@m1212e/oidc 0.0.0-stage → 0.1.1

package/out/index.d.mts

@@ -0,0 +1,298 @@
+import { JWTPayload } from "jose";
+import { IntrospectionResponse, TokenEndpointResponse, TokenEndpointResponseHelpers, UserInfoResponse } from "openid-client";
+import { Static, Type } from "typebox";
+type TokenKind = "access" | "id";
+type RefreshedTokenSet = TokenEndpointResponse & TokenEndpointResponseHelpers;
+declare class OidcError extends Error {
+  refreshedTokens?: RefreshedTokenSet;
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class OidcInputError extends OidcError {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class OidcTokenError extends OidcError {
+  readonly tokenKind: TokenKind;
+  readonly claim: string;
+  constructor(tokenKind: TokenKind, claim: string, message: string);
+}
+type TokenValidationFailure = {
+  tokenKind: TokenKind;
+  stage: string;
+  error: unknown;
+};
+declare class OidcTokenValidationError extends OidcError {
+  readonly tokenKinds: readonly TokenKind[];
+  readonly failures: readonly TokenValidationFailure[];
+  constructor(tokenKinds: readonly TokenKind[], failures: readonly TokenValidationFailure[]);
+}
+declare class OidcSubjectError extends OidcError {
+  readonly expected: string;
+  readonly actual: string;
+  constructor(message: string, expected: string, actual: string);
+}
+declare class OidcGrantError extends OidcError {
+  readonly grant: "authorization_code" | "refresh_token";
+  constructor(grant: "authorization_code" | "refresh_token", message: string, options?: ErrorOptions);
+}
+declare class OidcStateError extends OidcError {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class OidcClaimsError extends OidcError {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class OidcUserInfoError extends OidcError {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class OidcLogoutError extends OidcError {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare function attachRefreshedTokens<E>(error: E, refreshedTokens?: RefreshedTokenSet): E;
+declare const DEFAULT_AUTHORIZED_PARTY_CLAIMS: readonly string[];
+type AudienceClaims = Readonly<Record<string, unknown>>;
+type AudiencePolicy = {
+  clientId: string;
+  expectedAudience?: string[];
+  authorizedPartyClaims: readonly string[];
+  verifyAudience?: (claims: AudienceClaims, tokenKind: TokenKind) => boolean;
+};
+declare class OidcAudienceError extends OidcTokenError {
+  constructor(tokenKind: TokenKind, claim: string, message: string);
+}
+declare function audienceVerifyOption(policy: AudiencePolicy, tokenKind: TokenKind): string | string[] | undefined;
+declare function assertAudienceClaim(claims: AudienceClaims, tokenKind: TokenKind, policy: AudiencePolicy): void;
+declare function assertAuthorizedParty(claims: AudienceClaims, tokenKind: TokenKind, policy: AudiencePolicy): void;
+declare function assertAudienceAfterJwtVerify(claims: AudienceClaims, tokenKind: TokenKind, policy: AudiencePolicy): void;
+declare function assertTokenAudience(claims: AudienceClaims, tokenKind: TokenKind, policy: AudiencePolicy): void;
+declare function assertIntrospectedIdTokenAudience(claims: AudienceClaims, policy: AudiencePolicy): void;
+declare function buildAudiencePolicy(opts: {
+  clientId: string;
+  expectedAudience?: string | string[];
+  authorizedPartyClaims?: readonly string[];
+  verifyAudience?: (claims: AudienceClaims, tokenKind: TokenKind) => boolean;
+}): AudiencePolicy;
+type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
+type Logger = {
+  debug: (...args: unknown[]) => void;
+  info: (...args: unknown[]) => void;
+  warn: (...args: unknown[]) => void;
+  error: (...args: unknown[]) => void;
+};
+declare function buildLogger(logger?: Logger, logLevel?: LogLevel): Logger;
+declare const OIDCUserSchema: Type.TObject<{
+  iss: Type.TOptional<Type.TString>;
+  sub: Type.TString;
+  email: Type.TOptional<Type.TUnion<[Type.TNull, Type.TCodec<Type.TString, string>]>>;
+  email_verified: Type.TOptional<Type.TUnion<[Type.TNull, Type.TCodec<Type.TUnion<[Type.TBoolean, Type.TString, Type.TNumber]>, boolean>]>>;
+  name: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  given_name: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  family_name: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  middle_name: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  nickname: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  preferred_username: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  profile: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  picture: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  website: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  gender: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  birthdate: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  zoneinfo: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  locale: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  phone_number: Type.TOptional<Type.TUnion<[Type.TNull, Type.TString]>>;
+  phone_number_verified: Type.TOptional<Type.TUnion<[Type.TNull, Type.TCodec<Type.TUnion<[Type.TBoolean, Type.TString, Type.TNumber]>, boolean>]>>;
+  address: Type.TOptional<Type.TUnion<[Type.TNull, Type.TObject<{
+    formatted: Type.TOptional<Type.TString>;
+    street_address: Type.TOptional<Type.TString>;
+    locality: Type.TOptional<Type.TString>;
+    region: Type.TOptional<Type.TString>;
+    postal_code: Type.TOptional<Type.TString>;
+    country: Type.TOptional<Type.TString>;
+  }>]>>;
+  updated_at: Type.TOptional<Type.TUnion<[Type.TNull, Type.TNumber]>>;
+}>;
+type OIDCUser = Static<typeof OIDCUserSchema>;
+declare function parseOIDCUser(value: unknown): OIDCUser;
+declare const OIDCFlowStateSchema: Type.TObject<{
+  visitedUrl: Type.TString;
+  random: Type.TString;
+  nonce: Type.TOptional<Type.TString>;
+}>;
+type OIDCFlowState = Static<typeof OIDCFlowStateSchema>;
+declare function parseOIDCFlowState(value: string): OIDCFlowState;
+type AccessTokenClaims = JWTPayload | IntrospectionResponse | undefined;
+type IdTokenClaims = JWTPayload | IntrospectionResponse | UserInfoResponse | undefined;
+type ValidationResult = {
+  user: OIDCUser;
+  accessTokenClaims: AccessTokenClaims;
+  idTokenClaims: IdTokenClaims;
+};
+declare function mergeTokenClaims(accessTokenClaims: Record<string, unknown> | undefined, idTokenClaims: Record<string, unknown> | undefined, onConflict?: (claim: string) => void): Record<string, unknown>;
+type OidcCoreOptions = {
+  issuer: string;
+  clientId: string;
+  clientSecret?: string;
+  expectedAudience?: string | string[];
+  authorizedPartyClaims?: readonly string[];
+  verifyAudience?: (claims: AudienceClaims, tokenKind: TokenKind) => boolean;
+  idTokenOnlyClaims?: readonly string[];
+  accessTokenTyp?: string;
+  requireIntrospectedTokenType?: boolean;
+  introspection?: "opaque-only" | "auto" | "never";
+  allowedReturnToOrigins?: readonly string[];
+  clockTolerance?: string | number;
+  signingAlgorithms?: string[];
+  development?: boolean;
+  logger?: Logger;
+  logLevel?: LogLevel;
+};
+type StartSigninResult = {
+  codeVerifier: string;
+  authorizationUrl: URL;
+  state: string;
+};
+type ResolveSigninResult = {
+  tokens: TokenEndpointResponse & TokenEndpointResponseHelpers;
+  returnTo: string;
+};
+type SubjectBinding = {
+  subject?: string;
+};
+type ProcessTokensInput = SubjectBinding & ({
+  access_token: string | null;
+  id_token?: string | null;
+  refresh_token?: string | null;
+} | {
+  access_token?: string | null;
+  id_token: string | null;
+  refresh_token?: string | null;
+});
+type ProcessTokensResult = ValidationResult & ({
+  refreshed: true;
+  refreshedTokens: TokenEndpointResponse & TokenEndpointResponseHelpers;
+} | {
+  refreshed: false;
+  refreshedTokens?: undefined;
+});
+/**
+ * A JSON object.
+ */
+type JsonObject = { [Key in string]?: JsonValue; };
+/**
+ * A JSON array.
+ */
+type JsonArray = JsonValue[];
+/**
+ * A JSON primitive value.
+ */
+type JsonPrimitive = string | number | boolean | null;
+/**
+ * Any JSON-compatible value.
+ */
+type JsonValue = JsonPrimitive | JsonObject | JsonArray;
+/**
+ * The structured `address` claim in an OpenID Connect UserInfo response.
+ */
+interface UserInfoAddress {
+  readonly formatted?: string;
+  readonly street_address?: string;
+  readonly locality?: string;
+  readonly region?: string;
+  readonly postal_code?: string;
+  readonly country?: string;
+  readonly [claim: string]: JsonValue | undefined;
+}
+/**
+ * Claims from a parsed OpenID Connect UserInfo response.
+ */
+interface UserInfoResponse$1 {
+  readonly sub: string;
+  readonly name?: string;
+  readonly given_name?: string;
+  readonly family_name?: string;
+  readonly middle_name?: string;
+  readonly nickname?: string;
+  readonly preferred_username?: string;
+  readonly profile?: string;
+  readonly picture?: string;
+  readonly website?: string;
+  readonly email?: string;
+  readonly email_verified?: boolean;
+  readonly gender?: string;
+  readonly birthdate?: string;
+  readonly zoneinfo?: string;
+  readonly locale?: string;
+  readonly phone_number?: string;
+  readonly updated_at?: number;
+  readonly address?: UserInfoAddress;
+  readonly [claim: string]: JsonValue | undefined;
+}
+declare function resolveDevelopment(development?: boolean): boolean;
+declare const DEFAULT_SIGNING_ALGORITHMS: readonly string[];
+declare function resolveJwksUri(jwksUri: string, development: boolean): URL;
+declare function assertDiscoveredIssuer(configured: string, discovered: string): void;
+declare function assertPkceSupported(methods: string[] | undefined, clientSecret: string | undefined, log: Logger): void;
+declare function resolveClockTolerance(clockTolerance?: string | number): number;
+/**
+ * Discovers the issuer and returns the sign-in, validation, refresh and logout functions.
+ * @example const oidc = await createOidcCore({ issuer: "https://auth.example.com", clientId: "my-app" });
+ */
+declare function createOidcCore(opts: OidcCoreOptions): Promise<{
+  configuration: import("openid-client").Configuration;
+  startSignin: ({ redirectUri, returnTo, scope }: {
+    redirectUri: string;
+    returnTo: string;
+    scope?: string;
+  }) => Promise<StartSigninResult>;
+  resolveSignin: ({ callbackUrl, codeVerifier, expectedState }: {
+    callbackUrl: URL;
+    codeVerifier: string;
+    expectedState: string;
+  }) => Promise<ResolveSigninResult>;
+  processTokens: (input: ProcessTokensInput) => Promise<ProcessTokensResult>;
+  refresh: ({ refreshToken, expectedSubject }: {
+    refreshToken: string;
+    expectedSubject?: string;
+  }) => Promise<RefreshedTokenSet>;
+  getLogoutUrl: ({ postLogoutRedirectUri, idTokenHint, state }: {
+    postLogoutRedirectUri: string;
+    idTokenHint?: string;
+    state?: string;
+  }) => Promise<URL>;
+  fetchUserInfoFromIssuer: ({ accessToken, expectedSubject }: {
+    accessToken: string;
+    expectedSubject: string;
+  }) => Promise<UserInfoResponse$1>;
+}>;
+type OidcCore = Awaited<ReturnType<typeof createOidcCore>>;
+declare class OidcReturnToError extends OidcError {
+  readonly returnTo: string;
+  constructor(returnTo: string, message: string);
+}
+type ReturnToPolicy = {
+  allowedOrigins: readonly string[];
+};
+declare function buildReturnToPolicy(opts: {
+  allowedReturnToOrigins?: readonly string[];
+}): ReturnToPolicy;
+declare function assertSafeReturnTo(returnTo: string, policy: ReturnToPolicy): string;
+declare function assertSafeRedirectUri(uri: string, label: string): string;
+declare const DEFAULT_ID_TOKEN_ONLY_CLAIMS: readonly string[];
+declare class OidcTokenTypeError extends OidcTokenError {
+  constructor(tokenKind: TokenKind, claim: string, message: string);
+}
+type TokenTypePolicy = {
+  idTokenOnlyClaims: readonly string[];
+  accessTokenTyp?: string;
+  requireIntrospectedTokenType: boolean;
+};
+declare function buildTokenTypePolicy(opts: {
+  idTokenOnlyClaims?: readonly string[];
+  accessTokenTyp?: string;
+  requireIntrospectedTokenType?: boolean;
+}): TokenTypePolicy;
+declare function assertTokenTypeFromClaims(claims: AudienceClaims, tokenKind: TokenKind, policy: TokenTypePolicy): void;
+declare function assertTokenTypeAfterJwtVerify(claims: AudienceClaims, header: {
+  typ?: string;
+}, tokenKind: TokenKind, policy: TokenTypePolicy): void;
+declare function assertIntrospectedAccessToken(claims: AudienceClaims, policy: TokenTypePolicy): void;
+declare function assertIntrospectedIdToken(claims: AudienceClaims, policy: TokenTypePolicy): void;
+export { type AccessTokenClaims, type AudienceClaims, type AudiencePolicy, DEFAULT_AUTHORIZED_PARTY_CLAIMS, DEFAULT_ID_TOKEN_ONLY_CLAIMS, DEFAULT_SIGNING_ALGORITHMS, type IdTokenClaims, type LogLevel, type Logger, type OIDCFlowState, type OIDCUser, OidcAudienceError, OidcClaimsError, type OidcCore, type OidcCoreOptions, OidcError, OidcGrantError, OidcInputError, OidcLogoutError, OidcReturnToError, OidcStateError, OidcSubjectError, OidcTokenError, OidcTokenTypeError, OidcTokenValidationError, OidcUserInfoError, type ProcessTokensInput, type ProcessTokensResult, type RefreshedTokenSet, type ResolveSigninResult, type ReturnToPolicy, type StartSigninResult, type TokenKind, type TokenTypePolicy, type TokenValidationFailure, type ValidationResult, assertAudienceAfterJwtVerify, assertAudienceClaim, assertAuthorizedParty, assertDiscoveredIssuer, assertIntrospectedAccessToken, assertIntrospectedIdToken, assertIntrospectedIdTokenAudience, assertPkceSupported, assertSafeRedirectUri, assertSafeReturnTo, assertTokenAudience, assertTokenTypeAfterJwtVerify, assertTokenTypeFromClaims, attachRefreshedTokens, audienceVerifyOption, buildAudiencePolicy, buildLogger, buildReturnToPolicy, buildTokenTypePolicy, createOidcCore, mergeTokenClaims, parseOIDCFlowState, parseOIDCUser, resolveClockTolerance, resolveDevelopment, resolveJwksUri };
+//# sourceMappingURL=index.d.mts.map

package/out/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":["UserInfoResponse","_$__options0.StartSigninResult","_$__options0.ResolveSigninResult","_$__options0.ProcessTokensInput","_$__options0.ProcessTokensResult","_$__0.RefreshedTokenSet","_$oauth4webapi.UserInfoResponse"],"sources":["../lib/errors.ts","../lib/audience.ts","../lib/logger.ts","../lib/types.ts","../lib/core/options.ts","../node_modules/oauth4webapi/build/index.d.ts","../lib/discovery.ts","../lib/core/index.ts","../lib/returnTo.ts","../lib/tokenType.ts"],"ignoreList":[5],"mappings":";;;KAKY;KAEA,oBAAoB,wBAC9B;cAEW,kBAAkB;EAC7B,kBAAkB;EAElB,YAAY,iBAAiB,UAAU;;cAM5B,uBAAuB;EAClC,YAAY,iBAAiB,UAAU;;cAM5B,uBAAuB;WACzB,WAAW;WACX;EAET,YAAY,WAAW,WAAW,eAAe;;KAQvC;EACV,WAAW;EACX;EACA;;cAOW,iCAAiC;WACnC,qBAAqB;WACrB,mBAAmB;EAE5B,YACE,qBAAqB,aACrB,mBAAmB;;cAwBV,yBAAyB;WAC3B;WACA;EAET,YAAY,iBAAiB,kBAAkB;;cAQpC,uBAAuB;WACzB;EAET,YACE,+CACA,iBACA,UAAU;;cAQD,uBAAuB;EAClC,YAAY,iBAAiB,UAAU;;cAM5B,wBAAwB;EACnC,YAAY,iBAAiB,UAAU;;cAM5B,0BAA0B;EACrC,YAAY,iBAAiB,UAAU;;cAM5B,wBAAwB;EACnC,YAAY,iBAAiB,UAAU;;iBAMzB,sBAAsB,GACpC,OAAO,GACP,kBAAkB,oBACjB;cCnIU;KAOD,iBAAiB,SAAS;KAE1B;EACV;EACA;EACA;EACA,kBAAkB,QAAQ,gBAAgB,WAAW;;cAG1C,0BAA0B;EACrC,YAAY,WAAW,WAAW,eAAe;;iBAyBnC,qBACd,QAAQ,gBACR,WAAW;iBAMG,oBACd,QAAQ,gBACR,WAAW,WACX,QAAQ;iBAgBM,sBACd,QAAQ,gBACR,WAAW,WACX,QAAQ;iBAsDM,6BACd,QAAQ,gBACR,WAAW,WACX,QAAQ;iBAgBM,oBACd,QAAQ,gBACR,WAAW,WACX,QAAQ;iBAMM,kCACd,QAAQ,gBACR,QAAQ;iBA0DM,oBAAoB;EAClC;EACA;EACA;EACA,kBAAkB,QAAQ,gBAAgB,WAAW;IACnD;KC/NQ;KAEA;EACV,WAAW;EACX,UAAU;EACV,UAAU;EACV,WAAW;;iBAaG,YAAY,SAAS,QAAQ,WAAW,WAAW;cCG7D,gBAAc,KAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgCR,WAAW,cAAc;iBAOrB,cAAc,iBAAiB;cA4BzC,qBAAmB,KAAA;;;;;KAKb,gBAAgB,cAAc;iBAG1B,mBAAmB,gBAAgB;KAyBvC,oBAAoB,aAAa;KACjC,gBACR,aACA,wBACA;KAGQ;EACV,MAAM;EACN,mBAAmB;EACnB,eAAe;;iBASD,iBACd,mBAAmB,qCACnB,eAAe,qCACf,cAAc,yBACb;KCxIS;EACV;EACA;EACA;EACA;EACA;EACA,kBAAkB,QAAQ,gBAAgB,WAAW;EACrD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS;EACT,WAAW;;KAGD;EACV;EACA,kBAAkB;EAClB;;KAGU;EACV,QAAQ,wBAAwB;EAChC;;KAGG;EAAmB;;KAEZ,qBAAqB;EAGzB;EACA;EACA;;EAGA;EACA;EACA;;KAII,sBAAsB;EAG1B;EACA,iBAAiB,wBAAwB;;EAEzC;EAAkB;;;;;KC3Bd,gBACP,iBAAiB;;;;KAKV,YAAY;;;;KAIZ;;;;KAIA,YAAY,gBAAgB,aAAa;;;;UA4mDpC;WACJ;WACA;WACA;WACA;WACA;WACA;YACC,gBAAgB;;;;;UAKbA;WACJ;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA,UAAU;YACT,gBAAgB;;iBCzrDd,mBAAmB;cAMtB;iBAoBG,eAAe,iBAAiB,uBAAuB;iBA2BvD,uBACd,oBACA;iBA0Cc,oBACd,+BACA,kCACA,KAAK;iBA4BS,sBACd;;;;;iBCrFoB,eAAe,MAAM,kBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;KA+F9C,WAAW,QAAQ,kBAAkB;cCtIpC,0BAA0B;WAC5B;EAET,YAAY,kBAAkB;;KAOpB;EACV;;iBAGc,oBAAoB;EAClC;IACE;iBAyFY,mBACd,kBACA,QAAQ;iBAoBM,sBAAsB,aAAa;cCpItC;cA6CA,2BAA2B;EACtC,YAAY,WAAW,WAAW,eAAe;;KAMvC;EACV;EACA;EACA;;iBAGc,qBAAqB;EACnC;EACA;EACA;IACE;iBAQY,0BACd,QAAQ,gBACR,WAAW,WACX,QAAQ;iBAsCM,8BACd,QAAQ,gBACR;EAAU;GACV,WAAW,WACX,QAAQ;iBAgCM,8BACd,QAAQ,gBACR,QAAQ;iBAcM,0BACd,QAAQ,gBACR,QAAQ"}