@fluixi/oauth2 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/module.js

@@ -0,0 +1,22 @@
+/**
+ * The app-module half of this package, listed in `src/app.config.ts`.
+ *
+ * Registers the app's service under `AuthServiceToken` and its client under
+ * `AuthClientToken` on both sides. Package code reaches the service through those tokens,
+ * `OAuthCallback` among it, because a package cannot import the app. The server half, the
+ * routes and session middleware of `tokens: 'server'`, is `authServerModule` in
+ * `@fluixi/oauth2/server`, for `app.config.server.ts`.
+ */
+import { defineModule } from '@fluixi/start/app';
+import { AuthServiceToken, AuthClientToken } from './tokens.js';
+export function authModule(auth) {
+    return defineModule({
+        name: 'oauth2',
+        providers: [
+            // One instance for every request on the server. It holds no per-visitor state there:
+            // the signed-in user comes from request locals, which `sessionLocals` fills per request.
+            { provide: AuthServiceToken, useValue: auth },
+            { provide: AuthClientToken, useValue: auth.client },
+        ],
+    });
+}

package/dist/module.mjs

@@ -0,0 +1,23 @@
+// src/module.ts
+import { defineModule } from "@fluixi/start/app";
+
+// src/tokens.ts
+import { injectionToken } from "@fluixi/start/di";
+var AuthServiceToken = injectionToken("AuthService");
+var AuthClientToken = injectionToken("AuthClient");
+
+// src/module.ts
+function authModule(auth) {
+  return defineModule({
+    name: "oauth2",
+    providers: [
+      // One instance for every request on the server. It holds no per-visitor state there:
+      // the signed-in user comes from request locals, which `sessionLocals` fills per request.
+      { provide: AuthServiceToken, useValue: auth },
+      { provide: AuthClientToken, useValue: auth.client }
+    ]
+  });
+}
+export {
+  authModule
+};

package/dist/server.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.1 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.10 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -31,6 +31,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/server.ts
 var server_exports = {};
 __export(server_exports, {
+  authServerModule: () => authServerModule,
   oauthRoutes: () => oauthRoutes,
   sessionLocals: () => sessionLocals
 });
@@ -206,7 +207,106 @@ function expiryFrom(expiresIn, now = Date.now()) {
   return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
 }
 
+// src/dpop.ts
+async function loadJose2() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose2();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose2();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose2();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function proofFor(key, options) {
+  const jose = await loadJose2();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+
 // src/server.ts
+var import_app = require("@fluixi/start/app");
+var dpopNonces = /* @__PURE__ */ new Map();
+async function prove(headers, key, method, url, accessToken) {
+  headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
+}
+function learnNonce(url, response) {
+  const offered = nonceFrom(response);
+  if (!offered) return false;
+  const origin = new URL(url).origin;
+  const fresh = offered !== dpopNonces.get(origin);
+  dpopNonces.set(origin, offered);
+  return fresh && !response.ok;
+}
+async function withToken(url, session) {
+  const key = session.dpop && session.tokenType?.toLowerCase() === "dpop" ? await importDpopKey(session.dpop) : null;
+  const send = async () => {
+    const headers = {
+      authorization: `${key ? "DPoP" : "Bearer"} ${session.accessToken}`
+    };
+    if (key) await prove(headers, key, "GET", url, session.accessToken);
+    return fetch(url, { headers });
+  };
+  let response = await send();
+  if (key && learnNonce(url, response)) response = await send();
+  return response;
+}
 function oauthRoutes(config) {
   const base = (config.basePath ?? "/auth").replace(/\/$/, "");
   const scopes = config.scopes ?? ["openid", "profile", "email"];
@@ -238,14 +338,19 @@ function oauthRoutes(config) {
     keyId: config.keyId,
     assertionAlgorithm: config.assertionAlgorithm
   };
-  async function tokenRequest(body) {
+  async function tokenRequest(body, key = null) {
     const { token } = await resolve();
-    const headers = {
-      "content-type": "application/x-www-form-urlencoded"
+    const attempt = async () => {
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams(body);
+      await applyClientAuth(clientAuth, token, headers, form);
+      if (key) await prove(headers, key, "POST", token);
+      return fetch(token, { method: "POST", headers, body: form.toString() });
     };
-    const form = new URLSearchParams(body);
-    await applyClientAuth(clientAuth, token, headers, form);
-    const response = await fetch(token, { method: "POST", headers, body: form.toString() });
+    let response = await attempt();
+    if (key && learnNonce(token, response)) response = await attempt();
     const payload = await response.json().catch(() => ({}));
     if (!response.ok) {
       throw new OAuthError(
@@ -312,17 +417,23 @@ function oauthRoutes(config) {
       if (!pending || !state || !timingSafeEqual(pending.state, state)) {
         return json({ error: "state_mismatch" }, 400);
       }
-      const payload = await tokenRequest({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: config.redirectUri,
-        code_verifier: pending.verifier
-      });
+      const key = config.dpop ? await createDpopKey(config.dpopAlgorithm, { extractable: true }) : null;
+      const payload = await tokenRequest(
+        {
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: config.redirectUri,
+          code_verifier: pending.verifier
+        },
+        key
+      );
       const signedIn = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
         idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : void 0,
+        dpop: key ? await exportDpopKey(key) : void 0
       });
       return new Response(null, {
         status: 302,
@@ -342,17 +453,20 @@ function oauthRoutes(config) {
     if (route === "/refresh") {
       const current = await session();
       if (!current?.refreshToken) return json({ error: "no_session" }, 401);
-      const payload = await tokenRequest({
-        grant_type: "refresh_token",
-        refresh_token: current.refreshToken
-      });
+      const key = current.dpop ? await importDpopKey(current.dpop) : null;
+      const payload = await tokenRequest(
+        { grant_type: "refresh_token", refresh_token: current.refreshToken },
+        key
+      );
       const refreshed = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         // A provider that rotates refresh tokens sends a new one; one that does not
         // expects the old one to keep working.
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
         idToken: current.idToken,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : current.tokenType,
+        dpop: current.dpop
       });
       return json({ ok: true }, 200, { "set-cookie": refreshed });
     }
@@ -361,9 +475,7 @@ function oauthRoutes(config) {
       if (!current?.accessToken) return json({ error: "no_session" }, 401);
       const { userinfo } = await resolve();
       if (!userinfo) return json({ error: "no_userinfo" }, 501);
-      const response = await fetch(userinfo, {
-        headers: { authorization: `Bearer ${current.accessToken}` }
-      });
+      const response = await withToken(userinfo, current);
       if (!response.ok) return json({ error: "userinfo_failed" }, response.status);
       const claims = await response.json();
       return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
@@ -453,9 +565,7 @@ function sessionLocals(config) {
     try {
       const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
       if (endpoints?.userinfo) {
-        const response = await fetch(endpoints.userinfo, {
-          headers: { authorization: `Bearer ${session.accessToken}` }
-        });
+        const response = await withToken(endpoints.userinfo, session);
         if (response.ok) {
           const claims = await response.json();
           user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
@@ -468,3 +578,6 @@ function sessionLocals(config) {
     return next();
   };
 }
+function authServerModule(config) {
+  return (0, import_app.defineModule)({ name: "oauth2-server", middleware: [oauthRoutes(config), sessionLocals(config)] });
+}

package/dist/server.d.ts

@@ -1,5 +1,6 @@
 import { type ClientAuthMethodInput } from './client-auth.js';
 import { type Endpoints } from './types.js';
+import { type AppModule } from '@fluixi/start/app';
 export interface OAuthRoutesConfig {
     issuer?: string;
     endpoints?: Endpoints;
@@ -52,6 +53,17 @@ export interface OAuthRoutesConfig {
     userCacheMs?: number;
     /** Map the provider's userinfo onto the app's own shape. */
     mapUser?: (claims: Record<string, unknown>, accessToken: string) => unknown;
+    /**
+     * Bind tokens to a key with DPoP (RFC 9449), which a provider may require: an Okta org
+     * that mandates it refuses a server-mode client without it.
+     *
+     * The key is made per session at the code exchange and kept in the encrypted session
+     * cookie, since a refresh token is bound to the key that obtained it and a refresh with
+     * another key is refused. Needs `jose`.
+     */
+    dpop?: boolean;
+    /** Default `ES256`. Must be in the provider's `dpop_signing_alg_values_supported`. */
+    dpopAlgorithm?: string;
 }
 /**
  * The middleware.
@@ -86,4 +98,12 @@ export declare function oauthRoutes(config: OAuthRoutesConfig): (request: Reques
  * having its session resolved first.
  */
 export declare function sessionLocals(config: OAuthRoutesConfig): (request: Request, next: () => Promise<Response>) => Promise<Response>;
+/**
+ * The server half of `authModule`, listed in `src/app.config.server.ts`: the routes and the
+ * session middleware that `tokens: 'server'` needs, in the order they have to run.
+ *
+ * `oauthRoutes` first, so a request to the login route is answered rather than having its
+ * session resolved on the way past.
+ */
+export declare function authServerModule(config: OAuthRoutesConfig): AppModule;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7E;AAYD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IAwDjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwMrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CA0CrB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5E;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8DD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IA+DjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAmNrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwCrB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAErE"}

package/dist/server.js

@@ -34,6 +34,46 @@ import { applyClientAuth, } from './client-auth.js';
 import { discover } from './discovery.js';
 import { createPkcePair, createStateValue, expiryFrom, timingSafeEqual } from './pkce.js';
 import { OAuthError } from './types.js';
+import { createDpopKey, exportDpopKey, importDpopKey, nonceFrom, proofFor } from './dpop.js';
+import { defineModule } from '@fluixi/start/app';
+/**
+ * Nonces providers asked for, per origin, shared by the routes and `sessionLocals`. A nonce
+ * is the server's to set (RFC 9449 §8, §9), so the latest one it sent is the one to use.
+ */
+const dpopNonces = new Map();
+/** Put a proof for this request on `headers`, with the nonce this origin last asked for. */
+async function prove(headers, key, method, url, accessToken) {
+    headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
+}
+/** Record a nonce the server sent. True when it refused the request with one not seen before. */
+function learnNonce(url, response) {
+    const offered = nonceFrom(response);
+    if (!offered)
+        return false;
+    const origin = new URL(url).origin;
+    const fresh = offered !== dpopNonces.get(origin);
+    dpopNonces.set(origin, offered);
+    return fresh && !response.ok;
+}
+/**
+ * A request carrying the session's access token: the `DPoP` scheme and a proof bound to the
+ * token when the provider bound it, `Bearer` otherwise.
+ */
+async function withToken(url, session) {
+    const key = session.dpop && session.tokenType?.toLowerCase() === 'dpop' ? await importDpopKey(session.dpop) : null;
+    const send = async () => {
+        const headers = {
+            authorization: `${key ? 'DPoP' : 'Bearer'} ${session.accessToken}`,
+        };
+        if (key)
+            await prove(headers, key, 'GET', url, session.accessToken);
+        return fetch(url, { headers });
+    };
+    let response = await send();
+    if (key && learnNonce(url, response))
+        response = await send();
+    return response;
+}
 /**
  * The middleware.
  *
@@ -72,14 +112,23 @@ export function oauthRoutes(config) {
         keyId: config.keyId,
         assertionAlgorithm: config.assertionAlgorithm,
     };
-    async function tokenRequest(body) {
+    async function tokenRequest(body, key = null) {
         const { token } = await resolve();
-        const headers = {
-            'content-type': 'application/x-www-form-urlencoded',
+        // Built afresh for a retry: a `private_key_jwt` assertion carries a `jti`, and sending
+        // the same one twice can be refused as a replay.
+        const attempt = async () => {
+            const headers = {
+                'content-type': 'application/x-www-form-urlencoded',
+            };
+            const form = new URLSearchParams(body);
+            await applyClientAuth(clientAuth, token, headers, form);
+            if (key)
+                await prove(headers, key, 'POST', token);
+            return fetch(token, { method: 'POST', headers, body: form.toString() });
         };
-        const form = new URLSearchParams(body);
-        await applyClientAuth(clientAuth, token, headers, form);
-        const response = await fetch(token, { method: 'POST', headers, body: form.toString() });
+        let response = await attempt();
+        if (key && learnNonce(token, response))
+            response = await attempt();
         const payload = (await response.json().catch(() => ({})));
         if (!response.ok) {
             throw new OAuthError(String(payload.error ?? 'token_request_failed'), String(payload.error ?? 'token_request_failed'));
@@ -146,17 +195,23 @@ export function oauthRoutes(config) {
             if (!pending || !state || !timingSafeEqual(pending.state, state)) {
                 return json({ error: 'state_mismatch' }, 400);
             }
+            // The token is bound here, at the exchange, so this is where the session's key is made.
+            const key = config.dpop
+                ? await createDpopKey(config.dpopAlgorithm, { extractable: true })
+                : null;
             const payload = await tokenRequest({
                 grant_type: 'authorization_code',
                 code,
                 redirect_uri: config.redirectUri,
                 code_verifier: pending.verifier,
-            });
+            }, key);
             const signedIn = await cookie.write({
                 accessToken: String(payload.access_token ?? ''),
                 refreshToken: typeof payload.refresh_token === 'string' ? payload.refresh_token : undefined,
                 idToken: typeof payload.id_token === 'string' ? payload.id_token : undefined,
                 expiresAt: expiryFrom(payload.expires_in),
+                tokenType: typeof payload.token_type === 'string' ? payload.token_type : undefined,
+                dpop: key ? await exportDpopKey(key) : undefined,
             });
             return new Response(null, {
                 status: 302,
@@ -177,10 +232,9 @@ export function oauthRoutes(config) {
             const current = await session();
             if (!current?.refreshToken)
                 return json({ error: 'no_session' }, 401);
-            const payload = await tokenRequest({
-                grant_type: 'refresh_token',
-                refresh_token: current.refreshToken,
-            });
+            // The key that obtained the refresh token, or the provider refuses the refresh.
+            const key = current.dpop ? await importDpopKey(current.dpop) : null;
+            const payload = await tokenRequest({ grant_type: 'refresh_token', refresh_token: current.refreshToken }, key);
             const refreshed = await cookie.write({
                 accessToken: String(payload.access_token ?? ''),
                 // A provider that rotates refresh tokens sends a new one; one that does not
@@ -190,6 +244,8 @@ export function oauthRoutes(config) {
                     : current.refreshToken,
                 idToken: current.idToken,
                 expiresAt: expiryFrom(payload.expires_in),
+                tokenType: typeof payload.token_type === 'string' ? payload.token_type : current.tokenType,
+                dpop: current.dpop,
             });
             return json({ ok: true }, 200, { 'set-cookie': refreshed });
         }
@@ -200,9 +256,7 @@ export function oauthRoutes(config) {
             const { userinfo } = await resolve();
             if (!userinfo)
                 return json({ error: 'no_userinfo' }, 501);
-            const response = await fetch(userinfo, {
-                headers: { authorization: `Bearer ${current.accessToken}` },
-            });
+            const response = await withToken(userinfo, current);
             if (!response.ok)
                 return json({ error: 'userinfo_failed' }, response.status);
             const claims = (await response.json());
@@ -338,9 +392,7 @@ export function sessionLocals(config) {
         try {
             const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
             if (endpoints?.userinfo) {
-                const response = await fetch(endpoints.userinfo, {
-                    headers: { authorization: `Bearer ${session.accessToken}` },
-                });
+                const response = await withToken(endpoints.userinfo, session);
                 if (response.ok) {
                     const claims = (await response.json());
                     user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;
@@ -358,3 +410,13 @@ export function sessionLocals(config) {
         return next();
     };
 }
+/**
+ * The server half of `authModule`, listed in `src/app.config.server.ts`: the routes and the
+ * session middleware that `tokens: 'server'` needs, in the order they have to run.
+ *
+ * `oauthRoutes` first, so a request to the login route is answered rather than having its
+ * session resolved on the way past.
+ */
+export function authServerModule(config) {
+    return defineModule({ name: 'oauth2-server', middleware: [oauthRoutes(config), sessionLocals(config)] });
+}