@idpartners/client-attestation-sdk 1.0.1 → 1.4.0

package/dist/www-authenticate.js

@@ -0,0 +1,114 @@
+/**
+ * WWW-Authenticate parsing (RFC 9110 section 11.6.1) by the rule every port shares (vectors/README.md, "The
+ * WWW-Authenticate rule"; cases in vectors/www-authenticate.json). Anything that does not follow the grammar
+ * makes the whole value malformed, so a caller that acts on a challenge fails closed.
+ * @internal
+ */
+const TCHAR = /[!#$%&'*+\-.^_`|~0-9A-Za-z]/;
+const TOKEN68 = /[\-._~+/0-9A-Za-z]/;
+function ows(s, i) {
+    while (i < s.length && (s[i] === " " || s[i] === "\t"))
+        i++;
+    return i;
+}
+function token(s, i) {
+    while (i < s.length && TCHAR.test(s[i]))
+        i++;
+    return i;
+}
+function token68(s, i) {
+    const start = i;
+    while (i < s.length && TOKEN68.test(s[i]))
+        i++;
+    if (i === start)
+        return undefined;
+    while (s[i] === "=")
+        i++;
+    const k = ows(s, i);
+    return k === s.length || s[k] === "," ? i : undefined;
+}
+function qdtext(c) {
+    return c === 0x09 || c === 0x20 || c === 0x21 || (c >= 0x23 && c <= 0x5b) || (c >= 0x5d && c <= 0x7e) || c >= 0x80;
+}
+function quotedPairChar(c) {
+    return c === 0x09 || (c >= 0x20 && c <= 0x7e) || c >= 0x80;
+}
+/** A token or quoted-string at `i`: [value, index after it], or undefined. */
+function value(s, i) {
+    if (s[i] === '"') {
+        let out = "";
+        for (i++; i < s.length;) {
+            const c = s.charCodeAt(i);
+            if (c === 0x22)
+                return [out, i + 1];
+            if (c === 0x5c) {
+                if (i + 1 >= s.length || !quotedPairChar(s.charCodeAt(i + 1)))
+                    return undefined;
+                out += s[i + 1];
+                i += 2;
+            }
+            else if (qdtext(c)) {
+                out += s[i];
+                i++;
+            }
+            else {
+                return undefined;
+            }
+        }
+        return undefined;
+    }
+    const k = token(s, i);
+    return k > i ? [s.slice(i, k), k] : undefined;
+}
+/**
+ * Every field value of a WWW-Authenticate header, combined as one list (RFC 9110 section 5.3), as
+ * challenges; undefined when the combined value is malformed.
+ * @internal
+ */
+export function parseWwwAuthenticate(values) {
+    const s = values.join(", ");
+    const out = [];
+    let i = 0;
+    for (;;) {
+        while (i < s.length && (s[i] === " " || s[i] === "\t" || s[i] === ","))
+            i++;
+        if (i >= s.length)
+            return out;
+        const start = i;
+        i = token(s, i);
+        if (i === start)
+            return undefined;
+        const name = s.slice(start, i).toLowerCase();
+        const j = ows(s, i);
+        if (s[j] === "=") {
+            if (out.length === 0)
+                return undefined;
+            const got = value(s, ows(s, j + 1));
+            if (got === undefined)
+                return undefined;
+            const params = out[out.length - 1].params;
+            if (params.has(name))
+                return undefined;
+            params.set(name, got[0]);
+            i = got[1];
+        }
+        else {
+            out.push({ scheme: name, params: new Map() });
+            const k = j > i ? token68(s, j) : undefined;
+            if (k === undefined) {
+                i = j; // its first auth-param (if any) follows without a comma
+                continue;
+            }
+            i = k;
+        }
+        i = ows(s, i);
+        if (i < s.length && s[i] !== ",")
+            return undefined;
+    }
+}
+/** A DPoP challenge whose error is exactly "use_dpop_nonce" (RFC 9449 section 9). @internal */
+export function isDpopNonceChallenge(values) {
+    const challenges = parseWwwAuthenticate(values);
+    return challenges !== undefined &&
+        challenges.some((c) => c.scheme === "dpop" && c.params.get("error") === "use_dpop_nonce");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@idpartners/client-attestation-sdk",
-  "version": "1.0.1",
+  "version": "1.4.0",
   "description": "Client-side builder SDK for OAuth Attestation-Based Client Authentication",
   "type": "module",
   "main": "dist/index.js",
@@ -50,6 +50,7 @@
     "@types/node": "^20.0.0",
     "@vitest/coverage-v8": "^4.1.11",
     "esbuild": "^0.28.1",
+    "fast-check": "4.10.2",
     "tsx": "^4.23.15",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",