@hyper.authio/testing 0.8.1 → 0.10.0

package/dist/index.d.cts

@@ -28,6 +28,14 @@ type FakeAuthioTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_
  * The algorithm Authio signs every token of a client with: the realm's RSA key, or the client secret (HS*).
  */
 type FakeAuthioSigningAlgorithm = "RS256" | "HS256" | "HS384" | "HS512";
+/**
+ * The form a client's access tokens are handed out in, as Authio's access token format setting: `Jwt`, the
+ * self-contained JWT; `Reference`, an opaque handle of 43 characters that only introspection resolves; `Lightweight`, a
+ * JWT that carries only the identity and session claims (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`, `typ`,
+ * `client_id`, `azp`, `scope`, `sid`, `auth_time`, `acr`, `amr`, `idp`, `act`, `delegation_id`, `session_client`,
+ * `org_id`, `org_alias`). Introspection answers with every claim of the full token, whatever the form.
+ */
+type FakeAuthioAccessTokenFormat = "Jwt" | "Reference" | "Lightweight";
 /**
  * A client registered in the fake, configured as a client is in Authio's console. What the client requires is
  * enforced as Authio enforces it: a request that does not match is refused with an error naming the setting, and
@@ -62,6 +70,8 @@ interface FakeAuthioClient {
     signingAlgorithm?: FakeAuthioSigningAlgorithm;
     /** The algorithm the client's access tokens are signed with, Authio's second setting. Defaults to `RS256`. */
     accessTokenSigningAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** The form the client's access tokens are handed out in. Defaults to `Jwt`. */
+    accessTokenFormat?: FakeAuthioAccessTokenFormat;
     /** Issues a new ID token with every refresh. Defaults to `false`. */
     issueIdTokenOnRefresh?: boolean;
     /** Scopes granted when a request names none. */
@@ -198,6 +208,8 @@ interface FakeAuthioTokenOptions {
     expiresIn?: number;
     /** The `typ` claim. Defaults to `Bearer`. */
     type?: string;
+    /** The header `typ`. Defaults to `at+jwt` (RFC 9068 §2.1); `null` leaves it out. */
+    headerType?: string | null;
     /** Claims added to the payload. */
     claims?: Record<string, unknown>;
     /** Signs with another issuer. */
@@ -210,6 +222,12 @@ interface FakeAuthioTokenOptions {
         algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
         encryptionMethod?: string;
     };
+    /**
+     * The form of the token: `Reference` mints an opaque handle (never encrypted) and `Lightweight` a JWT with only the
+     * identity and session claims; introspection answers with every claim either way. Defaults to the client's
+     * `accessTokenFormat`, else `Jwt`.
+     */
+    format?: FakeAuthioAccessTokenFormat;
 }
 type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery" | "authorize" | "logout";
 /**
@@ -218,7 +236,8 @@ type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "dis
  * `iss`), token (client credentials, authorization code with ID tokens, refresh, token exchange, password, device code,
  * personal access token) with the client's exact authentication method, introspection, revocation, UserInfo, device
  * authorization, end session, back-channel and front-channel logout delivery, tokens signed RS256 or HS* with the
- * client secret, and JWE (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
+ * client secret, access tokens as a JWT, an opaque reference or a lightweight JWT (`accessTokenFormat`), and JWE
+ * (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
  */
 declare class FakeAuthio {
     /** Every request received, in order. */
@@ -416,4 +435,4 @@ declare function createWebhookDelivery(type: string, data: unknown, secret: stri
     sendEventIdHeader?: boolean;
 }): Promise<FakeWebhookDelivery>;
 
-export { FakeAuthio, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
+export { FakeAuthio, type FakeAuthioAccessTokenFormat, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };

package/dist/index.d.ts

@@ -28,6 +28,14 @@ type FakeAuthioTokenEndpointAuthMethod = "client_secret_basic" | "client_secret_
  * The algorithm Authio signs every token of a client with: the realm's RSA key, or the client secret (HS*).
  */
 type FakeAuthioSigningAlgorithm = "RS256" | "HS256" | "HS384" | "HS512";
+/**
+ * The form a client's access tokens are handed out in, as Authio's access token format setting: `Jwt`, the
+ * self-contained JWT; `Reference`, an opaque handle of 43 characters that only introspection resolves; `Lightweight`, a
+ * JWT that carries only the identity and session claims (`iss`, `sub`, `aud`, `exp`, `nbf`, `iat`, `jti`, `typ`,
+ * `client_id`, `azp`, `scope`, `sid`, `auth_time`, `acr`, `amr`, `idp`, `act`, `delegation_id`, `session_client`,
+ * `org_id`, `org_alias`). Introspection answers with every claim of the full token, whatever the form.
+ */
+type FakeAuthioAccessTokenFormat = "Jwt" | "Reference" | "Lightweight";
 /**
  * A client registered in the fake, configured as a client is in Authio's console. What the client requires is
  * enforced as Authio enforces it: a request that does not match is refused with an error naming the setting, and
@@ -62,6 +70,8 @@ interface FakeAuthioClient {
     signingAlgorithm?: FakeAuthioSigningAlgorithm;
     /** The algorithm the client's access tokens are signed with, Authio's second setting. Defaults to `RS256`. */
     accessTokenSigningAlgorithm?: FakeAuthioSigningAlgorithm;
+    /** The form the client's access tokens are handed out in. Defaults to `Jwt`. */
+    accessTokenFormat?: FakeAuthioAccessTokenFormat;
     /** Issues a new ID token with every refresh. Defaults to `false`. */
     issueIdTokenOnRefresh?: boolean;
     /** Scopes granted when a request names none. */
@@ -198,6 +208,8 @@ interface FakeAuthioTokenOptions {
     expiresIn?: number;
     /** The `typ` claim. Defaults to `Bearer`. */
     type?: string;
+    /** The header `typ`. Defaults to `at+jwt` (RFC 9068 §2.1); `null` leaves it out. */
+    headerType?: string | null;
     /** Claims added to the payload. */
     claims?: Record<string, unknown>;
     /** Signs with another issuer. */
@@ -210,6 +222,12 @@ interface FakeAuthioTokenOptions {
         algorithm?: "RSA-OAEP" | "RSA-OAEP-256";
         encryptionMethod?: string;
     };
+    /**
+     * The form of the token: `Reference` mints an opaque handle (never encrypted) and `Lightweight` a JWT with only the
+     * identity and session claims; introspection answers with every claim either way. Defaults to the client's
+     * `accessTokenFormat`, else `Jwt`.
+     */
+    format?: FakeAuthioAccessTokenFormat;
 }
 type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "discovery" | "authorize" | "logout";
 /**
@@ -218,7 +236,8 @@ type Endpoint = "token" | "introspect" | "revoke" | "userinfo" | "device" | "dis
  * `iss`), token (client credentials, authorization code with ID tokens, refresh, token exchange, password, device code,
  * personal access token) with the client's exact authentication method, introspection, revocation, UserInfo, device
  * authorization, end session, back-channel and front-channel logout delivery, tokens signed RS256 or HS* with the
- * client secret, and JWE (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
+ * client secret, access tokens as a JWT, an opaque reference or a lightweight JWT (`accessTokenFormat`), and JWE
+ * (RSA-OAEP, RSA-OAEP-256) for clients that registered an encryption key.
  */
 declare class FakeAuthio {
     /** Every request received, in order. */
@@ -416,4 +435,4 @@ declare function createWebhookDelivery(type: string, data: unknown, secret: stri
     sendEventIdHeader?: boolean;
 }): Promise<FakeWebhookDelivery>;
 
-export { FakeAuthio, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };
+export { FakeAuthio, type FakeAuthioAccessTokenFormat, type FakeAuthioAuthorizationOutcome, type FakeAuthioBackchannelDelivery, type FakeAuthioClient, type FakeAuthioClientEncryption, type FakeAuthioDeviceOutcome, type FakeAuthioError, type FakeAuthioFrontchannelDelivery, type FakeAuthioOptions, type FakeAuthioPersonalAccessToken, type FakeAuthioRecordedRequest, type FakeAuthioSigningAlgorithm, type FakeAuthioTokenEndpointAuthMethod, type FakeAuthioTokenOptions, type FakeAuthioUser, type FakeWebhookDelivery, ManualClock, createWebhookDelivery };

package/dist/index.js

@@ -1,9 +1,32 @@
 import { createServer } from 'http';
-import { randomUUID, createHash } from 'crypto';
+import { randomUUID, randomBytes, createHash } from 'crypto';
 import { SignJWT, decodeJwt, generateKeyPair, exportJWK, jwtVerify, importJWK, decodeProtectedHeader, CompactEncrypt } from 'jose';
 import { AuthioWebhookHeaders, computeWebhookSignatureHeader } from '@hyper.authio/client';
 
 // src/fake-authio.ts
+var lightweightAccessTokenClaims = /* @__PURE__ */ new Set([
+  "iss",
+  "sub",
+  "aud",
+  "exp",
+  "nbf",
+  "iat",
+  "jti",
+  "typ",
+  "client_id",
+  "azp",
+  "scope",
+  "sid",
+  "auth_time",
+  "acr",
+  "amr",
+  "idp",
+  "act",
+  "delegation_id",
+  "session_client",
+  "org_id",
+  "org_alias"
+]);
 var FakeAuthio = class _FakeAuthio {
   /** Every request received, in order. */
   requests = [];
@@ -130,6 +153,7 @@ var FakeAuthio = class _FakeAuthio {
   async issueAccessToken(options = {}) {
     const now = this.nowSeconds();
     const clientId = options.clientId ?? "fake-client";
+    const headerType = options.headerType === null ? void 0 : options.headerType ?? "at+jwt";
     const jti = randomUUID();
     const payload = {
       typ: options.type ?? "Bearer",
@@ -140,9 +164,17 @@ var FakeAuthio = class _FakeAuthio {
       ...options.claims
     };
     const builder = new SignJWT(payload).setIssuer(options.issuer ?? this.issuer).setAudience(options.audience ?? clientId).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + (options.expiresIn ?? this.lifetime)).setJti(jti);
-    const signed = options.untrusted ? await builder.setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: "JWT" }).sign(this.untrustedKey) : await this.sign(builder, this.clients.get(clientId), "JWT", this.clients.get(clientId)?.accessTokenSigningAlgorithm ?? "RS256");
-    const token = options.encryptTo ? await encryptTo(signed, options.encryptTo) : signed;
-    this.issued.set(token, { claims: decodeJwt(signed), clientId, revoked: false });
+    const sign = (jwt) => options.untrusted ? jwt.setProtectedHeader({ alg: "RS256", kid: this.keyId, typ: headerType }).sign(this.untrustedKey) : this.sign(jwt, this.clients.get(clientId), headerType, this.clients.get(clientId)?.accessTokenSigningAlgorithm ?? "RS256");
+    const format = options.format ?? this.clients.get(clientId)?.accessTokenFormat ?? "Jwt";
+    const full = await sign(builder);
+    const claims = decodeJwt(full);
+    let token;
+    if (format === "Reference") token = randomBytes(32).toString("base64url");
+    else {
+      const signed = format === "Lightweight" ? await sign(new SignJWT(Object.fromEntries(Object.entries(claims).filter(([name]) => lightweightAccessTokenClaims.has(name))))) : full;
+      token = options.encryptTo ? await encryptTo(signed, options.encryptTo) : signed;
+    }
+    this.issued.set(token, { claims, clientId, revoked: false });
     return token;
   }
   /**