@ever-works/oidc-identity 1.0.0

package/dist/testing/fake-oidc-provider.cjs

@@ -0,0 +1,651 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/testing/fake-oidc-provider.ts
+var fake_oidc_provider_exports = {};
+__export(fake_oidc_provider_exports, {
+  FAKE_BACKCHANNEL_LOGOUT_EVENT: () => FAKE_BACKCHANNEL_LOGOUT_EVENT,
+  FAKE_DEFAULT_LOCAL_CLIENT_ID: () => FAKE_DEFAULT_LOCAL_CLIENT_ID,
+  FAKE_DEFAULT_USER: () => FAKE_DEFAULT_USER,
+  FakeOidcProvider: () => FakeOidcProvider,
+  s256: () => s256
+});
+module.exports = __toCommonJS(fake_oidc_provider_exports);
+var import_node_crypto = require("crypto");
+var import_node_http = require("http");
+var FAKE_BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+var FAKE_DEFAULT_LOCAL_CLIENT_ID = "ever-works-cli";
+var FAKE_DEFAULT_USER = {
+  subject: "ever-id-subject-1",
+  email: "person@example.com",
+  emailVerified: true,
+  name: "A Person"
+};
+var FakeOidcProvider = class _FakeOidcProvider {
+  constructor(options) {
+    /** Every request, in order — method, path, query, form and headers. */
+    this.calls = [];
+    this.keys = [];
+    this.codes = /* @__PURE__ */ new Map();
+    this.devices = /* @__PURE__ */ new Map();
+    this.server = null;
+    this.issuerUrl = "";
+    this.keySequence = 0;
+    /** The person approved from now on, when a spec changed it after start (see {@link setUser}). */
+    this.userOverride = null;
+    /** Extra claims every ID token minted from now on carries (see {@link setIdTokenClaims}). */
+    this.extraIdTokenClaims = {};
+    /** The provider session id (`sid`) the next tokens carry (see {@link setSessionId}). */
+    this.sessionId = "ever-id-session-1";
+    this.options = options;
+  }
+  /** Bind a port and answer the discovery document a relying party will read. */
+  static async start(options = {}) {
+    const provider = new _FakeOidcProvider(options);
+    provider.rotateKeysSync({ keepPrevious: false });
+    await provider.listen();
+    return provider;
+  }
+  /**
+   * Bind an ephemeral loopback port and answer `/…/.well-known/openid-configuration`.
+   *
+   * Kept additive and public so a caller that wants a provider on a **fixed** port
+   * (a Playwright lane that must tell the API where to find it before the process
+   * starts) can build one; `start()` is the ordinary entry point.
+   */
+  async listen(port = 0) {
+    if (this.server !== null) throw new Error("FakeOidcProvider is already listening.");
+    const server = (0, import_node_http.createServer)((request, response) => {
+      void this.handle(request, response);
+    });
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(port, "127.0.0.1", () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+    this.server = server;
+    const address = server.address();
+    this.issuerUrl = `http://localhost:${typeof address === "object" && address !== null ? address.port : port}`;
+  }
+  /** The issuer the discovery document advertises, and the settings' `issuerUrl`. */
+  get issuer() {
+    return this.issuerUrl;
+  }
+  /** The bound port. */
+  get port() {
+    const address = this.server?.address();
+    return typeof address === "object" && address !== null ? address.port : 0;
+  }
+  get discoveryUrl() {
+    return `${this.issuer}/.well-known/openid-configuration`;
+  }
+  get jwksUri() {
+    return `${this.issuer}/jwks`;
+  }
+  get authorizationEndpoint() {
+    return `${this.issuer}/authorize`;
+  }
+  get tokenEndpoint() {
+    return `${this.issuer}/token`;
+  }
+  get endSessionEndpoint() {
+    return `${this.issuer}/end_session`;
+  }
+  get deviceAuthorizationEndpoint() {
+    return `${this.issuer}/device_authorization`;
+  }
+  /** The relying party's client id the token endpoint expects. */
+  get clientId() {
+    return this.options.clientId ?? "ever-works-web";
+  }
+  /** The `client_secret_basic` secret the token endpoint expects, or `null` for "any". */
+  get clientSecret() {
+    return this.options.clientSecret === void 0 ? "fake-client-secret" : this.options.clientSecret;
+  }
+  /** The API audience a minted access token carries. */
+  get apiAudience() {
+    return this.options.apiAudience ?? "ever-works";
+  }
+  /** The `azp` a minted access token carries when the caller does not say. */
+  get defaultAuthorizedParty() {
+    return this.options.localClients?.[0]?.clientId ?? FAKE_DEFAULT_LOCAL_CLIENT_ID;
+  }
+  /** The document this provider publishes, with the fields `omit` removed. */
+  discoveryDocument() {
+    const document = {
+      issuer: this.issuer,
+      authorization_endpoint: this.authorizationEndpoint,
+      token_endpoint: this.tokenEndpoint,
+      jwks_uri: this.jwksUri,
+      end_session_endpoint: this.endSessionEndpoint,
+      device_authorization_endpoint: this.deviceAuthorizationEndpoint,
+      userinfo_endpoint: `${this.issuer}/userinfo`,
+      code_challenge_methods_supported: ["S256"],
+      id_token_signing_alg_values_supported: ["ES256"],
+      backchannel_logout_supported: true,
+      backchannel_logout_session_supported: true,
+      response_types_supported: ["code"],
+      grant_types_supported: ["authorization_code", "urn:ietf:params:oauth:grant-type:device_code"],
+      subject_types_supported: ["public"],
+      scopes_supported: ["openid", "email", "profile", this.delegatedScope, this.exchangeScope]
+    };
+    for (const field of this.options.omit ?? []) delete document[field];
+    return document;
+  }
+  /** FR-44's delegated scope this provider mints. */
+  get delegatedScope() {
+    return this.options.delegatedScope ?? "apps:read";
+  }
+  /** FR-39/FR-40's exchange scope this provider mints. */
+  get exchangeScope() {
+    return this.options.exchangeScope ?? "ever-works:session";
+  }
+  /** The current clock, in epoch milliseconds. */
+  now() {
+    return (this.options.now ?? Date.now)();
+  }
+  /** The current clock, in whole seconds — the unit every JWT time claim uses. */
+  nowSeconds() {
+    return Math.floor(this.now() / 1e3);
+  }
+  /**
+   * Replace the signing key, the way a provider rotates one (FR-13, ACC-12-08).
+   *
+   * `keepPrevious` publishes the old key alongside the new one, which is what a
+   * rollover looks like while tokens signed with it are still in flight; the
+   * default is the harder case, where the old key is **gone** and a token signed
+   * with it must stop validating.
+   */
+  async rotateKeys(options = {}) {
+    this.rotateKeysSync(options);
+  }
+  /** The current key id, so a spec can name what it is signing with. */
+  /**
+   * Change the person the provider approves from now on — so one running fake
+   * can sign in a connected identity, a new one and one whose e-mail an account
+   * already uses, in turn. Additive test seam; the constructor option still sets
+   * the first person.
+   */
+  setUser(user) {
+    this.userOverride = user;
+  }
+  /**
+   * Extra claims every ID token minted from now on carries (for example the
+   * optional `urn:ever:` hint claims). Pass `{}` to stop adding any.
+   */
+  setIdTokenClaims(claims) {
+    this.extraIdTokenClaims = { ...claims };
+  }
+  /** The provider session id (`sid`) the next ID tokens and logout tokens carry. */
+  setSessionId(sid) {
+    this.sessionId = sid;
+  }
+  /** The provider session id the next tokens carry. */
+  get currentSessionId() {
+    return this.sessionId;
+  }
+  get currentKeyId() {
+    return this.keys[this.keys.length - 1]?.kid ?? "";
+  }
+  /**
+   * Sign an ID token for the configured person — what the token endpoint answers
+   * with, and what a spec can use to drive `exchangeAuthorizationCode` directly.
+   */
+  async mintIdToken(overrides = {}) {
+    const user = this.user();
+    const issuedAt = this.nowSeconds();
+    return this.sign({
+      iss: this.issuer,
+      sub: user.subject,
+      aud: this.clientId,
+      exp: issuedAt + 300,
+      iat: issuedAt,
+      email: user.email,
+      email_verified: user.emailVerified ?? true,
+      name: user.name ?? "A Person",
+      auth_time: issuedAt,
+      sid: this.sessionId,
+      jti: randomId("id-token"),
+      ...this.extraIdTokenClaims,
+      ...overrides
+    });
+  }
+  /**
+   * Sign an access token — the artifact FR-40's exchange and FR-45's delegated read
+   * are handed.
+   *
+   * The defaults are a **valid** token for the configured installation: `aud` is
+   * the API audience, `azp` is the first configured local client,
+   * `scope` is the exchange scope, `iat` is now and `exp` is now plus
+   * {@link FakeOidcProviderOptions.accessTokenLifetimeSeconds}. Every case in a
+   * spec is therefore "everything is valid, except this", and the literal numbers
+   * a case wants are passed in rather than derived from the plugin.
+   */
+  async mintAccessToken(overrides = {}) {
+    const issuedAt = overrides.issuedAt ?? this.nowSeconds();
+    const claims = {
+      iss: this.issuer,
+      sub: overrides.subject ?? this.user().subject,
+      aud: overrides.audience ?? this.apiAudience,
+      scope: (overrides.scopes ?? [this.exchangeScope]).join(" "),
+      iat: issuedAt,
+      exp: overrides.expiresAt ?? issuedAt + (this.options.accessTokenLifetimeSeconds ?? 300),
+      jti: overrides.jti === void 0 ? randomId("jti") : overrides.jti,
+      ...overrides.claims
+    };
+    if (overrides.authorizedParty !== null) {
+      claims.azp = overrides.authorizedParty ?? this.defaultAuthorizedParty;
+    }
+    return this.sign(claims);
+  }
+  /**
+   * Sign a back-channel logout notice (FR-33).
+   *
+   * The default is a **valid** notice about the configured person's session:
+   * the event member, an `iat` of now, a fresh `jti`, `sid` and no `nonce`, `exp`
+   * or `sub`. `extraClaims` is how a spec adds the claims FR-33 forbids (or
+   * removes the ones it requires), so every case reads as one deliberate change.
+   */
+  async mintLogoutToken(overrides = {}) {
+    const issuedAt = overrides.issuedAt ?? this.nowSeconds();
+    const claims = {
+      iss: this.issuer,
+      aud: this.clientId,
+      iat: issuedAt,
+      jti: overrides.jti === void 0 ? randomId("logout") : overrides.jti,
+      events: overrides.events === void 0 ? { [FAKE_BACKCHANNEL_LOGOUT_EVENT]: {} } : overrides.events,
+      sid: overrides.sid === void 0 ? this.sessionId : overrides.sid,
+      ...overrides.extraClaims
+    };
+    if (overrides.subject !== void 0 && overrides.subject !== null) claims.sub = overrides.subject;
+    if (overrides.expiresAt !== void 0 && overrides.expiresAt !== null) claims.exp = overrides.expiresAt;
+    return this.sign(claims);
+  }
+  /**
+   * Post a signed notice to a relying party's back-channel endpoint, the way the
+   * provider does (FR-33's "one public endpoint", form-encoded).
+   *
+   * Answers the status and the body text rather than throwing, so a spec can assert
+   * FR-34's "an invalid notice answers 400" — and FR-34's "200 with
+   * `Cache-Control: no-store`" — on a real HTTP exchange. A token is minted first
+   * when the caller does not pass one.
+   */
+  async postBackchannelLogout(url, token, overrides = {}) {
+    const logoutToken = token ?? await this.mintLogoutToken(overrides);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ logout_token: logoutToken }).toString()
+    });
+    return {
+      status: response.status,
+      body: await response.text(),
+      cacheControl: response.headers.get("cache-control")
+    };
+  }
+  /**
+   * Approve a pending device grant — what the person does in the browser at
+   * `verification_uri` (FR-39).
+   *
+   * With no argument every pending grant is approved, which is what a spec that has
+   * just asked for one wants; the `userCode` form is there for the case that reads
+   * the code off the wire.
+   */
+  approveDeviceAuthorization(userCode) {
+    let approved = 0;
+    for (const grant of this.devices.values()) {
+      if (userCode !== void 0 && grant.userCode !== userCode) continue;
+      grant.approved = true;
+      approved += 1;
+    }
+    return approved;
+  }
+  /** Every device grant this provider has issued, approved or not. */
+  get deviceGrants() {
+    return [...this.devices.values()].map((grant) => ({
+      userCode: grant.userCode,
+      deviceCode: grant.deviceCode,
+      approved: grant.approved
+    }));
+  }
+  /** The last authorization request's query, or `null` when none has been made. */
+  lastAuthorizationRequest() {
+    for (let index = this.calls.length - 1; index >= 0; index -= 1) {
+      const call = this.calls[index];
+      if (call.path === "/authorize") return call.query;
+    }
+    return null;
+  }
+  /** Stop listening. Safe to call twice, and safe to call after a failed start. */
+  async stop() {
+    const server = this.server;
+    if (server === null) return;
+    this.server = null;
+    await new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+      server.closeAllConnections();
+    });
+  }
+  // ---------------------------------------------------------------- internals
+  user() {
+    return this.userOverride ?? this.options.user ?? FAKE_DEFAULT_USER;
+  }
+  /**
+   * Whether `clientId` is one of the PUBLIC local clients (CLI, node) — RFC 8628
+   * public clients authenticate with their `client_id` alone, no secret.
+   */
+  isLocalClient(clientId) {
+    if (clientId === void 0 || clientId === "") return false;
+    const configured = this.options.localClients ?? [
+      { kind: "cli", clientId: FAKE_DEFAULT_LOCAL_CLIENT_ID }
+    ];
+    return configured.some((client) => client.clientId === clientId);
+  }
+  rotateKeysSync(options) {
+    this.keySequence += 1;
+    const key = makeSigningKey(`fake-key-${this.keySequence}`);
+    if (options.keepPrevious !== true) this.keys.length = 0;
+    this.keys.push(key);
+  }
+  currentKey() {
+    const key = this.keys[this.keys.length - 1];
+    if (key === void 0) throw new Error("FakeOidcProvider has no signing key.");
+    return key;
+  }
+  sign(payload) {
+    return signCompactJws(this.currentKey(), payload);
+  }
+  async handle(request, response) {
+    const url = new URL(request.url ?? "/", this.issuer || "http://localhost");
+    const form = await readForm(request);
+    const call = {
+      method: request.method ?? "GET",
+      path: url.pathname,
+      query: Object.fromEntries(url.searchParams.entries()),
+      form,
+      headers: Object.fromEntries(
+        Object.entries(request.headers).flatMap(
+          ([name, value]) => value === void 0 ? [] : [[name.toLowerCase(), Array.isArray(value) ? value.join(", ") : value]]
+        )
+      )
+    };
+    this.calls.push(call);
+    try {
+      switch (url.pathname) {
+        case "/.well-known/openid-configuration":
+          return sendJson(response, 200, this.discoveryDocument());
+        case "/jwks":
+          return sendJson(response, 200, { keys: this.keys.map((key) => key.jwk) });
+        case "/authorize":
+          return this.handleAuthorize(call, response);
+        case "/token":
+          return this.handleToken(call, response);
+        case "/device_authorization":
+          return this.handleDeviceAuthorization(call, response);
+        case "/end_session":
+          return this.handleEndSession(call, response);
+        case "/userinfo":
+          return sendJson(response, 200, { sub: this.user().subject, email: this.user().email });
+        default:
+          return sendJson(response, 404, { error: "not_found" });
+      }
+    } catch (error) {
+      return sendJson(response, 500, { error: "fake_provider_error", error_description: String(error) });
+    }
+  }
+  /** §10.4's "authorize (auto-approve a configured user)", with S256 required. */
+  handleAuthorize(call, response) {
+    const { query } = call;
+    if (query.response_type !== "code") {
+      return sendJson(response, 400, { error: "unsupported_response_type" });
+    }
+    if (query.code_challenge_method !== "S256" || (query.code_challenge ?? "") === "") {
+      return sendJson(response, 400, { error: "invalid_request", error_description: "PKCE S256 is required" });
+    }
+    if (query.client_id !== this.clientId) {
+      return sendJson(response, 400, { error: "invalid_request", error_description: "unknown client" });
+    }
+    const redirectUri = query.redirect_uri ?? "";
+    if (redirectUri === "") {
+      return sendJson(response, 400, { error: "invalid_request", error_description: "redirect_uri is required" });
+    }
+    const code = randomId("code");
+    this.codes.set(code, {
+      code,
+      clientId: query.client_id,
+      redirectUri,
+      codeChallenge: query.code_challenge ?? "",
+      nonce: query.nonce ?? null,
+      scope: query.scope ?? "openid email profile",
+      expiresAtSeconds: this.nowSeconds() + (this.options.authorizationCodeLifetimeSeconds ?? 60)
+    });
+    const target = new URL(redirectUri);
+    target.searchParams.set("code", code);
+    if (query.state !== void 0) target.searchParams.set("state", query.state);
+    target.searchParams.set("iss", this.issuer);
+    response.writeHead(302, { location: target.toString(), "cache-control": "no-store" });
+    response.end();
+  }
+  /** RFC 6749 §4.1.3 and RFC 8628 §3.4–3.5: two grants, both checked. */
+  handleToken(call, response) {
+    const { form } = call;
+    const publicDeviceClient = form.grant_type === "urn:ietf:params:oauth:grant-type:device_code" && this.isLocalClient(form.client_id);
+    if (this.clientSecret !== null && !publicDeviceClient && !this.credentialsAccepted(call)) {
+      return sendJson(response, 401, { error: "invalid_client" });
+    }
+    if (form.grant_type === "authorization_code") return this.handleAuthorizationCodeGrant(form, response);
+    if (form.grant_type === "urn:ietf:params:oauth:grant-type:device_code") {
+      return this.handleDeviceCodeGrant(form, response);
+    }
+    return sendJson(response, 400, { error: "unsupported_grant_type" });
+  }
+  handleAuthorizationCodeGrant(form, response) {
+    const stored = this.codes.get(form.code ?? "");
+    if (stored === void 0) {
+      return sendJson(response, 400, { error: "invalid_grant", error_description: "unknown code" });
+    }
+    this.codes.delete(stored.code);
+    if (stored.expiresAtSeconds < this.nowSeconds()) {
+      return sendJson(response, 400, { error: "invalid_grant", error_description: "expired code" });
+    }
+    if (form.redirect_uri !== stored.redirectUri) {
+      return sendJson(response, 400, { error: "invalid_grant", error_description: "redirect_uri mismatch" });
+    }
+    if (s256(form.code_verifier ?? "") !== stored.codeChallenge) {
+      return sendJson(response, 400, { error: "invalid_grant", error_description: "PKCE verification failed" });
+    }
+    void this.tokensFor(stored.nonce, stored.scope).then(
+      (tokens) => sendJson(response, 200, tokens),
+      (error) => sendJson(response, 500, { error: "server_error", error_description: String(error) })
+    );
+  }
+  handleDeviceCodeGrant(form, response) {
+    const grant = this.devices.get(form.device_code ?? "");
+    if (grant === void 0) {
+      return sendJson(response, 400, { error: "invalid_grant", error_description: "unknown device code" });
+    }
+    const nowSeconds = this.nowSeconds();
+    if (grant.expiresAtSeconds < nowSeconds) {
+      this.devices.delete(grant.deviceCode);
+      return sendJson(response, 400, { error: "expired_token" });
+    }
+    if (grant.lastPolledAtSeconds !== null && nowSeconds - grant.lastPolledAtSeconds < grant.intervalSeconds) {
+      grant.lastPolledAtSeconds = nowSeconds;
+      return sendJson(response, 400, { error: "slow_down" });
+    }
+    grant.lastPolledAtSeconds = nowSeconds;
+    if (!grant.approved) return sendJson(response, 400, { error: "authorization_pending" });
+    this.devices.delete(grant.deviceCode);
+    const authorizedParty = this.isLocalClient(grant.clientId) ? grant.clientId : this.clientId;
+    void this.tokensFor(null, grant.scope, authorizedParty).then(
+      (tokens) => sendJson(response, 200, tokens),
+      (error) => sendJson(response, 500, { error: "server_error", error_description: String(error) })
+    );
+  }
+  /** RFC 8628 §3.2's device authorization response. */
+  handleDeviceAuthorization(call, response) {
+    if (this.clientSecret !== null && !this.isLocalClient(call.form.client_id) && !this.credentialsAccepted(call)) {
+      return sendJson(response, 401, { error: "invalid_client" });
+    }
+    const intervalSeconds = this.options.devicePollIntervalSeconds ?? 5;
+    const grant = {
+      deviceCode: randomId("device"),
+      userCode: randomUserCode(),
+      clientId: call.form.client_id ?? this.clientId,
+      scope: call.form.scope ?? "openid email profile",
+      expiresAtSeconds: this.nowSeconds() + (this.options.deviceCodeLifetimeSeconds ?? 900),
+      intervalSeconds,
+      approved: false,
+      lastPolledAtSeconds: null
+    };
+    this.devices.set(grant.deviceCode, grant);
+    return sendJson(response, 200, {
+      device_code: grant.deviceCode,
+      user_code: grant.userCode,
+      verification_uri: `${this.issuer}/device`,
+      verification_uri_complete: `${this.issuer}/device?user_code=${grant.userCode}`,
+      expires_in: this.options.deviceCodeLifetimeSeconds ?? 900,
+      interval: intervalSeconds
+    });
+  }
+  /** RP-Initiated Logout 1.0 §2: back to the relying party, with `state` preserved. */
+  handleEndSession(call, response) {
+    const redirectUri = call.query.post_logout_redirect_uri;
+    if (redirectUri === void 0 || redirectUri === "") {
+      return sendJson(response, 200, { signedOut: true });
+    }
+    const target = new URL(redirectUri);
+    if (call.query.state !== void 0) target.searchParams.set("state", call.query.state);
+    response.writeHead(302, { location: target.toString(), "cache-control": "no-store" });
+    response.end();
+  }
+  async tokensFor(nonce, scope, authorizedParty = this.clientId) {
+    const user = this.user();
+    const idToken = await this.mintIdToken({ nonce, sid: this.sessionId, sub: user.subject });
+    const accessToken = await this.mintAccessToken({
+      scopes: scope.split(/\s+/u).filter((entry) => entry.length > 0),
+      authorizedParty
+    });
+    return {
+      access_token: accessToken,
+      id_token: idToken,
+      token_type: "Bearer",
+      expires_in: this.options.accessTokenLifetimeSeconds ?? 300,
+      scope
+    };
+  }
+  /** `client_secret_basic` (RFC 6749 §2.3.1), which is what plan §4.2 registers. */
+  credentialsAccepted(call) {
+    const header = call.headers.authorization;
+    if (header === void 0 || !header.toLowerCase().startsWith("basic ")) return false;
+    const raw = header.slice("basic ".length);
+    const decoded = Buffer.from(raw, "base64").toString("utf8");
+    const separator = decoded.indexOf(":");
+    if (separator < 0) return false;
+    const username = decoded.slice(0, separator);
+    const decodedUsername = decodeURIComponent(username.replace(/\+/gu, " "));
+    const password = decodeURIComponent(decoded.slice(separator + 1).replace(/\+/gu, " "));
+    const usernameMatches = username === this.clientId || decodedUsername === this.clientId;
+    return usernameMatches && password === (this.clientSecret ?? "");
+  }
+};
+function s256(codeVerifier) {
+  return (0, import_node_crypto.createHash)("sha256").update(codeVerifier, "ascii").digest("base64url");
+}
+function makeSigningKey(kid) {
+  const { privateKey, publicKey } = (0, import_node_crypto.generateKeyPairSync)("ec", { namedCurve: "prime256v1" });
+  const jwk = publicKey.export({ format: "jwk" });
+  return { kid, jwk: { ...jwk, kid, alg: "ES256", use: "sig" }, privateKey };
+}
+function signCompactJws(key, payload) {
+  const header = { alg: "ES256", kid: key.kid, typ: "JWT" };
+  const signingInput = `${base64Url(JSON.stringify(header))}.${base64Url(JSON.stringify(payload))}`;
+  const signature = (0, import_node_crypto.createSign)("SHA256").update(signingInput).sign(key.privateKey);
+  return `${signingInput}.${base64Url(derToJoseSignature(signature))}`;
+}
+function derToJoseSignature(der, partLength = 32) {
+  if (der.length < 8 || der[0] !== 48) throw new Error("unexpected ECDSA signature encoding");
+  let offset = 1;
+  if (der[offset] !== void 0 && (der[offset] & 128) !== 0) {
+    offset += 1 + (der[offset] & 127);
+  } else {
+    offset += 1;
+  }
+  const readInteger = () => {
+    if (der[offset] !== 2) throw new Error("unexpected ECDSA signature encoding");
+    const length = der[offset + 1];
+    if (length === void 0) throw new Error("unexpected ECDSA signature encoding");
+    const value = der.subarray(offset + 2, offset + 2 + length);
+    offset += 2 + length;
+    return value;
+  };
+  const r = readInteger();
+  const s = readInteger();
+  return Buffer.concat([leftPadUnsigned(r, partLength), leftPadUnsigned(s, partLength)]);
+}
+function leftPadUnsigned(value, length) {
+  let start = 0;
+  while (start < value.length - 1 && value[start] === 0) start += 1;
+  const trimmed = value.subarray(start);
+  if (trimmed.length > length) throw new Error("ECDSA coordinate wider than the curve");
+  return Buffer.concat([Buffer.alloc(length - trimmed.length, 0), trimmed]);
+}
+function base64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function randomId(prefix) {
+  return `${prefix}-${(0, import_node_crypto.randomBytes)(12).toString("hex")}`;
+}
+function randomUserCode() {
+  const alphabet = "BCDFGHJKLMNPQRSTVWXZ";
+  const bytes = (0, import_node_crypto.randomBytes)(8);
+  let code = "";
+  for (let index = 0; index < 8; index += 1) {
+    if (index === 4) code += "-";
+    code += alphabet[bytes[index] % alphabet.length];
+  }
+  return code;
+}
+function sendJson(response, status, body) {
+  const payload = JSON.stringify(body);
+  response.writeHead(status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(payload),
+    "cache-control": "no-store"
+  });
+  response.end(payload);
+}
+async function readForm(request) {
+  if (request.method !== "POST") return {};
+  const chunks = [];
+  for await (const chunk of request) chunks.push(Buffer.from(chunk));
+  const body = Buffer.concat(chunks).toString("utf8");
+  if (body === "") return {};
+  return Object.fromEntries(new URLSearchParams(body).entries());
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FAKE_BACKCHANNEL_LOGOUT_EVENT,
+  FAKE_DEFAULT_LOCAL_CLIENT_ID,
+  FAKE_DEFAULT_USER,
+  FakeOidcProvider,
+  s256
+});