@openid4vc/oauth2 0.3.1-alpha-20251124151046 → 0.4.0-alpha-20251127093634
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +2 -2
- package/package.json +4 -5
- package/dist/index.cjs +0 -3093
- package/dist/index.cjs.map +0 -1
- package/dist/index.d.cts +0 -3705
package/dist/index.d.cts
DELETED
|
@@ -1,3705 +0,0 @@
|
|
|
1
|
-
import { BaseSchema, ContentType, Fetch, FetchHeaders, FetchRequestInit, FetchResponse, HttpMethod, HttpMethod as HttpMethod$1, InvalidFetchResponseError, Oid4vcTsConfig, OrPromise, StringWithAutoCompletion, getGlobalConfig, setGlobalConfig } from "@openid4vc/utils";
|
|
2
|
-
import z$1, { z } from "zod";
|
|
3
|
-
|
|
4
|
-
//#region src/metadata/authorization-server/z-authorization-server-metadata.d.ts
|
|
5
|
-
declare const zAuthorizationServerMetadata: z$1.ZodObject<{
|
|
6
|
-
issuer: z$1.ZodURL;
|
|
7
|
-
token_endpoint: z$1.ZodURL;
|
|
8
|
-
token_endpoint_auth_methods_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodEnum<{
|
|
9
|
-
client_secret_basic: "client_secret_basic";
|
|
10
|
-
client_secret_post: "client_secret_post";
|
|
11
|
-
attest_jwt_client_auth: "attest_jwt_client_auth";
|
|
12
|
-
client_secret_jwt: "client_secret_jwt";
|
|
13
|
-
private_key_jwt: "private_key_jwt";
|
|
14
|
-
}>, z$1.ZodString]>>>;
|
|
15
|
-
authorization_endpoint: z$1.ZodOptional<z$1.ZodURL>;
|
|
16
|
-
jwks_uri: z$1.ZodOptional<z$1.ZodURL>;
|
|
17
|
-
grant_types_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
18
|
-
code_challenge_methods_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
19
|
-
dpop_signing_alg_values_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
20
|
-
require_pushed_authorization_requests: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
21
|
-
pushed_authorization_request_endpoint: z$1.ZodOptional<z$1.ZodURL>;
|
|
22
|
-
introspection_endpoint: z$1.ZodOptional<z$1.ZodURL>;
|
|
23
|
-
introspection_endpoint_auth_methods_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodUnion<readonly [z$1.ZodEnum<{
|
|
24
|
-
client_secret_basic: "client_secret_basic";
|
|
25
|
-
client_secret_post: "client_secret_post";
|
|
26
|
-
attest_jwt_client_auth: "attest_jwt_client_auth";
|
|
27
|
-
client_secret_jwt: "client_secret_jwt";
|
|
28
|
-
private_key_jwt: "private_key_jwt";
|
|
29
|
-
}>, z$1.ZodString]>>>;
|
|
30
|
-
introspection_endpoint_auth_signing_alg_values_supported: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
31
|
-
authorization_challenge_endpoint: z$1.ZodOptional<z$1.ZodURL>;
|
|
32
|
-
'pre-authorized_grant_anonymous_access_supported': z$1.ZodOptional<z$1.ZodBoolean>;
|
|
33
|
-
client_attestation_pop_nonce_required: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
34
|
-
}, z$1.core.$loose>;
|
|
35
|
-
type AuthorizationServerMetadata = z$1.infer<typeof zAuthorizationServerMetadata>;
|
|
36
|
-
//#endregion
|
|
37
|
-
//#region src/client-authentication.d.ts
|
|
38
|
-
declare enum SupportedClientAuthenticationMethod {
|
|
39
|
-
ClientSecretBasic = "client_secret_basic",
|
|
40
|
-
ClientSecretPost = "client_secret_post",
|
|
41
|
-
ClientAttestationJwt = "attest_jwt_client_auth",
|
|
42
|
-
None = "none",
|
|
43
|
-
}
|
|
44
|
-
interface ClientAuthenticationDynamicOptions {
|
|
45
|
-
clientId: string;
|
|
46
|
-
clientSecret: string;
|
|
47
|
-
}
|
|
48
|
-
/**
|
|
49
|
-
* Dynamicaly get the client authentication method based on endpoint type and authorization server.
|
|
50
|
-
* Only `client_secret_post`, `client_secret_basic`, and `none` supported.
|
|
51
|
-
*
|
|
52
|
-
* It also supports anonymous access to the token endpoint for pre-authorized code flow
|
|
53
|
-
* if the authorization server has enabled `pre-authorized_grant_anonymous_access_supported`
|
|
54
|
-
*/
|
|
55
|
-
declare function clientAuthenticationDynamic(options: ClientAuthenticationDynamicOptions): ClientAuthenticationCallback;
|
|
56
|
-
/**
|
|
57
|
-
* Options for client authentication
|
|
58
|
-
*/
|
|
59
|
-
interface ClientAuthenticationCallbackOptions {
|
|
60
|
-
/**
|
|
61
|
-
* Metadata of the authorization server
|
|
62
|
-
*/
|
|
63
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
64
|
-
/**
|
|
65
|
-
* URL to which the request will be made
|
|
66
|
-
*/
|
|
67
|
-
url: string;
|
|
68
|
-
/**
|
|
69
|
-
* http method that will be used
|
|
70
|
-
*/
|
|
71
|
-
method: HttpMethod$1;
|
|
72
|
-
/**
|
|
73
|
-
* Headers for the request. You can modify this object
|
|
74
|
-
*/
|
|
75
|
-
headers: FetchHeaders;
|
|
76
|
-
contentType: ContentType;
|
|
77
|
-
/**
|
|
78
|
-
* The body as a JSON object. If content type `x-www-form-urlencoded`
|
|
79
|
-
* is used, it will be encoded after this call.
|
|
80
|
-
*
|
|
81
|
-
* You can modify this object
|
|
82
|
-
*/
|
|
83
|
-
body: Record<string, unknown>;
|
|
84
|
-
}
|
|
85
|
-
/**
|
|
86
|
-
* Callback method to determine the client authentication for a request.
|
|
87
|
-
*/
|
|
88
|
-
type ClientAuthenticationCallback = (options: ClientAuthenticationCallbackOptions) => Promise<void> | void;
|
|
89
|
-
interface ClientAuthenticationClientSecretPostOptions {
|
|
90
|
-
clientId: string;
|
|
91
|
-
clientSecret: string;
|
|
92
|
-
}
|
|
93
|
-
/**
|
|
94
|
-
* Client authentication using `client_secret_post` option
|
|
95
|
-
*/
|
|
96
|
-
declare function clientAuthenticationClientSecretPost(options: ClientAuthenticationClientSecretPostOptions): ClientAuthenticationCallback;
|
|
97
|
-
interface ClientAuthenticationClientSecretBasicOptions {
|
|
98
|
-
clientId: string;
|
|
99
|
-
clientSecret: string;
|
|
100
|
-
}
|
|
101
|
-
/**
|
|
102
|
-
* Client authentication using `client_secret_basic` option
|
|
103
|
-
*/
|
|
104
|
-
declare function clientAuthenticationClientSecretBasic(options: ClientAuthenticationClientSecretBasicOptions): ClientAuthenticationCallback;
|
|
105
|
-
interface ClientAuthenticationNoneOptions {
|
|
106
|
-
clientId: string;
|
|
107
|
-
}
|
|
108
|
-
/**
|
|
109
|
-
* Client authentication using `none` option
|
|
110
|
-
*/
|
|
111
|
-
declare function clientAuthenticationNone(options: ClientAuthenticationNoneOptions): ClientAuthenticationCallback;
|
|
112
|
-
/**
|
|
113
|
-
* Anonymous client authentication
|
|
114
|
-
*/
|
|
115
|
-
declare function clientAuthenticationAnonymous(): ClientAuthenticationCallback;
|
|
116
|
-
interface ClientAuthenticationClientAttestationJwtOptions {
|
|
117
|
-
clientAttestationJwt: string;
|
|
118
|
-
callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom'>;
|
|
119
|
-
}
|
|
120
|
-
/**
|
|
121
|
-
* Client authentication using `attest_jwt_client_auth` option.
|
|
122
|
-
*/
|
|
123
|
-
declare function clientAuthenticationClientAttestationJwt(options: ClientAuthenticationClientAttestationJwtOptions): ClientAuthenticationCallback;
|
|
124
|
-
//#endregion
|
|
125
|
-
//#region src/common/jwk/z-jwk.d.ts
|
|
126
|
-
declare const zJwk: z$1.ZodObject<{
|
|
127
|
-
kty: z$1.ZodString;
|
|
128
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
129
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
130
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
131
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
132
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
133
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
134
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
135
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
136
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
137
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
138
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
139
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
140
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
141
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
142
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
143
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
144
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
145
|
-
}, z$1.core.$loose>>>;
|
|
146
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
147
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
148
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
149
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
150
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
151
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
152
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
153
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
154
|
-
}, z$1.core.$loose>;
|
|
155
|
-
type Jwk = z$1.infer<typeof zJwk>;
|
|
156
|
-
declare const zJwkSet: z$1.ZodObject<{
|
|
157
|
-
keys: z$1.ZodArray<z$1.ZodObject<{
|
|
158
|
-
kty: z$1.ZodString;
|
|
159
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
160
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
161
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
162
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
163
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
164
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
165
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
166
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
167
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
168
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
169
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
170
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
171
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
172
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
173
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
174
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
175
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
176
|
-
}, z$1.core.$loose>>>;
|
|
177
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
178
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
179
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
180
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
181
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
182
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
183
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
184
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
185
|
-
}, z$1.core.$loose>>;
|
|
186
|
-
}, z$1.core.$loose>;
|
|
187
|
-
type JwkSet = z$1.infer<typeof zJwkSet>;
|
|
188
|
-
//#endregion
|
|
189
|
-
//#region src/common/jwt/z-jwt.d.ts
|
|
190
|
-
type JwtSignerDid = {
|
|
191
|
-
method: 'did';
|
|
192
|
-
didUrl: string;
|
|
193
|
-
alg: string;
|
|
194
|
-
/**
|
|
195
|
-
* The key id that should be used for signing. You need to make sure the kid actuall matches
|
|
196
|
-
* with the key associated with the didUrl.
|
|
197
|
-
*/
|
|
198
|
-
kid?: string;
|
|
199
|
-
};
|
|
200
|
-
type JwtSignerJwk = {
|
|
201
|
-
method: 'jwk';
|
|
202
|
-
publicJwk: Jwk;
|
|
203
|
-
alg: string;
|
|
204
|
-
/**
|
|
205
|
-
* The key id that should be used for signing. You need to make sure the kid actuall matches
|
|
206
|
-
* with the key associated with the jwk.
|
|
207
|
-
*
|
|
208
|
-
* If not provided the kid can also be extracted from the `publicJwk`. Providing it here means the `kid` won't
|
|
209
|
-
* be included in the JWT header.
|
|
210
|
-
*/
|
|
211
|
-
kid?: string;
|
|
212
|
-
};
|
|
213
|
-
type JwtSignerX5c = {
|
|
214
|
-
method: 'x5c';
|
|
215
|
-
x5c: string[];
|
|
216
|
-
alg: string;
|
|
217
|
-
/**
|
|
218
|
-
* The key id that should be used for signing. You need to make sure the kid actuall matches
|
|
219
|
-
* with the key associated with the leaf certificate.
|
|
220
|
-
*/
|
|
221
|
-
kid?: string;
|
|
222
|
-
};
|
|
223
|
-
type JwtSignerFederation = {
|
|
224
|
-
method: 'federation';
|
|
225
|
-
trustChain?: [string, ...string[]];
|
|
226
|
-
alg: string;
|
|
227
|
-
/**
|
|
228
|
-
* The key id that should be used for signing. You need to make sure the kid actuall matches
|
|
229
|
-
* with a key present in the federation.
|
|
230
|
-
*/
|
|
231
|
-
kid: string;
|
|
232
|
-
};
|
|
233
|
-
type JwtSignerCustom = {
|
|
234
|
-
method: 'custom';
|
|
235
|
-
alg: string;
|
|
236
|
-
/**
|
|
237
|
-
* The key id that should be used for signing.
|
|
238
|
-
*/
|
|
239
|
-
kid?: string;
|
|
240
|
-
};
|
|
241
|
-
type JwtSigner = JwtSignerDid | JwtSignerJwk | JwtSignerX5c | JwtSignerFederation | JwtSignerCustom;
|
|
242
|
-
type JwtSignerWithJwk = JwtSigner & {
|
|
243
|
-
publicJwk: Jwk;
|
|
244
|
-
};
|
|
245
|
-
type JweEncryptor = JwtSignerJwk & {
|
|
246
|
-
enc: string;
|
|
247
|
-
/**
|
|
248
|
-
* base64-url encoded apu
|
|
249
|
-
*/
|
|
250
|
-
apu?: string;
|
|
251
|
-
/**
|
|
252
|
-
* base64-url encoded apv
|
|
253
|
-
*/
|
|
254
|
-
apv?: string;
|
|
255
|
-
};
|
|
256
|
-
declare const zCompactJwt: z$1.ZodString;
|
|
257
|
-
declare const zJwtPayload: z$1.ZodObject<{
|
|
258
|
-
iss: z$1.ZodOptional<z$1.ZodString>;
|
|
259
|
-
aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
|
|
260
|
-
iat: z$1.ZodOptional<z$1.ZodNumber>;
|
|
261
|
-
exp: z$1.ZodOptional<z$1.ZodNumber>;
|
|
262
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
263
|
-
nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
264
|
-
jti: z$1.ZodOptional<z$1.ZodString>;
|
|
265
|
-
sub: z$1.ZodOptional<z$1.ZodString>;
|
|
266
|
-
cnf: z$1.ZodOptional<z$1.ZodObject<{
|
|
267
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
268
|
-
kty: z$1.ZodString;
|
|
269
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
270
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
271
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
272
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
273
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
274
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
275
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
276
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
277
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
278
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
279
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
280
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
281
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
282
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
283
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
284
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
285
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
286
|
-
}, z$1.core.$loose>>>;
|
|
287
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
288
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
289
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
290
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
291
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
292
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
293
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
294
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
295
|
-
}, z$1.core.$loose>>;
|
|
296
|
-
jkt: z$1.ZodOptional<z$1.ZodString>;
|
|
297
|
-
}, z$1.core.$loose>>;
|
|
298
|
-
status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
|
|
299
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
300
|
-
}, z$1.core.$loose>;
|
|
301
|
-
type JwtPayload = z$1.infer<typeof zJwtPayload>;
|
|
302
|
-
declare const zJwtHeader: z$1.ZodObject<{
|
|
303
|
-
alg: z$1.ZodString;
|
|
304
|
-
typ: z$1.ZodOptional<z$1.ZodString>;
|
|
305
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
306
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
307
|
-
kty: z$1.ZodString;
|
|
308
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
309
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
310
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
311
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
312
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
313
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
314
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
315
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
316
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
317
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
318
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
319
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
320
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
321
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
322
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
323
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
324
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
325
|
-
}, z$1.core.$loose>>>;
|
|
326
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
327
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
328
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
329
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
330
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
331
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
332
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
333
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
334
|
-
}, z$1.core.$loose>>;
|
|
335
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
336
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
337
|
-
}, z$1.core.$loose>;
|
|
338
|
-
type JwtHeader = z$1.infer<typeof zJwtHeader>;
|
|
339
|
-
//#endregion
|
|
340
|
-
//#region src/callbacks.d.ts
|
|
341
|
-
/**
|
|
342
|
-
* Supported hashing algorithms
|
|
343
|
-
*
|
|
344
|
-
* Based on https://www.iana.org/assignments/named-information/named-information.xhtml
|
|
345
|
-
*/
|
|
346
|
-
declare enum HashAlgorithm {
|
|
347
|
-
Sha256 = "sha-256",
|
|
348
|
-
Sha384 = "sha-384",
|
|
349
|
-
Sha512 = "sha-512",
|
|
350
|
-
}
|
|
351
|
-
/**
|
|
352
|
-
* Callback used for operations that require hashing
|
|
353
|
-
*/
|
|
354
|
-
type HashCallback = (data: Uint8Array, alg: HashAlgorithm) => OrPromise<Uint8Array>;
|
|
355
|
-
type GenerateRandomCallback = (byteLength: number) => OrPromise<Uint8Array>;
|
|
356
|
-
type SignJwtCallback = (jwtSigner: JwtSigner, jwt: {
|
|
357
|
-
header: JwtHeader;
|
|
358
|
-
payload: JwtPayload;
|
|
359
|
-
}) => OrPromise<{
|
|
360
|
-
jwt: string;
|
|
361
|
-
signerJwk: Jwk;
|
|
362
|
-
}>;
|
|
363
|
-
type VerifyJwtCallback = (jwtSigner: JwtSigner, jwt: {
|
|
364
|
-
header: JwtHeader;
|
|
365
|
-
payload: JwtPayload;
|
|
366
|
-
compact: string;
|
|
367
|
-
}) => OrPromise<{
|
|
368
|
-
verified: true;
|
|
369
|
-
signerJwk: Jwk;
|
|
370
|
-
} | {
|
|
371
|
-
verified: false;
|
|
372
|
-
signerJwk?: Jwk;
|
|
373
|
-
}>;
|
|
374
|
-
interface DecryptJweCallbackOptions {
|
|
375
|
-
jwk?: Jwk;
|
|
376
|
-
}
|
|
377
|
-
type DecryptJweCallback = (jwe: string, options?: DecryptJweCallbackOptions) => OrPromise<{
|
|
378
|
-
decrypted: true;
|
|
379
|
-
decryptionJwk: Jwk;
|
|
380
|
-
payload: string;
|
|
381
|
-
} | {
|
|
382
|
-
decrypted: false;
|
|
383
|
-
decryptionJwk?: Jwk;
|
|
384
|
-
payload?: string;
|
|
385
|
-
}>;
|
|
386
|
-
type EncryptJweCallback = (jweEncryptor: JweEncryptor, data: string) => OrPromise<{
|
|
387
|
-
encryptionJwk: Jwk;
|
|
388
|
-
jwe: string;
|
|
389
|
-
}>;
|
|
390
|
-
/**
|
|
391
|
-
* Callback context provides the callbacks that are required for the openid4vc library
|
|
392
|
-
*/
|
|
393
|
-
interface CallbackContext {
|
|
394
|
-
/**
|
|
395
|
-
* Custom fetch implementation to use
|
|
396
|
-
*/
|
|
397
|
-
fetch?: Fetch;
|
|
398
|
-
/**
|
|
399
|
-
* Hash callback used for e.g. dpop and pkce
|
|
400
|
-
*/
|
|
401
|
-
hash: HashCallback;
|
|
402
|
-
/**
|
|
403
|
-
* Sign jwt callback for signing of Json Web Tokens
|
|
404
|
-
*/
|
|
405
|
-
signJwt: SignJwtCallback;
|
|
406
|
-
/**
|
|
407
|
-
* Decrypt jwe callback for decrypting of Json Web Encryptions
|
|
408
|
-
*/
|
|
409
|
-
decryptJwe: DecryptJweCallback;
|
|
410
|
-
/**
|
|
411
|
-
* Encrypt jwt callback for encrypting of Json Web Encryptions
|
|
412
|
-
*/
|
|
413
|
-
encryptJwe: EncryptJweCallback;
|
|
414
|
-
/**
|
|
415
|
-
* Verify jwt callback for verification of Json Web Tokens
|
|
416
|
-
*/
|
|
417
|
-
verifyJwt: VerifyJwtCallback;
|
|
418
|
-
/**
|
|
419
|
-
* Generate random callback to generate random bytes. Used for
|
|
420
|
-
* e.g. the 'jti' value in a dpop jwt, and 'code_verifier' in pkce.
|
|
421
|
-
*/
|
|
422
|
-
generateRandom: GenerateRandomCallback;
|
|
423
|
-
/**
|
|
424
|
-
* Extend a request to the authorization server with client authentication
|
|
425
|
-
* parameters. If you're not using client authentication, you can set this
|
|
426
|
-
* to `clientAuthenticationNone()`
|
|
427
|
-
*
|
|
428
|
-
* There are three default client authentication methods provided:
|
|
429
|
-
* - `clientAuthenticationClientSecretPost`
|
|
430
|
-
* - `clientAuthenticationClientSecretBasic`
|
|
431
|
-
* - `clientAuthenticationClientAttestationJwt`
|
|
432
|
-
* - `clientAuthenticationNone`
|
|
433
|
-
* - `clientAuthenticationAnonymous`
|
|
434
|
-
*
|
|
435
|
-
* A custom implementation can be made for other methods, or allowing complex
|
|
436
|
-
* scenarios where multiple authorization servers are supported.
|
|
437
|
-
*/
|
|
438
|
-
clientAuthentication: ClientAuthenticationCallback;
|
|
439
|
-
/**
|
|
440
|
-
* Get the DNS names and URI names from a X.509 certificate
|
|
441
|
-
*/
|
|
442
|
-
getX509CertificateMetadata?: (certificate: string) => {
|
|
443
|
-
sanDnsNames: string[];
|
|
444
|
-
sanUriNames: string[];
|
|
445
|
-
};
|
|
446
|
-
}
|
|
447
|
-
//#endregion
|
|
448
|
-
//#region src/common/z-common.d.ts
|
|
449
|
-
declare const zAlgValueNotNone: z$1.ZodString;
|
|
450
|
-
interface RequestLike {
|
|
451
|
-
headers: FetchHeaders;
|
|
452
|
-
method: HttpMethod$1;
|
|
453
|
-
url: string;
|
|
454
|
-
}
|
|
455
|
-
//#endregion
|
|
456
|
-
//#region src/dpop/dpop.d.ts
|
|
457
|
-
interface RequestDpopOptions {
|
|
458
|
-
/**
|
|
459
|
-
* Dpop nonce to use for constructing the dpop jwt
|
|
460
|
-
*/
|
|
461
|
-
nonce?: string;
|
|
462
|
-
/**
|
|
463
|
-
* The signer of the dpop jwt
|
|
464
|
-
*/
|
|
465
|
-
signer: JwtSignerJwk;
|
|
466
|
-
}
|
|
467
|
-
interface VerifyDpopJwtOptions {
|
|
468
|
-
/**
|
|
469
|
-
* The compact dpop jwt.
|
|
470
|
-
*/
|
|
471
|
-
dpopJwt: string;
|
|
472
|
-
/**
|
|
473
|
-
* The requet for which to verify the dpop jwt
|
|
474
|
-
*/
|
|
475
|
-
request: RequestLike;
|
|
476
|
-
/**
|
|
477
|
-
* Allowed dpop signing alg values. If not provided
|
|
478
|
-
* any alg values are allowed and it's up to the `verifyJwtCallback`
|
|
479
|
-
* to handle the alg.
|
|
480
|
-
*/
|
|
481
|
-
allowedSigningAlgs?: string[];
|
|
482
|
-
/**
|
|
483
|
-
* Expected nonce in the payload. If not provided the nonce won't be validated.
|
|
484
|
-
*/
|
|
485
|
-
expectedNonce?: string;
|
|
486
|
-
/**
|
|
487
|
-
* Access token to which the dpop jwt is bound. If provided the sha-256 hash of the
|
|
488
|
-
* access token needs to match the 'ath' claim.
|
|
489
|
-
*/
|
|
490
|
-
accessToken?: string;
|
|
491
|
-
/**
|
|
492
|
-
* The expected jwk thumprint 'jti' confirmation method. If provided the thumprint of the
|
|
493
|
-
* jwk used to sign the dpop jwt must match this provided thumbprint value. The 'jti' value
|
|
494
|
-
* can be extracted from the access token payload, or if opaque tokens are used can be retrieved
|
|
495
|
-
* using token introspection.
|
|
496
|
-
*/
|
|
497
|
-
expectedJwkThumbprint?: string;
|
|
498
|
-
/**
|
|
499
|
-
* Callbacks used for verifying dpop jwt
|
|
500
|
-
*/
|
|
501
|
-
callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash'>;
|
|
502
|
-
now?: Date;
|
|
503
|
-
}
|
|
504
|
-
//#endregion
|
|
505
|
-
//#region src/common/z-oauth2-error.d.ts
|
|
506
|
-
declare enum Oauth2ErrorCodes {
|
|
507
|
-
ServerError = "server_error",
|
|
508
|
-
InvalidTarget = "invalid_target",
|
|
509
|
-
InvalidRequest = "invalid_request",
|
|
510
|
-
InvalidToken = "invalid_token",
|
|
511
|
-
InsufficientScope = "insufficient_scope",
|
|
512
|
-
InvalidGrant = "invalid_grant",
|
|
513
|
-
InvalidClient = "invalid_client",
|
|
514
|
-
UnauthorizedClient = "unauthorized_client",
|
|
515
|
-
UnsupportedGrantType = "unsupported_grant_type",
|
|
516
|
-
InvalidScope = "invalid_scope",
|
|
517
|
-
InvalidDpopProof = "invalid_dpop_proof",
|
|
518
|
-
UseDpopNonce = "use_dpop_nonce",
|
|
519
|
-
RedirectToWeb = "redirect_to_web",
|
|
520
|
-
InvalidSession = "invalid_session",
|
|
521
|
-
InsufficientAuthorization = "insufficient_authorization",
|
|
522
|
-
InvalidCredentialRequest = "invalid_credential_request",
|
|
523
|
-
CredentialRequestDenied = "credential_request_denied",
|
|
524
|
-
InvalidProof = "invalid_proof",
|
|
525
|
-
InvalidNonce = "invalid_nonce",
|
|
526
|
-
InvalidEncryptionParameters = "invalid_encryption_parameters",
|
|
527
|
-
UnknownCredentialConfiguration = "unknown_credential_configuration",
|
|
528
|
-
UnknownCredentialIdentifier = "unknown_credential_identifier",
|
|
529
|
-
InvalidTransactionId = "invalid_transaction_id",
|
|
530
|
-
UnsupportedCredentialType = "unsupported_credential_type",
|
|
531
|
-
UnsupportedCredentialFormat = "unsupported_credential_format",
|
|
532
|
-
InvalidRequestUri = "invalid_request_uri",
|
|
533
|
-
InvalidRequestObject = "invalid_request_object",
|
|
534
|
-
RequestNotSupported = "request_not_supported",
|
|
535
|
-
RequestUriNotSupported = "request_uri_not_supported",
|
|
536
|
-
VpFormatsNotSupported = "vp_formats_not_supported",
|
|
537
|
-
AccessDenied = "access_denied",
|
|
538
|
-
InvalidPresentationDefinitionUri = "invalid_presentation_definition_uri",
|
|
539
|
-
InvalidPresentationDefinitionReference = "invalid_presentation_definition_reference",
|
|
540
|
-
InvalidRequestUriMethod = "invalid_request_uri_method",
|
|
541
|
-
InvalidTransactionData = "invalid_transaction_data",
|
|
542
|
-
WalletUnavailable = "wallet_unavailable",
|
|
543
|
-
}
|
|
544
|
-
declare const zOauth2ErrorResponse: z$1.ZodObject<{
|
|
545
|
-
error: z$1.ZodUnion<readonly [z$1.ZodEnum<typeof Oauth2ErrorCodes>, z$1.ZodString]>;
|
|
546
|
-
error_description: z$1.ZodOptional<z$1.ZodString>;
|
|
547
|
-
error_uri: z$1.ZodOptional<z$1.ZodString>;
|
|
548
|
-
}, z$1.core.$loose>;
|
|
549
|
-
type Oauth2ErrorResponse = z$1.infer<typeof zOauth2ErrorResponse>;
|
|
550
|
-
//#endregion
|
|
551
|
-
//#region src/access-token/z-access-token.d.ts
|
|
552
|
-
declare const zAccessTokenRequest: z$1.ZodIntersection<z$1.ZodObject<{
|
|
553
|
-
'pre-authorized_code': z$1.ZodOptional<z$1.ZodString>;
|
|
554
|
-
code: z$1.ZodOptional<z$1.ZodString>;
|
|
555
|
-
redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
|
|
556
|
-
refresh_token: z$1.ZodOptional<z$1.ZodString>;
|
|
557
|
-
resource: z$1.ZodOptional<z$1.ZodURL>;
|
|
558
|
-
code_verifier: z$1.ZodOptional<z$1.ZodString>;
|
|
559
|
-
grant_type: z$1.ZodUnion<readonly [z$1.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">, z$1.ZodLiteral<"authorization_code">, z$1.ZodLiteral<"refresh_token">, z$1.ZodString]>;
|
|
560
|
-
}, z$1.core.$loose>, z$1.ZodPipe<z$1.ZodObject<{
|
|
561
|
-
tx_code: z$1.ZodOptional<z$1.ZodString>;
|
|
562
|
-
user_pin: z$1.ZodOptional<z$1.ZodString>;
|
|
563
|
-
}, z$1.core.$loose>, z$1.ZodTransform<{
|
|
564
|
-
tx_code?: string | undefined;
|
|
565
|
-
}, {
|
|
566
|
-
[x: string]: unknown;
|
|
567
|
-
tx_code?: string | undefined;
|
|
568
|
-
user_pin?: string | undefined;
|
|
569
|
-
}>>>;
|
|
570
|
-
type AccessTokenRequest = z$1.infer<typeof zAccessTokenRequest>;
|
|
571
|
-
declare const zAccessTokenResponse: z$1.ZodObject<{
|
|
572
|
-
access_token: z$1.ZodString;
|
|
573
|
-
token_type: z$1.ZodString;
|
|
574
|
-
expires_in: z$1.ZodOptional<z$1.ZodNumber>;
|
|
575
|
-
scope: z$1.ZodOptional<z$1.ZodString>;
|
|
576
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
577
|
-
refresh_token: z$1.ZodOptional<z$1.ZodString>;
|
|
578
|
-
c_nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
579
|
-
c_nonce_expires_in: z$1.ZodOptional<z$1.ZodNumber>;
|
|
580
|
-
authorization_details: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{}, z$1.core.$loose>>>;
|
|
581
|
-
}, z$1.core.$loose>;
|
|
582
|
-
type AccessTokenResponse = z$1.infer<typeof zAccessTokenResponse>;
|
|
583
|
-
declare const zAccessTokenErrorResponse: z$1.ZodObject<{
|
|
584
|
-
error: z$1.ZodUnion<readonly [z$1.ZodEnum<typeof Oauth2ErrorCodes>, z$1.ZodString]>;
|
|
585
|
-
error_description: z$1.ZodOptional<z$1.ZodString>;
|
|
586
|
-
error_uri: z$1.ZodOptional<z$1.ZodString>;
|
|
587
|
-
}, z$1.core.$loose>;
|
|
588
|
-
type AccessTokenErrorResponse = z$1.infer<typeof zAccessTokenErrorResponse>;
|
|
589
|
-
//#endregion
|
|
590
|
-
//#region src/access-token/retrieve-access-token.d.ts
|
|
591
|
-
interface RetrieveAccessTokenReturn {
|
|
592
|
-
accessTokenResponse: AccessTokenResponse;
|
|
593
|
-
dpop?: RequestDpopOptions;
|
|
594
|
-
}
|
|
595
|
-
interface RetrieveAccessTokenBaseOptions {
|
|
596
|
-
/**
|
|
597
|
-
* Authorization server to request the access token from
|
|
598
|
-
*/
|
|
599
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
600
|
-
/**
|
|
601
|
-
* Callbacks to use for requesting access token
|
|
602
|
-
*/
|
|
603
|
-
callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'hash' | 'signJwt' | 'clientAuthentication'>;
|
|
604
|
-
/**
|
|
605
|
-
* The resource to which access is being requested. This can help the authorization
|
|
606
|
-
* server in determining the resource server to handle the authorization request for
|
|
607
|
-
*/
|
|
608
|
-
resource?: string;
|
|
609
|
-
/**
|
|
610
|
-
* Dpop parameters for including a dpop in the access token request. The request will automatically
|
|
611
|
-
* be retried if the server responds with a 'use_dpop_nonce' header.
|
|
612
|
-
*
|
|
613
|
-
* If provided but 'dpop_signing_alg_values_supported' is not available in the authorization server
|
|
614
|
-
* metadata, or the 'alg' value does not match an error will be thrown.
|
|
615
|
-
*/
|
|
616
|
-
dpop?: RequestDpopOptions;
|
|
617
|
-
}
|
|
618
|
-
interface RetrievePreAuthorizedCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
|
|
619
|
-
preAuthorizedCode: string;
|
|
620
|
-
txCode?: string;
|
|
621
|
-
/**
|
|
622
|
-
* Additional payload to include in the access token request. Items will be encoded and sent
|
|
623
|
-
* using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
|
|
624
|
-
*/
|
|
625
|
-
additionalRequestPayload?: Record<string, unknown>;
|
|
626
|
-
}
|
|
627
|
-
interface RetrieveAuthorizationCodeAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
|
|
628
|
-
/**
|
|
629
|
-
* PKCE Code verifier that was used in the authorization request.
|
|
630
|
-
*/
|
|
631
|
-
pkceCodeVerifier?: string;
|
|
632
|
-
/**
|
|
633
|
-
* The authorization code
|
|
634
|
-
*/
|
|
635
|
-
authorizationCode: string;
|
|
636
|
-
/**
|
|
637
|
-
* Redirect uri to include in the access token request. Only required
|
|
638
|
-
* if the redirect uri was present in the authorization request.
|
|
639
|
-
*/
|
|
640
|
-
redirectUri?: string;
|
|
641
|
-
/**
|
|
642
|
-
* Additional payload to include in the access token request. Items will be encoded and sent
|
|
643
|
-
* using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
|
|
644
|
-
*/
|
|
645
|
-
additionalRequestPayload?: Record<string, unknown>;
|
|
646
|
-
}
|
|
647
|
-
interface RetrieveRefreshTokenAccessTokenOptions extends RetrieveAccessTokenBaseOptions {
|
|
648
|
-
/**
|
|
649
|
-
* The refresh token
|
|
650
|
-
*/
|
|
651
|
-
refreshToken: string;
|
|
652
|
-
/**
|
|
653
|
-
* Additional payload to include in the access token request. Items will be encoded and sent
|
|
654
|
-
* using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
|
|
655
|
-
*/
|
|
656
|
-
additionalRequestPayload?: Record<string, unknown>;
|
|
657
|
-
}
|
|
658
|
-
//#endregion
|
|
659
|
-
//#region src/access-token/verify-access-token.d.ts
|
|
660
|
-
declare enum SupportedAuthenticationScheme {
|
|
661
|
-
Bearer = "Bearer",
|
|
662
|
-
DPoP = "DPoP",
|
|
663
|
-
}
|
|
664
|
-
//#endregion
|
|
665
|
-
//#region src/client-attestation/z-client-attestation.d.ts
|
|
666
|
-
declare const zClientAttestationJwtPayload: z$1.ZodObject<{
|
|
667
|
-
iss: z$1.ZodString;
|
|
668
|
-
sub: z$1.ZodString;
|
|
669
|
-
exp: z$1.ZodNumber;
|
|
670
|
-
cnf: z$1.ZodObject<{
|
|
671
|
-
jwk: z$1.ZodObject<{
|
|
672
|
-
kty: z$1.ZodString;
|
|
673
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
674
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
675
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
676
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
677
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
678
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
679
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
680
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
681
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
682
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
683
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
684
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
685
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
686
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
687
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
688
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
689
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
690
|
-
}, z$1.core.$loose>>>;
|
|
691
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
692
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
693
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
694
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
695
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
696
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
697
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
698
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
699
|
-
}, z$1.core.$loose>;
|
|
700
|
-
}, z$1.core.$loose>;
|
|
701
|
-
wallet_name: z$1.ZodOptional<z$1.ZodString>;
|
|
702
|
-
wallet_link: z$1.ZodOptional<z$1.ZodURL>;
|
|
703
|
-
aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
|
|
704
|
-
iat: z$1.ZodOptional<z$1.ZodNumber>;
|
|
705
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
706
|
-
nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
707
|
-
jti: z$1.ZodOptional<z$1.ZodString>;
|
|
708
|
-
status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
|
|
709
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
710
|
-
}, z$1.core.$loose>;
|
|
711
|
-
type ClientAttestationJwtPayload = z$1.infer<typeof zClientAttestationJwtPayload>;
|
|
712
|
-
declare const zClientAttestationJwtHeader: z$1.ZodObject<{
|
|
713
|
-
typ: z$1.ZodLiteral<"oauth-client-attestation+jwt">;
|
|
714
|
-
alg: z$1.ZodString;
|
|
715
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
716
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
717
|
-
kty: z$1.ZodString;
|
|
718
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
719
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
720
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
721
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
722
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
723
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
724
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
725
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
726
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
727
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
728
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
729
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
730
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
731
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
732
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
733
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
734
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
735
|
-
}, z$1.core.$loose>>>;
|
|
736
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
737
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
738
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
739
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
740
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
741
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
742
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
743
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
744
|
-
}, z$1.core.$loose>>;
|
|
745
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
746
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
747
|
-
}, z$1.core.$loose>;
|
|
748
|
-
type ClientAttestationJwtHeader = z$1.infer<typeof zClientAttestationJwtHeader>;
|
|
749
|
-
declare const zClientAttestationPopJwtPayload: z$1.ZodObject<{
|
|
750
|
-
iss: z$1.ZodString;
|
|
751
|
-
exp: z$1.ZodNumber;
|
|
752
|
-
aud: z$1.ZodUnion<readonly [z$1.ZodURL, z$1.ZodArray<z$1.ZodURL>]>;
|
|
753
|
-
jti: z$1.ZodString;
|
|
754
|
-
nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
755
|
-
iat: z$1.ZodOptional<z$1.ZodNumber>;
|
|
756
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
757
|
-
sub: z$1.ZodOptional<z$1.ZodString>;
|
|
758
|
-
cnf: z$1.ZodOptional<z$1.ZodObject<{
|
|
759
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
760
|
-
kty: z$1.ZodString;
|
|
761
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
762
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
763
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
764
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
765
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
766
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
767
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
768
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
769
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
770
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
771
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
772
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
773
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
774
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
775
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
776
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
777
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
778
|
-
}, z$1.core.$loose>>>;
|
|
779
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
780
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
781
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
782
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
783
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
784
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
785
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
786
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
787
|
-
}, z$1.core.$loose>>;
|
|
788
|
-
jkt: z$1.ZodOptional<z$1.ZodString>;
|
|
789
|
-
}, z$1.core.$loose>>;
|
|
790
|
-
status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
|
|
791
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
792
|
-
}, z$1.core.$loose>;
|
|
793
|
-
type ClientAttestationPopJwtPayload = z$1.infer<typeof zClientAttestationPopJwtPayload>;
|
|
794
|
-
declare const zClientAttestationPopJwtHeader: z$1.ZodObject<{
|
|
795
|
-
typ: z$1.ZodLiteral<"oauth-client-attestation-pop+jwt">;
|
|
796
|
-
alg: z$1.ZodString;
|
|
797
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
798
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
799
|
-
kty: z$1.ZodString;
|
|
800
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
801
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
802
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
803
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
804
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
805
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
806
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
807
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
808
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
809
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
810
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
811
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
812
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
813
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
814
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
815
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
816
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
817
|
-
}, z$1.core.$loose>>>;
|
|
818
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
819
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
820
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
821
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
822
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
823
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
824
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
825
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
826
|
-
}, z$1.core.$loose>>;
|
|
827
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
828
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
829
|
-
}, z$1.core.$loose>;
|
|
830
|
-
type ClientAttestationPopJwtHeader = z$1.infer<typeof zClientAttestationPopJwtHeader>;
|
|
831
|
-
//#endregion
|
|
832
|
-
//#region src/client-attestation/client-attestation.d.ts
|
|
833
|
-
interface VerifyClientAttestationJwtOptions {
|
|
834
|
-
/**
|
|
835
|
-
* The compact client attestation jwt.
|
|
836
|
-
*/
|
|
837
|
-
clientAttestationJwt: string;
|
|
838
|
-
/**
|
|
839
|
-
* Date to use for expiration. If not provided current date will be used.
|
|
840
|
-
*/
|
|
841
|
-
now?: Date;
|
|
842
|
-
/**
|
|
843
|
-
* Callbacks used for verifying client attestation pop jwt.
|
|
844
|
-
*/
|
|
845
|
-
callbacks: Pick<CallbackContext, 'verifyJwt'>;
|
|
846
|
-
}
|
|
847
|
-
type VerifiedClientAttestationJwt = Awaited<ReturnType<typeof verifyClientAttestationJwt>>;
|
|
848
|
-
declare function verifyClientAttestationJwt(options: VerifyClientAttestationJwtOptions): Promise<{
|
|
849
|
-
header: {
|
|
850
|
-
[x: string]: unknown;
|
|
851
|
-
typ: "oauth-client-attestation+jwt";
|
|
852
|
-
alg: string;
|
|
853
|
-
kid?: string | undefined;
|
|
854
|
-
jwk?: {
|
|
855
|
-
[x: string]: unknown;
|
|
856
|
-
kty: string;
|
|
857
|
-
crv?: string | undefined;
|
|
858
|
-
x?: string | undefined;
|
|
859
|
-
y?: string | undefined;
|
|
860
|
-
e?: string | undefined;
|
|
861
|
-
n?: string | undefined;
|
|
862
|
-
alg?: string | undefined;
|
|
863
|
-
d?: string | undefined;
|
|
864
|
-
dp?: string | undefined;
|
|
865
|
-
dq?: string | undefined;
|
|
866
|
-
ext?: boolean | undefined;
|
|
867
|
-
k?: string | undefined;
|
|
868
|
-
key_ops?: string[] | undefined;
|
|
869
|
-
kid?: string | undefined;
|
|
870
|
-
oth?: {
|
|
871
|
-
[x: string]: unknown;
|
|
872
|
-
d?: string | undefined;
|
|
873
|
-
r?: string | undefined;
|
|
874
|
-
t?: string | undefined;
|
|
875
|
-
}[] | undefined;
|
|
876
|
-
p?: string | undefined;
|
|
877
|
-
q?: string | undefined;
|
|
878
|
-
qi?: string | undefined;
|
|
879
|
-
use?: string | undefined;
|
|
880
|
-
x5c?: string[] | undefined;
|
|
881
|
-
x5t?: string | undefined;
|
|
882
|
-
'x5t#S256'?: string | undefined;
|
|
883
|
-
x5u?: string | undefined;
|
|
884
|
-
} | undefined;
|
|
885
|
-
x5c?: string[] | undefined;
|
|
886
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
887
|
-
};
|
|
888
|
-
payload: {
|
|
889
|
-
[x: string]: unknown;
|
|
890
|
-
iss: string;
|
|
891
|
-
sub: string;
|
|
892
|
-
exp: number;
|
|
893
|
-
cnf: {
|
|
894
|
-
[x: string]: unknown;
|
|
895
|
-
jwk: {
|
|
896
|
-
[x: string]: unknown;
|
|
897
|
-
kty: string;
|
|
898
|
-
crv?: string | undefined;
|
|
899
|
-
x?: string | undefined;
|
|
900
|
-
y?: string | undefined;
|
|
901
|
-
e?: string | undefined;
|
|
902
|
-
n?: string | undefined;
|
|
903
|
-
alg?: string | undefined;
|
|
904
|
-
d?: string | undefined;
|
|
905
|
-
dp?: string | undefined;
|
|
906
|
-
dq?: string | undefined;
|
|
907
|
-
ext?: boolean | undefined;
|
|
908
|
-
k?: string | undefined;
|
|
909
|
-
key_ops?: string[] | undefined;
|
|
910
|
-
kid?: string | undefined;
|
|
911
|
-
oth?: {
|
|
912
|
-
[x: string]: unknown;
|
|
913
|
-
d?: string | undefined;
|
|
914
|
-
r?: string | undefined;
|
|
915
|
-
t?: string | undefined;
|
|
916
|
-
}[] | undefined;
|
|
917
|
-
p?: string | undefined;
|
|
918
|
-
q?: string | undefined;
|
|
919
|
-
qi?: string | undefined;
|
|
920
|
-
use?: string | undefined;
|
|
921
|
-
x5c?: string[] | undefined;
|
|
922
|
-
x5t?: string | undefined;
|
|
923
|
-
'x5t#S256'?: string | undefined;
|
|
924
|
-
x5u?: string | undefined;
|
|
925
|
-
};
|
|
926
|
-
};
|
|
927
|
-
wallet_name?: string | undefined;
|
|
928
|
-
wallet_link?: string | undefined;
|
|
929
|
-
aud?: string | string[] | undefined;
|
|
930
|
-
iat?: number | undefined;
|
|
931
|
-
nbf?: number | undefined;
|
|
932
|
-
nonce?: string | undefined;
|
|
933
|
-
jti?: string | undefined;
|
|
934
|
-
status?: Record<string, any> | undefined;
|
|
935
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
936
|
-
};
|
|
937
|
-
signer: JwtSignerWithJwk;
|
|
938
|
-
}>;
|
|
939
|
-
interface CreateClientAttestationJwtOptions {
|
|
940
|
-
/**
|
|
941
|
-
* Creation time of the JWT. If not provided the current date will be used
|
|
942
|
-
*/
|
|
943
|
-
issuedAt?: Date;
|
|
944
|
-
/**
|
|
945
|
-
* Expiration time of the JWT.
|
|
946
|
-
*/
|
|
947
|
-
expiresAt: Date;
|
|
948
|
-
/**
|
|
949
|
-
* Issuer of the client attestation, usually identifier of the client backend
|
|
950
|
-
*/
|
|
951
|
-
issuer: string;
|
|
952
|
-
/**
|
|
953
|
-
* The client id of the client instance.
|
|
954
|
-
*/
|
|
955
|
-
clientId: string;
|
|
956
|
-
/**
|
|
957
|
-
* The confirmation payload for the client, attesting the `jwk`, `key_type` and `user_authentication`
|
|
958
|
-
*/
|
|
959
|
-
confirmation: ClientAttestationJwtPayload['cnf'];
|
|
960
|
-
/**
|
|
961
|
-
* Additional payload to include in the client attestation jwt payload. Will be applied after
|
|
962
|
-
* any default claims that are included, so add claims with caution.
|
|
963
|
-
*/
|
|
964
|
-
additionalPayload?: Record<string, unknown>;
|
|
965
|
-
/**
|
|
966
|
-
* Callback used for client attestation
|
|
967
|
-
*/
|
|
968
|
-
callbacks: Pick<CallbackContext, 'signJwt'>;
|
|
969
|
-
/**
|
|
970
|
-
* The signer of the client attestation jwt.
|
|
971
|
-
*/
|
|
972
|
-
signer: JwtSigner;
|
|
973
|
-
}
|
|
974
|
-
declare function createClientAttestationJwt(options: CreateClientAttestationJwtOptions): Promise<string>;
|
|
975
|
-
interface VerifyClientAttestationOptions {
|
|
976
|
-
authorizationServer: string;
|
|
977
|
-
clientAttestationJwt: string;
|
|
978
|
-
clientAttestationPopJwt: string;
|
|
979
|
-
callbacks: Pick<CallbackContext, 'verifyJwt'>;
|
|
980
|
-
/**
|
|
981
|
-
* Date to use for expiration. If not provided current date will be used.
|
|
982
|
-
*/
|
|
983
|
-
now?: Date;
|
|
984
|
-
}
|
|
985
|
-
//#endregion
|
|
986
|
-
//#region src/client-attestation/client-attestation-pop.d.ts
|
|
987
|
-
interface RequestClientAttestationOptions {
|
|
988
|
-
/**
|
|
989
|
-
* Dpop nonce to use for constructing the client attestation pop jwt
|
|
990
|
-
*/
|
|
991
|
-
nonce?: string;
|
|
992
|
-
/**
|
|
993
|
-
* Expiration time of the client attestation pop jwt.
|
|
994
|
-
*
|
|
995
|
-
* @default 5 minutes after issuance date
|
|
996
|
-
*/
|
|
997
|
-
expiresAt?: Date;
|
|
998
|
-
/**
|
|
999
|
-
* The client attestation jwt to create the pop for.
|
|
1000
|
-
*/
|
|
1001
|
-
jwt: string;
|
|
1002
|
-
/**
|
|
1003
|
-
* The signer of the client attestation pop jwt.
|
|
1004
|
-
*
|
|
1005
|
-
* Will be extracted from the client attestation if not provided.
|
|
1006
|
-
*/
|
|
1007
|
-
signer?: JwtSignerJwk;
|
|
1008
|
-
}
|
|
1009
|
-
interface VerifyClientAttestationPopJwtOptions {
|
|
1010
|
-
/**
|
|
1011
|
-
* The compact client attestation pop jwt.
|
|
1012
|
-
*/
|
|
1013
|
-
clientAttestationPopJwt: string;
|
|
1014
|
-
/**
|
|
1015
|
-
* The issuer identifier of the authorization server handling the client attestation
|
|
1016
|
-
*/
|
|
1017
|
-
authorizationServer: string;
|
|
1018
|
-
/**
|
|
1019
|
-
* Expected nonce in the payload. If not provided the nonce won't be validated.
|
|
1020
|
-
*/
|
|
1021
|
-
expectedNonce?: string;
|
|
1022
|
-
/**
|
|
1023
|
-
* Date to use for expiration. If not provided current date will be used.
|
|
1024
|
-
*/
|
|
1025
|
-
now?: Date;
|
|
1026
|
-
/**
|
|
1027
|
-
* Callbacks used for verifying client attestation pop jwt.
|
|
1028
|
-
*/
|
|
1029
|
-
callbacks: Pick<CallbackContext, 'verifyJwt'>;
|
|
1030
|
-
/**
|
|
1031
|
-
* The parsed and verified client attestation jwt
|
|
1032
|
-
*/
|
|
1033
|
-
clientAttestation: {
|
|
1034
|
-
header: ClientAttestationJwtHeader;
|
|
1035
|
-
payload: ClientAttestationJwtPayload;
|
|
1036
|
-
};
|
|
1037
|
-
}
|
|
1038
|
-
type VerifiedClientAttestationPopJwt = Awaited<ReturnType<typeof verifyClientAttestationPopJwt>>;
|
|
1039
|
-
declare function verifyClientAttestationPopJwt(options: VerifyClientAttestationPopJwtOptions): Promise<{
|
|
1040
|
-
header: {
|
|
1041
|
-
[x: string]: unknown;
|
|
1042
|
-
typ: "oauth-client-attestation-pop+jwt";
|
|
1043
|
-
alg: string;
|
|
1044
|
-
kid?: string | undefined;
|
|
1045
|
-
jwk?: {
|
|
1046
|
-
[x: string]: unknown;
|
|
1047
|
-
kty: string;
|
|
1048
|
-
crv?: string | undefined;
|
|
1049
|
-
x?: string | undefined;
|
|
1050
|
-
y?: string | undefined;
|
|
1051
|
-
e?: string | undefined;
|
|
1052
|
-
n?: string | undefined;
|
|
1053
|
-
alg?: string | undefined;
|
|
1054
|
-
d?: string | undefined;
|
|
1055
|
-
dp?: string | undefined;
|
|
1056
|
-
dq?: string | undefined;
|
|
1057
|
-
ext?: boolean | undefined;
|
|
1058
|
-
k?: string | undefined;
|
|
1059
|
-
key_ops?: string[] | undefined;
|
|
1060
|
-
kid?: string | undefined;
|
|
1061
|
-
oth?: {
|
|
1062
|
-
[x: string]: unknown;
|
|
1063
|
-
d?: string | undefined;
|
|
1064
|
-
r?: string | undefined;
|
|
1065
|
-
t?: string | undefined;
|
|
1066
|
-
}[] | undefined;
|
|
1067
|
-
p?: string | undefined;
|
|
1068
|
-
q?: string | undefined;
|
|
1069
|
-
qi?: string | undefined;
|
|
1070
|
-
use?: string | undefined;
|
|
1071
|
-
x5c?: string[] | undefined;
|
|
1072
|
-
x5t?: string | undefined;
|
|
1073
|
-
'x5t#S256'?: string | undefined;
|
|
1074
|
-
x5u?: string | undefined;
|
|
1075
|
-
} | undefined;
|
|
1076
|
-
x5c?: string[] | undefined;
|
|
1077
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
1078
|
-
};
|
|
1079
|
-
payload: {
|
|
1080
|
-
[x: string]: unknown;
|
|
1081
|
-
iss: string;
|
|
1082
|
-
exp: number;
|
|
1083
|
-
aud: string | string[];
|
|
1084
|
-
jti: string;
|
|
1085
|
-
nonce?: string | undefined;
|
|
1086
|
-
iat?: number | undefined;
|
|
1087
|
-
nbf?: number | undefined;
|
|
1088
|
-
sub?: string | undefined;
|
|
1089
|
-
cnf?: {
|
|
1090
|
-
[x: string]: unknown;
|
|
1091
|
-
jwk?: {
|
|
1092
|
-
[x: string]: unknown;
|
|
1093
|
-
kty: string;
|
|
1094
|
-
crv?: string | undefined;
|
|
1095
|
-
x?: string | undefined;
|
|
1096
|
-
y?: string | undefined;
|
|
1097
|
-
e?: string | undefined;
|
|
1098
|
-
n?: string | undefined;
|
|
1099
|
-
alg?: string | undefined;
|
|
1100
|
-
d?: string | undefined;
|
|
1101
|
-
dp?: string | undefined;
|
|
1102
|
-
dq?: string | undefined;
|
|
1103
|
-
ext?: boolean | undefined;
|
|
1104
|
-
k?: string | undefined;
|
|
1105
|
-
key_ops?: string[] | undefined;
|
|
1106
|
-
kid?: string | undefined;
|
|
1107
|
-
oth?: {
|
|
1108
|
-
[x: string]: unknown;
|
|
1109
|
-
d?: string | undefined;
|
|
1110
|
-
r?: string | undefined;
|
|
1111
|
-
t?: string | undefined;
|
|
1112
|
-
}[] | undefined;
|
|
1113
|
-
p?: string | undefined;
|
|
1114
|
-
q?: string | undefined;
|
|
1115
|
-
qi?: string | undefined;
|
|
1116
|
-
use?: string | undefined;
|
|
1117
|
-
x5c?: string[] | undefined;
|
|
1118
|
-
x5t?: string | undefined;
|
|
1119
|
-
'x5t#S256'?: string | undefined;
|
|
1120
|
-
x5u?: string | undefined;
|
|
1121
|
-
} | undefined;
|
|
1122
|
-
jkt?: string | undefined;
|
|
1123
|
-
} | undefined;
|
|
1124
|
-
status?: Record<string, any> | undefined;
|
|
1125
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
1126
|
-
};
|
|
1127
|
-
signer: JwtSignerWithJwk;
|
|
1128
|
-
}>;
|
|
1129
|
-
//#endregion
|
|
1130
|
-
//#region src/pkce.d.ts
|
|
1131
|
-
declare enum PkceCodeChallengeMethod {
|
|
1132
|
-
Plain = "plain",
|
|
1133
|
-
S256 = "S256",
|
|
1134
|
-
}
|
|
1135
|
-
interface CreatePkceReturn {
|
|
1136
|
-
codeVerifier: string;
|
|
1137
|
-
codeChallenge: string;
|
|
1138
|
-
codeChallengeMethod: PkceCodeChallengeMethod;
|
|
1139
|
-
}
|
|
1140
|
-
//#endregion
|
|
1141
|
-
//#region src/z-grant-type.d.ts
|
|
1142
|
-
declare const zPreAuthorizedCodeGrantIdentifier: z$1.ZodLiteral<"urn:ietf:params:oauth:grant-type:pre-authorized_code">;
|
|
1143
|
-
declare const preAuthorizedCodeGrantIdentifier: "urn:ietf:params:oauth:grant-type:pre-authorized_code";
|
|
1144
|
-
type PreAuthorizedCodeGrantIdentifier = z$1.infer<typeof zPreAuthorizedCodeGrantIdentifier>;
|
|
1145
|
-
declare const zAuthorizationCodeGrantIdentifier: z$1.ZodLiteral<"authorization_code">;
|
|
1146
|
-
declare const authorizationCodeGrantIdentifier: "authorization_code";
|
|
1147
|
-
type AuthorizationCodeGrantIdentifier = z$1.infer<typeof zAuthorizationCodeGrantIdentifier>;
|
|
1148
|
-
declare const zRefreshTokenGrantIdentifier: z$1.ZodLiteral<"refresh_token">;
|
|
1149
|
-
declare const refreshTokenGrantIdentifier: "refresh_token";
|
|
1150
|
-
type RefreshTokenGrantIdentifier = z$1.infer<typeof zRefreshTokenGrantIdentifier>;
|
|
1151
|
-
//#endregion
|
|
1152
|
-
//#region src/access-token/parse-access-token-request.d.ts
|
|
1153
|
-
interface ParsedAccessTokenPreAuthorizedCodeRequestGrant {
|
|
1154
|
-
grantType: PreAuthorizedCodeGrantIdentifier;
|
|
1155
|
-
preAuthorizedCode: string;
|
|
1156
|
-
txCode?: string;
|
|
1157
|
-
}
|
|
1158
|
-
interface ParsedAccessTokenAuthorizationCodeRequestGrant {
|
|
1159
|
-
grantType: AuthorizationCodeGrantIdentifier;
|
|
1160
|
-
code: string;
|
|
1161
|
-
}
|
|
1162
|
-
interface ParsedAccessTokenRefreshTokenRequestGrant {
|
|
1163
|
-
grantType: RefreshTokenGrantIdentifier;
|
|
1164
|
-
refreshToken: string;
|
|
1165
|
-
}
|
|
1166
|
-
type ParsedAccessTokenRequestGrant = ParsedAccessTokenPreAuthorizedCodeRequestGrant | ParsedAccessTokenAuthorizationCodeRequestGrant | ParsedAccessTokenRefreshTokenRequestGrant;
|
|
1167
|
-
interface ParseAccessTokenRequestResult {
|
|
1168
|
-
accessTokenRequest: AccessTokenRequest;
|
|
1169
|
-
grant: ParsedAccessTokenRequestGrant;
|
|
1170
|
-
/**
|
|
1171
|
-
* The dpop jwt from the access token request headers
|
|
1172
|
-
*/
|
|
1173
|
-
dpop?: {
|
|
1174
|
-
jwt: string;
|
|
1175
|
-
};
|
|
1176
|
-
/**
|
|
1177
|
-
* The client attestation jwts from the access token request headers
|
|
1178
|
-
*/
|
|
1179
|
-
clientAttestation?: {
|
|
1180
|
-
clientAttestationJwt: string;
|
|
1181
|
-
clientAttestationPopJwt: string;
|
|
1182
|
-
};
|
|
1183
|
-
/**
|
|
1184
|
-
* The pkce code verifier from the access token request
|
|
1185
|
-
*/
|
|
1186
|
-
pkceCodeVerifier?: string;
|
|
1187
|
-
}
|
|
1188
|
-
interface ParseAccessTokenRequestOptions {
|
|
1189
|
-
request: RequestLike;
|
|
1190
|
-
/**
|
|
1191
|
-
* The access token request as a JSON object. Your server should decode the
|
|
1192
|
-
* `x-www-url-form-urlencoded` body into an object (e.g. using `bodyParser.urlEncoded()` in express)
|
|
1193
|
-
*/
|
|
1194
|
-
accessTokenRequest: Record<string, unknown>;
|
|
1195
|
-
}
|
|
1196
|
-
//#endregion
|
|
1197
|
-
//#region src/access-token/verify-access-token-request.d.ts
|
|
1198
|
-
interface VerifyAccessTokenRequestDpop {
|
|
1199
|
-
/**
|
|
1200
|
-
* Whether dpop is required
|
|
1201
|
-
*/
|
|
1202
|
-
required?: boolean;
|
|
1203
|
-
/**
|
|
1204
|
-
* The dpop jwt from the access token request
|
|
1205
|
-
*/
|
|
1206
|
-
jwt?: string;
|
|
1207
|
-
/**
|
|
1208
|
-
* The expected jwk thumbprint, and can be used to match a dpop provided in the authorization
|
|
1209
|
-
* request to the dpop key used for the access token request.
|
|
1210
|
-
*/
|
|
1211
|
-
expectedJwkThumbprint?: string;
|
|
1212
|
-
/**
|
|
1213
|
-
* Allowed dpop signing alg values. If not provided
|
|
1214
|
-
* any alg values are allowed and it's up to the `verifyJwtCallback`
|
|
1215
|
-
* to handle the alg.
|
|
1216
|
-
*/
|
|
1217
|
-
allowedSigningAlgs?: string[];
|
|
1218
|
-
}
|
|
1219
|
-
interface VerifyAccessTokenRequestClientAttestation {
|
|
1220
|
-
/**
|
|
1221
|
-
* Whether client attestation is required.
|
|
1222
|
-
*/
|
|
1223
|
-
required?: boolean;
|
|
1224
|
-
/**
|
|
1225
|
-
* Whether to ensure that the key used in client attestation confirmation
|
|
1226
|
-
* is the same key used for DPoP. This only has effect if both DPoP and client
|
|
1227
|
-
* attestations are present.
|
|
1228
|
-
*
|
|
1229
|
-
* @default false
|
|
1230
|
-
*/
|
|
1231
|
-
ensureConfirmationKeyMatchesDpopKey?: boolean;
|
|
1232
|
-
clientAttestationJwt?: string;
|
|
1233
|
-
clientAttestationPopJwt?: string;
|
|
1234
|
-
/**
|
|
1235
|
-
* The expected client id that is bound to the authorization session, and can be used to match the client id
|
|
1236
|
-
* provided in the authorization request to the client used for the access token request.
|
|
1237
|
-
*/
|
|
1238
|
-
expectedClientId?: string;
|
|
1239
|
-
}
|
|
1240
|
-
interface VerifyAccessTokenRequestPkce {
|
|
1241
|
-
codeVerifier?: string;
|
|
1242
|
-
codeChallenge: string;
|
|
1243
|
-
codeChallengeMethod: PkceCodeChallengeMethod;
|
|
1244
|
-
}
|
|
1245
|
-
interface VerifyAccessTokenRequestReturn {
|
|
1246
|
-
dpop?: {
|
|
1247
|
-
/**
|
|
1248
|
-
* base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
|
|
1249
|
-
* of the DPoP public key (in JWK format)
|
|
1250
|
-
*/
|
|
1251
|
-
jwkThumbprint: string;
|
|
1252
|
-
jwk: Jwk;
|
|
1253
|
-
};
|
|
1254
|
-
clientAttestation?: {
|
|
1255
|
-
clientAttestation: VerifiedClientAttestationJwt;
|
|
1256
|
-
clientAttestationPop: VerifiedClientAttestationPopJwt;
|
|
1257
|
-
};
|
|
1258
|
-
}
|
|
1259
|
-
interface VerifyPreAuthorizedCodeAccessTokenRequestOptions {
|
|
1260
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
1261
|
-
grant: ParsedAccessTokenPreAuthorizedCodeRequestGrant;
|
|
1262
|
-
accessTokenRequest: AccessTokenRequest;
|
|
1263
|
-
request: RequestLike;
|
|
1264
|
-
expectedPreAuthorizedCode: string;
|
|
1265
|
-
expectedTxCode?: string;
|
|
1266
|
-
clientAttestation?: VerifyAccessTokenRequestClientAttestation;
|
|
1267
|
-
dpop?: VerifyAccessTokenRequestDpop;
|
|
1268
|
-
pkce?: VerifyAccessTokenRequestPkce;
|
|
1269
|
-
preAuthorizedCodeExpiresAt?: Date;
|
|
1270
|
-
now?: Date;
|
|
1271
|
-
callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
|
|
1272
|
-
}
|
|
1273
|
-
interface VerifyAuthorizationCodeAccessTokenRequestOptions {
|
|
1274
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
1275
|
-
grant: ParsedAccessTokenAuthorizationCodeRequestGrant;
|
|
1276
|
-
accessTokenRequest: AccessTokenRequest;
|
|
1277
|
-
request: RequestLike;
|
|
1278
|
-
expectedCode: string;
|
|
1279
|
-
clientAttestation?: VerifyAccessTokenRequestClientAttestation;
|
|
1280
|
-
dpop?: VerifyAccessTokenRequestDpop;
|
|
1281
|
-
pkce?: VerifyAccessTokenRequestPkce;
|
|
1282
|
-
codeExpiresAt?: Date;
|
|
1283
|
-
now?: Date;
|
|
1284
|
-
callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
|
|
1285
|
-
}
|
|
1286
|
-
interface VerifyRefreshTokenAccessTokenRequestOptions {
|
|
1287
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
1288
|
-
grant: ParsedAccessTokenRefreshTokenRequestGrant;
|
|
1289
|
-
accessTokenRequest: AccessTokenRequest;
|
|
1290
|
-
request: RequestLike;
|
|
1291
|
-
expectedRefreshToken: string;
|
|
1292
|
-
clientAttestation?: VerifyAccessTokenRequestClientAttestation;
|
|
1293
|
-
dpop?: VerifyAccessTokenRequestDpop;
|
|
1294
|
-
pkce?: VerifyAccessTokenRequestPkce;
|
|
1295
|
-
refreshTokenExpiresAt?: Date;
|
|
1296
|
-
now?: Date;
|
|
1297
|
-
callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
|
|
1298
|
-
}
|
|
1299
|
-
//#endregion
|
|
1300
|
-
//#region src/access-token/z-access-token-jwt.d.ts
|
|
1301
|
-
declare const zAccessTokenProfileJwtPayload: z$1.ZodObject<{
|
|
1302
|
-
iss: z$1.ZodString;
|
|
1303
|
-
exp: z$1.ZodNumber;
|
|
1304
|
-
iat: z$1.ZodNumber;
|
|
1305
|
-
aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
|
|
1306
|
-
sub: z$1.ZodString;
|
|
1307
|
-
client_id: z$1.ZodOptional<z$1.ZodString>;
|
|
1308
|
-
jti: z$1.ZodString;
|
|
1309
|
-
scope: z$1.ZodOptional<z$1.ZodString>;
|
|
1310
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
1311
|
-
nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
1312
|
-
cnf: z$1.ZodOptional<z$1.ZodObject<{
|
|
1313
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
1314
|
-
kty: z$1.ZodString;
|
|
1315
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
1316
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
1317
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
1318
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
1319
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
1320
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
1321
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
1322
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
1323
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
1324
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
1325
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
1326
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
1327
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
1328
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
1329
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
1330
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
1331
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
1332
|
-
}, z$1.core.$loose>>>;
|
|
1333
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
1334
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
1335
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
1336
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
1337
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
1338
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
1339
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
1340
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
1341
|
-
}, z$1.core.$loose>>;
|
|
1342
|
-
jkt: z$1.ZodOptional<z$1.ZodString>;
|
|
1343
|
-
}, z$1.core.$loose>>;
|
|
1344
|
-
status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
|
|
1345
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
1346
|
-
}, z$1.core.$loose>;
|
|
1347
|
-
type AccessTokenProfileJwtPayload = z$1.infer<typeof zAccessTokenProfileJwtPayload>;
|
|
1348
|
-
//#endregion
|
|
1349
|
-
//#region src/access-token/z-token-introspection.d.ts
|
|
1350
|
-
declare const zTokenIntrospectionResponse: z$1.ZodObject<{
|
|
1351
|
-
active: z$1.ZodBoolean;
|
|
1352
|
-
scope: z$1.ZodOptional<z$1.ZodString>;
|
|
1353
|
-
client_id: z$1.ZodOptional<z$1.ZodString>;
|
|
1354
|
-
username: z$1.ZodOptional<z$1.ZodString>;
|
|
1355
|
-
token_type: z$1.ZodOptional<z$1.ZodString>;
|
|
1356
|
-
exp: z$1.ZodOptional<z$1.ZodNumber>;
|
|
1357
|
-
iat: z$1.ZodOptional<z$1.ZodNumber>;
|
|
1358
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
1359
|
-
sub: z$1.ZodOptional<z$1.ZodString>;
|
|
1360
|
-
aud: z$1.ZodOptional<z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>>;
|
|
1361
|
-
iss: z$1.ZodOptional<z$1.ZodString>;
|
|
1362
|
-
jti: z$1.ZodOptional<z$1.ZodString>;
|
|
1363
|
-
cnf: z$1.ZodOptional<z$1.ZodObject<{
|
|
1364
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
1365
|
-
kty: z$1.ZodString;
|
|
1366
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
1367
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
1368
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
1369
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
1370
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
1371
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
1372
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
1373
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
1374
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
1375
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
1376
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
1377
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
1378
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
1379
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
1380
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
1381
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
1382
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
1383
|
-
}, z$1.core.$loose>>>;
|
|
1384
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
1385
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
1386
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
1387
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
1388
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
1389
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
1390
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
1391
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
1392
|
-
}, z$1.core.$loose>>;
|
|
1393
|
-
jkt: z$1.ZodOptional<z$1.ZodString>;
|
|
1394
|
-
}, z$1.core.$loose>>;
|
|
1395
|
-
}, z$1.core.$loose>;
|
|
1396
|
-
type TokenIntrospectionResponse = z$1.infer<typeof zTokenIntrospectionResponse>;
|
|
1397
|
-
//#endregion
|
|
1398
|
-
//#region src/authorization-request/parse-authorization-request.d.ts
|
|
1399
|
-
interface ParseAuthorizationRequestResult {
|
|
1400
|
-
/**
|
|
1401
|
-
* The dpop params from the authorization request.
|
|
1402
|
-
*
|
|
1403
|
-
* Both `dpop_jkt` and DPoP header can be included in the request.
|
|
1404
|
-
*
|
|
1405
|
-
* The jkt and the signer of the jwt have not been verified against
|
|
1406
|
-
* each other yet, this only happens during verification
|
|
1407
|
-
*/
|
|
1408
|
-
dpop?: {
|
|
1409
|
-
jwkThumbprint: string;
|
|
1410
|
-
jwt?: string;
|
|
1411
|
-
} | {
|
|
1412
|
-
jwkThumbprint?: string;
|
|
1413
|
-
jwt: string;
|
|
1414
|
-
};
|
|
1415
|
-
/**
|
|
1416
|
-
* The client attestation jwts from the authorization request headers.
|
|
1417
|
-
* These have not been verified yet.
|
|
1418
|
-
*/
|
|
1419
|
-
clientAttestation?: {
|
|
1420
|
-
clientAttestationJwt: string;
|
|
1421
|
-
clientAttestationPopJwt: string;
|
|
1422
|
-
};
|
|
1423
|
-
}
|
|
1424
|
-
//#endregion
|
|
1425
|
-
//#region src/authorization-challenge/z-authorization-challenge.d.ts
|
|
1426
|
-
declare const zAuthorizationChallengeRequest: z$1.ZodObject<{
|
|
1427
|
-
client_id: z$1.ZodOptional<z$1.ZodString>;
|
|
1428
|
-
auth_session: z$1.ZodOptional<z$1.ZodString>;
|
|
1429
|
-
presentation_during_issuance_session: z$1.ZodOptional<z$1.ZodString>;
|
|
1430
|
-
scope: z$1.ZodOptional<z$1.ZodString>;
|
|
1431
|
-
redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
|
|
1432
|
-
resource: z$1.ZodOptional<z$1.ZodURL>;
|
|
1433
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
1434
|
-
issuer_state: z$1.ZodOptional<z$1.ZodString>;
|
|
1435
|
-
dpop_jkt: z$1.ZodOptional<z$1.ZodBase64URL>;
|
|
1436
|
-
code_challenge: z$1.ZodOptional<z$1.ZodString>;
|
|
1437
|
-
code_challenge_method: z$1.ZodOptional<z$1.ZodString>;
|
|
1438
|
-
}, z$1.core.$loose>;
|
|
1439
|
-
type AuthorizationChallengeRequest = z$1.infer<typeof zAuthorizationChallengeRequest>;
|
|
1440
|
-
declare const zAuthorizationChallengeResponse: z$1.ZodObject<{
|
|
1441
|
-
authorization_code: z$1.ZodString;
|
|
1442
|
-
}, z$1.core.$loose>;
|
|
1443
|
-
type AuthorizationChallengeResponse = z$1.infer<typeof zAuthorizationChallengeResponse>;
|
|
1444
|
-
declare const zAuthorizationChallengeErrorResponse: z$1.ZodObject<{
|
|
1445
|
-
auth_session: z$1.ZodOptional<z$1.ZodString>;
|
|
1446
|
-
request_uri: z$1.ZodOptional<z$1.ZodString>;
|
|
1447
|
-
expires_in: z$1.ZodOptional<z$1.ZodNumber>;
|
|
1448
|
-
presentation: z$1.ZodOptional<z$1.ZodString>;
|
|
1449
|
-
error: z$1.ZodUnion<readonly [z$1.ZodEnum<typeof Oauth2ErrorCodes>, z$1.ZodString]>;
|
|
1450
|
-
error_description: z$1.ZodOptional<z$1.ZodString>;
|
|
1451
|
-
error_uri: z$1.ZodOptional<z$1.ZodString>;
|
|
1452
|
-
}, z$1.core.$loose>;
|
|
1453
|
-
type AuthorizationChallengeErrorResponse = z$1.infer<typeof zAuthorizationChallengeErrorResponse>;
|
|
1454
|
-
//#endregion
|
|
1455
|
-
//#region src/authorization-challenge/parse-authorization-challenge-request.d.ts
|
|
1456
|
-
interface ParseAuthorizationChallengeRequestOptions {
|
|
1457
|
-
request: RequestLike;
|
|
1458
|
-
authorizationChallengeRequest: unknown;
|
|
1459
|
-
}
|
|
1460
|
-
interface ParseAuthorizationChallengeRequestResult extends ParseAuthorizationRequestResult {
|
|
1461
|
-
authorizationChallengeRequest: AuthorizationChallengeRequest;
|
|
1462
|
-
}
|
|
1463
|
-
//#endregion
|
|
1464
|
-
//#region src/authorization-request/verify-authorization-request.d.ts
|
|
1465
|
-
interface VerifyAuthorizationRequestDpop {
|
|
1466
|
-
/**
|
|
1467
|
-
* Whether dpop is required.
|
|
1468
|
-
*/
|
|
1469
|
-
required?: boolean;
|
|
1470
|
-
/**
|
|
1471
|
-
* The dpop jwt from the pushed authorization request.
|
|
1472
|
-
*
|
|
1473
|
-
* If dpop is required, at least one of `jwt` or `jwkThumbprint` MUST
|
|
1474
|
-
* be provided. If both are provided, the jwk thumbprints are matched
|
|
1475
|
-
*/
|
|
1476
|
-
jwt?: string;
|
|
1477
|
-
/**
|
|
1478
|
-
* The jwk thumbprint as provided in the `dpop_jkt` parameter.
|
|
1479
|
-
*
|
|
1480
|
-
* If dpop is required, at least one of `jwt` or `jwkThumbprint` MUST
|
|
1481
|
-
* be provided. If both are provided, the jwk thumbprints are matched
|
|
1482
|
-
*/
|
|
1483
|
-
jwkThumbprint?: string;
|
|
1484
|
-
/**
|
|
1485
|
-
* Allowed dpop signing alg values. If not provided
|
|
1486
|
-
* any alg values are allowed and it's up to the `verifyJwtCallback`
|
|
1487
|
-
* to handle the alg.
|
|
1488
|
-
*/
|
|
1489
|
-
allowedSigningAlgs?: string[];
|
|
1490
|
-
}
|
|
1491
|
-
interface VerifyAuthorizationRequestClientAttestation {
|
|
1492
|
-
/**
|
|
1493
|
-
* Whether client attestation is required.
|
|
1494
|
-
*/
|
|
1495
|
-
required?: boolean;
|
|
1496
|
-
/**
|
|
1497
|
-
* Whether to ensure that the key used in client attestation confirmation
|
|
1498
|
-
* is the same key used for DPoP. This only has effect if both DPoP and client
|
|
1499
|
-
* attestations are present.
|
|
1500
|
-
*
|
|
1501
|
-
* @default false
|
|
1502
|
-
*/
|
|
1503
|
-
ensureConfirmationKeyMatchesDpopKey?: boolean;
|
|
1504
|
-
clientAttestationJwt?: string;
|
|
1505
|
-
clientAttestationPopJwt?: string;
|
|
1506
|
-
}
|
|
1507
|
-
interface VerifyAuthorizationRequestReturn {
|
|
1508
|
-
dpop?: {
|
|
1509
|
-
/**
|
|
1510
|
-
* base64url encoding of the JWK SHA-256 Thumbprint (according to [RFC7638])
|
|
1511
|
-
* of the DPoP public key (in JWK format).
|
|
1512
|
-
*
|
|
1513
|
-
* This will always be returned if dpop is used for the PAR endpoint
|
|
1514
|
-
*/
|
|
1515
|
-
jwkThumbprint: string;
|
|
1516
|
-
/**
|
|
1517
|
-
* The JWK will be returned if a DPoP proof was provided in the header.
|
|
1518
|
-
*/
|
|
1519
|
-
jwk?: Jwk;
|
|
1520
|
-
};
|
|
1521
|
-
/**
|
|
1522
|
-
* The verified client attestation if any were provided.
|
|
1523
|
-
*/
|
|
1524
|
-
clientAttestation?: {
|
|
1525
|
-
clientAttestation: VerifiedClientAttestationJwt;
|
|
1526
|
-
clientAttestationPop: VerifiedClientAttestationPopJwt;
|
|
1527
|
-
};
|
|
1528
|
-
}
|
|
1529
|
-
interface VerifyAuthorizationRequestOptions {
|
|
1530
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
1531
|
-
authorizationRequest: {
|
|
1532
|
-
client_id?: string;
|
|
1533
|
-
};
|
|
1534
|
-
request: RequestLike;
|
|
1535
|
-
dpop?: VerifyAuthorizationRequestDpop;
|
|
1536
|
-
clientAttestation?: VerifyAuthorizationRequestClientAttestation;
|
|
1537
|
-
/**
|
|
1538
|
-
* Date to use for expiration. If not provided current date will be used.
|
|
1539
|
-
*/
|
|
1540
|
-
now?: Date;
|
|
1541
|
-
callbacks: Pick<CallbackContext, 'hash' | 'verifyJwt'>;
|
|
1542
|
-
}
|
|
1543
|
-
//#endregion
|
|
1544
|
-
//#region src/authorization-challenge/verify-authorization-challenge-request.d.ts
|
|
1545
|
-
type VerifyAuthorizationChallengeRequestReturn = VerifyAuthorizationRequestReturn;
|
|
1546
|
-
interface VerifyAuthorizationChallengeRequestOptions extends Omit<VerifyAuthorizationRequestOptions, 'authorizationRequest'> {
|
|
1547
|
-
authorizationChallengeRequest: AuthorizationChallengeRequest;
|
|
1548
|
-
}
|
|
1549
|
-
//#endregion
|
|
1550
|
-
//#region src/authorization-request/create-authorization-request.d.ts
|
|
1551
|
-
interface CreateAuthorizationRequestUrlOptions {
|
|
1552
|
-
/**
|
|
1553
|
-
* Callback context mostly for crypto related functionality
|
|
1554
|
-
*/
|
|
1555
|
-
callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt' | 'clientAuthentication'>;
|
|
1556
|
-
/**
|
|
1557
|
-
* Metadata of the authorization server for which to create the authorization request url
|
|
1558
|
-
*/
|
|
1559
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
1560
|
-
/**
|
|
1561
|
-
* The client id to use for the authorization request.
|
|
1562
|
-
*
|
|
1563
|
-
* For authorization requests the `client_id` is ALWAYS required, even if client authentication is used
|
|
1564
|
-
* (which differs from the token endpoint). This should match with the client_id that will be used for
|
|
1565
|
-
* client authentication
|
|
1566
|
-
*/
|
|
1567
|
-
clientId: string;
|
|
1568
|
-
/**
|
|
1569
|
-
* Scope to request for the authorization request
|
|
1570
|
-
*/
|
|
1571
|
-
scope?: string;
|
|
1572
|
-
/**
|
|
1573
|
-
* State for the authorization request
|
|
1574
|
-
*/
|
|
1575
|
-
state?: string;
|
|
1576
|
-
/**
|
|
1577
|
-
* The resource to which access is being requested. This can help the authorization
|
|
1578
|
-
* server in determining the resource server to handle the authorization request for
|
|
1579
|
-
*/
|
|
1580
|
-
resource?: string;
|
|
1581
|
-
/**
|
|
1582
|
-
* Redirect uri to include in the authorization request
|
|
1583
|
-
*/
|
|
1584
|
-
redirectUri?: string;
|
|
1585
|
-
/**
|
|
1586
|
-
* Additional payload to include in the authorization request. Items will be encoded and sent
|
|
1587
|
-
* using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
|
|
1588
|
-
*/
|
|
1589
|
-
additionalRequestPayload?: Record<string, unknown>;
|
|
1590
|
-
/**
|
|
1591
|
-
* Code verifier to use for pkce. If not provided a value will generated when pkce is supported
|
|
1592
|
-
*/
|
|
1593
|
-
pkceCodeVerifier?: string;
|
|
1594
|
-
/**
|
|
1595
|
-
* DPoP options
|
|
1596
|
-
*
|
|
1597
|
-
* If PAR is not used only the `dpop_jkt` property will be included in the request
|
|
1598
|
-
*/
|
|
1599
|
-
dpop?: RequestDpopOptions;
|
|
1600
|
-
}
|
|
1601
|
-
//#endregion
|
|
1602
|
-
//#region src/authorization-request/create-pushed-authorization-response.d.ts
|
|
1603
|
-
interface CreatePushedAuthorizationResponseOptions {
|
|
1604
|
-
/**
|
|
1605
|
-
* The request uri where the client should redirect to
|
|
1606
|
-
*/
|
|
1607
|
-
requestUri: string;
|
|
1608
|
-
/**
|
|
1609
|
-
* Number of seconds after which the `requestUri` will expire.
|
|
1610
|
-
*/
|
|
1611
|
-
expiresInSeconds: number;
|
|
1612
|
-
/**
|
|
1613
|
-
* Additional payload to include in the pushed authorization response.
|
|
1614
|
-
*/
|
|
1615
|
-
additionalPayload?: Record<string, unknown>;
|
|
1616
|
-
}
|
|
1617
|
-
interface CreatePushedAuthorizationErrorResponseOptions {
|
|
1618
|
-
/**
|
|
1619
|
-
* The pushed authorization error
|
|
1620
|
-
*/
|
|
1621
|
-
error: StringWithAutoCompletion<Oauth2ErrorCodes>;
|
|
1622
|
-
/**
|
|
1623
|
-
* Optional error description
|
|
1624
|
-
*/
|
|
1625
|
-
errorDescription?: string;
|
|
1626
|
-
/**
|
|
1627
|
-
* Additional payload to include in the pushed authorization error response.
|
|
1628
|
-
*/
|
|
1629
|
-
additionalPayload?: Record<string, unknown>;
|
|
1630
|
-
}
|
|
1631
|
-
//#endregion
|
|
1632
|
-
//#region src/authorization-request/z-authorization-request.d.ts
|
|
1633
|
-
declare const zPushedAuthorizationRequestUriPrefix: z$1.ZodLiteral<"urn:ietf:params:oauth:request_uri:">;
|
|
1634
|
-
declare const pushedAuthorizationRequestUriPrefix: "urn:ietf:params:oauth:request_uri:";
|
|
1635
|
-
type PushedAuthorizationRequestUriPrefix = z$1.infer<typeof zPushedAuthorizationRequestUriPrefix>;
|
|
1636
|
-
declare const zAuthorizationRequest: z$1.ZodObject<{
|
|
1637
|
-
response_type: z$1.ZodString;
|
|
1638
|
-
client_id: z$1.ZodString;
|
|
1639
|
-
issuer_state: z$1.ZodOptional<z$1.ZodString>;
|
|
1640
|
-
redirect_uri: z$1.ZodOptional<z$1.ZodURL>;
|
|
1641
|
-
resource: z$1.ZodOptional<z$1.ZodURL>;
|
|
1642
|
-
scope: z$1.ZodOptional<z$1.ZodString>;
|
|
1643
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
1644
|
-
dpop_jkt: z$1.ZodOptional<z$1.ZodBase64URL>;
|
|
1645
|
-
code_challenge: z$1.ZodOptional<z$1.ZodString>;
|
|
1646
|
-
code_challenge_method: z$1.ZodOptional<z$1.ZodString>;
|
|
1647
|
-
}, z$1.core.$loose>;
|
|
1648
|
-
type AuthorizationRequest = z$1.infer<typeof zAuthorizationRequest>;
|
|
1649
|
-
//#endregion
|
|
1650
|
-
//#region src/authorization-request/parse-pushed-authorization-request.d.ts
|
|
1651
|
-
interface ParsePushedAuthorizationRequestOptions {
|
|
1652
|
-
request: RequestLike;
|
|
1653
|
-
authorizationRequest: unknown;
|
|
1654
|
-
callbacks: Pick<CallbackContext, 'fetch'>;
|
|
1655
|
-
}
|
|
1656
|
-
interface ParsePushedAuthorizationRequestResult extends ParseAuthorizationRequestResult {
|
|
1657
|
-
authorizationRequest: AuthorizationRequest;
|
|
1658
|
-
/**
|
|
1659
|
-
* The JWT-secured request object, if the request was pushed as a JAR.
|
|
1660
|
-
* May be undefined if the request object is not a JAR.
|
|
1661
|
-
*/
|
|
1662
|
-
authorizationRequestJwt?: string;
|
|
1663
|
-
}
|
|
1664
|
-
interface ParsePushedAuthorizationRequestUriReferenceValueOptions {
|
|
1665
|
-
uri: string;
|
|
1666
|
-
}
|
|
1667
|
-
/**
|
|
1668
|
-
* Parse a pushed authorization request URI prefixed with `urn:ietf:params:oauth:request_uri:`
|
|
1669
|
-
* and returns the identifier, without the prefix.
|
|
1670
|
-
*
|
|
1671
|
-
* @throws {Oauth2ServerErrorResponseError}
|
|
1672
|
-
*/
|
|
1673
|
-
declare function parsePushedAuthorizationRequestUriReferenceValue(options: ParsePushedAuthorizationRequestUriReferenceValueOptions): string;
|
|
1674
|
-
//#endregion
|
|
1675
|
-
//#region src/common/jwt/decode-jwt.d.ts
|
|
1676
|
-
interface DecodeJwtOptions<HeaderSchema extends BaseSchema | undefined, PayloadSchema extends BaseSchema | undefined> {
|
|
1677
|
-
/**
|
|
1678
|
-
* The comapct encoded jwt
|
|
1679
|
-
*/
|
|
1680
|
-
jwt: string;
|
|
1681
|
-
/**
|
|
1682
|
-
* Schema to use for validating the header. If not provided the
|
|
1683
|
-
* default `zJwtHeader` schema will be used
|
|
1684
|
-
*/
|
|
1685
|
-
headerSchema?: HeaderSchema;
|
|
1686
|
-
/**
|
|
1687
|
-
* Schema to use for validating the payload. If not provided the
|
|
1688
|
-
* default `zJwtPayload` schema will be used
|
|
1689
|
-
*/
|
|
1690
|
-
payloadSchema?: PayloadSchema;
|
|
1691
|
-
}
|
|
1692
|
-
type DecodeJwtResult<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined> = {
|
|
1693
|
-
header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
|
|
1694
|
-
payload: InferSchemaOrDefaultOutput<PayloadSchema, typeof zJwtPayload>;
|
|
1695
|
-
signature: string;
|
|
1696
|
-
compact: string;
|
|
1697
|
-
};
|
|
1698
|
-
declare function decodeJwt<HeaderSchema extends BaseSchema | undefined = undefined, PayloadSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtOptions<HeaderSchema, PayloadSchema>): DecodeJwtResult<HeaderSchema, PayloadSchema>;
|
|
1699
|
-
declare function jwtHeaderFromJwtSigner(signer: JwtSigner): {
|
|
1700
|
-
readonly alg: string;
|
|
1701
|
-
readonly kid: string;
|
|
1702
|
-
readonly trust_chain?: undefined;
|
|
1703
|
-
readonly jwk?: undefined;
|
|
1704
|
-
readonly x5c?: undefined;
|
|
1705
|
-
} | {
|
|
1706
|
-
readonly alg: string;
|
|
1707
|
-
readonly kid: string;
|
|
1708
|
-
readonly trust_chain: [string, ...string[]] | undefined;
|
|
1709
|
-
readonly jwk?: undefined;
|
|
1710
|
-
readonly x5c?: undefined;
|
|
1711
|
-
} | {
|
|
1712
|
-
readonly alg: string;
|
|
1713
|
-
readonly jwk: {
|
|
1714
|
-
[x: string]: unknown;
|
|
1715
|
-
kty: string;
|
|
1716
|
-
crv?: string | undefined;
|
|
1717
|
-
x?: string | undefined;
|
|
1718
|
-
y?: string | undefined;
|
|
1719
|
-
e?: string | undefined;
|
|
1720
|
-
n?: string | undefined;
|
|
1721
|
-
alg?: string | undefined;
|
|
1722
|
-
d?: string | undefined;
|
|
1723
|
-
dp?: string | undefined;
|
|
1724
|
-
dq?: string | undefined;
|
|
1725
|
-
ext?: boolean | undefined;
|
|
1726
|
-
k?: string | undefined;
|
|
1727
|
-
key_ops?: string[] | undefined;
|
|
1728
|
-
kid?: string | undefined;
|
|
1729
|
-
oth?: {
|
|
1730
|
-
[x: string]: unknown;
|
|
1731
|
-
d?: string | undefined;
|
|
1732
|
-
r?: string | undefined;
|
|
1733
|
-
t?: string | undefined;
|
|
1734
|
-
}[] | undefined;
|
|
1735
|
-
p?: string | undefined;
|
|
1736
|
-
q?: string | undefined;
|
|
1737
|
-
qi?: string | undefined;
|
|
1738
|
-
use?: string | undefined;
|
|
1739
|
-
x5c?: string[] | undefined;
|
|
1740
|
-
x5t?: string | undefined;
|
|
1741
|
-
'x5t#S256'?: string | undefined;
|
|
1742
|
-
x5u?: string | undefined;
|
|
1743
|
-
};
|
|
1744
|
-
readonly kid?: undefined;
|
|
1745
|
-
readonly trust_chain?: undefined;
|
|
1746
|
-
readonly x5c?: undefined;
|
|
1747
|
-
} | {
|
|
1748
|
-
readonly alg: string;
|
|
1749
|
-
readonly x5c: string[];
|
|
1750
|
-
readonly kid?: undefined;
|
|
1751
|
-
readonly trust_chain?: undefined;
|
|
1752
|
-
readonly jwk?: undefined;
|
|
1753
|
-
} | {
|
|
1754
|
-
alg: string;
|
|
1755
|
-
readonly kid?: undefined;
|
|
1756
|
-
readonly trust_chain?: undefined;
|
|
1757
|
-
readonly jwk?: undefined;
|
|
1758
|
-
readonly x5c?: undefined;
|
|
1759
|
-
};
|
|
1760
|
-
declare function jwtSignerFromJwt({
|
|
1761
|
-
header,
|
|
1762
|
-
payload,
|
|
1763
|
-
allowedSignerMethods
|
|
1764
|
-
}: Pick<DecodeJwtResult, 'header' | 'payload'> & {
|
|
1765
|
-
allowedSignerMethods?: JwtSigner['method'][];
|
|
1766
|
-
}): JwtSigner;
|
|
1767
|
-
type IsSchemaProvided<T> = T extends undefined ? false : true;
|
|
1768
|
-
type InferSchemaOrDefaultOutput<ProvidedSchema extends BaseSchema | undefined, DefaultSchema extends BaseSchema> = IsSchemaProvided<ProvidedSchema> extends true ? ProvidedSchema extends BaseSchema ? z$1.infer<ProvidedSchema> : never : z$1.infer<DefaultSchema>;
|
|
1769
|
-
//#endregion
|
|
1770
|
-
//#region src/jar/z-jar-authorization-request.d.ts
|
|
1771
|
-
declare const zJarAuthorizationRequest: z.ZodObject<{
|
|
1772
|
-
request: z.ZodOptional<z.ZodString>;
|
|
1773
|
-
request_uri: z.ZodOptional<z.ZodURL>;
|
|
1774
|
-
client_id: z.ZodOptional<z.ZodString>;
|
|
1775
|
-
}, z.core.$loose>;
|
|
1776
|
-
type JarAuthorizationRequest = z.infer<typeof zJarAuthorizationRequest>;
|
|
1777
|
-
declare function validateJarRequestParams(options: {
|
|
1778
|
-
jarRequestParams: JarAuthorizationRequest;
|
|
1779
|
-
}): JarAuthorizationRequest & ({
|
|
1780
|
-
request_uri: string;
|
|
1781
|
-
request?: never;
|
|
1782
|
-
} | {
|
|
1783
|
-
request: string;
|
|
1784
|
-
request_uri?: never;
|
|
1785
|
-
});
|
|
1786
|
-
//#endregion
|
|
1787
|
-
//#region src/jar/z-jar-request-object.d.ts
|
|
1788
|
-
declare const zJarRequestObjectPayload: z.ZodObject<{
|
|
1789
|
-
client_id: z.ZodString;
|
|
1790
|
-
iss: z.ZodOptional<z.ZodString>;
|
|
1791
|
-
aud: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
|
|
1792
|
-
iat: z.ZodOptional<z.ZodNumber>;
|
|
1793
|
-
exp: z.ZodOptional<z.ZodNumber>;
|
|
1794
|
-
nbf: z.ZodOptional<z.ZodNumber>;
|
|
1795
|
-
nonce: z.ZodOptional<z.ZodString>;
|
|
1796
|
-
jti: z.ZodOptional<z.ZodString>;
|
|
1797
|
-
sub: z.ZodOptional<z.ZodString>;
|
|
1798
|
-
cnf: z.ZodOptional<z.ZodObject<{
|
|
1799
|
-
jwk: z.ZodOptional<z.ZodObject<{
|
|
1800
|
-
kty: z.ZodString;
|
|
1801
|
-
crv: z.ZodOptional<z.ZodString>;
|
|
1802
|
-
x: z.ZodOptional<z.ZodString>;
|
|
1803
|
-
y: z.ZodOptional<z.ZodString>;
|
|
1804
|
-
e: z.ZodOptional<z.ZodString>;
|
|
1805
|
-
n: z.ZodOptional<z.ZodString>;
|
|
1806
|
-
alg: z.ZodOptional<z.ZodString>;
|
|
1807
|
-
d: z.ZodOptional<z.ZodString>;
|
|
1808
|
-
dp: z.ZodOptional<z.ZodString>;
|
|
1809
|
-
dq: z.ZodOptional<z.ZodString>;
|
|
1810
|
-
ext: z.ZodOptional<z.ZodBoolean>;
|
|
1811
|
-
k: z.ZodOptional<z.ZodString>;
|
|
1812
|
-
key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
1813
|
-
kid: z.ZodOptional<z.ZodString>;
|
|
1814
|
-
oth: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
1815
|
-
d: z.ZodOptional<z.ZodString>;
|
|
1816
|
-
r: z.ZodOptional<z.ZodString>;
|
|
1817
|
-
t: z.ZodOptional<z.ZodString>;
|
|
1818
|
-
}, z.core.$loose>>>;
|
|
1819
|
-
p: z.ZodOptional<z.ZodString>;
|
|
1820
|
-
q: z.ZodOptional<z.ZodString>;
|
|
1821
|
-
qi: z.ZodOptional<z.ZodString>;
|
|
1822
|
-
use: z.ZodOptional<z.ZodString>;
|
|
1823
|
-
x5c: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
1824
|
-
x5t: z.ZodOptional<z.ZodString>;
|
|
1825
|
-
'x5t#S256': z.ZodOptional<z.ZodString>;
|
|
1826
|
-
x5u: z.ZodOptional<z.ZodString>;
|
|
1827
|
-
}, z.core.$loose>>;
|
|
1828
|
-
jkt: z.ZodOptional<z.ZodString>;
|
|
1829
|
-
}, z.core.$loose>>;
|
|
1830
|
-
status: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
|
|
1831
|
-
trust_chain: z.ZodOptional<z.ZodTuple<[z.ZodString], z.ZodString>>;
|
|
1832
|
-
}, z.core.$loose>;
|
|
1833
|
-
type JarRequestObjectPayload = z.infer<typeof zJarRequestObjectPayload>;
|
|
1834
|
-
declare const signedAuthorizationRequestJwtHeaderTyp: "oauth-authz-req+jwt";
|
|
1835
|
-
declare const jwtAuthorizationRequestJwtHeaderTyp: "jwt";
|
|
1836
|
-
//#endregion
|
|
1837
|
-
//#region src/jar/handle-jar-request/verify-jar-request.d.ts
|
|
1838
|
-
interface VerifiedJarRequest {
|
|
1839
|
-
authorizationRequestPayload: JarRequestObjectPayload;
|
|
1840
|
-
signer: JwtSignerWithJwk;
|
|
1841
|
-
jwt: ReturnType<typeof decodeJwt<undefined, typeof zJarRequestObjectPayload>>;
|
|
1842
|
-
}
|
|
1843
|
-
//#endregion
|
|
1844
|
-
//#region src/authorization-request/verify-pushed-authorization-request.d.ts
|
|
1845
|
-
interface VerifyPushedAuthorizationRequestReturn extends VerifyAuthorizationRequestReturn {
|
|
1846
|
-
/**
|
|
1847
|
-
* The verified JAR request, if `authorizationRequestJwt` was provided
|
|
1848
|
-
*/
|
|
1849
|
-
jar?: VerifiedJarRequest;
|
|
1850
|
-
}
|
|
1851
|
-
interface VerifyPushedAuthorizationRequestOptions extends VerifyAuthorizationRequestOptions {
|
|
1852
|
-
/**
|
|
1853
|
-
* The authorization request JWT to verify. If this value was returned from `parsePushedAuthorizationRequest`
|
|
1854
|
-
* you MUST provide this value to ensure the JWT is verified.
|
|
1855
|
-
*/
|
|
1856
|
-
authorizationRequestJwt?: {
|
|
1857
|
-
jwt: string;
|
|
1858
|
-
signer: JwtSigner;
|
|
1859
|
-
};
|
|
1860
|
-
}
|
|
1861
|
-
//#endregion
|
|
1862
|
-
//#region src/authorization-response/z-authorization-response.d.ts
|
|
1863
|
-
declare const zAuthorizationResponse: z$1.ZodObject<{
|
|
1864
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
1865
|
-
code: z$1.ZodString;
|
|
1866
|
-
error: z$1.ZodOptional<z$1.ZodNever>;
|
|
1867
|
-
}, z$1.core.$loose>;
|
|
1868
|
-
declare const zAuthorizationResponseFromUriParams: z$1.ZodPipe<z$1.ZodPipe<z$1.ZodURL, z$1.ZodTransform<unknown, string>>, z$1.ZodObject<{
|
|
1869
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
1870
|
-
code: z$1.ZodString;
|
|
1871
|
-
error: z$1.ZodOptional<z$1.ZodNever>;
|
|
1872
|
-
}, z$1.core.$loose>>;
|
|
1873
|
-
type AuthorizationResponse = z$1.infer<typeof zAuthorizationResponse>;
|
|
1874
|
-
declare const zAuthorizationErrorResponse: z$1.ZodObject<{
|
|
1875
|
-
state: z$1.ZodOptional<z$1.ZodString>;
|
|
1876
|
-
code: z$1.ZodOptional<z$1.ZodNever>;
|
|
1877
|
-
error: z$1.ZodUnion<readonly [z$1.ZodEnum<typeof Oauth2ErrorCodes>, z$1.ZodString]>;
|
|
1878
|
-
error_description: z$1.ZodOptional<z$1.ZodString>;
|
|
1879
|
-
error_uri: z$1.ZodOptional<z$1.ZodString>;
|
|
1880
|
-
}, z$1.core.$loose>;
|
|
1881
|
-
type AuthorizationErrorResponse = z$1.infer<typeof zAuthorizationErrorResponse>;
|
|
1882
|
-
//#endregion
|
|
1883
|
-
//#region src/authorization-response/parse-authorization-response.d.ts
|
|
1884
|
-
interface ParseAuthorizationRequestOptions {
|
|
1885
|
-
url: string;
|
|
1886
|
-
}
|
|
1887
|
-
/**
|
|
1888
|
-
* Parse an authorization response redirect URL.
|
|
1889
|
-
*
|
|
1890
|
-
* @throws {Oauth2ServerErrorResponseError}
|
|
1891
|
-
*/
|
|
1892
|
-
declare function parseAuthorizationResponseRedirectUrl(options: ParseAuthorizationRequestOptions): AuthorizationResponse | AuthorizationErrorResponse;
|
|
1893
|
-
//#endregion
|
|
1894
|
-
//#region src/common/algorithm/algorithm-transform.d.ts
|
|
1895
|
-
/**
|
|
1896
|
-
* Algorithm transformation utilities for JWA and COSE
|
|
1897
|
-
*
|
|
1898
|
-
* This module provides utilities to transform between JWA (JSON Web Algorithms)
|
|
1899
|
-
* signature algorithm identifiers and fully-specified COSE (CBOR Object Signing and Encryption)
|
|
1900
|
-
* algorithm identifiers.
|
|
1901
|
-
*
|
|
1902
|
-
* Based on RFC 9864: Fully-Specified Algorithms for JOSE and COSE
|
|
1903
|
-
* https://www.rfc-editor.org/rfc/rfc9864.html
|
|
1904
|
-
*/
|
|
1905
|
-
/**
|
|
1906
|
-
* JWA (JSON Web Algorithms) signature algorithm identifiers
|
|
1907
|
-
*
|
|
1908
|
-
* From RFC 7518 (JWA) and RFC 9864 (Fully-Specified Algorithms)
|
|
1909
|
-
*/
|
|
1910
|
-
declare enum JwaSignatureAlgorithm {
|
|
1911
|
-
Ed25519 = "Ed25519",
|
|
1912
|
-
Ed448 = "Ed448",
|
|
1913
|
-
EdDSA = "EdDSA",
|
|
1914
|
-
ES256 = "ES256",
|
|
1915
|
-
ES384 = "ES384",
|
|
1916
|
-
ES512 = "ES512",
|
|
1917
|
-
ES256K = "ES256K",
|
|
1918
|
-
RS256 = "RS256",
|
|
1919
|
-
RS384 = "RS384",
|
|
1920
|
-
RS512 = "RS512",
|
|
1921
|
-
PS256 = "PS256",
|
|
1922
|
-
PS384 = "PS384",
|
|
1923
|
-
PS512 = "PS512",
|
|
1924
|
-
}
|
|
1925
|
-
/**
|
|
1926
|
-
* Mapping of COSE algorithm identifiers to JWA signature algorithm identifiers
|
|
1927
|
-
*
|
|
1928
|
-
* This is the inverse of JWA_SIGNATURE_TO_COSE_ALGORITHM_MAP, with additional entries
|
|
1929
|
-
* for deprecated polymorphic COSE algorithms that should be avoided.
|
|
1930
|
-
*/
|
|
1931
|
-
declare const COSE_TO_JWA_SIGNATURE_ALGORITHM_MAP: {
|
|
1932
|
-
readonly [-19]: JwaSignatureAlgorithm.Ed25519;
|
|
1933
|
-
readonly [-53]: JwaSignatureAlgorithm.Ed448;
|
|
1934
|
-
readonly [-8]: JwaSignatureAlgorithm.Ed25519;
|
|
1935
|
-
readonly [-9]: JwaSignatureAlgorithm.ES256;
|
|
1936
|
-
readonly [-51]: JwaSignatureAlgorithm.ES384;
|
|
1937
|
-
readonly [-52]: JwaSignatureAlgorithm.ES512;
|
|
1938
|
-
readonly [-47]: JwaSignatureAlgorithm.ES256K;
|
|
1939
|
-
readonly [-7]: JwaSignatureAlgorithm.ES256;
|
|
1940
|
-
readonly [-35]: JwaSignatureAlgorithm.ES384;
|
|
1941
|
-
readonly [-36]: JwaSignatureAlgorithm.ES512;
|
|
1942
|
-
readonly [-257]: JwaSignatureAlgorithm.RS256;
|
|
1943
|
-
readonly [-258]: JwaSignatureAlgorithm.RS384;
|
|
1944
|
-
readonly [-259]: JwaSignatureAlgorithm.RS512;
|
|
1945
|
-
readonly [-37]: JwaSignatureAlgorithm.PS256;
|
|
1946
|
-
readonly [-38]: JwaSignatureAlgorithm.PS384;
|
|
1947
|
-
readonly [-39]: JwaSignatureAlgorithm.PS512;
|
|
1948
|
-
};
|
|
1949
|
-
type CoseAlgorithmIdentifier = keyof typeof COSE_TO_JWA_SIGNATURE_ALGORITHM_MAP;
|
|
1950
|
-
type JwaSignatureAlgorithmIdentifier = `${JwaSignatureAlgorithm}`;
|
|
1951
|
-
/**
|
|
1952
|
-
* Transform a JWA signature algorithm identifier to an RFC 9864 fully-specified COSE algorithm identifier
|
|
1953
|
-
*
|
|
1954
|
-
* @param jwaAlg - JWA signature algorithm identifier (e.g., 'Ed25519', 'ES256')
|
|
1955
|
-
* @returns Fully-specified COSE algorithm identifier (e.g., -19, -9) or undefined if not mappable
|
|
1956
|
-
*
|
|
1957
|
-
* @example
|
|
1958
|
-
* ```typescript
|
|
1959
|
-
* const coseAlg = jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm('Ed25519') // Returns -19
|
|
1960
|
-
* const coseAlg = jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm('ES256') // Returns -9 (ESP256)
|
|
1961
|
-
* ```
|
|
1962
|
-
*/
|
|
1963
|
-
declare function jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm(jwaAlg: string): CoseAlgorithmIdentifier | undefined;
|
|
1964
|
-
/**
|
|
1965
|
-
* Transform a COSE algorithm identifier (either RFC 9864 fully-specified, or polymorphic) to a JWA signature algorithm identifier
|
|
1966
|
-
*
|
|
1967
|
-
* @param coseAlg - COSE algorithm identifier (e.g., -19, -9)
|
|
1968
|
-
* @returns JWA signature algorithm identifier (e.g., 'Ed25519', 'ES256') or undefined if not mappable
|
|
1969
|
-
*
|
|
1970
|
-
* @example
|
|
1971
|
-
* ```typescript
|
|
1972
|
-
* const jwaAlg = fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm(-19) // Returns 'Ed25519'
|
|
1973
|
-
* const jwaAlg = fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm(-9) // Returns 'ES256'
|
|
1974
|
-
* const jwaAlg = fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm(-7) // Returns 'ES256' (deprecated polymorphic COSE ES256)
|
|
1975
|
-
* ```
|
|
1976
|
-
*/
|
|
1977
|
-
declare function fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm(coseAlg: number): JwaSignatureAlgorithmIdentifier | undefined;
|
|
1978
|
-
/**
|
|
1979
|
-
* Transform an array of JWA signature algorithm identifiers to RFC 9864 fully-specified COSE algorithm identifiers.
|
|
1980
|
-
*
|
|
1981
|
-
* By default it filters out unmappable algorithms. You can also choose to throw an error when an unknown
|
|
1982
|
-
* algorithm is detected.
|
|
1983
|
-
*
|
|
1984
|
-
* @param jwaAlgs - Array of JWA signature algorithm identifiers
|
|
1985
|
-
* @returns Array of fully-specified COSE algorithm identifiers
|
|
1986
|
-
*
|
|
1987
|
-
* @example
|
|
1988
|
-
* ```typescript
|
|
1989
|
-
* const coseAlgs = jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray(['Ed25519', 'ES256', 'Unknown'])
|
|
1990
|
-
* // Returns [-19, -9]
|
|
1991
|
-
* ```
|
|
1992
|
-
*/
|
|
1993
|
-
declare function jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray(jwaAlgs: string[], throwOnUnknownValue?: boolean): CoseAlgorithmIdentifier[];
|
|
1994
|
-
/**
|
|
1995
|
-
* Transform an array of COSE algorithm identifiers (either RFC 9864 fully-specified or polymorphic) to JWA signature algorithm identifiers
|
|
1996
|
-
*
|
|
1997
|
-
* By default it filters out unmappable algorithms. You can also choose to throw an error when an unknown
|
|
1998
|
-
* algorithm is detected.
|
|
1999
|
-
*
|
|
2000
|
-
* @param coseAlgs - Array of COSE algorithm identifiers
|
|
2001
|
-
* @returns Array of JWA signature algorithm identifiers
|
|
2002
|
-
*
|
|
2003
|
-
* @example
|
|
2004
|
-
* ```typescript
|
|
2005
|
-
* const jwaAlgs = fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray([-19, -9, 999])
|
|
2006
|
-
* // Returns ['Ed25519', 'ES256']
|
|
2007
|
-
* ```
|
|
2008
|
-
*/
|
|
2009
|
-
declare function fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray(coseAlgs: number[], throwOnUnknownValue?: boolean): JwaSignatureAlgorithmIdentifier[];
|
|
2010
|
-
//#endregion
|
|
2011
|
-
//#region src/common/jwk/jwk-thumbprint.d.ts
|
|
2012
|
-
interface CalculateJwkThumbprintOptions {
|
|
2013
|
-
/**
|
|
2014
|
-
* The jwk to calcualte the thumbprint for.
|
|
2015
|
-
*/
|
|
2016
|
-
jwk: Jwk;
|
|
2017
|
-
/**
|
|
2018
|
-
* The hashing algorithm to use for calculating the thumbprint
|
|
2019
|
-
*/
|
|
2020
|
-
hashAlgorithm: HashAlgorithm;
|
|
2021
|
-
/**
|
|
2022
|
-
* The hash callback to calculate the digest
|
|
2023
|
-
*/
|
|
2024
|
-
hashCallback: HashCallback;
|
|
2025
|
-
}
|
|
2026
|
-
declare function calculateJwkThumbprint(options: CalculateJwkThumbprintOptions): Promise<string>;
|
|
2027
|
-
//#endregion
|
|
2028
|
-
//#region src/common/jwk/jwks.d.ts
|
|
2029
|
-
declare function isJwkInSet({
|
|
2030
|
-
jwk,
|
|
2031
|
-
jwks,
|
|
2032
|
-
callbacks
|
|
2033
|
-
}: {
|
|
2034
|
-
jwk: Jwk;
|
|
2035
|
-
jwks: Jwk[];
|
|
2036
|
-
callbacks: Pick<CallbackContext, 'hash'>;
|
|
2037
|
-
}): Promise<boolean>;
|
|
2038
|
-
//#endregion
|
|
2039
|
-
//#region src/common/jwt/decode-jwt-header.d.ts
|
|
2040
|
-
interface DecodeJwtHeaderOptions<HeaderSchema extends BaseSchema | undefined> {
|
|
2041
|
-
/**
|
|
2042
|
-
* The comapct encoded jwt
|
|
2043
|
-
*/
|
|
2044
|
-
jwt: string;
|
|
2045
|
-
/**
|
|
2046
|
-
* Schema to use for validating the header. If not provided the
|
|
2047
|
-
* default `vJwtHeader` schema will be used
|
|
2048
|
-
*/
|
|
2049
|
-
headerSchema?: HeaderSchema;
|
|
2050
|
-
}
|
|
2051
|
-
type DecodeJwtHeaderResult<HeaderSchema extends BaseSchema | undefined = undefined> = {
|
|
2052
|
-
header: InferSchemaOrDefaultOutput<HeaderSchema, typeof zJwtHeader>;
|
|
2053
|
-
};
|
|
2054
|
-
declare function decodeJwtHeader<HeaderSchema extends BaseSchema | undefined = undefined>(options: DecodeJwtHeaderOptions<HeaderSchema>): DecodeJwtHeaderResult<HeaderSchema>;
|
|
2055
|
-
//#endregion
|
|
2056
|
-
//#region src/common/jwt/verify-jwt.d.ts
|
|
2057
|
-
interface VerifyJwtOptions {
|
|
2058
|
-
/**
|
|
2059
|
-
* Compact jwt
|
|
2060
|
-
*/
|
|
2061
|
-
compact: string;
|
|
2062
|
-
/**
|
|
2063
|
-
* Header of the jwt
|
|
2064
|
-
*/
|
|
2065
|
-
header: JwtHeader;
|
|
2066
|
-
/**
|
|
2067
|
-
* Payload of the jwt.
|
|
2068
|
-
*/
|
|
2069
|
-
payload: JwtPayload;
|
|
2070
|
-
/**
|
|
2071
|
-
* If not provided current time will be used.
|
|
2072
|
-
*
|
|
2073
|
-
* @default new Date()
|
|
2074
|
-
*/
|
|
2075
|
-
now?: Date;
|
|
2076
|
-
/**
|
|
2077
|
-
* Whether to skip time based validation of `nbf` and `exp`.
|
|
2078
|
-
* @default false
|
|
2079
|
-
*/
|
|
2080
|
-
skipTimeBasedValidation?: boolean;
|
|
2081
|
-
/**
|
|
2082
|
-
* Callback to verify jwt signature
|
|
2083
|
-
*/
|
|
2084
|
-
verifyJwtCallback: VerifyJwtCallback;
|
|
2085
|
-
/**
|
|
2086
|
-
* Signer of the jwt
|
|
2087
|
-
*/
|
|
2088
|
-
signer: JwtSigner;
|
|
2089
|
-
/**
|
|
2090
|
-
* Custom error message
|
|
2091
|
-
*/
|
|
2092
|
-
errorMessage?: string;
|
|
2093
|
-
/**
|
|
2094
|
-
* Allowed skew time in seconds for validity of token. Used for `exp` and `nbf`
|
|
2095
|
-
* verification.
|
|
2096
|
-
*
|
|
2097
|
-
* @default 0
|
|
2098
|
-
*/
|
|
2099
|
-
allowedSkewInSeconds?: number;
|
|
2100
|
-
/**
|
|
2101
|
-
* Expected value for the 'aud' claim
|
|
2102
|
-
*/
|
|
2103
|
-
expectedAudience?: string;
|
|
2104
|
-
/**
|
|
2105
|
-
* Expected value for the 'iss' claim
|
|
2106
|
-
*/
|
|
2107
|
-
expectedIssuer?: string;
|
|
2108
|
-
/**
|
|
2109
|
-
* Expected value for the 'nonce' claim
|
|
2110
|
-
*/
|
|
2111
|
-
expectedNonce?: string;
|
|
2112
|
-
/**
|
|
2113
|
-
* Expected value for the 'sub' claim
|
|
2114
|
-
*/
|
|
2115
|
-
expectedSubject?: string;
|
|
2116
|
-
/**
|
|
2117
|
-
* The claims that are required to be present in the jwt.
|
|
2118
|
-
*/
|
|
2119
|
-
requiredClaims?: string[];
|
|
2120
|
-
}
|
|
2121
|
-
interface VerifyJwtReturn {
|
|
2122
|
-
signer: JwtSignerWithJwk;
|
|
2123
|
-
}
|
|
2124
|
-
declare function verifyJwt(options: VerifyJwtOptions): Promise<VerifyJwtReturn>;
|
|
2125
|
-
//#endregion
|
|
2126
|
-
//#region src/common/jwt/z-jwe.d.ts
|
|
2127
|
-
declare const zCompactJwe: z.ZodString;
|
|
2128
|
-
//#endregion
|
|
2129
|
-
//#region src/error/Oauth2Error.d.ts
|
|
2130
|
-
interface Oauth2ErrorOptions {
|
|
2131
|
-
cause?: unknown;
|
|
2132
|
-
}
|
|
2133
|
-
declare class Oauth2Error extends Error {
|
|
2134
|
-
readonly cause?: unknown;
|
|
2135
|
-
constructor(message?: string, options?: Oauth2ErrorOptions);
|
|
2136
|
-
}
|
|
2137
|
-
//#endregion
|
|
2138
|
-
//#region src/error/Oauth2ClientErrorResponseError.d.ts
|
|
2139
|
-
declare class Oauth2ClientErrorResponseError extends Oauth2Error {
|
|
2140
|
-
readonly errorResponse: Oauth2ErrorResponse;
|
|
2141
|
-
readonly response: FetchResponse;
|
|
2142
|
-
constructor(message: string, errorResponse: Oauth2ErrorResponse, response: FetchResponse);
|
|
2143
|
-
}
|
|
2144
|
-
//#endregion
|
|
2145
|
-
//#region src/error/Oauth2ClientAuthorizationChallengeError.d.ts
|
|
2146
|
-
declare class Oauth2ClientAuthorizationChallengeError extends Oauth2ClientErrorResponseError {
|
|
2147
|
-
readonly errorResponse: AuthorizationChallengeErrorResponse;
|
|
2148
|
-
constructor(message: string, errorResponse: AuthorizationChallengeErrorResponse, response: FetchResponse);
|
|
2149
|
-
}
|
|
2150
|
-
//#endregion
|
|
2151
|
-
//#region src/error/Oauth2JwtParseError.d.ts
|
|
2152
|
-
declare class Oauth2JwtParseError extends Oauth2Error {
|
|
2153
|
-
constructor(message?: string);
|
|
2154
|
-
}
|
|
2155
|
-
//#endregion
|
|
2156
|
-
//#region src/error/Oauth2JwtVerificationError.d.ts
|
|
2157
|
-
declare class Oauth2JwtVerificationError extends Oauth2Error {
|
|
2158
|
-
constructor(message?: string, options?: Oauth2ErrorOptions);
|
|
2159
|
-
}
|
|
2160
|
-
//#endregion
|
|
2161
|
-
//#region src/error/Oauth2ResourceUnauthorizedError.d.ts
|
|
2162
|
-
interface WwwAuthenticateHeaderChallenge {
|
|
2163
|
-
scheme: SupportedAuthenticationScheme | (string & {});
|
|
2164
|
-
/**
|
|
2165
|
-
* Space delimited scope value that lists scopes required
|
|
2166
|
-
* to access this resource.
|
|
2167
|
-
*/
|
|
2168
|
-
scope?: string;
|
|
2169
|
-
/**
|
|
2170
|
-
* Error should only be undefined if no access token was provided at all
|
|
2171
|
-
*/
|
|
2172
|
-
error?: Oauth2ErrorCodes | string;
|
|
2173
|
-
error_description?: string;
|
|
2174
|
-
/**
|
|
2175
|
-
* Additional payload items to include in the Www-Authenticate
|
|
2176
|
-
* header response.
|
|
2177
|
-
*/
|
|
2178
|
-
additionalPayload?: Record<string, string>;
|
|
2179
|
-
}
|
|
2180
|
-
declare class Oauth2ResourceUnauthorizedError extends Oauth2Error {
|
|
2181
|
-
readonly wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge[];
|
|
2182
|
-
constructor(internalMessage: string | undefined, wwwAuthenticateHeaders: WwwAuthenticateHeaderChallenge | Array<WwwAuthenticateHeaderChallenge>);
|
|
2183
|
-
static fromHeaderValue(value: string): Oauth2ResourceUnauthorizedError;
|
|
2184
|
-
toHeaderValue(): string;
|
|
2185
|
-
}
|
|
2186
|
-
//#endregion
|
|
2187
|
-
//#region src/error/Oauth2ServerErrorResponseError.d.ts
|
|
2188
|
-
interface Oauth2ServerErrorResponseErrorOptions extends Oauth2ErrorOptions {
|
|
2189
|
-
internalMessage?: string;
|
|
2190
|
-
/**
|
|
2191
|
-
* @default 400
|
|
2192
|
-
*/
|
|
2193
|
-
status?: number;
|
|
2194
|
-
}
|
|
2195
|
-
declare class Oauth2ServerErrorResponseError extends Oauth2Error {
|
|
2196
|
-
readonly errorResponse: Oauth2ErrorResponse;
|
|
2197
|
-
readonly status: number;
|
|
2198
|
-
constructor(errorResponse: Oauth2ErrorResponse, options?: Oauth2ServerErrorResponseErrorOptions);
|
|
2199
|
-
}
|
|
2200
|
-
//#endregion
|
|
2201
|
-
//#region src/id-token/verify-id-token.d.ts
|
|
2202
|
-
interface VerifyIdTokenJwtOptions {
|
|
2203
|
-
/**
|
|
2204
|
-
* The compact id token.
|
|
2205
|
-
*/
|
|
2206
|
-
idToken: string;
|
|
2207
|
-
/**
|
|
2208
|
-
* Callbacks used for verifying the id token
|
|
2209
|
-
*/
|
|
2210
|
-
callbacks: Pick<CallbackContext, 'verifyJwt' | 'fetch'>;
|
|
2211
|
-
/**
|
|
2212
|
-
* If not provided current time will be used
|
|
2213
|
-
*/
|
|
2214
|
-
now?: Date;
|
|
2215
|
-
/**
|
|
2216
|
-
* Authorization server metadata
|
|
2217
|
-
*/
|
|
2218
|
-
authorizationServer: AuthorizationServerMetadata;
|
|
2219
|
-
/**
|
|
2220
|
-
* The client_id of the Relying Party for which the token was issued.
|
|
2221
|
-
*/
|
|
2222
|
-
clientId: string;
|
|
2223
|
-
/**
|
|
2224
|
-
* Expected nonce in the payload. If not provided the nonce won't be validated.
|
|
2225
|
-
*/
|
|
2226
|
-
expectedNonce?: string;
|
|
2227
|
-
}
|
|
2228
|
-
/**
|
|
2229
|
-
* Verify an ID Token JWT.
|
|
2230
|
-
*/
|
|
2231
|
-
declare function verifyIdTokenJwt(options: VerifyIdTokenJwtOptions): Promise<{
|
|
2232
|
-
header: {
|
|
2233
|
-
[x: string]: unknown;
|
|
2234
|
-
alg: string;
|
|
2235
|
-
typ?: string | undefined;
|
|
2236
|
-
kid?: string | undefined;
|
|
2237
|
-
jwk?: {
|
|
2238
|
-
[x: string]: unknown;
|
|
2239
|
-
kty: string;
|
|
2240
|
-
crv?: string | undefined;
|
|
2241
|
-
x?: string | undefined;
|
|
2242
|
-
y?: string | undefined;
|
|
2243
|
-
e?: string | undefined;
|
|
2244
|
-
n?: string | undefined;
|
|
2245
|
-
alg?: string | undefined;
|
|
2246
|
-
d?: string | undefined;
|
|
2247
|
-
dp?: string | undefined;
|
|
2248
|
-
dq?: string | undefined;
|
|
2249
|
-
ext?: boolean | undefined;
|
|
2250
|
-
k?: string | undefined;
|
|
2251
|
-
key_ops?: string[] | undefined;
|
|
2252
|
-
kid?: string | undefined;
|
|
2253
|
-
oth?: {
|
|
2254
|
-
[x: string]: unknown;
|
|
2255
|
-
d?: string | undefined;
|
|
2256
|
-
r?: string | undefined;
|
|
2257
|
-
t?: string | undefined;
|
|
2258
|
-
}[] | undefined;
|
|
2259
|
-
p?: string | undefined;
|
|
2260
|
-
q?: string | undefined;
|
|
2261
|
-
qi?: string | undefined;
|
|
2262
|
-
use?: string | undefined;
|
|
2263
|
-
x5c?: string[] | undefined;
|
|
2264
|
-
x5t?: string | undefined;
|
|
2265
|
-
'x5t#S256'?: string | undefined;
|
|
2266
|
-
x5u?: string | undefined;
|
|
2267
|
-
} | undefined;
|
|
2268
|
-
x5c?: string[] | undefined;
|
|
2269
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
2270
|
-
};
|
|
2271
|
-
payload: {
|
|
2272
|
-
[x: string]: unknown;
|
|
2273
|
-
iss: string;
|
|
2274
|
-
sub: string;
|
|
2275
|
-
aud: string | string[];
|
|
2276
|
-
exp: number;
|
|
2277
|
-
iat: number;
|
|
2278
|
-
auth_time?: number | undefined;
|
|
2279
|
-
acr?: string | undefined;
|
|
2280
|
-
amr?: string[] | undefined;
|
|
2281
|
-
azp?: string | undefined;
|
|
2282
|
-
name?: string | undefined;
|
|
2283
|
-
given_name?: string | undefined;
|
|
2284
|
-
family_name?: string | undefined;
|
|
2285
|
-
middle_name?: string | undefined;
|
|
2286
|
-
nickname?: string | undefined;
|
|
2287
|
-
preferred_username?: string | undefined;
|
|
2288
|
-
profile?: string | undefined;
|
|
2289
|
-
picture?: string | undefined;
|
|
2290
|
-
website?: string | undefined;
|
|
2291
|
-
email?: string | undefined;
|
|
2292
|
-
email_verified?: boolean | undefined;
|
|
2293
|
-
gender?: string | undefined;
|
|
2294
|
-
birthdate?: string | undefined;
|
|
2295
|
-
zoneinfo?: string | undefined;
|
|
2296
|
-
locale?: string | undefined;
|
|
2297
|
-
phone_number?: string | undefined;
|
|
2298
|
-
phone_number_verified?: boolean | undefined;
|
|
2299
|
-
address?: {
|
|
2300
|
-
[x: string]: unknown;
|
|
2301
|
-
formatted?: string | undefined;
|
|
2302
|
-
street_address?: string | undefined;
|
|
2303
|
-
locality?: string | undefined;
|
|
2304
|
-
region?: string | undefined;
|
|
2305
|
-
postal_code?: string | undefined;
|
|
2306
|
-
country?: string | undefined;
|
|
2307
|
-
} | undefined;
|
|
2308
|
-
updated_at?: number | undefined;
|
|
2309
|
-
nbf?: number | undefined;
|
|
2310
|
-
nonce?: string | undefined;
|
|
2311
|
-
jti?: string | undefined;
|
|
2312
|
-
cnf?: {
|
|
2313
|
-
[x: string]: unknown;
|
|
2314
|
-
jwk?: {
|
|
2315
|
-
[x: string]: unknown;
|
|
2316
|
-
kty: string;
|
|
2317
|
-
crv?: string | undefined;
|
|
2318
|
-
x?: string | undefined;
|
|
2319
|
-
y?: string | undefined;
|
|
2320
|
-
e?: string | undefined;
|
|
2321
|
-
n?: string | undefined;
|
|
2322
|
-
alg?: string | undefined;
|
|
2323
|
-
d?: string | undefined;
|
|
2324
|
-
dp?: string | undefined;
|
|
2325
|
-
dq?: string | undefined;
|
|
2326
|
-
ext?: boolean | undefined;
|
|
2327
|
-
k?: string | undefined;
|
|
2328
|
-
key_ops?: string[] | undefined;
|
|
2329
|
-
kid?: string | undefined;
|
|
2330
|
-
oth?: {
|
|
2331
|
-
[x: string]: unknown;
|
|
2332
|
-
d?: string | undefined;
|
|
2333
|
-
r?: string | undefined;
|
|
2334
|
-
t?: string | undefined;
|
|
2335
|
-
}[] | undefined;
|
|
2336
|
-
p?: string | undefined;
|
|
2337
|
-
q?: string | undefined;
|
|
2338
|
-
qi?: string | undefined;
|
|
2339
|
-
use?: string | undefined;
|
|
2340
|
-
x5c?: string[] | undefined;
|
|
2341
|
-
x5t?: string | undefined;
|
|
2342
|
-
'x5t#S256'?: string | undefined;
|
|
2343
|
-
x5u?: string | undefined;
|
|
2344
|
-
} | undefined;
|
|
2345
|
-
jkt?: string | undefined;
|
|
2346
|
-
} | undefined;
|
|
2347
|
-
status?: Record<string, any> | undefined;
|
|
2348
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
2349
|
-
};
|
|
2350
|
-
}>;
|
|
2351
|
-
//#endregion
|
|
2352
|
-
//#region src/id-token/z-id-token-jwt.d.ts
|
|
2353
|
-
declare const zIdTokenJwtHeader: z$1.ZodObject<{
|
|
2354
|
-
alg: z$1.ZodString;
|
|
2355
|
-
typ: z$1.ZodOptional<z$1.ZodString>;
|
|
2356
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
2357
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
2358
|
-
kty: z$1.ZodString;
|
|
2359
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
2360
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
2361
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
2362
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
2363
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
2364
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
2365
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
2366
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
2367
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
2368
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
2369
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
2370
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2371
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
2372
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
2373
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
2374
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
2375
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
2376
|
-
}, z$1.core.$loose>>>;
|
|
2377
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
2378
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
2379
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
2380
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
2381
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2382
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
2383
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
2384
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
2385
|
-
}, z$1.core.$loose>>;
|
|
2386
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2387
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
2388
|
-
}, z$1.core.$loose>;
|
|
2389
|
-
type IdTokenJwtHeader = z$1.infer<typeof zIdTokenJwtHeader>;
|
|
2390
|
-
declare const zIdTokenJwtPayload: z$1.ZodObject<{
|
|
2391
|
-
iss: z$1.ZodString;
|
|
2392
|
-
sub: z$1.ZodString;
|
|
2393
|
-
aud: z$1.ZodUnion<readonly [z$1.ZodString, z$1.ZodArray<z$1.ZodString>]>;
|
|
2394
|
-
exp: z$1.ZodNumber;
|
|
2395
|
-
iat: z$1.ZodNumber;
|
|
2396
|
-
auth_time: z$1.ZodOptional<z$1.ZodNumber>;
|
|
2397
|
-
acr: z$1.ZodOptional<z$1.ZodString>;
|
|
2398
|
-
amr: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2399
|
-
azp: z$1.ZodOptional<z$1.ZodString>;
|
|
2400
|
-
name: z$1.ZodOptional<z$1.ZodString>;
|
|
2401
|
-
given_name: z$1.ZodOptional<z$1.ZodString>;
|
|
2402
|
-
family_name: z$1.ZodOptional<z$1.ZodString>;
|
|
2403
|
-
middle_name: z$1.ZodOptional<z$1.ZodString>;
|
|
2404
|
-
nickname: z$1.ZodOptional<z$1.ZodString>;
|
|
2405
|
-
preferred_username: z$1.ZodOptional<z$1.ZodString>;
|
|
2406
|
-
profile: z$1.ZodOptional<z$1.ZodURL>;
|
|
2407
|
-
picture: z$1.ZodOptional<z$1.ZodURL>;
|
|
2408
|
-
website: z$1.ZodOptional<z$1.ZodURL>;
|
|
2409
|
-
email: z$1.ZodOptional<z$1.ZodEmail>;
|
|
2410
|
-
email_verified: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
2411
|
-
gender: z$1.ZodOptional<z$1.ZodUnion<[z$1.ZodEnum<{
|
|
2412
|
-
male: "male";
|
|
2413
|
-
female: "female";
|
|
2414
|
-
}>, z$1.ZodString]>>;
|
|
2415
|
-
birthdate: z$1.ZodOptional<z$1.ZodISODate>;
|
|
2416
|
-
zoneinfo: z$1.ZodOptional<z$1.ZodString>;
|
|
2417
|
-
locale: z$1.ZodOptional<z$1.ZodString>;
|
|
2418
|
-
phone_number: z$1.ZodOptional<z$1.ZodString>;
|
|
2419
|
-
phone_number_verified: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
2420
|
-
address: z$1.ZodOptional<z$1.ZodObject<{
|
|
2421
|
-
formatted: z$1.ZodOptional<z$1.ZodString>;
|
|
2422
|
-
street_address: z$1.ZodOptional<z$1.ZodString>;
|
|
2423
|
-
locality: z$1.ZodOptional<z$1.ZodString>;
|
|
2424
|
-
region: z$1.ZodOptional<z$1.ZodString>;
|
|
2425
|
-
postal_code: z$1.ZodOptional<z$1.ZodString>;
|
|
2426
|
-
country: z$1.ZodOptional<z$1.ZodString>;
|
|
2427
|
-
}, z$1.core.$loose>>;
|
|
2428
|
-
updated_at: z$1.ZodOptional<z$1.ZodNumber>;
|
|
2429
|
-
nbf: z$1.ZodOptional<z$1.ZodNumber>;
|
|
2430
|
-
nonce: z$1.ZodOptional<z$1.ZodString>;
|
|
2431
|
-
jti: z$1.ZodOptional<z$1.ZodString>;
|
|
2432
|
-
cnf: z$1.ZodOptional<z$1.ZodObject<{
|
|
2433
|
-
jwk: z$1.ZodOptional<z$1.ZodObject<{
|
|
2434
|
-
kty: z$1.ZodString;
|
|
2435
|
-
crv: z$1.ZodOptional<z$1.ZodString>;
|
|
2436
|
-
x: z$1.ZodOptional<z$1.ZodString>;
|
|
2437
|
-
y: z$1.ZodOptional<z$1.ZodString>;
|
|
2438
|
-
e: z$1.ZodOptional<z$1.ZodString>;
|
|
2439
|
-
n: z$1.ZodOptional<z$1.ZodString>;
|
|
2440
|
-
alg: z$1.ZodOptional<z$1.ZodString>;
|
|
2441
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
2442
|
-
dp: z$1.ZodOptional<z$1.ZodString>;
|
|
2443
|
-
dq: z$1.ZodOptional<z$1.ZodString>;
|
|
2444
|
-
ext: z$1.ZodOptional<z$1.ZodBoolean>;
|
|
2445
|
-
k: z$1.ZodOptional<z$1.ZodString>;
|
|
2446
|
-
key_ops: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2447
|
-
kid: z$1.ZodOptional<z$1.ZodString>;
|
|
2448
|
-
oth: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
|
|
2449
|
-
d: z$1.ZodOptional<z$1.ZodString>;
|
|
2450
|
-
r: z$1.ZodOptional<z$1.ZodString>;
|
|
2451
|
-
t: z$1.ZodOptional<z$1.ZodString>;
|
|
2452
|
-
}, z$1.core.$loose>>>;
|
|
2453
|
-
p: z$1.ZodOptional<z$1.ZodString>;
|
|
2454
|
-
q: z$1.ZodOptional<z$1.ZodString>;
|
|
2455
|
-
qi: z$1.ZodOptional<z$1.ZodString>;
|
|
2456
|
-
use: z$1.ZodOptional<z$1.ZodString>;
|
|
2457
|
-
x5c: z$1.ZodOptional<z$1.ZodArray<z$1.ZodString>>;
|
|
2458
|
-
x5t: z$1.ZodOptional<z$1.ZodString>;
|
|
2459
|
-
'x5t#S256': z$1.ZodOptional<z$1.ZodString>;
|
|
2460
|
-
x5u: z$1.ZodOptional<z$1.ZodString>;
|
|
2461
|
-
}, z$1.core.$loose>>;
|
|
2462
|
-
jkt: z$1.ZodOptional<z$1.ZodString>;
|
|
2463
|
-
}, z$1.core.$loose>>;
|
|
2464
|
-
status: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodAny>>;
|
|
2465
|
-
trust_chain: z$1.ZodOptional<z$1.ZodTuple<[z$1.ZodString], z$1.ZodString>>;
|
|
2466
|
-
}, z$1.core.$loose>;
|
|
2467
|
-
type IdTokenJwtPayload = z$1.infer<typeof zIdTokenJwtPayload>;
|
|
2468
|
-
//#endregion
|
|
2469
|
-
//#region src/jar/create-jar-authorization-request.d.ts
|
|
2470
|
-
interface CreateJarAuthorizationRequestOptions {
|
|
2471
|
-
authorizationRequestPayload: JwtPayload & {
|
|
2472
|
-
client_id?: string;
|
|
2473
|
-
};
|
|
2474
|
-
requestUri?: string;
|
|
2475
|
-
jwtSigner: JwtSigner;
|
|
2476
|
-
jweEncryptor?: JweEncryptor;
|
|
2477
|
-
callbacks: Pick<CallbackContext, 'signJwt' | 'encryptJwe'>;
|
|
2478
|
-
/**
|
|
2479
|
-
* Number of seconds after which the signed authorization request will expire
|
|
2480
|
-
*/
|
|
2481
|
-
expiresInSeconds: number;
|
|
2482
|
-
/**
|
|
2483
|
-
* Date that should be used as now. If not provided current date will be used.
|
|
2484
|
-
*/
|
|
2485
|
-
now?: Date;
|
|
2486
|
-
additionalJwtPayload?: Record<string, unknown>;
|
|
2487
|
-
}
|
|
2488
|
-
/**
|
|
2489
|
-
* Creates a JAR (JWT Authorization Request) request object.
|
|
2490
|
-
*
|
|
2491
|
-
* @param options - The input parameters
|
|
2492
|
-
* @param options.authorizationRequestPayload - The authorization request parameters
|
|
2493
|
-
* @param options.jwtSigner - The JWT signer
|
|
2494
|
-
* @param options.jweEncryptor - The JWE encryptor (optional) if provided, the request object will be encrypted
|
|
2495
|
-
* @param options.requestUri - The request URI (optional) if provided, the request object needs to be fetched from the URI
|
|
2496
|
-
* @param options.callbacks - The callback context
|
|
2497
|
-
* @returns the requestParams, signerJwk, encryptionJwk, and requestObjectJwt
|
|
2498
|
-
*/
|
|
2499
|
-
declare function createJarAuthorizationRequest(options: CreateJarAuthorizationRequestOptions): Promise<{
|
|
2500
|
-
jarAuthorizationRequest: {
|
|
2501
|
-
[x: string]: unknown;
|
|
2502
|
-
request?: string | undefined;
|
|
2503
|
-
request_uri?: string | undefined;
|
|
2504
|
-
client_id?: string | undefined;
|
|
2505
|
-
};
|
|
2506
|
-
signerJwk: {
|
|
2507
|
-
[x: string]: unknown;
|
|
2508
|
-
kty: string;
|
|
2509
|
-
crv?: string | undefined;
|
|
2510
|
-
x?: string | undefined;
|
|
2511
|
-
y?: string | undefined;
|
|
2512
|
-
e?: string | undefined;
|
|
2513
|
-
n?: string | undefined;
|
|
2514
|
-
alg?: string | undefined;
|
|
2515
|
-
d?: string | undefined;
|
|
2516
|
-
dp?: string | undefined;
|
|
2517
|
-
dq?: string | undefined;
|
|
2518
|
-
ext?: boolean | undefined;
|
|
2519
|
-
k?: string | undefined;
|
|
2520
|
-
key_ops?: string[] | undefined;
|
|
2521
|
-
kid?: string | undefined;
|
|
2522
|
-
oth?: {
|
|
2523
|
-
[x: string]: unknown;
|
|
2524
|
-
d?: string | undefined;
|
|
2525
|
-
r?: string | undefined;
|
|
2526
|
-
t?: string | undefined;
|
|
2527
|
-
}[] | undefined;
|
|
2528
|
-
p?: string | undefined;
|
|
2529
|
-
q?: string | undefined;
|
|
2530
|
-
qi?: string | undefined;
|
|
2531
|
-
use?: string | undefined;
|
|
2532
|
-
x5c?: string[] | undefined;
|
|
2533
|
-
x5t?: string | undefined;
|
|
2534
|
-
'x5t#S256'?: string | undefined;
|
|
2535
|
-
x5u?: string | undefined;
|
|
2536
|
-
};
|
|
2537
|
-
encryptionJwk: {
|
|
2538
|
-
[x: string]: unknown;
|
|
2539
|
-
kty: string;
|
|
2540
|
-
crv?: string | undefined;
|
|
2541
|
-
x?: string | undefined;
|
|
2542
|
-
y?: string | undefined;
|
|
2543
|
-
e?: string | undefined;
|
|
2544
|
-
n?: string | undefined;
|
|
2545
|
-
alg?: string | undefined;
|
|
2546
|
-
d?: string | undefined;
|
|
2547
|
-
dp?: string | undefined;
|
|
2548
|
-
dq?: string | undefined;
|
|
2549
|
-
ext?: boolean | undefined;
|
|
2550
|
-
k?: string | undefined;
|
|
2551
|
-
key_ops?: string[] | undefined;
|
|
2552
|
-
kid?: string | undefined;
|
|
2553
|
-
oth?: {
|
|
2554
|
-
[x: string]: unknown;
|
|
2555
|
-
d?: string | undefined;
|
|
2556
|
-
r?: string | undefined;
|
|
2557
|
-
t?: string | undefined;
|
|
2558
|
-
}[] | undefined;
|
|
2559
|
-
p?: string | undefined;
|
|
2560
|
-
q?: string | undefined;
|
|
2561
|
-
qi?: string | undefined;
|
|
2562
|
-
use?: string | undefined;
|
|
2563
|
-
x5c?: string[] | undefined;
|
|
2564
|
-
x5t?: string | undefined;
|
|
2565
|
-
'x5t#S256'?: string | undefined;
|
|
2566
|
-
x5u?: string | undefined;
|
|
2567
|
-
} | undefined;
|
|
2568
|
-
authorizationRequestJwt: string;
|
|
2569
|
-
}>;
|
|
2570
|
-
//#endregion
|
|
2571
|
-
//#region src/metadata/authorization-server/authorization-server-metadata.d.ts
|
|
2572
|
-
/**
|
|
2573
|
-
* fetch authorization server metadata. It first tries to fetch the oauth-authorization-server metadata. If that returns
|
|
2574
|
-
* a 404, the openid-configuration metadata will be fetched.
|
|
2575
|
-
*/
|
|
2576
|
-
declare function fetchAuthorizationServerMetadata(issuer: string, fetch?: Fetch): Promise<AuthorizationServerMetadata | null>;
|
|
2577
|
-
declare function getAuthorizationServerMetadataFromList(authorizationServersMetadata: AuthorizationServerMetadata[], issuer: string): {
|
|
2578
|
-
[x: string]: unknown;
|
|
2579
|
-
issuer: string;
|
|
2580
|
-
token_endpoint: string;
|
|
2581
|
-
token_endpoint_auth_methods_supported?: string[] | undefined;
|
|
2582
|
-
authorization_endpoint?: string | undefined;
|
|
2583
|
-
jwks_uri?: string | undefined;
|
|
2584
|
-
grant_types_supported?: string[] | undefined;
|
|
2585
|
-
code_challenge_methods_supported?: string[] | undefined;
|
|
2586
|
-
dpop_signing_alg_values_supported?: string[] | undefined;
|
|
2587
|
-
require_pushed_authorization_requests?: boolean | undefined;
|
|
2588
|
-
pushed_authorization_request_endpoint?: string | undefined;
|
|
2589
|
-
introspection_endpoint?: string | undefined;
|
|
2590
|
-
introspection_endpoint_auth_methods_supported?: string[] | undefined;
|
|
2591
|
-
introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
|
|
2592
|
-
authorization_challenge_endpoint?: string | undefined;
|
|
2593
|
-
'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
|
|
2594
|
-
client_attestation_pop_nonce_required?: boolean | undefined;
|
|
2595
|
-
};
|
|
2596
|
-
//#endregion
|
|
2597
|
-
//#region src/metadata/fetch-jwks-uri.d.ts
|
|
2598
|
-
/**
|
|
2599
|
-
* Fetch JWKs from a provided JWKs URI.
|
|
2600
|
-
*
|
|
2601
|
-
* Returns validated metadata if successful response
|
|
2602
|
-
* Throws error otherwise
|
|
2603
|
-
*
|
|
2604
|
-
* @throws {ValidationError} if successful response but validation of response failed
|
|
2605
|
-
* @throws {InvalidFetchResponseError} if unsuccesful response
|
|
2606
|
-
*/
|
|
2607
|
-
declare function fetchJwks(jwksUrl: string, fetch?: Fetch): Promise<JwkSet>;
|
|
2608
|
-
//#endregion
|
|
2609
|
-
//#region src/metadata/fetch-well-known-metadata.d.ts
|
|
2610
|
-
interface FetchWellKnownMetadataOptions {
|
|
2611
|
-
/**
|
|
2612
|
-
* Custom fetch implementation to use for fetching the metadata
|
|
2613
|
-
*/
|
|
2614
|
-
fetch?: Fetch;
|
|
2615
|
-
/**
|
|
2616
|
-
* The accepted content types. If not provided a default of `ContentType.Json`
|
|
2617
|
-
* will be used. This will be used for the `Accept` header, as well as verified
|
|
2618
|
-
* against the `Content-Type` response header.
|
|
2619
|
-
*/
|
|
2620
|
-
acceptedContentType?: [ContentType, ...ContentType[]];
|
|
2621
|
-
}
|
|
2622
|
-
/**
|
|
2623
|
-
* Fetch well known metadata and validate the response.
|
|
2624
|
-
*
|
|
2625
|
-
* Returns null if 404 is returned
|
|
2626
|
-
* Returns validated metadata if successful response
|
|
2627
|
-
* Throws error otherwise
|
|
2628
|
-
*
|
|
2629
|
-
* @throws {ValidationError} if successful response but validation of response failed
|
|
2630
|
-
* @throws {InvalidFetchResponseError} if no successful or 404 response
|
|
2631
|
-
* @throws {Error} if parsing json from response fails
|
|
2632
|
-
*/
|
|
2633
|
-
declare function fetchWellKnownMetadata<Schema extends BaseSchema>(wellKnownMetadataUrl: string, schema: Schema, options?: FetchWellKnownMetadataOptions): Promise<z$1.infer<Schema> | null>;
|
|
2634
|
-
//#endregion
|
|
2635
|
-
//#region src/access-token/create-access-token.d.ts
|
|
2636
|
-
interface CreateAccessTokenOptions {
|
|
2637
|
-
callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom' | 'hash'>;
|
|
2638
|
-
/**
|
|
2639
|
-
* public dpop jwk key. Will be encoded as jwk thumbprint in the `cnf.jkt` claim.
|
|
2640
|
-
*/
|
|
2641
|
-
dpop?: {
|
|
2642
|
-
jwk: Jwk;
|
|
2643
|
-
};
|
|
2644
|
-
/**
|
|
2645
|
-
* scope of the access token. If the authorization request included scopes
|
|
2646
|
-
* they should be added to the access token as well
|
|
2647
|
-
*/
|
|
2648
|
-
scope?: string;
|
|
2649
|
-
/**
|
|
2650
|
-
* Client id to which the access token is bound.
|
|
2651
|
-
* Can be undefined in case of anonymous access using pre authorized code flow
|
|
2652
|
-
*/
|
|
2653
|
-
clientId?: string;
|
|
2654
|
-
/**
|
|
2655
|
-
* The authorization server that issues the access token
|
|
2656
|
-
*/
|
|
2657
|
-
authorizationServer: string;
|
|
2658
|
-
/**
|
|
2659
|
-
* Signer of the access token
|
|
2660
|
-
*/
|
|
2661
|
-
signer: JwtSigner;
|
|
2662
|
-
/**
|
|
2663
|
-
* Number of seconds after which the token will expire
|
|
2664
|
-
*/
|
|
2665
|
-
expiresInSeconds: number;
|
|
2666
|
-
/**
|
|
2667
|
-
* The audience of the access token. Should be the `resource` if included in the authorization request
|
|
2668
|
-
*/
|
|
2669
|
-
audience: string;
|
|
2670
|
-
/**
|
|
2671
|
-
* The subject of the access token. When a resource owner is involved,
|
|
2672
|
-
* it should be an identifier for the resource owner.
|
|
2673
|
-
*/
|
|
2674
|
-
subject: string;
|
|
2675
|
-
/**
|
|
2676
|
-
* Date that should be used as now. If not provided current date will be used.
|
|
2677
|
-
*/
|
|
2678
|
-
now?: Date;
|
|
2679
|
-
/**
|
|
2680
|
-
* Additional payload claims to include in the access token JWT.
|
|
2681
|
-
* Will override existing claims so you can override default behaviour, but be careful.
|
|
2682
|
-
*/
|
|
2683
|
-
additionalPayload?: Record<string, unknown>;
|
|
2684
|
-
}
|
|
2685
|
-
//#endregion
|
|
2686
|
-
//#region src/access-token/create-access-token-response.d.ts
|
|
2687
|
-
interface CreateAccessTokenResponseOptions {
|
|
2688
|
-
callbacks: Pick<CallbackContext, 'signJwt' | 'generateRandom' | 'hash'>;
|
|
2689
|
-
/**
|
|
2690
|
-
* The access token
|
|
2691
|
-
*/
|
|
2692
|
-
accessToken: string;
|
|
2693
|
-
/**
|
|
2694
|
-
* The type of token. Should be DPoP if the access token
|
|
2695
|
-
* is bound to a dpop key
|
|
2696
|
-
*/
|
|
2697
|
-
tokenType: 'DPoP' | 'Bearer' | (string & {});
|
|
2698
|
-
/**
|
|
2699
|
-
* Number of seconds after which the access tokens expires.
|
|
2700
|
-
*/
|
|
2701
|
-
expiresInSeconds: number;
|
|
2702
|
-
/**
|
|
2703
|
-
* The refresh token
|
|
2704
|
-
*/
|
|
2705
|
-
refreshToken?: string;
|
|
2706
|
-
/**
|
|
2707
|
-
* New cNonce value
|
|
2708
|
-
*/
|
|
2709
|
-
cNonce?: string;
|
|
2710
|
-
cNonceExpiresIn?: number;
|
|
2711
|
-
/**
|
|
2712
|
-
* Additional payload to include in the access token response.
|
|
2713
|
-
*
|
|
2714
|
-
* Will be applied after default payload to allow overriding over values, but be careful.
|
|
2715
|
-
*/
|
|
2716
|
-
additionalPayload?: Record<string, unknown>;
|
|
2717
|
-
}
|
|
2718
|
-
//#endregion
|
|
2719
|
-
//#region src/authorization-challenge/create-authorization-challenge-response.d.ts
|
|
2720
|
-
interface CreateAuthorizationChallengeResponseOptions {
|
|
2721
|
-
/**
|
|
2722
|
-
* The authorization code
|
|
2723
|
-
*/
|
|
2724
|
-
authorizationCode: string;
|
|
2725
|
-
/**
|
|
2726
|
-
* Additional payload to include in the authorization challenge response.
|
|
2727
|
-
*/
|
|
2728
|
-
additionalPayload?: Record<string, unknown>;
|
|
2729
|
-
}
|
|
2730
|
-
interface CreateAuthorizationChallengeErrorResponseOptions {
|
|
2731
|
-
/**
|
|
2732
|
-
* Auth session identifier for the authorization challenge. The client MUST include this
|
|
2733
|
-
* in subsequent requests to the authorization challenge endpoint.
|
|
2734
|
-
*/
|
|
2735
|
-
authSession?: string;
|
|
2736
|
-
/**
|
|
2737
|
-
* Error codes specific to authorization challenge are:
|
|
2738
|
-
* - @see Oauth2ErrorCodes.RedirectToWeb
|
|
2739
|
-
* - @see Oauth2ErrorCodes.InvalidSession
|
|
2740
|
-
* - @see Oauth2ErrorCodes.InsufficientAuthorization
|
|
2741
|
-
*/
|
|
2742
|
-
error: StringWithAutoCompletion<Oauth2ErrorCodes>;
|
|
2743
|
-
/**
|
|
2744
|
-
* Optional error description
|
|
2745
|
-
*/
|
|
2746
|
-
errorDescription?: string;
|
|
2747
|
-
/**
|
|
2748
|
-
* OpenID4VP authorization request url that must be completed before authorization
|
|
2749
|
-
* can be granted
|
|
2750
|
-
*
|
|
2751
|
-
* Should be combined with `error` @see Oauth2ErrorCodes.InsufficientAuthorization
|
|
2752
|
-
*/
|
|
2753
|
-
presentation?: string;
|
|
2754
|
-
/**
|
|
2755
|
-
* Optional PAR request uri, allowing the authorization challenge request to be treated
|
|
2756
|
-
* as a succesfull pushed authorization request.
|
|
2757
|
-
*
|
|
2758
|
-
* Should be combined with `error` @see Oauth2ErrorCodes.RedirectToWeb
|
|
2759
|
-
*/
|
|
2760
|
-
requestUri?: string;
|
|
2761
|
-
/**
|
|
2762
|
-
* Duration is seconds after which the `requestUri` parameter will expire. Should only be included
|
|
2763
|
-
* if the `requestUri` is also included, and has no meaning otherwise
|
|
2764
|
-
*/
|
|
2765
|
-
expiresIn?: number;
|
|
2766
|
-
/**
|
|
2767
|
-
* Additional payload to include in the authorization challenge error response.
|
|
2768
|
-
*/
|
|
2769
|
-
additionalPayload?: Record<string, unknown>;
|
|
2770
|
-
}
|
|
2771
|
-
//#endregion
|
|
2772
|
-
//#region src/Oauth2AuthorizationServer.d.ts
|
|
2773
|
-
interface Oauth2AuthorizationServerOptions {
|
|
2774
|
-
/**
|
|
2775
|
-
* Callbacks required for the oauth2 authorization server
|
|
2776
|
-
*/
|
|
2777
|
-
callbacks: Omit<CallbackContext, 'decryptJwe' | 'encryptJwe'>;
|
|
2778
|
-
}
|
|
2779
|
-
declare class Oauth2AuthorizationServer {
|
|
2780
|
-
private options;
|
|
2781
|
-
constructor(options: Oauth2AuthorizationServerOptions);
|
|
2782
|
-
createAuthorizationServerMetadata(authorizationServerMetadata: AuthorizationServerMetadata): {
|
|
2783
|
-
[x: string]: unknown;
|
|
2784
|
-
issuer: string;
|
|
2785
|
-
token_endpoint: string;
|
|
2786
|
-
token_endpoint_auth_methods_supported?: string[] | undefined;
|
|
2787
|
-
authorization_endpoint?: string | undefined;
|
|
2788
|
-
jwks_uri?: string | undefined;
|
|
2789
|
-
grant_types_supported?: string[] | undefined;
|
|
2790
|
-
code_challenge_methods_supported?: string[] | undefined;
|
|
2791
|
-
dpop_signing_alg_values_supported?: string[] | undefined;
|
|
2792
|
-
require_pushed_authorization_requests?: boolean | undefined;
|
|
2793
|
-
pushed_authorization_request_endpoint?: string | undefined;
|
|
2794
|
-
introspection_endpoint?: string | undefined;
|
|
2795
|
-
introspection_endpoint_auth_methods_supported?: string[] | undefined;
|
|
2796
|
-
introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
|
|
2797
|
-
authorization_challenge_endpoint?: string | undefined;
|
|
2798
|
-
'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
|
|
2799
|
-
client_attestation_pop_nonce_required?: boolean | undefined;
|
|
2800
|
-
};
|
|
2801
|
-
/**
|
|
2802
|
-
* Parse access token request and extract the grant specific properties.
|
|
2803
|
-
*
|
|
2804
|
-
* If something goes wrong, such as the grant is not supported, missing parameters, etc,
|
|
2805
|
-
* it will throw `Oauth2ServerErrorResponseError` containing an error response object
|
|
2806
|
-
* that can be returned to the client.
|
|
2807
|
-
*/
|
|
2808
|
-
parseAccessTokenRequest(options: ParseAccessTokenRequestOptions): ParseAccessTokenRequestResult;
|
|
2809
|
-
verifyPreAuthorizedCodeAccessTokenRequest(options: Omit<VerifyPreAuthorizedCodeAccessTokenRequestOptions, 'callbacks'>): Promise<VerifyAccessTokenRequestReturn>;
|
|
2810
|
-
verifyAuthorizationCodeAccessTokenRequest(options: Omit<VerifyAuthorizationCodeAccessTokenRequestOptions, 'callbacks'>): Promise<VerifyAccessTokenRequestReturn>;
|
|
2811
|
-
verifyRefreshTokenAccessTokenRequest(options: Omit<VerifyRefreshTokenAccessTokenRequestOptions, 'callbacks'>): Promise<VerifyAccessTokenRequestReturn>;
|
|
2812
|
-
/**
|
|
2813
|
-
* Create an access token response.
|
|
2814
|
-
*
|
|
2815
|
-
* The `sub` claim can be used to identify the resource owner is subsequent requests.
|
|
2816
|
-
* For pre-auth flow this can be the pre-authorized_code but there are no requirements
|
|
2817
|
-
* on the value.
|
|
2818
|
-
*
|
|
2819
|
-
* To generate a refresh token, set the `refreshToken` option to `true`. You can
|
|
2820
|
-
* also provide a custom refresh token string.
|
|
2821
|
-
*/
|
|
2822
|
-
createAccessTokenResponse(options: Pick<CreateAccessTokenOptions, 'expiresInSeconds' | 'scope' | 'clientId' | 'audience' | 'signer' | 'dpop' | 'authorizationServer' | 'now' | 'subject'> & Pick<CreateAccessTokenResponseOptions, 'cNonce' | 'cNonceExpiresIn'> & {
|
|
2823
|
-
additionalAccessTokenPayload?: CreateAccessTokenOptions['additionalPayload'];
|
|
2824
|
-
additionalAccessTokenResponsePayload?: CreateAccessTokenResponseOptions['additionalPayload'];
|
|
2825
|
-
refreshToken?: boolean | string;
|
|
2826
|
-
}): Promise<{
|
|
2827
|
-
[x: string]: unknown;
|
|
2828
|
-
access_token: string;
|
|
2829
|
-
token_type: string;
|
|
2830
|
-
expires_in?: number | undefined;
|
|
2831
|
-
scope?: string | undefined;
|
|
2832
|
-
state?: string | undefined;
|
|
2833
|
-
refresh_token?: string | undefined;
|
|
2834
|
-
c_nonce?: string | undefined;
|
|
2835
|
-
c_nonce_expires_in?: number | undefined;
|
|
2836
|
-
authorization_details?: {
|
|
2837
|
-
[x: string]: unknown;
|
|
2838
|
-
}[] | undefined;
|
|
2839
|
-
}>;
|
|
2840
|
-
/**
|
|
2841
|
-
* Parse a pushed authorization request
|
|
2842
|
-
*/
|
|
2843
|
-
parsePushedAuthorizationRequest(options: Omit<ParsePushedAuthorizationRequestOptions, 'callbacks'>): Promise<ParsePushedAuthorizationRequestResult>;
|
|
2844
|
-
/**
|
|
2845
|
-
* Verify pushed authorization request.
|
|
2846
|
-
*
|
|
2847
|
-
* Make sure to provide the `authorizationRequestJwt` if this was returned in the `parsePushedAuthorizationRequest`
|
|
2848
|
-
*/
|
|
2849
|
-
verifyPushedAuthorizationRequest(options: Omit<VerifyPushedAuthorizationRequestOptions, 'callbacks'>): Promise<VerifyPushedAuthorizationRequestReturn>;
|
|
2850
|
-
createPushedAuthorizationResponse(options: CreatePushedAuthorizationResponseOptions): {
|
|
2851
|
-
pushedAuthorizationResponse: {
|
|
2852
|
-
[x: string]: unknown;
|
|
2853
|
-
request_uri: string;
|
|
2854
|
-
expires_in: number;
|
|
2855
|
-
};
|
|
2856
|
-
};
|
|
2857
|
-
createPushedAuthorizationErrorResponse(options: CreatePushedAuthorizationErrorResponseOptions): {
|
|
2858
|
-
[x: string]: unknown;
|
|
2859
|
-
error: string;
|
|
2860
|
-
error_description?: string | undefined;
|
|
2861
|
-
error_uri?: string | undefined;
|
|
2862
|
-
};
|
|
2863
|
-
/**
|
|
2864
|
-
* Parse an authorization challenge request
|
|
2865
|
-
*/
|
|
2866
|
-
parseAuthorizationChallengeRequest(options: ParseAuthorizationChallengeRequestOptions): ParseAuthorizationChallengeRequestResult;
|
|
2867
|
-
verifyAuthorizationChallengeRequest(options: Omit<VerifyAuthorizationChallengeRequestOptions, 'callbacks'>): Promise<VerifyAuthorizationRequestReturn>;
|
|
2868
|
-
createAuthorizationChallengeResponse(options: CreateAuthorizationChallengeResponseOptions): {
|
|
2869
|
-
authorizationChallengeResponse: {
|
|
2870
|
-
[x: string]: unknown;
|
|
2871
|
-
authorization_code: string;
|
|
2872
|
-
};
|
|
2873
|
-
};
|
|
2874
|
-
/**
|
|
2875
|
-
* Create an authorization challenge error response indicating presentation of credentials
|
|
2876
|
-
* using OpenID4VP is required before authorization can be granted.
|
|
2877
|
-
*
|
|
2878
|
-
* The `presentation` parameter should be an OpenID4VP authorization request url.
|
|
2879
|
-
* The `authSession` should be used to track the session
|
|
2880
|
-
*/
|
|
2881
|
-
createAuthorizationChallengePresentationErrorResponse(options: Pick<CreateAuthorizationChallengeErrorResponseOptions, 'errorDescription' | 'additionalPayload'> & Required<Pick<CreateAuthorizationChallengeErrorResponseOptions, 'authSession' | 'presentation'>>): {
|
|
2882
|
-
[x: string]: unknown;
|
|
2883
|
-
error: string;
|
|
2884
|
-
auth_session?: string | undefined;
|
|
2885
|
-
request_uri?: string | undefined;
|
|
2886
|
-
expires_in?: number | undefined;
|
|
2887
|
-
presentation?: string | undefined;
|
|
2888
|
-
error_description?: string | undefined;
|
|
2889
|
-
error_uri?: string | undefined;
|
|
2890
|
-
};
|
|
2891
|
-
createAuthorizationChallengeErrorResponse(options: CreateAuthorizationChallengeErrorResponseOptions): {
|
|
2892
|
-
[x: string]: unknown;
|
|
2893
|
-
error: string;
|
|
2894
|
-
auth_session?: string | undefined;
|
|
2895
|
-
request_uri?: string | undefined;
|
|
2896
|
-
expires_in?: number | undefined;
|
|
2897
|
-
presentation?: string | undefined;
|
|
2898
|
-
error_description?: string | undefined;
|
|
2899
|
-
error_uri?: string | undefined;
|
|
2900
|
-
};
|
|
2901
|
-
verifyDpopJwt(options: Omit<VerifyDpopJwtOptions, 'callbacks'>): Promise<{
|
|
2902
|
-
header: {
|
|
2903
|
-
[x: string]: unknown;
|
|
2904
|
-
typ: "dpop+jwt";
|
|
2905
|
-
jwk: {
|
|
2906
|
-
[x: string]: unknown;
|
|
2907
|
-
kty: string;
|
|
2908
|
-
crv?: string | undefined;
|
|
2909
|
-
x?: string | undefined;
|
|
2910
|
-
y?: string | undefined;
|
|
2911
|
-
e?: string | undefined;
|
|
2912
|
-
n?: string | undefined;
|
|
2913
|
-
alg?: string | undefined;
|
|
2914
|
-
d?: string | undefined;
|
|
2915
|
-
dp?: string | undefined;
|
|
2916
|
-
dq?: string | undefined;
|
|
2917
|
-
ext?: boolean | undefined;
|
|
2918
|
-
k?: string | undefined;
|
|
2919
|
-
key_ops?: string[] | undefined;
|
|
2920
|
-
kid?: string | undefined;
|
|
2921
|
-
oth?: {
|
|
2922
|
-
[x: string]: unknown;
|
|
2923
|
-
d?: string | undefined;
|
|
2924
|
-
r?: string | undefined;
|
|
2925
|
-
t?: string | undefined;
|
|
2926
|
-
}[] | undefined;
|
|
2927
|
-
p?: string | undefined;
|
|
2928
|
-
q?: string | undefined;
|
|
2929
|
-
qi?: string | undefined;
|
|
2930
|
-
use?: string | undefined;
|
|
2931
|
-
x5c?: string[] | undefined;
|
|
2932
|
-
x5t?: string | undefined;
|
|
2933
|
-
'x5t#S256'?: string | undefined;
|
|
2934
|
-
x5u?: string | undefined;
|
|
2935
|
-
};
|
|
2936
|
-
alg: string;
|
|
2937
|
-
kid?: string | undefined;
|
|
2938
|
-
x5c?: string[] | undefined;
|
|
2939
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
2940
|
-
};
|
|
2941
|
-
payload: {
|
|
2942
|
-
[x: string]: unknown;
|
|
2943
|
-
iat: number;
|
|
2944
|
-
htu: string;
|
|
2945
|
-
htm: "POST" | "GET" | "PUT" | "DELETE" | "HEAD" | "OPTIONS" | "TRACE" | "CONNECT" | "PATCH";
|
|
2946
|
-
jti: string;
|
|
2947
|
-
ath?: string | undefined;
|
|
2948
|
-
iss?: string | undefined;
|
|
2949
|
-
aud?: string | string[] | undefined;
|
|
2950
|
-
exp?: number | undefined;
|
|
2951
|
-
nbf?: number | undefined;
|
|
2952
|
-
nonce?: string | undefined;
|
|
2953
|
-
sub?: string | undefined;
|
|
2954
|
-
cnf?: {
|
|
2955
|
-
[x: string]: unknown;
|
|
2956
|
-
jwk?: {
|
|
2957
|
-
[x: string]: unknown;
|
|
2958
|
-
kty: string;
|
|
2959
|
-
crv?: string | undefined;
|
|
2960
|
-
x?: string | undefined;
|
|
2961
|
-
y?: string | undefined;
|
|
2962
|
-
e?: string | undefined;
|
|
2963
|
-
n?: string | undefined;
|
|
2964
|
-
alg?: string | undefined;
|
|
2965
|
-
d?: string | undefined;
|
|
2966
|
-
dp?: string | undefined;
|
|
2967
|
-
dq?: string | undefined;
|
|
2968
|
-
ext?: boolean | undefined;
|
|
2969
|
-
k?: string | undefined;
|
|
2970
|
-
key_ops?: string[] | undefined;
|
|
2971
|
-
kid?: string | undefined;
|
|
2972
|
-
oth?: {
|
|
2973
|
-
[x: string]: unknown;
|
|
2974
|
-
d?: string | undefined;
|
|
2975
|
-
r?: string | undefined;
|
|
2976
|
-
t?: string | undefined;
|
|
2977
|
-
}[] | undefined;
|
|
2978
|
-
p?: string | undefined;
|
|
2979
|
-
q?: string | undefined;
|
|
2980
|
-
qi?: string | undefined;
|
|
2981
|
-
use?: string | undefined;
|
|
2982
|
-
x5c?: string[] | undefined;
|
|
2983
|
-
x5t?: string | undefined;
|
|
2984
|
-
'x5t#S256'?: string | undefined;
|
|
2985
|
-
x5u?: string | undefined;
|
|
2986
|
-
} | undefined;
|
|
2987
|
-
jkt?: string | undefined;
|
|
2988
|
-
} | undefined;
|
|
2989
|
-
status?: Record<string, any> | undefined;
|
|
2990
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
2991
|
-
};
|
|
2992
|
-
jwkThumbprint: string;
|
|
2993
|
-
}>;
|
|
2994
|
-
verifyClientAttestation(options: Omit<VerifyClientAttestationOptions, 'callbacks'>): Promise<{
|
|
2995
|
-
clientAttestation: {
|
|
2996
|
-
header: {
|
|
2997
|
-
[x: string]: unknown;
|
|
2998
|
-
typ: "oauth-client-attestation+jwt";
|
|
2999
|
-
alg: string;
|
|
3000
|
-
kid?: string | undefined;
|
|
3001
|
-
jwk?: {
|
|
3002
|
-
[x: string]: unknown;
|
|
3003
|
-
kty: string;
|
|
3004
|
-
crv?: string | undefined;
|
|
3005
|
-
x?: string | undefined;
|
|
3006
|
-
y?: string | undefined;
|
|
3007
|
-
e?: string | undefined;
|
|
3008
|
-
n?: string | undefined;
|
|
3009
|
-
alg?: string | undefined;
|
|
3010
|
-
d?: string | undefined;
|
|
3011
|
-
dp?: string | undefined;
|
|
3012
|
-
dq?: string | undefined;
|
|
3013
|
-
ext?: boolean | undefined;
|
|
3014
|
-
k?: string | undefined;
|
|
3015
|
-
key_ops?: string[] | undefined;
|
|
3016
|
-
kid?: string | undefined;
|
|
3017
|
-
oth?: {
|
|
3018
|
-
[x: string]: unknown;
|
|
3019
|
-
d?: string | undefined;
|
|
3020
|
-
r?: string | undefined;
|
|
3021
|
-
t?: string | undefined;
|
|
3022
|
-
}[] | undefined;
|
|
3023
|
-
p?: string | undefined;
|
|
3024
|
-
q?: string | undefined;
|
|
3025
|
-
qi?: string | undefined;
|
|
3026
|
-
use?: string | undefined;
|
|
3027
|
-
x5c?: string[] | undefined;
|
|
3028
|
-
x5t?: string | undefined;
|
|
3029
|
-
'x5t#S256'?: string | undefined;
|
|
3030
|
-
x5u?: string | undefined;
|
|
3031
|
-
} | undefined;
|
|
3032
|
-
x5c?: string[] | undefined;
|
|
3033
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3034
|
-
};
|
|
3035
|
-
payload: {
|
|
3036
|
-
[x: string]: unknown;
|
|
3037
|
-
iss: string;
|
|
3038
|
-
sub: string;
|
|
3039
|
-
exp: number;
|
|
3040
|
-
cnf: {
|
|
3041
|
-
[x: string]: unknown;
|
|
3042
|
-
jwk: {
|
|
3043
|
-
[x: string]: unknown;
|
|
3044
|
-
kty: string;
|
|
3045
|
-
crv?: string | undefined;
|
|
3046
|
-
x?: string | undefined;
|
|
3047
|
-
y?: string | undefined;
|
|
3048
|
-
e?: string | undefined;
|
|
3049
|
-
n?: string | undefined;
|
|
3050
|
-
alg?: string | undefined;
|
|
3051
|
-
d?: string | undefined;
|
|
3052
|
-
dp?: string | undefined;
|
|
3053
|
-
dq?: string | undefined;
|
|
3054
|
-
ext?: boolean | undefined;
|
|
3055
|
-
k?: string | undefined;
|
|
3056
|
-
key_ops?: string[] | undefined;
|
|
3057
|
-
kid?: string | undefined;
|
|
3058
|
-
oth?: {
|
|
3059
|
-
[x: string]: unknown;
|
|
3060
|
-
d?: string | undefined;
|
|
3061
|
-
r?: string | undefined;
|
|
3062
|
-
t?: string | undefined;
|
|
3063
|
-
}[] | undefined;
|
|
3064
|
-
p?: string | undefined;
|
|
3065
|
-
q?: string | undefined;
|
|
3066
|
-
qi?: string | undefined;
|
|
3067
|
-
use?: string | undefined;
|
|
3068
|
-
x5c?: string[] | undefined;
|
|
3069
|
-
x5t?: string | undefined;
|
|
3070
|
-
'x5t#S256'?: string | undefined;
|
|
3071
|
-
x5u?: string | undefined;
|
|
3072
|
-
};
|
|
3073
|
-
};
|
|
3074
|
-
wallet_name?: string | undefined;
|
|
3075
|
-
wallet_link?: string | undefined;
|
|
3076
|
-
aud?: string | string[] | undefined;
|
|
3077
|
-
iat?: number | undefined;
|
|
3078
|
-
nbf?: number | undefined;
|
|
3079
|
-
nonce?: string | undefined;
|
|
3080
|
-
jti?: string | undefined;
|
|
3081
|
-
status?: Record<string, any> | undefined;
|
|
3082
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3083
|
-
};
|
|
3084
|
-
signer: JwtSignerWithJwk;
|
|
3085
|
-
};
|
|
3086
|
-
clientAttestationPop: {
|
|
3087
|
-
header: {
|
|
3088
|
-
[x: string]: unknown;
|
|
3089
|
-
typ: "oauth-client-attestation-pop+jwt";
|
|
3090
|
-
alg: string;
|
|
3091
|
-
kid?: string | undefined;
|
|
3092
|
-
jwk?: {
|
|
3093
|
-
[x: string]: unknown;
|
|
3094
|
-
kty: string;
|
|
3095
|
-
crv?: string | undefined;
|
|
3096
|
-
x?: string | undefined;
|
|
3097
|
-
y?: string | undefined;
|
|
3098
|
-
e?: string | undefined;
|
|
3099
|
-
n?: string | undefined;
|
|
3100
|
-
alg?: string | undefined;
|
|
3101
|
-
d?: string | undefined;
|
|
3102
|
-
dp?: string | undefined;
|
|
3103
|
-
dq?: string | undefined;
|
|
3104
|
-
ext?: boolean | undefined;
|
|
3105
|
-
k?: string | undefined;
|
|
3106
|
-
key_ops?: string[] | undefined;
|
|
3107
|
-
kid?: string | undefined;
|
|
3108
|
-
oth?: {
|
|
3109
|
-
[x: string]: unknown;
|
|
3110
|
-
d?: string | undefined;
|
|
3111
|
-
r?: string | undefined;
|
|
3112
|
-
t?: string | undefined;
|
|
3113
|
-
}[] | undefined;
|
|
3114
|
-
p?: string | undefined;
|
|
3115
|
-
q?: string | undefined;
|
|
3116
|
-
qi?: string | undefined;
|
|
3117
|
-
use?: string | undefined;
|
|
3118
|
-
x5c?: string[] | undefined;
|
|
3119
|
-
x5t?: string | undefined;
|
|
3120
|
-
'x5t#S256'?: string | undefined;
|
|
3121
|
-
x5u?: string | undefined;
|
|
3122
|
-
} | undefined;
|
|
3123
|
-
x5c?: string[] | undefined;
|
|
3124
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3125
|
-
};
|
|
3126
|
-
payload: {
|
|
3127
|
-
[x: string]: unknown;
|
|
3128
|
-
iss: string;
|
|
3129
|
-
exp: number;
|
|
3130
|
-
aud: string | string[];
|
|
3131
|
-
jti: string;
|
|
3132
|
-
nonce?: string | undefined;
|
|
3133
|
-
iat?: number | undefined;
|
|
3134
|
-
nbf?: number | undefined;
|
|
3135
|
-
sub?: string | undefined;
|
|
3136
|
-
cnf?: {
|
|
3137
|
-
[x: string]: unknown;
|
|
3138
|
-
jwk?: {
|
|
3139
|
-
[x: string]: unknown;
|
|
3140
|
-
kty: string;
|
|
3141
|
-
crv?: string | undefined;
|
|
3142
|
-
x?: string | undefined;
|
|
3143
|
-
y?: string | undefined;
|
|
3144
|
-
e?: string | undefined;
|
|
3145
|
-
n?: string | undefined;
|
|
3146
|
-
alg?: string | undefined;
|
|
3147
|
-
d?: string | undefined;
|
|
3148
|
-
dp?: string | undefined;
|
|
3149
|
-
dq?: string | undefined;
|
|
3150
|
-
ext?: boolean | undefined;
|
|
3151
|
-
k?: string | undefined;
|
|
3152
|
-
key_ops?: string[] | undefined;
|
|
3153
|
-
kid?: string | undefined;
|
|
3154
|
-
oth?: {
|
|
3155
|
-
[x: string]: unknown;
|
|
3156
|
-
d?: string | undefined;
|
|
3157
|
-
r?: string | undefined;
|
|
3158
|
-
t?: string | undefined;
|
|
3159
|
-
}[] | undefined;
|
|
3160
|
-
p?: string | undefined;
|
|
3161
|
-
q?: string | undefined;
|
|
3162
|
-
qi?: string | undefined;
|
|
3163
|
-
use?: string | undefined;
|
|
3164
|
-
x5c?: string[] | undefined;
|
|
3165
|
-
x5t?: string | undefined;
|
|
3166
|
-
'x5t#S256'?: string | undefined;
|
|
3167
|
-
x5u?: string | undefined;
|
|
3168
|
-
} | undefined;
|
|
3169
|
-
jkt?: string | undefined;
|
|
3170
|
-
} | undefined;
|
|
3171
|
-
status?: Record<string, any> | undefined;
|
|
3172
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3173
|
-
};
|
|
3174
|
-
signer: JwtSignerWithJwk;
|
|
3175
|
-
};
|
|
3176
|
-
}>;
|
|
3177
|
-
}
|
|
3178
|
-
//#endregion
|
|
3179
|
-
//#region src/resource-request/make-resource-request.d.ts
|
|
3180
|
-
interface ResourceRequestOptions {
|
|
3181
|
-
/**
|
|
3182
|
-
* DPoP options
|
|
3183
|
-
*/
|
|
3184
|
-
dpop?: RequestDpopOptions & {
|
|
3185
|
-
/**
|
|
3186
|
-
* Whether to retry the request if the server responds with an error indicating
|
|
3187
|
-
* the request should be retried with a server provided dpop nonce
|
|
3188
|
-
*
|
|
3189
|
-
* @default true
|
|
3190
|
-
*/
|
|
3191
|
-
retryWithNonce?: boolean;
|
|
3192
|
-
};
|
|
3193
|
-
/**
|
|
3194
|
-
* Callbacks
|
|
3195
|
-
*/
|
|
3196
|
-
callbacks: Pick<CallbackContext, 'fetch' | 'generateRandom' | 'signJwt' | 'hash'>;
|
|
3197
|
-
/**
|
|
3198
|
-
* Access token
|
|
3199
|
-
*/
|
|
3200
|
-
accessToken: string;
|
|
3201
|
-
url: string;
|
|
3202
|
-
requestOptions: FetchRequestInit;
|
|
3203
|
-
}
|
|
3204
|
-
interface ResourceRequestResponseBase {
|
|
3205
|
-
ok: boolean;
|
|
3206
|
-
response: FetchResponse;
|
|
3207
|
-
/**
|
|
3208
|
-
* If the response included a dpop nonce to be used in subsequent requests
|
|
3209
|
-
*/
|
|
3210
|
-
dpop?: {
|
|
3211
|
-
nonce: string;
|
|
3212
|
-
};
|
|
3213
|
-
}
|
|
3214
|
-
interface ResourceRequestResponseOk extends ResourceRequestResponseBase {
|
|
3215
|
-
ok: true;
|
|
3216
|
-
}
|
|
3217
|
-
interface ResourceRequestResponseNotOk extends ResourceRequestResponseBase {
|
|
3218
|
-
ok: false;
|
|
3219
|
-
/**
|
|
3220
|
-
* If a WWW-Authenticate was included in the headers of the response
|
|
3221
|
-
* they will be parsed and added here.
|
|
3222
|
-
*/
|
|
3223
|
-
wwwAuthenticate?: WwwAuthenticateHeaderChallenge[];
|
|
3224
|
-
}
|
|
3225
|
-
declare function resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
|
|
3226
|
-
//#endregion
|
|
3227
|
-
//#region src/authorization-challenge/send-authorization-challenge.d.ts
|
|
3228
|
-
interface SendAuthorizationChallengeRequestOptions {
|
|
3229
|
-
/**
|
|
3230
|
-
* Callback context
|
|
3231
|
-
*/
|
|
3232
|
-
callbacks: Pick<CallbackContext, 'fetch' | 'hash' | 'generateRandom' | 'signJwt' | 'clientAuthentication'>;
|
|
3233
|
-
/**
|
|
3234
|
-
* Metadata of the authorization server where to perform the authorization challenge
|
|
3235
|
-
*/
|
|
3236
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
3237
|
-
/**
|
|
3238
|
-
* Previously established auth session
|
|
3239
|
-
*/
|
|
3240
|
-
authSession?: string;
|
|
3241
|
-
/**
|
|
3242
|
-
* Scope to request for the authorization challenge request
|
|
3243
|
-
*/
|
|
3244
|
-
scope?: string;
|
|
3245
|
-
/**
|
|
3246
|
-
* State for the authorization challenge request
|
|
3247
|
-
*/
|
|
3248
|
-
state?: string;
|
|
3249
|
-
/**
|
|
3250
|
-
* The resource to which access is being requested. This can help the authorization
|
|
3251
|
-
* server in determining the resource server to handle the authorization request for
|
|
3252
|
-
*/
|
|
3253
|
-
resource?: string;
|
|
3254
|
-
/**
|
|
3255
|
-
* Redirect uri to include in the authorization challenge request. Maybe be used by the
|
|
3256
|
-
* server when falling back to a PAR request.
|
|
3257
|
-
*/
|
|
3258
|
-
redirectUri?: string;
|
|
3259
|
-
/**
|
|
3260
|
-
* Presentation during issuance session if credentials were presented
|
|
3261
|
-
* as part of an issuance session
|
|
3262
|
-
*/
|
|
3263
|
-
presentationDuringIssuanceSession?: string;
|
|
3264
|
-
/**
|
|
3265
|
-
* Additional payload to include in the authorization challenge request. Items will be encoded and sent
|
|
3266
|
-
* using x-www-form-urlencoded format. Nested items (JSON) will be stringified and url encoded.
|
|
3267
|
-
*/
|
|
3268
|
-
additionalRequestPayload?: Record<string, unknown>;
|
|
3269
|
-
/**
|
|
3270
|
-
* Code verifier to use for pkce. If not provided a value will generated when pkce is supported
|
|
3271
|
-
*/
|
|
3272
|
-
pkceCodeVerifier?: string;
|
|
3273
|
-
/**
|
|
3274
|
-
* DPoP options
|
|
3275
|
-
*/
|
|
3276
|
-
dpop?: RequestDpopOptions;
|
|
3277
|
-
}
|
|
3278
|
-
//#endregion
|
|
3279
|
-
//#region src/Oauth2Client.d.ts
|
|
3280
|
-
interface Oauth2ClientOptions {
|
|
3281
|
-
/**
|
|
3282
|
-
* Callbacks required for the oauth2 client
|
|
3283
|
-
*/
|
|
3284
|
-
callbacks: Omit<CallbackContext, 'verifyJwt' | 'decryptJwe' | 'encryptJwe'>;
|
|
3285
|
-
}
|
|
3286
|
-
declare class Oauth2Client {
|
|
3287
|
-
private options;
|
|
3288
|
-
constructor(options: Oauth2ClientOptions);
|
|
3289
|
-
isDpopSupported(options: {
|
|
3290
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
3291
|
-
}): {
|
|
3292
|
-
readonly supported: false;
|
|
3293
|
-
readonly dpopSigningAlgValuesSupported?: undefined;
|
|
3294
|
-
} | {
|
|
3295
|
-
readonly supported: true;
|
|
3296
|
-
readonly dpopSigningAlgValuesSupported: string[];
|
|
3297
|
-
};
|
|
3298
|
-
isClientAttestationSupported(options: {
|
|
3299
|
-
authorizationServerMetadata: AuthorizationServerMetadata;
|
|
3300
|
-
}): {
|
|
3301
|
-
readonly supported: false;
|
|
3302
|
-
} | {
|
|
3303
|
-
readonly supported: true;
|
|
3304
|
-
};
|
|
3305
|
-
fetchAuthorizationServerMetadata(issuer: string): Promise<{
|
|
3306
|
-
[x: string]: unknown;
|
|
3307
|
-
issuer: string;
|
|
3308
|
-
token_endpoint: string;
|
|
3309
|
-
token_endpoint_auth_methods_supported?: string[] | undefined;
|
|
3310
|
-
authorization_endpoint?: string | undefined;
|
|
3311
|
-
jwks_uri?: string | undefined;
|
|
3312
|
-
grant_types_supported?: string[] | undefined;
|
|
3313
|
-
code_challenge_methods_supported?: string[] | undefined;
|
|
3314
|
-
dpop_signing_alg_values_supported?: string[] | undefined;
|
|
3315
|
-
require_pushed_authorization_requests?: boolean | undefined;
|
|
3316
|
-
pushed_authorization_request_endpoint?: string | undefined;
|
|
3317
|
-
introspection_endpoint?: string | undefined;
|
|
3318
|
-
introspection_endpoint_auth_methods_supported?: string[] | undefined;
|
|
3319
|
-
introspection_endpoint_auth_signing_alg_values_supported?: string[] | undefined;
|
|
3320
|
-
authorization_challenge_endpoint?: string | undefined;
|
|
3321
|
-
'pre-authorized_grant_anonymous_access_supported'?: boolean | undefined;
|
|
3322
|
-
client_attestation_pop_nonce_required?: boolean | undefined;
|
|
3323
|
-
} | null>;
|
|
3324
|
-
/**
|
|
3325
|
-
* Initiate authorization.
|
|
3326
|
-
*
|
|
3327
|
-
* It will take the followings steps:
|
|
3328
|
-
* - if `authorization_challenge_endpoint` is defined, send an authorization challenge request
|
|
3329
|
-
* - if authorization challenge request returns a `redirect_to_web` error code with `request_uri`
|
|
3330
|
-
* then construct the authorization request url based on the `request_uri`
|
|
3331
|
-
* - if the `authorization_challenge_endpoint` is not defined, or authorization challenge request reuturns a `redirect_to_web` error code without `request_uri`
|
|
3332
|
-
* then the authorization request url will be constructed as usual (optionally using PAR).
|
|
3333
|
-
*
|
|
3334
|
-
* @throws {Oauth2ClientAuthorizationChallengeError} in case of an error response. If `error` is
|
|
3335
|
-
* `insufficient_authorization` possible extra steps can be taken.
|
|
3336
|
-
*/
|
|
3337
|
-
initiateAuthorization(options: Omit<CreateAuthorizationRequestUrlOptions, 'callbacks'>): Promise<{
|
|
3338
|
-
authorizationRequestUrl: string;
|
|
3339
|
-
pkce: CreatePkceReturn | undefined;
|
|
3340
|
-
dpop: RequestDpopOptions | undefined;
|
|
3341
|
-
} | {
|
|
3342
|
-
dpop: {
|
|
3343
|
-
nonce: string | null;
|
|
3344
|
-
signer: JwtSignerJwk;
|
|
3345
|
-
} | undefined;
|
|
3346
|
-
authorizationRequestUrl: string;
|
|
3347
|
-
pkce: CreatePkceReturn | undefined;
|
|
3348
|
-
}>;
|
|
3349
|
-
sendAuthorizationChallengeRequest(options: Omit<SendAuthorizationChallengeRequestOptions, 'callbacks'>): Promise<{
|
|
3350
|
-
pkce: CreatePkceReturn | undefined;
|
|
3351
|
-
dpop: {
|
|
3352
|
-
nonce: string | undefined;
|
|
3353
|
-
signer: JwtSignerJwk;
|
|
3354
|
-
} | undefined;
|
|
3355
|
-
authorizationChallengeResponse: {
|
|
3356
|
-
[x: string]: unknown;
|
|
3357
|
-
authorization_code: string;
|
|
3358
|
-
};
|
|
3359
|
-
}>;
|
|
3360
|
-
createAuthorizationRequestUrl(options: Omit<CreateAuthorizationRequestUrlOptions, 'callbacks'>): Promise<{
|
|
3361
|
-
authorizationRequestUrl: string;
|
|
3362
|
-
pkce: CreatePkceReturn | undefined;
|
|
3363
|
-
dpop: RequestDpopOptions | undefined;
|
|
3364
|
-
}>;
|
|
3365
|
-
retrievePreAuthorizedCodeAccessToken({
|
|
3366
|
-
authorizationServerMetadata,
|
|
3367
|
-
preAuthorizedCode,
|
|
3368
|
-
additionalRequestPayload,
|
|
3369
|
-
txCode,
|
|
3370
|
-
dpop,
|
|
3371
|
-
resource
|
|
3372
|
-
}: Omit<RetrievePreAuthorizedCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
|
|
3373
|
-
retrieveAuthorizationCodeAccessToken({
|
|
3374
|
-
authorizationServerMetadata,
|
|
3375
|
-
additionalRequestPayload,
|
|
3376
|
-
authorizationCode,
|
|
3377
|
-
pkceCodeVerifier,
|
|
3378
|
-
redirectUri,
|
|
3379
|
-
resource,
|
|
3380
|
-
dpop
|
|
3381
|
-
}: Omit<RetrieveAuthorizationCodeAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
|
|
3382
|
-
retrieveRefreshTokenAccessToken({
|
|
3383
|
-
authorizationServerMetadata,
|
|
3384
|
-
additionalRequestPayload,
|
|
3385
|
-
refreshToken,
|
|
3386
|
-
resource,
|
|
3387
|
-
dpop
|
|
3388
|
-
}: Omit<RetrieveRefreshTokenAccessTokenOptions, 'callbacks'>): Promise<RetrieveAccessTokenReturn>;
|
|
3389
|
-
resourceRequest(options: ResourceRequestOptions): Promise<ResourceRequestResponseOk | ResourceRequestResponseNotOk>;
|
|
3390
|
-
}
|
|
3391
|
-
//#endregion
|
|
3392
|
-
//#region src/Oauth2ResourceServer.d.ts
|
|
3393
|
-
interface Oauth2ResourceServerOptions {
|
|
3394
|
-
/**
|
|
3395
|
-
* Callbacks required for the oauth2 resource server
|
|
3396
|
-
*/
|
|
3397
|
-
callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash' | 'clientAuthentication' | 'fetch'>;
|
|
3398
|
-
}
|
|
3399
|
-
declare class Oauth2ResourceServer {
|
|
3400
|
-
private options;
|
|
3401
|
-
constructor(options: Oauth2ResourceServerOptions);
|
|
3402
|
-
verifyResourceRequest(options: Omit<VerifyResourceRequestOptions, 'callbacks'>): Promise<{
|
|
3403
|
-
tokenPayload: {
|
|
3404
|
-
[x: string]: unknown;
|
|
3405
|
-
iss: string;
|
|
3406
|
-
exp: number;
|
|
3407
|
-
iat: number;
|
|
3408
|
-
aud: string | string[];
|
|
3409
|
-
sub: string;
|
|
3410
|
-
jti: string;
|
|
3411
|
-
client_id?: string | undefined;
|
|
3412
|
-
scope?: string | undefined;
|
|
3413
|
-
nbf?: number | undefined;
|
|
3414
|
-
nonce?: string | undefined;
|
|
3415
|
-
cnf?: {
|
|
3416
|
-
[x: string]: unknown;
|
|
3417
|
-
jwk?: {
|
|
3418
|
-
[x: string]: unknown;
|
|
3419
|
-
kty: string;
|
|
3420
|
-
crv?: string | undefined;
|
|
3421
|
-
x?: string | undefined;
|
|
3422
|
-
y?: string | undefined;
|
|
3423
|
-
e?: string | undefined;
|
|
3424
|
-
n?: string | undefined;
|
|
3425
|
-
alg?: string | undefined;
|
|
3426
|
-
d?: string | undefined;
|
|
3427
|
-
dp?: string | undefined;
|
|
3428
|
-
dq?: string | undefined;
|
|
3429
|
-
ext?: boolean | undefined;
|
|
3430
|
-
k?: string | undefined;
|
|
3431
|
-
key_ops?: string[] | undefined;
|
|
3432
|
-
kid?: string | undefined;
|
|
3433
|
-
oth?: {
|
|
3434
|
-
[x: string]: unknown;
|
|
3435
|
-
d?: string | undefined;
|
|
3436
|
-
r?: string | undefined;
|
|
3437
|
-
t?: string | undefined;
|
|
3438
|
-
}[] | undefined;
|
|
3439
|
-
p?: string | undefined;
|
|
3440
|
-
q?: string | undefined;
|
|
3441
|
-
qi?: string | undefined;
|
|
3442
|
-
use?: string | undefined;
|
|
3443
|
-
x5c?: string[] | undefined;
|
|
3444
|
-
x5t?: string | undefined;
|
|
3445
|
-
'x5t#S256'?: string | undefined;
|
|
3446
|
-
x5u?: string | undefined;
|
|
3447
|
-
} | undefined;
|
|
3448
|
-
jkt?: string | undefined;
|
|
3449
|
-
} | undefined;
|
|
3450
|
-
status?: Record<string, any> | undefined;
|
|
3451
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3452
|
-
} | {
|
|
3453
|
-
[x: string]: unknown;
|
|
3454
|
-
active: boolean;
|
|
3455
|
-
scope?: string | undefined;
|
|
3456
|
-
client_id?: string | undefined;
|
|
3457
|
-
username?: string | undefined;
|
|
3458
|
-
token_type?: string | undefined;
|
|
3459
|
-
exp?: number | undefined;
|
|
3460
|
-
iat?: number | undefined;
|
|
3461
|
-
nbf?: number | undefined;
|
|
3462
|
-
sub?: string | undefined;
|
|
3463
|
-
aud?: string | string[] | undefined;
|
|
3464
|
-
iss?: string | undefined;
|
|
3465
|
-
jti?: string | undefined;
|
|
3466
|
-
cnf?: {
|
|
3467
|
-
[x: string]: unknown;
|
|
3468
|
-
jwk?: {
|
|
3469
|
-
[x: string]: unknown;
|
|
3470
|
-
kty: string;
|
|
3471
|
-
crv?: string | undefined;
|
|
3472
|
-
x?: string | undefined;
|
|
3473
|
-
y?: string | undefined;
|
|
3474
|
-
e?: string | undefined;
|
|
3475
|
-
n?: string | undefined;
|
|
3476
|
-
alg?: string | undefined;
|
|
3477
|
-
d?: string | undefined;
|
|
3478
|
-
dp?: string | undefined;
|
|
3479
|
-
dq?: string | undefined;
|
|
3480
|
-
ext?: boolean | undefined;
|
|
3481
|
-
k?: string | undefined;
|
|
3482
|
-
key_ops?: string[] | undefined;
|
|
3483
|
-
kid?: string | undefined;
|
|
3484
|
-
oth?: {
|
|
3485
|
-
[x: string]: unknown;
|
|
3486
|
-
d?: string | undefined;
|
|
3487
|
-
r?: string | undefined;
|
|
3488
|
-
t?: string | undefined;
|
|
3489
|
-
}[] | undefined;
|
|
3490
|
-
p?: string | undefined;
|
|
3491
|
-
q?: string | undefined;
|
|
3492
|
-
qi?: string | undefined;
|
|
3493
|
-
use?: string | undefined;
|
|
3494
|
-
x5c?: string[] | undefined;
|
|
3495
|
-
x5t?: string | undefined;
|
|
3496
|
-
'x5t#S256'?: string | undefined;
|
|
3497
|
-
x5u?: string | undefined;
|
|
3498
|
-
} | undefined;
|
|
3499
|
-
jkt?: string | undefined;
|
|
3500
|
-
} | undefined;
|
|
3501
|
-
};
|
|
3502
|
-
dpop: {
|
|
3503
|
-
jwk: {
|
|
3504
|
-
[x: string]: unknown;
|
|
3505
|
-
kty: string;
|
|
3506
|
-
crv?: string | undefined;
|
|
3507
|
-
x?: string | undefined;
|
|
3508
|
-
y?: string | undefined;
|
|
3509
|
-
e?: string | undefined;
|
|
3510
|
-
n?: string | undefined;
|
|
3511
|
-
alg?: string | undefined;
|
|
3512
|
-
d?: string | undefined;
|
|
3513
|
-
dp?: string | undefined;
|
|
3514
|
-
dq?: string | undefined;
|
|
3515
|
-
ext?: boolean | undefined;
|
|
3516
|
-
k?: string | undefined;
|
|
3517
|
-
key_ops?: string[] | undefined;
|
|
3518
|
-
kid?: string | undefined;
|
|
3519
|
-
oth?: {
|
|
3520
|
-
[x: string]: unknown;
|
|
3521
|
-
d?: string | undefined;
|
|
3522
|
-
r?: string | undefined;
|
|
3523
|
-
t?: string | undefined;
|
|
3524
|
-
}[] | undefined;
|
|
3525
|
-
p?: string | undefined;
|
|
3526
|
-
q?: string | undefined;
|
|
3527
|
-
qi?: string | undefined;
|
|
3528
|
-
use?: string | undefined;
|
|
3529
|
-
x5c?: string[] | undefined;
|
|
3530
|
-
x5t?: string | undefined;
|
|
3531
|
-
'x5t#S256'?: string | undefined;
|
|
3532
|
-
x5u?: string | undefined;
|
|
3533
|
-
};
|
|
3534
|
-
} | undefined;
|
|
3535
|
-
scheme: SupportedAuthenticationScheme;
|
|
3536
|
-
accessToken: string;
|
|
3537
|
-
authorizationServer: string;
|
|
3538
|
-
}>;
|
|
3539
|
-
}
|
|
3540
|
-
//#endregion
|
|
3541
|
-
//#region src/resource-request/verify-resource-request.d.ts
|
|
3542
|
-
interface VerifyResourceRequestOptions {
|
|
3543
|
-
/**
|
|
3544
|
-
* The incoming request
|
|
3545
|
-
*/
|
|
3546
|
-
request: RequestLike;
|
|
3547
|
-
/**
|
|
3548
|
-
* Identifier for the resource server, will be matched with the `aud` value of the access token.
|
|
3549
|
-
*/
|
|
3550
|
-
resourceServer: string;
|
|
3551
|
-
/**
|
|
3552
|
-
* Callbacks for verification of the access token.
|
|
3553
|
-
*/
|
|
3554
|
-
callbacks: Pick<CallbackContext, 'verifyJwt' | 'hash' | 'clientAuthentication' | 'fetch'>;
|
|
3555
|
-
/**
|
|
3556
|
-
* allowed auth schems for the access token. If not provided
|
|
3557
|
-
* all supported authentication schemes are allowed.
|
|
3558
|
-
*/
|
|
3559
|
-
allowedAuthenticationSchemes?: SupportedAuthenticationScheme[];
|
|
3560
|
-
/**
|
|
3561
|
-
* List of authorization servers that this resource endpoint supports
|
|
3562
|
-
*/
|
|
3563
|
-
authorizationServers: AuthorizationServerMetadata[];
|
|
3564
|
-
now?: Date;
|
|
3565
|
-
}
|
|
3566
|
-
declare function verifyResourceRequest(options: VerifyResourceRequestOptions): Promise<{
|
|
3567
|
-
tokenPayload: {
|
|
3568
|
-
[x: string]: unknown;
|
|
3569
|
-
iss: string;
|
|
3570
|
-
exp: number;
|
|
3571
|
-
iat: number;
|
|
3572
|
-
aud: string | string[];
|
|
3573
|
-
sub: string;
|
|
3574
|
-
jti: string;
|
|
3575
|
-
client_id?: string | undefined;
|
|
3576
|
-
scope?: string | undefined;
|
|
3577
|
-
nbf?: number | undefined;
|
|
3578
|
-
nonce?: string | undefined;
|
|
3579
|
-
cnf?: {
|
|
3580
|
-
[x: string]: unknown;
|
|
3581
|
-
jwk?: {
|
|
3582
|
-
[x: string]: unknown;
|
|
3583
|
-
kty: string;
|
|
3584
|
-
crv?: string | undefined;
|
|
3585
|
-
x?: string | undefined;
|
|
3586
|
-
y?: string | undefined;
|
|
3587
|
-
e?: string | undefined;
|
|
3588
|
-
n?: string | undefined;
|
|
3589
|
-
alg?: string | undefined;
|
|
3590
|
-
d?: string | undefined;
|
|
3591
|
-
dp?: string | undefined;
|
|
3592
|
-
dq?: string | undefined;
|
|
3593
|
-
ext?: boolean | undefined;
|
|
3594
|
-
k?: string | undefined;
|
|
3595
|
-
key_ops?: string[] | undefined;
|
|
3596
|
-
kid?: string | undefined;
|
|
3597
|
-
oth?: {
|
|
3598
|
-
[x: string]: unknown;
|
|
3599
|
-
d?: string | undefined;
|
|
3600
|
-
r?: string | undefined;
|
|
3601
|
-
t?: string | undefined;
|
|
3602
|
-
}[] | undefined;
|
|
3603
|
-
p?: string | undefined;
|
|
3604
|
-
q?: string | undefined;
|
|
3605
|
-
qi?: string | undefined;
|
|
3606
|
-
use?: string | undefined;
|
|
3607
|
-
x5c?: string[] | undefined;
|
|
3608
|
-
x5t?: string | undefined;
|
|
3609
|
-
'x5t#S256'?: string | undefined;
|
|
3610
|
-
x5u?: string | undefined;
|
|
3611
|
-
} | undefined;
|
|
3612
|
-
jkt?: string | undefined;
|
|
3613
|
-
} | undefined;
|
|
3614
|
-
status?: Record<string, any> | undefined;
|
|
3615
|
-
trust_chain?: [string, ...string[]] | undefined;
|
|
3616
|
-
} | {
|
|
3617
|
-
[x: string]: unknown;
|
|
3618
|
-
active: boolean;
|
|
3619
|
-
scope?: string | undefined;
|
|
3620
|
-
client_id?: string | undefined;
|
|
3621
|
-
username?: string | undefined;
|
|
3622
|
-
token_type?: string | undefined;
|
|
3623
|
-
exp?: number | undefined;
|
|
3624
|
-
iat?: number | undefined;
|
|
3625
|
-
nbf?: number | undefined;
|
|
3626
|
-
sub?: string | undefined;
|
|
3627
|
-
aud?: string | string[] | undefined;
|
|
3628
|
-
iss?: string | undefined;
|
|
3629
|
-
jti?: string | undefined;
|
|
3630
|
-
cnf?: {
|
|
3631
|
-
[x: string]: unknown;
|
|
3632
|
-
jwk?: {
|
|
3633
|
-
[x: string]: unknown;
|
|
3634
|
-
kty: string;
|
|
3635
|
-
crv?: string | undefined;
|
|
3636
|
-
x?: string | undefined;
|
|
3637
|
-
y?: string | undefined;
|
|
3638
|
-
e?: string | undefined;
|
|
3639
|
-
n?: string | undefined;
|
|
3640
|
-
alg?: string | undefined;
|
|
3641
|
-
d?: string | undefined;
|
|
3642
|
-
dp?: string | undefined;
|
|
3643
|
-
dq?: string | undefined;
|
|
3644
|
-
ext?: boolean | undefined;
|
|
3645
|
-
k?: string | undefined;
|
|
3646
|
-
key_ops?: string[] | undefined;
|
|
3647
|
-
kid?: string | undefined;
|
|
3648
|
-
oth?: {
|
|
3649
|
-
[x: string]: unknown;
|
|
3650
|
-
d?: string | undefined;
|
|
3651
|
-
r?: string | undefined;
|
|
3652
|
-
t?: string | undefined;
|
|
3653
|
-
}[] | undefined;
|
|
3654
|
-
p?: string | undefined;
|
|
3655
|
-
q?: string | undefined;
|
|
3656
|
-
qi?: string | undefined;
|
|
3657
|
-
use?: string | undefined;
|
|
3658
|
-
x5c?: string[] | undefined;
|
|
3659
|
-
x5t?: string | undefined;
|
|
3660
|
-
'x5t#S256'?: string | undefined;
|
|
3661
|
-
x5u?: string | undefined;
|
|
3662
|
-
} | undefined;
|
|
3663
|
-
jkt?: string | undefined;
|
|
3664
|
-
} | undefined;
|
|
3665
|
-
};
|
|
3666
|
-
dpop: {
|
|
3667
|
-
jwk: {
|
|
3668
|
-
[x: string]: unknown;
|
|
3669
|
-
kty: string;
|
|
3670
|
-
crv?: string | undefined;
|
|
3671
|
-
x?: string | undefined;
|
|
3672
|
-
y?: string | undefined;
|
|
3673
|
-
e?: string | undefined;
|
|
3674
|
-
n?: string | undefined;
|
|
3675
|
-
alg?: string | undefined;
|
|
3676
|
-
d?: string | undefined;
|
|
3677
|
-
dp?: string | undefined;
|
|
3678
|
-
dq?: string | undefined;
|
|
3679
|
-
ext?: boolean | undefined;
|
|
3680
|
-
k?: string | undefined;
|
|
3681
|
-
key_ops?: string[] | undefined;
|
|
3682
|
-
kid?: string | undefined;
|
|
3683
|
-
oth?: {
|
|
3684
|
-
[x: string]: unknown;
|
|
3685
|
-
d?: string | undefined;
|
|
3686
|
-
r?: string | undefined;
|
|
3687
|
-
t?: string | undefined;
|
|
3688
|
-
}[] | undefined;
|
|
3689
|
-
p?: string | undefined;
|
|
3690
|
-
q?: string | undefined;
|
|
3691
|
-
qi?: string | undefined;
|
|
3692
|
-
use?: string | undefined;
|
|
3693
|
-
x5c?: string[] | undefined;
|
|
3694
|
-
x5t?: string | undefined;
|
|
3695
|
-
'x5t#S256'?: string | undefined;
|
|
3696
|
-
x5u?: string | undefined;
|
|
3697
|
-
};
|
|
3698
|
-
} | undefined;
|
|
3699
|
-
scheme: SupportedAuthenticationScheme;
|
|
3700
|
-
accessToken: string;
|
|
3701
|
-
authorizationServer: string;
|
|
3702
|
-
}>;
|
|
3703
|
-
//#endregion
|
|
3704
|
-
export { type AccessTokenErrorResponse, type AccessTokenProfileJwtPayload, type AccessTokenResponse, type AuthorizationChallengeErrorResponse, type AuthorizationChallengeRequest, type AuthorizationChallengeResponse, type AuthorizationCodeGrantIdentifier, AuthorizationErrorResponse, AuthorizationResponse, type AuthorizationServerMetadata, type CalculateJwkThumbprintOptions, type CallbackContext, type ClientAttestationJwtHeader, type ClientAttestationJwtPayload, type ClientAttestationPopJwtHeader, type ClientAttestationPopJwtPayload, type ClientAuthenticationCallback, type ClientAuthenticationCallbackOptions, type ClientAuthenticationClientAttestationJwtOptions, type ClientAuthenticationClientSecretBasicOptions, type ClientAuthenticationClientSecretPostOptions, type ClientAuthenticationDynamicOptions, type ClientAuthenticationNoneOptions, type CreateAuthorizationRequestUrlOptions, type CreateClientAttestationJwtOptions, type CreateJarAuthorizationRequestOptions, type CreatePkceReturn, type CreatePushedAuthorizationErrorResponseOptions, type CreatePushedAuthorizationResponseOptions, type DecodeJwtHeaderResult, type DecodeJwtOptions, type DecodeJwtResult, type DecryptJweCallback, type DecryptJweCallbackOptions, type EncryptJweCallback, type GenerateRandomCallback, HashAlgorithm, type HashCallback, type HttpMethod, IdTokenJwtHeader, IdTokenJwtPayload, InvalidFetchResponseError, type JarAuthorizationRequest, type JarRequestObjectPayload, type JweEncryptor, type Jwk, type JwkSet, type JwtHeader, type JwtPayload, type JwtSigner, type JwtSignerCustom, type JwtSignerDid, type JwtSignerJwk, type JwtSignerWithJwk, type JwtSignerX5c, Oauth2AuthorizationServer, type Oauth2AuthorizationServerOptions, Oauth2Client, Oauth2ClientAuthorizationChallengeError, Oauth2ClientErrorResponseError, type Oauth2ClientOptions, Oauth2Error, Oauth2ErrorCodes, type Oauth2ErrorOptions, type Oauth2ErrorResponse, Oauth2JwtParseError, Oauth2JwtVerificationError, Oauth2ResourceServer, type Oauth2ResourceServerOptions, Oauth2ResourceUnauthorizedError, Oauth2ServerErrorResponseError, type Oid4vcTsConfig, type ParseAuthorizationChallengeRequestOptions, type ParseAuthorizationChallengeRequestResult, ParseAuthorizationRequestOptions, type ParsePushedAuthorizationRequestOptions, type ParsePushedAuthorizationRequestResult, PkceCodeChallengeMethod, type PreAuthorizedCodeGrantIdentifier, type PushedAuthorizationRequestUriPrefix, type RefreshTokenGrantIdentifier, type RequestClientAttestationOptions, type RequestDpopOptions, type RequestLike, type ResourceRequestOptions, type ResourceRequestResponseNotOk, type ResourceRequestResponseOk, type RetrieveAuthorizationCodeAccessTokenOptions, type RetrievePreAuthorizedCodeAccessTokenOptions, type SignJwtCallback, SupportedAuthenticationScheme, SupportedClientAuthenticationMethod, type TokenIntrospectionResponse, type VerifiedClientAttestationJwt, type VerifyAccessTokenRequestReturn, type VerifyAuthorizationChallengeRequestOptions, type VerifyAuthorizationChallengeRequestReturn, VerifyIdTokenJwtOptions, type VerifyJwtCallback, type VerifyPushedAuthorizationRequestOptions, type VerifyPushedAuthorizationRequestReturn, type VerifyResourceRequestOptions, type WwwAuthenticateHeaderChallenge, authorizationCodeGrantIdentifier, calculateJwkThumbprint, clientAuthenticationAnonymous, clientAuthenticationClientAttestationJwt, clientAuthenticationClientSecretBasic, clientAuthenticationClientSecretPost, clientAuthenticationDynamic, clientAuthenticationNone, createClientAttestationJwt, createJarAuthorizationRequest, decodeJwt, decodeJwtHeader, fetchAuthorizationServerMetadata, fetchJwks, fetchWellKnownMetadata, fullySpecifiedCoseAlgorithmArrayToJwaSignatureAlgorithmArray, fullySpecifiedCoseAlgorithmToJwaSignatureAlgorithm, getAuthorizationServerMetadataFromList, getGlobalConfig, isJwkInSet, jwaSignatureAlgorithmArrayToFullySpecifiedCoseAlgorithmArray, jwaSignatureAlgorithmToFullySpecifiedCoseAlgorithm, jwtAuthorizationRequestJwtHeaderTyp, jwtHeaderFromJwtSigner, jwtSignerFromJwt, parseAuthorizationResponseRedirectUrl, parsePushedAuthorizationRequestUriReferenceValue, preAuthorizedCodeGrantIdentifier, pushedAuthorizationRequestUriPrefix, refreshTokenGrantIdentifier, resourceRequest, setGlobalConfig, signedAuthorizationRequestJwtHeaderTyp, validateJarRequestParams, verifyClientAttestationJwt, verifyIdTokenJwt, verifyJwt, verifyResourceRequest, zAlgValueNotNone, zAuthorizationCodeGrantIdentifier, zAuthorizationErrorResponse, zAuthorizationResponse, zAuthorizationResponseFromUriParams, zAuthorizationServerMetadata, zCompactJwe, zCompactJwt, zIdTokenJwtHeader, zIdTokenJwtPayload, zJarAuthorizationRequest, zJarRequestObjectPayload, zJwk, zJwkSet, zJwtHeader, zJwtPayload, zOauth2ErrorResponse, zPreAuthorizedCodeGrantIdentifier, zPushedAuthorizationRequestUriPrefix, zRefreshTokenGrantIdentifier };
|
|
3705
|
-
//# sourceMappingURL=index.d.cts.map
|