@gaballahtech/seba 0.0.0-stage → 0.2.1

package/dist/core/discovery.js

@@ -0,0 +1,243 @@
+/**
+ * OpenID Provider discovery (OpenID Connect Discovery 1.0 §3–§4).
+ *
+ * SEBA only trusts a discovery document whose `issuer` is byte-identical to the issuer it
+ * asked for, and only uses `https` endpoints (loopback `http` for local development).
+ */
+import { SebaDPoPError, SebaDiscoveryError } from "./errors.js";
+import { httpFetch, isOk, JSON_ACCEPT, parseJson, readText } from "./http.js";
+/** Hostnames that are only reachable from the local machine. */
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "::1", "localhost"]);
+/**
+ * Whether a hostname is a loopback interface.
+ *
+ * @param hostname - Hostname from a parsed URL.
+ */
+export function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase();
+    return LOOPBACK_HOSTS.has(host) || host.endsWith(".localhost");
+}
+/**
+ * Validate an issuer identifier.
+ *
+ * Rules applied (Solid-OIDC §6.1, OIDC Discovery §3): absolute URL, `https` scheme (plain
+ * `http` is accepted for loopback development hosts only), a host, and no query or
+ * fragment. The issuer string is returned unchanged because issuer identity is exact.
+ *
+ * @param issuer - Candidate issuer URL.
+ * @param label - Field name used in error messages.
+ * @throws {@link SebaDiscoveryError} when the value is not a usable issuer.
+ */
+export function validateIssuerUrl(issuer, label = "issuer") {
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new SebaDiscoveryError(`The ${label} "${issuer}" is not an absolute URL. ` +
+            'Use the provider\'s issuer identifier, for example "https://login.example.com".');
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+        throw new SebaDiscoveryError(`The ${label} "${issuer}" must use https. ` +
+            "Plain http is only accepted for loopback development hosts (127.0.0.1, ::1, localhost).");
+    }
+    if (url.hostname === "") {
+        throw new SebaDiscoveryError(`The ${label} "${issuer}" has no host component.`);
+    }
+    if (url.search !== "" || url.hash !== "") {
+        throw new SebaDiscoveryError(`The ${label} "${issuer}" must not contain a query string or fragment. ` +
+            "An issuer identifier is a stable URL such as \"https://login.example.com\".");
+    }
+    if (url.username !== "" || url.password !== "") {
+        throw new SebaDiscoveryError(`The ${label} "${issuer}" must not contain embedded credentials.`);
+    }
+    return issuer;
+}
+/**
+ * Candidate well-known configuration URLs for an issuer.
+ *
+ * RFC 8414 inserts the well-known segment between host and path; several providers only
+ * serve the appended form. Both are tried, in that order, and only on 404.
+ *
+ * @param issuer - Validated issuer URL.
+ */
+export function wellKnownCandidates(issuer) {
+    const url = new URL(issuer);
+    const origin = `${url.protocol}//${url.host}`;
+    const path = url.pathname.replace(/\/+$/, "");
+    if (path === "") {
+        return [`${origin}/.well-known/openid-configuration`];
+    }
+    return [
+        `${origin}/.well-known/openid-configuration${path}`,
+        `${origin}${path}/.well-known/openid-configuration`,
+    ];
+}
+/**
+ * Compare a provider-declared issuer with the requested one.
+ *
+ * Exact equality is required, with one narrowly scoped exception: a provider whose issuer
+ * has an empty path may publish it as `https://host/` while the caller typed
+ * `https://host` (no path). Both denote the same identifier and real providers
+ * (solidcommunity.net, solidweb.me, Community Solid Server) publish the trailing-slash
+ * form. Nothing else is normalized: paths, ports, schemes and query strings must match.
+ *
+ * @param declared - Issuer string from the discovery document.
+ * @param requested - Issuer string the caller asked for.
+ */
+export function issuerEquivalent(declared, requested) {
+    if (declared === requested) {
+        return true;
+    }
+    try {
+        const left = new URL(declared);
+        const right = new URL(requested);
+        const emptyPath = (url) => url.pathname === "" || url.pathname === "/";
+        return (left.origin === right.origin &&
+            emptyPath(left) &&
+            emptyPath(right) &&
+            left.search === "" &&
+            right.search === "" &&
+            left.hash === "" &&
+            right.hash === "");
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate an endpoint URL from provider metadata.
+ *
+ * @param value - Candidate value from the discovery document.
+ * @param field - Metadata member name, used in error messages.
+ * @param issuer - Issuer the document was fetched for, used in error messages.
+ */
+export function validateEndpointUrl(value, field, issuer) {
+    if (typeof value !== "string" || value === "") {
+        throw new SebaDiscoveryError(`The discovery document for "${issuer}" is missing the required "${field}" URL.`);
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new SebaDiscoveryError(`The discovery document for "${issuer}" declares "${field}" as "${value}", which is not an absolute URL.`);
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+        throw new SebaDiscoveryError(`The discovery document for "${issuer}" declares "${field}" as "${value}", which does not use https. ` +
+            "Refusing to send authorization codes or tokens over an insecure endpoint.");
+    }
+    if (url.hash !== "") {
+        throw new SebaDiscoveryError(`The discovery document for "${issuer}" declares "${field}" with a fragment.`);
+    }
+    return value;
+}
+function readStringArray(value, field, issuer) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
+        throw new SebaDiscoveryError(`The discovery document for "${issuer}" declares "${field}" as a non-string array.`);
+    }
+    return [...value];
+}
+/**
+ * Parse and validate an OpenID Provider configuration document.
+ *
+ * @param raw - Parsed JSON document.
+ * @param requestedIssuer - Issuer that was requested; must match the document exactly.
+ */
+export function parseProviderConfiguration(raw, requestedIssuer) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new SebaDiscoveryError(`The discovery document for "${requestedIssuer}" is not a JSON object.`);
+    }
+    const document = raw;
+    const declaredIssuer = document["issuer"];
+    if (typeof declaredIssuer !== "string" || !issuerEquivalent(declaredIssuer, requestedIssuer)) {
+        const found = typeof declaredIssuer === "string" ? `"${declaredIssuer}"` : "missing";
+        throw new SebaDiscoveryError(`The discovery document for "${requestedIssuer}" declares its issuer as ${found}. ` +
+            "A mismatching issuer identifier means the document cannot be trusted; check that the configured issuer is correct.");
+    }
+    const responseTypes = readStringArray(document["response_types_supported"], "response_types_supported", requestedIssuer);
+    if (responseTypes !== undefined && !responseTypes.includes("code")) {
+        throw new SebaDiscoveryError(`The provider "${requestedIssuer}" does not advertise support for the "code" response type. ` +
+            "SEBA only implements the authorization code flow.");
+    }
+    const dpopAlgorithms = readStringArray(document["dpop_signing_alg_values_supported"], "dpop_signing_alg_values_supported", requestedIssuer);
+    if (dpopAlgorithms !== undefined && !dpopAlgorithms.includes("ES256")) {
+        throw new SebaDPoPError(`The provider "${requestedIssuer}" does not advertise ES256 in "dpop_signing_alg_values_supported". ` +
+            `Advertised algorithms: ${dpopAlgorithms.join(", ") || "(none)"}. SEBA requires ES256.`);
+    }
+    const configuration = {
+        // The provider's spelling is authoritative: real providers commonly publish
+        // "https://host/" while users type "https://host". The callback `iss` and later
+        // comparisons use this exact string.
+        issuer: declaredIssuer,
+        authorizationEndpoint: validateEndpointUrl(document["authorization_endpoint"], "authorization_endpoint", requestedIssuer),
+        tokenEndpoint: validateEndpointUrl(document["token_endpoint"], "token_endpoint", requestedIssuer),
+        jwksUri: validateEndpointUrl(document["jwks_uri"], "jwks_uri", requestedIssuer),
+    };
+    if (document["revocation_endpoint"] !== undefined) {
+        configuration.revocationEndpoint = validateEndpointUrl(document["revocation_endpoint"], "revocation_endpoint", requestedIssuer);
+    }
+    const scopes = readStringArray(document["scopes_supported"], "scopes_supported", requestedIssuer);
+    if (scopes !== undefined) {
+        configuration.scopesSupported = scopes;
+    }
+    const grants = readStringArray(document["grant_types_supported"], "grant_types_supported", requestedIssuer);
+    if (grants !== undefined) {
+        configuration.grantTypesSupported = grants;
+    }
+    if (dpopAlgorithms !== undefined) {
+        configuration.dpopSigningAlgValuesSupported = dpopAlgorithms;
+    }
+    return configuration;
+}
+/**
+ * Fetch and validate the OpenID Provider configuration for an issuer.
+ *
+ * @param issuer - Issuer identifier supplied by configuration, WebID discovery or the user.
+ * @param fetchImpl - Runtime `fetch` implementation.
+ * @throws {@link SebaDiscoveryError} for an unusable issuer or an invalid/missing document.
+ * @throws {@link SebaNetworkError} when the provider cannot be reached.
+ */
+export async function discoverProvider(issuer, fetchImpl) {
+    const validated = validateIssuerUrl(issuer);
+    const candidates = wellKnownCandidates(validated);
+    let response = null;
+    let lastUrl = candidates[0] ?? validated;
+    for (const candidate of candidates) {
+        lastUrl = candidate;
+        const attempt = await httpFetch(candidate, { headers: { accept: JSON_ACCEPT }, redirect: "follow" }, { fetchImpl });
+        if (attempt.status === 404) {
+            continue;
+        }
+        response = attempt;
+        break;
+    }
+    if (response === null) {
+        throw new SebaDiscoveryError(`No OpenID Provider configuration was found for issuer "${validated}". ` +
+            `Tried ${candidates.map((candidate) => `"${candidate}"`).join(" and ")} and received HTTP 404. ` +
+            "Check the issuer URL and that the provider publishes openid-configuration.");
+    }
+    if (!isOk(response)) {
+        throw new SebaDiscoveryError(`Fetching the OpenID Provider configuration for "${validated}" failed with HTTP ${String(response.status)}. ` +
+            `Requested ${lastUrl}.`);
+    }
+    const text = await readText(response, "OpenID Provider configuration");
+    const raw = parseJson(text, `The OpenID Provider configuration for "${validated}"`);
+    return parseProviderConfiguration(raw, validated);
+}
+/**
+ * Whether a provider advertises Solid `webid` scope support.
+ *
+ * Used to decide whether Solid-specific ID token requirements (`aud` containing `solid`,
+ * `cnf.jkt` binding) are enforced. A provider that does not publish `scopes_supported` is
+ * treated as not advertising `webid`, so standard OIDC validation applies.
+ *
+ * @param configuration - Validated provider configuration.
+ */
+export function advertisesWebIdScope(configuration) {
+    return configuration.scopesSupported?.includes("webid") === true;
+}
+//# sourceMappingURL=discovery.js.map

package/dist/core/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/core/discovery.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG9E,gEAAgE;AAChE,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAK,GAAG,QAAQ;IAChE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,OAAO,KAAK,KAAK,MAAM,4BAA4B;YACjD,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,kBAAkB,CAC1B,OAAO,KAAK,KAAK,MAAM,oBAAoB;YACzC,yFAAyF,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,OAAO,KAAK,KAAK,MAAM,0BAA0B,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAC1B,OAAO,KAAK,KAAK,MAAM,iDAAiD;YACtE,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,kBAAkB,CAAC,OAAO,KAAK,KAAK,MAAM,0CAA0C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO;QACL,GAAG,MAAM,oCAAoC,IAAI,EAAE;QACnD,GAAG,MAAM,GAAG,IAAI,mCAAmC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC;QACrF,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,SAAS,CAAC,IAAI,CAAC;YACf,SAAS,CAAC,KAAK,CAAC;YAChB,IAAI,CAAC,MAAM,KAAK,EAAE;YAClB,KAAK,CAAC,MAAM,KAAK,EAAE;YACnB,IAAI,CAAC,IAAI,KAAK,EAAE;YAChB,KAAK,CAAC,IAAI,KAAK,EAAE,CAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,KAAa,EAAE,MAAc;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,MAAM,8BAA8B,KAAK,QAAQ,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,MAAM,eAAe,KAAK,SAAS,KAAK,kCAAkC,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,MAAM,eAAe,KAAK,SAAS,KAAK,+BAA+B;YACpG,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,MAAM,eAAe,KAAK,oBAAoB,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAE,MAAc;IACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,MAAM,eAAe,KAAK,0BAA0B,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY,EAAE,eAAuB;IAC9E,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,eAAe,yBAAyB,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,QAAQ,GAAG,GAA8B,CAAC;IAEhD,MAAM,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;QAC7F,MAAM,KAAK,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,eAAe,4BAA4B,KAAK,IAAI;YACjF,oHAAoH,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,eAAe,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACzH,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,eAAe,6DAA6D;YAC3F,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CACpC,QAAQ,CAAC,mCAAmC,CAAC,EAC7C,mCAAmC,EACnC,eAAe,CAChB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CACrB,iBAAiB,eAAe,qEAAqE;YACnG,0BAA0B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,wBAAwB,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAsB;QACvC,4EAA4E;QAC5E,gFAAgF;QAChF,qCAAqC;QACrC,MAAM,EAAE,cAAc;QACtB,qBAAqB,EAAE,mBAAmB,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,EAAE,eAAe,CAAC;QACzH,aAAa,EAAE,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,eAAe,CAAC;QACjG,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC;KAChF,CAAC;IAEF,IAAI,QAAQ,CAAC,qBAAqB,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,aAAa,CAAC,kBAAkB,GAAG,mBAAmB,CACpD,QAAQ,CAAC,qBAAqB,CAAC,EAC/B,qBAAqB,EACrB,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAClG,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,aAAa,CAAC,eAAe,GAAG,MAAM,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;IAC5G,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,aAAa,CAAC,mBAAmB,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,6BAA6B,GAAG,cAAc,CAAC;IAC/D,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAuB;IAC5E,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAEzC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC;QACnB,MAAM;IACR,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAC1B,0DAA0D,SAAS,KAAK;YACtE,SAAS,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B;YAChG,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,kBAAkB,CAC1B,mDAAmD,SAAS,sBAAsB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;YAC3G,aAAa,OAAO,GAAG,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAU,IAAI,EAAE,0CAA0C,SAAS,GAAG,CAAC,CAAC;IAC7F,OAAO,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,aAAgC;IACnE,OAAO,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AACnE,CAAC"}

package/dist/core/dpop.d.ts

@@ -0,0 +1,67 @@
+/**
+ * DPoP key management and proof creation (RFC 9449).
+ *
+ * Every attempt gets a brand-new proof: a new `jti`, a new signature and a new `iat`.
+ * This module holds no proof state, so no code path can replay a proof.
+ */
+import type { DPoPSigner, PersistedKey, ProofInput } from "../types.js";
+/** DPoP signing algorithm required by Solid-OIDC. */
+export declare const DPOP_ALG = "ES256";
+/** A generated DPoP key and its persistable representation. */
+export interface DPoPKeyMaterial {
+    /** Signing capability for this key. */
+    readonly signer: DPoPSigner;
+    /** Value to store (private key or exported JWK + public JWK). */
+    readonly persisted: PersistedKey;
+}
+/**
+ * Generate a new ES256 DPoP key pair.
+ *
+ * The private key is non-extractable whenever the runtime can structured-clone a
+ * `CryptoKey` (the property IndexedDB relies on). When it cannot, an extractable key is
+ * generated and its JWK is stored instead; this is reported in SECURITY.md and never
+ * happens silently.
+ */
+export declare function createDPoPKey(): Promise<DPoPKeyMaterial>;
+/**
+ * Rebuild a signer from a persisted key.
+ *
+ * @param persisted - Stored key material.
+ */
+export declare function loadDPoPKey(persisted: PersistedKey): Promise<DPoPSigner>;
+/**
+ * Strip private members from a JWK.
+ *
+ * @param jwk - JWK that may contain private material.
+ */
+export declare function publicJwkOf(jwk: JsonWebKey): JsonWebKey;
+/**
+ * Create a fresh DPoP proof.
+ *
+ * @param input - HTTP method, absolute URL, optional access token and optional nonce.
+ * @param key - Public half of the session key, used for the `jwk` header and thumbprint.
+ * @param privateKey - Key used to sign this proof.
+ */
+export declare function createDPoPProof(key: {
+    privateKey: CryptoKey;
+    publicJwk: JsonWebKey;
+}, input: ProofInput): Promise<string>;
+/**
+ * RFC 9449 `htu`: the HTTP URI without query and fragment.
+ *
+ * @param value - Absolute request URL.
+ */
+export declare function normalizeHtu(value: string): string | null;
+/**
+ * RFC 9449 `ath`: base64url(SHA-256(ASCII(access_token))).
+ *
+ * @param accessToken - Access token being presented.
+ */
+export declare function hashAccessToken(accessToken: string): Promise<string>;
+/**
+ * Base64url JWK SHA-256 thumbprint of a public key (`cnf.jkt`).
+ *
+ * @param publicJwk - Public JWK.
+ */
+export declare function dpopThumbprint(publicJwk: JsonWebKey): Promise<string>;
+//# sourceMappingURL=dpop.d.ts.map

package/dist/core/dpop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.d.ts","sourceRoot":"","sources":["../../src/core/dpop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExE,qDAAqD;AACrD,eAAO,MAAM,QAAQ,UAAU,CAAC;AAEhC,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;CAClC;AAmBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC,CAmB9D;AAsBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAY9E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAEvD;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE;IAAE,UAAU,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,EACrD,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzD;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1E;AAUD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAM3E"}

package/dist/core/dpop.js

@@ -0,0 +1,176 @@
+/**
+ * DPoP key management and proof creation (RFC 9449).
+ *
+ * Every attempt gets a brand-new proof: a new `jti`, a new signature and a new `iat`.
+ * This module holds no proof state, so no code path can replay a proof.
+ */
+import { SignJWT, calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from "jose";
+import { SebaDPoPError } from "./errors.js";
+/** DPoP signing algorithm required by Solid-OIDC. */
+export const DPOP_ALG = "ES256";
+function signerFrom(signingKey) {
+    return {
+        async createProof(input) {
+            return createDPoPProof(signingKey, input);
+        },
+        async thumbprint() {
+            return dpopThumbprint(signingKey.publicJwk);
+        },
+    };
+}
+/**
+ * Generate a new ES256 DPoP key pair.
+ *
+ * The private key is non-extractable whenever the runtime can structured-clone a
+ * `CryptoKey` (the property IndexedDB relies on). When it cannot, an extractable key is
+ * generated and its JWK is stored instead; this is reported in SECURITY.md and never
+ * happens silently.
+ */
+export async function createDPoPKey() {
+    try {
+        const pair = await generateKeyPair(DPOP_ALG, { extractable: false, crv: "P-256" });
+        const publicJwk = await exportJWK(pair.publicKey);
+        const cloneable = canStructuredClone(pair.privateKey);
+        if (cloneable) {
+            const signingKey = { privateKey: pair.privateKey, publicJwk };
+            return {
+                signer: signerFrom(signingKey),
+                persisted: { kind: "crypto-key", key: pair.privateKey, publicJwk },
+            };
+        }
+        return await generateExtractableKey();
+    }
+    catch (error) {
+        throw new SebaDPoPError("Unable to generate a DPoP key. The runtime must support Web Crypto ECDSA P-256.", { cause: error });
+    }
+}
+async function generateExtractableKey() {
+    const pair = await generateKeyPair(DPOP_ALG, { extractable: true, crv: "P-256" });
+    const publicJwk = await exportJWK(pair.publicKey);
+    const privateJwk = await exportJWK(pair.privateKey);
+    const signingKey = { privateKey: pair.privateKey, publicJwk };
+    return {
+        signer: signerFrom(signingKey),
+        persisted: { kind: "jwk", jwk: privateJwk },
+    };
+}
+function canStructuredClone(key) {
+    try {
+        structuredClone(key);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Rebuild a signer from a persisted key.
+ *
+ * @param persisted - Stored key material.
+ */
+export async function loadDPoPKey(persisted) {
+    try {
+        if (persisted.kind === "crypto-key") {
+            return signerFrom({ privateKey: persisted.key, publicJwk: persisted.publicJwk });
+        }
+        const privateKey = (await importJWK(persisted.jwk, DPOP_ALG));
+        return signerFrom({ privateKey, publicJwk: publicJwkOf(persisted.jwk) });
+    }
+    catch (error) {
+        throw new SebaDPoPError("The stored DPoP key could not be loaded; the session must be recreated.", {
+            cause: error,
+        });
+    }
+}
+/**
+ * Strip private members from a JWK.
+ *
+ * @param jwk - JWK that may contain private material.
+ */
+export function publicJwkOf(jwk) {
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+}
+/**
+ * Create a fresh DPoP proof.
+ *
+ * @param input - HTTP method, absolute URL, optional access token and optional nonce.
+ * @param key - Public half of the session key, used for the `jwk` header and thumbprint.
+ * @param privateKey - Key used to sign this proof.
+ */
+export async function createDPoPProof(key, input) {
+    const htu = normalizeHtu(input.url);
+    if (htu === null) {
+        throw new SebaDPoPError(`The request URL "${input.url}" cannot be normalized for a DPoP proof.`);
+    }
+    const payload = {
+        jti: randomJti(),
+        htm: input.method.toUpperCase(),
+        htu,
+        iat: Math.floor(Date.now() / 1000),
+    };
+    if (input.accessToken !== undefined) {
+        payload["ath"] = await hashAccessToken(input.accessToken);
+    }
+    if (input.nonce !== undefined) {
+        payload["nonce"] = input.nonce;
+    }
+    try {
+        return await new SignJWT(payload)
+            .setProtectedHeader({ typ: "dpop+jwt", alg: DPOP_ALG, jwk: key.publicJwk })
+            .sign(key.privateKey);
+    }
+    catch (error) {
+        throw new SebaDPoPError("Unable to sign the DPoP proof with the session key.", { cause: error });
+    }
+}
+/**
+ * RFC 9449 `htu`: the HTTP URI without query and fragment.
+ *
+ * @param value - Absolute request URL.
+ */
+export function normalizeHtu(value) {
+    try {
+        const url = new URL(value);
+        url.search = "";
+        url.hash = "";
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * RFC 9449 `ath`: base64url(SHA-256(ASCII(access_token))).
+ *
+ * @param accessToken - Access token being presented.
+ */
+export async function hashAccessToken(accessToken) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken));
+    return base64urlOf(new Uint8Array(digest));
+}
+function base64urlOf(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+/**
+ * Base64url JWK SHA-256 thumbprint of a public key (`cnf.jkt`).
+ *
+ * @param publicJwk - Public JWK.
+ */
+export async function dpopThumbprint(publicJwk) {
+    try {
+        return await calculateJwkThumbprint(publicJwk, "sha256");
+    }
+    catch (error) {
+        throw new SebaDPoPError("Unable to compute the DPoP key thumbprint.", { cause: error });
+    }
+}
+function randomJti() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    return base64urlOf(bytes);
+}
+//# sourceMappingURL=dpop.js.map

package/dist/core/dpop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dpop.js","sourceRoot":"","sources":["../../src/core/dpop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,qDAAqD;AACrD,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC;AAgBhC,SAAS,UAAU,CAAC,UAAsB;IACxC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAiB;YACjC,OAAO,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;YAC1E,OAAO;gBACL,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC;gBAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,sBAAsB,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CACrB,iFAAiF,EACjF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAe,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;IAC1E,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC;QAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAc;IACxC,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAuB;IACvD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,OAAO,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAc,CAAC;QAC3E,OAAO,UAAU,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,yEAAyE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAqD,EACrD,KAAiB;IAEjB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,aAAa,CAAC,oBAAoB,KAAK,CAAC,GAAG,0CAA0C,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,SAAS,EAAE;QAChB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC/B,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;aAC9B,kBAAkB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;aAC1E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,WAAmB;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5F,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAqB;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,aAAa,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Stable error codes exposed by SEBA.
+ *
+ * Every error thrown by the library is a {@link SebaError} carrying one of these
+ * codes, so applications can branch on `error.code` instead of matching strings.
+ */
+export type SebaErrorCode = "SEBA_ERR_CONFIG" | "SEBA_ERR_DISCOVERY" | "SEBA_ERR_REDIRECT_MISMATCH" | "SEBA_ERR_AUTH" | "SEBA_ERR_SESSION_EXPIRED" | "SEBA_ERR_DPOP" | "SEBA_ERR_NETWORK" | "SEBA_ERR_NO_UI";
+/** Options accepted by every SEBA error. */
+export interface SebaErrorOptions {
+    /** Underlying error, kept for diagnostics. Never used to carry secrets. */
+    cause?: unknown;
+}
+/**
+ * Base class of every error thrown by SEBA.
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await seba.login();
+ * } catch (error) {
+ *   if (error instanceof SebaError) console.error(error.code, error.message);
+ * }
+ * ```
+ */
+export declare class SebaError extends Error {
+    /** Stable, machine-readable error code. */
+    readonly code: SebaErrorCode;
+    constructor(code: SebaErrorCode, message: string, options?: SebaErrorOptions);
+}
+/** Invalid, missing or contradictory library configuration. */
+export declare class SebaConfigError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/** WebID, Client ID Document or OpenID Provider discovery failed. */
+export declare class SebaDiscoveryError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/**
+ * The configured redirect URI is not published by the Client ID Document.
+ *
+ * The message lists both the requested URI and the published URIs so the
+ * mismatch can be fixed without inspecting network traffic.
+ */
+export declare class SebaRedirectMismatchError extends SebaError {
+    /** Redirect URI requested by the application. */
+    readonly requestedRedirectUri: string;
+    /** Redirect URIs published in the Client ID Document. */
+    readonly publishedRedirectUris: readonly string[];
+    constructor(requestedRedirectUri: string, publishedRedirectUris: readonly string[], options?: SebaErrorOptions);
+}
+/**
+ * The authorization response, token response or identity token was rejected.
+ *
+ * Always indicates a security validation failure (state, `iss`, nonce, PKCE,
+ * issuer, audience, signature or expiration), never a transient failure.
+ */
+export declare class SebaAuthError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/**
+ * The stored session can no longer be used (refresh token revoked, expired or rejected).
+ *
+ * The local session state has already been cleared when this is thrown.
+ */
+export declare class SebaSessionExpiredError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/** A DPoP proof could not be created, or the provider rejected the DPoP key binding. */
+export declare class SebaDPoPError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/** A network request failed (offline, DNS, TLS, connection reset, non-HTTP response). */
+export declare class SebaNetworkError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/** Interactive login is impossible in the current environment. */
+export declare class SebaNoUIError extends SebaError {
+    constructor(message: string, options?: SebaErrorOptions);
+}
+/**
+ * Type guard for {@link SebaError}.
+ *
+ * @param value - Any caught value.
+ */
+export declare function isSebaError(value: unknown): value is SebaError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,oBAAoB,GACpB,4BAA4B,GAC5B,eAAe,GACf,0BAA0B,GAC1B,eAAe,GACf,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;gBAEjB,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAK7E;AAED,+DAA+D;AAC/D,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,qEAAqE;AACrE,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,iDAAiD;IACjD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,yDAAyD;IACzD,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEtC,oBAAoB,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAY/G;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,wFAAwF;AACxF,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,yFAAyF;AACzF,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,kEAAkE;AAClE,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAE9D"}