@openid4vc/oauth2 0.7.0-alpha-20261007094201 → 0.7.0

package/dist/index.d.mts

@@ -807,7 +807,7 @@ interface DpopVerificationOptions {
    *
    * @default 0
    */
-  allowedClockSkewSeconds?: number;
+  allowedSkewInSeconds?: number;
   /**
    * Callback to enforce one-time usage of the DPoP proof `jti`.
    *
@@ -3305,10 +3305,22 @@ interface Oauth2AuthorizationServerOptions {
    * Callbacks required for the oauth2 authorization server
    */
   callbacks: Omit<CallbackContext, 'decryptJwe' | 'encryptJwe'>;
+  /**
+   * Default allowed clock skew in seconds for DPoP and client attestation verification.
+   *
+   * Applied to the `nbf` and `exp` checks of client attestation and client attestation PoP JWTs, and to the
+   * `iat` checks of DPoP proofs (which are only performed when `maxProofAgeSeconds` is provided).
+   *
+   * A per-call `allowedSkewInSeconds` in the client attestation or DPoP options takes precedence, including `0`.
+   *
+   * @default 0
+   */
+  allowedSkewInSeconds?: number;
 }
 export declare class Oauth2AuthorizationServer {
   private options;
   constructor(options: Oauth2AuthorizationServerOptions);
+  private withDefaultSkew;
   createAuthorizationServerMetadata(authorizationServerMetadata: AuthorizationServerMetadata): {
     [x: string]: unknown;
     issuer: string;

package/dist/index.mjs

@@ -736,7 +736,7 @@ async function verifyDpopJwt(options) {
 		if (options.maxProofAgeSeconds !== void 0) {
 			if (options.maxProofAgeSeconds < 0) throw new Oauth2Error(`maxProofAgeSeconds must be greater than or equal to 0, received '${options.maxProofAgeSeconds}'.`);
 			const nowInSeconds = dateToSeconds(now);
-			const allowedSkew = options.allowedClockSkewSeconds ?? 0;
+			const allowedSkew = options.allowedSkewInSeconds ?? 0;
 			const proofAgeInSeconds = nowInSeconds - payload.iat;
 			if (payload.iat > nowInSeconds + allowedSkew) throw new Oauth2Error(`Dpop jwt contains iat value '${payload.iat}' that is in the future relative to now '${nowInSeconds}' with allowed skew '${allowedSkew}'.`);
 			if (proofAgeInSeconds > options.maxProofAgeSeconds + allowedSkew) throw new Oauth2Error(`Dpop jwt is too old. Proof age is '${proofAgeInSeconds}' seconds, but max allowed age is '${options.maxProofAgeSeconds}' seconds with allowed skew '${allowedSkew}'.`);
@@ -1121,7 +1121,7 @@ async function verifyAuthorizationRequestDpop(options, request, callbacks, now)
 		request,
 		allowedSigningAlgs: options.allowedSigningAlgs,
 		maxProofAgeSeconds: options.maxProofAgeSeconds,
-		allowedClockSkewSeconds: options.allowedClockSkewSeconds,
+		allowedSkewInSeconds: options.allowedSkewInSeconds,
 		assertJtiUniqueness: options.assertJtiUniqueness,
 		now
 	}) : void 0;
@@ -2050,7 +2050,7 @@ async function calculateCodeChallenge(options) {
 //#region src/access-token/verify-access-token-request.ts
 async function verifyPreAuthorizedCodeAccessTokenRequest(options) {
 	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
-	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
+	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks, options.now) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.preAuthorizedCode !== options.expectedPreAuthorizedCode) throw new Oauth2ServerErrorResponseError({
 		error: "invalid_grant",
@@ -2084,7 +2084,7 @@ async function verifyPreAuthorizedCodeAccessTokenRequest(options) {
 }
 async function verifyAuthorizationCodeAccessTokenRequest(options) {
 	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
-	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
+	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks, options.now) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.code !== options.expectedCode) throw new Oauth2ServerErrorResponseError({
 		error: "invalid_grant",
@@ -2104,7 +2104,7 @@ async function verifyAuthorizationCodeAccessTokenRequest(options) {
 }
 async function verifyRefreshTokenAccessTokenRequest(options) {
 	await verifyAccessTokenRequestPkce(options.pkce, options.accessTokenRequest, options.callbacks);
-	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks) : void 0;
+	const dpopResult = options.dpop ? await verifyAccessTokenRequestDpop(options.dpop, options.request, options.callbacks, options.now) : void 0;
 	const clientAttestationResult = options.clientAttestation ? await verifyAccessTokenRequestClientAttestation(options.clientAttestation, options.authorizationServerMetadata, options.callbacks, dpopResult?.jwkThumbprint, options.now) : void 0;
 	if (options.grant.refreshToken !== options.expectedRefreshToken) throw new Oauth2ServerErrorResponseError({
 		error: "invalid_grant",
@@ -2194,7 +2194,7 @@ async function assertConfirmationKeyMatchesDpopKey(confirmationJwk, dpopJwkThumb
 		error_description: "Expected the DPoP JWK thumbprint value to match the JWK thumbprint of the client attestation confirmation JWK. Ensure both DPoP and client attestation use the same key."
 	}, { status: 401 });
 }
-async function verifyAccessTokenRequestDpop(options, request, callbacks) {
+async function verifyAccessTokenRequestDpop(options, request, callbacks, now) {
 	if (options.required && !options.jwt) throw new Oauth2ServerErrorResponseError({
 		error: "invalid_dpop_proof",
 		error_description: "Missing required DPoP proof"
@@ -2208,8 +2208,9 @@ async function verifyAccessTokenRequestDpop(options, request, callbacks) {
 		expectedJwkThumbprint: options.expectedJwkThumbprint,
 		expectedNonce: options.expectedNonce,
 		maxProofAgeSeconds: options.maxProofAgeSeconds,
-		allowedClockSkewSeconds: options.allowedClockSkewSeconds,
-		assertJtiUniqueness: options.assertJtiUniqueness
+		allowedSkewInSeconds: options.allowedSkewInSeconds,
+		assertJtiUniqueness: options.assertJtiUniqueness,
+		now
 	});
 	return {
 		jwk: header.jwk,
@@ -2377,6 +2378,13 @@ var Oauth2AuthorizationServer = class {
 	constructor(options) {
 		this.options = options;
 	}
+	withDefaultSkew(options) {
+		if (!options) return void 0;
+		return {
+			...options,
+			allowedSkewInSeconds: options.allowedSkewInSeconds ?? this.options.allowedSkewInSeconds
+		};
+	}
 	createAuthorizationServerMetadata(authorizationServerMetadata) {
 		return parseWithErrorHandling(zAuthorizationServerMetadata, authorizationServerMetadata, "Error validating authorization server metadata");
 	}
@@ -2393,19 +2401,25 @@ var Oauth2AuthorizationServer = class {
 	verifyPreAuthorizedCodeAccessTokenRequest(options) {
 		return verifyPreAuthorizedCodeAccessTokenRequest({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			clientAttestation: this.withDefaultSkew(options.clientAttestation),
+			dpop: this.withDefaultSkew(options.dpop)
 		});
 	}
 	verifyAuthorizationCodeAccessTokenRequest(options) {
 		return verifyAuthorizationCodeAccessTokenRequest({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			clientAttestation: this.withDefaultSkew(options.clientAttestation),
+			dpop: this.withDefaultSkew(options.dpop)
 		});
 	}
 	verifyRefreshTokenAccessTokenRequest(options) {
 		return verifyRefreshTokenAccessTokenRequest({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			clientAttestation: this.withDefaultSkew(options.clientAttestation),
+			dpop: this.withDefaultSkew(options.dpop)
 		});
 	}
 	/**
@@ -2460,7 +2474,9 @@ var Oauth2AuthorizationServer = class {
 	verifyPushedAuthorizationRequest(options) {
 		return verifyPushedAuthorizationRequest({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			clientAttestation: this.withDefaultSkew(options.clientAttestation),
+			dpop: this.withDefaultSkew(options.dpop)
 		});
 	}
 	createPushedAuthorizationResponse(options) {
@@ -2478,7 +2494,9 @@ var Oauth2AuthorizationServer = class {
 	verifyAuthorizationChallengeRequest(options) {
 		return verifyAuthorizationChallengeRequest({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			clientAttestation: this.withDefaultSkew(options.clientAttestation),
+			dpop: this.withDefaultSkew(options.dpop)
 		});
 	}
 	createAuthorizationChallengeResponse(options) {
@@ -2506,13 +2524,15 @@ var Oauth2AuthorizationServer = class {
 	async verifyDpopJwt(options) {
 		return verifyDpopJwt({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			allowedSkewInSeconds: options.allowedSkewInSeconds ?? this.options.allowedSkewInSeconds
 		});
 	}
 	async verifyClientAttestation(options) {
 		return verifyClientAttestation({
 			...options,
-			callbacks: this.options.callbacks
+			callbacks: this.options.callbacks,
+			allowedSkewInSeconds: options.allowedSkewInSeconds ?? this.options.allowedSkewInSeconds
 		});
 	}
 };
@@ -3174,7 +3194,7 @@ async function verifyResourceRequest(options) {
 				expectedJwkThumbprint: tokenPayload.cnf?.jkt,
 				allowedSigningAlgs: authorizationServer.dpop_signing_alg_values_supported,
 				maxProofAgeSeconds: options.dpop?.maxProofAgeSeconds,
-				allowedClockSkewSeconds: options.dpop?.allowedClockSkewSeconds,
+				allowedSkewInSeconds: options.dpop?.allowedSkewInSeconds,
 				assertJtiUniqueness: options.dpop?.assertJtiUniqueness
 			})).header.jwk;
 		} catch (error) {