@openverifiable/connector-bluesky 1.0.1 → 1.0.2

package/lib/client-assertion.d.ts

@@ -1,7 +1,8 @@
 /**
  * Client Assertion Generation for private_key_jwt
  *
- * Generates JWT client assertion for OAuth token endpoint authentication
+ * Generates JWT client assertion for OAuth authentication
+ * Used for both PAR (Pushed Authorization Request) and token endpoint requests
  * RFC 7523: https://datatracker.ietf.org/doc/html/rfc7523
  */
 import type { BlueskyConfig } from './types.js';
@@ -14,6 +15,11 @@ import type { BlueskyConfig } from './types.js';
  *
  * For now, we'll support both approaches - if privateKeyJwk is in config, use it.
  * Otherwise, the server should provide an endpoint to generate assertions.
+ *
+ * @param clientId - The OAuth client identifier
+ * @param audience - The audience URL (PAR endpoint or token endpoint)
+ * @param config - Bluesky connector configuration
+ * @returns JWT client assertion string, or null if private key is not available
  */
-export declare function generateClientAssertion(clientId: string, tokenEndpoint: string, config: BlueskyConfig): Promise<string | null>;
+export declare function generateClientAssertion(clientId: string, audience: string, config: BlueskyConfig): Promise<string | null>;
 //# sourceMappingURL=client-assertion.d.ts.map

package/lib/client-assertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmCxB"}
+{"version":3,"file":"client-assertion.d.ts","sourceRoot":"","sources":["../src/client-assertion.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmCxB"}

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAIV,eAAe,EACf,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAkmB9B;;GAEG;AACH,QAAA,MAAM,sBAAsB,EAAE,eAAe,CAAC,eAAe,CAW5D,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAIV,eAAe,EACf,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAupB9B;;GAEG;AACH,QAAA,MAAM,sBAAsB,EAAE,eAAe,CAAC,eAAe,CAW5D,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/lib/index.js

@@ -619,7 +619,8 @@ async function fetchAuthorizationServerMetadataFromUrl(authServerUrl) {
 /**
  * Client Assertion Generation for private_key_jwt
  *
- * Generates JWT client assertion for OAuth token endpoint authentication
+ * Generates JWT client assertion for OAuth authentication
+ * Used for both PAR (Pushed Authorization Request) and token endpoint requests
  * RFC 7523: https://datatracker.ietf.org/doc/html/rfc7523
  */
 /**
@@ -631,8 +632,13 @@ async function fetchAuthorizationServerMetadataFromUrl(authServerUrl) {
  *
  * For now, we'll support both approaches - if privateKeyJwk is in config, use it.
  * Otherwise, the server should provide an endpoint to generate assertions.
+ *
+ * @param clientId - The OAuth client identifier
+ * @param audience - The audience URL (PAR endpoint or token endpoint)
+ * @param config - Bluesky connector configuration
+ * @returns JWT client assertion string, or null if private key is not available
  */
-async function generateClientAssertion(clientId, tokenEndpoint, config) {
+async function generateClientAssertion(clientId, audience, config) {
     // Check if private key is available in config (for server-side connectors)
     // In production, this would come from Vault via a server endpoint
     const privateKeyJwkStr = config.privateKeyJwk;
@@ -649,7 +655,7 @@ async function generateClientAssertion(clientId, tokenEndpoint, config) {
         const jwt = new SignJWT({
             iss: clientId,
             sub: clientId,
-            aud: tokenEndpoint,
+            aud: audience,
             jti,
             exp: now + 600,
             iat: now,
@@ -954,6 +960,55 @@ const getAuthorizationUri = (getConfig) => async ({ state, redirectUri, ...rest
         code_challenge_method: pkce.codeChallengeMethod,
         ...('login_hint' in rest && rest.login_hint ? { login_hint: String(rest.login_hint) } : {}),
     });
+    // Add client assertion for confidential clients (required for PAR)
+    if (validatedConfig.tokenEndpointAuthMethod === 'private_key_jwt') {
+        try {
+            const clientAssertion = await generateClientAssertion(effectiveClientId, authServerMetadata.pushed_authorization_request_endpoint, validatedConfig);
+            if (clientAssertion) {
+                parParams.append('client_assertion', clientAssertion);
+                parParams.append('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+            }
+            else {
+                // Fallback to assertion endpoint
+                const assertionEndpoint = config.assertionEndpoint;
+                if (assertionEndpoint) {
+                    const assertionResponse = await got.post(assertionEndpoint, {
+                        json: {
+                            clientId: effectiveClientId,
+                            tokenEndpoint: authServerMetadata.pushed_authorization_request_endpoint
+                        },
+                        headers: {
+                            'X-API-Key': config.assertionApiKey || '',
+                        },
+                        timeout: { request: defaultTimeout },
+                    });
+                    const assertionData = parseJson(assertionResponse.body);
+                    if (assertionData?.client_assertion) {
+                        parParams.append('client_assertion', assertionData.client_assertion);
+                        parParams.append('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
+                    }
+                    else {
+                        throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+                            error: 'Client assertion required for PAR but could not be generated',
+                        });
+                    }
+                }
+                else {
+                    throw new ConnectorError(ConnectorErrorCodes.InvalidConfig, {
+                        error: 'Client assertion required for PAR. Provide privateKeyJwk or assertionEndpoint.',
+                    });
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof ConnectorError) {
+                throw error;
+            }
+            throw new ConnectorError(ConnectorErrorCodes.General, {
+                error: `Failed to generate client assertion for PAR: ${error instanceof Error ? error.message : 'Unknown error'}`,
+            });
+        }
+    }
     const { requestUri, nonce } = await makePARRequest(authServerMetadata.pushed_authorization_request_endpoint, parParams, dpopKeyPair);
     // Store PKCE verifier and DPoP key pair in state store
     // Export DPoP keypair as JWK for storage

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openverifiable/connector-bluesky",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Bluesky/AT Protocol OAuth connector for LogTo with PAR, PKCE, and DPoP support",
   "author": "OpenVerifiable (https://github.com/openverifiable)",
   "homepage": "https://openverifiable.org",