@hyper.authio/client 0.8.0 → 0.9.0

package/README.md

@@ -102,6 +102,11 @@ callback that is not for the transaction throws `AuthioCallbackError` (`reason`:
 `missing_issuer`, `missing_code`); an OAuth error Authio sent back (`login_required` after `prompt: "none"`, for one)
 throws `AuthioProtocolError`.
 
+`acrValues` asks for a sign-in level; it does not guarantee one. Authio may sign the person in with less (no second
+factor enrolled and none required by the client), as OpenID Connect allows (`acr_values` is a voluntary claim), so
+read `idToken.acr` after the callback and refuse a sign-in below the level the app needs, as
+[`examples/web-login`](../../examples/web-login/server.mjs) does.
+
 ### ID tokens and sign-out
 
 ```ts
@@ -126,8 +131,9 @@ client's front-channel logout URI in an iframe; `validateFrontChannelLogout(requ
 
 ### Step-up
 
-When an API answers `403` with `WWW-Authenticate: Bearer error="insufficient_user_authentication", acr_values="2",
-max_age=300` (RFC 9470):
+When an API answers `401` with `WWW-Authenticate: Bearer error="insufficient_user_authentication", acr_values="2",
+max_age=300` (RFC 9470 §3; servers before `@hyper.authio/server` 0.8.1 and `@hyper.authio/mcp` 0.4.1 answer `403`, and
+the challenge reads the same):
 
 ```ts
 const challenge = parseAuthioBearerChallenge(response.headers.get("www-authenticate"));
@@ -237,7 +243,7 @@ const user = asUserEvent(event); // { id, username, emailConfirmed, … } for us
 
 Every event type has its accessor (`asLoginEvent`, `asUserLockedOutEvent`, `asTokenRevokedEvent`,
 `asKeysRotatedEvent`, `asTokenReuseDetectedEvent`, `asAdminResourceEvent`, `asUserSuspensionEvent`,
-`asAttackDetectedEvent`, `asCredentialCompromisedEvent`, `asPingEvent`), which exposes every member of `data` in
+`asAttackDetectedEvent`, `asCredentialCompromisedEvent`, `asAuthenticatorAppEvent`, `asPingEvent`), which exposes every member of `data` in
 camelCase with its value unchanged; `event.data` stays as delivered (snake_case). An unknown type still parses
 (`isKnownWebhookEventType` is `false`, `event.data` is the raw JSON).
 

package/dist/index.cjs

@@ -129,6 +129,10 @@ var AuthioWebhookEventTypes = {
   UserSuspensionEnded: "user_suspension_ended",
   AttackDetected: "attack_detected",
   CredentialCompromised: "credential_compromised",
+  UserAuthenticatorAppEnrolled: "user_authenticator_app_enrolled",
+  UserAuthenticatorAppRemoved: "user_authenticator_app_removed",
+  UserRecoveryCodesRegenerated: "user_recovery_codes_regenerated",
+  UserRecoveryCodeUsed: "user_recovery_code_used",
   Ping: "ping"
 };
 var AuthioWebhookHeaders = {
@@ -164,6 +168,8 @@ var AuthioDefaults = {
   CredentialClientIdPrefix: "cred_",
   ApiKeyHeader: "x-api-key",
   RequestIdHeader: "X-Request-Id",
+  /** The header `typ` of an access token (RFC 9068 §2.1). */
+  AccessTokenType: "at+jwt",
   /** The header `typ` of a back-channel logout token. */
   LogoutTokenType: "logout+jwt",
   /** The event a back-channel logout token carries. */
@@ -962,6 +968,14 @@ async function validateAuthioIdToken(token, context, expectations = {}) {
   }
   return payload;
 }
+function requireAccessTokenType(header) {
+  const type = typeof header.typ === "string" ? header.typ.toLowerCase() : void 0;
+  if (type !== AuthioDefaults.AccessTokenType && type !== `application/${AuthioDefaults.AccessTokenType}`)
+    throw new AuthioTokenValidationError(
+      "not_access_token",
+      `Only access tokens are accepted; this token's header typ is '${header.typ ?? ""}', not '${AuthioDefaults.AccessTokenType}'.`
+    );
+}
 async function validateAuthioLogoutToken(token, context) {
   const signed = isAuthioTokenEncrypted(token) ? await context.decrypt(token) : token;
   const invalid = (message) => new AuthioTokenValidationError("invalid_logout_token", message);
@@ -1293,12 +1307,13 @@ function createAuthioClient(options) {
       const signed = await decrypt(accessToken);
       if (signed.split(".").length !== 3) return void 0;
       const document = await discovery.get(callOptions.signal);
-      const { payload } = await verifyAuthioJwt(signed, withClientSecret(await signingKeys(callOptions.signal), clientSecret), {
+      const { payload, header } = await verifyAuthioJwt(signed, withClientSecret(await signingKeys(callOptions.signal), clientSecret), {
         issuer: connection.issuer,
         algorithms: acceptedSigningAlgorithms(accessTokenAlgorithm, document.id_token_signing_alg_values_supported),
         clockSkew,
         now: connection.clock.now()
       });
+      requireAccessTokenType(header);
       return payload;
     },
     async createEndSessionUrl(request = {}) {
@@ -1339,13 +1354,16 @@ function createAuthioClient(options) {
         };
         const token = await clientCredentials.getToken({ ...key, signal: request.signal });
         const response = await attempt(token);
-        if (response.status !== 401) return response;
+        if (response.status !== 401 || isStepUpChallenge(response)) return response;
         clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
         return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
       };
     }
   };
 }
+function isStepUpChallenge(response) {
+  return parseAuthioBearerChallenge(response.headers.get("www-authenticate"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;
+}
 function createTokenClient(connection, discovery, authenticator) {
   const requestToken = async (parameters, signal, authenticate = true) => {
     const response = await postForm(connection, discovery, authenticate ? authenticator : void 0, "token_endpoint", parameters, signal);
@@ -1708,7 +1726,7 @@ function createAuthioAccountCredential(options) {
     if (cached && clock.now() < cached.refreshAt) return cached;
     pending ??= (async () => {
       const issuedAt = clock.now();
-      const answer = kind === "client_secret" ? await client.tokens.clientCredentials({ scopes: scope, signal }) : await client.tokens.personalAccessToken({ token: value, scopes: scope, signal });
+      const answer = kind === "client_secret" ? await client.tokens.clientCredentials({ scopes: scope, signal }) : await client.tokens.personalAccessToken({ token: value, clientId: AuthioDefaults.PlatformClientId, scopes: scope, signal });
       cached = toClientCredentialsToken(answer, issuedAt, refreshSkewMs);
       return cached;
     })().finally(() => {
@@ -2021,6 +2039,13 @@ var asAdminResourceEvent = (event) => dataWhen(
 var asUserSuspensionEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserSuspended, AuthioWebhookEventTypes.UserSuspensionEnded);
 var asAttackDetectedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.AttackDetected);
 var asCredentialCompromisedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.CredentialCompromised);
+var asAuthenticatorAppEvent = (event) => dataWhen(
+  event,
+  AuthioWebhookEventTypes.UserAuthenticatorAppEnrolled,
+  AuthioWebhookEventTypes.UserAuthenticatorAppRemoved,
+  AuthioWebhookEventTypes.UserRecoveryCodesRegenerated,
+  AuthioWebhookEventTypes.UserRecoveryCodeUsed
+);
 var asPingEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.Ping);
 var knownEventTypes = new Set(Object.values(AuthioWebhookEventTypes));
 function isKnownWebhookEventType(type) {
@@ -2105,6 +2130,7 @@ exports.AuthioWebhookEventTypes = AuthioWebhookEventTypes;
 exports.AuthioWebhookHeaders = AuthioWebhookHeaders;
 exports.asAdminResourceEvent = asAdminResourceEvent;
 exports.asAttackDetectedEvent = asAttackDetectedEvent;
+exports.asAuthenticatorAppEvent = asAuthenticatorAppEvent;
 exports.asCredentialCompromisedEvent = asCredentialCompromisedEvent;
 exports.asKeysRotatedEvent = asKeysRotatedEvent;
 exports.asLoginEvent = asLoginEvent;
@@ -2137,6 +2163,7 @@ exports.randomValue = randomValue;
 exports.readAuthioAdminResponse = readAuthioAdminResponse;
 exports.readAuthioFrontChannelLogout = readAuthioFrontChannelLogout;
 exports.readWebhookEventData = readWebhookEventData;
+exports.requireAccessTokenType = requireAccessTokenType;
 exports.requireHmacSecretLength = requireHmacSecretLength;
 exports.resolveConnection = resolveConnection;
 exports.resolveIssuer = resolveIssuer;