@tdacorp/identity-client 0.2.1 → 0.2.2

package/dist/{chunk-S5WGUOJA.js → chunk-TTFIPEZ3.js}

@@ -306,6 +306,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }
@@ -315,6 +321,12 @@ async function verifyAccessToken(accessToken, options) {
   const result = await verifyAgainstIssuer(accessToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if (payload.token_use !== "oauth_access") {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: 'Token is missing token_use: "oauth_access". This is not an access token (likely an id_token).' }]
+    };
+  }
   const claims = payload;
   const roles = "roles" in claims ? claims.roles : void 0;
   if (typeof payload.sub === "string") {

package/dist/index.cjs

@@ -343,6 +343,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }
@@ -352,6 +358,12 @@ async function verifyAccessToken(accessToken, options) {
   const result = await verifyAgainstIssuer(accessToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if (payload.token_use !== "oauth_access") {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: 'Token is missing token_use: "oauth_access". This is not an access token (likely an id_token).' }]
+    };
+  }
   const claims = payload;
   const roles = "roles" in claims ? claims.roles : void 0;
   if (typeof payload.sub === "string") {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-C1Ga6JbS.cjs';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-ggSzUrdC.cjs';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-C1Ga6JbS.js';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-ggSzUrdC.js';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-S5WGUOJA.js";
+} from "./chunk-TTFIPEZ3.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -280,6 +280,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }

package/dist/next.d.cts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-C1Ga6JbS.cjs';
+import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
 import { SealSecret } from './sealed.cjs';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-C1Ga6JbS.js';
+import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
 import { SealSecret } from './sealed.js';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-S5WGUOJA.js";
+} from "./chunk-TTFIPEZ3.js";
 import {
   seal,
   unseal

package/dist/{verify-C1Ga6JbS.d.cts → verify-ggSzUrdC.d.cts}

@@ -246,8 +246,14 @@ declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
  * - `'malformed-token'`: the token is not a well-formed JWT at all.
  * - `'jwks-unavailable'`: the issuer's discovery document or JWKS could not
  *   be fetched -- infrastructure, not a verdict on the token.
+ * - `'wrong-token-type'`: the token verified (right issuer, right audience,
+ *   right signature) but is the OTHER kind of token this server mints for a
+ *   login -- an id_token presented to `verifyAccessToken`, or an access
+ *   token presented to `verifyIdToken`. The two share `iss`/`sub`/`aud`/`azp`
+ *   and are signed by the same key, so nothing else here would catch this;
+ *   see `token_use` on `IdentityTokenPayload`.
  */
-type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable';
+type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable' | 'wrong-token-type';
 /** One verification failure: a stable `code` to branch on, plus a
  *  human-readable `message` for logs. `verifyIdToken`/`verifyAccessToken`
  *  return a list of these rather than throwing -- see `VerificationResult`. */

package/dist/{verify-C1Ga6JbS.d.ts → verify-ggSzUrdC.d.ts}

@@ -246,8 +246,14 @@ declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
  * - `'malformed-token'`: the token is not a well-formed JWT at all.
  * - `'jwks-unavailable'`: the issuer's discovery document or JWKS could not
  *   be fetched -- infrastructure, not a verdict on the token.
+ * - `'wrong-token-type'`: the token verified (right issuer, right audience,
+ *   right signature) but is the OTHER kind of token this server mints for a
+ *   login -- an id_token presented to `verifyAccessToken`, or an access
+ *   token presented to `verifyIdToken`. The two share `iss`/`sub`/`aud`/`azp`
+ *   and are signed by the same key, so nothing else here would catch this;
+ *   see `token_use` on `IdentityTokenPayload`.
  */
-type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable';
+type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable' | 'wrong-token-type';
 /** One verification failure: a stable `code` to branch on, plus a
  *  human-readable `message` for logs. `verifyIdToken`/`verifyAccessToken`
  *  return a list of these rather than throwing -- see `VerificationResult`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {