@hawcx/oauth-client 0.2.0 → 5.1.0

package/dist/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AA6BlF,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,sBAAsB;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,MAAM,EAAE,SAAS,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAiDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAE/C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAgB;IACjD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAErD,OAAO,CAAC,IAAI,CAAsD;IAElE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA+B;IAErE;;;OAGG;gBACS,MAAM,EAAE,gBAAgB;IAqCpC;;;;;;;;;;;;;;;OAeG;WACU,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC;IAyH5E;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,UAAU;IA6B9D;;;;;;;;;;;;OAYG;IACG,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;IAkF1B;;;;;;;;OAQG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC;IA8ElF;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAoBf;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAInB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAclB,OAAO,CAAC,gBAAgB,CAAS;CAClC"}

package/dist/oauth.js

@@ -0,0 +1,497 @@
+"use strict";
+/**
+ * Hawcx OAuth Client
+ *
+ * Two construction paths:
+ *
+ *   1. OIDC discovery (recommended) — `HawcxOAuth.fromIssuer(...)` fetches
+ *      `<issuer>/.well-known/openid-configuration` once at startup and wires
+ *      up a verifier that enforces signature + iss + aud + exp + nbf on every
+ *      subsequent `verifyToken` call.
+ *
+ *   2. Legacy — `new HawcxOAuth({ configId, baseUrl })` hits the fixed
+ *      endpoints `/oauth2/token` and `/keys` directly. Backward-compatible
+ *      with v4.x callers, but does NOT verify `iss` or `aud` — the JWT's
+ *      signature is the only check.
+ *
+ * Both modes are safe to share across requests.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HawcxOAuth = void 0;
+const jose_1 = require("jose");
+const client_assertion_1 = require("./client-assertion");
+const errors_1 = require("./errors");
+const DEFAULT_BASE_URL = 'https://api.hawcx.com';
+const DEFAULT_TIMEOUT_MS = 10000;
+/** Bound the discovery fetch so an unreachable issuer fails fast at startup. */
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 5000;
+/**
+ * Spec.md §3.3 recommends a default clock-tolerance of 10 seconds for
+ * `exp` / `nbf` checks during JWT verification. Without it jose defaults
+ * to 0 and tokens minted under normal NTP drift between issuer and verifier
+ * fail at the very first millisecond — the symptom that drove the
+ * `exchangeCodeTolerant` workaround in hawcx_admin_console pre-5.0.
+ */
+const DEFAULT_CLOCK_TOLERANCE_SECONDS = 10;
+/**
+ * Closed id_token signing-algorithm allowlist (spec.md §3.3). Algorithms
+ * outside this set — including HS256 and the rest of the symmetric family,
+ * RS512, PS*, none — are refused even if a Hawcx issuer advertises them.
+ * Mirrors {@code JwtVerifier.DEFAULT_ALGORITHMS} in the Java SDK.
+ */
+const DEFAULT_ID_TOKEN_ALGS = Object.freeze([
+    'RS256',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+]);
+/**
+ * Require https on a discovery-related URL. Plaintext http is permitted only
+ * for loopback hosts (localhost / 127.0.0.1 / ::1) to support local dev and
+ * tests. OIDC Discovery §4 / OAuth 2.1 §7.4: an http issuer lets an on-path
+ * attacker swap the discovery doc and redirect token_endpoint / jwks_uri.
+ */
+function requireSecureUrl(label, url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch (err) {
+        throw new errors_1.DiscoveryError(`${label} is not a valid URL: ${url}`, { cause: err });
+    }
+    if (u.protocol === 'https:')
+        return;
+    const loopback = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1' || u.hostname === '[::1]';
+    if (u.protocol === 'http:' && loopback)
+        return;
+    throw new errors_1.DiscoveryError(`${label} must use https (got: ${url}). Plaintext http is permitted only for loopback hosts.`);
+}
+/**
+ * Hawcx OAuth Client
+ *
+ * Discovery-mode usage (recommended):
+ *
+ * ```typescript
+ * const oauth = await HawcxOAuth.fromIssuer({
+ *   issuer: 'https://api.hawcx.com',
+ *   configId: process.env.HAWCX_CONFIG_ID!,
+ *   clientId: process.env.HAWCX_CLIENT_ID!,
+ * });
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+ * ```
+ *
+ * Legacy usage (no discovery; aud/iss are not checked):
+ *
+ * ```typescript
+ * const oauth = new HawcxOAuth({ configId: process.env.HAWCX_CONFIG_ID! });
+ * const { idToken, claims } = await oauth.exchangeCode(code, codeVerifier);
+ * ```
+ */
+class HawcxOAuth {
+    constructor(config, discoveryInit) {
+        this.jwks = null;
+        this.clearCacheWarned = false;
+        if (!config.configId) {
+            throw new Error('configId is required');
+        }
+        this.configId = config.configId;
+        this.timeout = config.timeout ?? DEFAULT_TIMEOUT_MS;
+        this.clockToleranceSeconds =
+            config.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS;
+        if (discoveryInit) {
+            this.tokenEndpoint = discoveryInit.metadata.token_endpoint;
+            this.jwksUrl = discoveryInit.metadata.jwks_uri;
+            this.expectedAudience = discoveryInit.clientId;
+            this.expectedIssuer = discoveryInit.metadata.issuer;
+            this.discoveryMetadata = discoveryInit.metadata;
+            this.allowedAlgorithms = discoveryInit.allowedAlgorithms;
+            this.clientAssertionSigner = discoveryInit.signer ?? null;
+        }
+        else {
+            const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/$/, '');
+            this.tokenEndpoint = `${baseUrl}/oauth2/token`;
+            this.jwksUrl = `${baseUrl}/keys`;
+            this.expectedAudience = null;
+            this.expectedIssuer = null;
+            this.discoveryMetadata = null;
+            this.allowedAlgorithms = null;
+            this.clientAssertionSigner = null;
+        }
+    }
+    /**
+     * Construct a client via OIDC discovery.
+     *
+     * Fetches `<issuer>/.well-known/openid-configuration`, reads the token
+     * endpoint, JWKS URI, and supported id_token signing algorithm, and wires
+     * a verifier that enforces signature + `iss` + `aud` + `exp` + `nbf` on
+     * subsequent {@link verifyToken} calls.
+     *
+     * **Discovery is bounded** at `discoveryTimeout` ms (default 5000) so an
+     * unreachable issuer fails fast with {@link DiscoveryError} rather than
+     * hanging your bootstrap.
+     *
+     * @throws {DiscoveryError} if discovery fails to resolve or the document
+     *   is missing required fields (`token_endpoint`, `jwks_uri`,
+     *   `id_token_signing_alg_values_supported`).
+     */
+    static async fromIssuer(config) {
+        if (!config.issuer)
+            throw new Error('issuer is required');
+        if (!config.configId)
+            throw new Error('configId is required');
+        if (!config.clientId)
+            throw new Error('clientId is required');
+        if (config.clockToleranceSeconds !== undefined && config.clockToleranceSeconds < 0) {
+            throw new Error('clockToleranceSeconds must be >= 0');
+        }
+        const issuer = config.issuer.replace(/\/$/, '');
+        requireSecureUrl('issuer', issuer);
+        const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+        const timeout = config.discoveryTimeout ?? DEFAULT_DISCOVERY_TIMEOUT_MS;
+        let response;
+        try {
+            response = await fetch(discoveryUrl, {
+                method: 'GET',
+                headers: { Accept: 'application/json' },
+                signal: AbortSignal.timeout(timeout),
+            });
+        }
+        catch (err) {
+            throw new errors_1.DiscoveryError(`OIDC discovery failed at ${discoveryUrl}: ${err}`, { cause: err });
+        }
+        if (!response.ok) {
+            throw new errors_1.DiscoveryError(`OIDC discovery returned HTTP ${response.status} at ${discoveryUrl}`);
+        }
+        let raw;
+        try {
+            raw = (await response.json());
+        }
+        catch (err) {
+            throw new errors_1.DiscoveryError(`OIDC discovery document at ${discoveryUrl} is not valid JSON`, { cause: err });
+        }
+        const required = (field) => {
+            const value = raw[field];
+            if (typeof value !== 'string' || value.length === 0) {
+                throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field '${field}'`);
+            }
+            return value;
+        };
+        const tokenEndpoint = required('token_endpoint');
+        const jwksUri = required('jwks_uri');
+        // The discovered endpoints must also be https (loopback excepted) — a
+        // plaintext issuer could otherwise advertise plaintext sub-resources.
+        requireSecureUrl('token_endpoint', tokenEndpoint);
+        requireSecureUrl('jwks_uri', jwksUri);
+        const algsValue = raw['id_token_signing_alg_values_supported'];
+        if (!Array.isArray(algsValue) ||
+            algsValue.length === 0 ||
+            !algsValue.every((a) => typeof a === 'string')) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field ` +
+                `'id_token_signing_alg_values_supported' (must be a non-empty string array)`);
+        }
+        // spec.md §3.3: the algorithm allowlist MUST be a closed set
+        // ({RS256, ES256, ES384, ES512, EdDSA}). Intersect the issuer's advertised
+        // list with our allowlist — refuse to construct a client if no overlap.
+        // Without this, an issuer advertising only RS512 / PS256 / a symmetric alg
+        // would be silently trusted at verify time. Forecloses key-confusion /
+        // algorithm-substitution attacks where the JWKS happens to serve a key
+        // type matching whatever alg the JWT header advertises.
+        const allowedAlgorithms = Object.freeze(algsValue.filter((a) => DEFAULT_ID_TOKEN_ALGS.includes(a)));
+        if (allowedAlgorithms.length === 0) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} advertises id_token signing algorithms ` +
+                `${JSON.stringify(algsValue)} — none are in the SDK allowlist ` +
+                `${JSON.stringify(DEFAULT_ID_TOKEN_ALGS)} (per spec.md §3.3). ` +
+                `Refusing to construct a verifier.`);
+        }
+        // RFC 8414 §3.3 / OIDC Discovery §4.3: the `issuer` value in the metadata
+        // document MUST be identical to the issuer URL the request was made to.
+        // Without this cross-check, a discovery document that advertises a different
+        // `issuer` (e.g., a shared base URL on a multi-tenant deployment) would be
+        // silently trusted, and `verifyToken` would later accept tokens issued by
+        // that *other* issuer — a cross-tenant token-acceptance bypass.
+        if (typeof raw['issuer'] !== 'string' || raw['issuer'].length === 0) {
+            throw new errors_1.DiscoveryError(`Discovery document at ${discoveryUrl} is missing required field 'issuer'`);
+        }
+        const issuerFromDoc = raw['issuer'].replace(/\/$/, '');
+        if (issuerFromDoc !== issuer) {
+            throw new errors_1.DiscoveryError(`Discovery document issuer '${issuerFromDoc}' does not match the issuer ` +
+                `requested ('${issuer}'). RFC 8414 §3.3 requires these to be identical.`);
+        }
+        const metadata = {
+            ...raw,
+            issuer: issuerFromDoc,
+            token_endpoint: tokenEndpoint,
+            jwks_uri: jwksUri,
+            id_token_signing_alg_values_supported: algsValue,
+        };
+        return new HawcxOAuth({
+            configId: config.configId,
+            timeout: config.timeout,
+            clockToleranceSeconds: config.clockToleranceSeconds,
+        }, { metadata, clientId: config.clientId, allowedAlgorithms });
+    }
+    /**
+     * Opt into `private_key_jwt` client authentication (discovery mode only).
+     * When set, the token exchange signs and attaches an RFC 7523
+     * `client_assertion` (in addition to PKCE). Without it, the exchange stays
+     * public-client + PKCE.
+     *
+     * Intended to be called once right after {@link fromIssuer}, before the
+     * client is shared. Returns `this` for chaining.
+     */
+    /**
+     * @beta Experimental `private_key_jwt` surface; may change before stable.
+     *
+     * Returns a **new** discovery-mode client configured with the signer (sharing
+     * this client's resolved discovery state); the original is unchanged, so a
+     * configured client is immutable. Chained usage
+     * (`(await fromIssuer(...)).withClientAssertion(...)`) is unaffected.
+     *
+     * Refuses if the OP's discovery doc advertises
+     * `token_endpoint_auth_methods_supported` without `private_key_jwt`
+     * (the assertion would be silently ignored).
+     */
+    withClientAssertion(signer) {
+        if (this.discoveryMetadata === null) {
+            throw new Error('withClientAssertion requires a discovery-mode client built via HawcxOAuth.fromIssuer(...)');
+        }
+        const methods = this.discoveryMetadata['token_endpoint_auth_methods_supported'];
+        if (Array.isArray(methods) && methods.length > 0 && !methods.includes('private_key_jwt')) {
+            throw new errors_1.DiscoveryError(`The OP does not advertise 'private_key_jwt' in token_endpoint_auth_methods_supported ` +
+                `(${JSON.stringify(methods)}); refusing to attach a client_assertion that would be ` +
+                `ignored. Register the client for private_key_jwt in the Hawcx admin console.`);
+        }
+        return new HawcxOAuth({
+            configId: this.configId,
+            timeout: this.timeout,
+            clockToleranceSeconds: this.clockToleranceSeconds,
+        }, {
+            metadata: this.discoveryMetadata,
+            clientId: this.expectedAudience,
+            allowedAlgorithms: this.allowedAlgorithms,
+            signer,
+        });
+    }
+    /**
+     * Exchange authorization code for id_token and verified claims.
+     *
+     * @param code - Authorization code from auth flow
+     * @param codeVerifier - PKCE code verifier
+     * @param redirectUri - Optional. If your original authorization request
+     *   registered a `redirect_uri`, RFC 6749 §4.1.3 requires the token
+     *   request to carry the same value. Omit if the auth request also omitted it.
+     * @param expectedNonce - Optional. If your authorization request bound a
+     *   `nonce`, pass it here so the returned id_token's `nonce` is verified.
+     *   Required whenever the token carries a nonce (verification refuses
+     *   otherwise — OIDC Core §3.1.3.7).
+     */
+    async exchangeCode(code, codeVerifier, redirectUri, expectedNonce) {
+        if (!code)
+            throw new errors_1.TokenExchangeError('code is required');
+        if (!codeVerifier)
+            throw new errors_1.TokenExchangeError('codeVerifier is required');
+        const body = new URLSearchParams();
+        body.append('grant_type', 'authorization_code');
+        body.append('code', code);
+        body.append('code_verifier', codeVerifier);
+        if (redirectUri) {
+            body.append('redirect_uri', redirectUri);
+        }
+        const signer = this.clientAssertionSigner;
+        if (signer !== null && this.discoveryMetadata !== null) {
+            // private_key_jwt: include client_id (parity with the demo RP) + the
+            // signed assertion. aud is the discovered token_endpoint string exactly,
+            // which the OP pins for the assertion. PKCE fields above are retained.
+            // In this guarded branch discoveryMetadata !== null, so expectedAudience
+            // is the clientId (non-null). Assert rather than mask with ''.
+            const clientId = this.expectedAudience;
+            body.append('client_id', clientId);
+            body.append('client_assertion_type', client_assertion_1.CLIENT_ASSERTION_TYPE);
+            body.append('client_assertion', await signer.sign(clientId, this.discoveryMetadata.token_endpoint));
+        }
+        let response;
+        try {
+            response = await fetch(this.tokenEndpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'X-Config-Id': this.configId,
+                    Accept: 'application/json',
+                },
+                body: body.toString(),
+                signal: AbortSignal.timeout(this.timeout),
+            });
+        }
+        catch (err) {
+            throw new errors_1.TokenExchangeError(`Network error: ${err}`);
+        }
+        if (!response.ok) {
+            let errorMsg = `HTTP ${response.status}`;
+            // Read the body as text first so a non-JSON error (e.g. an HTML 502 from
+            // a gateway) is preserved in the message instead of being swallowed.
+            const rawBody = await response.text().catch(() => '');
+            let errCode;
+            let errDesc;
+            if (rawBody) {
+                try {
+                    const data = JSON.parse(rawBody);
+                    errCode = data.error;
+                    errDesc = data.error_description;
+                    errorMsg = data.error_description || data.error || `${errorMsg}: ${rawBody}`;
+                }
+                catch {
+                    errorMsg = `${errorMsg}: ${rawBody}`;
+                }
+            }
+            throw new errors_1.TokenExchangeError(errorMsg, response.status, {
+                error: errCode,
+                errorDescription: errDesc,
+            });
+        }
+        const data = (await response.json());
+        const idToken = data.id_token;
+        if (!idToken) {
+            throw new errors_1.TokenExchangeError('Response missing id_token');
+        }
+        const claims = await this.verifyToken(idToken, expectedNonce !== undefined ? { nonce: expectedNonce } : undefined);
+        return { idToken, claims };
+    }
+    /**
+     * Verify a JWT token and return its claims.
+     *
+     * In **discovery mode**, enforces signature + `iss` + `aud` + `exp` + `nbf`
+     * (and the optional `nonce` claim if `options.nonce` is provided).
+     *
+     * In **legacy mode**, only the signature is verified. Audience and issuer
+     * claims are not checked, matching the pre-5.x behavior.
+     */
+    async verifyToken(token, options) {
+        if (!token)
+            throw new errors_1.TokenVerificationError('token is required');
+        try {
+            const jwks = this.getJwks();
+            const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
+                ...(this.expectedIssuer !== null && { issuer: this.expectedIssuer }),
+                ...(this.expectedAudience !== null && { audience: this.expectedAudience }),
+                // Enforce the allowlist that fromIssuer pinned at construction time.
+                // Without this, jose accepts any algorithm whose key happens to be
+                // present in the JWKS — a key-confusion / alg-substitution path.
+                // `as string[]` because jose's type is mutable; ours is readonly.
+                ...(this.allowedAlgorithms !== null && {
+                    algorithms: this.allowedAlgorithms,
+                }),
+                // Fail closed on a token with no `exp`/`iat` (jose only checks them
+                // when present). In discovery mode we require both; legacy mode keeps
+                // 4.x behavior. A missing exp would otherwise read as never-expiring.
+                ...(this.discoveryMetadata !== null && { requiredClaims: ['exp', 'iat'] }),
+                clockTolerance: this.clockToleranceSeconds,
+            });
+            if (options?.nonce !== undefined) {
+                if (payload.nonce !== options.nonce) {
+                    throw new errors_1.TokenVerificationError(`Token nonce mismatch (expected '${options.nonce}', got '${payload.nonce ?? '<missing>'}')`);
+                }
+            }
+            else if (payload.nonce !== undefined && payload.nonce !== null) {
+                // OIDC Core §3.1.3.7 step 11: a present nonce MUST be verified. We have
+                // no expected value, so refuse rather than silently accept — pass the
+                // nonce you bound at /authorize via options.nonce (or exchangeCode's
+                // expectedNonce). Only RPs that actually use a nonce hit this.
+                throw new errors_1.TokenVerificationError('Token carries a nonce but none was provided to verify against. ' +
+                    'Pass the expected nonce (options.nonce / exchangeCode expectedNonce).');
+            }
+            return payload;
+        }
+        catch (err) {
+            if (err instanceof errors_1.TokenVerificationError)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            // jose exposes machine-readable codes via `(err as any).code` for
+            // common JWT failures. Prefer that over string matching when present;
+            // fall back to substring sniffs for older versions / wrapped errors.
+            const code = err instanceof Error ? err.code : undefined;
+            // Map jose errors to our error types
+            if (code === 'ERR_JWT_EXPIRED' || message.includes('expired')) {
+                throw new errors_1.TokenVerificationError('Token expired');
+            }
+            if (code === 'ERR_JWT_CLAIM_VALIDATION_FAILED') {
+                // The `claim` property tells us which claim mismatched
+                const claim = err.claim;
+                if (claim === 'iss')
+                    throw new errors_1.TokenVerificationError(`Unexpected JWT issuer: ${message}`);
+                if (claim === 'aud')
+                    throw new errors_1.TokenVerificationError(`Unexpected JWT audience: ${message}`);
+                if (claim === 'nbf')
+                    throw new errors_1.TokenVerificationError('Token not yet valid');
+            }
+            if (message.includes('not yet valid') || message.includes('nbf')) {
+                throw new errors_1.TokenVerificationError('Token not yet valid');
+            }
+            if (message.includes('signature')) {
+                throw new errors_1.TokenVerificationError('Invalid signature');
+            }
+            if (message.includes('audience') || message.includes('"aud"')) {
+                throw new errors_1.TokenVerificationError(`Unexpected JWT audience: ${message}`);
+            }
+            if (message.includes('issuer') || message.includes('"iss"')) {
+                throw new errors_1.TokenVerificationError(`Unexpected JWT issuer: ${message}`);
+            }
+            throw new errors_1.TokenVerificationError(`Token verification failed: ${message}`);
+        }
+    }
+    /**
+     * Get or create the remote JWKS. jose handles caching + concurrent-fetch
+     * coalescing internally.
+     *
+     * No single-flight guard is needed here: this method is fully synchronous
+     * (no `await` between the null-check and the assignment), so within Node's
+     * single-threaded event loop the first caller assigns `this.jwks` before any
+     * other code runs. Two concurrent `verifyToken` calls therefore cannot create
+     * duplicate `RemoteJWKSet` instances.
+     */
+    getJwks() {
+        if (!this.jwks) {
+            const jwksUrl = new URL(this.jwksUrl);
+            // Only set the X-Config-Id header for the legacy `/keys` endpoint; the
+            // OIDC-discovered `/.well-known/jwks.json` is public and tenant-agnostic.
+            const isLegacyKeysEndpoint = this.discoveryMetadata === null;
+            this.jwks = (0, jose_1.createRemoteJWKSet)(jwksUrl, {
+                // Bound the JWKS fetch explicitly (jose's default is 5s; pin it to the
+                // configured request timeout so a stalled keys endpoint can't hang
+                // verification longer than intended).
+                timeoutDuration: this.timeout,
+                ...(isLegacyKeysEndpoint && {
+                    headers: { 'X-Config-Id': this.configId },
+                }),
+            });
+        }
+        return this.jwks;
+    }
+    /**
+     * Drop the cached JWKS so the next `verifyToken` re-fetches it. Useful after
+     * an operator-triggered signing-key rotation, or in tests.
+     *
+     * Canonical name, aligned with the Java (`refreshJwks`) and Python
+     * (`refresh_jwks`) SDKs.
+     */
+    refreshJwks() {
+        this.jwks = null;
+    }
+    /**
+     * @deprecated since 5.1.0 — renamed to {@link refreshJwks} for cross-SDK
+     *   consistency. Will be removed in 6.0.0. Behaviour is identical.
+     */
+    clearCache() {
+        // One-time deprecation nudge per instance (per-instance so tests and
+        // multi-tenant setups each get warned, while a single instance doesn't spam).
+        if (!this.clearCacheWarned) {
+            this.clearCacheWarned = true;
+            // eslint-disable-next-line no-console
+            console.warn('[@hawcx/oauth-client] clearCache() is deprecated; use refreshJwks(). ' +
+                'clearCache() will be removed in 6.0.0.');
+        }
+        this.refreshJwks();
+    }
+}
+exports.HawcxOAuth = HawcxOAuth;
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAEH,+BAAsE;AACtE,yDAAkF;AAClF,qCAAsF;AAEtF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,MAAM,kBAAkB,GAAG,KAAM,CAAC;AAClC,gFAAgF;AAChF,MAAM,4BAA4B,GAAG,IAAK,CAAC;AAC3C;;;;;;GAMG;AACH,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAqHH;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa,EAAE,GAAW;IAClD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO;IACpC,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC7G,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ;QAAE,OAAO;IAC/C,MAAM,IAAI,uBAAc,CACtB,GAAG,KAAK,yBAAyB,GAAG,yDAAyD,CAC9F,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,UAAU;IA4CrB,YAAY,MAAwB,EAAE,aAA6B;QArB3D,SAAI,GAAiD,IAAI,CAAC;QAme1D,qBAAgB,GAAG,KAAK,CAAC;QA7c/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,kBAAkB,CAAC;QACpD,IAAI,CAAC,qBAAqB;YACxB,MAAM,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;QAElE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAC/C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,QAAQ,CAAC;YAChD,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,iBAAiB,CAAC;YACzD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,aAAa,GAAG,GAAG,OAAO,eAAe,CAAC;YAC/C,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,OAAO,CAAC;YACjC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAA8B;QACpD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,MAAM,mCAAmC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,4BAA4B,CAAC;QAExE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CAAC,4BAA4B,YAAY,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,uBAAc,CACtB,gCAAgC,QAAQ,CAAC,MAAM,OAAO,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAc,CACtB,8BAA8B,YAAY,oBAAoB,EAC9D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAU,EAAE;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,+BAA+B,KAAK,GAAG,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,aAAa,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,gBAAgB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC/D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,6BAA6B;gBAChE,4EAA4E,CAC/E,CAAC;QACJ,CAAC;QACD,6DAA6D;QAC7D,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,iBAAiB,GAAsB,MAAM,CAAC,MAAM,CACxD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;QACF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,0CAA0C;gBAC7E,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;gBAC/D,GAAG,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,uBAAuB;gBAC/D,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,uBAAc,CACtB,yBAAyB,YAAY,qCAAqC,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAI,GAAG,CAAC,QAAQ,CAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,uBAAc,CACtB,8BAA8B,aAAa,8BAA8B;gBACvE,eAAe,MAAM,mDAAmD,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB;YAClC,GAAG,GAAG;YACN,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,OAAO;YACjB,qCAAqC,EAAE,SAAS;SACjD,CAAC;QAEF,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;SACpD,EACD,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,MAA6B;QAC/C,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,uCAAuC,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,uBAAc,CACtB,uFAAuF;gBACrF,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yDAAyD;gBACpF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,UAAU,CACnB;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;SAClD,EACD;YACE,QAAQ,EAAE,IAAI,CAAC,iBAAiB;YAChC,QAAQ,EAAE,IAAI,CAAC,gBAA0B;YACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAsC;YAC9D,MAAM;SACP,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,YAAoB,EACpB,WAAoB,EACpB,aAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACvD,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAiB,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,wCAAqB,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CACT,kBAAkB,EAClB,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,IAAI,CAAC,QAAQ;oBAC5B,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,QAAQ,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,IAAI,OAA2B,CAAC;YAChC,IAAI,OAA2B,CAAC;YAChC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;oBACrB,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;oBACjC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE;gBACtD,KAAK,EAAE,OAAO;gBACd,gBAAgB,EAAE,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CACnC,OAAO,EACP,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAA4B;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1E,qEAAqE;gBACrE,mEAAmE;gBACnE,iEAAiE;gBACjE,kEAAkE;gBAClE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI;oBACrC,UAAU,EAAE,IAAI,CAAC,iBAA6B;iBAC/C,CAAC;gBACF,oEAAoE;gBACpE,sEAAsE;gBACtE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1E,cAAc,EAAE,IAAI,CAAC,qBAAqB;aAC3C,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,MAAM,IAAI,+BAAsB,CAC9B,mCAAmC,OAAO,CAAC,KAAK,WAAW,OAAO,CAAC,KAAK,IAAI,WAAW,IAAI,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACjE,wEAAwE;gBACxE,sEAAsE;gBACtE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,IAAI,+BAAsB,CAC9B,iEAAiE;oBAC/D,uEAAuE,CAC1E,CAAC;YACJ,CAAC;YAED,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,+BAAsB;gBAAE,MAAM,GAAG,CAAC;YAErD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAEhF,qCAAqC;YACrC,IAAI,IAAI,KAAK,iBAAiB,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;gBAC/C,uDAAuD;gBACvD,MAAM,KAAK,GAAI,GAA0B,CAAC,KAAK,CAAC;gBAChD,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;gBAC3F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,KAAK,KAAK,KAAK;oBAAE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,+BAAsB,CAAC,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,+BAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,+BAAsB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,+BAAsB,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,IAAI,+BAAsB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtC,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,OAAO,EAAE;gBACtC,uEAAuE;gBACvE,mEAAmE;gBACnE,sCAAsC;gBACtC,eAAe,EAAE,IAAI,CAAC,OAAO;gBAC7B,GAAG,CAAC,oBAAoB,IAAI;oBAC1B,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;iBAC1C,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,qEAAqE;QACrE,8EAA8E;QAC9E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,uEAAuE;gBACrE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;CAGF;AA3fD,gCA2fC"}

package/dist/stepup/client.d.ts

@@ -0,0 +1,26 @@
+import { DelegationTransport } from '../delegation/transport';
+import { DelegationKeyMaterial } from '../delegation/factory';
+import { StepUpClientBaseOptions, StepUpConsumeOptions, StepUpConsumeResponse, StepUpStartOptions, StepUpStartTokenResponse } from './types';
+export interface StepUpClientSecretKeyOptions extends StepUpClientBaseOptions {
+    secretKey: string;
+    apiKey?: string;
+}
+export type StepUpClientKeyOptions = StepUpClientBaseOptions & DelegationKeyMaterial & {
+    apiKey?: string;
+};
+export declare class StepUpClient {
+    private transport;
+    private options;
+    private apiKey?;
+    constructor(options: {
+        transport: DelegationTransport;
+        clientOptions: StepUpClientBaseOptions;
+        apiKey?: string;
+    });
+    static fromSecretKey(options: StepUpClientSecretKeyOptions): StepUpClient;
+    static fromKeys(options: StepUpClientKeyOptions): StepUpClient;
+    private buildExtraHeaders;
+    startToken(options: StepUpStartOptions): Promise<StepUpStartTokenResponse>;
+    consumeReceipt(options: StepUpConsumeOptions): Promise<StepUpConsumeResponse>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/stepup/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAuD,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,qBAAqB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,MAAM,CAAC,CAAS;gBAEZ,OAAO,EAAE;QACnB,SAAS,EAAE,mBAAmB,CAAC;QAC/B,aAAa,EAAE,uBAAuB,CAAC;QACvC,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAMD,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,4BAA4B,GAAG,YAAY;IAMzE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,YAAY;IAM9D,OAAO,CAAC,iBAAiB;IAmBnB,UAAU,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuB1E,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAoBpF"}

package/dist/stepup/client.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StepUpClient = void 0;
+const factory_1 = require("../delegation/factory");
+const exceptions_1 = require("../delegation/exceptions");
+class StepUpClient {
+    constructor(options) {
+        this.transport = options.transport;
+        this.options = options.clientOptions;
+        this.apiKey = options.apiKey;
+    }
+    static fromSecretKey(options) {
+        const { apiKey } = options;
+        const transport = (0, factory_1.buildTransportFromSecretKey)(options);
+        return new StepUpClient({ transport, clientOptions: options, apiKey });
+    }
+    static fromKeys(options) {
+        const { apiKey } = options;
+        const transport = (0, factory_1.buildTransportFromKeys)(options);
+        return new StepUpClient({ transport, clientOptions: options, apiKey });
+    }
+    buildExtraHeaders() {
+        const headers = {
+            'X-Hawcx-Protocol-Version': '1',
+            ...(this.options.extraHeaders || {}),
+        };
+        if (this.apiKey) {
+            headers['apikey'] = this.apiKey;
+        }
+        if (this.options.relyingParty) {
+            headers['X-Relying-Party'] = this.options.relyingParty;
+        }
+        if (this.options.tenantHeaderName && this.options.tenantHeaderValue) {
+            headers[this.options.tenantHeaderName] = this.options.tenantHeaderValue;
+        }
+        return headers;
+    }
+    async startToken(options) {
+        try {
+            const apiPrefix = this.options.apiPrefix ?? '/v1';
+            return (await this.transport.send({
+                endpoint: `${apiPrefix}/management/stepup/start-token`,
+                payload: {
+                    subject_userid: options.userId,
+                    purpose: options.purpose,
+                    new_mfa_method: options.newMfaMethod,
+                },
+                headers: this.buildExtraHeaders(),
+            }));
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationRequestError('stepup.start-token failed', { cause: error });
+        }
+    }
+    async consumeReceipt(options) {
+        try {
+            const apiPrefix = this.options.apiPrefix ?? '/v1';
+            return (await this.transport.send({
+                endpoint: `${apiPrefix}/management/stepup/consume`,
+                payload: {
+                    step_up_receipt: options.receipt,
+                },
+                headers: this.buildExtraHeaders(),
+            }));
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.DelegationError) {
+                throw error;
+            }
+            throw new exceptions_1.DelegationRequestError('stepup.consume failed', { cause: error });
+        }
+    }
+}
+exports.StepUpClient = StepUpClient;
+//# sourceMappingURL=client.js.map

package/dist/stepup/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/stepup/client.ts"],"names":[],"mappings":";;;AACA,mDAAmH;AACnH,yDAAmF;AAgBnF,MAAa,YAAY;IAKvB,YAAY,OAIX;QACC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,OAAqC;QACxD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,qCAA2B,EAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAA+B;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,YAAY,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,iBAAiB;QACvB,MAAM,OAAO,GAA2B;YACtC,0BAA0B,EAAE,GAAG;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;SACrC,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzD,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAA2B;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,gCAAgC;gBACtD,OAAO,EAAE;oBACP,cAAc,EAAE,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,cAAc,EAAE,OAAO,CAAC,YAAY;iBACrC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA6B,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;YAClD,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAG/B;gBACA,QAAQ,EAAE,GAAG,SAAS,4BAA4B;gBAClD,OAAO,EAAE;oBACP,eAAe,EAAE,OAAO,CAAC,OAAO;iBACjC;gBACD,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAClC,CAAC,CAA0B,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAAe,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;CACF;AAzFD,oCAyFC"}

package/dist/stepup/index.d.ts

@@ -0,0 +1,3 @@
+export * from './client';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/stepup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/stepup/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,SAAS,CAAC"}