@oauth42/next 0.5.0 → 0.5.1

package/dist/index.mjs

@@ -1,14 +1,102 @@
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+
+// src/server/client-assertion.ts
+import { createHash, createPublicKey, generateKeyPairSync, randomBytes, sign } from "crypto";
+var _key, _public;
+var _OAuth42ClientAssertion = class _OAuth42ClientAssertion {
+  constructor(kid, key) {
+    __privateAdd(this, _key);
+    __privateAdd(this, _public);
+    if (typeof kid !== "string" || !/^[\x21-\x7e]{1,128}$/.test(kid)) throw new Error("Invalid client signing key ID");
+    if (key.type !== "private" || key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+      throw new Error("Client assertions require a private P-256 key");
+    }
+    __privateSet(this, _key, key);
+    this.kid = kid;
+    const publicKey = createPublicKey(key).export({ format: "jwk" });
+    __privateSet(this, _public, { crv: "P-256", kty: "EC", x: publicKey.x, y: publicKey.y });
+    this.thumbprint = createHash("sha256").update(JSON.stringify(__privateGet(this, _public))).digest("base64url");
+  }
+  static generate(kid) {
+    return new _OAuth42ClientAssertion(kid, generateKeyPairSync("ec", { namedCurve: "prime256v1" }).privateKey);
+  }
+  get publicJwk() {
+    return { ...__privateGet(this, _public), kid: this.kid };
+  }
+  /** Private keys for the server-only NextAuth/openid-client configuration, never registration. */
+  get oidcJwks() {
+    return { keys: [{
+      kty: "EC",
+      crv: "P-256",
+      x: __privateGet(this, _public).x,
+      y: __privateGet(this, _public).y,
+      d: __privateGet(this, _key).export({ format: "jwk" }).d,
+      kid: this.kid
+    }] };
+  }
+  static validateEndpoint(target) {
+    const url = new URL(target);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.hash || url.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+      throw new Error("Client authentication requires HTTPS outside loopback development");
+    }
+  }
+  assertion(clientId, audience) {
+    _OAuth42ClientAssertion.validateEndpoint(audience);
+    if (!clientId || Buffer.byteLength(clientId) > 256) throw new Error("Invalid client identity");
+    const now = Math.floor(Date.now() / 1e3);
+    const header = { alg: "ES256", typ: "JWT", kid: this.kid };
+    const payload = { iss: clientId, sub: clientId, aud: audience, iat: now, exp: now + 60, jti: randomBytes(32).toString("base64url") };
+    const data = `${Buffer.from(JSON.stringify(header)).toString("base64url")}.${Buffer.from(JSON.stringify(payload)).toString("base64url")}`;
+    return `${data}.${sign("sha256", Buffer.from(data), { key: __privateGet(this, _key), dsaEncoding: "ieee-p1363" }).toString("base64url")}`;
+  }
+  async fetch(clientId, target, init, dpop) {
+    if (init.method?.toUpperCase() !== "POST" || !(typeof init.body === "string" || init.body instanceof URLSearchParams)) {
+      throw new Error("Client assertions require a form POST");
+    }
+    const prepare = () => {
+      const body = new URLSearchParams(init.body);
+      body.delete("client_secret");
+      body.set("client_id", clientId);
+      body.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      body.set("client_assertion", this.assertion(clientId, target));
+      const headers = new Headers(init.headers);
+      headers.delete("Authorization");
+      headers.delete("Content-Length");
+      headers.delete("Transfer-Encoding");
+      headers.set("Content-Type", "application/x-www-form-urlencoded");
+      return { ...init, body, headers, redirect: "error", cache: "no-store", signal: init.signal || AbortSignal.timeout(3e4) };
+    };
+    return dpop ? dpop.fetch(target, init, void 0, prepare) : fetch(target, prepare());
+  }
+};
+_key = new WeakMap();
+_public = new WeakMap();
+var OAuth42ClientAssertion = _OAuth42ClientAssertion;
+
 // src/provider.ts
 function OAuth42Provider(options) {
   const issuer = options.issuer || process.env.OAUTH42_ISSUER || "https://api.oauth42.com";
   const baseUrl = issuer.replace(/\/$/, "");
+  const { dpop, clientAssertionKey, ...providerOptions } = options;
+  if (clientAssertionKey) {
+    OAuth42ClientAssertion.validateEndpoint(`${baseUrl}/oauth2/token`);
+    providerOptions.clientSecret = void 0;
+  }
+  if (options.pkceEnabled === false) throw new Error("OAuth42 requires S256 PKCE");
   return {
     id: "oauth42",
     name: "OAuth42",
     type: "oauth",
     version: "2.0",
-    // Use OIDC discovery to automatically find endpoints
-    wellKnown: `${baseUrl}/.well-known/openid-configuration`,
+    // Pin O42 metadata: NextAuth v4 discovery does not compare the returned issuer.
+    // Constructing its OIDC client from these trusted endpoints preserves issuer binding.
+    jwks_endpoint: `${baseUrl}/.well-known/jwks.json`,
     // Use ID token for user profile (standard OIDC pattern)
     // This avoids an extra HTTP call to /userinfo on every auth flow
     // Apps can call /userinfo separately when they need extended claims (groups, company_id, etc.)
@@ -21,17 +109,26 @@ function OAuth42Provider(options) {
         response_type: "code"
       }
     },
-    token: `${baseUrl}/oauth2/token`,
+    token: dpop ? {
+      url: `${baseUrl}/oauth2/token`,
+      async request({ client, provider, params, checks }) {
+        const tokens = await client.callback(provider.callbackUrl, params, checks, { DPoP: dpop.oidcKey });
+        dpop.assertTokenResponse(tokens);
+        return { tokens };
+      }
+    } : `${baseUrl}/oauth2/token`,
     userinfo: `${baseUrl}/oauth2/userinfo`,
+    ...clientAssertionKey ? { jwks: clientAssertionKey.oidcJwks } : {},
     client: {
       id: options.clientId,
-      secret: options.clientSecret,
-      token_endpoint_auth_method: "client_secret_post",
+      secret: clientAssertionKey ? void 0 : options.clientSecret,
+      token_endpoint_auth_method: clientAssertionKey ? "private_key_jwt" : "client_secret_post",
+      ...clientAssertionKey ? { token_endpoint_auth_signing_alg: "ES256" } : {},
       id_token_signed_response_alg: "RS256"
       // OAuth42 uses RS256 for ID tokens
     },
-    issuer: baseUrl,
-    checks: options.pkceEnabled !== false ? ["pkce", "state"] : ["state"],
+    issuer,
+    checks: ["pkce", "state", "nonce"],
     profile(profile, tokens) {
       return {
         id: profile.sub || profile.id || profile.email,
@@ -47,45 +144,127 @@ function OAuth42Provider(options) {
       bg: "#1e40af",
       text: "#ffffff"
     },
-    options
+    // NextAuth v4 types require a string even when private_key_jwt sends no secret.
+    options: { ...providerOptions, clientSecret: providerOptions.clientSecret || "" }
+  };
+}
+
+// src/server/par.ts
+async function pushAuthorizationURL(value, config) {
+  const base = config.issuer.replace(/\/$/, "");
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return value;
+  }
+  if (`${url.origin}${url.pathname}` !== `${base}/oauth2/authorize`) return value;
+  if (url.username || url.password || url.hash) throw new Error("Invalid authorization endpoint");
+  const body = new URLSearchParams(url.search);
+  if (body.getAll("client_id").length !== 1 || body.get("client_id") !== config.clientId || body.get("response_type") !== "code" || !body.get("state") || !body.get("nonce") || body.get("code_challenge_method") !== "S256" || !/^[A-Za-z0-9_-]{43}$/.test(body.get("code_challenge") || "") || ["request_uri", "client_secret", "client_assertion", "client_assertion_type"].some((k) => body.has(k))) {
+    throw new Error("Invalid PAR authorization transaction");
+  }
+  const target = `${base}/oauth2/par`;
+  OAuth42ClientAssertion.validateEndpoint(target);
+  if (!config.clientAssertionKey) body.set("client_secret", config.clientSecret || "");
+  const init = {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+    redirect: "error",
+    cache: "no-store",
+    signal: AbortSignal.timeout(3e4)
+  };
+  const response = config.clientAssertionKey ? await config.clientAssertionKey.fetch(config.clientId, target, init, config.dpop) : config.dpop ? await config.dpop.fetch(target, init) : await fetch(target, init);
+  if (response.status !== 201) throw new Error("Pushed authorization failed");
+  const pushed = await response.json();
+  if (typeof pushed.request_uri !== "string" || !/^urn:ietf:params:oauth:request_uri:[A-Za-z0-9_-]{43}$/.test(pushed.request_uri) || !Number.isInteger(pushed.expires_in) || pushed.expires_in <= 0 || pushed.expires_in > 600) throw new Error("Invalid PAR response");
+  url.search = new URLSearchParams({ client_id: config.clientId, request_uri: pushed.request_uri }).toString();
+  return url.href;
+}
+function withPushedAuthorization(handler, config) {
+  return async (request, context) => {
+    if (!(request instanceof Request)) throw new Error("PAR handlers require Next.js App Router Request/Response");
+    const response = await handler(request, context);
+    const location = response.headers.get("Location");
+    if (location) {
+      const next = await pushAuthorizationURL(location, config);
+      if (next === location) return response;
+      const headers = new Headers(response.headers);
+      headers.set("Location", next);
+      headers.delete("content-length");
+      return new Response(response.body, { status: response.status, headers });
+    }
+    if (response.headers.get("content-type")?.includes("application/json")) {
+      const body = await response.clone().json();
+      if (typeof body?.url === "string") {
+        const next = await pushAuthorizationURL(body.url, config);
+        if (next !== body.url) {
+          const headers = new Headers(response.headers);
+          headers.delete("content-length");
+          return new Response(JSON.stringify({ ...body, url: next }), { status: response.status, headers });
+        }
+      }
+    }
+    return response;
   };
 }
 
+// src/server/verified-userinfo.ts
+async function verifiedUserInfo(issuer, accessToken, subject, dpop) {
+  if (typeof accessToken !== "string" || !accessToken || typeof subject !== "string" || !subject) return null;
+  try {
+    const target = `${issuer.replace(/\/$/, "")}/oauth2/userinfo`;
+    const fetcher = dpop ? (url, init) => dpop.fetch(url, init, accessToken) : fetch;
+    const response = await fetcher(target, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (!response.ok) return null;
+    const user = await response.json();
+    return parseVerifiedUserInfo(user, subject);
+  } catch {
+    return null;
+  }
+}
+function parseVerifiedUserInfo(value, subject) {
+  if (typeof subject !== "string" || !subject || !value || typeof value !== "object" || Array.isArray(value)) return null;
+  const user = value;
+  if (user.sub !== subject) return null;
+  if (user.groups !== void 0 && (!Array.isArray(user.groups) || user.groups.some((group) => typeof group !== "string"))) return null;
+  if (user.email !== void 0 && typeof user.email !== "string") return null;
+  if (user.email_verified !== void 0 && typeof user.email_verified !== "boolean") return null;
+  const profile = { sub: user.sub };
+  for (const field of ["email", "name", "preferred_username", "username", "given_name", "family_name", "company_id", "company_name"]) {
+    if (user[field] != null) {
+      if (typeof user[field] !== "string") return null;
+      profile[field] = user[field];
+    }
+  }
+  if (user.email_verified !== void 0) profile.email_verified = user.email_verified;
+  if (user.groups !== void 0) profile.groups = user.groups;
+  return profile;
+}
+async function verifiedBackendSessionUserInfo(issuer, session, subject, dpop) {
+  if (typeof session.access_token !== "string" || !session.access_token) return null;
+  if (Object.prototype.hasOwnProperty.call(session, "user_info")) {
+    return parseVerifiedUserInfo(session.user_info, subject);
+  }
+  return verifiedUserInfo(issuer, session.access_token, subject, dpop);
+}
+
 // src/server/auth.ts
 import NextAuthDefault from "next-auth";
 
 // src/server/session.ts
 import { getServerSession as getNextAuthSession } from "next-auth";
-import { headers } from "next/headers";
-var REFRESHED_TOKEN_HEADER = "x-oauth42-refreshed-token";
 async function getOAuth42Session(...args) {
   const session = await getNextAuthSession(...args);
-  if (!session) {
+  if (!session || session.error) {
     return null;
   }
-  let refreshedToken = null;
-  try {
-    if (args.length === 1) {
-      const headersList = await headers();
-      refreshedToken = headersList.get(REFRESHED_TOKEN_HEADER);
-    } else if (args.length === 3) {
-      const req = args[0];
-      refreshedToken = req.headers[REFRESHED_TOKEN_HEADER] || null;
-    }
-  } catch {
-  }
-  if (refreshedToken) {
-    const sessionToken = session.accessToken;
-    console.log("[OAuth42 Session] Using refreshed token from middleware:", {
-      refreshedPrefix: refreshedToken.substring(0, 20),
-      sessionPrefix: sessionToken?.substring(0, 20),
-      tokensMatch: refreshedToken === sessionToken
-    });
-    return {
-      ...session,
-      accessToken: refreshedToken
-    };
-  }
   return session;
 }
 function withOAuth42Session(handler, authOptions) {
@@ -123,66 +302,59 @@ function isBackendSessionMode(mode) {
 function sessionEndpoint(issuer) {
   return `${issuer.replace(/\/$/, "")}/api/sdk/sessions`;
 }
-async function createBackendSession(params) {
-  const response = await fetch(sessionEndpoint(params.issuer), {
-    method: "POST",
+async function sessionFetch(params, target, body, credential, method = "POST") {
+  OAuth42ClientAssertion.validateEndpoint(target);
+  const prepare = () => ({
+    method,
+    redirect: "error",
+    cache: "no-store",
+    signal: AbortSignal.timeout(3e4),
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
-      access_token: params.accessToken,
-      refresh_token: params.refreshToken,
-      expires_at: params.expiresAt ?? Math.floor(Date.now() / 1e3) + 3600,
-      id_token: params.idToken,
+      ...body,
       client_id: params.clientId,
-      client_secret: params.clientSecret,
-      issuer: params.issuer,
-      user: params.user
+      ...params.clientAssertionKey ? {
+        client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+        client_assertion: params.clientAssertionKey.assertion(params.clientId, target)
+      } : { client_secret: params.clientSecret }
     })
   });
-  if (!response.ok) {
-    throw new Error(`OAuth42 backend session create failed: ${response.status}`);
-  }
-  return response.json();
+  return params.dpop ? params.dpop.fetch(target, {}, credential, prepare) : fetch(target, prepare());
+}
+async function sessionResponse(response, params) {
+  if (!response.ok) throw new Error(`OAuth42 backend session request failed: ${response.status}`);
+  const session = await response.json();
+  if (params.dpop) params.dpop.assertTokenResponse(session);
+  else if (session.token_type?.toLowerCase() === "dpop") throw new Error("Backend session requires its retained proof key");
+  return session;
+}
+async function createBackendSession(params) {
+  return sessionResponse(await sessionFetch(params, sessionEndpoint(params.issuer), {
+    access_token: params.accessToken,
+    refresh_token: params.refreshToken,
+    id_token: params.idToken,
+    user: params.user
+  }, params.accessToken), params);
 }
 async function resolveBackendSession(params) {
-  const response = await fetch(`${sessionEndpoint(params.issuer)}/resolve`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      session_id: params.sessionId,
-      client_id: params.clientId,
-      client_secret: params.clientSecret,
-      issuer: params.issuer
-    })
-  });
-  if (response.status === 401 || response.status === 403 || response.status === 404) {
-    return null;
-  }
-  if (!response.ok) {
-    throw new Error(`OAuth42 backend session resolve failed: ${response.status}`);
-  }
-  return response.json();
+  const response = await sessionFetch(params, `${sessionEndpoint(params.issuer)}/resolve`, { session_id: params.sessionId }, params.sessionId);
+  if ([401, 403, 404].includes(response.status)) return null;
+  return sessionResponse(response, params);
 }
 async function revokeBackendSession(params) {
-  await fetch(sessionEndpoint(params.issuer), {
-    method: "DELETE",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      session_id: params.sessionId,
-      client_id: params.clientId,
-      client_secret: params.clientSecret
-    })
-  });
+  const response = await sessionFetch(params, sessionEndpoint(params.issuer), { session_id: params.sessionId }, params.sessionId, "DELETE");
+  if (!response.ok) throw new Error(`OAuth42 backend session revoke failed: ${response.status}`);
 }
 
 // src/server/auth.ts
 var NextAuth = NextAuthDefault.default || NextAuthDefault;
-var activeRefresh = null;
+var activeRefreshes = /* @__PURE__ */ new Map();
 function createAuth(options = {}) {
   const clientId = options.clientId || process.env.OAUTH42_CLIENT_ID;
-  const clientSecret = options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;
+  const clientSecret = options.clientAssertionKey ? "" : options.clientSecret || process.env.OAUTH42_CLIENT_SECRET;
   const issuer = options.issuer || process.env.NEXT_PUBLIC_OAUTH_ISSUER || process.env.OAUTH42_ISSUER || "https://localhost:8443";
   const useBackendSessions = isBackendSessionMode(options.sessionStore);
-  if (!clientId || !clientSecret) {
+  if (!clientId || !clientSecret && !options.clientAssertionKey) {
     throw new Error(
       "OAuth42 client credentials are required. Set OAUTH42_CLIENT_ID and OAUTH42_CLIENT_SECRET environment variables or pass them in the options."
     );
@@ -191,14 +363,17 @@ function createAuth(options = {}) {
     providers: [
       OAuth42Provider({
         clientId,
-        clientSecret,
+        clientSecret: clientSecret || "",
         issuer,
         scopes: options.scopes,
-        pkceEnabled: options.pkceEnabled
+        pkceEnabled: options.pkceEnabled,
+        dpop: options.dpop,
+        clientAssertionKey: options.clientAssertionKey
       })
     ],
     callbacks: {
       async jwt({ token, account, profile }) {
+        if (options.clientAssertionKey) delete token.clientSecret;
         console.log("[OAuth42 SDK] JWT callback called", { hasAccount: !!account, hasProfile: !!profile });
         if (account) {
           if (useBackendSessions) {
@@ -207,9 +382,11 @@ function createAuth(options = {}) {
             }
             const oauth42Profile = profile;
             const backendSession = await createBackendSession({
+              dpop: options.dpop,
+              clientAssertionKey: options.clientAssertionKey,
               issuer,
               clientId,
-              clientSecret,
+              clientSecret: clientSecret || "",
               accessToken: account.access_token,
               refreshToken: account.refresh_token,
               expiresAt: account.expires_at,
@@ -233,7 +410,8 @@ function createAuth(options = {}) {
             token.expiresAt = account.expires_at;
             token.idToken = account.id_token;
             token.clientId = clientId;
-            token.clientSecret = clientSecret;
+            if (options.clientAssertionKey) delete token.clientSecret;
+            else token.clientSecret = clientSecret;
             token.issuer = issuer;
           }
         }
@@ -252,25 +430,36 @@ function createAuth(options = {}) {
       },
       async session({ session, token }) {
         console.log("[OAuth42 SDK] Session callback called", { hasToken: !!token, hasSession: !!session });
+        const revokedSession = () => {
+          session.error = "SessionRevoked";
+          delete session.accessToken;
+          delete session.idToken;
+          delete session.userInfo;
+          delete session.user;
+          return session;
+        };
+        if (token.error) return revokedSession();
+        let verified;
         if (useBackendSessions) {
           const sessionId = token.oauth42SessionId;
           if (!sessionId) {
-            session.error = "SessionRevoked";
-            return session;
+            return revokedSession();
           }
           const backendSession = await resolveBackendSession({
+            dpop: options.dpop,
+            clientAssertionKey: options.clientAssertionKey,
             issuer,
             clientId,
-            clientSecret,
+            clientSecret: clientSecret || "",
             sessionId
           });
           if (!backendSession) {
-            session.error = "SessionRevoked";
-            return session;
+            return revokedSession();
           }
           session.accessToken = backendSession.access_token;
           session.idToken = backendSession.id_token;
           token.expiresAt = backendSession.expires_at;
+          verified = await verifiedBackendSessionUserInfo(issuer, backendSession, token.sub, options.dpop);
           if (backendSession.user && session.user) {
             session.user.email = backendSession.user.email;
             session.user.name = backendSession.user.name;
@@ -281,6 +470,23 @@ function createAuth(options = {}) {
         } else {
           session.accessToken = token.accessToken;
           session.idToken = token.idToken;
+          verified = await verifiedUserInfo(issuer, session.accessToken, token.sub, options.dpop);
+        }
+        if (!verified) {
+          return revokedSession();
+        }
+        session.userInfo = verified;
+        token.email = verified.email;
+        token.name = verified.name;
+        token.username = verified.preferred_username ?? verified.username;
+        token.emailVerified = verified.email_verified;
+        token.groups = verified.groups ?? [];
+        if (session.user) {
+          session.user.email = verified.email;
+          session.user.name = verified.name;
+          session.user.username = verified.preferred_username ?? verified.username;
+          session.user.emailVerified = verified.email_verified;
+          session.user.groups = verified.groups ?? [];
         }
         if (token.error) {
           session.error = token.error;
@@ -315,9 +521,11 @@ function createAuth(options = {}) {
           const sessionId = message.token?.oauth42SessionId;
           if (sessionId) {
             await revokeBackendSession({
+              dpop: options.dpop,
+              clientAssertionKey: options.clientAssertionKey,
               issuer,
               clientId,
-              clientSecret,
+              clientSecret: clientSecret || "",
               sessionId
             }).catch((error) => {
               console.warn("[OAuth42 SDK] Failed to revoke backend session on signOut:", error);
@@ -404,31 +612,48 @@ function createAuth(options = {}) {
       }
     }
   };
-  const handler = NextAuth(authOptions);
+  const nextAuthHandler = NextAuth(authOptions);
+  const handler = options.pushedAuthorization ? withPushedAuthorization(nextAuthHandler, { issuer, clientId, clientSecret, dpop: options.dpop, clientAssertionKey: options.clientAssertionKey }) : nextAuthHandler;
   return {
     auth: authOptions,
     handlers: { GET: handler, POST: handler }
   };
 }
 var getServerSession = getOAuth42Session;
-async function refreshAccessToken(token, clientId, clientSecret, issuer) {
-  if (activeRefresh) {
-    console.log("[OAuth42] Refresh already in progress, waiting...");
-    return await activeRefresh;
+async function refreshAccessToken(token, clientId, clientSecret, issuer, dpop, clientAssertionKey) {
+  if (typeof token.refreshToken !== "string" || !token.refreshToken) {
+    return { ...token, error: "RefreshAccessTokenError" };
+  }
+  const key = JSON.stringify([issuer || process.env.OAUTH42_ISSUER || "https://api.oauth42.com", clientId, clientSecret, token.sub, token.refreshToken, dpop?.thumbprint, clientAssertionKey?.thumbprint, clientAssertionKey?.kid]);
+  let refresh = activeRefreshes.get(key);
+  if (!refresh) {
+    refresh = doRefresh(token, clientId, clientSecret, issuer, dpop, clientAssertionKey);
+    activeRefreshes.set(key, refresh);
   }
-  activeRefresh = doRefresh(token, clientId, clientSecret, issuer);
   try {
-    return await activeRefresh;
+    const result = await refresh;
+    const updated = {
+      ...token,
+      accessToken: result.accessToken,
+      refreshToken: result.refreshToken,
+      expiresAt: result.expiresAt,
+      error: result.error
+    };
+    if (clientAssertionKey) delete updated.clientSecret;
+    return updated;
   } finally {
-    activeRefresh = null;
+    if (activeRefreshes.get(key) === refresh) activeRefreshes.delete(key);
   }
 }
-async function doRefresh(token, clientId, clientSecret, issuer) {
+async function doRefresh(token, clientId, clientSecret, issuer, dpop, clientAssertionKey) {
   try {
     const baseUrl = issuer || process.env.OAUTH42_ISSUER || "https://api.oauth42.com";
     const tokenUrl = `${baseUrl}/oauth2/token`;
     const fetchOptions = {
       method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(3e4),
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
@@ -439,17 +664,12 @@ async function doRefresh(token, clientId, clientSecret, issuer) {
         client_secret: clientSecret
       })
     };
-    if (process.env.NODE_ENV !== "production" && tokenUrl.startsWith("https://")) {
-      const https = await import("https");
-      fetchOptions.agent = new https.Agent({
-        rejectUnauthorized: false
-      });
-    }
-    const response = await fetch(tokenUrl, fetchOptions);
+    const response = clientAssertionKey ? await clientAssertionKey.fetch(clientId, tokenUrl, fetchOptions, dpop) : dpop ? await dpop.fetch(tokenUrl, fetchOptions) : await fetch(tokenUrl, fetchOptions);
     const refreshedTokens = await response.json();
     if (!response.ok) {
       throw refreshedTokens;
     }
+    dpop?.assertTokenResponse(refreshedTokens);
     console.log("[OAuth42] Token refreshed successfully");
     return {
       ...token,
@@ -461,7 +681,7 @@ async function doRefresh(token, clientId, clientSecret, issuer) {
       error: void 0
     };
   } catch (error) {
-    console.error("[OAuth42] Failed to refresh access token:", error);
+    console.error("[OAuth42] Failed to refresh access token");
     return {
       ...token,
       error: "RefreshAccessTokenError"
@@ -475,14 +695,20 @@ import { getToken, encode } from "next-auth/jwt";
 var ALLOWED_COOKIE_SIZE = 4096;
 var ESTIMATED_EMPTY_COOKIE_SIZE = 163;
 var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
-var REFRESH_RACE_GRACE_SECONDS = 60;
 var DEFAULT_SESSION_MAX_AGE_SECONDS = 365 * 24 * 60 * 60;
 var pendingRefreshes = /* @__PURE__ */ new Map();
-function shouldPreserveSessionOnRefreshFailure(params) {
-  if (params.error !== "invalid_grant" || !params.expiresAt) {
-    return false;
+function forwardedHeaders(req, cookieName, jwt) {
+  const headers = new Headers(req.headers);
+  headers.delete("x-oauth42-refreshed-token");
+  if (cookieName && jwt) {
+    const cookies = req.cookies.getAll().filter((cookie) => cookie.name !== cookieName && !cookie.name.startsWith(`${cookieName}.`));
+    if (jwt.length <= CHUNK_SIZE) cookies.push({ name: cookieName, value: jwt });
+    else for (let i = 0; i * CHUNK_SIZE < jwt.length; i++) {
+      cookies.push({ name: `${cookieName}.${i}`, value: jwt.slice(i * CHUNK_SIZE, (i + 1) * CHUNK_SIZE) });
+    }
+    headers.set("cookie", cookies.map((cookie) => `${encodeURIComponent(cookie.name)}=${encodeURIComponent(cookie.value)}`).join("; "));
   }
-  return params.now - params.expiresAt <= REFRESH_RACE_GRACE_SECONDS;
+  return headers;
 }
 function resolveRefreshConfig(options, token) {
   return {
@@ -491,11 +717,15 @@ function resolveRefreshConfig(options, token) {
     issuer: options.issuer || token.issuer || process.env.OAUTH42_ISSUER || "https://localhost:8443"
   };
 }
-async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
+async function refreshTokens(refreshToken, clientId, clientSecret, issuer, dpop, clientAssertionKey) {
   try {
     const tokenUrl = `${issuer}/oauth2/token`;
-    const response = await fetch(tokenUrl, {
+    const fetcher = clientAssertionKey ? (url, init) => clientAssertionKey.fetch(clientId, url, init, dpop) : dpop ? dpop.fetch.bind(dpop) : fetch;
+    const response = await fetcher(tokenUrl, {
       method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(3e4),
       headers: {
         "Content-Type": "application/x-www-form-urlencoded"
       },
@@ -508,9 +738,10 @@ async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
     });
     const data = await response.json();
     if (!response.ok) {
-      console.error("[OAuth42 Middleware] Token refresh failed:", data);
+      console.error("[OAuth42 Middleware] Token refresh failed:", response.status);
       return { success: false, error: data.error || "refresh_failed" };
     }
+    dpop?.assertTokenResponse(data);
     console.log("[OAuth42 Middleware] Token refreshed successfully");
     return {
       success: true,
@@ -519,14 +750,14 @@ async function refreshTokens(refreshToken, clientId, clientSecret, issuer) {
       expiresAt: Math.floor(Date.now() / 1e3) + (data.expires_in || 3600)
     };
   } catch (error) {
-    console.error("[OAuth42 Middleware] Token refresh error:", error);
+    console.error("[OAuth42 Middleware] Token refresh request failed");
     return { success: false, error: "refresh_error" };
   }
 }
 function withOAuth42Auth(options = {}) {
   const secret = process.env.NEXTAUTH_SECRET;
   if (!secret) {
-    console.warn("[OAuth42 Middleware] NEXTAUTH_SECRET not set");
+    throw new Error("NEXTAUTH_SECRET is required for OAuth42 middleware");
   }
   return async function middleware(req) {
     const cookieName = options.cookiePrefix ? `${options.cookiePrefix}.session-token` : "next-auth.session-token";
@@ -537,22 +768,41 @@ function withOAuth42Auth(options = {}) {
     });
     const pathname = req.nextUrl.pathname;
     if (options.publicPaths?.some((path) => pathname.startsWith(path))) {
-      return NextResponse.next();
+      return NextResponse.next({ request: { headers: forwardedHeaders(req) } });
     }
     const needsProtection = options.protectedPaths ? options.protectedPaths.some((path) => pathname.startsWith(path)) : true;
     if (!needsProtection) {
-      return NextResponse.next();
+      return NextResponse.next({ request: { headers: forwardedHeaders(req) } });
     }
-    if (!token) {
+    if (!token || token.error) {
       const signInUrl = options.pages?.signIn || "/auth/signin";
       const url = new URL(signInUrl, req.url);
       url.searchParams.set("callbackUrl", pathname);
       return NextResponse.redirect(url);
     }
     const refreshConfig = resolveRefreshConfig(options, token);
+    const denied = () => {
+      const url = new URL(options.pages?.signIn || "/auth/signin", req.url);
+      url.searchParams.set("callbackUrl", pathname);
+      const response = NextResponse.redirect(url);
+      for (const cookie of req.cookies.getAll()) {
+        if (cookie.name === cookieName || cookie.name.startsWith(`${cookieName}.`)) response.cookies.delete(cookie.name);
+      }
+      return response;
+    };
+    const verifyAndAuthorize = async (current, resolved) => {
+      const user = resolved === void 0 ? await verifiedUserInfo(refreshConfig.issuer, current.accessToken, token.sub, options.dpop) : resolved;
+      if (!user) return false;
+      current.groups = user.groups ?? [];
+      current.email = user.email;
+      current.name = user.name;
+      current.username = user.preferred_username ?? user.username;
+      current.emailVerified = user.email_verified;
+      return options.callbacks?.authorized ? options.callbacks.authorized({ token: current, req }) : true;
+    };
     if (isBackendSessionMode(options.sessionStore)) {
       const sessionId = token.oauth42SessionId;
-      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret) {
+      if (!sessionId || !refreshConfig.clientId || !refreshConfig.clientSecret && !options.clientAssertionKey) {
         const signInUrl = options.pages?.signIn || "/auth/signin";
         const url = new URL(signInUrl, req.url);
         url.searchParams.set("callbackUrl", pathname);
@@ -561,9 +811,11 @@ function withOAuth42Auth(options = {}) {
         return response;
       }
       const backendSession = await resolveBackendSession({
+        dpop: options.dpop,
+        clientAssertionKey: options.clientAssertionKey,
         issuer: refreshConfig.issuer,
         clientId: refreshConfig.clientId,
-        clientSecret: refreshConfig.clientSecret,
+        clientSecret: refreshConfig.clientSecret || "",
         sessionId
       }).catch((error) => {
         console.error("[OAuth42 Middleware] Backend session resolve failed:", error);
@@ -577,8 +829,9 @@ function withOAuth42Auth(options = {}) {
         response.cookies.delete(cookieName);
         return response;
       }
-      const requestHeaders = new Headers(req.headers);
-      requestHeaders.set("x-oauth42-refreshed-token", backendSession.access_token);
+      const verified = await verifiedBackendSessionUserInfo(refreshConfig.issuer, backendSession, token.sub, options.dpop);
+      if (!await verifyAndAuthorize({ ...token, accessToken: backendSession.access_token }, verified)) return denied();
+      const requestHeaders = forwardedHeaders(req);
       return NextResponse.next({
         request: {
           headers: requestHeaders
@@ -594,13 +847,12 @@ function withOAuth42Auth(options = {}) {
         expiresAt,
         now,
         expiredAgo: expiresAt ? now - expiresAt : "n/a",
-        accessTokenPrefix: token.accessToken?.substring(0, 20),
         path: pathname
       });
     }
-    if (needsRefresh && token.refreshToken && refreshConfig.clientId && refreshConfig.clientSecret) {
-      const userId = token.sub;
-      let refreshPromise = pendingRefreshes.get(userId);
+    if (needsRefresh && token.refreshToken && refreshConfig.clientId && (refreshConfig.clientSecret || options.clientAssertionKey)) {
+      const grantKey = JSON.stringify([refreshConfig.issuer, refreshConfig.clientId, refreshConfig.clientSecret, token.sub, token.refreshToken, options.dpop?.thumbprint, options.clientAssertionKey?.thumbprint, options.clientAssertionKey?.kid]);
+      let refreshPromise = pendingRefreshes.get(grantKey);
       if (refreshPromise) {
         console.log("[OAuth42 Middleware] Waiting for in-flight refresh...");
       } else {
@@ -608,15 +860,17 @@ function withOAuth42Auth(options = {}) {
         refreshPromise = refreshTokens(
           token.refreshToken,
           refreshConfig.clientId,
-          refreshConfig.clientSecret,
-          refreshConfig.issuer
+          refreshConfig.clientSecret || "",
+          refreshConfig.issuer,
+          options.dpop,
+          options.clientAssertionKey
         ).finally(() => {
-          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(userId), 3e4);
+          const cleanupTimer = setTimeout(() => pendingRefreshes.delete(grantKey), 3e4);
           if (typeof cleanupTimer === "object" && "unref" in cleanupTimer) {
             cleanupTimer.unref();
           }
         });
-        pendingRefreshes.set(userId, refreshPromise);
+        pendingRefreshes.set(grantKey, refreshPromise);
       }
       const refreshed = await refreshPromise;
       if (refreshed.success && refreshed.accessToken && refreshed.refreshToken) {
@@ -626,12 +880,13 @@ function withOAuth42Auth(options = {}) {
           refreshToken: refreshed.refreshToken,
           expiresAt: refreshed.expiresAt
         };
+        if (options.clientAssertionKey) delete updatedToken.clientSecret;
+        if (!await verifyAndAuthorize(updatedToken)) return denied();
         const newJwt = await encode({
           token: updatedToken,
           secret
         });
-        const requestHeaders = new Headers(req.headers);
-        requestHeaders.set("x-oauth42-refreshed-token", refreshed.accessToken);
+        const requestHeaders = forwardedHeaders(req, cookieName, newJwt);
         const response = NextResponse.next({
           request: {
             headers: requestHeaders
@@ -684,28 +939,11 @@ function withOAuth42Auth(options = {}) {
           chunked: newJwt.length > CHUNK_SIZE,
           existingBaseCooke: req.cookies.has(cookieName),
           existingChunks: existingChunks.length > 0 ? existingChunks : "none",
-          newAccessTokenPrefix: refreshed.accessToken?.substring(0, 20),
           newExpiresAt: refreshed.expiresAt,
           cookieName
         });
         return response;
       } else {
-        if (shouldPreserveSessionOnRefreshFailure({
-          error: refreshed.error,
-          expiresAt,
-          now
-        })) {
-          console.warn(
-            "[OAuth42 Middleware] Refresh failed with invalid_grant for a recently expired token; preserving session cookie for likely parallel refresh race",
-            {
-              expiresAt,
-              now,
-              expiredAgo: now - expiresAt,
-              path: pathname
-            }
-          );
-          return NextResponse.next();
-        }
         console.log("[OAuth42 Middleware] Refresh failed, clearing session");
         const signInUrl = options.pages?.signIn || "/auth/signin";
         const url = new URL(signInUrl, req.url);
@@ -723,16 +961,13 @@ function withOAuth42Auth(options = {}) {
         return response;
       }
     }
-    if (options.callbacks?.authorized) {
-      const isAuthorized = await options.callbacks.authorized({ token, req });
-      if (!isAuthorized) {
-        const signInUrl = options.pages?.signIn || "/auth/signin";
-        const url = new URL(signInUrl, req.url);
-        url.searchParams.set("callbackUrl", pathname);
-        return NextResponse.redirect(url);
-      }
+    if (!Number.isFinite(expiresAt) || now >= expiresAt || !token.accessToken) {
+      const url = new URL(options.pages?.signIn || "/auth/signin", req.url);
+      url.searchParams.set("callbackUrl", pathname);
+      return NextResponse.redirect(url);
     }
-    return NextResponse.next();
+    if (!await verifyAndAuthorize(token)) return denied();
+    return NextResponse.next({ request: { headers: forwardedHeaders(req) } });
   };
 }
 function createMiddlewareConfig(protectedPaths = ["/protected"], publicPaths = ["/auth", "/api/auth"]) {
@@ -751,15 +986,87 @@ function createMiddlewareConfig(protectedPaths = ["/protected"], publicPaths = [
     publicPaths
   };
 }
+
+// src/server/dpop.ts
+import { createHash as createHash2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2, randomBytes as randomBytes2, sign as sign2 } from "crypto";
+var OAuth42DPoP = class _OAuth42DPoP {
+  constructor(key) {
+    this.nonces = /* @__PURE__ */ new Map();
+    if (key.type !== "private" || key.asymmetricKeyType !== "ec" || key.asymmetricKeyDetails?.namedCurve !== "prime256v1") {
+      throw new Error("DPoP requires a private P-256 key");
+    }
+    this.key = key;
+    const publicKey = createPublicKey2(key).export({ format: "jwk" });
+    this.jwk = { crv: "P-256", kty: "EC", x: publicKey.x, y: publicKey.y };
+    this.thumbprint = createHash2("sha256").update(JSON.stringify(this.jwk)).digest("base64url");
+  }
+  /** Persist keys in protected server storage; regeneration cannot recover a public refresh grant. */
+  static generate() {
+    return new _OAuth42DPoP(generateKeyPairSync2("ec", { namedCurve: "prime256v1" }).privateKey);
+  }
+  /** Passed directly to openid-client so its callback keeps OIDC issuer/nonce/signature validation. */
+  get oidcKey() {
+    return this.key;
+  }
+  proof(method, target, nonce, accessToken) {
+    const url = new URL(target);
+    if (!["http:", "https:"].includes(url.protocol) || url.protocol !== "https:" && !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+      throw new Error("DPoP requires HTTPS outside loopback development");
+    }
+    if (url.username || url.password) throw new Error("DPoP endpoint must not contain credentials");
+    url.search = "";
+    url.hash = "";
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk: this.jwk };
+    const claims = {
+      htm: method.toUpperCase(),
+      htu: url.href,
+      iat: Math.floor(Date.now() / 1e3),
+      jti: randomBytes2(32).toString("base64url"),
+      ...nonce ? { nonce } : {},
+      ...accessToken !== void 0 ? { ath: createHash2("sha256").update(accessToken).digest("base64url") } : {}
+    };
+    const input = `${Buffer.from(JSON.stringify(header)).toString("base64url")}.${Buffer.from(JSON.stringify(claims)).toString("base64url")}`;
+    return `${input}.${sign2("sha256", Buffer.from(input), { key: this.key, dsaEncoding: "ieee-p1363" }).toString("base64url")}`;
+  }
+  assertTokenResponse(tokens) {
+    if (typeof tokens.token_type !== "string" || tokens.token_type.toLowerCase() !== "dpop") {
+      throw new Error("Server did not issue the requested DPoP-bound token");
+    }
+  }
+  async fetch(target, init = {}, accessToken, prepare) {
+    if (init.body instanceof ReadableStream) throw new Error("DPoP nonce retries require a replayable request body");
+    const cacheKey = `${new URL(target).origin}:${accessToken !== void 0 ? "resource" : "token"}`;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const request = prepare ? prepare() : init;
+      const headers = new Headers(request.headers);
+      headers.set("DPoP", this.proof(request.method || "GET", target, this.nonces.get(cacheKey), accessToken));
+      if (accessToken !== void 0) headers.set("Authorization", `DPoP ${accessToken}`);
+      const response = await fetch(target, { ...request, headers, redirect: "error", cache: "no-store", signal: request.signal || AbortSignal.timeout(3e4) });
+      const nonce = response.headers.get("DPoP-Nonce");
+      if (nonce && /^[\x21-\x7e]{1,128}$/.test(nonce)) {
+        if (this.nonces.size >= 256) this.nonces.clear();
+        this.nonces.set(cacheKey, nonce);
+      } else return response;
+      if (attempt || ![400, 401].includes(response.status)) return response;
+      const error = await response.clone().json().catch(() => null);
+      if (error?.error !== "use_dpop_nonce") return response;
+    }
+    throw new Error("DPoP nonce negotiation failed");
+  }
+};
 export {
+  OAuth42ClientAssertion,
+  OAuth42DPoP,
   OAuth42Provider,
   createAuth,
   createMiddlewareConfig,
   getOAuth42Session,
   getServerSession,
+  pushAuthorizationURL,
   refreshAccessToken,
   withOAuth42Auth,
   withOAuth42ServerSideProps,
-  withOAuth42Session
+  withOAuth42Session,
+  withPushedAuthorization
 };
 //# sourceMappingURL=index.mjs.map