@atlasauth/pca-idjag 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -65,3 +65,7 @@ The ID-JAG specification is an IETF draft and may change. JWT checks are delegat
|
|
|
65
65
|
## License
|
|
66
66
|
|
|
67
67
|
MIT - see LICENSE
|
|
68
|
+
|
|
69
|
+
## Canonical token spelling
|
|
70
|
+
|
|
71
|
+
Before any JOSE verification this package runs `assertCanonicalCompactJws` from `@atlasauth/pca` on the ID-JAG (via `verifyIdToken`): one accepted string form per token, so the token string (or its hash) is safe to use as a dedupe / replay / ledger key. Padded, `+` `/` alphabet, altered-trailing-bit, whitespace and duplicate-header-key re-encodings are rejected with a typed reason before the signature is even checked.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@atlasauth/pca-idjag",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "ID-JAG / OAuth Cross-App-Access bridge for PCA: verify an identity-assertion authorization grant (sub=human, act=agent, scoped, single-audience) and map it to a PCA principal/capability; RFC 8693/7523 token-exchange.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"id-jag",
|
|
@@ -33,8 +33,8 @@
|
|
|
33
33
|
},
|
|
34
34
|
"dependencies": {
|
|
35
35
|
"jose": "^5.9.6",
|
|
36
|
-
"@atlasauth/pca": "0.
|
|
37
|
-
"@atlasauth/pca-oidc": "0.
|
|
36
|
+
"@atlasauth/pca": "0.4.0",
|
|
37
|
+
"@atlasauth/pca-oidc": "0.4.0"
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
40
|
"typescript": "^5.6.3",
|