@relyper/sp-auth 0.1.0 → 0.4.0

package/dist/oidc/client.js

@@ -0,0 +1,340 @@
+import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+import { createDiscoveryLoader } from './discovery.js';
+import { defaultClaimsToIdentity } from './claims.js';
+import { codeChallengeFor, createCodeVerifier, createNonce, createState } from './pkce.js';
+import { RelyperOidcError } from './types.js';
+/**
+ * OIDC client for a Relyper service provider.
+ *
+ * Authorization Code Flow with PKCE and a confidential client: the client secret
+ * only ever travels from this server to the IdP's token endpoint, never through
+ * the browser. Every ID token is verified against the IdP's JWKS before a single
+ * claim in it is believed.
+ */
+const DEFAULT_SCOPE = 'openid email profile roles tenant teams';
+function resolveOptions(options) {
+    const required = ['issuer', 'clientId', 'clientSecret', 'redirectUri'];
+    for (const key of required) {
+        if (!options[key] || typeof options[key] !== 'string') {
+            throw new TypeError('@relyper/sp-auth/oidc: ' + key + ' is required.');
+        }
+    }
+    const requiredRoles = options.requiredRole === undefined
+        ? []
+        : (Array.isArray(options.requiredRole) ? options.requiredRole : [options.requiredRole]).filter(Boolean);
+    return {
+        issuer: trimTrailingSlashes(options.issuer),
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        redirectUri: options.redirectUri,
+        scope: options.scope ?? DEFAULT_SCOPE,
+        tokenEndpointAuthMethod: options.tokenEndpointAuthMethod ?? null,
+        requiredRoles,
+        roleMatch: options.roleMatch ?? 'any',
+        requireEmail: options.requireEmail ?? true,
+        useUserInfo: options.useUserInfo ?? false,
+        clockToleranceSeconds: options.clockToleranceSeconds ?? 60,
+        discoveryTtlMs: options.discoveryTtlMs ?? 3_600_000,
+        requestTimeoutMs: options.requestTimeoutMs ?? 10_000
+    };
+}
+export function createRelyperOidcClient(options) {
+    const resolved = resolveOptions(options);
+    const doFetch = options.fetch ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        throw new TypeError('@relyper/sp-auth/oidc: no fetch implementation available.');
+    }
+    const mapClaims = options.mapClaims ?? defaultClaimsToIdentity;
+    const discovery = createDiscoveryLoader({
+        issuer: resolved.issuer,
+        ttlMs: resolved.discoveryTtlMs,
+        requestTimeoutMs: resolved.requestTimeoutMs,
+        fetch: doFetch
+    });
+    // One JWKS per jwks_uri. jose caches the keys, refetches on an unknown `kid`
+    // and rate-limits those refetches, which is exactly the key-rotation behaviour
+    // we would otherwise have to build by hand.
+    const jwksCache = new Map();
+    function jwksFor(uri) {
+        let jwks = jwksCache.get(uri);
+        if (!jwks) {
+            jwks = createRemoteJWKSet(new URL(uri), {
+                timeoutDuration: resolved.requestTimeoutMs,
+                cooldownDuration: 30_000,
+                // The JWKS has to travel the same path as every other call to the IdP,
+                // so a proxy-aware or test fetch covers key retrieval as well.
+                [customFetch]: doFetch
+            });
+            jwksCache.set(uri, jwks);
+        }
+        return jwks;
+    }
+    function authMethod(document) {
+        if (resolved.tokenEndpointAuthMethod)
+            return resolved.tokenEndpointAuthMethod;
+        const supported = document.token_endpoint_auth_methods_supported ?? [];
+        if (supported.includes('client_secret_basic'))
+            return 'client_secret_basic';
+        if (supported.includes('client_secret_post'))
+            return 'client_secret_post';
+        // The OIDC default for a confidential client when the document says nothing.
+        return 'client_secret_basic';
+    }
+    async function exchangeCode(document, code, codeVerifier) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: resolved.redirectUri,
+            code_verifier: codeVerifier
+        });
+        const headers = {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json'
+        };
+        if (authMethod(document) === 'client_secret_basic') {
+            // RFC 6749 section 2.3.1: both halves are form-urlencoded before the
+            // base64. Skipping that breaks any secret holding a reserved character.
+            const credentials = encodeURIComponent(resolved.clientId) + ':' + encodeURIComponent(resolved.clientSecret);
+            headers.authorization = 'Basic ' + Buffer.from(credentials, 'utf8').toString('base64');
+        }
+        else {
+            body.set('client_id', resolved.clientId);
+            body.set('client_secret', resolved.clientSecret);
+        }
+        let response;
+        try {
+            response = await doFetch(document.token_endpoint, {
+                method: 'POST',
+                headers,
+                body: body.toString(),
+                signal: AbortSignal.timeout(resolved.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('token_exchange_failed', 'The identity provider could not be reached.', { cause });
+        }
+        const payload = await readJson(response);
+        if (!response.ok) {
+            // The IdP's own error code is safe to log; the body may hold more, so only
+            // the two documented fields are carried over.
+            const error = typeof payload?.error === 'string' ? payload.error : 'HTTP ' + response.status;
+            const description = typeof payload?.error_description === 'string' ? payload.error_description : '';
+            throw new RelyperOidcError('token_exchange_failed', 'The login could not be completed.', {
+                detail: description ? error + ': ' + description : error
+            });
+        }
+        const idToken = typeof payload?.id_token === 'string' ? payload.id_token : '';
+        if (!idToken) {
+            throw new RelyperOidcError('token_exchange_failed', 'The identity provider returned no ID token.', {
+                detail: 'token response without id_token'
+            });
+        }
+        return {
+            idToken,
+            accessToken: typeof payload?.access_token === 'string' ? payload.access_token : '',
+            tokenType: typeof payload?.token_type === 'string' ? payload.token_type : 'Bearer',
+            expiresIn: typeof payload?.expires_in === 'number' ? payload.expires_in : null,
+            refreshToken: typeof payload?.refresh_token === 'string' ? payload.refresh_token : null,
+            scope: typeof payload?.scope === 'string' ? payload.scope : null
+        };
+    }
+    async function verifyIdToken(document, idToken, nonce) {
+        let payload;
+        try {
+            const result = await jwtVerify(idToken, jwksFor(document.jwks_uri), {
+                issuer: document.issuer,
+                audience: resolved.clientId,
+                clockTolerance: resolved.clockToleranceSeconds,
+                // Pinning the algorithms is what stops a token downgraded to `none`, or
+                // to an HMAC signed with the provider's public key, from being accepted.
+                algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'ES256', 'ES384']
+            });
+            payload = result.payload;
+        }
+        catch (cause) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                cause,
+                detail: cause instanceof Error ? cause.message : undefined
+            });
+        }
+        // OpenID Connect Core 3.1.3.7 step 11: the nonce ties this token to the login
+        // this browser started. Without the check a token captured elsewhere replays.
+        if (payload.nonce !== nonce) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'nonce mismatch'
+            });
+        }
+        // Step 12: with several audiences, `azp` has to name this client.
+        if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== resolved.clientId) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'azp does not match the client id'
+            });
+        }
+        if (typeof payload.sub !== 'string' || !payload.sub) {
+            throw new RelyperOidcError('invalid_id_token', 'The identity provider returned an invalid token.', {
+                detail: 'missing sub claim'
+            });
+        }
+        return payload;
+    }
+    async function fetchUserInfo(document, accessToken) {
+        if (!document.userinfo_endpoint || !accessToken)
+            return {};
+        let response;
+        try {
+            response = await doFetch(document.userinfo_endpoint, {
+                method: 'GET',
+                headers: { authorization: 'Bearer ' + accessToken, accept: 'application/json' },
+                signal: AbortSignal.timeout(resolved.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('userinfo_failed', 'The identity provider could not be reached.', { cause });
+        }
+        if (!response.ok) {
+            throw new RelyperOidcError('userinfo_failed', 'The user profile could not be read.', {
+                detail: 'HTTP ' + response.status
+            });
+        }
+        return (await readJson(response)) ?? {};
+    }
+    return {
+        options: resolved,
+        discover: () => discovery.load(),
+        async createAuthorizationRequest(requestOptions = {}) {
+            const document = await discovery.load();
+            const transaction = {
+                state: createState(),
+                nonce: createNonce(),
+                codeVerifier: createCodeVerifier(),
+                returnTo: safeReturnTo(requestOptions.returnTo)
+            };
+            const url = new URL(document.authorization_endpoint);
+            url.searchParams.set('response_type', 'code');
+            url.searchParams.set('client_id', resolved.clientId);
+            url.searchParams.set('redirect_uri', resolved.redirectUri);
+            url.searchParams.set('scope', resolved.scope);
+            url.searchParams.set('state', transaction.state);
+            url.searchParams.set('nonce', transaction.nonce);
+            url.searchParams.set('code_challenge', codeChallengeFor(transaction.codeVerifier));
+            url.searchParams.set('code_challenge_method', 'S256');
+            if (requestOptions.prompt)
+                url.searchParams.set('prompt', requestOptions.prompt);
+            if (requestOptions.loginHint)
+                url.searchParams.set('login_hint', requestOptions.loginHint);
+            return { url: url.toString(), transaction };
+        },
+        async completeLogin({ query, transaction }) {
+            const idpError = firstValue(query.error);
+            if (idpError) {
+                throw new RelyperOidcError('idp_error', 'The identity provider refused the login.', {
+                    status: 401,
+                    detail: [idpError, firstValue(query.error_description)].filter(Boolean).join(': ')
+                });
+            }
+            const state = firstValue(query.state);
+            // A constant-time comparison would buy nothing here: whoever can measure
+            // the response already holds the cookie this is compared against.
+            if (!state || state !== transaction.state) {
+                throw new RelyperOidcError('invalid_state', 'The login could not be verified. Please try again.', {
+                    status: 400,
+                    detail: state ? 'state does not match the login transaction' : 'state parameter missing'
+                });
+            }
+            const code = firstValue(query.code);
+            if (!code) {
+                throw new RelyperOidcError('idp_error', 'The identity provider returned no authorization code.', {
+                    status: 400
+                });
+            }
+            const document = await discovery.load();
+            const tokens = await exchangeCode(document, code, transaction.codeVerifier);
+            const idClaims = await verifyIdToken(document, tokens.idToken, transaction.nonce);
+            let claims = { ...idClaims };
+            if (resolved.useUserInfo) {
+                const userInfo = await fetchUserInfo(document, tokens.accessToken);
+                // OpenID Connect Core 5.3.2: a UserInfo response whose `sub` differs from
+                // the ID token's must be discarded outright.
+                if (userInfo.sub && userInfo.sub !== idClaims.sub) {
+                    throw new RelyperOidcError('userinfo_failed', 'The user profile could not be read.', {
+                        detail: 'userinfo sub does not match the id token'
+                    });
+                }
+                claims = { ...claims, ...userInfo };
+            }
+            const identity = mapClaims(claims);
+            if (resolved.requireEmail && !identity.email) {
+                throw new RelyperOidcError('missing_email', 'The identity provider supplied no e-mail address.', {
+                    status: 403
+                });
+            }
+            if (resolved.requiredRoles.length && !matchesRoles(identity.roles, resolved.requiredRoles, resolved.roleMatch)) {
+                throw new RelyperOidcError('missing_role', 'Your account does not have access to this application.', {
+                    status: 403,
+                    detail: 'presented roles: ' + (identity.roles.join(', ') || '(none)')
+                });
+            }
+            return { identity, claims, tokens };
+        },
+        hasRole(identity, role, match = 'any') {
+            const wanted = Array.isArray(role) ? role : [role];
+            return matchesRoles(identity.roles, wanted, match);
+        },
+        async endSessionUrl(endSessionOptions = {}) {
+            const document = await discovery.load();
+            if (!document.end_session_endpoint)
+                return null;
+            const url = new URL(document.end_session_endpoint);
+            if (endSessionOptions.idTokenHint)
+                url.searchParams.set('id_token_hint', endSessionOptions.idTokenHint);
+            if (endSessionOptions.postLogoutRedirectUri) {
+                url.searchParams.set('post_logout_redirect_uri', endSessionOptions.postLogoutRedirectUri);
+            }
+            url.searchParams.set('client_id', resolved.clientId);
+            return url.toString();
+        }
+    };
+}
+function matchesRoles(actual, required, match) {
+    return match === 'all'
+        ? required.every((role) => actual.includes(role))
+        : required.some((role) => actual.includes(role));
+}
+function firstValue(value) {
+    if (Array.isArray(value))
+        return typeof value[0] === 'string' ? value[0] : '';
+    return typeof value === 'string' ? value : '';
+}
+async function readJson(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+function trimTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value[end - 1] === '/')
+        end -= 1;
+    return value.slice(0, end);
+}
+/**
+ * Only a local path is ever used as a post-login target. An absolute URL, or a
+ * protocol-relative one starting with two slashes, would turn the login route
+ * into an open redirect. Backslashes are rejected too, because some browsers
+ * normalise them to forward slashes and would follow "/\\evil.example".
+ */
+export function safeReturnTo(value, fallback = '/') {
+    const candidate = typeof value === 'string' ? value.trim() : '';
+    if (!candidate)
+        return fallback;
+    if (!candidate.startsWith('/'))
+        return fallback;
+    if (candidate.startsWith('//'))
+        return fallback;
+    if (candidate.includes('\\'))
+        return fallback;
+    return candidate;
+}
+//# sourceMappingURL=client.js.map

package/dist/oidc/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oidc/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AAEzG,OAAO,EAAE,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC3F,OAAO,EACL,gBAAgB,EASjB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AAEH,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAkChE,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,CAAU,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,SAAS,CAAC,yBAAyB,GAAG,GAAG,GAAG,eAAe,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS;QACtD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE1G,OAAO;QACL,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,aAAa;QACrC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;QAChE,aAAa;QACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;QACzC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,EAAE;QAC1D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,SAAS;QACnD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,MAAM;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAE/D,MAAM,SAAS,GAAoB,qBAAqB,CAAC;QACvD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,cAAc;QAC9B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+EAA+E;IAC/E,4CAA4C;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,SAAS,OAAO,CAAC,GAAW;QAC1B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;gBACtC,eAAe,EAAE,QAAQ,CAAC,gBAAgB;gBAC1C,gBAAgB,EAAE,MAAM;gBACxB,uEAAuE;gBACvE,+DAA+D;gBAC/D,CAAC,WAAW,CAAC,EAAE,OAAO;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,UAAU,CAAC,QAA+B;QACjD,IAAI,QAAQ,CAAC,uBAAuB;YAAE,OAAO,QAAQ,CAAC,uBAAuB,CAAC;QAC9E,MAAM,SAAS,GAAG,QAAQ,CAAC,qCAAqC,IAAI,EAAE,CAAC;QACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC5E,IAAI,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAAE,OAAO,oBAAoB,CAAC;QAC1E,6EAA6E;QAC7E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAA+B,EAC/B,IAAY,EACZ,YAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QAEF,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,qBAAqB,EAAE,CAAC;YACnD,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC5G,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,2EAA2E;YAC3E,8CAA8C;YAC9C,MAAM,KAAK,GAAG,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7F,MAAM,WAAW,GAAG,OAAO,OAAO,EAAE,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,mCAAmC,EAAE;gBACvF,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,uBAAuB,EAAE,6CAA6C,EAAE;gBACjG,MAAM,EAAE,iCAAiC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO;YACP,WAAW,EAAE,OAAO,OAAO,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YAClF,SAAS,EAAE,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YAClF,SAAS,EAAE,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YAC9E,YAAY,EAAE,OAAO,OAAO,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;YACvF,KAAK,EAAE,OAAO,OAAO,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;SACjE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,QAA+B,EAC/B,OAAe,EACf,KAAa;QAEb,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAClE,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,cAAc,EAAE,QAAQ,CAAC,qBAAqB;gBAC9C,wEAAwE;gBACxE,yEAAyE;gBACzE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,KAAK;gBACL,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,kEAAkE;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC9F,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,kCAAkC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,kDAAkD,EAAE;gBACjG,MAAM,EAAE,mBAAmB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAA+B,EAAE,WAAmB;QAC/E,IAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE;gBACnD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC/E,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,qCAAqC,EAAE;gBACnF,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QAEjB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE;QAEhC,KAAK,CAAC,0BAA0B,CAAC,cAAc,GAAgC,EAAE;YAC/E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,WAAW,GAA4B;gBAC3C,KAAK,EAAE,WAAW,EAAE;gBACpB,KAAK,EAAE,WAAW,EAAE;gBACpB,YAAY,EAAE,kBAAkB,EAAE;gBAClC,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC;aAChD,CAAC;YAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;YACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,cAAc,CAAC,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,cAAc,CAAC,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;YAE3F,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE;YACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,0CAA0C,EAAE;oBAClF,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,oDAAoD,EAAE;oBAChG,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,yBAAyB;iBACzF,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,uDAAuD,EAAE;oBAC/F,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC5E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAElF,IAAI,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;gBACnE,0EAA0E;gBAC1E,6CAA6C;gBAC7C,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;oBAClD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,qCAAqC,EAAE;wBACnF,MAAM,EAAE,0CAA0C;qBACnD,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAEnC,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,mDAAmD,EAAE;oBAC/F,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/G,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,wDAAwD,EAAE;oBACnG,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,mBAAmB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;QAED,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,GAAG,KAAK;YACnC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,iBAAiB,GAAG,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,iBAAiB,CAAC,WAAW;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACxG,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,CAAC;gBAC5C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;YAC5F,CAAC;YACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,QAAkB,EAAE,KAAoB;IAC9E,OAAO,KAAK,KAAK,KAAK;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAoC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,QAAQ,GAAG,GAAG;IACzD,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/oidc/discovery.d.ts

@@ -0,0 +1,15 @@
+import { type OidcDiscoveryDocument } from './types.js';
+export type DiscoveryLoaderOptions = {
+    issuer: string;
+    ttlMs: number;
+    requestTimeoutMs: number;
+    fetch: typeof globalThis.fetch;
+};
+export type DiscoveryLoader = {
+    load(): Promise<OidcDiscoveryDocument>;
+    /** Drops the cache, e.g. after a JWKS lookup failed against a rotated IdP. */
+    invalidate(): void;
+};
+export declare function discoveryUrl(issuer: string): string;
+export declare function createDiscoveryLoader(options: DiscoveryLoaderOptions): DiscoveryLoader;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/oidc/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAY1E,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvC,8EAA8E;IAC9E,UAAU,IAAI,IAAI,CAAC;CACpB,CAAC;AAEF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA8EtF"}

package/dist/oidc/discovery.js

@@ -0,0 +1,90 @@
+import { RelyperOidcError } from './types.js';
+/**
+ * Reads and caches the IdP's discovery document.
+ *
+ * The endpoints are never hardcoded: an IdP is free to move them, and the
+ * document is the contract. Concurrent callers share one in-flight request so a
+ * burst of logins does not turn into a burst of requests against the IdP.
+ */
+const REQUIRED_FIELDS = ['issuer', 'authorization_endpoint', 'token_endpoint', 'jwks_uri'];
+export function discoveryUrl(issuer) {
+    const base = issuer.replace(/\/+$/, '');
+    return base + '/.well-known/openid-configuration';
+}
+export function createDiscoveryLoader(options) {
+    let cached = null;
+    let inFlight = null;
+    async function fetchDocument() {
+        const url = discoveryUrl(options.issuer);
+        let response;
+        try {
+            response = await options.fetch(url, {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(options.requestTimeoutMs)
+            });
+        }
+        catch (cause) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider could not be reached.', {
+                cause,
+                detail: 'GET ' + url
+            });
+        }
+        if (!response.ok) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider could not be reached.', {
+                detail: 'GET ' + url + ' returned HTTP ' + response.status
+            });
+        }
+        let document;
+        try {
+            document = (await response.json());
+        }
+        catch (cause) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider returned a malformed discovery document.', {
+                cause,
+                detail: 'GET ' + url
+            });
+        }
+        for (const field of REQUIRED_FIELDS) {
+            if (typeof document?.[field] !== 'string' || !document[field]) {
+                throw new RelyperOidcError('discovery_failed', 'The discovery document is incomplete.', {
+                    detail: 'missing field: ' + field
+                });
+            }
+        }
+        // The issuer is the identity of the IdP and is compared against the `iss`
+        // claim later. A document that names a different issuer than the one we
+        // configured means we are talking to the wrong party.
+        if (trimSlash(document.issuer) !== trimSlash(options.issuer)) {
+            throw new RelyperOidcError('discovery_failed', 'The identity provider reports a different issuer.', {
+                detail: 'configured ' + options.issuer + ', document ' + document.issuer
+            });
+        }
+        return document;
+    }
+    return {
+        async load() {
+            const now = Date.now();
+            if (cached && cached.expiresAt > now)
+                return cached.document;
+            if (inFlight)
+                return inFlight;
+            inFlight = fetchDocument()
+                .then((document) => {
+                cached = { document, expiresAt: Date.now() + options.ttlMs };
+                return document;
+            })
+                .finally(() => {
+                inFlight = null;
+            });
+            return inFlight;
+        },
+        invalidate() {
+            cached = null;
+        }
+    };
+}
+function trimSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+//# sourceMappingURL=discovery.js.map

package/dist/oidc/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/oidc/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA8B,MAAM,YAAY,CAAC;AAE1E;;;;;;GAMG;AAEH,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,UAAU,CAAU,CAAC;AAepG,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,IAAI,GAAG,mCAAmC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,IAAI,MAAM,GAAkE,IAAI,CAAC;IACjF,IAAI,QAAQ,GAA0C,IAAI,CAAC;IAE3D,KAAK,UAAU,aAAa;QAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6CAA6C,EAAE;gBAC5F,KAAK;gBACL,MAAM,EAAE,MAAM,GAAG,GAAG;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6CAA6C,EAAE;gBAC5F,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,iBAAiB,GAAG,QAAQ,CAAC,MAAM;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAA+B,CAAC;QACpC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,gEAAgE,EAAE;gBAC/G,KAAK;gBACL,MAAM,EAAE,MAAM,GAAG,GAAG;aACrB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,OAAO,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,uCAAuC,EAAE;oBACtF,MAAM,EAAE,iBAAiB,GAAG,KAAK;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,mDAAmD,EAAE;gBAClG,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAC,MAAM;aACzE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;YAC7D,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAE9B,QAAQ,GAAG,aAAa,EAAE;iBACvB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjB,MAAM,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC;YAClB,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;YAEL,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,UAAU;YACR,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/oidc/pkce.d.ts

@@ -0,0 +1,6 @@
+export declare function createCodeVerifier(): string;
+export declare function createState(): string;
+export declare function createNonce(): string;
+/** S256 challenge for a verifier. `plain` is deliberately not offered. */
+export declare function codeChallengeFor(verifier: string): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/oidc/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":"AAeA,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/oidc/pkce.js

@@ -0,0 +1,26 @@
+import { randomBytes, createHash } from 'node:crypto';
+/**
+ * Client side of Proof Key for Code Exchange (RFC 7636) plus the random values
+ * that protect the authorization request: `state` against CSRF on the callback,
+ * `nonce` against a replayed ID token.
+ *
+ * All three are 256 bits of CSPRNG output rendered as base64url, which lands in
+ * the 43 characters RFC 7636 asks for as a minimum.
+ */
+function randomUrlSafe(byteLength = 32) {
+    return randomBytes(byteLength).toString('base64url');
+}
+export function createCodeVerifier() {
+    return randomUrlSafe(32);
+}
+export function createState() {
+    return randomUrlSafe(32);
+}
+export function createNonce() {
+    return randomUrlSafe(32);
+}
+/** S256 challenge for a verifier. `plain` is deliberately not offered. */
+export function codeChallengeFor(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/oidc/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/oidc/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD;;;;;;;GAOG;AAEH,SAAS,aAAa,CAAC,UAAU,GAAG,EAAE;IACpC,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/oidc/session.d.ts

@@ -0,0 +1,47 @@
+import type { RelyperIdentity } from '../types.js';
+import type { RelyperLoginTransaction } from './types.js';
+export type SessionPayload = {
+    identity: RelyperIdentity;
+    /** Seconds since the epoch at which the IdP login happened. */
+    authenticatedAt: number;
+    /**
+     * Identifier of this login. The session itself is stateless, so this exists
+     * for the application: recording it at logout and rejecting it afterwards is
+     * what turns "the browser dropped its cookie" into a revocation that also
+     * stops a cookie someone copied beforehand.
+     */
+    sessionId: string;
+    /**
+     * ID token, kept only when `keepIdToken` is on -- it is needed as the
+     * `id_token_hint` of an RP-initiated logout and for nothing else.
+     */
+    idToken?: string;
+};
+/** Opaque, unguessable identifier for one login. */
+export declare function createSessionId(): string;
+export type SealedCodec<T> = {
+    seal(value: T, ttlSeconds: number): Promise<string>;
+    /** Returns null for anything that is not a valid, unexpired token of this codec. */
+    open(token: string | undefined | null): Promise<T | null>;
+};
+export declare function createSessionCodec(secret: string): SealedCodec<SessionPayload>;
+export declare function createLoginCodec(secret: string): SealedCodec<RelyperLoginTransaction>;
+/** Constant-time string comparison for CSRF-style tokens of equal expected length. */
+export declare function safeEqual(a: string, b: string): boolean;
+export type CookieOptions = {
+    path?: string;
+    domain?: string;
+    maxAgeSeconds?: number;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+};
+/**
+ * Minimal cookie serialisation, so consumers are not forced to install a cookie
+ * plugin just to use this package.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+/** Cookie header that deletes `name`. */
+export declare function clearCookie(name: string, options?: CookieOptions): string;
+export declare function parseCookies(header: string | undefined | null): Record<string, string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/oidc/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/oidc/session.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAwB1D,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,oDAAoD;AACpD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,oFAAoF;IACpF,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CAC3D,CAAC;AAqCF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,CAE9E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,uBAAuB,CAAC,CAErF;AAED,sFAAsF;AACtF,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKvD;AAID,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAchG;AAED,yCAAyC;AACzC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAE7E;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBtF"}