@telecrypt-io/storage 0.6.1 → 0.7.1

package/dist/core/oidc.js

@@ -11,35 +11,13 @@ import { StorageError } from "./errors.js";
 import { cancelResponseBody, raceWithAbort, readResponseBody, ResponseBodyReadError, } from "./http.js";
 import { validateCanonicalMatrixUserId, validateMatrixDeviceId, } from "./constants.js";
 const AUTHORIZATION_CONTEXT_PREFIX = "telecrypt:oauth2:pkce:v1:";
-const AUTHORIZATION_CONTEXT_VERSION = 1;
-// The callback context is a short-lived transaction, not a durable login
-// session. Ten minutes covers normal redirects while limiting replay after a
-// stale browser tab or session-storage copy is recovered.
-const AUTHORIZATION_CONTEXT_MAX_AGE_MS = 10 * 60 * 1000;
-const AUTHORIZATION_CONTEXT_MAX_FUTURE_SKEW_MS = 30 * 1000;
-const MAX_AUTHORIZATION_CONTEXT_LENGTH = 64 * 1024;
 const PKCE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
-const DEVICE_ID_PATTERN = /^[A-Za-z0-9._~-]{1,128}$/;
-const STATE_PATTERN = /^[A-Za-z0-9._~-]{32,128}$/;
 const OIDC_REQUEST_TIMEOUT_MS = 30_000;
 const OIDC_REFRESH_TIMEOUT_MS = 30_000;
 const OIDC_CLEANUP_TIMEOUT_MS = 30_000;
-const MAX_OIDC_URL_LENGTH = 2048;
-const MAX_OIDC_METADATA_STRING_LENGTH = 4096;
-const MAX_OIDC_CLIENT_ID_LENGTH = 512;
-const MAX_OIDC_CODE_LENGTH = 4096;
-const MAX_OIDC_TOKEN_LENGTH = 8192;
-const MAX_OIDC_SCOPE_LENGTH = 4096;
-const MAX_OIDC_CONTACTS = 16;
-const MAX_OIDC_REDIRECT_URIS = 8;
 const LEGACY_MATRIX_SCOPE_PREFIX = "urn:matrix:client:";
 const MSC2967_MATRIX_SCOPE_PREFIX = "urn:matrix:org.matrix.msc2967.client:";
 const MATRIX_SCOPE_PREFIXES = [LEGACY_MATRIX_SCOPE_PREFIX, MSC2967_MATRIX_SCOPE_PREFIX];
-// MAS advertises a 20-minute device-code lifetime. Keep that provider window
-// as the hard upper bound while retaining a finite polling budget.
-const MAX_DEVICE_EXPIRES_IN_SECONDS = 20 * 60;
-const MAX_DEVICE_INTERVAL_SECONDS = 5 * 60;
-const MAX_DEVICE_POLL_DURATION_MS = MAX_DEVICE_EXPIRES_IN_SECONDS * 1000;
 const deviceAuthorizationDeviceIds = new WeakMap();
 const SAFE_OAUTH_ERROR_CODES = new Set([
     "invalid_request",
@@ -82,7 +60,7 @@ class OidcValidationError extends StorageError {
         this.name = "OidcValidationError";
     }
 }
-const DIAGNOSTIC_SECRET_FIELD = /^(?:access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?id|client[_-]?secret|user[_-]?id|device[_-]?id|authorization(?:[_-]?code)?|device[_-]?code|user[_-]?code|code[_-]?verifier|token|credential[s]?|private[_-]?key|(?:[A-Za-z0-9]+[_-])?(?:encryption|signing|password|secret|api[_-]?key|recovery[_-]?key|cookie|session)(?:[_-]?token|[_-]?key)?)$/iu;
+const DIAGNOSTIC_SECRET_FIELD = /(?:access[_-]?token|refresh[_-]?token|id[_-]?token|client[_-]?id|client[_-]?secret|user[_-]?id|device[_-]?id|authorization(?:[_-]?code)?|device[_-]?code|user[_-]?code|code[_-]?verifier|token|credential|private[_-]?key|encryption|signing|password|secret|api[_-]?key|recovery[_-]?key|cookie|session)/iu;
 const DIAGNOSTIC_EMAIL = /[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9-]+(?:\.[A-Z0-9-]+)+/giu;
 const DIAGNOSTIC_MXID = /@[A-Z0-9._=+\-/]+:[A-Z0-9.-]+/giu;
 const DIAGNOSTIC_ULID = /\b[0-9A-HJKMNP-TV-Z]{26}\b/giu;
@@ -112,194 +90,19 @@ class OidcResponseError extends Error {
         this.status = status;
     }
 }
-function diagnosticKey(key) {
-    return String(key);
-}
-function diagnosticDisplayKey(key) {
-    return sanitizeDiagnosticText(diagnosticKey(key)) || "<empty property>";
-}
-function diagnosticPropertyIsSecret(key) {
-    return DIAGNOSTIC_SECRET_FIELD.test(diagnosticKey(key));
-}
-function readDiagnosticProperties(value, seen) {
-    const properties = [];
-    const failures = [];
-    let keys;
-    try {
-        keys = Reflect.ownKeys(value);
-    }
-    catch (error) {
-        failures.push(`own properties unavailable: ${diagnosticFailureText(error, seen)}`);
-        return { properties, failures };
-    }
-    for (const key of keys) {
-        let descriptor;
-        try {
-            descriptor = Object.getOwnPropertyDescriptor(value, key);
-        }
-        catch (error) {
-            failures.push(`${diagnosticDisplayKey(key)} unavailable: ${diagnosticPropertyIsSecret(key) ? "<redacted>" : diagnosticFailureText(error, seen)}`);
-            continue;
-        }
-        if (!descriptor)
-            continue;
-        try {
-            if ("value" in descriptor) {
-                properties.push({ key, value: descriptor.value });
-            }
-            else if (typeof descriptor.get === "function") {
-                properties.push({ key, value: Reflect.get(value, key) });
-            }
-            else {
-                failures.push(`${diagnosticDisplayKey(key)} unavailable: ${diagnosticPropertyIsSecret(key) ? "<redacted>" : "accessor has no getter"}`);
-            }
-        }
-        catch (error) {
-            failures.push(`${diagnosticDisplayKey(key)} unavailable: ${diagnosticPropertyIsSecret(key) ? "<redacted>" : diagnosticFailureText(error, seen)}`);
-        }
-    }
-    return { properties, failures };
-}
-function diagnosticObjectText(value, seen) {
-    const inspection = readDiagnosticProperties(value, seen);
-    const parts = inspection.failures.slice();
-    for (const property of inspection.properties) {
-        const key = diagnosticDisplayKey(property.key);
-        parts.push(`${key}: ${diagnosticPropertyIsSecret(property.key) ? "<redacted>" : diagnosticValueText(property.value, seen)}`);
-    }
-    if (parts.length === 0) {
-        return "object { }";
-    }
-    return `object { ${parts.join(", ")} }`;
-}
-function diagnosticValueText(value, seen) {
-    if (value !== null && (typeof value === "object" || typeof value === "function")) {
-        if (seen.has(value))
-            return "[cyclic diagnostic]";
-        seen.add(value);
-    }
-    if (value instanceof AggregateError) {
-        const parts = [`${sanitizeDiagnosticText(value.name)}: ${sanitizeDiagnosticText(value.message)}`];
-        if (typeof value.stack === "string")
-            parts.push(`stack: ${sanitizeDiagnosticText(value.stack)}`);
-        try {
-            parts.push(`children: ${value.errors.map((child) => diagnosticValueText(child, seen)).join(", ")}`);
-        }
-        catch (error) {
-            parts.push(`children unavailable: ${diagnosticFailureText(error, seen)}`);
-        }
-        const inspection = readDiagnosticProperties(value, seen);
-        for (const property of inspection.properties) {
-            if (["name", "message", "stack", "cause", "errors"].includes(diagnosticKey(property.key)))
-                continue;
-            const key = diagnosticDisplayKey(property.key);
-            parts.push(`${key}: ${diagnosticPropertyIsSecret(property.key) ? "<redacted>" : diagnosticValueText(property.value, seen)}`);
-        }
-        parts.push(...inspection.failures);
-        return parts.join("; ");
-    }
-    if (value instanceof Error) {
-        const parts = [`${sanitizeDiagnosticText(value.name)}: ${sanitizeDiagnosticText(value.message)}`];
-        if (typeof value.stack === "string")
-            parts.push(`stack: ${sanitizeDiagnosticText(value.stack)}`);
-        try {
-            if (value.cause !== undefined)
-                parts.push(`cause: ${diagnosticValueText(value.cause, seen)}`);
-        }
-        catch (error) {
-            parts.push(`cause unavailable: ${diagnosticFailureText(error, seen)}`);
-        }
-        const inspection = readDiagnosticProperties(value, seen);
-        for (const property of inspection.properties) {
-            if (["name", "message", "stack", "cause", "bytes"].includes(diagnosticKey(property.key)))
-                continue;
-            const key = diagnosticDisplayKey(property.key);
-            parts.push(`${key}: ${diagnosticPropertyIsSecret(property.key) ? "<redacted>" : diagnosticValueText(property.value, seen)}`);
-        }
-        parts.push(...inspection.failures);
-        return parts.join("; ");
-    }
-    if (value !== null && (typeof value === "object" || typeof value === "function")) {
-        return diagnosticObjectText(value, seen);
-    }
-    try {
-        return sanitizeDiagnosticText(String(value));
-    }
-    catch {
-        return "unknown failure";
-    }
-}
-function diagnosticFailureText(error, seen) {
-    try {
-        return diagnosticValueText(error, seen);
-    }
-    catch {
-        return "unknown property failure";
-    }
-}
-/** Copy a transport error's useful details across the SDK boundary after the
- * same secret/control-character sanitization used for provider responses. */
-export function diagnosticCause(error, seen = new WeakSet()) {
-    if (error !== null && (typeof error === "object" || typeof error === "function")) {
-        if (seen.has(error))
-            return new Error("[cyclic diagnostic]");
+/** Copy only a native transport error's message across the SDK boundary. */
+function diagnosticCause(error, seen = new Set()) {
+    if (error instanceof Error && seen.has(error))
+        return new Error("cyclic failure cause");
+    const detail = error instanceof Error
+        ? `${error.name}: ${error.message}`
+        : typeof error === "string"
+            ? error
+            : "request failed";
+    const cause = error instanceof Error ? error.cause : undefined;
+    if (error instanceof Error)
         seen.add(error);
-    }
-    if (error instanceof AggregateError) {
-        let children = [];
-        try {
-            if (Array.isArray(error.errors))
-                children = error.errors;
-        }
-        catch {
-            children = [];
-        }
-        const copy = new AggregateError(children.map((child) => diagnosticCause(child, seen)), diagnosticValueText(error, new WeakSet()));
-        copy.name = sanitizeDiagnosticText(error.name) || "AggregateError";
-        if (typeof error.stack === "string")
-            copy.stack = sanitizeDiagnosticText(error.stack);
-        let cause;
-        try {
-            cause = error.cause;
-        }
-        catch {
-            cause = undefined;
-        }
-        if (cause !== undefined) {
-            Object.defineProperty(copy, "cause", {
-                configurable: true,
-                enumerable: false,
-                value: diagnosticCause(cause, seen),
-                writable: true,
-            });
-        }
-        return copy;
-    }
-    if (error instanceof Error) {
-        const copy = new Error(diagnosticValueText(error, new WeakSet()));
-        copy.name = sanitizeDiagnosticText(error.name) || "Error";
-        if (typeof error.stack === "string")
-            copy.stack = sanitizeDiagnosticText(error.stack);
-        let cause;
-        try {
-            cause = error.cause;
-        }
-        catch {
-            cause = undefined;
-        }
-        if (cause !== undefined) {
-            Object.defineProperty(copy, "cause", {
-                configurable: true,
-                enumerable: false,
-                value: diagnosticCause(cause, seen),
-                writable: true,
-            });
-        }
-        return copy;
-    }
-    const copy = new Error(diagnosticValueText(error, new WeakSet()));
-    copy.name = "ThrownObject";
-    return copy;
+    return new Error(sanitizeDiagnosticText(detail) || "request failed", cause instanceof Error ? { cause: diagnosticCause(cause, seen) } : undefined);
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -311,7 +114,6 @@ function randomHex(byteLength) {
 function requireString(value, name, pattern) {
     if (typeof value !== "string" ||
         value.length === 0 ||
-        value.length > MAX_OIDC_METADATA_STRING_LENGTH ||
         /[\u0000-\u001f\u007f]/.test(value) ||
         (pattern && !pattern.test(value))) {
         throw new StorageError(`OIDC authorization context has an invalid ${name}`);
@@ -320,27 +122,32 @@ function requireString(value, name, pattern) {
 }
 function requireClientId(value) {
     const clientId = requireString(value, "client ID");
-    if (clientId.length > MAX_OIDC_CLIENT_ID_LENGTH || /\s/.test(clientId)) {
+    if (/\s/.test(clientId)) {
         throw new StorageError("OIDC authorization context has an invalid client ID");
     }
     return clientId;
 }
-function requireBoundedString(value, name, maxLength) {
-    if (typeof value !== "string" ||
-        value.length === 0 ||
-        value.length > maxLength ||
-        /[\s\u0000-\u001f\u007f]/.test(value)) {
-        throw new StorageError(`OIDC authorization context has an invalid ${name}`);
+function requireDeviceId(value) {
+    try {
+        return validateMatrixDeviceId(value);
+    }
+    catch (error) {
+        throw new StorageError("OIDC authorization context has an invalid device ID", { cause: error });
+    }
+}
+function isDeviceId(value) {
+    try {
+        validateMatrixDeviceId(value);
+        return true;
+    }
+    catch {
+        return false;
     }
-    return value;
 }
-function requireScope(value, name) {
+function requireOpaqueString(value, name) {
     if (typeof value !== "string" ||
         value.length === 0 ||
-        value.length > MAX_OIDC_SCOPE_LENGTH ||
-        /[\u0000-\u001f\u007f]/.test(value) ||
-        value.trim() !== value ||
-        /\s{2,}/.test(value)) {
+        /[\s\u0000-\u001f\u007f]/.test(value)) {
         throw new StorageError(`OIDC authorization context has an invalid ${name}`);
     }
     return value;
@@ -350,7 +157,7 @@ function isLoopbackHostname(hostname) {
     return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
 }
 function parseSafeRedirectUri(value, name) {
-    const text = requireBoundedString(value, name, MAX_OIDC_URL_LENGTH);
+    const text = requireOpaqueString(value, name);
     let parsed;
     try {
         parsed = new URL(text);
@@ -369,10 +176,9 @@ function parseSafeRedirectUri(value, name) {
     }
     return parsed;
 }
-function requireMetadataString(value, name, maxLength = MAX_OIDC_METADATA_STRING_LENGTH) {
+function requireMetadataString(value, name) {
     if (typeof value !== "string" ||
         value.length === 0 ||
-        value.length > maxLength ||
         /[\u0000-\u001f\u007f]/.test(value)) {
         throw new StorageError(`OIDC dynamic client registration has an invalid ${name}`);
     }
@@ -388,30 +194,23 @@ function validateRegistrationMetadata(metadata) {
         ["policy URI", metadata.policyUri],
     ]) {
         if (value !== undefined) {
-            const uri = parseHttpUrl(value, name);
-            if (uri.origin !== clientUri.origin) {
-                throw new StorageError("OIDC dynamic client registration has an untrusted metadata origin");
-            }
+            parseHttpUrl(value, name);
         }
     }
     if (metadata.contacts !== undefined) {
-        if (!Array.isArray(metadata.contacts) || metadata.contacts.length > MAX_OIDC_CONTACTS) {
-            throw new StorageError("OIDC dynamic client registration has too many contacts");
+        if (!Array.isArray(metadata.contacts)) {
+            throw new StorageError("OIDC dynamic client registration has invalid contacts");
         }
-        metadata.contacts.forEach((contact) => requireMetadataString(contact, "contact", 512));
+        metadata.contacts.forEach((contact) => requireMetadataString(contact, "contact"));
     }
     if (metadata.redirectUris === undefined)
         return { clientUri };
     if (!Array.isArray(metadata.redirectUris) ||
-        metadata.redirectUris.length === 0 ||
-        metadata.redirectUris.length > MAX_OIDC_REDIRECT_URIS) {
-        throw new StorageError("OIDC dynamic client registration has too many redirect URIs");
+        metadata.redirectUris.length === 0) {
+        throw new StorageError("OIDC dynamic client registration has invalid redirect URIs");
     }
     const redirectUris = metadata.redirectUris.map((value) => {
         const uri = parseSafeRedirectUri(value, "redirect URI");
-        if (uri.origin !== clientUri.origin) {
-            throw new StorageError("OIDC dynamic client registration has an untrusted redirect origin");
-        }
         return uri.toString();
     });
     return { clientUri, redirectUris };
@@ -451,7 +250,7 @@ async function assertNoRedirect(response, endpoint, operation) {
         (response.url !== "" && response.url !== endpoint) ||
         response.redirected) {
         const failure = new StorageError(`OIDC ${operation} rejected an untrusted redirect`);
-        await cancelResponseBody(response, `OIDC ${operation} redirect`, failure);
+        cancelResponseBody(response);
         throw failure;
     }
 }
@@ -563,20 +362,28 @@ function abortableDelay(milliseconds, signal) {
         return Promise.reject(new OidcRequestCancelledError("device authorization"));
     return new Promise((resolve, reject) => {
         let timer;
+        let remaining = milliseconds;
         const abort = () => {
             clearTimeout(timer);
             signal?.removeEventListener("abort", abort);
             reject(new OidcRequestCancelledError("device authorization"));
         };
-        timer = setTimeout(() => {
-            signal?.removeEventListener("abort", abort);
-            resolve();
-        }, milliseconds);
+        const schedule = () => {
+            if (remaining <= 0) {
+                signal?.removeEventListener("abort", abort);
+                resolve();
+                return;
+            }
+            const delay = Math.min(remaining, 2_147_483_647);
+            remaining -= delay;
+            timer = setTimeout(schedule, delay);
+        };
         signal?.addEventListener("abort", abort, { once: true });
+        schedule();
     });
 }
-function parseHttpUrl(value, name) {
-    const text = requireBoundedString(value, name, MAX_OIDC_URL_LENGTH);
+function parseHttpUrl(value, name, allowQuery = false) {
+    const text = requireOpaqueString(value, name);
     let parsed;
     try {
         parsed = new URL(text);
@@ -589,7 +396,7 @@ function parseHttpUrl(value, name) {
         (parsed.protocol === "http:" && !isLoopbackHostname(parsed.hostname)) ||
         parsed.username !== "" ||
         parsed.password !== "" ||
-        parsed.search !== "" ||
+        (!allowQuery && parsed.search !== "") ||
         parsed.hash !== "" ||
         (parsed.toString() !== text && !isRootWithoutSlash)) {
         throw new StorageError(`OIDC authorization context has an invalid ${name}`);
@@ -602,6 +409,15 @@ function isWithinIssuerPath(issuer, endpoint) {
     const prefix = issuer.pathname.endsWith("/") ? issuer.pathname : `${issuer.pathname}/`;
     return endpoint.pathname === issuer.pathname || endpoint.pathname.startsWith(prefix);
 }
+/** Validates an endpoint against the configured homeserver and optional issuer path. */
+export function assertOidcEndpoint(value, trustedHomeserver, name, issuer, allowQuery = false) {
+    const homeserver = parseHttpUrl(trustedHomeserver, "homeserver URL");
+    const endpoint = parseHttpUrl(value, name, allowQuery);
+    if (endpoint.origin !== homeserver.origin || (issuer && !isWithinIssuerPath(issuer, endpoint))) {
+        throw new StorageError(`${name} must remain on the configured OIDC origin and issuer path`);
+    }
+    return endpoint.toString();
+}
 function matrixAuthMetadataEndpoint(homeserver) {
     const basePath = homeserver.pathname.replace(/\/+$/u, "");
     return new URL(`${basePath}/_matrix/client/v1/auth_metadata`, homeserver.origin).toString();
@@ -645,7 +461,6 @@ function validateAuthMetadata(value) {
         if (field !== undefined &&
             (typeof field !== "string" ||
                 field.length === 0 ||
-                field.length > MAX_OIDC_URL_LENGTH ||
                 /[\u0000-\u001f\u007f]/.test(field))) {
             throw new StorageError("OIDC authorization context has invalid auth metadata");
         }
@@ -664,7 +479,6 @@ function validateAuthMetadata(value) {
         if (field !== undefined &&
             (typeof field !== "string" ||
                 field.length === 0 ||
-                field.length > MAX_OIDC_URL_LENGTH ||
                 /[\u0000-\u001f\u007f]/.test(field))) {
             throw new StorageError("OIDC authorization context has invalid auth metadata");
         }
@@ -679,9 +493,8 @@ function validateAuthMetadata(value) {
     ]) {
         const field = metadata[name];
         if (field !== undefined &&
-            (!Array.isArray(field) || field.length > 32 || field.some((item) => typeof item !== "string" ||
+            (!Array.isArray(field) || field.some((item) => typeof item !== "string" ||
                 item.length === 0 ||
-                item.length > MAX_OIDC_METADATA_STRING_LENGTH ||
                 /[\u0000-\u001f\u007f]/.test(item)))) {
             throw new StorageError("OIDC authorization context has invalid auth metadata");
         }
@@ -724,21 +537,18 @@ function validateDeviceAuthorizationSession(value) {
         throw new StorageError("OIDC device authorization returned an invalid response", { cause: error });
     }
     const session = value;
-    requireBoundedString(session.device_code, "device code", MAX_OIDC_CODE_LENGTH);
-    requireBoundedString(session.user_code, "user code", MAX_OIDC_CODE_LENGTH);
+    requireOpaqueString(session.device_code, "device code");
+    requireOpaqueString(session.user_code, "user code");
     parseSafeRedirectUri(session.verification_uri, "verification URI");
     if (session.verification_uri_complete !== undefined) {
         parseSafeRedirectUri(session.verification_uri_complete, "complete verification URI");
     }
-    if (!Number.isInteger(session.expires_in) ||
-        session.expires_in <= 0 ||
-        session.expires_in > MAX_DEVICE_EXPIRES_IN_SECONDS) {
+    if (!Number.isSafeInteger(session.expires_in) ||
+        session.expires_in <= 0) {
         throw new StorageError("OIDC device authorization returned an invalid expiry");
     }
     if (session.interval !== undefined &&
-        (!Number.isInteger(session.interval) ||
-            session.interval <= 0 ||
-            session.interval > MAX_DEVICE_INTERVAL_SECONDS)) {
+        (!Number.isSafeInteger(session.interval) || session.interval <= 0)) {
         throw new StorageError("OIDC device authorization returned an invalid polling interval");
     }
     return session;
@@ -756,18 +566,16 @@ function validateDeviceAccessTokenResponse(value) {
 }
 function validateTokenBounds(value, operation) {
     try {
-        requireBoundedString(value.access_token, "access token", MAX_OIDC_TOKEN_LENGTH);
+        requireOpaqueString(value.access_token, "access token");
         if (value.refresh_token !== undefined) {
-            requireBoundedString(value.refresh_token, "refresh token", MAX_OIDC_TOKEN_LENGTH);
+            requireOpaqueString(value.refresh_token, "refresh token");
         }
-        if (value.scope !== undefined)
-            requireScope(value.scope, "scope");
     }
     catch (error) {
         throw new StorageError(`OIDC ${operation} returned an invalid token response`, { cause: error });
     }
     if (value.expires_in !== undefined &&
-        (!Number.isInteger(value.expires_in) || value.expires_in < 0 || value.expires_in > 86400)) {
+        (!Number.isSafeInteger(value.expires_in) || value.expires_in < 0)) {
         throw new StorageError(`OIDC ${operation} returned an invalid token expiry`);
     }
 }
@@ -787,26 +595,16 @@ function validateAuthorizationInputs(opts) {
     }
     requireClientId(opts.clientId);
     const deviceId = opts.deviceId ?? randomHex(5).toUpperCase();
-    requireString(deviceId, "device ID", DEVICE_ID_PATTERN);
+    requireDeviceId(deviceId);
     return { authMetadata, homeserver, redirect, deviceId };
 }
 function parseAuthorizationContext(value, expectedState) {
-    if (!isRecord(value) || value.version !== AUTHORIZATION_CONTEXT_VERSION) {
+    if (!isRecord(value)) {
         throw new StorageError("OIDC authorization context is missing or invalid");
     }
     if (value.state !== expectedState) {
         throw new StorageError("OIDC authorization context state does not match callback state");
     }
-    if (typeof value.createdAtMs !== "number" || !Number.isSafeInteger(value.createdAtMs)) {
-        throw new StorageError("OIDC authorization context has an invalid creation time");
-    }
-    const ageMs = Date.now() - value.createdAtMs;
-    if (ageMs < -AUTHORIZATION_CONTEXT_MAX_FUTURE_SKEW_MS) {
-        throw new StorageError("OIDC authorization context is from the future");
-    }
-    if (ageMs > AUTHORIZATION_CONTEXT_MAX_AGE_MS) {
-        throw new StorageError("OIDC authorization context is expired");
-    }
     const authMetadata = validateTrustedAuthMetadata(value.authMetadata);
     const homeserver = parseHttpUrl(value.homeserverUrl, "homeserver URL");
     const redirect = parseHttpUrl(value.redirectUri, "redirect URI");
@@ -814,14 +612,12 @@ function parseAuthorizationContext(value, expectedState) {
         throw new StorageError("OIDC authorization context origins are not trusted");
     }
     return {
-        version: AUTHORIZATION_CONTEXT_VERSION,
-        createdAtMs: value.createdAtMs,
         state: expectedState,
         authMetadata,
         clientId: requireClientId(value.clientId),
         redirectUri: redirect.toString(),
         homeserverUrl: homeserver.toString(),
-        deviceId: requireString(value.deviceId, "device ID", DEVICE_ID_PATTERN),
+        deviceId: requireDeviceId(value.deviceId),
         codeVerifier: requireString(value.codeVerifier, "PKCE verifier", PKCE_VERIFIER_PATTERN),
     };
 }
@@ -853,7 +649,12 @@ export async function discoverOidcIssuer(homeserverBaseUrl, signal) {
             throw failure;
         }
         ensureOidcNotCancelled(signal, "discovery");
-        return validateTrustedAuthMetadata(body);
+        try {
+            return validateTrustedAuthMetadata(body);
+        }
+        catch (error) {
+            throw responseValidationFailure("discovery", response, responseText ?? "", error);
+        }
     }
     catch (err) {
         if (err instanceof AggregateError)
@@ -862,9 +663,8 @@ export async function discoverOidcIssuer(homeserverBaseUrl, signal) {
     }
 }
 /**
- * Dynamic client registration (DCR). `clientUri`/`redirectUris` must share a
- * host unless the issuer's policy allows a mismatch (our local dev/test MAS
- * does; a production issuer may not).
+ * Dynamic client registration (DCR). The issuer validates the supplied
+ * metadata; the PKCE flow separately binds its callback to the current app.
  */
 export async function registerClient(authMetadata, metadata, signal) {
     try {
@@ -944,7 +744,7 @@ export async function startDeviceCodeLogin(authMetadata, clientId, deviceId, sig
     try {
         const safeAuthMetadata = validateTrustedAuthMetadata(authMetadata);
         const safeClientId = requireClientId(clientId);
-        requireString(deviceId, "device ID", DEVICE_ID_PATTERN);
+        requireDeviceId(deviceId);
         const scope = generateScope(deviceId);
         const endpoint = safeAuthMetadata.device_authorization_endpoint;
         if (!endpoint)
@@ -1006,10 +806,10 @@ export async function waitForDeviceCodeLogin(authMetadata, clientId, session, si
         if (requestedDeviceId === undefined) {
             throw new StorageError("OIDC device authorization requires an expected device ID");
         }
-        requireString(requestedDeviceId, "device ID", DEVICE_ID_PATTERN);
+        requireDeviceId(requestedDeviceId);
         const endpoint = exactEndpoint(safeAuthMetadata.token_endpoint, "token endpoint");
         let interval = (safeSession.interval ?? 5) * 1000;
-        const expiration = Date.now() + Math.min(safeSession.expires_in * 1000, MAX_DEVICE_POLL_DURATION_MS);
+        const expiration = Date.now() + safeSession.expires_in * 1000;
         do {
             const remaining = expiration - Date.now();
             if (remaining <= 0) {
@@ -1038,9 +838,6 @@ export async function waitForDeviceCodeLogin(authMetadata, clientId, session, si
                 throw providerResponseFailure("device authorization", response, responseText ?? "", "OIDC device authorization returned an invalid response");
             }
             if (response.ok) {
-                if (!isValidDeviceAccessTokenResponse(body)) {
-                    throw providerResponseFailure("device authorization", response, responseText ?? "", "OIDC device authorization returned an invalid response");
-                }
                 try {
                     const tokenResponse = validateDeviceAccessTokenResponse(body);
                     if (!requestedDeviceId ||
@@ -1101,7 +898,6 @@ export async function beginAuthorizationCodeFlow(opts) {
     if (opts.signal?.aborted)
         throw new StorageError("OIDC authorization cancelled");
     const { authMetadata, homeserver, redirect, deviceId } = validateAuthorizationInputs(opts);
-    const createdAtMs = Date.now();
     const state = randomHex(32);
     const codeVerifier = randomHex(64);
     const oauth = new OAuth2(authMetadata, {
@@ -1134,8 +930,6 @@ export async function beginAuthorizationCodeFlow(opts) {
         throw new StorageError("OIDC authorization URL is not bound to the validated request");
     }
     const context = {
-        version: AUTHORIZATION_CONTEXT_VERSION,
-        createdAtMs,
         state,
         authMetadata,
         clientId: opts.clientId,
@@ -1149,43 +943,27 @@ export async function beginAuthorizationCodeFlow(opts) {
 }
 /** Completes the authorization-code exchange after the `?code&state` redirect. */
 export async function completeAuthorizationCodeFlow(code, state, signal) {
-    requireString(state, "authorization state", STATE_PATTERN);
     const store = sessionStorage();
     const key = `${AUTHORIZATION_CONTEXT_PREFIX}${state}`;
     const serialized = store.getItem(key);
     if (!serialized)
-        throw new StorageError("OIDC authorization context is missing or expired");
+        throw new StorageError("OIDC authorization context is missing");
     let context;
     let validationError;
-    if (serialized.length > MAX_AUTHORIZATION_CONTEXT_LENGTH) {
-        validationError = new StorageError("OIDC authorization context is too large");
-    }
-    else {
-        try {
-            context = parseAuthorizationContext(JSON.parse(serialized), state);
-        }
-        catch (error) {
-            validationError = error instanceof StorageError
-                ? error
-                : new StorageError("OIDC authorization context is missing or invalid", { cause: error });
-        }
-    }
-    // Consume the state before any network exchange. A retry must not replay
-    // the authorization code, even if validation fails. Preserve a validation
-    // failure when storage cleanup fails as well.
     try {
-        store.removeItem(key);
+        context = parseAuthorizationContext(JSON.parse(serialized), state);
     }
     catch (error) {
-        if (validationError !== undefined) {
-            throw new AggregateError([validationError, error], "OIDC authorization context validation and cleanup failed", { cause: validationError });
-        }
-        throw error;
+        validationError = error instanceof StorageError
+            ? error
+            : new StorageError("OIDC authorization context is missing or invalid", { cause: error });
     }
+    // Consume the state before any network exchange so a retry cannot replay it.
+    store.removeItem(key);
     if (validationError !== undefined)
         throw validationError;
     try {
-        requireBoundedString(code, "authorization code", MAX_OIDC_CODE_LENGTH);
+        requireOpaqueString(code, "authorization code");
         const endpoint = exactEndpoint(context.authMetadata.token_endpoint, "token endpoint");
         const params = new URLSearchParams({
             grant_type: "authorization_code",
@@ -1250,7 +1028,6 @@ export async function completeAuthorizationCodeFlow(code, state, signal) {
  * OAuth scope. */
 export function extractDeviceIdFromScope(scope) {
     if (typeof scope !== "string" ||
-        scope.length > MAX_OIDC_SCOPE_LENGTH ||
         /[\u0000-\u001f\u007f]/.test(scope) ||
         scope.trim() !== scope) {
         return null;
@@ -1264,7 +1041,7 @@ export function extractDeviceIdFromScope(scope) {
     if (!prefix)
         return null;
     const deviceId = deviceToken.slice(`${prefix}device:`.length);
-    return DEVICE_ID_PATTERN.test(deviceId) ? deviceId : null;
+    return isDeviceId(deviceId) ? deviceId : null;
 }
 /**
  * Accepts the legacy Matrix OAuth scope and the current MSC2967 namespace
@@ -1275,9 +1052,8 @@ export function extractDeviceIdFromScope(scope) {
 function scopeMatchesDevice(scope, expectedDeviceId) {
     if (typeof scope !== "string" ||
         typeof expectedDeviceId !== "string" ||
-        !DEVICE_ID_PATTERN.test(expectedDeviceId) ||
+        !isDeviceId(expectedDeviceId) ||
         scope.length === 0 ||
-        scope.length > MAX_OIDC_SCOPE_LENGTH ||
         /[\u0000-\u001f\u007f]/.test(scope) ||
         scope.trim() !== scope ||
         /\s{2,}/.test(scope)) {
@@ -1317,7 +1093,7 @@ function validateMatrixUserId(userId, serverName) {
 export async function whoAmI(homeserverUrl, accessToken, serverName, signal) {
     try {
         const homeserver = parseHttpUrl(homeserverUrl, "homeserver URL");
-        requireBoundedString(accessToken, "access token", MAX_OIDC_TOKEN_LENGTH);
+        requireOpaqueString(accessToken, "access token");
         const endpoint = matrixWhoAmIEndpoint(homeserver);
         const { response, body, responseText } = await requestWithTimeout(endpoint, {
             method: "GET",
@@ -1338,14 +1114,20 @@ export async function whoAmI(homeserverUrl, accessToken, serverName, signal) {
         if (!isRecord(body)) {
             throw responseValidationFailure("identity confirmation", response, responseText ?? "", new StorageError("OIDC identity confirmation returned an invalid response"));
         }
-        const userId = validateMatrixUserId(body.user_id, serverName);
+        let userId;
+        try {
+            userId = validateMatrixUserId(body.user_id, serverName);
+        }
+        catch (error) {
+            throw responseValidationFailure("identity confirmation", response, responseText ?? "", error);
+        }
         let deviceId = null;
         if (body.device_id !== undefined && body.device_id !== null) {
             try {
                 deviceId = validateMatrixDeviceId(body.device_id);
             }
             catch (error) {
-                throw new StorageError("OIDC identity confirmation returned an invalid device ID", { cause: error });
+                throw responseValidationFailure("identity confirmation", response, responseText ?? "", new StorageError("OIDC identity confirmation returned an invalid device ID", { cause: error }));
             }
         }
         if (signal?.aborted)
@@ -1374,7 +1156,7 @@ export async function whoAmI(homeserverUrl, accessToken, serverName, signal) {
 async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedDeviceId, signal) {
     const endpoint = exactEndpoint(tokenEndpoint, "token endpoint");
     const safeClientId = requireClientId(clientId);
-    const safeRefreshToken = requireBoundedString(refreshToken, "refresh token", MAX_OIDC_TOKEN_LENGTH);
+    const safeRefreshToken = requireOpaqueString(refreshToken, "refresh token");
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), OIDC_REFRESH_TIMEOUT_MS);
     const abortExternal = () => controller.abort(signal?.reason);
@@ -1438,7 +1220,6 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
         const expiresIn = record.expires_in;
         if (typeof accessToken !== "string" ||
             accessToken.trim() === "" ||
-            accessToken.length > MAX_OIDC_TOKEN_LENGTH ||
             /[\s\u0000-\u001f\u007f]/.test(accessToken)) {
             throw invalidResponse("OIDC token refresh returned no access token");
         }
@@ -1449,7 +1230,6 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
         if (nextRefreshToken !== undefined &&
             (typeof nextRefreshToken !== "string" ||
                 nextRefreshToken.trim() === "" ||
-                nextRefreshToken.length > MAX_OIDC_TOKEN_LENGTH ||
                 /[\s\u0000-\u001f\u007f]/.test(nextRefreshToken))) {
             throw invalidResponse("OIDC token refresh returned an invalid refresh token");
         }
@@ -1457,12 +1237,6 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
             if (typeof grantedScope !== "string") {
                 throw invalidResponse("OIDC token refresh returned an invalid scope");
             }
-            try {
-                requireScope(grantedScope, "scope");
-            }
-            catch (error) {
-                throw invalidResponse("OIDC token refresh returned an invalid scope", { cause: error });
-            }
             if (!scopeMatchesDevice(grantedScope, expectedDeviceId)) {
                 throw invalidResponse("OIDC token refresh returned an unexpected granted scope");
             }
@@ -1472,9 +1246,8 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
         }
         if (expiresIn !== undefined &&
             (typeof expiresIn !== "number" ||
-                !Number.isInteger(expiresIn) ||
-                expiresIn < 0 ||
-                expiresIn > 86400)) {
+                !Number.isSafeInteger(expiresIn) ||
+                expiresIn < 0)) {
             throw invalidResponse("OIDC token refresh returned an invalid expiry");
         }
         ensureOidcNotCancelled(signal, "token refresh");
@@ -1508,7 +1281,7 @@ async function refreshOidcToken(tokenEndpoint, clientId, refreshToken, expectedD
 async function revokeOidcToken(revocationEndpoint, clientId, token, tokenTypeHint = "access_token", signal) {
     const endpoint = exactEndpoint(revocationEndpoint, "revocation endpoint");
     const safeClientId = requireClientId(clientId);
-    const safeToken = requireBoundedString(token, "token", MAX_OIDC_TOKEN_LENGTH);
+    const safeToken = requireOpaqueString(token, "token");
     try {
         const { response, responseText } = await requestWithTimeout(endpoint, {
             method: "POST",
@@ -1591,7 +1364,7 @@ export function buildTokenRefreshFunction(metadata, clientId, onPersist, expecte
     // endpoint and cause a refresh or revocation token to leave that issuer.
     const { tokenEndpoint: endpoint, revocationEndpoint } = validateTokenEndpointMetadata(metadata);
     const safeClientId = requireClientId(clientId);
-    const safeExpectedDeviceId = requireString(expectedDeviceId, "device ID", DEVICE_ID_PATTERN);
+    const safeExpectedDeviceId = requireDeviceId(expectedDeviceId);
     return async (refreshToken, signal) => {
         const tokens = await refreshOidcToken(endpoint, safeClientId, refreshToken, safeExpectedDeviceId, signal);
         try {