@schemavaults/auth-common 0.10.6 → 0.10.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/pkce/authorization_code_age.d.ts +12 -0
- package/dist/pkce/authorization_code_age.js +13 -0
- package/dist/pkce/authorization_code_age.js.map +1 -0
- package/dist/pkce/index.d.ts +1 -0
- package/dist/pkce/index.js +1 -0
- package/dist/pkce/index.js.map +1 -1
- package/dist/pkce/pkce.d.ts +13 -0
- package/dist/pkce/pkce.js +15 -6
- package/dist/pkce/pkce.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,12 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Maximum lifetime of an OAuth2 authorization code.
|
|
3
|
+
*
|
|
4
|
+
* Per RFC 6749 §4.1.2, authorization codes MUST be single-use and short-lived;
|
|
5
|
+
* a maximum lifetime of 10 minutes is RECOMMENDED.
|
|
6
|
+
*
|
|
7
|
+
* This is distinct from {@link MAX_PKCE_CODE_VERIFIER_AGE}, which bounds how
|
|
8
|
+
* long a user may sit on the `/authorize` page before submitting. The
|
|
9
|
+
* authorization code age bounds how long the client application has to
|
|
10
|
+
* exchange a received authorization code for tokens at the token endpoint.
|
|
11
|
+
*/
|
|
12
|
+
export declare const MAX_AUTHORIZATION_CODE_AGE: number;
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Maximum lifetime of an OAuth2 authorization code.
|
|
3
|
+
*
|
|
4
|
+
* Per RFC 6749 §4.1.2, authorization codes MUST be single-use and short-lived;
|
|
5
|
+
* a maximum lifetime of 10 minutes is RECOMMENDED.
|
|
6
|
+
*
|
|
7
|
+
* This is distinct from {@link MAX_PKCE_CODE_VERIFIER_AGE}, which bounds how
|
|
8
|
+
* long a user may sit on the `/authorize` page before submitting. The
|
|
9
|
+
* authorization code age bounds how long the client application has to
|
|
10
|
+
* exchange a received authorization code for tokens at the token endpoint.
|
|
11
|
+
*/
|
|
12
|
+
export const MAX_AUTHORIZATION_CODE_AGE = 10 * 60 * 1000; // 10 minutes
|
|
13
|
+
//# sourceMappingURL=authorization_code_age.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authorization_code_age.js","sourceRoot":"","sources":["../../src/pkce/authorization_code_age.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa"}
|
package/dist/pkce/index.d.ts
CHANGED
|
@@ -3,4 +3,5 @@ export type * from './pkce';
|
|
|
3
3
|
export type { CodeChallenge, CodeChallengeWithDetails } from './code_challenge';
|
|
4
4
|
export type { CodeVerifier, CodeVerifierWithDetails } from './code_verifier';
|
|
5
5
|
export { MAX_PKCE_CODE_VERIFIER_AGE } from './code_verifier';
|
|
6
|
+
export { MAX_AUTHORIZATION_CODE_AGE } from './authorization_code_age';
|
|
6
7
|
export { isPkceChallengeExpired } from './is_pkce_challenge_expired';
|
package/dist/pkce/index.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
export { PKCE_ProofKeyManager } from './pkce';
|
|
2
2
|
export { MAX_PKCE_CODE_VERIFIER_AGE } from './code_verifier';
|
|
3
|
+
export { MAX_AUTHORIZATION_CODE_AGE } from './authorization_code_age';
|
|
3
4
|
export { isPkceChallengeExpired } from './is_pkce_challenge_expired';
|
|
4
5
|
//# sourceMappingURL=index.js.map
|
package/dist/pkce/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pkce/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAK9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pkce/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAK9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC"}
|
package/dist/pkce/pkce.d.ts
CHANGED
|
@@ -1,9 +1,22 @@
|
|
|
1
1
|
import { code_challenge_method, type CodeChallengeWithDetails } from "./code_challenge";
|
|
2
2
|
import { type CodeVerifier, type CodeVerifierWithDetails } from "./code_verifier";
|
|
3
|
+
/**
|
|
4
|
+
* Signature compatible with node:crypto's `timingSafeEqual`. Callers of
|
|
5
|
+
* `doesVerifierMatchChallenge` inject this so that this package doesn't need
|
|
6
|
+
* to import `node:crypto` itself — which would break browser bundlers
|
|
7
|
+
* (Cypress webpack, etc.) that also consume this class for client-side
|
|
8
|
+
* verifier/challenge generation.
|
|
9
|
+
*/
|
|
10
|
+
export type TimingSafeEqualFn = (a: Uint8Array, b: Uint8Array) => boolean;
|
|
3
11
|
interface CheckWhetherVerifierMatchesChallengeInputOptions {
|
|
4
12
|
input_code_verifier: string;
|
|
5
13
|
saved_code_challenge: string;
|
|
6
14
|
challenge_time: number;
|
|
15
|
+
/**
|
|
16
|
+
* Timing-safe byte comparator. Server-side callers should pass
|
|
17
|
+
* `timingSafeEqual` from `node:crypto`.
|
|
18
|
+
*/
|
|
19
|
+
timingSafeEqual: TimingSafeEqualFn;
|
|
7
20
|
}
|
|
8
21
|
export declare class PKCE_ProofKeyManager {
|
|
9
22
|
private code_verifier;
|
package/dist/pkce/pkce.js
CHANGED
|
@@ -109,10 +109,13 @@ export class PKCE_ProofKeyManager {
|
|
|
109
109
|
* @returns sha256_hash(input_code_verifier) === saved_code_challenge
|
|
110
110
|
*/
|
|
111
111
|
static async doesVerifierMatchChallenge(opts) {
|
|
112
|
-
const { input_code_verifier, saved_code_challenge, challenge_time } = opts;
|
|
112
|
+
const { input_code_verifier, saved_code_challenge, challenge_time, timingSafeEqual, } = opts;
|
|
113
113
|
if (typeof input_code_verifier !== "string" || !input_code_verifier) {
|
|
114
114
|
throw new Error("Input code verifier is not a string");
|
|
115
115
|
}
|
|
116
|
+
if (typeof timingSafeEqual !== "function") {
|
|
117
|
+
throw new Error("PKCE_ProofKeyManager.doesVerifierMatchChallenge requires a `timingSafeEqual` function (e.g. the one from node:crypto) to perform a constant-time comparison.");
|
|
118
|
+
}
|
|
116
119
|
const parsed_input_verifier = PKCE_ProofKeyManager.codeVerifierSchema.safeParse(input_code_verifier);
|
|
117
120
|
if (!parsed_input_verifier.success) {
|
|
118
121
|
console.error("Invalid input code verifier: ", parsed_input_verifier.error);
|
|
@@ -126,11 +129,17 @@ export class PKCE_ProofKeyManager {
|
|
|
126
129
|
challenge_time,
|
|
127
130
|
});
|
|
128
131
|
const generated_challenge = await pkce_flow.getCodeChallenge();
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
132
|
+
// Timing-safe byte comparison using the caller-provided function.
|
|
133
|
+
// The caller is responsible for supplying a constant-time comparator;
|
|
134
|
+
// accepting it as an argument keeps this module free of any runtime
|
|
135
|
+
// dependency on node:crypto, so it can be bundled for browsers (for
|
|
136
|
+
// createCodeVerifier/createCodeChallenge) without bundler errors.
|
|
137
|
+
const generatedBuf = Buffer.from(generated_challenge.code_challenge, "base64");
|
|
138
|
+
const savedBuf = Buffer.from(saved_code_challenge, "base64");
|
|
139
|
+
if (generatedBuf.length !== savedBuf.length) {
|
|
140
|
+
return false;
|
|
141
|
+
}
|
|
142
|
+
return timingSafeEqual(generatedBuf, savedBuf);
|
|
134
143
|
}
|
|
135
144
|
catch (e) {
|
|
136
145
|
console.error(e);
|
package/dist/pkce/pkce.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/pkce/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EAGrB,8BAA8B,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAE1B,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAsBhD,6DAA6D;AAC7D,MAAM,OAAO,oBAAoB;IACvB,aAAa,CAGnB;IAEK,MAAM,CAAC,kBAAkB,CAC9B,cAAuB;QAEvB,OAAO,oBAAoB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,mBAAmB,CACrC,aAAsC;QAEtC,MAAM,0BAA0B,GAAoC;YAClE,aAAa;YACb,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC1D,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,6CAA6C;IAC7C,8EAA8E;IAC9E,YACE,aAGC;QAED,IAAI,OAAO,aAAa,KAAK,WAAW,EAAE,CAAC;YACzC,oDAAoD;YACpD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,iFAAiF;YACjF,aAA8B,CAAC;YAE/B,MAAM,QAAQ,GAA6B,aAAa,CAAC,aAAa,CAAC;YACvE,IAAI,CAAC,QAAQ,IAAI,OAAO,aAAa,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACjE,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,aAAa,CAAC,cAAc,CAAC;YACpD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,aAAa;gBAChB,aAAa,EAAE,QAAQ;gBACvB,cAAc;aACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,oBAAoB,GAAoC;YAC5D,aAAa,EAAE;gBACb,GAAG,aAAa;gBAChB,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;aAC7C;YACD,aAAa,EAAE,aAAa;SAC7B,CAAC;QACF,OAAO,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAW,cAAc;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC;IAC3C,CAAC;IAED,IAAW,WAAW;QACpB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,kBAAkB;QAClC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAEM,MAAM,KAAK,6BAA6B;QAC7C,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAEM,MAAM,KAAK,8BAA8B;QAC9C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAEM,MAAM,KAAK,OAAO;QACvB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAEM,MAAM,KAAK,mBAAmB;QACnC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAEM,MAAM,CAAC,yBAAyB,CACrC,mBAA4B;QAE5B,OAAO,oBAAoB,CAAC,6BAA6B,CAAC,SAAS,CACjE,mBAAmB,CACpB,CAAC,OAAO,CAAC;IACZ,CAAC;IAEM,MAAM,CAAC,0BAA0B,CACtC,oBAA6B;QAE7B,OAAO,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,oBAAoB,CAAC;aACvE,OAAO,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,IAAsD;QAEtD,MAAM,EACJ,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,GAAG,IAAI,CAAC;QAET,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,8JAA8J,CAC/J,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GACzB,oBAAoB,CAAC,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,qBAAqB,CAAC,KAAK,CAC5B,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,uDAAuD;YACvD,wDAAwD;YACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;gBACzC,aAAa,EAAE,mBAAmB;gBAClC,cAAc;aACf,CAAC,CAAC;YAEH,MAAM,mBAAmB,GACvB,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAErC,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,YAAY,GAAW,MAAM,CAAC,IAAI,CACtC,mBAAmB,CAAC,cAAc,EAClC,QAAQ,CACT,CAAC;YACF,MAAM,QAAQ,GAAW,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;YACrE,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED