate': 'Bearer error="insufficient_scope", scope="openid"' }, body: { error: 'insufficient_scope', error_description: 'The openid scope is required.' } };
-                return { body: { sub: rec.userId, ...userClaims(e, rec.userId, rec.scope) } };
+                return { body: { sub: await (0, emu4_oauth_auth_1.subjectFor)(e, e.db.oauthClients.get(rec.clientId), rec.userId), ...(0, exports.userClaims)(e, rec.userId, rec.scope) } };
             },
         })),
     ];