@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/lib/key_management.js

@@ -0,0 +1,196 @@
+import { encode as b64u } from "../util/base64url.js";
+import { prepareKey, rawKey, jwkToKey, checkCryptoKey, checkModulusLength, checkUsage, assertCryptoKey } from "./key.js";
+import { jweAlgorithm, jweEncryption, isJWECEKTransport } from "./jwe_algorithms.js";
+import { JOSENotSupported, JWEInvalid } from "../util/errors.js";
+import { decodeBase64url, assertUint8Array, isObject } from "./validate.js";
+import { digest, concat, encode, uint32be } from "./buffer_utils.js";
+import { checkCekLength, generateCek, encrypt, decrypt } from "./content_encryption.js";
+function checkEcdhCryptoKey(key, usage) {
+  if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519")
+    throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");
+  checkUsage(key, usage);
+}
+async function aeskwWrap(alg, key, cek) {
+  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "wrapKey", !0), cryptoKeyCek = await crypto.subtle.importKey("raw", cek, { hash: "SHA-256", name: "HMAC" }, !0, ["sign"]);
+  return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
+}
+async function aeskwUnwrap(alg, key, encryptedKey) {
+  const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "unwrapKey", !0), cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", { hash: "SHA-256", name: "HMAC" }, !0, ["sign"]);
+  return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+}
+function checkRsaKey(alg, key, usage) {
+  checkCryptoKey(key, jweAlgorithm(alg).subtle, usage), checkModulusLength(alg, key);
+}
+async function deriveKey(p2s, alg, p2c, key) {
+  if (!(p2s instanceof Uint8Array) || p2s.length < 8)
+    throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");
+  if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1)
+    throw new JWEInvalid("PBES2 Count Input must be a positive integer");
+  const salt = concat(encode(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {
+    hash: `SHA-${alg.slice(8, 11)}`,
+    iterations: p2c,
+    name: "PBKDF2",
+    salt
+  }, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "deriveBits");
+  return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+function lengthAndInput(input) {
+  return concat(uint32be(input.length), input);
+}
+async function concatKdf(Z, L, OtherInfo) {
+  const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
+  for (let i = 1; i <= reps; i++) {
+    const hashResult = await digest("sha256", concat(uint32be(i), Z, OtherInfo));
+    dk.set(hashResult, (i - 1) * hashLen);
+  }
+  return dk.slice(0, dkLen);
+}
+async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
+  checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, "deriveBits");
+  const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({
+    name: publicKey.algorithm.name,
+    public: publicKey
+  }, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
+  return concatKdf(Z, keyLength, otherInfo);
+}
+function assertEcdhKey(key) {
+  assertCryptoKey(key);
+  const curve = key.algorithm.namedCurve;
+  if (curve !== "P-256" && curve !== "P-384" && curve !== "P-521" && key.algorithm.name !== "X25519")
+    throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+}
+function partyInfo(joseHeader, name) {
+  const value = joseHeader[name];
+  if (value !== void 0) {
+    if (typeof value != "string")
+      throw new JWEInvalid(`JOSE Header "${name}" (Agreement Party${name === "apu" ? "U" : "V"}Info) invalid`);
+    return decodeBase64url(value, name, JWEInvalid);
+  }
+}
+function checkPartyInfo(apu, apv) {
+  if (!(apu === void 0 || apv === void 0 || apu.byteLength !== apv.byteLength)) {
+    for (let i = 0; i < apu.byteLength; i++)
+      if (apu[i] !== apv[i])
+        return;
+    throw new JWEInvalid('JOSE Header "apu" and "apv" values must be distinct');
+  }
+}
+function assertEncryptedKey(encryptedKey) {
+  if (encryptedKey === void 0)
+    throw new JWEInvalid("JWE Encrypted Key missing");
+}
+function assertNoEncryptedKey(encryptedKey) {
+  if (encryptedKey !== void 0)
+    throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
+}
+function validateMaxPBES2Count(value) {
+  if (value !== void 0 && value !== 1 / 0 && (!Number.isSafeInteger(value) || value < 1))
+    throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity");
+}
+async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
+  const { alg } = entry, mode = entry.mode;
+  if (mode === "direct-encryption")
+    return assertNoEncryptedKey(encryptedKey), key;
+  const direct = mode === "direct-key-agreement";
+  switch (direct ? assertNoEncryptedKey(encryptedKey) : assertEncryptedKey(encryptedKey), entry.subtle.name) {
+    case "ECDH": {
+      const { epk } = joseHeader;
+      if (!isObject(epk) || ["d", "k", "p", "q", "dp", "dq", "qi", "oth", "priv"].some((parameter) => Object.hasOwn(epk, parameter)))
+        throw new JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');
+      assertEcdhKey(key);
+      const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, "apu"), partyVInfo = partyInfo(joseHeader, "apv");
+      checkPartyInfo(partyUInfo, partyVInfo);
+      const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+      if (direct)
+        return sharedSecret;
+      key = sharedSecret;
+      break;
+    }
+    case "RSA-OAEP":
+      return assertCryptoKey(key), checkRsaKey(alg, key, "decrypt"), new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
+    case "PBKDF2": {
+      if (typeof joseHeader.p2c != "number")
+        throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');
+      validateMaxPBES2Count(maxPBES2Count);
+      const p2cLimit = maxPBES2Count ?? 1e4;
+      if (joseHeader.p2c > p2cLimit)
+        throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');
+      if (typeof joseHeader.p2s != "string")
+        throw new JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');
+      const p2s = decodeBase64url(joseHeader.p2s, "p2s", JWEInvalid);
+      key = await deriveKey(p2s, alg, joseHeader.p2c, key);
+      break;
+    }
+    case "AES-GCM": {
+      if (typeof joseHeader.iv != "string")
+        throw new JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');
+      if (typeof joseHeader.tag != "string")
+        throw new JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');
+      const iv = decodeBase64url(joseHeader.iv, "iv", JWEInvalid), tag = decodeBase64url(joseHeader.tag, "tag", JWEInvalid);
+      if (iv.byteLength !== 12)
+        throw new JWEInvalid("Invalid Initialization Vector length");
+      if (tag.byteLength !== 16)
+        throw new JWEInvalid("Invalid Authentication Tag length");
+      return decrypt(jweEncryption(alg.slice(0, -2)), key, encryptedKey, iv, tag, new Uint8Array());
+    }
+  }
+  return aeskwUnwrap(alg.slice(-6), key, encryptedKey);
+}
+async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCek, providedParameters = {}) {
+  const { alg, mode } = entry, transport = isJWECEKTransport(entry);
+  if (providedCek !== void 0 && !transport)
+    throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+  let key = await prepareKey(mode === "direct-encryption" ? enc : entry, inputKey, "encrypt");
+  if (mode === "direct-encryption")
+    return [key, void 0, void 0];
+  const cek = transport ? providedCek ?? generateCek(enc) : void 0;
+  cek && checkCekLength(cek, enc.cekBits);
+  let encryptedKey, parameters;
+  switch (entry.subtle.name) {
+    case "ECDH": {
+      assertEcdhKey(key);
+      const { apu: providedApu, apv: providedApv } = providedParameters;
+      providedApu !== void 0 && assertUint8Array(providedApu, '"apu"'), providedApv !== void 0 && assertUint8Array(providedApv, '"apv"');
+      const apu = providedApu ?? partyInfo(joseHeader, "apu"), apv = providedApv ?? partyInfo(joseHeader, "apv");
+      checkPartyInfo(apu, apv);
+      let ephemeralKey;
+      providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, !0, ["deriveBits"])).privateKey;
+      const subtle = crypto.subtle;
+      let exportableEpk = ephemeralKey;
+      if (!exportableEpk.extractable) {
+        if (typeof subtle.getPublicKey != "function")
+          throw new TypeError('CryptoKey for "epk" must be extractable');
+        exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
+      }
+      const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };
+      if (kty === "EC" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = b64u(providedApu)), providedApv !== void 0 && (parameters.apv = b64u(providedApv)), direct)
+        return [sharedSecret, void 0, parameters];
+      key = sharedSecret;
+      break;
+    }
+    case "RSA-OAEP": {
+      assertCryptoKey(key), checkRsaKey(alg, key, "encrypt"), encryptedKey = new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
+      break;
+    }
+    case "PBKDF2": {
+      const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters;
+      key = await deriveKey(p2s, alg, p2c, key), parameters = { p2c, p2s: b64u(p2s) };
+      break;
+    }
+    case "AES-GCM": {
+      const iv = providedParameters.iv === void 0 ? crypto.getRandomValues(new Uint8Array(12)) : providedParameters.iv;
+      if (!(iv instanceof Uint8Array))
+        throw new TypeError('"iv" must be an instance of Uint8Array');
+      const wrapped = await encrypt(jweEncryption(alg.slice(0, -2)), cek, key, iv, new Uint8Array());
+      encryptedKey = wrapped.ciphertext, parameters = { iv: b64u(wrapped.iv), tag: b64u(wrapped.tag) };
+    }
+  }
+  if (encryptedKey ??= await aeskwWrap(alg.slice(-6), key, cek), !(encryptedKey instanceof Uint8Array) || !encryptedKey.byteLength)
+    throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");
+  return [cek, encryptedKey, parameters];
+}
+export {
+  decryptKeyManagement,
+  encryptKeyManagement,
+  validateMaxPBES2Count
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/lib/validate.js

@@ -0,0 +1,122 @@
+import { JOSENotSupported, JWSInvalid } from "../util/errors.js";
+import { decode } from "../util/base64url.js";
+import { encode, strictDecoder } from "./buffer_utils.js";
+function assertUint8Array(input, label) {
+  if (!(input instanceof Uint8Array))
+    throw new TypeError(`${label} must be an instance of Uint8Array`);
+}
+function isObject(input) {
+  if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
+    return !1;
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
+}
+function isDisjoint(...headers) {
+  const parameters = /* @__PURE__ */ new Set();
+  for (const header of headers)
+    if (header)
+      for (const parameter of Object.keys(header)) {
+        if (parameters.has(parameter))
+          return !1;
+        parameters.add(parameter);
+      }
+  return !0;
+}
+function assertNotSet(value, name) {
+  if (value !== void 0)
+    throw new TypeError(`${name} can only be called once`);
+}
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message);
+  }
+  if (!isObject(parsed))
+    throw new ErrorClass(message);
+  return parsed;
+}
+const JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  return algorithms === void 0 ? void 0 : new Set(algorithms);
+}
+function validateCritDuplicates(Err, protectedHeader) {
+  const { crit } = protectedHeader ?? {};
+  if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+    throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!protectedHeader || protectedHeader.crit === void 0)
+    return [];
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized))
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 != "boolean")
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    return b64;
+  }
+  return !0;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized, parsed;
+  try {
+    serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed))
+    throw new Err("JOSE Header is not a JSON object");
+  return [parsed, serialized];
+}
+export {
+  JWE_RECOGNIZED,
+  JWS_RECOGNIZED,
+  assertNotSet,
+  assertUint8Array,
+  decodeBase64url,
+  encodeBase64url,
+  isDisjoint,
+  isJwkSet,
+  isObject,
+  parseJoseHeader,
+  serializeJoseHeader,
+  validateAlgorithms,
+  validateB64,
+  validateCrit,
+  validateCritDuplicates
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/util/base64url.js

@@ -0,0 +1,16 @@
+import { encoder, decoder, encodeBase64, decodeBase64 } from "../lib/buffer_utils.js";
+const invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  try {
+    return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+  } catch (cause) {
+    throw new TypeError(invalid, { cause });
+  }
+}
+function encode(input) {
+  return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, !0);
+}
+export {
+  decode,
+  encode
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/util/decode_jwt.js

@@ -0,0 +1,33 @@
+import { decode as b64u } from "./base64url.js";
+import { strictDecoder } from "../lib/buffer_utils.js";
+import { isObject } from "../lib/validate.js";
+import { JWTInvalid } from "./errors.js";
+function decodeJwt(jwt) {
+  if (typeof jwt != "string")
+    throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
+  const { 1: payload, length } = jwt.split(".");
+  if (length === 5)
+    throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
+  if (length !== 3)
+    throw new JWTInvalid("Invalid JWT");
+  if (!payload)
+    throw new JWTInvalid("JWTs must contain a payload");
+  let decoded;
+  try {
+    decoded = b64u(payload);
+  } catch {
+    throw new JWTInvalid("Failed to base64url decode the payload");
+  }
+  let result;
+  try {
+    result = JSON.parse(strictDecoder.decode(decoded));
+  } catch {
+    throw new JWTInvalid("Failed to parse the decoded payload as JSON");
+  }
+  if (!isObject(result))
+    throw new JWTInvalid("Invalid JWT Claims Set");
+  return result;
+}
+export {
+  decodeJwt
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/util/decode_protected_header.js

@@ -0,0 +1,19 @@
+import { parseJoseHeader } from "../lib/validate.js";
+function decodeProtectedHeader(token) {
+  let protectedB64u;
+  if (typeof token == "string") {
+    const parts = token.split(".");
+    (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+  } else if (typeof token == "object" && token)
+    if ("protected" in token)
+      protectedB64u = token.protected;
+    else
+      throw new TypeError("Token does not contain a Protected Header");
+  const invalid = "Invalid Token or Protected Header formatting";
+  if (typeof protectedB64u != "string" || !protectedB64u)
+    throw new TypeError(invalid);
+  return parseJoseHeader(protectedB64u, TypeError, invalid);
+}
+export {
+  decodeProtectedHeader
+};

package/dist/node_modules/oidc-provider/node_modules/jose/dist/webapi/util/errors.js

@@ -0,0 +1,109 @@
+class JOSEError extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message, options) {
+    super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+class JWTClaimValidationFailed extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JWTExpired extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message, payload, claim = "unspecified", reason = "unspecified") {
+    super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;
+  }
+}
+class JOSEAlgNotAllowed extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+}
+class JOSENotSupported extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+}
+class JWEDecryptionFailed extends JOSEError {
+  static code = "ERR_JWE_DECRYPTION_FAILED";
+  code = "ERR_JWE_DECRYPTION_FAILED";
+  constructor(message = "decryption operation failed", options) {
+    super(message, options);
+  }
+}
+class JWEInvalid extends JOSEError {
+  static code = "ERR_JWE_INVALID";
+  code = "ERR_JWE_INVALID";
+}
+class JWSInvalid extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+}
+class JWTInvalid extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+}
+class JWKInvalid extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+}
+class JWKSInvalid extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+}
+class JWKSNoMatchingKey extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message = "no applicable key found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSMultipleMatchingKeys extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message, options);
+  }
+}
+class JWKSTimeout extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message = "request timed out", options) {
+    super(message, options);
+  }
+}
+class JWSSignatureVerificationFailed extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message = "signature verification failed", options) {
+    super(message, options);
+  }
+}
+export {
+  JOSEAlgNotAllowed,
+  JOSEError,
+  JOSENotSupported,
+  JWEDecryptionFailed,
+  JWEInvalid,
+  JWKInvalid,
+  JWKSInvalid,
+  JWKSMultipleMatchingKeys,
+  JWKSNoMatchingKey,
+  JWKSTimeout,
+  JWSInvalid,
+  JWSSignatureVerificationFailed,
+  JWTClaimValidationFailed,
+  JWTExpired,
+  JWTInvalid
+};

package/dist/node_modules/oidc-provider/node_modules/jose/package.json

@@ -0,0 +1,134 @@
+{
+  "name": "jose",
+  "version": "6.2.12",
+  "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+  "keywords": [
+    "akp",
+    "browser",
+    "bun",
+    "cloudflare",
+    "compact",
+    "decode",
+    "decrypt",
+    "deno",
+    "detached",
+    "ec",
+    "ecdsa",
+    "ed25519",
+    "eddsa",
+    "edge",
+    "electron",
+    "embedded",
+    "encrypt",
+    "flattened",
+    "general",
+    "jose",
+    "json web token",
+    "jsonwebtoken",
+    "jwa",
+    "jwe",
+    "jwk",
+    "jwks",
+    "jws",
+    "jwt-decode",
+    "jwt",
+    "ml-dsa",
+    "netlify",
+    "next",
+    "nextjs",
+    "oct",
+    "okp",
+    "payload",
+    "pem",
+    "pkcs8",
+    "rsa",
+    "sign",
+    "signature",
+    "spki",
+    "validate",
+    "vercel",
+    "verify",
+    "webcrypto",
+    "workerd",
+    "workers",
+    "x509"
+  ],
+  "homepage": "https://github.com/panva/jose",
+  "repository": "panva/jose",
+  "funding": {
+    "url": "https://github.com/sponsors/panva"
+  },
+  "license": "MIT",
+  "author": "Filip Skokan <panva.ip@gmail.com>",
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "default": "./dist/webapi/index.js"
+    },
+    "./jwk/*": {
+      "types": "./dist/types/jwk/*.d.ts",
+      "default": "./dist/webapi/jwk/*.js"
+    },
+    "./key/import": {
+      "types": "./dist/types/key/import.d.ts",
+      "default": "./dist/webapi/key/import.js"
+    },
+    "./key/export": {
+      "types": "./dist/types/key/export.d.ts",
+      "default": "./dist/webapi/key/export.js"
+    },
+    "./key/generate/keypair": {
+      "types": "./dist/types/key/generate_key_pair.d.ts",
+      "default": "./dist/webapi/key/generate_key_pair.js"
+    },
+    "./key/generate/secret": {
+      "types": "./dist/types/key/generate_secret.d.ts",
+      "default": "./dist/webapi/key/generate_secret.js"
+    },
+    "./jwks/*": {
+      "types": "./dist/types/jwks/*.d.ts",
+      "default": "./dist/webapi/jwks/*.js"
+    },
+    "./jwt/decode": {
+      "types": "./dist/types/util/decode_jwt.d.ts",
+      "default": "./dist/webapi/util/decode_jwt.js"
+    },
+    "./jwt/*": {
+      "types": "./dist/types/jwt/*.d.ts",
+      "default": "./dist/webapi/jwt/*.js"
+    },
+    "./decode/protected_header": {
+      "types": "./dist/types/util/decode_protected_header.d.ts",
+      "default": "./dist/webapi/util/decode_protected_header.js"
+    },
+    "./jws/*": {
+      "types": "./dist/types/jws/*.d.ts",
+      "default": "./dist/webapi/jws/*.js"
+    },
+    "./jwe/*": {
+      "types": "./dist/types/jwe/*.d.ts",
+      "default": "./dist/webapi/jwe/*.js"
+    },
+    "./errors": {
+      "types": "./dist/types/util/errors.d.ts",
+      "default": "./dist/webapi/util/errors.js"
+    },
+    "./base64url": {
+      "types": "./dist/types/util/base64url.d.ts",
+      "default": "./dist/webapi/util/base64url.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/webapi/index.js",
+  "types": "./dist/types/index.d.ts",
+  "files": [
+    "dist/webapi/**/*.js",
+    "dist/types/**/*.d.ts",
+    "!dist/**/*.bundle.js",
+    "!dist/**/*.umd.js",
+    "!dist/**/*.min.js",
+    "!dist/types/lib/**"
+  ]
+}

package/dist/node_modules/oidc-provider/node_modules/{jsesc/LICENSE-MIT.txt → koa/LICENSE}

@@ -1,8 +1,10 @@
-Copyright Mathias Bynens <https://mathiasbynens.be/>
+(The MIT License)
+
+Copyright (c) 2019 Koa contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
+'Software'), to deal in the Software without restriction, including
 without limitation the rights to use, copy, modify, merge, publish,
 distribute, sublicense, and/or sell copies of the Software, and to
 permit persons to whom the Software is furnished to do so, subject to
@@ -11,10 +13,10 @@ the following conditions:
 The above copyright notice and this permission notice shall be
 included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
 EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.