@fabrika/iam-contract 0.8.2 → 0.9.0-cloudflare.2

package/types/src/oauth.d.ts

@@ -0,0 +1,136 @@
+import type { KeyGrant } from '@fabrika/auth-core';
+/** Managed CIMD registrations only; public dynamic registration is not part of this contract. */
+export interface OAuthManagedClient {
+    provider: 'chatgpt' | 'claude';
+    clientId: string;
+    redirectUris: string[];
+}
+/** RFC 7523 §2.2: the `client_assertion_type` of a JWT client assertion (`private_key_jwt`). */
+export declare const OAUTH_CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** The signing algorithms IAM verifies a client assertion with. */
+export declare const OAUTH_CLIENT_ASSERTION_ALGORITHMS: readonly ["RS256"];
+export type OAuthClientAssertionAlgorithm = (typeof OAUTH_CLIENT_ASSERTION_ALGORITHMS)[number];
+interface OAuthClientMetadataFields {
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+    grant_types: ('authorization_code' | 'refresh_token')[];
+    response_types: ['code'];
+}
+/** A public client, or one that authenticates with a JWT signed by a key its document publishes. */
+export type OAuthClientMetadataDocument = (OAuthClientMetadataFields & {
+    token_endpoint_auth_method: 'none';
+}) | (OAuthClientMetadataFields & {
+    token_endpoint_auth_method: 'private_key_jwt';
+    /** HTTPS, on the client id's own origin. */
+    jwks_uri: string;
+    token_endpoint_auth_signing_alg: OAuthClientAssertionAlgorithm;
+});
+/** How a token or revocation request authenticates its client: no credential, or a JWT assertion. */
+export type OAuthClientCredential = {
+    method: 'none';
+} | {
+    method: 'private_key_jwt';
+    assertion: string;
+};
+export interface OAuthResourceDto {
+    app: string;
+    resource: string;
+    /** IAM resolves these app-owned grants; OAuth scope text alone never authorizes an action. */
+    scopeGrants: {
+        scope: string;
+        permissions: KeyGrant[];
+    }[];
+    /** Used only when scope is omitted. No configured default means invalid_scope, never all scopes. */
+    defaultScopes?: string[];
+}
+/** No access token, refresh token, hash, or authorization code appears in a grant DTO. */
+export interface OAuthGrantDto {
+    id: string;
+    principalId: string;
+    clientId: string;
+    app: string;
+    resource: string;
+    scopes: string[];
+    createdAt: number;
+    expiresAt: number;
+    revokedAt: number | null;
+}
+export interface OAuthAuthorizationRequest {
+    response_type: 'code';
+    client_id: string;
+    redirect_uri: string;
+    resource: string;
+    scope?: string;
+    state?: string;
+    code_challenge: string;
+    code_challenge_method: 'S256';
+}
+export type OAuthAuthorizationCoordinates = Omit<OAuthAuthorizationRequest, 'scope'>;
+export type OAuthAuthorizationParseResult = {
+    kind: 'valid';
+    request: OAuthAuthorizationRequest;
+} | {
+    kind: 'invalid_scope';
+    coordinates: OAuthAuthorizationCoordinates;
+    rawScope: string;
+} | {
+    kind: 'invalid_request';
+};
+export type OAuthTokenRequest = {
+    grant_type: 'authorization_code';
+    client_id: string;
+    code: string;
+    redirect_uri: string;
+    code_verifier: string;
+    resource: string;
+} | {
+    grant_type: 'refresh_token';
+    client_id: string;
+    refresh_token: string;
+    resource: string;
+};
+export interface OAuthTokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+}
+export interface OAuthRevocationRequest {
+    client_id: string;
+    token: string;
+    token_type_hint?: 'access_token' | 'refresh_token';
+}
+export interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    revocation_endpoint: string;
+    jwks_uri: string;
+    response_types_supported: ['code'];
+    grant_types_supported: ['authorization_code', 'refresh_token'];
+    code_challenge_methods_supported: ['S256'];
+    token_endpoint_auth_methods_supported: ['none', 'private_key_jwt'];
+    token_endpoint_auth_signing_alg_values_supported: OAuthClientAssertionAlgorithm[];
+    revocation_endpoint_auth_methods_supported: ['none', 'private_key_jwt'];
+    revocation_endpoint_auth_signing_alg_values_supported: OAuthClientAssertionAlgorithm[];
+    /** RFC 9207: every authorization response carries `iss`. */
+    authorization_response_iss_parameter_supported: true;
+    client_id_metadata_document_supported: true;
+}
+export declare function parseOAuthManagedClient(value: unknown): OAuthManagedClient | null;
+/** A fetched document cannot enlarge the managed registration's exact redirect allowlist. */
+export declare function parseOAuthClientMetadata(value: unknown, registration: OAuthManagedClient): OAuthClientMetadataDocument | null;
+export declare function parseOAuthResourceDto(value: unknown): OAuthResourceDto | null;
+export declare function resolveOAuthAuthorizationScopes(scope: string | undefined, resource: OAuthResourceDto): string[] | null;
+export declare function parseOAuthAuthorizationAttempt(value: unknown): OAuthAuthorizationParseResult;
+export declare function parseOAuthAuthorizationRequest(value: unknown): OAuthAuthorizationRequest | null;
+export declare function parseOAuthTokenRequest(value: unknown): OAuthTokenRequest | null;
+/**
+ * The client credential of a token or revocation request (RFC 7521 §4.2). Neither assertion field is no
+ * credential; a half-present pair, another assertion type or an oversized assertion is null.
+ */
+export declare function parseOAuthClientCredential(value: unknown): OAuthClientCredential | null;
+export declare function parseOAuthRevocationRequest(value: unknown): OAuthRevocationRequest | null;
+export {};

package/types/src/password-policy.d.ts

@@ -0,0 +1,34 @@
+/** The minimum of an installation that never set one: NIST SP 800-63B's for a password that is the only factor. */
+export declare const PASSWORD_DEFAULT_MIN_LENGTH = 15;
+/**
+ * The lowest minimum IAM accepts on a runtime whose verifiers meet OWASP's PBKDF2 cost. Below it a password is a PIN, and
+ * no throttle makes it one a person can be trusted with.
+ */
+export declare const PASSWORD_MIN_LENGTH_FLOOR = 4;
+/** The most code points a password may have, whatever the minimum. */
+export declare const PASSWORD_MAX_LENGTH = 256;
+/** Below this NIST asks for a second factor, which IAM does not have; the console says so. */
+export declare const PASSWORD_SINGLE_FACTOR_FLOOR = 8;
+/** The password policy as IAM applies it now. */
+export interface PasswordPolicyDto {
+    /** The minimum length in Unicode code points that IAM applies to every new password. */
+    minLength: number;
+    /** The minimum of an installation that never set one, `PASSWORD_DEFAULT_MIN_LENGTH`. */
+    defaultMinLength: number;
+    /**
+     * The lowest minimum this IAM accepts. `PASSWORD_MIN_LENGTH_FLOOR` where verifiers meet OWASP's PBKDF2 cost; the
+     * default on a runtime whose cost is lower (a Cloudflare Worker, backlog 201), where a short password is cheap to
+     * crack offline.
+     */
+    minLengthFloor: number;
+    /** The most code points a password may have. */
+    maxLength: number;
+    /** Whether the installation enables password sign-in at all; the minimum waits for it when it does not. */
+    passwordEnabled: boolean;
+    /** When an administrator last changed the minimum, in epoch seconds; null when nobody ever did. */
+    updatedAt: number | null;
+}
+export interface SetPasswordPolicyRequest {
+    /** A whole number from `minLengthFloor` to `maxLength`. */
+    minLength: number;
+}