@draftlab/auth 0.8.0 → 0.9.0

package/dist/client.mjs

@@ -201,7 +201,10 @@ const createClient = (input) => {
 		},
 		async verify(subjects, token, options) {
 			try {
-				const jwtResult = await jwtVerify(token, await getJWKS(), { issuer });
+				const jwtResult = await jwtVerify(token, await getJWKS(), {
+					issuer: options?.issuer ?? issuer,
+					...options?.audience && { audience: options.audience }
+				});
 				const validated = await subjects[jwtResult.payload.type]?.["~standard"].validate(jwtResult.payload.properties);
 				if (!validated?.issues && jwtResult.payload.mode === "access") return {
 					success: true,

package/dist/core.d.mts

@@ -6,6 +6,7 @@ import { StorageAdapter } from "./storage/storage.mjs";
 import { Plugin } from "./plugin/types.mjs";
 import { Provider } from "./provider/provider.mjs";
 import { Theme } from "./themes/theme.mjs";
+import { AuthorizationState } from "./types.mjs";
 import { Router } from "@draftlab/auth-router";
 
 //#region src/core.d.ts
@@ -27,26 +28,6 @@ interface OnSuccessResponder<T$1 extends {
     subject?: string;
   }): Promise<Response>;
 }
-/**
- * Authorization state for OAuth 2.0 flows.
- */
-interface AuthorizationState {
-  /** OAuth redirect URI */
-  redirect_uri: string;
-  /** OAuth response type */
-  response_type: string;
-  /** OAuth state parameter for CSRF protection */
-  state: string;
-  /** OAuth client identifier */
-  client_id: string;
-  /** OAuth audience parameter */
-  audience: string;
-  /** PKCE challenge data for code verification */
-  pkce?: {
-    challenge: string;
-    method: "S256";
-  };
-}
 /**
  * Main issuer input configuration interface.
  */
@@ -129,4 +110,4 @@ declare const issuer: <Providers extends Record<string, Provider<unknown>>, Subj
   };
 }>;
 //#endregion
-export { AuthorizationState, OnSuccessResponder, issuer };
+export { OnSuccessResponder, issuer };

package/dist/core.mjs

@@ -139,7 +139,8 @@ const issuer = (input) => {
 				clientID: value.clientID,
 				subject: value.subject,
 				ttl: value.ttl,
-				nextToken: generateSecureToken()
+				nextToken: generateSecureToken(),
+				timeUsed: value.timeUsed
 			};
 			const refreshKey = [
 				"oauth:refresh",
@@ -231,6 +232,7 @@ const issuer = (input) => {
 					subject,
 					redirectURI: authorization.redirect_uri,
 					clientID: authorization.client_id,
+					scopes: authorization.scopes,
 					pkce: authorization.pkce,
 					ttl: {
 						access: subjectOpts?.ttl?.access ?? ttlAccess,
@@ -492,13 +494,51 @@ const issuer = (input) => {
 			credentials: false
 		})],
 		handler: async (c) => {
-			const token = (await c.formData()).get("token")?.toString();
+			const form = await c.formData();
+			const token = form.get("token")?.toString();
+			const tokenTypeHint = form.get("token_type_hint")?.toString();
 			if (!token) {
 				const error$1 = new OauthError("invalid_request", "Missing token parameter");
 				return c.json(error$1.toJSON(), { status: 400 });
 			}
 			try {
-				const expiresAt = Date.now() + ttlRefresh * 1e3;
+				if (tokenTypeHint === "refresh_token") {
+					const splits$1 = token.split(":");
+					const tokenPart$1 = splits$1.pop();
+					if (tokenPart$1 && splits$1.length > 0) {
+						const key = [
+							"oauth:refresh",
+							splits$1.join(":"),
+							tokenPart$1
+						];
+						if (await Storage.get(storage, key)) {
+							await Storage.remove(storage, key);
+							const expiresAt$1 = Date.now() + ttlRefreshRetention * 1e3;
+							await Revocation.revoke(storage, token, expiresAt$1);
+							return c.json({});
+						}
+					}
+				} else if (tokenTypeHint === "access_token") {
+					const expiresAt$1 = Date.now() + ttlAccess * 1e3;
+					await Revocation.revoke(storage, token, expiresAt$1);
+					return c.json({});
+				}
+				const splits = token.split(":");
+				const tokenPart = splits.pop();
+				if (tokenPart && splits.length > 0) {
+					const key = [
+						"oauth:refresh",
+						splits.join(":"),
+						tokenPart
+					];
+					if (await Storage.get(storage, key)) {
+						await Storage.remove(storage, key);
+						const expiresAt$1 = Date.now() + ttlRefreshRetention * 1e3;
+						await Revocation.revoke(storage, token, expiresAt$1);
+						return c.json({});
+					}
+				}
+				const expiresAt = Date.now() + ttlAccess * 1e3;
 				await Revocation.revoke(storage, token, expiresAt);
 				return c.json({});
 			} catch (_err) {
@@ -526,6 +566,7 @@ const issuer = (input) => {
 			client_id,
 			audience,
 			scope,
+			scopes: scope ? scope.split(" ").filter(Boolean) : void 0,
 			...code_challenge && code_challenge_method && { pkce: {
 				challenge: code_challenge,
 				method: code_challenge_method

package/dist/provider/oauth2.mjs

@@ -2,6 +2,7 @@ import { getRelativeUrl } from "../util.mjs";
 import { OauthError } from "../error.mjs";
 import { generatePKCE } from "../pkce.mjs";
 import { generateSecureToken, timingSafeCompare } from "../random.mjs";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 
 //#region src/provider/oauth2.ts
 /**
@@ -70,6 +71,12 @@ const Oauth2Provider = (config) => {
 			if (!response.ok) throw new Error(`Token request failed with status ${response.status}`);
 			const tokenData = await response.json();
 			if (tokenData.error) throw new OauthError(tokenData.error, tokenData.error_description || "");
+			if (tokenData.id_token && config.endpoint.jwks) try {
+				const jwks = createRemoteJWKSet(new URL(config.endpoint.jwks));
+				await jwtVerify(tokenData.id_token, jwks, { issuer: config.endpoint.authorization.split("/").slice(0, 3).join("/") });
+			} catch (error) {
+				throw new OauthError("invalid_request", `ID token validation failed: ${error instanceof Error ? error.message : "Unknown error"}`);
+			}
 			return await ctx.success(c, {
 				clientID: config.clientID,
 				tokenset: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@draftlab/auth",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Core implementation for @draftlab/auth",
   "author": "Matheus Pergoli",
@@ -39,7 +39,7 @@
   "devDependencies": {
     "@types/node": "^24.10.1",
     "@types/qrcode": "^1.5.6",
-    "tsdown": "^0.16.6",
+    "tsdown": "^0.16.7",
     "typescript": "^5.9.3",
     "@draftlab/tsconfig": "0.1.0"
   },
@@ -63,7 +63,7 @@
     "preact": "^10.27.2",
     "preact-render-to-string": "^6.6.3",
     "qrcode": "^1.5.4",
-    "@draftlab/auth-router": "0.1.0"
+    "@draftlab/auth-router": "0.2.0"
   },
   "engines": {
     "node": ">=18"