@atlasauth/pca-dpop 0.1.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +69 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.js +10 -0
- package/dist/index.js.map +1 -1
- package/package.json +28 -3
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 Atlas Authorization
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,69 @@
|
|
|
1
|
+
# @atlasauth/pca-dpop
|
|
2
|
+
|
|
3
|
+
Sender-constrained proof-of-possession for Proof-Carrying Authority. It ties a PCActn to the holder key (or TLS channel) that is allowed to use it, and interoperates with OAuth proof-of-possession:
|
|
4
|
+
|
|
5
|
+
- RFC 9449 DPoP: a holder-key-signed `dpop+jwt` proof over the HTTP method and target URI.
|
|
6
|
+
- RFC 8705 mutual TLS: the `x5t#S256` certificate-thumbprint confirmation.
|
|
7
|
+
|
|
8
|
+
A PCActn's bound holder key is the last capability in its chain (`cap_chain[last].holder`, an Ed25519 public key). That key is exactly an OKP/Ed25519 JWK, so a DPoP proof signed by it has a `jkt` thumbprint equal to the PCActn's binding.
|
|
9
|
+
|
|
10
|
+
## Install
|
|
11
|
+
|
|
12
|
+
```sh
|
|
13
|
+
npm i @atlasauth/pca-dpop
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
Depends on `@atlasauth/pca` and `jose`.
|
|
17
|
+
|
|
18
|
+
## Usage
|
|
19
|
+
|
|
20
|
+
```ts
|
|
21
|
+
import { createDpopProof, assertPcaDpop, leafHolderJwk } from '@atlasauth/pca-dpop';
|
|
22
|
+
|
|
23
|
+
// Client: sign a DPoP proof with the same key that holds the PCActn's leaf capability.
|
|
24
|
+
const proof = await createDpopProof({
|
|
25
|
+
method: 'POST',
|
|
26
|
+
url: 'https://api.example.com/refunds',
|
|
27
|
+
privateKey: holderPrivateJwk, // { kty: 'OKP', crv: 'Ed25519', x, d }
|
|
28
|
+
publicJwk: leafHolderJwk(pcactn),
|
|
29
|
+
});
|
|
30
|
+
|
|
31
|
+
// Resource server: confirm the proof is held by the PCActn's bound key and is for this request.
|
|
32
|
+
const seenJti = new Set<string>(); // use a shared store with expiry in production
|
|
33
|
+
const result = await assertPcaDpop(pcactn, proof, {
|
|
34
|
+
method: 'POST',
|
|
35
|
+
url: 'https://api.example.com/refunds', // query and fragment are ignored
|
|
36
|
+
maxAgeSec: 300, // default 300
|
|
37
|
+
seenJti, // rejects a repeated jti
|
|
38
|
+
});
|
|
39
|
+
result.jkt; // verified key thumbprint
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
`assertPcaDpop` throws a `DpopVerificationError` (with a `code` such as `typ`, `signature`, `htm`, `htu`, `iat_stale`, `jkt`, `jti_replay`) on any mismatch.
|
|
43
|
+
|
|
44
|
+
## API
|
|
45
|
+
|
|
46
|
+
- `createDpopProof`, `verifyDpopProof` (generic RFC 9449 proofs, with optional `expectedJkt`, `seenJti`, `nonce` and `ath`)
|
|
47
|
+
- `bindPcaToDpop(pcactn)` returns `{ jkt }`, the `cnf` binding for the PCActn's holder key
|
|
48
|
+
- `assertPcaDpop(pcactn, proof, opts)` verifies a proof against that binding
|
|
49
|
+
- `leafHolderJwk`, `jwkThumbprint`, `normalizeHtu`, `athFor`
|
|
50
|
+
- `mtlsCnf(certDerOrPem)` returns `{ 'x5t#S256': ... }`
|
|
51
|
+
- `DPOP_ALLOWED_ALGS`: asymmetric algorithms only (`none` and MACs are rejected)
|
|
52
|
+
|
|
53
|
+
## Status
|
|
54
|
+
|
|
55
|
+
Experimental. This package checks the proof only; it does not issue DPoP nonces, and replay protection is whatever `seenJti` store you supply. It does not verify the TLS client certificate itself, only computes its thumbprint for comparison. The cryptography is unaudited.
|
|
56
|
+
|
|
57
|
+
What is validated:
|
|
58
|
+
|
|
59
|
+
- The three example DPoP proofs published in RFC 9449 (token request, refresh request, and the resource request with `ath`) are accepted, with the RFC's own `jkt`, `ath` and thumbprint values reproduced. Their ES256 signatures are also checked with Node's built-in crypto, independent of `jose`.
|
|
60
|
+
- Tampering (method, URL, payload, signature, age, future `iat`, wrong key, replayed `jti`, missing or wrong `nonce`, missing or wrong `ath`) is rejected, and each test asserts the specific rejection code.
|
|
61
|
+
- Proofs interoperate in both directions with PyJWT 2.10.1 (Ed25519 and ES256).
|
|
62
|
+
|
|
63
|
+
`verifyDpopProof` and `assertPcaDpop` accept `expectedNonce` and `accessToken` to enforce a server nonce and the access-token hash; supply them whenever your server issues nonces or the request carries an access token.
|
|
64
|
+
|
|
65
|
+
Not validated: the RFC 8705 mTLS thumbprint has no external vector, and no independent DPoP server implementation has been run against this verifier.
|
|
66
|
+
|
|
67
|
+
## License
|
|
68
|
+
|
|
69
|
+
MIT - see LICENSE
|
package/dist/index.d.ts
CHANGED
|
@@ -79,6 +79,10 @@ export interface VerifyDpopProofOptions {
|
|
|
79
79
|
seenJti?: JtiSeenSet;
|
|
80
80
|
/** Override "now" (epoch seconds) — for tests / fixed clocks. */
|
|
81
81
|
nowSec?: number;
|
|
82
|
+
/** If given, the proof MUST carry exactly this server-issued `nonce` (RFC 9449 §8/§9). */
|
|
83
|
+
expectedNonce?: string;
|
|
84
|
+
/** If given, the proof MUST carry `ath` = base64url(SHA-256(accessToken)) (RFC 9449 §4.2/§7.1). */
|
|
85
|
+
accessToken?: string;
|
|
82
86
|
}
|
|
83
87
|
export interface DpopVerifyResult {
|
|
84
88
|
/** The verified, type-checked DPoP claims. */
|
|
@@ -133,4 +137,6 @@ export declare function assertPcaDpop(p: PCActn, dpopProof: string, opts: {
|
|
|
133
137
|
maxAgeSec?: number;
|
|
134
138
|
seenJti?: JtiSeenSet;
|
|
135
139
|
nowSec?: number;
|
|
140
|
+
expectedNonce?: string;
|
|
141
|
+
accessToken?: string;
|
|
136
142
|
}): Promise<DpopVerifyResult>;
|
package/dist/index.js
CHANGED
|
@@ -183,6 +183,14 @@ async function verifyDpopProof(proof, opts) {
|
|
|
183
183
|
if (opts.expectedJkt !== undefined && jkt !== opts.expectedJkt) {
|
|
184
184
|
throw new DpopVerificationError('jkt', 'embedded key thumbprint does not match expected jkt');
|
|
185
185
|
}
|
|
186
|
+
// Server nonce (RFC 9449 §8/§9): when required, an absent or different nonce is rejected.
|
|
187
|
+
if (opts.expectedNonce !== undefined && payload.nonce !== opts.expectedNonce) {
|
|
188
|
+
throw new DpopVerificationError('nonce', 'proof nonce is missing or does not match the expected nonce');
|
|
189
|
+
}
|
|
190
|
+
// Access-token binding (RFC 9449 §4.2 / §7.1): when presented with an access token, `ath` must match.
|
|
191
|
+
if (opts.accessToken !== undefined && payload.ath !== athFor(opts.accessToken)) {
|
|
192
|
+
throw new DpopVerificationError('ath', 'proof ath is missing or does not match the access token');
|
|
193
|
+
}
|
|
186
194
|
// Replay: reject a reused jti, then record this one.
|
|
187
195
|
if (opts.seenJti !== undefined) {
|
|
188
196
|
if (opts.seenJti.has(jti))
|
|
@@ -247,6 +255,8 @@ async function assertPcaDpop(p, dpopProof, opts) {
|
|
|
247
255
|
expectedJkt: jkt,
|
|
248
256
|
...(opts.seenJti !== undefined ? { seenJti: opts.seenJti } : {}),
|
|
249
257
|
...(opts.nowSec !== undefined ? { nowSec: opts.nowSec } : {}),
|
|
258
|
+
...(opts.expectedNonce !== undefined ? { expectedNonce: opts.expectedNonce } : {}),
|
|
259
|
+
...(opts.accessToken !== undefined ? { accessToken: opts.accessToken } : {}),
|
|
250
260
|
});
|
|
251
261
|
}
|
|
252
262
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA8GH,sCAEC;AAGD,sCAeC;AAcD,oCAGC;AAGD,wBAEC;AAcD,0CAaC;AAOD,0CA6EC;AAeD,0BAGC;AAQD,sCAKC;AAGD,sCAEC;AAOD,sCAwBC;AAxUD,+BAAsG;AAEtG,wCAA2D;AAE3D,mGAAmG;AAEnG,mGAAmG;AACtF,QAAA,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAGjG,qDAAqD;AACxC,QAAA,YAAY,GAAG,UAAU,CAAC;AAEvC,oFAAoF;AACvE,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAE5C,gGAAgG;AACnF,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAErC,mGAAmG;AAEnG,oGAAoG;AACpG,MAAa,qBAAsB,SAAQ,KAAK;IACrC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,sDAOC;AA4ED,mGAAmG;AAEnG,6DAA6D;AAC7D,SAAgB,aAAa,CAAC,GAAQ,EAAE,SAAyC,QAAQ;IACvF,OAAO,IAAA,6BAAsB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kGAAkG;AAClG,SAAgB,aAAa,CAAC,GAAQ;IACpC,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACjE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5G,KAAK,IAAI;YACP,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3G,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAQ;IAC3B,MAAM,GAAG,GAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAC7C,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,SAAgB,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yFAAyF;AACzF,SAAgB,MAAM,CAAC,WAAmB;IACxC,OAAO,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,gEAAgE;AAChE,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,kGAAkG;AAElG,0GAA0G;AACnG,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAe;QACzB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE;QAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,OAAO,IAAI,cAAO,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,oBAAY,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,IAA4B;IAC/E,qFAAqF;IACrF,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,cAAc,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAY,EAAE,CAAC;QAChC,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,oBAAY,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAE5G,kGAAkG;IAClG,IAAI,OAAmB,CAAC;IACxB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,kBAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,yBAAiB,CAAC,EAAE,GAAG,EAAE,oBAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC;QAC7G,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,qBAAqB;YAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,kCAAkC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,gBAAgB;IAChB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC/H,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAEnH,kDAAkD;IAClD,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,iCAAiC,CAAC,CAAC;IAC5H,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,8BAA8B,CAAC,CAAC;IAEtH,aAAa;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,GAAG,GAAG,2BAAmB;QAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC3G,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,uBAAuB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAEvH,eAAe;IACf,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;IAChG,CAAC;IAED,0FAA0F;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7E,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,6DAA6D,CAAC,CAAC;IAC1G,CAAC;IAED,sGAAsG;IACtG,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACpG,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,QAAQ,GAAG,yBAAyB,CAAC,CAAC;QAC/G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,MAAM,GAAe;QACzB,GAAG,OAAO;QACV,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED,kGAAkG;AAElG,oEAAoE;AACpE,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,YAAiC;IACvD,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAElG;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAS;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC;IAC5H,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,iGAAiG;AAC1F,KAAK,UAAU,aAAa,CAAC,CAAS;IAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,CAAS,EACT,SAAiB,EACjB,IAQC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC,SAAS,EAAE;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gCAAwB;QACrD,WAAW,EAAE,GAAG;QAChB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,28 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/pca-dpop",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "Sender-constrained proof-of-possession for PCA: RFC 9449 DPoP proofs and RFC 8705 mTLS cnf binding, tying a PCActn to the holder key/channel for OAuth PoP interop.",
|
|
5
|
+
"keywords": [
|
|
6
|
+
"dpop",
|
|
7
|
+
"rfc 9449",
|
|
8
|
+
"mtls",
|
|
9
|
+
"rfc 8705",
|
|
10
|
+
"proof of possession",
|
|
11
|
+
"agent authorization",
|
|
12
|
+
"proof-carrying authority",
|
|
13
|
+
"pca",
|
|
14
|
+
"ai agents"
|
|
15
|
+
],
|
|
16
|
+
"license": "MIT",
|
|
17
|
+
"homepage": "https://github.com/Atlas-Authorization/pca#readme",
|
|
18
|
+
"bugs": {
|
|
19
|
+
"url": "https://github.com/Atlas-Authorization/pca/issues"
|
|
20
|
+
},
|
|
21
|
+
"repository": {
|
|
22
|
+
"type": "git",
|
|
23
|
+
"url": "git+https://github.com/Atlas-Authorization/pca.git",
|
|
24
|
+
"directory": "packages/pca-dpop"
|
|
25
|
+
},
|
|
5
26
|
"main": "./dist/index.js",
|
|
6
27
|
"types": "./dist/index.d.ts",
|
|
7
28
|
"exports": {
|
|
@@ -13,7 +34,7 @@
|
|
|
13
34
|
},
|
|
14
35
|
"dependencies": {
|
|
15
36
|
"jose": "^5.9.6",
|
|
16
|
-
"@atlasauth/pca": "0.
|
|
37
|
+
"@atlasauth/pca": "0.3.0"
|
|
17
38
|
},
|
|
18
39
|
"devDependencies": {
|
|
19
40
|
"typescript": "^5.6.3",
|
|
@@ -21,8 +42,12 @@
|
|
|
21
42
|
},
|
|
22
43
|
"files": [
|
|
23
44
|
"dist",
|
|
24
|
-
"README.md"
|
|
45
|
+
"README.md",
|
|
46
|
+
"LICENSE"
|
|
25
47
|
],
|
|
48
|
+
"engines": {
|
|
49
|
+
"node": ">=20"
|
|
50
|
+
},
|
|
26
51
|
"publishConfig": {
|
|
27
52
|
"access": "public"
|
|
28
53
|
},
|