@flowdular/sdk 0.2.4 → 0.3.1

package/modules/auth/src/server/http.ts

@@ -127,10 +127,11 @@ export function actorOf(session: AuthSession): AuthActor {
 	};
 }
 
-export function sessionPayload(
+export async function sessionPayload(
 	session: AuthSession,
 	runtime: AuthRuntime,
-): Record<string, unknown> {
+): Promise<Record<string, unknown>> {
+	await runtime.moduleSettings.prime(session.principal.tenantId);
 	return {
 		principal: session.principal,
 		csrfToken: session.csrfToken,

package/modules/auth/src/server/index.ts

@@ -16,13 +16,34 @@ export type {
 	AuthRuntimeOptions,
 } from './runtime.ts';
 export { sessionMutationDenial } from './session-security.ts';
+export {
+	createMfaEnrolmentMiddleware,
+	guardMfaSettings,
+	mfaEnrolmentSatisfied,
+	MFA_ENROLMENT_REQUIRED,
+	MFA_KEY_REQUIRED,
+} from './mfa-enforcement.ts';
+export type { MfaEnrolmentGate } from './mfa-enforcement.ts';
+export { createOidcVerifier } from './oidc.ts';
+export type { OidcVerifier, VerifiedIdToken } from './oidc.ts';
 export {
 	createPlatformAgentRegistry,
 	createPlatformCapabilityRegistry,
 	createPlatformToolRegistry,
 } from '@flowdular/sdk/kernel';
 export { AuthServiceError } from '../services/auth-service-error.ts';
-export { AUDIT_ACTIONS, AUDIT_ACTION_LIST } from '../services/auth-service.ts';
+/* The platform mail port opens its SMTP connection with this factory: auth.core
+   is the module that declares the mail client dependency. */
+export { nodemailerSmtpTransport } from '../services/mail-smtp.ts';
+export {
+	AUDIT_ACTIONS,
+	AUDIT_ACTION_LIST,
+	TENANT_MEMBER_LOOKUP_LIMIT,
+	TENANT_MEMBER_SEARCH_LIMIT,
+	TENANT_MEMBER_SEARCH_TERM_LENGTH,
+	TENANT_MEMBER_SORTS,
+} from '../services/auth-service.ts';
+export type { TenantMemberSortedInput } from '../services/auth-service.ts';
 export {
 	AUTH_PRINCIPAL_STATE_KEY,
 	AUTH_SESSION_STATE_KEY,

package/modules/auth/src/server/membership-endpoints.ts

@@ -0,0 +1,62 @@
+import { ServerRoute } from '@octanejs/app-core';
+import { readJsonObject } from '@flowdular/sdk/server';
+import { BUNDLED_MODULE_SCOPES } from '../acl/scopes.ts';
+import { AuthServiceError } from '../services/auth-service-error.ts';
+import {
+	actorOf,
+	errorResponse,
+	requireScope,
+	requireSession,
+	response,
+	stringField,
+} from './http.ts';
+import type { AuthRuntime } from './runtime.ts';
+import { sessionMutationDenial } from './session-security.ts';
+
+/**
+ * The administration port users.core calls to disable or re-enable a member of
+ * the acting workspace. The workspace comes from the principal, so a target in
+ * another workspace answers exactly as an unknown account.
+ */
+export function createMembershipRoutes(
+	runtime: AuthRuntime,
+): readonly ServerRoute[] {
+	const status = new ServerRoute({
+		path: '/api/auth/memberships/status',
+		methods: ['POST'],
+		handler: async (context) => {
+			const denial = sessionMutationDenial(context, runtime);
+			if (denial) return denial;
+			try {
+				const session = requireSession(context);
+				requireScope(session, BUNDLED_MODULE_SCOPES.usersManage);
+				const body = await readJsonObject(context.request);
+				const accountId = stringField(body, 'accountId');
+				const value = stringField(body, 'status');
+				if (accountId.length === 0 || accountId.length > 128) {
+					throw new AuthServiceError(
+						'INVALID_INPUT',
+						'accountId is invalid.',
+						400,
+					);
+				}
+				if (value !== 'active' && value !== 'disabled') {
+					throw new AuthServiceError(
+						'INVALID_INPUT',
+						'status must be active or disabled.',
+						400,
+					);
+				}
+				return response({
+					membership: await (
+						await runtime.service()
+					).setMembershipStatus(actorOf(session), accountId, value),
+				});
+			} catch (error) {
+				return errorResponse(error, '[auth.core] membership request failed');
+			}
+		},
+	});
+
+	return [status];
+}

package/modules/auth/src/server/mfa-enforcement.ts

@@ -0,0 +1,156 @@
+import type { Middleware } from '@octanejs/app-core';
+import {
+	ModuleSettingsError,
+	type ModuleSettingsRuntime,
+} from '@flowdular/sdk/kernel';
+import { readJsonObject } from '@flowdular/sdk/server';
+import {
+	isTokenPrincipal,
+	principalFromContext,
+} from '../middleware/authentication.ts';
+import type { AuthPrincipal } from '../domain/types.ts';
+import type { AuthService } from '../services/auth-service.ts';
+import type { AuthTenantSettings } from '../settings.ts';
+
+export const MFA_ENROLMENT_REQUIRED = 'MFA_ENROLMENT_REQUIRED';
+export const MFA_KEY_REQUIRED = 'MFA_KEY_REQUIRED';
+
+const MFA_KEY_REQUIRED_MESSAGE =
+	'Required multi-factor authentication needs a deployment MFA encryption key; none is configured.';
+
+/* Routes an account still has to reach while it holds no second factor: the
+   shell's own identity read, the enrolment exchange itself, the workspace
+   settings that carry the requirement, and the ways out of the workspace.
+   Everything else under /api answers with the enrolment problem; nothing
+   outside /api is gated here, so the shell that carries the enrolment screen
+   keeps loading. Module web surfaces are covered by mfaEnrolmentSatisfied in
+   the composition's identity resolver instead. */
+const ENROLMENT_PATHS: ReadonlySet<string> = new Set([
+	/* Platform probes answer the same to everyone; a session cookie that happens
+	   to ride along must not turn one into a workspace decision. */
+	'/api/health',
+	'/api/ready',
+	'/api/auth/config',
+	'/api/auth/session',
+	'/api/auth/mfa/status',
+	'/api/auth/mfa/enroll',
+	'/api/auth/mfa/confirm',
+	'/api/auth/mfa/challenge',
+	'/api/auth/password',
+	'/api/auth/switch-tenant',
+	'/api/auth/sign-out',
+	/* The requirement is a stored setting, and an owner who turned it on before
+	   enrolling has to be able to read it and turn it off again. The read stays
+	   open; the write is narrowed to that one setting below. Both routes still
+	   demand the settings scopes and, for the write, a session and a CSRF
+	   proof. */
+	'/api/settings',
+]);
+
+const SETTINGS_UPDATE_PATH = '/api/settings/update';
+
+/* The settings write is open only for the setting that reverses the hold, so
+   an unenrolled owner cannot administer the rest of the workspace through the
+   one route that has to stay reachable. The body is read from a clone under
+   the bound the endpoint itself applies, leaving the handler an unconsumed
+   request; an unreadable body targets nothing and stays held. */
+async function targetsRequireMfa(request: Request): Promise<boolean> {
+	try {
+		const body = await readJsonObject(request.clone());
+		return body.moduleId === 'auth.core' && body.key === 'requireMfa';
+	} catch {
+		return false;
+	}
+}
+
+export interface MfaEnrolmentGate {
+	/** Live auth.core settings of one workspace, after stored values landed. */
+	tenantSettings(tenantId: string): Promise<AuthTenantSettings>;
+	service(): Promise<Pick<AuthService, 'hasConfirmedMfa'>>;
+}
+
+/**
+ * Whether a principal meets its workspace's enrolment requirement. A workspace
+ * that does not require enrolment pays one read of a primed settings snapshot
+ * and no query. Every surface that resolves an identity of its own, including
+ * module web pages, answers this before it serves workspace data.
+ */
+export async function mfaEnrolmentSatisfied(
+	gate: MfaEnrolmentGate,
+	principal: AuthPrincipal,
+): Promise<boolean> {
+	const settings = await gate.tenantSettings(principal.tenantId);
+	if (!settings.requireMfa) return true;
+	return (await gate.service()).hasConfirmedMfa(principal.accountId);
+}
+
+/**
+ * Holds a member of a workspace that requires multi-factor authentication at
+ * enrolment. It runs after the principal is resolved, so it sees exactly what
+ * an endpoint's identity resolver sees.
+ */
+export function createMfaEnrolmentMiddleware(
+	gate: MfaEnrolmentGate,
+): Middleware {
+	return async (context, next) => {
+		const principal = principalFromContext(context);
+		if (!principal) return next();
+		/* A machine credential cannot enrol anything, and its authority is
+		   already the intersection of its recorded scopes with the live
+		   membership. Holding it here would close the workspace to every
+		   integration with no way out; browser sessions stay gated. */
+		if (isTokenPrincipal(context)) return next();
+		const path = context.url.pathname;
+		if (!path.startsWith('/api/') || ENROLMENT_PATHS.has(path)) return next();
+		if (await mfaEnrolmentSatisfied(gate, principal)) return next();
+		if (
+			path === SETTINGS_UPDATE_PATH &&
+			(await targetsRequireMfa(context.request))
+		) {
+			return next();
+		}
+		return Response.json(
+			{
+				error: {
+					code: MFA_ENROLMENT_REQUIRED,
+					message:
+						'This workspace requires multi-factor authentication. Enrol an authenticator to continue.',
+				},
+			},
+			{ status: 403, headers: { 'cache-control': 'no-store' } },
+		);
+	};
+}
+
+/**
+ * Refuses `auth.core.requireMfa` on a deployment that configured no MFA
+ * encryption key, the way email confirmation is refused without a mail
+ * transport. Without the key enrolment answers 503, so the requirement would
+ * close every workspace API to every member with nothing left to undo it.
+ */
+export function guardMfaSettings(
+	settings: ModuleSettingsRuntime,
+	mfaKeyConfigured: boolean,
+): ModuleSettingsRuntime {
+	if (mfaKeyConfigured) return settings;
+	return {
+		declare: (declaration) => settings.declare(declaration),
+		declarations: () => settings.declarations(),
+		prime: (tenantId) => settings.prime(tenantId),
+		get: (tenantId, moduleId, key) => settings.get(tenantId, moduleId, key),
+		list: (tenantId) => settings.list(tenantId),
+		set(tenantId, moduleId, key, value, actor) {
+			if (moduleId === 'auth.core' && key === 'requireMfa' && value === true) {
+				return Promise.reject(
+					new ModuleSettingsError(
+						MFA_KEY_REQUIRED,
+						MFA_KEY_REQUIRED_MESSAGE,
+						409,
+					),
+				);
+			}
+			return settings.set(tenantId, moduleId, key, value, actor);
+		},
+		onChange: (listener) => settings.onChange(listener),
+	};
+}

package/modules/auth/src/server/oidc.ts

@@ -0,0 +1,389 @@
+import {
+	createPublicKey,
+	timingSafeEqual,
+	verify,
+	type JsonWebKey,
+} from 'node:crypto';
+import { AuthServiceError } from '../services/auth-service-error.ts';
+import { assertProviderHostAllowed } from './provider-host.ts';
+import type { OidcProvider } from './runtime.ts';
+
+export const OIDC_REQUEST_TIMEOUT_MS = 10_000;
+export const OIDC_RESPONSE_MAX_BYTES = 64 * 1024;
+/* Discovery and the key set are refetched on this interval. A provider that
+   rotates keys stays verifiable within it without a request per sign-in. */
+const PROVIDER_KEY_TTL_MS = 10 * 60 * 1000;
+/* An unknown kid may be a rotation that happened inside the window above. One
+   refetch per provider per minute follows it without letting a forged kid turn
+   into an outbound request per attempt. */
+const KEY_REFRESH_INTERVAL_MS = 60_000;
+const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
+const MAX_ID_TOKEN_BYTES = 8 * 1024;
+const MAX_SUBJECT_LENGTH = 128;
+const SUPPORTED_ALGORITHMS: ReadonlySet<string> = new Set(['RS256', 'ES256']);
+
+/* A workspace may add providers of its own, so the number of distinct providers
+   this cache can see is no longer the eight the environment configures. It is
+   bounded here instead: the oldest entry goes when a new one arrives above the
+   limit, and an evicted provider only pays for one more discovery. */
+const PROVIDER_KEY_CACHE_LIMIT = 256;
+
+export function oidcFailure(): AuthServiceError {
+	return new AuthServiceError(
+		'OIDC_AUTHENTICATION_FAILED',
+		'External sign-in could not be completed.',
+		401,
+	);
+}
+
+/** What an administrator sees when an issuer does not verify at save time. */
+export function oidcIssuerUnverified(): AuthServiceError {
+	return new AuthServiceError(
+		'PROVIDER_ISSUER_UNVERIFIED',
+		'The issuer did not answer a discovery document naming itself.',
+		400,
+	);
+}
+
+/** The endpoints an issuer publishes for itself. */
+export interface OidcDiscovery {
+	readonly authorizationEndpoint: string;
+	readonly tokenEndpoint: string;
+	readonly userInfoEndpoint: string;
+}
+
+/**
+ * Verifies an issuer the way every ID token is verified against it: the
+ * document has to be served under the issuer and name the same issuer back.
+ * The endpoints it publishes are what a tenant-owned provider is saved with,
+ * so a sign-in costs no discovery request of its own.
+ *
+ * The issuer is host-guarded before the request leaves, and so is every
+ * endpoint the document publishes: those are stored and fetched again at every
+ * sign-in, so a document that answers with a loopback or literal address must
+ * never become a stored row.
+ */
+export async function discoverOidcProvider(
+	issuer: string,
+	allowlist: readonly string[] = [],
+): Promise<OidcDiscovery> {
+	assertProviderHostAllowed(issuer, allowlist, 'issuer');
+	let document: {
+		readonly issuer?: unknown;
+		readonly authorization_endpoint?: unknown;
+		readonly token_endpoint?: unknown;
+		readonly userinfo_endpoint?: unknown;
+	};
+	try {
+		document = (await fetchJson(
+			`${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`,
+		)) as typeof document;
+	} catch {
+		throw oidcIssuerUnverified();
+	}
+	if (typeof document.issuer !== 'string' || !equals(document.issuer, issuer)) {
+		throw oidcIssuerUnverified();
+	}
+	let endpoints: OidcDiscovery;
+	try {
+		endpoints = {
+			authorizationEndpoint: httpsUrl(document.authorization_endpoint),
+			tokenEndpoint: httpsUrl(document.token_endpoint),
+			userInfoEndpoint: httpsUrl(document.userinfo_endpoint),
+		};
+	} catch {
+		throw oidcIssuerUnverified();
+	}
+	assertProviderHostAllowed(
+		endpoints.authorizationEndpoint,
+		allowlist,
+		'authorizationEndpoint',
+	);
+	assertProviderHostAllowed(
+		endpoints.tokenEndpoint,
+		allowlist,
+		'tokenEndpoint',
+	);
+	assertProviderHostAllowed(
+		endpoints.userInfoEndpoint,
+		allowlist,
+		'userInfoEndpoint',
+	);
+	return endpoints;
+}
+
+/* A provider response is foreign input on the identity path: it is read with a
+   declared and a streamed ceiling, so a hostile or broken endpoint cannot make
+   the server hold an unbounded body. */
+export async function readOidcJson(response: Response): Promise<unknown> {
+	const declared = Number(response.headers.get('content-length') ?? 0);
+	if (
+		(Number.isFinite(declared) && declared > OIDC_RESPONSE_MAX_BYTES) ||
+		!response.body
+	)
+		throw oidcFailure();
+	const reader = response.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			total += chunk.value.byteLength;
+			if (total > OIDC_RESPONSE_MAX_BYTES) {
+				await reader.cancel();
+				throw oidcFailure();
+			}
+			chunks.push(chunk.value);
+		}
+		return JSON.parse(Buffer.concat(chunks, total).toString('utf8')) as unknown;
+	} catch (error) {
+		if (error instanceof AuthServiceError) throw error;
+		throw oidcFailure();
+	}
+}
+
+export interface VerifiedIdToken {
+	/** The provider `sub`; the stable identity the account is linked to. */
+	readonly subject: string;
+}
+
+export interface OidcVerifier {
+	/** Verifies signature, issuer, audience, freshness and nonce, or throws. */
+	verifyIdToken(
+		provider: OidcProvider,
+		idToken: string,
+		nonce: string,
+	): Promise<VerifiedIdToken>;
+	/**
+	 * Drops every key set cached for a provider id, so an updated or deleted
+	 * workspace provider leaves none behind. Scanning the cache is what keeps
+	 * the cached entry addressable by issuer; it is bounded by
+	 * `PROVIDER_KEY_CACHE_LIMIT` and runs only when a provider row changes.
+	 */
+	forget(providerId: string): void;
+}
+
+interface ProviderKeys {
+	readonly keys: readonly JsonWebKey[];
+	readonly fetchedAt: number;
+}
+
+interface JwtHeader {
+	readonly alg?: unknown;
+	readonly kid?: unknown;
+}
+
+interface IdTokenClaims {
+	readonly iss?: unknown;
+	readonly aud?: unknown;
+	readonly azp?: unknown;
+	readonly exp?: unknown;
+	readonly iat?: unknown;
+	readonly nonce?: unknown;
+	readonly sub?: unknown;
+}
+
+function equals(left: string, right: string): boolean {
+	const leftBuffer = Buffer.from(left, 'utf8');
+	const rightBuffer = Buffer.from(right, 'utf8');
+	return (
+		leftBuffer.byteLength === rightBuffer.byteLength &&
+		timingSafeEqual(leftBuffer, rightBuffer)
+	);
+}
+
+function decodeSegment(value: string): Record<string, unknown> {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+	} catch {
+		throw oidcFailure();
+	}
+	if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+		throw oidcFailure();
+	return parsed as Record<string, unknown>;
+}
+
+function seconds(value: unknown): number {
+	if (typeof value !== 'number' || !Number.isFinite(value)) throw oidcFailure();
+	return value * 1000;
+}
+
+async function fetchJson(url: string): Promise<unknown> {
+	let response: Response;
+	try {
+		response = await fetch(url, {
+			headers: { accept: 'application/json' },
+			signal: AbortSignal.timeout(OIDC_REQUEST_TIMEOUT_MS),
+		});
+	} catch {
+		throw oidcFailure();
+	}
+	if (!response.ok) throw oidcFailure();
+	return readOidcJson(response);
+}
+
+function httpsUrl(value: unknown): string {
+	if (typeof value !== 'string' || value.length > 2_048) throw oidcFailure();
+	try {
+		if (new URL(value).protocol !== 'https:') throw new Error();
+	} catch {
+		throw oidcFailure();
+	}
+	return value;
+}
+
+/**
+ * Verifies provider ID tokens against the key set the provider publishes. The
+ * cache holds one entry per provider it has seen, capped at
+ * `PROVIDER_KEY_CACHE_LIMIT` entries, so workspaces adding providers of their
+ * own bound it by configuration rather than by traffic.
+ */
+export function createOidcVerifier(now: () => number = Date.now): OidcVerifier {
+	const cached = new Map<string, ProviderKeys>();
+
+	/* The issuer is part of the key: a workspace that repoints a provider at
+	   another issuer must not keep verifying tokens against the key set the old
+	   one published, whatever the entry's age. */
+	const cacheKey = (provider: OidcProvider): string =>
+		`${provider.id}\0${provider.issuer}`;
+
+	const load = async (provider: OidcProvider): Promise<ProviderKeys> => {
+		const discovery = (await fetchJson(
+			`${provider.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`,
+		)) as { readonly issuer?: unknown; readonly jwks_uri?: unknown };
+		/* The document has to name the same issuer it was fetched for, or a
+		   redirect could hand this server another provider's key set. */
+		if (
+			typeof discovery.issuer !== 'string' ||
+			!equals(discovery.issuer, provider.issuer)
+		)
+			throw oidcFailure();
+		const document = (await fetchJson(httpsUrl(discovery.jwks_uri))) as {
+			readonly keys?: unknown;
+		};
+		if (!Array.isArray(document.keys) || document.keys.length > 32)
+			throw oidcFailure();
+		const keys = document.keys.filter(
+			(key): key is JsonWebKey =>
+				!!key && typeof key === 'object' && !Array.isArray(key),
+		);
+		const entry: ProviderKeys = { keys, fetchedAt: now() };
+		const key = cacheKey(provider);
+		cached.delete(key);
+		if (cached.size >= PROVIDER_KEY_CACHE_LIMIT) {
+			const oldest = cached.keys().next().value;
+			if (oldest !== undefined) cached.delete(oldest);
+		}
+		cached.set(key, entry);
+		return entry;
+	};
+
+	const keysFor = async (provider: OidcProvider): Promise<ProviderKeys> => {
+		const entry = cached.get(cacheKey(provider));
+		return entry && now() - entry.fetchedAt < PROVIDER_KEY_TTL_MS
+			? entry
+			: load(provider);
+	};
+
+	const selectKey = (
+		entry: ProviderKeys,
+		kid: string | null,
+	): JsonWebKey | null => {
+		if (kid === null) return entry.keys.length === 1 ? entry.keys[0]! : null;
+		return entry.keys.find((key) => key.kid === kid) ?? null;
+	};
+
+	return {
+		forget(providerId) {
+			const prefix = `${providerId}\0`;
+			for (const key of cached.keys()) {
+				if (key.startsWith(prefix)) cached.delete(key);
+			}
+		},
+		async verifyIdToken(provider, idToken, nonce) {
+			if (
+				typeof idToken !== 'string' ||
+				Buffer.byteLength(idToken, 'utf8') > MAX_ID_TOKEN_BYTES
+			)
+				throw oidcFailure();
+			const parts = idToken.split('.');
+			if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2])
+				throw oidcFailure();
+			const header = decodeSegment(parts[0]) as JwtHeader;
+			if (
+				typeof header.alg !== 'string' ||
+				!SUPPORTED_ALGORITHMS.has(header.alg)
+			)
+				throw oidcFailure();
+			const kid = typeof header.kid === 'string' ? header.kid : null;
+			let entry = await keysFor(provider);
+			let jwk = selectKey(entry, kid);
+			if (!jwk && now() - entry.fetchedAt >= KEY_REFRESH_INTERVAL_MS) {
+				entry = await load(provider);
+				jwk = selectKey(entry, kid);
+			}
+			if (!jwk) throw oidcFailure();
+			/* The key has to be of the kind the header claims, so a published key
+			   can never be read under another algorithm's rules. */
+			if (jwk.kty !== (header.alg === 'RS256' ? 'RSA' : 'EC'))
+				throw oidcFailure();
+			if (header.alg === 'ES256' && jwk.crv !== 'P-256') throw oidcFailure();
+			let verified = false;
+			try {
+				verified = verify(
+					'sha256',
+					Buffer.from(`${parts[0]}.${parts[1]}`, 'ascii'),
+					{
+						key: createPublicKey({ key: jwk, format: 'jwk' }),
+						/* ES256 signatures are the raw r||s pair; RSA ignores this. */
+						dsaEncoding: 'ieee-p1363',
+					},
+					Buffer.from(parts[2], 'base64url'),
+				);
+			} catch {
+				throw oidcFailure();
+			}
+			if (!verified) throw oidcFailure();
+
+			const claims = decodeSegment(parts[1]) as IdTokenClaims;
+			if (
+				typeof claims.iss !== 'string' ||
+				!equals(claims.iss, provider.issuer)
+			)
+				throw oidcFailure();
+			const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+			if (
+				audiences.length > 8 ||
+				!audiences.some(
+					(audience) =>
+						typeof audience === 'string' && equals(audience, provider.clientId),
+				)
+			)
+				throw oidcFailure();
+			/* More than one audience means the token was minted for another party
+			   as well; only the authorized party may present it here. */
+			if (
+				audiences.length > 1 &&
+				(typeof claims.azp !== 'string' ||
+					!equals(claims.azp, provider.clientId))
+			)
+				throw oidcFailure();
+			const current = now();
+			if (seconds(claims.exp) + MAX_CLOCK_SKEW_MS <= current)
+				throw oidcFailure();
+			if (Math.abs(current - seconds(claims.iat)) > MAX_CLOCK_SKEW_MS)
+				throw oidcFailure();
+			if (typeof claims.nonce !== 'string' || !equals(claims.nonce, nonce))
+				throw oidcFailure();
+			if (
+				typeof claims.sub !== 'string' ||
+				claims.sub.length === 0 ||
+				claims.sub.length > MAX_SUBJECT_LENGTH
+			)
+				throw oidcFailure();
+			return { subject: claims.sub };
+		},
+	};
+}