@openid4vc/oauth2 0.3.0-alpha-20251029102217 → 0.3.0-alpha-20251030140425

package/dist/index.mjs

@@ -164,6 +164,7 @@ const zJwtPayload = z$1.object({
 	nbf: zInteger.optional(),
 	nonce: z$1.string().optional(),
 	jti: z$1.string().optional(),
+	sub: z$1.string().optional(),
 	cnf: zJwtConfirmationPayload.optional(),
 	status: z$1.record(z$1.string(), z$1.any()).optional(),
 	trust_chain: z$1.tuple([z$1.string()], z$1.string()).optional()
@@ -843,6 +844,91 @@ var Oauth2ResourceUnauthorizedError = class Oauth2ResourceUnauthorizedError exte
 	}
 };
 
+//#endregion
+//#region src/id-token/z-id-token-jwt.ts
+const zIdTokenJwtHeader = z$1.object({ ...zJwtHeader.shape }).loose();
+const zIdTokenJwtPayload = z$1.object({
+	...zJwtPayload.shape,
+	iss: z$1.string(),
+	sub: z$1.string(),
+	aud: z$1.string(),
+	exp: zInteger,
+	iat: zInteger,
+	auth_time: zInteger.optional(),
+	acr: z$1.string().optional(),
+	amr: z$1.array(z$1.string()).optional(),
+	azp: z$1.string().optional(),
+	name: z$1.string().optional(),
+	given_name: z$1.string().optional(),
+	family_name: z$1.string().optional(),
+	middle_name: z$1.string().optional(),
+	nickname: z$1.string().optional(),
+	preferred_username: z$1.string().optional(),
+	profile: z$1.url().optional(),
+	picture: z$1.url().optional(),
+	website: z$1.url().optional(),
+	email: z$1.email().optional(),
+	email_verified: z$1.boolean().optional(),
+	gender: z$1.enum(["male", "female"]).or(z$1.string()).optional(),
+	birthdate: z$1.iso.date().optional(),
+	zoneinfo: z$1.string().optional(),
+	locale: z$1.string().optional(),
+	phone_number: z$1.string().optional(),
+	phone_number_verified: z$1.boolean().optional(),
+	address: z$1.object({
+		formatted: z$1.string().optional(),
+		street_address: z$1.string().optional(),
+		locality: z$1.string().optional(),
+		region: z$1.string().optional(),
+		postal_code: z$1.string().optional(),
+		country: z$1.string().optional()
+	}).loose().optional(),
+	updated_at: zInteger.optional()
+}).loose();
+
+//#endregion
+//#region src/id-token/verify-id-token.ts
+/**
+* Verify an ID Token JWT.
+*/
+async function verifyJwtIdToken(options) {
+	const { header, payload } = decodeJwt({
+		jwt: options.idToken,
+		headerSchema: zIdTokenJwtHeader,
+		payloadSchema: zIdTokenJwtPayload
+	});
+	const jwksUrl = options.authorizationServer.jwks_uri;
+	if (!jwksUrl) throw new Oauth2Error(`Authorization server '${options.authorizationServer.issuer}' does not have a 'jwks_uri' parameter to fetch JWKs.`);
+	if (payload.iss !== options.authorizationServer.issuer) throw new Oauth2Error(`Invalid 'iss' claim in id token jwt. Expected '${options.authorizationServer.issuer}', got '${payload.iss}'.`);
+	if (payload.azp && payload.azp !== options.clientId) throw new Oauth2Error(`Invalid 'azp' claim in id token jwt. Expected '${options.clientId}', got '${payload.azp}'.`);
+	const jwks = await fetchJwks(jwksUrl, options.callbacks.fetch);
+	const publicJwk = extractJwkFromJwksForJwt({
+		kid: header.kid,
+		jwks,
+		use: "sig"
+	});
+	await verifyJwt({
+		compact: options.idToken,
+		header,
+		payload,
+		signer: {
+			method: "jwk",
+			publicJwk,
+			alg: header.alg
+		},
+		verifyJwtCallback: options.callbacks.verifyJwt,
+		errorMessage: "Error during verification of id token jwt.",
+		now: options.now,
+		expectedAudience: options.clientId,
+		expectedIssuer: options.authorizationServer.issuer,
+		expectedNonce: options.expectedNonce
+	});
+	return {
+		header,
+		payload
+	};
+}
+
 //#endregion
 //#region src/metadata/fetch-well-known-metadata.ts
 /**
@@ -2257,7 +2343,8 @@ var Oauth2Client = class {
 			scope: options.scope,
 			callbacks: this.options.callbacks,
 			pkceCodeVerifier: options.pkceCodeVerifier,
-			dpop: options.dpop
+			dpop: options.dpop,
+			state: options.state
 		});
 	}
 	async retrievePreAuthorizedCodeAccessToken({ authorizationServerMetadata, preAuthorizedCode, additionalRequestPayload, txCode, dpop, resource }) {
@@ -2455,5 +2542,5 @@ async function verifyResourceRequest(options) {
 }
 
 //#endregion
-export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
+export { HashAlgorithm, InvalidFetchResponseError, Oauth2AuthorizationServer, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, Oauth2Error, Oauth2ErrorCodes, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, PkceCodeChallengeMethod, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, VerifiedClientAttestationJwt, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwtHeaderFromJwtSigner, jwtSignerFromJwt, preAuthorizedCodeGrantIdentifier, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, verifyClientAttestationJwt, verifyJwt, verifyJwtIdToken, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zRefreshTokenGrantIdentifier };
 //# sourceMappingURL=index.mjs.map