@tdacorp/identity-client 0.2.1 → 0.2.3

package/dist/{chunk-S5WGUOJA.js → chunk-MB66JUMG.js}

@@ -129,6 +129,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -159,7 +169,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -179,7 +189,7 @@ async function exchangeAuthorizationCode(options) {
   return toTokenSet(body);
 }
 async function clientCredentialsGrant(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -306,6 +316,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }
@@ -315,6 +331,12 @@ async function verifyAccessToken(accessToken, options) {
   const result = await verifyAgainstIssuer(accessToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if (payload.token_use !== "oauth_access") {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: 'Token is missing token_use: "oauth_access". This is not an access token (likely an id_token).' }]
+    };
+  }
   const claims = payload;
   const roles = "roles" in claims ? claims.roles : void 0;
   if (typeof payload.sub === "string") {

package/dist/index.cjs

@@ -166,6 +166,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -196,7 +206,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -216,7 +226,7 @@ async function exchangeAuthorizationCode(options) {
   return toTokenSet(body);
 }
 async function clientCredentialsGrant(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -343,6 +353,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }
@@ -352,6 +368,12 @@ async function verifyAccessToken(accessToken, options) {
   const result = await verifyAgainstIssuer(accessToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if (payload.token_use !== "oauth_access") {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: 'Token is missing token_use: "oauth_access". This is not an access token (likely an id_token).' }]
+    };
+  }
   const claims = payload;
   const roles = "roles" in claims ? claims.roles : void 0;
   if (typeof payload.sub === "string") {

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-C1Ga6JbS.cjs';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-ggSzUrdC.cjs';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { createRemoteJWKSet } from 'jose';
-export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-C1Ga6JbS.js';
+export { A as AuthorizationCodeExchangeOptions, C as CLOCK_SKEW_TOLERANCE_SECONDS, a as ClientCredentialsGrantOptions, I as IdTokenClaims, R as RefreshTokensOptions, T as TokenEndpointAuthMethod, b as TokenRefreshOutcome, c as TokenRequestError, d as TokenSet, e as TokenVerificationError, f as TokenVerificationErrorCode, V as VerificationResult, g as VerifiedAccessToken, h as VerifyTokenOptions, i as clientCredentialsGrant, j as exchangeAuthorizationCode, r as refreshTokens, v as verifyAccessToken, k as verifyIdToken } from './verify-ggSzUrdC.js';
 import '@tdacorp/identity-authz';
 
 /**

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   refreshTokens,
   verifyAccessToken,
   verifyIdToken
-} from "./chunk-S5WGUOJA.js";
+} from "./chunk-MB66JUMG.js";
 export {
   CLOCK_SKEW_TOLERANCE_SECONDS,
   TokenRequestError,

package/dist/next.cjs

@@ -157,6 +157,16 @@ var TokenRequestError = class extends Error {
     this.errorDescription = details.errorDescription;
   }
 };
+async function fetchDiscoveryForTokenRequest(issuer) {
+  try {
+    return await fetchDiscovery(issuer);
+  } catch (error) {
+    throw new TokenRequestError({
+      error: "discovery_failed",
+      errorDescription: error instanceof Error ? error.message : "Failed to fetch the issuer's discovery document"
+    });
+  }
+}
 function toTokenSet(body) {
   return {
     accessToken: body.access_token,
@@ -187,7 +197,7 @@ async function readTokenResponseBody(response) {
   return await response.json().catch(() => null);
 }
 async function exchangeAuthorizationCode(options) {
-  const discovery = await fetchDiscovery(options.issuer);
+  const discovery = await fetchDiscoveryForTokenRequest(options.issuer);
   const response = await postTokenRequest(
     discovery.token_endpoint,
     options.clientId,
@@ -280,6 +290,12 @@ async function verifyIdToken(idToken, options) {
   const result = await verifyAgainstIssuer(idToken, options);
   if ("errors" in result) return { success: false, errors: result.errors };
   const { payload } = result;
+  if ("token_use" in payload) {
+    return {
+      success: false,
+      errors: [{ code: "wrong-token-type", message: "Token has a token_use claim; an id_token never carries one. This is an access token, not an id_token." }]
+    };
+  }
   if (typeof payload.sub !== "string") {
     return { success: false, errors: [{ code: "malformed-claims", message: "id_token has no sub claim" }] };
   }

package/dist/next.d.cts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-C1Ga6JbS.cjs';
+import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.cjs';
 import { SealSecret } from './sealed.cjs';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { d as TokenSet, I as IdTokenClaims } from './verify-C1Ga6JbS.js';
+import { d as TokenSet, I as IdTokenClaims } from './verify-ggSzUrdC.js';
 import { SealSecret } from './sealed.js';
 import '@tdacorp/identity-authz';
 import 'jose';

package/dist/next.js

@@ -5,7 +5,7 @@ import {
   generateCodeVerifier,
   generateState,
   verifyIdToken
-} from "./chunk-S5WGUOJA.js";
+} from "./chunk-MB66JUMG.js";
 import {
   seal,
   unseal

package/dist/{verify-C1Ga6JbS.d.cts → verify-ggSzUrdC.d.cts}

@@ -246,8 +246,14 @@ declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
  * - `'malformed-token'`: the token is not a well-formed JWT at all.
  * - `'jwks-unavailable'`: the issuer's discovery document or JWKS could not
  *   be fetched -- infrastructure, not a verdict on the token.
+ * - `'wrong-token-type'`: the token verified (right issuer, right audience,
+ *   right signature) but is the OTHER kind of token this server mints for a
+ *   login -- an id_token presented to `verifyAccessToken`, or an access
+ *   token presented to `verifyIdToken`. The two share `iss`/`sub`/`aud`/`azp`
+ *   and are signed by the same key, so nothing else here would catch this;
+ *   see `token_use` on `IdentityTokenPayload`.
  */
-type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable';
+type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable' | 'wrong-token-type';
 /** One verification failure: a stable `code` to branch on, plus a
  *  human-readable `message` for logs. `verifyIdToken`/`verifyAccessToken`
  *  return a list of these rather than throwing -- see `VerificationResult`. */

package/dist/{verify-C1Ga6JbS.d.ts → verify-ggSzUrdC.d.ts}

@@ -246,8 +246,14 @@ declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
  * - `'malformed-token'`: the token is not a well-formed JWT at all.
  * - `'jwks-unavailable'`: the issuer's discovery document or JWKS could not
  *   be fetched -- infrastructure, not a verdict on the token.
+ * - `'wrong-token-type'`: the token verified (right issuer, right audience,
+ *   right signature) but is the OTHER kind of token this server mints for a
+ *   login -- an id_token presented to `verifyAccessToken`, or an access
+ *   token presented to `verifyIdToken`. The two share `iss`/`sub`/`aud`/`azp`
+ *   and are signed by the same key, so nothing else here would catch this;
+ *   see `token_use` on `IdentityTokenPayload`.
  */
-type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable';
+type TokenVerificationErrorCode = 'expired' | 'invalid-signature' | 'invalid-issuer' | 'invalid-audience' | 'unauthorized-party' | 'malformed-claims' | 'malformed-token' | 'jwks-unavailable' | 'wrong-token-type';
 /** One verification failure: a stable `code` to branch on, plus a
  *  human-readable `message` for logs. `verifyIdToken`/`verifyAccessToken`
  *  return a list of these rather than throwing -- see `VerificationResult`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdacorp/identity-client",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "OIDC relying-party client for TDACorp Identity: discovery, PKCE, token exchange, token verification and Next.js route helpers.",
   "license": "MIT",
   "bugs": {
@@ -55,7 +55,7 @@
   ],
   "dependencies": {
     "jose": "^6.2.9",
-    "@tdacorp/identity-authz": "^0.2.0"
+    "@tdacorp/identity-authz": "^0.2.1"
   },
   "peerDependencies": {
     "next": ">=14"