@fluixi/oauth2 1.0.0-alpha.1

package/dist/dpop-NS7NKOWM.mjs

@@ -0,0 +1,79 @@
+import {
+  OAuthError
+} from "./chunk-OGSFNTKA.mjs";
+import "./chunk-7P6ASYW6.mjs";
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("./browser-FDUOEUM2.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+export {
+  boundKeyOf,
+  createDpopKey,
+  nonceFrom,
+  proofFor,
+  thumbprintOf,
+  wantsNonce
+};

package/dist/dpop-store.cjs

@@ -0,0 +1,152 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/dpop-store.ts
+var dpop_store_exports = {};
+__export(dpop_store_exports, {
+  forgetKey: () => forgetKey,
+  keyFor: () => keyFor
+});
+module.exports = __toCommonJS(dpop_store_exports);
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+
+// src/dpop-store.ts
+var DB = "fluixi-oauth2-dpop";
+var STORE = "keys";
+function available() {
+  return typeof indexedDB !== "undefined";
+}
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB, 1);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE)) db.createObjectStore(STORE);
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("indexedDB.open failed"));
+  });
+}
+function act(mode, run) {
+  return open().then(
+    (db) => new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE, mode);
+      const request = run(tx.objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("DPoP key request failed"));
+      tx.oncomplete = () => db.close();
+    })
+  );
+}
+function usable(value) {
+  const stored = value;
+  return !!stored && typeof stored.thumbprint === "string" && typeof stored.alg === "string" && !!stored.publicJwk && // A CryptoKey survives the round trip as a CryptoKey. Anything else means the record was
+  // written by something other than this, and binding to it would fail at the provider.
+  typeof stored.privateKey?.type === "string";
+}
+async function keyFor(clientKey, alg = "ES256", onEphemeral) {
+  if (!available()) {
+    onEphemeral?.("This environment has no IndexedDB, so the key lasts only as long as this document.");
+    return createDpopKey(alg);
+  }
+  try {
+    const found = await act("readonly", (store) => store.get(clientKey));
+    if (usable(found) && found.alg === alg) {
+      return {
+        privateKey: found.privateKey,
+        publicJwk: found.publicJwk,
+        thumbprint: found.thumbprint,
+        alg: found.alg
+      };
+    }
+  } catch (cause) {
+    onEphemeral?.(
+      `The stored DPoP key could not be read (${cause instanceof Error ? cause.message : String(cause)}), so a new one was made.`
+    );
+  }
+  const key = await createDpopKey(alg);
+  try {
+    await act(
+      "readwrite",
+      (store) => store.put(
+        {
+          privateKey: key.privateKey,
+          publicJwk: key.publicJwk,
+          thumbprint: key.thumbprint,
+          alg: key.alg
+        },
+        clientKey
+      )
+    );
+  } catch (cause) {
+    onEphemeral?.(
+      `The DPoP key could not be stored (${cause instanceof Error ? cause.message : String(cause)}), so a refresh after the next navigation will be refused.`
+    );
+  }
+  return key;
+}
+async function forgetKey(clientKey) {
+  if (!available()) return;
+  try {
+    await act("readwrite", (store) => store.delete(clientKey));
+  } catch {
+  }
+}

package/dist/dpop-store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Keeping a DPoP key across page loads.
+ *
+ * RFC 9449 §5 binds a refresh token to the key that obtained it, and a refresh must be
+ * proved with that same key. A key held only in a variable does not survive a navigation,
+ * so the refresh token it came with is unusable from the next document onwards. Okta says so
+ * plainly: `invalid_dpop_proof: Invalid DPoP Public Key binding in refresh token`. Browser
+ * mode reaches a new document on every sign in, because the callback navigates, so without
+ * persistence DPoP and refresh cannot both work.
+ *
+ * IndexedDB rather than `localStorage`, because it stores a `CryptoKey` itself. The
+ * structured clone of a key created with `extractable: false` keeps that property, so the
+ * private half is written by the browser, read back by the browser, and never becomes bytes
+ * any script can see. `localStorage` holds strings, which would mean exporting the key, and
+ * an exported key in storage is a password with extra steps.
+ *
+ * One key per client, so two clients on the same origin cannot bind to each other's.
+ */
+import { type DpopKey } from './dpop.js';
+/**
+ * The key for `clientKey`, from storage when one is there and newly made when not.
+ *
+ * A failure to persist is not a failure to authenticate: the key is still returned, so the
+ * flow continues with a key that lasts as long as the document. `onEphemeral` says when that
+ * happened, because the consequence is real and silent otherwise, a refresh will be refused
+ * after the next navigation.
+ */
+export declare function keyFor(clientKey: string, alg?: string, onEphemeral?: (reason: string) => void): Promise<DpopKey>;
+/**
+ * Forget the key for `clientKey`.
+ *
+ * Part of signing out. A key left behind is not a credential on its own, since the tokens
+ * bound to it are gone, but the next sign in should not be provably the same client as the
+ * last: that is a correlator handed to the provider for nothing.
+ */
+export declare function forgetKey(clientKey: string): Promise<void>;
+//# sourceMappingURL=dpop-store.d.ts.map

package/dist/dpop-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop-store.d.ts","sourceRoot":"","sources":["../src/dpop-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AA6DxD;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,SAAS,EAAE,MAAM,EACjB,GAAG,SAAU,EACb,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACrC,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE"}

package/dist/dpop-store.js

@@ -0,0 +1,119 @@
+/**
+ * Keeping a DPoP key across page loads.
+ *
+ * RFC 9449 §5 binds a refresh token to the key that obtained it, and a refresh must be
+ * proved with that same key. A key held only in a variable does not survive a navigation,
+ * so the refresh token it came with is unusable from the next document onwards. Okta says so
+ * plainly: `invalid_dpop_proof: Invalid DPoP Public Key binding in refresh token`. Browser
+ * mode reaches a new document on every sign in, because the callback navigates, so without
+ * persistence DPoP and refresh cannot both work.
+ *
+ * IndexedDB rather than `localStorage`, because it stores a `CryptoKey` itself. The
+ * structured clone of a key created with `extractable: false` keeps that property, so the
+ * private half is written by the browser, read back by the browser, and never becomes bytes
+ * any script can see. `localStorage` holds strings, which would mean exporting the key, and
+ * an exported key in storage is a password with extra steps.
+ *
+ * One key per client, so two clients on the same origin cannot bind to each other's.
+ */
+import { createDpopKey } from './dpop.js';
+const DB = 'fluixi-oauth2-dpop';
+const STORE = 'keys';
+/** Whether this environment can persist a key at all. */
+function available() {
+    return typeof indexedDB !== 'undefined';
+}
+function open() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open(DB, 1);
+        request.onupgradeneeded = () => {
+            const db = request.result;
+            if (!db.objectStoreNames.contains(STORE))
+                db.createObjectStore(STORE);
+        };
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error ?? new Error('indexedDB.open failed'));
+    });
+}
+/** One transaction, wrapped so a caller sees a promise rather than three events. */
+function act(mode, run) {
+    return open().then((db) => new Promise((resolve, reject) => {
+        const tx = db.transaction(STORE, mode);
+        const request = run(tx.objectStore(STORE));
+        request.onsuccess = () => resolve(request.result);
+        request.onerror = () => reject(request.error ?? new Error('DPoP key request failed'));
+        tx.oncomplete = () => db.close();
+    }));
+}
+/** Whether what came back is a usable key rather than a partial or stale record. */
+function usable(value) {
+    const stored = value;
+    return (!!stored &&
+        typeof stored.thumbprint === 'string' &&
+        typeof stored.alg === 'string' &&
+        !!stored.publicJwk &&
+        // A CryptoKey survives the round trip as a CryptoKey. Anything else means the record was
+        // written by something other than this, and binding to it would fail at the provider.
+        typeof stored.privateKey?.type === 'string');
+}
+/**
+ * The key for `clientKey`, from storage when one is there and newly made when not.
+ *
+ * A failure to persist is not a failure to authenticate: the key is still returned, so the
+ * flow continues with a key that lasts as long as the document. `onEphemeral` says when that
+ * happened, because the consequence is real and silent otherwise, a refresh will be refused
+ * after the next navigation.
+ */
+export async function keyFor(clientKey, alg = 'ES256', onEphemeral) {
+    if (!available()) {
+        onEphemeral?.('This environment has no IndexedDB, so the key lasts only as long as this document.');
+        return createDpopKey(alg);
+    }
+    try {
+        const found = await act('readonly', (store) => store.get(clientKey));
+        // The algorithm is part of the identity: a config changed from ES256 to RS256 must not
+        // keep proving with the old key, since the provider was told which to expect.
+        if (usable(found) && found.alg === alg) {
+            return {
+                privateKey: found.privateKey,
+                publicJwk: found.publicJwk,
+                thumbprint: found.thumbprint,
+                alg: found.alg,
+            };
+        }
+    }
+    catch (cause) {
+        onEphemeral?.(`The stored DPoP key could not be read (${cause instanceof Error ? cause.message : String(cause)}), so a new one was made.`);
+    }
+    const key = await createDpopKey(alg);
+    try {
+        await act('readwrite', (store) => store.put({
+            privateKey: key.privateKey,
+            publicJwk: key.publicJwk,
+            thumbprint: key.thumbprint,
+            alg: key.alg,
+        }, clientKey));
+    }
+    catch (cause) {
+        // Private browsing and a full disk both land here.
+        onEphemeral?.(`The DPoP key could not be stored (${cause instanceof Error ? cause.message : String(cause)}), so a refresh after the next navigation will be refused.`);
+    }
+    return key;
+}
+/**
+ * Forget the key for `clientKey`.
+ *
+ * Part of signing out. A key left behind is not a credential on its own, since the tokens
+ * bound to it are gone, but the next sign in should not be provably the same client as the
+ * last: that is a correlator handed to the provider for nothing.
+ */
+export async function forgetKey(clientKey) {
+    if (!available())
+        return;
+    try {
+        await act('readwrite', (store) => store.delete(clientKey));
+    }
+    catch {
+        // Nothing useful to do. The tokens are already gone, which is what signs someone out.
+    }
+}

package/dist/dpop-store.mjs

@@ -0,0 +1,121 @@
+import "./chunk-7P6ASYW6.mjs";
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("./browser-FDUOEUM2.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+
+// src/dpop-store.ts
+var DB = "fluixi-oauth2-dpop";
+var STORE = "keys";
+function available() {
+  return typeof indexedDB !== "undefined";
+}
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB, 1);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE)) db.createObjectStore(STORE);
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("indexedDB.open failed"));
+  });
+}
+function act(mode, run) {
+  return open().then(
+    (db) => new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE, mode);
+      const request = run(tx.objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("DPoP key request failed"));
+      tx.oncomplete = () => db.close();
+    })
+  );
+}
+function usable(value) {
+  const stored = value;
+  return !!stored && typeof stored.thumbprint === "string" && typeof stored.alg === "string" && !!stored.publicJwk && // A CryptoKey survives the round trip as a CryptoKey. Anything else means the record was
+  // written by something other than this, and binding to it would fail at the provider.
+  typeof stored.privateKey?.type === "string";
+}
+async function keyFor(clientKey, alg = "ES256", onEphemeral) {
+  if (!available()) {
+    onEphemeral?.("This environment has no IndexedDB, so the key lasts only as long as this document.");
+    return createDpopKey(alg);
+  }
+  try {
+    const found = await act("readonly", (store) => store.get(clientKey));
+    if (usable(found) && found.alg === alg) {
+      return {
+        privateKey: found.privateKey,
+        publicJwk: found.publicJwk,
+        thumbprint: found.thumbprint,
+        alg: found.alg
+      };
+    }
+  } catch (cause) {
+    onEphemeral?.(
+      `The stored DPoP key could not be read (${cause instanceof Error ? cause.message : String(cause)}), so a new one was made.`
+    );
+  }
+  const key = await createDpopKey(alg);
+  try {
+    await act(
+      "readwrite",
+      (store) => store.put(
+        {
+          privateKey: key.privateKey,
+          publicJwk: key.publicJwk,
+          thumbprint: key.thumbprint,
+          alg: key.alg
+        },
+        clientKey
+      )
+    );
+  } catch (cause) {
+    onEphemeral?.(
+      `The DPoP key could not be stored (${cause instanceof Error ? cause.message : String(cause)}), so a refresh after the next navigation will be refused.`
+    );
+  }
+  return key;
+}
+async function forgetKey(clientKey) {
+  if (!available()) return;
+  try {
+    await act("readwrite", (store) => store.delete(clientKey));
+  } catch {
+  }
+}
+export {
+  forgetKey,
+  keyFor
+};

package/dist/dpop.cjs

@@ -0,0 +1,117 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/dpop.ts
+var dpop_exports = {};
+__export(dpop_exports, {
+  boundKeyOf: () => boundKeyOf,
+  createDpopKey: () => createDpopKey,
+  nonceFrom: () => nonceFrom,
+  proofFor: () => proofFor,
+  thumbprintOf: () => thumbprintOf,
+  wantsNonce: () => wantsNonce
+});
+module.exports = __toCommonJS(dpop_exports);
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/dpop.ts
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}