@monocloud/auth-core 0.1.7 → 0.1.8

package/dist/index.mjs

@@ -1,4 +1,5 @@
-import { decodeBase64Url, encodeBase64Url, findToken, getPublicSigKeyFromIssuerJwks, now, parseSpaceSeparated, profileSync, randomBytes, stringToArrayBuffer } from "./utils/internal.mjs";
+import { arrayBufferToBase64, decodeBase64Url, encodeBase64Url, findToken, getPublicSigKeyFromIssuerJwks, now, parseSpaceSeparated, profileSync, randomBytes, stringToArrayBuffer } from "./utils/internal.mjs";
+import { isUserInGroup } from "./utils/index.mjs";
 
 //#region src/errors/monocloud-auth-base-error.ts
 /**
@@ -56,6 +57,129 @@ var MonoCloudTokenError = class extends MonoCloudAuthBaseError {};
 */
 var MonoCloudValidationError = class extends MonoCloudAuthBaseError {};
 
+//#endregion
+//#region src/helper.ts
+const JWT_ASSERTION_CLOCK_SKEW = 5;
+function assertMetadataProperty(metadata, property) {
+	if (metadata[property] === void 0 || metadata[property] === null) throw new MonoCloudValidationError(`${property} endpoint is required but not available in the issuer metadata`);
+}
+const innerFetch = async (input, reqInit = {}, customFetch) => {
+	try {
+		return await (customFetch ?? fetch)(input, reqInit);
+	} catch (e) {
+		/* v8 ignore next -- @preserve */
+		throw new MonoCloudHttpError(e.message ?? "Unexpected Network Error");
+	}
+};
+const deserializeJson = async (res) => {
+	try {
+		return await res.json();
+	} catch (e) {
+		throw new MonoCloudHttpError(
+			/* v8 ignore next -- @preserve */
+			`Failed to parse response body as JSON ${e.message ? `: ${e.message}` : ""}`
+		);
+	}
+};
+
+//#endregion
+//#region src/monocloud-oidc-client-base.ts
+/**
+* @category Classes
+*/
+var MonoCloudOidcClientBase = class {
+	/**
+	* Creates a new instance of MonoCloudOidcClientBase.
+	*
+	* @param tenantDomain - The tenant domain URL.
+	* @param metadataCacheDuration - Duration (in seconds) to cache OpenID Connect discovery metadata. Defaults to 300 (5 minutes).
+	* @param jwksCacheDuration - Duration (in seconds) to cache the JSON Web Key Set (JWKS). Defaults to 300 (5 minutes).
+	* @param fetcher - Custom `fetch` implementation used for making HTTP requests. Falls back to the global `fetch` if not provided.
+	*/
+	constructor(tenantDomain, metadataCacheDuration, jwksCacheDuration, fetcher) {
+		this.jwksCacheExpiry = 0;
+		this.jwksCacheDuration = 300;
+		this.metadataCacheExpiry = 0;
+		this.metadataCacheDuration = 300;
+		tenantDomain ??= "";
+		/* v8 ignore next -- @preserve */
+		this.tenantDomain = `${!tenantDomain.startsWith("https://") ? "https://" : ""}${tenantDomain.endsWith("/") ? tenantDomain.slice(0, -1) : tenantDomain}`;
+		if (metadataCacheDuration !== void 0) this.metadataCacheDuration = metadataCacheDuration;
+		if (jwksCacheDuration !== void 0) this.jwksCacheDuration = jwksCacheDuration;
+		this.fetcher = fetcher;
+	}
+	/**
+	* Fetches the authorization server metadata from the .well-known endpoint.
+	* The metadata is cached for 5 minutes by default.
+	*
+	* @param forceRefresh - If `true`, bypasses the cache and fetches fresh metadata from the server.
+	*
+	* @returns The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.
+	*
+	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
+	* unexpected status code during the request or a serialization error while processing the response.
+	*
+	*/
+	async getMetadata(forceRefresh = false) {
+		if (!forceRefresh && this.metadata && this.metadataCacheExpiry > now()) return this.metadata;
+		this.metadata = void 0;
+		const response = await innerFetch(`${this.tenantDomain}/.well-known/openid-configuration`, void 0, this.fetcher);
+		if (response.status !== 200) throw new MonoCloudHttpError(`Error while fetching metadata. Unexpected status code: ${response.status}`);
+		const metadata = await deserializeJson(response);
+		this.metadata = metadata;
+		this.metadataCacheExpiry = now() + this.metadataCacheDuration;
+		return metadata;
+	}
+	/**
+	* Fetches the JSON Web Keys used to sign the ID token.
+	* The JWKS is cached for 5 minutes by default.
+	*
+	* @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.
+	*
+	* @returns The JSON Web Key Set containing the public keys for token verification.
+	*
+	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
+	* unexpected status code during the request or a serialization error while processing the response.
+	*
+	*/
+	async getJwks(forceRefresh = false) {
+		if (!forceRefresh && this.jwks && this.jwksCacheExpiry > now()) return this.jwks;
+		this.jwks = void 0;
+		const metadata = await this.getMetadata();
+		assertMetadataProperty(metadata, "jwks_uri");
+		const response = await innerFetch(metadata.jwks_uri, void 0, this.fetcher);
+		if (response.status !== 200) throw new MonoCloudHttpError(`Error while fetching JWKS. Unexpected status code: ${response.status}`);
+		const jwks = await deserializeJson(response);
+		this.jwks = jwks;
+		this.jwksCacheExpiry = now() + this.jwksCacheDuration;
+		return jwks;
+	}
+	/**
+	* Decodes the payload of a JSON Web Token (JWT) and returns it as an object.
+	*
+	* >Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
+	*
+	* @param jwt - JWT to decode.
+	*
+	* @returns Decoded payload.
+	*
+	* @throws {@link MonoCloudTokenError} - If decoding fails
+	*
+	*/
+	static decodeJwt(jwt) {
+		try {
+			const [, payload] = jwt.split(".");
+			if (!payload?.trim()) throw new MonoCloudTokenError("JWT does not contain payload");
+			const decoded = decodeBase64Url(payload);
+			if (!decoded.startsWith("{")) throw new MonoCloudTokenError("Payload is not an object");
+			return JSON.parse(decoded);
+		} catch (e) {
+			if (e instanceof MonoCloudAuthBaseError) throw e;
+			throw new MonoCloudTokenError("Could not parse payload. Malformed payload");
+		}
+	}
+};
+
 //#endregion
 //#region src/client-auth.ts
 const algToSubtle = (alg) => {
@@ -214,13 +338,15 @@ const clientAuth = async (clientId, clientSecret, method, issuer, headers, body,
 		case method === "private_key_jwt" && typeof clientSecret === "object" && clientSecret.kty !== "oct" && !!issuer && !!body:
 			await jwtAssertionGenerator(issuer, clientId, clientSecret, body, jwtAssertionSkew ?? 0);
 			break;
+		case (method === "tls_client_auth" || method === "self_signed_tls_client_auth") && !!body:
+			body.set("client_id", clientId);
+			break;
 		default: throw new Error("Invalid Client Authentication Method");
 	}
 };
 
 //#endregion
 //#region src/monocloud-oidc-client.ts
-const JWT_ASSERTION_CLOCK_SKEW = 5;
 const FILTER_ID_TOKEN_CLAIMS = [
 	"iss",
 	"exp",
@@ -233,45 +359,23 @@ const FILTER_ID_TOKEN_CLAIMS = [
 	"at_hash",
 	"s_hash"
 ];
-function assertMetadataProperty(metadata, property) {
-	if (metadata[property] === void 0 || metadata[property] === null) throw new MonoCloudValidationError(`${property} endpoint is required but not available in the issuer metadata`);
-}
-const innerFetch = async (input, reqInit = {}) => {
-	try {
-		return await fetch(input, reqInit);
-	} catch (e) {
-		/* v8 ignore next -- @preserve */
-		throw new MonoCloudHttpError(e.message ?? "Unexpected Network Error");
-	}
-};
-const deserializeJson = async (res) => {
-	try {
-		return await res.json();
-	} catch (e) {
-		throw new MonoCloudHttpError(
-			/* v8 ignore next -- @preserve */
-			`Failed to parse response body as JSON ${e.message ? `: ${e.message}` : ""}`
-		);
-	}
-};
 /**
 * @category Classes
 */
-var MonoCloudOidcClient = class MonoCloudOidcClient {
+var MonoCloudOidcClient = class MonoCloudOidcClient extends MonoCloudOidcClientBase {
+	/**
+	* Creates a new instance of MonoCloudOidcClient.
+	*
+	* @param tenantDomain - The tenant domain URL.
+	* @param clientId - Client id of the application registered in MonoCloud.
+	* @param options - Additional client configuration options.
+	*/
 	constructor(tenantDomain, clientId, options) {
-		this.jwksCacheExpiry = 0;
-		this.jwksCacheDuration = 300;
-		this.metadataCacheExpiry = 0;
-		this.metadataCacheDuration = 300;
-		tenantDomain ??= "";
-		/* v8 ignore next -- @preserve */
-		this.tenantDomain = `${!tenantDomain.startsWith("https://") ? "https://" : ""}${tenantDomain.endsWith("/") ? tenantDomain.slice(0, -1) : tenantDomain}`;
+		super(tenantDomain, options?.metadataCacheDuration, options?.jwksCacheDuration, options?.fetcher);
 		this.clientId = clientId;
 		this.clientSecret = options?.clientSecret;
 		this.authMethod = options?.clientAuthMethod ?? "client_secret_basic";
 		this.idTokenSigningAlgorithm = options?.idTokenSigningAlgorithm ?? "RS256";
-		if (options?.jwksCacheDuration) this.jwksCacheDuration = options.jwksCacheDuration;
-		if (options?.metadataCacheDuration) this.metadataCacheDuration = options.metadataCacheDuration;
 	}
 	/**
 	* Generates an authorization URL with specified parameters.
@@ -317,52 +421,6 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 		return `${metadata.authorization_endpoint}?${queryParams.toString()}`;
 	}
 	/**
-	* Fetches the authorization server metadata from the .well-known endpoint.
-	* The metadata is cached for 1 minute.
-	*
-	* @param forceRefresh - If `true`, bypasses the cache and fetches fresh metadata from the server.
-	*
-	* @returns The issuer metadata for the tenant, retrieved from the OpenID Connect discovery endpoint.
-	*
-	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
-	* unexpected status code during the request or a serialization error while processing the response.
-	*
-	*/
-	async getMetadata(forceRefresh = false) {
-		if (!forceRefresh && this.metadata && this.metadataCacheExpiry > now()) return this.metadata;
-		this.metadata = void 0;
-		const response = await innerFetch(`${this.tenantDomain}/.well-known/openid-configuration`);
-		if (response.status !== 200) throw new MonoCloudHttpError(`Error while fetching metadata. Unexpected status code: ${response.status}`);
-		const metadata = await deserializeJson(response);
-		this.metadata = metadata;
-		this.metadataCacheExpiry = now() + this.metadataCacheDuration;
-		return metadata;
-	}
-	/**
-	* Fetches the JSON Web Keys used to sign the ID token.
-	* The JWKS is cached for 1 minute.
-	*
-	* @param forceRefresh - If `true`, bypasses the cache and fetches fresh set of JWKS from the server.
-	*
-	* @returns The JSON Web Key Set containing the public keys for token verification.
-	*
-	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
-	* unexpected status code during the request or a serialization error while processing the response.
-	*
-	*/
-	async getJwks(forceRefresh = false) {
-		if (!forceRefresh && this.jwks && this.jwksCacheExpiry > now()) return this.jwks;
-		this.jwks = void 0;
-		const metadata = await this.getMetadata();
-		assertMetadataProperty(metadata, "jwks_uri");
-		const response = await innerFetch(metadata.jwks_uri);
-		if (response.status !== 200) throw new MonoCloudHttpError(`Error while fetching JWKS. Unexpected status code: ${response.status}`);
-		const jwks = await deserializeJson(response);
-		this.jwks = jwks;
-		this.jwksCacheExpiry = now() + this.jwksCacheDuration;
-		return jwks;
-	}
-	/**
 	* Performs a pushed authorization request.
 	*
 	* @param params - Authorization Parameters.
@@ -411,7 +469,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 			body: body.toString(),
 			method: "POST",
 			headers
-		});
+		}, this.fetcher);
 		if (response.status === 400) {
 			const standardBodyError = await deserializeJson(response);
 			throw new MonoCloudOPError(standardBodyError.error ?? "par_request_failed", standardBodyError.error_description ?? "Pushed Authorization Request Failed");
@@ -443,7 +501,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 		const response = await innerFetch(metadata.userinfo_endpoint, {
 			method: "GET",
 			headers: { authorization: `Bearer ${accessToken}` }
-		});
+		}, this.fetcher);
 		if (response.status === 401) {
 			const authenticateError = response.headers.get("WWW-Authenticate");
 			if (authenticateError) {
@@ -517,7 +575,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 			method: "POST",
 			body: body.toString(),
 			headers
-		});
+		}, this.fetcher);
 		if (response.status === 400) {
 			const standardBodyError = await deserializeJson(response);
 			throw new MonoCloudOPError(standardBodyError.error ?? "code_grant_failed", standardBodyError.error_description ?? "Authorization code grant failed");
@@ -559,7 +617,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 			method: "POST",
 			body: body.toString(),
 			headers
-		});
+		}, this.fetcher);
 		if (response.status === 400) {
 			const standardBodyError = await deserializeJson(response);
 			throw new MonoCloudOPError(standardBodyError.error ?? "refresh_grant_failed", standardBodyError.error_description ?? "Refresh token grant failed");
@@ -743,7 +801,7 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 			method: "POST",
 			body: body.toString(),
 			headers
-		});
+		}, this.fetcher);
 		if (response.status === 400) {
 			const standardBodyError = await deserializeJson(response);
 			throw new MonoCloudOPError(standardBodyError.error ?? "revocation_failed", standardBodyError.error_description ?? "Token revocation failed");
@@ -811,32 +869,193 @@ var MonoCloudOidcClient = class MonoCloudOidcClient {
 		if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(this.clientId)) throw new MonoCloudTokenError("Invalid audience claim");
 		return claims;
 	}
+};
+
+//#endregion
+//#region src/monocloud-oidc-backend-client.ts
+/**
+* @category Classes
+*/
+var MonoCloudOidcBackendClient = class extends MonoCloudOidcClientBase {
 	/**
-	* Decodes the payload of a JSON Web Token (JWT) and returns it as an object.
+	* Creates a new instance of MonoCloudOidcBackendClient.
 	*
-	* >Note: THIS METHOD DOES NOT VERIFY JWT TOKENS.
+	* @param tenantDomain - The tenant domain URL.
+	* @param audience - The expected audience value used to validate the `aud` claim in access tokens.
+	* @param options - Additional client configuration options.
+	*/
+	constructor(tenantDomain, audience, options) {
+		super(tenantDomain, options?.metadataCacheDuration, options?.jwksCacheDuration, options?.fetcher);
+		this.clockSkew = 0;
+		this.clockTolerance = 300;
+		this.audience = audience;
+		if (options?.clientId) this.clientId = options.clientId;
+		this.clientSecret = options?.clientSecret;
+		this.authMethod = options?.clientAuthMethod ?? "client_secret_basic";
+		this.groupOptions = options?.groupOptions;
+		if (options?.clockSkew !== void 0) this.clockSkew = options.clockSkew;
+		if (options?.clockTolerance !== void 0) this.clockTolerance = options.clockTolerance;
+	}
+	/**
+	* Validates an opaque access token using the OAuth 2.0 Token Introspection endpoint (RFC 7662).
 	*
-	* @param jwt - JWT to decode.
+	* @param accessToken - The access token string to introspect.
+	* @param options - Claims validation options.
 	*
-	* @returns Decoded payload.
+	* @returns Validated access token claims (without the `active` field).
 	*
-	* @throws {@link MonoCloudTokenError} - If decoding fails
+	* @throws {@link MonoCloudTokenError} - If the token is not active or claim validation fails.
+	*
+	* @throws {@link MonoCloudOPError} - When the introspection endpoint returns a standardized
+	* OAuth 2.0 error response.
+	*
+	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
+	* unexpected status code during the request or a serialization error while processing the response.
+	*
+	* @throws {@link MonoCloudValidationError} - When the access token is empty or the introspection
+	* endpoint is not available in the issuer metadata or claims validation fails.
 	*
 	*/
-	static decodeJwt(jwt) {
+	async introspectAccessToken(accessToken, options) {
+		if (!this.clientId) throw new MonoCloudValidationError("The clientId option must be configured to introspect access tokens");
+		if (typeof accessToken !== "string" || accessToken.trim().length === 0) throw new MonoCloudValidationError("Access token must be a valid non-empty string");
+		const metadata = await this.getMetadata();
+		assertMetadataProperty(metadata, "introspection_endpoint");
+		const body = new URLSearchParams();
+		body.set("token", accessToken);
+		body.set("token_type_hint", "access_token");
+		const headers = {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		};
+		await clientAuth(this.clientId, this.clientSecret, this.authMethod, this.tenantDomain, headers, body, JWT_ASSERTION_CLOCK_SKEW);
+		const response = await innerFetch(metadata.introspection_endpoint, {
+			method: "POST",
+			body: body.toString(),
+			headers
+		}, this.fetcher);
+		if (response.status === 400 || response.status === 401) {
+			const standardBodyError = await deserializeJson(response);
+			throw new MonoCloudOPError(standardBodyError.error ?? "introspection_failed", standardBodyError.error_description ?? "Token introspection failed");
+		}
+		if (response.status !== 200) throw new MonoCloudHttpError(`Error while performing token introspection. Unexpected status code: ${response.status}`);
+		const introspectionResponse = await deserializeJson(response);
+		if (!introspectionResponse.active) throw new MonoCloudTokenError("Token is not active");
+		const { active: _, ...claims } = introspectionResponse;
+		this.validateAccessTokenClaims(claims, options?.scopes, options?.groups);
+		if (options?.validateCertificateBinding) await this.validateCertificateBinding(claims, options.clientCertificate);
+		return claims;
+	}
+	/**
+	* Validates a JWT access token by verifying the signature and claims.
+	*
+	* @param accessToken - The access token JWT string to validate.
+	* @param options - Validation options.
+	*
+	* @returns Validated access token claims.
+	*
+	* @throws {@link MonoCloudTokenError} - If JWT parsing, signature verification, or claim validation fails.
+	*
+	* @throws {@link MonoCloudHttpError} - Thrown if there is a network error during the request or
+	* unexpected status code during the request or a serialization error while processing the response.
+	*
+	* @throws {@link MonoCloudValidationError} - When the access token is empty or claims validation fails.
+	*
+	*/
+	async validateJwtAccessToken(accessToken, options) {
+		if (typeof accessToken !== "string" || accessToken.trim().length === 0) throw new MonoCloudValidationError("Access token must be a valid non-empty string");
+		const { 0: protectedHeader, 1: payload, 2: encodedSignature, length } = accessToken.split(".");
+		if (length !== 3) throw new MonoCloudTokenError("JWT access token must have a header, payload and signature");
+		let header;
 		try {
-			const [, payload] = jwt.split(".");
-			if (!payload?.trim()) throw new MonoCloudTokenError("JWT does not contain payload");
-			const decoded = decodeBase64Url(payload);
-			if (!decoded.startsWith("{")) throw new MonoCloudTokenError("Payload is not an object");
-			return JSON.parse(decoded);
-		} catch (e) {
-			if (e instanceof MonoCloudAuthBaseError) throw e;
-			throw new MonoCloudTokenError("Could not parse payload. Malformed payload");
+			header = JSON.parse(decodeBase64Url(protectedHeader));
+		} catch {
+			throw new MonoCloudTokenError("Failed to parse JWT Header");
+		}
+		if (header === null || typeof header !== "object" || Array.isArray(header)) throw new MonoCloudTokenError("JWT Header must be a top level object");
+		if (header.crit !== void 0) throw new MonoCloudTokenError("Unexpected JWT \"crit\" header parameter");
+		if (header.typ && header.typ !== "at+jwt") throw new MonoCloudTokenError("Invalid token type");
+		const binary = decodeBase64Url(encodedSignature);
+		const signature = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) signature[i] = binary.charCodeAt(i);
+		const key = await getPublicSigKeyFromIssuerJwks((options?.jwks ?? await this.getJwks()).keys, header);
+		const input = `${protectedHeader}.${payload}`;
+		if (!await crypto.subtle.verify(keyToSubtle(key), key, signature, stringToArrayBuffer(input))) throw new MonoCloudTokenError("JWT signature verification failed");
+		let claims;
+		try {
+			claims = JSON.parse(decodeBase64Url(payload));
+		} catch {
+			throw new MonoCloudTokenError("Failed to parse JWT Payload");
+		}
+		if (claims === null || typeof claims !== "object" || Array.isArray(claims)) throw new MonoCloudTokenError("JWT Payload must be a top level object");
+		this.validateAccessTokenClaims(claims, options?.scopes, options?.groups);
+		if (options?.validateCertificateBinding) await this.validateCertificateBinding(claims, options.clientCertificate);
+		return claims;
+	}
+	/**
+	* Sets clock skew used for access token time-based claim validation.
+	*
+	* @param clockSkew - Number of seconds to adjust the current time to account for clock differences.
+	*/
+	setClockSkew(clockSkew) {
+		this.clockSkew = clockSkew;
+	}
+	/**
+	* Sets clock tolerance used for access token time-based claim validation.
+	*
+	* @param clockTolerance - Additional time tolerance in seconds for time-based claim validation.
+	*/
+	setClockTolerance(clockTolerance) {
+		this.clockTolerance = clockTolerance;
+	}
+	validateAccessTokenClaims(claims, scopes, groups) {
+		const current = now() + this.clockSkew;
+		if (claims.iss !== this.tenantDomain) throw new MonoCloudTokenError("Invalid Issuer");
+		if (claims.sub && typeof claims.sub !== "string") throw new MonoCloudTokenError("Invalid subject");
+		if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(this.audience)) throw new MonoCloudTokenError("Invalid audience claim");
+		if (claims.exp !== void 0) {
+			if (typeof claims.exp !== "number") throw new MonoCloudTokenError("Unexpected \"exp\" (expiration time) claim type");
+			if (claims.exp <= current - this.clockTolerance) throw new MonoCloudTokenError("Unexpected \"exp\" (expiration time) claim value, timestamp is <= now()");
+		}
+		if (claims.nbf !== void 0) {
+			if (typeof claims.nbf !== "number") throw new MonoCloudTokenError("Unexpected \"nbf\" (not before) claim type");
+			if (claims.nbf > current + this.clockTolerance) throw new MonoCloudTokenError("Unexpected \"nbf\" (not before) claim value, timestamp is > now()");
+		}
+		if (scopes && scopes.length > 0) {
+			const tokenScopes = new Set(parseSpaceSeparated(claims.scope));
+			for (const requiredScope of scopes) if (!tokenScopes.has(requiredScope)) throw new MonoCloudTokenError("Token is missing required scopes");
+		}
+		if (groups) {
+			if (!isUserInGroup(claims, groups, this.groupOptions?.groupsClaim, this.groupOptions?.matchAll)) throw new MonoCloudTokenError("Token is missing required groups");
+		}
+	}
+	async validateCertificateBinding(accessTokenClaims, certificate) {
+		if (typeof certificate !== "string" || certificate.trim().length === 0) throw new MonoCloudTokenError("Client certificate is not present");
+		const encodedCertificate = (/-----BEGIN CERTIFICATE-----([\s\S]+?)-----END CERTIFICATE-----/.exec(certificate)?.[1] ?? certificate).replace(/\s+/g, "");
+		let certificateBinary;
+		try {
+			certificateBinary = atob(encodedCertificate);
+		} catch {
+			throw new MonoCloudTokenError("Client certificate is malformed");
+		}
+		const certificateBytes = new Uint8Array(certificateBinary.length);
+		for (let i = 0; i < certificateBinary.length; i++) certificateBytes[i] = certificateBinary.charCodeAt(i);
+		const certificateDigest = await crypto.subtle.digest("SHA-256", certificateBytes);
+		const clientCertHash = arrayBufferToBase64(new Uint8Array(certificateDigest));
+		let cnfClaimValue = accessTokenClaims.cnf;
+		if (cnfClaimValue === void 0 || cnfClaimValue === null) throw new MonoCloudTokenError("Access token does not contain a 'cnf' (confirmation) claim for certificate binding");
+		if (typeof cnfClaimValue === "string") try {
+			cnfClaimValue = JSON.parse(cnfClaimValue);
+		} catch {
+			throw new MonoCloudTokenError("Malformed 'cnf' claim for certificate binding");
 		}
+		if (cnfClaimValue === null || typeof cnfClaimValue !== "object" || Array.isArray(cnfClaimValue)) throw new MonoCloudTokenError("The 'cnf' claim could not be parsed");
+		const certHash = cnfClaimValue["x5t#S256"];
+		if (typeof certHash !== "string" || certHash.length === 0) throw new MonoCloudTokenError("The 'cnf' claim does not contain an 'x5t#S256' member specifying the certificate hash for binding");
+		if (certHash !== clientCertHash) throw new MonoCloudTokenError("The certificate hash in the access token does not match the presented client certificate (certificate binding validation failed)");
 	}
 };
 
 //#endregion
-export { MonoCloudAuthBaseError, MonoCloudHttpError, MonoCloudOPError, MonoCloudOidcClient, MonoCloudTokenError, MonoCloudValidationError };
+export { MonoCloudAuthBaseError, MonoCloudHttpError, MonoCloudOPError, MonoCloudOidcBackendClient, MonoCloudOidcClient, MonoCloudOidcClientBase, MonoCloudTokenError, MonoCloudValidationError };
 //# sourceMappingURL=index.mjs.map