@maronn-openid-connect/experimental 0.0.3 → 0.0.5

package/README.md

@@ -14,6 +14,8 @@
 |---|---|---|---|
 | `par` | Pushed Authorization Requests | RFC 9126 | `@maronn-openid-connect/experimental/par` |
 | `token-exchange` | OAuth 2.0 Token Exchange (impersonation) | RFC 8693 | `@maronn-openid-connect/experimental/token-exchange` |
+| `jarm` | JWT Secured Authorization Response Mode (signed `query.jwt` only) | JARM (OpenID Foundation Final, 2022-11-09) | `@maronn-openid-connect/experimental/jarm` |
+| `device-authorization-grant` | OAuth 2.0 Device Authorization Grant | RFC 8628 | `@maronn-openid-connect/experimental/device-authorization-grant` |
 
 機能ごとに subpath export で提供します。ルート (`.`) からの再エクスポートは提供しません。機能間でコードを共有しないことで、昇格・削除時に他機能へ影響しない構造を保っています。
 
@@ -63,3 +65,8 @@ Experimental 機能が core へ昇格する目安は次のとおりです。
 ## 利用者ドキュメント
 
 `docs/library-document` の Experimental セクションを参照してください。
+
+## 実装解説
+
+各機能を「何を・どう実装したか」をコード全文つきで説明する解説（日本語・英語）を
+`docs/implementation-guides/experimental/` に置いています。実装の内側を読むときはこちらを参照してください。

package/dist/device-authorization-grant/device-authorization-request.d.ts

@@ -0,0 +1,41 @@
+import { type DeviceAuthorizationRecord, type DeviceAuthorizationStore } from './store.js';
+export declare const DEFAULT_DEVICE_CODE_EXPIRES_IN = 600;
+export declare const DEFAULT_POLL_INTERVAL = 5;
+export interface DeviceAuthorizationClient {
+    clientId: string;
+    grantTypes?: string[];
+}
+export interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function validateDeviceGrantAllowed(client: DeviceAuthorizationClient): void;
+export declare function validateDeviceAuthorizationScope(scope: string | undefined): string[];
+export declare function applyOfflineAccessPolicy(scope: string[], options: {
+    client: DeviceAuthorizationClient;
+    refreshTokenFeatureEnabled: boolean;
+}): string[];
+export declare function createDeviceAuthorizationRecord(options: {
+    clientId: string;
+    scope: string[];
+    store: DeviceAuthorizationStore;
+    expiresIn: number;
+    interval: number;
+    now?: Date;
+}): Promise<DeviceAuthorizationRecord>;
+export declare function buildDeviceAuthorizationResponse(record: DeviceAuthorizationRecord, issuer: string): DeviceAuthorizationResponse;
+export declare function processDeviceAuthorizationRequest(input: {
+    params: Record<string, string>;
+    client: DeviceAuthorizationClient;
+    issuer: string;
+    expiresIn?: number;
+    interval?: number;
+    refreshTokenFeatureEnabled: boolean;
+    store: DeviceAuthorizationStore;
+    now?: Date;
+}): Promise<DeviceAuthorizationResponse>;
+//# sourceMappingURL=device-authorization-request.d.ts.map

package/dist/device-authorization-grant/device-authorization-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization-request.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/device-authorization-request.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAGvC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAQlF;AAaD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAepF;AAUD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE;IAAE,MAAM,EAAE,yBAAyB,CAAC;IAAC,0BAA0B,EAAE,OAAO,CAAA;CAAE,GAClF,MAAM,EAAE,CAMV;AAOD,wBAAsB,+BAA+B,CAAC,OAAO,EAAE;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAoBrC;AASD,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,MAAM,GACb,2BAA2B,CAU7B;AAUD,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,yBAAyB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B,EAAE,OAAO,CAAC;IACpC,KAAK,EAAE,wBAAwB,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAmBvC"}

package/dist/device-authorization-grant/device-authorization-request.js

@@ -0,0 +1,80 @@
+import { generateRandomString } from '@maronn-openid-connect/core';
+import { DeviceAuthorizationError } from './errors.js';
+import { generateUniqueUserCode } from './user-code.js';
+import { DEVICE_CODE_GRANT_TYPE, } from './store.js';
+const DEVICE_CODE_BYTE_LENGTH = 32;
+export const DEFAULT_DEVICE_CODE_EXPIRES_IN = 600;
+export const DEFAULT_POLL_INTERVAL = 5;
+export function validateDeviceGrantAllowed(client) {
+    const grantTypes = client.grantTypes ?? [];
+    if (!grantTypes.includes(DEVICE_CODE_GRANT_TYPE)) {
+        throw new DeviceAuthorizationError('unauthorized_client', 'The client is not authorized to use the device_code grant');
+    }
+}
+export function validateDeviceAuthorizationScope(scope) {
+    if (scope === undefined || scope.trim() === '') {
+        throw new DeviceAuthorizationError('invalid_request', 'Missing required parameter: scope');
+    }
+    const values = [...new Set(scope.trim().split(/\s+/).filter((value) => value.length > 0))];
+    if (!values.includes('openid')) {
+        throw new DeviceAuthorizationError('invalid_scope', 'The openid scope is required');
+    }
+    return values;
+}
+export function applyOfflineAccessPolicy(scope, options) {
+    const clientAllowsRefresh = (options.client.grantTypes ?? []).includes('refresh_token');
+    if (options.refreshTokenFeatureEnabled && clientAllowsRefresh) {
+        return scope;
+    }
+    return scope.filter((value) => value !== 'offline_access');
+}
+export async function createDeviceAuthorizationRecord(options) {
+    const { userCode, userCodeDisplay } = await generateUniqueUserCode(options.store);
+    const createdAt = options.now ?? new Date();
+    const record = {
+        deviceCode: generateRandomString(DEVICE_CODE_BYTE_LENGTH),
+        userCode,
+        userCodeDisplay,
+        clientId: options.clientId,
+        scope: options.scope,
+        status: 'pending',
+        createdAt,
+        expiresAt: new Date(createdAt.getTime() + options.expiresIn * 1000),
+        interval: options.interval,
+        lastPolledAt: null,
+        csrfToken: null,
+        bindingHash: null,
+        loginAttempts: 0,
+    };
+    await options.store.save(record);
+    return record;
+}
+export function buildDeviceAuthorizationResponse(record, issuer) {
+    const verificationUri = `${issuer}/device`;
+    return {
+        device_code: record.deviceCode,
+        user_code: record.userCodeDisplay,
+        verification_uri: verificationUri,
+        verification_uri_complete: `${verificationUri}?user_code=${encodeURIComponent(record.userCodeDisplay)}`,
+        expires_in: Math.round((record.expiresAt.getTime() - record.createdAt.getTime()) / 1000),
+        interval: record.interval,
+    };
+}
+export async function processDeviceAuthorizationRequest(input) {
+    validateDeviceGrantAllowed(input.client);
+    const requestedScope = validateDeviceAuthorizationScope(input.params['scope']);
+    const scope = applyOfflineAccessPolicy(requestedScope, {
+        client: input.client,
+        refreshTokenFeatureEnabled: input.refreshTokenFeatureEnabled,
+    });
+    const record = await createDeviceAuthorizationRecord({
+        clientId: input.client.clientId,
+        scope,
+        store: input.store,
+        expiresIn: input.expiresIn ?? DEFAULT_DEVICE_CODE_EXPIRES_IN,
+        interval: input.interval ?? DEFAULT_POLL_INTERVAL,
+        now: input.now,
+    });
+    return buildDeviceAuthorizationResponse(record, input.issuer);
+}
+//# sourceMappingURL=device-authorization-request.js.map

package/dist/device-authorization-grant/device-authorization-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization-request.js","sourceRoot":"","sources":["../../src/device-authorization-grant/device-authorization-request.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EACL,sBAAsB,GAGvB,MAAM,YAAY,CAAC;AAGpB,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAGnC,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AA0BvC,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,gCAAgC,CAAC,KAAyB;IACxE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,wBAAwB,CAChC,iBAAiB,EACjB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,KAAe,EACf,OAAmF;IAEnF,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,0BAA0B,IAAI,mBAAmB,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAOrD;IACC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAA8B;QACxC,UAAU,EAAE,oBAAoB,CAAC,uBAAuB,CAAC;QACzD,QAAQ;QACR,eAAe;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;QACnE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,MAAM,UAAU,gCAAgC,CAC9C,MAAiC,EACjC,MAAc;IAEd,MAAM,eAAe,GAAG,GAAG,MAAM,SAAS,CAAC;IAC3C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,gBAAgB,EAAE,eAAe;QACjC,yBAAyB,EAAE,GAAG,eAAe,cAAc,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE;QACvG,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;QACxF,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KASvD;IACC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEzC,MAAM,cAAc,GAAG,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,wBAAwB,CAAC,cAAc,EAAE;QACrD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAC/B,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,8BAA8B;QAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,qBAAqB;QACjD,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IAEH,OAAO,gCAAgC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC"}

package/dist/device-authorization-grant/device-code-grant.d.ts

@@ -0,0 +1,23 @@
+import { type DeviceAuthorizationRecord, type DeviceAuthorizationStore } from './store.js';
+export declare const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+export interface DeviceCodeGrantClient {
+    clientId: string;
+    grantTypes?: string[];
+}
+export interface DeviceCodeGrantResult {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    authTime: number;
+    grantId: string;
+}
+export declare function validateDeviceCodeGrantAllowed(client: DeviceCodeGrantClient): void;
+export declare function resolveDeviceCodeRecord(params: Record<string, string>, client: DeviceCodeGrantClient, store: DeviceAuthorizationStore): Promise<DeviceAuthorizationRecord>;
+export declare function evaluateDeviceCodeState(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore, now?: Date): Promise<DeviceCodeGrantResult>;
+export declare function processDeviceCodeGrant(input: {
+    params: Record<string, string>;
+    client: DeviceCodeGrantClient;
+    store: DeviceAuthorizationStore;
+    now?: Date;
+}): Promise<DeviceCodeGrantResult>;
+//# sourceMappingURL=device-code-grant.d.ts.map

package/dist/device-authorization-grant/device-code-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-grant.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/device-code-grant.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAY9C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAGD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAOlF;AAUD,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAapC;AAkBD,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA6DhC;AAUD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,qBAAqB,CAAC;IAC9B,KAAK,EAAE,wBAAwB,CAAC;IAChC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAIjC"}

package/dist/device-authorization-grant/device-code-grant.js

@@ -0,0 +1,63 @@
+import { DeviceAuthorizationError } from './errors.js';
+import { DEVICE_CODE_GRANT_TYPE, } from './store.js';
+export const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+const INVALID_DEVICE_CODE_MESSAGE = 'The device_code is invalid, expired, or was issued to another client';
+export function validateDeviceCodeGrantAllowed(client) {
+    if (!(client.grantTypes ?? []).includes(DEVICE_CODE_GRANT_TYPE)) {
+        throw new DeviceAuthorizationError('unauthorized_client', 'The client is not authorized to use the device_code grant');
+    }
+}
+export async function resolveDeviceCodeRecord(params, client, store) {
+    const deviceCode = params['device_code'];
+    if (deviceCode === undefined || deviceCode === '') {
+        throw new DeviceAuthorizationError('invalid_request', 'Missing required parameter: device_code');
+    }
+    const record = await store.findByDeviceCode(deviceCode);
+    if (record === null || record.clientId !== client.clientId) {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_DEVICE_CODE_MESSAGE);
+    }
+    return record;
+}
+export async function evaluateDeviceCodeState(record, store, now = new Date()) {
+    if (now.getTime() >= record.expiresAt.getTime()) {
+        await store.delete(record.deviceCode);
+        throw new DeviceAuthorizationError('expired_token', 'The device_code has expired. Start a new device authorization request.');
+    }
+    if (record.lastPolledAt !== null &&
+        now.getTime() - record.lastPolledAt.getTime() < record.interval * 1000) {
+        record.interval += SLOW_DOWN_INTERVAL_INCREMENT;
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new DeviceAuthorizationError('slow_down', 'Polling too frequently. Increase the interval by 5 seconds.');
+    }
+    if (record.status === 'pending') {
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new DeviceAuthorizationError('authorization_pending', 'The authorization request is still pending');
+    }
+    if (record.status === 'denied') {
+        await store.delete(record.deviceCode);
+        throw new DeviceAuthorizationError('access_denied', 'The end-user denied the authorization request');
+    }
+    const consumed = await store.consume(record.deviceCode);
+    if (consumed === null ||
+        consumed.status !== 'approved' ||
+        consumed.subject === undefined ||
+        consumed.authTime === undefined ||
+        consumed.grantId === undefined) {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_DEVICE_CODE_MESSAGE);
+    }
+    return {
+        subject: consumed.subject,
+        clientId: consumed.clientId,
+        scope: consumed.approvedScope ?? consumed.scope,
+        authTime: consumed.authTime,
+        grantId: consumed.grantId,
+    };
+}
+export async function processDeviceCodeGrant(input) {
+    validateDeviceCodeGrantAllowed(input.client);
+    const record = await resolveDeviceCodeRecord(input.params, input.client, input.store);
+    return evaluateDeviceCodeState(record, input.store, input.now);
+}
+//# sourceMappingURL=device-code-grant.js.map

package/dist/device-authorization-grant/device-code-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-grant.js","sourceRoot":"","sources":["../../src/device-authorization-grant/device-code-grant.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACL,sBAAsB,GAGvB,MAAM,YAAY,CAAC;AAGpB,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAQ9C,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAsBzE,MAAM,UAAU,8BAA8B,CAAC,MAA6B;IAC1E,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA8B,EAC9B,MAA6B,EAC7B,KAA+B;IAE/B,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,wBAAwB,CAChC,iBAAiB,EACjB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAkBD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAiC,EACjC,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,YAAY,KAAK,IAAI;QAC5B,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EACtE,CAAC;QAGD,MAAM,CAAC,QAAQ,IAAI,4BAA4B,CAAC;QAChD,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,WAAW,EACX,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAID,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,MAAM,KAAK,UAAU;QAC9B,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC9B,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAC/B,QAAQ,CAAC,OAAO,KAAK,SAAS,EAC9B,CAAC;QACD,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACnF,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK;QAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,OAAO,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC"}

package/dist/device-authorization-grant/errors.d.ts

@@ -0,0 +1,12 @@
+export type DeviceAuthorizationErrorCode = 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token' | 'invalid_request' | 'invalid_grant' | 'invalid_scope' | 'unauthorized_client';
+export declare class DeviceAuthorizationError extends Error {
+    readonly code: DeviceAuthorizationErrorCode;
+    readonly errorDescription: string;
+    constructor(code: DeviceAuthorizationErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+export declare class DeviceVerificationError extends Error {
+    readonly statusCode: 401 | 403;
+    constructor(message: string, statusCode: 401 | 403);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/device-authorization-grant/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/errors.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,4BAA4B,GACpC,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,eAAe,GACf,qBAAqB,CAAC;AAY1B,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM;IAUxE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAQD,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,GAAG;CAKnD"}

package/dist/device-authorization-grant/errors.js

@@ -0,0 +1,24 @@
+import { sanitizeErrorDescription } from '@maronn-openid-connect/core';
+export class DeviceAuthorizationError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'DeviceAuthorizationError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+export class DeviceVerificationError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.name = 'DeviceVerificationError';
+        this.statusCode = statusCode;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/device-authorization-grant/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/device-authorization-grant/errors.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AA8BvE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAA+B;IACnC,gBAAgB,CAAS;IAElC,YAAY,IAAkC,EAAE,gBAAwB;QAEtE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAQD,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,UAAU,CAAY;IAE/B,YAAY,OAAe,EAAE,UAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/device-authorization-grant/index.d.ts

@@ -0,0 +1,11 @@
+export { DEVICE_CODE_GRANT_TYPE, USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export type { DeviceAuthorizationRecord, DeviceAuthorizationStatus, DeviceAuthorizationStore, } from './store.js';
+export { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+export type { DeviceAuthorizationErrorCode } from './errors.js';
+export { formatUserCode, generateUniqueUserCode, generateUserCode, normalizeUserCode, } from './user-code.js';
+export { DEFAULT_DEVICE_CODE_EXPIRES_IN, DEFAULT_POLL_INTERVAL, applyOfflineAccessPolicy, buildDeviceAuthorizationResponse, createDeviceAuthorizationRecord, processDeviceAuthorizationRequest, validateDeviceAuthorizationScope, validateDeviceGrantAllowed, } from './device-authorization-request.js';
+export type { DeviceAuthorizationClient, DeviceAuthorizationResponse, } from './device-authorization-request.js';
+export { INVALID_USER_CODE_MESSAGE, approveDeviceAuthorization, denyDeviceAuthorization, findPendingRecordByUserCode, issueVerificationBinding, recordDeviceLoginFailure, validateVerificationBinding, validateVerificationCsrfToken, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, evaluateDeviceCodeState, processDeviceCodeGrant, resolveDeviceCodeRecord, validateDeviceCodeGrantAllowed, } from './device-code-grant.js';
+export type { DeviceCodeGrantClient, DeviceCodeGrantResult, } from './device-code-grant.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/device-authorization-grant/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,YAAY,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,iCAAiC,EACjC,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/device-authorization-grant/index.js

@@ -0,0 +1,7 @@
+export { DEVICE_CODE_GRANT_TYPE, USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+export { formatUserCode, generateUniqueUserCode, generateUserCode, normalizeUserCode, } from './user-code.js';
+export { DEFAULT_DEVICE_CODE_EXPIRES_IN, DEFAULT_POLL_INTERVAL, applyOfflineAccessPolicy, buildDeviceAuthorizationResponse, createDeviceAuthorizationRecord, processDeviceAuthorizationRequest, validateDeviceAuthorizationScope, validateDeviceGrantAllowed, } from './device-authorization-request.js';
+export { INVALID_USER_CODE_MESSAGE, approveDeviceAuthorization, denyDeviceAuthorization, findPendingRecordByUserCode, issueVerificationBinding, recordDeviceLoginFailure, validateVerificationBinding, validateVerificationCsrfToken, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, evaluateDeviceCodeState, processDeviceCodeGrant, resolveDeviceCodeRecord, validateDeviceCodeGrantAllowed, } from './device-code-grant.js';
+//# sourceMappingURL=index.js.map

package/dist/device-authorization-grant/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/device-authorization-grant/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAGhF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,wBAAwB,EACxB,gCAAgC,EAChC,+BAA+B,EAC/B,iCAAiC,EACjC,gCAAgC,EAChC,0BAA0B,GAC3B,MAAM,mCAAmC,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC"}

package/dist/device-authorization-grant/store.d.ts

@@ -0,0 +1,33 @@
+export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+export declare const USER_CODE_CHARSET = "BCDFGHJKLMNPQRSTVWXZ";
+export declare const USER_CODE_LENGTH = 8;
+export declare const USER_CODE_GROUP_SIZE = 4;
+export type DeviceAuthorizationStatus = 'pending' | 'approved' | 'denied';
+export interface DeviceAuthorizationRecord {
+    deviceCode: string;
+    userCode: string;
+    userCodeDisplay: string;
+    clientId: string;
+    scope: string[];
+    status: DeviceAuthorizationStatus;
+    createdAt: Date;
+    expiresAt: Date;
+    interval: number;
+    lastPolledAt: Date | null;
+    csrfToken: string | null;
+    bindingHash: string | null;
+    loginAttempts: number;
+    subject?: string;
+    authTime?: number;
+    approvedScope?: string[];
+    grantId?: string;
+}
+export interface DeviceAuthorizationStore {
+    save(record: DeviceAuthorizationRecord): Promise<void>;
+    findByDeviceCode(deviceCode: string): Promise<DeviceAuthorizationRecord | null>;
+    findByUserCode(userCode: string): Promise<DeviceAuthorizationRecord | null>;
+    update(record: DeviceAuthorizationRecord): Promise<void>;
+    delete(deviceCode: string): Promise<void>;
+    consume(deviceCode: string): Promise<DeviceAuthorizationRecord | null>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/device-authorization-grant/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/store.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AASrF,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AAGxD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAGlC,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAGtC,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAQ1E,MAAM,WAAW,yBAAyB;IAExC,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,EAAE,MAAM,CAAC;IAExB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAE1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAKzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,aAAa,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AASD,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAEhF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAS5E,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAc1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACxE"}

package/dist/device-authorization-grant/store.js

@@ -0,0 +1,5 @@
+export const DEVICE_CODE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+export const USER_CODE_CHARSET = 'BCDFGHJKLMNPQRSTVWXZ';
+export const USER_CODE_LENGTH = 8;
+export const USER_CODE_GROUP_SIZE = 4;
+//# sourceMappingURL=store.js.map

package/dist/device-authorization-grant/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/device-authorization-grant/store.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AASrF,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAGxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAGlC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}

package/dist/device-authorization-grant/user-code.d.ts

@@ -0,0 +1,9 @@
+import { type DeviceAuthorizationStore } from './store.js';
+export declare function generateUserCode(): string;
+export declare function formatUserCode(normalized: string): string;
+export declare function normalizeUserCode(input: string): string;
+export declare function generateUniqueUserCode(store: DeviceAuthorizationStore, maxAttempts?: number): Promise<{
+    userCode: string;
+    userCodeDisplay: string;
+}>;
+//# sourceMappingURL=user-code.d.ts.map

package/dist/device-authorization-grant/user-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-code.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/user-code.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,YAAY,CAAC;AAapB,wBAAgB,gBAAgB,IAAI,MAAM,CAazC;AAQD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMzD;AAUD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAWD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,wBAAwB,EAC/B,WAAW,SAAI,GACd,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAaxD"}

package/dist/device-authorization-grant/user-code.js

@@ -0,0 +1,39 @@
+import { USER_CODE_CHARSET, USER_CODE_GROUP_SIZE, USER_CODE_LENGTH, } from './store.js';
+export function generateUserCode() {
+    const charset = USER_CODE_CHARSET;
+    const limit = 256 - (256 % charset.length);
+    let code = '';
+    const buffer = new Uint8Array(1);
+    while (code.length < USER_CODE_LENGTH) {
+        crypto.getRandomValues(buffer);
+        const byte = buffer[0];
+        if (byte >= limit)
+            continue;
+        code += charset[byte % charset.length];
+    }
+    return formatUserCode(code);
+}
+export function formatUserCode(normalized) {
+    const groups = [];
+    for (let i = 0; i < normalized.length; i += USER_CODE_GROUP_SIZE) {
+        groups.push(normalized.slice(i, i + USER_CODE_GROUP_SIZE));
+    }
+    return groups.join('-');
+}
+export function normalizeUserCode(input) {
+    return input
+        .toUpperCase()
+        .replace(/[\s　-]/g, '');
+}
+export async function generateUniqueUserCode(store, maxAttempts = 5) {
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const userCodeDisplay = generateUserCode();
+        const userCode = normalizeUserCode(userCodeDisplay);
+        const existing = await store.findByUserCode(userCode);
+        if (existing === null) {
+            return { userCode, userCodeDisplay };
+        }
+    }
+    throw new Error(`Failed to generate a unique user_code after ${maxAttempts} attempts`);
+}
+//# sourceMappingURL=user-code.js.map

package/dist/device-authorization-grant/user-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-code.js","sourceRoot":"","sources":["../../src/device-authorization-grant/user-code.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,YAAY,CAAC;AAapB,MAAM,UAAU,gBAAgB;IAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC;IAElC,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QACjC,IAAI,IAAI,IAAI,KAAK;YAAE,SAAS;QAC5B,IAAI,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAQD,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAUD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA+B,EAC/B,WAAW,GAAG,CAAC;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,eAAe,GAAG,gBAAgB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,+CAA+C,WAAW,WAAW,CACtE,CAAC;AACJ,CAAC"}

package/dist/device-authorization-grant/verification.d.ts

@@ -0,0 +1,26 @@
+import type { DeviceAuthorizationRecord, DeviceAuthorizationStore } from './store.js';
+export declare const INVALID_USER_CODE_MESSAGE = "The code is invalid or has expired";
+export declare function findPendingRecordByUserCode(userCode: string, store: DeviceAuthorizationStore, now?: Date): Promise<DeviceAuthorizationRecord | null>;
+export declare function issueVerificationBinding(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore): Promise<{
+    bindingSecret: string;
+    csrfToken: string;
+}>;
+export declare function validateVerificationBinding(record: DeviceAuthorizationRecord, bindingSecret: string | null | undefined): Promise<void>;
+export declare function validateVerificationCsrfToken(record: DeviceAuthorizationRecord, csrfToken: string): void;
+export declare function recordDeviceLoginFailure(record: DeviceAuthorizationRecord, store: DeviceAuthorizationStore, maxLoginAttempts: number): Promise<{
+    canRetry: boolean;
+    remainingAttempts: number;
+}>;
+export declare function approveDeviceAuthorization(input: {
+    record: DeviceAuthorizationRecord;
+    store: DeviceAuthorizationStore;
+    csrfToken: string;
+    subject: string;
+    authTime: number;
+}): Promise<DeviceAuthorizationRecord>;
+export declare function denyDeviceAuthorization(input: {
+    record: DeviceAuthorizationRecord;
+    store: DeviceAuthorizationStore;
+    csrfToken: string;
+}): Promise<DeviceAuthorizationRecord>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/device-authorization-grant/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAWpB,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AA0B9E,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,wBAAwB,EAC/B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAQ3C;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAOvD;AAcD,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,yBAAyB,EACjC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAQf;AAYD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,IAAI,CAIN;AAcD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,wBAAwB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAW3D;AAeD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAerC;AAQD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,MAAM,EAAE,yBAAyB,CAAC;IAClC,KAAK,EAAE,wBAAwB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CASrC"}

package/dist/device-authorization-grant/verification.js

@@ -0,0 +1,88 @@
+import { generateRandomString } from '@maronn-openid-connect/core';
+import { DeviceAuthorizationError, DeviceVerificationError } from './errors.js';
+import { normalizeUserCode } from './user-code.js';
+const VERIFICATION_SECRET_BYTE_LENGTH = 32;
+export const INVALID_USER_CODE_MESSAGE = 'The code is invalid or has expired';
+async function sha256Base64Url(value) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+    let binary = '';
+    for (const byte of new Uint8Array(digest)) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export async function findPendingRecordByUserCode(userCode, store, now = new Date()) {
+    const normalized = normalizeUserCode(userCode);
+    if (normalized === '')
+        return null;
+    const record = await store.findByUserCode(normalized);
+    if (record === null)
+        return null;
+    if (record.status !== 'pending')
+        return null;
+    if (now.getTime() >= record.expiresAt.getTime())
+        return null;
+    return record;
+}
+export async function issueVerificationBinding(record, store) {
+    const bindingSecret = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    const csrfToken = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    record.bindingHash = await sha256Base64Url(bindingSecret);
+    record.csrfToken = csrfToken;
+    await store.update(record);
+    return { bindingSecret, csrfToken };
+}
+export async function validateVerificationBinding(record, bindingSecret) {
+    if (record.bindingHash === null || !bindingSecret) {
+        throw new DeviceVerificationError('Device verification binding is missing', 403);
+    }
+    const presented = await sha256Base64Url(bindingSecret);
+    if (presented !== record.bindingHash) {
+        throw new DeviceVerificationError('Device verification binding is invalid', 403);
+    }
+}
+export function validateVerificationCsrfToken(record, csrfToken) {
+    if (record.csrfToken === null || csrfToken === '' || csrfToken !== record.csrfToken) {
+        throw new DeviceVerificationError('CSRF token mismatch', 403);
+    }
+}
+export async function recordDeviceLoginFailure(record, store, maxLoginAttempts) {
+    record.loginAttempts += 1;
+    const canRetry = record.loginAttempts < maxLoginAttempts;
+    if (!canRetry) {
+        record.status = 'denied';
+    }
+    await store.update(record);
+    return {
+        canRetry,
+        remainingAttempts: Math.max(0, maxLoginAttempts - record.loginAttempts),
+    };
+}
+export async function approveDeviceAuthorization(input) {
+    validateVerificationCsrfToken(input.record, input.csrfToken);
+    assertPending(input.record);
+    input.record.status = 'approved';
+    input.record.subject = input.subject;
+    input.record.authTime = input.authTime;
+    input.record.approvedScope = [...input.record.scope];
+    input.record.grantId = generateRandomString(VERIFICATION_SECRET_BYTE_LENGTH);
+    input.record.bindingHash = null;
+    input.record.csrfToken = null;
+    await input.store.update(input.record);
+    return input.record;
+}
+export async function denyDeviceAuthorization(input) {
+    validateVerificationCsrfToken(input.record, input.csrfToken);
+    assertPending(input.record);
+    input.record.status = 'denied';
+    input.record.bindingHash = null;
+    input.record.csrfToken = null;
+    await input.store.update(input.record);
+    return input.record;
+}
+function assertPending(record) {
+    if (record.status !== 'pending') {
+        throw new DeviceAuthorizationError('invalid_grant', INVALID_USER_CODE_MESSAGE);
+    }
+}
+//# sourceMappingURL=verification.js.map

package/dist/device-authorization-grant/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/device-authorization-grant/verification.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAOnD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAQ3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAQ9E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,KAA+B,EAC/B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B;IAE/B,MAAM,aAAa,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,CAAC,WAAW,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAiC,EACjC,aAAwC;IAExC,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClD,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,6BAA6B,CAC3C,MAAiC,EACjC,SAAiB;IAEjB,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiC,EACjC,KAA+B,EAC/B,gBAAwB;IAExB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,GAAG,gBAAgB,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC;KACxE,CAAC;AACJ,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAMhD;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrC,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,CAAC,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;IAG7E,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,6BAA6B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE5B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAMD,SAAS,aAAa,CAAC,MAAiC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,yBAAyB,CAC1B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/jarm/index.d.ts

@@ -0,0 +1,6 @@
+export { JARM_RESPONSE_PARAM, JARM_SUPPORTED_RESPONSE_MODES, resolveJarmResponseMode, type JarmResponseModeResolution, } from './response-mode.js';
+export { assertJarmLifetimeSeconds, buildJarmRedirectUrl, createJarmResponseJwt, } from './response-jwt.js';
+export type JarmAuthTransactionFields = {
+    jarmResponseMode?: 'query.jwt';
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/jarm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jarm/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAa3B,MAAM,MAAM,yBAAyB,GAAG;IAEtC,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,CAAC"}

package/dist/jarm/index.js

@@ -0,0 +1,3 @@
+export { JARM_RESPONSE_PARAM, JARM_SUPPORTED_RESPONSE_MODES, resolveJarmResponseMode, } from './response-mode.js';
+export { assertJarmLifetimeSeconds, buildJarmRedirectUrl, createJarmResponseJwt, } from './response-jwt.js';
+//# sourceMappingURL=index.js.map

package/dist/jarm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jarm/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/jarm/response-jwt.d.ts

@@ -0,0 +1,12 @@
+import type { SigningKey } from '@maronn-openid-connect/core';
+export declare function assertJarmLifetimeSeconds(value: number): void;
+export declare function createJarmResponseJwt(options: {
+    issuer: string;
+    clientId: string;
+    parameters: Record<string, string | undefined>;
+    signingKey: SigningKey;
+    lifetimeSeconds?: number;
+    now?: Date;
+}): Promise<string>;
+export declare function buildJarmRedirectUrl(redirectUri: string, responseJwt: string): string;
+//# sourceMappingURL=response-jwt.d.ts.map

package/dist/jarm/response-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-jwt.d.ts","sourceRoot":"","sources":["../../src/jarm/response-jwt.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwD9D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAU7D;AA0BD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BlB;AAQD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAIrF"}

package/dist/jarm/response-jwt.js

@@ -0,0 +1,49 @@
+const MIN_LIFETIME_SECONDS = 5;
+const MAX_LIFETIME_SECONDS = 600;
+const DEFAULT_LIFETIME_SECONDS = 60;
+const RESPONSE_SIGNING_ALG = 'RS256';
+const WEB_CRYPTO_ALGORITHM = 'RSASSA-PKCS1-v1_5';
+function base64UrlFromBytes(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlFromJson(value) {
+    return base64UrlFromBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+export function assertJarmLifetimeSeconds(value) {
+    if (!Number.isInteger(value) ||
+        value < MIN_LIFETIME_SECONDS ||
+        value > MAX_LIFETIME_SECONDS) {
+        throw new Error(`jarmConfig.jarmResponseLifetimeSeconds must be an integer between ${MIN_LIFETIME_SECONDS} and ${MAX_LIFETIME_SECONDS} seconds (JARM Section 2.1), got ${value}`);
+    }
+}
+export async function createJarmResponseJwt(options) {
+    const lifetimeSeconds = options.lifetimeSeconds ?? DEFAULT_LIFETIME_SECONDS;
+    const issuedAtSeconds = Math.floor((options.now ?? new Date()).getTime() / 1000);
+    const claims = {};
+    for (const [name, value] of Object.entries(options.parameters)) {
+        if (value !== undefined) {
+            claims[name] = value;
+        }
+    }
+    claims['iss'] = options.issuer;
+    claims['aud'] = options.clientId;
+    claims['exp'] = issuedAtSeconds + lifetimeSeconds;
+    const encodedHeader = base64UrlFromJson({
+        alg: RESPONSE_SIGNING_ALG,
+        kid: options.signingKey.keyId,
+    });
+    const encodedPayload = base64UrlFromJson(claims);
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = await crypto.subtle.sign(WEB_CRYPTO_ALGORITHM, options.signingKey.privateKey, new TextEncoder().encode(signingInput));
+    return `${signingInput}.${base64UrlFromBytes(new Uint8Array(signature))}`;
+}
+export function buildJarmRedirectUrl(redirectUri, responseJwt) {
+    const url = new URL(redirectUri);
+    url.searchParams.set('response', responseJwt);
+    return url.toString();
+}
+//# sourceMappingURL=response-jwt.js.map

package/dist/jarm/response-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-jwt.js","sourceRoot":"","sources":["../../src/jarm/response-jwt.ts"],"names":[],"mappings":"AAcA,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAQ/B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAGjC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAiBpC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAGrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B;IACvD,OAAO,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAUD,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACxB,KAAK,GAAG,oBAAoB;QAC5B,KAAK,GAAG,oBAAoB,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,oBAAoB,QAAQ,oBAAoB,oCAAoC,KAAK,EAAE,CACjK,CAAC;IACJ,CAAC;AACH,CAAC;AA0BD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAO3C;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;IAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAEjF,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,GAAG,eAAe,CAAC;IAElD,MAAM,aAAa,GAAG,iBAAiB,CAAC;QACtC,GAAG,EAAE,oBAAoB;QACzB,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;KAC9B,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;IAE1D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,oBAAoB,EACpB,OAAO,CAAC,UAAU,CAAC,UAAU,EAC7B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAC;IAEF,OAAO,GAAG,YAAY,IAAI,kBAAkB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAQD,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,WAAmB;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/jarm/response-mode.d.ts

@@ -0,0 +1,13 @@
+export declare const JARM_SUPPORTED_RESPONSE_MODES: readonly ["query.jwt", "jwt"];
+export declare const JARM_RESPONSE_PARAM = "response";
+export type JarmResponseModeResolution = {
+    kind: 'jarm';
+    mode: 'query.jwt';
+} | {
+    kind: 'plain';
+} | {
+    kind: 'unsupported-jwt-mode';
+    requested: string;
+};
+export declare function resolveJarmResponseMode(params: object): JarmResponseModeResolution;
+//# sourceMappingURL=response-mode.d.ts.map

package/dist/jarm/response-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-mode.d.ts","sourceRoot":"","sources":["../../src/jarm/response-mode.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,6BAA6B,+BAAgC,CAAC;AAG3E,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAU9C,MAAM,MAAM,0BAA0B,GAElC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAEnC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,GAEjB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,0BAA0B,CAgBlF"}

package/dist/jarm/response-mode.js

@@ -0,0 +1,16 @@
+export const JARM_SUPPORTED_RESPONSE_MODES = ['query.jwt', 'jwt'];
+export const JARM_RESPONSE_PARAM = 'response';
+export function resolveJarmResponseMode(params) {
+    const responseMode = params['response_mode'];
+    if (typeof responseMode !== 'string') {
+        return { kind: 'plain' };
+    }
+    if (JARM_SUPPORTED_RESPONSE_MODES.includes(responseMode)) {
+        return { kind: 'jarm', mode: 'query.jwt' };
+    }
+    if (responseMode.endsWith('.jwt')) {
+        return { kind: 'unsupported-jwt-mode', requested: responseMode };
+    }
+    return { kind: 'plain' };
+}
+//# sourceMappingURL=response-mode.js.map

package/dist/jarm/response-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-mode.js","sourceRoot":"","sources":["../../src/jarm/response-mode.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,KAAK,CAAU,CAAC;AAG3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAkC9C,MAAM,UAAU,uBAAuB,CAAC,MAAc;IAKpD,MAAM,YAAY,GAAI,MAAsC,CAAC,eAAe,CAAC,CAAC;IAC9E,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,IAAK,6BAAmD,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/token-exchange/index.d.ts

@@ -1,2 +1,2 @@
-export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, type ParsedTokenExchangeParams, type TokenExchangeErrorCode, type TokenExchangeGrant, type TokenExchangeRequestContext, type TokenExchangeResponse, } from './token-exchange-request.js';
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, composeActClaim, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveActorToken, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, type ExchangedAccessTokenInfo, type ParsedTokenExchangeParams, type TokenExchangeActor, type TokenExchangeErrorCode, type TokenExchangeGrant, type TokenExchangeRequestContext, type TokenExchangeResponse, } from './token-exchange-request.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/token-exchange/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,eAAe,EACf,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/index.js

@@ -1,2 +1,2 @@
-export { SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, } from './token-exchange-request.js';
+export { ACTOR_TOKEN_INVALID_DESCRIPTION, SUBJECT_TOKEN_INVALID_DESCRIPTION, TOKEN_EXCHANGE_GRANT_TYPE, TOKEN_TYPE_ACCESS_TOKEN, TokenExchangeError, authorizeTokenExchangeClient, buildTokenExchangeResponse, composeActClaim, computeExchangedTokenLifetime, parseTokenExchangeParams, processTokenExchangeRequest, resolveActorToken, resolveExchangeTarget, resolveSubjectToken, validateExchangeScope, } from './token-exchange-request.js';
 //# sourceMappingURL=index.js.map

package/dist/token-exchange/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GAMtB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-exchange/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EACjC,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,EAC1B,eAAe,EACf,6BAA6B,EAC7B,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GAQtB,MAAM,6BAA6B,CAAC"}

package/dist/token-exchange/token-exchange-request.d.ts

@@ -2,6 +2,7 @@ import { type AccessTokenInfo, type AccessTokenResolver, type TokenClientInfo }
 export declare const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
 export declare const TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
 export declare const SUBJECT_TOKEN_INVALID_DESCRIPTION = "The provided subject_token is not valid";
+export declare const ACTOR_TOKEN_INVALID_DESCRIPTION = "The provided actor_token is not valid";
 export type TokenExchangeErrorCode = 'invalid_request' | 'unauthorized_client' | 'invalid_scope' | 'invalid_target';
 export declare class TokenExchangeError extends Error {
     readonly code: TokenExchangeErrorCode;
@@ -9,11 +10,19 @@ export declare class TokenExchangeError extends Error {
     constructor(code: TokenExchangeErrorCode, errorDescription: string);
     get statusCode(): 400;
 }
+export interface TokenExchangeActor {
+    sub: string;
+    act?: TokenExchangeActor;
+}
+export type ExchangedAccessTokenInfo = AccessTokenInfo & {
+    act?: TokenExchangeActor;
+};
 export interface ParsedTokenExchangeParams {
     subjectToken: string;
     scope?: string;
     audience?: string;
     resource?: string;
+    actorToken?: string;
 }
 export interface TokenExchangeGrant {
     subject: string;
@@ -22,6 +31,7 @@ export interface TokenExchangeGrant {
     requestedAudience?: string[];
     expiresIn: number;
     grantId?: string;
+    actor?: TokenExchangeActor;
 }
 export interface TokenExchangeResponse {
     access_token: string;
@@ -45,6 +55,15 @@ export declare function resolveSubjectToken(options: {
     accessTokenResolver: AccessTokenResolver;
     now?: Date;
 }): Promise<AccessTokenInfo>;
+export declare function resolveActorToken(options: {
+    actorToken: string;
+    accessTokenResolver: AccessTokenResolver;
+    now?: Date;
+}): Promise<AccessTokenInfo>;
+export declare function composeActClaim(options: {
+    actorSub: string;
+    subjectActChain?: TokenExchangeActor;
+}): TokenExchangeActor;
 export declare function validateExchangeScope(requestedScope: string | undefined, subjectScope: string[]): string[];
 export declare function resolveExchangeTarget(options: {
     audience?: string;

package/dist/token-exchange/token-exchange-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange-request.d.ts","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AASvF,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAS5C,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AASrB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IAUlE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAGD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,kBAAkB;IAEjC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,uBAAuB,CAAC;IAClD,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,2BAA2B;IAE1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,EAAE,mBAAmB,CAAC;IAEzC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB1E;AAUD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,yBAAyB,CAoD3B;AAaD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAe3B;AAWD,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,EAAE,CAcV;AAcD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,SAAS,CAmBvB;AAeD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAErD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,MAAM,CAcT;AAGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAUxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAoC7B"}
+{"version":3,"file":"token-exchange-request.d.ts","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,6BAA6B,CAAC;AAGrC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAG3F,eAAO,MAAM,uBAAuB,kDAAkD,CAAC;AASvF,eAAO,MAAM,iCAAiC,4CACH,CAAC;AAO5C,eAAO,MAAM,+BAA+B,0CACH,CAAC;AAS1C,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAC;AASrB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;gBAEtB,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM;IAUlE,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAQD,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,kBAAkB,CAAC;CAC1B;AAUD,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG;IACvD,GAAG,CAAC,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAGF,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IAErB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,kBAAkB;IAEjC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,CAAC,EAAE,MAAM,CAAC;IAKjB,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,OAAO,uBAAuB,CAAC;IAClD,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,2BAA2B;IAE1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,mBAAmB,EAAE,mBAAmB,CAAC;IAEzC,cAAc,EAAE,MAAM,EAAE,CAAC;IAEzB,mBAAmB,EAAE,MAAM,CAAC;IAE5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,CAgB1E;AAUD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,yBAAyB,CAoE3B;AAaD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AAcD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAO3B;AASD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAEvC,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,CAAC,EAAE,kBAAkB,CAAC;CACtC,GAAG,kBAAkB,CAKrB;AAWD,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,EAAE,CAcV;AAcD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GAAG,MAAM,EAAE,GAAG,SAAS,CAmBvB;AAeD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IAErD,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,MAAM,CAcT;AAGD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,qBAAqB,CAUxB;AAUD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAoD7B"}

package/dist/token-exchange/token-exchange-request.js

@@ -2,6 +2,7 @@ import { sanitizeErrorDescription, } from '@maronn-openid-connect/core';
 export const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
 export const TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
 export const SUBJECT_TOKEN_INVALID_DESCRIPTION = 'The provided subject_token is not valid';
+export const ACTOR_TOKEN_INVALID_DESCRIPTION = 'The provided actor_token is not valid';
 export class TokenExchangeError extends Error {
     code;
     errorDescription;
@@ -26,9 +27,6 @@ export function authorizeTokenExchangeClient(client) {
     }
 }
 export function parseTokenExchangeParams(params) {
-    if (params['actor_token'] !== undefined || params['actor_token_type'] !== undefined) {
-        throw new TokenExchangeError('invalid_request', 'Delegation is not supported: actor_token and actor_token_type must not be present.');
-    }
     const subjectToken = optional(params['subject_token']);
     if (subjectToken === undefined) {
         throw new TokenExchangeError('invalid_request', 'subject_token is required');
@@ -48,26 +46,36 @@ export function parseTokenExchangeParams(params) {
     if (resource !== undefined && !isAbsoluteUriWithoutFragment(resource)) {
         throw new TokenExchangeError('invalid_request', 'resource must be an absolute URI without a fragment component');
     }
+    const actorToken = optional(params['actor_token']);
+    const actorTokenType = optional(params['actor_token_type']);
+    if (actorToken !== undefined && actorTokenType === undefined) {
+        throw new TokenExchangeError('invalid_request', 'actor_token_type is required when actor_token is present');
+    }
+    if (actorToken === undefined && actorTokenType !== undefined) {
+        throw new TokenExchangeError('invalid_request', 'actor_token_type must not be present without actor_token');
+    }
+    if (actorTokenType !== undefined && actorTokenType !== TOKEN_TYPE_ACCESS_TOKEN) {
+        throw new TokenExchangeError('invalid_request', `Unsupported actor_token_type. Only ${TOKEN_TYPE_ACCESS_TOKEN} is supported.`);
+    }
     return {
         subjectToken,
         scope: optional(params['scope']),
         audience: optional(params['audience']),
         resource,
+        actorToken,
     };
 }
 export async function resolveSubjectToken(options) {
-    const info = await options.accessTokenResolver.findAccessToken(options.subjectToken);
-    if (info === null) {
-        throw invalidSubjectToken();
-    }
-    const nowSeconds = toEpochSeconds(options.now);
-    if (info.expiresAt <= nowSeconds) {
-        throw invalidSubjectToken();
-    }
-    if (info.nbf !== undefined && info.nbf > nowSeconds) {
-        throw invalidSubjectToken();
+    return resolveExchangeToken(options.subjectToken, options.accessTokenResolver, options.now, invalidSubjectToken);
+}
+export async function resolveActorToken(options) {
+    return resolveExchangeToken(options.actorToken, options.accessTokenResolver, options.now, invalidActorToken);
+}
+export function composeActClaim(options) {
+    if (options.subjectActChain === undefined) {
+        return { sub: options.actorSub };
     }
-    return info;
+    return { sub: options.actorSub, act: options.subjectActChain };
 }
 export function validateExchangeScope(requestedScope, subjectScope) {
     const requested = splitScope(requestedScope);
@@ -125,6 +133,18 @@ export async function processTokenExchangeRequest(context) {
         accessTokenResolver: context.accessTokenResolver,
         now: context.now,
     });
+    let actor;
+    if (parsed.actorToken !== undefined) {
+        const actorInfo = await resolveActorToken({
+            actorToken: parsed.actorToken,
+            accessTokenResolver: context.accessTokenResolver,
+            now: context.now,
+        });
+        actor = composeActClaim({
+            actorSub: actorInfo.sub,
+            subjectActChain: subject.act,
+        });
+    }
     const scope = validateExchangeScope(parsed.scope, subject.scope);
     const requestedAudience = resolveExchangeTarget({
         audience: parsed.audience,
@@ -144,6 +164,7 @@ export async function processTokenExchangeRequest(context) {
         requestedAudience,
         expiresIn,
         grantId: subject.grantId,
+        ...(actor === undefined ? {} : { actor }),
     };
 }
 function optional(value) {
@@ -163,6 +184,23 @@ function toEpochSeconds(now) {
 function invalidSubjectToken() {
     return new TokenExchangeError('invalid_request', SUBJECT_TOKEN_INVALID_DESCRIPTION);
 }
+function invalidActorToken() {
+    return new TokenExchangeError('invalid_request', ACTOR_TOKEN_INVALID_DESCRIPTION);
+}
+async function resolveExchangeToken(token, accessTokenResolver, now, invalidToken) {
+    const info = await accessTokenResolver.findAccessToken(token);
+    if (info === null) {
+        throw invalidToken();
+    }
+    const nowSeconds = toEpochSeconds(now);
+    if (info.expiresAt <= nowSeconds) {
+        throw invalidToken();
+    }
+    if (info.nbf !== undefined && info.nbf > nowSeconds) {
+        throw invalidToken();
+    }
+    return info;
+}
 function isAbsoluteUriWithoutFragment(value) {
     if (value.includes('#'))
         return false;

package/dist/token-exchange/token-exchange-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange-request.js","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAkBA,OAAO,EACL,wBAAwB,GAIzB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AASvF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAsB5C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,gBAAgB,CAAS;IAElC,YAAY,IAA4B,EAAE,gBAAwB;QAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA+DD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAGlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAG9B,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,wCAAwC,uBAAuB,gBAAgB,CAChF,CAAC;IACJ,CAAC;IAID,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACpE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,uBAAuB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0CAA0C,uBAAuB,gBAAgB,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAItE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ;KACT,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAElB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,UAAU,qBAAqB,CACnC,cAAkC,EAClC,YAAsB;IAEtB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAExC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAClB,4DAA4D,mBAAmB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAEnB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,iBAAiB,EAAE,uBAAuB;QAE1C,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAE7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC;IAIpC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,iBAAiB;QACjB,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACtF,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"token-exchange-request.js","sourceRoot":"","sources":["../../src/token-exchange/token-exchange-request.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,wBAAwB,GAIzB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,CAAC,MAAM,yBAAyB,GAAG,iDAAiD,CAAC;AAG3F,MAAM,CAAC,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AASvF,MAAM,CAAC,MAAM,iCAAiC,GAC5C,yCAAyC,CAAC;AAO5C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,uCAAuC,CAAC;AAsB1C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,gBAAgB,CAAS;IAElC,YAAY,IAA4B,EAAE,gBAAwB;QAEhE,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA6FD,MAAM,UAAU,4BAA4B,CAAC,MAAuB;IAGlE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,wBAAwB,CACtC,MAA8B;IAE9B,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAChE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,KAAK,uBAAuB,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,wCAAwC,uBAAuB,gBAAgB,CAChF,CAAC;IACJ,CAAC;IAID,MAAM,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACpE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,uBAAuB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0CAA0C,uBAAuB,gBAAgB,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAItE,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAID,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,uBAAuB,EAAE,CAAC;QAC/E,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,sCAAsC,uBAAuB,gBAAgB,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAIzC;IACC,OAAO,oBAAoB,CACzB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,GAAG,EACX,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAIvC;IACC,OAAO,oBAAoB,CACzB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,mBAAmB,EAC3B,OAAO,CAAC,GAAG,EACX,iBAAiB,CAClB,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,eAAe,CAAC,OAK/B;IACC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;AACjE,CAAC;AAWD,MAAM,UAAU,qBAAqB,CACnC,cAAkC,EAClC,YAAsB;IAEtB,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAcD,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAExC,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,UAAU,CAClB,4DAA4D,mBAAmB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAEnB,MAAM,mBAAmB,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AAGD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,iBAAiB,EAAE,uBAAuB;QAE1C,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,OAAO,CAAC,SAAS;QAE7B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC;IAIpC,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAIH,IAAI,KAAqC,CAAC;IAC1C,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,KAAK,GAAG,eAAe,CAAC;YACtB,QAAQ,EAAE,SAAS,CAAC,GAAG;YACvB,eAAe,EAAG,OAAoC,CAAC,GAAG;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,OAAO,CAAC,SAAS;QACnC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG;QACpB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QACjC,KAAK;QACL,iBAAiB;QACjB,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAGD,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,GAAqB;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;AACpF,CAAC;AAQD,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,mBAAwC,EACxC,GAAqB,EACrB,YAAsC;IAEtC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAElB,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAMD,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "@maronn-openid-connect/experimental",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Experimental OAuth/OIDC extensions for maronn-openid-connect (unstable APIs)",
   "type": "module",
   "exports": {
+    "./device-authorization-grant": {
+      "types": "./dist/device-authorization-grant/index.d.ts",
+      "import": "./dist/device-authorization-grant/index.js"
+    },
+    "./jarm": {
+      "types": "./dist/jarm/index.d.ts",
+      "import": "./dist/jarm/index.js"
+    },
     "./par": {
       "types": "./dist/par/index.d.ts",
       "import": "./dist/par/index.js"