@atlasauth/pca-dpop 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.js +15 -2
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -54,6 +54,20 @@ result.jkt; // verified key thumbprint
|
|
|
54
54
|
|
|
55
55
|
Experimental. This package checks the proof only; it does not issue DPoP nonces, and replay protection is whatever `seenJti` store you supply. It does not verify the TLS client certificate itself, only computes its thumbprint for comparison. The cryptography is unaudited.
|
|
56
56
|
|
|
57
|
+
What is validated:
|
|
58
|
+
|
|
59
|
+
- The three example DPoP proofs published in RFC 9449 (token request, refresh request, and the resource request with `ath`) are accepted, with the RFC's own `jkt`, `ath` and thumbprint values reproduced. Their ES256 signatures are also checked with Node's built-in crypto, independent of `jose`.
|
|
60
|
+
- Tampering (method, URL, payload, signature, age, future `iat`, wrong key, replayed `jti`, missing or wrong `nonce`, missing or wrong `ath`) is rejected, and each test asserts the specific rejection code.
|
|
61
|
+
- Proofs interoperate in both directions with PyJWT 2.10.1 (Ed25519 and ES256).
|
|
62
|
+
|
|
63
|
+
`verifyDpopProof` and `assertPcaDpop` accept `expectedNonce` and `accessToken` to enforce a server nonce and the access-token hash; supply them whenever your server issues nonces or the request carries an access token.
|
|
64
|
+
|
|
65
|
+
Not validated: the RFC 8705 mTLS thumbprint has no external vector, and no independent DPoP server implementation has been run against this verifier.
|
|
66
|
+
|
|
57
67
|
## License
|
|
58
68
|
|
|
59
69
|
MIT - see LICENSE
|
|
70
|
+
|
|
71
|
+
## Canonical token spelling
|
|
72
|
+
|
|
73
|
+
Before any JOSE verification this package runs `assertCanonicalCompactJws` from `@atlasauth/pca` on the DPoP proof (rejected with code `malformed`): one accepted string form per token, so the token string (or its hash) is safe to use as a dedupe / replay / ledger key. Padded, `+` `/` alphabet, altered-trailing-bit, whitespace and duplicate-header-key re-encodings are rejected with a typed reason before the signature is even checked.
|
package/dist/index.d.ts
CHANGED
|
@@ -79,6 +79,10 @@ export interface VerifyDpopProofOptions {
|
|
|
79
79
|
seenJti?: JtiSeenSet;
|
|
80
80
|
/** Override "now" (epoch seconds) — for tests / fixed clocks. */
|
|
81
81
|
nowSec?: number;
|
|
82
|
+
/** If given, the proof MUST carry exactly this server-issued `nonce` (RFC 9449 §8/§9). */
|
|
83
|
+
expectedNonce?: string;
|
|
84
|
+
/** If given, the proof MUST carry `ath` = base64url(SHA-256(accessToken)) (RFC 9449 §4.2/§7.1). */
|
|
85
|
+
accessToken?: string;
|
|
82
86
|
}
|
|
83
87
|
export interface DpopVerifyResult {
|
|
84
88
|
/** The verified, type-checked DPoP claims. */
|
|
@@ -133,4 +137,6 @@ export declare function assertPcaDpop(p: PCActn, dpopProof: string, opts: {
|
|
|
133
137
|
maxAgeSec?: number;
|
|
134
138
|
seenJti?: JtiSeenSet;
|
|
135
139
|
nowSec?: number;
|
|
140
|
+
expectedNonce?: string;
|
|
141
|
+
accessToken?: string;
|
|
136
142
|
}): Promise<DpopVerifyResult>;
|
package/dist/index.js
CHANGED
|
@@ -29,6 +29,7 @@ exports.bindPcaToDpop = bindPcaToDpop;
|
|
|
29
29
|
exports.assertPcaDpop = assertPcaDpop;
|
|
30
30
|
const jose_1 = require("jose");
|
|
31
31
|
const pca_1 = require("@atlasauth/pca");
|
|
32
|
+
const pca_2 = require("@atlasauth/pca");
|
|
32
33
|
// ---- constants ---------------------------------------------------------------------------------
|
|
33
34
|
/** JWS algorithms a DPoP proof may use: asymmetric only, never `none` or a MAC (RFC 9449 §4.2). */
|
|
34
35
|
exports.DPOP_ALLOWED_ALGS = ['EdDSA', 'ES256', 'ES384', 'ES512', 'PS256', 'RS256'];
|
|
@@ -97,7 +98,7 @@ function normalizeHtu(url) {
|
|
|
97
98
|
}
|
|
98
99
|
/** The DPoP access-token hash `ath`: base64url(SHA-256(access token)), RFC 9449 §4.2. */
|
|
99
100
|
function athFor(accessToken) {
|
|
100
|
-
return (0,
|
|
101
|
+
return (0, pca_2.b64u)((0, pca_2.sha256)(new TextEncoder().encode(accessToken)));
|
|
101
102
|
}
|
|
102
103
|
function freshJti() {
|
|
103
104
|
return globalThis.crypto.randomUUID();
|
|
@@ -131,6 +132,8 @@ async function verifyDpopProof(proof, opts) {
|
|
|
131
132
|
// Reject a missing / non-public / absent-`jwk` header before trusting the signature.
|
|
132
133
|
let header;
|
|
133
134
|
try {
|
|
135
|
+
// Canonical-spelling gate BEFORE jose: a DPoP proof string has exactly one accepted form (jti/replay keys).
|
|
136
|
+
(0, pca_1.assertCanonicalCompactJws)(proof);
|
|
134
137
|
header = (0, jose_1.decodeProtectedHeader)(proof);
|
|
135
138
|
}
|
|
136
139
|
catch (e) {
|
|
@@ -183,6 +186,14 @@ async function verifyDpopProof(proof, opts) {
|
|
|
183
186
|
if (opts.expectedJkt !== undefined && jkt !== opts.expectedJkt) {
|
|
184
187
|
throw new DpopVerificationError('jkt', 'embedded key thumbprint does not match expected jkt');
|
|
185
188
|
}
|
|
189
|
+
// Server nonce (RFC 9449 §8/§9): when required, an absent or different nonce is rejected.
|
|
190
|
+
if (opts.expectedNonce !== undefined && payload.nonce !== opts.expectedNonce) {
|
|
191
|
+
throw new DpopVerificationError('nonce', 'proof nonce is missing or does not match the expected nonce');
|
|
192
|
+
}
|
|
193
|
+
// Access-token binding (RFC 9449 §4.2 / §7.1): when presented with an access token, `ath` must match.
|
|
194
|
+
if (opts.accessToken !== undefined && payload.ath !== athFor(opts.accessToken)) {
|
|
195
|
+
throw new DpopVerificationError('ath', 'proof ath is missing or does not match the access token');
|
|
196
|
+
}
|
|
186
197
|
// Replay: reject a reused jti, then record this one.
|
|
187
198
|
if (opts.seenJti !== undefined) {
|
|
188
199
|
if (opts.seenJti.has(jti))
|
|
@@ -215,7 +226,7 @@ function pemToDer(pem) {
|
|
|
215
226
|
*/
|
|
216
227
|
function mtlsCnf(certDerOrPem) {
|
|
217
228
|
const der = typeof certDerOrPem === 'string' ? pemToDer(certDerOrPem) : certDerOrPem;
|
|
218
|
-
return { 'x5t#S256': (0,
|
|
229
|
+
return { 'x5t#S256': (0, pca_2.b64u)((0, pca_2.sha256)(der)) };
|
|
219
230
|
}
|
|
220
231
|
// ---- PCActn ↔ DPoP binding --------------------------------------------------------------------
|
|
221
232
|
/**
|
|
@@ -247,6 +258,8 @@ async function assertPcaDpop(p, dpopProof, opts) {
|
|
|
247
258
|
expectedJkt: jkt,
|
|
248
259
|
...(opts.seenJti !== undefined ? { seenJti: opts.seenJti } : {}),
|
|
249
260
|
...(opts.nowSec !== undefined ? { nowSec: opts.nowSec } : {}),
|
|
261
|
+
...(opts.expectedNonce !== undefined ? { expectedNonce: opts.expectedNonce } : {}),
|
|
262
|
+
...(opts.accessToken !== undefined ? { accessToken: opts.accessToken } : {}),
|
|
250
263
|
});
|
|
251
264
|
}
|
|
252
265
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA+GH,sCAEC;AAGD,sCAeC;AAcD,oCAGC;AAGD,wBAEC;AAcD,0CAaC;AAOD,0CA+EC;AAeD,0BAGC;AAQD,sCAKC;AAGD,sCAEC;AAOD,sCAwBC;AA3UD,+BAAsG;AAEtG,wCAA2D;AAC3D,wCAA2D;AAE3D,mGAAmG;AAEnG,mGAAmG;AACtF,QAAA,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAGjG,qDAAqD;AACxC,QAAA,YAAY,GAAG,UAAU,CAAC;AAEvC,oFAAoF;AACvE,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAE5C,gGAAgG;AACnF,QAAA,mBAAmB,GAAG,CAAC,CAAC;AAErC,mGAAmG;AAEnG,oGAAoG;AACpG,MAAa,qBAAsB,SAAQ,KAAK;IACrC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,sDAOC;AA4ED,mGAAmG;AAEnG,6DAA6D;AAC7D,SAAgB,aAAa,CAAC,GAAQ,EAAE,SAAyC,QAAQ;IACvF,OAAO,IAAA,6BAAsB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,kGAAkG;AAClG,SAAgB,aAAa,CAAC,GAAQ;IACpC,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACjE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5G,KAAK,IAAI;YACP,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACxC,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3G,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,MAAM,IAAI,qBAAqB,CAAC,iBAAiB,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,GAAQ;IAC3B,MAAM,GAAG,GAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAC7C,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wGAAwG;AACxG,SAAgB,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yFAAyF;AACzF,SAAgB,MAAM,CAAC,WAAmB;IACxC,OAAO,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,gEAAgE;AAChE,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,kGAAkG;AAElG,0GAA0G;AACnG,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,MAAM,MAAM,GAAe;QACzB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;QAC5B,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE;QAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,OAAO,IAAI,cAAO,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,oBAAY,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,IAA4B;IAC/E,qFAAqF;IACrF,IAAI,MAAgD,CAAC;IACrD,IAAI,CAAC;QACH,4GAA4G;QAC5G,IAAA,+BAAyB,EAAC,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,cAAc,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAY,EAAE,CAAC;QAChC,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,oBAAY,WAAW,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;IAE5G,kGAAkG;IAClG,IAAI,OAAmB,CAAC;IACxB,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,kBAAW,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,yBAAiB,CAAC,EAAE,GAAG,EAAE,oBAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC;QAC7G,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,qBAAqB;YAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,kCAAkC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,gBAAgB;IAChB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC/H,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAEnH,kDAAkD;IAClD,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,iCAAiC,CAAC,CAAC;IAC5H,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,8BAA8B,CAAC,CAAC;IAEtH,aAAa;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,GAAG,GAAG,2BAAmB;QAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAC3G,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,uBAAuB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAEvH,eAAe;IACf,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,qDAAqD,CAAC,CAAC;IAChG,CAAC;IAED,0FAA0F;IAC1F,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7E,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,6DAA6D,CAAC,CAAC;IAC1G,CAAC;IAED,sGAAsG;IACtG,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;IACpG,CAAC;IAED,qDAAqD;IACrD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,EAAE,QAAQ,GAAG,yBAAyB,CAAC,CAAC;QAC/G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,MAAM,MAAM,GAAe;QACzB,GAAG,OAAO;QACV,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG;QACH,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9B,CAAC;AAED,kGAAkG;AAElG,oEAAoE;AACpE,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,YAAiC;IACvD,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACrF,OAAO,EAAE,UAAU,EAAE,IAAA,UAAI,EAAC,IAAA,YAAM,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,kGAAkG;AAElG;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAS;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC;IAC5H,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,iGAAiG;AAC1F,KAAK,UAAU,aAAa,CAAC,CAAS;IAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,aAAa,CACjC,CAAS,EACT,SAAiB,EACjB,IAQC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC,SAAS,EAAE;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,gCAAwB;QACrD,WAAW,EAAE,GAAG;QAChB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/pca-dpop",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Sender-constrained proof-of-possession for PCA: RFC 9449 DPoP proofs and RFC 8705 mTLS cnf binding, tying a PCActn to the holder key/channel for OAuth PoP interop.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"dpop",
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
36
|
"jose": "^5.9.6",
|
|
37
|
-
"@atlasauth/pca": "0.
|
|
37
|
+
"@atlasauth/pca": "0.4.0"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
40
|
"typescript": "^5.6.3",
|