@fluixi/oauth2 1.0.0-alpha.3 → 1.0.0-alpha.5

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;CAC7E;AAYD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IAwDjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwMrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CA0CrB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAErE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5E;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AA8DD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,IA+DjD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAmNrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,IA8BnD,SAAS,OAAO,EAChB,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAwCrB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAErE"}

package/dist/server.js

@@ -34,7 +34,46 @@ import { applyClientAuth, } from './client-auth.js';
 import { discover } from './discovery.js';
 import { createPkcePair, createStateValue, expiryFrom, timingSafeEqual } from './pkce.js';
 import { OAuthError } from './types.js';
+import { createDpopKey, exportDpopKey, importDpopKey, nonceFrom, proofFor } from './dpop.js';
 import { defineModule } from '@fluixi/start/app';
+/**
+ * Nonces providers asked for, per origin, shared by the routes and `sessionLocals`. A nonce
+ * is the server's to set (RFC 9449 §8, §9), so the latest one it sent is the one to use.
+ */
+const dpopNonces = new Map();
+/** Put a proof for this request on `headers`, with the nonce this origin last asked for. */
+async function prove(headers, key, method, url, accessToken) {
+    headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
+}
+/** Record a nonce the server sent. True when it refused the request with one not seen before. */
+function learnNonce(url, response) {
+    const offered = nonceFrom(response);
+    if (!offered)
+        return false;
+    const origin = new URL(url).origin;
+    const fresh = offered !== dpopNonces.get(origin);
+    dpopNonces.set(origin, offered);
+    return fresh && !response.ok;
+}
+/**
+ * A request carrying the session's access token: the `DPoP` scheme and a proof bound to the
+ * token when the provider bound it, `Bearer` otherwise.
+ */
+async function withToken(url, session) {
+    const key = session.dpop && session.tokenType?.toLowerCase() === 'dpop' ? await importDpopKey(session.dpop) : null;
+    const send = async () => {
+        const headers = {
+            authorization: `${key ? 'DPoP' : 'Bearer'} ${session.accessToken}`,
+        };
+        if (key)
+            await prove(headers, key, 'GET', url, session.accessToken);
+        return fetch(url, { headers });
+    };
+    let response = await send();
+    if (key && learnNonce(url, response))
+        response = await send();
+    return response;
+}
 /**
  * The middleware.
  *
@@ -73,14 +112,23 @@ export function oauthRoutes(config) {
         keyId: config.keyId,
         assertionAlgorithm: config.assertionAlgorithm,
     };
-    async function tokenRequest(body) {
+    async function tokenRequest(body, key = null) {
         const { token } = await resolve();
-        const headers = {
-            'content-type': 'application/x-www-form-urlencoded',
+        // Built afresh for a retry: a `private_key_jwt` assertion carries a `jti`, and sending
+        // the same one twice can be refused as a replay.
+        const attempt = async () => {
+            const headers = {
+                'content-type': 'application/x-www-form-urlencoded',
+            };
+            const form = new URLSearchParams(body);
+            await applyClientAuth(clientAuth, token, headers, form);
+            if (key)
+                await prove(headers, key, 'POST', token);
+            return fetch(token, { method: 'POST', headers, body: form.toString() });
         };
-        const form = new URLSearchParams(body);
-        await applyClientAuth(clientAuth, token, headers, form);
-        const response = await fetch(token, { method: 'POST', headers, body: form.toString() });
+        let response = await attempt();
+        if (key && learnNonce(token, response))
+            response = await attempt();
         const payload = (await response.json().catch(() => ({})));
         if (!response.ok) {
             throw new OAuthError(String(payload.error ?? 'token_request_failed'), String(payload.error ?? 'token_request_failed'));
@@ -147,17 +195,23 @@ export function oauthRoutes(config) {
             if (!pending || !state || !timingSafeEqual(pending.state, state)) {
                 return json({ error: 'state_mismatch' }, 400);
             }
+            // The token is bound here, at the exchange, so this is where the session's key is made.
+            const key = config.dpop
+                ? await createDpopKey(config.dpopAlgorithm, { extractable: true })
+                : null;
             const payload = await tokenRequest({
                 grant_type: 'authorization_code',
                 code,
                 redirect_uri: config.redirectUri,
                 code_verifier: pending.verifier,
-            });
+            }, key);
             const signedIn = await cookie.write({
                 accessToken: String(payload.access_token ?? ''),
                 refreshToken: typeof payload.refresh_token === 'string' ? payload.refresh_token : undefined,
                 idToken: typeof payload.id_token === 'string' ? payload.id_token : undefined,
                 expiresAt: expiryFrom(payload.expires_in),
+                tokenType: typeof payload.token_type === 'string' ? payload.token_type : undefined,
+                dpop: key ? await exportDpopKey(key) : undefined,
             });
             return new Response(null, {
                 status: 302,
@@ -178,10 +232,9 @@ export function oauthRoutes(config) {
             const current = await session();
             if (!current?.refreshToken)
                 return json({ error: 'no_session' }, 401);
-            const payload = await tokenRequest({
-                grant_type: 'refresh_token',
-                refresh_token: current.refreshToken,
-            });
+            // The key that obtained the refresh token, or the provider refuses the refresh.
+            const key = current.dpop ? await importDpopKey(current.dpop) : null;
+            const payload = await tokenRequest({ grant_type: 'refresh_token', refresh_token: current.refreshToken }, key);
             const refreshed = await cookie.write({
                 accessToken: String(payload.access_token ?? ''),
                 // A provider that rotates refresh tokens sends a new one; one that does not
@@ -191,6 +244,8 @@ export function oauthRoutes(config) {
                     : current.refreshToken,
                 idToken: current.idToken,
                 expiresAt: expiryFrom(payload.expires_in),
+                tokenType: typeof payload.token_type === 'string' ? payload.token_type : current.tokenType,
+                dpop: current.dpop,
             });
             return json({ ok: true }, 200, { 'set-cookie': refreshed });
         }
@@ -201,9 +256,7 @@ export function oauthRoutes(config) {
             const { userinfo } = await resolve();
             if (!userinfo)
                 return json({ error: 'no_userinfo' }, 501);
-            const response = await fetch(userinfo, {
-                headers: { authorization: `Bearer ${current.accessToken}` },
-            });
+            const response = await withToken(userinfo, current);
             if (!response.ok)
                 return json({ error: 'userinfo_failed' }, response.status);
             const claims = (await response.json());
@@ -339,9 +392,7 @@ export function sessionLocals(config) {
         try {
             const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
             if (endpoints?.userinfo) {
-                const response = await fetch(endpoints.userinfo, {
-                    headers: { authorization: `Bearer ${session.accessToken}` },
-                });
+                const response = await withToken(endpoints.userinfo, session);
                 if (response.ok) {
                     const claims = (await response.json());
                     user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;

package/dist/server.mjs

@@ -1,5 +1,5 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.3 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-4GSQS5YG.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.5 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-DCBOCQLJ.mjs";
 
 // src/server.ts
 import { createSessionCookie } from "@fluixi/session/server";
@@ -53,7 +53,7 @@ function resolveMethod(auth) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-QQDMUXPB.mjs");
+    return await import("./browser-QTUJRR3J.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
@@ -173,8 +173,106 @@ function expiryFrom(expiresIn, now = Date.now()) {
   return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
 }
 
+// src/dpop.ts
+async function loadJose2() {
+  try {
+    return await import("./browser-QTUJRR3J.mjs");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose2();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose2();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+var PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+async function importDpopKey(stored) {
+  const jose = await loadJose2();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function proofFor(key, options) {
+  const jose = await loadJose2();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+
 // src/server.ts
 import { defineModule } from "@fluixi/start/app";
+var dpopNonces = /* @__PURE__ */ new Map();
+async function prove(headers, key, method, url, accessToken) {
+  headers.dpop = await proofFor(key, { method, url, accessToken, nonce: dpopNonces.get(new URL(url).origin) });
+}
+function learnNonce(url, response) {
+  const offered = nonceFrom(response);
+  if (!offered) return false;
+  const origin = new URL(url).origin;
+  const fresh = offered !== dpopNonces.get(origin);
+  dpopNonces.set(origin, offered);
+  return fresh && !response.ok;
+}
+async function withToken(url, session) {
+  const key = session.dpop && session.tokenType?.toLowerCase() === "dpop" ? await importDpopKey(session.dpop) : null;
+  const send = async () => {
+    const headers = {
+      authorization: `${key ? "DPoP" : "Bearer"} ${session.accessToken}`
+    };
+    if (key) await prove(headers, key, "GET", url, session.accessToken);
+    return fetch(url, { headers });
+  };
+  let response = await send();
+  if (key && learnNonce(url, response)) response = await send();
+  return response;
+}
 function oauthRoutes(config) {
   const base = (config.basePath ?? "/auth").replace(/\/$/, "");
   const scopes = config.scopes ?? ["openid", "profile", "email"];
@@ -206,14 +304,19 @@ function oauthRoutes(config) {
     keyId: config.keyId,
     assertionAlgorithm: config.assertionAlgorithm
   };
-  async function tokenRequest(body) {
+  async function tokenRequest(body, key = null) {
     const { token } = await resolve();
-    const headers = {
-      "content-type": "application/x-www-form-urlencoded"
+    const attempt = async () => {
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams(body);
+      await applyClientAuth(clientAuth, token, headers, form);
+      if (key) await prove(headers, key, "POST", token);
+      return fetch(token, { method: "POST", headers, body: form.toString() });
     };
-    const form = new URLSearchParams(body);
-    await applyClientAuth(clientAuth, token, headers, form);
-    const response = await fetch(token, { method: "POST", headers, body: form.toString() });
+    let response = await attempt();
+    if (key && learnNonce(token, response)) response = await attempt();
     const payload = await response.json().catch(() => ({}));
     if (!response.ok) {
       throw new OAuthError(
@@ -280,17 +383,23 @@ function oauthRoutes(config) {
       if (!pending || !state || !timingSafeEqual(pending.state, state)) {
         return json({ error: "state_mismatch" }, 400);
       }
-      const payload = await tokenRequest({
-        grant_type: "authorization_code",
-        code,
-        redirect_uri: config.redirectUri,
-        code_verifier: pending.verifier
-      });
+      const key = config.dpop ? await createDpopKey(config.dpopAlgorithm, { extractable: true }) : null;
+      const payload = await tokenRequest(
+        {
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: config.redirectUri,
+          code_verifier: pending.verifier
+        },
+        key
+      );
       const signedIn = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
         idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : void 0,
+        dpop: key ? await exportDpopKey(key) : void 0
       });
       return new Response(null, {
         status: 302,
@@ -310,17 +419,20 @@ function oauthRoutes(config) {
     if (route === "/refresh") {
       const current = await session();
       if (!current?.refreshToken) return json({ error: "no_session" }, 401);
-      const payload = await tokenRequest({
-        grant_type: "refresh_token",
-        refresh_token: current.refreshToken
-      });
+      const key = current.dpop ? await importDpopKey(current.dpop) : null;
+      const payload = await tokenRequest(
+        { grant_type: "refresh_token", refresh_token: current.refreshToken },
+        key
+      );
       const refreshed = await cookie.write({
         accessToken: String(payload.access_token ?? ""),
         // A provider that rotates refresh tokens sends a new one; one that does not
         // expects the old one to keep working.
         refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : current.refreshToken,
         idToken: current.idToken,
-        expiresAt: expiryFrom(payload.expires_in)
+        expiresAt: expiryFrom(payload.expires_in),
+        tokenType: typeof payload.token_type === "string" ? payload.token_type : current.tokenType,
+        dpop: current.dpop
       });
       return json({ ok: true }, 200, { "set-cookie": refreshed });
     }
@@ -329,9 +441,7 @@ function oauthRoutes(config) {
       if (!current?.accessToken) return json({ error: "no_session" }, 401);
       const { userinfo } = await resolve();
       if (!userinfo) return json({ error: "no_userinfo" }, 501);
-      const response = await fetch(userinfo, {
-        headers: { authorization: `Bearer ${current.accessToken}` }
-      });
+      const response = await withToken(userinfo, current);
       if (!response.ok) return json({ error: "userinfo_failed" }, response.status);
       const claims = await response.json();
       return json(config.mapUser ? config.mapUser(claims, current.accessToken) : claims);
@@ -421,9 +531,7 @@ function sessionLocals(config) {
     try {
       const endpoints = config.endpoints ?? (config.issuer ? await discover(config.issuer) : null);
       if (endpoints?.userinfo) {
-        const response = await fetch(endpoints.userinfo, {
-          headers: { authorization: `Bearer ${session.accessToken}` }
-        });
+        const response = await withToken(endpoints.userinfo, session);
         if (response.ok) {
           const claims = await response.json();
           user = config.mapUser ? config.mapUser(claims, session.accessToken) : claims;

package/dist/service-client.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.3 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.5 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;

package/dist/service-client.mjs

@@ -1,5 +1,5 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.3 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-4GSQS5YG.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.5 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-DCBOCQLJ.mjs";
 
 // src/types.ts
 var OAuthError = class extends Error {
@@ -42,7 +42,7 @@ function assertUsable(auth, who) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-QQDMUXPB.mjs");
+    return await import("./browser-QTUJRR3J.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",

package/dist/service.cjs

@@ -191,9 +191,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,

package/dist/service.d.ts

@@ -13,7 +13,7 @@
  * else lines up directly: `fetchUser`, `refresh`, `logout` and `getExpiry`.
  */
 import { type AccessControl, type Session } from '@fluixi/session';
-import { createAuthHooks } from '@fluixi/auth/client';
+import { createAuthHooks, type AuthHooksOptions } from '@fluixi/auth/client';
 import type { AuthClient, AuthConfig, CallbackParams, LoginOptions } from './types.js';
 /** The credential a redirect flow produces. */
 export type AuthCredentials = CallbackParams;
@@ -55,9 +55,7 @@ export interface AuthServiceOptions<U, P = unknown, Q = (p: P) => boolean> {
      * client-side navigation; leave it out and it assigns `location`, which reloads the
      * document and discards the reactive tree.
      */
-    navigate?: {
-        handler: () => (to: string, options?: unknown) => void;
-    };
+    navigate?: AuthHooksOptions['navigate'];
     /** Where a signed-out visitor is sent. Default `/login`. */
     loginPath?: string;
     /** Where a signed-in visitor is sent from a guest-only page. Default `/`. */

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMtD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAU,MAAM,YAAY,CAAC;AAE/F,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IACvE,mDAAmD;IACnD,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,qCAAqC;IACrC,WAAW,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;KAAE,CAAC;IACtE,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAChE,SAAQ,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAChD,IAAI,CACF,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3C,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CACxE;IACH,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,cAAc,CAWhE;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EACrE,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACnC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CA0FtB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAiB,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAM7E,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAU,MAAM,YAAY,CAAC;AAE/F,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAE7C,MAAM,WAAW,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO;IACvE,mDAAmD;IACnD,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAChC,qCAAqC;IACrC,WAAW,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,CAChE,SAAQ,OAAO,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,EAChD,IAAI,CACF,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3C,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CACxE;IACH,oFAAoF;IACpF,MAAM,CAAC,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,GAAG,GAAG,cAAc,CAWhE;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,OAAO,EACrE,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACnC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CA0FtB"}

package/dist/service.mjs

@@ -158,9 +158,11 @@ async function loadJose2() {
     );
   }
 }
-async function createDpopKey(alg = "ES256") {
+async function createDpopKey(alg = "ES256", options = {}) {
   const jose = await loadJose2();
-  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
   const publicJwk = { ...await jose.exportJWK(publicKey) };
   return {
     privateKey,