@taico/taico 0.5.1 → 0.6.0

package/dist/authorization-server/errors/authorization.errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/authorization.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,uBAAuB,GAAG;IACrC,mBAAmB,EAAE,mBAAU,CAAC,mBAAmB;IACnD,2BAA2B,EAAE,mBAAU,CAAC,2BAA2B;IACnE,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;IACzD,2BAA2B,EAAE,mBAAU,CAAC,2BAA2B;IACnE,yBAAyB,EAAE,mBAAU,CAAC,yBAAyB;IAC/D,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;CAC7C,CAAC;AASX,MAAsB,wBAAyB,SAAQ,KAAK;IAG/C;IACA;IAHX,YACE,OAAe,EACN,IAA4B,EAC5B,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAwB;QAC5B,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,4DASC;AAED,MAAa,qBAAsB,SAAQ,wBAAwB;IACjE,YAAY,MAAc;QACxB,KAAK,CACH,+BAA+B,EAC/B,+BAAuB,CAAC,mBAAmB,EAC3C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,gDAAgD,EAChD,+BAAuB,CAAC,2BAA2B,EACnD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAED,MAAa,qBAAsB,SAAQ,wBAAwB;IACjE,YAAY,MAAc;QACxB,KAAK,CACH,uBAAuB,MAAM,EAAE,EAC/B,+BAAuB,CAAC,kBAAkB,EAC1C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,6BAA6B,EAC7B,+BAAuB,CAAC,0BAA0B,EAClD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAED,MAAa,yBAA0B,SAAQ,wBAAwB;IACrE,YAAY,MAAc;QACxB,KAAK,CACH,2DAA2D,MAAM,EAAE,EACnE,+BAAuB,CAAC,sBAAsB,EAC9C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,8DAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE;QACE,KAAK,CACH,oCAAoC,EACpC,+BAAuB,CAAC,2BAA2B,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,sEAOC;AAED,MAAa,2BAA4B,SAAQ,wBAAwB;IACvE,YAAY,KAAa;QACvB,KAAK,CACH,4BAA4B,EAC5B,+BAAuB,CAAC,yBAAyB,EACjD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;CACF;AARD,kEAQC;AAED,MAAa,wBAAyB,SAAQ,wBAAwB;IACpE,YAAY,MAAc;QACxB,KAAK,CACH,0BAA0B,MAAM,EAAE,EAClC,+BAAuB,CAAC,qBAAqB,EAC7C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,4DAQC;AAED,MAAa,sBAAuB,SAAQ,wBAAwB;IAClE,YAAY,gBAAwB;QAClC,KAAK,CAAC,uBAAuB,EAAE,+BAAuB,CAAC,gBAAgB,EAAE;YACvE,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;CACF;AAND,wDAMC;AAED,MAAa,sBAAuB,SAAQ,wBAAwB;IAClE,YAAY,QAAgB;QAC1B,KAAK,CAAC,mBAAmB,EAAE,+BAAuB,CAAC,gBAAgB,EAAE;YACnE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAND,wDAMC;AAED,MAAa,uBAAwB,SAAQ,wBAAwB;IACnE,YAAY,WAAmB,EAAE,QAAgB;QAC/C,KAAK,CACH,iDAAiD,EACjD,+BAAuB,CAAC,oBAAoB,EAC5C,EAAE,WAAW,EAAE,QAAQ,EAAE,CAC1B,CAAC;IACJ,CAAC;CACF;AARD,0DAQC"}
+{"version":3,"file":"authorization.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/authorization.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,uBAAuB,GAAG;IACrC,mBAAmB,EAAE,mBAAU,CAAC,mBAAmB;IACnD,2BAA2B,EAAE,mBAAU,CAAC,2BAA2B;IACnE,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,iBAAiB,EAAE,mBAAU,CAAC,iBAAiB;IAC/C,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;IACzD,2BAA2B,EAAE,mBAAU,CAAC,2BAA2B;IACnE,yBAAyB,EAAE,mBAAU,CAAC,yBAAyB;IAC/D,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;CAC7C,CAAC;AASX,MAAsB,wBAAyB,SAAQ,KAAK;IAG/C;IACA;IAHX,YACE,OAAe,EACN,IAA4B,EAC5B,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAwB;QAC5B,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,4DASC;AAED,MAAa,qBAAsB,SAAQ,wBAAwB;IACjE,YAAY,MAAc;QACxB,KAAK,CACH,+BAA+B,EAC/B,+BAAuB,CAAC,mBAAmB,EAC3C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,gDAAgD,EAChD,+BAAuB,CAAC,2BAA2B,EACnD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAED,MAAa,qBAAsB,SAAQ,wBAAwB;IACjE,YAAY,MAAc;QACxB,KAAK,CACH,uBAAuB,MAAM,EAAE,EAC/B,+BAAuB,CAAC,kBAAkB,EAC1C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,6BAA6B,EAC7B,+BAAuB,CAAC,0BAA0B,EAClD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAGD,MAAa,qBAAsB,SAAQ,wBAAwB;IACjE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,0DAA0D,EAC1D,+BAAuB,CAAC,iBAAiB,EACzC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,yBAA0B,SAAQ,wBAAwB;IACrE,YAAY,MAAc;QACxB,KAAK,CACH,2DAA2D,MAAM,EAAE,EACnE,+BAAuB,CAAC,sBAAsB,EAC9C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,8DAQC;AAED,MAAa,6BAA8B,SAAQ,wBAAwB;IACzE;QACE,KAAK,CACH,oCAAoC,EACpC,+BAAuB,CAAC,2BAA2B,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,sEAOC;AAED,MAAa,2BAA4B,SAAQ,wBAAwB;IACvE,YAAY,KAAa;QACvB,KAAK,CACH,4BAA4B,EAC5B,+BAAuB,CAAC,yBAAyB,EACjD,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;CACF;AARD,kEAQC;AAED,MAAa,wBAAyB,SAAQ,wBAAwB;IACpE,YAAY,MAAc;QACxB,KAAK,CACH,0BAA0B,MAAM,EAAE,EAClC,+BAAuB,CAAC,qBAAqB,EAC7C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,4DAQC;AAED,MAAa,sBAAuB,SAAQ,wBAAwB;IAClE,YAAY,gBAAwB;QAClC,KAAK,CAAC,uBAAuB,EAAE,+BAAuB,CAAC,gBAAgB,EAAE;YACvE,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;CACF;AAND,wDAMC;AAED,MAAa,sBAAuB,SAAQ,wBAAwB;IAClE,YAAY,QAAgB;QAC1B,KAAK,CAAC,mBAAmB,EAAE,+BAAuB,CAAC,gBAAgB,EAAE;YACnE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAND,wDAMC;AAED,MAAa,uBAAwB,SAAQ,wBAAwB;IACnE,YAAY,WAAmB,EAAE,QAAgB;QAC/C,KAAK,CACH,iDAAiD,EACjD,+BAAuB,CAAC,oBAAoB,EAC5C,EAAE,WAAW,EAAE,QAAQ,EAAE,CAC1B,CAAC;IACJ,CAAC;CACF;AARD,0DAQC"}

package/dist/authorization-server/errors/client-registration.errors.d.ts

@@ -5,6 +5,7 @@ export declare const ClientRegistrationErrorCodes: {
     readonly INVALID_GRANT_TYPE: "INVALID_GRANT_TYPE";
     readonly INVALID_TOKEN_ENDPOINT_AUTH_METHOD: "INVALID_TOKEN_ENDPOINT_AUTH_METHOD";
     readonly MISSING_REQUIRED_FIELD: "MISSING_REQUIRED_FIELD";
+    readonly INVALID_CLIENT_METADATA: "INVALID_CLIENT_METADATA";
 };
 type ClientRegistrationErrorCode = (typeof ClientRegistrationErrorCodes)[keyof typeof ClientRegistrationErrorCodes];
 export declare abstract class ClientRegistrationDomainError extends Error {
@@ -27,4 +28,7 @@ export declare class InvalidTokenEndpointAuthMethodError extends ClientRegistrat
 export declare class MissingRequiredFieldError extends ClientRegistrationDomainError {
     constructor(fieldName: string);
 }
+export declare class InvalidClientMetadataError extends ClientRegistrationDomainError {
+    constructor(clientId: string, reason: string);
+}
 export {};

package/dist/authorization-server/errors/client-registration.errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MissingRequiredFieldError = exports.InvalidTokenEndpointAuthMethodError = exports.InvalidGrantTypeError = exports.InvalidRedirectUriError = exports.ClientNotFoundError = exports.ClientRegistrationDomainError = exports.ClientRegistrationErrorCodes = void 0;
+exports.InvalidClientMetadataError = exports.MissingRequiredFieldError = exports.InvalidTokenEndpointAuthMethodError = exports.InvalidGrantTypeError = exports.InvalidRedirectUriError = exports.ClientNotFoundError = exports.ClientRegistrationDomainError = exports.ClientRegistrationErrorCodes = void 0;
 const errors_1 = require("@taico/errors");
 exports.ClientRegistrationErrorCodes = {
     CLIENT_ALREADY_REGISTERED: errors_1.ErrorCodes.CLIENT_ALREADY_REGISTERED,
@@ -9,6 +9,7 @@ exports.ClientRegistrationErrorCodes = {
     INVALID_GRANT_TYPE: errors_1.ErrorCodes.INVALID_GRANT_TYPE,
     INVALID_TOKEN_ENDPOINT_AUTH_METHOD: errors_1.ErrorCodes.INVALID_TOKEN_ENDPOINT_AUTH_METHOD,
     MISSING_REQUIRED_FIELD: errors_1.ErrorCodes.MISSING_REQUIRED_FIELD,
+    INVALID_CLIENT_METADATA: errors_1.ErrorCodes.INVALID_CLIENT_METADATA,
 };
 class ClientRegistrationDomainError extends Error {
     code;
@@ -53,4 +54,10 @@ class MissingRequiredFieldError extends ClientRegistrationDomainError {
     }
 }
 exports.MissingRequiredFieldError = MissingRequiredFieldError;
+class InvalidClientMetadataError extends ClientRegistrationDomainError {
+    constructor(clientId, reason) {
+        super(`Invalid client metadata document: ${reason}`, exports.ClientRegistrationErrorCodes.INVALID_CLIENT_METADATA, { clientId, reason });
+    }
+}
+exports.InvalidClientMetadataError = InvalidClientMetadataError;
 //# sourceMappingURL=client-registration.errors.js.map

package/dist/authorization-server/errors/client-registration.errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-registration.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/client-registration.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,4BAA4B,GAAG;IAC1C,yBAAyB,EAAE,mBAAU,CAAC,yBAAyB;IAC/D,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;IACrD,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,kCAAkC,EAChC,mBAAU,CAAC,kCAAkC;IAC/C,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;CACjD,CAAC;AASX,MAAsB,6BAA8B,SAAQ,KAAK;IAGpD;IACA;IAHX,YACE,OAAe,EACN,IAAiC,EACjC,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAA6B;QACjC,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,sEASC;AAED,MAAa,mBAAoB,SAAQ,6BAA6B;IACpE,YAAY,QAAgB;QAC1B,KAAK,CAAC,mBAAmB,EAAE,oCAA4B,CAAC,gBAAgB,EAAE;YACxE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAND,kDAMC;AAED,MAAa,uBAAwB,SAAQ,6BAA6B;IACxE,YAAY,MAAc;QACxB,KAAK,CACH,yBAAyB,MAAM,EAAE,EACjC,oCAA4B,CAAC,oBAAoB,EACjD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,0DAQC;AAED,MAAa,qBAAsB,SAAQ,6BAA6B;IACtE,YAAY,MAAc;QACxB,KAAK,CACH,qCAAqC,MAAM,EAAE,EAC7C,oCAA4B,CAAC,kBAAkB,EAC/C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,mCAAoC,SAAQ,6BAA6B;IACpF,YAAY,MAAc;QACxB,KAAK,CACH,iDAAiD,MAAM,EAAE,EACzD,oCAA4B,CAAC,kCAAkC,EAC/D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,kFAQC;AAED,MAAa,yBAA0B,SAAQ,6BAA6B;IAC1E,YAAY,SAAiB;QAC3B,KAAK,CACH,2BAA2B,SAAS,EAAE,EACtC,oCAA4B,CAAC,sBAAsB,EACnD,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;CACF;AARD,8DAQC"}
+{"version":3,"file":"client-registration.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/client-registration.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,4BAA4B,GAAG;IAC1C,yBAAyB,EAAE,mBAAU,CAAC,yBAAyB;IAC/D,gBAAgB,EAAE,mBAAU,CAAC,gBAAgB;IAC7C,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;IACrD,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,kCAAkC,EAChC,mBAAU,CAAC,kCAAkC;IAC/C,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;IACzD,uBAAuB,EAAE,mBAAU,CAAC,uBAAuB;CACnD,CAAC;AASX,MAAsB,6BAA8B,SAAQ,KAAK;IAGpD;IACA;IAHX,YACE,OAAe,EACN,IAAiC,EACjC,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAA6B;QACjC,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,sEASC;AAED,MAAa,mBAAoB,SAAQ,6BAA6B;IACpE,YAAY,QAAgB;QAC1B,KAAK,CAAC,mBAAmB,EAAE,oCAA4B,CAAC,gBAAgB,EAAE;YACxE,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAND,kDAMC;AAED,MAAa,uBAAwB,SAAQ,6BAA6B;IACxE,YAAY,MAAc;QACxB,KAAK,CACH,yBAAyB,MAAM,EAAE,EACjC,oCAA4B,CAAC,oBAAoB,EACjD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,0DAQC;AAED,MAAa,qBAAsB,SAAQ,6BAA6B;IACtE,YAAY,MAAc;QACxB,KAAK,CACH,qCAAqC,MAAM,EAAE,EAC7C,oCAA4B,CAAC,kBAAkB,EAC/C,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,sDAQC;AAED,MAAa,mCAAoC,SAAQ,6BAA6B;IACpF,YAAY,MAAc;QACxB,KAAK,CACH,iDAAiD,MAAM,EAAE,EACzD,oCAA4B,CAAC,kCAAkC,EAC/D,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,kFAQC;AAED,MAAa,yBAA0B,SAAQ,6BAA6B;IAC1E,YAAY,SAAiB;QAC3B,KAAK,CACH,2BAA2B,SAAS,EAAE,EACtC,oCAA4B,CAAC,sBAAsB,EACnD,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;CACF;AARD,8DAQC;AAMD,MAAa,0BAA2B,SAAQ,6BAA6B;IAC3E,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,qCAAqC,MAAM,EAAE,EAC7C,oCAA4B,CAAC,uBAAuB,EACpD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,gEAQC"}

package/dist/authorization-server/errors/token.errors.d.ts

@@ -11,6 +11,9 @@ export declare const TokenErrorCodes: {
     readonly INVALID_REFRESH_TOKEN: "INVALID_REFRESH_TOKEN";
     readonly REFRESH_TOKEN_EXPIRED: "REFRESH_TOKEN_EXPIRED";
     readonly REFRESH_TOKEN_REVOKED: "REFRESH_TOKEN_REVOKED";
+    readonly SERVER_IDENTIFIER_MISMATCH: "SERVER_IDENTIFIER_MISMATCH";
+    readonly RESOURCE_MISMATCH: "RESOURCE_MISMATCH";
+    readonly INVALID_CLIENT_ASSERTION: "INVALID_CLIENT_ASSERTION";
 };
 type TokenErrorCode = (typeof TokenErrorCodes)[keyof typeof TokenErrorCodes];
 export declare abstract class TokenDomainError extends Error {
@@ -54,4 +57,13 @@ export declare class RefreshTokenExpiredError extends TokenDomainError {
 export declare class RefreshTokenRevokedError extends TokenDomainError {
     constructor();
 }
+export declare class TokenServerMismatchError extends TokenDomainError {
+    constructor(expected: string, actual: string);
+}
+export declare class TokenResourceMismatchError extends TokenDomainError {
+    constructor(expected: string, actual: string);
+}
+export declare class InvalidClientAssertionError extends TokenDomainError {
+    constructor(reason: string);
+}
 export {};

package/dist/authorization-server/errors/token.errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RefreshTokenRevokedError = exports.RefreshTokenExpiredError = exports.InvalidRefreshTokenError = exports.InvalidCodeVerifierError = exports.MissingPkceParametersError = exports.RedirectUriMismatchError = exports.AuthorizationCodeExpiredError = exports.AuthorizationCodeUsedError = exports.ClientIdMismatchError = exports.InvalidAuthorizationCodeError = exports.MissingRequiredParametersError = exports.InvalidGrantTypeError = exports.TokenDomainError = exports.TokenErrorCodes = void 0;
+exports.InvalidClientAssertionError = exports.TokenResourceMismatchError = exports.TokenServerMismatchError = exports.RefreshTokenRevokedError = exports.RefreshTokenExpiredError = exports.InvalidRefreshTokenError = exports.InvalidCodeVerifierError = exports.MissingPkceParametersError = exports.RedirectUriMismatchError = exports.AuthorizationCodeExpiredError = exports.AuthorizationCodeUsedError = exports.ClientIdMismatchError = exports.InvalidAuthorizationCodeError = exports.MissingRequiredParametersError = exports.InvalidGrantTypeError = exports.TokenDomainError = exports.TokenErrorCodes = void 0;
 const errors_1 = require("@taico/errors");
 exports.TokenErrorCodes = {
     INVALID_GRANT_TYPE: errors_1.ErrorCodes.INVALID_GRANT_TYPE,
@@ -15,6 +15,9 @@ exports.TokenErrorCodes = {
     INVALID_REFRESH_TOKEN: errors_1.ErrorCodes.INVALID_REFRESH_TOKEN,
     REFRESH_TOKEN_EXPIRED: errors_1.ErrorCodes.REFRESH_TOKEN_EXPIRED,
     REFRESH_TOKEN_REVOKED: errors_1.ErrorCodes.REFRESH_TOKEN_REVOKED,
+    SERVER_IDENTIFIER_MISMATCH: errors_1.ErrorCodes.SERVER_IDENTIFIER_MISMATCH,
+    RESOURCE_MISMATCH: errors_1.ErrorCodes.RESOURCE_MISMATCH,
+    INVALID_CLIENT_ASSERTION: errors_1.ErrorCodes.INVALID_CLIENT_ASSERTION,
 };
 class TokenDomainError extends Error {
     code;
@@ -101,4 +104,22 @@ class RefreshTokenRevokedError extends TokenDomainError {
     }
 }
 exports.RefreshTokenRevokedError = RefreshTokenRevokedError;
+class TokenServerMismatchError extends TokenDomainError {
+    constructor(expected, actual) {
+        super('Grant was not issued for this MCP server.', exports.TokenErrorCodes.SERVER_IDENTIFIER_MISMATCH, { expected, actual });
+    }
+}
+exports.TokenServerMismatchError = TokenServerMismatchError;
+class TokenResourceMismatchError extends TokenDomainError {
+    constructor(expected, actual) {
+        super('Resource does not match the MCP server the grant was issued for.', exports.TokenErrorCodes.RESOURCE_MISMATCH, { expected, actual });
+    }
+}
+exports.TokenResourceMismatchError = TokenResourceMismatchError;
+class InvalidClientAssertionError extends TokenDomainError {
+    constructor(reason) {
+        super(`Client authentication failed: ${reason}`, exports.TokenErrorCodes.INVALID_CLIENT_ASSERTION, { reason });
+    }
+}
+exports.InvalidClientAssertionError = InvalidClientAssertionError;
 //# sourceMappingURL=token.errors.js.map

package/dist/authorization-server/errors/token.errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/token.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,eAAe,GAAG;IAC7B,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;IACzD,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,uBAAuB,EAAE,mBAAU,CAAC,uBAAuB;IAC3D,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,uBAAuB,EAAE,mBAAU,CAAC,uBAAuB;IAC3D,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;CAC/C,CAAC;AAQX,MAAsB,gBAAiB,SAAQ,KAAK;IAGvC;IACA;IAHX,YACE,OAAe,EACN,IAAoB,EACpB,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,4CASC;AAED,MAAa,qBAAsB,SAAQ,gBAAgB;IACzD,YAAY,SAAiB;QAC3B,KAAK,CAAC,qBAAqB,EAAE,uBAAe,CAAC,kBAAkB,EAAE;YAC/D,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAND,sDAMC;AAED,MAAa,8BAA+B,SAAQ,gBAAgB;IAClE,YAAY,SAAiB;QAC3B,KAAK,CACH,mCAAmC,SAAS,SAAS,EACrD,uBAAe,CAAC,sBAAsB,EACtC,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;CACF;AARD,wEAQC;AAED,MAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,IAAY;QACtB,KAAK,CACH,6BAA6B,EAC7B,uBAAe,CAAC,0BAA0B,EAC1C,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAED,MAAa,qBAAsB,SAAQ,gBAAgB;IACzD;QACE,KAAK,CAAC,qBAAqB,EAAE,uBAAe,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;CACF;AAJD,sDAIC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D;QACE,KAAK,CACH,2CAA2C,EAC3C,uBAAe,CAAC,uBAAuB,CACxC,CAAC;IACJ,CAAC;CACF;AAPD,gEAOC;AAED,MAAa,6BAA8B,SAAQ,gBAAgB;IACjE;QACE,KAAK,CACH,iCAAiC,EACjC,uBAAe,CAAC,0BAA0B,CAC3C,CAAC;IACJ,CAAC;CACF;AAPD,sEAOC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D;QACE,KAAK,CAAC,0BAA0B,EAAE,uBAAe,CAAC,uBAAuB,CAAC,CAAC;IAC7E,CAAC;CACF;AAJD,gEAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,4BAA4B,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IAC7E,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CACH,iCAAiC,EACjC,uBAAe,CAAC,qBAAqB,CACtC,CAAC;IACJ,CAAC;CACF;AAPD,4DAOC"}
+{"version":3,"file":"token.errors.js","sourceRoot":"","sources":["../../../src/authorization-server/errors/token.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAG9B,QAAA,eAAe,GAAG;IAC7B,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,sBAAsB,EAAE,mBAAU,CAAC,sBAAsB;IACzD,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;IACjD,uBAAuB,EAAE,mBAAU,CAAC,uBAAuB;IAC3D,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,uBAAuB,EAAE,mBAAU,CAAC,uBAAuB;IAC3D,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,qBAAqB,EAAE,mBAAU,CAAC,qBAAqB;IACvD,0BAA0B,EAAE,mBAAU,CAAC,0BAA0B;IACjE,iBAAiB,EAAE,mBAAU,CAAC,iBAAiB;IAC/C,wBAAwB,EAAE,mBAAU,CAAC,wBAAwB;CACrD,CAAC;AAQX,MAAsB,gBAAiB,SAAQ,KAAK;IAGvC;IACA;IAHX,YACE,OAAe,EACN,IAAoB,EACpB,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAgB;QACpB,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,4CASC;AAED,MAAa,qBAAsB,SAAQ,gBAAgB;IACzD,YAAY,SAAiB;QAC3B,KAAK,CAAC,qBAAqB,EAAE,uBAAe,CAAC,kBAAkB,EAAE;YAC/D,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAND,sDAMC;AAED,MAAa,8BAA+B,SAAQ,gBAAgB;IAClE,YAAY,SAAiB;QAC3B,KAAK,CACH,mCAAmC,SAAS,SAAS,EACrD,uBAAe,CAAC,sBAAsB,EACtC,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;CACF;AARD,wEAQC;AAED,MAAa,6BAA8B,SAAQ,gBAAgB;IACjE,YAAY,IAAY;QACtB,KAAK,CACH,6BAA6B,EAC7B,uBAAe,CAAC,0BAA0B,EAC1C,EAAE,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;CACF;AARD,sEAQC;AAED,MAAa,qBAAsB,SAAQ,gBAAgB;IACzD;QACE,KAAK,CAAC,qBAAqB,EAAE,uBAAe,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;CACF;AAJD,sDAIC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D;QACE,KAAK,CACH,2CAA2C,EAC3C,uBAAe,CAAC,uBAAuB,CACxC,CAAC;IACJ,CAAC;CACF;AAPD,gEAOC;AAED,MAAa,6BAA8B,SAAQ,gBAAgB;IACjE;QACE,KAAK,CACH,iCAAiC,EACjC,uBAAe,CAAC,0BAA0B,CAC3C,CAAC;IACJ,CAAC;CACF;AAPD,sEAOC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D;QACE,KAAK,CAAC,0BAA0B,EAAE,uBAAe,CAAC,uBAAuB,CAAC,CAAC;IAC7E,CAAC;CACF;AAJD,gEAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,wBAAwB,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IACzE,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,4BAA4B,EAAE,uBAAe,CAAC,qBAAqB,CAAC,CAAC;IAC7E,CAAC;CACF;AAJD,4DAIC;AAED,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CACH,iCAAiC,EACjC,uBAAe,CAAC,qBAAqB,CACtC,CAAC;IACJ,CAAC;CACF;AAPD,4DAOC;AAGD,MAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,2CAA2C,EAC3C,uBAAe,CAAC,0BAA0B,EAC1C,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,4DAQC;AAGD,MAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,kEAAkE,EAClE,uBAAe,CAAC,iBAAiB,EACjC,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACJ,CAAC;CACF;AARD,gEAQC;AAMD,MAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,YAAY,MAAc;QACxB,KAAK,CACH,iCAAiC,MAAM,EAAE,EACzC,uBAAe,CAAC,wBAAwB,EACxC,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;CACF;AARD,kEAQC"}

package/dist/authorization-server/token-exchange.service.js

@@ -60,7 +60,7 @@ let TokenExchangeService = TokenExchangeService_1 = class TokenExchangeService {
         const downstreamToken = await this.getDownstreamToken(connection, mcpTokenPayload.client_id, requestedScopes);
         return new token_exchange_response_dto_1.TokenExchangeResponseDto(downstreamToken.accessToken, 'urn:ietf:params:oauth:token-type:access_token', 'Bearer', this.calculateExpiresIn(downstreamToken.expiresAt), requestedScopes.join(' '));
     }
-    async validateMcpJwt(token, expectedAudience) {
+    async validateMcpJwt(token, expectedServerIdentifier) {
         let claims;
         try {
             claims = await this.tokenVerifierService.verifyAndDecode(token);
@@ -68,8 +68,8 @@ let TokenExchangeService = TokenExchangeService_1 = class TokenExchangeService {
         catch (error) {
             throw new common_1.UnauthorizedException('Token validation failed');
         }
-        if (claims.aud !== expectedAudience) {
-            this.logger.warn(`MCP JWT audience mismatch: expected ${expectedAudience}, got ${claims.aud}`);
+        if (claims.mcp_server_identifier !== expectedServerIdentifier) {
+            this.logger.warn(`MCP JWT server mismatch: expected ${expectedServerIdentifier}, got ${claims.mcp_server_identifier}`);
             throw new common_1.UnauthorizedException('MCP JWT audience mismatch');
         }
         return claims;

package/dist/authorization-server/token-exchange.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-exchange.service.js","sourceRoot":"","sources":["../../src/authorization-server/token-exchange.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAmD;AACnD,qCAAyC;AACzC,0FAAqF;AACrF,gGAA0F;AAC1F,yHAAmH;AACnH,+EAA0E;AAG1E,mFAA6E;AAE7E,kFAA8E;AAE9E,gIAAsH;AAQ/G,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAKZ;IAEA;IAEA;IACA;IACA;IAVF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAEmB,uBAAwD,EAExD,yBAA4D,EAE5D,qCAAoF,EACpF,kBAAsC,EACtC,oBAA0C;QAN1C,4BAAuB,GAAvB,uBAAuB,CAAiC;QAExD,8BAAyB,GAAzB,yBAAyB,CAAmC;QAE5D,0CAAqC,GAArC,qCAAqC,CAA+C;QACpF,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAKJ,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,gBAAwB;QAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2CAA2C,OAAO,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAGF,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CACzD,gBAAgB,CACjB,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,OAAO,CAAC,aAAa,EACrB,gBAAgB,CACjB,CAAC;QAGF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC;QAGxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjE,SAAS,EACT,UAAU,CAAC,EAAE,CACd,CAAC;QAGF,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK;YACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,wBAAwB,CAAC;QAC7B,IAAI,CAAC,wBAAwB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAGzE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACnD,UAAU,EACV,eAAe,CAAC,SAAS,EACzB,eAAe,CAChB,CAAC;QAGF,OAAO,IAAI,sDAAwB,CACjC,eAAe,CAAC,WAAW,EAC3B,+CAA+C,EAC/C,QAAQ,EACR,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,EAClD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1B,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,KAAa,EACb,gBAAwB;QAExB,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,MAAM,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uCAAuC,gBAAgB,SAAS,MAAM,CAAC,GAAG,EAAE,CAC7E,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,QAAgB;QAGhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBACtD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QAGD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;YAChD,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAKO,MAAM,CAAC,GAAW;QACxB,MAAM,SAAS,GACb,iEAAiE,CAAC;QACpE,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAKO,KAAK,CAAC,uBAAuB,CACnC,SAAmB,EACnB,YAAoB;QAGpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACzD,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,OAAO,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC;aACvB;SACF,CAAC,CAAC;QAGH,MAAM,gBAAgB,GAAG;YACvB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;SACnD,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAKO,wBAAwB,CAC9B,eAAyB,EACzB,cAAwB;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAE5C,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8BAA8B,cAAc,gBAAgB,CAC7D,CAAC;gBACF,MAAM,IAAI,2BAAkB,CAC1B,wBAAwB,cAAc,kBAAkB;oBACtD,oBAAoB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAKO,KAAK,CAAC,kBAAkB,CAC9B,UAA+B,EAC/B,QAAgB,EAChB,eAAyB;QAGzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,OAAO,CAAC;YACxE,KAAK,EAAE;gBACL,eAAe,EAAE,UAAU,CAAC,EAAE;gBAC9B,MAAM,EAAE,6EAAiC,CAAC,UAAU;aACrD;YACD,SAAS,EAAE,CAAC,aAAa,EAAE,kCAAkC,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kDAAkD,UAAU,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,MAAM,IAAI,8BAAqB,CAC7B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC1C,MAAM,aAAa,GAAG,CAAC,CAAC;QAExB,IACE,SAAS;YACT,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,EAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QAGD,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,sBAAsB,CAClC,QAA2C,EAC3C,UAA+B;QAE/B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,CAC1D,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,QAAQ,CAAC,YAAY;gBACpC,SAAS,EAAE,UAAU,CAAC,QAAQ;gBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAC1D,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;YAGzD,QAAQ,CAAC,WAAW,GAAG,YAAY,CAAC;YACpC,QAAQ,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAE3D,OAAO;gBACL,WAAW,EAAE,YAAY;gBACzB,SAAS,EAAE,QAAQ,CAAC,cAAc;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAClG,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAKO,kBAAkB,CAAC,SAAgB;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAlTY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,2CAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,gDAAqB,CAAC,CAAA;IAEvC,WAAA,IAAA,0BAAgB,EAAC,wEAAiC,CAAC,CAAA;qCAHV,oBAAU;QAER,oBAAU;QAEE,oBAAU;QAC7B,yCAAkB;QAChB,6CAAoB;GAXlD,oBAAoB,CAkThC"}
+{"version":3,"file":"token-exchange.service.js","sourceRoot":"","sources":["../../src/authorization-server/token-exchange.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAmD;AACnD,qCAAyC;AACzC,0FAAqF;AACrF,gGAA0F;AAC1F,yHAAmH;AACnH,+EAA0E;AAG1E,mFAA6E;AAE7E,kFAA8E;AAE9E,gIAAsH;AAQ/G,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAKZ;IAEA;IAEA;IACA;IACA;IAVF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAEmB,uBAAwD,EAExD,yBAA4D,EAE5D,qCAAoF,EACpF,kBAAsC,EACtC,oBAA0C;QAN1C,4BAAuB,GAAvB,uBAAuB,CAAiC;QAExD,8BAAyB,GAAzB,yBAAyB,CAAmC;QAE5D,0CAAqC,GAArC,qCAAqC,CAA+C;QACpF,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,yBAAoB,GAApB,oBAAoB,CAAsB;IAC1D,CAAC;IAKJ,KAAK,CAAC,aAAa,CACjB,OAAgC,EAChC,gBAAwB;QAExB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2CAA2C,OAAO,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAGF,MAAM,QAAQ,GACZ,MAAM,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CACzD,gBAAgB,CACjB,CAAC;QACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,OAAO,CAAC,aAAa,EACrB,gBAAgB,CACjB,CAAC;QAGF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC;QAGxC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,wBAAwB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjE,SAAS,EACT,UAAU,CAAC,EAAE,CACd,CAAC;QAGF,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK;YACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,wBAAwB,CAAC;QAC7B,IAAI,CAAC,wBAAwB,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;QAGzE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CACnD,UAAU,EACV,eAAe,CAAC,SAAS,EACzB,eAAe,CAChB,CAAC;QAGF,OAAO,IAAI,sDAAwB,CACjC,eAAe,CAAC,WAAW,EAC3B,+CAA+C,EAC/C,QAAQ,EACR,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,EAClD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAC1B,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,KAAa,EACb,wBAAgC;QAEhC,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAID,IAAI,MAAM,CAAC,qBAAqB,KAAK,wBAAwB,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,wBAAwB,SAAS,MAAM,CAAC,qBAAqB,EAAE,CACrG,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAKO,KAAK,CAAC,cAAc,CAC1B,QAAgB,EAChB,QAAgB;QAGhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;gBACtD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;QAGD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;YAChD,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAKO,MAAM,CAAC,GAAW;QACxB,MAAM,SAAS,GACb,iEAAiE,CAAC;QACpE,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAKO,KAAK,CAAC,uBAAuB,CACnC,SAAmB,EACnB,YAAoB;QAGpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACzD,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,OAAO,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC;aACvB;SACF,CAAC,CAAC;QAGH,MAAM,gBAAgB,GAAG;YACvB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;SACnD,CAAC;QAEF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAKO,wBAAwB,CAC9B,eAAyB,EACzB,cAAwB;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAE5C,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8BAA8B,cAAc,gBAAgB,CAC7D,CAAC;gBACF,MAAM,IAAI,2BAAkB,CAC1B,wBAAwB,cAAc,kBAAkB;oBACtD,oBAAoB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAKO,KAAK,CAAC,kBAAkB,CAC9B,UAA+B,EAC/B,QAAgB,EAChB,eAAyB;QAGzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qCAAqC,CAAC,OAAO,CAAC;YACxE,KAAK,EAAE;gBACL,eAAe,EAAE,UAAU,CAAC,EAAE;gBAC9B,MAAM,EAAE,6EAAiC,CAAC,UAAU;aACrD;YACD,SAAS,EAAE,CAAC,aAAa,EAAE,kCAAkC,CAAC;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kDAAkD,UAAU,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,MAAM,IAAI,8BAAqB,CAC7B,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,CAAC;QAC1C,MAAM,aAAa,GAAG,CAAC,CAAC;QAExB,IACE,SAAS;YACT,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,EAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QAGD,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,cAAc;SACnC,CAAC;IACJ,CAAC;IAKO,KAAK,CAAC,sBAAsB,CAClC,QAA2C,EAC3C,UAA+B;QAE/B,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDAAyD,CAC1D,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,QAAQ,CAAC,YAAY;gBACpC,SAAS,EAAE,UAAU,CAAC,QAAQ;gBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;aACvC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACtB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yBAAyB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAC1D,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;YAGzD,QAAQ,CAAC,WAAW,GAAG,YAAY,CAAC;YACpC,QAAQ,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;YACnE,IAAI,aAAa,EAAE,CAAC;gBAClB,QAAQ,CAAC,YAAY,GAAG,aAAa,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEhE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAE3D,OAAO;gBACL,WAAW,EAAE,YAAY;gBACzB,SAAS,EAAE,QAAQ,CAAC,cAAc;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAClG,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAKO,kBAAkB,CAAC,SAAgB;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAnTY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,2CAAmB,CAAC,CAAA;IAErC,WAAA,IAAA,0BAAgB,EAAC,gDAAqB,CAAC,CAAA;IAEvC,WAAA,IAAA,0BAAgB,EAAC,wEAAiC,CAAC,CAAA;qCAHV,oBAAU;QAER,oBAAU;QAEE,oBAAU;QAC7B,yCAAkB;QAChB,6CAAoB;GAXlD,oBAAoB,CAmThC"}

package/dist/authorization-server/token.service.d.ts

@@ -3,6 +3,7 @@ import { AuthJourneysService } from '../auth-journeys/auth-journeys.service';
 import { TokenRequestDto } from './dto/token-request.dto';
 import { TokenResponseDto } from './dto/token-response.dto';
 import { IntrospectTokenInput, IntrospectTokenResult } from './dto/service/token.service.types';
+import { ClientAssertionService } from './client-assertion.service';
 import { TokenVerifierService } from '../auth/crypto/token-verifier.service';
 import { TokenSignerService } from '../auth/crypto/token-signer.service';
 import { McpRefreshTokenEntity } from './entities/mcp-refresh-token.entity';
@@ -10,15 +11,17 @@ export declare class TokenService {
     private readonly authJourneysService;
     private readonly tokenVerifierService;
     private readonly tokenSignerService;
+    private readonly clientAssertionService;
     private readonly mcpRefreshTokenRepository;
     private readonly logger;
-    constructor(authJourneysService: AuthJourneysService, tokenVerifierService: TokenVerifierService, tokenSignerService: TokenSignerService, mcpRefreshTokenRepository: Repository<McpRefreshTokenEntity>);
-    handleTokenRequest(tokenRequest: TokenRequestDto): Promise<TokenResponseDto>;
-    exchangeAuthorizationCode(tokenRequest: TokenRequestDto): Promise<TokenResponseDto>;
+    constructor(authJourneysService: AuthJourneysService, tokenVerifierService: TokenVerifierService, tokenSignerService: TokenSignerService, clientAssertionService: ClientAssertionService, mcpRefreshTokenRepository: Repository<McpRefreshTokenEntity>);
+    handleTokenRequest(tokenRequest: TokenRequestDto, serverIdentifier: string, version?: string): Promise<TokenResponseDto>;
     private handleAuthorizationCodeGrant;
     private handleRefreshTokenGrant;
+    private authenticateClient;
+    private assertGrantBoundToServer;
     private validatePkceVerifier;
     private generateAccessToken;
     private generateAndStoreRefreshToken;
-    introspectToken(input: IntrospectTokenInput): Promise<IntrospectTokenResult>;
+    introspectToken(input: IntrospectTokenInput, serverIdentifier?: string): Promise<IntrospectTokenResult>;
 }

package/dist/authorization-server/token.service.js

@@ -21,6 +21,8 @@ const crypto_1 = require("crypto");
 const auth_journeys_service_1 = require("../auth-journeys/auth-journeys.service");
 const grant_type_enum_1 = require("./enums/grant-type.enum");
 const token_type_enum_1 = require("./enums/token-type.enum");
+const token_endpoint_auth_method_enum_1 = require("./enums/token-endpoint-auth-method.enum");
+const client_assertion_service_1 = require("./client-assertion.service");
 const mcp_authorization_flow_status_enum_1 = require("../auth-journeys/enums/mcp-authorization-flow-status.enum");
 const env_config_1 = require("../config/env.config");
 const token_errors_1 = require("./errors/token.errors");
@@ -28,33 +30,33 @@ const token_verifier_service_1 = require("../auth/crypto/token-verifier.service"
 const token_signer_service_1 = require("../auth/crypto/token-signer.service");
 const auth_journey_status_enum_1 = require("../auth-journeys/enums/auth-journey-status.enum");
 const mcp_refresh_token_entity_1 = require("./entities/mcp-refresh-token.entity");
+const resource_audience_1 = require("../auth/core/resource-audience");
 let TokenService = TokenService_1 = class TokenService {
     authJourneysService;
     tokenVerifierService;
     tokenSignerService;
+    clientAssertionService;
     mcpRefreshTokenRepository;
     logger = new common_1.Logger(TokenService_1.name);
-    constructor(authJourneysService, tokenVerifierService, tokenSignerService, mcpRefreshTokenRepository) {
+    constructor(authJourneysService, tokenVerifierService, tokenSignerService, clientAssertionService, mcpRefreshTokenRepository) {
         this.authJourneysService = authJourneysService;
         this.tokenVerifierService = tokenVerifierService;
         this.tokenSignerService = tokenSignerService;
+        this.clientAssertionService = clientAssertionService;
         this.mcpRefreshTokenRepository = mcpRefreshTokenRepository;
     }
-    async handleTokenRequest(tokenRequest) {
+    async handleTokenRequest(tokenRequest, serverIdentifier, version = resource_audience_1.MCP_AUTH_SERVER_VERSION) {
         this.logger.debug(`Processing token request for client: ${tokenRequest.client_id}, grant_type: ${tokenRequest.grant_type}`);
         switch (tokenRequest.grant_type) {
             case grant_type_enum_1.GrantType.AUTHORIZATION_CODE:
-                return this.handleAuthorizationCodeGrant(tokenRequest);
+                return this.handleAuthorizationCodeGrant(tokenRequest, serverIdentifier, version);
             case grant_type_enum_1.GrantType.REFRESH_TOKEN:
-                return this.handleRefreshTokenGrant(tokenRequest);
+                return this.handleRefreshTokenGrant(tokenRequest, serverIdentifier, version);
             default:
                 throw new token_errors_1.InvalidGrantTypeError(tokenRequest.grant_type);
         }
     }
-    async exchangeAuthorizationCode(tokenRequest) {
-        return this.handleTokenRequest(tokenRequest);
-    }
-    async handleAuthorizationCodeGrant(tokenRequest) {
+    async handleAuthorizationCodeGrant(tokenRequest, serverIdentifier, version) {
         if (!tokenRequest.code ||
             !tokenRequest.code_verifier ||
             !tokenRequest.redirect_uri) {
@@ -71,10 +73,8 @@ let TokenService = TokenService_1 = class TokenService {
             this.logger.warn(`Authorization code not found: ${tokenRequest.code}`);
             throw new token_errors_1.InvalidAuthorizationCodeError(tokenRequest.code);
         }
-        if (mcpAuthFlow.client.clientId !== tokenRequest.client_id) {
-            this.logger.warn(`Client ID mismatch for authorization code`);
-            throw new token_errors_1.ClientIdMismatchError();
-        }
+        this.assertGrantBoundToServer(mcpAuthFlow, tokenRequest, serverIdentifier);
+        const clientId = await this.authenticateClient(mcpAuthFlow, tokenRequest, version);
         if (mcpAuthFlow.authorizationCodeUsed) {
             this.logger.warn(`Authorization code already used: ${tokenRequest.code}`);
             throw new token_errors_1.AuthorizationCodeUsedError();
@@ -104,7 +104,7 @@ let TokenService = TokenService_1 = class TokenService {
         await this.authJourneysService.updateAuthJourneyStatus(mcpAuthFlow.authorizationJourneyId, auth_journey_status_enum_1.AuthJourneyStatus.AUTHORIZATION_CODE_EXCHANGED);
         const config = (0, env_config_1.getConfig)();
         const accessToken = await this.generateAccessToken(mcpAuthFlow);
-        const refreshToken = await this.generateAndStoreRefreshToken(mcpAuthFlow, tokenRequest.client_id);
+        const refreshToken = await this.generateAndStoreRefreshToken(mcpAuthFlow, clientId);
         const tokenResponse = {
             access_token: accessToken,
             token_type: token_type_enum_1.TokenType.BEARER,
@@ -114,10 +114,10 @@ let TokenService = TokenService_1 = class TokenService {
                 ? mcpAuthFlow.client.scopes.join(' ')
                 : undefined,
         };
-        this.logger.log(`Issued access token for client: ${tokenRequest.client_id}`);
+        this.logger.log(`Issued access token for client: ${clientId}`);
         return tokenResponse;
     }
-    async handleRefreshTokenGrant(tokenRequest) {
+    async handleRefreshTokenGrant(tokenRequest, serverIdentifier, version) {
         this.logger.debug('refresh token request');
         if (!tokenRequest.refresh_token) {
             throw new token_errors_1.MissingRequiredParametersError(tokenRequest.grant_type);
@@ -140,10 +140,6 @@ let TokenService = TokenService_1 = class TokenService {
             this.logger.warn('Refresh token not found');
             throw new token_errors_1.InvalidRefreshTokenError();
         }
-        if (storedToken.clientId !== tokenRequest.client_id) {
-            this.logger.warn('Client ID mismatch for refresh token');
-            throw new token_errors_1.ClientIdMismatchError();
-        }
         if (storedToken.revokedAt) {
             this.logger.warn('Refresh token has been revoked');
             throw new token_errors_1.RefreshTokenRevokedError();
@@ -153,11 +149,17 @@ let TokenService = TokenService_1 = class TokenService {
             throw new token_errors_1.RefreshTokenExpiredError();
         }
         const mcpAuthFlow = storedToken.mcpAuthorizationFlow;
+        this.assertGrantBoundToServer(mcpAuthFlow, tokenRequest, serverIdentifier);
+        const clientId = await this.authenticateClient(mcpAuthFlow, tokenRequest, version);
+        if (storedToken.clientId !== clientId) {
+            this.logger.warn('Client ID mismatch for refresh token');
+            throw new token_errors_1.ClientIdMismatchError();
+        }
         storedToken.revokedAt = new Date();
         await this.mcpRefreshTokenRepository.save(storedToken);
         const config = (0, env_config_1.getConfig)();
         const accessToken = await this.generateAccessToken(mcpAuthFlow);
-        const newRefreshToken = await this.generateAndStoreRefreshToken(mcpAuthFlow, tokenRequest.client_id);
+        const newRefreshToken = await this.generateAndStoreRefreshToken(mcpAuthFlow, clientId);
         const tokenResponse = {
             access_token: accessToken,
             token_type: token_type_enum_1.TokenType.BEARER,
@@ -167,9 +169,43 @@ let TokenService = TokenService_1 = class TokenService {
                 ? mcpAuthFlow.client.scopes.join(' ')
                 : undefined,
         };
-        this.logger.log(`Refreshed access token for client: ${tokenRequest.client_id}`);
+        this.logger.log(`Refreshed access token for client: ${clientId}`);
         return tokenResponse;
     }
+    async authenticateClient(mcpAuthFlow, tokenRequest, version) {
+        const { client, server } = mcpAuthFlow;
+        if (tokenRequest.client_id !== undefined &&
+            tokenRequest.client_id !== client.clientId) {
+            this.logger.warn('Client ID mismatch for token request');
+            throw new token_errors_1.ClientIdMismatchError();
+        }
+        if (client.tokenEndpointAuthMethod === token_endpoint_auth_method_enum_1.TokenEndpointAuthMethod.PRIVATE_KEY_JWT) {
+            const { issuerUrl } = (0, env_config_1.getConfig)();
+            const audiences = [server.providedId, server.id].flatMap((identifier) => [
+                `${issuerUrl}/mcp/${identifier}/${version}`,
+                `${issuerUrl}/api/v1/auth/token/mcp/${identifier}/${version}`,
+            ]);
+            await this.clientAssertionService.authenticate(client, tokenRequest, audiences);
+        }
+        else if (tokenRequest.client_id === undefined) {
+            throw new token_errors_1.MissingRequiredParametersError(tokenRequest.grant_type);
+        }
+        return client.clientId;
+    }
+    assertGrantBoundToServer(mcpAuthFlow, tokenRequest, serverIdentifier) {
+        const server = mcpAuthFlow.server;
+        if (server.providedId !== serverIdentifier &&
+            server.id !== serverIdentifier) {
+            this.logger.warn('Grant presented at another MCP server token endpoint');
+            throw new token_errors_1.TokenServerMismatchError(serverIdentifier, server.providedId);
+        }
+        const serverResource = (0, resource_audience_1.getMcpServerResourceUrl)(server);
+        if (tokenRequest.resource &&
+            !(0, resource_audience_1.isSameResource)(tokenRequest.resource, serverResource)) {
+            this.logger.warn('Token request resource does not match the grant');
+            throw new token_errors_1.TokenResourceMismatchError(serverResource, tokenRequest.resource);
+        }
+    }
     validatePkceVerifier(codeVerifier, codeChallenge, codeChallengeMethod) {
         if (codeChallengeMethod === 'S256') {
             const hash = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest();
@@ -189,6 +225,7 @@ let TokenService = TokenService_1 = class TokenService {
         }
         const now = Math.floor(Date.now() / 1000);
         const config = (0, env_config_1.getConfig)();
+        const serverResource = (0, resource_audience_1.getMcpServerResourceUrl)(mcpAuthFlow.server);
         const payload = {
             iss: config.issuerUrl,
             sub: mcpAuthFlow.authJourney.actorId,
@@ -197,15 +234,15 @@ let TokenService = TokenService_1 = class TokenService {
             actor_type: mcpAuthFlow.authJourney.actor.type,
             email: mcpAuthFlow.authJourney.actor.user.email,
             displayName: mcpAuthFlow.authJourney.actor.displayName,
-            aud: mcpAuthFlow.server.providedId,
+            aud: serverResource,
             exp: now + config.mcpAccessTokenDurationSeconds,
             iat: now,
             jti: (0, crypto_1.randomBytes)(16).toString('hex'),
             client_id: mcpAuthFlow.client.clientId,
             scope: mcpAuthFlow.scopes || [],
             mcp_server_identifier: mcpAuthFlow.server.providedId,
-            resource: mcpAuthFlow.resource || '',
-            version: '1.0.0',
+            resource: serverResource,
+            version: resource_audience_1.MCP_AUTH_SERVER_VERSION,
         };
         const jwt = await this.tokenSignerService.signToken(payload);
         return jwt;
@@ -227,7 +264,7 @@ let TokenService = TokenService_1 = class TokenService {
         this.logger.debug(`Stored refresh token for flow: ${mcpAuthFlow.id}, expires: ${expiresAt.toISOString()}`);
         return token;
     }
-    async introspectToken(input) {
+    async introspectToken(input, serverIdentifier) {
         this.logger.debug(`Introspecting token${input.client_id ? ` for client: ${input.client_id}` : ''}`);
         let claims;
         try {
@@ -241,6 +278,10 @@ let TokenService = TokenService_1 = class TokenService {
             this.logger.warn('Client ID mismatch during introspection');
             return { active: false };
         }
+        if (serverIdentifier && claims.mcp_server_identifier !== serverIdentifier) {
+            this.logger.warn('Token introspected at another MCP server endpoint');
+            return { active: false };
+        }
         const result = {
             active: true,
             token_type: token_type_enum_1.TokenType.BEARER,
@@ -263,10 +304,11 @@ let TokenService = TokenService_1 = class TokenService {
 exports.TokenService = TokenService;
 exports.TokenService = TokenService = TokenService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(3, (0, typeorm_1.InjectRepository)(mcp_refresh_token_entity_1.McpRefreshTokenEntity)),
+    __param(4, (0, typeorm_1.InjectRepository)(mcp_refresh_token_entity_1.McpRefreshTokenEntity)),
     __metadata("design:paramtypes", [auth_journeys_service_1.AuthJourneysService,
         token_verifier_service_1.TokenVerifierService,
         token_signer_service_1.TokenSignerService,
+        client_assertion_service_1.ClientAssertionService,
         typeorm_2.Repository])
 ], TokenService);
 //# sourceMappingURL=token.service.js.map

package/dist/authorization-server/token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/authorization-server/token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAiD;AAEjD,kFAA6E;AAO7E,6DAAoD;AACpD,6DAAoD;AACpD,kHAAuG;AACvG,qDAAiD;AACjD,wDAa+B;AAC/B,kFAA6E;AAE7E,8EAAyE;AACzE,8FAAqF;AACrF,kFAA4E;AAGrE,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIJ;IACA;IACA;IAEA;IAPF,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,YACmB,mBAAwC,EACxC,oBAA0C,EAC1C,kBAAsC,EAEtC,yBAA4D;QAJ5D,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,uBAAkB,GAAlB,kBAAkB,CAAoB;QAEtC,8BAAyB,GAAzB,yBAAyB,CAAmC;IAC5E,CAAC;IAMJ,KAAK,CAAC,kBAAkB,CACtB,YAA6B;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,YAAY,CAAC,SAAS,iBAAiB,YAAY,CAAC,UAAU,EAAE,CACzG,CAAC;QAEF,QAAQ,YAAY,CAAC,UAAU,EAAE,CAAC;YAChC,KAAK,2BAAS,CAAC,kBAAkB;gBAC/B,OAAO,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACzD,KAAK,2BAAS,CAAC,aAAa;gBAC1B,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACpD;gBACE,MAAM,IAAI,oCAAqB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,yBAAyB,CAC7B,YAA6B;QAE7B,OAAO,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAKO,KAAK,CAAC,4BAA4B,CACxC,YAA6B;QAG7B,IACE,CAAC,YAAY,CAAC,IAAI;YAClB,CAAC,YAAY,CAAC,aAAa;YAC3B,CAAC,YAAY,CAAC,YAAY,EAC1B,CAAC;YACD,MAAM,IAAI,6CAA8B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,mBAAmB,CAAC,kCAAkC,CAC/D,YAAY,CAAC,IAAI,EACjB;YACE,QAAQ;YACR,QAAQ;YACR,aAAa;YACb,mBAAmB;YACnB,wBAAwB;SACzB,CACF,CAAC;QAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,IAAI,4CAA6B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,WAAW,CAAC,MAAM,CAAC,QAAQ,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,IAAI,oCAAqB,EAAE,CAAC;QACpC,CAAC;QAGD,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,yCAA0B,EAAE,CAAC;QACzC,CAAC;QAGD,IACE,CAAC,WAAW,CAAC,0BAA0B;YACvC,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,0BAA0B,EACnD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,MAAM,IAAI,4CAA6B,EAAE,CAAC;QAC5C,CAAC;QAGD,IAAI,WAAW,CAAC,WAAW,KAAK,YAAY,CAAC,YAAY,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,CAAC,WAAW,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAClE,MAAM,IAAI,yCAA0B,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAC/C,YAAY,CAAC,aAAa,EAC1B,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,mBAAmB,CAChC,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,WAAW,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACzC,WAAW,CAAC,MAAM;YAChB,+DAA0B,CAAC,4BAA4B,CAAC;QAC1D,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,4BAA4B,CAC/C,CAAC;QAGF,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAC1D,WAAW,EACX,YAAY,CAAC,SAAS,CACvB,CAAC;QAGF,MAAM,aAAa,GAAqB;YACtC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,UAAU,EAAE,MAAM,CAAC,6BAA6B;YAChD,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBAC9B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mCAAmC,YAAY,CAAC,SAAS,EAAE,CAC5D,CAAC;QAEF,OAAO,aAAa,CAAC;IACvB,CAAC;IAMO,KAAK,CAAC,uBAAuB,CACnC,YAA6B;QAE7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE3C,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,6CAA8B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACnC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAC/D,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,SAAS,EAAE;gBACT,sBAAsB;gBACtB,6BAA6B;gBAC7B,6BAA6B;gBAC7B,kCAAkC;gBAClC,wCAAwC;gBACxC,6CAA6C;aAC9C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,WAAW,CAAC,QAAQ,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,IAAI,oCAAqB,EAAE,CAAC;QACpC,CAAC;QAGD,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACnD,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC;QAGrD,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAGvD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAC7D,WAAW,EACX,YAAY,CAAC,SAAS,CACvB,CAAC;QAGF,MAAM,aAAa,GAAqB;YACtC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,UAAU,EAAE,MAAM,CAAC,6BAA6B;YAChD,aAAa,EAAE,eAAe;YAC9B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBAC9B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,sCAAsC,YAAY,CAAC,SAAS,EAAE,CAC/D,CAAC;QAEF,OAAO,aAAa,CAAC;IACvB,CAAC;IAMO,oBAAoB,CAC1B,YAAoB,EACpB,aAAqB,EACrB,mBAA2B;QAE3B,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAEnC,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YAChE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,OAAO,iBAAiB,KAAK,aAAa,CAAC;QAC7C,CAAC;aAAM,IAAI,mBAAmB,KAAK,OAAO,EAAE,CAAC;YAE3C,OAAO,YAAY,KAAK,aAAa,CAAC;QACxC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAKO,KAAK,CAAC,mBAAmB,CAC/B,WAAuC;QAEvC,IACE,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO;YAChC,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK;YAC9B,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EACnC,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,OAAO,GAAsB;YACjC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO;YACpC,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;YAC1C,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI;YAC9C,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI;YAC9C,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;YAC/C,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW;YACtD,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU;YAClC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,6BAA6B;YAC/C,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ;YACtC,KAAK,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;YAC/B,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU;YACpD,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,EAAE;YACpC,OAAO,EAAE,OAAO;SACjB,CAAC;QAGF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAE7D,OAAO,GAAG,CAAC;IACb,CAAC;IAMO,KAAK,CAAC,4BAA4B,CACxC,WAAuC,EACvC,QAAgB;QAGhB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAGpD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGnE,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAG5E,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;YACzD,sBAAsB,EAAE,WAAW,CAAC,EAAE;YACtC,QAAQ;YACR,SAAS;YACT,SAAS;YACT,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kCAAkC,WAAW,CAAC,EAAE,cAAc,SAAS,CAAC,WAAW,EAAE,EAAE,CACxF,CAAC;QAGF,OAAO,KAAK,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,eAAe,CACnB,KAA2B;QAE3B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sBAAsB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC;QAEF,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC1F,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAID,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAGD,MAAM,MAAM,GAA0B;YACpC,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YAC9B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,8CAA8C,MAAM,CAAC,SAAS,EAAE,CACjE,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA3YY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,0BAAgB,EAAC,gDAAqB,CAAC,CAAA;qCAHF,2CAAmB;QAClB,6CAAoB;QACtB,yCAAkB;QAEX,oBAAU;GAR7C,YAAY,CA2YxB"}
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/authorization-server/token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAiD;AAEjD,kFAA6E;AAO7E,6DAAoD;AACpD,6DAAoD;AACpD,6FAAkF;AAClF,yEAAoE;AACpE,kHAAuG;AACvG,qDAAiD;AACjD,wDAe+B;AAC/B,kFAA6E;AAE7E,8EAAyE;AACzE,8FAAqF;AACrF,kFAA4E;AAC5E,sEAIwC;AAGjC,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIJ;IACA;IACA;IACA;IAEA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,YACmB,mBAAwC,EACxC,oBAA0C,EAC1C,kBAAsC,EACtC,sBAA8C,EAE9C,yBAA4D;QAL5D,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,2BAAsB,GAAtB,sBAAsB,CAAwB;QAE9C,8BAAyB,GAAzB,yBAAyB,CAAmC;IAC5E,CAAC;IAMJ,KAAK,CAAC,kBAAkB,CACtB,YAA6B,EAC7B,gBAAwB,EACxB,UAAkB,2CAAuB;QAEzC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,YAAY,CAAC,SAAS,iBAAiB,YAAY,CAAC,UAAU,EAAE,CACzG,CAAC;QAEF,QAAQ,YAAY,CAAC,UAAU,EAAE,CAAC;YAChC,KAAK,2BAAS,CAAC,kBAAkB;gBAC/B,OAAO,IAAI,CAAC,4BAA4B,CACtC,YAAY,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;YACJ,KAAK,2BAAS,CAAC,aAAa;gBAC1B,OAAO,IAAI,CAAC,uBAAuB,CACjC,YAAY,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;YACJ;gBACE,MAAM,IAAI,oCAAqB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAKO,KAAK,CAAC,4BAA4B,CACxC,YAA6B,EAC7B,gBAAwB,EACxB,OAAe;QAGf,IACE,CAAC,YAAY,CAAC,IAAI;YAClB,CAAC,YAAY,CAAC,aAAa;YAC3B,CAAC,YAAY,CAAC,YAAY,EAC1B,CAAC;YACD,MAAM,IAAI,6CAA8B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,WAAW,GACf,MAAM,IAAI,CAAC,mBAAmB,CAAC,kCAAkC,CAC/D,YAAY,CAAC,IAAI,EACjB;YACE,QAAQ;YACR,QAAQ;YACR,aAAa;YACb,mBAAmB;YACnB,wBAAwB;SACzB,CACF,CAAC;QAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,IAAI,4CAA6B,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAG3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,WAAW,EACX,YAAY,EACZ,OAAO,CACR,CAAC;QAGF,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,MAAM,IAAI,yCAA0B,EAAE,CAAC;QACzC,CAAC;QAGD,IACE,CAAC,WAAW,CAAC,0BAA0B;YACvC,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,0BAA0B,EACnD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,MAAM,IAAI,4CAA6B,EAAE,CAAC;QAC5C,CAAC;QAGD,IAAI,WAAW,CAAC,WAAW,KAAK,YAAY,CAAC,YAAY,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,CAAC,WAAW,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAClE,MAAM,IAAI,yCAA0B,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAC/C,YAAY,CAAC,aAAa,EAC1B,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,mBAAmB,CAChC,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC/C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,WAAW,CAAC,qBAAqB,GAAG,IAAI,CAAC;QACzC,WAAW,CAAC,MAAM;YAChB,+DAA0B,CAAC,4BAA4B,CAAC;QAC1D,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACpD,WAAW,CAAC,sBAAsB,EAClC,4CAAiB,CAAC,4BAA4B,CAC/C,CAAC;QAGF,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAC1D,WAAW,EACX,QAAQ,CACT,CAAC;QAGF,MAAM,aAAa,GAAqB;YACtC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,UAAU,EAAE,MAAM,CAAC,6BAA6B;YAChD,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBAC9B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;QAE/D,OAAO,aAAa,CAAC;IACvB,CAAC;IAMO,KAAK,CAAC,uBAAuB,CACnC,YAA6B,EAC7B,gBAAwB,EACxB,OAAe;QAEf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAE3C,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,6CAA8B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAGD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACnC,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC;YAC/D,KAAK,EAAE,EAAE,SAAS,EAAE;YACpB,SAAS,EAAE;gBACT,sBAAsB;gBACtB,6BAA6B;gBAC7B,6BAA6B;gBAC7B,kCAAkC;gBAClC,wCAAwC;gBACxC,6CAA6C;aAC9C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAC5C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YACnD,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAGD,IAAI,IAAI,IAAI,EAAE,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC1C,MAAM,IAAI,uCAAwB,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC;QAErD,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAG3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAC5C,WAAW,EACX,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,IAAI,oCAAqB,EAAE,CAAC;QACpC,CAAC;QAGD,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAGvD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAC7D,WAAW,EACX,QAAQ,CACT,CAAC;QAGF,MAAM,aAAa,GAAqB;YACtC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,UAAU,EAAE,MAAM,CAAC,6BAA6B;YAChD,aAAa,EAAE,eAAe;YAC9B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM;gBAC9B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAC,SAAS;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QAElE,OAAO,aAAa,CAAC;IACvB,CAAC;IAUO,KAAK,CAAC,kBAAkB,CAC9B,WAAuC,EACvC,YAA6B,EAC7B,OAAe;QAEf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QAEvC,IACE,YAAY,CAAC,SAAS,KAAK,SAAS;YACpC,YAAY,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ,EAC1C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,IAAI,oCAAqB,EAAE,CAAC;QACpC,CAAC;QAED,IACE,MAAM,CAAC,uBAAuB,KAAK,yDAAuB,CAAC,eAAe,EAC1E,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,sBAAS,GAAE,CAAC;YAIlC,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;gBACvE,GAAG,SAAS,QAAQ,UAAU,IAAI,OAAO,EAAE;gBAC3C,GAAG,SAAS,0BAA0B,UAAU,IAAI,OAAO,EAAE;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAC5C,MAAM,EACN,YAAY,EACZ,SAAS,CACV,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAEhD,MAAM,IAAI,6CAA8B,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAOO,wBAAwB,CAC9B,WAAuC,EACvC,YAA6B,EAC7B,gBAAwB;QAExB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,IACE,MAAM,CAAC,UAAU,KAAK,gBAAgB;YACtC,MAAM,CAAC,EAAE,KAAK,gBAAgB,EAC9B,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACzE,MAAM,IAAI,uCAAwB,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,2CAAuB,EAAC,MAAM,CAAC,CAAC;QACvD,IACE,YAAY,CAAC,QAAQ;YACrB,CAAC,IAAA,kCAAc,EAAC,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,EACtD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACpE,MAAM,IAAI,yCAA0B,CAClC,cAAc,EACd,YAAY,CAAC,QAAQ,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAMO,oBAAoB,CAC1B,YAAoB,EACpB,aAAqB,EACrB,mBAA2B;QAE3B,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAEnC,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;YAChE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,OAAO,iBAAiB,KAAK,aAAa,CAAC;QAC7C,CAAC;aAAM,IAAI,mBAAmB,KAAK,OAAO,EAAE,CAAC;YAE3C,OAAO,YAAY,KAAK,aAAa,CAAC;QACxC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAKO,KAAK,CAAC,mBAAmB,CAC/B,WAAuC;QAEvC,IACE,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO;YAChC,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK;YAC9B,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EACnC,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAGD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAG3B,MAAM,cAAc,GAAG,IAAA,2CAAuB,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAsB;YACjC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,OAAO;YACpC,QAAQ,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;YAC1C,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI;YAC9C,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI;YAC9C,KAAK,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;YAC/C,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW;YACtD,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,6BAA6B;YAC/C,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ;YACtC,KAAK,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;YAC/B,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAAC,UAAU;YACpD,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,2CAAuB;SACjC,CAAC;QAGF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAE7D,OAAO,GAAG,CAAC;IACb,CAAC;IAMO,KAAK,CAAC,4BAA4B,CACxC,WAAuC,EACvC,QAAgB;QAGhB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAGpD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAGnE,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAG5E,MAAM,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC;YACzD,sBAAsB,EAAE,WAAW,CAAC,EAAE;YACtC,QAAQ;YACR,SAAS;YACT,SAAS;YACT,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAExD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kCAAkC,WAAW,CAAC,EAAE,cAAc,SAAS,CAAC,WAAW,EAAE,EAAE,CACxF,CAAC;QAGF,OAAO,KAAK,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,eAAe,CACnB,KAA2B,EAC3B,gBAAyB;QAEzB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sBAAsB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC;QAEF,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC1F,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAID,IAAI,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAC5D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAKD,IAAI,gBAAgB,IAAI,MAAM,CAAC,qBAAqB,KAAK,gBAAgB,EAAE,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;QAGD,MAAM,MAAM,GAA0B;YACpC,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,2BAAS,CAAC,MAAM;YAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YAC9B,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,8CAA8C,MAAM,CAAC,SAAS,EAAE,CACjE,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAhfY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,0BAAgB,EAAC,gDAAqB,CAAC,CAAA;qCAJF,2CAAmB;QAClB,6CAAoB;QACtB,yCAAkB;QACd,iDAAsB;QAEnB,oBAAU;GAT7C,YAAY,CAgfxB"}

package/dist/authorization-server/utils/cache-control.d.ts

@@ -0,0 +1 @@
+export declare function cacheSeconds(cacheControl: string | null): number;

package/dist/authorization-server/utils/cache-control.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cacheSeconds = cacheSeconds;
+const MIN_CACHE_SECONDS = 60;
+const DEFAULT_CACHE_SECONDS = 15 * 60;
+const MAX_CACHE_SECONDS = 24 * 60 * 60;
+function cacheSeconds(cacheControl) {
+    if (!cacheControl) {
+        return DEFAULT_CACHE_SECONDS;
+    }
+    if (/\b(no-store|no-cache)\b/i.test(cacheControl)) {
+        return MIN_CACHE_SECONDS;
+    }
+    const maxAge = /\bmax-age\s*=\s*"?(\d+)/i.exec(cacheControl);
+    if (!maxAge) {
+        return DEFAULT_CACHE_SECONDS;
+    }
+    return Math.min(MAX_CACHE_SECONDS, Math.max(MIN_CACHE_SECONDS, parseInt(maxAge[1], 10)));
+}
+//# sourceMappingURL=cache-control.js.map

package/dist/authorization-server/utils/cache-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.js","sourceRoot":"","sources":["../../../src/authorization-server/utils/cache-control.ts"],"names":[],"mappings":";;AAOA,oCAeC;AApBD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AACtC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAGvC,SAAgB,YAAY,CAAC,YAA2B;IACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAClD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CACb,iBAAiB,EACjB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CACrD,CAAC;AACJ,CAAC"}

package/dist/authorization-server/utils/cache-control.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authorization-server/utils/cache-control.spec.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cache_control_1 = require("./cache-control");
+describe('cacheSeconds', () => {
+    it('uses max-age', () => {
+        expect((0, cache_control_1.cacheSeconds)('public, max-age=3600')).toBe(3600);
+    });
+    it('falls back to 15 minutes without a usable header', () => {
+        expect((0, cache_control_1.cacheSeconds)(null)).toBe(900);
+        expect((0, cache_control_1.cacheSeconds)('public')).toBe(900);
+    });
+    it('never caches for less than a minute, so requests cannot force a fetch each time', () => {
+        expect((0, cache_control_1.cacheSeconds)('max-age=0')).toBe(60);
+        expect((0, cache_control_1.cacheSeconds)('no-store')).toBe(60);
+        expect((0, cache_control_1.cacheSeconds)('no-cache, max-age=3600')).toBe(60);
+    });
+    it('never caches for more than a day', () => {
+        expect((0, cache_control_1.cacheSeconds)('max-age=31536000')).toBe(86400);
+    });
+});
+//# sourceMappingURL=cache-control.spec.js.map

package/dist/authorization-server/utils/cache-control.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.spec.js","sourceRoot":"","sources":["../../../src/authorization-server/utils/cache-control.spec.ts"],"names":[],"mappings":";;AAAA,mDAA+C;AAE/C,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,IAAA,4BAAY,EAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,IAAA,4BAAY,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,IAAA,4BAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,IAAA,4BAAY,EAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAA,4BAAY,EAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAA,4BAAY,EAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,IAAA,4BAAY,EAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/authorization-server/utils/client-assertion.d.ts

@@ -0,0 +1,5 @@
+export declare const JWT_BEARER_CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+export declare const CLIENT_ASSERTION_SIGNING_ALGORITHMS: string[];
+export declare function parsePublicJwks(value: unknown, reject: (reason: string) => never): {
+    keys: Record<string, unknown>[];
+};

package/dist/authorization-server/utils/client-assertion.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_ASSERTION_SIGNING_ALGORITHMS = exports.JWT_BEARER_CLIENT_ASSERTION_TYPE = void 0;
+exports.parsePublicJwks = parsePublicJwks;
+exports.JWT_BEARER_CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+exports.CLIENT_ASSERTION_SIGNING_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
+const MAX_KEYS = 10;
+const PUBLIC_KEY_TYPES = ['RSA', 'EC', 'OKP'];
+const SECRET_KEY_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth', 'k'];
+function parsePublicJwks(value, reject) {
+    const keys = value?.keys;
+    if (!Array.isArray(keys) ||
+        keys.length === 0 ||
+        !keys.every((key) => typeof key === 'object' && key !== null && !Array.isArray(key))) {
+        return reject('the key set must be a JSON object with a non-empty keys array');
+    }
+    if (keys.length > MAX_KEYS) {
+        reject(`the key set has more than ${MAX_KEYS} keys`);
+    }
+    for (const key of keys) {
+        if (typeof key.kty !== 'string' ||
+            !PUBLIC_KEY_TYPES.includes(key.kty) ||
+            SECRET_KEY_MEMBERS.some((member) => member in key)) {
+            reject('the key set must contain public keys only');
+        }
+    }
+    return { keys };
+}
+//# sourceMappingURL=client-assertion.js.map

package/dist/authorization-server/utils/client-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.js","sourceRoot":"","sources":["../../../src/authorization-server/utils/client-assertion.ts"],"names":[],"mappings":";;;AAkCA,0CA8BC;AA/DY,QAAA,gCAAgC,GAC3C,wDAAwD,CAAC;AAM9C,QAAA,mCAAmC,GAAG;IACjD,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC;AAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;AAIpB,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAG9C,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;AAMzE,SAAgB,eAAe,CAC7B,KAAc,EACd,MAAiC;IAEjC,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;IACxD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,IAAI,CAAC,KAAK,CACT,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CACjE,EACD,CAAC;QACD,OAAO,MAAM,CACX,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,6BAA6B,QAAQ,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IACE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAC3B,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YACnC,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC,EAClD,CAAC;YACD,MAAM,CAAC,2CAA2C,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/authorization-server/utils/public-address.d.ts

@@ -0,0 +1,2 @@
+export declare function isPublicAddress(address: string): boolean;
+export declare function isLoopbackAddress(address: string): boolean;