@hearth-auth/sdk 1.6.1 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +20 -9
- package/dist/admin.d.ts +7 -23
- package/dist/admin.js +24 -51
- package/dist/admin.js.map +1 -1
- package/dist/client.d.ts +23 -6
- package/dist/client.js +31 -8
- package/dist/client.js.map +1 -1
- package/dist/hearth-client.d.ts +10 -5
- package/dist/hearth-client.js +14 -5
- package/dist/hearth-client.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js.map +1 -1
- package/dist/jwks-client.d.ts +21 -3
- package/dist/jwks-client.js +27 -7
- package/dist/jwks-client.js.map +1 -1
- package/dist/middleware.d.ts +6 -3
- package/dist/middleware.js +9 -8
- package/dist/middleware.js.map +1 -1
- package/dist/types.d.ts +38 -5
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -286,8 +286,8 @@ await admin.deleteUser("<user-id>");
|
|
|
286
286
|
### Realms
|
|
287
287
|
|
|
288
288
|
```typescript
|
|
289
|
-
//
|
|
290
|
-
|
|
289
|
+
// Realms are provisioned via hearth.yaml, not the admin API — there is no
|
|
290
|
+
// createRealm() (the server returns 405). Only read paths are exposed.
|
|
291
291
|
|
|
292
292
|
// List realms (paginated)
|
|
293
293
|
const page = await admin.listRealms({ limit: 20 });
|
|
@@ -490,21 +490,32 @@ registering the OAuth client; the SDK validates you stay consistent.
|
|
|
490
490
|
|
|
491
491
|
### Embedded (default)
|
|
492
492
|
|
|
493
|
-
RBAC claims (`permissions`, `roles`, `groups`) are embedded in the JWT at issuance.
|
|
494
|
-
|
|
493
|
+
RBAC claims (`permissions`, `roles`, `groups`) are embedded in the JWT at issuance. The
|
|
494
|
+
checker verifies the token first — EdDSA signature against the realm's JWKS, plus `exp`,
|
|
495
|
+
`nbf`, `iss` and (when `clientId` is set) `aud` — and only then reads the claim. The JWKS
|
|
496
|
+
is cached, so after the first request there is no network traffic per check.
|
|
497
|
+
|
|
498
|
+
A token that does not verify returns `false`; the checker never trusts an unverified
|
|
499
|
+
payload.
|
|
495
500
|
|
|
496
501
|
```typescript
|
|
497
|
-
import { requirePermission } from "@hearth-auth/sdk";
|
|
502
|
+
import { HearthClient, requirePermission } from "@hearth-auth/sdk";
|
|
498
503
|
|
|
499
|
-
const
|
|
500
|
-
|
|
501
|
-
|
|
504
|
+
const client = new HearthClient({
|
|
505
|
+
issuerUrl: "https://auth.example.com",
|
|
506
|
+
clientId: "<your-client-id>", // enables `aud` pinning
|
|
502
507
|
});
|
|
503
508
|
|
|
504
|
-
|
|
509
|
+
const check = requirePermission("docs.write", { mode: "embedded", client });
|
|
510
|
+
|
|
511
|
+
// Verifies the token, then reads its permissions claim.
|
|
505
512
|
const allowed = await check(accessToken);
|
|
506
513
|
```
|
|
507
514
|
|
|
515
|
+
> **Security note.** Before v1.1 this checker called `decodeJwt` and trusted whatever the
|
|
516
|
+
> payload said, so an `alg: none` token carrying `permissions: ["admin.write"]` was
|
|
517
|
+
> accepted. If you pinned an older version, upgrade.
|
|
518
|
+
|
|
508
519
|
### Decision (per-request server check)
|
|
509
520
|
|
|
510
521
|
JWT carries only identity claims. The SDK calls `POST /oauth/authorize` on every check.
|
package/dist/admin.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type {
|
|
1
|
+
import type { CreateUserParams, PageResponse, Realm, UpdateUserParams, User } from "./types.js";
|
|
2
2
|
/**
|
|
3
3
|
* Admin API client for Hearth.
|
|
4
4
|
*
|
|
@@ -19,12 +19,10 @@ export declare class AdminClient {
|
|
|
19
19
|
}): Promise<PageResponse<User>>;
|
|
20
20
|
/** GET /admin/users/:id — get a user by ID. */
|
|
21
21
|
getUser(userId: string): Promise<User>;
|
|
22
|
-
/**
|
|
22
|
+
/** PATCH /admin/users/:id — update a user. */
|
|
23
23
|
updateUser(userId: string, params: UpdateUserParams): Promise<User>;
|
|
24
24
|
/** DELETE /admin/users/:id — delete a user. */
|
|
25
25
|
deleteUser(userId: string): Promise<void>;
|
|
26
|
-
/** POST /admin/realms — create a realm. */
|
|
27
|
-
createRealm(params: CreateRealmParams): Promise<Realm>;
|
|
28
26
|
/** GET /admin/realms — list realms with pagination. */
|
|
29
27
|
listRealms(options?: {
|
|
30
28
|
limit?: number;
|
|
@@ -32,19 +30,17 @@ export declare class AdminClient {
|
|
|
32
30
|
}): Promise<PageResponse<Realm>>;
|
|
33
31
|
/** GET /admin/realms/:id — get a realm by ID. */
|
|
34
32
|
getRealm(realmId: string): Promise<Realm>;
|
|
35
|
-
/** PUT /admin/realms/:id — update a realm. */
|
|
36
|
-
updateRealm(realmId: string, params: UpdateRealmParams): Promise<Realm>;
|
|
37
33
|
/** DELETE /admin/realms/:id — delete a realm. */
|
|
38
34
|
deleteRealm(realmId: string): Promise<void>;
|
|
39
|
-
/** POST /admin/
|
|
35
|
+
/** POST /admin/applications — register an OAuth 2.0 client. */
|
|
40
36
|
createClient(params: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
41
|
-
/** GET /admin/
|
|
37
|
+
/** GET /admin/applications/:id — get a client by ID. */
|
|
42
38
|
getClient(clientId: string): Promise<Record<string, unknown>>;
|
|
43
|
-
/** PATCH /admin/
|
|
39
|
+
/** PATCH /admin/applications/:id — update a client. */
|
|
44
40
|
updateClient(clientId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
45
|
-
/** DELETE /admin/
|
|
41
|
+
/** DELETE /admin/applications/:id — delete a client. */
|
|
46
42
|
deleteClient(clientId: string): Promise<void>;
|
|
47
|
-
/** GET /admin/
|
|
43
|
+
/** GET /admin/applications — list clients with optional pagination. */
|
|
48
44
|
listClients(options?: {
|
|
49
45
|
limit?: number;
|
|
50
46
|
cursor?: string;
|
|
@@ -84,18 +80,6 @@ export declare class AdminClient {
|
|
|
84
80
|
items: Record<string, unknown>[];
|
|
85
81
|
next_cursor: string | null;
|
|
86
82
|
}>;
|
|
87
|
-
/** POST /admin/orgs/:orgId/members — add a member to an organization. */
|
|
88
|
-
addOrgMember(orgId: string, params: Record<string, unknown>): Promise<Record<string, unknown>>;
|
|
89
|
-
/** GET /admin/orgs/:orgId/members — list members of an organization. */
|
|
90
|
-
listOrgMembers(orgId: string, options?: {
|
|
91
|
-
limit?: number;
|
|
92
|
-
cursor?: string;
|
|
93
|
-
}): Promise<{
|
|
94
|
-
items: Record<string, unknown>[];
|
|
95
|
-
next_cursor: string | null;
|
|
96
|
-
}>;
|
|
97
|
-
/** DELETE /admin/orgs/:orgId/members/:userId — remove a member from an organization. */
|
|
98
|
-
removeOrgMember(orgId: string, userId: string): Promise<void>;
|
|
99
83
|
private headers;
|
|
100
84
|
private get;
|
|
101
85
|
private post;
|
package/dist/admin.js
CHANGED
|
@@ -35,7 +35,7 @@ export class AdminClient {
|
|
|
35
35
|
async getUser(userId) {
|
|
36
36
|
return this.get(`/admin/users/${userId}`);
|
|
37
37
|
}
|
|
38
|
-
/**
|
|
38
|
+
/** PATCH /admin/users/:id — update a user. */
|
|
39
39
|
async updateUser(userId, params) {
|
|
40
40
|
return this.request("PATCH", `/admin/users/${userId}`, {
|
|
41
41
|
email: params.email,
|
|
@@ -54,13 +54,12 @@ export class AdminClient {
|
|
|
54
54
|
}
|
|
55
55
|
}
|
|
56
56
|
// === Realms ===
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
}
|
|
57
|
+
//
|
|
58
|
+
// Realms are provisioned via hearth.yaml, not the admin API. There is no
|
|
59
|
+
// `createRealm`/`updateRealm` client method: the server answers 405 with
|
|
60
|
+
// "Realms are managed via hearth.yaml" to both POST /admin/realms and
|
|
61
|
+
// PATCH /admin/realms/{id} (HEA-2171, audit 2026-08-28 §25.4). Only read
|
|
62
|
+
// paths and deletion are exposed.
|
|
64
63
|
/** GET /admin/realms — list realms with pagination. */
|
|
65
64
|
async listRealms(options) {
|
|
66
65
|
const q = new URLSearchParams();
|
|
@@ -74,14 +73,6 @@ export class AdminClient {
|
|
|
74
73
|
async getRealm(realmId) {
|
|
75
74
|
return this.get(`/admin/realms/${realmId}`);
|
|
76
75
|
}
|
|
77
|
-
/** PUT /admin/realms/:id — update a realm. */
|
|
78
|
-
async updateRealm(realmId, params) {
|
|
79
|
-
return this.request("PATCH", `/admin/realms/${realmId}`, {
|
|
80
|
-
name: params.name,
|
|
81
|
-
status: params.status,
|
|
82
|
-
config: params.config,
|
|
83
|
-
});
|
|
84
|
-
}
|
|
85
76
|
/** DELETE /admin/realms/:id — delete a realm. */
|
|
86
77
|
async deleteRealm(realmId) {
|
|
87
78
|
const resp = await fetch(`${this.baseUrl}/admin/realms/${realmId}`, {
|
|
@@ -93,21 +84,21 @@ export class AdminClient {
|
|
|
93
84
|
}
|
|
94
85
|
}
|
|
95
86
|
// === OAuth Clients ===
|
|
96
|
-
/** POST /admin/
|
|
87
|
+
/** POST /admin/applications — register an OAuth 2.0 client. */
|
|
97
88
|
async createClient(params) {
|
|
98
|
-
return this.post("/admin/
|
|
89
|
+
return this.post("/admin/applications", params);
|
|
99
90
|
}
|
|
100
|
-
/** GET /admin/
|
|
91
|
+
/** GET /admin/applications/:id — get a client by ID. */
|
|
101
92
|
async getClient(clientId) {
|
|
102
|
-
return this.get(`/admin/
|
|
93
|
+
return this.get(`/admin/applications/${clientId}`);
|
|
103
94
|
}
|
|
104
|
-
/** PATCH /admin/
|
|
95
|
+
/** PATCH /admin/applications/:id — update a client. */
|
|
105
96
|
async updateClient(clientId, params) {
|
|
106
|
-
return this.request("PATCH", `/admin/
|
|
97
|
+
return this.request("PATCH", `/admin/applications/${clientId}`, params);
|
|
107
98
|
}
|
|
108
|
-
/** DELETE /admin/
|
|
99
|
+
/** DELETE /admin/applications/:id — delete a client. */
|
|
109
100
|
async deleteClient(clientId) {
|
|
110
|
-
const resp = await fetch(`${this.baseUrl}/admin/
|
|
101
|
+
const resp = await fetch(`${this.baseUrl}/admin/applications/${clientId}`, {
|
|
111
102
|
method: "DELETE",
|
|
112
103
|
headers: this.headers(),
|
|
113
104
|
});
|
|
@@ -115,7 +106,7 @@ export class AdminClient {
|
|
|
115
106
|
throw new HearthError(resp.status, await resp.json());
|
|
116
107
|
}
|
|
117
108
|
}
|
|
118
|
-
/** GET /admin/
|
|
109
|
+
/** GET /admin/applications — list clients with optional pagination. */
|
|
119
110
|
async listClients(options) {
|
|
120
111
|
const q = new URLSearchParams();
|
|
121
112
|
if (options?.limit)
|
|
@@ -123,7 +114,7 @@ export class AdminClient {
|
|
|
123
114
|
if (options?.cursor)
|
|
124
115
|
q.set("cursor", options.cursor);
|
|
125
116
|
const qs = q.toString();
|
|
126
|
-
return this.get(`/admin/
|
|
117
|
+
return this.get(`/admin/applications${qs ? `?${qs}` : ""}`);
|
|
127
118
|
}
|
|
128
119
|
// === Roles ===
|
|
129
120
|
/** POST /admin/roles — create a role. */
|
|
@@ -191,31 +182,13 @@ export class AdminClient {
|
|
|
191
182
|
const qs = q.toString();
|
|
192
183
|
return this.get(`/admin/groups${qs ? `?${qs}` : ""}`);
|
|
193
184
|
}
|
|
194
|
-
// === Org Members ===
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
const q = new URLSearchParams();
|
|
202
|
-
if (options?.limit)
|
|
203
|
-
q.set("limit", String(options.limit));
|
|
204
|
-
if (options?.cursor)
|
|
205
|
-
q.set("cursor", options.cursor);
|
|
206
|
-
const qs = q.toString();
|
|
207
|
-
return this.get(`/admin/orgs/${orgId}/members${qs ? `?${qs}` : ""}`);
|
|
208
|
-
}
|
|
209
|
-
/** DELETE /admin/orgs/:orgId/members/:userId — remove a member from an organization. */
|
|
210
|
-
async removeOrgMember(orgId, userId) {
|
|
211
|
-
const resp = await fetch(`${this.baseUrl}/admin/orgs/${orgId}/members/${userId}`, {
|
|
212
|
-
method: "DELETE",
|
|
213
|
-
headers: this.headers(),
|
|
214
|
-
});
|
|
215
|
-
if (!resp.ok) {
|
|
216
|
-
throw new HearthError(resp.status, await resp.json());
|
|
217
|
-
}
|
|
218
|
-
}
|
|
185
|
+
// === Org Members — removed ===
|
|
186
|
+
//
|
|
187
|
+
// Hearth serves no organization route over HTTP: there is no /admin/orgs, no
|
|
188
|
+
// /admin/orgs/:orgId/members and no per-member route anywhere in the router,
|
|
189
|
+
// so addOrgMember, listOrgMembers and removeOrgMember every one 404'd
|
|
190
|
+
// (audit 2026-08-28 §25.19). Organization membership is administered through
|
|
191
|
+
// the admin console, not the admin API.
|
|
219
192
|
headers() {
|
|
220
193
|
return {
|
|
221
194
|
"X-Realm-ID": this.realmId,
|
package/dist/admin.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,OAAe,EACf,OAAe,EACf,WAAmB;QAFnB,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,gBAAW,GAAX,WAAW,CAAQ;IACnC,CAAC;IAEJ,gBAAgB;IAEhB,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS,CAAC,OAGf;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAwB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE;YACrD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,MAAM,EAAE,EAAE;YAChE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,kCAAkC;IAElC,uDAAuD;IACvD,KAAK,CAAC,UAAU,CAAC,OAGhB;QACC,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,EAAE,EAAE;YAClE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,wBAAwB;IAExB,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAAC,MAA+B;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAA+B;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,QAAQ,EAAE,EAAE;YACzE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,WAAW,CAAC,OAA6C;QAC7D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,gBAAgB;IAEhB,yCAAyC;IACzC,KAAK,CAAC,UAAU,CAAC,MAA+B;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAA+B;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,gBAAgB,MAAM,EAAE,EAAE;YAChE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,SAAS,CAAC,OAA6C;QAC3D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,iBAAiB;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,WAAW,CAAC,MAA+B;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAA+B;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,iBAAiB,OAAO,EAAE,EAAE;YAClE,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,UAAU,CAAC,OAA6C;QAC5D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,gCAAgC;IAChC,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,6EAA6E;IAC7E,wCAAwC;IAEhC,OAAO;QACb,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO;YAC1B,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa;QAEb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}
|
package/dist/client.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { AuthorizeParams, AuthorizeResponse, BootstrapResponse, JwksDocument, MePermissionsResponse, RegisterClientParams, OAuthClient, TokenExchangeParams, TokenResponse, UserInfoResponse, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest } from "./types.js";
|
|
1
|
+
import type { AuthorizeParams, AuthorizeResponse, BootstrapResponse, JwksDocument, MePermissionsResponse, RegisterClientParams, OAuthClient, StepUpProof, TokenExchangeParams, TokenResponse, UserInfoResponse, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest } from "./types.js";
|
|
2
2
|
/** Parameters for the PKCE authorization-code callback handler (spec §7). */
|
|
3
3
|
export interface HandleCallbackParams {
|
|
4
4
|
/** Full callback URL including query parameters (`code`, `state`, etc.). */
|
|
@@ -34,10 +34,23 @@ export declare class HearthApiClient {
|
|
|
34
34
|
constructor(config: HearthApiClientConfig);
|
|
35
35
|
/** POST /admin/bootstrap — create realm, admin user, tokens (dev mode only). */
|
|
36
36
|
static bootstrap(baseUrl: string): Promise<BootstrapResponse>;
|
|
37
|
-
/**
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
37
|
+
/**
|
|
38
|
+
* POST /clients — register an OAuth 2.0 client.
|
|
39
|
+
*
|
|
40
|
+
* `accessToken` is required by the server: client registration is an admin
|
|
41
|
+
* operation and answers `401 missing authorization header` without one. It is
|
|
42
|
+
* optional here only so that adding it does not break existing callers.
|
|
43
|
+
*/
|
|
44
|
+
registerClient(params: RegisterClientParams, accessToken?: string): Promise<OAuthClient>;
|
|
45
|
+
/**
|
|
46
|
+
* POST /authorize — initiate an authorization code flow.
|
|
47
|
+
*
|
|
48
|
+
* `accessToken` is required whenever `userId` selects the subject directly
|
|
49
|
+
* instead of the caller having a session: that is an administrative act and
|
|
50
|
+
* the server answers `401 invalid_token` without one. Optional here so that
|
|
51
|
+
* adding it does not break existing callers.
|
|
52
|
+
*/
|
|
53
|
+
authorize(params: AuthorizeParams, accessToken?: string): Promise<AuthorizeResponse>;
|
|
41
54
|
/** POST /token — exchange an authorization code for tokens. */
|
|
42
55
|
exchangeCode(params: TokenExchangeParams): Promise<TokenResponse>;
|
|
43
56
|
/**
|
|
@@ -77,8 +90,12 @@ export declare class HearthApiClient {
|
|
|
77
90
|
* Returns `PublicKeyCredentialCreationOptions` for
|
|
78
91
|
* `navigator.credentials.create()`. `accessToken` is the authenticated
|
|
79
92
|
* user's bearer token so the server knows who is registering the credential.
|
|
93
|
+
*
|
|
94
|
+
* `stepUp` proves possession of a credential the account already holds — the
|
|
95
|
+
* password, a current authenticator code, or an assertion from an enrolled
|
|
96
|
+
* passkey. The server answers `403 step_up_required` without it.
|
|
80
97
|
*/
|
|
81
|
-
startWebAuthnRegistration(accessToken: string): Promise<WebAuthnRegistrationBeginResponse>;
|
|
98
|
+
startWebAuthnRegistration(accessToken: string, stepUp: StepUpProof): Promise<WebAuthnRegistrationBeginResponse>;
|
|
82
99
|
/**
|
|
83
100
|
* Complete a WebAuthn passkey registration ceremony. Send the attestation
|
|
84
101
|
* produced by `navigator.credentials.create()`. `accessToken` must be the
|
package/dist/client.js
CHANGED
|
@@ -34,15 +34,34 @@ export class HearthApiClient {
|
|
|
34
34
|
}
|
|
35
35
|
return resp.json();
|
|
36
36
|
}
|
|
37
|
-
/**
|
|
38
|
-
|
|
37
|
+
/**
|
|
38
|
+
* POST /clients — register an OAuth 2.0 client.
|
|
39
|
+
*
|
|
40
|
+
* `accessToken` is required by the server: client registration is an admin
|
|
41
|
+
* operation and answers `401 missing authorization header` without one. It is
|
|
42
|
+
* optional here only so that adding it does not break existing callers.
|
|
43
|
+
*/
|
|
44
|
+
async registerClient(params, accessToken) {
|
|
39
45
|
return this.post("/clients", {
|
|
40
46
|
client_name: params.clientName,
|
|
41
47
|
redirect_uris: params.redirectUris,
|
|
42
|
-
|
|
48
|
+
// The server reads trust_level as the proto enum name.
|
|
49
|
+
...(params.trustLevel && {
|
|
50
|
+
trust_level: params.trustLevel === "first_party"
|
|
51
|
+
? "CLIENT_TRUST_LEVEL_FIRST_PARTY"
|
|
52
|
+
: "CLIENT_TRUST_LEVEL_THIRD_PARTY",
|
|
53
|
+
}),
|
|
54
|
+
}, accessToken);
|
|
43
55
|
}
|
|
44
|
-
/**
|
|
45
|
-
|
|
56
|
+
/**
|
|
57
|
+
* POST /authorize — initiate an authorization code flow.
|
|
58
|
+
*
|
|
59
|
+
* `accessToken` is required whenever `userId` selects the subject directly
|
|
60
|
+
* instead of the caller having a session: that is an administrative act and
|
|
61
|
+
* the server answers `401 invalid_token` without one. Optional here so that
|
|
62
|
+
* adding it does not break existing callers.
|
|
63
|
+
*/
|
|
64
|
+
async authorize(params, accessToken) {
|
|
46
65
|
return this.post("/authorize", {
|
|
47
66
|
client_id: params.clientId,
|
|
48
67
|
redirect_uri: params.redirectUri,
|
|
@@ -53,7 +72,7 @@ export class HearthApiClient {
|
|
|
53
72
|
code_challenge: params.codeChallenge,
|
|
54
73
|
code_challenge_method: params.codeChallengeMethod,
|
|
55
74
|
nonce: params.nonce,
|
|
56
|
-
});
|
|
75
|
+
}, accessToken);
|
|
57
76
|
}
|
|
58
77
|
/** POST /token — exchange an authorization code for tokens. */
|
|
59
78
|
async exchangeCode(params) {
|
|
@@ -179,9 +198,13 @@ export class HearthApiClient {
|
|
|
179
198
|
* Returns `PublicKeyCredentialCreationOptions` for
|
|
180
199
|
* `navigator.credentials.create()`. `accessToken` is the authenticated
|
|
181
200
|
* user's bearer token so the server knows who is registering the credential.
|
|
201
|
+
*
|
|
202
|
+
* `stepUp` proves possession of a credential the account already holds — the
|
|
203
|
+
* password, a current authenticator code, or an assertion from an enrolled
|
|
204
|
+
* passkey. The server answers `403 step_up_required` without it.
|
|
182
205
|
*/
|
|
183
|
-
async startWebAuthnRegistration(accessToken) {
|
|
184
|
-
return this.post("/webauthn/register/begin",
|
|
206
|
+
async startWebAuthnRegistration(accessToken, stepUp) {
|
|
207
|
+
return this.post("/webauthn/register/begin", stepUp, accessToken);
|
|
185
208
|
}
|
|
186
209
|
/**
|
|
187
210
|
* Complete a WebAuthn passkey registration ceremony. Send the attestation
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAgClD,yDAAyD;AACzD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAElB;IACA;IAFlB,YACkB,MAAc,EACd,IAAa;QAE7B,KAAK,CAAC,oBAAoB,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAH7C,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAQD;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,CAAS;IAChB,OAAO,CAAS;IAEjC,YAAY,MAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,gFAAgF;IAChF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAe;QACpC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,MAA4B,EAC5B,WAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CACd,UAAU,EACV;YACE,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,uDAAuD;YACvD,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI;gBACvB,WAAW,EACT,MAAM,CAAC,UAAU,KAAK,aAAa;oBACjC,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,gCAAgC;aACvC,CAAC;SACH,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,MAAuB,EACvB,WAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CACd,YAAY,EACZ;YACE,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,aAAa,EAAE,MAAM,CAAC,YAAY,IAAI,MAAM;YAC5C,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM,CAAC,mBAAmB;YACjD,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,YAAY,CAAC,MAA2B;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,cAAc,CAAC,MAA4B;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,yBAAyB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CACpD,8BAA8B,CAC/B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,0DAA0D;QAC1D,IAAI,UAAU,GAA4B,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAA4B,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;QAED,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACnE,CAAC,CAAE,UAAU,CAAC,kBAAkB,CAAc;YAC9C,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,yBAAyB,IAAI,SAAS,CACvC,CAAC;QACJ,CAAC;QAED,IAAI,yBAAyB,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,mBAAmB,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,YAAoB;QAEpB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE;YAC5D,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAoC,CAAC;IACvD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,WAAW,EAAE;YACnD,OAAO,EAAE;gBACP,YAAY,EAAE,IAAI,CAAC,OAAO;gBAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAA+B,CAAC;IAClD,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAA2B,CAAC;IAC9C,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,KAAK,CACtB,GAAG,IAAI,CAAC,OAAO,mCAAmC,CACnD,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAsC,CAAC;IACzD,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,wDAAwD;IAExD;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAC7B,WAAmB,EACnB,MAAmB;QAEnB,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,0BAA0B,CAC9B,WAAmB,EACnB,OAA4C;QAE5C,OAAO,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,2BAA2B,CAC/B,MAAe;QAEf,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,4BAA4B,CAChC,OAA8C;QAE9C,OAAO,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,IAAa,EACb,WAAoB;QAEpB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,YAAY,EAAE,IAAI,CAAC,OAAO;SAC3B,CAAC;QACF,IAAI,WAAW;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,WAAW,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF;AAED,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/hearth-client.d.ts
CHANGED
|
@@ -133,12 +133,17 @@ export declare class HearthClient {
|
|
|
133
133
|
/**
|
|
134
134
|
* Verify a JWT using JWKS-backed EdDSA/Ed25519 local signature verification (spec §2).
|
|
135
135
|
*
|
|
136
|
-
* Performs all
|
|
137
|
-
* 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519
|
|
136
|
+
* Performs all mandatory validation steps in order:
|
|
137
|
+
* 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519 only). This
|
|
138
|
+
* verifies access tokens, which Hearth signs with EdDSA alone. A realm
|
|
139
|
+
* JWKS may also publish an RS256 key, but only for ID tokens of clients
|
|
140
|
+
* that registered `id_token_signed_response_alg: RS256`; RS256 (and ES256)
|
|
141
|
+
* tokens are refused here even when their key is published.
|
|
138
142
|
* 2. `exp` claim (rejects expired tokens).
|
|
139
|
-
* 3. `
|
|
140
|
-
* 4. `
|
|
141
|
-
* 5. `
|
|
143
|
+
* 3. `nbf` claim (rejects post-dated tokens).
|
|
144
|
+
* 4. `iss` claim (must match configured `issuerUrl`).
|
|
145
|
+
* 5. `aud` claim (validated when `clientId` is set in config).
|
|
146
|
+
* 6. `iat` claim (within 60-second clock skew tolerance).
|
|
142
147
|
*
|
|
143
148
|
* @throws {@link TokenExpiredError} — token is expired.
|
|
144
149
|
* @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
|
package/dist/hearth-client.js
CHANGED
|
@@ -94,6 +94,10 @@ export class HearthClient {
|
|
|
94
94
|
const doc = await this.discover();
|
|
95
95
|
this._jwksClient = new JwksClient({
|
|
96
96
|
jwksUri: doc.jwks_uri,
|
|
97
|
+
// Pin iss/aud on the client itself, so a caller who reaches for the
|
|
98
|
+
// exported JwksClient still gets them checked.
|
|
99
|
+
issuer: this.issuerUrl,
|
|
100
|
+
audience: this.clientId,
|
|
97
101
|
ttl: this.jwksTtl,
|
|
98
102
|
httpTimeout: this.httpTimeout,
|
|
99
103
|
});
|
|
@@ -192,12 +196,17 @@ export class HearthClient {
|
|
|
192
196
|
/**
|
|
193
197
|
* Verify a JWT using JWKS-backed EdDSA/Ed25519 local signature verification (spec §2).
|
|
194
198
|
*
|
|
195
|
-
* Performs all
|
|
196
|
-
* 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519
|
|
199
|
+
* Performs all mandatory validation steps in order:
|
|
200
|
+
* 1. Signature against the JWKS endpoint (EdDSA/OKP/Ed25519 only). This
|
|
201
|
+
* verifies access tokens, which Hearth signs with EdDSA alone. A realm
|
|
202
|
+
* JWKS may also publish an RS256 key, but only for ID tokens of clients
|
|
203
|
+
* that registered `id_token_signed_response_alg: RS256`; RS256 (and ES256)
|
|
204
|
+
* tokens are refused here even when their key is published.
|
|
197
205
|
* 2. `exp` claim (rejects expired tokens).
|
|
198
|
-
* 3. `
|
|
199
|
-
* 4. `
|
|
200
|
-
* 5. `
|
|
206
|
+
* 3. `nbf` claim (rejects post-dated tokens).
|
|
207
|
+
* 4. `iss` claim (must match configured `issuerUrl`).
|
|
208
|
+
* 5. `aud` claim (validated when `clientId` is set in config).
|
|
209
|
+
* 6. `iat` claim (within 60-second clock skew tolerance).
|
|
201
210
|
*
|
|
202
211
|
* @throws {@link TokenExpiredError} — token is expired.
|
|
203
212
|
* @throws {@link TokenInvalidError} — signature invalid or JWT malformed.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AAkEnC;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,cAAc,MAAM,CAAC,SAAS,sBAAsB,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,wCAAwC,GAAG,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B;YAClC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,IAAI,CAAC,YAAY,EACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E
|
|
1
|
+
{"version":3,"file":"hearth-client.js","sourceRoot":"","sources":["../src/hearth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,mBAAmB,GAEpB,MAAM,2BAA2B,CAAC;AAkEnC;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IACvB,0CAA0C;IACjC,SAAS,CAAS;IAClB,QAAQ,CAAqB;IAC7B,YAAY,CAAqB;IACjC,OAAO,CAAqB;IAC5B,6BAA6B,CAAqB;IAC3D,wEAAwE;IAC/D,WAAW,CAAS;IAC7B,qEAAqE;IAC5D,OAAO,CAAqB;IACrC,6EAA6E;IACpE,YAAY,CAA2C;IAExD,UAAU,GAA6B,IAAI,CAAC;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAkB,CAC1B,cAAc,MAAM,CAAC,SAAS,sBAAsB,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,6BAA6B,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACjE,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,wCAAwC,GAAG,EAAE,EAC7C,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,IAAI,GAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE;gBAC/D,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,6DAA6D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;YAChC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,oEAAoE;YACpE,+CAA+C;YAC/C,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,IAAI,CAAC,oBAAoB;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEhE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAC1B,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,6BAA6B;YAClC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,CAAC;QAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,CAC1B,uEAAuE;gBACrE,8DAA8D,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,mBAAmB,CAAC;YAClD,qBAAqB,EAAE,QAAQ;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,KAAa,EACb,UAAkB,EAClB,IAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,CAAC;QACpD,IAAI,IAAI,EAAE,cAAc;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACxE,IAAI,IAAI,EAAE,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,kBAAkB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,IAAI,CAAC,OAAO;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC3B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0B,CAAC;YAC1D,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wCAAwC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EACjC,CAAC;YACD,MAAM,IAAI,8BAA8B,CACtC,IAAI,CAAC,YAAY,EACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAE5E;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAc;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC9B,aAAa,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACvC,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,cAAc,GAAI,GAA+B,CAAC,+BAA+B,CAAuB,CAAC;QAC/G,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAA8B,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,eAAuB;QAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAC;QAE/C,yFAAyF;QACzF,iDAAiD;QACjD,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAErE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,UAAU;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;aAC/B,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,IAAI,EAA4B,CAAC;YAC/C,CAAC;YAED,IAAI,SAAS,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,SAAS,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAEvC,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;gBACrC,iBAAiB,IAAI,IAAI,CAAC;gBAC1B,SAAS;YACX,CAAC;iBAAM,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBACzC,MAAM,IAAI,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAAC,0CAA0C,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,kBAAkB,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAI,GAA+B,CAAC,gBAAgB,CAAuB,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,kCAAkC;YAC9C,KAAK;SACN,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAgB,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,QAAQ,CAAI,QAAgB,EAAE,MAA8B;QACxE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,SAAS,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAgB,CAAC;IACnC,CAAC;CACF"}
|
package/dist/index.d.ts
CHANGED
|
@@ -17,7 +17,7 @@ export { createHearth } from "./hearth.js";
|
|
|
17
17
|
export type { HearthFacade, HearthHttpClient, HearthOptions, } from "./hearth.js";
|
|
18
18
|
export { HearthContext, HearthProvider, useHasPermission, useHasRole, useInGroup, useInOrg, } from "./react.js";
|
|
19
19
|
export type { HearthProviderProps } from "./react.js";
|
|
20
|
-
export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse,
|
|
20
|
+
export type { AccessTokenAuthorizationMode, AuthorizeParams, AuthorizePermissionOptions, AuthorizeResponse, BootstrapResponse, CreateUserParams, JwksDocument, JsonWebKey, MePermissionsResponse, OAuthClient, PageResponse, RegisterClientParams, Realm, SessionVersionConfig, StepUpAssertion, StepUpProof, TokenExchangeParams, DeviceAuthorizationResponse, TokenResponse, UpdateRealmParams, UpdateUserParams, User, UserInfoResponse, WebAuthnAllowCredential, WebAuthnRegistrationBeginResponse, WebAuthnRegistrationCompleteRequest, WebAuthnRegistrationCompleteResponse, WebAuthnAuthenticationBeginResponse, WebAuthnAuthenticationCompleteRequest, } from "./types.js";
|
|
21
21
|
export { SessionVersionCache } from "./session-version-cache.js";
|
|
22
22
|
export { getAccessToken, getRefreshToken, getIdToken, isAuthenticated, clearTokens, createHearthAuth, } from "./browser-auth.js";
|
|
23
23
|
export type { AuthConfig, HearthBrowserAuth } from "./browser-auth.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,qCAAqC;AACrC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,UAAU,GACX,MAAM,WAAW,CAAC;AASnB,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMhE,yBAAyB;AACzB,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,EAC1B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,mCAAmC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,6DAA6D;AAC7D,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAiCpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,0DAA0D;AAC1D,OAAO,EACL,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}
|
package/dist/jwks-client.d.ts
CHANGED
|
@@ -13,6 +13,20 @@ export interface VerifyOptions {
|
|
|
13
13
|
export interface JwksClientConfig {
|
|
14
14
|
/** URL of the JWKS endpoint (e.g. from OIDC discovery `jwks_uri`). */
|
|
15
15
|
jwksUri: string;
|
|
16
|
+
/**
|
|
17
|
+
* Expected `iss` claim, pinned for every {@link JwksClient.verify} call that
|
|
18
|
+
* does not override it.
|
|
19
|
+
*
|
|
20
|
+
* Required in practice: `verify` throws {@link ConfigurationError} when
|
|
21
|
+
* neither this nor `options.issuer` is set, because a signature-only check
|
|
22
|
+
* would accept a token any realm sharing this JWKS had issued.
|
|
23
|
+
*/
|
|
24
|
+
issuer?: string;
|
|
25
|
+
/**
|
|
26
|
+
* Expected `aud` claim(s), pinned for every {@link JwksClient.verify} call
|
|
27
|
+
* that does not override it. When neither is set the audience is not checked.
|
|
28
|
+
*/
|
|
29
|
+
audience?: string | string[];
|
|
16
30
|
/**
|
|
17
31
|
* Override cache TTL in milliseconds.
|
|
18
32
|
* When absent, the client respects `Cache-Control: max-age` from the JWKS
|
|
@@ -32,6 +46,8 @@ export interface JwksClientConfig {
|
|
|
32
46
|
*/
|
|
33
47
|
export declare class JwksClient {
|
|
34
48
|
private readonly jwksUri;
|
|
49
|
+
readonly issuer: string | undefined;
|
|
50
|
+
readonly audience: string | string[] | undefined;
|
|
35
51
|
readonly ttl: number | undefined;
|
|
36
52
|
readonly httpTimeout: number;
|
|
37
53
|
/** Cached local key set and when it was fetched. */
|
|
@@ -42,10 +58,11 @@ export declare class JwksClient {
|
|
|
42
58
|
* Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
|
|
43
59
|
*
|
|
44
60
|
* Executes all five spec §2 validation steps in order:
|
|
45
|
-
* 1. Signature against cached JWKS
|
|
61
|
+
* 1. Signature against cached JWKS — EdDSA only; RS256 and ES256 are refused.
|
|
46
62
|
* 2. `exp` — rejects expired tokens.
|
|
47
|
-
* 3. `iss` —
|
|
48
|
-
*
|
|
63
|
+
* 3. `iss` — always, against `options.issuer` or the client's configured
|
|
64
|
+
* `issuer`. Throws {@link ConfigurationError} when neither is set.
|
|
65
|
+
* 4. `aud` — when `options.audience` or the client's configured `audience` is set.
|
|
49
66
|
* 5. `iat` — within clock skew tolerance.
|
|
50
67
|
*
|
|
51
68
|
* @throws {@link TokenExpiredError} when the token is expired.
|
|
@@ -53,6 +70,7 @@ export declare class JwksClient {
|
|
|
53
70
|
* @throws {@link TokenIssuerError} when the issuer does not match.
|
|
54
71
|
* @throws {@link TokenAudienceError} when the audience does not match.
|
|
55
72
|
* @throws {@link JWKSFetchError} when the JWKS endpoint cannot be reached.
|
|
73
|
+
* @throws {@link ConfigurationError} when no expected issuer is configured.
|
|
56
74
|
*/
|
|
57
75
|
verify(token: string, options?: VerifyOptions): Promise<Claims>;
|
|
58
76
|
private mapJoseError;
|
package/dist/jwks-client.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { createLocalJWKSet, jwtVerify, errors as joseErrors, } from "jose";
|
|
2
2
|
import { Claims } from "./claims.js";
|
|
3
|
-
import { JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenAudienceError, } from "./errors.js";
|
|
3
|
+
import { ConfigurationError, JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError, TokenAudienceError, } from "./errors.js";
|
|
4
4
|
/**
|
|
5
5
|
* JWKS-backed JWT verifier with key caching, automatic key rotation,
|
|
6
6
|
* and full EdDSA / Ed25519 signature verification (spec §2).
|
|
@@ -11,12 +11,16 @@ import { JWKSFetchError, TokenExpiredError, TokenInvalidError, TokenIssuerError,
|
|
|
11
11
|
*/
|
|
12
12
|
export class JwksClient {
|
|
13
13
|
jwksUri;
|
|
14
|
+
issuer;
|
|
15
|
+
audience;
|
|
14
16
|
ttl;
|
|
15
17
|
httpTimeout;
|
|
16
18
|
/** Cached local key set and when it was fetched. */
|
|
17
19
|
_cache = null;
|
|
18
20
|
constructor(config) {
|
|
19
21
|
this.jwksUri = config.jwksUri;
|
|
22
|
+
this.issuer = config.issuer;
|
|
23
|
+
this.audience = config.audience;
|
|
20
24
|
this.ttl = config.ttl;
|
|
21
25
|
this.httpTimeout = config.httpTimeout ?? 10_000;
|
|
22
26
|
}
|
|
@@ -35,10 +39,11 @@ export class JwksClient {
|
|
|
35
39
|
* Verify a JWT using Ed25519/EdDSA JWKS-based local signature verification (spec §2).
|
|
36
40
|
*
|
|
37
41
|
* Executes all five spec §2 validation steps in order:
|
|
38
|
-
* 1. Signature against cached JWKS
|
|
42
|
+
* 1. Signature against cached JWKS — EdDSA only; RS256 and ES256 are refused.
|
|
39
43
|
* 2. `exp` — rejects expired tokens.
|
|
40
|
-
* 3. `iss` —
|
|
41
|
-
*
|
|
44
|
+
* 3. `iss` — always, against `options.issuer` or the client's configured
|
|
45
|
+
* `issuer`. Throws {@link ConfigurationError} when neither is set.
|
|
46
|
+
* 4. `aud` — when `options.audience` or the client's configured `audience` is set.
|
|
42
47
|
* 5. `iat` — within clock skew tolerance.
|
|
43
48
|
*
|
|
44
49
|
* @throws {@link TokenExpiredError} when the token is expired.
|
|
@@ -46,15 +51,30 @@ export class JwksClient {
|
|
|
46
51
|
* @throws {@link TokenIssuerError} when the issuer does not match.
|
|
47
52
|
* @throws {@link TokenAudienceError} when the audience does not match.
|
|
48
53
|
* @throws {@link JWKSFetchError} when the JWKS endpoint cannot be reached.
|
|
54
|
+
* @throws {@link ConfigurationError} when no expected issuer is configured.
|
|
49
55
|
*/
|
|
50
56
|
async verify(token, options) {
|
|
51
57
|
const clockTolerance = options?.clockSkewSeconds ?? 60;
|
|
58
|
+
// Pin the issuer: fall back to the one this client was constructed with,
|
|
59
|
+
// and refuse outright when neither is available. Verifying a signature
|
|
60
|
+
// without checking `iss` accepts any token from any realm that shares this
|
|
61
|
+
// JWKS, which is not a meaningful authorization decision.
|
|
62
|
+
const issuer = options?.issuer ?? this.issuer;
|
|
63
|
+
if (issuer === undefined || issuer === "") {
|
|
64
|
+
throw new ConfigurationError("JwksClient.verify requires an expected issuer — set `issuer` on the " +
|
|
65
|
+
"JwksClient config or pass `options.issuer`. Verifying without pinning " +
|
|
66
|
+
"`iss` would accept a token minted by any issuer sharing this JWKS.");
|
|
67
|
+
}
|
|
68
|
+
const audience = options?.audience ?? this.audience;
|
|
52
69
|
let keySet = await this.getKeySet();
|
|
53
70
|
const doVerify = async (ks) => {
|
|
54
71
|
const { payload } = await jwtVerify(token, ks, {
|
|
55
|
-
issuer
|
|
56
|
-
audience
|
|
57
|
-
|
|
72
|
+
issuer,
|
|
73
|
+
audience,
|
|
74
|
+
// EdDSA only (§25.10). Hearth signs every access token with Ed25519;
|
|
75
|
+
// the RS256 key a realm JWKS may carry signs ID tokens only, and an ID
|
|
76
|
+
// token must never pass as an access token (task 26.55).
|
|
77
|
+
algorithms: ["EdDSA"],
|
|
58
78
|
clockTolerance,
|
|
59
79
|
});
|
|
60
80
|
return new Claims(payload);
|
package/dist/jwks-client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-client.js","sourceRoot":"","sources":["../src/jwks-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,MAAM,IAAI,UAAU,GACrB,MAAM,MAAM,CAAC;AAOd,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"jwks-client.js","sourceRoot":"","sources":["../src/jwks-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,MAAM,IAAI,UAAU,GACrB,MAAM,MAAM,CAAC;AAOd,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AA0CrB;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACJ,OAAO,CAAS;IACxB,MAAM,CAAqB;IAC3B,QAAQ,CAAgC;IACxC,GAAG,CAAqB;IACxB,WAAW,CAAS;IAC7B,oDAAoD;IAC5C,MAAM,GAAyD,IAAI,CAAC;IAE5E,YAAY,MAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAY,GAAG,KAAK;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAuD,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,MAAwB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACnE,OAAO,MAAwB,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAuB;QACjD,MAAM,cAAc,GAAG,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;QAEvD,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,kBAAkB,CAC1B,sEAAsE;gBACpE,wEAAwE;gBACxE,oEAAoE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QAEpD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,EAAkB,EAAE,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE;gBAC7C,MAAM;gBACN,QAAQ;gBACR,qEAAqE;gBACrE,uEAAuE;gBACvE,yDAAyD;gBACzD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc;aACf,CAAC,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAkC,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAI,QAAQ,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACrD,+DAA+D;gBAC/D,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAY,EAAE,OAAuB;QACxD,IAAI,GAAG,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAI,GAAG,CAAC,OAAmC,EAAE,CAAC,KAAK,CAAW,IAAI,EAAE,CAAC;gBACjF,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAI,GAAG,CAAC,OAAmC,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC;oBAC/C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IACE,GAAG,YAAY,UAAU,CAAC,UAAU;YACpC,GAAG,YAAY,UAAU,CAAC,UAAU;YACpC,GAAG,YAAY,UAAU,CAAC,8BAA8B;YACxD,GAAG,YAAY,UAAU,CAAC,iBAAiB,EAC3C,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAClE,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,+BAA+B,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC1D,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF"}
|
package/dist/middleware.d.ts
CHANGED
|
@@ -22,9 +22,12 @@ export type PermissionChecker = (token: string) => Promise<boolean>;
|
|
|
22
22
|
* Returns a mode-aware permission checker for the given `permission`.
|
|
23
23
|
*
|
|
24
24
|
* Behaviour by mode:
|
|
25
|
-
* - **embedded** —
|
|
26
|
-
*
|
|
27
|
-
*
|
|
25
|
+
* - **embedded** — verifies the JWT with `client.verifyToken()` (EdDSA signature
|
|
26
|
+
* against the realm's cached JWKS, plus `exp`, `nbf`, `iss` and `aud`) and only
|
|
27
|
+
* then checks the `permissions` claim. No per-request network traffic once the
|
|
28
|
+
* JWKS is warm. Returns `false` when the token does not verify or the claim is
|
|
29
|
+
* absent; DOES NOT fall back to network (design constraint: absence of claims ≠
|
|
30
|
+
* switch mode).
|
|
28
31
|
* - **decision** — calls `client.authorize(token, permission, opts)` which
|
|
29
32
|
* POSTs to `POST /oauth/authorize`. Fail-closed on network/server errors.
|
|
30
33
|
* - **introspection** — calls `client.introspectionClient().introspect(token)`,
|
package/dist/middleware.js
CHANGED
|
@@ -1,12 +1,14 @@
|
|
|
1
|
-
import { decodeJwt } from "jose";
|
|
2
1
|
import { AuthorizationModeMismatchError } from "./errors.js";
|
|
3
2
|
/**
|
|
4
3
|
* Returns a mode-aware permission checker for the given `permission`.
|
|
5
4
|
*
|
|
6
5
|
* Behaviour by mode:
|
|
7
|
-
* - **embedded** —
|
|
8
|
-
*
|
|
9
|
-
*
|
|
6
|
+
* - **embedded** — verifies the JWT with `client.verifyToken()` (EdDSA signature
|
|
7
|
+
* against the realm's cached JWKS, plus `exp`, `nbf`, `iss` and `aud`) and only
|
|
8
|
+
* then checks the `permissions` claim. No per-request network traffic once the
|
|
9
|
+
* JWKS is warm. Returns `false` when the token does not verify or the claim is
|
|
10
|
+
* absent; DOES NOT fall back to network (design constraint: absence of claims ≠
|
|
11
|
+
* switch mode).
|
|
10
12
|
* - **decision** — calls `client.authorize(token, permission, opts)` which
|
|
11
13
|
* POSTs to `POST /oauth/authorize`. Fail-closed on network/server errors.
|
|
12
14
|
* - **introspection** — calls `client.introspectionClient().introspect(token)`,
|
|
@@ -22,15 +24,14 @@ export function requirePermission(permission, opts) {
|
|
|
22
24
|
switch (mode) {
|
|
23
25
|
case "embedded":
|
|
24
26
|
return async (token) => {
|
|
25
|
-
|
|
27
|
+
// Verify BEFORE reading a claim. Decoding without verifying would let
|
|
28
|
+
// anyone mint `{"alg":"none"}` with any permission they liked.
|
|
26
29
|
try {
|
|
27
|
-
|
|
30
|
+
return (await client.verifyToken(token)).hasPermission(permission);
|
|
28
31
|
}
|
|
29
32
|
catch {
|
|
30
33
|
return false;
|
|
31
34
|
}
|
|
32
|
-
const perms = claims["permissions"];
|
|
33
|
-
return Array.isArray(perms) && perms.includes(permission);
|
|
34
35
|
};
|
|
35
36
|
case "decision":
|
|
36
37
|
return async (token) => client.authorize(token, permission, { organizationId, resource });
|
package/dist/middleware.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAwB7D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAExD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,KAAa,EAAoB,EAAE;gBAC/C,sEAAsE;gBACtE,+DAA+D;gBAC/D,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC,CAAC;QAEJ,KAAK,UAAU;YACb,OAAO,KAAK,EAAE,KAAa,EAAoB,EAAE,CAC/C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtE,KAAK,eAAe;YAClB,OAAO,KAAK,EAAE,KAAa,EAAoB,EAAE;gBAC/C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAE1C,uEAAuE;gBACvE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACjE,MAAM,IAAI,8BAA8B,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjF,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACjC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC7E,CAAC;YACJ,CAAC,CAAC;IACN,CAAC;AACH,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -60,6 +60,31 @@ export interface WebAuthnAllowCredential {
|
|
|
60
60
|
id: string;
|
|
61
61
|
type: string;
|
|
62
62
|
}
|
|
63
|
+
/**
|
|
64
|
+
* An assertion from an already-enrolled passkey, offered as a step-up proof.
|
|
65
|
+
* Every field is base64url without padding.
|
|
66
|
+
*/
|
|
67
|
+
export interface StepUpAssertion {
|
|
68
|
+
credential_id: string;
|
|
69
|
+
client_data_json: string;
|
|
70
|
+
authenticator_data: string;
|
|
71
|
+
signature: string;
|
|
72
|
+
user_handle?: string | null;
|
|
73
|
+
}
|
|
74
|
+
/**
|
|
75
|
+
* Proof that the caller holds a credential the account already has.
|
|
76
|
+
*
|
|
77
|
+
* Passkey enrolment refuses a request that carries no proof: an access token
|
|
78
|
+
* alone is one factor, and enrolling with it would turn a stolen token into a
|
|
79
|
+
* permanent credential. Supply exactly one field.
|
|
80
|
+
*/
|
|
81
|
+
export type StepUpProof = {
|
|
82
|
+
password: string;
|
|
83
|
+
} | {
|
|
84
|
+
totp_code: string;
|
|
85
|
+
} | {
|
|
86
|
+
assertion: StepUpAssertion;
|
|
87
|
+
};
|
|
63
88
|
/** `PublicKeyCredentialCreationOptions` returned by `/webauthn/register/begin`. */
|
|
64
89
|
export interface WebAuthnRegistrationBeginResponse {
|
|
65
90
|
challenge: string;
|
|
@@ -122,11 +147,6 @@ export interface UpdateUserParams {
|
|
|
122
147
|
displayName?: string;
|
|
123
148
|
status?: string;
|
|
124
149
|
}
|
|
125
|
-
/** Parameters for creating a realm. */
|
|
126
|
-
export interface CreateRealmParams {
|
|
127
|
-
name: string;
|
|
128
|
-
config?: Record<string, unknown>;
|
|
129
|
-
}
|
|
130
150
|
/** Realm record from the API. */
|
|
131
151
|
export interface Realm {
|
|
132
152
|
id: string;
|
|
@@ -137,6 +157,11 @@ export interface Realm {
|
|
|
137
157
|
updated_at?: number;
|
|
138
158
|
}
|
|
139
159
|
/** Parameters for updating a realm. */
|
|
160
|
+
/**
|
|
161
|
+
* Realm patch shape. No client method sends it: realms are provisioned from
|
|
162
|
+
* `hearth.yaml` and `PATCH /admin/realms/{id}` answers 405 (audit
|
|
163
|
+
* 2026-08-28 §25.4).
|
|
164
|
+
*/
|
|
140
165
|
export interface UpdateRealmParams {
|
|
141
166
|
name?: string;
|
|
142
167
|
status?: string;
|
|
@@ -147,10 +172,18 @@ export interface PageResponse<T> {
|
|
|
147
172
|
items: T[];
|
|
148
173
|
next_cursor: string | null;
|
|
149
174
|
}
|
|
175
|
+
/**
|
|
176
|
+
* A client's trust level. `first_party` is an operator-owned client: it needs
|
|
177
|
+
* no user consent and may receive the user's RBAC claims. `third_party` (the
|
|
178
|
+
* server default) needs consent and never receives first-party-only claims.
|
|
179
|
+
*/
|
|
180
|
+
export type ClientTrustLevel = "first_party" | "third_party";
|
|
150
181
|
/** Parameters for registering an OAuth client. */
|
|
151
182
|
export interface RegisterClientParams {
|
|
152
183
|
clientName: string;
|
|
153
184
|
redirectUris: string[];
|
|
185
|
+
/** Optional; when omitted the server default (`third_party`) applies. */
|
|
186
|
+
trustLevel?: ClientTrustLevel;
|
|
154
187
|
}
|
|
155
188
|
/** OAuth client record from the API. */
|
|
156
189
|
export interface OAuthClient {
|