@fluixi/oauth2 1.0.0-alpha.9 → 1.0.0-alpha.99

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Fluixi
+Copyright (c) 2026 Ibrahima Touré
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/backchannel.cjs

@@ -0,0 +1,462 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/types.ts
+var OAuthError;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    OAuthError = class extends Error {
+      constructor(message, code, description) {
+        super(message);
+        this.code = code;
+        this.description = description;
+        this.name = "OAuthError";
+      }
+    };
+  }
+});
+
+// src/dpop.ts
+var dpop_exports = {};
+__export(dpop_exports, {
+  boundKeyOf: () => boundKeyOf,
+  createDpopKey: () => createDpopKey,
+  exportDpopKey: () => exportDpopKey,
+  importDpopKey: () => importDpopKey,
+  nonceFrom: () => nonceFrom,
+  proofFor: () => proofFor,
+  thumbprintOf: () => thumbprintOf,
+  wantsNonce: () => wantsNonce
+});
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256", options = {}) {
+  const jose = await loadJose();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, {
+    extractable: options.extractable ?? false
+  });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function exportDpopKey(key) {
+  const jose = await loadJose();
+  return { jwk: { ...await jose.exportJWK(key.privateKey) }, alg: key.alg };
+}
+async function importDpopKey(stored) {
+  const jose = await loadJose();
+  const privateKey = await jose.importJWK(stored.jwk, stored.alg);
+  const publicJwk = Object.fromEntries(Object.entries(stored.jwk).filter(([k]) => !PRIVATE_MEMBERS.has(k)));
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg: stored.alg
+  };
+}
+async function thumbprintOf(jwk) {
+  const jose = await loadJose();
+  return jose.calculateJwkThumbprint(jwk, "sha256");
+}
+async function proofFor(key, options) {
+  const jose = await loadJose();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+function wantsNonce(error, response) {
+  const code = typeof error === "string" ? error : error?.error;
+  return code === "use_dpop_nonce" || !!response && !!nonceFrom(response);
+}
+function boundKeyOf(claims) {
+  const cnf = claims.cnf;
+  return typeof cnf?.jkt === "string" ? cnf.jkt : null;
+}
+var PRIVATE_MEMBERS;
+var init_dpop = __esm({
+  "src/dpop.ts"() {
+    "use strict";
+    init_types();
+    PRIVATE_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth"]);
+  }
+});
+
+// src/backchannel.ts
+var backchannel_exports = {};
+__export(backchannel_exports, {
+  LOGOUT_EVENT: () => LOGOUT_EVENT,
+  idTokenClaims: () => idTokenClaims,
+  logoutTokenVerifier: () => logoutTokenVerifier,
+  memoryLogouts: () => memoryLogouts
+});
+module.exports = __toCommonJS(backchannel_exports);
+
+// src/client-auth.ts
+init_types();
+
+// src/discovery.ts
+init_types();
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
+      throw new OAuthError(
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/verify.ts
+init_types();
+var TokenError = class extends OAuthError {
+  constructor(message, code = "invalid_token") {
+    super(message, code);
+    this.name = "TokenError";
+  }
+};
+function bearerOf(request) {
+  const header = request.headers.get("authorization");
+  if (!header) return null;
+  const match = header.match(/^(?:Bearer|DPoP)\s+(.+)$/i);
+  return match ? match[1].trim() : null;
+}
+async function loadJose2() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "Token verification needs `jose`. Install it: npm i jose. It is an optional peer so an app that does not verify does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+function createTokenVerifier(options) {
+  const issuers = (Array.isArray(options.issuer) ? options.issuer : [options.issuer]).filter(Boolean);
+  if (!issuers.length) {
+    throw new Error("[fluixi/oauth2] createTokenVerifier needs an issuer to accept tokens from.");
+  }
+  const discoveryIssuer = issuers[0];
+  if (options.audience === void 0) {
+    throw new Error(
+      "[fluixi/oauth2] createTokenVerifier needs an audience, or `audience: false` to say this service really does accept a token minted for any client of the issuer."
+    );
+  }
+  if (options.audience === false && options.authorizedParty === void 0) {
+    console.warn(
+      "[fluixi/oauth2] This verifier checks neither `aud` nor `azp`, so a token minted for any client of the issuer is accepted. Set `authorizedParty` if that is not what you meant."
+    );
+  }
+  const algorithms = options.algorithms ?? ["RS256"];
+  if (algorithms.some((alg) => !alg || alg.toLowerCase() === "none")) {
+    throw new Error("[fluixi/oauth2] `none` is not a signing algorithm and cannot be accepted.");
+  }
+  let keys = null;
+  async function keySet() {
+    if (keys) return keys;
+    const jose = await loadJose2();
+    if (options.jwks) {
+      keys = jose.createLocalJWKSet(options.jwks);
+      return keys;
+    }
+    let uri = options.jwksUri;
+    if (!uri) {
+      const endpoints = await discover(discoveryIssuer);
+      uri = endpoints.jwks;
+    }
+    if (!uri) {
+      throw new OAuthError(
+        `${discoveryIssuer} published no jwks_uri. Give the verifier one directly.`,
+        "no_jwks"
+      );
+    }
+    keys = jose.createRemoteJWKSet(new URL(uri));
+    return keys;
+  }
+  const checkProof = async (claims, token, request) => {
+    const jose = await loadJose2();
+    const { boundKeyOf: boundKeyOf2, thumbprintOf: thumbprintOf2 } = await Promise.resolve().then(() => (init_dpop(), dpop_exports));
+    const bound = boundKeyOf2(claims);
+    if (!bound) {
+      throw new TokenError(
+        "This token is not bound to a key, and this service requires binding.",
+        "token_not_bound"
+      );
+    }
+    const proof = request.headers.get("dpop");
+    if (!proof) throw new TokenError("The request carried no DPoP proof.", "missing_dpop_proof");
+    let payload;
+    let header;
+    try {
+      const result = await jose.jwtVerify(proof, jose.EmbeddedJWK, { typ: "dpop+jwt" });
+      payload = result.payload;
+      header = result.protectedHeader;
+    } catch (cause) {
+      throw new TokenError(
+        `The DPoP proof did not verify: ${cause instanceof Error ? cause.message : String(cause)}`,
+        "invalid_dpop_proof"
+      );
+    }
+    const presented = await thumbprintOf2(header.jwk);
+    if (presented !== bound) {
+      throw new TokenError(
+        "The DPoP proof was signed with a different key from the one this token is bound to.",
+        "dpop_key_mismatch"
+      );
+    }
+    const url = new URL(request.url);
+    url.search = "";
+    url.hash = "";
+    if (payload.htm !== request.method.toUpperCase()) {
+      throw new TokenError("The DPoP proof was made for a different method.", "invalid_dpop_proof");
+    }
+    if (payload.htu !== url.toString()) {
+      throw new TokenError("The DPoP proof was made for a different URL.", "invalid_dpop_proof");
+    }
+    if (typeof payload.ath === "string") {
+      const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+      let binary = "";
+      for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+      const expected = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+      if (payload.ath !== expected) {
+        throw new TokenError("The DPoP proof was made for a different token.", "invalid_dpop_proof");
+      }
+    }
+    const age = Math.abs(Date.now() / 1e3 - payload.iat);
+    if (!Number.isFinite(age) || age > (options.dpopProofAgeSec ?? 10)) {
+      throw new TokenError("The DPoP proof is too old to accept.", "invalid_dpop_proof");
+    }
+  };
+  const verify = async (token, request) => {
+    if (!token) throw new TokenError("No token to verify.", "no_token");
+    const jose = await loadJose2();
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, await keySet(), {
+        // jose takes a list and accepts any of them, which is what a provider naming
+        // itself two ways needs.
+        issuer: issuers,
+        ...options.audience === false ? {} : { audience: options.audience },
+        algorithms,
+        clockTolerance: options.clockToleranceSec ?? 5
+      }));
+    } catch (cause) {
+      throw new TokenError(
+        `The token was not accepted: ${cause instanceof Error ? cause.message : String(cause)}`
+      );
+    }
+    if (options.authorizedParty !== void 0) {
+      const allowed = Array.isArray(options.authorizedParty) ? options.authorizedParty : [options.authorizedParty];
+      const issuedTo = payload.azp ?? payload.client_id;
+      if (typeof issuedTo !== "string" || !allowed.includes(issuedTo)) {
+        throw new TokenError("The token was issued to a different client.", "invalid_azp");
+      }
+    }
+    if (options.dpop) {
+      if (!request) {
+        throw new Error(
+          "[fluixi/oauth2] `dpop: true` needs the request to read its proof. Use `verify.fromRequest(request)` rather than verifying a bare token."
+        );
+      }
+      await checkProof(payload, token, request);
+    }
+    if (options.require) {
+      const verdict = options.require(payload);
+      if (verdict !== true) {
+        throw new TokenError(
+          typeof verdict === "string" ? verdict : "The token did not meet this service's requirements.",
+          "insufficient_claims"
+        );
+      }
+    }
+    return payload;
+  };
+  const verifier = verify;
+  verifier.bearerOf = bearerOf;
+  verifier.fromRequest = async (request) => {
+    const token = verifier.bearerOf(request);
+    if (!token) {
+      throw new TokenError("The request carried no bearer token.", "no_token");
+    }
+    return verify(token, request);
+  };
+  return verifier;
+}
+
+// src/backchannel.ts
+var LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+function memoryLogouts(ttlMs = 14 * 24 * 36e5) {
+  const sids = /* @__PURE__ */ new Map();
+  const subs = /* @__PURE__ */ new Map();
+  const prune = (now) => {
+    for (const map of [sids, subs]) for (const [key, at] of map) if (now - at > ttlMs) map.delete(key);
+  };
+  return {
+    add(entry) {
+      prune(Date.now());
+      if (entry.sid) sids.set(entry.sid, entry.at);
+      else if (entry.sub) subs.set(entry.sub, Math.max(entry.at, subs.get(entry.sub) ?? 0));
+    },
+    ended(session) {
+      if (session.sid && sids.has(session.sid)) return true;
+      const all = session.sub ? subs.get(session.sub) : void 0;
+      return all !== void 0 && session.since <= all;
+    }
+  };
+}
+function idTokenClaims(idToken) {
+  if (!idToken) return {};
+  try {
+    const part = idToken.split(".")[1] ?? "";
+    const json = atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "="));
+    const claims = JSON.parse(json);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      iat: typeof claims.iat === "number" ? claims.iat : void 0
+    };
+  } catch {
+    return {};
+  }
+}
+function headerOf(token) {
+  try {
+    const part = token.split(".")[0] ?? "";
+    return JSON.parse(atob(part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "=")));
+  } catch {
+    return {};
+  }
+}
+function logoutTokenVerifier(options) {
+  const verify = createTokenVerifier({
+    issuer: options.issuer,
+    audience: options.clientId,
+    jwksUri: options.jwksUri,
+    jwks: options.jwks,
+    require: (claims) => {
+      const events = claims.events;
+      if (!events || typeof events !== "object" || !(LOGOUT_EVENT in events)) return "no logout event";
+      if ("nonce" in claims) return "a logout token has no nonce";
+      if (typeof claims.sid !== "string" && typeof claims.sub !== "string") return "names no session and no subject";
+      return true;
+    }
+  });
+  return async (token) => {
+    const typ = headerOf(token).typ;
+    if (typ !== void 0 && typ !== "logout+jwt") throw new Error("not a logout token");
+    const claims = await verify(token);
+    return {
+      sid: typeof claims.sid === "string" ? claims.sid : void 0,
+      sub: typeof claims.sub === "string" ? claims.sub : void 0,
+      at: (typeof claims.iat === "number" ? claims.iat : Math.floor(Date.now() / 1e3)) * 1e3
+    };
+  };
+}

package/dist/backchannel.d.ts

@@ -0,0 +1,39 @@
+export declare const LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+/** A logout the provider announced: a session (`sid`), or every session of `sub` begun before `at`. */
+export interface LogoutEntry {
+    sid?: string;
+    sub?: string;
+    /** When the provider said so, in milliseconds. */
+    at: number;
+}
+export interface LogoutStore {
+    add(entry: LogoutEntry): void | Promise<void>;
+    /** Whether a session (its `sid`, its `sub`, and when it signed in) has been logged out since. */
+    ended(session: {
+        sid?: string;
+        sub?: string;
+        since: number;
+    }): boolean | Promise<boolean>;
+}
+/** Logouts in memory, forgotten after `ttlMs` (a session that old has expired anyway). */
+export declare function memoryLogouts(ttlMs?: number): LogoutStore;
+/** The claims of an ID token, unverified: it came from the token endpoint and sits in a sealed cookie. */
+export declare function idTokenClaims(idToken: string | undefined): {
+    sid?: string;
+    sub?: string;
+    iat?: number;
+};
+/**
+ * Checks a logout token as the specification asks: signature, issuer, audience and age like
+ * any token, then the logout event, a `sid` or a `sub`, and no `nonce` (which only an ID token
+ * carries, so a token with one is an ID token being passed off as a logout).
+ */
+export declare function logoutTokenVerifier(options: {
+    issuer: string;
+    clientId: string;
+    jwksUri?: string;
+    jwks?: {
+        keys: unknown[];
+    };
+}): (token: string) => Promise<LogoutEntry>;
+//# sourceMappingURL=backchannel.d.ts.map

package/dist/backchannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backchannel.d.ts","sourceRoot":"","sources":["../src/backchannel.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,YAAY,uDAAuD,CAAC;AAEjF,uGAAuG;AACvG,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,iGAAiG;IACjG,KAAK,CAAC,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3F;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,SAAqB,GAAG,WAAW,CAkBrE;AAED,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAcvG;AAcD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAA;CAAE,IAc/G,OAAO,MAAM,KAAG,OAAO,CAAC,WAAW,CAAC,CAUnD"}

package/dist/backchannel.js

@@ -0,0 +1,97 @@
+/**
+ * OpenID Connect Back-Channel Logout, the app's half: the provider posts a logout token when a
+ * session this app took part in ends, and the app ends its own session for it.
+ *
+ * Logouts are kept in a `LogoutStore`. The default holds them in this process's memory, which
+ * is right for one instance; several instances behind a balancer each need to hear of every
+ * logout, so they share a store (Redis, a table) passed as `logouts`.
+ */
+import { createTokenVerifier } from './verify.js';
+export const LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout';
+/** Logouts in memory, forgotten after `ttlMs` (a session that old has expired anyway). */
+export function memoryLogouts(ttlMs = 14 * 24 * 3600_000) {
+    const sids = new Map();
+    const subs = new Map();
+    const prune = (now) => {
+        for (const map of [sids, subs])
+            for (const [key, at] of map)
+                if (now - at > ttlMs)
+                    map.delete(key);
+    };
+    return {
+        add(entry) {
+            prune(Date.now());
+            if (entry.sid)
+                sids.set(entry.sid, entry.at);
+            else if (entry.sub)
+                subs.set(entry.sub, Math.max(entry.at, subs.get(entry.sub) ?? 0));
+        },
+        ended(session) {
+            if (session.sid && sids.has(session.sid))
+                return true;
+            const all = session.sub ? subs.get(session.sub) : undefined;
+            return all !== undefined && session.since <= all;
+        },
+    };
+}
+/** The claims of an ID token, unverified: it came from the token endpoint and sits in a sealed cookie. */
+export function idTokenClaims(idToken) {
+    if (!idToken)
+        return {};
+    try {
+        const part = idToken.split('.')[1] ?? '';
+        const json = atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '='));
+        const claims = JSON.parse(json);
+        return {
+            sid: typeof claims.sid === 'string' ? claims.sid : undefined,
+            sub: typeof claims.sub === 'string' ? claims.sub : undefined,
+            iat: typeof claims.iat === 'number' ? claims.iat : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+function headerOf(token) {
+    try {
+        const part = token.split('.')[0] ?? '';
+        return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '=')));
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Checks a logout token as the specification asks: signature, issuer, audience and age like
+ * any token, then the logout event, a `sid` or a `sub`, and no `nonce` (which only an ID token
+ * carries, so a token with one is an ID token being passed off as a logout).
+ */
+export function logoutTokenVerifier(options) {
+    const verify = createTokenVerifier({
+        issuer: options.issuer,
+        audience: options.clientId,
+        jwksUri: options.jwksUri,
+        jwks: options.jwks,
+        require: (claims) => {
+            const events = claims.events;
+            if (!events || typeof events !== 'object' || !(LOGOUT_EVENT in events))
+                return 'no logout event';
+            if ('nonce' in claims)
+                return 'a logout token has no nonce';
+            if (typeof claims.sid !== 'string' && typeof claims.sub !== 'string')
+                return 'names no session and no subject';
+            return true;
+        },
+    });
+    return async (token) => {
+        const typ = headerOf(token).typ;
+        if (typ !== undefined && typ !== 'logout+jwt')
+            throw new Error('not a logout token');
+        const claims = await verify(token);
+        return {
+            sid: typeof claims.sid === 'string' ? claims.sid : undefined,
+            sub: typeof claims.sub === 'string' ? claims.sub : undefined,
+            at: (typeof claims.iat === 'number' ? claims.iat : Math.floor(Date.now() / 1000)) * 1000,
+        };
+    };
+}