@crvouga/mockingbird-service-oauth 1.0.2 → 1.2.0

package/dist/cli.js

@@ -3,8 +3,8 @@ import {
   runCli,
   serveCommand,
   serveTarget
-} from "./chunk-X5QMVVR5.js";
-import "./chunk-I24F66FL.js";
+} from "./chunk-U4WWQUOX.js";
+import "./chunk-XUUSJ73W.js";
 
 // src/cli.ts
 var code = await runCli(

package/dist/index.d.ts

@@ -518,7 +518,7 @@ type WebhookHub = {
     messages(namespace?: string): WebhookMessage[];
     deliveries(namespace?: string): WebhookDelivery[];
     replay(deliveryId: string): Promise<WebhookDelivery | undefined>;
-    /** Run every pending retry (and release held reordered messages) now. */
+    /** Run every pending retry (and release held reordered messages) now, and every retry those attempts schedule, until nothing is pending. */
     flush(): Promise<void>;
     /** Resolve once nothing is in flight. */
     idle(): Promise<void>;
@@ -635,6 +635,10 @@ type OAuthBehavior = {
         refreshTtlSeconds?: number;
         refreshRotation?: "reuse" | "rotate";
         refreshError?: "invalid_grant" | "invalid_rapt";
+        /** Offsets an ID token's iat and auth_time from the mock clock; exp stays iat + accessTtlSeconds. */
+        idTokenClockSkewSeconds?: number;
+        /** "unpublished" signs ID tokens with a key no JWKS response ever contains. */
+        idTokenSigningKey?: "published" | "unpublished";
     };
     /** Additional scopes accepted for incremental/partial-consent tests. No resource APIs implied. */
     additionalScopes?: string[];
@@ -727,6 +731,21 @@ declare const OAUTH_SCENARIOS: {
             readonly tokenUnavailable: 0.25;
         };
     };
+    readonly id_token_clock_ahead: {
+        readonly tokens: {
+            readonly idTokenClockSkewSeconds: 600;
+        };
+    };
+    readonly id_token_stale: {
+        readonly tokens: {
+            readonly idTokenClockSkewSeconds: -7200;
+        };
+    };
+    readonly id_token_unknown_key: {
+        readonly tokens: {
+            readonly idTokenSigningKey: "unpublished";
+        };
+    };
 };
 type OAuthScenario = keyof typeof OAUTH_SCENARIOS;
 type BehaviorInput = OAuthBehavior & {
@@ -807,8 +826,19 @@ type Client = {
         teamId: string;
         keyId: string;
         publicKey: JsonWebKey;
+        /** Where Sign in with Apple server-to-server notifications are POSTed. */
+        notificationUrl?: string;
     };
 };
+type AppleNotificationType = "consent-revoked" | "account-delete" | "email-disabled" | "email-enabled";
+/** Outcome of one server-to-server notification; a failed delivery never throws. */
+type NotificationDelivery = {
+    clientId: string;
+    type: AppleNotificationType;
+    delivered: boolean;
+    status?: number;
+    error?: string;
+};
 
 /**
  * The slice of OpenAPI 3.1 (and JSON Schema 2020-12) Mockingbird understands.
@@ -1032,6 +1062,10 @@ type OAuthAPIOptions = APIOptions & {
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
+    /** Outbound delivery of Sign in with Apple server-to-server notifications. Defaults to global `fetch`. */
+    webhooks?: {
+        fetch?: (request: Request) => Promise<Response>;
+    };
 };
 /** Portable OAuth/OIDC provider. State is isolated and included in runtime snapshots. */
 declare class OAuthAPI {
@@ -1045,6 +1079,8 @@ declare class OAuthAPI {
     private readonly consents;
     private signer;
     private previousSigners;
+    /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
+    private unpublishedSigner?;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;
@@ -1058,12 +1094,31 @@ declare class OAuthAPI {
     seedAccount(account: Account): Account;
     registerClient(client: Client): Client;
     reset(): Promise<void>;
-    private issuer;
+    issuer(request: Request): string;
     configureBehavior(input: BehaviorInput): OAuthBehavior;
     rotateSigningKey(retainPrevious?: boolean): {
         kid: string;
     };
-    revokeConsent(clientId: string, accountId: string): void;
+    /**
+     * Withdraws one client's consent. When the client registered `apple.notificationUrl` and held
+     * the consent, Apple's `consent-revoked` notification is delivered before this resolves.
+     */
+    revokeConsent(clientId: string, accountId: string, issuer?: string): Promise<NotificationDelivery[]>;
+    /**
+     * Deletes an account with its grants and sessions, after telling every client that held a
+     * consent (`account-delete`).
+     */
+    deleteAccount(accountId: string, issuer?: string): Promise<NotificationDelivery[]>;
+    /**
+     * Tells every client whose identity for the account is a private relay address that the user
+     * turned forwarding off (`email-disabled`) or on (`email-enabled`).
+     */
+    setRelayForwarding(accountId: string, forwarding: boolean, issuer?: string): Promise<NotificationDelivery[]>;
+    /** Clients with a notification endpoint that hold a consent for the account. */
+    private notifiable;
+    private notify;
+    /** Drops one client's grant for an account: consent, identity, first-use disclosure, codes, tokens. */
+    private forget;
     private paths;
     private supportedScopes;
     private identityKey;
@@ -1077,6 +1132,7 @@ declare class OAuthAPI {
     private authorize;
     private consent;
     private interact;
+    private startSession;
     private finish;
     private callback;
     private githubTokenResponse;
@@ -1084,4 +1140,4 @@ declare class OAuthAPI {
 }
 
 export { OAUTH_PRESETS, OAUTH_SCENARIOS, OAuthAPI, createMultiRuntime, createRuntime, document, operationIds, supportedOperationIds };
-export type { Account, BehaviorEvent, BehaviorInput, Client, EdgeCase, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider };
+export type { Account, AppleNotificationType, BehaviorEvent, BehaviorInput, Client, EdgeCase, NotificationDelivery, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider };

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   document,
   operationIds,
   supportedOperationIds
-} from "./chunk-I24F66FL.js";
+} from "./chunk-XUUSJ73W.js";
 export {
   OAUTH_PRESETS,
   OAUTH_SCENARIOS,

package/dist/server.d.ts

@@ -458,7 +458,7 @@ type WebhookHub$1 = {
     messages(namespace?: string): WebhookMessage$1[];
     deliveries(namespace?: string): WebhookDelivery$1[];
     replay(deliveryId: string): Promise<WebhookDelivery$1 | undefined>;
-    /** Run every pending retry (and release held reordered messages) now. */
+    /** Run every pending retry (and release held reordered messages) now, and every retry those attempts schedule, until nothing is pending. */
     flush(): Promise<void>;
     /** Resolve once nothing is in flight. */
     idle(): Promise<void>;
@@ -1057,7 +1057,7 @@ type WebhookHub = {
     messages(namespace?: string): WebhookMessage[];
     deliveries(namespace?: string): WebhookDelivery[];
     replay(deliveryId: string): Promise<WebhookDelivery | undefined>;
-    /** Run every pending retry (and release held reordered messages) now. */
+    /** Run every pending retry (and release held reordered messages) now, and every retry those attempts schedule, until nothing is pending. */
     flush(): Promise<void>;
     /** Resolve once nothing is in flight. */
     idle(): Promise<void>;
@@ -1174,6 +1174,10 @@ type OAuthBehavior = {
         refreshTtlSeconds?: number;
         refreshRotation?: "reuse" | "rotate";
         refreshError?: "invalid_grant" | "invalid_rapt";
+        /** Offsets an ID token's iat and auth_time from the mock clock; exp stays iat + accessTtlSeconds. */
+        idTokenClockSkewSeconds?: number;
+        /** "unpublished" signs ID tokens with a key no JWKS response ever contains. */
+        idTokenSigningKey?: "published" | "unpublished";
     };
     /** Additional scopes accepted for incremental/partial-consent tests. No resource APIs implied. */
     additionalScopes?: string[];
@@ -1266,6 +1270,21 @@ declare const OAUTH_SCENARIOS: {
             readonly tokenUnavailable: 0.25;
         };
     };
+    readonly id_token_clock_ahead: {
+        readonly tokens: {
+            readonly idTokenClockSkewSeconds: 600;
+        };
+    };
+    readonly id_token_stale: {
+        readonly tokens: {
+            readonly idTokenClockSkewSeconds: -7200;
+        };
+    };
+    readonly id_token_unknown_key: {
+        readonly tokens: {
+            readonly idTokenSigningKey: "unpublished";
+        };
+    };
 };
 type OAuthScenario = keyof typeof OAUTH_SCENARIOS;
 type BehaviorInput = OAuthBehavior & {
@@ -1346,8 +1365,19 @@ type Client = {
         teamId: string;
         keyId: string;
         publicKey: JsonWebKey;
+        /** Where Sign in with Apple server-to-server notifications are POSTed. */
+        notificationUrl?: string;
     };
 };
+type AppleNotificationType = "consent-revoked" | "account-delete" | "email-disabled" | "email-enabled";
+/** Outcome of one server-to-server notification; a failed delivery never throws. */
+type NotificationDelivery = {
+    clientId: string;
+    type: AppleNotificationType;
+    delivered: boolean;
+    status?: number;
+    error?: string;
+};
 
 type OAuthAPIOptions = APIOptions & {
     /** Browser Fetch forbids Cookie/Set-Cookie; local transports may explicitly remap them. */
@@ -1368,6 +1398,10 @@ type OAuthAPIOptions = APIOptions & {
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
+    /** Outbound delivery of Sign in with Apple server-to-server notifications. Defaults to global `fetch`. */
+    webhooks?: {
+        fetch?: (request: Request) => Promise<Response>;
+    };
 };
 /** Portable OAuth/OIDC provider. State is isolated and included in runtime snapshots. */
 declare class OAuthAPI {
@@ -1381,6 +1415,8 @@ declare class OAuthAPI {
     private readonly consents;
     private signer;
     private previousSigners;
+    /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
+    private unpublishedSigner?;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;
@@ -1394,12 +1430,31 @@ declare class OAuthAPI {
     seedAccount(account: Account): Account;
     registerClient(client: Client): Client;
     reset(): Promise<void>;
-    private issuer;
+    issuer(request: Request): string;
     configureBehavior(input: BehaviorInput): OAuthBehavior;
     rotateSigningKey(retainPrevious?: boolean): {
         kid: string;
     };
-    revokeConsent(clientId: string, accountId: string): void;
+    /**
+     * Withdraws one client's consent. When the client registered `apple.notificationUrl` and held
+     * the consent, Apple's `consent-revoked` notification is delivered before this resolves.
+     */
+    revokeConsent(clientId: string, accountId: string, issuer?: string): Promise<NotificationDelivery[]>;
+    /**
+     * Deletes an account with its grants and sessions, after telling every client that held a
+     * consent (`account-delete`).
+     */
+    deleteAccount(accountId: string, issuer?: string): Promise<NotificationDelivery[]>;
+    /**
+     * Tells every client whose identity for the account is a private relay address that the user
+     * turned forwarding off (`email-disabled`) or on (`email-enabled`).
+     */
+    setRelayForwarding(accountId: string, forwarding: boolean, issuer?: string): Promise<NotificationDelivery[]>;
+    /** Clients with a notification endpoint that hold a consent for the account. */
+    private notifiable;
+    private notify;
+    /** Drops one client's grant for an account: consent, identity, first-use disclosure, codes, tokens. */
+    private forget;
     private paths;
     private supportedScopes;
     private identityKey;
@@ -1413,6 +1468,7 @@ declare class OAuthAPI {
     private authorize;
     private consent;
     private interact;
+    private startSession;
     private finish;
     private callback;
     private githubTokenResponse;

package/dist/server.js

@@ -3,8 +3,8 @@ import {
   createMultiServer,
   createServer,
   serveTarget
-} from "./chunk-X5QMVVR5.js";
-import "./chunk-I24F66FL.js";
+} from "./chunk-U4WWQUOX.js";
+import "./chunk-XUUSJ73W.js";
 export {
   DEFAULT_PORT,
   createMultiServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/mockingbird-service-oauth",
-  "version": "1.0.2",
+  "version": "1.2.0",
   "description": "Portable social-login mock with Google, Apple, Microsoft, GitHub and generic OIDC profiles, private relay identities, reproducible edge cases, signed tokens and an accessible UI.",
   "license": "MIT",
   "type": "module",