@silkweave/auth 2.6.0 → 3.0.0

package/build/index.mjs

@@ -1,6 +1,3 @@
-import { randomBytes, randomUUID } from "crypto";
-import { SignJWT, jwtVerify } from "jose";
-import { existsSync, readFileSync, writeFileSync } from "fs";
 //#region src/errors.ts
 var AuthError = class extends Error {
 	constructor(message, code, statusCode = 401) {
@@ -22,638 +19,25 @@ function extractBearerToken(header) {
 	if (!header) return null;
 	return /^Bearer\s+(.+)$/i.exec(header)?.[1] ?? null;
 }
-function buildWWWAuthenticate(error, description, resourceMetadataUrl) {
+function buildWWWAuthenticate(error, description, resourceMetadataUrl, scope) {
 	const parts = [];
 	if (error) parts.push(`error="${error}"`);
 	if (description) parts.push(`error_description="${description}"`);
 	if (resourceMetadataUrl) parts.push(`resource_metadata="${resourceMetadataUrl}"`);
+	if (scope) parts.push(`scope="${scope}"`);
 	return parts.length > 0 ? `Bearer ${parts.join(", ")}` : "Bearer";
 }
 //#endregion
 //#region src/metadata.ts
-function generateProtectedResourceMetadata(resourceUrl, authorizationServers) {
+function generateProtectedResourceMetadata(resourceUrl, authorizationServers, scopesSupported) {
 	return {
 		resource: resourceUrl,
 		authorization_servers: authorizationServers,
+		...scopesSupported?.length ? { scopes_supported: scopesSupported } : {},
 		bearer_methods_supported: ["header"]
 	};
 }
 //#endregion
-//#region src/store/memory-store.ts
-function withTtl$1(map, key) {
-	const item = map.get(key);
-	if (!item) return;
-	if (item.expiresAt < Date.now() / 1e3) {
-		map.delete(key);
-		return;
-	}
-	return item;
-}
-function createMemoryStore() {
-	const authCodes = /* @__PURE__ */ new Map();
-	const pendingAuths = /* @__PURE__ */ new Map();
-	const pkceVerifiers = /* @__PURE__ */ new Map();
-	const clients = /* @__PURE__ */ new Map();
-	const refreshTokens = /* @__PURE__ */ new Map();
-	return {
-		async saveAuthCode(code, data) {
-			authCodes.set(code, data);
-		},
-		async getAuthCode(code) {
-			return withTtl$1(authCodes, code);
-		},
-		async deleteAuthCode(code) {
-			authCodes.delete(code);
-		},
-		async savePendingAuth(state, data) {
-			pendingAuths.set(state, data);
-		},
-		async getPendingAuth(state) {
-			return withTtl$1(pendingAuths, state);
-		},
-		async deletePendingAuth(state) {
-			pendingAuths.delete(state);
-		},
-		async savePkceVerifier(state, verifier) {
-			pkceVerifiers.set(state, {
-				verifier,
-				expiresAt: Date.now() / 1e3 + 600
-			});
-		},
-		async getPkceVerifier(state) {
-			const item = pkceVerifiers.get(state);
-			if (!item) return;
-			if (item.expiresAt < Date.now() / 1e3) {
-				pkceVerifiers.delete(state);
-				return;
-			}
-			return item.verifier;
-		},
-		async deletePkceVerifier(state) {
-			pkceVerifiers.delete(state);
-		},
-		async saveClient(clientId, data) {
-			clients.set(clientId, data);
-		},
-		async getClient(clientId) {
-			return clients.get(clientId);
-		},
-		async saveRefreshToken(token, data) {
-			refreshTokens.set(token, data);
-		},
-		async getRefreshToken(token) {
-			return withTtl$1(refreshTokens, token);
-		},
-		async deleteRefreshToken(token) {
-			refreshTokens.delete(token);
-		}
-	};
-}
-//#endregion
-//#region src/provider/uri.ts
-function matchRedirectUri(uri, patterns) {
-	return patterns.some((pattern) => {
-		return patternToRegex(pattern).test(uri);
-	});
-}
-function patternToRegex(pattern) {
-	const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-	return new RegExp(`^${escaped}$`);
-}
-//#endregion
-//#region src/provider/proxy.ts
-const CORS_HEADERS = {
-	"Access-Control-Allow-Origin": "*",
-	"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-	"Access-Control-Allow-Headers": "*"
-};
-function generateCode() {
-	return randomBytes(32).toString("base64url");
-}
-async function generatePkce() {
-	const verifier = randomBytes(32).toString("base64url");
-	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-	return {
-		verifier,
-		challenge: Buffer.from(hash).toString("base64url")
-	};
-}
-async function verifyPkce(verifier, challenge) {
-	const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
-	return Buffer.from(hash).toString("base64url") === challenge;
-}
-function jsonResponse(status, body, headers = {}) {
-	return {
-		status,
-		headers: {
-			"Content-Type": "application/json",
-			...CORS_HEADERS,
-			...headers
-		},
-		body
-	};
-}
-function redirectResponse(url) {
-	return {
-		status: 302,
-		headers: {
-			Location: url,
-			...CORS_HEADERS
-		},
-		body: void 0
-	};
-}
-function errorResponse(status, error, description) {
-	return jsonResponse(status, {
-		error,
-		error_description: description
-	});
-}
-async function signAccessToken(key, opts) {
-	const now = Math.floor(Date.now() / 1e3);
-	return new SignJWT({
-		scope: opts.scopes.join(" "),
-		email: opts.email
-	}).setProtectedHeader({ alg: "HS256" }).setSubject(opts.sub ?? opts.email ?? opts.clientId).setIssuer(opts.issuer).setAudience(opts.issuer).setIssuedAt(now).setExpirationTime(now + opts.ttl).sign(key);
-}
-async function handleRegister(req, store, allowedRedirectUris) {
-	const body = req.body;
-	if (!body) return errorResponse(400, "invalid_request", "Missing request body");
-	const redirectUris = body.redirect_uris;
-	if (!redirectUris) return errorResponse(400, "invalid_request", "redirect_uris is required");
-	let uris;
-	try {
-		uris = typeof redirectUris === "string" ? JSON.parse(redirectUris) : redirectUris;
-	} catch {
-		uris = [redirectUris];
-	}
-	if (!Array.isArray(uris) || uris.length === 0) return errorResponse(400, "invalid_request", "redirect_uris must be a non-empty array");
-	for (const uri of uris) if (!matchRedirectUri(uri, allowedRedirectUris)) return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-	const clientId = randomUUID();
-	const clientSecret = randomBytes(32).toString("base64url");
-	const registration = {
-		clientId,
-		clientSecret,
-		redirectUris: uris,
-		clientName: body.client_name,
-		createdAt: Date.now() / 1e3
-	};
-	await store.saveClient(clientId, registration);
-	return jsonResponse(201, {
-		client_id: clientId,
-		client_secret: clientSecret,
-		redirect_uris: uris,
-		client_name: body.client_name,
-		token_endpoint_auth_method: "none"
-	});
-}
-async function resolveClient(clientId, store, allowedRedirectUris) {
-	const existing = await store.getClient(clientId);
-	if (existing) return existing;
-	if (!clientId.startsWith("https://")) return errorResponse(400, "invalid_client", "Unknown client_id");
-	try {
-		const metaRes = await fetch(clientId);
-		if (!metaRes.ok) return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-		const meta = await metaRes.json();
-		const metaRedirectUris = meta.redirect_uris;
-		if (!Array.isArray(metaRedirectUris) || metaRedirectUris.length === 0) return errorResponse(400, "invalid_client", "Client metadata must include redirect_uris");
-		for (const uri of metaRedirectUris) if (!matchRedirectUri(uri, allowedRedirectUris)) return errorResponse(400, "invalid_redirect_uri", `Redirect URI not allowed: ${uri}`);
-		const client = {
-			clientId,
-			clientSecret: "",
-			redirectUris: metaRedirectUris,
-			clientName: meta.client_name,
-			createdAt: Date.now() / 1e3
-		};
-		await store.saveClient(clientId, client);
-		return client;
-	} catch {
-		return errorResponse(400, "invalid_client", "Failed to fetch client metadata document");
-	}
-}
-async function exchangeUpstreamCode(code, config, callbackPath, pkceVerifier) {
-	const tokenBody = new URLSearchParams({
-		grant_type: "authorization_code",
-		code,
-		redirect_uri: `${config.resourceUrl}${callbackPath}`,
-		client_id: config.clientId,
-		client_secret: config.clientSecret,
-		code_verifier: pkceVerifier
-	});
-	const tokenResponse = await fetch(config.tokenUrl, {
-		method: "POST",
-		headers: { "Content-Type": "application/x-www-form-urlencoded" },
-		body: tokenBody.toString()
-	});
-	if (!tokenResponse.ok) {
-		const errorBody = await tokenResponse.text();
-		console.error("Upstream token exchange failed:", errorBody);
-		return errorResponse(502, "upstream_error", "Failed to exchange code with upstream provider");
-	}
-	const tokens = await tokenResponse.json();
-	return {
-		accessToken: tokens.access_token,
-		idToken: tokens.id_token
-	};
-}
-async function fetchUserinfo(userinfoUrl, accessToken) {
-	if (!userinfoUrl || !accessToken) return {};
-	try {
-		const res = await fetch(userinfoUrl, { headers: { Authorization: `Bearer ${accessToken}` } });
-		if (res.ok) {
-			const userinfo = await res.json();
-			return {
-				email: userinfo.email,
-				sub: userinfo.sub
-			};
-		}
-	} catch {}
-	return {};
-}
-async function handleRefreshToken(body, store, getSigningKey, config) {
-	const refreshToken = body.refresh_token;
-	if (!refreshToken) return errorResponse(400, "invalid_request", "Missing refresh_token");
-	const tokenData = await store.getRefreshToken(refreshToken);
-	if (!tokenData) return errorResponse(400, "invalid_grant", "Invalid or expired refresh token");
-	return jsonResponse(200, {
-		access_token: await signAccessToken(await getSigningKey(), {
-			scopes: tokenData.scopes,
-			email: tokenData.email,
-			sub: tokenData.sub,
-			clientId: tokenData.clientId,
-			issuer: config.resourceUrl,
-			ttl: config.tokenTtl
-		}),
-		token_type: "Bearer",
-		expires_in: config.tokenTtl,
-		scope: tokenData.scopes.join(" "),
-		refresh_token: refreshToken
-	});
-}
-async function handleAuthorizationCode(body, store, getSigningKey, config) {
-	const code = body.code;
-	const redirectUri = body.redirect_uri;
-	const clientId = body.client_id;
-	const codeVerifier = body.code_verifier;
-	if (!code || !codeVerifier || !clientId) return errorResponse(400, "invalid_request", "Missing required parameters");
-	const authCode = await store.getAuthCode(code);
-	if (!authCode) return errorResponse(400, "invalid_grant", "Invalid or expired authorization code");
-	await store.deleteAuthCode(code);
-	if (authCode.clientId !== clientId) return errorResponse(400, "invalid_grant", "client_id mismatch");
-	if (redirectUri && authCode.redirectUri !== redirectUri) return errorResponse(400, "invalid_grant", "redirect_uri mismatch");
-	if (!await verifyPkce(codeVerifier, authCode.codeChallenge)) return errorResponse(400, "invalid_grant", "PKCE verification failed");
-	const accessToken = await signAccessToken(await getSigningKey(), {
-		scopes: authCode.scopes,
-		email: authCode.email,
-		sub: authCode.sub,
-		clientId: authCode.clientId,
-		issuer: config.resourceUrl,
-		ttl: config.tokenTtl
-	});
-	const refreshToken = randomBytes(32).toString("base64url");
-	await store.saveRefreshToken(refreshToken, {
-		clientId: authCode.clientId,
-		scopes: authCode.scopes,
-		email: authCode.email,
-		sub: authCode.sub,
-		expiresAt: Math.floor(Date.now() / 1e3) + 720 * 3600
-	});
-	return jsonResponse(200, {
-		access_token: accessToken,
-		token_type: "Bearer",
-		expires_in: config.tokenTtl,
-		scope: authCode.scopes.join(" "),
-		refresh_token: refreshToken
-	});
-}
-function createOAuthProxy(config) {
-	const store = config.store ?? createMemoryStore();
-	const callbackPath = config.callbackPath ?? "/auth/callback";
-	const tokenTtl = config.tokenTtl ?? 3600;
-	const scopes = config.requiredScopes ?? [];
-	let signingKey = null;
-	async function getSigningKey() {
-		if (signingKey) return signingKey;
-		if (config.signingKey) signingKey = new TextEncoder().encode(config.signingKey);
-		else signingKey = randomBytes(32);
-		return signingKey;
-	}
-	return {
-		metadata() {
-			return jsonResponse(200, {
-				issuer: config.resourceUrl,
-				authorization_endpoint: `${config.resourceUrl}/authorize`,
-				token_endpoint: `${config.resourceUrl}/token`,
-				registration_endpoint: `${config.resourceUrl}/register`,
-				response_types_supported: ["code"],
-				grant_types_supported: ["authorization_code", "refresh_token"],
-				code_challenge_methods_supported: ["S256"],
-				token_endpoint_auth_methods_supported: ["none", "client_secret_post"],
-				scopes_supported: scopes
-			}, { "Cache-Control": "max-age=3600" });
-		},
-		register(req) {
-			return handleRegister(req, store, config.redirectUris);
-		},
-		async authorize(req) {
-			const params = req.url.searchParams;
-			const responseType = params.get("response_type");
-			const clientId = params.get("client_id");
-			const redirectUri = params.get("redirect_uri");
-			const scope = params.get("scope") ?? "";
-			const clientState = params.get("state") ?? "";
-			const codeChallenge = params.get("code_challenge");
-			const codeChallengeMethod = params.get("code_challenge_method");
-			const resource = params.get("resource");
-			if (responseType !== "code") return errorResponse(400, "unsupported_response_type", "Only response_type=code is supported");
-			if (!clientId) return errorResponse(400, "invalid_request", "client_id is required");
-			if (!redirectUri) return errorResponse(400, "invalid_request", "redirect_uri is required");
-			if (!codeChallenge || codeChallengeMethod !== "S256") return errorResponse(400, "invalid_request", "PKCE with S256 is required");
-			const result = await resolveClient(clientId, store, config.redirectUris);
-			if ("status" in result) return result;
-			if (!result.redirectUris.includes(redirectUri)) return errorResponse(400, "invalid_redirect_uri", "redirect_uri does not match registered URIs");
-			const proxyState = randomUUID();
-			const pkce = await generatePkce();
-			await store.savePendingAuth(proxyState, {
-				clientId,
-				redirectUri,
-				codeChallenge,
-				codeChallengeMethod,
-				scope,
-				clientState,
-				resource: resource ?? void 0,
-				expiresAt: Date.now() / 1e3 + 600
-			});
-			await store.savePkceVerifier(proxyState, pkce.verifier);
-			const upstreamScopes = scopes.length > 0 ? scopes.join(" ") : scope;
-			const upstreamUrl = new URL(config.authorizeUrl);
-			upstreamUrl.searchParams.set("response_type", "code");
-			upstreamUrl.searchParams.set("client_id", config.clientId);
-			upstreamUrl.searchParams.set("redirect_uri", `${config.resourceUrl}${callbackPath}`);
-			upstreamUrl.searchParams.set("scope", upstreamScopes);
-			upstreamUrl.searchParams.set("state", proxyState);
-			upstreamUrl.searchParams.set("code_challenge", pkce.challenge);
-			upstreamUrl.searchParams.set("code_challenge_method", "S256");
-			if (params.has("access_type")) upstreamUrl.searchParams.set("access_type", params.get("access_type"));
-			return redirectResponse(upstreamUrl.toString());
-		},
-		async callback(req) {
-			const params = req.url.searchParams;
-			const upstreamCode = params.get("code");
-			const proxyState = params.get("state");
-			const upstreamError = params.get("error");
-			if (upstreamError) return errorResponse(400, "upstream_error", params.get("error_description") ?? upstreamError);
-			if (!upstreamCode || !proxyState) return errorResponse(400, "invalid_request", "Missing code or state");
-			const pending = await store.getPendingAuth(proxyState);
-			if (!pending) return errorResponse(400, "invalid_request", "Unknown or expired state");
-			const pkceVerifier = await store.getPkceVerifier(proxyState);
-			if (!pkceVerifier) return errorResponse(400, "invalid_request", "Missing PKCE verifier");
-			await store.deletePendingAuth(proxyState);
-			await store.deletePkceVerifier(proxyState);
-			const upstream = await exchangeUpstreamCode(upstreamCode, config, callbackPath, pkceVerifier);
-			if ("status" in upstream) return upstream;
-			const userinfo = await fetchUserinfo(config.userinfoUrl, upstream.accessToken);
-			const mcpCode = generateCode();
-			await store.saveAuthCode(mcpCode, {
-				clientId: pending.clientId,
-				redirectUri: pending.redirectUri,
-				codeChallenge: pending.codeChallenge,
-				codeChallengeMethod: pending.codeChallengeMethod,
-				scopes: pending.scope.split(" ").filter(Boolean),
-				upstreamAccessToken: upstream.accessToken,
-				upstreamIdToken: upstream.idToken,
-				email: userinfo.email,
-				sub: userinfo.sub,
-				expiresAt: Date.now() / 1e3 + 600
-			});
-			const clientRedirect = new URL(pending.redirectUri);
-			clientRedirect.searchParams.set("code", mcpCode);
-			if (pending.clientState) clientRedirect.searchParams.set("state", pending.clientState);
-			return redirectResponse(clientRedirect.toString());
-		},
-		async token(req) {
-			const body = req.body;
-			if (!body) return errorResponse(400, "invalid_request", "Missing request body");
-			const tokenConfig = {
-				resourceUrl: config.resourceUrl,
-				tokenTtl
-			};
-			if (body.grant_type === "refresh_token") return handleRefreshToken(body, store, getSigningKey, tokenConfig);
-			if (body.grant_type !== "authorization_code") return errorResponse(400, "unsupported_grant_type", "Supported grant types: authorization_code, refresh_token");
-			return handleAuthorizationCode(body, store, getSigningKey, tokenConfig);
-		},
-		async verifyToken(token) {
-			try {
-				const { payload } = await jwtVerify(token, await getSigningKey(), {
-					issuer: config.resourceUrl,
-					audience: config.resourceUrl
-				});
-				return {
-					token,
-					clientId: payload.sub ?? void 0,
-					scopes: typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : [],
-					expiresAt: payload.exp,
-					email: payload.email
-				};
-			} catch {
-				return;
-			}
-		}
-	};
-}
-//#endregion
-//#region src/provider/google.ts
-function google(options) {
-	const provider = createOAuthProxy({
-		authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-		tokenUrl: "https://oauth2.googleapis.com/token",
-		userinfoUrl: "https://openidconnect.googleapis.com/v1/userinfo",
-		clientId: options.clientId,
-		clientSecret: options.clientSecret,
-		resourceUrl: options.resourceUrl,
-		redirectUris: options.redirectUris,
-		requiredScopes: options.requiredScopes ?? ["openid", "email"],
-		callbackPath: options.callbackPath,
-		signingKey: options.signingKey,
-		tokenTtl: options.tokenTtl,
-		store: options.store
-	});
-	return {
-		verifyToken: (token) => provider.verifyToken(token),
-		required: true,
-		resourceUrl: options.resourceUrl,
-		authorizationServers: [options.resourceUrl],
-		provider,
-		callbackPath: options.callbackPath ?? "/auth/callback"
-	};
-}
-//#endregion
-//#region src/store/json-store.ts
-function withTtl(obj, key) {
-	const item = obj[key];
-	if (!item) return;
-	if (item.expiresAt < Date.now() / 1e3) {
-		delete obj[key];
-		return;
-	}
-	return item;
-}
-function writeJsonStore(path, store) {
-	writeFileSync(path, JSON.stringify(store, null, 2), "utf-8");
-}
-function readJsonStore(path) {
-	if (!existsSync(path)) return {
-		authCodes: {},
-		pendingAuths: {},
-		pkceVerifiers: {},
-		clients: {},
-		refreshTokens: {}
-	};
-	const data = JSON.parse(readFileSync(path, "utf-8"));
-	if (!data.refreshTokens) data.refreshTokens = {};
-	return data;
-}
-function createJsonStore(path) {
-	const store = readJsonStore(path);
-	return {
-		async saveAuthCode(code, data) {
-			store.authCodes[code] = data;
-			writeJsonStore(path, store);
-		},
-		async getAuthCode(code) {
-			return withTtl(store.authCodes, code);
-		},
-		async deleteAuthCode(code) {
-			delete store.authCodes[code];
-			writeJsonStore(path, store);
-		},
-		async savePendingAuth(state, data) {
-			store.pendingAuths[state] = data;
-			writeJsonStore(path, store);
-		},
-		async getPendingAuth(state) {
-			return withTtl(store.pendingAuths, state);
-		},
-		async deletePendingAuth(state) {
-			delete store.pendingAuths[state];
-			writeJsonStore(path, store);
-		},
-		async savePkceVerifier(state, verifier) {
-			store.pkceVerifiers[state] = {
-				verifier,
-				expiresAt: Date.now() / 1e3 + 600
-			};
-			writeJsonStore(path, store);
-		},
-		async getPkceVerifier(state) {
-			const item = store.pkceVerifiers[state];
-			if (!item) return;
-			if (item.expiresAt < Date.now() / 1e3) {
-				delete store.pkceVerifiers[state];
-				writeJsonStore(path, store);
-				return;
-			}
-			return item.verifier;
-		},
-		async deletePkceVerifier(state) {
-			delete store.pkceVerifiers[state];
-			writeJsonStore(path, store);
-		},
-		async saveClient(clientId, data) {
-			store.clients[clientId] = data;
-			writeJsonStore(path, store);
-		},
-		async getClient(clientId) {
-			return store.clients[clientId];
-		},
-		async saveRefreshToken(token, data) {
-			store.refreshTokens[token] = data;
-			writeJsonStore(path, store);
-		},
-		async getRefreshToken(token) {
-			return withTtl(store.refreshTokens, token);
-		},
-		async deleteRefreshToken(token) {
-			delete store.refreshTokens[token];
-			writeJsonStore(path, store);
-		}
-	};
-}
-//#endregion
-//#region src/store/redis-store.ts
-function createRedisStore(options) {
-	const { client, prefix = "silkweave:oauth:" } = options;
-	function key(namespace, id) {
-		return `${prefix}${namespace}:${id}`;
-	}
-	function ttlFromExpiry(expiresAt) {
-		const seconds = Math.floor(expiresAt - Date.now() / 1e3);
-		return seconds > 0 ? seconds : void 0;
-	}
-	async function save(namespace, id, data, expiresAt) {
-		const opts = {};
-		const ttl = expiresAt != null ? ttlFromExpiry(expiresAt) : void 0;
-		if (ttl != null) opts.ex = ttl;
-		await client.set(key(namespace, id), JSON.stringify(data), opts);
-	}
-	async function load(namespace, id) {
-		const raw = await client.get(key(namespace, id));
-		if (raw == null) return;
-		return typeof raw === "string" ? JSON.parse(raw) : raw;
-	}
-	async function remove(namespace, id) {
-		await client.del(key(namespace, id));
-	}
-	return {
-		async saveAuthCode(code, data) {
-			await save("auth-code", code, data, data.expiresAt);
-		},
-		async getAuthCode(code) {
-			return load("auth-code", code);
-		},
-		async deleteAuthCode(code) {
-			await remove("auth-code", code);
-		},
-		async savePendingAuth(state, data) {
-			await save("pending-auth", state, data, data.expiresAt);
-		},
-		async getPendingAuth(state) {
-			return load("pending-auth", state);
-		},
-		async deletePendingAuth(state) {
-			await remove("pending-auth", state);
-		},
-		async savePkceVerifier(state, verifier) {
-			const expiresAt = Date.now() / 1e3 + 600;
-			await save("pkce-verifier", state, {
-				verifier,
-				expiresAt
-			}, expiresAt);
-		},
-		async getPkceVerifier(state) {
-			return (await load("pkce-verifier", state))?.verifier;
-		},
-		async deletePkceVerifier(state) {
-			await remove("pkce-verifier", state);
-		},
-		async saveClient(clientId, data) {
-			await save("client", clientId, data);
-		},
-		async getClient(clientId) {
-			return load("client", clientId);
-		},
-		async saveRefreshToken(token, data) {
-			await save("refresh-token", token, data, data.expiresAt);
-		},
-		async getRefreshToken(token) {
-			return load("refresh-token", token);
-		},
-		async deleteRefreshToken(token) {
-			await remove("refresh-token", token);
-		}
-	};
-}
-//#endregion
 //#region src/validate.ts
 async function validateToken(authorizationHeader, config, context) {
 	const required = config.required ?? true;
@@ -671,12 +55,26 @@ async function validateToken(authorizationHeader, config, context) {
 	}
 	if (!authInfo) return buildErrorResult(invalidToken(), resourceMetadataUrl);
 	if (authInfo.expiresAt && authInfo.expiresAt < Date.now() / 1e3) return buildErrorResult(invalidToken("Token has expired"), resourceMetadataUrl);
+	if (config.issuer && typeof authInfo.iss === "string" && authInfo.iss !== config.issuer) return buildErrorResult(invalidToken("Token issuer mismatch"), resourceMetadataUrl);
+	const expectedAudience = config.audience === false ? void 0 : config.audience ?? config.resourceUrl;
+	if (expectedAudience !== void 0 && !audienceMatches(authInfo.aud, expectedAudience)) return buildErrorResult(invalidToken("Token audience mismatch"), resourceMetadataUrl);
 	if (config.requiredScopes?.length) {
 		const scopes = authInfo.scopes ?? [];
-		if (!config.requiredScopes.every((s) => scopes.includes(s))) return buildErrorResult(insufficientScope(), resourceMetadataUrl);
+		if (!config.requiredScopes.every((s) => scopes.includes(s))) return buildErrorResult(insufficientScope(), resourceMetadataUrl, config.requiredScopes.join(" "));
 	}
 	return { auth: authInfo };
 }
+/**
+* True when the token's `aud` claim includes one of the expected values. A token
+* with no `aud` is allowed (the verifier may have bound the audience already);
+* a present-but-mismatched `aud` is rejected.
+*/
+function audienceMatches(tokenAud, expected) {
+	if (tokenAud === void 0 || tokenAud === null) return true;
+	const have = Array.isArray(tokenAud) ? tokenAud : [tokenAud];
+	const want = Array.isArray(expected) ? expected : [expected];
+	return have.some((a) => want.includes(a));
+}
 function buildChallengeResult(resourceMetadataUrl) {
 	return { error: {
 		statusCode: 401,
@@ -690,11 +88,11 @@ function buildChallengeResult(resourceMetadataUrl) {
 		}
 	} };
 }
-function buildErrorResult(err, resourceMetadataUrl) {
+function buildErrorResult(err, resourceMetadataUrl, scope) {
 	return { error: {
 		statusCode: err.statusCode,
 		headers: {
-			"WWW-Authenticate": buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl),
+			"WWW-Authenticate": buildWWWAuthenticate(err.code, err.message, resourceMetadataUrl, scope),
 			"Content-Type": "application/json"
 		},
 		body: {
@@ -704,6 +102,6 @@ function buildErrorResult(err, resourceMetadataUrl) {
 	} };
 }
 //#endregion
-export { AuthError, buildWWWAuthenticate, createJsonStore, createMemoryStore, createOAuthProxy, createRedisStore, extractBearerToken, generateProtectedResourceMetadata, google, insufficientScope, invalidToken, matchRedirectUri, validateToken };
+export { AuthError, buildWWWAuthenticate, extractBearerToken, generateProtectedResourceMetadata, insufficientScope, invalidToken, validateToken };
 
 //# sourceMappingURL=index.mjs.map