@maronn-openid-connect/experimental 0.0.5 → 0.0.7

package/README.md

@@ -16,6 +16,9 @@
 | `token-exchange` | OAuth 2.0 Token Exchange (impersonation) | RFC 8693 | `@maronn-openid-connect/experimental/token-exchange` |
 | `jarm` | JWT Secured Authorization Response Mode (signed `query.jwt` only) | JARM (OpenID Foundation Final, 2022-11-09) | `@maronn-openid-connect/experimental/jarm` |
 | `device-authorization-grant` | OAuth 2.0 Device Authorization Grant | RFC 8628 | `@maronn-openid-connect/experimental/device-authorization-grant` |
+| `id-jag` | Cross-App Access / Identity Assertion Authorization Grant（発行と受領の両側） | draft-ietf-oauth-identity-assertion-authz-grant-04 | `@maronn-openid-connect/experimental/id-jag` |
+| `ciba` | Client-Initiated Backchannel Authentication（Poll モードのみ） | CIBA Core 1.0 (OpenID Foundation Final, 2021-09-01) | `@maronn-openid-connect/experimental/ciba` |
+| `jwt-introspection-response` | JWT Response for OAuth Token Introspection（署名付き応答のみ・RS256 固定） | RFC 9701 | `@maronn-openid-connect/experimental/jwt-introspection-response` |
 
 機能ごとに subpath export で提供します。ルート (`.`) からの再エクスポートは提供しません。機能間でコードを共有しないことで、昇格・削除時に他機能へ影響しない構造を保っています。
 
@@ -65,8 +68,3 @@ Experimental 機能が core へ昇格する目安は次のとおりです。
 ## 利用者ドキュメント
 
 `docs/library-document` の Experimental セクションを参照してください。
-
-## 実装解説
-
-各機能を「何を・どう実装したか」をコード全文つきで説明する解説（日本語・英語）を
-`docs/implementation-guides/experimental/` に置いています。実装の内側を読むときはこちらを参照してください。

package/dist/ciba/backchannel-authentication-request.d.ts

@@ -0,0 +1,31 @@
+import { type TokenClientInfo } from '@maronn-openid-connect/core';
+import { type CibaAuthenticationRequestStore } from './store.js';
+export declare const BINDING_MESSAGE_MAX_LENGTH = 100;
+export type CibaClientInfo = TokenClientInfo & {
+    backchannelTokenDeliveryMode?: 'poll' | 'ping' | 'push';
+};
+export type CibaUserResolver = (loginHint: string) => Promise<{
+    subject: string;
+} | null> | {
+    subject: string;
+} | null;
+export interface CibaConfig {
+    authReqIdExpiresIn: number;
+    pollingInterval: number;
+    maxPendingPerSubject: number;
+}
+export interface BackchannelAuthenticationResponse {
+    auth_req_id: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function processBackchannelAuthenticationRequest(input: {
+    params: Record<string, string>;
+    client: CibaClientInfo;
+    store: CibaAuthenticationRequestStore;
+    config: CibaConfig;
+    refreshTokenFeatureEnabled: boolean;
+    resolveUser: CibaUserResolver;
+    now?: Date;
+}): Promise<BackchannelAuthenticationResponse>;
+//# sourceMappingURL=backchannel-authentication-request.d.ts.map

package/dist/ciba/backchannel-authentication-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backchannel-authentication-request.d.ts","sourceRoot":"","sources":["../../src/ciba/backchannel-authentication-request.ts"],"names":[],"mappings":"AAYA,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,EAGL,KAAK,8BAA8B,EACpC,MAAM,YAAY,CAAC;AAUpB,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAkB9C,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG;IAC7C,4BAA4B,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CACzD,CAAC;AASF,MAAM,MAAM,gBAAgB,GAAG,CAC7B,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC;AAGtE,MAAM,WAAW,UAAU;IAEzB,kBAAkB,EAAE,MAAM,CAAC;IAE3B,eAAe,EAAE,MAAM,CAAC;IAExB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,iCAAiC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAYD,wBAAsB,uCAAuC,CAAC,KAAK,EAAE;IACnE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,EAAE,8BAA8B,CAAC;IACtC,MAAM,EAAE,UAAU,CAAC;IAEnB,0BAA0B,EAAE,OAAO,CAAC;IACpC,WAAW,EAAE,gBAAgB,CAAC;IAE9B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAsD7C"}

package/dist/ciba/backchannel-authentication-request.js

@@ -0,0 +1,132 @@
+import { generateRandomString } from '@maronn-openid-connect/core';
+import { BackchannelAuthenticationError } from './errors.js';
+import { CIBA_GRANT_TYPE, } from './store.js';
+const AUTH_REQ_ID_BYTE_LENGTH = 32;
+export const BINDING_MESSAGE_MAX_LENGTH = 100;
+const REQUESTED_EXPIRY_MIN = 30;
+const UNKNOWN_USER_MESSAGE = 'The login_hint could not be matched to a user';
+export async function processBackchannelAuthenticationRequest(input) {
+    const { params, client, store, config } = input;
+    validateCibaClient(client);
+    rejectSignedRequest(params);
+    const loginHint = extractLoginHint(params);
+    const scope = applyOfflineAccessPolicy(validateCibaScope(params['scope']), {
+        client,
+        refreshTokenFeatureEnabled: input.refreshTokenFeatureEnabled,
+    });
+    const bindingMessage = validateBindingMessage(params['binding_message']);
+    const expiresIn = resolveExpiresIn(params['requested_expiry'], config);
+    const subject = await resolveSubject(loginHint, input.resolveUser);
+    const pending = await store.listPendingBySubject(subject);
+    if (pending.length >= config.maxPendingPerSubject) {
+        throw new BackchannelAuthenticationError('invalid_request', 'Too many pending authentication requests for this user');
+    }
+    const createdAt = input.now ?? new Date();
+    const record = {
+        authReqId: generateRandomString(AUTH_REQ_ID_BYTE_LENGTH),
+        clientId: client.clientId,
+        subject,
+        scope,
+        status: 'pending',
+        createdAt,
+        expiresAt: new Date(createdAt.getTime() + expiresIn * 1000),
+        interval: config.pollingInterval,
+        lastPolledAt: null,
+        csrfToken: null,
+    };
+    if (bindingMessage !== undefined) {
+        record.bindingMessage = bindingMessage;
+    }
+    const acrValues = params['acr_values'];
+    if (acrValues !== undefined && acrValues !== '') {
+        record.acrValues = acrValues;
+    }
+    await store.save(record);
+    return {
+        auth_req_id: record.authReqId,
+        expires_in: expiresIn,
+        interval: config.pollingInterval,
+    };
+}
+function validateCibaClient(client) {
+    if (client.tokenEndpointAuthMethod === 'none') {
+        throw new BackchannelAuthenticationError('unauthorized_client', 'Public clients are not allowed to use the CIBA grant type');
+    }
+    if (!(client.grantTypes ?? []).includes(CIBA_GRANT_TYPE)) {
+        throw new BackchannelAuthenticationError('unauthorized_client', 'The client is not authorized to use the CIBA grant');
+    }
+    const deliveryMode = client.backchannelTokenDeliveryMode ?? 'poll';
+    if (deliveryMode !== 'poll') {
+        throw new BackchannelAuthenticationError('unauthorized_client', 'This provider only supports the poll token delivery mode');
+    }
+}
+function rejectSignedRequest(params) {
+    if (params['request'] !== undefined) {
+        throw new BackchannelAuthenticationError('invalid_request', 'Signed authentication requests are not supported');
+    }
+}
+function extractLoginHint(params) {
+    const presented = ['login_hint', 'id_token_hint', 'login_hint_token'].filter((name) => params[name] !== undefined && params[name] !== '');
+    if (presented.length !== 1) {
+        throw new BackchannelAuthenticationError('invalid_request', 'Exactly one of login_hint, id_token_hint or login_hint_token is required');
+    }
+    if (presented[0] !== 'login_hint') {
+        throw new BackchannelAuthenticationError('invalid_request', 'Only login_hint is supported by this provider');
+    }
+    return params['login_hint'];
+}
+function validateCibaScope(scope) {
+    if (scope === undefined || scope.trim() === '') {
+        throw new BackchannelAuthenticationError('invalid_request', 'Missing required parameter: scope');
+    }
+    const values = [...new Set(scope.trim().split(/\s+/).filter((value) => value.length > 0))];
+    if (!values.includes('openid')) {
+        throw new BackchannelAuthenticationError('invalid_scope', 'The openid scope is required');
+    }
+    return values;
+}
+function applyOfflineAccessPolicy(scope, options) {
+    const clientAllowsRefresh = (options.client.grantTypes ?? []).includes('refresh_token');
+    if (options.refreshTokenFeatureEnabled && clientAllowsRefresh) {
+        return scope;
+    }
+    return scope.filter((value) => value !== 'offline_access');
+}
+function validateBindingMessage(bindingMessage) {
+    if (bindingMessage === undefined)
+        return undefined;
+    const hasControlCharacter = [...bindingMessage].some((char) => {
+        const code = char.codePointAt(0) ?? 0;
+        return code < 0x20 || code === 0x7f;
+    });
+    if (bindingMessage.length < 1 ||
+        bindingMessage.length > BINDING_MESSAGE_MAX_LENGTH ||
+        hasControlCharacter) {
+        throw new BackchannelAuthenticationError('invalid_binding_message', 'binding_message must be 1 to 100 characters without control characters');
+    }
+    return bindingMessage;
+}
+function resolveExpiresIn(requestedExpiry, config) {
+    if (requestedExpiry === undefined) {
+        return config.authReqIdExpiresIn;
+    }
+    if (!/^[0-9]+$/.test(requestedExpiry) || Number(requestedExpiry) < 1) {
+        throw new BackchannelAuthenticationError('invalid_request', 'requested_expiry must be a positive integer');
+    }
+    const requested = Number(requestedExpiry);
+    return Math.min(Math.max(requested, REQUESTED_EXPIRY_MIN), config.authReqIdExpiresIn);
+}
+async function resolveSubject(loginHint, resolveUser) {
+    let resolved;
+    try {
+        resolved = await resolveUser(loginHint);
+    }
+    catch {
+        resolved = null;
+    }
+    if (resolved === null) {
+        throw new BackchannelAuthenticationError('unknown_user_id', UNKNOWN_USER_MESSAGE);
+    }
+    return resolved.subject;
+}
+//# sourceMappingURL=backchannel-authentication-request.js.map

package/dist/ciba/backchannel-authentication-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backchannel-authentication-request.js","sourceRoot":"","sources":["../../src/ciba/backchannel-authentication-request.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,oBAAoB,EAAwB,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,eAAe,GAGhB,MAAM,YAAY,CAAC;AAGpB,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAOnC,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAG9C,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAKhC,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAoD7E,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,KAW7D;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEhD,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,wBAAwB,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;QACzE,MAAM;QACN,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KAC7D,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAInE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAoC;QAC9C,SAAS,EAAE,oBAAoB,CAAC,uBAAuB,CAAC;QACxD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO;QACP,KAAK;QACL,MAAM,EAAE,SAAS;QACjB,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAC3D,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,YAAY,EAAE,IAAI;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC;IACF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;IAGD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEzB,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,SAAS;QAC7B,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,MAAM,CAAC,eAAe;KACjC,CAAC;AACJ,CAAC;AAgBD,SAAS,kBAAkB,CAAC,MAAsB;IAChD,IAAI,MAAM,CAAC,uBAAuB,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,8BAA8B,CACtC,qBAAqB,EACrB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,8BAA8B,CACtC,qBAAqB,EACrB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,4BAA4B,IAAI,MAAM,CAAC;IACnE,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,8BAA8B,CACtC,qBAAqB,EACrB,0DAA0D,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAAC,MAA8B;IACzD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,kDAAkD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAaD,SAAS,gBAAgB,CAAC,MAA8B;IACtD,MAAM,SAAS,GAAI,CAAC,YAAY,EAAE,eAAe,EAAE,kBAAkB,CAAW,CAAC,MAAM,CACrF,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAC5D,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,CAAW,CAAC;AACxC,CAAC;AAYD,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,8BAA8B,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD,SAAS,wBAAwB,CAC/B,KAAe,EACf,OAAwE;IAExE,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,0BAA0B,IAAI,mBAAmB,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAOD,SAAS,sBAAsB,CAAC,cAAkC;IAChE,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,mBAAmB,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,IACE,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,cAAc,CAAC,MAAM,GAAG,0BAA0B;QAClD,mBAAmB,EACnB,CAAC;QACD,MAAM,IAAI,8BAA8B,CACtC,yBAAyB,EACzB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAWD,SAAS,gBAAgB,CAAC,eAAmC,EAAE,MAAkB;IAC/E,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,kBAAkB,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,8BAA8B,CACtC,iBAAiB,EACjB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACxF,CAAC;AASD,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,WAA6B;IAC5E,IAAI,QAAoC,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC"}

package/dist/ciba/ciba-grant.d.ts

@@ -0,0 +1,17 @@
+import type { TokenClientInfo } from '@maronn-openid-connect/core';
+import type { CibaAuthenticationRequestStore } from './store.js';
+export declare const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+export interface CibaGrantResult {
+    subject: string;
+    clientId: string;
+    scope: string[];
+    authTime: number;
+    grantId: string;
+}
+export declare function processCibaGrant(input: {
+    params: Record<string, string>;
+    client: TokenClientInfo;
+    store: CibaAuthenticationRequestStore;
+    now?: Date;
+}): Promise<CibaGrantResult>;
+//# sourceMappingURL=ciba-grant.d.ts.map

package/dist/ciba/ciba-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciba-grant.d.ts","sourceRoot":"","sources":["../../src/ciba/ciba-grant.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAa9C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAyBD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,8BAA8B,CAAC;IACtC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAG3B"}

package/dist/ciba/ciba-grant.js

@@ -0,0 +1,55 @@
+import { CibaGrantError } from './errors.js';
+export const SLOW_DOWN_INTERVAL_INCREMENT = 5;
+const INVALID_AUTH_REQ_ID_MESSAGE = 'The auth_req_id is invalid, expired, or was issued to another client';
+export async function processCibaGrant(input) {
+    const record = await resolveCibaRecord(input.params, input.client, input.store);
+    return evaluateCibaState(record, input.store, input.now ?? new Date());
+}
+async function resolveCibaRecord(params, client, store) {
+    const authReqId = params['auth_req_id'];
+    if (authReqId === undefined || authReqId === '') {
+        throw new CibaGrantError('invalid_request', 'Missing required parameter: auth_req_id');
+    }
+    const record = await store.findByAuthReqId(authReqId);
+    if (record === null || record.clientId !== client.clientId) {
+        throw new CibaGrantError('invalid_grant', INVALID_AUTH_REQ_ID_MESSAGE);
+    }
+    return record;
+}
+async function evaluateCibaState(record, store, now) {
+    if (now.getTime() >= record.expiresAt.getTime()) {
+        await store.delete(record.authReqId);
+        throw new CibaGrantError('expired_token', 'The auth_req_id has expired. Start a new backchannel authentication request.');
+    }
+    if (record.lastPolledAt !== null &&
+        now.getTime() - record.lastPolledAt.getTime() < record.interval * 1000) {
+        record.interval += SLOW_DOWN_INTERVAL_INCREMENT;
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new CibaGrantError('slow_down', 'Polling too frequently. Increase the interval by 5 seconds.');
+    }
+    if (record.status === 'pending') {
+        record.lastPolledAt = now;
+        await store.update(record);
+        throw new CibaGrantError('authorization_pending', 'The authentication request is still pending');
+    }
+    if (record.status === 'denied') {
+        await store.delete(record.authReqId);
+        throw new CibaGrantError('access_denied', 'The end-user denied the authentication request');
+    }
+    const consumed = await store.consume(record.authReqId);
+    if (consumed === null ||
+        consumed.status !== 'approved' ||
+        consumed.authTime === undefined ||
+        consumed.grantId === undefined) {
+        throw new CibaGrantError('invalid_grant', INVALID_AUTH_REQ_ID_MESSAGE);
+    }
+    return {
+        subject: consumed.subject,
+        clientId: consumed.clientId,
+        scope: consumed.approvedScope ?? consumed.scope,
+        authTime: consumed.authTime,
+        grantId: consumed.grantId,
+    };
+}
+//# sourceMappingURL=ciba-grant.js.map

package/dist/ciba/ciba-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciba-grant.js","sourceRoot":"","sources":["../../src/ciba/ciba-grant.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAS9C,MAAM,2BAA2B,GAC/B,sEAAsE,CAAC;AAkCzE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAMtC;IACC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAOD,KAAK,UAAU,iBAAiB,CAC9B,MAA8B,EAC9B,MAAuB,EACvB,KAAqC;IAErC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,KAAK,UAAU,iBAAiB,CAC9B,MAAuC,EACvC,KAAqC,EACrC,GAAS;IAET,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,IAAI,cAAc,CACtB,eAAe,EACf,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,IACE,MAAM,CAAC,YAAY,KAAK,IAAI;QAC5B,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EACtE,CAAC;QAGD,MAAM,CAAC,QAAQ,IAAI,4BAA4B,CAAC;QAChD,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,uBAAuB,EACvB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,gDAAgD,CAAC,CAAC;IAC9F,CAAC;IAKD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,IACE,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,MAAM,KAAK,UAAU;QAC9B,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAC/B,QAAQ,CAAC,OAAO,KAAK,SAAS,EAC9B,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,KAAK;QAC/C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC"}

package/dist/ciba/errors.d.ts

@@ -0,0 +1,19 @@
+export type BackchannelAuthenticationErrorCode = 'invalid_request' | 'invalid_scope' | 'unknown_user_id' | 'unauthorized_client' | 'invalid_binding_message';
+export declare class BackchannelAuthenticationError extends Error {
+    readonly code: BackchannelAuthenticationErrorCode;
+    readonly errorDescription: string;
+    constructor(code: BackchannelAuthenticationErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+export declare class CibaVerificationError extends Error {
+    readonly statusCode: 401 | 403;
+    constructor(message: string, statusCode: 401 | 403);
+}
+export type CibaGrantErrorCode = 'authorization_pending' | 'slow_down' | 'expired_token' | 'access_denied' | 'invalid_grant' | 'invalid_request';
+export declare class CibaGrantError extends Error {
+    readonly code: CibaGrantErrorCode;
+    readonly errorDescription: string;
+    constructor(code: CibaGrantErrorCode, errorDescription: string);
+    get statusCode(): 400;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/ciba/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ciba/errors.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,kCAAkC,GAC1C,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,yBAAyB,CAAC;AAW9B,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,YAAY,IAAI,EAAE,kCAAkC,EAAE,gBAAgB,EAAE,MAAM,EAO7E;IAGD,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF;AAYD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;IAE/B,YAAY,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,GAAG,EAIjD;CACF;AASD,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,eAAe,GACf,iBAAiB,CAAC;AAWtB,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,YAAY,IAAI,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,EAO7D;IAGD,IAAI,UAAU,IAAI,GAAG,CAEpB;CACF"}

package/dist/ciba/errors.js

@@ -0,0 +1,38 @@
+import { sanitizeErrorDescription } from '@maronn-openid-connect/core';
+export class BackchannelAuthenticationError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'BackchannelAuthenticationError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+export class CibaVerificationError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.name = 'CibaVerificationError';
+        this.statusCode = statusCode;
+    }
+}
+export class CibaGrantError extends Error {
+    code;
+    errorDescription;
+    constructor(code, errorDescription) {
+        const sanitized = sanitizeErrorDescription(errorDescription);
+        super(sanitized);
+        this.name = 'CibaGrantError';
+        this.code = code;
+        this.errorDescription = sanitized;
+    }
+    get statusCode() {
+        return 400;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/ciba/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/ciba/errors.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AA0BvE,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAC9C,IAAI,CAAqC;IACzC,gBAAgB,CAAS;IAElC,YAAY,IAAwC,EAAE,gBAAwB;QAE5E,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAYD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,UAAU,CAAY;IAE/B,YAAY,OAAe,EAAE,UAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AA0BD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IACzB,gBAAgB,CAAS;IAElC,YAAY,IAAwB,EAAE,gBAAwB;QAE5D,MAAM,SAAS,GAAG,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,KAAK,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/ciba/index.d.ts

@@ -0,0 +1,10 @@
+export { CIBA_GRANT_TYPE, CIBA_LOGIN_TRANSACTION_TTL_SECONDS, createInMemoryCibaAuthenticationRequestStore, createInMemoryCibaLoginTransactionStore, } from './store.js';
+export type { CibaAuthenticationRequestRecord, CibaAuthenticationRequestStore, CibaLoginTransactionRecord, CibaLoginTransactionStore, CibaStatus, } from './store.js';
+export { BackchannelAuthenticationError, CibaGrantError, CibaVerificationError, } from './errors.js';
+export type { BackchannelAuthenticationErrorCode, CibaGrantErrorCode, } from './errors.js';
+export { BINDING_MESSAGE_MAX_LENGTH, processBackchannelAuthenticationRequest, } from './backchannel-authentication-request.js';
+export type { BackchannelAuthenticationResponse, CibaClientInfo, CibaConfig, CibaUserResolver, } from './backchannel-authentication-request.js';
+export { approveCibaRequest, createCibaLoginTransaction, denyCibaRequest, listPendingCibaRequests, recordCibaLoginFailure, validateCibaLoginSubmission, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, processCibaGrant } from './ciba-grant.js';
+export type { CibaGrantResult } from './ciba-grant.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ciba/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ciba/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,eAAe,EACf,kCAAkC,EAClC,4CAA4C,EAC5C,uCAAuC,GACxC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,+BAA+B,EAC/B,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,8BAA8B,EAC9B,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,kCAAkC,EAClC,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,0BAA0B,EAC1B,uCAAuC,GACxC,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,iCAAiC,EACjC,cAAc,EACd,UAAU,EACV,gBAAgB,GACjB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/ciba/index.js

@@ -0,0 +1,6 @@
+export { CIBA_GRANT_TYPE, CIBA_LOGIN_TRANSACTION_TTL_SECONDS, createInMemoryCibaAuthenticationRequestStore, createInMemoryCibaLoginTransactionStore, } from './store.js';
+export { BackchannelAuthenticationError, CibaGrantError, CibaVerificationError, } from './errors.js';
+export { BINDING_MESSAGE_MAX_LENGTH, processBackchannelAuthenticationRequest, } from './backchannel-authentication-request.js';
+export { approveCibaRequest, createCibaLoginTransaction, denyCibaRequest, listPendingCibaRequests, recordCibaLoginFailure, validateCibaLoginSubmission, } from './verification.js';
+export { SLOW_DOWN_INTERVAL_INCREMENT, processCibaGrant } from './ciba-grant.js';
+//# sourceMappingURL=index.js.map

package/dist/ciba/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/ciba/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,eAAe,EACf,kCAAkC,EAClC,4CAA4C,EAC5C,uCAAuC,GACxC,MAAM,YAAY,CAAC;AASpB,OAAO,EACL,8BAA8B,EAC9B,cAAc,EACd,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,0BAA0B,EAC1B,uCAAuC,GACxC,MAAM,yCAAyC,CAAC;AAQjD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/ciba/store.d.ts

@@ -0,0 +1,44 @@
+export declare const CIBA_GRANT_TYPE = "urn:openid:params:grant-type:ciba";
+export declare const CIBA_LOGIN_TRANSACTION_TTL_SECONDS = 600;
+export type CibaStatus = 'pending' | 'approved' | 'denied';
+export interface CibaAuthenticationRequestRecord {
+    authReqId: string;
+    clientId: string;
+    subject: string;
+    scope: string[];
+    bindingMessage?: string;
+    acrValues?: string;
+    status: CibaStatus;
+    createdAt: Date;
+    expiresAt: Date;
+    interval: number;
+    lastPolledAt: Date | null;
+    csrfToken: string | null;
+    authTime?: number;
+    approvedScope?: string[];
+    grantId?: string;
+}
+export interface CibaAuthenticationRequestStore {
+    save(record: CibaAuthenticationRequestRecord): Promise<void>;
+    findByAuthReqId(authReqId: string): Promise<CibaAuthenticationRequestRecord | null>;
+    listPendingBySubject(subject: string): Promise<CibaAuthenticationRequestRecord[]>;
+    update(record: CibaAuthenticationRequestRecord): Promise<void>;
+    delete(authReqId: string): Promise<void>;
+    consume(authReqId: string): Promise<CibaAuthenticationRequestRecord | null>;
+}
+export interface CibaLoginTransactionRecord {
+    id: string;
+    csrfToken: string;
+    bindingHash: string;
+    loginAttempts: number;
+    expiresAt: Date;
+}
+export interface CibaLoginTransactionStore {
+    save(record: CibaLoginTransactionRecord): Promise<void>;
+    findById(id: string): Promise<CibaLoginTransactionRecord | null>;
+    update(record: CibaLoginTransactionRecord): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+export declare function createInMemoryCibaAuthenticationRequestStore(): CibaAuthenticationRequestStore;
+export declare function createInMemoryCibaLoginTransactionStore(): CibaLoginTransactionStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/ciba/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/ciba/store.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAQnE,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAGtD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAQ3D,MAAM,WAAW,+BAA+B;IAE9C,SAAS,EAAE,MAAM,CAAC;IAElB,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAEhB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAE1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAQD,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;IAEpF,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAAC;IASlF,MAAM,CAAC,MAAM,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAczC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;CAC7E;AASD,MAAM,WAAW,0BAA0B;IAEzC,EAAE,EAAE,MAAM,CAAC;IAEX,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;CACjB;AAGD,MAAM,WAAW,yBAAyB;IACxC,IAAI,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAQD,wBAAgB,4CAA4C,IAAI,8BAA8B,CAiD7F;AAOD,wBAAgB,uCAAuC,IAAI,yBAAyB,CAyBnF"}

package/dist/ciba/store.js

@@ -0,0 +1,73 @@
+export const CIBA_GRANT_TYPE = 'urn:openid:params:grant-type:ciba';
+export const CIBA_LOGIN_TRANSACTION_TTL_SECONDS = 600;
+export function createInMemoryCibaAuthenticationRequestStore() {
+    const records = new Map();
+    const evictionGraceMs = 600 * 1000;
+    const evictExpired = () => {
+        const cutoff = Date.now() - evictionGraceMs;
+        for (const [authReqId, record] of records) {
+            if (record.expiresAt.getTime() < cutoff) {
+                records.delete(authReqId);
+            }
+        }
+    };
+    return {
+        async save(record) {
+            evictExpired();
+            records.set(record.authReqId, record);
+        },
+        async findByAuthReqId(authReqId) {
+            return records.get(authReqId) ?? null;
+        },
+        async listPendingBySubject(subject) {
+            const now = Date.now();
+            const pending = [];
+            for (const record of records.values()) {
+                if (record.subject === subject &&
+                    record.status === 'pending' &&
+                    record.expiresAt.getTime() > now) {
+                    pending.push(record);
+                }
+            }
+            return pending;
+        },
+        async update(record) {
+            records.set(record.authReqId, record);
+        },
+        async delete(authReqId) {
+            records.delete(authReqId);
+        },
+        async consume(authReqId) {
+            const record = records.get(authReqId) ?? null;
+            records.delete(authReqId);
+            return record;
+        },
+    };
+}
+export function createInMemoryCibaLoginTransactionStore() {
+    const records = new Map();
+    const evictExpired = () => {
+        const now = Date.now();
+        for (const [id, record] of records) {
+            if (record.expiresAt.getTime() < now) {
+                records.delete(id);
+            }
+        }
+    };
+    return {
+        async save(record) {
+            evictExpired();
+            records.set(record.id, record);
+        },
+        async findById(id) {
+            return records.get(id) ?? null;
+        },
+        async update(record) {
+            records.set(record.id, record);
+        },
+        async delete(id) {
+            records.delete(id);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/ciba/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/ciba/store.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAQnE,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AA8GtD,MAAM,UAAU,4CAA4C;IAC1D,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAC;IAGnE,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;IACnC,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAC5C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAuC;YAChD,YAAY,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,SAAiB;YACrC,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,OAAe;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAsC,EAAE,CAAC;YACtD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IACE,MAAM,CAAC,OAAO,KAAK,OAAO;oBAC1B,MAAM,CAAC,MAAM,KAAK,SAAS;oBAC3B,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAChC,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAuC;YAClD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAiB;YAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;YAG9C,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,uCAAuC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC9D,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;gBACrC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAkC;YAC3C,YAAY,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAkC;YAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ciba/verification.d.ts

@@ -0,0 +1,37 @@
+import { type CibaAuthenticationRequestRecord, type CibaAuthenticationRequestStore, type CibaLoginTransactionRecord, type CibaLoginTransactionStore } from './store.js';
+export declare function createCibaLoginTransaction(store: CibaLoginTransactionStore): Promise<{
+    record: CibaLoginTransactionRecord;
+    bindingSecret: string;
+}>;
+export declare function validateCibaLoginSubmission(input: {
+    transactionId: string;
+    csrfToken: string;
+    bindingSecret: string | null | undefined;
+    store: CibaLoginTransactionStore;
+    now?: Date;
+}): Promise<CibaLoginTransactionRecord>;
+export declare function recordCibaLoginFailure(record: CibaLoginTransactionRecord, store: CibaLoginTransactionStore, maxLoginAttempts: number): Promise<{
+    canRetry: boolean;
+    remainingAttempts: number;
+}>;
+export declare function listPendingCibaRequests(input: {
+    subject: string;
+    store: CibaAuthenticationRequestStore;
+}): Promise<CibaAuthenticationRequestRecord[]>;
+export declare function approveCibaRequest(input: {
+    authReqId: string;
+    subject: string;
+    csrfToken: string;
+    authTime: number;
+    grantId: string;
+    store: CibaAuthenticationRequestStore;
+    now?: Date;
+}): Promise<CibaAuthenticationRequestRecord>;
+export declare function denyCibaRequest(input: {
+    authReqId: string;
+    subject: string;
+    csrfToken: string;
+    store: CibaAuthenticationRequestStore;
+    now?: Date;
+}): Promise<void>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/ciba/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/ciba/verification.ts"],"names":[],"mappings":"AAgCA,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC/B,MAAM,YAAY,CAAC;AAwCpB,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAWxE;AAWD,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAElB,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,KAAK,EAAE,yBAAyB,CAAC;IACjC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAetC;AAWD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,0BAA0B,EAClC,KAAK,EAAE,yBAAyB,EAChC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAY3D;AASD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,8BAA8B,CAAC;CACvC,GAAG,OAAO,CAAC,+BAA+B,EAAE,CAAC,CAO7C;AAeD,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAElB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,8BAA8B,CAAC;IACtC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAW3C;AAOD,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,8BAA8B,CAAC;IACtC,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB"}