@cloudflare/workers-oauth-provider 0.10.2 → 0.10.4

package/README.md

@@ -248,6 +248,8 @@ A typical flow has three steps:
 
 `completeAuthorization()` stores a new grant and, by default, revokes existing grants for the same user and client after the new grant is safely stored. Set `revokeExistingGrants: false` only when the application intentionally allows concurrent grants for the same user and client.
 
+For Client ID Metadata Document clients, whose client_id is the metadata URL shared by every installation, default revocation is additionally scoped to grants created from the same redirect URI, so one installation's re-authorization does not revoke another's. Grants created before the redirect URI was recorded are never auto-revoked by CIMD clients.
+
 For users with many grants, `revokeExistingGrantsBatchSize` controls the KV page size used during that scan. It defaults to `50` and is capped at KV's maximum page size of `1000`.
 
 ### Authorization response issuer

package/dist/oauth-provider.d.ts

@@ -1103,6 +1103,13 @@ interface Grant {
    * Indicates the protected resource(s) for which access is requested
    */
   resource?: string | string[];
+  /**
+   * The exact redirect URI used in the authorization request that created this grant
+   * Recorded so that default grant revocation can be scoped to a single installation
+   * of a CIMD client (whose client_id is shared across all installations). Absent on
+   * grants created before this field was introduced.
+   */
+  redirectUri?: string;
 }
 /**
  * OAuth 2.0 Token Response
@@ -1314,6 +1321,13 @@ interface GrantSummary {
    * Unix timestamp when the grant expires (if TTL is configured)
    */
   expiresAt?: number;
+  /**
+   * The exact redirect URI used in the authorization request that created this grant
+   * Recorded so that default grant revocation can be scoped to a single installation
+   * of a CIMD client (whose client_id is shared across all installations). Absent on
+   * grants created before this field was introduced.
+   */
+  redirectUri?: string;
 }
 /**
  * OAuth 2.0 Provider implementation for Cloudflare Workers

package/dist/oauth-provider.js

@@ -581,6 +581,8 @@ const EMA_DEFAULT_MAX_ASSERTION_LIFETIME_SECONDS = 300;
 * values to amplify load on the IdP's JWKS endpoint.
 */
 const EMA_JWKS_FORCE_REFRESH_COOLDOWN_SECONDS = 30;
+/** Floor for the `jti` replay marker's KV TTL; KV rejects a sub-60s expiration. */
+const EMA_JTI_MIN_TTL_SECONDS = 60;
 /** Default JWT signing algorithm assumed for a trusted issuer. */
 const EMA_DEFAULT_JWT_ALGORITHM = "RS256";
 /** JWT signing algorithms supported by the built-in WebCrypto verifier. */
@@ -698,7 +700,7 @@ const EMA_JTI_KV_PREFIX = "enterprise-jti:";
 /** Create the default KV-backed JTI store. KV TTL handles cleanup. */
 function createKvJtiStore() {
 	return { async markUsed({ issuer, jti, exp, now, env }) {
-		const ttl = Math.max(1, exp - now);
+		const ttl = Math.max(EMA_JTI_MIN_TTL_SECONDS, exp - now);
 		const key = `${EMA_JTI_KV_PREFIX}${await sha256Hex(`${issuer}\n${jti}`)}`;
 		if (await env.OAUTH_KV.get(key)) return err({
 			reason: "replayed",
@@ -3572,6 +3574,7 @@ var OAuthHelpersImpl = class {
 		validateAuthorizationPkce(this.provider.serverCapabilities, options.request, clientInfo);
 		let grantsToRevoke = [];
 		if (options.revokeExistingGrants !== false) {
+			const isCimdClient = this.provider.isClientMetadataUrl(clientId);
 			const batchSize = getRevokeExistingGrantsBatchSize(options.revokeExistingGrantsBatchSize);
 			let cursor;
 			do {
@@ -3579,7 +3582,7 @@ var OAuthHelpersImpl = class {
 					cursor,
 					limit: batchSize
 				});
-				for (const grant of page.items) if (grant.clientId === clientId) grantsToRevoke.push(grant.id);
+				for (const grant of page.items) if (grant.clientId === clientId && (!isCimdClient || grant.redirectUri === options.request.redirectUri)) grantsToRevoke.push(grant.id);
 				cursor = page.cursor;
 			} while (cursor);
 		}
@@ -3603,7 +3606,8 @@ var OAuthHelpersImpl = class {
 				metadata: options.metadata,
 				encryptedProps: encryptedData,
 				createdAt: now,
-				resource: effectiveResource
+				resource: effectiveResource,
+				redirectUri: options.request.redirectUri
 			};
 			const grantKey = `grant:${options.userId}:${grantId}`;
 			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant));
@@ -3653,7 +3657,8 @@ var OAuthHelpersImpl = class {
 				authCodeWrappedKey,
 				codeChallenge: options.request.codeChallenge,
 				codeChallengeMethod: options.request.codeChallengeMethod,
-				resource: effectiveResource
+				resource: effectiveResource,
+				redirectUri: options.request.redirectUri
 			};
 			const grantKey = `grant:${options.userId}:${grantId}`;
 			await this.env.OAUTH_KV.put(grantKey, JSON.stringify(grant), { expirationTtl: 600 });
@@ -3810,7 +3815,8 @@ var OAuthHelpersImpl = class {
 					scope: grantData.scope,
 					metadata: grantData.metadata,
 					createdAt: grantData.createdAt,
-					expiresAt: grantData.expiresAt
+					expiresAt: grantData.expiresAt,
+					redirectUri: grantData.redirectUri
 				};
 				grantSummaries.push(summary);
 			}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",