@gaballahtech/seba 0.0.0-stage → 0.2.0

package/dist/core/client.js

@@ -0,0 +1,371 @@
+/**
+ * Runtime-independent implementation of the four public operations.
+ *
+ * The platform object supplies storage, navigation, callback capture and `fetch`; this
+ * class owns the protocol flow and the security decisions that must be identical in
+ * every runtime.
+ */
+import { createDPoPKey } from "./dpop.js";
+import { SebaAuthError, SebaConfigError, SebaNoUIError } from "./errors.js";
+import { discoverProvider, isLoopbackHost } from "./discovery.js";
+import { httpFetch, inputToString } from "./http.js";
+import { assertRedirectUriPublished, discoverIssuerForWebId, loadClientIdDocument, validateClientIdUrl, validateWebId, } from "./identity.js";
+import { buildAuthorizationUrl, createPendingAuthorization, exchangeAuthorizationCode, parseAuthorizationResponse, pkceChallenge, } from "./oidc.js";
+import { SessionManager } from "./session.js";
+import { assertStorageKind } from "./session.js";
+/** HTTP statuses that carry a `Location` header. */
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Maximum same-origin redirects followed by {@link SebaClient.fetch}. */
+const MAX_REDIRECTS = 5;
+/** Hard cap on attempts per logical request (redirects, nonce and token refresh included). */
+const MAX_ATTEMPTS = 8;
+/**
+ * The protocol engine behind {@link Seba}.
+ *
+ * Obtained through `Seba`, which resolves the platform first. Not exported from the
+ * package entry point.
+ */
+export class SebaClient {
+    #platform;
+    #config;
+    #sessions;
+    #nonce = null;
+    constructor(config, platform) {
+        this.#platform = platform;
+        this.#config = resolveConfig(config, platform);
+        this.#sessions = new SessionManager({
+            clientId: this.#config.clientId,
+            storage: platform.createStorage(this.#config.storage),
+            fetchImpl: platform.fetch,
+            discover: (issuer) => discoverProvider(issuer, platform.fetch),
+            debug: (message) => {
+                this.#debug(message);
+            },
+        });
+    }
+    /** Current session, if any (token-free). */
+    get session() {
+        return this.#sessions.toPublicSession();
+    }
+    /**
+     * Sign in, or finish a sign-in that the provider redirected back to this application.
+     *
+     * When the current URL carries an authorization response, the stored transaction is
+     * validated and the code is exchanged. Otherwise a new authorization request is
+     * started: the returned promise resolves after the redirect in Node.js and never
+     * settles in the browser (the page navigates away).
+     */
+    async login(options = {}) {
+        const callbackUrl = this.#callbackUrl();
+        if (callbackUrl !== null) {
+            return this.#completeLogin(callbackUrl);
+        }
+        const existing = this.#sessions.toPublicSession();
+        if (existing !== null) {
+            return existing;
+        }
+        return this.#startLogin(options);
+    }
+    /**
+     * Restore a previous session from storage.
+     *
+     * @returns The session, or `null` when nothing is stored.
+     * @throws SebaSessionExpiredError when the stored grant was revoked (state cleared).
+     */
+    async restoreSession() {
+        return this.#sessions.restore();
+    }
+    /**
+     * Perform a DPoP-authenticated request.
+     *
+     * A fresh proof is created for every attempt. Same-origin redirects are followed with a
+     * new proof per hop; cross-origin redirects are returned to the caller unchanged, so
+     * credentials are never forwarded to another origin. One retry is allowed for a DPoP
+     * nonce challenge and one for an expired access token; non-replayable bodies are never
+     * resent.
+     */
+    async fetch(input, init) {
+        this.#sessions.require();
+        if (this.#sessions.isExpired()) {
+            await this.#sessions.refreshIfNeeded();
+        }
+        const template = buildTemplate(input, init);
+        const replayable = isReplayable(input, init);
+        const body = template.body === null ? null : replayable ? await readBody(template) : template.body;
+        const origin = new URL(template.url).origin;
+        let current = {
+            url: template.url,
+            method: template.method,
+            headers: new Headers(template.headers),
+        };
+        let redirects = 0;
+        let nonceRetried = false;
+        let tokenRetried = false;
+        for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+            const state = this.#sessions.require();
+            const accessToken = state.tokens.accessToken;
+            const headers = new Headers(current.headers);
+            headers.set("authorization", `DPoP ${accessToken}`);
+            headers.set("DPoP", await state.signer.createProof({
+                method: current.method,
+                url: current.url,
+                accessToken,
+                ...(this.#nonce === null ? {} : { nonce: this.#nonce }),
+            }));
+            const response = await this.#send(current, headers, body, init?.signal ?? null);
+            const nonce = response.headers.get("dpop-nonce");
+            if (nonce !== null) {
+                this.#nonce = nonce;
+            }
+            if (REDIRECT_STATUSES.has(response.status)) {
+                const location = response.headers.get("location");
+                const next = location === null ? null : safeResolve(location, current.url);
+                if (next === null || next.origin !== origin || redirects >= MAX_REDIRECTS || !replayable) {
+                    return response;
+                }
+                redirects += 1;
+                const method = downgradeToGet(response.status, current.method) ? "GET" : current.method;
+                current = {
+                    url: next.href,
+                    method,
+                    headers: current.headers,
+                };
+                continue;
+            }
+            if (response.status === 400 || response.status === 401) {
+                if (nonce !== null && !nonceRetried && replayable) {
+                    nonceRetried = true;
+                    continue;
+                }
+                if (response.status === 401 && !tokenRetried && replayable) {
+                    tokenRetried = true;
+                    await this.#sessions.refreshIfNeeded(true);
+                    continue;
+                }
+            }
+            return response;
+        }
+        throw new SebaAuthError("The request could not be completed after following redirects and retrying the DPoP nonce and access token. " +
+            "Reduce the redirect chain or check that the resource server accepts the session's DPoP key.");
+    }
+    /** Sign out, revoking the refresh token when the provider supports revocation. */
+    async logout() {
+        await this.#sessions.logout();
+    }
+    async #send(request, headers, body, signal) {
+        const init = {
+            method: request.method,
+            headers,
+            redirect: "manual",
+        };
+        if (body !== null && request.method !== "GET" && request.method !== "HEAD") {
+            init.body = body;
+            if (body instanceof ReadableStream) {
+                init.duplex = "half";
+            }
+        }
+        return httpFetch(request.url, init, {
+            fetchImpl: this.#platform.fetch,
+            signal,
+        });
+    }
+    async #startLogin(options) {
+        let webId = options.webId === undefined ? undefined : validateWebId(options.webId).webId;
+        let issuer = options.issuer;
+        if (webId === undefined && issuer === undefined) {
+            if (this.#platform.selectIdentity === undefined) {
+                throw new SebaNoUIError("No WebID or identity provider was provided and this runtime cannot ask the user. " +
+                    "Call login({ issuer }) or login({ webId }) in Node.js.");
+            }
+            const chosen = await this.#platform.selectIdentity();
+            webId = chosen.webId === undefined ? undefined : validateWebId(chosen.webId).webId;
+            issuer = chosen.issuer;
+        }
+        if (issuer === undefined && webId !== undefined) {
+            issuer = await discoverIssuerForWebId(webId, this.#platform.fetch);
+        }
+        if (issuer === undefined) {
+            throw new SebaConfigError("Login requires either a WebID or an identity provider issuer. Neither was provided.");
+        }
+        const configuration = await discoverProvider(issuer, this.#platform.fetch);
+        const document = await loadClientIdDocument(this.#config.clientId, this.#platform.fetch);
+        assertRedirectUriPublished(document, this.#config.redirectUri);
+        const pending = await createPendingAuthorization({
+            issuer: configuration.issuer,
+            clientId: this.#config.clientId,
+            redirectUri: this.#config.redirectUri,
+            ...(webId === undefined ? {} : { webId }),
+        });
+        const codeChallenge = await pkceChallenge(pending.codeVerifier);
+        const authorizationUrl = buildAuthorizationUrl({
+            configuration,
+            clientId: this.#config.clientId,
+            redirectUri: this.#config.redirectUri,
+            state: pending.state,
+            nonce: pending.nonce,
+            codeChallenge,
+        });
+        await this.#platform.pendingAuth.save(pending);
+        this.#debug(`starting authorization at ${describeEndpoint(configuration.authorizationEndpoint)}`);
+        const responseUrl = await this.#platform.beginInteractiveLogin({
+            authorizationUrl,
+            redirectUri: this.#config.redirectUri,
+            state: pending.state,
+            ...(this.#config.openAuthorizationUrl === undefined
+                ? {}
+                : { openAuthorizationUrl: this.#config.openAuthorizationUrl }),
+        });
+        return this.#completeLogin(responseUrl.href);
+    }
+    async #completeLogin(callbackUrl) {
+        const pending = await this.#platform.pendingAuth.load();
+        if (pending === null) {
+            throw new SebaAuthError("An authorization response was found in the URL, but no login is pending. " +
+                "Start the login from this application; responses from other tabs or sessions are ignored.");
+        }
+        if (pending.clientId !== this.#config.clientId || pending.redirectUri !== this.#config.redirectUri) {
+            await this.#platform.pendingAuth.clear();
+            throw new SebaAuthError("The pending login was started for a different client or redirect URI. The response was ignored.");
+        }
+        const code = parseAuthorizationResponse(callbackUrl, pending);
+        const configuration = await discoverProvider(pending.issuer, this.#platform.fetch);
+        const material = await createDPoPKey();
+        const result = await exchangeAuthorizationCode({
+            configuration,
+            clientId: this.#config.clientId,
+            redirectUri: this.#config.redirectUri,
+            code,
+            codeVerifier: pending.codeVerifier,
+            nonce: pending.nonce,
+            signer: material.signer,
+            fetchImpl: this.#platform.fetch,
+            ...(pending.webId === undefined ? {} : { expectedWebId: pending.webId }),
+        });
+        await this.#sessions.adopt({
+            tokens: result.tokens,
+            identity: result.identity,
+            signer: material.signer,
+            key: material.persisted,
+            configuration,
+        });
+        await this.#platform.pendingAuth.clear();
+        this.#platform.clearCallback?.();
+        this.#debug(`authenticated as ${result.identity.webId}`);
+        const session = this.#sessions.toPublicSession();
+        if (session === null) {
+            throw new SebaAuthError("The session was created but could not be read back.");
+        }
+        return session;
+    }
+    #callbackUrl() {
+        const url = this.#platform.currentUrl();
+        if (url === null) {
+            return null;
+        }
+        const params = url.searchParams;
+        if (!params.has("code") && !params.has("error")) {
+            return null;
+        }
+        if (!params.has("state")) {
+            return null;
+        }
+        let configured;
+        try {
+            configured = new URL(this.#config.redirectUri);
+        }
+        catch {
+            return null;
+        }
+        if (url.origin !== configured.origin || url.pathname !== configured.pathname) {
+            return null;
+        }
+        return url.href;
+    }
+    #debug(message) {
+        if (!this.#config.debug) {
+            return;
+        }
+        console.debug(`[seba] ${message}`);
+    }
+}
+function resolveConfig(config, platform) {
+    const clientId = validateClientIdUrl(config.clientId);
+    let redirect;
+    try {
+        redirect = new URL(config.redirectUri);
+    }
+    catch {
+        throw new SebaConfigError(`The redirectUri "${config.redirectUri}" is not an absolute URL. ` +
+            'Use the callback URL published in your Client ID Document, for example "https://app.example/auth/callback".');
+    }
+    if (redirect.protocol !== "https:" && !(redirect.protocol === "http:" && isLoopbackHost(redirect.hostname))) {
+        throw new SebaConfigError(`The redirectUri "${config.redirectUri}" must use https. ` +
+            "Plain http is only accepted for loopback development hosts.");
+    }
+    if (platform.kind === "node" && !isLoopbackHost(redirect.hostname)) {
+        throw new SebaConfigError(`In Node.js the redirectUri must point at a loopback interface (127.0.0.1, ::1 or localhost), ` +
+            `but "${config.redirectUri}" does not. The temporary callback server only listens on loopback.`);
+    }
+    const storage = config.storage ?? platform.defaultStorage;
+    assertStorageKind(storage);
+    return {
+        clientId,
+        redirectUri: config.redirectUri,
+        storage,
+        debug: config.debug === true,
+        ...(config.openAuthorizationUrl === undefined ? {} : { openAuthorizationUrl: config.openAuthorizationUrl }),
+    };
+}
+function buildTemplate(input, init) {
+    try {
+        return new Request(input, init);
+    }
+    catch (error) {
+        throw new SebaConfigError(`The request for "${safeDescribe(inputToString(input))}" could not be constructed. ` +
+            "Use an absolute URL and a body type accepted by fetch.", { cause: error });
+    }
+}
+function isReplayable(input, init) {
+    if (init?.body instanceof ReadableStream) {
+        return false;
+    }
+    if (input instanceof Request && input.body !== null) {
+        return false;
+    }
+    return true;
+}
+async function readBody(request) {
+    try {
+        return await request.arrayBuffer();
+    }
+    catch (error) {
+        throw new SebaConfigError("The request body could not be read.", { cause: error });
+    }
+}
+function downgradeToGet(status, method) {
+    if (status === 303) {
+        return true;
+    }
+    return (status === 301 || status === 302) && method === "POST";
+}
+function safeResolve(location, base) {
+    try {
+        return new URL(location, base);
+    }
+    catch {
+        return null;
+    }
+}
+function safeDescribe(value) {
+    try {
+        const url = new URL(value);
+        return `${url.origin}${url.pathname}`;
+    }
+    catch {
+        return "the request URL";
+    }
+}
+function describeEndpoint(value) {
+    return safeDescribe(value);
+}
+//# sourceMappingURL=client.js.map

package/dist/core/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,GACd,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGjD,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,8FAA8F;AAC9F,MAAM,YAAY,GAAG,CAAC,CAAC;AAgBvB;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACZ,SAAS,CAAW;IACpB,OAAO,CAAiB;IACxB,SAAS,CAAiB;IACnC,MAAM,GAAkB,IAAI,CAAC;IAE7B,YAAY,MAAkB,EAAE,QAAkB;QAChD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC;YAClC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrD,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC;YAC9D,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;gBACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,UAAwB,EAAE;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,KAAwB,EAAE,IAAkB;QACtD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,GACR,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,OAAO,GAAsD;YAC/D,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACvC,CAAC;QACF,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,YAAY,GAAG,KAAK,CAAC;QAEzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CACT,MAAM,EACN,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,WAAW;gBACX,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aACxD,CAAC,CACH,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;YACtB,CAAC;YAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,IAAI,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzF,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,SAAS,IAAI,CAAC,CAAC;gBACf,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxF,OAAO,GAAG;oBACR,GAAG,EAAE,IAAI,CAAC,IAAI;oBACd,MAAM;oBACN,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACF,SAAS;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,CAAC;oBAClD,YAAY,GAAG,IAAI,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,EAAE,CAAC;oBAC3D,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAC3C,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,aAAa,CACrB,6GAA6G;YAC3G,6FAA6F,CAChG,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,OAA0D,EAC1D,OAAgB,EAChB,IAAqB,EACrB,MAA0B;QAE1B,MAAM,IAAI,GAAuB;YAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,IAAI,YAAY,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAqB;QACrC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QACzF,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE5B,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,IAAI,aAAa,CACrB,mFAAmF;oBACjF,wDAAwD,CAC3D,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YACrD,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;YACnF,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAED,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACvB,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzF,0BAA0B,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC;YAC/C,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;YAC7C,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,6BAA6B,gBAAgB,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAElG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC7D,gBAAgB;YAChB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;gBACjD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CACrB,2EAA2E;gBACzE,2FAA2F,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACnG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,aAAa,CACrB,iGAAiG,CAClG,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,0BAA0B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,aAAa;YACb,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;YAC/B,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,SAAS;YACvB,aAAa;SACd,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,oBAAoB,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;QACjD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CAAC,qDAAqD,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IACrC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,MAAkB,EAAE,QAAkB;IAC3D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEtD,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CACvB,oBAAoB,MAAM,CAAC,WAAW,4BAA4B;YAChE,6GAA6G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,eAAe,CACvB,oBAAoB,MAAM,CAAC,WAAW,oBAAoB;YACxD,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,eAAe,CACvB,+FAA+F;YAC7F,QAAQ,MAAM,CAAC,WAAW,qEAAqE,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC;IAC1D,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAE3B,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,IAAI;QAC5B,GAAG,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB,EAAE,IAA6B;IAC5E,IAAI,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,oBAAoB,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,8BAA8B;YAClF,wDAAwD,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB,EAAE,IAA6B;IAC3E,IAAI,IAAI,EAAE,IAAI,YAAY,cAAc,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAc;IACpD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/core/discovery.d.ts

@@ -0,0 +1,82 @@
+/**
+ * OpenID Provider discovery (OpenID Connect Discovery 1.0 §3–§4).
+ *
+ * SEBA only trusts a discovery document whose `issuer` is byte-identical to the issuer it
+ * asked for, and only uses `https` endpoints (loopback `http` for local development).
+ */
+import type { OIDCConfiguration } from "../types.js";
+/**
+ * Whether a hostname is a loopback interface.
+ *
+ * @param hostname - Hostname from a parsed URL.
+ */
+export declare function isLoopbackHost(hostname: string): boolean;
+/**
+ * Validate an issuer identifier.
+ *
+ * Rules applied (Solid-OIDC §6.1, OIDC Discovery §3): absolute URL, `https` scheme (plain
+ * `http` is accepted for loopback development hosts only), a host, and no query or
+ * fragment. The issuer string is returned unchanged because issuer identity is exact.
+ *
+ * @param issuer - Candidate issuer URL.
+ * @param label - Field name used in error messages.
+ * @throws {@link SebaDiscoveryError} when the value is not a usable issuer.
+ */
+export declare function validateIssuerUrl(issuer: string, label?: string): string;
+/**
+ * Candidate well-known configuration URLs for an issuer.
+ *
+ * RFC 8414 inserts the well-known segment between host and path; several providers only
+ * serve the appended form. Both are tried, in that order, and only on 404.
+ *
+ * @param issuer - Validated issuer URL.
+ */
+export declare function wellKnownCandidates(issuer: string): string[];
+/**
+ * Compare a provider-declared issuer with the requested one.
+ *
+ * Exact equality is required, with one narrowly scoped exception: a provider whose issuer
+ * has an empty path may publish it as `https://host/` while the caller typed
+ * `https://host` (no path). Both denote the same identifier and real providers
+ * (solidcommunity.net, solidweb.me, Community Solid Server) publish the trailing-slash
+ * form. Nothing else is normalized: paths, ports, schemes and query strings must match.
+ *
+ * @param declared - Issuer string from the discovery document.
+ * @param requested - Issuer string the caller asked for.
+ */
+export declare function issuerEquivalent(declared: string, requested: string): boolean;
+/**
+ * Validate an endpoint URL from provider metadata.
+ *
+ * @param value - Candidate value from the discovery document.
+ * @param field - Metadata member name, used in error messages.
+ * @param issuer - Issuer the document was fetched for, used in error messages.
+ */
+export declare function validateEndpointUrl(value: unknown, field: string, issuer: string): string;
+/**
+ * Parse and validate an OpenID Provider configuration document.
+ *
+ * @param raw - Parsed JSON document.
+ * @param requestedIssuer - Issuer that was requested; must match the document exactly.
+ */
+export declare function parseProviderConfiguration(raw: unknown, requestedIssuer: string): OIDCConfiguration;
+/**
+ * Fetch and validate the OpenID Provider configuration for an issuer.
+ *
+ * @param issuer - Issuer identifier supplied by configuration, WebID discovery or the user.
+ * @param fetchImpl - Runtime `fetch` implementation.
+ * @throws {@link SebaDiscoveryError} for an unusable issuer or an invalid/missing document.
+ * @throws {@link SebaNetworkError} when the provider cannot be reached.
+ */
+export declare function discoverProvider(issuer: string, fetchImpl: typeof fetch): Promise<OIDCConfiguration>;
+/**
+ * Whether a provider advertises Solid `webid` scope support.
+ *
+ * Used to decide whether Solid-specific ID token requirements (`aud` containing `solid`,
+ * `cnf.jkt` binding) are enforced. A provider that does not publish `scopes_supported` is
+ * treated as not advertising `webid`, so standard OIDC validation applies.
+ *
+ * @param configuration - Validated provider configuration.
+ */
+export declare function advertisesWebIdScope(configuration: OIDCConfiguration): boolean;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/core/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKrD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,MAAM,CA6B1E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAW5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoB7E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsBzF;AAYD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,CAiEnG;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiC1G;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAE9E"}