@atproto/oauth-client 0.3.22 → 0.4.0

package/src/validate-client-metadata.ts

@@ -4,28 +4,13 @@ import {
   assertOAuthDiscoverableClientId,
   assertOAuthLoopbackClientId,
 } from '@atproto/oauth-types'
+import { FALLBACK_ALG } from './constants.js'
 import { ClientMetadata, clientMetadataSchema } from './types.js'
 
-const TOKEN_ENDPOINT_AUTH_METHOD = `token_endpoint_auth_method`
-const TOKEN_ENDPOINT_AUTH_SIGNING_ALG = `token_endpoint_auth_signing_alg`
-
 export function validateClientMetadata(
   input: OAuthClientMetadataInput,
   keyset?: Keyset,
 ): ClientMetadata {
-  if (input.jwks) {
-    if (!keyset) {
-      throw new TypeError(`Keyset must not be provided when jwks is provided`)
-    }
-    for (const key of input.jwks.keys) {
-      if (!key.kid) {
-        throw new TypeError(`Key must have a "kid" property`)
-      } else if (!keyset.has(key.kid)) {
-        throw new TypeError(`Key with kid "${key.kid}" not found in keyset`)
-      }
-    }
-  }
-
   // Allow to pass a keyset and omit the jwks/jwks_uri properties
   if (!input.jwks && !input.jwks_uri && keyset?.size) {
     input = { ...input, jwks: keyset.toJSON() }
@@ -53,32 +38,60 @@ export function validateClientMetadata(
     throw new TypeError(`"grant_types" must include "authorization_code"`)
   }
 
-  const method = metadata[TOKEN_ENDPOINT_AUTH_METHOD]
+  const method = metadata.token_endpoint_auth_method
+  const methodAlg = metadata.token_endpoint_auth_signing_alg
   switch (method) {
-    case undefined:
-      throw new TypeError(`${TOKEN_ENDPOINT_AUTH_METHOD} must be provided`)
     case 'none':
-      if (metadata[TOKEN_ENDPOINT_AUTH_SIGNING_ALG]) {
+      if (methodAlg) {
         throw new TypeError(
-          `${TOKEN_ENDPOINT_AUTH_SIGNING_ALG} must not be provided when ${TOKEN_ENDPOINT_AUTH_METHOD} is "${method}"`,
+          `"token_endpoint_auth_signing_alg" must not be provided when "token_endpoint_auth_method" is "${method}"`,
         )
       }
       break
-    case 'private_key_jwt':
-      if (!keyset?.size) {
+
+    case 'private_key_jwt': {
+      if (!methodAlg) {
+        throw new TypeError(
+          `"token_endpoint_auth_signing_alg" must be provided when "token_endpoint_auth_method" is "${method}"`,
+        )
+      }
+
+      const signingKeys = keyset
+        ? Array.from(keyset.list({ use: 'sig' })).filter(
+            (key) => key.isPrivate && key.kid,
+          )
+        : null
+
+      if (!signingKeys?.some((key) => key.algorithms.includes(FALLBACK_ALG))) {
         throw new TypeError(
-          `A non-empty keyset must be provided when ${TOKEN_ENDPOINT_AUTH_METHOD} is "${method}"`,
+          `Client authentication method "${method}" requires at least one "${FALLBACK_ALG}" signing key with a "kid" property`,
         )
       }
-      if (!metadata[TOKEN_ENDPOINT_AUTH_SIGNING_ALG]) {
+
+      if (metadata.jwks) {
+        // Ensure that all the signing keys that could end-up being used are
+        // advertised in the JWKS.
+        for (const key of signingKeys) {
+          if (!metadata.jwks.keys.some((k) => k.kid === key.kid)) {
+            throw new TypeError(`Key with kid "${key.kid}" not found in jwks`)
+          }
+        }
+      } else if (metadata.jwks_uri) {
+        // @NOTE we only ensure that all the signing keys are referenced in JWKS
+        // when it is available (see previous "if") as we don't want to download
+        // that file here (for efficiency reasons).
+      } else {
         throw new TypeError(
-          `${TOKEN_ENDPOINT_AUTH_SIGNING_ALG} must be provided when ${TOKEN_ENDPOINT_AUTH_METHOD} is "${method}"`,
+          `Client authentication method "${method}" requires a JWKS`,
         )
       }
+
       break
+    }
+
     default:
       throw new TypeError(
-        `Invalid "token_endpoint_auth_method" value: ${method}`,
+        `Unsupported "token_endpoint_auth_method" value: ${method}`,
       )
   }
 

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/atproto-token-response.ts","./src/constants.ts","./src/fetch-dpop.ts","./src/index.ts","./src/lock.ts","./src/oauth-authorization-server-metadata-resolver.ts","./src/oauth-callback-error.ts","./src/oauth-client.ts","./src/oauth-protected-resource-metadata-resolver.ts","./src/oauth-resolver-error.ts","./src/oauth-resolver.ts","./src/oauth-response-error.ts","./src/oauth-server-agent.ts","./src/oauth-server-factory.ts","./src/oauth-session.ts","./src/runtime-implementation.ts","./src/runtime.ts","./src/session-getter.ts","./src/state-store.ts","./src/types.ts","./src/util.ts","./src/validate-client-metadata.ts","./src/errors/token-invalid-error.ts","./src/errors/token-refresh-error.ts","./src/errors/token-revoked-error.ts"],"version":"5.8.2"}
+{"root":["./src/atproto-token-response.ts","./src/constants.ts","./src/fetch-dpop.ts","./src/index.ts","./src/lock.ts","./src/oauth-authorization-server-metadata-resolver.ts","./src/oauth-callback-error.ts","./src/oauth-client-auth.ts","./src/oauth-client.ts","./src/oauth-protected-resource-metadata-resolver.ts","./src/oauth-resolver-error.ts","./src/oauth-resolver.ts","./src/oauth-response-error.ts","./src/oauth-server-agent.ts","./src/oauth-server-factory.ts","./src/oauth-session.ts","./src/runtime-implementation.ts","./src/runtime.ts","./src/session-getter.ts","./src/state-store.ts","./src/types.ts","./src/util.ts","./src/validate-client-metadata.ts","./src/errors/auth-method-unsatisfiable-error.ts","./src/errors/token-invalid-error.ts","./src/errors/token-refresh-error.ts","./src/errors/token-revoked-error.ts"],"version":"5.8.2"}