@o2js/core 0.1.0 → 0.2.0

package/README.md

@@ -1,10 +1,10 @@
 # o2js
 
-**A lightweight and provider-agnostic OAuth2 library for Node.js.**
+**A lightweight, provider-agnostic OAuth2 and OpenID Connect library for Node.js.**
 
-o2js provides the core OAuth2 authorization code and refresh token flows.
+o2js provides the core OAuth2 Authorization Code and Refresh Token flows, along with OpenID Connect ID Token validation.
 
-It does not manage users, sessions, token storage, or database operations. It only handles OAuth2 mechanics and leaves the rest to your application.
+It does not manage users, sessions, token storage, or database operations. It handles protocol mechanics and leaves application state and lifecycle management to your application.
 
 ## Installation
 
@@ -19,15 +19,10 @@ First, define a provider:
 ```typescript
 import type { Provider } from "@o2js/core";
 
-class MyProvider implements Provider {
-    authURL(): string {
-        return "https://example.com/oauth/authorize";
-    }
-
-    tokenURL(): string {
-        return "https://example.com/oauth/token";
-    }
-}
+const provider: Provider = {
+    authURL: "https://example.com/oauth/authorize",
+    tokenURL: "https://example.com/oauth/token",
+};
 ```
 
 Create an OAuth2 client:
@@ -35,14 +30,11 @@ Create an OAuth2 client:
 ```typescript
 import { OAuth2 } from "@o2js/core";
 
-const oauth = new OAuth2(
-    new MyProvider(),
-    {
-        clientID: "your-client-id",
-        clientSecret: "your-client-secret",
-        redirectURL: "https://yourapp.com/callback",
-    }
-);
+const oauth = new OAuth2(provider, {
+    clientID: "your-client-id",
+    clientSecret: "your-client-secret",
+    redirectURL: "https://yourapp.com/callback",
+});
 ```
 
 Generate an authorization URL:
@@ -104,14 +96,13 @@ const oauth = new OAuth2(provider, {
 
 If `clientAuthMethod` is omitted, o2js uses `client_secret_basic`.
 
-
 ## Custom Parameters
 
 OAuth providers may require additional parameters for scopes, PKCE, or other features.
 
-You can pass these parameters directly to the relevant methods.
+You can pass additional parameters directly to the relevant methods.
 
-Additional authorization URL parameters:
+Authorization URL parameters:
 
 ```typescript
 const url = oauth.authCodeURL(state, {
@@ -120,7 +111,7 @@ const url = oauth.authCodeURL(state, {
 });
 ```
 
-Additional token request parameters:
+Token request parameters:
 
 ```typescript
 const response = await oauth.exchangeAuthCode(code, {
@@ -138,11 +129,13 @@ const response = await oauth.exchangeRefreshToken(refreshToken, {
 
 Check your provider's documentation for supported parameters and their expected values.
 
-## State and PKCE
+## State, Nonce and PKCE
 
-o2js provides helpers for generating random state values and PKCE parameters.
+o2js provides helpers for generating cryptographically secure random state, nonce, and PKCE values.
 
-Generate a random state:
+### State
+
+Generate a random state value:
 
 ```typescript
 import { generateRandomState } from "@o2js/core";
@@ -150,6 +143,46 @@ import { generateRandomState } from "@o2js/core";
 const state = generateRandomState();
 ```
 
+Pass it to the authorization URL:
+
+```typescript
+const url = oauth.authCodeURL(state);
+```
+
+Your application is responsible for storing the state and verifying the returned value during the callback.
+
+### Nonce
+
+Generate a random nonce:
+
+```typescript
+import { generateRandomNonce } from "@o2js/core";
+
+const nonce = generateRandomNonce();
+```
+
+Include it in the authorization request:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    nonce,
+});
+```
+
+After receiving the ID Token, pass the expected nonce to `parseClaims`:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    nonce,
+});
+```
+
+o2js verifies that the nonce in the ID Token matches the expected value.
+
+Your application is responsible for storing and managing the nonce throughout the authorization flow.
+
+### PKCE
+
 Generate PKCE parameters:
 
 ```typescript
@@ -175,7 +208,147 @@ const response = await oauth.exchangeAuthCode(code, {
 });
 ```
 
-State and PKCE values must be stored and managed by your application. o2js does not handle their storage, verification, or lifecycle.
+State, nonce, and PKCE values must be stored and managed by your application. Your application is also responsible for verifying the returned state and managing the lifecycle of these values.
+
+o2js does not store or manage these values.
+
+## OpenID Connect
+
+o2js supports OpenID Connect ID Token validation through the `parseClaims` method.
+
+To enable ID Token validation, provide the issuer and JWKS URLs in your provider configuration:
+
+```typescript
+import type { Provider } from "@o2js/core";
+
+const provider: Provider = {
+    authURL: "https://example.com/oauth/authorize",
+    tokenURL: "https://example.com/oauth/token",
+    issuerURL: "https://example.com",
+    jwksURL: "https://example.com/.well-known/jwks.json",
+};
+```
+
+The `issuerURL` and `jwksURL` properties are optional for OAuth2-only providers. They are required when using `parseClaims`.
+
+### ID Token Validation
+
+After exchanging the authorization code, retrieve the ID Token from the token response and validate it:
+
+```typescript
+const response = await oauth.exchangeAuthCode(code);
+
+const idToken = response.data.id_token;
+
+if (typeof idToken !== "string") {
+    throw new Error("ID Token is missing");
+}
+
+const claims = await oauth.parseClaims(idToken);
+
+console.log(claims.sub);
+```
+
+`parseClaims` verifies the ID Token signature using the provider's JWKS and validates its issuer, audience, expiration, and required claims.
+
+### Validation Options
+
+The `parseClaims` method accepts an optional options object:
+
+```typescript
+type ParseClaimsOptions = {
+    nonce?: string;
+    maxAge?: number;
+    trustedAudiences?: string[];
+    algorithms?: (
+        | "RS256"
+        | "PS256"
+        | "ES256"
+        | "ES384"
+        | "ES512"
+    )[];
+};
+```
+
+**Nonce**
+
+If a nonce was included in the authorization request, pass the expected value when validating the ID Token:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    nonce: savedNonce,
+});
+```
+
+The nonce must match the value in the ID Token.
+
+**Maximum Authentication Age**
+
+If you request a maximum authentication age, include `max_age` in the authorization request:
+
+```typescript
+const url = oauth.authCodeURL(state, {
+    max_age: "300",
+});
+```
+
+Pass the same value to `parseClaims`:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    maxAge: 300,
+});
+```
+
+When `maxAge` is provided, `auth_time` is required and checked against the requested maximum age.
+
+**Trusted Audiences**
+
+By default, o2js accepts the configured client ID as a trusted audience.
+
+If your application expects additional audiences, specify them explicitly:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    trustedAudiences: [
+        "trusted-service",
+    ],
+});
+```
+
+Any audience not included in the client ID or the trusted audience list is rejected.
+
+**Signing Algorithms**
+
+The default signing algorithm is `RS256`.
+
+You can specify additional supported algorithms:
+
+```typescript
+const claims = await oauth.parseClaims(idToken, {
+    algorithms: ["RS256", "PS256", "ES256"],
+});
+```
+
+Only use algorithms supported and expected by your identity provider.
+
+### ID Token Claims
+
+The `parseClaims` method returns an `IDTokenClaims` object:
+
+```typescript
+import type { IDTokenClaims } from "@o2js/core";
+```
+
+The type extends `JWTPayload` and includes the standard claims:
+
+- `iss`: Issuer identifier.
+- `sub`: Subject identifier.
+- `aud`: Intended audience.
+- `exp`: Expiration time.
+- `iat`: Issued-at time.
+
+Other claims provided by the identity provider are also available through the returned payload.
 
 ## Response
 
@@ -193,7 +366,7 @@ type ExchangeResponse = {
 
 ## Error Handling
 
-HTTP and response parsing errors are represented by `HTTPError`.
+HTTP and token response parsing errors are represented by `HTTPError`.
 
 ```typescript
 import { HTTPError } from "@o2js/core";
@@ -211,21 +384,30 @@ try {
 
 `body` contains the raw response body when available.
 
+ID Token validation errors and JWT verification errors are also thrown by `parseClaims`. These may originate from the validation logic or the underlying `jose` library.
+
 ## Providers
 
 o2js does not include provider implementations.
 
-You can implement the `Provider` interface yourself or use separate provider packages when available.
-
-A provider only needs to implement:
+You can define your own provider using the `Provider` interface:
 
 ```typescript
 export interface Provider {
-    authURL(): string;
-    tokenURL(): string;
+    authURL: string;
+    tokenURL: string;
+    issuerURL?: string;
+    jwksURL?: string;
 }
 ```
 
+- `authURL`: Authorization endpoint URL.
+- `tokenURL`: Token endpoint URL.
+- `issuerURL`: OpenID Connect issuer URL. Required for ID Token validation.
+- `jwksURL`: JSON Web Key Set endpoint URL. Required for ID Token validation.
+
+OAuth2-only providers do not need to define `issuerURL` or `jwksURL`.
+
 ## License
 
 MIT

package/dist/crypto.d.ts

@@ -3,5 +3,6 @@ export type PKCE = {
     codeChallenge: string;
 };
 export declare function generateRandomState(): string;
+export declare function generateRandomNonce(): string;
 export declare function generateRandomPKCE(): PKCE;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,IAAI,GAAG;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC"}

package/dist/crypto.js

@@ -2,6 +2,9 @@ import { randomBytes, createHash } from "node:crypto";
 export function generateRandomState() {
     return randomBytes(32).toString("hex");
 }
+export function generateRandomNonce() {
+    return generateRandomState();
+}
 export function generateRandomPKCE() {
     const codeVerifier = randomBytes(32).toString("base64url");
     const codeChallenge = createHash("sha256")

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOtD,MAAM,UAAU,mBAAmB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAC9B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzB,OAAO;QACH,YAAY;QACZ,aAAa;KAChB,CAAC;AACN,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOtD,MAAM,UAAU,mBAAmB;IAC/B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,OAAO,mBAAmB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAC9B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;SACrC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzB,OAAO;QACH,YAAY;QACZ,aAAa;KAChB,CAAC;AACN,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-export { OAuth2 } from "./oauth2.js";
+export { OAuth2, type IDTokenClaims } from "./oauth2.js";
 export { HTTPError } from "./errors.js";
 export type { Provider } from "./provider.js";
 export type { Config, ClientAuthMethod } from "./config.js";
 export type { ExchangeResponse } from "./response.js";
-export { generateRandomState, generateRandomPKCE, type PKCE } from "./crypto.js";
+export { generateRandomState, generateRandomNonce, generateRandomPKCE, type PKCE } from "./crypto.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACH,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,IAAI,EACZ,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,IAAI,EACZ,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { OAuth2 } from "./oauth2.js";
 export { HTTPError } from "./errors.js";
-export { generateRandomState, generateRandomPKCE } from "./crypto.js";
+export { generateRandomState, generateRandomNonce, generateRandomPKCE } from "./crypto.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACH,mBAAmB,EACnB,kBAAkB,EAErB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAsB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACH,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAErB,MAAM,aAAa,CAAC"}

package/dist/oauth2.d.ts

@@ -1,14 +1,29 @@
 import type { Provider } from "./provider.js";
 import type { Config } from "./config.js";
 import type { ExchangeResponse } from "./response.js";
+import { type JWTPayload } from "jose";
+export type IDTokenClaims = JWTPayload & {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+};
 export declare class OAuth2 {
     private provider;
     private config;
+    private jwks?;
     constructor(provider: Provider, config: Config);
     authCodeURL(state: string, urlParams?: Record<string, string>): string;
     exchangeAuthCode(code: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
     exchangeRefreshToken(refreshToken: string, tokenParams?: Record<string, string>): Promise<ExchangeResponse>;
     private exchange;
+    parseClaims(idToken: string, options?: {
+        nonce?: string;
+        maxAge?: number;
+        trustedAudiences?: string[];
+        algorithms?: ("RS256" | "PS256" | "ES256" | "ES384" | "ES512")[];
+    }): Promise<IDTokenClaims>;
     private validate;
 }
 //# sourceMappingURL=oauth2.d.ts.map

package/dist/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AActD,qBAAa,MAAM;IAEX,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,MAAM;IAFlB,YACY,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EAGzB;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0BrE;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgBhH;YAEa,QAAQ;IAqGtB,OAAO,CAAC,QAAQ;CAoCnB"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAQtD,OAAO,EAGH,KAAK,UAAU,EAClB,MAAM,MAAM,CAAC;AAEd,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACf,CAAC;AAQF,qBAAa,MAAM;IAIX,OAAO,CAAC,QAAQ;IAChB,OAAO,CAAC,MAAM;IAJlB,OAAO,CAAC,IAAI,CAAC,CAAwC;IAErD,YACY,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EAGzB;IAED,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0BrE;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYpG;IAEK,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAehH;YAEa,QAAQ;IAqGhB,WAAW,CACb,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACN,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,UAAU,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;KACpE,GACF,OAAO,CAAC,aAAa,CAAC,CAmKxB;IAED,OAAO,CAAC,QAAQ;CAoCnB"}

package/dist/oauth2.js

@@ -1,5 +1,6 @@
 import { HTTPError } from "./errors.js";
 import { parseParams, baseReservedParams, } from "./params.js";
+import { createRemoteJWKSet, jwtVerify, } from "jose";
 function encodeFormValue(value) {
     return new URLSearchParams([["value", value]])
         .toString()
@@ -8,6 +9,7 @@ function encodeFormValue(value) {
 export class OAuth2 {
     provider;
     config;
+    jwks;
     constructor(provider, config) {
         this.provider = provider;
         this.config = config;
@@ -24,7 +26,7 @@ export class OAuth2 {
         if (state !== "") {
             params.set("state", state);
         }
-        const url = new URL(this.provider.authURL());
+        const url = new URL(this.provider.authURL);
         params.forEach((value, key) => {
             url.searchParams.set(key, value);
         });
@@ -46,7 +48,6 @@ export class OAuth2 {
         }
         const params = new URLSearchParams();
         params.set("refresh_token", refreshToken);
-        params.set("redirect_uri", this.config.redirectURL);
         params.set("grant_type", "refresh_token");
         return this.exchange(params, baseReservedParams(), tokenParams);
     }
@@ -68,7 +69,7 @@ export class OAuth2 {
         }
         let response;
         try {
-            response = await fetch(this.provider.tokenURL(), {
+            response = await fetch(this.provider.tokenURL, {
                 method: "POST",
                 headers,
                 body: params.toString(),
@@ -104,6 +105,110 @@ export class OAuth2 {
             data: parsed,
         };
     }
+    async parseClaims(idToken, options) {
+        if (!idToken.trim()) {
+            throw new Error("ID Token cannot be empty");
+        }
+        const issuer = this.provider.issuerURL;
+        const jwksURL = this.provider.jwksURL;
+        if (!issuer?.trim()) {
+            throw new Error("Provider issuer URL is required");
+        }
+        if (!jwksURL?.trim()) {
+            throw new Error("Provider JWKS URL is required");
+        }
+        if (options?.nonce !== undefined &&
+            !options.nonce.trim()) {
+            throw new Error("Nonce cannot be empty");
+        }
+        if (options?.maxAge !== undefined &&
+            (!Number.isFinite(options.maxAge) || options.maxAge < 0)) {
+            throw new Error("maxAge must be a non-negative number");
+        }
+        if (options?.trustedAudiences?.some((audience) => !audience.trim())) {
+            throw new Error("Trusted audiences cannot contain empty values");
+        }
+        const algorithms = options?.algorithms ?? ["RS256"];
+        if (algorithms.length === 0) {
+            throw new Error("At least one signing algorithm is required");
+        }
+        if (!this.jwks) {
+            this.jwks = createRemoteJWKSet(new URL(jwksURL));
+        }
+        const { payload } = await jwtVerify(idToken, this.jwks, {
+            issuer,
+            audience: this.config.clientID,
+            algorithms,
+            clockTolerance: 5,
+        });
+        // Subject
+        if (typeof payload.sub !== "string" ||
+            !payload.sub) {
+            throw new Error("Invalid ID Token: missing subject");
+        }
+        // Audience
+        const audiences = typeof payload.aud === "string"
+            ? [payload.aud]
+            : payload.aud;
+        if (!Array.isArray(audiences) ||
+            audiences.length === 0 ||
+            audiences.some((audience) => typeof audience !== "string" ||
+                !audience)) {
+            throw new Error("Invalid ID Token: invalid audience");
+        }
+        const trustedAudiences = new Set([
+            this.config.clientID,
+            ...(options?.trustedAudiences ?? []),
+        ]);
+        if (audiences.some((audience) => !trustedAudiences.has(audience))) {
+            throw new Error("Invalid ID Token: untrusted audience");
+        }
+        // Expiration
+        if (typeof payload.exp !== "number" ||
+            !Number.isFinite(payload.exp)) {
+            throw new Error("Invalid ID Token: invalid expiration");
+        }
+        // Issued at
+        if (typeof payload.iat !== "number" ||
+            !Number.isFinite(payload.iat) ||
+            payload.iat < 0) {
+            throw new Error("Invalid ID Token: invalid issued-at claim");
+        }
+        // Nonce
+        if (options?.nonce !== undefined) {
+            if (typeof payload.nonce !== "string" ||
+                payload.nonce !== options.nonce) {
+                throw new Error("Invalid ID Token: nonce mismatch");
+            }
+        }
+        // Authorized party
+        if (audiences.length > 1 && typeof payload.azp !== "string") {
+            throw new Error("Invalid ID Token: missing authorized party");
+        }
+        if (payload.azp !== undefined &&
+            (typeof payload.azp !== "string" ||
+                payload.azp !== this.config.clientID)) {
+            throw new Error("Invalid ID Token: authorized party mismatch");
+        }
+        // Authentication time
+        if (options?.maxAge !== undefined) {
+            if (typeof payload.auth_time !== "number") {
+                throw new Error("Invalid ID Token: missing authentication time");
+            }
+            const now = Math.floor(Date.now() / 1000);
+            const authTime = payload.auth_time;
+            if (!Number.isFinite(authTime) || authTime < 0) {
+                throw new Error("Invalid ID Token: invalid authentication time");
+            }
+            if (authTime > now + 5) {
+                throw new Error("Invalid ID Token: authentication time is in the future");
+            }
+            if (now - authTime > options.maxAge + 5) {
+                throw new Error("Invalid ID Token: authentication is too old");
+            }
+        }
+        return payload;
+    }
     validate() {
         if (!this.provider) {
             throw new Error("Provider cannot be null or undefined");
@@ -111,10 +216,10 @@ export class OAuth2 {
         if (!this.config) {
             throw new Error("Config cannot be null or undefined");
         }
-        if (!this.provider.authURL().trim()) {
+        if (!this.provider.authURL.trim()) {
             throw new Error("Provider authorization URL cannot be empty");
         }
-        if (!this.provider.tokenURL().trim()) {
+        if (!this.provider.tokenURL.trim()) {
             throw new Error("Provider token URL cannot be empty");
         }
         if (!this.config.clientID.trim()) {

package/dist/oauth2.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACH,WAAW,EACX,kBAAkB,GACrB,MAAM,aAAa,CAAC;AAErB,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SACzC,QAAQ,EAAE;SACV,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,MAAM;IAEH,QAAQ;IACR,MAAM;IAFlB,YACY,QAAkB,EAClB,MAAc;wBADd,QAAQ;sBACR,MAAM;QAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,SAAkC;QACzD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpC,WAAW,CACP,kBAAkB,EAAE,EACpB,SAAS,IAAI,EAAE,EACf,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAE7C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,WAAoC;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,QAAQ,CAChB,MAAM,EACN,kBAAkB,EAAE,EACpB,WAAW,CACd,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,QAAQ,CAClB,MAAuB,EACvB,cAA2B,EAC3B,WAAoC;QAGpC,WAAW,CACP,cAAc,EACd,WAAW,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;QAEzE,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC3B,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EACvF,MAAM,CACT,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAErB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,wCAAwC,EACxC,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,GAAW,CAAC;QAEhB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,yCAAyC,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACf,8CAA8C,QAAQ,CAAC,MAAM,EAAE,EAC/D,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,0CAA0C,EAC1C,QAAQ,CAAC,MAAM,EACf,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IACI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvB,CAAC;YACC,MAAM,IAAI,SAAS,CACf,gDAAgD,EAChD,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,OAAO;YACH,GAAG;YACH,IAAI,EAAE,MAAiC;SAC1C,CAAC;IACN,CAAC;IAEO,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;QAED,IACI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACvF,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../src/oauth2.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EACH,WAAW,EACX,kBAAkB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACH,kBAAkB,EAClB,SAAS,GAEZ,MAAM,MAAM,CAAC;AAUd,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;SACzC,QAAQ,EAAE;SACV,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,MAAM;IAIH,QAAQ;IACR,MAAM;IAJV,IAAI,CAAyC;IAErD,YACY,QAAkB,EAClB,MAAc;wBADd,QAAQ;sBACR,MAAM;QAEd,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,SAAkC;QACzD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAEpC,WAAW,CACP,kBAAkB,EAAE,EACpB,SAAS,IAAI,EAAE,EACf,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,WAAoC;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAE/C,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,WAAoC;QACjF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAE1C,OAAO,IAAI,CAAC,QAAQ,CAChB,MAAM,EACN,kBAAkB,EAAE,EACpB,WAAW,CACd,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,QAAQ,CAClB,MAAuB,EACvB,cAA2B,EAC3B,WAAoC;QAGpC,WAAW,CACP,cAAc,EACd,WAAW,IAAI,EAAE,EACjB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CACJ,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;QAEzE,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,IAAI,UAAU,KAAK,qBAAqB,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC3B,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EACvF,MAAM,CACT,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAErB,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,WAAW,EAAE,CAAC;QACtD,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;aAC1B,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,wCAAwC,EACxC,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,GAAW,CAAC;QAEhB,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,yCAAyC,EACzC,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,SAAS,CACf,8CAA8C,QAAQ,CAAC,MAAM,EAAE,EAC/D,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,IAAI,MAAe,CAAC;QAEpB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACf,0CAA0C,EAC1C,QAAQ,CAAC,MAAM,EACf,GAAG,EACH,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QAED,IACI,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACvB,CAAC;YACC,MAAM,IAAI,SAAS,CACf,gDAAgD,EAChD,QAAQ,CAAC,MAAM,EACf,GAAG,CACN,CAAC;QACN,CAAC;QAED,OAAO;YACH,GAAG;YACH,IAAI,EAAE,MAAiC;SAC1C,CAAC;IACN,CAAC;IAED,KAAK,CAAC,WAAW,CACb,OAAe,EACf,OAKC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEtC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IACI,OAAO,EAAE,KAAK,KAAK,SAAS;YAC5B,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EACvB,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAED,IACI,OAAO,EAAE,MAAM,KAAK,SAAS;YAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,EAC1D,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IACI,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAC3B,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CACjC,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAC/B,OAAO,EACP,IAAI,CAAC,IAAI,EACT;YACI,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,UAAU;YACV,cAAc,EAAE,CAAC;SACpB,CACJ,CAAC;QAEF,UAAU;QACV,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,OAAO,CAAC,GAAG,EACd,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,WAAW;QACX,MAAM,SAAS,GACX,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAEtB,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACzB,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,SAAS,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CACT,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,CAAC,QAAQ,CAChB,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ;YACpB,GAAG,CAAC,OAAO,EAAE,gBAAgB,IAAI,EAAE,CAAC;SACvC,CAAC,CAAC;QAEH,IACI,SAAS,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChD,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,aAAa;QACb,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAC/B,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,YAAY;QACZ,IACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;YAC7B,OAAO,CAAC,GAAG,GAAG,CAAC,EACjB,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACjE,CAAC;QAED,QAAQ;QACR,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IACI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;gBACjC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EACjC,CAAC;gBACC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;QAED,mBAAmB;QACnB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IACI,OAAO,CAAC,GAAG,KAAK,SAAS;YACzB,CACI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CACvC,EACH,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QAED,sBAAsB;QACtB,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,QAAQ,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9E,CAAC;YAED,IAAI,GAAG,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACnE,CAAC;QACL,CAAC;QAED,OAAO,OAAwB,CAAC;IACpC,CAAC;IAEO,QAAQ;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;QAED,IACI,IAAI,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EACvF,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;CACJ"}

package/dist/provider.d.ts

@@ -1,5 +1,7 @@
 export interface Provider {
-    authURL(): string;
-    tokenURL(): string;
+    authURL: string;
+    tokenURL: string;
+    issuerURL?: string;
+    jwksURL?: string;
 }
 //# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACrB,OAAO,IAAI,MAAM,CAAC;IAClB,QAAQ,IAAI,MAAM,CAAC;CACtB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o2js/core",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A minimal, provider-agnostic OAuth 2.0 client for Node.js.",
   "license": "MIT",
   "type": "module",
@@ -23,9 +23,16 @@
     "oauth",
     "oauth2",
     "oauth-2.0",
+    "openid",
+    "openid-connect",
+    "oidc",
+    "pkce",
+    "authorization-code",
+    "refresh-token",
     "authentication",
     "authorization",
     "node",
+    "nodejs",
     "typescript"
   ],
   "scripts": {
@@ -35,5 +42,8 @@
   "devDependencies": {
     "@types/node": "^26.6.6",
     "typescript": "^7.0.2"
+  },
+  "dependencies": {
+    "jose": "^6.2.15"
   }
-}
+}