@atproto/oauth-provider 0.8.1 → 0.9.0

package/dist/token/token-manager.d.ts

@@ -1,6 +1,6 @@
 import { SignedJwt } from '@atproto/jwk';
 import type { Account } from '@atproto/oauth-provider-api';
-import { OAuthAccessToken, OAuthAuthorizationCodeGrantTokenRequest, OAuthAuthorizationRequestParameters, OAuthClientCredentialsGrantTokenRequest, OAuthPasswordGrantTokenRequest, OAuthRefreshTokenGrantTokenRequest, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
+import { OAuthAccessToken, OAuthAuthorizationRequestParameters, OAuthTokenResponse, OAuthTokenType } from '@atproto/oauth-types';
 import { AccessTokenMode } from '../access-token/access-token-mode.js';
 import { ClientAuth } from '../client/client-auth.js';
 import { Client } from '../client/client.js';
@@ -29,21 +29,21 @@ export declare class TokenManager {
         now: Date;
         expiresAt: Date;
     }): Promise<OAuthAccessToken>;
-    create(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, account: Account, deviceId: null | DeviceId, parameters: OAuthAuthorizationRequestParameters, input: OAuthAuthorizationCodeGrantTokenRequest | OAuthClientCredentialsGrantTokenRequest | OAuthPasswordGrantTokenRequest, dpopProof: null | DpopProof): Promise<OAuthTokenResponse>;
+    createToken(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, account: Account, deviceId: null | DeviceId, parameters: OAuthAuthorizationRequestParameters, code: Code): Promise<OAuthTokenResponse>;
+    protected validateTokenParams(client: Client, clientAuth: ClientAuth, parameters: OAuthAuthorizationRequestParameters): Promise<void>;
     protected buildTokenResponse(client: Client, accessToken: OAuthAccessToken, refreshToken: string | undefined, expiresAt: Date, parameters: OAuthAuthorizationRequestParameters, sub: Sub): OAuthTokenResponse;
-    validateAccess(client: Client, clientAuth: ClientAuth, tokenInfo: TokenInfo): Promise<void>;
-    validateRefresh(client: Client, clientAuth: ClientAuth, { data }: TokenInfo): Promise<void>;
-    refresh(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, input: OAuthRefreshTokenGrantTokenRequest, dpopProof: null | DpopProof): Promise<OAuthTokenResponse>;
+    rotateToken(client: Client, clientAuth: ClientAuth, clientMetadata: RequestMetadata, tokenInfo: TokenInfo): Promise<OAuthTokenResponse>;
     /**
      * @note The token validity is not guaranteed. The caller must ensure that the
      * token is valid before using the returned token info.
      */
-    findToken(token: string): Promise<TokenInfo>;
-    findBySignedJwt(token: SignedJwt): Promise<TokenInfo>;
-    findByRefreshToken(token: RefreshToken): Promise<TokenInfo>;
-    findByCode(code: Code): Promise<TokenInfo>;
+    findToken(token: string): Promise<null | TokenInfo>;
+    findByAccessToken(token: SignedJwt): Promise<null | TokenInfo>;
+    protected findByRefreshToken(token: RefreshToken): Promise<null | TokenInfo>;
+    consumeRefreshToken(token: RefreshToken): Promise<TokenInfo>;
+    findByCode(code: Code): Promise<null | TokenInfo>;
     deleteToken(tokenId: TokenId): Promise<void>;
-    getTokenInfo(tokenId: TokenId): Promise<TokenInfo>;
+    getTokenInfo(tokenId: TokenId): Promise<null | TokenInfo>;
     verifyToken(token: OAuthAccessToken, tokenType: OAuthTokenType, tokenId: TokenId, dpopProof: null | DpopProof, verifyOptions?: VerifyTokenClaimsOptions): Promise<VerifyTokenClaimsResult>;
     listAccountTokens(sub: Sub): Promise<TokenInfo[]>;
 }

package/dist/token/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAEL,gBAAgB,EAChB,uCAAuC,EACvC,mCAAmC,EACnC,uCAAuC,EACvC,8BAA8B,EAC9B,kCAAkC,EAClC,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAQ5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAMjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,IAAI,EAAU,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EACL,YAAY,EAIb,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,OAAO,EAA8B,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAExB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAA;AAE/D,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe;IACnD,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAJX,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,eAAe,EAChC,WAAW,SAAgB;IAGhD,SAAS,CAAC,iBAAiB,CAAC,GAAG,OAAa;cAI5B,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,mCAAmC,EAC/C,OAAO,EAAE;QACP,GAAG,EAAE,IAAI,CAAA;QACT,SAAS,EAAE,IAAI,CAAA;KAChB,GACA,OAAO,CAAC,gBAAgB,CAAC;IAiBtB,MAAM,CACV,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,GAAG,QAAQ,EACzB,UAAU,EAAE,mCAAmC,EAC/C,KAAK,EACD,uCAAuC,GACvC,uCAAuC,GACvC,8BAA8B,EAClC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAsK9B,SAAS,CAAC,kBAAkB,CAC1B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,IAAI,EACf,UAAU,EAAE,mCAAmC,EAC/C,GAAG,EAAE,GAAG,GACP,kBAAkB;IAoBR,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,SAAS;IAeT,eAAe,CAC1B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,EAAE,IAAI,EAAE,EAAE,SAAS,GAClB,OAAO,CAAC,IAAI,CAAC;IAwBV,OAAO,CACX,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,KAAK,EAAE,kCAAkC,EACzC,SAAS,EAAE,IAAI,GAAG,SAAS,GAC1B,OAAO,CAAC,kBAAkB,CAAC;IAuG9B;;;OAGG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAc5C,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAkBrD,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IAgB3D,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;IAU1C,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAUlD,WAAW,CACf,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,aAAa,CAAC,EAAE,wBAAwB,GACvC,OAAO,CAAC,uBAAuB,CAAC;IAuC7B,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAMxD"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,gBAAgB,EAChB,mCAAmC,EACnC,kBAAkB,EAClB,cAAc,EACf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAIjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AACpC,OAAO,EAAE,IAAI,EAAU,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5C,OAAO,EACL,YAAY,EAGb,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EAAE,OAAO,EAA8B,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EAExB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAA;AAClC,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAA;AAE/D,qBAAa,YAAY;IAErB,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACjC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;IACpC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,eAAe;IACnD,SAAS,CAAC,QAAQ,CAAC,WAAW;gBAJX,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,eAAe,EAChC,WAAW,SAAgB;IAGhD,SAAS,CAAC,iBAAiB,CAAC,GAAG,OAAa;cAI5B,gBAAgB,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,mCAAmC,EAC/C,OAAO,EAAE;QACP,GAAG,EAAE,IAAI,CAAA;QACT,SAAS,EAAE,IAAI,CAAA;KAChB,GACA,OAAO,CAAC,gBAAgB,CAAC;IAiBtB,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,IAAI,GAAG,QAAQ,EACzB,UAAU,EAAE,mCAAmC,EAC/C,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,kBAAkB,CAAC;cA6Dd,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,mCAAmC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAQhB,SAAS,CAAC,kBAAkB,CAC1B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,gBAAgB,EAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,IAAI,EACf,UAAU,EAAE,mCAAmC,EAC/C,GAAG,EAAE,GAAG,GACP,kBAAkB;IAoBf,WAAW,CACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,eAAe,EAC/B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAoD9B;;;OAGG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAcnD,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;cAmB3D,kBAAkB,CAChC,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAIf,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;IA2B5D,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAIjD,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAIzD,WAAW,CACf,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,IAAI,GAAG,SAAS,EAC3B,aAAa,CAAC,EAAE,wBAAwB,GACvC,OAAO,CAAC,uBAAuB,CAAC;IA2C7B,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAMxD"}

package/dist/token/token-manager.js

@@ -1,14 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenManager = exports.Signer = exports.AccessTokenMode = void 0;
-const node_crypto_1 = require("node:crypto");
 const jwk_1 = require("@atproto/jwk");
-const oauth_types_1 = require("@atproto/oauth-types");
 const access_token_mode_js_1 = require("../access-token/access-token-mode.js");
 Object.defineProperty(exports, "AccessTokenMode", { enumerable: true, get: function () { return access_token_mode_js_1.AccessTokenMode; } });
 const constants_js_1 = require("../constants.js");
-const invalid_dpop_key_binding_error_js_1 = require("../errors/invalid-dpop-key-binding-error.js");
-const invalid_dpop_proof_error_js_1 = require("../errors/invalid-dpop-proof-error.js");
 const invalid_grant_error_js_1 = require("../errors/invalid-grant-error.js");
 const invalid_request_error_js_1 = require("../errors/invalid-request-error.js");
 const invalid_token_error_js_1 = require("../errors/invalid-token-error.js");
@@ -51,93 +47,8 @@ class TokenManager {
             }),
         });
     }
-    async create(client, clientAuth, clientMetadata, account, deviceId, parameters, input, dpopProof) {
-        // @NOTE the atproto specific DPoP requirement is enforced though the
-        // "dpop_bound_access_tokens" metadata, which is enforced by the
-        // ClientManager class.
-        if (client.metadata.dpop_bound_access_tokens && !dpopProof) {
-            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof required');
-        }
-        if (!parameters.dpop_jkt) {
-            // Allow clients to bind their access tokens to a DPoP key during
-            // token request if they didn't provide a "dpop_jkt" during the
-            // authorization request.
-            if (dpopProof)
-                parameters = { ...parameters, dpop_jkt: dpopProof.jkt };
-        }
-        else if (!dpopProof) {
-            throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof required');
-        }
-        else if (parameters.dpop_jkt !== dpopProof.jkt) {
-            throw new invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError();
-        }
-        if (clientAuth.method === oauth_types_1.CLIENT_ASSERTION_TYPE_JWT_BEARER) {
-            // Clients **must not** use their private key to sign DPoP proofs.
-            if (parameters.dpop_jkt && clientAuth.jkt === parameters.dpop_jkt) {
-                throw new invalid_request_error_js_1.InvalidRequestError('The DPoP proof must be signed with a different key than the client assertion');
-            }
-        }
-        if (!client.metadata.grant_types.includes(input.grant_type)) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`This client is not allowed to use the "${input.grant_type}" grant type`);
-        }
-        let code = null;
-        switch (input.grant_type) {
-            case 'authorization_code': {
-                if (!(0, code_js_1.isCode)(input.code)) {
-                    throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code');
-                }
-                // @NOTE not using `this.findByCode` because we want to delete the token
-                // if it still exists (rather than throwing if the code is invalid).
-                const tokenInfo = await this.store.findTokenByCode(input.code);
-                if (tokenInfo) {
-                    await this.deleteToken(tokenInfo.id);
-                    throw new invalid_grant_error_js_1.InvalidGrantError(`Code replayed`);
-                }
-                code = input.code;
-                if (parameters.redirect_uri !== input.redirect_uri) {
-                    throw new invalid_grant_error_js_1.InvalidGrantError('The redirect_uri parameter must match the one used in the authorization request');
-                }
-                if (parameters.code_challenge) {
-                    if (!input.code_verifier) {
-                        throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier is required');
-                    }
-                    if (input.code_verifier.length < 43) {
-                        throw new invalid_grant_error_js_1.InvalidGrantError('code_verifier too short');
-                    }
-                    switch (parameters.code_challenge_method ?? 'plain') {
-                        case 'plain': {
-                            if (parameters.code_challenge !== input.code_verifier) {
-                                throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
-                            }
-                            break;
-                        }
-                        case 'S256': {
-                            const inputChallenge = Buffer.from(parameters.code_challenge, 'base64');
-                            const computedChallenge = (0, node_crypto_1.createHash)('sha256')
-                                .update(input.code_verifier)
-                                .digest();
-                            if (inputChallenge.compare(computedChallenge) !== 0) {
-                                throw new invalid_grant_error_js_1.InvalidGrantError('Invalid code_verifier');
-                            }
-                            break;
-                        }
-                        default: {
-                            // Should never happen (because request validation should catch this)
-                            throw new Error(`Unsupported code_challenge_method`);
-                        }
-                    }
-                }
-                else if (input.code_verifier !== undefined) {
-                    throw new invalid_request_error_js_1.InvalidRequestError("code_challenge parameter wasn't provided");
-                }
-                break;
-            }
-            default: {
-                // Other grants (e.g "password", "client_credentials") could be added
-                // here in the future...
-                throw new invalid_request_error_js_1.InvalidRequestError(`Unsupported grant type "${input.grant_type}"`);
-            }
-        }
+    async createToken(client, clientAuth, clientMetadata, account, deviceId, parameters, code) {
+        await this.validateTokenParams(client, clientAuth, parameters);
         const tokenId = await (0, token_id_js_1.generateTokenId)();
         const refreshToken = client.metadata.grant_types.includes('refresh_token')
             ? await (0, refresh_token_js_1.generateRefreshToken)()
@@ -156,10 +67,10 @@ class TokenManager {
             details: null,
             code,
         };
+        const accessToken = await this.buildAccessToken(tokenId, account, client, parameters, { now, expiresAt });
+        const response = await this.buildTokenResponse(client, accessToken, refreshToken, expiresAt, parameters, account.sub);
         await this.store.createToken(tokenId, tokenData, refreshToken);
         try {
-            const accessToken = await this.buildAccessToken(tokenId, account, client, parameters, { now, expiresAt });
-            const response = await this.buildTokenResponse(client, accessToken, refreshToken, expiresAt, parameters, account.sub);
             await (0, function_js_1.callAsync)(this.hooks.onTokenCreated, {
                 client,
                 clientAuth,
@@ -170,11 +81,17 @@ class TokenManager {
             return response;
         }
         catch (err) {
-            // Just in case the token could not be issued, we delete it from the store
+            // If the hook fails, we delete the token to avoid leaving a dangling
+            // token in the store.
             await this.deleteToken(tokenId);
             throw err;
         }
     }
+    async validateTokenParams(client, clientAuth, parameters) {
+        if (client.metadata.dpop_bound_access_tokens && !parameters.dpop_jkt) {
+            throw new invalid_grant_error_js_1.InvalidGrantError(`DPoP JKT is required for DPoP bound access tokens`);
+        }
+    }
     buildTokenResponse(client, accessToken, refreshToken, expiresAt, parameters, sub) {
         return {
             access_token: accessToken,
@@ -192,100 +109,35 @@ class TokenManager {
             sub,
         };
     }
-    async validateAccess(client, clientAuth, tokenInfo) {
-        if (tokenInfo.data.clientId !== client.id) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Token was not issued to this client`);
-        }
-        if (tokenInfo.data.clientAuth.method !== clientAuth.method) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication method mismatch`);
-        }
-        if (!(await client.validateClientAuth(tokenInfo.data.clientAuth))) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Client authentication mismatch`);
-        }
-    }
-    async validateRefresh(client, clientAuth, { data }) {
-        // @TODO This value should be computable even if we don't have the "client"
-        // (because fetching client info could be flaky). Instead, all the info
-        // needed should be stored in the token info.
-        const allowLongerLifespan = client.info.isFirstParty || data.clientAuth.method !== 'none';
-        const lifetime = allowLongerLifespan
-            ? constants_js_1.AUTHENTICATED_REFRESH_LIFETIME
-            : constants_js_1.UNAUTHENTICATED_REFRESH_LIFETIME;
-        if (data.createdAt.getTime() + lifetime < Date.now()) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token expired`);
-        }
-        const inactivityTimeout = allowLongerLifespan
-            ? constants_js_1.AUTHENTICATED_REFRESH_INACTIVITY_TIMEOUT
-            : constants_js_1.UNAUTHENTICATED_REFRESH_INACTIVITY_TIMEOUT;
-        if (data.updatedAt.getTime() + inactivityTimeout < Date.now()) {
-            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token exceeded inactivity timeout`);
-        }
-    }
-    async refresh(client, clientAuth, clientMetadata, input, dpopProof) {
-        const refreshTokenParsed = refresh_token_js_1.refreshTokenSchema.safeParse(input.refresh_token);
-        if (!refreshTokenParsed.success) {
-            throw new invalid_request_error_js_1.InvalidRequestError('Invalid refresh token');
-        }
-        const refreshToken = refreshTokenParsed.data;
-        const tokenInfo = await this.findByRefreshToken(refreshToken).catch((err) => {
-            throw invalid_grant_error_js_1.InvalidGrantError.from(err, err instanceof invalid_request_error_js_1.InvalidRequestError
-                ? err.error_description
-                : 'Invalid refresh token');
-        });
+    async rotateToken(client, clientAuth, clientMetadata, tokenInfo) {
         const { account, data } = tokenInfo;
         const { parameters } = data;
-        try {
-            await this.validateAccess(client, clientAuth, tokenInfo);
-            await this.validateRefresh(client, clientAuth, tokenInfo);
-            if (!client.metadata.grant_types.includes(input.grant_type)) {
-                // In case the client metadata was updated after the token was issued
-                throw new invalid_grant_error_js_1.InvalidGrantError(`This client is not allowed to use the "${input.grant_type}" grant type`);
-            }
-            if (parameters.dpop_jkt) {
-                if (!dpopProof) {
-                    throw new invalid_dpop_proof_error_js_1.InvalidDpopProofError('DPoP proof required');
-                }
-                else if (parameters.dpop_jkt !== dpopProof.jkt) {
-                    throw new invalid_dpop_key_binding_error_js_1.InvalidDpopKeyBindingError();
-                }
-            }
-            const nextTokenId = await (0, token_id_js_1.generateTokenId)();
-            const nextRefreshToken = await (0, refresh_token_js_1.generateRefreshToken)();
-            const now = new Date();
-            const expiresAt = this.createTokenExpiry(now);
-            await this.store.rotateToken(tokenInfo.id, nextTokenId, nextRefreshToken, {
-                updatedAt: now,
-                expiresAt,
-                // When clients rotate their public keys, we store the key that was
-                // used by the client to authenticate itself while requesting new
-                // tokens. The validateAccess() method will ensure that the client
-                // still advertises the key that was used to issue the previous
-                // refresh token. If a client stops advertising a key, all tokens
-                // bound to that key will no longer be be refreshable. This allows
-                // clients to proactively invalidate tokens when a key is compromised.
-                // Note that the original DPoP key cannot be rotated. This protects
-                // users in case the ownership of the client id changes. In the latter
-                // case, a malicious actor could still advertises the public keys of
-                // the previous owner, but the new owner would not be able to present
-                // a valid DPoP proof.
-                clientAuth,
-            });
-            const accessToken = await this.buildAccessToken(nextTokenId, account, client, parameters, { now, expiresAt });
-            const response = await this.buildTokenResponse(client, accessToken, nextRefreshToken, expiresAt, parameters, account.sub);
-            await (0, function_js_1.callAsync)(this.hooks.onTokenRefreshed, {
-                client,
-                clientAuth,
-                clientMetadata,
-                account,
-                parameters,
-            });
-            return response;
-        }
-        catch (err) {
-            // Just in case the token could not be refreshed, we delete it from the store
-            await this.deleteToken(tokenInfo.id);
-            throw err;
-        }
+        await this.validateTokenParams(client, clientAuth, parameters);
+        const nextTokenId = await (0, token_id_js_1.generateTokenId)();
+        const nextRefreshToken = await (0, refresh_token_js_1.generateRefreshToken)();
+        const now = new Date();
+        const expiresAt = this.createTokenExpiry(now);
+        await this.store.rotateToken(tokenInfo.id, nextTokenId, nextRefreshToken, {
+            updatedAt: now,
+            expiresAt,
+            // @NOTE Normally, the clientAuth not change over time. There are two
+            // exceptions:
+            // - Upgrade from a legacy representation of client authentication to
+            //   a modern one.
+            // - Allow clients to become "confidential" if they were previously
+            //   "public"
+            clientAuth,
+        });
+        const accessToken = await this.buildAccessToken(nextTokenId, account, client, parameters, { now, expiresAt });
+        const response = await this.buildTokenResponse(client, accessToken, nextRefreshToken, expiresAt, parameters, account.sub);
+        await (0, function_js_1.callAsync)(this.hooks.onTokenRefreshed, {
+            client,
+            clientAuth,
+            clientMetadata,
+            account,
+            parameters,
+        });
+        return response;
     }
     /**
      * @note The token validity is not guaranteed. The caller must ensure that the
@@ -302,17 +154,19 @@ class TokenManager {
             return this.findByRefreshToken(token);
         }
         else if ((0, jwk_1.isSignedJwt)(token)) {
-            return this.findBySignedJwt(token);
+            return this.findByAccessToken(token);
         }
         else {
             throw new invalid_request_error_js_1.InvalidRequestError(`Invalid token`);
         }
     }
-    async findBySignedJwt(token) {
+    async findByAccessToken(token) {
         const { payload } = await this.signer.verifyAccessToken(token, {
             clockTolerance: Infinity,
         });
         const tokenInfo = await this.getTokenInfo(payload.jti);
+        if (!tokenInfo)
+            return null;
         // Fool-proof: Invalid store implementation ?
         if (payload.sub !== tokenInfo.account.sub) {
             await this.deleteToken(tokenInfo.id);
@@ -321,37 +175,46 @@ class TokenManager {
         return tokenInfo;
     }
     async findByRefreshToken(token) {
-        const tokenInfo = await this.store.findTokenByRefreshToken(token);
+        return this.store.findTokenByRefreshToken(token);
+    }
+    async consumeRefreshToken(token) {
+        // @NOTE concurrent refreshes of the same refresh token could theoretically
+        // lead to two new tokens (access & refresh) being created. This is deemed
+        // acceptable for now (as the mechanism can only be used once since only one
+        // of the two refresh token created will be valid, and any future refresh
+        // attempts from outdated tokens will cause the entire session to be
+        // invalidated). Ideally, the store should be able to handle this case by
+        // atomically consuming the refresh token and returning the token info.
+        // @TODO Add another store method that atomically consumes the refresh token
+        // with a lock.
+        const tokenInfo = await this.findByRefreshToken(token).catch((err) => {
+            throw invalid_token_error_js_1.InvalidTokenError.from(err, `Invalid refresh token`);
+        });
         if (!tokenInfo) {
-            throw new invalid_request_error_js_1.InvalidRequestError(`Invalid refresh token`);
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Invalid refresh token`);
         }
         if (tokenInfo.currentRefreshToken !== token) {
             await this.deleteToken(tokenInfo.id);
-            throw new invalid_request_error_js_1.InvalidRequestError(`Refresh token replayed`);
+            throw new invalid_grant_error_js_1.InvalidGrantError(`Refresh token replayed`);
         }
         return tokenInfo;
     }
     async findByCode(code) {
-        const tokenInfo = await this.store.findTokenByCode(code);
-        if (!tokenInfo) {
-            throw new invalid_request_error_js_1.InvalidRequestError(`Invalid code`);
-        }
-        return tokenInfo;
+        return this.store.findTokenByCode(code);
     }
     async deleteToken(tokenId) {
         return this.store.deleteToken(tokenId);
     }
     async getTokenInfo(tokenId) {
-        const tokenInfo = await this.store.readToken(tokenId);
-        if (!tokenInfo) {
-            throw new invalid_request_error_js_1.InvalidRequestError(`Invalid token`);
-        }
-        return tokenInfo;
+        return this.store.readToken(tokenId);
     }
     async verifyToken(token, tokenType, tokenId, dpopProof, verifyOptions) {
         const tokenInfo = await this.getTokenInfo(tokenId).catch((err) => {
             throw invalid_token_error_js_1.InvalidTokenError.from(err, tokenType);
         });
+        if (!tokenInfo) {
+            throw new invalid_token_error_js_1.InvalidTokenError(tokenType, `Invalid token`);
+        }
         if (isCurrentTokenExpired(tokenInfo)) {
             await this.deleteToken(tokenId);
             throw new invalid_token_error_js_1.InvalidTokenError(tokenType, `Token expired`);

package/dist/token/token-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AACxC,sCAAqD;AAErD,sDAU6B;AAC7B,+EAAsE;AAwC7D,gGAxCA,sCAAe,OAwCA;AArCxB,kDAMwB;AAExB,mGAAwF;AACxF,uFAA6E;AAC7E,6EAAoE;AACpE,iFAAwE;AACxE,6EAAoE;AAEpE,iDAAwE;AACxE,yDAAmD;AAInD,gDAAiD;AAEjD,mDAA4C;AAgBlB,uFAhBjB,kBAAM,OAgBiB;AAfhC,yDAK2B;AAE3B,+CAAmE;AAEnE,qEAIiC;AAKjC,MAAa,YAAY;IAEF;IACA;IACA;IACA;IACA;IALrB,YACqB,KAAiB,EACjB,MAAc,EACd,KAAiB,EACjB,eAAgC,EAChC,cAAc,4BAAa;QAJ3B,UAAK,GAAL,KAAK,CAAY;QACjB,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAY;QACjB,oBAAe,GAAf,eAAe,CAAiB;QAChC,gBAAW,GAAX,WAAW,CAAgB;IAC7C,CAAC;IAEM,iBAAiB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC1C,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,OAAgB,EAChB,OAAgB,EAChB,MAAc,EACd,UAA+C,EAC/C,OAGC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACnC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,OAAO,CAAC,SAAS,CAAC;YACnC,GAAG,EAAE,IAAA,qBAAW,EAAC,OAAO,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAEnE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,IAAI;gBACxD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,4DAA4D;gBAC5D,SAAS,EAAE,MAAM,CAAC,EAAE;aACrB,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,OAAgB,EAChB,QAAyB,EACzB,UAA+C,EAC/C,KAGkC,EAClC,SAA2B;QAE3B,qEAAqE;QACrE,gEAAgE;QAChE,uBAAuB;QACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3D,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,iEAAiE;YACjE,+DAA+D;YAC/D,yBAAyB;YACzB,IAAI,SAAS;gBAAE,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,CAAA;QACxE,CAAC;aAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;QACxD,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;YACjD,MAAM,IAAI,8DAA0B,EAAE,CAAA;QACxC,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,KAAK,8CAAgC,EAAE,CAAC;YAC3D,kEAAkE;YAClE,IAAI,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAClE,MAAM,IAAI,8CAAmB,CAC3B,8EAA8E,CAC/E,CAAA;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,0CAAiB,CACzB,0CAA0C,KAAK,CAAC,UAAU,cAAc,CACzE,CAAA;QACH,CAAC;QAED,IAAI,IAAI,GAAgB,IAAI,CAAA;QAE5B,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;YACzB,KAAK,oBAAoB,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,IAAA,gBAAM,EAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,0CAAiB,CAAC,cAAc,CAAC,CAAA;gBAC7C,CAAC;gBAED,wEAAwE;gBACxE,oEAAoE;gBACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC9D,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;oBACpC,MAAM,IAAI,0CAAiB,CAAC,eAAe,CAAC,CAAA;gBAC9C,CAAC;gBAED,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;gBAEjB,IAAI,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;oBACnD,MAAM,IAAI,0CAAiB,CACzB,iFAAiF,CAClF,CAAA;gBACH,CAAC;gBAED,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;oBAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;wBACzB,MAAM,IAAI,0CAAiB,CAAC,2BAA2B,CAAC,CAAA;oBAC1D,CAAC;oBACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBACpC,MAAM,IAAI,0CAAiB,CAAC,yBAAyB,CAAC,CAAA;oBACxD,CAAC;oBACD,QAAQ,UAAU,CAAC,qBAAqB,IAAI,OAAO,EAAE,CAAC;wBACpD,KAAK,OAAO,CAAC,CAAC,CAAC;4BACb,IAAI,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;gCACtD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;4BACtD,CAAC;4BACD,MAAK;wBACP,CAAC;wBACD,KAAK,MAAM,CAAC,CAAC,CAAC;4BACZ,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAChC,UAAU,CAAC,cAAc,EACzB,QAAQ,CACT,CAAA;4BACD,MAAM,iBAAiB,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;iCAC3C,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;iCAC3B,MAAM,EAAE,CAAA;4BACX,IAAI,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACpD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;4BACtD,CAAC;4BACD,MAAK;wBACP,CAAC;wBACD,OAAO,CAAC,CAAC,CAAC;4BACR,qEAAqE;4BACrE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;wBACtD,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;oBAC7C,MAAM,IAAI,8CAAmB,CAC3B,0CAA0C,CAC3C,CAAA;gBACH,CAAC;gBAED,MAAK;YACP,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,qEAAqE;gBACrE,wBAAwB;gBACxB,MAAM,IAAI,8CAAmB,CAC3B,2BAA2B,KAAK,CAAC,UAAU,GAAG,CAC/C,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxE,CAAC,CAAC,MAAM,IAAA,uCAAoB,GAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU;YACV,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,OAAO,EAAE,IAAI;YACb,IAAI;SACL,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QAE9D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,OAAO,EACP,OAAO,EACP,MAAM,EACN,UAAU,EACV,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,MAAM,EACN,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,IAAA,uBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;gBACzC,MAAM;gBACN,UAAU;gBACV,cAAc;gBACd,OAAO;gBACP,UAAU;aACX,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAE/B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,MAAc,EACd,WAA6B,EAC7B,YAAgC,EAChC,SAAe,EACf,UAA+C,EAC/C,GAAQ;QAER,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACnD,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;YAEvB,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,UAAU;gBACZ,OAAO,IAAA,+BAAqB,EAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,aAAa;YACb,GAAG;SACJ,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,MAAc,EACd,UAAsB,EACtB,SAAoB;QAEpB,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,0CAAiB,CAAC,qCAAqC,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,0CAAiB,CAAC,uCAAuC,CAAC,CAAA;QACtE,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,0CAAiB,CAAC,gCAAgC,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,MAAc,EACd,UAAsB,EACtB,EAAE,IAAI,EAAa;QAEnB,2EAA2E;QAC3E,uEAAuE;QACvE,6CAA6C;QAC7C,MAAM,mBAAmB,GACvB,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAA;QAE/D,MAAM,QAAQ,GAAG,mBAAmB;YAClC,CAAC,CAAC,6CAA8B;YAChC,CAAC,CAAC,+CAAgC,CAAA;QAEpC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;QAED,MAAM,iBAAiB,GAAG,mBAAmB;YAC3C,CAAC,CAAC,uDAAwC;YAC1C,CAAC,CAAC,yDAA0C,CAAA;QAE9C,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,0CAAiB,CAAC,2CAA2C,CAAC,CAAA;QAC1E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,KAAyC,EACzC,SAA2B;QAE3B,MAAM,kBAAkB,GAAG,qCAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QAC5E,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,8CAAmB,CAAC,uBAAuB,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAA;QAE5C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,KAAK,CACjE,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,0CAAiB,CAAC,IAAI,CAC1B,GAAG,EACH,GAAG,YAAY,8CAAmB;gBAChC,CAAC,CAAC,GAAG,CAAC,iBAAiB;gBACvB,CAAC,CAAC,uBAAuB,CAC5B,CAAA;QACH,CAAC,CACF,CAAA;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;YACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;YAEzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5D,qEAAqE;gBACrE,MAAM,IAAI,0CAAiB,CACzB,0CAA0C,KAAK,CAAC,UAAU,cAAc,CACzE,CAAA;YACH,CAAC;YAED,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,IAAI,mDAAqB,CAAC,qBAAqB,CAAC,CAAA;gBACxD,CAAC;qBAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;oBACjD,MAAM,IAAI,8DAA0B,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;YAC3C,MAAM,gBAAgB,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAA;YAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;YAE7C,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC1B,SAAS,CAAC,EAAE,EACZ,WAAW,EACX,gBAAgB,EAChB;gBACE,SAAS,EAAE,GAAG;gBACd,SAAS;gBACT,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,+DAA+D;gBAC/D,iEAAiE;gBACjE,kEAAkE;gBAClE,sEAAsE;gBACtE,mEAAmE;gBACnE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,sBAAsB;gBACtB,UAAU;aACX,CACF,CAAA;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAA;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,OAAO,CAAC,GAAG,CACZ,CAAA;YAED,MAAM,IAAA,uBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBAC3C,MAAM;gBACN,UAAU;gBACV,cAAc;gBACd,OAAO;gBACP,UAAU;aACX,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,6EAA6E;YAC7E,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEpC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,IAAI,IAAA,uBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;aAAM,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,IAAA,iCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,IAAI,IAAA,iBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,8CAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAgB;QAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE;YAC7D,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAA;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAEtD,6CAA6C;QAC7C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,KAAK,CACb,gBAAgB,SAAS,CAAC,OAAO,CAAC,GAAG,+BAA+B,OAAO,CAAC,GAAG,GAAG,CACnF,CAAA;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,KAAmB;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAA;QAEjE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,8CAAmB,CAAC,uBAAuB,CAAC,CAAA;QACxD,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAEpC,MAAM,IAAI,8CAAmB,CAAC,wBAAwB,CAAC,CAAA;QACzD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,IAAU;QAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAExD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,8CAAmB,CAAC,cAAc,CAAC,CAAA;QAC/C,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAgB;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAErD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,8CAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAuB,EACvB,SAAyB,EACzB,OAAgB,EAChB,SAA2B,EAC3B,aAAwC;QAExC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/D,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEF,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,wDAAwD;QACxD,MAAM,WAAW,GAAuB;YACtC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACvB,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAEnE,uEAAuE;YACvE,gCAAgC;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAA;QAED,OAAO,IAAA,0CAAiB,EACtB,KAAK,EACL,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,EACT,aAAa,CACd,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,aAAa;aAClE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D,CAAC;CACF;AA9gBD,oCA8gBC;AAED,SAAS,qBAAqB,CAAC,SAAoB;IACjD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC"}
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../src/token/token-manager.ts"],"names":[],"mappings":";;;AAAA,sCAAqD;AAQrD,+EAAsE;AA+B7D,gGA/BA,sCAAe,OA+BA;AA5BxB,kDAA+C;AAE/C,6EAAoE;AACpE,iFAAwE;AACxE,6EAAoE;AAEpE,iDAAwE;AACxE,yDAAmD;AAInD,gDAAiD;AAEjD,mDAA4C;AAelB,uFAfjB,kBAAM,OAeiB;AAdhC,yDAI2B;AAE3B,+CAAmE;AAEnE,qEAIiC;AAKjC,MAAa,YAAY;IAEF;IACA;IACA;IACA;IACA;IALrB,YACqB,KAAiB,EACjB,MAAc,EACd,KAAiB,EACjB,eAAgC,EAChC,cAAc,4BAAa;QAJ3B,UAAK,GAAL,KAAK,CAAY;QACjB,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAY;QACjB,oBAAe,GAAf,eAAe,CAAiB;QAChC,gBAAW,GAAX,WAAW,CAAgB;IAC7C,CAAC;IAEM,iBAAiB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC1C,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;IACnD,CAAC;IAES,KAAK,CAAC,gBAAgB,CAC9B,OAAgB,EAChB,OAAgB,EAChB,MAAc,EACd,UAA+C,EAC/C,OAGC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACnC,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,OAAO,CAAC,SAAS,CAAC;YACnC,GAAG,EAAE,IAAA,qBAAW,EAAC,OAAO,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAEnE,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,sCAAe,CAAC,SAAS,IAAI;gBACxD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,4DAA4D;gBAC5D,SAAS,EAAE,MAAM,CAAC,EAAE;aACrB,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,OAAgB,EAChB,QAAyB,EACzB,UAA+C,EAC/C,IAAU;QAEV,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;QACvC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;YACxE,CAAC,CAAC,MAAM,IAAA,uCAAoB,GAAE;YAC9B,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,SAAS,GAAc;YAC3B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;YACd,SAAS;YACT,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,UAAU;YACV,QAAQ;YACR,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,OAAO,EAAE,IAAI;YACb,IAAI;SACL,CAAA;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,OAAO,EACP,OAAO,EACP,MAAM,EACN,UAAU,EACV,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,MAAM,EACN,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,OAAO,CAAC,GAAG,CACZ,CAAA;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QAE9D,IAAI,CAAC;YACH,MAAM,IAAA,uBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;gBACzC,MAAM;gBACN,UAAU;gBACV,cAAc;gBACd,OAAO;gBACP,UAAU;aACX,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,sBAAsB;YACtB,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,MAAc,EACd,UAAsB,EACtB,UAA+C;QAE/C,IAAI,MAAM,CAAC,QAAQ,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,0CAAiB,CACzB,mDAAmD,CACpD,CAAA;QACH,CAAC;IACH,CAAC;IAES,kBAAkB,CAC1B,MAAc,EACd,WAA6B,EAC7B,YAAgC,EAChC,SAAe,EACf,UAA+C,EAC/C,GAAQ;QAER,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YACnD,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;YAEvB,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,UAAU;gBACZ,OAAO,IAAA,+BAAqB,EAAC,SAAS,CAAC,CAAA;YACzC,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,aAAa;YACb,GAAG;SACJ,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,UAAsB,EACtB,cAA+B,EAC/B,SAAoB;QAEpB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;QAE9D,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAe,GAAE,CAAA;QAC3C,MAAM,gBAAgB,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAA;QAErD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAE7C,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACxE,SAAS,EAAE,GAAG;YACd,SAAS;YACT,qEAAqE;YACrE,cAAc;YACd,qEAAqE;YACrE,kBAAkB;YAClB,mEAAmE;YACnE,aAAa;YACb,UAAU;SACX,CAAC,CAAA;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC7C,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACV,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,OAAO,CAAC,GAAG,CACZ,CAAA;QAED,MAAM,IAAA,uBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC3C,MAAM;YACN,UAAU;YACV,cAAc;YACd,OAAO;YACP,UAAU;SACX,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa;QAClC,IAAI,IAAA,uBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;aAAM,IAAI,IAAA,gBAAM,EAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAC/B,CAAC;aAAM,IAAI,IAAA,iCAAc,EAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACvC,CAAC;aAAM,IAAI,IAAA,iBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,8CAAmB,CAAC,eAAe,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE;YAC7D,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAA;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAE3B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,KAAK,CACb,gBAAgB,SAAS,CAAC,OAAO,CAAC,GAAG,+BAA+B,OAAO,CAAC,GAAG,GAAG,CACnF,CAAA;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,KAAmB;QAEnB,OAAO,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAA;IAClD,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAmB;QAClD,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QAEvE,4EAA4E;QAC5E,eAAe;QACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnE,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAAiB,CAAC,uBAAuB,CAAC,CAAA;QACtD,CAAC;QAED,IAAI,SAAS,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACpC,MAAM,IAAI,0CAAiB,CAAC,wBAAwB,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,IAAU;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAgB;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAuB,EACvB,SAAyB,EACzB,OAAgB,EAChB,SAA2B,EAC3B,aAAwC;QAExC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/D,MAAM,0CAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC9C,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,IAAI,0CAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,SAAS,CAAA;QACnC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAA;QAE3B,wDAAwD;QACxD,MAAM,WAAW,GAAuB;YACtC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACvB,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,IAAA,qBAAW,EAAC,IAAI,CAAC,SAAS,CAAC;YAChC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAEnE,uEAAuE;YACvE,gCAAgC;YAChC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAA;QAED,OAAO,IAAA,0CAAiB,EACtB,KAAK,EACL,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,EACT,aAAa,CACd,CAAA;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAQ;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACvD,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,aAAa;aAClE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D,CAAC;CACF;AArVD,oCAqVC;AAED,SAAS,qBAAqB,CAAC,SAAoB;IACjD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AACxD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/oauth-provider",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "license": "MIT",
   "description": "Generic OAuth2 and OpenID Connect provider for Node.js. Currently only supports features needed for Atproto.",
   "keywords": [
@@ -49,12 +49,12 @@
     "@atproto-labs/simple-store-memory": "0.1.3",
     "@atproto/common": "^0.4.11",
     "@atproto/did": "0.1.5",
-    "@atproto/jwk": "0.2.0",
-    "@atproto/jwk-jose": "0.1.7",
-    "@atproto/oauth-types": "0.2.8",
-    "@atproto/oauth-provider-api": "0.1.3",
-    "@atproto/oauth-provider-frontend": "0.1.7",
-    "@atproto/oauth-provider-ui": "0.1.8",
+    "@atproto/jwk": "0.3.0",
+    "@atproto/jwk-jose": "0.1.8",
+    "@atproto/oauth-types": "0.3.0",
+    "@atproto/oauth-provider-api": "0.1.4",
+    "@atproto/oauth-provider-frontend": "0.1.8",
+    "@atproto/oauth-provider-ui": "0.1.9",
     "@atproto/syntax": "0.4.0"
   },
   "devDependencies": {

package/src/client/client-auth.ts

@@ -1,45 +1,64 @@
-import { KeyLike, calculateJwkThumbprint, errors, exportJWK } from 'jose'
 import { CLIENT_ASSERTION_TYPE_JWT_BEARER } from '@atproto/oauth-types'
-import { InvalidClientError } from '../errors/invalid-client-error.js'
-
-const { JOSEError } = errors
 
 export type ClientAuth =
   | { method: 'none' }
   | {
-      method: typeof CLIENT_ASSERTION_TYPE_JWT_BEARER
-      alg: string
-      kid: string
-      jkt: string
-    }
+      method: 'private_key_jwt'
 
-export function compareClientAuth(a: ClientAuth, b: ClientAuth): boolean {
-  if (a.method === 'none') {
-    if (b.method !== a.method) return false
+      /**
+       * Algorithm used for client authentication.
+       *
+       * @note We could allow clients to use a different algorithm over time
+       * (e.g. because new safer algorithms become available). For now, we
+       * require that the algorithm remains the same, as it is a bad practice to
+       * use the same key for different purposes.
+       */
+      alg: string
 
-    return true
-  }
+      /**
+       * ID of the key that was used for client authentication.
+       *
+       * @note The most important thing to validate is that the actual key didn't change (which is )
+       */
+      kid: string
 
-  if (a.method === CLIENT_ASSERTION_TYPE_JWT_BEARER) {
-    if (b.method !== a.method) return false
+      /**
+       * Thumbprint of the key used for client authentication. This value must
+       * be the same during token refreshes as the thumbprint of the key used
+       * during initial token issuance.
+       *
+       * @note This value is computed by the AS to ensure that the key used for
+       * client auth does not change
+       */
+      jkt: string
 
-    return true
-  }
+      /**
+       * Nonce used to prevent replay attacks. This value is generated by the
+       * client when generating it's assertion JWT and must be unique for each
+       * request.
+       *
+       * @see {@link https://www.rfc-editor.org/rfc/rfc7523.html#section-3}
+       */
+      jti: string
 
-  // Fool-proof
-  throw new TypeError('Invalid ClientAuth method')
-}
+      /**
+       * "exp" (expiration time) claim that limits the time window during which
+       * the JWT can be used.
+       *
+       * @note This field is optional for legacy reasons.
+       */
+      exp?: number
+    }
 
-export async function authJwkThumbprint(
-  key: Uint8Array | KeyLike,
-): Promise<string> {
-  try {
-    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')
-  } catch (err) {
-    const message =
-      err instanceof JOSEError
-        ? err.message
-        : 'Failed to compute JWK thumbprint'
-    throw new InvalidClientError(message, err)
-  }
+/**
+ * @note In its previous version, the code was storing the
+ * "client_assertion_type" instead of the authentication method, which was
+ * confusing and prevented proper comparison with the client's
+ * "token_endpoint_auth_method" metadata.
+ */
+export type ClientAuthLegacy = {
+  method: typeof CLIENT_ASSERTION_TYPE_JWT_BEARER
+  alg: string
+  kid: string
+  jkt: string
 }