@samebase/identity-broker 0.2.0 → 0.4.0

package/README.md

@@ -81,7 +81,8 @@ export const {
 
 Keys: `npx identity-broker keys` prints the value for `IDENTITY_BROKER_KEYS`; `keys --rotate`
 advances it, and `keys --rotate --no-overlap` replaces a compromised key at once. Back up the key
-set: its salt makes every `sub`. `parseKeySet` checks a value before a deploy.
+set: its salt makes every `sub`. `parseKeySet` checks a value's shape before a deploy, and
+`assertKeySetUsable` signs a test token with it and verifies that token against its JWKS.
 
 ## Register an app's deployments
 

package/dist/cli/index.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import { createKeySet, parseKeySet, rotateKeySet, rotateKeySetWithoutOverlap, } from "../client/keys.js";
+import { createKeySet } from "../client/keys.js";
+import { rotateKeys } from "./rotate.js";
 const USAGE = `identity-broker keys                         print a new key set for IDENTITY_BROKER_KEYS
-identity-broker keys --rotate                read the current key set on stdin, print the rotated
-                                             one; the retired public key stays for 14 days
+identity-broker keys --rotate                read the current key set on stdin, print the
+                                             rotated one once it signs and verifies; the
+                                             retired public key stays for 14 days
 identity-broker keys --rotate --no-overlap   the same after a key compromise: retired keys are
                                              dropped at once; the salt is kept`;
 async function readStdin() {
@@ -25,10 +27,7 @@ async function main(argv) {
         return 2;
     }
     if (rotate) {
-        const current = parseKeySet(await readStdin());
-        const rotated = noOverlap
-            ? await rotateKeySetWithoutOverlap(current)
-            : await rotateKeySet(current);
+        const rotated = await rotateKeys(await readStdin(), { overlap: !noOverlap });
         process.stdout.write(`${JSON.stringify(rotated)}\n`);
         return 0;
     }

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,MAAM,KAAK,GAAG;;;;+EAIiE,CAAC;AAEhF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC,MAAM,0BAA0B,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,KAAK,GAAG;;;;;+EAKiE,CAAC;AAEhF,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChD,+FAA+F;IAC/F,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/cli/rotate.d.ts

@@ -0,0 +1,10 @@
+import { type KeySet } from "../client/keys.js";
+/**
+ * `identity-broker keys --rotate`. The input is only parsed, so a key set whose current key cannot
+ * sign, such as RSA under 2048 bits, can still be rotated out; the output must be usable. Its new
+ * current key is fresh, so with overlap a failure comes from a key carried over as retired, which
+ * only `--no-overlap` drops.
+ */
+export declare function rotateKeys(raw: string, options: {
+    overlap: boolean;
+}): Promise<KeySet>;

package/dist/cli/rotate.js

@@ -0,0 +1,25 @@
+import { assertKeySetUsable } from "../client/jwt.js";
+import { parseKeySet, rotateKeySet, rotateKeySetWithoutOverlap, } from "../client/keys.js";
+/**
+ * `identity-broker keys --rotate`. The input is only parsed, so a key set whose current key cannot
+ * sign, such as RSA under 2048 bits, can still be rotated out; the output must be usable. Its new
+ * current key is fresh, so with overlap a failure comes from a key carried over as retired, which
+ * only `--no-overlap` drops.
+ */
+export async function rotateKeys(raw, options) {
+    const input = parseKeySet(raw);
+    if (!options.overlap) {
+        const rotated = await rotateKeySetWithoutOverlap(input);
+        await assertKeySetUsable(rotated);
+        return rotated;
+    }
+    const rotated = await rotateKeySet(input);
+    try {
+        await assertKeySetUsable(rotated);
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}. That key is carried over as retired; rotate with --rotate --no-overlap to drop the retired keys at once.`, { cause: error });
+    }
+    return rotated;
+}
+//# sourceMappingURL=rotate.js.map

package/dist/cli/rotate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.js","sourceRoot":"","sources":["../../src/cli/rotate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,WAAW,EACX,YAAY,EACZ,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,OAA6B;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,4GAA4G,EACrK,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/client/connectors/google.d.ts

@@ -1,5 +1,9 @@
 import type { OidcConnector } from "./types.js";
-/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+/**
+ * Google as an OIDC connector: discovery and id_token claims. Google documents no `login` value
+ * for `prompt`, only `none`, `consent`, and `select_account`, so a fresh login through it answers
+ * `login_required`.
+ */
 export declare function google(credentials: {
     clientId: () => string;
     clientSecret: () => string;

package/dist/client/connectors/google.js

@@ -1,4 +1,8 @@
-/** Google as an OIDC connector: discovery, id_token claims, `prompt=login` for fresh logins. */
+/**
+ * Google as an OIDC connector: discovery and id_token claims. Google documents no `login` value
+ * for `prompt`, only `none`, `consent`, and `select_account`, so a fresh login through it answers
+ * `login_required`.
+ */
 export function google(credentials) {
     return {
         kind: "oidc",
@@ -6,6 +10,7 @@ export function google(credentials) {
         label: "Google",
         issuer: "https://accounts.google.com",
         scopes: ["openid", "email", "profile"],
+        promptLogin: false,
         clientId: credentials.clientId,
         clientSecret: credentials.clientSecret,
     };

package/dist/client/connectors/google.js.map

@@ -1 +1 @@
-{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/client/connectors/google.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QACtC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/client/connectors/google.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,WAItB;IACC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ;QAClC,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,6BAA6B;QACrC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QACtC,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC"}

package/dist/client/connectors/types.d.ts

@@ -30,6 +30,11 @@ export type OidcConnector = Credentials & {
     label: string;
     issuer: string;
     scopes: string[];
+    /**
+     * The provider documents `prompt=login`, so a fresh login (`prompt=login` or `max_age`) is sent
+     * upstream as that. Without it, a fresh login answers `login_required`.
+     */
+    promptLogin: boolean;
 };
 /** The host action that delivers a code. The broker never sees how. */
 export type SendEmailCode = FunctionReference<"action", "internal", {

package/dist/client/connectors/upstream.d.ts

@@ -11,6 +11,14 @@ export declare function startUpstream(args: {
     callbackUrl: string;
     freshLogin: boolean;
 }): Promise<UpstreamStart>;
+export type UpstreamFinish = {
+    identity: UpstreamIdentity;
+    /**
+     * The id_token's `auth_time`, in seconds: when the provider last authenticated the user. A plain
+     * OAuth connector has no id_token and an OIDC provider may omit the claim, so it can be absent.
+     */
+    authTimeSeconds: number | undefined;
+};
 /**
  * The connector callback: validate the response, exchange the code, and read the identity. Errors
  * propagate; the caller turns them into a redirect back to the client.
@@ -22,4 +30,4 @@ export declare function finishUpstream(args: {
     state: string;
     codeVerifier: string;
     nonce: string | undefined;
-}): Promise<UpstreamIdentity>;
+}): Promise<UpstreamFinish>;

package/dist/client/connectors/upstream.js

@@ -42,7 +42,10 @@ export async function startUpstream(args) {
         url.searchParams.set("nonce", nonce);
     }
     if (args.freshLogin && args.connector.kind === "oidc") {
+        // With max_age the provider must return auth_time (OIDC Core 3.1.2.1), which the callback
+        // checks; prompt=login asks for the login itself.
         url.searchParams.set("prompt", "login");
+        url.searchParams.set("max_age", "0");
     }
     return { url: url.toString(), state, codeVerifier, nonce };
 }
@@ -58,7 +61,10 @@ export async function finishUpstream(args) {
     const response = await oauth.authorizationCodeGrantRequest(as, client, clientAuth, params, args.callbackUrl, args.codeVerifier);
     if (args.connector.kind === "oauth") {
         const tokens = await oauth.processAuthorizationCodeResponse(as, client, response);
-        return await args.connector.identity(tokens.access_token);
+        return {
+            identity: await args.connector.identity(tokens.access_token),
+            authTimeSeconds: undefined,
+        };
     }
     const tokens = await oauth.processAuthorizationCodeResponse(as, client, response, {
         requireIdToken: true,
@@ -81,6 +87,7 @@ export async function finishUpstream(args) {
     if (typeof claims["picture"] === "string") {
         identity.picture = claims["picture"];
     }
-    return identity;
+    // oauth4webapi rejects an id_token whose `auth_time` is present and not a non-negative number.
+    return { identity, authTimeSeconds: claims.auth_time };
 }
 //# sourceMappingURL=upstream.js.map

package/dist/client/connectors/upstream.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../../src/client/connectors/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;AAEzE,mDAAmD;AACnD,SAAS,mBAAmB,CAC1B,SAAyC;IAEzC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,SAAS,CAAC,qBAAqB;YACvC,sBAAsB,EAAE,SAAS,CAAC,qBAAqB;YACvD,cAAc,EAAE,SAAS,CAAC,aAAa;SACxC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK;SAClB,gBAAgB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,0BAA0B,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAOpC;IACC,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,CACxD,EAAE,EACF,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,CAClB,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChF,cAAc,EAAE,IAAI;QACpB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAqB,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxC,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1C,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../../src/client/connectors/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8C,CAAC;AAEzE,mDAAmD;AACnD,SAAS,mBAAmB,CAC1B,SAAyC;IAEzC,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,SAAS,CAAC,qBAAqB;YACvC,sBAAsB,EAAE,SAAS,CAAC,qBAAqB;YACvD,cAAc,EAAE,SAAS,CAAC,aAAa;SACxC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK;SAClB,gBAAgB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,EAAE,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,iCAAiC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,0BAA0B,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtD,0FAA0F;QAC1F,kDAAkD;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AAC7D,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAOpC;IACC,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,CACxD,EAAE,EACF,MAAM,EACN,UAAU,EACV,MAAM,EACN,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,CAClB,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO;YACL,QAAQ,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5D,eAAe,EAAE,SAAS;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gCAAgC,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;QAChF,cAAc,EAAE,IAAI;QACpB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAqB,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC9D,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxC,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,QAAQ,CAAC,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1C,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,+FAA+F;IAC/F,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AACzD,CAAC"}

package/dist/client/html.js

@@ -38,6 +38,9 @@ export function page(title, body, status = 200) {
             "Content-Type": "text/html; charset=utf-8",
             "Cache-Control": "no-store",
             "Referrer-Policy": "no-referrer",
+            // No page of the broker may be framed: the chooser doubles as consent.
+            "Content-Security-Policy": "frame-ancestors 'none'",
+            "X-Frame-Options": "DENY",
         },
     });
 }

package/dist/client/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,MAAM,GAAG,GAAG;IAC5D,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAO3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,IAAI,CAAC;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6DAA6D,IAAI,OAAO,CAAC;IACrH,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../../src/client/html.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAC;AAEF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,IAAY,EAAE,MAAM,GAAG,GAAG;IAC5D,MAAM,IAAI,GAAG;;;;;;SAMN,MAAM,CAAC,KAAK,CAAC;SACb,KAAK;;cAEA,IAAI;QACV,CAAC;IACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;YAChC,uEAAuE;YACvE,yBAAyB,EAAE,wBAAwB;YACnD,iBAAiB,EAAE,MAAM;SAC1B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAO3B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;SAC5B,GAAG,CACF,CAAC,SAAS,EAAE,EAAE,CACZ,2BAA2B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CACpG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,QAAQ,GAAG;QACf,aAAa;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,IAAI,CAAC;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU;QAC7B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6DAA6D,IAAI,OAAO,CAAC;IACrH,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,OAAO,qBAAqB,OAAO,SAAS,IAAI,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAMhC;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,kBAAkB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wEAAwE,KAAK;8BACzF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO,IAAI,CACT,cAAc,IAAI,CAAC,OAAO,EAAE,EAC5B,gEAAgE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK;8BACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;6CACJ,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;;;;QAI3D,EACJ,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAM,GAAG,GAAG;IACpE,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC"}

package/dist/client/index.d.ts

@@ -6,6 +6,7 @@ export { github } from "./connectors/github.js";
 export { google } from "./connectors/google.js";
 export { email } from "./connectors/email.js";
 export { createKeySet, parseKeySet, rotateKeySet, type KeySet } from "./keys.js";
+export { assertKeySetUsable } from "./jwt.js";
 export type IdentityBrokerConfig = {
     /** `components.identityBroker` of the host app. */
     component: ComponentApi;
@@ -14,9 +15,13 @@ export type IdentityBrokerConfig = {
     /** The content of `IDENTITY_BROKER_KEYS`, read in the request. */
     keys: () => string | undefined;
     connectors: Connector[];
+    /**
+     * Days without a sign-in after which `cleanup` deletes a preview client. Absent: `cleanup` deletes
+     * no client, because a deployment whose client was deleted does not register again by itself.
+     */
+    previewClientIdleDays?: number;
 };
-/** Lifecycle values the host's cron passes to `cleanup`. */
-export declare const PREVIEW_CLIENT_MAX_AGE_MS: number;
+/** How long `cleanup` keeps an audit row of an issued id_token. */
 export declare const SIGN_IN_RETENTION_MS: number;
 export declare function defineIdentityBroker(config: IdentityBrokerConfig): {
     /** Mounts every endpoint on the host's router. */

package/dist/client/index.js

@@ -12,17 +12,19 @@ export { github } from "./connectors/github.js";
 export { google } from "./connectors/google.js";
 export { email } from "./connectors/email.js";
 export { createKeySet, parseKeySet, rotateKeySet } from "./keys.js";
+export { assertKeySetUsable } from "./jwt.js";
 /** A request lives this long from /authorize to the code redirect. */
 const AUTH_REQUEST_TTL_MS = 10 * 60 * 1000;
 /** A code is redeemed by the client's callback at once. */
 const CODE_TTL_MS = 60 * 1000;
 const EMAIL_CODE_TTL_MS = 10 * 60 * 1000;
+/** How far an upstream `auth_time` may sit outside the request's lifetime: the clocks differ. */
+const AUTH_TIME_SKEW_SECONDS = 60;
 const EMAIL_MAX_ATTEMPTS = 5;
 /** The scopes the broker grants; any other requested scope is dropped. */
 const SCOPES = ["openid", "email", "profile"];
 const REGISTRATION_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;
-/** Lifecycle values the host's cron passes to `cleanup`. */
-export const PREVIEW_CLIENT_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+/** How long `cleanup` keeps an audit row of an issued id_token. */
 export const SIGN_IN_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
 export function defineIdentityBroker(config) {
     const issuerUrl = new URL(config.issuer);
@@ -32,9 +34,13 @@ export function defineIdentityBroker(config) {
     const issuer = issuerUrl.href.replace(/\/$/, "");
     const prefix = issuerUrl.pathname.replace(/\/$/, "");
     const path = (suffix) => `${prefix}${suffix}`;
-    /** Binds the chooser's links to its browser. `__Host-` needs Path=/, so a path issuer uses a plain name. */
-    const txnCookieName = prefix === "" ? "__Host-broker_txn" : "broker_txn";
-    const txnCookieAttributes = `HttpOnly; Secure; SameSite=Lax; Path=${prefix === "" ? "/" : prefix}`;
+    /**
+     * The chooser binds its request to the browser that saw it with one cookie per request, named
+     * after the request id, so two sign-ins in one browser keep their own. `__Host-` needs Path=/, so
+     * a path issuer uses a plain name scoped to its path.
+     */
+    const txnCookiePrefix = prefix === "" ? "__Host-broker_txn_" : "broker_txn_";
+    const txnCookieAttributes = `Path=${prefix === "" ? "/" : prefix}; HttpOnly; Secure; SameSite=Lax`;
     const component = config.component;
     const connectors = new Map(config.connectors.map((connector) => [connector.name, connector]));
     if (connectors.size !== config.connectors.length) {
@@ -43,6 +49,41 @@ export function defineIdentityBroker(config) {
     if (connectors.size === 0) {
         throw new Error("At least one connector is required");
     }
+    const { previewClientIdleDays } = config;
+    // Zero or less would delete every preview client at the next cleanup.
+    if (previewClientIdleDays !== undefined && !(previewClientIdleDays > 0)) {
+        throw new Error("previewClientIdleDays must be a positive number of days");
+    }
+    /** The transaction cookies the browser sent, by request id. */
+    function readTxnCookies(request) {
+        const cookies = new Map();
+        for (const pair of request.headers.get("cookie")?.split(";") ?? []) {
+            const separator = pair.indexOf("=");
+            const name = pair.slice(0, separator).trim();
+            if (separator > 0 && name.startsWith(txnCookiePrefix)) {
+                cookies.set(name.slice(txnCookiePrefix.length), pair.slice(separator + 1).trim());
+            }
+        }
+        return cookies;
+    }
+    /**
+     * Whether the browser holds the cookie whose hash a chooser request stores. A first-party request
+     * that skipped the chooser stores none and needs none.
+     */
+    async function browserBound(request, stored) {
+        if (stored.txnCookieHash === undefined) {
+            return true;
+        }
+        const cookie = readTxnCookies(request).get(stored.requestId);
+        return cookie !== undefined && (await sha256Hex(cookie)) === stored.txnCookieHash;
+    }
+    /** The Set-Cookie value that deletes a request's cookie, when the browser sent one. */
+    function clearTxnCookie(request, requestId) {
+        return readTxnCookies(request).has(requestId)
+            ? `${txnCookiePrefix}${requestId}=; ${txnCookieAttributes}; Max-Age=0`
+            : undefined;
+    }
+    const unboundPage = () => errorPage("Sign-in not continued", "This sign-in did not start in this browser. Return to the app and try again.", 400);
     const keySet = () => parseKeySet(config.keys());
     const callbackUrl = (connector) => `${issuer}/connectors/${connector.name}/callback`;
     const metadata = () => ({
@@ -84,7 +125,12 @@ export function defineIdentityBroker(config) {
     /** Sends the user to a connector for a stored request, or shows the email form. */
     async function startConnector(ctx, args) {
         const { connector, request } = args;
-        const back = { redirectUri: request.redirectUri, issuer, state: request.state };
+        const back = {
+            redirectUri: request.redirectUri,
+            issuer,
+            state: request.state,
+            clearCookie: args.clearCookie,
+        };
         if (connector.kind === "email") {
             return emailAddressPage({
                 appName: args.appName,
@@ -92,7 +138,9 @@ export function defineIdentityBroker(config) {
                 requestId: request.requestId,
             });
         }
-        if (request.freshLogin && connector.kind === "oauth") {
+        // Freshness is honored only as prompt=login upstream; a connector without it is refused, never
+        // pretended.
+        if (request.freshLogin && (connector.kind === "oauth" || !connector.promptLogin)) {
             return authorizationError({
                 ...back,
                 error: "login_required",
@@ -148,6 +196,7 @@ export function defineIdentityBroker(config) {
             redirectUri: client.redirectUri,
             issuer,
             state: params.get("state") ?? undefined,
+            clearCookie: undefined,
         };
         const rest = validateAuthorizeRest(params, target.value);
         if (!rest.ok) {
@@ -176,8 +225,8 @@ export function defineIdentityBroker(config) {
         const named = rest.value.connector === undefined ? undefined : connectors.get(rest.value.connector);
         const only = connectors.size === 1 ? [...connectors.values()][0] : undefined;
         const chosen = app.firstParty ? (named ?? only) : undefined;
-        // The chooser's links work only with this cookie, so a client that fetches the chooser itself
-        // cannot send a user's browser on from it.
+        // The request moves on only with this cookie, so a client that fetches the chooser itself cannot
+        // send a user's browser on from it.
         const txnCookie = randomToken(32);
         const now = Date.now();
         const requestId = randomToken(24);
@@ -206,6 +255,7 @@ export function defineIdentityBroker(config) {
                     freshLogin,
                 },
                 appName: app.name,
+                clearCookie: undefined,
             });
         }
         const page = chooserPage({
@@ -219,7 +269,7 @@ export function defineIdentityBroker(config) {
             })),
             denyHref: `${path("/continue")}?request=${encodeURIComponent(requestId)}&deny=1`,
         });
-        page.headers.append("Set-Cookie", `${txnCookieName}=${txnCookie}; ${txnCookieAttributes}`);
+        page.headers.append("Set-Cookie", `${txnCookiePrefix}${requestId}=${txnCookie}; ${txnCookieAttributes}; Max-Age=${AUTH_REQUEST_TTL_MS / 1000}`);
         return page;
     });
     /** A chooser click: start the chosen connector, or abandon the request on deny. */
@@ -230,18 +280,16 @@ export function defineIdentityBroker(config) {
         if (stored === null) {
             return errorPage("Sign-in not found", "This sign-in is unknown or finished. Return to the app and try again.", 404);
         }
-        const txnCookie = request.headers
-            .get("cookie")
-            ?.split(";")
-            .map((pair) => pair.trim())
-            .find((pair) => pair.startsWith(`${txnCookieName}=`))
-            ?.slice(txnCookieName.length + 1);
-        if (stored.txnCookieHash === undefined ||
-            txnCookie === undefined ||
-            (await sha256Hex(txnCookie)) !== stored.txnCookieHash) {
-            return errorPage("Sign-in not continued", "This sign-in did not start in this browser. Return to the app and try again.", 400);
-        }
-        const back = { redirectUri: stored.redirectUri, issuer, state: stored.state };
+        // Only a request that showed the chooser has links to continue.
+        if (stored.txnCookieHash === undefined || !(await browserBound(request, stored))) {
+            return unboundPage();
+        }
+        const back = {
+            redirectUri: stored.redirectUri,
+            issuer,
+            state: stored.state,
+            clearCookie: clearTxnCookie(request, requestId),
+        };
         if (url.searchParams.get("deny") !== null) {
             await ctx.runMutation(component.authRequests.abandon, { requestId });
             return authorizationError({
@@ -275,6 +323,7 @@ export function defineIdentityBroker(config) {
                 freshLogin: stored.freshLogin,
             },
             appName: app.name,
+            clearCookie: back.clearCookie,
         });
     });
     function upstreamCallback(connector) {
@@ -288,12 +337,21 @@ export function defineIdentityBroker(config) {
             const claim = await ctx.runMutation(component.authRequests.claimUpstream, {
                 upstreamStateHash: await sha256Hex(state),
                 connector: connector.name,
+                txnCookieHashes: await Promise.all([...readTxnCookies(request).values()].map((cookie) => sha256Hex(cookie))),
                 now,
             });
             if (claim.status === "missing") {
                 return errorPage("Sign-in link used", "This sign-in link is invalid or was already used. Return to the app and try again.", 400);
             }
-            const back = { redirectUri: claim.redirectUri, issuer, state: claim.state };
+            if (claim.status === "unbound") {
+                return unboundPage();
+            }
+            const back = {
+                redirectUri: claim.redirectUri,
+                issuer,
+                state: claim.state,
+                clearCookie: clearTxnCookie(request, claim.requestId),
+            };
             if (claim.status === "expired") {
                 return authorizationError({
                     ...back,
@@ -301,9 +359,9 @@ export function defineIdentityBroker(config) {
                     description: "The sign-in expired.",
                 });
             }
-            let identity;
+            let upstream;
             try {
-                identity = await finishUpstream({
+                upstream = await finishUpstream({
                     connector,
                     callbackUrl: callbackUrl(connector),
                     currentUrl: url,
@@ -338,11 +396,30 @@ export function defineIdentityBroker(config) {
                     description: `${connector.label} sign-in failed.`,
                 });
             }
+            let authTime = now;
+            if (claim.freshLogin) {
+                // prompt=login and max_age=0 went upstream, but a provider can still reuse its session;
+                // only the id_token's auth_time attests a login during this request. It must fall between
+                // the request's creation and now, each widened by the clock skew; auth_time is in whole
+                // seconds. A plain OAuth connector has no auth_time, and startConnector already refused it.
+                const { authTimeSeconds } = upstream;
+                if (authTimeSeconds === undefined ||
+                    authTimeSeconds < Math.floor(claim.createdAt / 1000) - AUTH_TIME_SKEW_SECONDS ||
+                    authTimeSeconds > Math.floor(now / 1000) + AUTH_TIME_SKEW_SECONDS) {
+                    await ctx.runMutation(component.authRequests.abandon, { requestId: claim.requestId });
+                    return authorizationError({
+                        ...back,
+                        error: "login_required",
+                        description: `${connector.label} did not confirm a new login, which prompt=login or max_age asked for.`,
+                    });
+                }
+                authTime = authTimeSeconds * 1000;
+            }
             const code = randomToken(32);
             const completed = await ctx.runMutation(component.authRequests.complete, {
                 requestId: claim.requestId,
-                identity: { connector: connector.name, ...identity },
-                authTime: now,
+                identity: { connector: connector.name, ...upstream.identity },
+                authTime,
                 codeHash: await sha256Hex(code),
                 codeExpiresAt: now + CODE_TTL_MS,
                 now,
@@ -371,7 +448,16 @@ export function defineIdentityBroker(config) {
         if (stored === null) {
             return errorPage("Sign-in not found", "This sign-in is unknown or finished. Return to the app and try again.", 404);
         }
-        const back = { redirectUri: stored.redirectUri, issuer, state: stored.state };
+        // Every step moves the request on, so every step needs the browser that saw the chooser.
+        if (!(await browserBound(request, stored))) {
+            return unboundPage();
+        }
+        const back = {
+            redirectUri: stored.redirectUri,
+            issuer,
+            state: stored.state,
+            clearCookie: clearTxnCookie(request, requestId),
+        };
         const app = await readApp(ctx, stored.appId);
         if (app === null) {
             return authorizationError({
@@ -808,7 +894,9 @@ export function defineIdentityBroker(config) {
                     args: {},
                     handler: async (ctx) => await ctx.runMutation(component.lifecycle.cleanup, {
                         now: Date.now(),
-                        previewClientMaxAgeMs: PREVIEW_CLIENT_MAX_AGE_MS,
+                        ...(previewClientIdleDays === undefined
+                            ? {}
+                            : { previewClientMaxAgeMs: previewClientIdleDays * 24 * 60 * 60 * 1000 }),
                         signInRetentionMs: SIGN_IN_RETENTION_MS,
                     }),
                 }),