@hyper.authio/server 0.8.1 → 0.9.0

package/README.md

@@ -41,7 +41,7 @@ try {
 | `introspectionCacheDuration` | 30 s | Never past the token's expiry; only active answers are kept. |
 | `clockSkew` | 30 s | |
 | `accessTokenSignedResponseAlg` | RS*, PS*, ES* (never HS*) | The algorithm (or several) access tokens are signed with, as the client is registered in Authio. HS256/384/512 are verified with the `clientSecret` of `client: { clientId, clientSecret }` (at least 32, 48 or 64 bytes). |
-| `rejectNonAccessTokens` | `true` | Refuses a token whose `typ` is not `Bearer` (an ID token, for one). |
+| `rejectNonAccessTokens` | `true` | Refuses a token whose `typ` claim is not `Bearer` (an ID token, for one). The header `typ` must be `at+jwt` (RFC 9068 §4) regardless. |
 | `roleClaims` | `["role"]` | Claims holding flat role names (a Role claim mapper). |
 | `groupClaims` | `["groups"]` | Claims holding group names (a Group claim mapper). |
 
@@ -134,6 +134,9 @@ if (refusal) {
 | Sign-in too weak or too old (step-up) | `401` | `Bearer error="insufficient_user_authentication", error_description="…", acr_values="…", max_age=…` |
 | Missing role, permission, group, claim, organization, client or caller kind | `403` | none |
 
+When several rules fail at once, a step-up is asked for only if every failing rule is a step-up: a missing scope, role
+or permission, which no stronger sign-in fixes, answers `403` (with `insufficient_scope` for a scope) and no step-up.
+
 `resource_metadata` (RFC 9728 §5.1) is added to every `401` when the verifier publishes the protected resource
 metadata (`resourceMetadata`): the verifier's own refusals carry it, and `new AuthioForbiddenError(refusal, {
 resourceMetadata: verifier.resourceMetadataUrl })` (or `withResourceMetadata`) adds it to a step-up; the guards of

package/dist/index.cjs

@@ -43,7 +43,7 @@ var AuthioUser = class _AuthioUser {
   actorChain;
   /** `auth_time`, in seconds since the epoch. */
   authTime;
-  /** The client the token was issued to (`azp`, else `client_id`). */
+  /** The client the token was issued to (`client_id`, RFC 9068 §2.2, else `azp`). */
   clientId;
   /** `sid`. */
   sessionId;
@@ -104,7 +104,7 @@ var AuthioUser = class _AuthioUser {
     const text = (name) => typeof claims[name] === "string" && claims[name] ? claims[name] : void 0;
     this.claims = Object.freeze({ ...claims });
     this.subject = text(client.AuthioClaimTypes.Subject) ?? "";
-    this.clientId = text(client.AuthioClaimTypes.AuthorizedParty) ?? text(client.AuthioClaimTypes.ClientId);
+    this.clientId = text(client.AuthioClaimTypes.ClientId) ?? text(client.AuthioClaimTypes.AuthorizedParty);
     this.sessionId = text(client.AuthioClaimTypes.SessionId);
     this.tokenId = text(client.AuthioClaimTypes.JwtId);
     this.audiences = Object.freeze(distinct(valuesOf(claims[client.AuthioClaimTypes.Audience])));
@@ -277,8 +277,9 @@ function distinctIgnoringCase(values) {
 function authorize(user, ...rules) {
   const failures = rules.map((rule) => rule.check(user)).filter((failure) => failure !== void 0);
   if (failures.length === 0) return void 0;
-  const stepUps = failures.filter((failure) => failure.error === "insufficient_user_authentication");
-  const bearer = stepUps[0] ?? failures.find((failure) => failure.error);
+  const others = failures.filter((failure) => failure.error !== "insufficient_user_authentication");
+  const stepUps = others.length === 0 ? failures : [];
+  const bearer = stepUps[0] ?? others.find((failure) => failure.error);
   const acrValues = strongestAcr(stepUps.map((failure) => failure.acrValues));
   const maxAges = stepUps.map((failure) => failure.maxAge).filter((value) => value !== void 0);
   return {
@@ -638,13 +639,15 @@ function createAuthioVerifier(options) {
     }
     let payload;
     try {
-      ({ payload } = await client.verifyAuthioJwt(signed, keySet, {
+      let header;
+      ({ payload, header } = await client.verifyAuthioJwt(signed, keySet, {
         issuer: connection.issuer,
         audiences,
         algorithms,
         clockSkew,
         now: connection.clock.now()
       }));
+      client.requireAccessTokenType(header);
     } catch (error) {
       if (error instanceof client.AuthioTokenValidationError && error.reason === "invalid_algorithm" && symmetric.length === 0 && isSymmetricToken(signed))
         throw new AuthioBearerError(AuthioBearerErrorDescriptions.Symmetric, { cause: error, reason: error.reason });