@schemavaults/auth-common 0.22.11 → 0.24.0

package/dist/auth_acquire_tokens_grant_types.d.ts

@@ -8,6 +8,7 @@ export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, env
     code_verifier: zod.ZodEffects<zod.ZodString, string, string>;
     audience: zod.ZodUnion<[zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">]>;
     client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    client_secret: zod.ZodOptional<zod.ZodString>;
     grant_type: zod.ZodLiteral<"authorization_code">;
     redirect_uri: zod.ZodOptional<zod.ZodNullable<zod.ZodString>>;
 }, "strict", zod.ZodTypeAny, {
@@ -17,6 +18,7 @@ export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, env
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    client_secret?: string | undefined;
     redirect_uri?: string | null | undefined;
 }, {
     code: string;
@@ -25,21 +27,25 @@ export declare function createAuthorizationCodePOSTBodySchema(z: typeof zod, env
     audience: string | string[];
     client_app_id: string;
     grant_type: "authorization_code";
+    client_secret?: string | undefined;
     redirect_uri?: string | null | undefined;
 }>;
 export declare function createRefreshTokenPOSTBodySchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment, overrides?: AudienceSchemaOverrides): zod.ZodObject<{
     audience: zod.ZodUnion<[zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, zod.ZodArray<zod.ZodUnion<[zod.ZodEffects<zod.ZodString, string, string>, zod.ZodEffects<zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>, string, string>]>, "many">]>;
     client_app_id: zod.ZodEffects<zod.ZodEffects<zod.ZodString, string, string>, string, string>;
+    client_secret: zod.ZodOptional<zod.ZodString>;
     grant_type: zod.ZodLiteral<"refresh_token">;
     replaceRefreshToo: zod.ZodOptional<zod.ZodBoolean>;
 }, "strict", zod.ZodTypeAny, {
     audience: string | string[];
     client_app_id: string;
     grant_type: "refresh_token";
+    client_secret?: string | undefined;
     replaceRefreshToo?: boolean | undefined;
 }, {
     audience: string | string[];
     client_app_id: string;
     grant_type: "refresh_token";
+    client_secret?: string | undefined;
     replaceRefreshToo?: boolean | undefined;
 }>;

package/dist/auth_acquire_tokens_grant_types.js

@@ -16,6 +16,10 @@ function createTokenEndpointBaseSchema(z, environment = getAppEnvironment(), ove
             createAudienceListSchema(z, environment, overrides),
         ]),
         client_app_id: appIdSchema,
+        // OAuth2 client secret (client_secret_post) — required by the token
+        // endpoints when the app has a client secret registered
+        // (confidential client), and must be omitted otherwise.
+        client_secret: z.string().min(1).max(256).optional(),
     });
 }
 export function createAuthorizationCodePOSTBodySchema(z, environment = getAppEnvironment(), overrides) {

package/dist/auth_acquire_tokens_grant_types.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,oCAAoC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;YAC/C,wBAAwB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC;QACF,aAAa,EAAE,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,uBAAuB;QACvB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth_acquire_tokens_grant_types.js","sourceRoot":"","sources":["../src/auth_acquire_tokens_grant_types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAEL,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,WAAW,EACX,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,oBAAoB;IACpB,eAAe;CACqB,CAAC;AAEvC,SAAS,6BAA6B,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,oCAAoC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAChB,oBAAoB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;YAC/C,wBAAwB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SACpD,CAAC;QACF,aAAa,EAAE,WAAW;QAC1B,oEAAoE;QACpE,wDAAwD;QACxD,wDAAwD;QACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACrD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE;QAC9C,aAAa,EAAE,oBAAoB,CAAC,mBAAmB;QACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QACxC,8DAA8D;QAC9D,mEAAmE;QACnE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,qCAAqC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI;KACrB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,CAAa,EACb,cAA0C,iBAAiB,EAAE,EAC7D,SAAmC;IAEnC,OAAO,6BAA6B,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC;SAC5D,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACtC,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,uBAAuB;QACvB,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,CAAC;QACR,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;KACpB,CAAC;SACD,MAAM,EAAE,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export type { PaginationOptions } from "./pagination";
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
 export { sanitizeNextHref, MAX_NEXT_HREF_LENGTH, } from "./sanitize-next-href";
 export { isOriginInAllowedList } from "./cors";
+export { isRedirectUriInCallbackAllowlist } from "./oauth2";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 export type { OAuth2State } from "./oauth2-state-schema";
 export { createAuthorizationCodePOSTBodySchema, createRefreshTokenPOSTBodySchema, } from "./auth_acquire_tokens_grant_types";

package/dist/index.js

@@ -26,6 +26,7 @@ export { paginationOptionsSchema, DEFAULT_PAGINATION_PAGE_INDEX, DEFAULT_PAGINAT
 export { timingSafeStringEqual } from "./timing-safe-string-equal";
 export { sanitizeNextHref, MAX_NEXT_HREF_LENGTH, } from "./sanitize-next-href";
 export { isOriginInAllowedList } from "./cors";
+export { isRedirectUriInCallbackAllowlist } from "./oauth2";
 export { oauth2StateSchema, OAUTH2_STATE_VSCHAR_REGEX, parseOAuth2State, OAuth2StateValidationError, } from "./oauth2-state-schema";
 export { createAuthorizationCodePOSTBodySchema, createRefreshTokenPOSTBodySchema, } from "./auth_acquire_tokens_grant_types";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAE5D,cAAc,eAAe,CAAC;AAG9B,mBAAmB;AACnB,cAAc,cAAc,CAAC;AAM7B,cAAc,cAAc,CAAC;AAG7B,cAAc,QAAQ,CAAC;AAGvB,cAAc,QAAQ,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EACL,wBAAwB,EACxB,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,wCAAwC,EACxC,wBAAwB,EACxB,uBAAuB,GAOxB,MAAM,uBAAuB,CAAC;AAE/B,cAAc,OAAO,CAAC;AACtB,OAAO,EACL,+BAA+B,EAE/B,6CAA6C,GAE9C,MAAM,yBAAyB,CAAC;AAEjC,cAAc,mCAAmC,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,gCAAgC,EAChC,yCAAyC,EACzC,kCAAkC,EAClC,2CAA2C,EAC3C,0BAA0B,EAC1B,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,qCAAqC,EACrC,uCAAuC,EACvC,wCAAwC,GACzC,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wCAAwC,EAAE,MAAM,4CAA4C,CAAC;AAEtG,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,gCAAgC,EAAE,MAAM,UAAU,CAAC;AAE5D,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,qCAAqC,EACrC,gCAAgC,GACjC,MAAM,mCAAmC,CAAC"}

package/dist/oauth2/index.d.ts

@@ -0,0 +1 @@
+export { isRedirectUriInCallbackAllowlist } from "./is-redirect-uri-in-callback-allowlist";

package/dist/oauth2/index.js

@@ -0,0 +1,2 @@
+export { isRedirectUriInCallbackAllowlist } from "./is-redirect-uri-in-callback-allowlist";
+//# sourceMappingURL=index.js.map

package/dist/oauth2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth2/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/oauth2/is-redirect-uri-in-callback-allowlist.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Exact-match check of an OAuth2/OIDC `redirect_uri` against an app's
+ * explicit callback-URL allowlist (RFC 6749 §3.1.2.3 simple string
+ * comparison).
+ *
+ * Both sides are parsed with `new URL()` and compared by serialized
+ * href, which makes the comparison robust to purely-cosmetic encoding
+ * differences (default ports, host casing, the mandatory trailing
+ * slash on a bare origin) while still requiring the path, query, and
+ * fragment-absence to match byte-for-byte.
+ *
+ * An unparseable value on either side never matches.
+ */
+export declare function isRedirectUriInCallbackAllowlist(redirect_uri: string, allowedCallbackUrls: readonly string[]): boolean;
+export default isRedirectUriInCallbackAllowlist;

package/dist/oauth2/is-redirect-uri-in-callback-allowlist.js

@@ -0,0 +1,35 @@
+/**
+ * Exact-match check of an OAuth2/OIDC `redirect_uri` against an app's
+ * explicit callback-URL allowlist (RFC 6749 §3.1.2.3 simple string
+ * comparison).
+ *
+ * Both sides are parsed with `new URL()` and compared by serialized
+ * href, which makes the comparison robust to purely-cosmetic encoding
+ * differences (default ports, host casing, the mandatory trailing
+ * slash on a bare origin) while still requiring the path, query, and
+ * fragment-absence to match byte-for-byte.
+ *
+ * An unparseable value on either side never matches.
+ */
+export function isRedirectUriInCallbackAllowlist(redirect_uri, allowedCallbackUrls) {
+    if (typeof redirect_uri !== "string" || redirect_uri.length === 0) {
+        return false;
+    }
+    let presented;
+    try {
+        presented = new URL(redirect_uri);
+    }
+    catch {
+        return false;
+    }
+    return allowedCallbackUrls.some((allowed) => {
+        try {
+            return new URL(allowed).href === presented.href;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+export default isRedirectUriInCallbackAllowlist;
+//# sourceMappingURL=is-redirect-uri-in-callback-allowlist.js.map

package/dist/oauth2/is-redirect-uri-in-callback-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-redirect-uri-in-callback-allowlist.js","sourceRoot":"","sources":["../../src/oauth2/is-redirect-uri-in-callback-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gCAAgC,CAC9C,YAAoB,EACpB,mBAAsC;IAEtC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,eAAe,gCAAgC,CAAC"}

package/dist/oidc/index.d.ts

@@ -2,3 +2,4 @@ export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOP
 export type { OidcSupportedScope, OidcScope, ParsedOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
 export type { OidcNonce } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";

package/dist/oidc/index.js

@@ -1,3 +1,4 @@
 export { OIDC_OPENID_SCOPE, OIDC_SUPPORTED_SCOPES, DEFAULT_AUTH_SCOPE, OIDC_SCOPE_REGEX, oidcScopeSchema, parseAndGrantScopes, serializeOidcScopes, } from "./scope";
 export { oidcNonceSchema, OIDC_NONCE_VSCHAR_REGEX, parseOidcNonce, OidcNonceValidationError, } from "./nonce";
+export { OIDC_SUB_CLAIM_DELIMITER, formatOidcSubClaim, parseOidcSubClaim, } from "./sub-claim";
 //# sourceMappingURL=index.js.map

package/dist/oidc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,SAAS,CAAC;AAOjB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,wBAAwB,GACzB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC"}

package/dist/oidc/sub-claim.d.ts

@@ -0,0 +1,21 @@
+import { type AppId } from "@schemavaults/app-definitions";
+export declare const OIDC_SUB_CLAIM_DELIMITER: "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export declare function formatOidcSubClaim(auth_server_app_id: AppId | string, uid: string): string;
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export declare function parseOidcSubClaim(sub: string): {
+    auth_server_app_id: AppId;
+    uid: string;
+} | null;

package/dist/oidc/sub-claim.js

@@ -0,0 +1,57 @@
+import { appIdSchema } from "@schemavaults/app-definitions";
+// The OIDC-facing `sub` claim namespaces the platform user id with the
+// deployment's own app id (SCHEMAVAULTS_AUTH_SERVER_APP_ID), Auth0-style:
+// `<auth_server_app_id>|<uid>` (e.g. "schemavaults-auth|4f7c…"). The
+// prefix marks which auth deployment a subject came from, so RPs that
+// aggregate identities from several issuers / white-label deployments
+// can't collide or confuse them. It applies ONLY at the OIDC boundary —
+// the id_token, /api/oidc/userinfo, and RFC 7662 introspection, which
+// OIDC Core §5.3.2 requires to agree exactly — never inside the
+// platform's own encrypted access/refresh token payloads, whose
+// `sub === uid` invariant (payload_data.ts) resource servers rely on.
+// The app id charset ([a-z0-9_-]) can never contain the delimiter, so
+// the encoding is unambiguous.
+export const OIDC_SUB_CLAIM_DELIMITER = "|";
+/**
+ * Builds the OIDC-facing `sub` claim for a platform user:
+ * `<auth_server_app_id>|<uid>`. The auth server app id is stable per
+ * deployment, so the resulting subject is stable for the lifetime of
+ * the user (OIDC Core §2: `sub` must be locally unique and never
+ * reassigned within the issuer).
+ */
+export function formatOidcSubClaim(auth_server_app_id, uid) {
+    const app_id = appIdSchema.safeParse(auth_server_app_id);
+    if (!app_id.success) {
+        throw new TypeError("Invalid auth server app id for OIDC 'sub' claim prefix!", { cause: app_id.error });
+    }
+    if (typeof uid !== "string" || uid.length === 0) {
+        throw new TypeError("A user id is required to build an OIDC 'sub' claim!");
+    }
+    return `${app_id.data}${OIDC_SUB_CLAIM_DELIMITER}${uid}`;
+}
+/**
+ * Splits an OIDC-facing `sub` claim back into the issuing deployment's
+ * app id and the platform user id. Returns `null` for values not in the
+ * `<app_id>|<uid>` shape (e.g. subjects issued by other providers).
+ * Only the FIRST delimiter splits — the uid keeps any later characters
+ * verbatim.
+ */
+export function parseOidcSubClaim(sub) {
+    if (typeof sub !== "string") {
+        return null;
+    }
+    const delimiter_index = sub.indexOf(OIDC_SUB_CLAIM_DELIMITER);
+    if (delimiter_index <= 0) {
+        return null;
+    }
+    const app_id = appIdSchema.safeParse(sub.slice(0, delimiter_index));
+    if (!app_id.success) {
+        return null;
+    }
+    const uid = sub.slice(delimiter_index + OIDC_SUB_CLAIM_DELIMITER.length);
+    if (uid.length === 0) {
+        return null;
+    }
+    return { auth_server_app_id: app_id.data, uid };
+}
+//# sourceMappingURL=sub-claim.js.map

package/dist/oidc/sub-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sub-claim.js","sourceRoot":"","sources":["../../src/oidc/sub-claim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAc,MAAM,+BAA+B,CAAC;AAExE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,gEAAgE;AAChE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,+BAA+B;AAE/B,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,kBAAkC,EAClC,GAAW;IAEX,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,yDAAyD,EACzD,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,IAAI,GAAG,wBAAwB,GAAG,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAW;IAEX,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/auth-common",
   "description": "Types and utility functions for authentication and authorization",
-  "version": "0.22.11",
+  "version": "0.24.0",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -14,7 +14,7 @@
   "types": "dist/index.d.ts",
   "dependencies": {
     "zod": "3.25.8",
-    "@schemavaults/app-definitions": "0.11.4",
+    "@schemavaults/app-definitions": "0.12.0",
     "crypto-js": "4.2.0"
   },
   "scripts": {