@canton-network/core-wallet-auth 0.11.0 → 0.12.1

package/dist/auth-token-provider-self-signed.d.ts

@@ -3,9 +3,10 @@ import { AccessTokenProvider, ClientCredentials } from './auth-service.js';
 import { SelfSignedAuth } from './config/schema.js';
 export declare class AuthTokenProviderSelfSigned implements AccessTokenProvider {
     private auth;
+    private authAdmin;
     private logger;
     private expirySeconds;
-    constructor(auth: SelfSignedAuth, logger: Logger, expirySeconds?: number);
+    constructor(auth: SelfSignedAuth, authAdmin: SelfSignedAuth, logger: Logger, expirySeconds?: number);
     getUserAccessToken(): Promise<string>;
     getAdminAccessToken(): Promise<string>;
     static fetchToken(logger: Logger, credentials: ClientCredentials, issuer: string, expirySeconds?: number): Promise<string>;

package/dist/auth-token-provider-self-signed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-provider-self-signed.d.ts","sourceRoot":"","sources":["../src/auth-token-provider-self-signed.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGnD,qBAAa,2BAA4B,YAAW,mBAAmB;IAE/D,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,aAAa;gBAFb,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa;IAGlC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAerC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;WAkB/B,UAAU,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa,GAC7B,OAAO,CAAC,MAAM,CAAC;CAgBrB"}
+{"version":3,"file":"auth-token-provider-self-signed.d.ts","sourceRoot":"","sources":["../src/auth-token-provider-self-signed.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGnD,qBAAa,2BAA4B,YAAW,mBAAmB;IAE/D,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,aAAa;gBAHb,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa;IAGlC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAerC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;WAkB/B,UAAU,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa,GAC7B,OAAO,CAAC,MAAM,CAAC;CAgBrB"}

package/dist/auth-token-provider.d.ts

@@ -1,10 +1,12 @@
 import { Logger } from '@canton-network/core-types';
 import { AccessTokenProvider } from './auth-service.js';
-import { Auth } from './config/schema.js';
+import { Auth, Idp } from './config/schema.js';
 export declare class AuthTokenProvider implements AccessTokenProvider {
+    private idp;
     private auth;
+    private adminAuth;
     private logger;
-    constructor(auth: Auth, logger: Logger);
+    constructor(idp: Idp, auth: Auth, adminAuth: Auth, logger: Logger);
     getUserAccessToken(): Promise<string>;
     getAdminAccessToken(): Promise<string>;
 }

package/dist/auth-token-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-provider.d.ts","sourceRoot":"","sources":["../src/auth-token-provider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AAIzC,qBAAa,iBAAkB,YAAW,mBAAmB;IAErD,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,MAAM;gBADN,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM;IAGpB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAwBrC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;CAuB/C"}
+{"version":3,"file":"auth-token-provider.d.ts","sourceRoot":"","sources":["../src/auth-token-provider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAkB,MAAM,oBAAoB,CAAA;AAI9D,qBAAa,iBAAkB,YAAW,mBAAmB;IAErD,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;gBAHN,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,IAAI,EACf,MAAM,EAAE,MAAM;IAGpB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgCrC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;CAqC/C"}

package/dist/config/schema.d.ts

@@ -1,378 +1,58 @@
 import { z } from 'zod';
-declare const credentials: z.ZodObject<{
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-}, {
-    clientId: string;
-    clientSecret: string;
-}>;
-declare const passwordAuthSchema: z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"password">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
+declare const authorizationCodeAuthSchema: z.ZodObject<{
+    method: z.ZodLiteral<"authorization_code">;
     audience: z.ZodString;
-    tokenUrl: z.ZodString;
-    grantType: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    type: "password";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    tokenUrl: string;
-    grantType: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    type: "password";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    tokenUrl: string;
-    grantType: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>;
-declare const implicitAuthSchema: z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"implicit">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
-    audience: z.ZodString;
-    scope: z.ZodString;
-    clientId: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    type: "implicit";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    type: "implicit";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>;
-declare const clientCredentialAuthSchema: z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"client_credentials">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
+}, z.core.$strip>;
+declare const clientCredentialsAuthSchema: z.ZodObject<{
+    method: z.ZodLiteral<"client_credentials">;
     audience: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-    type: "client_credentials";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    clientSecret: string;
-    type: "client_credentials";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>;
+}, z.core.$strip>;
 declare const selfSignedAuthSchema: z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"self_signed">;
+    method: z.ZodLiteral<"self_signed">;
     issuer: z.ZodString;
     audience: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-    type: "self_signed";
-    identityProviderId: string;
-    issuer: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    clientSecret: string;
-    type: "self_signed";
-    identityProviderId: string;
-    issuer: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>;
-export declare const authSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"password">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
+}, z.core.$strip>;
+export declare const authSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"authorization_code">;
     audience: z.ZodString;
-    tokenUrl: z.ZodString;
-    grantType: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    type: "password";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    tokenUrl: string;
-    grantType: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    type: "password";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    tokenUrl: string;
-    grantType: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>, z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"implicit">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
-    audience: z.ZodString;
-    scope: z.ZodString;
-    clientId: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    type: "implicit";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    type: "implicit";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>, z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"client_credentials">;
-    issuer: z.ZodString;
-    configUrl: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    method: z.ZodLiteral<"client_credentials">;
     audience: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-    type: "client_credentials";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    clientSecret: string;
-    type: "client_credentials";
-    identityProviderId: string;
-    issuer: string;
-    configUrl: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>, z.ZodObject<{
-    identityProviderId: z.ZodString;
-    type: z.ZodLiteral<"self_signed">;
+}, z.core.$strip>, z.ZodObject<{
+    method: z.ZodLiteral<"self_signed">;
     issuer: z.ZodString;
     audience: z.ZodString;
     scope: z.ZodString;
     clientId: z.ZodString;
     clientSecret: z.ZodString;
-    admin: z.ZodOptional<z.ZodObject<{
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        clientId: string;
-        clientSecret: string;
-    }, {
-        clientId: string;
-        clientSecret: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    clientId: string;
-    clientSecret: string;
-    type: "self_signed";
-    identityProviderId: string;
-    issuer: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}, {
-    clientId: string;
-    clientSecret: string;
-    type: "self_signed";
-    identityProviderId: string;
-    issuer: string;
-    audience: string;
-    scope: string;
-    admin?: {
-        clientId: string;
-        clientSecret: string;
-    } | undefined;
-}>]>;
+}, z.core.$strip>], "method">;
 export type Auth = z.infer<typeof authSchema>;
-export type ImplicitAuth = z.infer<typeof implicitAuthSchema>;
-export type PasswordAuth = z.infer<typeof passwordAuthSchema>;
-export type Credentials = z.infer<typeof credentials>;
-export type ClientCredentialAuth = z.infer<typeof clientCredentialAuthSchema>;
+export type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>;
+export type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>;
 export type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>;
+export declare const idpSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<"self_signed">;
+    issuer: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodLiteral<"oauth">;
+    issuer: z.ZodString;
+    configUrl: z.ZodString;
+}, z.core.$strip>], "type">;
+export type Idp = z.infer<typeof idpSchema>;
 export {};
 //# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,QAAA,MAAM,WAAW;;;;;;;;;EAGf,CAAA;AAEF,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWtB,CAAA;AAEF,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAStB,CAAA;AAEF,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU9B,CAAA;AAEF,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASxB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKrB,CAAA;AAEF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAC7D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AACrD,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAC7E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,QAAA,MAAM,2BAA2B;;;;;iBAK/B,CAAA;AAEF,QAAA,MAAM,2BAA2B;;;;;;iBAM/B,CAAA;AAEF,QAAA,MAAM,oBAAoB;;;;;;;iBAOxB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;6BAIrB,CAAA;AAEF,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAA;AAC7C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAC/E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEjE,eAAO,MAAM,SAAS;;;;;;;;;2BAYpB,CAAA;AAEF,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA"}

package/dist/index.cjs

@@ -16,18 +16,18 @@ var ClientCredentialsService = class {
    * @returns The JWT access token as a string.
    * @throws If fetching the token fails or the response is invalid.
    */
-  async fetchToken(credentials2) {
+  async fetchToken(credentials) {
     try {
       const oidcConfig = await this.getOIDCConfig(this.configUrl);
       this.logger?.debug({ oidcConfig }, "Fetched OIDC config");
       const res = await this.fetchTokenEndpoint(
         oidcConfig.token_endpoint,
-        credentials2
+        credentials
       );
       const json = await res.json();
       this.logger?.info(
         { response: json },
-        `Fetched admin token for clientId: ${credentials2.clientId}`
+        `Fetched admin token for clientId: ${credentials.clientId}`
       );
       if (!json.access_token) {
         throw new Error("No access_token in token endpoint response");
@@ -38,13 +38,13 @@ var ClientCredentialsService = class {
       throw error;
     }
   }
-  async fetchTokenEndpoint(tokenEndpoint, credentials2) {
+  async fetchTokenEndpoint(tokenEndpoint, credentials) {
     const params = new URLSearchParams({
       grant_type: "client_credentials",
-      client_id: credentials2.clientId,
-      client_secret: credentials2.clientSecret,
-      scope: credentials2.scope ?? "",
-      audience: credentials2.audience ?? ""
+      client_id: credentials.clientId,
+      client_secret: credentials.clientSecret,
+      scope: credentials.scope ?? "",
+      audience: credentials.audience ?? ""
     });
     const res = await fetch(tokenEndpoint, {
       method: "POST",
@@ -78,7 +78,7 @@ var ClientCredentialsService = class {
   }
 };
 var clientCredentialsService = (configUrl, logger) => ({
-  fetchToken: async (credentials2) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials2)
+  fetchToken: async (credentials) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials)
 });
 function assertConnected(authContext) {
   if (!authContext) {
@@ -88,62 +88,49 @@ function assertConnected(authContext) {
   }
   return authContext;
 }
-var credentials = zod.z.object({
-  clientId: zod.z.string(),
-  clientSecret: zod.z.string()
-});
-var passwordAuthSchema = zod.z.object({
-  identityProviderId: zod.z.string(),
-  type: zod.z.literal("password"),
-  issuer: zod.z.string(),
-  configUrl: zod.z.string(),
+var authorizationCodeAuthSchema = zod.z.object({
+  method: zod.z.literal("authorization_code"),
   audience: zod.z.string(),
-  tokenUrl: zod.z.string(),
-  grantType: zod.z.string(),
   scope: zod.z.string(),
-  clientId: zod.z.string(),
-  admin: zod.z.optional(credentials)
+  clientId: zod.z.string()
 });
-var implicitAuthSchema = zod.z.object({
-  identityProviderId: zod.z.string(),
-  type: zod.z.literal("implicit"),
-  issuer: zod.z.string(),
-  configUrl: zod.z.string(),
+var clientCredentialsAuthSchema = zod.z.object({
+  method: zod.z.literal("client_credentials"),
   audience: zod.z.string(),
   scope: zod.z.string(),
   clientId: zod.z.string(),
-  admin: zod.z.optional(credentials)
-});
-var clientCredentialAuthSchema = zod.z.object({
-  identityProviderId: zod.z.string(),
-  type: zod.z.literal("client_credentials"),
-  issuer: zod.z.string(),
-  configUrl: zod.z.string(),
-  audience: zod.z.string(),
-  scope: zod.z.string(),
-  clientId: zod.z.string(),
-  clientSecret: zod.z.string(),
-  admin: zod.z.optional(credentials)
+  clientSecret: zod.z.string()
 });
 var selfSignedAuthSchema = zod.z.object({
-  identityProviderId: zod.z.string(),
-  type: zod.z.literal("self_signed"),
+  method: zod.z.literal("self_signed"),
   issuer: zod.z.string(),
   audience: zod.z.string(),
   scope: zod.z.string(),
   clientId: zod.z.string(),
-  clientSecret: zod.z.string(),
-  admin: zod.z.optional(credentials)
+  clientSecret: zod.z.string()
 });
-var authSchema = zod.z.discriminatedUnion("type", [
-  passwordAuthSchema,
-  implicitAuthSchema,
-  clientCredentialAuthSchema,
+var authSchema = zod.z.discriminatedUnion("method", [
+  authorizationCodeAuthSchema,
+  clientCredentialsAuthSchema,
   selfSignedAuthSchema
 ]);
+var idpSchema = zod.z.discriminatedUnion("type", [
+  zod.z.object({
+    id: zod.z.string(),
+    type: zod.z.literal("self_signed"),
+    issuer: zod.z.string()
+  }),
+  zod.z.object({
+    id: zod.z.string(),
+    type: zod.z.literal("oauth"),
+    issuer: zod.z.string(),
+    configUrl: zod.z.string().url()
+  })
+]);
 var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
-  constructor(auth, logger, expirySeconds = 3600) {
+  constructor(auth, authAdmin, logger, expirySeconds = 3600) {
     this.auth = auth;
+    this.authAdmin = authAdmin;
     this.logger = logger;
     this.expirySeconds = expirySeconds;
   }
@@ -163,27 +150,27 @@ var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
   }
   async getAdminAccessToken() {
     this.logger.debug("Fetching self-signed admin auth token");
-    if (!this.auth.admin) {
+    if (!this.authAdmin) {
       throw new Error("Admin credentials are not configured");
     }
     return _AuthTokenProviderSelfSigned.fetchToken(
       this.logger,
       {
-        clientId: this.auth.admin.clientId,
-        clientSecret: this.auth.admin.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
+        clientId: this.authAdmin.clientId,
+        clientSecret: this.authAdmin.clientSecret,
+        scope: this.authAdmin.scope,
+        audience: this.authAdmin.audience
       },
-      this.auth.issuer,
+      this.authAdmin.issuer,
       this.expirySeconds
     );
   }
-  static async fetchToken(logger, credentials2, issuer, expirySeconds = 3600) {
-    const secret = new TextEncoder().encode(credentials2.clientSecret);
+  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
+    const secret = new TextEncoder().encode(credentials.clientSecret);
     const now = Math.floor(Date.now() / 1e3);
     const jwt = await new jose.SignJWT({
-      sub: credentials2.clientId,
-      aud: credentials2.audience || "",
+      sub: credentials.clientId,
+      aud: credentials.audience || "",
       iat: now,
       exp: now + expirySeconds,
       iss: issuer
@@ -195,52 +182,75 @@ var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
 
 // src/auth-token-provider.ts
 var AuthTokenProvider = class {
-  constructor(auth, logger) {
+  constructor(idp, auth, adminAuth, logger) {
+    this.idp = idp;
     this.auth = auth;
+    this.adminAuth = adminAuth;
     this.logger = logger;
   }
   async getUserAccessToken() {
     this.logger.debug("Fetching user auth token");
-    if (this.auth.type === "self_signed")
+    if (this.auth.method === "self_signed")
       return new AuthTokenProviderSelfSigned(
         this.auth,
+        this.adminAuth,
         this.logger
       ).getUserAccessToken();
-    if (this.auth.type === "client_credentials")
-      return clientCredentialsService(
-        this.auth.configUrl,
-        this.logger
-      ).fetchToken({
-        clientId: this.auth.clientId,
-        clientSecret: this.auth.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
-      });
+    if (this.auth.method === "client_credentials") {
+      if (this.idp.type === "oauth")
+        return clientCredentialsService(
+          this.idp.configUrl,
+          this.logger
+        ).fetchToken({
+          clientId: this.auth.clientId,
+          clientSecret: this.auth.clientSecret,
+          scope: this.auth.scope,
+          audience: this.auth.audience
+        });
+      else {
+        throw new Error(
+          `IDP type ${this.idp.type} not supported for client_credentials auth`
+        );
+      }
+    }
     throw new Error(
-      `Auth type ${this.auth.type} not supported for user access token`
+      `Auth method ${this.auth.method} not supported for user access token`
     );
   }
   async getAdminAccessToken() {
     this.logger.debug("Fetching admin auth token");
-    if (this.auth.type === "self_signed")
+    if (this.adminAuth.method === "self_signed")
       return new AuthTokenProviderSelfSigned(
         this.auth,
+        this.adminAuth,
         this.logger
       ).getAdminAccessToken();
-    if (!this.auth.admin) {
+    if (!this.adminAuth) {
       throw new Error(
-        `No admin credentials configured for auth type ${this.auth.type}`
+        `No admin credentials configured for auth type ${this.auth.method}`
+      );
+    }
+    if (this.adminAuth.method === "client_credentials") {
+      if (this.idp.type === "oauth")
+        return clientCredentialsService(
+          this.idp.configUrl,
+          this.logger
+        ).fetchToken({
+          clientId: this.adminAuth.clientId,
+          clientSecret: this.adminAuth.clientSecret,
+          scope: this.adminAuth.scope,
+          audience: this.adminAuth.audience
+        });
+      else {
+        throw new Error(
+          `IDP type ${this.idp.type} not supported for client_credentials auth`
+        );
+      }
+    } else {
+      throw new Error(
+        `Auth method ${this.auth.method} not supported for admin access token`
       );
     }
-    return clientCredentialsService(
-      this.auth.configUrl,
-      this.logger
-    ).fetchToken({
-      clientId: this.auth.admin.clientId,
-      clientSecret: this.auth.admin.clientSecret,
-      scope: this.auth.scope,
-      audience: this.auth.audience
-    });
   }
 };
 
@@ -250,5 +260,6 @@ exports.ClientCredentialsService = ClientCredentialsService;
 exports.assertConnected = assertConnected;
 exports.authSchema = authSchema;
 exports.clientCredentialsService = clientCredentialsService;
+exports.idpSchema = idpSchema;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":["credentials","providerErrors","z","SignJWT"],"mappings":";;;;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAWA,YAAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACXA;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqCA,aAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACAA,YAAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAWA,YAAAA,CAAY,QAAA;AAAA,MACvB,eAAeA,YAAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAOA,aAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAUA,aAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAOA,YAAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAWA,YAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAMC,6BAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,WAAA,GAAcC,MAAE,MAAA,CAAO;AAAA,EACzB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EAChC,kBAAA,EAAoBA,MAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,EAC1B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,KAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,kBAAA,GAAqBA,MAAE,MAAA,CAAO;AAAA,EAChC,kBAAA,EAAoBA,MAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,EAC1B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,KAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,0BAAA,GAA6BA,MAAE,MAAA,CAAO;AAAA,EACxC,kBAAA,EAAoBA,MAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACpC,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAWA,MAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAOA,KAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAClC,kBAAA,EAAoBA,MAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAOA,KAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAEM,IAAM,UAAA,GAAaA,KAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACnD,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,0BAAA;AAAA,EACA;AACJ,CAAC;ACtDM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,MAAA,EACA,aAAA,GAAwB,IAAA,EAClC;AAHU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,QAAA;AAAA,QAC1B,YAAA,EAAc,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,YAAA;AAAA,QAC9B,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACAF,YAAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOA,aAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAIG,YAAA,CAAQ;AAAA,MAC1B,KAAKH,YAAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAKA,aAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC5DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,MACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,aAAA;AACnB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,oBAAA;AACnB,MAAA,OAAO,wBAAA;AAAA,QACH,KAAK,IAAA,CAAK,SAAA;AAAA,QACV,IAAA,CAAK;AAAA,QACP,UAAA,CAAW;AAAA,QACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACvB,CAAA;AAEL,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,UAAA,EAAa,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,oCAAA;AAAA,KAC/B;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,aAAA;AACnB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAAA,OACnE;AAAA,IACJ;AACA,IAAA,OAAO,wBAAA;AAAA,MACH,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,IAAA,CAAK;AAAA,MACP,UAAA,CAAW;AAAA,MACT,QAAA,EAAU,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,QAAA;AAAA,MAC1B,YAAA,EAAc,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,YAAA;AAAA,MAC9B,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,MACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,KACvB,CAAA;AAAA,EACL;AACJ","file":"index.cjs","sourcesContent":["// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst credentials = z.object({\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst passwordAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('password'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    tokenUrl: z.string(),\n    grantType: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst implicitAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('implicit'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst clientCredentialAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('client_credentials'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst selfSignedAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n    admin: z.optional(credentials),\n})\n\nexport const authSchema = z.discriminatedUnion('type', [\n    passwordAuthSchema,\n    implicitAuthSchema,\n    clientCredentialAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type ImplicitAuth = z.infer<typeof implicitAuthSchema>\nexport type PasswordAuth = z.infer<typeof passwordAuthSchema>\nexport type Credentials = z.infer<typeof credentials>\nexport type ClientCredentialAuth = z.infer<typeof clientCredentialAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.auth.admin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.admin.clientId,\n                clientSecret: this.auth.admin.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private auth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.type === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.type === 'client_credentials')\n            return clientCredentialsService(\n                this.auth.configUrl,\n                this.logger\n            ).fetchToken({\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            })\n\n        throw new Error(\n            `Auth type ${this.auth.type} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.auth.type === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.auth.admin) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.type}`\n            )\n        }\n        return clientCredentialsService(\n            this.auth.configUrl,\n            this.logger\n        ).fetchToken({\n            clientId: this.auth.admin.clientId,\n            clientSecret: this.auth.admin.clientSecret,\n            scope: this.auth.scope,\n            audience: this.auth.audience,\n        })\n    }\n}\n"]}
+{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":["providerErrors","z","SignJWT"],"mappings":";;;;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAMA,6BAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,2BAAA,GAA8BC,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8BA,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAaA,KAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAYA,KAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQA,MAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC;AC5CM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,SAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EAClC;AAJU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,QACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,QAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,QACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,OAC7B;AAAA,MACA,KAAK,SAAA,CAAU,MAAA;AAAA,MACf,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAIC,YAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC7DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,GAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACV;AAJU,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,MAAA,KAAW,aAAA;AACrB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,oBAAA,EAAsB;AAC3C,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,UACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,UACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,SACvB,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,oCAAA;AAAA,KACnC;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,KAAW,aAAA;AAC1B,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,OACrE;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,KAAW,oBAAA,EAAsB;AAChD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,UACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,UAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,UACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,SAC5B,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,qCAAA;AAAA,OACnC;AAAA,IACJ;AAAA,EACJ;AACJ","file":"index.cjs","sourcesContent":["// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private authAdmin: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.authAdmin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.authAdmin.clientId,\n                clientSecret: this.authAdmin.clientSecret,\n                scope: this.authAdmin.scope,\n                audience: this.authAdmin.audience,\n            },\n            this.authAdmin.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth, Idp, SelfSignedAuth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private idp: Idp,\n        private auth: Auth,\n        private adminAuth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.auth.clientId,\n                    clientSecret: this.auth.clientSecret,\n                    scope: this.auth.scope,\n                    audience: this.auth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${this.auth.method} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.adminAuth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth as SelfSignedAuth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.adminAuth) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.method}`\n            )\n        }\n\n        if (this.adminAuth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.adminAuth.clientId,\n                    clientSecret: this.adminAuth.clientSecret,\n                    scope: this.adminAuth.scope,\n                    audience: this.adminAuth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        } else {\n            throw new Error(\n                `Auth method ${this.auth.method} not supported for admin access token`\n            )\n        }\n    }\n}\n"]}

package/dist/index.js

@@ -14,18 +14,18 @@ var ClientCredentialsService = class {
    * @returns The JWT access token as a string.
    * @throws If fetching the token fails or the response is invalid.
    */
-  async fetchToken(credentials2) {
+  async fetchToken(credentials) {
     try {
       const oidcConfig = await this.getOIDCConfig(this.configUrl);
       this.logger?.debug({ oidcConfig }, "Fetched OIDC config");
       const res = await this.fetchTokenEndpoint(
         oidcConfig.token_endpoint,
-        credentials2
+        credentials
       );
       const json = await res.json();
       this.logger?.info(
         { response: json },
-        `Fetched admin token for clientId: ${credentials2.clientId}`
+        `Fetched admin token for clientId: ${credentials.clientId}`
       );
       if (!json.access_token) {
         throw new Error("No access_token in token endpoint response");
@@ -36,13 +36,13 @@ var ClientCredentialsService = class {
       throw error;
     }
   }
-  async fetchTokenEndpoint(tokenEndpoint, credentials2) {
+  async fetchTokenEndpoint(tokenEndpoint, credentials) {
     const params = new URLSearchParams({
       grant_type: "client_credentials",
-      client_id: credentials2.clientId,
-      client_secret: credentials2.clientSecret,
-      scope: credentials2.scope ?? "",
-      audience: credentials2.audience ?? ""
+      client_id: credentials.clientId,
+      client_secret: credentials.clientSecret,
+      scope: credentials.scope ?? "",
+      audience: credentials.audience ?? ""
     });
     const res = await fetch(tokenEndpoint, {
       method: "POST",
@@ -76,7 +76,7 @@ var ClientCredentialsService = class {
   }
 };
 var clientCredentialsService = (configUrl, logger) => ({
-  fetchToken: async (credentials2) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials2)
+  fetchToken: async (credentials) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials)
 });
 function assertConnected(authContext) {
   if (!authContext) {
@@ -86,62 +86,49 @@ function assertConnected(authContext) {
   }
   return authContext;
 }
-var credentials = z.object({
-  clientId: z.string(),
-  clientSecret: z.string()
-});
-var passwordAuthSchema = z.object({
-  identityProviderId: z.string(),
-  type: z.literal("password"),
-  issuer: z.string(),
-  configUrl: z.string(),
+var authorizationCodeAuthSchema = z.object({
+  method: z.literal("authorization_code"),
   audience: z.string(),
-  tokenUrl: z.string(),
-  grantType: z.string(),
   scope: z.string(),
-  clientId: z.string(),
-  admin: z.optional(credentials)
+  clientId: z.string()
 });
-var implicitAuthSchema = z.object({
-  identityProviderId: z.string(),
-  type: z.literal("implicit"),
-  issuer: z.string(),
-  configUrl: z.string(),
+var clientCredentialsAuthSchema = z.object({
+  method: z.literal("client_credentials"),
   audience: z.string(),
   scope: z.string(),
   clientId: z.string(),
-  admin: z.optional(credentials)
-});
-var clientCredentialAuthSchema = z.object({
-  identityProviderId: z.string(),
-  type: z.literal("client_credentials"),
-  issuer: z.string(),
-  configUrl: z.string(),
-  audience: z.string(),
-  scope: z.string(),
-  clientId: z.string(),
-  clientSecret: z.string(),
-  admin: z.optional(credentials)
+  clientSecret: z.string()
 });
 var selfSignedAuthSchema = z.object({
-  identityProviderId: z.string(),
-  type: z.literal("self_signed"),
+  method: z.literal("self_signed"),
   issuer: z.string(),
   audience: z.string(),
   scope: z.string(),
   clientId: z.string(),
-  clientSecret: z.string(),
-  admin: z.optional(credentials)
+  clientSecret: z.string()
 });
-var authSchema = z.discriminatedUnion("type", [
-  passwordAuthSchema,
-  implicitAuthSchema,
-  clientCredentialAuthSchema,
+var authSchema = z.discriminatedUnion("method", [
+  authorizationCodeAuthSchema,
+  clientCredentialsAuthSchema,
   selfSignedAuthSchema
 ]);
+var idpSchema = z.discriminatedUnion("type", [
+  z.object({
+    id: z.string(),
+    type: z.literal("self_signed"),
+    issuer: z.string()
+  }),
+  z.object({
+    id: z.string(),
+    type: z.literal("oauth"),
+    issuer: z.string(),
+    configUrl: z.string().url()
+  })
+]);
 var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
-  constructor(auth, logger, expirySeconds = 3600) {
+  constructor(auth, authAdmin, logger, expirySeconds = 3600) {
     this.auth = auth;
+    this.authAdmin = authAdmin;
     this.logger = logger;
     this.expirySeconds = expirySeconds;
   }
@@ -161,27 +148,27 @@ var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
   }
   async getAdminAccessToken() {
     this.logger.debug("Fetching self-signed admin auth token");
-    if (!this.auth.admin) {
+    if (!this.authAdmin) {
       throw new Error("Admin credentials are not configured");
     }
     return _AuthTokenProviderSelfSigned.fetchToken(
       this.logger,
       {
-        clientId: this.auth.admin.clientId,
-        clientSecret: this.auth.admin.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
+        clientId: this.authAdmin.clientId,
+        clientSecret: this.authAdmin.clientSecret,
+        scope: this.authAdmin.scope,
+        audience: this.authAdmin.audience
       },
-      this.auth.issuer,
+      this.authAdmin.issuer,
       this.expirySeconds
     );
   }
-  static async fetchToken(logger, credentials2, issuer, expirySeconds = 3600) {
-    const secret = new TextEncoder().encode(credentials2.clientSecret);
+  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
+    const secret = new TextEncoder().encode(credentials.clientSecret);
     const now = Math.floor(Date.now() / 1e3);
     const jwt = await new SignJWT({
-      sub: credentials2.clientId,
-      aud: credentials2.audience || "",
+      sub: credentials.clientId,
+      aud: credentials.audience || "",
       iat: now,
       exp: now + expirySeconds,
       iss: issuer
@@ -193,55 +180,78 @@ var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
 
 // src/auth-token-provider.ts
 var AuthTokenProvider = class {
-  constructor(auth, logger) {
+  constructor(idp, auth, adminAuth, logger) {
+    this.idp = idp;
     this.auth = auth;
+    this.adminAuth = adminAuth;
     this.logger = logger;
   }
   async getUserAccessToken() {
     this.logger.debug("Fetching user auth token");
-    if (this.auth.type === "self_signed")
+    if (this.auth.method === "self_signed")
       return new AuthTokenProviderSelfSigned(
         this.auth,
+        this.adminAuth,
         this.logger
       ).getUserAccessToken();
-    if (this.auth.type === "client_credentials")
-      return clientCredentialsService(
-        this.auth.configUrl,
-        this.logger
-      ).fetchToken({
-        clientId: this.auth.clientId,
-        clientSecret: this.auth.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
-      });
+    if (this.auth.method === "client_credentials") {
+      if (this.idp.type === "oauth")
+        return clientCredentialsService(
+          this.idp.configUrl,
+          this.logger
+        ).fetchToken({
+          clientId: this.auth.clientId,
+          clientSecret: this.auth.clientSecret,
+          scope: this.auth.scope,
+          audience: this.auth.audience
+        });
+      else {
+        throw new Error(
+          `IDP type ${this.idp.type} not supported for client_credentials auth`
+        );
+      }
+    }
     throw new Error(
-      `Auth type ${this.auth.type} not supported for user access token`
+      `Auth method ${this.auth.method} not supported for user access token`
     );
   }
   async getAdminAccessToken() {
     this.logger.debug("Fetching admin auth token");
-    if (this.auth.type === "self_signed")
+    if (this.adminAuth.method === "self_signed")
       return new AuthTokenProviderSelfSigned(
         this.auth,
+        this.adminAuth,
         this.logger
       ).getAdminAccessToken();
-    if (!this.auth.admin) {
+    if (!this.adminAuth) {
       throw new Error(
-        `No admin credentials configured for auth type ${this.auth.type}`
+        `No admin credentials configured for auth type ${this.auth.method}`
+      );
+    }
+    if (this.adminAuth.method === "client_credentials") {
+      if (this.idp.type === "oauth")
+        return clientCredentialsService(
+          this.idp.configUrl,
+          this.logger
+        ).fetchToken({
+          clientId: this.adminAuth.clientId,
+          clientSecret: this.adminAuth.clientSecret,
+          scope: this.adminAuth.scope,
+          audience: this.adminAuth.audience
+        });
+      else {
+        throw new Error(
+          `IDP type ${this.idp.type} not supported for client_credentials auth`
+        );
+      }
+    } else {
+      throw new Error(
+        `Auth method ${this.auth.method} not supported for admin access token`
       );
     }
-    return clientCredentialsService(
-      this.auth.configUrl,
-      this.logger
-    ).fetchToken({
-      clientId: this.auth.admin.clientId,
-      clientSecret: this.auth.admin.clientSecret,
-      scope: this.auth.scope,
-      audience: this.auth.audience
-    });
   }
 };
 
-export { AuthTokenProvider, AuthTokenProviderSelfSigned, ClientCredentialsService, assertConnected, authSchema, clientCredentialsService };
+export { AuthTokenProvider, AuthTokenProviderSelfSigned, ClientCredentialsService, assertConnected, authSchema, clientCredentialsService, idpSchema };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":["credentials"],"mappings":";;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAWA,YAAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACXA;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqCA,aAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACAA,YAAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAWA,YAAAA,CAAY,QAAA;AAAA,MACvB,eAAeA,YAAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAOA,aAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAUA,aAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAOA,YAAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAWA,YAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,eAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,WAAA,GAAc,EAAE,MAAA,CAAO;AAAA,EACzB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA,EAChC,kBAAA,EAAoB,EAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,EAC1B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA,EAChC,kBAAA,EAAoB,EAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,UAAU,CAAA;AAAA,EAC1B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,0BAAA,GAA6B,EAAE,MAAA,CAAO;AAAA,EACxC,kBAAA,EAAoB,EAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACpC,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,SAAA,EAAW,EAAE,MAAA,EAAO;AAAA,EACpB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAClC,kBAAA,EAAoB,EAAE,MAAA,EAAO;AAAA,EAC7B,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA,EAAO;AAAA,EACvB,KAAA,EAAO,CAAA,CAAE,QAAA,CAAS,WAAW;AACjC,CAAC,CAAA;AAEM,IAAM,UAAA,GAAa,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EACnD,kBAAA;AAAA,EACA,kBAAA;AAAA,EACA,0BAAA;AAAA,EACA;AACJ,CAAC;ACtDM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,MAAA,EACA,aAAA,GAAwB,IAAA,EAClC;AAHU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,QAAA;AAAA,QAC1B,YAAA,EAAc,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,YAAA;AAAA,QAC9B,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACAA,YAAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAOA,aAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAI,OAAA,CAAQ;AAAA,MAC1B,KAAKA,YAAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAKA,aAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC5DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,MACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,aAAA;AACnB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,oBAAA;AACnB,MAAA,OAAO,wBAAA;AAAA,QACH,KAAK,IAAA,CAAK,SAAA;AAAA,QACV,IAAA,CAAK;AAAA,QACP,UAAA,CAAW;AAAA,QACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACvB,CAAA;AAEL,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,UAAA,EAAa,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,oCAAA;AAAA,KAC/B;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,KAAK,IAAA,KAAS,aAAA;AACnB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AAAA,OACnE;AAAA,IACJ;AACA,IAAA,OAAO,wBAAA;AAAA,MACH,KAAK,IAAA,CAAK,SAAA;AAAA,MACV,IAAA,CAAK;AAAA,MACP,UAAA,CAAW;AAAA,MACT,QAAA,EAAU,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,QAAA;AAAA,MAC1B,YAAA,EAAc,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,YAAA;AAAA,MAC9B,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,MACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,KACvB,CAAA;AAAA,EACL;AACJ","file":"index.js","sourcesContent":["// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst credentials = z.object({\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst passwordAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('password'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    tokenUrl: z.string(),\n    grantType: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst implicitAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('implicit'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst clientCredentialAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('client_credentials'),\n    issuer: z.string(),\n    configUrl: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n    admin: z.optional(credentials),\n})\n\nconst selfSignedAuthSchema = z.object({\n    identityProviderId: z.string(),\n    type: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n    admin: z.optional(credentials),\n})\n\nexport const authSchema = z.discriminatedUnion('type', [\n    passwordAuthSchema,\n    implicitAuthSchema,\n    clientCredentialAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type ImplicitAuth = z.infer<typeof implicitAuthSchema>\nexport type PasswordAuth = z.infer<typeof passwordAuthSchema>\nexport type Credentials = z.infer<typeof credentials>\nexport type ClientCredentialAuth = z.infer<typeof clientCredentialAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.auth.admin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.admin.clientId,\n                clientSecret: this.auth.admin.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private auth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.type === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.type === 'client_credentials')\n            return clientCredentialsService(\n                this.auth.configUrl,\n                this.logger\n            ).fetchToken({\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            })\n\n        throw new Error(\n            `Auth type ${this.auth.type} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.auth.type === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.auth.admin) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.type}`\n            )\n        }\n        return clientCredentialsService(\n            this.auth.configUrl,\n            this.logger\n        ).fetchToken({\n            clientId: this.auth.admin.clientId,\n            clientSecret: this.auth.admin.clientSecret,\n            scope: this.auth.scope,\n            audience: this.auth.audience,\n        })\n    }\n}\n"]}
+{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":[],"mappings":";;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,eAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAa,CAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAY,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQ,EAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC;AC5CM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,SAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EAClC;AAJU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,QACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,QAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,QACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,OAC7B;AAAA,MACA,KAAK,SAAA,CAAU,MAAA;AAAA,MACf,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAI,OAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC7DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,GAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACV;AAJU,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,MAAA,KAAW,aAAA;AACrB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,oBAAA,EAAsB;AAC3C,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,UACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,UACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,SACvB,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,oCAAA;AAAA,KACnC;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,KAAW,aAAA;AAC1B,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,OACrE;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,KAAW,oBAAA,EAAsB;AAChD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,UACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,UAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,UACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,SAC5B,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,qCAAA;AAAA,OACnC;AAAA,IACJ;AAAA,EACJ;AACJ","file":"index.js","sourcesContent":["// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private authAdmin: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.authAdmin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.authAdmin.clientId,\n                clientSecret: this.authAdmin.clientSecret,\n                scope: this.authAdmin.scope,\n                audience: this.authAdmin.audience,\n            },\n            this.authAdmin.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth, Idp, SelfSignedAuth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private idp: Idp,\n        private auth: Auth,\n        private adminAuth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.auth.clientId,\n                    clientSecret: this.auth.clientSecret,\n                    scope: this.auth.scope,\n                    audience: this.auth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${this.auth.method} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.adminAuth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth as SelfSignedAuth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.adminAuth) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.method}`\n            )\n        }\n\n        if (this.adminAuth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.adminAuth.clientId,\n                    clientSecret: this.adminAuth.clientSecret,\n                    scope: this.adminAuth.scope,\n                    audience: this.adminAuth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        } else {\n            throw new Error(\n                `Auth method ${this.auth.method} not supported for admin access token`\n            )\n        }\n    }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canton-network/core-wallet-auth",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "type": "module",
   "description": "Provides authentication middleware and user management for the Wallet Gateway",
   "repository": "github:hyperledger-labs/splice-wallet-kernel",
@@ -37,10 +37,10 @@
     "typescript": "^5.8.3"
   },
   "dependencies": {
-    "@canton-network/core-rpc-errors": "^0.7.0",
-    "@canton-network/core-types": "^0.10.0",
+    "@canton-network/core-rpc-errors": "^0.8.1",
+    "@canton-network/core-types": "^0.11.1",
     "jose": "^5.10.0",
-    "zod": "^3.25.64"
+    "zod": "^4.1.12"
   },
   "files": [
     "dist/**"