@hyper.authio/testing 0.1.1 → 0.8.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createServer } from 'http';
-import { randomUUID } from 'crypto';
-import { SignJWT, decodeJwt, generateKeyPair, exportJWK, importJWK, jwtVerify } from 'jose';
+import { randomUUID, createHash } from 'crypto';
+import { SignJWT, decodeJwt, generateKeyPair, exportJWK, jwtVerify, importJWK, decodeProtectedHeader, CompactEncrypt } from 'jose';
 import { AuthioWebhookHeaders, computeWebhookSignatureHeader } from '@hyper.authio/client';
 
 // src/fake-authio.ts
@@ -9,23 +9,35 @@ var FakeAuthio = class _FakeAuthio {
   requests = [];
   /** Answers the next requests to an endpoint with these errors, in order, before answering normally. */
   failures = /* @__PURE__ */ new Map();
+  /** Every back-channel logout token posted, in order. */
+  backchannelDeliveries = [];
+  /** Every front-channel logout page loaded, in order. */
+  frontchannelDeliveries = [];
   /** What successive device-code polls answer; the last value repeats. Defaults to `["approved"]`. */
   deviceOutcomes = ["approved"];
   /** Overrides the discovery document's issuer, to test the mismatch check. */
   discoveryIssuer;
-  /** Answers UserInfo as `application/jwt`, signed by the realm key. */
+  /** Answers UserInfo as `application/jwt`, signed by the realm key (and encrypted for a client with a key). */
   userInfoAsJwt = false;
+  /** Leaves `iss` out of authorization responses, to test the RFC 9207 check. */
+  omitAuthorizationIssuer = false;
   /** Answers connected-account exchanges. Defaults to granting a token for the provider. */
   connectionResponder;
+  /** The person the authorization endpoint signs in when the request names none with `login_hint`. Defaults to the first user. */
+  signInAs;
   clients = /* @__PURE__ */ new Map();
   users = /* @__PURE__ */ new Map();
+  personalAccessTokens = /* @__PURE__ */ new Map();
   codes = /* @__PURE__ */ new Map();
   refreshTokens = /* @__PURE__ */ new Map();
   issued = /* @__PURE__ */ new Map();
   devicePolls = /* @__PURE__ */ new Map();
   lifetime;
+  clock;
+  session;
   server;
   signingKey;
+  verificationKey;
   untrustedKey;
   publicJwk;
   baseUrl;
@@ -34,8 +46,10 @@ var FakeAuthio = class _FakeAuthio {
   constructor(options) {
     this.realm = options.realm ?? "fake";
     this.lifetime = options.accessTokenLifetime ?? 300;
-    for (const client of options.clients ?? []) this.clients.set(client.clientId, client);
+    this.clock = options.clock ?? { now: () => Date.now() };
+    for (const client of options.clients ?? []) this.clients.set(client.clientId, checkClient(client));
     for (const user of options.users ?? []) this.users.set(user.username, user);
+    for (const pat of options.personalAccessTokens ?? []) this.personalAccessTokens.set(pat.token, pat);
   }
   /**
    * Starts the fake on a random loopback port.
@@ -57,14 +71,26 @@ var FakeAuthio = class _FakeAuthio {
   get jwks() {
     return { keys: [this.publicJwk] };
   }
+  /** The session the authorization endpoint keeps (one browser), or `undefined` when nobody is signed in. */
+  get currentSession() {
+    return this.session ? { sub: this.session.sub, sid: this.session.sid, authTime: this.session.authTime } : void 0;
+  }
   /** Registers a client. */
   addClient(client) {
-    this.clients.set(client.clientId, client);
+    this.clients.set(client.clientId, checkClient(client));
   }
   /** Registers a person. */
   addUser(user) {
     this.users.set(user.username, user);
   }
+  /** Registers a personal access token. */
+  addPersonalAccessToken(token) {
+    this.personalAccessTokens.set(token.token, token);
+  }
+  /** Ends the signed-in session without notifying anyone, as if it expired. */
+  endSession() {
+    this.session = void 0;
+  }
   /**
    * Registers an authorization code for a person, as the authorization endpoint would after sign-in.
    */
@@ -77,15 +103,32 @@ var FakeAuthio = class _FakeAuthio {
       redirectUri: options.redirectUri,
       scope: options.scope,
       codeVerifier: options.codeChallengeVerifier,
-      resource: options.resource
+      resource: options.resource,
+      nonce: options.nonce
     });
     return code;
   }
+  /**
+   * Follows an authorization URL as a browser would, signing in `signInAs` (or the `login_hint`), and returns what
+   * Authio sent back: the callback URL for `response_mode=query`, the posted message's parameters for `web_message`.
+   */
+  async authorize(authorizationUrl) {
+    const response = await fetch(authorizationUrl, { redirect: "manual" });
+    const location = response.headers.get("location");
+    if (location) {
+      const callback = new URL(location);
+      return { parameters: Object.fromEntries(callback.searchParams), callbackUrl: location };
+    }
+    const html = await response.text();
+    const message = /data-authorization-response='([^']*)'/.exec(html)?.[1];
+    if (!message) throw new Error(`The fake answered the authorization with HTTP ${response.status} and no response.`);
+    return { parameters: JSON.parse(decodeURIComponent(message)), callbackUrl: void 0 };
+  }
   /**
    * Mints an access token signed by the realm key, recorded so introspection and revocation know it.
    */
   async issueAccessToken(options = {}) {
-    const now = Math.floor(Date.now() / 1e3);
+    const now = this.nowSeconds();
     const clientId = options.clientId ?? "fake-client";
     const jti = randomUUID();
     const payload = {
@@ -96,14 +139,101 @@ var FakeAuthio = class _FakeAuthio {
       ...options.sub ? { sub: options.sub } : {},
       ...options.claims
     };
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: "JWT" }).setIssuer(options.issuer ?? this.issuer).setAudience(options.audience ?? clientId).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + (options.expiresIn ?? this.lifetime)).setJti(jti).sign(options.untrusted ? this.untrustedKey : this.signingKey);
-    this.issued.set(token, { claims: decodeJwt(token), clientId, revoked: false });
+    const builder = new SignJWT(payload).setIssuer(options.issuer ?? this.issuer).setAudience(options.audience ?? clientId).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + (options.expiresIn ?? this.lifetime)).setJti(jti);
+    const signed = options.untrusted ? await builder.setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: "JWT" }).sign(this.untrustedKey) : await this.sign(builder, this.clients.get(clientId), "JWT", this.clients.get(clientId)?.accessTokenSigningAlgorithm ?? "RS256");
+    const token = options.encryptTo ? await encryptTo(signed, options.encryptTo) : signed;
+    this.issued.set(token, { claims: decodeJwt(signed), clientId, revoked: false });
     return token;
   }
-  /** Marks a token revoked, as Authio would after a sign-out. */
+  /**
+   * Mints a back-channel logout token for a client, signed by the realm key. `overrides` replaces claims (`undefined`
+   * removes one) and `type` the header `typ`, to build invalid ones in tests.
+   */
+  async createLogoutToken(options) {
+    const now = this.nowSeconds();
+    const payload = {
+      iss: this.issuer,
+      aud: options.clientId,
+      iat: now,
+      exp: now + 120,
+      jti: randomUUID(),
+      ...options.sub ? { sub: options.sub } : {},
+      ...options.sid ? { sid: options.sid } : {},
+      events: { "http://schemas.openid.net/event/backchannel-logout": {} },
+      ...options.overrides
+    };
+    for (const key of Object.keys(payload)) if (payload[key] === void 0) delete payload[key];
+    const signed = await this.sign(new SignJWT(payload), this.clients.get(options.clientId), options.type ?? "logout+jwt");
+    const encryption = this.clients.get(options.clientId)?.encryption;
+    return encryption?.logoutTokens ? encryptTo(signed, encryption) : signed;
+  }
+  /**
+   * Posts a back-channel logout token to the client's `backchannelLogoutUri`, as Authio does when a session ends.
+   *
+   * @returns The HTTP status the client answered, or 0 when it could not be reached.
+   */
+  async deliverBackchannelLogout(clientId, options = {}) {
+    const client = this.clients.get(clientId);
+    if (!client?.backchannelLogoutUri) throw new Error(`The fake client ${clientId} has no backchannelLogoutUri.`);
+    const logoutToken = await this.createLogoutToken({ clientId, sub: options.sub, sid: options.sid });
+    let status = 0;
+    try {
+      const response = await fetch(client.backchannelLogoutUri, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ logout_token: logoutToken }).toString()
+      });
+      status = response.status;
+      await response.arrayBuffer();
+    } catch {
+      status = 0;
+    }
+    this.backchannelDeliveries.push({ clientId, uri: client.backchannelLogoutUri, logoutToken, status });
+    return status;
+  }
+  /**
+   * The front-channel logout URL of a client for a session: its `frontchannelLogoutUri`, with `iss` and `sid` when the
+   * client requires the session.
+   */
+  frontchannelLogoutUrl(clientId, sid) {
+    const client = this.clients.get(clientId);
+    if (!client?.frontchannelLogoutUri) throw new Error(`The fake client ${clientId} has no frontchannelLogoutUri.`);
+    const url = new URL(client.frontchannelLogoutUri);
+    if (client.frontchannelLogoutSessionRequired) {
+      url.searchParams.set("iss", this.issuer);
+      url.searchParams.set("sid", sid);
+    }
+    return url.toString();
+  }
+  /**
+   * Loads the client's front-channel logout page, as the browser does in an iframe when Authio ends a session.
+   *
+   * @returns The HTTP status the client answered, or 0 when it could not be reached.
+   */
+  async deliverFrontchannelLogout(clientId, options) {
+    const url = this.frontchannelLogoutUrl(clientId, options.sid);
+    let status = 0;
+    try {
+      const response = await fetch(url, { headers: options.headers, redirect: "manual" });
+      status = response.status;
+      await response.arrayBuffer();
+    } catch {
+      status = 0;
+    }
+    this.frontchannelDeliveries.push({ clientId, url, status });
+    return status;
+  }
+  /** Marks a token revoked, as Authio would after a sign-out: an access token, or a refresh token, which is then forgotten. */
   revokeToken(token) {
     const issued = this.issued.get(token);
     if (issued) issued.revoked = true;
+    this.refreshTokens.delete(token);
+  }
+  /** Revokes every refresh token of a person, or of one Authio session (`sid`), as Authio does when a session ends. */
+  revokeRefreshTokens(options) {
+    for (const [token, refresh] of this.refreshTokens)
+      if (options.sid !== void 0 && refresh.sid === options.sid || options.sid === void 0 && options.sub !== void 0 && refresh.sub === options.sub)
+        this.refreshTokens.delete(token);
   }
   /** Forgets the recorded requests. */
   clearRequests() {
@@ -124,6 +254,7 @@ var FakeAuthio = class _FakeAuthio {
     const pair = await generateKeyPair("RS256", { extractable: true });
     const untrusted = await generateKeyPair("RS256");
     this.signingKey = pair.privateKey;
+    this.verificationKey = pair.publicKey;
     this.untrustedKey = untrusted.privateKey;
     this.publicJwk = { ...await exportJWK(pair.publicKey), kid: this.keyId, alg: "RS256", use: "sig" };
     this.server = createServer((request, response) => {
@@ -139,7 +270,8 @@ var FakeAuthio = class _FakeAuthio {
     const body = await readBody(request);
     const form = Object.fromEntries(new URLSearchParams(request.headers["content-type"]?.includes("form") ? body : ""));
     const headers = Object.fromEntries(Object.entries(request.headers).map(([name, value]) => [name, Array.isArray(value) ? value.join(", ") : value ?? ""]));
-    const recorded = { method: request.method ?? "GET", path: url.pathname, headers, form };
+    const query = Object.fromEntries(url.searchParams);
+    const recorded = { method: request.method ?? "GET", path: url.pathname, headers, form, query };
     this.requests.push(recorded);
     const prefix = `/realms/${this.realm}`;
     const path = url.pathname.startsWith(prefix) ? url.pathname.slice(prefix.length) : url.pathname;
@@ -151,6 +283,8 @@ var FakeAuthio = class _FakeAuthio {
         return send(response, { status: 200, body: this.discovery() });
       case "/protocol/openid-connect/certs":
         return send(response, { status: 200, body: this.jwks });
+      case "/protocol/openid-connect/auth":
+        return this.authorizeEndpoint(query, response);
       case "/protocol/openid-connect/token":
         return send(response, await this.token(recorded, form));
       case "/protocol/openid-connect/token/introspect":
@@ -161,6 +295,8 @@ var FakeAuthio = class _FakeAuthio {
         return this.userInfo(headers, response);
       case "/protocol/openid-connect/auth/device":
         return send(response, await this.device(recorded, form));
+      case "/protocol/openid-connect/logout":
+        return this.endSessionEndpoint(query, response);
       default:
         return send(response, { status: 404, body: { error: "not_found" } });
     }
@@ -177,46 +313,211 @@ var FakeAuthio = class _FakeAuthio {
       end_session_endpoint: `${base}/logout`,
       device_authorization_endpoint: `${base}/auth/device`,
       jwks_uri: `${base}/certs`,
-      grant_types_supported: ["authorization_code", "refresh_token", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "urn:ietf:params:oauth:grant-type:token-exchange"],
+      scopes_supported: ["openid", "profile", "email", "phone", "roles", "offline_access"],
+      response_types_supported: ["code"],
+      response_modes_supported: ["query", "web_message"],
+      grant_types_supported: [
+        "authorization_code",
+        "refresh_token",
+        "client_credentials",
+        "password",
+        "urn:ietf:params:oauth:grant-type:device_code",
+        "urn:ietf:params:oauth:grant-type:token-exchange",
+        "personal_access_token"
+      ],
+      subject_types_supported: ["public"],
+      id_token_signing_alg_values_supported: ["RS256"],
+      id_token_encryption_alg_values_supported: ["RSA-OAEP", "RSA-OAEP-256"],
+      id_token_encryption_enc_values_supported: ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"],
+      userinfo_signing_alg_values_supported: ["RS256"],
+      userinfo_encryption_alg_values_supported: ["RSA-OAEP", "RSA-OAEP-256"],
+      userinfo_encryption_enc_values_supported: ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"],
       token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post", "private_key_jwt", "none"],
-      code_challenge_methods_supported: ["S256"],
-      authorization_response_iss_parameter_supported: true
+      code_challenge_methods_supported: ["S256", "plain"],
+      prompt_values_supported: ["none", "login", "select_account", "consent"],
+      display_values_supported: ["page", "popup"],
+      acr_values_supported: ["1", "2", "3"],
+      backchannel_logout_supported: true,
+      backchannel_logout_session_supported: true,
+      frontchannel_logout_supported: true,
+      frontchannel_logout_session_supported: true,
+      authorization_response_iss_parameter_supported: !this.omitAuthorizationIssuer
+    };
+  }
+  authorizeEndpoint(query, response) {
+    const client = this.clients.get(query.client_id ?? "");
+    if (!client) return send(response, { status: 400, body: { error: "invalid_request", error_description: "Unknown client_id." } });
+    if (!query.redirect_uri || client.redirectUris && !client.redirectUris.includes(query.redirect_uri))
+      return send(response, { status: 400, body: { error: "invalid_request", error_description: "The redirect_uri is not registered." } });
+    const answer = (parameters) => {
+      const values = {};
+      for (const [name, value] of Object.entries({ ...parameters, state: query.state, iss: this.omitAuthorizationIssuer ? void 0 : this.issuer }))
+        if (value !== void 0) values[name] = value;
+      if (query.response_mode === "web_message") {
+        const message = encodeURIComponent(JSON.stringify(values));
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end(
+          `<!doctype html><html><body data-authorization-response='${message}'><script>window.opener&&window.opener.postMessage({type:"authorization_response",response:JSON.parse(decodeURIComponent(document.body.dataset.authorizationResponse))},${JSON.stringify(new URL(query.redirect_uri).origin)});</script></body></html>`
+        );
+        return;
+      }
+      const location = new URL(query.redirect_uri);
+      for (const [name, value] of Object.entries(values)) location.searchParams.set(name, value);
+      response.writeHead(302, { location: location.toString() });
+      response.end();
     };
+    if (query.response_mode !== void 0 && query.response_mode !== "query" && query.response_mode !== "web_message")
+      return answer({ error: "invalid_request", error_description: `The response_mode '${query.response_mode}' is not supported: Authio answers with query or web_message.` });
+    if (query.response_type !== "code") return answer({ error: "unsupported_response_type", error_description: "Only code is supported." });
+    const method = query.code_challenge ? query.code_challenge_method : void 0;
+    const allowedMethods = client.pkceMethods ?? ["S256"];
+    if (query.code_challenge) {
+      if (!method)
+        return answer({ error: "invalid_request", error_description: "code_challenge_method is required with code_challenge: Authio does not assume plain." });
+      if (method !== "S256" && method !== "plain") return answer({ error: "invalid_request", error_description: `The PKCE method '${method}' is not supported.` });
+      if (!allowedMethods.includes(method))
+        return answer({
+          error: "invalid_request",
+          error_description: `The PKCE method '${method}' is not allowed for the client ${client.clientId}, which allows ${allowedMethods.join(", ")} (codeChallengeMethod).`
+        });
+    } else if (client.requirePkce ?? true) {
+      return answer({
+        error: "invalid_request",
+        error_description: `The client ${client.clientId} requires PKCE: send code_challenge and code_challenge_method (checks: ["pkce"]).`
+      });
+    }
+    const prompts = (query.prompt ?? "").split(" ").filter(Boolean);
+    const now = this.nowSeconds();
+    const maxAge = query.max_age !== void 0 ? Number(query.max_age) : void 0;
+    const tooOld = this.session !== void 0 && maxAge !== void 0 && now - this.session.authTime > maxAge;
+    const requestedAcr = (query.acr_values ?? "").split(" ").filter(Boolean).sort().at(-1);
+    const weaker = this.session !== void 0 && requestedAcr !== void 0 && Number(this.session.acr) < Number(requestedAcr);
+    if (prompts.includes("none") && (!this.session || tooOld || weaker)) return answer({ error: "login_required", error_description: "Nobody is signed in." });
+    if (!this.session || prompts.includes("login") || tooOld || weaker || query.login_hint && this.users.get(query.login_hint)?.sub !== this.session.sub) {
+      const username = (query.login_hint && this.users.has(query.login_hint) ? query.login_hint : void 0) ?? this.signInAs ?? this.users.keys().next().value;
+      const user = username ? this.users.get(username) : void 0;
+      if (!user) return answer({ error: "access_denied", error_description: "The fake has no user to sign in." });
+      const acr = requestedAcr ?? user.acr ?? "1";
+      this.session = {
+        sub: user.sub,
+        sid: randomUUID().replace(/-/g, ""),
+        authTime: now,
+        acr,
+        amr: user.amr ?? (Number(acr) >= 2 ? ["pwd", "otp", "mfa"] : ["pwd"]),
+        clients: /* @__PURE__ */ new Set()
+      };
+    }
+    this.session.clients.add(client.clientId);
+    const code = randomUUID();
+    this.codes.set(code, {
+      clientId: client.clientId,
+      sub: this.session.sub,
+      redirectUri: query.redirect_uri,
+      scope: query.scope,
+      codeChallenge: query.code_challenge,
+      codeChallengeMethod: method,
+      resource: query.resource,
+      nonce: query.nonce,
+      sid: this.session.sid,
+      authTime: this.session.authTime,
+      acr: this.session.acr,
+      amr: this.session.amr
+    });
+    answer({ code });
+  }
+  async endSessionEndpoint(query, response) {
+    let clientId = query.client_id;
+    if (query.id_token_hint) {
+      try {
+        const audience = [decodeJwt(query.id_token_hint).aud ?? []].flat()[0];
+        const { payload } = await jwtVerify(query.id_token_hint, this.verificationKeyFor(audience ? this.clients.get(audience) : void 0, query.id_token_hint), {
+          issuer: this.issuer,
+          currentDate: new Date(this.clock.now())
+        });
+        clientId ??= [payload.aud ?? []].flat()[0];
+      } catch {
+        return send(response, { status: 400, body: { error: "invalid_request", error_description: "The id_token_hint is not valid." } });
+      }
+    }
+    const client = clientId ? this.clients.get(clientId) : void 0;
+    const redirect = query.post_logout_redirect_uri;
+    if (redirect && (!client || client.postLogoutRedirectUris && !client.postLogoutRedirectUris.includes(redirect)))
+      return send(response, { status: 400, body: { error: "invalid_request", error_description: "The post_logout_redirect_uri is not registered." } });
+    const ended = this.session;
+    this.session = void 0;
+    if (ended) this.revokeRefreshTokens({ sid: ended.sid });
+    if (ended)
+      for (const id of ended.clients) {
+        if (this.clients.get(id)?.backchannelLogoutUri) await this.deliverBackchannelLogout(id, { sub: ended.sub, sid: ended.sid });
+        if (this.clients.get(id)?.frontchannelLogoutUri) await this.deliverFrontchannelLogout(id, { sid: ended.sid });
+      }
+    if (!redirect) {
+      response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      response.end("<!doctype html><p>You are signed out.</p>");
+      return;
+    }
+    const location = new URL(redirect);
+    if (query.state) location.searchParams.set("state", query.state);
+    response.writeHead(302, { location: location.toString() });
+    response.end();
   }
   async authenticate(recorded, form) {
     const invalid = (description) => ({ status: 401, body: { error: "invalid_client", error_description: description } });
     const authorization = recorded.headers.authorization;
-    let client;
-    if (authorization?.startsWith("Basic ")) {
-      const [id, secret] = Buffer.from(authorization.slice(6), "base64").toString("utf8").split(":").map(decodeURIComponent);
-      client = this.clients.get(id ?? "");
-      if (!client || !client.clientSecret || client.clientSecret !== secret) return invalid("The client credentials are wrong.");
-    } else if (form.client_assertion) {
-      client = this.clients.get(form.client_id ?? "");
-      if (!client?.publicKey) return invalid("The client has no registered key.");
-      if (form.client_assertion_type !== "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") return invalid("Wrong assertion type.");
-      try {
-        const key = await importJWK(client.publicKey, client.publicKey.alg);
-        const { payload } = await jwtVerify(form.client_assertion, key, { issuer: client.clientId, subject: client.clientId, audience: this.issuer });
-        if (!payload.jti) return invalid("The assertion has no jti.");
-      } catch (error) {
-        return invalid(`The assertion does not verify: ${error.message}`);
+    const basic = authorization?.startsWith("Basic ") ? Buffer.from(authorization.slice(6), "base64").toString("utf8").split(":").map(decodeURIComponent) : void 0;
+    const presented = basic ? "client_secret_basic" : form.client_assertion ? "private_key_jwt" : form.client_secret !== void 0 ? "client_secret_post" : "none";
+    const client = this.clients.get((basic ? basic[0] : form.client_id) ?? "");
+    if (!client) return invalid("Unknown client.");
+    if (form.client_assertion && form.client_secret !== void 0) return invalid("A client assertion and a client secret cannot be sent together.");
+    const registered = registeredMethodOf(client);
+    if (presented !== registered && !(registered === "none" && (presented === "client_secret_basic" || presented === "client_secret_post")))
+      return invalid(`The client ${client.clientId} authenticates with ${registered} (tokenEndpointAuthMethod), not ${presented}.`);
+    switch (registered) {
+      case "client_secret_basic":
+        if (!client.clientSecret || client.clientSecret !== basic?.[1]) return invalid("The client credentials are wrong.");
+        break;
+      case "client_secret_post":
+        if (!client.clientSecret || client.clientSecret !== form.client_secret) return invalid("The client credentials are wrong.");
+        break;
+      case "private_key_jwt": {
+        if (!client.publicKey) return invalid("The client has no registered key.");
+        if (form.client_assertion_type !== "urn:ietf:params:oauth:client-assertion-type:jwt-bearer") return invalid("Wrong assertion type.");
+        try {
+          const key = await importJWK(client.publicKey, client.publicKey.alg);
+          const { payload } = await jwtVerify(form.client_assertion, key, {
+            issuer: client.clientId,
+            subject: client.clientId,
+            audience: this.issuer,
+            currentDate: new Date(this.clock.now())
+          });
+          if (!payload.jti) return invalid("The assertion has no jti.");
+        } catch (error) {
+          return invalid(`The assertion does not verify: ${error.message}`);
+        }
+        break;
       }
-    } else if (form.client_secret !== void 0) {
-      client = this.clients.get(form.client_id ?? "");
-      if (!client || client.clientSecret !== form.client_secret) return invalid("The client credentials are wrong.");
-    } else {
-      client = this.clients.get(form.client_id ?? "");
-      if (!client || client.clientSecret || client.publicKey) return invalid("The client must authenticate.");
     }
     recorded.clientId = client.clientId;
     return client;
   }
   async token(recorded, form) {
+    const grant = (error, description) => ({ status: 400, body: { error, error_description: description } });
+    if (form.grant_type === "personal_access_token") {
+      const pat = this.personalAccessTokens.get(form.client_secret ?? "");
+      if (!pat || form.client_id && pat.clientId && form.client_id !== pat.clientId)
+        return { status: 401, body: { error: "invalid_client", error_description: "The personal access token is not valid." } };
+      const clientId = pat.clientId ?? "authio";
+      recorded.clientId = clientId;
+      return this.tokenAnswer(this.clients.get(clientId) ?? { clientId }, {
+        sub: pat.sub,
+        scope: form.scope,
+        audience: form.resource,
+        claims: { amr: "personal_access_token", actor_type: "personal_access_token", credential_id: pat.sub, ...pat.claims }
+      });
+    }
     const client = await this.authenticate(recorded, form);
     if ("status" in client) return client;
     const scope = form.scope ?? client.defaultScopes?.join(" ");
-    const grant = (error, description) => ({ status: 400, body: { error, error_description: description } });
     switch (form.grant_type) {
       case "client_credentials":
         return this.tokenAnswer(client, { sub: client.clientId, scope, audience: form.resource, claims: client.claims });
@@ -229,12 +530,23 @@ var FakeAuthio = class _FakeAuthio {
         const code = this.codes.get(form.code ?? "");
         if (!code || code.clientId !== client.clientId || code.redirectUri !== form.redirect_uri) return grant("invalid_grant", "The code is not valid.");
         if (code.codeVerifier && code.codeVerifier !== form.code_verifier) return grant("invalid_grant", "PKCE verification failed.");
+        if (code.codeChallenge && !form.code_verifier) return grant("invalid_grant", "code_verifier is required: the code was issued with a code_challenge.");
+        if (code.codeChallenge && !verifiesChallenge(form.code_verifier, code.codeChallenge, code.codeChallengeMethod ?? "S256"))
+          return grant("invalid_grant", "PKCE verification failed.");
         this.codes.delete(form.code);
         const user = [...this.users.values()].find((candidate) => candidate.sub === code.sub);
+        const signIn = code.sid ? { sid: code.sid, auth_time: code.authTime, acr: code.acr, amr: code.amr } : { auth_time: this.nowSeconds(), acr: user.acr ?? "1", amr: user.amr ?? ["pwd"] };
         return this.tokenAnswer(
           client,
-          { sub: user.sub, scope: code.scope, audience: form.resource ?? code.resource, claims: { ...client.claims, ...user.claims, preferred_username: user.username } },
-          user
+          {
+            sub: user.sub,
+            scope: code.scope,
+            audience: form.resource ?? code.resource,
+            claims: { ...client.claims, ...user.claims, ...signIn, preferred_username: user.username }
+          },
+          user,
+          void 0,
+          { nonce: code.nonce, signIn }
         );
       }
       case "refresh_token": {
@@ -242,10 +554,13 @@ var FakeAuthio = class _FakeAuthio {
         if (!refresh || refresh.clientId !== client.clientId) return grant("invalid_grant", "The refresh token is not valid.");
         this.refreshTokens.delete(form.refresh_token);
         const user = [...this.users.values()].find((candidate) => candidate.sub === refresh.sub);
+        const signIn = { ...refresh.sid ? { sid: refresh.sid } : {}, ...refresh.authTime ? { auth_time: refresh.authTime } : {} };
         return this.tokenAnswer(
           client,
-          { sub: refresh.sub, scope: form.scope ?? refresh.scope, claims: { ...client.claims, ...user?.claims } },
-          user
+          { sub: refresh.sub, scope: form.scope ?? refresh.scope, claims: { ...client.claims, ...user?.claims, ...signIn } },
+          user,
+          void 0,
+          client.issueIdTokenOnRefresh ? { signIn } : void 0
         );
       }
       case "urn:ietf:params:oauth:grant-type:token-exchange": {
@@ -261,12 +576,12 @@ var FakeAuthio = class _FakeAuthio {
           };
           return "status" in answer && typeof answer.status === "number" ? answer : { status: 200, body: answer };
         }
-        const { iss: _issuer, aud: _audience, exp: _expiry, iat: _issuedAt, nbf: _notBefore, jti: _jti, ...claims } = subject.claims;
+        const { iss: _issuer, aud: _audience, exp: _expiry, iat: _issuedAt, nbf: _notBefore, jti: _jti, scope: _scope, ...claims } = subject.claims;
         return this.tokenAnswer(client, {
           sub: subject.claims.sub,
           scope: form.scope ?? subject.claims.scope,
           audience: form.resource,
-          claims: { ...claims, act: { client_id: client.clientId, sub: client.clientId } }
+          claims: { ...claims, act: { client_id: client.clientId } }
         }, void 0, form.requested_token_type);
       }
       case "urn:ietf:params:oauth:grant-type:device_code": {
@@ -291,13 +606,15 @@ var FakeAuthio = class _FakeAuthio {
         return grant("unsupported_grant_type", `The grant ${form.grant_type} is not supported.`);
     }
   }
-  async tokenAnswer(client, options, user, issuedTokenType) {
+  async tokenAnswer(client, options, user, issuedTokenType, idToken) {
+    const encryption = client.encryption;
     const accessToken = await this.issueAccessToken({
       clientId: client.clientId,
       sub: options.sub,
       scope: options.scope,
       audience: options.audience ?? client.clientId,
-      claims: options.claims
+      claims: options.claims,
+      ...encryption?.accessTokens ? { encryptTo: encryption } : {}
     });
     const body = {
       access_token: accessToken,
@@ -308,16 +625,57 @@ var FakeAuthio = class _FakeAuthio {
     };
     if (user) {
       const refreshToken = randomUUID();
-      this.refreshTokens.set(refreshToken, { clientId: client.clientId, sub: user.sub, scope: options.scope });
+      const sid = typeof options.claims?.sid === "string" ? options.claims.sid : void 0;
+      const authTime = typeof options.claims?.auth_time === "number" ? options.claims.auth_time : void 0;
+      this.refreshTokens.set(refreshToken, {
+        clientId: client.clientId,
+        sub: user.sub,
+        scope: options.scope,
+        sid,
+        authTime,
+        expiresAt: this.nowSeconds() + 30 * 24 * 3600
+      });
       body.refresh_token = refreshToken;
     }
+    if (user && idToken && (options.scope ?? "").split(" ").includes("openid")) {
+      const now = this.nowSeconds();
+      const signIn = Object.fromEntries(Object.entries(idToken.signIn).filter(([, value]) => value !== void 0));
+      const signed = await this.sign(
+        new SignJWT({
+          typ: "ID",
+          azp: client.clientId,
+          ...signIn,
+          ...idToken.nonce ? { nonce: idToken.nonce } : {},
+          at_hash: halfHash(accessToken, client.signingAlgorithm ?? "RS256"),
+          preferred_username: user.username,
+          ...user.userInfo
+        }).setIssuer(this.issuer).setAudience(client.clientId).setSubject(user.sub).setIssuedAt(now).setExpirationTime(now + this.lifetime),
+        client,
+        "JWT"
+      );
+      body.id_token = encryption && encryption.idTokens !== false ? await encryptTo(signed, encryption) : signed;
+    }
     return { status: 200, body };
   }
   async introspect(recorded, form) {
     const client = await this.authenticate(recorded, form);
     if ("status" in client) return client;
     const issued = this.issued.get(form.token ?? "");
-    const now = Math.floor(Date.now() / 1e3);
+    const now = this.nowSeconds();
+    const refresh = this.refreshTokens.get(form.token ?? "");
+    if (refresh)
+      return refresh.clientId === client.clientId ? {
+        status: 200,
+        body: {
+          active: true,
+          token_type: "Refresh",
+          client_id: refresh.clientId,
+          sub: refresh.sub,
+          exp: refresh.expiresAt,
+          ...refresh.scope ? { scope: refresh.scope } : {},
+          ...refresh.sid ? { sid: refresh.sid } : {}
+        }
+      } : { status: 200, body: { active: false } };
     if (!issued || issued.revoked || (issued.claims.exp ?? 0) <= now) return { status: 200, body: { active: false } };
     const audiences = [issued.claims.aud ?? []].flat();
     const allowed = issued.clientId === client.clientId && audiences.includes(client.clientId) ? true : audiences.some((audience) => this.clients.get(audience)?.introspectionClients?.includes(client.clientId) || audience === client.clientId);
@@ -360,10 +718,29 @@ var FakeAuthio = class _FakeAuthio {
     const user = [...this.users.values()].find((candidate) => candidate.sub === issued.claims.sub);
     const claims = { sub: issued.claims.sub, ...user?.userInfo };
     if (!this.userInfoAsJwt) return send(response, { status: 200, body: claims });
-    const jwt = await new SignJWT(claims).setProtectedHeader({ alg: "RS256", kid: this.keyId }).setIssuer(this.issuer).setAudience(issued.clientId).setIssuedAt().sign(this.signingKey);
+    const now = this.nowSeconds();
+    const signed = await this.sign(
+      new SignJWT(claims).setIssuer(this.issuer).setAudience(issued.clientId).setIssuedAt(now).setExpirationTime(now + this.lifetime),
+      this.clients.get(issued.clientId),
+      void 0
+    );
+    const encryption = this.clients.get(issued.clientId)?.encryption;
+    const jwt = encryption && encryption.userInfo !== false ? await encryptTo(signed, encryption) : signed;
     response.writeHead(200, { "content-type": "application/jwt" });
     response.end(jwt);
   }
+  nowSeconds() {
+    return Math.floor(this.clock.now() / 1e3);
+  }
+  sign(builder, client, type, algorithm = client?.signingAlgorithm ?? "RS256") {
+    if (algorithm === "RS256") return builder.setProtectedHeader({ alg: "RS256", kid: this.keyId, ...type ? { typ: type } : {} }).sign(this.signingKey);
+    if (!client?.clientSecret) throw new Error(`The fake client ${client?.clientId} signs with ${algorithm} and has no clientSecret.`);
+    return builder.setProtectedHeader({ alg: algorithm, ...type ? { typ: type } : {} }).sign(new TextEncoder().encode(client.clientSecret));
+  }
+  verificationKeyFor(client, token) {
+    const algorithm = String(decodeProtectedHeader(token).alg ?? "");
+    return algorithm.startsWith("HS") && client?.clientSecret ? new TextEncoder().encode(client.clientSecret) : this.verificationKey;
+  }
   requireUser(username) {
     const user = this.users.get(username);
     if (!user) throw new Error(`The fake has no user ${username}.`);
@@ -377,8 +754,35 @@ function endpointOf(path) {
   if (path.endsWith("/userinfo")) return "userinfo";
   if (path.endsWith("/auth/device")) return "device";
   if (path.endsWith("/openid-configuration")) return "discovery";
+  if (path.endsWith("/auth")) return "authorize";
+  if (path.endsWith("/logout")) return "logout";
   return void 0;
 }
+async function encryptTo(signed, encryption) {
+  const algorithm = encryption.algorithm ?? "RSA-OAEP-256";
+  const key = await importJWK({ ...encryption.key, alg: algorithm, use: "enc", key_ops: void 0 }, algorithm);
+  return new CompactEncrypt(new TextEncoder().encode(signed)).setProtectedHeader({ alg: algorithm, enc: encryption.encryptionMethod ?? "A256CBC-HS512", typ: "JWE", cty: "JWT", ...encryption.key.kid ? { kid: encryption.key.kid } : {} }).encrypt(key);
+}
+function verifiesChallenge(verifier, challenge, method) {
+  if (!verifier) return false;
+  return method === "S256" ? createHash("sha256").update(verifier, "ascii").digest("base64url") === challenge : verifier === challenge;
+}
+function halfHash(value, algorithm) {
+  const size = algorithm.endsWith("384") ? 384 : algorithm.endsWith("512") ? 512 : 256;
+  const digest = createHash(`sha${size}`).update(value, "ascii").digest();
+  return digest.subarray(0, digest.length / 2).toString("base64url");
+}
+function checkClient(client) {
+  for (const algorithm of [client.signingAlgorithm ?? "RS256", client.accessTokenSigningAlgorithm ?? "RS256"]) {
+    const minimum = { HS256: 32, HS384: 48, HS512: 64 }[algorithm];
+    if (minimum !== void 0 && Buffer.byteLength(client.clientSecret ?? "", "utf8") < minimum)
+      throw new Error(`The fake client ${client.clientId} signs with ${algorithm}, which needs a clientSecret of at least ${minimum} bytes (RFC 7518 \xA73.2).`);
+  }
+  return client;
+}
+function registeredMethodOf(client) {
+  return client.tokenEndpointAuthMethod ?? (client.clientSecret ? "client_secret_basic" : client.publicKey ? "private_key_jwt" : "none");
+}
 function send(response, answer) {
   const headers = { ...answer.headers };
   if (answer.body !== void 0) headers["content-type"] ??= "application/json";