@atproto/oauth-provider 0.1.0

package/dist/oauth-provider.js

@@ -0,0 +1,748 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthProvider = exports.Keyset = void 0;
+const fetch_node_1 = require("@atproto-labs/fetch-node");
+const simple_store_memory_1 = require("@atproto-labs/simple-store-memory");
+const jwk_1 = require("@atproto/jwk");
+Object.defineProperty(exports, "Keyset", { enumerable: true, get: function () { return jwk_1.Keyset; } });
+const oauth_types_1 = require("@atproto/oauth-types");
+const zod_1 = require("zod");
+const access_token_type_js_1 = require("./access-token/access-token-type.js");
+const account_manager_js_1 = require("./account/account-manager.js");
+const account_store_js_1 = require("./account/account-store.js");
+const assets_middleware_js_1 = require("./assets/assets-middleware.js");
+const client_auth_js_1 = require("./client/client-auth.js");
+const client_id_js_1 = require("./client/client-id.js");
+const client_manager_js_1 = require("./client/client-manager.js");
+const client_store_js_1 = require("./client/client-store.js");
+const constants_js_1 = require("./constants.js");
+const device_manager_js_1 = require("./device/device-manager.js");
+const device_store_js_1 = require("./device/device-store.js");
+const access_denied_error_js_1 = require("./errors/access-denied-error.js");
+const account_selection_required_error_js_1 = require("./errors/account-selection-required-error.js");
+const consent_required_error_js_1 = require("./errors/consent-required-error.js");
+const invalid_client_error_js_1 = require("./errors/invalid-client-error.js");
+const invalid_grant_error_js_1 = require("./errors/invalid-grant-error.js");
+const invalid_parameters_error_js_1 = require("./errors/invalid-parameters-error.js");
+const invalid_request_error_js_1 = require("./errors/invalid-request-error.js");
+const login_required_error_js_1 = require("./errors/login-required-error.js");
+const oauth_error_js_1 = require("./errors/oauth-error.js");
+const unauthorized_client_error_js_1 = require("./errors/unauthorized-client-error.js");
+const www_authenticate_error_js_1 = require("./errors/www-authenticate-error.js");
+const index_js_1 = require("./lib/http/index.js");
+const date_js_1 = require("./lib/util/date.js");
+const build_metadata_js_1 = require("./metadata/build-metadata.js");
+const oauth_verifier_js_1 = require("./oauth-verifier.js");
+const build_error_payload_js_1 = require("./output/build-error-payload.js");
+const send_authorize_page_js_1 = require("./output/send-authorize-page.js");
+const send_authorize_redirect_js_1 = require("./output/send-authorize-redirect.js");
+const send_error_page_js_1 = require("./output/send-error-page.js");
+const oidc_payload_js_1 = require("./parameters/oidc-payload.js");
+const replay_store_js_1 = require("./replay/replay-store.js");
+const request_manager_js_1 = require("./request/request-manager.js");
+const request_store_memory_js_1 = require("./request/request-store-memory.js");
+const request_store_redis_js_1 = require("./request/request-store-redis.js");
+const request_store_js_1 = require("./request/request-store.js");
+const request_uri_js_1 = require("./request/request-uri.js");
+const types_js_1 = require("./request/types.js");
+const token_id_js_1 = require("./token/token-id.js");
+const token_manager_js_1 = require("./token/token-manager.js");
+const token_store_js_1 = require("./token/token-store.js");
+const types_js_2 = require("./token/types.js");
+class OAuthProvider extends oauth_verifier_js_1.OAuthVerifier {
+    metadata;
+    customization;
+    authenticationMaxAge;
+    accountManager;
+    deviceStore;
+    clientManager;
+    requestManager;
+    tokenManager;
+    constructor({ metadata, customization = undefined, authenticationMaxAge = constants_js_1.AUTHENTICATION_MAX_AGE, tokenMaxAge = constants_js_1.TOKEN_MAX_AGE, safeFetch = (0, fetch_node_1.safeFetchWrap)(), redis, store, // compound store implementation
+    // Requires stores
+    accountStore = (0, account_store_js_1.asAccountStore)(store), deviceStore = (0, device_store_js_1.asDeviceStore)(store), tokenStore = (0, token_store_js_1.asTokenStore)(store), 
+    // These are optional
+    clientStore = (0, client_store_js_1.ifClientStore)(store), replayStore = (0, replay_store_js_1.ifReplayStore)(store), requestStore = (0, request_store_js_1.ifRequestStore)(store), clientJwksCache = new simple_store_memory_1.SimpleStoreMemory({
+        maxSize: 50_000_000,
+        ttl: 600e3,
+    }), clientMetadataCache = new simple_store_memory_1.SimpleStoreMemory({
+        maxSize: 50_000_000,
+        ttl: 600e3,
+    }), loopbackMetadata = oauth_types_1.atprotoLoopbackClientMetadata, 
+    // OAuthHooks & OAuthVerifierOptions
+    ...rest }) {
+        super({ replayStore, redis, ...rest });
+        requestStore ??= redis
+            ? new request_store_redis_js_1.RequestStoreRedis({ redis })
+            : new request_store_memory_js_1.RequestStoreMemory();
+        this.authenticationMaxAge = authenticationMaxAge;
+        this.metadata = (0, build_metadata_js_1.buildMetadata)(this.issuer, this.keyset, metadata);
+        this.customization = customization;
+        this.deviceStore = deviceStore;
+        this.accountManager = new account_manager_js_1.AccountManager(accountStore);
+        this.clientManager = new client_manager_js_1.ClientManager(this.keyset, rest, clientStore || null, loopbackMetadata || null, safeFetch, clientJwksCache, clientMetadataCache);
+        this.requestManager = new request_manager_js_1.RequestManager(requestStore, this.signer, this.metadata, rest);
+        this.tokenManager = new token_manager_js_1.TokenManager(tokenStore, this.signer, rest, this.accessTokenType, tokenMaxAge);
+    }
+    get jwks() {
+        return this.keyset.publicJwks;
+    }
+    loginRequired(client, parameters, info) {
+        /** in seconds */
+        const authAge = (Date.now() - info.authenticatedAt.getTime()) / 1e3;
+        // Fool-proof (invalid date, or suspiciously in the future)
+        if (!Number.isFinite(authAge) || authAge < 0) {
+            return true;
+        }
+        /** in seconds */
+        const maxAge = parameters.max_age ?? client.metadata.default_max_age;
+        if (maxAge != null && maxAge < this.authenticationMaxAge) {
+            return authAge >= maxAge;
+        }
+        else {
+            return authAge >= this.authenticationMaxAge;
+        }
+    }
+    async authenticateClient(client, endpoint, credentials) {
+        const { clientAuth, nonce } = await client.verifyCredentials(credentials, endpoint, { audience: this.issuer });
+        if (nonce != null) {
+            const unique = await this.replayManager.uniqueAuth(nonce, client.id);
+            if (!unique) {
+                throw new invalid_client_error_js_1.InvalidClientError(`${clientAuth.method} jti reused`);
+            }
+        }
+        return clientAuth;
+    }
+    async decodeJAR(client, input) {
+        const result = await client.decodeRequestObject(input.request);
+        const payload = oauth_types_1.oauthAuthenticationRequestParametersSchema.parse(result.payload);
+        if (!result.payload.jti) {
+            throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Request object must contain a jti claim');
+        }
+        if (!(await this.replayManager.uniqueJar(result.payload.jti, client.id))) {
+            throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Request object jti is not unique');
+        }
+        if ('protectedHeader' in result) {
+            if (!result.protectedHeader.kid) {
+                throw new invalid_parameters_error_js_1.InvalidParametersError(payload, 'Missing "kid" in header');
+            }
+            return {
+                jkt: await (0, client_auth_js_1.authJwkThumbprint)(result.key),
+                payload,
+                protectedHeader: result.protectedHeader,
+            };
+        }
+        if ('header' in result) {
+            return {
+                payload,
+            };
+        }
+        // Should never happen
+        throw new Error('Invalid request object');
+    }
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc9126}
+     */
+    async pushedAuthorizationRequest(input, dpopJkt) {
+        try {
+            const client = await this.clientManager.getClient(input.client_id);
+            const clientAuth = await this.authenticateClient(client, 'pushed_authorization_request', input);
+            const { payload: parameters } = 'request' in input // Handle JAR
+                ? await this.decodeJAR(client, input)
+                : { payload: input };
+            const { uri, expiresAt } = await this.requestManager.createAuthorizationRequest(client, clientAuth, parameters, null, dpopJkt);
+            return {
+                request_uri: uri,
+                expires_in: (0, date_js_1.dateToRelativeSeconds)(expiresAt),
+            };
+        }
+        catch (err) {
+            // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3-1
+            // > Since initial processing of the pushed authorization request does not
+            // > involve resource owner interaction, error codes related to user
+            // > interaction, such as consent_required defined by [OIDC], are never
+            // > returned.
+            if (err instanceof access_denied_error_js_1.AccessDeniedError) {
+                throw new invalid_request_error_js_1.InvalidRequestError(err.error_description, err);
+            }
+            throw err;
+        }
+    }
+    async loadAuthorizationRequest(client, deviceId, input) {
+        // Load PAR
+        if ('request_uri' in input) {
+            return this.requestManager.get(input.request_uri, client.id, deviceId);
+        }
+        // Handle JAR
+        if ('request' in input) {
+            const requestObject = await this.decodeJAR(client, input);
+            if ('protectedHeader' in requestObject && requestObject.protectedHeader) {
+                // Allow using signed JAR during "/authorize" as client authentication.
+                // This allows clients to skip PAR to initiate trusted sessions.
+                const clientAuth = {
+                    method: oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER,
+                    kid: requestObject.protectedHeader.kid,
+                    alg: requestObject.protectedHeader.alg,
+                    jkt: requestObject.jkt,
+                };
+                return this.requestManager.createAuthorizationRequest(client, clientAuth, requestObject.payload, deviceId, null);
+            }
+            return this.requestManager.createAuthorizationRequest(client, { method: 'none' }, requestObject.payload, deviceId, null);
+        }
+        return this.requestManager.createAuthorizationRequest(client, { method: 'none' }, input, deviceId, null);
+    }
+    async deleteRequest(uri, parameters) {
+        try {
+            await this.requestManager.delete(uri);
+        }
+        catch (err) {
+            throw access_denied_error_js_1.AccessDeniedError.from(parameters, err);
+        }
+    }
+    async authorize(deviceId, input) {
+        const { issuer } = this;
+        const client = await this.clientManager.getClient(input.client_id);
+        try {
+            const { uri, parameters, clientAuth } = await this.loadAuthorizationRequest(client, deviceId, input);
+            try {
+                const sessions = await this.getSessions(client, clientAuth, deviceId, parameters);
+                if (parameters.prompt === 'none') {
+                    const ssoSessions = sessions.filter((s) => s.matchesHint);
+                    if (ssoSessions.length > 1) {
+                        throw new account_selection_required_error_js_1.AccountSelectionRequiredError(parameters);
+                    }
+                    if (ssoSessions.length < 1) {
+                        throw new login_required_error_js_1.LoginRequiredError(parameters);
+                    }
+                    const ssoSession = ssoSessions[0];
+                    if (ssoSession.loginRequired) {
+                        throw new login_required_error_js_1.LoginRequiredError(parameters);
+                    }
+                    if (ssoSession.consentRequired) {
+                        throw new consent_required_error_js_1.ConsentRequiredError(parameters);
+                    }
+                    const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account, ssoSession.info);
+                    return { issuer, client, parameters, redirect };
+                }
+                // Automatic SSO when a did was provided
+                if (parameters.prompt == null && parameters.login_hint != null) {
+                    const ssoSessions = sessions.filter((s) => s.matchesHint);
+                    if (ssoSessions.length === 1) {
+                        const ssoSession = ssoSessions[0];
+                        if (!ssoSession.loginRequired && !ssoSession.consentRequired) {
+                            const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, ssoSession.account, ssoSession.info);
+                            return { issuer, client, parameters, redirect };
+                        }
+                    }
+                }
+                return {
+                    issuer,
+                    client,
+                    parameters,
+                    authorize: { uri, sessions },
+                };
+            }
+            catch (err) {
+                await this.deleteRequest(uri, parameters);
+                // Transform into an AccessDeniedError to allow redirecting the user
+                // to the client with the error details.
+                throw access_denied_error_js_1.AccessDeniedError.from(parameters, err);
+            }
+        }
+        catch (err) {
+            if (err instanceof access_denied_error_js_1.AccessDeniedError) {
+                return {
+                    issuer,
+                    client,
+                    parameters: err.parameters,
+                    redirect: err.toJSON(),
+                };
+            }
+            throw err;
+        }
+    }
+    async getSessions(client, clientAuth, deviceId, parameters) {
+        const accounts = await this.accountManager.list(deviceId);
+        return accounts.map(({ account, info }) => ({
+            account,
+            info,
+            selected: parameters.prompt !== 'select_account' &&
+                parameters.login_hint === account.sub,
+            loginRequired: parameters.prompt === 'login' ||
+                this.loginRequired(client, parameters, info),
+            consentRequired: parameters.prompt === 'consent' ||
+                !info.authorizedClients.includes(client.id),
+            matchesHint: parameters.login_hint === account.sub || parameters.login_hint == null,
+        }));
+    }
+    async signIn(deviceId, credentials) {
+        return this.accountManager.signIn(credentials, deviceId);
+    }
+    async acceptRequest(deviceId, uri, clientId, sub) {
+        const { issuer } = this;
+        const client = await this.clientManager.getClient(clientId);
+        try {
+            const { parameters, clientAuth } = await this.requestManager.get(uri, clientId, deviceId);
+            try {
+                const { account, info } = await this.accountManager.get(deviceId, sub);
+                // The user is trying to authorize without a fresh login
+                if (this.loginRequired(client, parameters, info)) {
+                    throw new login_required_error_js_1.LoginRequiredError(parameters, 'Account authentication required.');
+                }
+                const redirect = await this.requestManager.setAuthorized(client, uri, deviceId, account, info);
+                await this.accountManager.addAuthorizedClient(deviceId, account, client, clientAuth);
+                return { issuer, client, parameters, redirect };
+            }
+            catch (err) {
+                await this.deleteRequest(uri, parameters);
+                // throw AccessDeniedError.from(parameters, err)
+                throw err;
+            }
+        }
+        catch (err) {
+            if (err instanceof access_denied_error_js_1.AccessDeniedError) {
+                const { parameters } = err;
+                return { issuer, client, parameters, redirect: err.toJSON() };
+            }
+            throw err;
+        }
+    }
+    async rejectRequest(deviceId, uri, clientId) {
+        try {
+            const { parameters } = await this.requestManager.get(uri, clientId, deviceId);
+            await this.deleteRequest(uri, parameters);
+            // Trigger redirect (see catch block)
+            throw new access_denied_error_js_1.AccessDeniedError(parameters, 'Access denied');
+        }
+        catch (err) {
+            if (err instanceof access_denied_error_js_1.AccessDeniedError) {
+                return {
+                    issuer: this.issuer,
+                    client: await this.clientManager.getClient(clientId),
+                    parameters: err.parameters,
+                    redirect: err.toJSON(),
+                };
+            }
+            throw err;
+        }
+    }
+    async token(input, dpopJkt) {
+        const client = await this.clientManager.getClient(input.client_id);
+        const clientAuth = await this.authenticateClient(client, 'token', input);
+        if (!client.metadata.grant_types.includes(input.grant_type)) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`"${input.grant_type}" grant type is not allowed for this client`);
+        }
+        if (input.grant_type === 'authorization_code') {
+            return this.codeGrant(client, clientAuth, input, dpopJkt);
+        }
+        if (input.grant_type === 'refresh_token') {
+            return this.refreshTokenGrant(client, clientAuth, input, dpopJkt);
+        }
+        throw new invalid_grant_error_js_1.InvalidGrantError(
+        // @ts-expect-error: fool proof
+        `Grant type "${input.grant_type}" not supported`);
+    }
+    async codeGrant(client, clientAuth, input, dpopJkt) {
+        try {
+            const { sub, deviceId, parameters } = await this.requestManager.findCode(client, clientAuth, input.code);
+            const { account, info } = await this.accountManager.get(deviceId, sub);
+            return await this.tokenManager.create(client, clientAuth, account, { id: deviceId, info }, parameters, input, dpopJkt);
+        }
+        catch (err) {
+            // If a token is replayed, requestManager.findCode will throw. In that
+            // case, we need to revoke any token that was issued for this code.
+            await this.tokenManager.revoke(input.code);
+            // @TODO (?) in order to protect the user, we should maybe also mark the
+            // account-device association as expired ?
+            throw err;
+        }
+    }
+    async refreshTokenGrant(client, clientAuth, input, dpopJkt) {
+        return this.tokenManager.refresh(client, clientAuth, input, dpopJkt);
+    }
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7009#section-2.1 rfc7009}
+     */
+    async revoke(input) {
+        // @TODO this should also remove the account-device association (or, at
+        // least, mark it as expired)
+        await this.tokenManager.revoke(input.token);
+    }
+    /**
+     * @see {@link https://datatracker.ietf.org/doc/html/rfc7662#section-2.1 rfc7662}
+     */
+    async introspect(input) {
+        const client = await this.clientManager.getClient(input.client_id);
+        const clientAuth = await this.authenticateClient(client, 'introspection', input);
+        // RFC7662 states the following:
+        //
+        // > To prevent token scanning attacks, the endpoint MUST also require some
+        // > form of authorization to access this endpoint, such as client
+        // > authentication as described in OAuth 2.0 [RFC6749] or a separate OAuth
+        // > 2.0 access token such as the bearer token described in OAuth 2.0 Bearer
+        // > Token Usage [RFC6750]. The methods of managing and validating these
+        // > authentication credentials are out of scope of this specification.
+        if (clientAuth.method === 'none') {
+            throw new unauthorized_client_error_js_1.UnauthorizedClientError('Client authentication required');
+        }
+        const start = Date.now();
+        try {
+            const tokenInfo = await this.tokenManager.clientTokenInfo(client, clientAuth, input.token);
+            return {
+                active: true,
+                scope: tokenInfo.data.parameters.scope,
+                client_id: tokenInfo.data.clientId,
+                username: tokenInfo.account.preferred_username,
+                token_type: tokenInfo.data.parameters.dpop_jkt ? 'DPoP' : 'Bearer',
+                authorization_details: tokenInfo.data.details ?? undefined,
+                aud: tokenInfo.account.aud,
+                exp: (0, date_js_1.dateToEpoch)(tokenInfo.data.expiresAt),
+                iat: (0, date_js_1.dateToEpoch)(tokenInfo.data.updatedAt),
+                iss: this.signer.issuer,
+                jti: tokenInfo.id,
+                sub: tokenInfo.account.sub,
+            };
+        }
+        catch (err) {
+            // Prevent brute force & timing attack (only for inactive tokens)
+            await new Promise((r) => setTimeout(r, 750 - (Date.now() - start)));
+            return {
+                active: false,
+            };
+        }
+    }
+    /**
+     * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.5.3.2 Successful UserInfo Response}
+     */
+    async userinfo({ data, account }) {
+        return {
+            ...(0, oidc_payload_js_1.oidcPayload)(data.parameters, account),
+            sub: account.sub,
+            client_id: data.clientId,
+            username: account.preferred_username,
+        };
+    }
+    async signUserinfo(userinfo) {
+        const client = await this.clientManager.getClient(userinfo.client_id);
+        return this.signer.sign({
+            alg: client.metadata.userinfo_signed_response_alg,
+            typ: 'JWT',
+        }, userinfo);
+    }
+    async authenticateToken(tokenType, token, dpopJkt, verifyOptions) {
+        if ((0, token_id_js_1.isTokenId)(token)) {
+            this.assertTokenTypeAllowed(tokenType, access_token_type_js_1.AccessTokenType.id);
+            return this.tokenManager.authenticateTokenId(tokenType, token, dpopJkt, verifyOptions);
+        }
+        return super.authenticateToken(tokenType, token, dpopJkt, verifyOptions);
+    }
+    /**
+     * @returns An http request handler that can be used with node's http server
+     * or as a middleware with express / connect.
+     */
+    httpHandler(options) {
+        const router = this.buildRouter(options);
+        return router.buildHandler();
+    }
+    buildRouter({ onError = process.env['NODE_ENV'] === 'development'
+        ? (req, res, err, msg) => console.error(`OAuthProvider error (${msg}):`, err)
+        : undefined, } = {}) {
+        const deviceManager = new device_manager_js_1.DeviceManager(this.deviceStore);
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
+        const server = this;
+        const issuerUrl = new URL(server.issuer);
+        const issuerOrigin = issuerUrl.origin;
+        const router = new index_js_1.Router(issuerUrl);
+        // Utils
+        const csrfCookie = (uri) => `csrf-${uri}`;
+        /**
+         * Creates a middleware that will serve static JSON content.
+         */
+        const staticJson = (json) => (0, index_js_1.combineMiddlewares)([
+            function (req, res, next) {
+                res.setHeader('Access-Control-Allow-Origin', '*');
+                res.setHeader('Cache-Control', 'max-age=300');
+                next();
+            },
+            (0, index_js_1.staticJsonHandler)(json),
+        ]);
+        /**
+         * Wrap an OAuth endpoint in a middleware that will set the appropriate
+         * response headers and format the response as JSON.
+         */
+        const dynamicJson = (buildJson, status) => async function (req, res) {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            // https://www.rfc-editor.org/rfc/rfc6749.html#section-5.1
+            res.setHeader('Cache-Control', 'no-store');
+            res.setHeader('Pragma', 'no-cache');
+            // https://datatracker.ietf.org/doc/html/rfc9449#section-8.2
+            const dpopNonce = server.nextDpopNonce();
+            if (dpopNonce) {
+                const name = 'DPoP-Nonce';
+                res.setHeader(name, dpopNonce);
+                res.appendHeader('Access-Control-Expose-Headers', name);
+            }
+            try {
+                const result = await buildJson.call(this, req, res);
+                if (result !== undefined)
+                    (0, index_js_1.writeJson)(res, result, status);
+                else if (!res.headersSent)
+                    res.writeHead(status ?? 204).end();
+            }
+            catch (err) {
+                if (!res.headersSent) {
+                    if (err instanceof www_authenticate_error_js_1.WWWAuthenticateError) {
+                        const name = 'WWW-Authenticate';
+                        res.setHeader(name, err.wwwAuthenticateHeader);
+                        res.appendHeader('Access-Control-Expose-Headers', name);
+                    }
+                    (0, index_js_1.writeJson)(res, (0, build_error_payload_js_1.buildErrorPayload)(err), (0, build_error_payload_js_1.buildErrorStatus)(err));
+                }
+                else {
+                    res.destroy();
+                }
+                // OAuthError are used to build expected responses, so we don't log
+                // them as errors.
+                if (!(err instanceof oauth_error_js_1.OAuthError) || err.statusCode >= 500) {
+                    await onError?.(req, res, err, 'Unexpected error');
+                }
+            }
+        };
+        //- Public OAuth endpoints
+        /*
+         * Although OpenID compatibility is not required to implement the Atproto
+         * OAuth2 specification, we do support OIDC discovery in this
+         * implementation as we believe this may:
+         * 1) Make the implementation of Atproto clients easier (since lots of
+         *    libraries support OIDC discovery)
+         * 2) Allow self hosted PDS' to not implement authentication themselves
+         *    but rely on a trusted Atproto actor to act as their OIDC providers.
+         *    By supporting OIDC in the current implementation, Bluesky's
+         *    Authorization Server server can be used as an OIDC provider for
+         *    these users.
+         */
+        router.get('/.well-known/openid-configuration', staticJson(server.metadata));
+        router.get('/.well-known/oauth-authorization-server', staticJson(server.metadata));
+        // CORS preflight
+        router.options(/^\/oauth\/(?<endpoint>jwks|par|token|revoke|introspect|userinfo)$/, function (req, res, _next) {
+            res
+                .writeHead(204, {
+                'Access-Control-Allow-Origin': req.headers['origin'] || '*',
+                'Access-Control-Allow-Methods': this.params.endpoint === 'jwks' ? 'GET' : 'POST',
+                'Access-Control-Allow-Headers': 'Content-Type,Authorization,DPoP',
+                'Access-Control-Max-Age': '86400', // 1 day
+            })
+                .end();
+        });
+        router.get('/oauth/jwks', staticJson(server.jwks));
+        router.post('/oauth/par', dynamicJson(async function (req, _res) {
+            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_1.pushedAuthorizationRequestSchema);
+            const dpopJkt = await server.checkDpopProof(req.headers['dpop'], req.method, this.url);
+            return server.pushedAuthorizationRequest(input, dpopJkt);
+        }, 201));
+        // https://datatracker.ietf.org/doc/html/rfc9126#section-2.3
+        router.addRoute('*', '/oauth/par', (req, res) => {
+            res.writeHead(405).end();
+        });
+        router.post('/oauth/token', dynamicJson(async function (req, _res) {
+            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.tokenRequestSchema);
+            const dpopJkt = await server.checkDpopProof(req.headers['dpop'], req.method, this.url);
+            return server.token(input, dpopJkt);
+        }));
+        router.post('/oauth/revoke', dynamicJson(async function (req, res) {
+            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.revokeSchema);
+            try {
+                await server.revoke(input);
+            }
+            catch (err) {
+                onError?.(req, res, err, 'Failed to revoke token');
+            }
+        }));
+        router.get('/oauth/revoke', dynamicJson(async function (req, res) {
+            (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
+            (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+            const query = Object.fromEntries(this.url.searchParams);
+            const input = types_js_2.revokeSchema.parse(query, { path: ['query'] });
+            try {
+                await server.revoke(input);
+            }
+            catch (err) {
+                onError?.(req, res, err, 'Failed to revoke token');
+            }
+            // Same as POST + redirect to callback URL
+            // todo: generate JSONP response (if "callback" is provided)
+            throw new Error('You are successfully logged out. Redirect not implemented');
+        }));
+        router.post('/oauth/introspect', dynamicJson(async function (req, _res) {
+            const input = await (0, index_js_1.validateRequestPayload)(req, types_js_2.introspectSchema);
+            return server.introspect(input);
+        }));
+        const userinfoBodySchema = zod_1.z.object({
+            access_token: jwk_1.signedJwtSchema.optional(),
+        });
+        router.addRoute(['GET', 'POST'], '/oauth/userinfo', (0, index_js_1.acceptMiddleware)(async function (req, _res) {
+            const body = req.method === 'POST'
+                ? await (0, index_js_1.validateRequestPayload)(req, userinfoBodySchema)
+                : null;
+            if (body?.access_token && req.headers['authorization']) {
+                throw new invalid_request_error_js_1.InvalidRequestError('access token must be provided in either the authorization header or the request body');
+            }
+            const auth = await server.authenticateRequest(req.method, this.url, body?.access_token // Allow credentials to be parsed from body.
+                ? {
+                    authorization: `Bearer ${body.access_token}`,
+                    dpop: undefined, // DPoP can only be used with headers
+                }
+                : req.headers, {
+                scope: ['profile'],
+            });
+            const tokenInfo = 'tokenInfo' in auth
+                ? auth.tokenInfo
+                : await server.tokenManager.getTokenInfo(auth.tokenType, auth.tokenId);
+            return server.userinfo(tokenInfo);
+        }, {
+            '': 'application/json',
+            'application/json': dynamicJson(async function (_req, _res) {
+                return this.data;
+            }),
+            'application/jwt': dynamicJson(async function (_req, res) {
+                const jwt = await server.signUserinfo(this.data);
+                res.writeHead(200, { 'Content-Type': 'application/jwt' }).end(jwt);
+                return undefined;
+            }),
+        }));
+        //- Private authorization endpoints
+        router.use((0, assets_middleware_js_1.authorizeAssetsMiddleware)());
+        router.get('/oauth/authorize', async function (req, res) {
+            try {
+                res.setHeader('Cache-Control', 'no-store');
+                (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
+                (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+                const query = Object.fromEntries(this.url.searchParams);
+                const input = await types_js_1.authorizationRequestQuerySchema.parseAsync(query, {
+                    path: ['query'],
+                });
+                const { deviceId } = await deviceManager.load(req, res);
+                const data = await server.authorize(deviceId, input);
+                switch (true) {
+                    case 'redirect' in data: {
+                        return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
+                    }
+                    case 'authorize' in data: {
+                        await (0, index_js_1.setupCsrfToken)(req, res, csrfCookie(data.authorize.uri));
+                        return await (0, send_authorize_page_js_1.sendAuthorizePage)(res, data, server.customization);
+                    }
+                    default: {
+                        // Should never happen
+                        throw new Error('Unexpected authorization result');
+                    }
+                }
+            }
+            catch (err) {
+                await onError?.(req, res, err, 'Failed to setup authorize');
+                if (!res.headersSent) {
+                    await (0, send_error_page_js_1.sendErrorPage)(res, err, server.customization);
+                }
+            }
+        });
+        const signInPayloadSchema = zod_1.z.object({
+            csrf_token: zod_1.z.string(),
+            request_uri: request_uri_js_1.requestUriSchema,
+            client_id: client_id_js_1.clientIdSchema,
+            credentials: zod_1.z.object({
+                username: zod_1.z.string(),
+                password: zod_1.z.string(),
+                remember: zod_1.z.boolean().optional().default(false),
+            }),
+        });
+        router.post('/oauth/authorize/sign-in', async function (req, res) {
+            (0, index_js_1.validateFetchMode)(req, res, ['same-origin']);
+            (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+            const input = await (0, index_js_1.validateRequestPayload)(req, signInPayloadSchema);
+            (0, index_js_1.validateReferer)(req, res, {
+                origin: issuerOrigin,
+                pathname: '/oauth/authorize',
+            });
+            (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri));
+            const { deviceId } = await deviceManager.load(req, res);
+            const { account, info } = await server.signIn(deviceId, input.credentials);
+            // Prevent fixation attacks
+            await deviceManager.rotate(req, res, deviceId);
+            return (0, index_js_1.writeJson)(res, {
+                account,
+                consentRequired: !info.authorizedClients.includes(input.client_id),
+            });
+        });
+        const acceptQuerySchema = zod_1.z.object({
+            csrf_token: zod_1.z.string(),
+            request_uri: request_uri_js_1.requestUriSchema,
+            client_id: client_id_js_1.clientIdSchema,
+            account_sub: zod_1.z.string(),
+        });
+        router.get('/oauth/authorize/accept', async function (req, res) {
+            try {
+                res.setHeader('Cache-Control', 'no-store');
+                (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
+                (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+                const query = Object.fromEntries(this.url.searchParams);
+                const input = await acceptQuerySchema.parseAsync(query, {
+                    path: ['query'],
+                });
+                (0, index_js_1.validateReferer)(req, res, {
+                    origin: issuerOrigin,
+                    pathname: '/oauth/authorize',
+                    searchParams: [
+                        ['request_uri', input.request_uri],
+                        ['client_id', input.client_id],
+                    ],
+                });
+                (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri), true);
+                const { deviceId } = await deviceManager.load(req, res);
+                const data = await server.acceptRequest(deviceId, input.request_uri, input.client_id, input.account_sub);
+                return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
+            }
+            catch (err) {
+                await onError?.(req, res, err, 'Failed to accept authorization request');
+                if (!res.headersSent) {
+                    await (0, send_error_page_js_1.sendErrorPage)(res, err, server.customization);
+                }
+            }
+        });
+        const rejectQuerySchema = zod_1.z.object({
+            csrf_token: zod_1.z.string(),
+            request_uri: request_uri_js_1.requestUriSchema,
+            client_id: client_id_js_1.clientIdSchema,
+        });
+        router.get('/oauth/authorize/reject', async function (req, res) {
+            try {
+                res.setHeader('Cache-Control', 'no-store');
+                (0, index_js_1.validateFetchMode)(req, res, ['navigate']);
+                (0, index_js_1.validateSameOrigin)(req, res, issuerOrigin);
+                const query = Object.fromEntries(this.url.searchParams);
+                const input = await rejectQuerySchema.parseAsync(query, {
+                    path: ['query'],
+                });
+                (0, index_js_1.validateReferer)(req, res, {
+                    origin: issuerOrigin,
+                    pathname: '/oauth/authorize',
+                    searchParams: [
+                        ['request_uri', input.request_uri],
+                        ['client_id', input.client_id],
+                    ],
+                });
+                (0, index_js_1.validateCsrfToken)(req, res, input.csrf_token, csrfCookie(input.request_uri), true);
+                const { deviceId } = await deviceManager.load(req, res);
+                const data = await server.rejectRequest(deviceId, input.request_uri, input.client_id);
+                return await (0, send_authorize_redirect_js_1.sendAuthorizeRedirect)(res, data);
+            }
+            catch (err) {
+                await onError?.(req, res, err, 'Failed to reject authorization request');
+                if (!res.headersSent) {
+                    await (0, send_error_page_js_1.sendErrorPage)(res, err, server.customization);
+                }
+            }
+        });
+        return router;
+    }
+}
+exports.OAuthProvider = OAuthProvider;
+//# sourceMappingURL=oauth-provider.js.map