@maronn-openid-connect/core 0.0.1

package/dist/token-request.d.ts

@@ -0,0 +1,111 @@
+export { TokenError, TokenErrorCode } from './token-error.js';
+export { buildValidatedAuthorizationCodeRequest, consumeAuthorizationCode, resolveAuthorizationCode, validateAuthorizationCodeClient, validateAuthorizationCodeExpiration, validateAuthorizationCodeGrant, validateAuthorizationCodeRedirectUri, validateAuthorizationCodeUnused, verifyAuthorizationCodePkce, } from './authorization-code-grant.js';
+export { buildValidatedRefreshTokenRequest, resolveRefreshToken, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenGrant, validateRefreshTokenIdleTimeout, validateRefreshTokenScope, validateRefreshTokenUnused, } from './refresh-token-grant.js';
+export type { ResolvedAuthorizationCode, } from './authorization-code-grant.js';
+export type { ResolvedRefreshToken, } from './refresh-token-grant.js';
+export interface TokenRequestParams {
+    grant_type: string;
+    code?: string;
+    redirect_uri?: string;
+    code_verifier?: string;
+    client_id?: string;
+    client_secret?: string;
+    refresh_token?: string;
+    scope?: string;
+}
+export interface TokenClientInfo {
+    clientId: string;
+    clientSecret?: string;
+    grantTypes?: string[];
+    tokenEndpointAuthMethod?: 'client_secret_basic' | 'client_secret_post' | 'none';
+}
+export interface TokenClientResolver {
+    findClient(clientId: string): Promise<TokenClientInfo | null>;
+}
+export interface AuthorizationCodeInfo {
+    code: string;
+    grantId: string;
+    clientId: string;
+    redirectUri: string;
+    redirectUriExplicit: boolean;
+    scope: string[];
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    expiresAt: number;
+    used: boolean;
+    nonce?: string;
+    audience?: string[];
+    acrValues?: string;
+    claims?: import('./userinfo.js').ClaimsParameter;
+}
+export interface AuthorizationCodeResolver {
+    findAuthorizationCode(code: string): Promise<AuthorizationCodeInfo | null>;
+    revokeAuthorizationCode(code: string): Promise<void>;
+    revokeTokensByGrantId?(grantId: string): Promise<void>;
+}
+export interface RefreshTokenInfo {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    expiresAt: number;
+    used: boolean;
+    grantId: string;
+    iat?: number;
+    originalIssuedAt: number;
+    issuer?: string;
+    lastUsedAt?: number;
+    audience?: string[];
+    authTime: number;
+    nonce?: string;
+    acr?: string;
+    amr?: string[];
+    azp?: string;
+}
+export interface RefreshTokenResolver {
+    resolve(token: string): Promise<RefreshTokenInfo | null>;
+    revokeRefreshToken(token: string): Promise<void>;
+    revokeTokensByGrantId?(grantId: string): Promise<void>;
+}
+export interface TokenRequestContext {
+    params: TokenRequestParams;
+    clientResolver: TokenClientResolver;
+    authCodeResolver: AuthorizationCodeResolver;
+    authenticatedClientId: string;
+    refreshTokenResolver?: RefreshTokenResolver;
+    supportedGrantTypes?: string[];
+    refreshTokenIdleTimeoutSeconds?: number;
+}
+export interface ValidatedAuthorizationCodeRequest {
+    grantType: 'authorization_code';
+    clientId: string;
+    code: string;
+    grantId: string;
+    redirectUri: string;
+    scope: string[];
+    nonce?: string;
+    audience?: string[];
+    acrValues?: string;
+    claims?: import('./userinfo.js').ClaimsParameter;
+    codeVerified: boolean;
+}
+export interface ValidatedRefreshTokenRequest {
+    grantType: 'refresh_token';
+    clientId: string;
+    subject: string;
+    scope: string[];
+    grantId: string;
+    audience?: string[];
+    authTime: number;
+    nonce?: string;
+    acr?: string;
+    amr?: string[];
+    azp?: string;
+    originalIssuedAt: number;
+    hadOfflineAccess: boolean;
+}
+export type ValidatedTokenRequest = ValidatedAuthorizationCodeRequest | ValidatedRefreshTokenRequest;
+export declare function validateGrantTypeSupported(grantType: string | undefined, supportedGrantTypes?: string[]): 'authorization_code' | 'refresh_token';
+export declare function resolveAuthenticatedTokenClient(authenticatedClientId: string, clientResolver: TokenClientResolver): Promise<TokenClientInfo>;
+export declare function validateClientGrantType(client: TokenClientInfo, grantType: string): void;
+export declare function validateTokenRequest(context: TokenRequestContext): Promise<ValidatedTokenRequest>;
+//# sourceMappingURL=token-request.d.ts.map

package/dist/token-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-request.d.ts","sourceRoot":"","sources":["../src/token-request.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EACxB,wBAAwB,EACxB,+BAA+B,EAC/B,mCAAmC,EACnC,8BAA8B,EAC9B,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAUlC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IAMjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAOtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAOtB,uBAAuB,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,MAAM,CAAC;CACjF;AAKD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CAC/D;AAKD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IAKb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IAMpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAKpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,MAAM,CAAC,EAAE,OAAO,eAAe,EAAE,eAAe,CAAC;CAClD;AAKD,MAAM,WAAW,yBAAyB;IACxC,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAqB3E,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAMrD,qBAAqB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAaD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IAKd,OAAO,EAAE,MAAM,CAAC;IAEhB,GAAG,CAAC,EAAE,MAAM,CAAC;IAOb,gBAAgB,EAAE,MAAM,CAAC;IAEzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAOhB,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAKpB,QAAQ,EAAE,MAAM,CAAC;IASjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAMf,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAKf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAKD,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAmBzD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQjD,qBAAqB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAYD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,EAAE,yBAAyB,CAAC;IAE5C,qBAAqB,EAAE,MAAM,CAAC;IAE9B,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAQ5C,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAU/B,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAKD,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,oBAAoB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAMpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,MAAM,CAAC,EAAE,OAAO,eAAe,EAAE,eAAe,CAAC;IACjD,YAAY,EAAE,OAAO,CAAC;CACvB;AASD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,OAAO,EAAE,MAAM,CAAC;IAKhB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,gBAAgB,EAAE,MAAM,CAAC;IASzB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAKD,MAAM,MAAM,qBAAqB,GAAG,iCAAiC,GAAG,4BAA4B,CAAC;AAarG,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,mBAAmB,GAAE,MAAM,EAAuC,GACjE,oBAAoB,GAAG,eAAe,CAmBxC;AASD,wBAAsB,+BAA+B,CACnD,qBAAqB,EAAE,MAAM,EAC7B,cAAc,EAAE,mBAAmB,GAClC,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAUD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,GAChB,IAAI,CAQN;AAoBD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAsBhC"}

package/dist/token-request.js

@@ -0,0 +1,44 @@
+import { TokenError, TokenErrorCode } from './token-error.js';
+import { validateAuthorizationCodeGrant } from './authorization-code-grant.js';
+import { validateRefreshTokenGrant } from './refresh-token-grant.js';
+export { TokenError, TokenErrorCode } from './token-error.js';
+export { buildValidatedAuthorizationCodeRequest, consumeAuthorizationCode, resolveAuthorizationCode, validateAuthorizationCodeClient, validateAuthorizationCodeExpiration, validateAuthorizationCodeGrant, validateAuthorizationCodeRedirectUri, validateAuthorizationCodeUnused, verifyAuthorizationCodePkce, } from './authorization-code-grant.js';
+export { buildValidatedRefreshTokenRequest, resolveRefreshToken, validateRefreshTokenClient, validateRefreshTokenExpiration, validateRefreshTokenGrant, validateRefreshTokenIdleTimeout, validateRefreshTokenScope, validateRefreshTokenUnused, } from './refresh-token-grant.js';
+const DEFAULT_SUPPORTED_GRANT_TYPES = ['authorization_code', 'refresh_token'];
+export function validateGrantTypeSupported(grantType, supportedGrantTypes = [...DEFAULT_SUPPORTED_GRANT_TYPES]) {
+    if (!grantType) {
+        throw new TokenError(TokenErrorCode.InvalidRequest, 'Missing required parameter: grant_type');
+    }
+    if ((grantType !== 'authorization_code' && grantType !== 'refresh_token') ||
+        !supportedGrantTypes.includes(grantType)) {
+        throw new TokenError(TokenErrorCode.UnsupportedGrantType, `Unsupported grant_type: ${grantType}`);
+    }
+    return grantType;
+}
+export async function resolveAuthenticatedTokenClient(authenticatedClientId, clientResolver) {
+    if (!authenticatedClientId) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication required');
+    }
+    const client = await clientResolver.findClient(authenticatedClientId);
+    if (!client) {
+        throw new TokenError(TokenErrorCode.InvalidClient, 'Client authentication failed');
+    }
+    return client;
+}
+export function validateClientGrantType(client, grantType) {
+    const allowedGrantTypes = client.grantTypes ?? ['authorization_code'];
+    if (!allowedGrantTypes.includes(grantType)) {
+        throw new TokenError(TokenErrorCode.UnauthorizedClient, `Client is not authorized to use grant_type: ${grantType}`);
+    }
+}
+export async function validateTokenRequest(context) {
+    const { params, clientResolver, authenticatedClientId } = context;
+    const grantType = validateGrantTypeSupported(params.grant_type, context.supportedGrantTypes);
+    const client = await resolveAuthenticatedTokenClient(authenticatedClientId, clientResolver);
+    validateClientGrantType(client, grantType);
+    if (grantType === 'refresh_token') {
+        return validateRefreshTokenGrant(context);
+    }
+    return validateAuthorizationCodeGrant(context);
+}
+//# sourceMappingURL=token-request.js.map

package/dist/token-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-request.js","sourceRoot":"","sources":["../src/token-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAIrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EACL,sCAAsC,EACtC,wBAAwB,EACxB,wBAAwB,EACxB,+BAA+B,EAC/B,mCAAmC,EACnC,8BAA8B,EAC9B,oCAAoC,EACpC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,EAC1B,8BAA8B,EAC9B,yBAAyB,EACzB,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,0BAA0B,CAAC;AA0PlC,MAAM,6BAA6B,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAU,CAAC;AAwHvF,MAAM,UAAU,0BAA0B,CACxC,SAA6B,EAC7B,sBAAgC,CAAC,GAAG,6BAA6B,CAAC;IAElE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,cAAc,EAC7B,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED,IACE,CAAC,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,CAAC;QACrE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,oBAAoB,EACnC,2BAA2B,SAAS,EAAE,CACvC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,qBAA6B,EAC7B,cAAmC;IAEnC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,aAAa,EAC5B,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,MAAM,UAAU,uBAAuB,CACrC,MAAuB,EACvB,SAAiB;IAEjB,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,UAAU,CAClB,cAAc,CAAC,kBAAkB,EACjC,+CAA+C,SAAS,EAAE,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC;IAGlE,MAAM,SAAS,GAAG,0BAA0B,CAC1C,MAAM,CAAC,UAAU,EACjB,OAAO,CAAC,mBAAmB,CAC5B,CAAC;IAGF,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAClD,qBAAqB,EACrB,cAAc,CACf,CAAC;IACF,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAG3C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/token-response.d.ts

@@ -0,0 +1,111 @@
+import type { IdTokenPayload } from './id-token.js';
+import type { AccessTokenIssuer } from './access-token-issuer.js';
+import type { AccessTokenPayload } from './access-token.js';
+import type { UserClaims, ClaimsParameter } from './userinfo.js';
+export type AcrResolver = (context: {
+    userId: string;
+    clientId: string;
+    requestedAcrValues?: string;
+}) => Promise<{
+    acr: string;
+    amr: string[];
+} | undefined>;
+export interface TokenResponseOptions {
+    issuer: string;
+    subject: string;
+    clientId: string;
+    scope: string[];
+    privateKey: CryptoKey;
+    accessTokenExpiresIn: number;
+    idTokenExpiresIn: number;
+    keyId?: string;
+    idTokenPrivateKey?: CryptoKey;
+    idTokenKeyId?: string;
+    nonce?: string;
+    authTime?: number;
+    audience?: string[];
+    idTokenAudiences?: string[];
+    issueRefreshToken?: boolean;
+    refreshTokenExpiresIn?: number;
+    accessTokenIssuer?: AccessTokenIssuer;
+    issueIdToken?: boolean;
+    acrResolver?: AcrResolver;
+    requestedAcrValues?: string;
+    acr?: string;
+    amr?: string[];
+    userClaims?: UserClaims;
+    claims?: ClaimsParameter;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    id_token?: string;
+    scope: string;
+    refresh_token?: string;
+}
+export interface GenerateTokenResponseResult {
+    response: TokenResponse;
+    resolvedAcr?: string;
+    resolvedAmr?: string[];
+    accessTokenJti?: string;
+}
+export interface AccessTokenAudienceInput {
+    userInfoEndpoint?: string;
+    requested?: string[];
+    issuer: string;
+}
+export declare function buildAccessTokenAudience(input: AccessTokenAudienceInput): string[];
+export interface IdTokenAudienceInput {
+    clientId: string;
+    additional?: string[];
+}
+export interface IdTokenAudienceResult {
+    aud: string | string[];
+    azp?: string;
+}
+export declare function buildIdTokenAudience(input: IdTokenAudienceInput): IdTokenAudienceResult;
+export interface AccessTokenPayloadInput {
+    issuer: string;
+    subject: string;
+    clientId: string;
+    scope: string[];
+    audience?: string[];
+    expiresIn: number;
+    issuedAt?: number;
+    jti?: string;
+}
+export declare function buildAccessTokenPayload(input: AccessTokenPayloadInput): AccessTokenPayload;
+export declare function computeAtHash(accessToken: string, idTokenPrivateKey: CryptoKey): Promise<string>;
+export interface ResolveAcrAmrInput {
+    subject: string;
+    clientId: string;
+    acr?: string;
+    amr?: string[];
+    requestedAcrValues?: string;
+    claims?: ClaimsParameter;
+    acrResolver?: AcrResolver;
+}
+export interface ResolvedAcrAmr {
+    acr?: string;
+    amr?: string[];
+}
+export declare function resolveAcrAmr(input: ResolveAcrAmrInput): Promise<ResolvedAcrAmr>;
+export interface IdTokenPayloadInput {
+    issuer: string;
+    subject: string;
+    clientId: string;
+    scope: string[];
+    expiresIn: number;
+    issuedAt?: number;
+    atHash?: string;
+    nonce?: string;
+    authTime?: number;
+    acr?: string;
+    amr?: string[];
+    idTokenAudiences?: string[];
+    userClaims?: UserClaims;
+}
+export declare function buildIdTokenPayload(input: IdTokenPayloadInput): IdTokenPayload;
+export declare function generateTokenResponse(options: TokenResponseOptions): Promise<GenerateTokenResponseResult>;
+//# sourceMappingURL=token-response.d.ts.map

package/dist/token-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-response.d.ts","sourceRoot":"","sources":["../src/token-response.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAiBjE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,KAAK,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAAC,CAAC;AAK1D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAKhB,UAAU,EAAE,SAAS,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IAEzB,KAAK,CAAC,EAAE,MAAM,CAAC;IAOf,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAE9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAOlB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IASpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAO/B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAMtC,YAAY,CAAC,EAAE,OAAO,CAAC;IAOvB,WAAW,CAAC,EAAE,WAAW,CAAC;IAI1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAM5B,GAAG,CAAC,EAAE,MAAM,CAAC;IAIb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAOf,UAAU,CAAC,EAAE,UAAU,CAAC;IAOxB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAMD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IAMnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAKlB,KAAK,EAAE,MAAM,CAAC;IAEd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAUD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,aAAa,CAAC;IAExB,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAQvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,MAAM,WAAW,wBAAwB;IAKvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB,MAAM,EAAE,MAAM,CAAC;CAChB;AAcD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAWlF;AAcD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,qBAAqB,CAOvF;AAKD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAMhB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAKlB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAYD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,uBAAuB,GAC7B,kBAAkB,CAsBpB;AAeD,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,iBAAiB,EAAE,SAAS,GAC3B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAKD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAaD,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+BtF;AAKD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,SAAS,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IAEf,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AASD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAyD9E;AAiBD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAiH/G"}

package/dist/token-response.js

@@ -0,0 +1,173 @@
+import { generateIdToken } from './id-token.js';
+import { arrayBufferToBase64Url, stringToArrayBuffer, generateRandomString, getJwaAlgorithm, jwaToHashName } from './crypto-utils.js';
+import { createJwtAccessTokenIssuer } from './access-token-issuer.js';
+import { filterClaimsByScope } from './userinfo.js';
+export function buildAccessTokenAudience(input) {
+    const { userInfoEndpoint, requested, issuer } = input;
+    const members = [];
+    if (userInfoEndpoint) {
+        members.push(userInfoEndpoint);
+    }
+    if (requested) {
+        members.push(...requested);
+    }
+    const deduped = [...new Set(members)];
+    return deduped.length > 0 ? deduped : [issuer];
+}
+export function buildIdTokenAudience(input) {
+    const { clientId, additional } = input;
+    const deduped = [...new Set([clientId, ...(additional ?? [])])];
+    if (deduped.length <= 1) {
+        return { aud: clientId };
+    }
+    return { aud: deduped, azp: clientId };
+}
+export function buildAccessTokenPayload(input) {
+    const { issuer, subject, clientId, scope, audience, expiresIn } = input;
+    const issuedAt = input.issuedAt ?? Math.floor(Date.now() / 1000);
+    return {
+        iss: issuer,
+        sub: subject,
+        aud: buildAccessTokenAudience({ requested: audience, issuer }),
+        exp: issuedAt + expiresIn,
+        iat: issuedAt,
+        jti: input.jti ?? generateRandomString(16),
+        scope: scope.join(' '),
+        client_id: clientId,
+    };
+}
+export async function computeAtHash(accessToken, idTokenPrivateKey) {
+    const hashName = jwaToHashName(getJwaAlgorithm(idTokenPrivateKey));
+    const tokenBytes = stringToArrayBuffer(accessToken);
+    const hashBuffer = await crypto.subtle.digest(hashName, tokenBytes);
+    const leftHalf = hashBuffer.slice(0, hashBuffer.byteLength / 2);
+    return arrayBufferToBase64Url(leftHalf);
+}
+export async function resolveAcrAmr(input) {
+    const { subject, clientId, acr, amr, requestedAcrValues, claims, acrResolver } = input;
+    if (acr !== undefined || amr !== undefined) {
+        return { acr, amr };
+    }
+    if (!acrResolver) {
+        return { acr: undefined, amr: undefined };
+    }
+    let effectiveRequestedAcrValues = requestedAcrValues;
+    if (effectiveRequestedAcrValues === undefined && claims?.id_token) {
+        const acrEntry = claims.id_token['acr'];
+        if (acrEntry && Array.isArray(acrEntry.values)) {
+            const stringValues = acrEntry.values.filter((v) => typeof v === 'string');
+            if (stringValues.length > 0) {
+                effectiveRequestedAcrValues = stringValues.join(' ');
+            }
+        }
+    }
+    const result = await acrResolver({
+        userId: subject,
+        clientId,
+        requestedAcrValues: effectiveRequestedAcrValues,
+    });
+    return { acr: result?.acr, amr: result?.amr };
+}
+export function buildIdTokenPayload(input) {
+    const { issuer, subject, clientId, scope, expiresIn, atHash, nonce, authTime, acr, amr, idTokenAudiences, userClaims, } = input;
+    const issuedAt = input.issuedAt ?? Math.floor(Date.now() / 1000);
+    const payload = {};
+    if (userClaims) {
+        Object.assign(payload, filterClaimsByScope(userClaims, scope));
+    }
+    payload.iss = issuer;
+    payload.sub = subject;
+    const { aud, azp } = buildIdTokenAudience({ clientId, additional: idTokenAudiences });
+    payload.aud = aud;
+    if (azp !== undefined) {
+        payload.azp = azp;
+    }
+    payload.exp = issuedAt + expiresIn;
+    payload.iat = issuedAt;
+    if (atHash !== undefined) {
+        payload.at_hash = atHash;
+    }
+    if (nonce !== undefined) {
+        payload.nonce = nonce;
+    }
+    if (authTime !== undefined) {
+        payload.auth_time = authTime;
+    }
+    if (acr !== undefined) {
+        payload.acr = acr;
+    }
+    if (amr !== undefined) {
+        payload.amr = amr;
+    }
+    return payload;
+}
+export async function generateTokenResponse(options) {
+    const { issuer, subject, clientId, scope, privateKey, accessTokenExpiresIn, idTokenExpiresIn, keyId, idTokenPrivateKey, idTokenKeyId, nonce, authTime, audience, idTokenAudiences, issueRefreshToken, accessTokenIssuer, issueIdToken = true, acrResolver, requestedAcrValues, acr: directAcr, amr: directAmr, userClaims, claims, } = options;
+    const idtKey = idTokenPrivateKey ?? privateKey;
+    const idtKid = idTokenKeyId ?? keyId;
+    const now = Math.floor(Date.now() / 1000);
+    const accessTokenPayload = buildAccessTokenPayload({
+        issuer,
+        subject,
+        clientId,
+        scope,
+        audience,
+        expiresIn: accessTokenExpiresIn,
+        issuedAt: now,
+    });
+    const issuerImpl = accessTokenIssuer ?? createJwtAccessTokenIssuer();
+    const accessToken = await issuerImpl.issue({
+        payload: accessTokenPayload,
+        privateKey,
+        keyId,
+    });
+    let idToken;
+    let resolvedAcr;
+    let resolvedAmr;
+    if (issueIdToken) {
+        const atHash = await computeAtHash(accessToken, idtKey);
+        ({ acr: resolvedAcr, amr: resolvedAmr } = await resolveAcrAmr({
+            subject,
+            clientId,
+            acr: directAcr,
+            amr: directAmr,
+            requestedAcrValues,
+            claims,
+            acrResolver,
+        }));
+        const idTokenPayload = buildIdTokenPayload({
+            issuer,
+            subject,
+            clientId,
+            scope,
+            expiresIn: idTokenExpiresIn,
+            issuedAt: now,
+            atHash,
+            nonce,
+            authTime,
+            acr: resolvedAcr,
+            amr: resolvedAmr,
+            idTokenAudiences,
+            userClaims,
+        });
+        idToken = await generateIdToken({
+            payload: idTokenPayload,
+            privateKey: idtKey,
+            keyId: idtKid,
+        });
+    }
+    return {
+        response: {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: accessTokenExpiresIn,
+            id_token: idToken,
+            scope: scope.join(' '),
+            refresh_token: issueRefreshToken ? generateRandomString(32) : undefined,
+        },
+        resolvedAcr,
+        resolvedAmr,
+        accessTokenJti: accessTokenPayload.jti,
+    };
+}
+//# sourceMappingURL=token-response.js.map

package/dist/token-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-response.js","sourceRoot":"","sources":["../src/token-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtI,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAoMpD,MAAM,UAAU,wBAAwB,CAAC,KAA+B;IACtE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAyBD,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAqCD,MAAM,UAAU,uBAAuB,CACrC,KAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjE,OAAO;QACL,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC9D,GAAG,EAAE,QAAQ,GAAG,SAAS;QACzB,GAAG,EAAE,QAAQ;QASb,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,iBAA4B;IAE5B,MAAM,QAAQ,GAAG,aAAa,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,sBAAsB,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAoCD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEvF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAKD,IAAI,2BAA2B,GAAG,kBAAkB,CAAC;IACrD,IAAI,2BAA2B,KAAK,SAAS,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YACvF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,2BAA2B,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,MAAM,EAAE,OAAO;QACf,QAAQ;QACR,kBAAkB,EAAE,2BAA2B;KAChD,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAChD,CAAC;AAiCD,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC5D,MAAM,EACJ,MAAM,EACN,OAAO,EACP,QAAQ,EACR,KAAK,EACL,SAAS,EACT,MAAM,EACN,KAAK,EACL,QAAQ,EACR,GAAG,EACH,GAAG,EACH,gBAAgB,EAChB,UAAU,GACX,GAAG,KAAK,CAAC;IACV,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAK5C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC;IACrB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;IAMtB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAClB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnC,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC;IACvB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,OAAyB,CAAC;AACnC,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA6B;IACvE,MAAM,EACJ,MAAM,EACN,OAAO,EACP,QAAQ,EACR,KAAK,EACL,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,EACL,iBAAiB,EACjB,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GAAG,IAAI,EACnB,WAAW,EACX,kBAAkB,EAClB,GAAG,EAAE,SAAS,EACd,GAAG,EAAE,SAAS,EACd,UAAU,EACV,MAAM,GACP,GAAG,OAAO,CAAC;IAGZ,MAAM,MAAM,GAAG,iBAAiB,IAAI,UAAU,CAAC;IAC/C,MAAM,MAAM,GAAG,YAAY,IAAI,KAAK,CAAC;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAO1C,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;QACjD,MAAM;QACN,OAAO;QACP,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,GAAG;KACd,CAAC,CAAC;IAGH,MAAM,UAAU,GAAG,iBAAiB,IAAI,0BAA0B,EAAE,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC;QACzC,OAAO,EAAE,kBAAkB;QAC3B,UAAU;QACV,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,OAA2B,CAAC;IAGhC,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAiC,CAAC;IAEtC,IAAI,YAAY,EAAE,CAAC;QAGjB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAExD,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC;YAC5D,OAAO;YACP,QAAQ;YACR,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,SAAS;YACd,kBAAkB;YAClB,MAAM;YACN,WAAW;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,cAAc,GAAG,mBAAmB,CAAC;YACzC,MAAM;YACN,OAAO;YACP,QAAQ;YACR,KAAK;YACL,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,GAAG;YACb,MAAM;YACN,KAAK;YACL,QAAQ;YACR,GAAG,EAAE,WAAW;YAChB,GAAG,EAAE,WAAW;YAChB,gBAAgB;YAChB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,GAAG,MAAM,eAAe,CAAC;YAC9B,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,QAAQ,EAAE;YACR,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,oBAAoB;YAChC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YACtB,aAAa,EAAE,iBAAiB,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;SACxE;QACD,WAAW;QACX,WAAW;QACX,cAAc,EAAE,kBAAkB,CAAC,GAAG;KACvC,CAAC;AACJ,CAAC"}

package/dist/userinfo.d.ts

@@ -0,0 +1,98 @@
+export declare enum UserInfoErrorCode {
+    InvalidToken = "invalid_token",
+    InsufficientScope = "insufficient_scope"
+}
+export declare class UserInfoError extends Error {
+    readonly error: UserInfoErrorCode;
+    readonly errorDescription: string;
+    constructor(error: UserInfoErrorCode, errorDescription: string);
+    get statusCode(): number;
+}
+export interface AccessTokenInfo {
+    sub: string;
+    scope: string[];
+    clientId: string;
+    expiresAt: number;
+    grantId?: string;
+    iat?: number;
+    nbf?: number;
+    audience?: string[];
+    issuer?: string;
+    jti?: string;
+    claims?: ClaimsParameter;
+}
+export interface AccessTokenResolver {
+    findAccessToken(token: string): Promise<AccessTokenInfo | null>;
+}
+export interface AddressClaim {
+    formatted?: string;
+    street_address?: string;
+    locality?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+}
+export interface UserClaims {
+    sub: string;
+    name?: string;
+    family_name?: string;
+    given_name?: string;
+    middle_name?: string;
+    nickname?: string;
+    preferred_username?: string;
+    profile?: string;
+    picture?: string;
+    website?: string;
+    gender?: string;
+    birthdate?: string;
+    zoneinfo?: string;
+    locale?: string;
+    updated_at?: number;
+    email?: string;
+    email_verified?: boolean;
+    address?: AddressClaim;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+}
+export interface UserClaimsResolver {
+    findUserClaims(sub: string): Promise<UserClaims | null>;
+}
+export interface ClaimRequestEntry {
+    essential?: boolean;
+    value?: unknown;
+    values?: unknown[];
+    [key: string]: unknown;
+}
+export type ClaimRequestValue = ClaimRequestEntry | null;
+export interface ClaimsParameter {
+    userinfo?: Record<string, ClaimRequestValue>;
+    id_token?: Record<string, ClaimRequestValue>;
+}
+export interface UserInfoRequestContext {
+    accessToken: string;
+    accessTokenResolver: AccessTokenResolver;
+    userClaimsResolver: UserClaimsResolver;
+    claimsParameter?: ClaimsParameter;
+    expectedAudience?: string;
+}
+export type UserInfoResponse = {
+    sub: string;
+} & Partial<Omit<UserClaims, 'sub'>>;
+export declare const SCOPE_CLAIMS_MAP: Record<string, (keyof UserClaims)[]>;
+export declare function filterClaimsByScope(userClaims: UserClaims, scopes: string[]): UserInfoResponse;
+export declare function resolveUserInfoAccessToken(accessToken: string | undefined, accessTokenResolver: AccessTokenResolver): Promise<AccessTokenInfo>;
+export declare function validateUserInfoTokenExpiration(tokenInfo: AccessTokenInfo, now?: number): void;
+export declare function validateUserInfoScope(tokenInfo: AccessTokenInfo): void;
+export declare function validateUserInfoAudience(tokenInfo: AccessTokenInfo, expectedAudience: string | undefined): void;
+export declare function resolveUserInfoClaims(tokenInfo: AccessTokenInfo, userClaimsResolver: UserClaimsResolver): Promise<UserClaims>;
+export declare function applyRequestedClaims(response: UserInfoResponse, userClaims: UserClaims, claimsParameter?: ClaimsParameter): UserInfoResponse;
+export declare function handleUserInfoRequest(context: UserInfoRequestContext): Promise<UserInfoResponse>;
+export interface UserInfoJwtOptions {
+    issuer: string;
+    audience: string;
+    privateKey: CryptoKey;
+    keyId?: string;
+    expiresIn?: number;
+}
+export declare function generateUserInfoJwt(userInfoResponse: UserInfoResponse, options: UserInfoJwtOptions): Promise<string>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../src/userinfo.ts"],"names":[],"mappings":"AAYA,oBAAY,iBAAiB;IAC3B,YAAY,kBAAkB;IAC9B,iBAAiB,uBAAuB;CACzC;AAKD,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAgB,KAAK,EAAE,iBAAiB,CAAC;IACzC,SAAgB,gBAAgB,EAAE,MAAM,CAAC;gBAE7B,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM;IAe9D,IAAI,UAAU,IAAI,MAAM,CAEvB;CACF;AASD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAOlB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,GAAG,CAAC,EAAE,MAAM,CAAC;IAOb,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAKD,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACjE;AAMD,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,OAAO,CAAC,EAAE,YAAY,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAKD,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACzD;AAOD,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAC;AAQzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC9C;AAKD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,eAAe,CAAC,EAAE,eAAe,CAAC;IAYlC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAKD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAMrC,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,UAAU,CAAC,EAAE,CAoBjE,CAAC;AASF,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EAAE,GACf,gBAAgB,CAiBlB;AAgGD,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,mBAAmB,EAAE,mBAAmB,GACvC,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAWD,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAsC,GAC1C,IAAI,CAON;AAWD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAOtE;AAgBD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,eAAe,EAC1B,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,IAAI,CAUN;AAUD,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,EAC1B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,CAAC,UAAU,CAAC,CAUrB;AAkBD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,EAC1B,UAAU,EAAE,UAAU,EACtB,eAAe,CAAC,EAAE,eAAe,GAChC,gBAAgB,CAgBlB;AAsBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAkB3B;AAMD,MAAM,WAAW,kBAAkB;IAEjC,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,EAAE,SAAS,CAAC;IAEtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuBD,wBAAsB,mBAAmB,CACvC,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CA4BjB"}