@broberg/sso 0.7.0 → 0.9.0

package/dist/index.d.cts

@@ -224,9 +224,23 @@ interface SsoClaims extends JWTPayload {
 }
 interface LoginResult {
     claims: SsoClaims;
+    /**
+     * The claims in `claims` that came from the UNSIGNED userinfo response and
+     * not from the signed ID token (components-F084.51, since 0.8.0). Sorted; an
+     * empty list means everything in `claims` was signed (or userinfo was not
+     * reached). When both sources carry a claim, the signed token's value wins
+     * and the claim is not listed.
+     *
+     * On BID today this always contains "email" and "email_verified": the ID
+     * token does not carry them (measured by broberg-id, 20 Sep 2026). A decision
+     * that must rest on a signed identity binds on `claims.sub`, never on email.
+     */
+    unverifiedClaims: string[];
     idToken: string;
     accessToken?: string;
     refreshToken?: string;
+    /** Seconds the access token lives, when BID said so (`expires_in`). */
+    expiresIn?: number;
 }
 /**
  * `prompt=none` asks BID to answer WITHOUT showing anything (components-F084.6).
@@ -266,6 +280,16 @@ interface SsoClient {
      * answers — see the implementation for why that must never become "unverified".
      */
     addressOwnership(accessToken: string, address: string): Promise<AddressOwnership>;
+    /**
+     * F095.1 — trade a refresh token for a new access token (`grant_type=refresh_token`).
+     * Throws SsoError on refusal; the message carries the status and BID's error
+     * code, never a token.
+     */
+    refreshTokens(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn?: number;
+    }>;
     /**
      * Invite users to BID on behalf of this app (the app's OWN key, `bidk_…`).
      * One result per email. Throws SsoError on anything BID did not clearly say.
@@ -359,6 +383,12 @@ interface SessionPayload {
      * older than any logout.
      */
     iat?: number;
+    /**
+     * F095.1 — the key to this session's server-side tokens (ssoRoutes'
+     * `tokenStore`). Random, 128 bits. The tokens themselves are NEVER in the
+     * cookie: it is signed, not encrypted, and the browser can read it.
+     */
+    sid?: string;
     /** Optional convenience copies; never authorisation data. */
     email?: string;
     name?: string;
@@ -437,4 +467,50 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+/**
+ * Server-side tokens for calling Broberg ID on the user's behalf (F095.1).
+ *
+ * The login already RECEIVES an access token and a refresh token; before 0.9.0
+ * ssoRoutes dropped both, so an app could not call BID's app API (the account
+ * page: read and change your own name and picture) as the user.
+ *
+ * ── WHY NOT IN THE COOKIE ────────────────────────────────────────────────
+ * The session cookie is SIGNED, not encrypted, and the browser can read it. A
+ * refresh token is the longest-lived, highest-value credential in the whole
+ * flow: whoever holds it can mint access tokens until it is revoked. So the
+ * tokens live server-side, keyed by a random `sid` that is the only thing the
+ * cookie carries. A stolen cookie still needs the server to be useful.
+ */
+interface TokenSet {
+    /** The BID subject the tokens belong to — lets «Log ud overalt» find them. */
+    sub: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+/**
+ * Where the tokens live. The APP provides it in production, backed by
+ * something every instance shares (SQLite on one machine, a database or Redis
+ * on several) — the same reason BackchannelStore has no in-memory default.
+ */
+interface TokenStore {
+    get(sid: string): Promise<TokenSet | undefined>;
+    set(sid: string, tokens: TokenSet): Promise<void>;
+    delete(sid: string): Promise<void>;
+    /** Drop every token set for `sub` — what «Log ud overalt» calls. */
+    deleteSub(sub: string): Promise<void>;
+}
+/**
+ * An in-process TokenStore. Fine for tests and a single dev process. In
+ * production it LOSES every user's tokens on a restart (they must log in again
+ * before the account page works) and is not shared between machines — so it
+ * says so, once, when created.
+ */
+declare function memoryTokenStore(options?: {
+    quiet?: boolean;
+}): TokenStore & {
+    readonly size: number;
+};
+
+export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, type TokenSet, type TokenStore, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };

package/dist/index.d.ts

@@ -224,9 +224,23 @@ interface SsoClaims extends JWTPayload {
 }
 interface LoginResult {
     claims: SsoClaims;
+    /**
+     * The claims in `claims` that came from the UNSIGNED userinfo response and
+     * not from the signed ID token (components-F084.51, since 0.8.0). Sorted; an
+     * empty list means everything in `claims` was signed (or userinfo was not
+     * reached). When both sources carry a claim, the signed token's value wins
+     * and the claim is not listed.
+     *
+     * On BID today this always contains "email" and "email_verified": the ID
+     * token does not carry them (measured by broberg-id, 20 Sep 2026). A decision
+     * that must rest on a signed identity binds on `claims.sub`, never on email.
+     */
+    unverifiedClaims: string[];
     idToken: string;
     accessToken?: string;
     refreshToken?: string;
+    /** Seconds the access token lives, when BID said so (`expires_in`). */
+    expiresIn?: number;
 }
 /**
  * `prompt=none` asks BID to answer WITHOUT showing anything (components-F084.6).
@@ -266,6 +280,16 @@ interface SsoClient {
      * answers — see the implementation for why that must never become "unverified".
      */
     addressOwnership(accessToken: string, address: string): Promise<AddressOwnership>;
+    /**
+     * F095.1 — trade a refresh token for a new access token (`grant_type=refresh_token`).
+     * Throws SsoError on refusal; the message carries the status and BID's error
+     * code, never a token.
+     */
+    refreshTokens(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken?: string;
+        expiresIn?: number;
+    }>;
     /**
      * Invite users to BID on behalf of this app (the app's OWN key, `bidk_…`).
      * One result per email. Throws SsoError on anything BID did not clearly say.
@@ -359,6 +383,12 @@ interface SessionPayload {
      * older than any logout.
      */
     iat?: number;
+    /**
+     * F095.1 — the key to this session's server-side tokens (ssoRoutes'
+     * `tokenStore`). Random, 128 bits. The tokens themselves are NEVER in the
+     * cookie: it is signed, not encrypted, and the browser can read it.
+     */
+    sid?: string;
     /** Optional convenience copies; never authorisation data. */
     email?: string;
     name?: string;
@@ -437,4 +467,50 @@ declare function cookieHeader(name: string, value: string, opts: {
 }): string;
 declare function readCookie(header: string | null | undefined, name: string): string | undefined;
 
-export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+/**
+ * Server-side tokens for calling Broberg ID on the user's behalf (F095.1).
+ *
+ * The login already RECEIVES an access token and a refresh token; before 0.9.0
+ * ssoRoutes dropped both, so an app could not call BID's app API (the account
+ * page: read and change your own name and picture) as the user.
+ *
+ * ── WHY NOT IN THE COOKIE ────────────────────────────────────────────────
+ * The session cookie is SIGNED, not encrypted, and the browser can read it. A
+ * refresh token is the longest-lived, highest-value credential in the whole
+ * flow: whoever holds it can mint access tokens until it is revoked. So the
+ * tokens live server-side, keyed by a random `sid` that is the only thing the
+ * cookie carries. A stolen cookie still needs the server to be useful.
+ */
+interface TokenSet {
+    /** The BID subject the tokens belong to — lets «Log ud overalt» find them. */
+    sub: string;
+    accessToken: string;
+    refreshToken?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+/**
+ * Where the tokens live. The APP provides it in production, backed by
+ * something every instance shares (SQLite on one machine, a database or Redis
+ * on several) — the same reason BackchannelStore has no in-memory default.
+ */
+interface TokenStore {
+    get(sid: string): Promise<TokenSet | undefined>;
+    set(sid: string, tokens: TokenSet): Promise<void>;
+    delete(sid: string): Promise<void>;
+    /** Drop every token set for `sub` — what «Log ud overalt» calls. */
+    deleteSub(sub: string): Promise<void>;
+}
+/**
+ * An in-process TokenStore. Fine for tests and a single dev process. In
+ * production it LOSES every user's tokens on a restart (they must log in again
+ * before the account page works) and is not shared between machines — so it
+ * says so, once, when created.
+ */
+declare function memoryTokenStore(options?: {
+    quiet?: boolean;
+}): TokenStore & {
+    readonly size: number;
+};
+
+export { type AddressOwnership, type BeginLoginOptions, type CreateSsoClientOptions, DEFAULT_SESSION_MAX_AGE, type Discovery, type InvitationOutcome, type InvitationResult, type InviteUsersInput, type JwksCache, type JwksCacheOptions, JwksError, JwksUnavailableError, JwksUnknownKeyError, type LoginResult, type LoginStart, type LogoutToken, MAX_INVITATIONS, type MigrationState, type MigrationStatus, type SessionPayload, type SsoClaims, type SsoClient, type SsoConfig, SsoConfigError, SsoError, type TokenSet, type TokenStore, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };

package/dist/index.js

@@ -355,18 +355,19 @@ function createSsoClient(config, options = {}) {
   }
   async function withUserInfo(claims, accessToken) {
     const doc = await discovery();
-    if (!doc.userinfo_endpoint) return claims;
+    if (!doc.userinfo_endpoint) return { claims, unverifiedClaims: [] };
     const res = await fetchImpl(doc.userinfo_endpoint, {
       headers: { authorization: `Bearer ${accessToken}` }
     });
-    if (!res.ok) return claims;
+    if (!res.ok) return { claims, unverifiedClaims: [] };
     const info = await res.json();
     if (info.sub !== claims.sub) {
       throw new SsoError(
         `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
       );
     }
-    return { ...claims, ...info, sub: claims.sub };
+    const unverifiedClaims = Object.keys(info).filter((k) => k !== "sub" && info[k] !== void 0 && !(k in claims)).sort();
+    return { claims: { ...info, ...claims, sub: claims.sub }, unverifiedClaims };
   }
   return {
     discovery,
@@ -438,11 +439,42 @@ function createSsoClient(config, options = {}) {
         );
       }
       const claims = await verifyIdToken(body.id_token, { nonce });
+      const merged = body.access_token ? await withUserInfo(claims, body.access_token) : { claims, unverifiedClaims: [] };
       return {
-        claims: body.access_token ? await withUserInfo(claims, body.access_token) : claims,
+        claims: merged.claims,
+        unverifiedClaims: merged.unverifiedClaims,
         idToken: body.id_token,
         ...body.access_token ? { accessToken: body.access_token } : {},
-        ...body.refresh_token ? { refreshToken: body.refresh_token } : {}
+        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
+      };
+    },
+    async refreshTokens(refreshToken) {
+      const { token_endpoint } = await discovery();
+      const res = await fetchImpl(token_endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: config.clientId,
+          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
+        })
+      });
+      const raw = await res.text();
+      let body;
+      try {
+        body = raw.trim() === "" ? {} : JSON.parse(raw);
+      } catch {
+        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
+      }
+      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
+        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
+      }
+      return {
+        accessToken: body.access_token,
+        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
+        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
       };
     },
     async logoutUrl(opts = {}) {
@@ -593,6 +625,35 @@ function readCookie(header, name) {
   return void 0;
 }
 
-export { DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_INVITATIONS, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, readCookie, signSession, signValue, verifySession, verifyValue };
+// src/tokens.ts
+var warned = false;
+function memoryTokenStore(options = {}) {
+  if (!options.quiet && !warned) {
+    warned = true;
+    console.warn(
+      "@broberg/sso: memoryTokenStore() keeps tokens in this process only \u2014 they are lost on restart and not shared between instances. Give ssoRoutes a TokenStore backed by your database in production."
+    );
+  }
+  const rows = /* @__PURE__ */ new Map();
+  return {
+    get size() {
+      return rows.size;
+    },
+    async get(sid) {
+      return rows.get(sid);
+    },
+    async set(sid, tokens) {
+      rows.set(sid, { ...tokens });
+    },
+    async delete(sid) {
+      rows.delete(sid);
+    },
+    async deleteSub(sub) {
+      for (const [sid, t] of rows) if (t.sub === sub) rows.delete(sid);
+    }
+  };
+}
+
+export { DEFAULT_SESSION_MAX_AGE, JwksError, JwksUnavailableError, JwksUnknownKeyError, MAX_INVITATIONS, SsoConfigError, SsoError, cookieHeader, createJwksCache, createSsoClient, loadSsoConfig, memoryTokenStore, readCookie, signSession, signValue, verifySession, verifyValue };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map