@hyper.authio/testing 0.1.1 → 0.8.0

package/dist/index.d.cts

@@ -2,20 +2,86 @@ import { JWK } from 'jose';
 import { AuthioClock } from '@hyper.authio/client';
 
 /**
- * A client registered in the fake.
+ * How the fake encrypts what it issues to a client, as Authio does once the client registered an encryption key.
+ */
+interface FakeAuthioClientEncryption {
+    /** The client's public encryption key (RSA). */
+    key: JWK;
+    /** Defaults to `RSA-OAEP-256`. */
+    algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
+    /** Defaults to `A256CBC-HS512`. */
+    encryptionMethod?: "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
+    /** Encrypts the client's access tokens (nested JWT). */
+    accessTokens?: boolean;
+    /** Encrypts the client's ID tokens. Defaults to `true`. */
+    idTokens?: boolean;
+    /** Encrypts UserInfo answered as a JWT. Defaults to `true`. */
+    userInfo?: boolean;
+    /** Encrypts back-channel logout tokens. */
+    logoutTokens?: boolean;
+}
+/**
+ * How a client authenticates to the token, introspection, revocation and device endpoints, as registered in Authio.
+ */
+type FakeAuthioTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+/**
+ * The algorithm Authio signs every token of a client with: the realm's RSA key, or the client secret (HS*).
+ */
+type FakeAuthioSigningAlgorithm = "RS256" | "HS256" | "HS384" | "HS512";
+/**
+ * A client registered in the fake, configured as a client is in Authio's console. What the client requires is
+ * enforced as Authio enforces it: a request that does not match is refused with an error naming the setting, and
+ * what the client does not require is accepted (PKCE sent voluntarily, a secret sent by a public client).
  */
 interface FakeAuthioClient {
     clientId: string;
-    /** For `client_secret_basic` and `client_secret_post`. */
+    /** For `client_secret_basic` and `client_secret_post`, and the key of HS* signatures. */
     clientSecret?: string;
     /** The public JWK `private_key_jwt` assertions are verified with. */
     publicKey?: JWK;
+    /**
+     * How the client must authenticate; another method is refused with `invalid_client`, except a secret sent by a
+     * `none` client, which is ignored. Defaults to `client_secret_basic` with a `clientSecret`, `private_key_jwt` with
+     * only a `publicKey`, and `none` with neither.
+     */
+    tokenEndpointAuthMethod?: FakeAuthioTokenEndpointAuthMethod;
+    /**
+     * Refuses an authorization request without `code_challenge` (Authio's "PKCE" switch). Defaults to `true`, as Authio
+     * creates clients; set `false` for a client with PKCE off.
+     */
+    requirePkce?: boolean;
+    /**
+     * The PKCE methods accepted, required or not: a `code_challenge` with another method is refused. Defaults to
+     * `["S256"]`, as Authio creates clients.
+     */
+    pkceMethods?: ("S256" | "plain")[];
+    /**
+     * The algorithm the client's ID tokens, signed UserInfo and logout tokens are signed with. Defaults to `RS256`. HS*
+     * needs a `clientSecret` of at least 32, 48 or 64 bytes (RFC 7518 §3.2), as Authio requires.
+     */
+    signingAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** The algorithm the client's access tokens are signed with, Authio's second setting. Defaults to `RS256`. */
+    accessTokenSigningAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** Issues a new ID token with every refresh. Defaults to `false`. */
+    issueIdTokenOnRefresh?: boolean;
     /** Scopes granted when a request names none. */
     defaultScopes?: string[];
     /** Extra claims put into every access token issued to the client. */
     claims?: Record<string, unknown>;
     /** The client this one's tokens are introspectable by, besides itself (a resource server's introspection client). */
     introspectionClients?: string[];
+    /** The redirect URIs the authorization endpoint accepts. Any when absent. */
+    redirectUris?: string[];
+    /** The post-logout redirect URIs the end-session endpoint accepts. Any when absent. */
+    postLogoutRedirectUris?: string[];
+    /** Where back-channel logout tokens are posted when a session of the client ends. */
+    backchannelLogoutUri?: string;
+    /** The page loaded (here: fetched) when a session of the client ends (front-channel logout). */
+    frontchannelLogoutUri?: string;
+    /** Adds `iss` and `sid` to the front-channel logout URI. Defaults to `false`. */
+    frontchannelLogoutSessionRequired?: boolean;
+    /** Encrypts what is issued to the client. */
+    encryption?: FakeAuthioClientEncryption;
 }
 /**
  * A person the fake knows, for the password grant, authorization codes and UserInfo.
@@ -28,6 +94,23 @@ interface FakeAuthioUser {
     claims?: Record<string, unknown>;
     /** What UserInfo answers besides `sub`. */
     userInfo?: Record<string, unknown>;
+    /** The sign-in's methods. Defaults to `["pwd"]`. */
+    amr?: string[];
+    /** The sign-in's level. Defaults to `1`, or the `acr_values` asked for. */
+    acr?: string;
+}
+/**
+ * A personal access token the fake accepts with the `personal_access_token` grant.
+ */
+interface FakeAuthioPersonalAccessToken {
+    /** The `pat_…` value. */
+    token: string;
+    /** The credential's id, the token's `sub`. */
+    sub: string;
+    /** The consumer's client, for a consumer's token; the `authio` client of an account otherwise. */
+    clientId?: string;
+    /** Claims added to the access token. */
+    claims?: Record<string, unknown>;
 }
 /**
  * An error the fake answers a request with.
@@ -45,9 +128,40 @@ interface FakeAuthioRecordedRequest {
     path: string;
     headers: Record<string, string>;
     form: Record<string, string>;
+    /** The query parameters. */
+    query: Record<string, string>;
     /** The client the request authenticated as, when it did. */
     clientId?: string;
 }
+/**
+ * A back-channel logout token the fake posted to a client.
+ */
+interface FakeAuthioBackchannelDelivery {
+    clientId: string;
+    uri: string;
+    logoutToken: string;
+    /** The HTTP status the client answered, or 0 when it could not be reached. */
+    status: number;
+}
+/**
+ * A front-channel logout page the fake loaded for a client.
+ */
+interface FakeAuthioFrontchannelDelivery {
+    clientId: string;
+    /** The URL loaded, with `iss` and `sid` when the client requires the session. */
+    url: string;
+    /** The HTTP status the client answered, or 0 when it could not be reached. */
+    status: number;
+}
+/**
+ * The parameters an authorization ended with, as the fake sent them back.
+ */
+interface FakeAuthioAuthorizationOutcome {
+    /** `code`, `state` and `iss`, or `error`, `error_description`, `state` and `iss`. */
+    parameters: Record<string, string>;
+    /** The redirect URI with the parameters, for `response_mode=query`. */
+    callbackUrl: string | undefined;
+}
 /**
  * What the device flow answers to successive polls.
  */
@@ -62,6 +176,14 @@ interface FakeAuthioOptions {
     accessTokenLifetime?: number;
     clients?: FakeAuthioClient[];
     users?: FakeAuthioUser[];
+    personalAccessTokens?: FakeAuthioPersonalAccessToken[];
+    /**
+     * The clock tokens are issued and checked with (milliseconds since the epoch), such as the `ManualClock` the
+     * library under test uses. Defaults to the system clock.
+     */
+    clock?: {
+        now(): number;
+    };
 }
 /**
  * Options of a token minted directly.
@@ -82,34 +204,56 @@ interface FakeAuthioTokenOptions {
     issuer?: string;
     /** Signs with another key, so the signature does not verify. */
     untrusted?: boolean;
+    /** Encrypts the token (nested JWT) to this public key, as Authio does for a client with an encryption key. */
+    encryptTo?: {
+        key: JWK;
+        algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
+        encryptionMethod?: string;
+    };
 }
+type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery" | "authorize" | "logout";
 /**
- * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, token (client credentials,
- * authorization code, refresh, token exchange, password, device code), introspection, revocation, UserInfo and
- * device authorization.
+ * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, authorization (PKCE required or not and its
+ * allowed methods, `state`, `nonce`, `prompt`, `max_age`, `acr_values`, `response_mode` query or web_message, RFC 9207
+ * `iss`), token (client credentials, authorization code with ID tokens, refresh, token exchange, password, device code,
+ * personal access token) with the client's exact authentication method, introspection, revocation, UserInfo, device
+ * authorization, end session, back-channel and front-channel logout delivery, tokens signed RS256 or HS* with the
+ * client secret, and JWE (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
  */
 declare class FakeAuthio {
     /** Every request received, in order. */
     readonly requests: FakeAuthioRecordedRequest[];
     /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */
-    readonly failures: Map<"token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery", FakeAuthioError[]>;
+    readonly failures: Map<Endpoint, FakeAuthioError[]>;
+    /** Every back-channel logout token posted, in order. */
+    readonly backchannelDeliveries: FakeAuthioBackchannelDelivery[];
+    /** Every front-channel logout page loaded, in order. */
+    readonly frontchannelDeliveries: FakeAuthioFrontchannelDelivery[];
     /** What successive device-code polls answer; the last value repeats. Defaults to `["approved"]`. */
     deviceOutcomes: FakeAuthioDeviceOutcome[];
     /** Overrides the discovery document's issuer, to test the mismatch check. */
     discoveryIssuer: string | undefined;
-    /** Answers UserInfo as `application/jwt`, signed by the realm key. */
+    /** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */
     userInfoAsJwt: boolean;
+    /** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */
+    omitAuthorizationIssuer: boolean;
     /** Answers connected-account exchanges. Defaults to granting a token for the provider. */
     connectionResponder: ((form: Record<string, string>) => FakeAuthioError | Record<string, unknown>) | undefined;
+    /** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */
+    signInAs: string | undefined;
     private readonly clients;
     private readonly users;
+    private readonly personalAccessTokens;
     private readonly codes;
     private readonly refreshTokens;
     private readonly issued;
     private readonly devicePolls;
     private readonly lifetime;
+    private readonly clock;
+    private session;
     private server;
     private signingKey;
+    private verificationKey;
     private untrustedKey;
     private publicJwk;
     private baseUrl;
@@ -128,10 +272,20 @@ declare class FakeAuthio {
     get jwks(): {
         keys: JWK[];
     };
+    /** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */
+    get currentSession(): {
+        sub: string;
+        sid: string;
+        authTime: number;
+    } | undefined;
     /** Registers a client. */
     addClient(client: FakeAuthioClient): void;
     /** Registers a person. */
     addUser(user: FakeAuthioUser): void;
+    /** Registers a personal access token. */
+    addPersonalAccessToken(token: FakeAuthioPersonalAccessToken): void;
+    /** Ends the signed-in session without notifying anyone, as if it expired. */
+    endSession(): void;
     /**
      * Registers an authorization code for a person, as the authorization endpoint would after sign-in.
      */
@@ -142,13 +296,58 @@ declare class FakeAuthio {
         scope?: string;
         codeChallengeVerifier?: string;
         resource?: string;
+        nonce?: string;
     }): string;
+    /**
+     * Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what
+     * Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.
+     */
+    authorize(authorizationUrl: string): Promise<FakeAuthioAuthorizationOutcome>;
     /**
      * Mints an access token signed by the realm key, recorded so introspection and revocation know it.
      */
     issueAccessToken(options?: FakeAuthioTokenOptions): Promise<string>;
-    /** Marks a token revoked, as Authio would after a sign-out. */
+    /**
+     * Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`
+     * removes one) and `type` the header `typ`, to build invalid ones in tests.
+     */
+    createLogoutToken(options: {
+        clientId: string;
+        sub?: string;
+        sid?: string;
+        type?: string;
+        overrides?: Record<string, unknown>;
+    }): Promise<string>;
+    /**
+     * Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.
+     *
+     * @returns The HTTP status the client answered, or 0 when it could not be reached.
+     */
+    deliverBackchannelLogout(clientId: string, options?: {
+        sub?: string;
+        sid?: string;
+    }): Promise<number>;
+    /**
+     * The front-channel logout URL of a client for a session: its `frontchannelLogoutUri`, with `iss` and `sid` when the
+     * client requires the session.
+     */
+    frontchannelLogoutUrl(clientId: string, sid: string): string;
+    /**
+     * Loads the client's front-channel logout page, as the browser does in an iframe when Authio ends a session.
+     *
+     * @returns The HTTP status the client answered, or 0 when it could not be reached.
+     */
+    deliverFrontchannelLogout(clientId: string, options: {
+        sid: string;
+        headers?: Record<string, string>;
+    }): Promise<number>;
+    /** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */
     revokeToken(token: string): void;
+    /** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */
+    revokeRefreshTokens(options: {
+        sub?: string;
+        sid?: string;
+    }): void;
     /** Forgets the recorded requests. */
     clearRequests(): void;
     /** The recorded requests to one endpoint path suffix, such as `/token`. */
@@ -158,6 +357,8 @@ declare class FakeAuthio {
     private listen;
     private handle;
     private discovery;
+    private authorizeEndpoint;
+    private endSessionEndpoint;
     private authenticate;
     private token;
     private tokenAnswer;
@@ -165,6 +366,9 @@ declare class FakeAuthio {
     private revoke;
     private device;
     private userInfo;
+    private nowSeconds;
+    private sign;
+    private verificationKeyFor;
     private requireUser;
 }
 
@@ -212,4 +416,4 @@ declare function createWebhookDelivery(type: string, data: unknown, secret: stri
     sendEventIdHeader?: boolean;
 }): Promise<FakeWebhookDelivery>;
 
-export { FakeAuthio, type FakeAuthioClient, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioOptions, type FakeAuthioRecordedRequest, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
+export { FakeAuthio, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };

package/dist/index.d.ts

@@ -2,20 +2,86 @@ import { JWK } from 'jose';
 import { AuthioClock } from '@hyper.authio/client';
 
 /**
- * A client registered in the fake.
+ * How the fake encrypts what it issues to a client, as Authio does once the client registered an encryption key.
+ */
+interface FakeAuthioClientEncryption {
+    /** The client's public encryption key (RSA). */
+    key: JWK;
+    /** Defaults to `RSA-OAEP-256`. */
+    algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
+    /** Defaults to `A256CBC-HS512`. */
+    encryptionMethod?: "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
+    /** Encrypts the client's access tokens (nested JWT). */
+    accessTokens?: boolean;
+    /** Encrypts the client's ID tokens. Defaults to `true`. */
+    idTokens?: boolean;
+    /** Encrypts UserInfo answered as a JWT. Defaults to `true`. */
+    userInfo?: boolean;
+    /** Encrypts back-channel logout tokens. */
+    logoutTokens?: boolean;
+}
+/**
+ * How a client authenticates to the token, introspection, revocation and device endpoints, as registered in Authio.
+ */
+type FakeAuthioTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_post" | "private_key_jwt" | "none";
+/**
+ * The algorithm Authio signs every token of a client with: the realm's RSA key, or the client secret (HS*).
+ */
+type FakeAuthioSigningAlgorithm = "RS256" | "HS256" | "HS384" | "HS512";
+/**
+ * A client registered in the fake, configured as a client is in Authio's console. What the client requires is
+ * enforced as Authio enforces it: a request that does not match is refused with an error naming the setting, and
+ * what the client does not require is accepted (PKCE sent voluntarily, a secret sent by a public client).
  */
 interface FakeAuthioClient {
     clientId: string;
-    /** For `client_secret_basic` and `client_secret_post`. */
+    /** For `client_secret_basic` and `client_secret_post`, and the key of HS* signatures. */
     clientSecret?: string;
     /** The public JWK `private_key_jwt` assertions are verified with. */
     publicKey?: JWK;
+    /**
+     * How the client must authenticate; another method is refused with `invalid_client`, except a secret sent by a
+     * `none` client, which is ignored. Defaults to `client_secret_basic` with a `clientSecret`, `private_key_jwt` with
+     * only a `publicKey`, and `none` with neither.
+     */
+    tokenEndpointAuthMethod?: FakeAuthioTokenEndpointAuthMethod;
+    /**
+     * Refuses an authorization request without `code_challenge` (Authio's "PKCE" switch). Defaults to `true`, as Authio
+     * creates clients; set `false` for a client with PKCE off.
+     */
+    requirePkce?: boolean;
+    /**
+     * The PKCE methods accepted, required or not: a `code_challenge` with another method is refused. Defaults to
+     * `["S256"]`, as Authio creates clients.
+     */
+    pkceMethods?: ("S256" | "plain")[];
+    /**
+     * The algorithm the client's ID tokens, signed UserInfo and logout tokens are signed with. Defaults to `RS256`. HS*
+     * needs a `clientSecret` of at least 32, 48 or 64 bytes (RFC 7518 §3.2), as Authio requires.
+     */
+    signingAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** The algorithm the client's access tokens are signed with, Authio's second setting. Defaults to `RS256`. */
+    accessTokenSigningAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** Issues a new ID token with every refresh. Defaults to `false`. */
+    issueIdTokenOnRefresh?: boolean;
     /** Scopes granted when a request names none. */
     defaultScopes?: string[];
     /** Extra claims put into every access token issued to the client. */
     claims?: Record<string, unknown>;
     /** The client this one's tokens are introspectable by, besides itself (a resource server's introspection client). */
     introspectionClients?: string[];
+    /** The redirect URIs the authorization endpoint accepts. Any when absent. */
+    redirectUris?: string[];
+    /** The post-logout redirect URIs the end-session endpoint accepts. Any when absent. */
+    postLogoutRedirectUris?: string[];
+    /** Where back-channel logout tokens are posted when a session of the client ends. */
+    backchannelLogoutUri?: string;
+    /** The page loaded (here: fetched) when a session of the client ends (front-channel logout). */
+    frontchannelLogoutUri?: string;
+    /** Adds `iss` and `sid` to the front-channel logout URI. Defaults to `false`. */
+    frontchannelLogoutSessionRequired?: boolean;
+    /** Encrypts what is issued to the client. */
+    encryption?: FakeAuthioClientEncryption;
 }
 /**
  * A person the fake knows, for the password grant, authorization codes and UserInfo.
@@ -28,6 +94,23 @@ interface FakeAuthioUser {
     claims?: Record<string, unknown>;
     /** What UserInfo answers besides `sub`. */
     userInfo?: Record<string, unknown>;
+    /** The sign-in's methods. Defaults to `["pwd"]`. */
+    amr?: string[];
+    /** The sign-in's level. Defaults to `1`, or the `acr_values` asked for. */
+    acr?: string;
+}
+/**
+ * A personal access token the fake accepts with the `personal_access_token` grant.
+ */
+interface FakeAuthioPersonalAccessToken {
+    /** The `pat_…` value. */
+    token: string;
+    /** The credential's id, the token's `sub`. */
+    sub: string;
+    /** The consumer's client, for a consumer's token; the `authio` client of an account otherwise. */
+    clientId?: string;
+    /** Claims added to the access token. */
+    claims?: Record<string, unknown>;
 }
 /**
  * An error the fake answers a request with.
@@ -45,9 +128,40 @@ interface FakeAuthioRecordedRequest {
     path: string;
     headers: Record<string, string>;
     form: Record<string, string>;
+    /** The query parameters. */
+    query: Record<string, string>;
     /** The client the request authenticated as, when it did. */
     clientId?: string;
 }
+/**
+ * A back-channel logout token the fake posted to a client.
+ */
+interface FakeAuthioBackchannelDelivery {
+    clientId: string;
+    uri: string;
+    logoutToken: string;
+    /** The HTTP status the client answered, or 0 when it could not be reached. */
+    status: number;
+}
+/**
+ * A front-channel logout page the fake loaded for a client.
+ */
+interface FakeAuthioFrontchannelDelivery {
+    clientId: string;
+    /** The URL loaded, with `iss` and `sid` when the client requires the session. */
+    url: string;
+    /** The HTTP status the client answered, or 0 when it could not be reached. */
+    status: number;
+}
+/**
+ * The parameters an authorization ended with, as the fake sent them back.
+ */
+interface FakeAuthioAuthorizationOutcome {
+    /** `code`, `state` and `iss`, or `error`, `error_description`, `state` and `iss`. */
+    parameters: Record<string, string>;
+    /** The redirect URI with the parameters, for `response_mode=query`. */
+    callbackUrl: string | undefined;
+}
 /**
  * What the device flow answers to successive polls.
  */
@@ -62,6 +176,14 @@ interface FakeAuthioOptions {
     accessTokenLifetime?: number;
     clients?: FakeAuthioClient[];
     users?: FakeAuthioUser[];
+    personalAccessTokens?: FakeAuthioPersonalAccessToken[];
+    /**
+     * The clock tokens are issued and checked with (milliseconds since the epoch), such as the `ManualClock` the
+     * library under test uses. Defaults to the system clock.
+     */
+    clock?: {
+        now(): number;
+    };
 }
 /**
  * Options of a token minted directly.
@@ -82,34 +204,56 @@ interface FakeAuthioTokenOptions {
     issuer?: string;
     /** Signs with another key, so the signature does not verify. */
     untrusted?: boolean;
+    /** Encrypts the token (nested JWT) to this public key, as Authio does for a client with an encryption key. */
+    encryptTo?: {
+        key: JWK;
+        algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
+        encryptionMethod?: string;
+    };
 }
+type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery" | "authorize" | "logout";
 /**
- * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, token (client credentials,
- * authorization code, refresh, token exchange, password, device code), introspection, revocation, UserInfo and
- * device authorization.
+ * An in-memory Authio realm served over HTTP on loopback: discovery, JWKS, authorization (PKCE required or not and its
+ * allowed methods, `state`, `nonce`, `prompt`, `max_age`, `acr_values`, `response_mode` query or web_message, RFC 9207
+ * `iss`), token (client credentials, authorization code with ID tokens, refresh, token exchange, password, device code,
+ * personal access token) with the client's exact authentication method, introspection, revocation, UserInfo, device
+ * authorization, end session, back-channel and front-channel logout delivery, tokens signed RS256 or HS* with the
+ * client secret, and JWE (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
  */
 declare class FakeAuthio {
     /** Every request received, in order. */
     readonly requests: FakeAuthioRecordedRequest[];
     /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */
-    readonly failures: Map<"token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery", FakeAuthioError[]>;
+    readonly failures: Map<Endpoint, FakeAuthioError[]>;
+    /** Every back-channel logout token posted, in order. */
+    readonly backchannelDeliveries: FakeAuthioBackchannelDelivery[];
+    /** Every front-channel logout page loaded, in order. */
+    readonly frontchannelDeliveries: FakeAuthioFrontchannelDelivery[];
     /** What successive device-code polls answer; the last value repeats. Defaults to `["approved"]`. */
     deviceOutcomes: FakeAuthioDeviceOutcome[];
     /** Overrides the discovery document's issuer, to test the mismatch check. */
     discoveryIssuer: string | undefined;
-    /** Answers UserInfo as `application/jwt`, signed by the realm key. */
+    /** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */
     userInfoAsJwt: boolean;
+    /** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */
+    omitAuthorizationIssuer: boolean;
     /** Answers connected-account exchanges. Defaults to granting a token for the provider. */
     connectionResponder: ((form: Record<string, string>) => FakeAuthioError | Record<string, unknown>) | undefined;
+    /** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */
+    signInAs: string | undefined;
     private readonly clients;
     private readonly users;
+    private readonly personalAccessTokens;
     private readonly codes;
     private readonly refreshTokens;
     private readonly issued;
     private readonly devicePolls;
     private readonly lifetime;
+    private readonly clock;
+    private session;
     private server;
     private signingKey;
+    private verificationKey;
     private untrustedKey;
     private publicJwk;
     private baseUrl;
@@ -128,10 +272,20 @@ declare class FakeAuthio {
     get jwks(): {
         keys: JWK[];
     };
+    /** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */
+    get currentSession(): {
+        sub: string;
+        sid: string;
+        authTime: number;
+    } | undefined;
     /** Registers a client. */
     addClient(client: FakeAuthioClient): void;
     /** Registers a person. */
     addUser(user: FakeAuthioUser): void;
+    /** Registers a personal access token. */
+    addPersonalAccessToken(token: FakeAuthioPersonalAccessToken): void;
+    /** Ends the signed-in session without notifying anyone, as if it expired. */
+    endSession(): void;
     /**
      * Registers an authorization code for a person, as the authorization endpoint would after sign-in.
      */
@@ -142,13 +296,58 @@ declare class FakeAuthio {
         scope?: string;
         codeChallengeVerifier?: string;
         resource?: string;
+        nonce?: string;
     }): string;
+    /**
+     * Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what
+     * Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.
+     */
+    authorize(authorizationUrl: string): Promise<FakeAuthioAuthorizationOutcome>;
     /**
      * Mints an access token signed by the realm key, recorded so introspection and revocation know it.
      */
     issueAccessToken(options?: FakeAuthioTokenOptions): Promise<string>;
-    /** Marks a token revoked, as Authio would after a sign-out. */
+    /**
+     * Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`
+     * removes one) and `type` the header `typ`, to build invalid ones in tests.
+     */
+    createLogoutToken(options: {
+        clientId: string;
+        sub?: string;
+        sid?: string;
+        type?: string;
+        overrides?: Record<string, unknown>;
+    }): Promise<string>;
+    /**
+     * Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.
+     *
+     * @returns The HTTP status the client answered, or 0 when it could not be reached.
+     */
+    deliverBackchannelLogout(clientId: string, options?: {
+        sub?: string;
+        sid?: string;
+    }): Promise<number>;
+    /**
+     * The front-channel logout URL of a client for a session: its `frontchannelLogoutUri`, with `iss` and `sid` when the
+     * client requires the session.
+     */
+    frontchannelLogoutUrl(clientId: string, sid: string): string;
+    /**
+     * Loads the client's front-channel logout page, as the browser does in an iframe when Authio ends a session.
+     *
+     * @returns The HTTP status the client answered, or 0 when it could not be reached.
+     */
+    deliverFrontchannelLogout(clientId: string, options: {
+        sid: string;
+        headers?: Record<string, string>;
+    }): Promise<number>;
+    /** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */
     revokeToken(token: string): void;
+    /** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */
+    revokeRefreshTokens(options: {
+        sub?: string;
+        sid?: string;
+    }): void;
     /** Forgets the recorded requests. */
     clearRequests(): void;
     /** The recorded requests to one endpoint path suffix, such as `/token`. */
@@ -158,6 +357,8 @@ declare class FakeAuthio {
     private listen;
     private handle;
     private discovery;
+    private authorizeEndpoint;
+    private endSessionEndpoint;
     private authenticate;
     private token;
     private tokenAnswer;
@@ -165,6 +366,9 @@ declare class FakeAuthio {
     private revoke;
     private device;
     private userInfo;
+    private nowSeconds;
+    private sign;
+    private verificationKeyFor;
     private requireUser;
 }
 
@@ -212,4 +416,4 @@ declare function createWebhookDelivery(type: string, data: unknown, secret: stri
     sendEventIdHeader?: boolean;
 }): Promise<FakeWebhookDelivery>;
 
-export { FakeAuthio, type FakeAuthioClient, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioOptions, type FakeAuthioRecordedRequest, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
+export { FakeAuthio, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };