@pidgeon-ai/issuer 0.1.1 → 0.2.0

package/dist/{chunk-CCOFMK5K.js → chunk-BXZ2EI2Y.js}

@@ -128,12 +128,229 @@ function keycloakDirectory(options) {
   };
 }
 
+// src/person.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createPublicKey,
+  randomBytes,
+  timingSafeEqual,
+  verify
+} from "crypto";
+var MIN_SECRET = 32;
+var FLOW_COOKIE = "pidgeon_issuer_flow";
+var CODE_SECONDS = 60;
+var FLOW_SECONDS = 600;
+var SKEW = 60;
+var UPSTREAM_ALGS = ["RS256", "ES256", "EdDSA"];
+function checkSecret(secret) {
+  if (!secret || secret.length < MIN_SECRET) {
+    throw new Error(
+      `A person's sign-in needs PIDGEON_ISSUER_SECRET, ${MIN_SECRET} characters or more. It seals the sign-in in progress and the code; there is no default.`
+    );
+  }
+  return secret;
+}
+var b64url = (bytes) => Buffer.from(bytes).toString("base64url");
+function sealKey(secret, purpose) {
+  return createHash("sha256").update(`pidgeon issuer seal\0${purpose}\0${secret}`).digest();
+}
+function seal(secret, purpose, value) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", sealKey(secret, purpose), iv);
+  cipher.setAAD(Buffer.from(purpose));
+  const body = Buffer.concat([cipher.update(JSON.stringify(value), "utf8"), cipher.final()]);
+  return b64url(Buffer.concat([iv, body, cipher.getAuthTag()]));
+}
+function unseal(secret, purpose, token) {
+  if (!token) return null;
+  try {
+    const raw = Buffer.from(token, "base64url");
+    if (raw.length < 29) return null;
+    const decipher = createDecipheriv("aes-256-gcm", sealKey(secret, purpose), raw.subarray(0, 12));
+    decipher.setAAD(Buffer.from(purpose));
+    decipher.setAuthTag(raw.subarray(raw.length - 16));
+    const text2 = Buffer.concat([
+      decipher.update(raw.subarray(12, raw.length - 16)),
+      decipher.final()
+    ]).toString("utf8");
+    return JSON.parse(text2);
+  } catch {
+    return null;
+  }
+}
+function pkceChallenge(verifier) {
+  return b64url(createHash("sha256").update(verifier).digest());
+}
+function pkceHolds(verifier, challenge) {
+  const a = Buffer.from(pkceChallenge(verifier));
+  const b = Buffer.from(challenge);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function cookieOf(request, name) {
+  for (const part of (request.headers.get("cookie") ?? "").split(";")) {
+    const eq = part.indexOf("=");
+    if (eq > 0 && part.slice(0, eq).trim() === name) {
+      return decodeURIComponent(part.slice(eq + 1).trim());
+    }
+  }
+  return null;
+}
+var ProviderRefused = class extends Error {
+};
+function provider(options, fetcher, now) {
+  const issuer = options.issuer.replace(/\/$/, "");
+  let configuration = null;
+  let keys = null;
+  function discover() {
+    if (!configuration || configuration.at <= now() - 36e5) {
+      const url = options.discoveryUrl ?? `${issuer}/.well-known/openid-configuration`;
+      const value = (async () => {
+        const response = await fetcher(url, { headers: { accept: "application/json" } });
+        if (!response.ok) throw new Error(`${url} answered ${response.status}.`);
+        const body = await response.json();
+        if (body.issuer?.replace(/\/$/, "") !== issuer) {
+          throw new Error(`${url} names the issuer ${body.issuer}, not ${issuer}.`);
+        }
+        return body;
+      })();
+      configuration = { at: now(), value };
+      value.catch(() => {
+        if (configuration?.value === value) configuration = null;
+      });
+    }
+    return configuration.value;
+  }
+  async function key(kid) {
+    const find = () => keys?.value.find((one) => (kid ? one.kid === kid : true) && one.use !== "enc") ?? null;
+    const fresh = keys && keys.at > now() - 3e5;
+    if (fresh && find()) return find();
+    if (keys && keys.at > now() - 1e4) return null;
+    const response = await fetcher((await discover()).jwks_uri);
+    const body = await response.json().catch(() => ({}));
+    keys = { at: now(), value: Array.isArray(body.keys) ? body.keys : [] };
+    return find();
+  }
+  async function authorizeUrl(input) {
+    const url = new URL((await discover()).authorization_endpoint);
+    url.search = new URLSearchParams({
+      response_type: "code",
+      client_id: options.clientId,
+      redirect_uri: input.redirectUri,
+      scope: "openid email",
+      state: input.state,
+      nonce: input.nonce,
+      code_challenge: pkceChallenge(input.verifier),
+      code_challenge_method: "S256"
+    }).toString();
+    return url.toString();
+  }
+  async function redeem(input) {
+    const form = new URLSearchParams({
+      grant_type: "authorization_code",
+      code: input.code,
+      redirect_uri: input.redirectUri,
+      code_verifier: input.verifier
+    });
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    if (options.tokenAuth === "client_secret_post") {
+      form.set("client_id", options.clientId);
+      form.set("client_secret", options.clientSecret);
+    } else {
+      const pair = `${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`;
+      headers.authorization = `Basic ${Buffer.from(pair).toString("base64")}`;
+    }
+    const response = await fetcher((await discover()).token_endpoint, {
+      method: "POST",
+      headers,
+      body: form
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || typeof body.id_token !== "string") {
+      throw new ProviderRefused(
+        `The identity provider did not sign the person in (${body.error ?? response.status}).`
+      );
+    }
+    return check(body.id_token, input.nonce);
+  }
+  async function check(token, nonce) {
+    const parts = token.split(".");
+    if (parts.length !== 3) throw new ProviderRefused("The provider sent no ID token.");
+    let header;
+    let claims;
+    try {
+      header = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+      claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    } catch {
+      throw new ProviderRefused("The provider sent no ID token.");
+    }
+    if (!header.alg || !UPSTREAM_ALGS.includes(header.alg)) {
+      throw new ProviderRefused(`The provider's ID token is signed with ${header.alg}.`);
+    }
+    const jwk = await key(header.kid);
+    if (!jwk || !signatureHolds(header.alg, jwk, `${parts[0]}.${parts[1]}`, parts[2])) {
+      throw new ProviderRefused("The provider's ID token is not signed by its keys.");
+    }
+    const at = Math.floor(now() / 1e3);
+    if (typeof claims.iss !== "string" || claims.iss.replace(/\/$/, "") !== issuer) {
+      throw new ProviderRefused("The provider's ID token is from another issuer.");
+    }
+    const aud = claims.aud;
+    const audiences = Array.isArray(aud) ? aud : [aud];
+    if (!audiences.includes(options.clientId)) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (audiences.length > 1 && claims.azp !== options.clientId) {
+      throw new ProviderRefused("The provider's ID token is for another client.");
+    }
+    if (typeof claims.exp !== "number" || claims.exp + SKEW <= at) {
+      throw new ProviderRefused("The provider's ID token has expired.");
+    }
+    if (typeof claims.iat === "number" && claims.iat > at + SKEW) {
+      throw new ProviderRefused("The provider's ID token is from the future.");
+    }
+    if (claims.nonce !== nonce) {
+      throw new ProviderRefused("The provider's ID token is for another sign-in.");
+    }
+    if (typeof claims.sub !== "string" || !claims.sub) {
+      throw new ProviderRefused("The provider's ID token names nobody.");
+    }
+    if (claims.email_verified !== true || typeof claims.email !== "string") {
+      throw new ProviderRefused("The identity provider has not verified this person\u2019s address.");
+    }
+    return {
+      sub: claims.sub,
+      email: claims.email.trim().toLowerCase(),
+      authTime: typeof claims.auth_time === "number" ? claims.auth_time : at
+    };
+  }
+  return { authorizeUrl, redeem };
+}
+function signatureHolds(alg, jwk, input, signature) {
+  try {
+    const key = createPublicKey({ key: jwk, format: "jwk" });
+    const data = Buffer.from(input);
+    const sig = Buffer.from(signature, "base64url");
+    if (alg === "EdDSA") return jwk.kty === "OKP" && verify(null, data, key, sig);
+    if (alg === "ES256") {
+      return jwk.kty === "EC" && jwk.crv === "P-256" && verify("sha256", data, { key, dsaEncoding: "ieee-p1363" }, sig);
+    }
+    return jwk.kty === "RSA" && verify("sha256", data, key, sig);
+  } catch {
+    return false;
+  }
+}
+
 // src/signer.ts
 import { readFile } from "fs/promises";
 
 // ../id/dist/chunk-QDQDZSU7.js
-import { createHash } from "crypto";
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash as createHash2 } from "crypto";
+import { createHash as createHash22, randomBytes as randomBytes2 } from "crypto";
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -149,7 +366,7 @@ __export(post_core_wasm_exports, {
   policyMaxAge: () => policyMaxAge,
   publicKey: () => publicKey,
   sign: () => sign,
-  verify: () => verify
+  verify: () => verify2
 });
 function generateSeed() {
   try {
@@ -235,7 +452,7 @@ function sign(seed, message) {
     wasm.__wbindgen_add_to_stack_pointer(16);
   }
 }
-function verify(public_key, message, signature) {
+function verify2(public_key, message, signature) {
   try {
     const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
     const ptr0 = passArray8ToWasm0(public_key, wasm.__wbindgen_export3);
@@ -480,9 +697,9 @@ function wasm2() {
   }
   return post_core_wasm_exports;
 }
-var b64url = (bytes) => Buffer.from(bytes).toString("base64url");
+var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
 function jwkThumbprint(publicKey2) {
-  return createHash("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${b64url(publicKey2)}"}`).digest("base64url");
+  return createHash2("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${b64url2(publicKey2)}"}`).digest("base64url");
 }
 function verifyBytes(publicKey2, message, signature) {
   try {
@@ -515,7 +732,7 @@ function bytesOf(body) {
   return typeof body === "string" ? new TextEncoder().encode(body) : body;
 }
 function contentDigest(body) {
-  return `sha-256=:${createHash2("sha256").update(bytesOf(body)).digest("base64")}:`;
+  return `sha-256=:${createHash22("sha256").update(bytesOf(body)).digest("base64")}:`;
 }
 async function verifyRequest(input, options) {
   const headers = /* @__PURE__ */ new Map();
@@ -674,8 +891,34 @@ async function loadConfig(path, env = process.env) {
     const old = await fileSigner(here(entry.key));
     retired.push({ kid: old.kid, publicKey: old.publicKey, notAfter: new Date(entry.not_after) });
   }
+  let person;
+  if (file.person) {
+    const { oidc } = file.person;
+    const secretName = oidc?.client_secret_env ?? "PIDGEON_PERSON_CLIENT_SECRET";
+    if (!oidc?.issuer || !oidc.client_id) {
+      throw new Error(
+        `${path}: \`person.oidc\` names the provider's \`issuer\` and the \`client_id\`.`
+      );
+    }
+    const clientSecret = env[secretName];
+    if (!clientSecret) {
+      throw new Error(`${path}: set ${secretName}, the issuer's client secret at ${oidc.issuer}.`);
+    }
+    person = {
+      secret: checkSecret(env.PIDGEON_ISSUER_SECRET),
+      oidc: {
+        issuer: oidc.issuer,
+        discoveryUrl: oidc.discovery_url,
+        clientId: oidc.client_id,
+        clientSecret,
+        tokenAuth: oidc.token_auth
+      },
+      emailDomains: file.person.email_domains
+    };
+  }
   return {
     domain: file.domain,
+    person,
     issuer: file.issuer,
     organisation: file.organisation,
     signer,
@@ -715,7 +958,7 @@ function directoryFrom(file, path, env) {
 }
 
 // src/issuer.ts
-import { createHash as createHash3, createPublicKey, randomUUID, verify as verify2 } from "crypto";
+import { createHash as createHash3, createPublicKey as createPublicKey2, randomBytes as randomBytes3, randomUUID, verify as verify3 } from "crypto";
 var TOKEN_EXCHANGE2 = "urn:ietf:params:oauth:grant-type:token-exchange";
 var TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
 var TOKEN_TYPE_ID = "urn:ietf:params:oauth:token-type:id_token";
@@ -726,6 +969,9 @@ var PATHS = {
   card: "/.well-known/post/card",
   directory: "/.well-known/http-message-signatures-directory",
   token: "/api/post/oidc/token",
+  authorize: "/api/post/oidc/authorize",
+  /** The issuer's own: where the company's identity provider sends a person back. Cloud has none. */
+  callback: "/api/post/oidc/callback",
   jwks: "/api/post/oidc/jwks",
   grants: "/api/post/grants"
 };
@@ -736,8 +982,8 @@ var NEW_ADDRESS_DAYS = 30;
 var EXCHANGE_SIGNATURE_SECONDS = 600;
 var EXCHANGE_COMPONENTS = ["@method", "@authority", "@path", "from", "content-digest"];
 var GRANT_HEADER = "post-grant";
-var b64url2 = (bytes) => Buffer.from(bytes).toString("base64url");
-var encode = (value) => b64url2(JSON.stringify(value));
+var b64url3 = (bytes) => Buffer.from(bytes).toString("base64url");
+var encode = (value) => b64url3(JSON.stringify(value));
 var iso = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, "Z");
 function memoryReplayStore(now = () => Date.now()) {
   const seen = /* @__PURE__ */ new Map();
@@ -768,10 +1014,12 @@ function createIssuer(options) {
   const replay = options.replay ?? memoryReplayStore(now);
   const organisation = options.organisation ?? domain;
   const nowSeconds = () => Math.floor(now() / 1e3);
+  const person = options.person ? { ...options.person, secret: checkSecret(options.person.secret) } : null;
+  const upstream = person ? provider(person.oidc, fetcher, now) : null;
   async function jws(header, payload) {
     const input = `${encode({ ...header, kid: options.signer.kid })}.${encode(payload)}`;
     const signature = await options.signer.sign(new TextEncoder().encode(input));
-    return `${input}.${b64url2(signature)}`;
+    return `${input}.${b64url3(signature)}`;
   }
   function readOurs(token, typ) {
     const parts = token.replace(/\s+/g, "").split(".");
@@ -781,11 +1029,11 @@ function createIssuer(options) {
       if (header?.alg !== "EdDSA" || header?.typ !== typ) return null;
       const key = publishedIssuerKeys().find((candidate) => candidate.kid === header.kid);
       if (!key) return null;
-      const signed = verify2(
+      const signed = verify3(
         null,
         Buffer.from(`${parts[0]}.${parts[1]}`),
-        createPublicKey({
-          key: { kty: "OKP", crv: "Ed25519", x: b64url2(key.publicKey) },
+        createPublicKey2({
+          key: { kty: "OKP", crv: "Ed25519", x: b64url3(key.publicKey) },
           format: "jwk"
         }),
         Buffer.from(parts[2], "base64url")
@@ -812,7 +1060,7 @@ function createIssuer(options) {
       ...publishedIssuerKeys().map((key) => ({
         kid: key.kid,
         alg: "Ed25519",
-        pub: b64url2(key.publicKey),
+        pub: b64url3(key.publicKey),
         not_after: iso(key.notAfter)
       })),
       ...unique(agents.map((agent) => agent.key)).map((x) => ({
@@ -852,7 +1100,7 @@ function createIssuer(options) {
       keys: publishedIssuerKeys().map((key) => ({
         kty: "OKP",
         crv: "Ed25519",
-        x: b64url2(key.publicKey),
+        x: b64url3(key.publicKey),
         kid: key.kid,
         alg: "EdDSA",
         use: "sig"
@@ -864,9 +1112,17 @@ function createIssuer(options) {
       issuer,
       token_endpoint: `${issuer}${PATHS.token}`,
       jwks_uri: `${issuer}${PATHS.jwks}`,
-      grant_types_supported: [TOKEN_EXCHANGE2],
-      // No person signs in here yet: there is no authorization endpoint.
-      response_types_supported: [],
+      ...person ? {
+        authorization_endpoint: `${issuer}${PATHS.authorize}`,
+        grant_types_supported: ["authorization_code", TOKEN_EXCHANGE2],
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        scopes_supported: ["openid", "email"]
+      } : {
+        grant_types_supported: [TOKEN_EXCHANGE2],
+        // No person signs in here: there is no authorization endpoint.
+        response_types_supported: []
+      },
       subject_types_supported: ["public"],
       id_token_signing_alg_values_supported: ["EdDSA"],
       token_endpoint_auth_methods_supported: ["none"],
@@ -886,6 +1142,8 @@ function createIssuer(options) {
         "standing",
         "card",
         "grant",
+        "grants",
+        "nonce",
         "cnf",
         "act",
         "sub_type"
@@ -977,20 +1235,25 @@ function createIssuer(options) {
   const clientCache = /* @__PURE__ */ new Map();
   async function clientHost(clientId) {
     if (!clientId) throw new Refused("invalid_target", "audience is the site's client_id.");
+    return (await site(clientId)).host;
+  }
+  async function site(clientId) {
     const listed = options.clients?.find((client) => client.client_id === clientId);
-    if (listed) return listed.host.toLowerCase();
+    if (listed) {
+      return { host: listed.host.toLowerCase(), redirectUris: listed.redirect_uris ?? [] };
+    }
     let url;
     try {
       url = new URL(clientId);
     } catch {
       throw new Refused("invalid_target", `${clientId} is not a site this issuer knows.`);
     }
-    const allowed = (options.clientMetadataHosts ?? []).map((host2) => host2.toLowerCase());
+    const allowed = (options.clientMetadataHosts ?? []).map((host) => host.toLowerCase());
     if (url.protocol !== "https:" || !allowed.includes(url.hostname.toLowerCase())) {
       throw new Refused("invalid_target", `${clientId} is not a site this issuer knows.`);
     }
     const held = clientCache.get(clientId);
-    if (held && held.at > now() - 3e5) return held.host;
+    if (held && held.at > now() - 3e5) return held.site;
     const response = await fetcher(clientId, {
       redirect: "error",
       headers: { accept: "application/json" },
@@ -1002,16 +1265,20 @@ function createIssuer(options) {
       if (text2.length <= 64 * 1024) document = JSON.parse(text2);
     } catch {
     }
-    const redirect = Array.isArray(document.redirect_uris) ? document.redirect_uris[0] : null;
-    if (document.client_id !== clientId || typeof redirect !== "string") {
+    const redirects = Array.isArray(document.redirect_uris) ? document.redirect_uris.filter((uri) => typeof uri === "string") : [];
+    if (document.client_id !== clientId || redirects.length === 0) {
+      throw new Refused("invalid_target", `${clientId} does not describe a site.`);
+    }
+    let found;
+    try {
+      found = { host: new URL(redirects[0]).hostname.toLowerCase(), redirectUris: redirects };
+    } catch {
       throw new Refused("invalid_target", `${clientId} does not describe a site.`);
     }
-    const host = new URL(redirect).hostname.toLowerCase();
-    clientCache.set(clientId, { at: now(), host });
-    return host;
+    clientCache.set(clientId, { at: now(), site: found });
+    return found;
   }
-  async function exchange(request) {
-    const body = await request.text();
+  async function exchange(request, body) {
     const form = new URLSearchParams(body);
     if (form.get("grant_type") !== TOKEN_EXCHANGE2) {
       throw new Refused("unsupported_grant_type", `Use ${TOKEN_EXCHANGE2}.`);
@@ -1211,6 +1478,170 @@ function createIssuer(options) {
     const grants = await grantsFor(agent);
     return json({ object: "list", data: grants.map((grant) => ({ object: "grant", ...grant })) });
   }
+  const callbackUrl = `${issuer}${PATHS.callback}`;
+  const random = () => b64url3(randomBytes3(32));
+  function flowCookie(value, maxAge) {
+    const secure = issuer.startsWith("https:") ? "; Secure" : "";
+    return `${FLOW_COOKIE}=${value}; Path=${PATHS.callback}; Max-Age=${maxAge}; HttpOnly; SameSite=Lax${secure}`;
+  }
+  function backToSite(redirectUri, state, values, headers = {}) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(values)) url.searchParams.set(name, value);
+    if (state) url.searchParams.set("state", state);
+    url.searchParams.set("iss", issuer);
+    return new Response(null, {
+      status: 302,
+      headers: { location: url.toString(), "cache-control": "no-store", ...headers }
+    });
+  }
+  async function authorize(url) {
+    const params = url.searchParams;
+    for (const name of ["client_id", "redirect_uri", "state", "nonce", "code_challenge"]) {
+      if (params.getAll(name).length > 1) return page(`${name} is given more than once`);
+    }
+    const clientId = params.get("client_id");
+    const redirectUri = params.get("redirect_uri");
+    if (!clientId || !redirectUri) return page("client_id and redirect_uri are required");
+    const known = await site(clientId).catch((error) => {
+      if (error instanceof Refused) return null;
+      throw error;
+    });
+    if (!known) return page(`${clientId} is not a site this issuer knows`);
+    if (!known.redirectUris.includes(redirectUri)) {
+      return page(`${redirectUri} is not where ${clientId} receives sign-ins`);
+    }
+    const state = params.get("state");
+    const fail = (error, description) => backToSite(redirectUri, state, { error, error_description: description });
+    if (params.get("response_type") !== "code") {
+      return fail("unsupported_response_type", "response_type is code.");
+    }
+    const scope = params.get("scope") ?? "";
+    if (!scope.split(" ").includes("openid")) {
+      return fail("invalid_scope", "scope includes openid.");
+    }
+    const challenge = params.get("code_challenge");
+    if (!challenge || !/^[A-Za-z0-9_-]{43}$/.test(challenge) || params.get("code_challenge_method") !== "S256") {
+      return fail("invalid_request", "PKCE is required: code_challenge with S256.");
+    }
+    const flow = {
+      site: { clientId, redirectUri, state, nonce: params.get("nonce"), challenge, scope },
+      upstream: { state: random(), nonce: random(), verifier: random() },
+      exp: nowSeconds() + FLOW_SECONDS
+    };
+    const location = await upstream.authorizeUrl({
+      redirectUri: callbackUrl,
+      state: flow.upstream.state,
+      nonce: flow.upstream.nonce,
+      verifier: flow.upstream.verifier
+    });
+    return new Response(null, {
+      status: 302,
+      headers: {
+        location,
+        "cache-control": "no-store",
+        "set-cookie": flowCookie(seal(person.secret, "flow", flow), FLOW_SECONDS)
+      }
+    });
+  }
+  async function callback(request, url) {
+    const flow = unseal(person.secret, "flow", cookieOf(request, FLOW_COOKIE));
+    const clear = { "set-cookie": flowCookie("", 0) };
+    if (!flow || flow.exp <= nowSeconds() || url.searchParams.get("state") !== flow.upstream.state) {
+      return page("this sign-in was not started in this browser. Start again from the site", clear);
+    }
+    const back = (values) => backToSite(flow.site.redirectUri, flow.site.state, values, clear);
+    const code = url.searchParams.get("code");
+    if (url.searchParams.get("error") || !code) {
+      return back({ error: "access_denied", error_description: "The person did not sign in." });
+    }
+    let who;
+    try {
+      who = await upstream.redeem({
+        code,
+        redirectUri: callbackUrl,
+        verifier: flow.upstream.verifier,
+        nonce: flow.upstream.nonce
+      });
+    } catch (error) {
+      if (!(error instanceof ProviderRefused)) throw error;
+      return back({ error: "access_denied", error_description: error.message });
+    }
+    const domains = (person.emailDomains ?? [domain]).map((one) => one.toLowerCase());
+    if (!domains.includes(who.email.slice(who.email.lastIndexOf("@") + 1))) {
+      return back({
+        error: "access_denied",
+        error_description: `${who.email} is not an address this issuer signs people in with.`
+      });
+    }
+    if ((await options.directory.agents()).some((agent) => agent.address === who.email)) {
+      return back({
+        error: "access_denied",
+        error_description: `${who.email} is an agent's address, not a person's.`
+      });
+    }
+    const sealed = {
+      jti: randomUUID(),
+      clientId: flow.site.clientId,
+      redirectUri: flow.site.redirectUri,
+      challenge: flow.site.challenge,
+      nonce: flow.site.nonce,
+      scope: flow.site.scope,
+      sub: who.sub,
+      email: who.email,
+      authTime: who.authTime,
+      exp: nowSeconds() + CODE_SECONDS
+    };
+    return back({ code: seal(person.secret, "code", sealed) });
+  }
+  async function redeemCode(form) {
+    const verifier = form.get("code_verifier");
+    const clientId = form.get("client_id");
+    if (!verifier || !clientId) {
+      throw new Refused("invalid_request", "code, code_verifier and client_id are required.");
+    }
+    const code = unseal(person.secret, "code", form.get("code"));
+    if (!code) throw new Refused("invalid_grant", "That code is not valid.");
+    if (code.clientId !== clientId) {
+      throw new Refused("invalid_grant", "That code was issued to a different client.");
+    }
+    if (!await replay.use(`code ${code.jti}`, code.exp + 60)) {
+      throw new Refused("invalid_grant", "That code has already been used.");
+    }
+    if (code.exp <= nowSeconds()) throw new Refused("invalid_grant", "That code has expired.");
+    const redirectUri = form.get("redirect_uri");
+    if (redirectUri !== null && redirectUri !== code.redirectUri) {
+      throw new Refused("invalid_grant", "redirect_uri does not match the authorization request.");
+    }
+    if (!pkceHolds(verifier, code.challenge)) {
+      throw new Refused("invalid_grant", "code_verifier does not match the code_challenge.");
+    }
+    const iat = nowSeconds();
+    const idToken = await jws(
+      { alg: "EdDSA", typ: "JWT" },
+      {
+        iss: issuer,
+        aud: clientId,
+        iat,
+        exp: iat + ID_TOKEN_SECONDS,
+        auth_time: code.authTime,
+        ...code.nonce ? { nonce: code.nonce } : {},
+        jti: randomUUID(),
+        sub: code.sub,
+        kind: "person",
+        email: code.email,
+        email_verified: true,
+        // Grants here are the organisation's, to its agents; a person gives none at this issuer.
+        grants: []
+      }
+    );
+    return json({
+      access_token: idToken,
+      token_type: "Bearer",
+      expires_in: ID_TOKEN_SECONDS,
+      id_token: idToken,
+      scope: code.scope
+    });
+  }
   async function handle(request) {
     const url = new URL(request.url);
     const path = url.pathname;
@@ -1237,7 +1668,16 @@ function createIssuer(options) {
           300
         );
       }
-      if (request.method === "POST" && path === PATHS.token) return await exchange(request);
+      if (request.method === "POST" && path === PATHS.token) {
+        const body = await request.text();
+        const form = new URLSearchParams(body);
+        if (person && form.get("grant_type") === "authorization_code") {
+          return await redeemCode(form);
+        }
+        return await exchange(request, body);
+      }
+      if (person && get && path === PATHS.authorize) return await authorize(url);
+      if (person && get && path === PATHS.callback) return await callback(request, url);
       if (get && path === PATHS.grants) return await listGrants(request);
       const status = /^\/api\/post\/grants\/(grt_[A-Za-z0-9_-]+)\/status$/.exec(path);
       if (get && status) {
@@ -1266,6 +1706,17 @@ function createIssuer(options) {
 function unique(values) {
   return [...new Set(values)];
 }
+function page(reason, headers = {}) {
+  return new Response(`This sign-in can\u2019t go on: ${reason}.
+`, {
+    status: 400,
+    headers: {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "no-store",
+      ...headers
+    }
+  });
+}
 function json(value, maxAge = 0, status = 200) {
   return text(JSON.stringify(value), "application/json", maxAge, status);
 }
@@ -1426,4 +1877,4 @@ export {
   UsageError2 as UsageError,
   runIssuer
 };
-//# sourceMappingURL=chunk-CCOFMK5K.js.map
+//# sourceMappingURL=chunk-BXZ2EI2Y.js.map