@maronn-openid-connect/core 0.0.1

package/dist/authorization-code-grant.js

@@ -0,0 +1,109 @@
+import { sha256 } from './crypto-utils.js';
+import { TokenError, TokenErrorCode } from './token-error.js';
+async function verifyCodeChallenge(codeVerifier, codeChallenge, method) {
+    if (method === 'S256') {
+        const computed = await sha256(codeVerifier);
+        return computed === codeChallenge;
+    }
+    return false;
+}
+export async function resolveAuthorizationCode(params, authCodeResolver) {
+    const code = params.code;
+    if (!code) {
+        throw new TokenError(TokenErrorCode.InvalidRequest, 'Missing required parameter: code');
+    }
+    const authorizationCode = await authCodeResolver.findAuthorizationCode(code);
+    if (!authorizationCode) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Authorization code not found');
+    }
+    return { code, authorizationCode };
+}
+export async function validateAuthorizationCodeUnused(authorizationCode, authCodeResolver) {
+    if (!authorizationCode.used) {
+        return;
+    }
+    if (authCodeResolver.revokeTokensByGrantId) {
+        await authCodeResolver.revokeTokensByGrantId(authorizationCode.grantId);
+    }
+    throw new TokenError(TokenErrorCode.InvalidGrant, 'Authorization code has already been used');
+}
+export function validateAuthorizationCodeClient(authorizationCode, authenticatedClientId) {
+    if (authorizationCode.clientId !== authenticatedClientId) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Authorization code was issued to a different client');
+    }
+}
+export function validateAuthorizationCodeExpiration(authorizationCode, currentTime = Math.floor(Date.now() / 1000)) {
+    if (authorizationCode.expiresAt <= currentTime) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Authorization code has expired');
+    }
+}
+export function validateAuthorizationCodeRedirectUri(authorizationCode, requestRedirectUri) {
+    if (authorizationCode.redirectUriExplicit) {
+        if (!requestRedirectUri) {
+            throw new TokenError(TokenErrorCode.InvalidGrant, 'redirect_uri is required because it was included in the authorization request');
+        }
+        if (requestRedirectUri !== authorizationCode.redirectUri) {
+            throw new TokenError(TokenErrorCode.InvalidGrant, 'redirect_uri does not match the authorization request');
+        }
+        return;
+    }
+    if (requestRedirectUri !== undefined &&
+        requestRedirectUri !== authorizationCode.redirectUri) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'redirect_uri does not match the authorization request');
+    }
+}
+export async function verifyAuthorizationCodePkce(authorizationCode, codeVerifier) {
+    const hasPkceBinding = authorizationCode.codeChallenge !== undefined ||
+        authorizationCode.codeChallengeMethod !== undefined;
+    if (!hasPkceBinding) {
+        return false;
+    }
+    if (authorizationCode.codeChallenge === undefined ||
+        authorizationCode.codeChallengeMethod === undefined) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Authorization code PKCE binding is incomplete');
+    }
+    if (!codeVerifier) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'Missing required parameter: code_verifier');
+    }
+    if (codeVerifier.length < 43 || codeVerifier.length > 128) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'code_verifier length must be between 43 and 128 characters');
+    }
+    if (!/^[A-Za-z0-9\-._~]+$/.test(codeVerifier)) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'code_verifier contains invalid characters');
+    }
+    const isValid = await verifyCodeChallenge(codeVerifier, authorizationCode.codeChallenge, authorizationCode.codeChallengeMethod);
+    if (!isValid) {
+        throw new TokenError(TokenErrorCode.InvalidGrant, 'code_verifier validation failed');
+    }
+    return true;
+}
+export async function consumeAuthorizationCode(code, authCodeResolver) {
+    await authCodeResolver.revokeAuthorizationCode(code);
+}
+export function buildValidatedAuthorizationCodeRequest(code, authorizationCode, authenticatedClientId, codeVerified) {
+    return {
+        grantType: 'authorization_code',
+        clientId: authenticatedClientId,
+        code,
+        grantId: authorizationCode.grantId,
+        redirectUri: authorizationCode.redirectUri,
+        scope: authorizationCode.scope,
+        nonce: authorizationCode.nonce,
+        audience: authorizationCode.audience,
+        acrValues: authorizationCode.acrValues,
+        claims: authorizationCode.claims,
+        codeVerified,
+    };
+}
+export async function validateAuthorizationCodeGrant(context) {
+    const { params, authCodeResolver, authenticatedClientId } = context;
+    const { code, authorizationCode } = await resolveAuthorizationCode(params, authCodeResolver);
+    await validateAuthorizationCodeUnused(authorizationCode, authCodeResolver);
+    validateAuthorizationCodeClient(authorizationCode, authenticatedClientId);
+    validateAuthorizationCodeExpiration(authorizationCode);
+    validateAuthorizationCodeRedirectUri(authorizationCode, params.redirect_uri);
+    const codeVerified = await verifyAuthorizationCodePkce(authorizationCode, params.code_verifier);
+    await consumeAuthorizationCode(code, authCodeResolver);
+    return buildValidatedAuthorizationCodeRequest(code, authorizationCode, authenticatedClientId, codeVerified);
+}
+//# sourceMappingURL=authorization-code-grant.js.map

package/dist/authorization-code-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code-grant.js","sourceRoot":"","sources":["../src/authorization-code-grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAwB9D,KAAK,UAAU,mBAAmB,CAChC,YAAoB,EACpB,aAAqB,EACrB,MAAc;IAEd,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,QAAQ,KAAK,aAAa,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA0B,EAC1B,gBAA2C;IAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GACrB,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,iBAAwC,EACxC,gBAA2C;IAE3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC3C,MAAM,gBAAgB,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAKD,MAAM,UAAU,+BAA+B,CAC7C,iBAAwC,EACxC,qBAA6B;IAE7B,IAAI,iBAAiB,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,qDAAqD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,mCAAmC,CACjD,iBAAwC,EACxC,cAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEnD,IAAI,iBAAiB,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,gCAAgC,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AASD,MAAM,UAAU,oCAAoC,CAClD,iBAAwC,EACxC,kBAAsC;IAEtC,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,CAAC;QAC1C,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,uDAAuD,CACxD,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IACE,kBAAkB,KAAK,SAAS;QAChC,kBAAkB,KAAK,iBAAiB,CAAC,WAAW,EACpD,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,uDAAuD,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,iBAAwC,EACxC,YAAgC;IAEhC,MAAM,cAAc,GAClB,iBAAiB,CAAC,aAAa,KAAK,SAAS;QAC7C,iBAAiB,CAAC,mBAAmB,KAAK,SAAS,CAAC;IACtD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,iBAAiB,CAAC,aAAa,KAAK,SAAS;QAC7C,iBAAiB,CAAC,mBAAmB,KAAK,SAAS,EACnD,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAGD,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,YAAY,EACZ,iBAAiB,CAAC,aAAa,EAC/B,iBAAiB,CAAC,mBAAmB,CACtC,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,YAAY,EAC3B,iCAAiC,CAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,gBAA2C;IAE3C,MAAM,gBAAgB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAKD,MAAM,UAAU,sCAAsC,CACpD,IAAY,EACZ,iBAAwC,EACxC,qBAA6B,EAC7B,YAAqB;IAErB,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,qBAAqB;QAC/B,IAAI;QACJ,OAAO,EAAE,iBAAiB,CAAC,OAAO;QAClC,WAAW,EAAE,iBAAiB,CAAC,WAAW;QAC1C,KAAK,EAAE,iBAAiB,CAAC,KAAK;QAC9B,KAAK,EAAE,iBAAiB,CAAC,KAAK;QAC9B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;QACpC,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB,CAAC,MAAM;QAChC,YAAY;KACb,CAAC;AACJ,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,MAAM,wBAAwB,CAChE,MAAM,EACN,gBAAgB,CACjB,CAAC;IAEF,MAAM,+BAA+B,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IAC3E,+BAA+B,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IAC1E,mCAAmC,CAAC,iBAAiB,CAAC,CAAC;IACvD,oCAAoC,CAClC,iBAAiB,EACjB,MAAM,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,2BAA2B,CACpD,iBAAiB,EACjB,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,MAAM,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAEvD,OAAO,sCAAsC,CAC3C,IAAI,EACJ,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/authorization-code.d.ts

@@ -0,0 +1,28 @@
+import type { AuthorizationResponseParams } from './auth-transaction.js';
+import type { ClaimsParameter } from './userinfo.js';
+export interface AuthorizationCodeData {
+    code: string;
+    grantId: string;
+    clientId: string;
+    redirectUri: string;
+    redirectUriExplicit: boolean;
+    scope: string[];
+    subject: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    used: boolean;
+    expiresAt: number;
+    nonce?: string;
+    authTime?: number;
+    audience?: string[];
+    acrValues?: string;
+    claims?: ClaimsParameter;
+}
+export interface CreateAuthorizationCodeOptions {
+    authorizationResponse: AuthorizationResponseParams;
+    subject: string;
+    authTime: number;
+    ttlSeconds?: number;
+}
+export declare function createAuthorizationCode(options: CreateAuthorizationCodeOptions): Promise<AuthorizationCodeData>;
+//# sourceMappingURL=authorization-code.d.ts.map

package/dist/authorization-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../src/authorization-code.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUrD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAMb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAKpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAKpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAKD,MAAM,WAAW,8BAA8B;IAE7C,qBAAqB,EAAE,2BAA2B,CAAC;IAEnD,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAcD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAyChC"}

package/dist/authorization-code.js

@@ -0,0 +1,41 @@
+import { generateRandomString } from './crypto-utils.js';
+const DEFAULT_AUTH_CODE_TTL_SECONDS = 300;
+export async function createAuthorizationCode(options) {
+    const { authorizationResponse, subject, authTime, ttlSeconds } = options;
+    const code = generateRandomString(32);
+    const grantId = generateRandomString(32);
+    const now = Math.floor(Date.now() / 1000);
+    const ttl = ttlSeconds ?? DEFAULT_AUTH_CODE_TTL_SECONDS;
+    const data = {
+        code,
+        grantId,
+        clientId: authorizationResponse.clientId,
+        redirectUri: authorizationResponse.redirectUri,
+        redirectUriExplicit: authorizationResponse.redirectUriExplicit,
+        scope: authorizationResponse.scope,
+        subject,
+        used: false,
+        expiresAt: now + ttl,
+        authTime,
+    };
+    if (authorizationResponse.codeChallenge !== undefined) {
+        data.codeChallenge = authorizationResponse.codeChallenge;
+    }
+    if (authorizationResponse.codeChallengeMethod !== undefined) {
+        data.codeChallengeMethod = authorizationResponse.codeChallengeMethod;
+    }
+    if (authorizationResponse.nonce !== undefined) {
+        data.nonce = authorizationResponse.nonce;
+    }
+    if (authorizationResponse.audience !== undefined) {
+        data.audience = authorizationResponse.audience;
+    }
+    if (authorizationResponse.acrValues !== undefined) {
+        data.acrValues = authorizationResponse.acrValues;
+    }
+    if (authorizationResponse.claims !== undefined) {
+        data.claims = authorizationResponse.claims;
+    }
+    return data;
+}
+//# sourceMappingURL=authorization-code.js.map

package/dist/authorization-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code.js","sourceRoot":"","sources":["../src/authorization-code.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AA8DzD,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAW1C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC;IAEvC,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAEzE,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,IAAI,6BAA6B,CAAC;IAExD,MAAM,IAAI,GAA0B;QAClC,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,qBAAqB,CAAC,QAAQ;QACxC,WAAW,EAAE,qBAAqB,CAAC,WAAW;QAC9C,mBAAmB,EAAE,qBAAqB,CAAC,mBAAmB;QAC9D,KAAK,EAAE,qBAAqB,CAAC,KAAK;QAClC,OAAO;QACP,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,GAAG,GAAG,GAAG;QACpB,QAAQ;KACT,CAAC;IAEF,IAAI,qBAAqB,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,qBAAqB,CAAC,aAAa,CAAC;IAC3D,CAAC;IACD,IAAI,qBAAqB,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,mBAAmB,GAAG,qBAAqB,CAAC,mBAAmB,CAAC;IACvE,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC;IAC3C,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,IAAI,qBAAqB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC;IACnD,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/authorization-request.d.ts

@@ -0,0 +1,128 @@
+import type { JwkSet } from './jwks.js';
+import type { ClaimsParameter } from './userinfo.js';
+export declare const DEFAULT_REQUEST_OBJECT_SIGNING_ALGS: readonly ["RS256"];
+export declare enum AuthorizationErrorCode {
+    InvalidRequest = "invalid_request",
+    UnauthorizedClient = "unauthorized_client",
+    AccessDenied = "access_denied",
+    UnsupportedResponseType = "unsupported_response_type",
+    InvalidScope = "invalid_scope",
+    ServerError = "server_error",
+    TemporarilyUnavailable = "temporarily_unavailable",
+    InteractionRequired = "interaction_required",
+    LoginRequired = "login_required",
+    AccountSelectionRequired = "account_selection_required",
+    ConsentRequired = "consent_required",
+    RequestNotSupported = "request_not_supported",
+    RequestUriNotSupported = "request_uri_not_supported",
+    RegistrationNotSupported = "registration_not_supported"
+}
+export interface AuthorizationRequestParams {
+    response_type?: string;
+    client_id: string;
+    redirect_uri?: string;
+    scope?: string;
+    state?: string;
+    nonce?: string;
+    prompt?: string;
+    display?: string;
+    max_age?: string;
+    ui_locales?: string;
+    claims_locales?: string;
+    acr_values?: string;
+    login_hint?: string;
+    id_token_hint?: string;
+    request?: string;
+    request_uri?: string;
+    registration?: string;
+    audience?: string;
+    claims?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+}
+export interface ClientInfo {
+    clientId: string;
+    redirectUris: string[];
+    clientType?: 'confidential' | 'public';
+    responseTypes?: string[];
+    defaultMaxAge?: number;
+    jwks?: JwkSet;
+}
+export interface ClientResolver {
+    findClient(clientId: string): Promise<ClientInfo | null>;
+}
+export type OfflineAccessGrantedCallback = (request: AuthorizationRequestParams, context: {
+    promptValues: string[];
+}) => boolean | Promise<boolean>;
+export declare const defaultIsOfflineAccessGranted: OfflineAccessGrantedCallback;
+export interface ValidateAuthorizationRequestOptions {
+    isOfflineAccessGranted?: OfflineAccessGrantedCallback;
+    maxClaimsParameterLength?: number;
+    allowNonPkceAuthorizationCodeFlow?: boolean;
+    requestObject?: {
+        supported?: boolean;
+        supportedSigningAlgs?: string[];
+        allowUnsigned?: boolean;
+    };
+}
+export declare const DEFAULT_MAX_CLAIMS_PARAMETER_LENGTH = 16384;
+export interface ValidatedAuthorizationRequest {
+    responseType: 'code';
+    clientId: string;
+    redirectUri: string;
+    redirectUriExplicit: boolean;
+    scope: string[];
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    state?: string;
+    nonce?: string;
+    prompt?: string[];
+    display?: string;
+    maxAge?: number;
+    uiLocales?: string;
+    claimsLocales?: string;
+    acrValues?: string;
+    loginHint?: string;
+    idTokenHint?: string;
+    audience?: string[];
+    claims?: ClaimsParameter;
+}
+export declare class AuthorizationError extends Error {
+    readonly error: AuthorizationErrorCode;
+    readonly errorDescription: string;
+    readonly redirectUri?: string;
+    readonly state?: string;
+    constructor(error: AuthorizationErrorCode, errorDescription: string, redirectUri?: string, state?: string);
+    get redirectable(): boolean;
+}
+export declare function validateRegisteredRedirectUris(registeredUris: string[]): void;
+export declare function resolveAuthorizationRedirectUri(effectiveParams: AuthorizationRequestParams, client: ClientInfo): string;
+export declare function validatePromptParameter(effectiveParams: AuthorizationRequestParams, redirectUri: string, state?: string): string[] | undefined;
+export declare function resolveMaxAge(effectiveParams: AuthorizationRequestParams, client: ClientInfo, redirectUri: string, state?: string): number | undefined;
+export declare function validateAuthorizationCodePkce(effectiveParams: AuthorizationRequestParams, client: ClientInfo, redirectUri: string, state?: string, options?: {
+    allowNonPkceAuthorizationCodeFlow?: boolean;
+}): {
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+};
+export declare function resolveClientForAuthorization(params: AuthorizationRequestParams, clientResolver: ClientResolver): Promise<ClientInfo>;
+export interface ResolvedRequestObjectParams {
+    effectiveParams: AuthorizationRequestParams;
+    requestObjectClaims?: Record<string, unknown>;
+}
+export declare function resolveRequestObjectParams(params: AuthorizationRequestParams, client: ClientInfo, options?: {
+    supportedSigningAlgs?: string[];
+    allowUnsigned?: boolean;
+}): Promise<ResolvedRequestObjectParams>;
+export declare function rejectUnsupportedRequestParams(params: AuthorizationRequestParams, redirectUri: string, state?: string, options?: {
+    requestParameterSupported?: boolean;
+}): void;
+export declare function validateRequestObjectConsistency(params: AuthorizationRequestParams, requestObjectClaims: Record<string, unknown> | undefined, redirectUri: string, state?: string): void;
+export declare function validateResponseType(params: AuthorizationRequestParams, client: ClientInfo, redirectUri: string, state?: string): 'code';
+export declare function validateAuthorizationScope(queryParams: AuthorizationRequestParams, effectiveParams: AuthorizationRequestParams, redirectUri: string, state?: string): string[];
+export declare function applyOfflineAccessPolicy(scope: string[], effectiveParams: AuthorizationRequestParams, promptValues: string[] | undefined, isOfflineAccessGranted?: OfflineAccessGrantedCallback): Promise<string[]>;
+export declare function validateDisplayParameter(effectiveParams: AuthorizationRequestParams, redirectUri: string, state?: string): string | undefined;
+export declare function parseAudienceParameter(effectiveParams: AuthorizationRequestParams): string[] | undefined;
+export declare function validateAuthorizationRequest(params: AuthorizationRequestParams, clientResolver: ClientResolver, options?: ValidateAuthorizationRequestOptions): Promise<ValidatedAuthorizationRequest>;
+export declare function parseClaimsRequestParameter(effectiveParams: AuthorizationRequestParams, redirectUri: string, state?: string, maxLength?: number): ClaimsParameter | undefined;
+//# sourceMappingURL=authorization-request.d.ts.map

package/dist/authorization-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-request.d.ts","sourceRoot":"","sources":["../src/authorization-request.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,eAAe,CAAC;AAMxE,eAAO,MAAM,mCAAmC,oBAAqB,CAAC;AAMtE,oBAAY,sBAAsB;IAEhC,cAAc,oBAAoB;IAClC,kBAAkB,wBAAwB;IAC1C,YAAY,kBAAkB;IAC9B,uBAAuB,8BAA8B;IACrD,YAAY,kBAAkB;IAC9B,WAAW,iBAAiB;IAC5B,sBAAsB,4BAA4B;IAElD,mBAAmB,yBAAyB;IAC5C,aAAa,mBAAmB;IAChC,wBAAwB,+BAA+B;IACvD,eAAe,qBAAqB;IAGpC,mBAAmB,0BAA0B;IAC7C,sBAAsB,8BAA8B;IAGpD,wBAAwB,+BAA+B;CACxD;AAMD,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAQvB,OAAO,CAAC,EAAE,MAAM,CAAC;IAMjB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAKlB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAaD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,GAAG,QAAQ,CAAC;IAOvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IASzB,aAAa,CAAC,EAAE,MAAM,CAAC;IAOvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAqBD,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC1D;AAcD,MAAM,MAAM,4BAA4B,GAAG,CACzC,OAAO,EAAE,0BAA0B,EACnC,OAAO,EAAE;IAAE,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,KAChC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAMhC,eAAO,MAAM,6BAA6B,EAAE,4BAGP,CAAC;AAKtC,MAAM,WAAW,mCAAmC;IAKlD,sBAAsB,CAAC,EAAE,4BAA4B,CAAC;IAUtD,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAQlC,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAI5C,aAAa,CAAC,EAAE;QAOd,SAAS,CAAC,EAAE,OAAO,CAAC;QAIpB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;QAOhC,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAUD,eAAO,MAAM,mCAAmC,QAAQ,CAAC;AAKzD,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAMpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAKpB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAQD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,KAAK,EAAE,sBAAsB,CAAC;IAC9C,SAAgB,gBAAgB,EAAE,MAAM,CAAC;IACzC,SAAgB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrC,SAAgB,KAAK,CAAC,EAAE,MAAM,CAAC;gBAG7B,KAAK,EAAE,sBAAsB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,WAAW,CAAC,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,MAAM;IAchB,IAAI,YAAY,IAAI,OAAO,CAE1B;CACF;AAoFD,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CA6C7E;AAqDD,wBAAgB,+BAA+B,CAC7C,eAAe,EAAE,0BAA0B,EAC3C,MAAM,EAAE,UAAU,GACjB,MAAM,CAMR;AAUD,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,0BAA0B,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,EAAE,GAAG,SAAS,CAKtB;AA0FD,wBAAgB,aAAa,CAC3B,eAAe,EAAE,0BAA0B,EAC3C,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAQpB;AA2ED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,0BAA0B,EAC3C,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,iCAAiC,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5D;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,CAmB1D;AAOD,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,0BAA0B,EAClC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,UAAU,CAAC,CA6BrB;AAKD,MAAM,WAAW,2BAA2B;IAM1C,eAAe,EAAE,0BAA0B,CAAC;IAM5C,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AAcD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IAKP,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAKhC,aAAa,CAAC,EAAE,OAAO,CAAC;CACpB,GACL,OAAO,CAAC,2BAA2B,CAAC,CA6BtC;AAYD,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,0BAA0B,EAClC,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAAO,GACpD,IAAI,CA8BN;AAWD,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,0BAA0B,EAClC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACxD,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,IAAI,CA8BN;AAaD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAmCR;AAUD,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,0BAA0B,EACvC,eAAe,EAAE,0BAA0B,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,EAAE,CA0BV;AAWD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EAAE,EACf,eAAe,EAAE,0BAA0B,EAC3C,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,EAClC,sBAAsB,GAAE,4BAA4D,GACnF,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAQD,wBAAgB,wBAAwB,CACtC,eAAe,EAAE,0BAA0B,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAcpB;AAMD,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,0BAA0B,GAC1C,MAAM,EAAE,GAAG,SAAS,CAMtB;AA0BD,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,0BAA0B,EAClC,cAAc,EAAE,cAAc,EAC9B,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,6BAA6B,CAAC,CA0GxC;AA+ED,wBAAgB,2BAA2B,CACzC,eAAe,EAAE,0BAA0B,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,SAAS,GAAE,MAA4C,GACtD,eAAe,GAAG,SAAS,CA6C7B"}