@cauthyhq/node 1.0.0 → 1.1.0

package/dist/index.mjs

@@ -1745,6 +1745,7 @@ function createTokenVerifier(options = {}) {
     if (claims.roles !== void 0 && claims.roles !== null && !(Array.isArray(claims.roles) && claims.roles.every((r) => typeof r === "string"))) bad("roles");
     if (claims.email !== void 0 && typeof claims.email !== "string") bad("email");
     for (const name of ["email_verified", "anon"]) if (claims[name] !== void 0 && typeof claims[name] !== "boolean") bad(name);
+    for (const name of ["token_use", "azp"]) if (claims[name] !== void 0 && typeof claims[name] !== "string") bad(name);
     if (!issuers.includes(claims.iss)) throw new CauthyTokenError("wrong_issuer");
     if (!(Array.isArray(aud) ? aud.includes(audience) : aud === audience)) throw new CauthyTokenError("wrong_audience");
     const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
@@ -1753,7 +1754,9 @@ function createTokenVerifier(options = {}) {
     if (now < claims.iat - leeway) throw new CauthyTokenError("issued_in_future");
     if (claims.tid !== tenant) throw new CauthyTokenError("wrong_tenant");
     if ("sys" in claims && !options.allowSystem) throw new CauthyTokenError("system_token");
+    if ("token_use" in claims && !options.allowClientTokens) throw new CauthyTokenError("client_token");
     if (claims.anon === true && !options.allowAnonymous) throw new CauthyTokenError("anonymous_token");
+    if (options.clientId && typeof claims.azp === "string" && claims.azp !== "" && claims.azp !== options.clientId) throw new CauthyTokenError("wrong_client");
     return {
       userId: claims.sub,
       tenantId: claims.tid,
@@ -1762,6 +1765,8 @@ function createTokenVerifier(options = {}) {
       roles: Array.isArray(claims.roles) ? claims.roles : [],
       ...typeof claims.sys === "string" && claims.sys !== "" ? { system: claims.sys } : {},
       ...claims.anon === true ? { anonymous: true } : {},
+      ...typeof claims.azp === "string" && claims.azp !== "" ? { authorizedParty: claims.azp } : {},
+      ...typeof claims.client_id === "string" && claims.client_id !== "" ? { clientId: claims.client_id } : {},
       expiresAt: new Date(claims.exp * 1e3).toISOString(),
       token
     };
@@ -3261,13 +3266,19 @@ function createCauthy(given = {}) {
     return { response: redirect(to) };
   }
   const replay = given.webhookReplay ?? memoryReplayStore();
-  const tokenVerifier = (o = {}) => createTokenVerifier({
-    issuer,
-    tenantId: contract?.tenantId ?? given.tenantId,
-    audience: given.audience,
-    fetch: given.fetch,
-    ...o
-  });
+  const tokenVerifier = (o = {}) => {
+    if (contract && o.clientId !== void 0 && o.clientId !== contract.clientId) {
+      throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`);
+    }
+    return createTokenVerifier({
+      issuer,
+      tenantId: contract?.tenantId ?? given.tenantId,
+      audience: given.audience,
+      fetch: given.fetch,
+      ...contract ? { clientId: contract.clientId } : {},
+      ...o
+    });
+  };
   const webhook = (request, o = {}) => verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay });
   const pact = contract && ownKeys ? {
     contract,