@better-auth/core 1.7.0-beta.1 → 1.7.0-beta.10

package/dist/oauth2/validate-authorization-code.mjs

@@ -1,39 +1,32 @@
-import { resolveAssertionParams } from "./client-assertion.mjs";
 import { getOAuth2Tokens } from "./utils.mjs";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-import { base64 } from "@better-auth/utils/base64";
-import { betterFetch } from "@better-fetch/fetch";
+import { assertResponseNotRedirect, fetchRefusingRedirects, noFollowRedirect } from "./reject-redirects.mjs";
+import { applyTokenEndpointAuth } from "./token-endpoint-auth.mjs";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 //#region src/oauth2/validate-authorization-code.ts
-async function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, clientAssertion, tokenEndpoint, deviceId, headers, additionalParams = {}, resource }) {
+async function authorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, tokenEndpointAuth, tokenEndpoint, deviceId, headers, additionalParams = {}, resource }) {
 	options = typeof options === "function" ? await options() : options;
-	if (authentication === "private_key_jwt") {
-		if (!clientAssertion) throw new Error("private_key_jwt authentication requires a clientAssertion configuration");
-		const assertionParams = await resolveAssertionParams({
-			clientAssertion,
-			clientId: Array.isArray(options.clientId) ? options.clientId[0] : options.clientId,
-			tokenEndpoint
-		});
-		additionalParams = {
-			...additionalParams,
-			...assertionParams
-		};
-	}
-	return createAuthorizationCodeRequest({
+	const request = buildAuthorizationCodeRequest({
 		code,
 		codeVerifier,
 		redirectURI,
 		options,
-		authentication,
 		deviceId,
 		headers,
 		additionalParams,
 		resource
 	});
+	await applyTokenEndpointAuth({
+		body: request.body,
+		headers: request.headers,
+		options,
+		tokenEndpoint: tokenEndpoint ?? "",
+		grantType: "authorization_code",
+		tokenEndpointAuth,
+		authentication
+	});
+	return request;
 }
-/**
-* @deprecated use async'd authorizationCodeRequest instead
-*/
-function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, authentication, deviceId, headers, additionalParams = {}, resource }) {
+function buildAuthorizationCodeRequest({ code, codeVerifier, redirectURI, options, deviceId, headers, additionalParams = {}, resource }) {
 	const body = new URLSearchParams();
 	const requestHeaders = {
 		"content-type": "application/x-www-form-urlencoded",
@@ -48,33 +41,27 @@ function createAuthorizationCodeRequest({ code, codeVerifier, redirectURI, optio
 	body.set("redirect_uri", options.redirectURI || redirectURI);
 	if (resource) if (typeof resource === "string") body.append("resource", resource);
 	else for (const _resource of resource) body.append("resource", _resource);
-	const primaryClientId = Array.isArray(options.clientId) ? options.clientId[0] : options.clientId;
-	if (authentication === "basic") requestHeaders["authorization"] = `Basic ${base64.encode(`${primaryClientId}:${options.clientSecret ?? ""}`)}`;
-	else {
-		body.set("client_id", primaryClientId);
-		if (authentication !== "private_key_jwt" && options.clientSecret) body.set("client_secret", options.clientSecret);
-	}
 	for (const [key, value] of Object.entries(additionalParams)) if (!body.has(key)) body.append(key, value);
 	return {
 		body,
 		headers: requestHeaders
 	};
 }
-async function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, clientAssertion, deviceId, headers, additionalParams = {}, resource }) {
+async function validateAuthorizationCode({ code, codeVerifier, redirectURI, options, tokenEndpoint, authentication, tokenEndpointAuth, deviceId, headers, additionalParams = {}, resource }) {
 	const { body, headers: requestHeaders } = await authorizationCodeRequest({
 		code,
 		codeVerifier,
 		redirectURI,
 		options,
 		authentication,
-		clientAssertion,
+		tokenEndpointAuth,
 		tokenEndpoint,
 		deviceId,
 		headers,
 		additionalParams,
 		resource
 	});
-	const { data, error } = await betterFetch(tokenEndpoint, {
+	const { data, error } = await fetchRefusingRedirects(tokenEndpoint, {
 		method: "POST",
 		body,
 		headers: requestHeaders
@@ -83,10 +70,17 @@ async function validateAuthorizationCode({ code, codeVerifier, redirectURI, opti
 	return getOAuth2Tokens(data);
 }
 async function validateToken(token, jwksEndpoint, options) {
-	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint)), {
+	return await jwtVerify(token, createRemoteJWKSet(new URL(jwksEndpoint), { [customFetch]: async (url, init) => {
+		const response = await fetch(url, {
+			...init,
+			...noFollowRedirect
+		});
+		assertResponseNotRedirect(String(url), response);
+		return response;
+	} }), {
 		audience: options?.audience,
 		issuer: options?.issuer
 	});
 }
 //#endregion
-export { authorizationCodeRequest, createAuthorizationCodeRequest, validateAuthorizationCode, validateToken };
+export { authorizationCodeRequest, validateAuthorizationCode, validateToken };

package/dist/oauth2/verify-id-token.d.mts

@@ -0,0 +1,27 @@
+import { OAuthProvider } from "./oauth-provider.mjs";
+
+//#region src/oauth2/verify-id-token.d.ts
+type ProviderWithIdTokenConfig = Pick<OAuthProvider, "idToken" | "options">;
+/**
+ * Whether a provider can verify a client-submitted id_token.
+ *
+ * A provider supports id_token sign-in when it declares an {@link OAuthProvider.idToken}
+ * verification config, or when the integrator supplies a `verifyIdToken` override on the
+ * provider options. A provider whose options set `disableIdTokenSignIn`, or that declares
+ * neither, rejects the client id_token sign-in path with `ID_TOKEN_NOT_SUPPORTED`.
+ */
+declare function supportsIdTokenSignIn(provider: ProviderWithIdTokenConfig): boolean;
+/**
+ * Verify a client-submitted id_token against a provider's verification config.
+ *
+ * This is the single id_token verifier for every social provider. Providers no longer
+ * implement their own boolean `verifyIdToken`; they declare an {@link OAuthProvider.idToken}
+ * config and this function performs the cryptographic check. The contract is fail-closed: a
+ * provider without a config (and without an integrator `verifyIdToken` override) returns
+ * `false`, so a forged token can never be accepted by omission.
+ *
+ * @returns `true` only when the token is authentic for the provider.
+ */
+declare function verifyProviderIdToken(provider: ProviderWithIdTokenConfig, token: string, nonce?: string): Promise<boolean>;
+//#endregion
+export { supportsIdTokenSignIn, verifyProviderIdToken };

package/dist/oauth2/verify-id-token.mjs

@@ -0,0 +1,62 @@
+import { decodeProtectedHeader, jwtVerify } from "jose";
+//#region src/oauth2/verify-id-token.ts
+async function sha256Hex(value) {
+	const data = new TextEncoder().encode(value);
+	const digest = await crypto.subtle.digest("SHA-256", data);
+	return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function nonceMatches(claimNonce, nonce, comparison = "exact") {
+	if (typeof claimNonce !== "string") return false;
+	if (claimNonce === nonce) return true;
+	if (comparison === "exact-or-sha256") return claimNonce === await sha256Hex(nonce);
+	return false;
+}
+/**
+* Whether a provider can verify a client-submitted id_token.
+*
+* A provider supports id_token sign-in when it declares an {@link OAuthProvider.idToken}
+* verification config, or when the integrator supplies a `verifyIdToken` override on the
+* provider options. A provider whose options set `disableIdTokenSignIn`, or that declares
+* neither, rejects the client id_token sign-in path with `ID_TOKEN_NOT_SUPPORTED`.
+*/
+function supportsIdTokenSignIn(provider) {
+	const options = provider.options ?? {};
+	if (options.disableIdTokenSignIn) return false;
+	return Boolean(provider.idToken || options.verifyIdToken);
+}
+/**
+* Verify a client-submitted id_token against a provider's verification config.
+*
+* This is the single id_token verifier for every social provider. Providers no longer
+* implement their own boolean `verifyIdToken`; they declare an {@link OAuthProvider.idToken}
+* config and this function performs the cryptographic check. The contract is fail-closed: a
+* provider without a config (and without an integrator `verifyIdToken` override) returns
+* `false`, so a forged token can never be accepted by omission.
+*
+* @returns `true` only when the token is authentic for the provider.
+*/
+async function verifyProviderIdToken(provider, token, nonce) {
+	const options = provider.options ?? {};
+	if (options.disableIdTokenSignIn) return false;
+	try {
+		if (options.verifyIdToken) return await options.verifyIdToken(token, nonce);
+		const config = provider.idToken;
+		if (!config) return false;
+		if ("verify" in config) return await config.verify(token, nonce);
+		if (token.split(".").length !== 3) return config.allowOpaqueToken === true;
+		const { alg } = decodeProtectedHeader(token);
+		const { payload } = await jwtVerify(token, config.jwks, {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms: config.algorithms ?? (alg ? [alg] : void 0),
+			maxTokenAge: config.maxTokenAge
+		});
+		if (nonce && !await nonceMatches(payload.nonce, nonce, config.nonceComparison)) return false;
+		if (config.verifyClaims && !config.verifyClaims(payload)) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { supportsIdTokenSignIn, verifyProviderIdToken };

package/dist/oauth2/verify.d.mts

@@ -1,6 +1,19 @@
+import { DpopReplayStore } from "./dpop.mjs";
 import { JSONWebKeySet, JWTPayload, JWTVerifyOptions } from "jose";
 
 //#region src/oauth2/verify.d.ts
+type JwksFetchOptions = {
+  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
+  /**
+   * Stable object to cache the result of a function `jwksFetch` under,
+   * with the same TTL and kid-miss refetch rules as string sources.
+   * Without it, a function source is fetched on every verification.
+   */
+  jwksCacheKey?: object;
+};
+/**
+ * @internal
+ */
 interface VerifyAccessTokenRemote {
   /** Full url of the introspect endpoint. Should end with `/oauth2/introspect` */
   introspectUrl: string;
@@ -14,29 +27,89 @@ interface VerifyAccessTokenRemote {
    * is also still active.
    */
   force?: boolean;
+  /**
+   * Accept introspection responses that omit the `aud` claim even when a
+   * required `audience` is configured in `verifyOptions`.
+   *
+   * By default verification fails closed: if you configure an `audience` and
+   * the introspection response has no `aud` (or a mismatching one), the token
+   * is rejected. Some authorization servers legitimately omit `aud` from
+   * introspection responses (it is OPTIONAL per RFC 7662 §2.2); only enable
+   * this if you trust the issuer to bind the token to this resource through
+   * another mechanism, as it skips the audience check in that case.
+   *
+   * @default false
+   */
+  allowMissingAudience?: boolean;
+}
+interface VerifyAccessTokenOptions {
+  /** Verify options */
+  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+  /** Scopes to additionally verify. Token must include all but not exact. */
+  scopes?: string[];
+  /** Required to verify access token locally */
+  jwksUrl?: string;
+  /** If provided, can verify a token remotely */
+  remoteVerify?: VerifyAccessTokenRemote;
+}
+interface VerifyAccessTokenRequestOptions extends VerifyAccessTokenOptions {
+  dpop?: {
+    proofMaxAgeSeconds?: number;
+    /**
+     * Store used to reject replayed DPoP proof `jti` values.
+     *
+     * Defaults to a process-local in-memory store, which is only safe for a
+     * single-instance deployment: it shares no state across instances and
+     * resets on cold start, so a captured proof can be replayed against
+     * another instance within the proof's lifetime. Supply a shared,
+     * persistent store (for example one backed by your database) for any
+     * multi-instance or serverless resource server.
+     */
+    replayStore?: DpopReplayStore;
+    signingAlgorithms?: readonly string[];
+  };
 }
+interface ResourceRequestInput {
+  authorizationHeader: string | null | undefined;
+  dpopProofJwt?: string | null | undefined;
+  method: string;
+  url: string;
+}
+/**
+ * Builds a {@link ResourceRequestInput} from a standard `Request`, reading the
+ * `Authorization` and `DPoP` headers and the request method and URL. Resource
+ * servers share this so every entry point maps the wire request the same way.
+ */
+declare function requestToResourceInput(request: Request): ResourceRequestInput;
 /**
  * Performs local verification of an access token for your APIs.
  *
  * Can also be configured for remote verification.
  */
-declare function verifyJwsAccessToken(token: string, opts: {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>); /** Verify options */
-  verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
+declare function verifyJwsAccessToken(token: string, opts: JwksFetchOptions & {
+  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>;
 }): Promise<JWTPayload>;
-declare function getJwks(token: string, opts: {
-  /** Jwks url or promise of a Jwks */jwksFetch: string | (() => Promise<JSONWebKeySet | undefined>);
-}): Promise<JSONWebKeySet>;
+declare function getJwks(token: string, opts: JwksFetchOptions): Promise<JSONWebKeySet>;
 /**
- * Performs local verification of an access token for your API.
+ * Performs local verification of a bearer access token for your API.
  *
- * Can also be configured for remote verification.
+ * Can also be configured for remote verification. DPoP-bound access tokens
+ * require {@link verifyAccessTokenRequest}, because sender-constraining cannot
+ * be verified without the HTTP method, URL, Authorization scheme, DPoP proof,
+ * and access-token hash. This function rejects DPoP-bound tokens; reach for it
+ * only when you hold a raw token string and intentionally accept bearer tokens
+ * alone.
  */
-declare function verifyAccessToken(token: string, opts: {
-  /** Verify options */verifyOptions: JWTVerifyOptions & Required<Pick<JWTVerifyOptions, "audience" | "issuer">>; /** Scopes to additionally verify. Token must include all but not exact. */
-  scopes?: string[]; /** Required to verify access token locally */
-  jwksUrl?: string; /** If provided, can verify a token remotely */
-  remoteVerify?: VerifyAccessTokenRemote;
-}): Promise<JWTPayload>;
+declare function verifyBearerToken(token: string, opts: VerifyAccessTokenOptions): Promise<JWTPayload>;
+/**
+ * Verifies an HTTP resource request carrying an OAuth access token. This is the
+ * recommended resource-server entry point: it handles both bearer and
+ * DPoP-bound tokens, the bearer case being the request with no DPoP proof.
+ *
+ * It performs the same token validation as {@link verifyBearerToken}, then adds
+ * the RFC 9449 sender-constraint checks that need request context: authorization
+ * scheme, method, URL, DPoP proof, `ath`, and `cnf.jkt` binding.
+ */
+declare function verifyAccessTokenRequest(request: ResourceRequestInput, opts: VerifyAccessTokenRequestOptions): Promise<JWTPayload>;
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { ResourceRequestInput, VerifyAccessTokenOptions, VerifyAccessTokenRequestOptions, getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/oauth2/verify.mjs

@@ -1,10 +1,76 @@
 import { logger } from "../env/logger.mjs";
+import { fetchRefusingRedirects } from "./reject-redirects.mjs";
+import { createInMemoryDpopReplayStore, enforceDpopBinding, getDpopJktFromPayload, isDpopBindingError, parseAccessTokenAuthorization } from "./dpop.mjs";
 import { APIError } from "better-call";
-import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
-import { betterFetch } from "@better-fetch/fetch";
+import { UnsecuredJWT, createLocalJWKSet, decodeProtectedHeader, errors, jwtVerify } from "jose";
 //#region src/oauth2/verify.ts
-/** Last fetched jwks used locally in getJwks @internal */
-let jwks;
+const joseInfrastructureErrorCodes = new Set([
+	errors.JWKSTimeout.code,
+	errors.JWKSInvalid.code,
+	errors.JWKSMultipleMatchingKeys.code
+]);
+function isJoseInfrastructureError(error) {
+	return joseInfrastructureErrorCodes.has(error.code);
+}
+/**
+* @internal
+*/
+const jwksCache = /* @__PURE__ */ new Map();
+/**
+* Cache for function jwks sources, keyed by a caller-provided stable object.
+* Entries are released with their key, so per-request keys cannot accumulate.
+*/
+const functionJwksCache = /* @__PURE__ */ new WeakMap();
+/**
+* How long a cached JWKS is trusted before it is refetched
+*
+* @internal
+*/
+const JWKS_CACHE_TTL_MS = 300 * 1e3;
+const JWKS_NO_KID_REFETCH_COOLDOWN_MS = 30 * 1e3;
+/**
+* Returns the cached key set when it is within the TTL. When the token carries
+* `kid`, the cached set must contain that key id; without `kid`, key selection
+* is deferred to JOSE because RFC 7515 makes the header parameter optional.
+*/
+function getFreshJwksWithKid(cached, kid) {
+	if (!cached) return void 0;
+	if (Date.now() - cached.fetchedAt >= JWKS_CACHE_TTL_MS) return void 0;
+	if (kid && !cached.jwks.keys.some((jwk) => jwk.kid === kid)) return;
+	return cached.jwks;
+}
+function shouldRefetchCachedJwksWithoutKid(error, resolved) {
+	if (!(resolved.fromCache && !resolved.kid && (error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWSSignatureVerificationFailed))) return false;
+	if (!resolved.noKidRefetchedAt) return true;
+	return Date.now() - resolved.noKidRefetchedAt >= JWKS_NO_KID_REFETCH_COOLDOWN_MS;
+}
+async function fetchJwks(jwksFetch) {
+	const jwks = typeof jwksFetch === "string" ? await fetchRefusingRedirects(jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
+		if (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);
+		return res.data;
+	}) : await jwksFetch();
+	if (!jwks) throw new Error("No jwks found");
+	return jwks;
+}
+/**
+* Builds a {@link ResourceRequestInput} from a standard `Request`, reading the
+* `Authorization` and `DPoP` headers and the request method and URL. Resource
+* servers share this so every entry point maps the wire request the same way.
+*/
+function requestToResourceInput(request) {
+	return {
+		authorizationHeader: request.headers.get("authorization"),
+		dpopProofJwt: request.headers.get("dpop"),
+		method: request.method,
+		url: request.url
+	};
+}
+/**
+* Process-local, single-instance replay store. See the warning on
+* {@link VerifyAccessTokenRequestOptions.dpop.replayStore}; multi-instance
+* resource servers must pass their own shared store.
+*/
+const defaultDpopReplayStore = createInMemoryDpopReplayStore();
 /**
 * Performs local verification of an access token for your APIs.
 *
@@ -12,7 +78,17 @@ let jwks;
 */
 async function verifyJwsAccessToken(token, opts) {
 	try {
-		const jwt = await jwtVerify(token, createLocalJWKSet(await getJwks(token, opts)), opts.verifyOptions);
+		const resolved = await getJwksForVerification(token, opts);
+		let jwt;
+		try {
+			jwt = await jwtVerify(token, createLocalJWKSet(resolved.jwks), opts.verifyOptions);
+		} catch (error) {
+			if (shouldRefetchCachedJwksWithoutKid(error, resolved)) jwt = await jwtVerify(token, createLocalJWKSet((await getJwksForVerification(token, {
+				...opts,
+				forceRefresh: true
+			})).jwks), opts.verifyOptions);
+			else throw error;
+		}
 		if (jwt.payload.azp) jwt.payload.client_id = jwt.payload.azp;
 		return jwt.payload;
 	} catch (error) {
@@ -21,6 +97,9 @@ async function verifyJwsAccessToken(token, opts) {
 	}
 }
 async function getJwks(token, opts) {
+	return (await getJwksForVerification(token, opts)).jwks;
+}
+async function getJwksForVerification(token, opts) {
 	let jwtHeaders;
 	try {
 		jwtHeaders = decodeProtectedHeader(token);
@@ -28,22 +107,65 @@ async function getJwks(token, opts) {
 		if (error instanceof Error) throw error;
 		throw new Error(error);
 	}
-	if (!jwtHeaders.kid) throw new Error("Missing jwt kid");
-	if (!jwks || !jwks.keys.find((jwk) => jwk.kid === jwtHeaders.kid)) {
-		jwks = typeof opts.jwksFetch === "string" ? await betterFetch(opts.jwksFetch, { headers: { Accept: "application/json" } }).then(async (res) => {
-			if (res.error) throw new Error(`Jwks failed: ${res.error.message ?? res.error.statusText}`);
-			return res.data;
-		}) : await opts.jwksFetch();
+	const kid = jwtHeaders.kid;
+	if (typeof opts.jwksFetch !== "string") {
+		const cacheKey = opts.jwksCacheKey;
+		if (!cacheKey) {
+			const jwks = await opts.jwksFetch();
+			if (!jwks) throw new Error("No jwks found");
+			return {
+				jwks,
+				fromCache: false,
+				kid
+			};
+		}
+		const cached = functionJwksCache.get(cacheKey);
+		const cachedJwks = opts.forceRefresh ? void 0 : getFreshJwksWithKid(cached, kid);
+		if (cachedJwks) return {
+			jwks: cachedJwks,
+			fromCache: true,
+			kid,
+			noKidRefetchedAt: cached?.noKidRefetchedAt
+		};
+		const jwks = await opts.jwksFetch();
 		if (!jwks) throw new Error("No jwks found");
+		const fetchedAt = Date.now();
+		functionJwksCache.set(cacheKey, {
+			jwks,
+			fetchedAt,
+			...opts.forceRefresh && !kid ? { noKidRefetchedAt: fetchedAt } : {}
+		});
+		return {
+			jwks,
+			fromCache: false,
+			kid
+		};
 	}
-	return jwks;
+	const cacheKey = opts.jwksFetch;
+	const cached = jwksCache.get(cacheKey);
+	const cachedJwks = opts.forceRefresh ? void 0 : getFreshJwksWithKid(cached, kid);
+	if (!cachedJwks) {
+		const jwks = await fetchJwks(opts.jwksFetch);
+		const fetchedAt = Date.now();
+		jwksCache.set(cacheKey, {
+			jwks,
+			fetchedAt,
+			...opts.forceRefresh && !kid ? { noKidRefetchedAt: fetchedAt } : {}
+		});
+		return {
+			jwks,
+			fromCache: false,
+			kid
+		};
+	}
+	return {
+		jwks: cachedJwks,
+		fromCache: true,
+		kid,
+		noKidRefetchedAt: cached?.noKidRefetchedAt
+	};
 }
-/**
-* Performs local verification of an access token for your API.
-*
-* Can also be configured for remote verification.
-*/
-async function verifyAccessToken(token, opts) {
+async function verifyAccessTokenPayload(token, opts) {
 	let payload;
 	if (opts.jwksUrl && !opts?.remoteVerify?.force) try {
 		payload = await verifyJwsAccessToken(token, {
@@ -51,13 +173,15 @@ async function verifyAccessToken(token, opts) {
 			verifyOptions: opts.verifyOptions
 		});
 	} catch (error) {
-		if (error instanceof Error) if (error.name === "TypeError" || error.name === "JWSInvalid") {} else if (error.name === "JWTExpired") throw new APIError("UNAUTHORIZED", { message: "token expired" });
-		else if (error.name === "JWTInvalid") throw new APIError("UNAUTHORIZED", { message: "token invalid" });
-		else throw error;
+		if (error instanceof Error) if (error.name === "TypeError" || error.name === "JWSInvalid") {} else if (error instanceof errors.JWTExpired) throw new APIError("UNAUTHORIZED", { message: "token expired" });
+		else if (error instanceof errors.JOSEError) {
+			if (isJoseInfrastructureError(error)) throw error;
+			throw new APIError("UNAUTHORIZED", { message: "invalid access token" });
+		} else throw error;
 		else throw new Error(error);
 	}
 	if (opts?.remoteVerify) {
-		const { data: introspect, error: introspectError } = await betterFetch(opts.remoteVerify.introspectUrl, {
+		const { data: introspect, error: introspectError } = await fetchRefusingRedirects(opts.remoteVerify.introspectUrl, {
 			method: "POST",
 			headers: {
 				Accept: "application/json",
@@ -75,8 +199,9 @@ async function verifyAccessToken(token, opts) {
 		if (!introspect.active) throw new APIError("UNAUTHORIZED", { message: "token inactive" });
 		try {
 			const unsecuredJwt = new UnsecuredJWT(introspect).encode();
-			const { audience: _audience, ...verifyOptions } = opts.verifyOptions;
-			payload = (introspect.aud ? UnsecuredJWT.decode(unsecuredJwt, opts.verifyOptions) : UnsecuredJWT.decode(unsecuredJwt, verifyOptions)).payload;
+			const { audience: _audience, ...verifyOptionsNoAudience } = opts.verifyOptions;
+			const skipAudience = !introspect.aud && opts.remoteVerify.allowMissingAudience === true;
+			payload = UnsecuredJWT.decode(unsecuredJwt, skipAudience ? verifyOptionsNoAudience : opts.verifyOptions).payload;
 		} catch (error) {
 			throw new Error(error);
 		}
@@ -88,5 +213,58 @@ async function verifyAccessToken(token, opts) {
 	}
 	return payload;
 }
+function throwDpopUnauthorized(message, error) {
+	throw new APIError("UNAUTHORIZED", error ? {
+		message,
+		error,
+		error_description: message
+	} : { message });
+}
+/**
+* Performs local verification of a bearer access token for your API.
+*
+* Can also be configured for remote verification. DPoP-bound access tokens
+* require {@link verifyAccessTokenRequest}, because sender-constraining cannot
+* be verified without the HTTP method, URL, Authorization scheme, DPoP proof,
+* and access-token hash. This function rejects DPoP-bound tokens; reach for it
+* only when you hold a raw token string and intentionally accept bearer tokens
+* alone.
+*/
+async function verifyBearerToken(token, opts) {
+	const payload = await verifyAccessTokenPayload(token, opts);
+	if (getDpopJktFromPayload(payload)) throwDpopUnauthorized("DPoP-bound access token requires verifyAccessTokenRequest", "invalid_token");
+	return payload;
+}
+/**
+* Verifies an HTTP resource request carrying an OAuth access token. This is the
+* recommended resource-server entry point: it handles both bearer and
+* DPoP-bound tokens, the bearer case being the request with no DPoP proof.
+*
+* It performs the same token validation as {@link verifyBearerToken}, then adds
+* the RFC 9449 sender-constraint checks that need request context: authorization
+* scheme, method, URL, DPoP proof, `ath`, and `cnf.jkt` binding.
+*/
+async function verifyAccessTokenRequest(request, opts) {
+	const authorization = parseAccessTokenAuthorization(request.authorizationHeader);
+	if (!authorization?.token) throwDpopUnauthorized("missing authorization header");
+	if (authorization.scheme === "Unknown") throwDpopUnauthorized("authorization scheme must be Bearer or DPoP", "invalid_token");
+	const payload = await verifyAccessTokenPayload(authorization.token, opts);
+	try {
+		await enforceDpopBinding({
+			payload,
+			authorization,
+			proofJwt: request.dpopProofJwt,
+			method: request.method,
+			url: request.url,
+			replayStore: opts.dpop?.replayStore ?? defaultDpopReplayStore,
+			proofMaxAgeSeconds: opts.dpop?.proofMaxAgeSeconds,
+			signingAlgorithms: opts.dpop?.signingAlgorithms
+		});
+	} catch (error) {
+		if (isDpopBindingError(error)) throwDpopUnauthorized(error.message, error.code);
+		throw error;
+	}
+	return payload;
+}
 //#endregion
-export { getJwks, verifyAccessToken, verifyJwsAccessToken };
+export { getJwks, requestToResourceInput, verifyAccessTokenRequest, verifyBearerToken, verifyJwsAccessToken };

package/dist/social-providers/apple.d.mts

@@ -1,4 +1,6 @@
 import { OAuth2Tokens, ProviderOptions } from "../oauth2/oauth-provider.mjs";
+import * as jose from "jose";
+
 //#region src/social-providers/apple.d.ts
 interface AppleProfile {
   /**
@@ -12,7 +14,7 @@ interface AppleProfile {
    * The email address is either the user's real email address or the proxy
    * address, depending on their status private email relay service.
    */
-  email: string;
+  email?: string;
   /**
    * A string or Boolean value that indicates whether the service verifies
    * the email. The value can either be a string ("true" or "false") or a
@@ -60,7 +62,7 @@ interface AppleNonConformUser {
   email: string;
 }
 interface AppleOptions extends ProviderOptions<AppleProfile> {
-  clientId: string;
+  clientId: string | string[];
   appBundleIdentifier?: string | undefined;
   audience?: (string | string[]) | undefined;
 }
@@ -70,7 +72,8 @@ declare const apple: (options: AppleOptions) => {
   createAuthorizationURL({
     state,
     scopes,
-    redirectURI
+    redirectURI,
+    additionalParams
   }: {
     state: string;
     codeVerifier: string;
@@ -78,6 +81,8 @@ declare const apple: (options: AppleOptions) => {
     redirectURI: string;
     display?: string | undefined;
     loginHint?: string | undefined;
+    idTokenNonce?: string | undefined;
+    additionalParams?: Record<string, string> | undefined;
   }): Promise<URL>;
   validateAuthorizationCode: ({
     code,
@@ -89,9 +94,16 @@ declare const apple: (options: AppleOptions) => {
     codeVerifier?: string | undefined;
     deviceId?: string | undefined;
   }) => Promise<OAuth2Tokens>;
-  verifyIdToken(token: string, nonce: string | undefined): Promise<boolean>;
+  idToken: {
+    jwks: (header: jose.JWTHeaderParameters) => Promise<Uint8Array<ArrayBufferLike> | CryptoKey>;
+    issuer: string;
+    audience: string | string[];
+    maxTokenAge: string;
+    nonceComparison: "exact-or-sha256";
+  };
   refreshAccessToken: (refreshToken: string) => Promise<OAuth2Tokens>;
   getUserInfo(token: OAuth2Tokens & {
+    expectedIdTokenNonce?: string | undefined;
     user?: {
       name?: {
         firstName?: string;