@canton-network/core-wallet-auth 0.21.0 → 0.23.0

package/dist/auth-service.d.ts

@@ -23,8 +23,8 @@ export interface AuthService {
  * Interface for providing access tokens used to authenticate requests
  */
 export interface AccessTokenProvider {
-    getUserAccessToken(): Promise<string>;
-    getAdminAccessToken(): Promise<string>;
+    getAccessToken(): Promise<string>;
+    getAuthContext(): Promise<AuthContext>;
 }
 export interface OIDCConfig {
     token_endpoint: string;

package/dist/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC;IACxB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,KAAK,CAAC,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACrC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,UAAU;IACvB,cAAc,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,MAAM,GAAG,MAAM,CAAA;AAE3B;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,CAAC;IACxB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAA;IACpC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,KAAK,CAAC,CAAA;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IACxB,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;CACzC;AAED,MAAM,WAAW,UAAU;IACvB,cAAc,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B"}

package/dist/auth-token-provider.d.ts

@@ -1,13 +1,49 @@
 import { Logger } from '@canton-network/core-types';
-import { AccessTokenProvider } from './auth-service.js';
-import { Auth, Idp } from './config/schema.js';
+import { AccessTokenProvider, AuthContext, ClientCredentials } from './auth-service';
+import { Auth, Idp } from './config/schema';
+type TokenProviderConfig = {
+    method: 'static';
+    token: string;
+} | {
+    method: 'self_signed';
+    issuer: string;
+    credentials: ClientCredentials;
+} | {
+    method: 'client_credentials';
+    configUrl: string;
+    credentials: ClientCredentials;
+};
+/**
+ * AuthTokenProvider provides some common functionality across token providers.
+ *
+ *  1. Token caching: tokens are cached in-memory, so long as the token lifespan is not expired.
+ *  2. Context retrieval: deriving a user context from the stored access token.
+ *
+ *
+ * The following programmatic methods of token fetching are supported:
+ *
+ *  - `static`: a fixed, in-memory token. Only used for compatibility, it will totally break for expired tokens.
+ *  - `self_signed`: only for development purposes, used for Canton setups that accept HMAC256 self signed tokens.
+ *  - `client_credentials`: used to programmatically acquire tokens via oauth2, a.k.a "machine-to-machine" tokens.
+ */
 export declare class AuthTokenProvider implements AccessTokenProvider {
-    private idp;
-    private auth;
-    private adminAuth;
-    private logger;
-    constructor(idp: Idp, auth: Auth, adminAuth: Auth, logger: Logger);
-    getUserAccessToken(): Promise<string>;
-    getAdminAccessToken(): Promise<string>;
+    protected readonly config: TokenProviderConfig;
+    protected logger: Logger;
+    private cachedToken;
+    constructor(config: TokenProviderConfig, logger: Logger);
+    static fromToken(token: string, logger: Logger): AuthTokenProvider;
+    static fromGatewayConfig(idp: Idp, auth: Auth, logger: Logger): AuthTokenProvider;
+    private _fetchToken;
+    /**
+     *
+     * @returns A valid JWT token retrieved according to the auth configuration given.
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     *
+     * @returns An AuthContext containing a valid token and userId.
+     */
+    getAuthContext(): Promise<AuthContext>;
 }
+export {};
 //# sourceMappingURL=auth-token-provider.d.ts.map

package/dist/auth-token-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-provider.d.ts","sourceRoot":"","sources":["../src/auth-token-provider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAkB,MAAM,oBAAoB,CAAA;AAI9D,qBAAa,iBAAkB,YAAW,mBAAmB;IAErD,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;gBAHN,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,IAAI,EACf,MAAM,EAAE,MAAM;IAGpB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAgCrC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;CAqC/C"}
+{"version":3,"file":"auth-token-provider.d.ts","sourceRoot":"","sources":["../src/auth-token-provider.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EACH,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACpB,MAAM,gBAAgB,CAAA;AAIvB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAE3C,KAAK,mBAAmB,GAClB;IACI,MAAM,EAAE,QAAQ,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CAChB,GACD;IACI,MAAM,EAAE,aAAa,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,iBAAiB,CAAA;CACjC,GACD;IACI,MAAM,EAAE,oBAAoB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,iBAAiB,CAAA;CACjC,CAAA;AAEP;;;;;;;;;;;;GAYG;AACH,qBAAa,iBAAkB,YAAW,mBAAmB;IAIrD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB;IAC9C,SAAS,CAAC,MAAM,EAAE,MAAM;IAJ5B,OAAO,CAAC,WAAW,CAAoB;gBAGhB,MAAM,EAAE,mBAAmB,EACpC,MAAM,EAAE,MAAM;IAG5B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAIlE,MAAM,CAAC,iBAAiB,CACpB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,GACf,iBAAiB;YA4CN,WAAW;IAoBzB;;;OAGG;IACU,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAgB9C;;;OAGG;IACU,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CAMtD"}

package/dist/auth-utils.d.ts

@@ -1,3 +1,17 @@
 import { AuthContext } from './auth-service';
 export declare function assertConnected(authContext: AuthContext | undefined): AuthContext;
+/**
+ * Extract a User ID from the `sub` claim of a JWT. Throws if `sub` is missing.
+ *
+ * @param token a base64 encoded JWT token
+ * @returns
+ */
+export declare function jwtUserId(token: string): string;
+/**
+ * Determine if a given JWT is still valid based on its expiry time.
+ *
+ * @param token a base64 encoded JWT token
+ * @returns true if the token is expired, false if not
+ */
+export declare function jwtExpired(token: string): boolean;
 //# sourceMappingURL=auth-utils.d.ts.map

package/dist/auth-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../src/auth-utils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,wBAAgB,eAAe,CAC3B,WAAW,EAAE,WAAW,GAAG,SAAS,GACrC,WAAW,CAOb"}
+{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../src/auth-utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAG5C,wBAAgB,eAAe,CAC3B,WAAW,EAAE,WAAW,GAAG,SAAS,GACrC,WAAW,CAOb;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ/C;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQjD"}

package/dist/index.cjs

@@ -1,8 +1,36 @@
 'use strict';
 
+var jose = require('jose');
 var coreRpcErrors = require('@canton-network/core-rpc-errors');
 var zod = require('zod');
-var jose = require('jose');
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "" , value);
+function assertConnected(authContext) {
+  if (!authContext) {
+    throw coreRpcErrors.providerErrors.unauthorized({
+      message: "User is not connected"
+    });
+  }
+  return authContext;
+}
+function jwtUserId(token) {
+  const { sub } = jose.decodeJwt(token);
+  if (!sub) {
+    throw new Error("token did not contain a subject field");
+  }
+  return sub;
+}
+function jwtExpired(token) {
+  try {
+    const payload = jose.decodeJwt(token);
+    const now = Math.floor(Date.now() / 1e3);
+    return typeof payload.exp === "number" && payload.exp <= now;
+  } catch {
+    return true;
+  }
+}
 
 // src/client-credentials-service.ts
 var ClientCredentialsService = class {
@@ -80,14 +108,120 @@ var ClientCredentialsService = class {
 var clientCredentialsService = (configUrl, logger) => ({
   fetchToken: async (credentials) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials)
 });
-function assertConnected(authContext) {
-  if (!authContext) {
-    throw coreRpcErrors.providerErrors.unauthorized({
-      message: "User is not connected"
-    });
+var SelfSignedTokenService = class {
+  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
+    const secret = new TextEncoder().encode(credentials.clientSecret);
+    const now = Math.floor(Date.now() / 1e3);
+    const jwt = await new jose.SignJWT({
+      sub: credentials.clientId,
+      aud: credentials.audience || "",
+      scope: credentials.scope || "",
+      iat: now,
+      exp: now + expirySeconds,
+      iss: issuer
+    }).setProtectedHeader({ alg: "HS256" }).sign(secret);
+    logger.info(`Generated self-signed JWT token: ${jwt}`);
+    return jwt;
   }
-  return authContext;
-}
+};
+
+// src/auth-token-provider.ts
+var AuthTokenProvider = class _AuthTokenProvider {
+  constructor(config, logger) {
+    this.config = config;
+    this.logger = logger;
+    __publicField(this, "cachedToken");
+  }
+  static fromToken(token, logger) {
+    return new _AuthTokenProvider({ method: "static", token }, logger);
+  }
+  static fromGatewayConfig(idp, auth, logger) {
+    if (auth.method === "self_signed") {
+      return new _AuthTokenProvider(
+        {
+          method: auth.method,
+          issuer: auth.issuer,
+          credentials: {
+            clientId: auth.clientId,
+            clientSecret: auth.clientSecret,
+            scope: auth.scope,
+            audience: auth.audience
+          }
+        },
+        logger
+      );
+    }
+    if (auth.method === "client_credentials") {
+      if (idp.type === "oauth")
+        return new _AuthTokenProvider(
+          {
+            method: auth.method,
+            configUrl: idp.configUrl,
+            credentials: {
+              clientId: auth.clientId,
+              clientSecret: auth.clientSecret,
+              scope: auth.scope,
+              audience: auth.audience
+            }
+          },
+          logger
+        );
+      else {
+        throw new Error(
+          `IDP type ${idp.type} not supported for client_credentials auth`
+        );
+      }
+    }
+    throw new Error(
+      `Auth method ${auth.method} not supported for programmatic access token`
+    );
+  }
+  async _fetchToken() {
+    this.logger.debug("Fetching user auth token");
+    switch (this.config.method) {
+      case "static":
+        return this.config.token;
+      case "self_signed":
+        return SelfSignedTokenService.fetchToken(
+          this.logger,
+          this.config.credentials,
+          this.config.issuer
+        );
+      case "client_credentials":
+        return clientCredentialsService(
+          this.config.configUrl,
+          this.logger
+        ).fetchToken(this.config.credentials);
+    }
+  }
+  /**
+   *
+   * @returns A valid JWT token retrieved according to the auth configuration given.
+   */
+  async getAccessToken() {
+    if (this.cachedToken && !jwtExpired(this.cachedToken)) {
+      return this.cachedToken;
+    } else {
+      const newToken = await this._fetchToken();
+      if (jwtExpired(newToken)) {
+        throw new Error(
+          "Attempted to refresh a token, but it came back expired."
+        );
+      }
+      this.cachedToken = newToken;
+      return newToken;
+    }
+  }
+  /**
+   *
+   * @returns An AuthContext containing a valid token and userId.
+   */
+  async getAuthContext() {
+    const accessToken = await this.getAccessToken();
+    const userId = jwtUserId(accessToken);
+    return { accessToken, userId };
+  }
+};
 var authorizationCodeAuthSchema = zod.z.object({
   method: zod.z.literal("authorization_code"),
   audience: zod.z.string(),
@@ -127,140 +261,14 @@ var idpSchema = zod.z.discriminatedUnion("type", [
     configUrl: zod.z.string().url()
   })
 ]);
-var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
-  constructor(auth, authAdmin, logger, expirySeconds = 3600) {
-    this.auth = auth;
-    this.authAdmin = authAdmin;
-    this.logger = logger;
-    this.expirySeconds = expirySeconds;
-  }
-  async getUserAccessToken() {
-    this.logger.debug("Fetching self-signed user auth token");
-    return _AuthTokenProviderSelfSigned.fetchToken(
-      this.logger,
-      {
-        clientId: this.auth.clientId,
-        clientSecret: this.auth.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
-      },
-      this.auth.issuer,
-      this.expirySeconds
-    );
-  }
-  async getAdminAccessToken() {
-    this.logger.debug("Fetching self-signed admin auth token");
-    if (!this.authAdmin) {
-      throw new Error("Admin credentials are not configured");
-    }
-    return _AuthTokenProviderSelfSigned.fetchToken(
-      this.logger,
-      {
-        clientId: this.authAdmin.clientId,
-        clientSecret: this.authAdmin.clientSecret,
-        scope: this.authAdmin.scope,
-        audience: this.authAdmin.audience
-      },
-      this.authAdmin.issuer,
-      this.expirySeconds
-    );
-  }
-  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
-    const secret = new TextEncoder().encode(credentials.clientSecret);
-    const now = Math.floor(Date.now() / 1e3);
-    const jwt = await new jose.SignJWT({
-      sub: credentials.clientId,
-      aud: credentials.audience || "",
-      scope: credentials.scope || "",
-      iat: now,
-      exp: now + expirySeconds,
-      iss: issuer
-    }).setProtectedHeader({ alg: "HS256" }).sign(secret);
-    logger.info(`Generated self-signed JWT token: ${jwt}`);
-    return jwt;
-  }
-};
-
-// src/auth-token-provider.ts
-var AuthTokenProvider = class {
-  constructor(idp, auth, adminAuth, logger) {
-    this.idp = idp;
-    this.auth = auth;
-    this.adminAuth = adminAuth;
-    this.logger = logger;
-  }
-  async getUserAccessToken() {
-    this.logger.debug("Fetching user auth token");
-    if (this.auth.method === "self_signed")
-      return new AuthTokenProviderSelfSigned(
-        this.auth,
-        this.adminAuth,
-        this.logger
-      ).getUserAccessToken();
-    if (this.auth.method === "client_credentials") {
-      if (this.idp.type === "oauth")
-        return clientCredentialsService(
-          this.idp.configUrl,
-          this.logger
-        ).fetchToken({
-          clientId: this.auth.clientId,
-          clientSecret: this.auth.clientSecret,
-          scope: this.auth.scope,
-          audience: this.auth.audience
-        });
-      else {
-        throw new Error(
-          `IDP type ${this.idp.type} not supported for client_credentials auth`
-        );
-      }
-    }
-    throw new Error(
-      `Auth method ${this.auth.method} not supported for user access token`
-    );
-  }
-  async getAdminAccessToken() {
-    this.logger.debug("Fetching admin auth token");
-    if (this.adminAuth.method === "self_signed")
-      return new AuthTokenProviderSelfSigned(
-        this.auth,
-        this.adminAuth,
-        this.logger
-      ).getAdminAccessToken();
-    if (!this.adminAuth) {
-      throw new Error(
-        `No admin credentials configured for auth type ${this.auth.method}`
-      );
-    }
-    if (this.adminAuth.method === "client_credentials") {
-      if (this.idp.type === "oauth")
-        return clientCredentialsService(
-          this.idp.configUrl,
-          this.logger
-        ).fetchToken({
-          clientId: this.adminAuth.clientId,
-          clientSecret: this.adminAuth.clientSecret,
-          scope: this.adminAuth.scope,
-          audience: this.adminAuth.audience
-        });
-      else {
-        throw new Error(
-          `IDP type ${this.idp.type} not supported for client_credentials auth`
-        );
-      }
-    } else {
-      throw new Error(
-        `Auth method ${this.auth.method} not supported for admin access token`
-      );
-    }
-  }
-};
 
 exports.AuthTokenProvider = AuthTokenProvider;
-exports.AuthTokenProviderSelfSigned = AuthTokenProviderSelfSigned;
 exports.ClientCredentialsService = ClientCredentialsService;
 exports.assertConnected = assertConnected;
 exports.authSchema = authSchema;
 exports.clientCredentialsService = clientCredentialsService;
 exports.idpSchema = idpSchema;
+exports.jwtExpired = jwtExpired;
+exports.jwtUserId = jwtUserId;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":["providerErrors","z","SignJWT"],"mappings":";;;;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAMA,6BAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,2BAAA,GAA8BC,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8BA,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAaA,KAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAYA,KAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQA,MAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC;AC5CM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,SAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EAClC;AAJU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,QACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,QAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,QACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,OAC7B;AAAA,MACA,KAAK,SAAA,CAAU,MAAA;AAAA,MACf,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAIC,YAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC9DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,GAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACV;AAJU,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,MAAA,KAAW,aAAA;AACrB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,oBAAA,EAAsB;AAC3C,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,UACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,UACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,SACvB,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,oCAAA;AAAA,KACnC;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,KAAW,aAAA;AAC1B,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,OACrE;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,KAAW,oBAAA,EAAsB;AAChD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,UACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,UAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,UACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,SAC5B,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,qCAAA;AAAA,OACnC;AAAA,IACJ;AAAA,EACJ;AACJ","file":"index.cjs","sourcesContent":["// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private authAdmin: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.authAdmin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.authAdmin.clientId,\n                clientSecret: this.authAdmin.clientSecret,\n                scope: this.authAdmin.scope,\n                audience: this.authAdmin.audience,\n            },\n            this.authAdmin.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            scope: credentials.scope || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth, Idp, SelfSignedAuth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private idp: Idp,\n        private auth: Auth,\n        private adminAuth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.auth.clientId,\n                    clientSecret: this.auth.clientSecret,\n                    scope: this.auth.scope,\n                    audience: this.auth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${this.auth.method} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.adminAuth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth as SelfSignedAuth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.adminAuth) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.method}`\n            )\n        }\n\n        if (this.adminAuth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.adminAuth.clientId,\n                    clientSecret: this.adminAuth.clientSecret,\n                    scope: this.adminAuth.scope,\n                    audience: this.adminAuth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        } else {\n            throw new Error(\n                `Auth method ${this.auth.method} not supported for admin access token`\n            )\n        }\n    }\n}\n"]}
+{"version":3,"sources":["../src/auth-utils.ts","../src/client-credentials-service.ts","../src/self-signed-token-service.ts","../src/auth-token-provider.ts","../src/config/schema.ts"],"names":["providerErrors","decodeJwt","SignJWT","z"],"mappings":";;;;;;;;;AAOO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAMA,6BAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;AAQO,SAAS,UAAU,KAAA,EAAuB;AAC7C,EAAA,MAAM,EAAE,GAAA,EAAI,GAAIC,cAAA,CAAU,KAAK,CAAA;AAE/B,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,WAAW,KAAA,EAAwB;AAC/C,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAUA,eAAU,KAAK,CAAA;AAC/B,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,OAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,QAAQ,GAAA,IAAO,GAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;AC1CO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC3FO,IAAM,yBAAN,MAA6B;AAAA,EAChC,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAIC,YAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ,CAAA;;;ACaO,IAAM,iBAAA,GAAN,MAAM,kBAAA,CAAiD;AAAA,EAG1D,WAAA,CACuB,QACT,MAAA,EACZ;AAFqB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACT,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAJd,IAAA,aAAA,CAAA,IAAA,EAAQ,aAAA,CAAA;AAAA,EAKL;AAAA,EAEH,OAAO,SAAA,CAAU,KAAA,EAAe,MAAA,EAAmC;AAC/D,IAAA,OAAO,IAAI,kBAAA,CAAkB,EAAE,QAAQ,QAAA,EAAU,KAAA,IAAS,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAO,iBAAA,CACH,GAAA,EACA,IAAA,EACA,MAAA,EACiB;AACjB,IAAA,IAAI,IAAA,CAAK,WAAW,aAAA,EAAe;AAC/B,MAAA,OAAO,IAAI,kBAAA;AAAA,QACP;AAAA,UACI,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,WAAA,EAAa;AAAA,YACT,UAAU,IAAA,CAAK,QAAA;AAAA,YACf,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,OAAO,IAAA,CAAK,KAAA;AAAA,YACZ,UAAU,IAAA,CAAK;AAAA;AACnB,SACJ;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,oBAAA,EAAsB;AACtC,MAAA,IAAI,IAAI,IAAA,KAAS,OAAA;AACb,QAAA,OAAO,IAAI,kBAAA;AAAA,UACP;AAAA,YACI,QAAQ,IAAA,CAAK,MAAA;AAAA,YACb,WAAW,GAAA,CAAI,SAAA;AAAA,YACf,WAAA,EAAa;AAAA,cACT,UAAU,IAAA,CAAK,QAAA;AAAA,cACf,cAAc,IAAA,CAAK,YAAA;AAAA,cACnB,OAAO,IAAA,CAAK,KAAA;AAAA,cACZ,UAAU,IAAA,CAAK;AAAA;AACnB,WACJ;AAAA,UACA;AAAA,SACJ;AAAA,WACC;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAI,IAAI,CAAA,0CAAA;AAAA,SACxB;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,KAAK,MAAM,CAAA,4CAAA;AAAA,KAC9B;AAAA,EACJ;AAAA,EAEA,MAAc,WAAA,GAA+B;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAE5C,IAAA,QAAQ,IAAA,CAAK,OAAO,MAAA;AAAQ,MACxB,KAAK,QAAA;AACD,QAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,MACvB,KAAK,aAAA;AACD,QAAA,OAAO,sBAAA,CAAuB,UAAA;AAAA,UAC1B,IAAA,CAAK,MAAA;AAAA,UACL,KAAK,MAAA,CAAO,WAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SAChB;AAAA,MACJ,KAAK,oBAAA;AACD,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,MAAA,CAAO,SAAA;AAAA,UACZ,IAAA,CAAK;AAAA,SACT,CAAE,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAAA;AAC5C,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,cAAA,GAAkC;AAC3C,IAAA,IAAI,KAAK,WAAA,IAAe,CAAC,UAAA,CAAW,IAAA,CAAK,WAAW,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IAChB,CAAA,MAAO;AACH,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAEA,MAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,MAAA,OAAO,QAAA;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,cAAA,GAAuC;AAChD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,MAAM,MAAA,GAAS,UAAU,WAAW,CAAA;AAEpC,IAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAAA,EACjC;AACJ;ACpJA,IAAM,2BAAA,GAA8BC,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8BA,MAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuBA,MAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAOA,MAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAUA,MAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAcA,MAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAaA,KAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAYA,KAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQA,MAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACDA,MAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAIA,MAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAMA,KAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQA,MAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAWA,KAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC","file":"index.cjs","sourcesContent":["// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { decodeJwt } from 'jose'\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n\n/**\n * Extract a User ID from the `sub` claim of a JWT. Throws if `sub` is missing.\n *\n * @param token a base64 encoded JWT token\n * @returns\n */\nexport function jwtUserId(token: string): string {\n    const { sub } = decodeJwt(token)\n\n    if (!sub) {\n        throw new Error('token did not contain a subject field')\n    }\n\n    return sub\n}\n\n/**\n * Determine if a given JWT is still valid based on its expiry time.\n *\n * @param token a base64 encoded JWT token\n * @returns true if the token is expired, false if not\n */\nexport function jwtExpired(token: string): boolean {\n    try {\n        const payload = decodeJwt(token)\n        const now = Math.floor(Date.now() / 1000)\n        return typeof payload.exp === 'number' && payload.exp <= now\n    } catch {\n        return true\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials } from './auth-service.js'\nimport { SignJWT } from 'jose'\n\nexport class SelfSignedTokenService {\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            scope: credentials.scope || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport {\n    AccessTokenProvider,\n    AuthContext,\n    ClientCredentials,\n} from './auth-service'\nimport { jwtExpired, jwtUserId } from './auth-utils'\nimport { clientCredentialsService } from './client-credentials-service'\nimport { SelfSignedTokenService } from './self-signed-token-service'\nimport { Auth, Idp } from './config/schema'\n\ntype TokenProviderConfig =\n    | {\n          method: 'static'\n          token: string\n      }\n    | {\n          method: 'self_signed'\n          issuer: string\n          credentials: ClientCredentials\n      }\n    | {\n          method: 'client_credentials'\n          configUrl: string\n          credentials: ClientCredentials\n      }\n\n/**\n * AuthTokenProvider provides some common functionality across token providers.\n *\n *  1. Token caching: tokens are cached in-memory, so long as the token lifespan is not expired.\n *  2. Context retrieval: deriving a user context from the stored access token.\n *\n *\n * The following programmatic methods of token fetching are supported:\n *\n *  - `static`: a fixed, in-memory token. Only used for compatibility, it will totally break for expired tokens.\n *  - `self_signed`: only for development purposes, used for Canton setups that accept HMAC256 self signed tokens.\n *  - `client_credentials`: used to programmatically acquire tokens via oauth2, a.k.a \"machine-to-machine\" tokens.\n */\nexport class AuthTokenProvider implements AccessTokenProvider {\n    private cachedToken: string | undefined\n\n    constructor(\n        protected readonly config: TokenProviderConfig,\n        protected logger: Logger\n    ) {}\n\n    static fromToken(token: string, logger: Logger): AuthTokenProvider {\n        return new AuthTokenProvider({ method: 'static', token }, logger)\n    }\n\n    static fromGatewayConfig(\n        idp: Idp,\n        auth: Auth,\n        logger: Logger\n    ): AuthTokenProvider {\n        if (auth.method === 'self_signed') {\n            return new AuthTokenProvider(\n                {\n                    method: auth.method,\n                    issuer: auth.issuer,\n                    credentials: {\n                        clientId: auth.clientId,\n                        clientSecret: auth.clientSecret,\n                        scope: auth.scope,\n                        audience: auth.audience,\n                    },\n                },\n                logger\n            )\n        }\n\n        if (auth.method === 'client_credentials') {\n            if (idp.type === 'oauth')\n                return new AuthTokenProvider(\n                    {\n                        method: auth.method,\n                        configUrl: idp.configUrl,\n                        credentials: {\n                            clientId: auth.clientId,\n                            clientSecret: auth.clientSecret,\n                            scope: auth.scope,\n                            audience: auth.audience,\n                        },\n                    },\n                    logger\n                )\n            else {\n                throw new Error(\n                    `IDP type ${idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${auth.method} not supported for programmatic access token`\n        )\n    }\n\n    private async _fetchToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n\n        switch (this.config.method) {\n            case 'static':\n                return this.config.token\n            case 'self_signed':\n                return SelfSignedTokenService.fetchToken(\n                    this.logger,\n                    this.config.credentials,\n                    this.config.issuer\n                )\n            case 'client_credentials':\n                return clientCredentialsService(\n                    this.config.configUrl,\n                    this.logger\n                ).fetchToken(this.config.credentials)\n        }\n    }\n\n    /**\n     *\n     * @returns A valid JWT token retrieved according to the auth configuration given.\n     */\n    public async getAccessToken(): Promise<string> {\n        if (this.cachedToken && !jwtExpired(this.cachedToken)) {\n            return this.cachedToken\n        } else {\n            const newToken = await this._fetchToken()\n            if (jwtExpired(newToken)) {\n                throw new Error(\n                    'Attempted to refresh a token, but it came back expired.'\n                )\n            }\n\n            this.cachedToken = newToken\n            return newToken\n        }\n    }\n\n    /**\n     *\n     * @returns An AuthContext containing a valid token and userId.\n     */\n    public async getAuthContext(): Promise<AuthContext> {\n        const accessToken = await this.getAccessToken()\n        const userId = jwtUserId(accessToken)\n\n        return { accessToken, userId }\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n"]}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export * from './auth-service.js';
-export * from './client-credentials-service.js';
 export * from './auth-utils.js';
+export * from './client-credentials-service.js';
+export * from './auth-token-provider.js';
 export * from './config/schema.js';
 export * from './auth-token-provider.js';
-export * from './auth-token-provider-self-signed.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,mBAAmB,CAAA;AACjC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iCAAiC,CAAA;AAC/C,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,0BAA0B,CAAA"}

package/dist/index.js

@@ -1,6 +1,34 @@
+import { decodeJwt, SignJWT } from 'jose';
 import { providerErrors } from '@canton-network/core-rpc-errors';
 import { z } from 'zod';
-import { SignJWT } from 'jose';
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "" , value);
+function assertConnected(authContext) {
+  if (!authContext) {
+    throw providerErrors.unauthorized({
+      message: "User is not connected"
+    });
+  }
+  return authContext;
+}
+function jwtUserId(token) {
+  const { sub } = decodeJwt(token);
+  if (!sub) {
+    throw new Error("token did not contain a subject field");
+  }
+  return sub;
+}
+function jwtExpired(token) {
+  try {
+    const payload = decodeJwt(token);
+    const now = Math.floor(Date.now() / 1e3);
+    return typeof payload.exp === "number" && payload.exp <= now;
+  } catch {
+    return true;
+  }
+}
 
 // src/client-credentials-service.ts
 var ClientCredentialsService = class {
@@ -78,14 +106,120 @@ var ClientCredentialsService = class {
 var clientCredentialsService = (configUrl, logger) => ({
   fetchToken: async (credentials) => new ClientCredentialsService(configUrl, logger).fetchToken(credentials)
 });
-function assertConnected(authContext) {
-  if (!authContext) {
-    throw providerErrors.unauthorized({
-      message: "User is not connected"
-    });
+var SelfSignedTokenService = class {
+  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
+    const secret = new TextEncoder().encode(credentials.clientSecret);
+    const now = Math.floor(Date.now() / 1e3);
+    const jwt = await new SignJWT({
+      sub: credentials.clientId,
+      aud: credentials.audience || "",
+      scope: credentials.scope || "",
+      iat: now,
+      exp: now + expirySeconds,
+      iss: issuer
+    }).setProtectedHeader({ alg: "HS256" }).sign(secret);
+    logger.info(`Generated self-signed JWT token: ${jwt}`);
+    return jwt;
   }
-  return authContext;
-}
+};
+
+// src/auth-token-provider.ts
+var AuthTokenProvider = class _AuthTokenProvider {
+  constructor(config, logger) {
+    this.config = config;
+    this.logger = logger;
+    __publicField(this, "cachedToken");
+  }
+  static fromToken(token, logger) {
+    return new _AuthTokenProvider({ method: "static", token }, logger);
+  }
+  static fromGatewayConfig(idp, auth, logger) {
+    if (auth.method === "self_signed") {
+      return new _AuthTokenProvider(
+        {
+          method: auth.method,
+          issuer: auth.issuer,
+          credentials: {
+            clientId: auth.clientId,
+            clientSecret: auth.clientSecret,
+            scope: auth.scope,
+            audience: auth.audience
+          }
+        },
+        logger
+      );
+    }
+    if (auth.method === "client_credentials") {
+      if (idp.type === "oauth")
+        return new _AuthTokenProvider(
+          {
+            method: auth.method,
+            configUrl: idp.configUrl,
+            credentials: {
+              clientId: auth.clientId,
+              clientSecret: auth.clientSecret,
+              scope: auth.scope,
+              audience: auth.audience
+            }
+          },
+          logger
+        );
+      else {
+        throw new Error(
+          `IDP type ${idp.type} not supported for client_credentials auth`
+        );
+      }
+    }
+    throw new Error(
+      `Auth method ${auth.method} not supported for programmatic access token`
+    );
+  }
+  async _fetchToken() {
+    this.logger.debug("Fetching user auth token");
+    switch (this.config.method) {
+      case "static":
+        return this.config.token;
+      case "self_signed":
+        return SelfSignedTokenService.fetchToken(
+          this.logger,
+          this.config.credentials,
+          this.config.issuer
+        );
+      case "client_credentials":
+        return clientCredentialsService(
+          this.config.configUrl,
+          this.logger
+        ).fetchToken(this.config.credentials);
+    }
+  }
+  /**
+   *
+   * @returns A valid JWT token retrieved according to the auth configuration given.
+   */
+  async getAccessToken() {
+    if (this.cachedToken && !jwtExpired(this.cachedToken)) {
+      return this.cachedToken;
+    } else {
+      const newToken = await this._fetchToken();
+      if (jwtExpired(newToken)) {
+        throw new Error(
+          "Attempted to refresh a token, but it came back expired."
+        );
+      }
+      this.cachedToken = newToken;
+      return newToken;
+    }
+  }
+  /**
+   *
+   * @returns An AuthContext containing a valid token and userId.
+   */
+  async getAuthContext() {
+    const accessToken = await this.getAccessToken();
+    const userId = jwtUserId(accessToken);
+    return { accessToken, userId };
+  }
+};
 var authorizationCodeAuthSchema = z.object({
   method: z.literal("authorization_code"),
   audience: z.string(),
@@ -125,134 +259,7 @@ var idpSchema = z.discriminatedUnion("type", [
     configUrl: z.string().url()
   })
 ]);
-var AuthTokenProviderSelfSigned = class _AuthTokenProviderSelfSigned {
-  constructor(auth, authAdmin, logger, expirySeconds = 3600) {
-    this.auth = auth;
-    this.authAdmin = authAdmin;
-    this.logger = logger;
-    this.expirySeconds = expirySeconds;
-  }
-  async getUserAccessToken() {
-    this.logger.debug("Fetching self-signed user auth token");
-    return _AuthTokenProviderSelfSigned.fetchToken(
-      this.logger,
-      {
-        clientId: this.auth.clientId,
-        clientSecret: this.auth.clientSecret,
-        scope: this.auth.scope,
-        audience: this.auth.audience
-      },
-      this.auth.issuer,
-      this.expirySeconds
-    );
-  }
-  async getAdminAccessToken() {
-    this.logger.debug("Fetching self-signed admin auth token");
-    if (!this.authAdmin) {
-      throw new Error("Admin credentials are not configured");
-    }
-    return _AuthTokenProviderSelfSigned.fetchToken(
-      this.logger,
-      {
-        clientId: this.authAdmin.clientId,
-        clientSecret: this.authAdmin.clientSecret,
-        scope: this.authAdmin.scope,
-        audience: this.authAdmin.audience
-      },
-      this.authAdmin.issuer,
-      this.expirySeconds
-    );
-  }
-  static async fetchToken(logger, credentials, issuer, expirySeconds = 3600) {
-    const secret = new TextEncoder().encode(credentials.clientSecret);
-    const now = Math.floor(Date.now() / 1e3);
-    const jwt = await new SignJWT({
-      sub: credentials.clientId,
-      aud: credentials.audience || "",
-      scope: credentials.scope || "",
-      iat: now,
-      exp: now + expirySeconds,
-      iss: issuer
-    }).setProtectedHeader({ alg: "HS256" }).sign(secret);
-    logger.info(`Generated self-signed JWT token: ${jwt}`);
-    return jwt;
-  }
-};
-
-// src/auth-token-provider.ts
-var AuthTokenProvider = class {
-  constructor(idp, auth, adminAuth, logger) {
-    this.idp = idp;
-    this.auth = auth;
-    this.adminAuth = adminAuth;
-    this.logger = logger;
-  }
-  async getUserAccessToken() {
-    this.logger.debug("Fetching user auth token");
-    if (this.auth.method === "self_signed")
-      return new AuthTokenProviderSelfSigned(
-        this.auth,
-        this.adminAuth,
-        this.logger
-      ).getUserAccessToken();
-    if (this.auth.method === "client_credentials") {
-      if (this.idp.type === "oauth")
-        return clientCredentialsService(
-          this.idp.configUrl,
-          this.logger
-        ).fetchToken({
-          clientId: this.auth.clientId,
-          clientSecret: this.auth.clientSecret,
-          scope: this.auth.scope,
-          audience: this.auth.audience
-        });
-      else {
-        throw new Error(
-          `IDP type ${this.idp.type} not supported for client_credentials auth`
-        );
-      }
-    }
-    throw new Error(
-      `Auth method ${this.auth.method} not supported for user access token`
-    );
-  }
-  async getAdminAccessToken() {
-    this.logger.debug("Fetching admin auth token");
-    if (this.adminAuth.method === "self_signed")
-      return new AuthTokenProviderSelfSigned(
-        this.auth,
-        this.adminAuth,
-        this.logger
-      ).getAdminAccessToken();
-    if (!this.adminAuth) {
-      throw new Error(
-        `No admin credentials configured for auth type ${this.auth.method}`
-      );
-    }
-    if (this.adminAuth.method === "client_credentials") {
-      if (this.idp.type === "oauth")
-        return clientCredentialsService(
-          this.idp.configUrl,
-          this.logger
-        ).fetchToken({
-          clientId: this.adminAuth.clientId,
-          clientSecret: this.adminAuth.clientSecret,
-          scope: this.adminAuth.scope,
-          audience: this.adminAuth.audience
-        });
-      else {
-        throw new Error(
-          `IDP type ${this.idp.type} not supported for client_credentials auth`
-        );
-      }
-    } else {
-      throw new Error(
-        `Auth method ${this.auth.method} not supported for admin access token`
-      );
-    }
-  }
-};
 
-export { AuthTokenProvider, AuthTokenProviderSelfSigned, ClientCredentialsService, assertConnected, authSchema, clientCredentialsService, idpSchema };
+export { AuthTokenProvider, ClientCredentialsService, assertConnected, authSchema, clientCredentialsService, idpSchema, jwtExpired, jwtUserId };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client-credentials-service.ts","../src/auth-utils.ts","../src/config/schema.ts","../src/auth-token-provider-self-signed.ts","../src/auth-token-provider.ts"],"names":[],"mappings":";;;;;AAMO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC5FO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,eAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;ACVA,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAa,CAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAY,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQ,EAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC;AC5CM,IAAM,2BAAA,GAAN,MAAM,4BAAA,CAA2D;AAAA,EACpE,WAAA,CACY,IAAA,EACA,SAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EAClC;AAJU,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,sCAAsC,CAAA;AACxD,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,QACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,QACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,QACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,OACxB;AAAA,MACA,KAAK,IAAA,CAAK,MAAA;AAAA,MACV,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,uCAAuC,CAAA;AACzD,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IAC1D;AACA,IAAA,OAAO,4BAAA,CAA4B,UAAA;AAAA,MAC/B,IAAA,CAAK,MAAA;AAAA,MACL;AAAA,QACI,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,QACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,QAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,QACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,OAC7B;AAAA,MACA,KAAK,SAAA,CAAU,MAAA;AAAA,MACf,IAAA,CAAK;AAAA,KACT;AAAA,EACJ;AAAA,EAEA,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAI,OAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ;;;AC9DO,IAAM,oBAAN,MAAuD;AAAA,EAC1D,WAAA,CACY,GAAA,EACA,IAAA,EACA,SAAA,EACA,MAAA,EACV;AAJU,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA,EAEH,MAAM,kBAAA,GAAsC;AACxC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAC5C,IAAA,IAAI,IAAA,CAAK,KAAK,MAAA,KAAW,aAAA;AACrB,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,kBAAA,EAAmB;AAEzB,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,MAAA,KAAW,oBAAA,EAAsB;AAC3C,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,IAAA,CAAK,QAAA;AAAA,UACpB,YAAA,EAAc,KAAK,IAAA,CAAK,YAAA;AAAA,UACxB,KAAA,EAAO,KAAK,IAAA,CAAK,KAAA;AAAA,UACjB,QAAA,EAAU,KAAK,IAAA,CAAK;AAAA,SACvB,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,oCAAA;AAAA,KACnC;AAAA,EACJ;AAAA,EAEA,MAAM,mBAAA,GAAuC;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,2BAA2B,CAAA;AAC7C,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,KAAW,aAAA;AAC1B,MAAA,OAAO,IAAI,2BAAA;AAAA,QACP,IAAA,CAAK,IAAA;AAAA,QACL,IAAA,CAAK,SAAA;AAAA,QACL,IAAA,CAAK;AAAA,QACP,mBAAA,EAAoB;AAE1B,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACjB,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,8CAAA,EAAiD,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA;AAAA,OACrE;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,KAAW,oBAAA,EAAsB;AAChD,MAAA,IAAI,IAAA,CAAK,IAAI,IAAA,KAAS,OAAA;AAClB,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,GAAA,CAAI,SAAA;AAAA,UACT,IAAA,CAAK;AAAA,UACP,UAAA,CAAW;AAAA,UACT,QAAA,EAAU,KAAK,SAAA,CAAU,QAAA;AAAA,UACzB,YAAA,EAAc,KAAK,SAAA,CAAU,YAAA;AAAA,UAC7B,KAAA,EAAO,KAAK,SAAA,CAAU,KAAA;AAAA,UACtB,QAAA,EAAU,KAAK,SAAA,CAAU;AAAA,SAC5B,CAAA;AAAA,WACA;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,0CAAA;AAAA,SAC7B;AAAA,MACJ;AAAA,IACJ,CAAA,MAAO;AACH,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,YAAA,EAAe,IAAA,CAAK,IAAA,CAAK,MAAM,CAAA,qCAAA;AAAA,OACnC;AAAA,IACJ;AAAA,EACJ;AACJ","file":"index.js","sourcesContent":["// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider, ClientCredentials } from './auth-service.js'\nimport { SelfSignedAuth } from './config/schema.js'\nimport { SignJWT } from 'jose'\n\nexport class AuthTokenProviderSelfSigned implements AccessTokenProvider {\n    constructor(\n        private auth: SelfSignedAuth,\n        private authAdmin: SelfSignedAuth,\n        private logger: Logger,\n        private expirySeconds: number = 3600\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed user auth token')\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.auth.clientId,\n                clientSecret: this.auth.clientSecret,\n                scope: this.auth.scope,\n                audience: this.auth.audience,\n            },\n            this.auth.issuer,\n            this.expirySeconds\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching self-signed admin auth token')\n        if (!this.authAdmin) {\n            throw new Error('Admin credentials are not configured')\n        }\n        return AuthTokenProviderSelfSigned.fetchToken(\n            this.logger,\n            {\n                clientId: this.authAdmin.clientId,\n                clientSecret: this.authAdmin.clientSecret,\n                scope: this.authAdmin.scope,\n                audience: this.authAdmin.audience,\n            },\n            this.authAdmin.issuer,\n            this.expirySeconds\n        )\n    }\n\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            scope: credentials.scope || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { AccessTokenProvider } from './auth-service.js'\nimport { Auth, Idp, SelfSignedAuth } from './config/schema.js'\nimport { AuthTokenProviderSelfSigned } from './auth-token-provider-self-signed.js'\nimport { clientCredentialsService } from './client-credentials-service.js'\n\nexport class AuthTokenProvider implements AccessTokenProvider {\n    constructor(\n        private idp: Idp,\n        private auth: Auth,\n        private adminAuth: Auth,\n        private logger: Logger\n    ) {}\n\n    async getUserAccessToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n        if (this.auth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getUserAccessToken()\n\n        if (this.auth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.auth.clientId,\n                    clientSecret: this.auth.clientSecret,\n                    scope: this.auth.scope,\n                    audience: this.auth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${this.auth.method} not supported for user access token`\n        )\n    }\n\n    async getAdminAccessToken(): Promise<string> {\n        this.logger.debug('Fetching admin auth token')\n        if (this.adminAuth.method === 'self_signed')\n            return new AuthTokenProviderSelfSigned(\n                this.auth as SelfSignedAuth,\n                this.adminAuth as SelfSignedAuth,\n                this.logger\n            ).getAdminAccessToken()\n\n        if (!this.adminAuth) {\n            throw new Error(\n                `No admin credentials configured for auth type ${this.auth.method}`\n            )\n        }\n\n        if (this.adminAuth.method === 'client_credentials') {\n            if (this.idp.type === 'oauth')\n                return clientCredentialsService(\n                    this.idp.configUrl,\n                    this.logger\n                ).fetchToken({\n                    clientId: this.adminAuth.clientId,\n                    clientSecret: this.adminAuth.clientSecret,\n                    scope: this.adminAuth.scope,\n                    audience: this.adminAuth.audience,\n                })\n            else {\n                throw new Error(\n                    `IDP type ${this.idp.type} not supported for client_credentials auth`\n                )\n            }\n        } else {\n            throw new Error(\n                `Auth method ${this.auth.method} not supported for admin access token`\n            )\n        }\n    }\n}\n"]}
+{"version":3,"sources":["../src/auth-utils.ts","../src/client-credentials-service.ts","../src/self-signed-token-service.ts","../src/auth-token-provider.ts","../src/config/schema.ts"],"names":[],"mappings":";;;;;;;AAOO,SAAS,gBACZ,WAAA,EACW;AACX,EAAA,IAAI,CAAC,WAAA,EAAa;AACd,IAAA,MAAM,eAAe,YAAA,CAAa;AAAA,MAC9B,OAAA,EAAS;AAAA,KACZ,CAAA;AAAA,EACL;AACA,EAAA,OAAO,WAAA;AACX;AAQO,SAAS,UAAU,KAAA,EAAuB;AAC7C,EAAA,MAAM,EAAE,GAAA,EAAI,GAAI,SAAA,CAAU,KAAK,CAAA;AAE/B,EAAA,IAAI,CAAC,GAAA,EAAK;AACN,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EAC3D;AAEA,EAAA,OAAO,GAAA;AACX;AAQO,SAAS,WAAW,KAAA,EAAwB;AAC/C,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAU,UAAU,KAAK,CAAA;AAC/B,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,OAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,QAAQ,GAAA,IAAO,GAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,IAAA;AAAA,EACX;AACJ;;;AC1CO,IAAM,2BAAN,MAA+B;AAAA,EAClC,WAAA,CACY,WACA,MAAA,EACV;AAFU,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,MAAM,WAAW,WAAA,EAAiD;AAC9D,IAAA,IAAI;AACA,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,aAAA,CAAc,KAAK,SAAS,CAAA;AAC1D,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA,CAAM,EAAE,UAAA,IAAc,qBAAqB,CAAA;AAExD,MAAA,MAAM,GAAA,GAAgB,MAAM,IAAA,CAAK,kBAAA;AAAA,QAC7B,UAAA,CAAW,cAAA;AAAA,QACX;AAAA,OACJ;AACA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAE5B,MAAA,IAAA,CAAK,MAAA,EAAQ,IAAA;AAAA,QACT,EAAE,UAAU,IAAA,EAAK;AAAA,QACjB,CAAA,kCAAA,EAAqC,YAAY,QAAQ,CAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACpB,QAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,MAChE;AAEA,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IAChB,SAAS,KAAA,EAAO;AACZ,MAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,EAAE,GAAA,EAAK,KAAA,IAAS,6BAA6B,CAAA;AAChE,MAAA,MAAM,KAAA;AAAA,IACV;AAAA,EACJ;AAAA,EAEA,MAAM,kBAAA,CACF,aAAA,EACA,WAAA,EACiB;AACjB,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAC/B,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,WAAA,CAAY,QAAA;AAAA,MACvB,eAAe,WAAA,CAAY,YAAA;AAAA,MAC3B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,QAAA,EAAU,YAAY,QAAA,IAAY;AAAA,KACrC,CAAA;AAED,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MACnC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,OAAO,QAAA;AAAS,KACzB,CAAA;AAED,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,UAAA,EAAY,IAAI,UAAA,EAAW;AAAA,QACjD;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACzD;AAAA,IACJ;AAEA,IAAA,OAAO,GAAA;AAAA,EACX;AAAA,EAEA,MAAM,cAAc,GAAA,EAAkC;AAClD,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACT,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,IAAA,CAAK,MAAA,EAAQ,KAAA;AAAA,QACT,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,YAAY,GAAA,CAAI,UAAA,EAAY,MAAM,IAAA,EAAK;AAAA,QAC7D;AAAA,OACJ;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACN,CAAA,mBAAA,EAAsB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA;AAAA,OACtD;AAAA,IACJ;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EACpB;AACJ;AAEO,IAAM,wBAAA,GAA2B,CACpC,SAAA,EACA,MAAA,MACE;AAAA,EACF,UAAA,EAAY,OAAO,WAAA,KACf,IAAI,yBAAyB,SAAA,EAAW,MAAM,CAAA,CAAE,UAAA,CAAW,WAAW;AAC9E,CAAA;AC3FO,IAAM,yBAAN,MAA6B;AAAA,EAChC,aAAa,UAAA,CACT,MAAA,EACA,WAAA,EACA,MAAA,EACA,gBAAwB,IAAA,EACT;AACf,IAAA,MAAM,SAAS,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,YAAY,YAAY,CAAA;AAChE,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AACxC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAI,OAAA,CAAQ;AAAA,MAC1B,KAAK,WAAA,CAAY,QAAA;AAAA,MACjB,GAAA,EAAK,YAAY,QAAA,IAAY,EAAA;AAAA,MAC7B,KAAA,EAAO,YAAY,KAAA,IAAS,EAAA;AAAA,MAC5B,GAAA,EAAK,GAAA;AAAA,MACL,KAAK,GAAA,GAAM,aAAA;AAAA,MACX,GAAA,EAAK;AAAA,KACR,EACI,kBAAA,CAAmB,EAAE,KAAK,OAAA,EAAS,CAAA,CACnC,IAAA,CAAK,MAAM,CAAA;AAEhB,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,iCAAA,EAAoC,GAAG,CAAA,CAAE,CAAA;AACrD,IAAA,OAAO,GAAA;AAAA,EACX;AACJ,CAAA;;;ACaO,IAAM,iBAAA,GAAN,MAAM,kBAAA,CAAiD;AAAA,EAG1D,WAAA,CACuB,QACT,MAAA,EACZ;AAFqB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACT,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAJd,IAAA,aAAA,CAAA,IAAA,EAAQ,aAAA,CAAA;AAAA,EAKL;AAAA,EAEH,OAAO,SAAA,CAAU,KAAA,EAAe,MAAA,EAAmC;AAC/D,IAAA,OAAO,IAAI,kBAAA,CAAkB,EAAE,QAAQ,QAAA,EAAU,KAAA,IAAS,MAAM,CAAA;AAAA,EACpE;AAAA,EAEA,OAAO,iBAAA,CACH,GAAA,EACA,IAAA,EACA,MAAA,EACiB;AACjB,IAAA,IAAI,IAAA,CAAK,WAAW,aAAA,EAAe;AAC/B,MAAA,OAAO,IAAI,kBAAA;AAAA,QACP;AAAA,UACI,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,WAAA,EAAa;AAAA,YACT,UAAU,IAAA,CAAK,QAAA;AAAA,YACf,cAAc,IAAA,CAAK,YAAA;AAAA,YACnB,OAAO,IAAA,CAAK,KAAA;AAAA,YACZ,UAAU,IAAA,CAAK;AAAA;AACnB,SACJ;AAAA,QACA;AAAA,OACJ;AAAA,IACJ;AAEA,IAAA,IAAI,IAAA,CAAK,WAAW,oBAAA,EAAsB;AACtC,MAAA,IAAI,IAAI,IAAA,KAAS,OAAA;AACb,QAAA,OAAO,IAAI,kBAAA;AAAA,UACP;AAAA,YACI,QAAQ,IAAA,CAAK,MAAA;AAAA,YACb,WAAW,GAAA,CAAI,SAAA;AAAA,YACf,WAAA,EAAa;AAAA,cACT,UAAU,IAAA,CAAK,QAAA;AAAA,cACf,cAAc,IAAA,CAAK,YAAA;AAAA,cACnB,OAAO,IAAA,CAAK,KAAA;AAAA,cACZ,UAAU,IAAA,CAAK;AAAA;AACnB,WACJ;AAAA,UACA;AAAA,SACJ;AAAA,WACC;AACD,QAAA,MAAM,IAAI,KAAA;AAAA,UACN,CAAA,SAAA,EAAY,IAAI,IAAI,CAAA,0CAAA;AAAA,SACxB;AAAA,MACJ;AAAA,IACJ;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACN,CAAA,YAAA,EAAe,KAAK,MAAM,CAAA,4CAAA;AAAA,KAC9B;AAAA,EACJ;AAAA,EAEA,MAAc,WAAA,GAA+B;AACzC,IAAA,IAAA,CAAK,MAAA,CAAO,MAAM,0BAA0B,CAAA;AAE5C,IAAA,QAAQ,IAAA,CAAK,OAAO,MAAA;AAAQ,MACxB,KAAK,QAAA;AACD,QAAA,OAAO,KAAK,MAAA,CAAO,KAAA;AAAA,MACvB,KAAK,aAAA;AACD,QAAA,OAAO,sBAAA,CAAuB,UAAA;AAAA,UAC1B,IAAA,CAAK,MAAA;AAAA,UACL,KAAK,MAAA,CAAO,WAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SAChB;AAAA,MACJ,KAAK,oBAAA;AACD,QAAA,OAAO,wBAAA;AAAA,UACH,KAAK,MAAA,CAAO,SAAA;AAAA,UACZ,IAAA,CAAK;AAAA,SACT,CAAE,UAAA,CAAW,IAAA,CAAK,MAAA,CAAO,WAAW,CAAA;AAAA;AAC5C,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,cAAA,GAAkC;AAC3C,IAAA,IAAI,KAAK,WAAA,IAAe,CAAC,UAAA,CAAW,IAAA,CAAK,WAAW,CAAA,EAAG;AACnD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IAChB,CAAA,MAAO;AACH,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,WAAA,EAAY;AACxC,MAAA,IAAI,UAAA,CAAW,QAAQ,CAAA,EAAG;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACN;AAAA,SACJ;AAAA,MACJ;AAEA,MAAA,IAAA,CAAK,WAAA,GAAc,QAAA;AACnB,MAAA,OAAO,QAAA;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,cAAA,GAAuC;AAChD,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,cAAA,EAAe;AAC9C,IAAA,MAAM,MAAA,GAAS,UAAU,WAAW,CAAA;AAEpC,IAAA,OAAO,EAAE,aAAa,MAAA,EAAO;AAAA,EACjC;AACJ;ACpJA,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA;AAChB,CAAC,CAAA;AAED,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EACzC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,oBAAoB,CAAA;AAAA,EACtC,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAED,IAAM,oBAAA,GAAuB,EAAE,MAAA,CAAO;AAAA,EAClC,MAAA,EAAQ,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC/B,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,EACjB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,EAChB,QAAA,EAAU,EAAE,MAAA,EAAO;AAAA,EACnB,YAAA,EAAc,EAAE,MAAA;AACpB,CAAC,CAAA;AAEM,IAAM,UAAA,GAAa,CAAA,CAAE,kBAAA,CAAmB,QAAA,EAAU;AAAA,EACrD,2BAAA;AAAA,EACA,2BAAA;AAAA,EACA;AACJ,CAAC;AAOM,IAAM,SAAA,GAAY,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAClD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,IAC7B,MAAA,EAAQ,EAAE,MAAA;AAAO,GACpB,CAAA;AAAA,EACD,EAAE,MAAA,CAAO;AAAA,IACL,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,IACb,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,OAAO,CAAA;AAAA,IACvB,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,IACjB,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA;AAAI,GAC7B;AACL,CAAC","file":"index.js","sourcesContent":["// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { decodeJwt } from 'jose'\nimport { AuthContext } from './auth-service'\nimport { providerErrors } from '@canton-network/core-rpc-errors'\n\nexport function assertConnected(\n    authContext: AuthContext | undefined\n): AuthContext {\n    if (!authContext) {\n        throw providerErrors.unauthorized({\n            message: 'User is not connected',\n        })\n    }\n    return authContext\n}\n\n/**\n * Extract a User ID from the `sub` claim of a JWT. Throws if `sub` is missing.\n *\n * @param token a base64 encoded JWT token\n * @returns\n */\nexport function jwtUserId(token: string): string {\n    const { sub } = decodeJwt(token)\n\n    if (!sub) {\n        throw new Error('token did not contain a subject field')\n    }\n\n    return sub\n}\n\n/**\n * Determine if a given JWT is still valid based on its expiry time.\n *\n * @param token a base64 encoded JWT token\n * @returns true if the token is expired, false if not\n */\nexport function jwtExpired(token: string): boolean {\n    try {\n        const payload = decodeJwt(token)\n        const now = Math.floor(Date.now() / 1000)\n        return typeof payload.exp === 'number' && payload.exp <= now\n    } catch {\n        return true\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials, OIDCConfig } from './auth-service.js'\n\nexport class ClientCredentialsService {\n    constructor(\n        private configUrl: string,\n        private logger: Logger | undefined\n    ) {}\n\n    /**\n     * Fetches the JWT token (M2M) using client credentials.\n     *\n     * @returns The JWT access token as a string.\n     * @throws If fetching the token fails or the response is invalid.\n     */\n    async fetchToken(credentials: ClientCredentials): Promise<string> {\n        try {\n            const oidcConfig = await this.getOIDCConfig(this.configUrl)\n            this.logger?.debug({ oidcConfig }, 'Fetched OIDC config')\n\n            const res: Response = await this.fetchTokenEndpoint(\n                oidcConfig.token_endpoint,\n                credentials\n            )\n            const json = await res.json()\n\n            this.logger?.info(\n                { response: json },\n                `Fetched admin token for clientId: ${credentials.clientId}`\n            )\n\n            if (!json.access_token) {\n                throw new Error('No access_token in token endpoint response')\n            }\n\n            return json.access_token\n        } catch (error) {\n            this.logger?.error({ err: error }, 'Failed to fetch admin token')\n            throw error\n        }\n    }\n\n    async fetchTokenEndpoint(\n        tokenEndpoint: string,\n        credentials: ClientCredentials\n    ): Promise<Response> {\n        const params = new URLSearchParams({\n            grant_type: 'client_credentials',\n            client_id: credentials.clientId,\n            client_secret: credentials.clientSecret,\n            scope: credentials.scope ?? '',\n            audience: credentials.audience ?? '',\n        })\n\n        const res = await fetch(tokenEndpoint, {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n            body: params.toString(),\n        })\n\n        if (!res.ok) {\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText },\n                'Token endpoint error'\n            )\n            throw new Error(\n                `Token endpoint error: ${res.status} ${res.statusText}`\n            )\n        }\n\n        return res\n    }\n\n    async getOIDCConfig(url: string): Promise<OIDCConfig> {\n        const res = await fetch(url)\n        if (!res.ok) {\n            const text = await res.text()\n            this.logger?.error(\n                { status: res.status, statusText: res.statusText, body: text },\n                'Failed to fetch OIDC config'\n            )\n            throw new Error(\n                `OIDC config error: ${res.status} ${res.statusText}`\n            )\n        }\n        return res.json()\n    }\n}\n\nexport const clientCredentialsService = (\n    configUrl: string,\n    logger: Logger | undefined\n) => ({\n    fetchToken: async (credentials: ClientCredentials) =>\n        new ClientCredentialsService(configUrl, logger).fetchToken(credentials),\n})\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport { ClientCredentials } from './auth-service.js'\nimport { SignJWT } from 'jose'\n\nexport class SelfSignedTokenService {\n    static async fetchToken(\n        logger: Logger,\n        credentials: ClientCredentials,\n        issuer: string,\n        expirySeconds: number = 3600\n    ): Promise<string> {\n        const secret = new TextEncoder().encode(credentials.clientSecret)\n        const now = Math.floor(Date.now() / 1000)\n        const jwt = await new SignJWT({\n            sub: credentials.clientId,\n            aud: credentials.audience || '',\n            scope: credentials.scope || '',\n            iat: now,\n            exp: now + expirySeconds,\n            iss: issuer,\n        })\n            .setProtectedHeader({ alg: 'HS256' })\n            .sign(secret)\n\n        logger.info(`Generated self-signed JWT token: ${jwt}`)\n        return jwt\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Logger } from '@canton-network/core-types'\nimport {\n    AccessTokenProvider,\n    AuthContext,\n    ClientCredentials,\n} from './auth-service'\nimport { jwtExpired, jwtUserId } from './auth-utils'\nimport { clientCredentialsService } from './client-credentials-service'\nimport { SelfSignedTokenService } from './self-signed-token-service'\nimport { Auth, Idp } from './config/schema'\n\ntype TokenProviderConfig =\n    | {\n          method: 'static'\n          token: string\n      }\n    | {\n          method: 'self_signed'\n          issuer: string\n          credentials: ClientCredentials\n      }\n    | {\n          method: 'client_credentials'\n          configUrl: string\n          credentials: ClientCredentials\n      }\n\n/**\n * AuthTokenProvider provides some common functionality across token providers.\n *\n *  1. Token caching: tokens are cached in-memory, so long as the token lifespan is not expired.\n *  2. Context retrieval: deriving a user context from the stored access token.\n *\n *\n * The following programmatic methods of token fetching are supported:\n *\n *  - `static`: a fixed, in-memory token. Only used for compatibility, it will totally break for expired tokens.\n *  - `self_signed`: only for development purposes, used for Canton setups that accept HMAC256 self signed tokens.\n *  - `client_credentials`: used to programmatically acquire tokens via oauth2, a.k.a \"machine-to-machine\" tokens.\n */\nexport class AuthTokenProvider implements AccessTokenProvider {\n    private cachedToken: string | undefined\n\n    constructor(\n        protected readonly config: TokenProviderConfig,\n        protected logger: Logger\n    ) {}\n\n    static fromToken(token: string, logger: Logger): AuthTokenProvider {\n        return new AuthTokenProvider({ method: 'static', token }, logger)\n    }\n\n    static fromGatewayConfig(\n        idp: Idp,\n        auth: Auth,\n        logger: Logger\n    ): AuthTokenProvider {\n        if (auth.method === 'self_signed') {\n            return new AuthTokenProvider(\n                {\n                    method: auth.method,\n                    issuer: auth.issuer,\n                    credentials: {\n                        clientId: auth.clientId,\n                        clientSecret: auth.clientSecret,\n                        scope: auth.scope,\n                        audience: auth.audience,\n                    },\n                },\n                logger\n            )\n        }\n\n        if (auth.method === 'client_credentials') {\n            if (idp.type === 'oauth')\n                return new AuthTokenProvider(\n                    {\n                        method: auth.method,\n                        configUrl: idp.configUrl,\n                        credentials: {\n                            clientId: auth.clientId,\n                            clientSecret: auth.clientSecret,\n                            scope: auth.scope,\n                            audience: auth.audience,\n                        },\n                    },\n                    logger\n                )\n            else {\n                throw new Error(\n                    `IDP type ${idp.type} not supported for client_credentials auth`\n                )\n            }\n        }\n\n        throw new Error(\n            `Auth method ${auth.method} not supported for programmatic access token`\n        )\n    }\n\n    private async _fetchToken(): Promise<string> {\n        this.logger.debug('Fetching user auth token')\n\n        switch (this.config.method) {\n            case 'static':\n                return this.config.token\n            case 'self_signed':\n                return SelfSignedTokenService.fetchToken(\n                    this.logger,\n                    this.config.credentials,\n                    this.config.issuer\n                )\n            case 'client_credentials':\n                return clientCredentialsService(\n                    this.config.configUrl,\n                    this.logger\n                ).fetchToken(this.config.credentials)\n        }\n    }\n\n    /**\n     *\n     * @returns A valid JWT token retrieved according to the auth configuration given.\n     */\n    public async getAccessToken(): Promise<string> {\n        if (this.cachedToken && !jwtExpired(this.cachedToken)) {\n            return this.cachedToken\n        } else {\n            const newToken = await this._fetchToken()\n            if (jwtExpired(newToken)) {\n                throw new Error(\n                    'Attempted to refresh a token, but it came back expired.'\n                )\n            }\n\n            this.cachedToken = newToken\n            return newToken\n        }\n    }\n\n    /**\n     *\n     * @returns An AuthContext containing a valid token and userId.\n     */\n    public async getAuthContext(): Promise<AuthContext> {\n        const accessToken = await this.getAccessToken()\n        const userId = jwtUserId(accessToken)\n\n        return { accessToken, userId }\n    }\n}\n","// Copyright (c) 2025-2026 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from 'zod'\n\nconst authorizationCodeAuthSchema = z.object({\n    method: z.literal('authorization_code'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n})\n\nconst clientCredentialsAuthSchema = z.object({\n    method: z.literal('client_credentials'),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nconst selfSignedAuthSchema = z.object({\n    method: z.literal('self_signed'),\n    issuer: z.string(),\n    audience: z.string(),\n    scope: z.string(),\n    clientId: z.string(),\n    clientSecret: z.string(),\n})\n\nexport const authSchema = z.discriminatedUnion('method', [\n    authorizationCodeAuthSchema,\n    clientCredentialsAuthSchema,\n    selfSignedAuthSchema,\n])\n\nexport type Auth = z.infer<typeof authSchema>\nexport type AuthorizationCodeAuth = z.infer<typeof authorizationCodeAuthSchema>\nexport type ClientCredentialsAuth = z.infer<typeof clientCredentialsAuthSchema>\nexport type SelfSignedAuth = z.infer<typeof selfSignedAuthSchema>\n\nexport const idpSchema = z.discriminatedUnion('type', [\n    z.object({\n        id: z.string(),\n        type: z.literal('self_signed'),\n        issuer: z.string(),\n    }),\n    z.object({\n        id: z.string(),\n        type: z.literal('oauth'),\n        issuer: z.string(),\n        configUrl: z.string().url(),\n    }),\n])\n\nexport type Idp = z.infer<typeof idpSchema>\n"]}

package/dist/self-signed-token-service.d.ts

@@ -0,0 +1,6 @@
+import { Logger } from '@canton-network/core-types';
+import { ClientCredentials } from './auth-service.js';
+export declare class SelfSignedTokenService {
+    static fetchToken(logger: Logger, credentials: ClientCredentials, issuer: string, expirySeconds?: number): Promise<string>;
+}
+//# sourceMappingURL=self-signed-token-service.d.ts.map

package/dist/self-signed-token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-signed-token-service.d.ts","sourceRoot":"","sources":["../src/self-signed-token-service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAGrD,qBAAa,sBAAsB;WAClB,UAAU,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa,GAC7B,OAAO,CAAC,MAAM,CAAC;CAiBrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canton-network/core-wallet-auth",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "type": "module",
   "description": "Provides authentication middleware and user management for the Wallet Gateway",
   "license": "Apache-2.0",
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@jest/globals": "^30.2.0",
-    "@swc/core": "^1.15.10",
+    "@swc/core": "^1.15.18",
     "@swc/jest": "^0.2.39",
     "@types/jest": "^30.0.0",
     "jest": "^30.2.0",
@@ -36,10 +36,10 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@canton-network/core-rpc-errors": "^0.17.0",
-    "@canton-network/core-types": "^0.20.0",
+    "@canton-network/core-rpc-errors": "^0.18.1",
+    "@canton-network/core-types": "^0.22.0",
     "jose": "^6.1.3",
-    "zod": "^4.3.5"
+    "zod": "^4.3.6"
   },
   "files": [
     "dist/**"

package/dist/auth-token-provider-self-signed.d.ts

@@ -1,14 +0,0 @@
-import { Logger } from '@canton-network/core-types';
-import { AccessTokenProvider, ClientCredentials } from './auth-service.js';
-import { SelfSignedAuth } from './config/schema.js';
-export declare class AuthTokenProviderSelfSigned implements AccessTokenProvider {
-    private auth;
-    private authAdmin;
-    private logger;
-    private expirySeconds;
-    constructor(auth: SelfSignedAuth, authAdmin: SelfSignedAuth, logger: Logger, expirySeconds?: number);
-    getUserAccessToken(): Promise<string>;
-    getAdminAccessToken(): Promise<string>;
-    static fetchToken(logger: Logger, credentials: ClientCredentials, issuer: string, expirySeconds?: number): Promise<string>;
-}
-//# sourceMappingURL=auth-token-provider-self-signed.d.ts.map

package/dist/auth-token-provider-self-signed.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-token-provider-self-signed.d.ts","sourceRoot":"","sources":["../src/auth-token-provider-self-signed.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGnD,qBAAa,2BAA4B,YAAW,mBAAmB;IAE/D,OAAO,CAAC,IAAI;IACZ,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,aAAa;gBAHb,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa;IAGlC,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAerC,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;WAkB/B,UAAU,CACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,aAAa,GAAE,MAAa,GAC7B,OAAO,CAAC,MAAM,CAAC;CAiBrB"}