@muze-nl/metro-oidc 0.9.0 → 0.9.2

package/dist/browser.js

@@ -107,35 +107,11 @@
       if (!(typeof options === "object") || options instanceof String) {
         throw metroError("metro.client.fetch: Invalid options parameter " + metroURL + "client/fetch-invalid-options/", options);
       }
-      const metrofetch = async function browserFetch(req2) {
-        if (req2[Symbol.metroProxy]) {
-          req2 = req2[Symbol.metroSource];
-        }
-        const res = await fetch(req2);
-        return response(res);
-      };
-      let middlewares = [metrofetch].concat(this.clientOptions?.middlewares?.slice() || []);
       options = Object.assign({}, this.clientOptions, options);
       const traceContext = createTraceContext(req, options);
       const middlewareContext = createMiddlewareContext(this, options, traceContext);
-      let next;
-      for (let middleware of middlewares) {
-        next = /* @__PURE__ */ (function(next2, middleware2) {
-          return async function(req2) {
-            let res;
-            let tracers = traceContext.tracers;
-            callTracers(tracers, "request", req2, middleware2, traceContext);
-            try {
-              res = await middleware2(req2, next2, middlewareContext);
-            } catch (error2) {
-              callTracers(tracers, "error", error2, req2, middleware2, traceContext);
-              throw error2;
-            }
-            callTracers(tracers, "response", res, middleware2, traceContext);
-            return res;
-          };
-        })(next, middleware);
-      }
+      const middlewares = this.clientOptions?.middlewares || [];
+      const next = createMiddlewareChain(middlewares, traceContext, middlewareContext);
       return next(req);
     }
     with(...options) {
@@ -145,6 +121,35 @@
       return this.clientOptions.url;
     }
   };
+  async function browserFetch(req) {
+    if (req[Symbol.metroProxy]) {
+      req = req[Symbol.metroSource];
+    }
+    const res = await fetch(req);
+    return response(res);
+  }
+  function createMiddlewareChain(middlewares, traceContext, middlewareContext) {
+    let next;
+    for (const middleware of [browserFetch, ...middlewares]) {
+      next = traceMiddleware(middleware, next, traceContext, middlewareContext);
+    }
+    return next;
+  }
+  function traceMiddleware(middleware, next, traceContext, middlewareContext) {
+    const tracers = traceContext.tracers;
+    return async function(req) {
+      callTracers(tracers, "request", req, middleware, traceContext);
+      let res;
+      try {
+        res = await middleware(req, next, middlewareContext);
+      } catch (error2) {
+        callTracers(tracers, "error", error2, req, middleware, traceContext);
+        throw error2;
+      }
+      callTracers(tracers, "response", res, middleware, traceContext);
+      return res;
+    };
+  }
   var traceContextId = 0;
   var TRACE_OPTION_KEYS = ["trace", "tracer", "tracers"];
   function fetchOptionsFrom(...options) {
@@ -258,7 +263,7 @@
         if (!tracer) {
           return fn();
         }
-        return tracer.span(name, fn, data, context);
+        return tracedSpan(tracer, name, fn, data, context);
       },
       link(key) {
         let traceId = null;
@@ -278,10 +283,38 @@
   function callTracers(tracers, method, ...args) {
     for (const tracer of tracers) {
       if (tracer && typeof tracer[method] == "function") {
-        tracer[method].call(tracer, ...args);
+        callTracer(tracer, method, args);
       }
     }
   }
+  async function tracedSpan(tracer, name, fn, data, context) {
+    let work = null;
+    const run = () => {
+      if (!work) {
+        work = (async () => fn())();
+      }
+      return work;
+    };
+    try {
+      await tracer.span(name, run, data, context);
+    } catch (error2) {
+      metroConsole.error("metro: tracer.span() failed", error2);
+    }
+    return run();
+  }
+  function callTracer(tracer, method, args) {
+    const reportFailure = (error2) => {
+      metroConsole.error("metro: tracer." + method + "() failed", error2);
+    };
+    try {
+      const result = tracer[method].call(tracer, ...args);
+      if (typeof result?.then == "function") {
+        result.then(void 0, reportFailure);
+      }
+    } catch (error2) {
+      reportFailure(error2);
+    }
+  }
   function isPlainObject(value) {
     return value && typeof value == "object" && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
   }
@@ -1178,6 +1211,7 @@
   }
 
   // ../metro-oauth2/src/oauth2.mjs
+  var pendingTokenRequests = /* @__PURE__ */ new Map();
   var SUPPORTED_TOKEN_TYPES = /* @__PURE__ */ new Map([
     ["bearer", "Bearer"],
     ["dpop", "DPoP"]
@@ -1210,6 +1244,7 @@
     const oauth2 = Object.assign({}, defaultOptions.oauth2_configuration, options?.oauth2_configuration);
     options = Object.assign({}, defaultOptions, options);
     options.oauth2_configuration = oauth2;
+    const tokenStoreKey = options.tokens ?? "site:" + options.site;
     const store = tokenStore(options.site);
     if (!options.tokens) {
       options.tokens = store.tokens;
@@ -1251,15 +1286,15 @@
       const refreshToken = options.tokens.get("refresh_token");
       const tokenIsExpired = isExpired(accessToken);
       if (!accessToken || tokenIsExpired && !refreshToken) {
-        const token = await fetchAccessToken();
+        const token = await requestToken(fetchAccessToken);
         if (!token) {
-          return response("false");
+          throw authorizationNotCompleted(req);
         }
         return oauth2authorized(req, next);
       } else if (tokenIsExpired && refreshToken) {
-        const token = await refreshAccessToken();
+        const token = await requestToken(refreshAccessToken);
         if (!token) {
-          return response("false");
+          throw authorizationNotCompleted(req);
         }
         return oauth2authorized(req, next);
       } else {
@@ -1272,14 +1307,30 @@
         if (!shouldAuthorizeResponse(res) || retryState.handledRejectedToken) {
           return res;
         }
+        if (options.tokens.get("access_token")?.value !== accessToken.value) {
+          return oauth2authorized(req, next, { handledRejectedToken: true });
+        }
         options.tokens.delete("access_token");
-        const token = refreshToken ? await refreshAccessToken() : await fetchAccessToken();
+        let tokenRequest = fetchAccessToken;
+        if (refreshToken) {
+          tokenRequest = refreshAccessToken;
+        }
+        const token = await requestToken(tokenRequest);
         if (!token) {
-          return response("false");
+          throw authorizationNotCompleted(req);
         }
         return oauth2authorized(req, next, { handledRejectedToken: true });
       }
     }
+    function requestToken(tokenRequest) {
+      if (!pendingTokenRequests.has(tokenStoreKey)) {
+        const pending = tokenRequest().finally(() => {
+          pendingTokenRequests.delete(tokenStoreKey);
+        });
+        pendingTokenRequests.set(tokenStoreKey, pending);
+      }
+      return pendingTokenRequests.get(tokenStoreKey);
+    }
     function getTokensFromLocation() {
       if (typeof window !== "undefined" && window?.location) {
         let url2 = url(window.location);
@@ -1295,6 +1346,7 @@
           history.pushState({}, "", url2.href);
         }
         if (params) {
+          validateIssuer(params.get("iss"));
           if (params.has("error")) {
             throw metroError("oauth2mw: authorization failed: " + params.get("error") + (params.get("error_description") ? " (" + params.get("error_description") + ")" : ""));
           }
@@ -1376,6 +1428,9 @@
       if (oauth2.prompt) {
         search.prompt = oauth2.prompt;
       }
+      if (oauth2.login_hint) {
+        search.login_hint = oauth2.login_hint;
+      }
       if (oauth2.nonce) {
         search.nonce = oauth2.nonce;
       }
@@ -1440,6 +1495,7 @@
     function storeAuthorizationResult(authorization) {
       let code = authorization;
       if (authorization && typeof authorization === "object") {
+        validateIssuer(authorization.iss);
         if (authorization.error) {
           throw metroError("oauth2mw: authorization failed: " + authorization.error);
         }
@@ -1451,6 +1507,20 @@
       }
       options.tokens.set("authorization_code", code);
     }
+    function validateIssuer(iss) {
+      if (!oauth2.issuer) {
+        return;
+      }
+      if (!iss) {
+        if (oauth2.authorization_response_iss_parameter_supported) {
+          throw metroError("oauth2mw: authorization response is missing iss, expected " + oauth2.issuer);
+        }
+        return;
+      }
+      if (iss !== oauth2.issuer) {
+        throw metroError("oauth2mw: authorization response is from issuer " + iss + ", expected " + oauth2.issuer);
+      }
+    }
     function validateState(state) {
       let storedState = options.state.get();
       if (!state || state !== storedState) {
@@ -1458,7 +1528,7 @@
       }
     }
     function storeTokenResponse(data) {
-      const token = validateTokenResponse(data);
+      const token = validateTokenResponse(data, oauth2.token_type);
       options.tokens.set("access_token", token);
       if (data.refresh_token) {
         options.tokens.set("refresh_token", { value: data.refresh_token });
@@ -1469,10 +1539,10 @@
     if (!res) {
       return false;
     }
+    const challenge = parseBearerChallenge(res.headers?.get("WWW-Authenticate"));
     if (res.status === 400) {
-      return true;
+      return challenge?.error === "invalid_token";
     }
-    const challenge = parseBearerChallenge(res.headers?.get("WWW-Authenticate"));
     if (challenge?.error === "insufficient_scope") {
       return false;
     }
@@ -1490,7 +1560,7 @@
     }
     return token;
   }
-  function validateTokenResponse(data) {
+  function validateTokenResponse(data, requiredTokenType) {
     if (!data || typeof data !== "object") {
       throw metroError("OAuth2mw: token endpoint did not return a JSON object");
     }
@@ -1501,6 +1571,9 @@
       throw metroError("OAuth2mw: token response did not include token_type");
     }
     const tokenType = normalizeTokenType(data.token_type);
+    if (requiredTokenType && tokenType !== normalizeTokenType(requiredTokenType)) {
+      throw metroError("OAuth2mw: token endpoint returned a " + tokenType + " token, but " + requiredTokenType + " is required");
+    }
     return {
       value: data.access_token,
       expires: data.expires_in === void 0 ? null : getExpires(data.expires_in),
@@ -1590,6 +1663,12 @@
     }
     return randomState;
   }
+  function authorizationNotCompleted(req) {
+    const error2 = new Error("oauth2mw: authorization was not completed for " + req.url + "; no access token was obtained");
+    error2.code = "authorization_not_completed";
+    error2.request = req;
+    return error2;
+  }
   function isRedirected() {
     let url2 = new URL(document.location.href);
     if (!url2.searchParams.has("code")) {
@@ -1889,54 +1968,90 @@
   }
 
   // ../metro-oauth2/src/oauth2.dpop.mjs
+  var serverNonces = /* @__PURE__ */ new Map();
   function dpopmw(options) {
     assert(options, {
       site: Required(validURL),
-      authorization_endpoint: Required(validURL),
       token_endpoint: Required(validURL),
       dpop_signing_alg_values_supported: Optional([])
       // this property is unfortunately rarely supported
     });
     return async (req, next) => {
-      const keys = await keysStore();
-      let keyInfo = await keys.get(options.site);
-      if (!keyInfo) {
-        let keyPair = await generateKeyPair("ES256");
-        keyInfo = { domain: options.site, keyPair };
-        await keys.set(keyInfo);
-      }
-      const url2 = url(req.url);
-      if (req.url.startsWith(options.authorization_endpoint)) {
-        let params = req.body;
-        if (params instanceof URLSearchParams || params instanceof FormData) {
-          params.set("dpop_jkt", keyInfo.keyPair.publicKey);
-        } else {
-          params.dpop_jkt = keyInfo.keyPair.publicKey;
-        }
-      } else if (req.url.startsWith(options.token_endpoint)) {
-        const dpopHeader = await generateProof(keyInfo.keyPair, req.url, req.method);
-        req = req.with({
-          headers: {
-            "DPoP": dpopHeader
-          }
-        });
-      } else if (req.headers.has("Authorization")) {
-        const nonce = localStorage.getItem(url2.host + ":nonce") || void 0;
-        const accessToken = req.headers.get("Authorization").split(" ")[1];
-        const dpopHeader = await generateProof(keyInfo.keyPair, req.url, req.method, nonce, accessToken);
-        req = req.with({
+      const keyPair = await keyPairFor(options.site);
+      const origin = url(req.url).origin;
+      let res = await next(await withProof(req, keyPair));
+      rememberNonce(origin, res);
+      if (needsProof(req) && await asksForNonce(res)) {
+        res = await next(await withProof(req, keyPair));
+        rememberNonce(origin, res);
+      }
+      return res;
+    };
+    function needsProof(req) {
+      return req.url.startsWith(options.token_endpoint) || isDPoPAuthorization(req.headers.get("Authorization"));
+    }
+    async function withProof(req, keyPair) {
+      if (!needsProof(req)) {
+        return req;
+      }
+      const nonce = serverNonces.get(url(req.url).origin);
+      const htu = targetURI(req.url);
+      if (req.url.startsWith(options.token_endpoint)) {
+        const proof2 = await generateProof(keyPair, htu, req.method, nonce);
+        return req.with({
           headers: {
-            "Authorization": "DPoP " + accessToken,
-            "DPoP": dpopHeader
+            "DPoP": proof2
           }
         });
       }
-      let response2 = await next(req);
-      if (response2.headers.get("DPoP-Nonce")) {
-        localStorage.setItem(url2.host + ":nonce", response2.headers.get("DPoP-Nonce"));
-      }
-      return response2;
-    };
+      const accessToken = req.headers.get("Authorization").split(" ")[1];
+      const proof = await generateProof(keyPair, htu, req.method, nonce, accessToken);
+      return req.with({
+        headers: {
+          "Authorization": "DPoP " + accessToken,
+          "DPoP": proof
+        }
+      });
+    }
+  }
+  async function keyPairFor(site) {
+    const keys = await keysStore();
+    let keyInfo = await keys.get(site);
+    if (!keyInfo) {
+      const keyPair = await generateKeyPair("ES256");
+      keyInfo = { domain: site, keyPair };
+      await keys.set(keyInfo);
+    }
+    return keyInfo.keyPair;
+  }
+  function targetURI(url2) {
+    const target = new URL(url2);
+    target.search = "";
+    target.hash = "";
+    return target.href;
+  }
+  function rememberNonce(origin, res) {
+    const nonce = res.headers.get("DPoP-Nonce");
+    if (nonce) {
+      serverNonces.set(origin, nonce);
+    }
+  }
+  async function asksForNonce(res) {
+    if (!res.headers.get("DPoP-Nonce")) {
+      return false;
+    }
+    if (res.status == 401) {
+      const challenge = parseBearerChallenge(res.headers.get("WWW-Authenticate"));
+      return challenge?.error == "use_dpop_nonce";
+    }
+    if (res.status == 400) {
+      const body = await res.clone().json().catch(() => null);
+      return body?.error == "use_dpop_nonce";
+    }
+    return false;
+  }
+  function isDPoPAuthorization(value) {
+    return /^DPoP\s/i.test(value || "");
   }
 
   // ../metro-middleware/src/json.mjs
@@ -2071,9 +2186,12 @@
     };
     options = Object.assign({}, defaultOptions, options);
     options.client = options.client.with(throwermw()).with(jsonmw());
-    const TestSucceeded = false;
+    requireSecureURL("issuer", options.issuer);
     function MustUseHTTPS(url2) {
-      return TestSucceeded;
+      if (isSecureURL(url2)) {
+        return false;
+      }
+      return error("url must use https", url2);
     }
     const openid_provider_metadata = {
       issuer: Required(allOf(options.issuer, MustUseHTTPS)),
@@ -2121,9 +2239,57 @@
     );
     const openid_config = response2.data;
     assert(openid_config, openid_provider_metadata);
-    assert(openid_config.issuer, options.issuer);
+    checkProviderMetadata(openid_config, options.issuer);
     return openid_config;
   }
+  var REQUIRED_ENDPOINTS = ["authorization_endpoint", "token_endpoint", "jwks_uri"];
+  function checkProviderMetadata(config, issuer) {
+    if (!config || typeof config !== "object") {
+      throw metroError("metro.oidc.discovery: openid-configuration for " + issuer + " is not a JSON object");
+    }
+    if (!sameIssuer(config.issuer, issuer)) {
+      throw metroError("metro.oidc.discovery: openid-configuration is for issuer " + config.issuer + ", expected " + issuer);
+    }
+    requireSecureURL("issuer", config.issuer);
+    for (const name of REQUIRED_ENDPOINTS) {
+      if (!config[name]) {
+        throw metroError("metro.oidc.discovery: openid-configuration for " + issuer + " has no " + name);
+      }
+      requireSecureURL(name, config[name]);
+    }
+    if (config.registration_endpoint) {
+      requireSecureURL("registration_endpoint", config.registration_endpoint);
+    }
+  }
+  function sameIssuer(discovered, requested) {
+    if (typeof discovered != "string") {
+      return false;
+    }
+    return withoutTrailingSlash(discovered) === withoutTrailingSlash(String(requested));
+  }
+  function withoutTrailingSlash(value) {
+    return value.replace(/\/$/, "");
+  }
+  function requireSecureURL(name, value) {
+    if (!isSecureURL(value)) {
+      throw metroError("metro.oidc.discovery: " + name + " must use https: " + value);
+    }
+  }
+  function isSecureURL(value) {
+    let url2;
+    try {
+      url2 = new URL(String(value));
+    } catch (e) {
+      return false;
+    }
+    if (url2.protocol == "https:") {
+      return true;
+    }
+    return url2.protocol == "http:" && isLoopback(url2.hostname);
+  }
+  function isLoopback(hostname) {
+    return hostname == "localhost" || hostname.endsWith(".localhost") || hostname == "127.0.0.1" || hostname == "[::1]";
+  }
 
   // src/oidc.register.mjs
   async function register(options) {
@@ -3497,6 +3663,21 @@
   }
 
   // src/oidcmw.mjs
+  var pendingClientSetups = /* @__PURE__ */ new Map();
+  var BROWSER_CLIENT_METADATA = {
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"]
+  };
+  function sharedClientSetup(key, setup) {
+    if (!pendingClientSetups.has(key)) {
+      const pending = setup().finally(() => {
+        pendingClientSetups.delete(key);
+      });
+      pendingClientSetups.set(key, pending);
+    }
+    return pendingClientSetups.get(key);
+  }
   function oidcmw(options = {}) {
     const defaultOptions = {
       client: client(),
@@ -3519,8 +3700,14 @@
       oauth2: Optional({}),
       openid_configuration: Optional()
     });
+    const account = accountFor(options);
+    const expectedClaims = expectedClaimsFor(options);
+    const site = siteFor(options.issuer, account);
+    const clientSetupKey = options.issuer + " " + JSON.stringify(requestedClientInfo?.redirect_uris ?? null);
+    let userStore = options.store;
     if (!options.store) {
       options.store = oidcStore(options.issuer);
+      userStore = oidcStore(site);
     }
     if (!options.openid_configuration && options.store.has("openid_configuration")) {
       options.openid_configuration = options.store.get("openid_configuration");
@@ -3531,51 +3718,70 @@
         options.client_info = storedClientInfo;
       }
     }
-    return async (req, next) => {
-      let res;
-      if (!options.force_authorization) {
-        try {
-          res = await next(req);
-        } catch (err) {
-          res = err?.cause;
-          if (!res || res.status != 401 && res.status != 403) {
-            throw err;
-          }
-        }
-        if (res.ok || res.status != 401 && res.status != 403) {
-          return res;
-        }
+    async function prepareClient() {
+      if (options.openid_configuration && options.client_info?.client_id) {
+        return;
       }
-      if (!options.openid_configuration) {
-        options.openid_configuration = await oidcDiscovery({
+      const prepared = await sharedClientSetup(clientSetupKey, discoverAndRegister);
+      options.openid_configuration = prepared.openid_configuration;
+      options.client_info = prepared.client_info;
+      options.store.set("openid_configuration", options.openid_configuration);
+      options.store.set("client_info", options.client_info);
+    }
+    async function discoverAndRegister() {
+      let openid_configuration = options.openid_configuration;
+      if (!openid_configuration) {
+        openid_configuration = await oidcDiscovery({
           issuer: options.issuer,
           client: options.client.with(options.issuer)
         });
-        options.store.set("openid_configuration", options.openid_configuration);
       }
-      if (!options.client_info?.client_id) {
-        if (!options.openid_configuration.registration_endpoint) {
+      let client_info = options.client_info;
+      if (!client_info?.client_id) {
+        if (!openid_configuration.registration_endpoint) {
           throw metroError("metro.oidcmw: Error: issuer " + options.issuer + " does not support dynamic client registration, but you haven't specified a client_id");
         }
-        options.client_info = await register({
-          registration_endpoint: options.openid_configuration.registration_endpoint,
+        client_info = await register({
+          registration_endpoint: openid_configuration.registration_endpoint,
           client: options.client,
-          client_info: options.client_info
+          client_info: Object.assign({}, BROWSER_CLIENT_METADATA, client_info)
         });
-        options.store.set("client_info", options.client_info);
+        if (client_info.token_endpoint_auth_method == "none") {
+          delete client_info.client_secret;
+        }
+      }
+      return { openid_configuration, client_info };
+    }
+    function rememberNonce2(authorizeCallback) {
+      if (typeof authorizeCallback != "function") {
+        return authorizeCallback;
+      }
+      return async (url2) => {
+        userStore.set("pending_nonce", url2.searchParams.get("nonce"));
+        return authorizeCallback(url2);
+      };
+    }
+    return async (req, next) => {
+      let res;
+      if (!options.force_authorization) {
+        res = await next(req);
+        if (res.ok || res.status != 401 && res.status != 403) {
+          return res;
+        }
       }
-      const scope = options.scope || "openid";
+      await prepareClient();
+      const scope = options.scope || defaultScope(options);
       const nonce = options.nonce || generateCodeVerifier(32);
-      options.store.set("pending_nonce", nonce);
       const oauth2Options = Object.assign(
         {
-          site: options.issuer,
+          site,
           client: options.client,
           force_authorization: true,
-          authorize_callback: options.authorize_callback,
+          authorize_callback: rememberNonce2(options.authorize_callback),
           oauth2_configuration: {
             client_id: options.client_info?.client_id,
             client_secret: options.client_info?.client_secret,
+            token_endpoint_auth_method: options.client_info?.token_endpoint_auth_method,
             grant_type: "authorization_code",
             response_type: "code",
             response_mode: "query",
@@ -3584,6 +3790,10 @@
             scope,
             //FIXME: should only use scopes supported by server
             redirect_uri: options.client_info.redirect_uris[0],
+            login_hint: options.login_hint ?? options.webid,
+            issuer: options.openid_configuration.issuer,
+            authorization_response_iss_parameter_supported: options.openid_configuration.authorization_response_iss_parameter_supported,
+            token_type: options.use_dpop ? "DPoP" : void 0,
             nonce
           }
         }
@@ -3597,7 +3807,7 @@
           return res2;
         }
         const contentType = res2.headers.get("content-type");
-        if (!contentType?.startsWith("application/json")) {
+        if (!res2.ok || !contentType?.startsWith("application/json")) {
           return res2;
         }
         let data = res2.data && typeof res2.data === "object" ? res2.data : null;
@@ -3606,16 +3816,24 @@
           data = await res22.json();
         }
         const id_token = data?.id_token;
+        const isRefresh = await grantTypeOf(req2) == "refresh_token";
+        if (isRefresh && !id_token) {
+          return res2;
+        }
         const jwks = await getJwks();
         const validation = await validateIdToken(id_token, {
           issuer: options.openid_configuration.issuer,
           client_id: options.client_info.client_id,
           jwks,
           openid_configuration: options.openid_configuration,
-          nonce: options.store.get("pending_nonce")
+          nonce: isRefresh ? void 0 : userStore.get("pending_nonce")
         });
-        options.store.set("id_token", id_token);
-        options.store.set("id_token_claims", validation.claims);
+        if (isRefresh) {
+          assertSameUserAsLogin(validation.claims, userStore.get("id_token_claims"));
+        }
+        assertExpectedUser(validation.claims, expectedClaims);
+        userStore.set("id_token", id_token);
+        userStore.set("id_token_claims", validation.claims);
         return res2;
       };
       const getJwks = async () => {
@@ -3630,7 +3848,6 @@
       if (options.use_dpop) {
         const dpopOptions = {
           site: options.issuer,
-          authorization_endpoint: options.openid_configuration.authorization_endpoint,
           token_endpoint: options.openid_configuration.token_endpoint,
           dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported
         };
@@ -3652,6 +3869,52 @@
     const storedRedirectUris = new Set(storedClientInfo.redirect_uris || []);
     return requestedClientInfo.redirect_uris.every((uri) => storedRedirectUris.has(uri));
   }
+  function accountFor(options) {
+    return options.webid ?? options.login_hint;
+  }
+  function expectedClaimsFor(options) {
+    if (options.webid) {
+      return Object.assign({ webid: options.webid }, options.expected_claims);
+    }
+    return options.expected_claims || {};
+  }
+  function defaultScope(options) {
+    const supported = options.openid_configuration?.scopes_supported;
+    const solidIssuer = Array.isArray(supported) && supported.includes("webid");
+    if (options.webid || solidIssuer) {
+      return "openid webid";
+    }
+    return "openid";
+  }
+  function siteFor(issuer, account) {
+    if (!account) {
+      return issuer;
+    }
+    return issuer + "|" + account;
+  }
+  function assertExpectedUser(claims, expectedClaims) {
+    for (const [name, expected] of Object.entries(expectedClaims)) {
+      const actual = claimValue(claims, name);
+      if (actual !== expected) {
+        throw metroError("metro.oidcmw: id_token is for a different user: expected " + name + " " + expected + ", got " + actual);
+      }
+    }
+  }
+  async function grantTypeOf(req) {
+    const body = await req.clone().text();
+    return new URLSearchParams(body).get("grant_type");
+  }
+  function assertSameUserAsLogin(claims, loginClaims) {
+    if (loginClaims && claims.sub !== loginClaims.sub) {
+      throw metroError("metro.oidcmw: refreshed id_token is for a different user: expected sub " + loginClaims.sub + ", got " + claims.sub);
+    }
+  }
+  function claimValue(claims, name) {
+    if (name == "webid" && claims.webid === void 0) {
+      return claims.sub;
+    }
+    return claims[name];
+  }
   function isRedirected2() {
     return isRedirected();
   }
@@ -3660,7 +3923,7 @@
       if (!options.issuer) {
         throw metroError("Must supply options.issuer or options.store to get the id_token");
       }
-      options.store = oidcStore(options.issuer);
+      options.store = oidcStore(siteFor(options.issuer, accountFor(options)));
     }
     return options.store.get("id_token");
   }
@@ -3669,7 +3932,7 @@
       if (!options.issuer) {
         throw metroError("Must supply options.issuer or options.store to get the id_token claims");
       }
-      options.store = oidcStore(options.issuer);
+      options.store = oidcStore(siteFor(options.issuer, accountFor(options)));
     }
     return options.store.get("id_token_claims");
   }