@hyper.authio/testing 0.0.0-stage → 0.7.0

package/dist/index.js

@@ -0,0 +1,736 @@
+import { createServer } from 'http';
+import { randomUUID, createHash } from 'crypto';
+import { SignJWT, decodeJwt, generateKeyPair, exportJWK, jwtVerify, importJWK, CompactEncrypt } from 'jose';
+import { AuthioWebhookHeaders, computeWebhookSignatureHeader } from '@hyper.authio/client';
+
+// src/fake-authio.ts
+var FakeAuthio = class _FakeAuthio {
+  /** Every request received, in order. */
+  requests = [];
+  /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */
+  failures = /* @__PURE__ */ new Map();
+  /** Every back-channel logout token posted, in order. */
+  backchannelDeliveries = [];
+  /** What successive device-code polls answer; the last value repeats. Defaults to `["approved"]`. */
+  deviceOutcomes = ["approved"];
+  /** Overrides the discovery document's issuer, to test the mismatch check. */
+  discoveryIssuer;
+  /** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */
+  userInfoAsJwt = false;
+  /** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */
+  omitAuthorizationIssuer = false;
+  /** Answers connected-account exchanges. Defaults to granting a token for the provider. */
+  connectionResponder;
+  /** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */
+  signInAs;
+  clients = /* @__PURE__ */ new Map();
+  users = /* @__PURE__ */ new Map();
+  personalAccessTokens = /* @__PURE__ */ new Map();
+  codes = /* @__PURE__ */ new Map();
+  refreshTokens = /* @__PURE__ */ new Map();
+  issued = /* @__PURE__ */ new Map();
+  devicePolls = /* @__PURE__ */ new Map();
+  lifetime;
+  session;
+  server;
+  signingKey;
+  verificationKey;
+  untrustedKey;
+  publicJwk;
+  baseUrl;
+  realm;
+  keyId = "fake-key-1";
+  constructor(options) {
+    this.realm = options.realm ?? "fake";
+    this.lifetime = options.accessTokenLifetime ?? 300;
+    for (const client of options.clients ?? []) this.clients.set(client.clientId, client);
+    for (const user of options.users ?? []) this.users.set(user.username, user);
+    for (const pat of options.personalAccessTokens ?? []) this.personalAccessTokens.set(pat.token, pat);
+  }
+  /**
+   * Starts the fake on a random loopback port.
+   */
+  static async start(options = {}) {
+    const fake = new _FakeAuthio(options);
+    await fake.listen();
+    return fake;
+  }
+  /** `http://127.0.0.1:{port}`. */
+  get authority() {
+    return this.baseUrl;
+  }
+  /** `{authority}/realms/{realm}`. */
+  get issuer() {
+    return `${this.baseUrl}/realms/${this.realm}`;
+  }
+  /** The realm's public signing key. */
+  get jwks() {
+    return { keys: [this.publicJwk] };
+  }
+  /** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */
+  get currentSession() {
+    return this.session ? { sub: this.session.sub, sid: this.session.sid, authTime: this.session.authTime } : void 0;
+  }
+  /** Registers a client. */
+  addClient(client) {
+    this.clients.set(client.clientId, client);
+  }
+  /** Registers a person. */
+  addUser(user) {
+    this.users.set(user.username, user);
+  }
+  /** Registers a personal access token. */
+  addPersonalAccessToken(token) {
+    this.personalAccessTokens.set(token.token, token);
+  }
+  /** Ends the signed-in session without notifying anyone, as if it expired. */
+  endSession() {
+    this.session = void 0;
+  }
+  /**
+   * Registers an authorization code for a person, as the authorization endpoint would after sign-in.
+   */
+  createAuthorizationCode(options) {
+    const user = this.requireUser(options.username);
+    const code = randomUUID();
+    this.codes.set(code, {
+      clientId: options.clientId,
+      sub: user.sub,
+      redirectUri: options.redirectUri,
+      scope: options.scope,
+      codeVerifier: options.codeChallengeVerifier,
+      resource: options.resource,
+      nonce: options.nonce
+    });
+    return code;
+  }
+  /**
+   * Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what
+   * Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.
+   */
+  async authorize(authorizationUrl) {
+    const response = await fetch(authorizationUrl, { redirect: "manual" });
+    const location = response.headers.get("location");
+    if (location) {
+      const callback = new URL(location);
+      return { parameters: Object.fromEntries(callback.searchParams), callbackUrl: location };
+    }
+    const html = await response.text();
+    const message = /data-authorization-response='([^']*)'/.exec(html)?.[1];
+    if (!message) throw new Error(`The fake answered the authorization with HTTP ${response.status} and no response.`);
+    return { parameters: JSON.parse(decodeURIComponent(message)), callbackUrl: void 0 };
+  }
+  /**
+   * Mints an access token signed by the realm key, recorded so introspection and revocation know it.
+   */
+  async issueAccessToken(options = {}) {
+    const now = Math.floor(Date.now() / 1e3);
+    const clientId = options.clientId ?? "fake-client";
+    const jti = randomUUID();
+    const payload = {
+      typ: options.type ?? "Bearer",
+      azp: clientId,
+      client_id: clientId,
+      ...options.scope ? { scope: options.scope } : {},
+      ...options.sub ? { sub: options.sub } : {},
+      ...options.claims
+    };
+    const signed = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: "JWT" }).setIssuer(options.issuer ?? this.issuer).setAudience(options.audience ?? clientId).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + (options.expiresIn ?? this.lifetime)).setJti(jti).sign(options.untrusted ? this.untrustedKey : this.signingKey);
+    const token = options.encryptTo ? await encryptTo(signed, options.encryptTo) : signed;
+    this.issued.set(token, { claims: decodeJwt(signed), clientId, revoked: false });
+    return token;
+  }
+  /**
+   * Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`
+   * removes one) and `type` the header `typ`, to build invalid ones in tests.
+   */
+  async createLogoutToken(options) {
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      iss: this.issuer,
+      aud: options.clientId,
+      iat: now,
+      exp: now + 120,
+      jti: randomUUID(),
+      ...options.sub ? { sub: options.sub } : {},
+      ...options.sid ? { sid: options.sid } : {},
+      events: { "http://schemas.openid.net/event/backchannel-logout": {} },
+      ...options.overrides
+    };
+    for (const key of Object.keys(payload)) if (payload[key] === void 0) delete payload[key];
+    const signed = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: options.type ?? "logout+jwt" }).sign(this.signingKey);
+    const encryption = this.clients.get(options.clientId)?.encryption;
+    return encryption?.logoutTokens ? encryptTo(signed, encryption) : signed;
+  }
+  /**
+   * Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.
+   *
+   * @returns The HTTP status the client answered, or 0 when it could not be reached.
+   */
+  async deliverBackchannelLogout(clientId, options = {}) {
+    const client = this.clients.get(clientId);
+    if (!client?.backchannelLogoutUri) throw new Error(`The fake client ${clientId} has no backchannelLogoutUri.`);
+    const logoutToken = await this.createLogoutToken({ clientId, sub: options.sub, sid: options.sid });
+    let status = 0;
+    try {
+      const response = await fetch(client.backchannelLogoutUri, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ logout_token: logoutToken }).toString()
+      });
+      status = response.status;
+      await response.arrayBuffer();
+    } catch {
+      status = 0;
+    }
+    this.backchannelDeliveries.push({ clientId, uri: client.backchannelLogoutUri, logoutToken, status });
+    return status;
+  }
+  /** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */
+  revokeToken(token) {
+    const issued = this.issued.get(token);
+    if (issued) issued.revoked = true;
+    this.refreshTokens.delete(token);
+  }
+  /** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */
+  revokeRefreshTokens(options) {
+    for (const [token, refresh] of this.refreshTokens)
+      if (options.sid !== void 0 && refresh.sid === options.sid || options.sid === void 0 && options.sub !== void 0 && refresh.sub === options.sub)
+        this.refreshTokens.delete(token);
+  }
+  /** Forgets the recorded requests. */
+  clearRequests() {
+    this.requests.length = 0;
+  }
+  /** The recorded requests to one endpoint path suffix, such as `/token`. */
+  requestsTo(suffix) {
+    return this.requests.filter((request) => request.path.endsWith(suffix));
+  }
+  /** Stops the server. */
+  close() {
+    return new Promise((resolve, reject) => {
+      this.server.closeAllConnections?.();
+      this.server.close((error) => error ? reject(error) : resolve());
+    });
+  }
+  async listen() {
+    const pair = await generateKeyPair("RS256", { extractable: true });
+    const untrusted = await generateKeyPair("RS256");
+    this.signingKey = pair.privateKey;
+    this.verificationKey = pair.publicKey;
+    this.untrustedKey = untrusted.privateKey;
+    this.publicJwk = { ...await exportJWK(pair.publicKey), kid: this.keyId, alg: "RS256", use: "sig" };
+    this.server = createServer((request, response) => {
+      this.handle(request, response).catch((error) => {
+        send(response, { status: 500, body: { error: "server_error", error_description: String(error) } });
+      });
+    });
+    await new Promise((resolve) => this.server.listen(0, "127.0.0.1", resolve));
+    this.baseUrl = `http://127.0.0.1:${this.server.address().port}`;
+  }
+  async handle(request, response) {
+    const url = new URL(request.url ?? "/", this.baseUrl);
+    const body = await readBody(request);
+    const form = Object.fromEntries(new URLSearchParams(request.headers["content-type"]?.includes("form") ? body : ""));
+    const headers = Object.fromEntries(Object.entries(request.headers).map(([name, value]) => [name, Array.isArray(value) ? value.join(", ") : value ?? ""]));
+    const query = Object.fromEntries(url.searchParams);
+    const recorded = { method: request.method ?? "GET", path: url.pathname, headers, form, query };
+    this.requests.push(recorded);
+    const prefix = `/realms/${this.realm}`;
+    const path = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : url.pathname;
+    const endpoint = endpointOf(path);
+    const failure = endpoint ? this.failures.get(endpoint)?.shift() : void 0;
+    if (failure) return send(response, failure);
+    switch (path) {
+      case "/.well-known/openid-configuration":
+        return send(response, { status: 200, body: this.discovery() });
+      case "/protocol/openid-connect/certs":
+        return send(response, { status: 200, body: this.jwks });
+      case "/protocol/openid-connect/auth":
+        return this.authorizeEndpoint(query, response);
+      case "/protocol/openid-connect/token":
+        return send(response, await this.token(recorded, form));
+      case "/protocol/openid-connect/token/introspect":
+        return send(response, await this.introspect(recorded, form));
+      case "/protocol/openid-connect/revoke":
+        return send(response, await this.revoke(recorded, form));
+      case "/protocol/openid-connect/userinfo":
+        return this.userInfo(headers, response);
+      case "/protocol/openid-connect/auth/device":
+        return send(response, await this.device(recorded, form));
+      case "/protocol/openid-connect/logout":
+        return this.endSessionEndpoint(query, response);
+      default:
+        return send(response, { status: 404, body: { error: "not_found" } });
+    }
+  }
+  discovery() {
+    const base = `${this.issuer}/protocol/openid-connect`;
+    return {
+      issuer: this.discoveryIssuer ?? this.issuer,
+      authorization_endpoint: `${base}/auth`,
+      token_endpoint: `${base}/token`,
+      introspection_endpoint: `${base}/token/introspect`,
+      revocation_endpoint: `${base}/revoke`,
+      userinfo_endpoint: `${base}/userinfo`,
+      end_session_endpoint: `${base}/logout`,
+      device_authorization_endpoint: `${base}/auth/device`,
+      jwks_uri: `${base}/certs`,
+      scopes_supported: ["openid", "profile", "email", "phone", "roles", "offline_access"],
+      response_types_supported: ["code"],
+      response_modes_supported: ["query", "web_message"],
+      grant_types_supported: [
+        "authorization_code",
+        "refresh_token",
+        "client_credentials",
+        "password",
+        "urn:ietf:params:oauth:grant-type:device_code",
+        "urn:ietf:params:oauth:grant-type:token-exchange",
+        "personal_access_token"
+      ],
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["RS256"],
+      id_token_encryption_alg_values_supported: ["RSA-OAEP", "RSA-OAEP-256"],
+      id_token_encryption_enc_values_supported: ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"],
+      userinfo_signing_alg_values_supported: ["RS256"],
+      userinfo_encryption_alg_values_supported: ["RSA-OAEP", "RSA-OAEP-256"],
+      userinfo_encryption_enc_values_supported: ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"],
+      token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "private_key_jwt", "none"],
+      code_challenge_methods_supported: ["S256", "plain"],
+      prompt_values_supported: ["none", "login", "select_account", "consent"],
+      display_values_supported: ["page", "popup"],
+      acr_values_supported: ["1", "2", "3"],
+      backchannel_logout_supported: true,
+      backchannel_logout_session_supported: true,
+      authorization_response_iss_parameter_supported: !this.omitAuthorizationIssuer
+    };
+  }
+  authorizeEndpoint(query, response) {
+    const client = this.clients.get(query.client_id ?? "");
+    if (!client) return send(response, { status: 400, body: { error: "invalid_request", error_description: "Unknown client_id." } });
+    if (!query.redirect_uri || client.redirectUris && !client.redirectUris.includes(query.redirect_uri))
+      return send(response, { status: 400, body: { error: "invalid_request", error_description: "The redirect_uri is not registered." } });
+    const answer = (parameters) => {
+      const values = {};
+      for (const [name, value] of Object.entries({ ...parameters, state: query.state, iss: this.omitAuthorizationIssuer ? void 0 : this.issuer }))
+        if (value !== void 0) values[name] = value;
+      if (query.response_mode === "web_message") {
+        const message = encodeURIComponent(JSON.stringify(values));
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end(
+          `<!doctype html><html><body data-authorization-response='${message}'><script>window.opener&&window.opener.postMessage({type:"authorization_response",response:JSON.parse(decodeURIComponent(document.body.dataset.authorizationResponse))},${JSON.stringify(new URL(query.redirect_uri).origin)});</script></body></html>`
+        );
+        return;
+      }
+      const location = new URL(query.redirect_uri);
+      for (const [name, value] of Object.entries(values)) location.searchParams.set(name, value);
+      response.writeHead(302, { location: location.toString() });
+      response.end();
+    };
+    if (query.response_type !== "code") return answer({ error: "unsupported_response_type", error_description: "Only code is supported." });
+    const method = query.code_challenge_method ?? (query.code_challenge ? "plain" : void 0);
+    if (method && method !== "S256" && method !== "plain") return answer({ error: "invalid_request", error_description: "Unsupported PKCE method." });
+    const prompts = (query.prompt ?? "").split(" ").filter(Boolean);
+    const now = Math.floor(Date.now() / 1e3);
+    const maxAge = query.max_age !== void 0 ? Number(query.max_age) : void 0;
+    const tooOld = this.session !== void 0 && maxAge !== void 0 && now - this.session.authTime > maxAge;
+    const requestedAcr = (query.acr_values ?? "").split(" ").filter(Boolean).sort().at(-1);
+    const weaker = this.session !== void 0 && requestedAcr !== void 0 && Number(this.session.acr) < Number(requestedAcr);
+    if (prompts.includes("none") && (!this.session || tooOld || weaker)) return answer({ error: "login_required", error_description: "Nobody is signed in." });
+    if (!this.session || prompts.includes("login") || tooOld || weaker || query.login_hint && this.users.get(query.login_hint)?.sub !== this.session.sub) {
+      const username = (query.login_hint && this.users.has(query.login_hint) ? query.login_hint : void 0) ?? this.signInAs ?? this.users.keys().next().value;
+      const user = username ? this.users.get(username) : void 0;
+      if (!user) return answer({ error: "access_denied", error_description: "The fake has no user to sign in." });
+      const acr = requestedAcr ?? user.acr ?? "1";
+      this.session = {
+        sub: user.sub,
+        sid: randomUUID().replace(/-/g, ""),
+        authTime: now,
+        acr,
+        amr: user.amr ?? (Number(acr) >= 2 ? ["pwd", "otp", "mfa"] : ["pwd"]),
+        clients: /* @__PURE__ */ new Set()
+      };
+    }
+    this.session.clients.add(client.clientId);
+    const code = randomUUID();
+    this.codes.set(code, {
+      clientId: client.clientId,
+      sub: this.session.sub,
+      redirectUri: query.redirect_uri,
+      scope: query.scope,
+      codeChallenge: query.code_challenge,
+      codeChallengeMethod: method,
+      resource: query.resource,
+      nonce: query.nonce,
+      sid: this.session.sid,
+      authTime: this.session.authTime,
+      acr: this.session.acr,
+      amr: this.session.amr
+    });
+    answer({ code });
+  }
+  async endSessionEndpoint(query, response) {
+    let clientId = query.client_id;
+    if (query.id_token_hint) {
+      try {
+        const { payload } = await jwtVerify(query.id_token_hint, this.verificationKey, { issuer: this.issuer });
+        clientId ??= [payload.aud ?? []].flat()[0];
+      } catch {
+        return send(response, { status: 400, body: { error: "invalid_request", error_description: "The id_token_hint is not valid." } });
+      }
+    }
+    const client = clientId ? this.clients.get(clientId) : void 0;
+    const redirect = query.post_logout_redirect_uri;
+    if (redirect && (!client || client.postLogoutRedirectUris && !client.postLogoutRedirectUris.includes(redirect)))
+      return send(response, { status: 400, body: { error: "invalid_request", error_description: "The post_logout_redirect_uri is not registered." } });
+    const ended = this.session;
+    this.session = void 0;
+    if (ended) this.revokeRefreshTokens({ sid: ended.sid });
+    if (ended) {
+      for (const id of ended.clients) if (this.clients.get(id)?.backchannelLogoutUri) await this.deliverBackchannelLogout(id, { sub: ended.sub, sid: ended.sid });
+    }
+    if (!redirect) {
+      response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      response.end("<!doctype html><p>You are signed out.</p>");
+      return;
+    }
+    const location = new URL(redirect);
+    if (query.state) location.searchParams.set("state", query.state);
+    response.writeHead(302, { location: location.toString() });
+    response.end();
+  }
+  async authenticate(recorded, form) {
+    const invalid = (description) => ({ status: 401, body: { error: "invalid_client", error_description: description } });
+    const authorization = recorded.headers.authorization;
+    let client;
+    if (authorization?.startsWith("Basic ")) {
+      const [id, secret] = Buffer.from(authorization.slice(6), "base64").toString("utf8").split(":").map(decodeURIComponent);
+      client = this.clients.get(id ?? "");
+      if (!client || !client.clientSecret || client.clientSecret !== secret) return invalid("The client credentials are wrong.");
+    } else if (form.client_assertion) {
+      client = this.clients.get(form.client_id ?? "");
+      if (!client?.publicKey) return invalid("The client has no registered key.");
+      if (form.client_assertion_type !== "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") return invalid("Wrong assertion type.");
+      try {
+        const key = await importJWK(client.publicKey, client.publicKey.alg);
+        const { payload } = await jwtVerify(form.client_assertion, key, { issuer: client.clientId, subject: client.clientId, audience: this.issuer });
+        if (!payload.jti) return invalid("The assertion has no jti.");
+      } catch (error) {
+        return invalid(`The assertion does not verify: ${error.message}`);
+      }
+    } else if (form.client_secret !== void 0) {
+      client = this.clients.get(form.client_id ?? "");
+      if (!client || client.clientSecret !== form.client_secret) return invalid("The client credentials are wrong.");
+    } else {
+      client = this.clients.get(form.client_id ?? "");
+      if (!client || client.clientSecret || client.publicKey) return invalid("The client must authenticate.");
+    }
+    recorded.clientId = client.clientId;
+    return client;
+  }
+  async token(recorded, form) {
+    const grant = (error, description) => ({ status: 400, body: { error, error_description: description } });
+    if (form.grant_type === "personal_access_token") {
+      const pat = this.personalAccessTokens.get(form.client_secret ?? "");
+      if (!pat || form.client_id && pat.clientId && form.client_id !== pat.clientId)
+        return { status: 401, body: { error: "invalid_client", error_description: "The personal access token is not valid." } };
+      const clientId = pat.clientId ?? "authio";
+      recorded.clientId = clientId;
+      return this.tokenAnswer(this.clients.get(clientId) ?? { clientId }, {
+        sub: pat.sub,
+        scope: form.scope,
+        audience: form.resource,
+        claims: { amr: "personal_access_token", actor_type: "personal_access_token", credential_id: pat.sub, ...pat.claims }
+      });
+    }
+    const client = await this.authenticate(recorded, form);
+    if ("status" in client) return client;
+    const scope = form.scope ?? client.defaultScopes?.join(" ");
+    switch (form.grant_type) {
+      case "client_credentials":
+        return this.tokenAnswer(client, { sub: client.clientId, scope, audience: form.resource, claims: client.claims });
+      case "password": {
+        const user = this.users.get(form.username ?? "");
+        if (!user || user.password !== form.password) return grant("invalid_grant", "Wrong username or password.");
+        return this.tokenAnswer(client, { sub: user.sub, scope, claims: { ...client.claims, ...user.claims, preferred_username: user.username } }, user);
+      }
+      case "authorization_code": {
+        const code = this.codes.get(form.code ?? "");
+        if (!code || code.clientId !== client.clientId || code.redirectUri !== form.redirect_uri) return grant("invalid_grant", "The code is not valid.");
+        if (code.codeVerifier && code.codeVerifier !== form.code_verifier) return grant("invalid_grant", "PKCE verification failed.");
+        if (code.codeChallenge && !verifiesChallenge(form.code_verifier, code.codeChallenge, code.codeChallengeMethod ?? "plain"))
+          return grant("invalid_grant", "PKCE verification failed.");
+        this.codes.delete(form.code);
+        const user = [...this.users.values()].find((candidate) => candidate.sub === code.sub);
+        const signIn = code.sid ? { sid: code.sid, auth_time: code.authTime, acr: code.acr, amr: code.amr } : { auth_time: Math.floor(Date.now() / 1e3), acr: user.acr ?? "1", amr: user.amr ?? ["pwd"] };
+        return this.tokenAnswer(
+          client,
+          {
+            sub: user.sub,
+            scope: code.scope,
+            audience: form.resource ?? code.resource,
+            claims: { ...client.claims, ...user.claims, ...signIn, preferred_username: user.username }
+          },
+          user,
+          void 0,
+          { nonce: code.nonce, signIn }
+        );
+      }
+      case "refresh_token": {
+        const refresh = this.refreshTokens.get(form.refresh_token ?? "");
+        if (!refresh || refresh.clientId !== client.clientId) return grant("invalid_grant", "The refresh token is not valid.");
+        this.refreshTokens.delete(form.refresh_token);
+        const user = [...this.users.values()].find((candidate) => candidate.sub === refresh.sub);
+        return this.tokenAnswer(
+          client,
+          { sub: refresh.sub, scope: form.scope ?? refresh.scope, claims: { ...client.claims, ...user?.claims, ...refresh.sid ? { sid: refresh.sid } : {} } },
+          user
+        );
+      }
+      case "urn:ietf:params:oauth:grant-type:token-exchange": {
+        const subject = this.issued.get(form.subject_token ?? "");
+        if (!subject || subject.revoked) return grant("invalid_grant", "The subject token is not valid.");
+        if (form.requested_token_type === "urn:authio:params:oauth:token-type:connection-access-token") {
+          const answer = this.connectionResponder?.(form) ?? {
+            access_token: `provider-token-${form.connection_provider}`,
+            issued_token_type: form.requested_token_type,
+            token_type: "Bearer",
+            expires_in: 3600,
+            provider: form.connection_provider
+          };
+          return "status" in answer && typeof answer.status === "number" ? answer : { status: 200, body: answer };
+        }
+        const { iss: _issuer, aud: _audience, exp: _expiry, iat: _issuedAt, nbf: _notBefore, jti: _jti, scope: _scope, ...claims } = subject.claims;
+        return this.tokenAnswer(client, {
+          sub: subject.claims.sub,
+          scope: form.scope ?? subject.claims.scope,
+          audience: form.resource,
+          claims: { ...claims, act: { client_id: client.clientId } }
+        }, void 0, form.requested_token_type);
+      }
+      case "urn:ietf:params:oauth:grant-type:device_code": {
+        const polls = this.devicePolls.get(form.device_code ?? "");
+        if (polls === void 0) return grant("invalid_grant", "Unknown device code.");
+        this.devicePolls.set(form.device_code, polls + 1);
+        const outcome = this.deviceOutcomes[Math.min(polls, this.deviceOutcomes.length - 1)] ?? "approved";
+        switch (outcome) {
+          case "pending":
+            return grant("authorization_pending", "The user has not approved yet.");
+          case "slow_down":
+            return grant("slow_down", "Poll less often.");
+          case "denied":
+            return grant("access_denied", "The user denied the request.");
+          case "expired":
+            return grant("expired_token", "The device code expired.");
+          default:
+            return this.tokenAnswer(client, { sub: "device-user", scope, claims: client.claims });
+        }
+      }
+      default:
+        return grant("unsupported_grant_type", `The grant ${form.grant_type} is not supported.`);
+    }
+  }
+  async tokenAnswer(client, options, user, issuedTokenType, idToken) {
+    const encryption = client.encryption;
+    const accessToken = await this.issueAccessToken({
+      clientId: client.clientId,
+      sub: options.sub,
+      scope: options.scope,
+      audience: options.audience ?? client.clientId,
+      claims: options.claims,
+      ...encryption?.accessTokens ? { encryptTo: encryption } : {}
+    });
+    const body = {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.lifetime,
+      ...options.scope ? { scope: options.scope } : {},
+      ...issuedTokenType ? { issued_token_type: issuedTokenType } : {}
+    };
+    if (user) {
+      const refreshToken = randomUUID();
+      const sid = typeof options.claims?.sid === "string" ? options.claims.sid : void 0;
+      this.refreshTokens.set(refreshToken, { clientId: client.clientId, sub: user.sub, scope: options.scope, sid, expiresAt: Math.floor(Date.now() / 1e3) + 30 * 24 * 3600 });
+      body.refresh_token = refreshToken;
+    }
+    if (user && idToken && (options.scope ?? "").split(" ").includes("openid")) {
+      const now = Math.floor(Date.now() / 1e3);
+      const signIn = Object.fromEntries(Object.entries(idToken.signIn).filter(([, value]) => value !== void 0));
+      const signed = await new SignJWT({
+        typ: "ID",
+        azp: client.clientId,
+        ...signIn,
+        ...idToken.nonce ? { nonce: idToken.nonce } : {},
+        at_hash: halfHash(accessToken),
+        preferred_username: user.username,
+        ...user.userInfo
+      }).setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: "JWT" }).setIssuer(this.issuer).setAudience(client.clientId).setSubject(user.sub).setIssuedAt(now).setExpirationTime(now + this.lifetime).sign(this.signingKey);
+      body.id_token = encryption && encryption.idTokens !== false ? await encryptTo(signed, encryption) : signed;
+    }
+    return { status: 200, body };
+  }
+  async introspect(recorded, form) {
+    const client = await this.authenticate(recorded, form);
+    if ("status" in client) return client;
+    const issued = this.issued.get(form.token ?? "");
+    const now = Math.floor(Date.now() / 1e3);
+    const refresh = this.refreshTokens.get(form.token ?? "");
+    if (refresh)
+      return refresh.clientId === client.clientId ? {
+        status: 200,
+        body: {
+          active: true,
+          token_type: "Refresh",
+          client_id: refresh.clientId,
+          sub: refresh.sub,
+          exp: refresh.expiresAt,
+          ...refresh.scope ? { scope: refresh.scope } : {},
+          ...refresh.sid ? { sid: refresh.sid } : {}
+        }
+      } : { status: 200, body: { active: false } };
+    if (!issued || issued.revoked || (issued.claims.exp ?? 0) <= now) return { status: 200, body: { active: false } };
+    const audiences = [issued.claims.aud ?? []].flat();
+    const allowed = issued.clientId === client.clientId && audiences.includes(client.clientId) ? true : audiences.some((audience) => this.clients.get(audience)?.introspectionClients?.includes(client.clientId) || audience === client.clientId);
+    if (!allowed) return { status: 200, body: { active: false } };
+    const { typ, ...claims } = issued.claims;
+    return { status: 200, body: { active: true, token_type: typ ?? "Bearer", username: claims.preferred_username, ...claims } };
+  }
+  async revoke(recorded, form) {
+    const client = await this.authenticate(recorded, form);
+    if ("status" in client) return client;
+    this.revokeToken(form.token ?? "");
+    this.refreshTokens.delete(form.token ?? "");
+    return { status: 200 };
+  }
+  async device(recorded, form) {
+    const client = await this.authenticate(recorded, form);
+    if ("status" in client) return client;
+    const deviceCode = randomUUID();
+    this.devicePolls.set(deviceCode, 0);
+    return {
+      status: 200,
+      body: {
+        device_code: deviceCode,
+        user_code: "WDJB-MJHT",
+        verification_uri: `${this.issuer}/device`,
+        verification_uri_complete: `${this.issuer}/device?user_code=WDJB-MJHT`,
+        expires_in: 600,
+        interval: 5
+      }
+    };
+  }
+  async userInfo(headers, response) {
+    const token = headers.authorization?.replace(/^Bearer\s+/i, "");
+    const issued = token ? this.issued.get(token) : void 0;
+    if (!issued || issued.revoked)
+      return send(response, {
+        status: 401,
+        headers: { "www-authenticate": 'Bearer error="invalid_token", error_description="The access token is not valid."' }
+      });
+    const user = [...this.users.values()].find((candidate) => candidate.sub === issued.claims.sub);
+    const claims = { sub: issued.claims.sub, ...user?.userInfo };
+    if (!this.userInfoAsJwt) return send(response, { status: 200, body: claims });
+    const now = Math.floor(Date.now() / 1e3);
+    const signed = await new SignJWT(claims).setProtectedHeader({ alg: "RS256", kid: this.keyId }).setIssuer(this.issuer).setAudience(issued.clientId).setIssuedAt(now).setExpirationTime(now + this.lifetime).sign(this.signingKey);
+    const encryption = this.clients.get(issued.clientId)?.encryption;
+    const jwt = encryption && encryption.userInfo !== false ? await encryptTo(signed, encryption) : signed;
+    response.writeHead(200, { "content-type": "application/jwt" });
+    response.end(jwt);
+  }
+  requireUser(username) {
+    const user = this.users.get(username);
+    if (!user) throw new Error(`The fake has no user ${username}.`);
+    return user;
+  }
+};
+function endpointOf(path) {
+  if (path.endsWith("/token")) return "token";
+  if (path.endsWith("/introspect")) return "introspect";
+  if (path.endsWith("/revoke")) return "revoke";
+  if (path.endsWith("/userinfo")) return "userinfo";
+  if (path.endsWith("/auth/device")) return "device";
+  if (path.endsWith("/openid-configuration")) return "discovery";
+  if (path.endsWith("/auth")) return "authorize";
+  if (path.endsWith("/logout")) return "logout";
+  return void 0;
+}
+async function encryptTo(signed, encryption) {
+  const algorithm = encryption.algorithm ?? "RSA-OAEP-256";
+  const key = await importJWK({ ...encryption.key, alg: algorithm, use: "enc", key_ops: void 0 }, algorithm);
+  return new CompactEncrypt(new TextEncoder().encode(signed)).setProtectedHeader({ alg: algorithm, enc: encryption.encryptionMethod ?? "A256CBC-HS512", typ: "JWE", cty: "JWT", ...encryption.key.kid ? { kid: encryption.key.kid } : {} }).encrypt(key);
+}
+function verifiesChallenge(verifier, challenge, method) {
+  if (!verifier) return false;
+  return method === "S256" ? createHash("sha256").update(verifier, "ascii").digest("base64url") === challenge : verifier === challenge;
+}
+function halfHash(value) {
+  return createHash("sha256").update(value, "ascii").digest().subarray(0, 16).toString("base64url");
+}
+function send(response, answer) {
+  const headers = { ...answer.headers };
+  if (answer.body !== void 0) headers["content-type"] ??= "application/json";
+  response.writeHead(answer.status, headers);
+  response.end(answer.body === void 0 ? void 0 : JSON.stringify(answer.body));
+}
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    request.on("data", (chunk) => chunks.push(chunk));
+    request.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    request.on("error", reject);
+  });
+}
+
+// src/manual-clock.ts
+var ManualClock = class {
+  /** Every `sleep` asked for, in milliseconds. */
+  sleeps = [];
+  time;
+  /**
+   * @param start Milliseconds since the epoch. Defaults to the current time.
+   */
+  constructor(start = Date.now()) {
+    this.time = start;
+  }
+  now() {
+    return this.time;
+  }
+  sleep(ms, signal) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    this.sleeps.push(ms);
+    this.time += ms;
+    return Promise.resolve();
+  }
+  /** Moves the clock forward. */
+  advance(ms) {
+    this.time += ms;
+  }
+  /** Sets the clock. */
+  set(ms) {
+    this.time = ms;
+  }
+};
+async function createWebhookDelivery(type, data, secret, options = {}) {
+  const timestamp = options.timestamp ?? Date.now();
+  const id = options.id ?? randomUUID();
+  const event = {
+    id,
+    type,
+    created_at: Math.floor(timestamp / 1e3),
+    ...options.realmId ? { realm_id: options.realmId } : {},
+    ...options.clientId ? { client_id: options.clientId } : {},
+    data
+  };
+  const body = JSON.stringify(event);
+  const headers = {
+    "content-type": "application/json",
+    [AuthioWebhookHeaders.Signature]: await computeWebhookSignatureHeader(body, secret, timestamp),
+    [AuthioWebhookHeaders.Event]: type
+  };
+  if (options.sendEventIdHeader ?? true) headers[AuthioWebhookHeaders.EventId] = id;
+  return { body, headers, event };
+}
+
+export { FakeAuthio, ManualClock, createWebhookDelivery };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map