@tempoxyz/id 0.0.0-pr-615.sha-e2eda2d → 0.0.0-pr-614.sha-fdd715e
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/AccessToken.d.ts +10 -2
- package/dist/AccessToken.d.ts.map +1 -1
- package/dist/AccessToken.js +10 -2
- package/dist/AccessToken.js.map +1 -1
- package/dist/Id.d.ts +1 -1
- package/dist/Id.d.ts.map +1 -1
- package/dist/Id.js.map +1 -1
- package/dist/actions/oauth.d.ts +16 -3
- package/dist/actions/oauth.d.ts.map +1 -1
- package/dist/actions/oauth.js +12 -3
- package/dist/actions/oauth.js.map +1 -1
- package/package.json +1 -1
- package/src/AccessToken.ts +21 -4
- package/src/Id.ts +4 -2
- package/src/actions/oauth.ts +18 -3
package/dist/AccessToken.d.ts
CHANGED
|
@@ -26,6 +26,13 @@ export declare namespace InvalidError {
|
|
|
26
26
|
export declare function create(auth: Config, options?: create.Options): create.ReturnType;
|
|
27
27
|
export declare namespace create {
|
|
28
28
|
type Options = {
|
|
29
|
+
/**
|
|
30
|
+
* The resource that the API serves, which each token that it accepts names in `aud`: Tempo ID's
|
|
31
|
+
* origin, or a [registered resource](https://github.com/tempoxyz/id/blob/main/docs/resources.md),
|
|
32
|
+
* such as `https://mercator.sh/mcp`. A token that names any other audience, also beside this
|
|
33
|
+
* one, throws. The issuer's `userinfo` URL is allowed beside it. Defaults to `issuer`.
|
|
34
|
+
*/
|
|
35
|
+
audience?: string | undefined;
|
|
29
36
|
/**
|
|
30
37
|
* The client IDs of the apps whose tokens the API accepts. Every other app's token throws.
|
|
31
38
|
* Defaults to the instance's `clientId`.
|
|
@@ -52,8 +59,9 @@ export declare namespace create {
|
|
|
52
59
|
/** The verifier. */
|
|
53
60
|
type ReturnType = {
|
|
54
61
|
/**
|
|
55
|
-
* Verifies an access token: its RS256 signature over the issuer's keys, `typ: at+jwt`, `iss`
|
|
56
|
-
*
|
|
62
|
+
* Verifies an access token: its RS256 signature over the issuer's keys, `typ: at+jwt`, `iss` of
|
|
63
|
+
* the issuer, an `aud` of `audience` and nothing else but the `userinfo` URL, an `exp` that has
|
|
64
|
+
* not passed, and a `client_id` of `clientIds`.
|
|
57
65
|
* @throws {InvalidError} For a token that does not verify, or another app's token.
|
|
58
66
|
* @throws {Id.RequestError} With status 0, when the key set cannot be fetched or imported, such
|
|
59
67
|
* as during an issuer outage.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../src/AccessToken.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,MAAM,EAAgB,MAAM,SAAS,CAAA;AAEnD,8FAA8F;AAC9F,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,GAAE,YAAY,CAAC,OAAY,EAK7C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,mEAAmE;QACnE,KAAK,CAAC,EAAE,OAAO,CAAA;KAChB,CAAA;CACF;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,OAAY,GAC3B,MAAM,CAAC,UAAU,
|
|
1
|
+
{"version":3,"file":"AccessToken.d.ts","sourceRoot":"","sources":["../src/AccessToken.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,MAAM,EAAgB,MAAM,SAAS,CAAA;AAEnD,8FAA8F;AAC9F,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,GAAE,YAAY,CAAC,OAAY,EAK7C;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,mEAAmE;QACnE,KAAK,CAAC,EAAE,OAAO,CAAA;KAChB,CAAA;CACF;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,OAAY,GAC3B,MAAM,CAAC,UAAU,CA0DnB;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B;;;WAGG;QACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAA;QACzC;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC7B,CAAA;IAED,oBAAoB;IACpB,KAAK,UAAU,GAAG;QAChB;;;;;;;WAOG;QACH,MAAM,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,KAAK,CAAC,CAAA;KACnD,CAAA;IAED,+BAA+B;IAC/B,KAAK,aAAa,GAAG;QACnB,8CAA8C;QAC9C,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IAED,wCAAwC;IACxC,KAAK,KAAK,GAAG;QACX;;;;WAIG;QACH,UAAU,EAAE,SAAS,SAAS,EAAE,CAAA;QAChC;;;WAGG;QACH,QAAQ,EAAE,SAAS,KAAK,MAAM,EAAE,EAAE,CAAA;QAClC,uCAAuC;QACvC,QAAQ,EAAE,MAAM,CAAA;QAChB,+CAA+C;QAC/C,SAAS,EAAE,MAAM,CAAA;QACjB,wCAAwC;QACxC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;QACxB,yCAAyC;QACzC,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG;IACtB,mEAAmE;IACnE,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB,yDAAyD;IACzD,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,EACrC,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAMT;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,+DAA+D;QAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;KACvB,CAAA;CACF"}
|
package/dist/AccessToken.js
CHANGED
|
@@ -46,6 +46,9 @@ const refusals = [
|
|
|
46
46
|
export function create(auth, options = {}) {
|
|
47
47
|
const { clientIds = [auth.clientId], maxAge = 10 * 60 * 1000, timeout = 5_000, } = options;
|
|
48
48
|
const issuer = new URL(options.issuer ?? auth.url).origin;
|
|
49
|
+
const audience = options.audience ?? issuer;
|
|
50
|
+
// The issuer adds its `userinfo` URL to the audience of every token with the `openid` scope.
|
|
51
|
+
const own = [audience, `${issuer}/oauth2/userinfo`];
|
|
49
52
|
// jose shares a fetch in flight outside Workers, and on Workers each request fetches the set itself.
|
|
50
53
|
const keys = createRemoteJWKSet(new URL('/oauth2/jwks', auth.url), {
|
|
51
54
|
cacheMaxAge: maxAge,
|
|
@@ -57,7 +60,7 @@ export function create(auth, options = {}) {
|
|
|
57
60
|
async verify(verifyOptions) {
|
|
58
61
|
const { payload } = await jwtVerify(verifyOptions.accessToken, keys, {
|
|
59
62
|
algorithms: ['RS256'],
|
|
60
|
-
audience
|
|
63
|
+
audience,
|
|
61
64
|
issuer,
|
|
62
65
|
requiredClaims: ['client_id', 'exp', 'sub'],
|
|
63
66
|
typ: 'at+jwt',
|
|
@@ -68,7 +71,12 @@ export function create(auth, options = {}) {
|
|
|
68
71
|
throw new InvalidError({ cause: error });
|
|
69
72
|
throw unavailable(error);
|
|
70
73
|
});
|
|
71
|
-
//
|
|
74
|
+
// jose admits an `aud` that names the audience among others. Another API that a token names
|
|
75
|
+
// holds the token, so a token for any other audience, also beside this one, throws.
|
|
76
|
+
const audiences = typeof payload.aud === 'string' ? [payload.aud] : (payload.aud ?? []);
|
|
77
|
+
if (audiences.some((entry) => !own.includes(entry)))
|
|
78
|
+
throw new InvalidError();
|
|
79
|
+
// Every app may request a token for the audience, so the app's `client_id` decides.
|
|
72
80
|
if (typeof payload.client_id !== 'string' ||
|
|
73
81
|
!clientIds.includes(payload.client_id))
|
|
74
82
|
throw new InvalidError();
|
package/dist/AccessToken.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../src/AccessToken.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,MAAM,EAEN,SAAS,GACV,MAAM,MAAM,CAAA;AACb,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAe,YAAY,EAAE,MAAM,SAAS,CAAA;AAEnD,8FAA8F;AAC9F,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAO,GAAyB,EAAE;QAC5C,KAAK,CACH,wIAAwI,EACxI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;IACH,CAAC;CACF;AASD,gGAAgG;AAChG,MAAM,QAAQ,GAAG,MAAM,CAAA;AAEvB;;;GAGG;AACH,MAAM,QAAQ,GAAG;IACf,MAAM,CAAC,iBAAiB;IACxB,MAAM,CAAC,gBAAgB;IACvB,MAAM,CAAC,wBAAwB;IAC/B,MAAM,CAAC,iBAAiB;IACxB,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,8BAA8B;IACrC,MAAM,CAAC,wBAAwB;IAC/B,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,UAAU;CACT,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,OAAO,GAAmB,EAAE;IAE5B,MAAM,EACJ,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3B,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EACvB,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAA;IACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACzD,qGAAqG;IACrG,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACjE,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,OAAO;QACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,aAAa;YACxB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE;gBACnE,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ
|
|
1
|
+
{"version":3,"file":"AccessToken.js","sourceRoot":"","sources":["../src/AccessToken.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,MAAM,EAEN,SAAS,GACV,MAAM,MAAM,CAAA;AACb,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAA;AAC5B,OAAO,EAAe,YAAY,EAAE,MAAM,SAAS,CAAA;AAEnD,8FAA8F;AAC9F,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAO,GAAyB,EAAE;QAC5C,KAAK,CACH,wIAAwI,EACxI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CACzB,CAAA;IACH,CAAC;CACF;AASD,gGAAgG;AAChG,MAAM,QAAQ,GAAG,MAAM,CAAA;AAEvB;;;GAGG;AACH,MAAM,QAAQ,GAAG;IACf,MAAM,CAAC,iBAAiB;IACxB,MAAM,CAAC,gBAAgB;IACvB,MAAM,CAAC,wBAAwB;IAC/B,MAAM,CAAC,iBAAiB;IACxB,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,8BAA8B;IACrC,MAAM,CAAC,wBAAwB;IAC/B,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,UAAU;CACT,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,OAAO,GAAmB,EAAE;IAE5B,MAAM,EACJ,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC3B,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EACvB,OAAO,GAAG,KAAK,GAChB,GAAG,OAAO,CAAA;IACX,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAA;IAC3C,6FAA6F;IAC7F,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAA;IACnD,qGAAqG;IACrG,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACjE,WAAW,EAAE,MAAM;QACnB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,OAAO;QACxB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAA;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,aAAa;YACxB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE;gBACnE,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ;gBACR,MAAM;gBACN,cAAc,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC;gBAC3C,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,wFAAwF;gBACxF,mDAAmD;gBACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,YAAY,OAAO,CAAC;oBACtD,MAAM,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC1C,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;YAC1B,CAAC,CAAC,CAAA;YACF,4FAA4F;YAC5F,oFAAoF;YACpF,MAAM,SAAS,GACb,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;YACvE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACjD,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,oFAAoF;YACpF,IACE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;gBACrC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;gBAEtC,MAAM,IAAI,YAAY,EAAE,CAAA;YAC1B,OAAO;gBACL,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC;gBAC/B,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,SAAS,EAAE,OAAO,CAAC,GAAI,GAAG,IAAI;gBAC9B,KAAK,EACH,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;oBAC/B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBAC1C,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,OAAO,CAAC,GAAI;aACrB,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAwFD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAqC,EACrC,OAAyB;IAEzB,8EAA8E;IAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAC1C,CAAA;AACH,CAAC;AASD,wFAAwF;AACxF,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAA;IAC1C,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,EAAE;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,CAAA;QAC1D,MAAM,KAAK,GAAG,KAAgC,CAAA;QAC9C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;QAC5C,IACE,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC7C,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAE7C,OAAO,EAAE,CAAA;QACX,OAAO;YACL;gBACE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,QAAQ;aAClB;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAA;IAC7C,OAAO,cAAc,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA0B,EAAE,CAChC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC1E,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,IAAI,YAAY,CAAC;QACtB,KAAK,EAAE,KAAK;QACZ,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EACL,qFAAqF;QACvF,MAAM,EAAE,CAAC;KACV,CAAC,CAAA;AACJ,CAAC"}
|
package/dist/Id.d.ts
CHANGED
|
@@ -114,7 +114,7 @@ export declare namespace RequestError {
|
|
|
114
114
|
uri?: string | undefined;
|
|
115
115
|
};
|
|
116
116
|
/** Each refusal's stable name, as `docs/errors.md` explains. */
|
|
117
|
-
type Reason = 'access_key_taken' | '
|
|
117
|
+
type Reason = 'access_key_taken' | 'already_decided' | 'app_exists' | 'authorization_expired' | 'backend_sign_in_not_permitted' | 'body_too_large' | 'challenge_not_permitted' | 'config_conflict' | 'configurable_accounts_disabled' | 'consent_required' | 'cross_site_request' | 'duplicate_limit' | 'duplicate_scope' | 'embed_not_permitted' | 'employee_required' | 'empty_limits' | 'empty_scopes' | 'expiry_exceeds_maximum' | 'expiry_passed' | 'foreign_account' | 'foreign_origin' | 'funding_unavailable' | 'insufficient_balance' | 'invalid_app' | 'invalid_chain' | 'invalid_client' | 'invalid_client_attestation' | 'invalid_code' | 'invalid_dpop_proof' | 'invalid_expiry' | 'invalid_field' | 'invalid_id_token_hint' | 'invalid_origin' | 'invalid_period' | 'invalid_public_key' | 'invalid_realm' | 'invalid_recipients' | 'invalid_resource' | 'invalid_target' | 'invalid_token' | 'limit_exceeds_maximum' | 'localhost_not_permitted' | 'logout_not_permitted' | 'malformed_body' | 'missing_code_challenge' | 'missing_key' | 'missing_permissions' | 'missing_recipients' | 'not_configurable' | 'origin_required' | 'owner_exists' | 'owner_unavailable' | 'passkey_limit' | 'passkey_link_expired' | 'passkey_not_permitted' | 'passkey_register_not_permitted' | 'payment_declined' | 'post_logout_redirect_not_permitted' | 'privy_app_taken' | 'public_app' | 'pushed_authorization_required' | 'rate_limited' | 'realm_exists' | 'realm_in_use' | 'reauthentication_required' | 'registrar_required' | 'rejected' | 'relying_party_taken' | 'resource_exists' | 'scope_without_limit' | 'session_changed' | 'session_required' | 'sign_not_permitted' | 'sign_out_link_expired' | 'sign_up_not_permitted' | 'signing_key_in_use' | 'too_many_signing_keys' | 'unexpected' | 'unknown_app' | 'unknown_code' | 'unknown_endpoint' | 'unknown_key' | 'unknown_order' | 'unknown_realm' | 'unknown_resource' | 'unknown_screening' | 'unknown_session' | 'unknown_signing_key' | 'unknown_user' | 'unsupported_call' | 'unsupported_token' | 'upgrade_required' | 'upstream_unavailable' | 'webauthn_rejected' | 'webauthn_required';
|
|
118
118
|
}
|
|
119
119
|
/** A revocation of an access key that the chain holds revoked already. */
|
|
120
120
|
export declare class RevokedError extends Error {
|
package/dist/Id.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Id.d.ts","sourceRoot":"","sources":["../src/Id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIrC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAEtD,8GAA8G;AAC9G,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAIjD;CACF;AAED,MAAM,CAAC,OAAO,WAAW,qBAAqB,CAAC;IAC7C,KAAK,OAAO,GAAG;QACb,iCAAiC;QACjC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,gGAAgG;AAChG,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,iCAAgC;IAEtD,cAIC;CACF;AAED,qGAAqG;AACrG,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,8BAA6B;IAEnD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAkB,IAAI,kCAAiC;IAEvD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,yBAAwB;IAE9C,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,6BAA4B;IAElD,cAIC;CACF;AAED,uCAAuC;AACvC,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,qBAAoB;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;IAChD,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EASxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,yBAAyB;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,kCAAkC;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,+BAA+B;QAC/B,OAAO,EAAE,MAAM,CAAA;QACf,4CAA4C;QAC5C,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;QAC5D,sEAAsE;QACtE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC9B,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAA;QACd,uBAAuB;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;IAED,gEAAgE;IAChE,KAAK,MAAM,GACP,kBAAkB,GAClB,
|
|
1
|
+
{"version":3,"file":"Id.d.ts","sourceRoot":"","sources":["../src/Id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,KAAK,eAAe,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIrC,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAE5D,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,KAAK,OAAO,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAEtD,8GAA8G;AAC9G,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,8BAA6B;IAEnD,YAAY,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAIjD;CACF;AAED,MAAM,CAAC,OAAO,WAAW,qBAAqB,CAAC;IAC7C,KAAK,OAAO,GAAG;QACb,iCAAiC;QACjC,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,gGAAgG;AAChG,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,SAAkB,IAAI,iCAAgC;IAEtD,cAIC;CACF;AAED,qGAAqG;AACrG,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAkB,IAAI,8BAA6B;IAEnD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,SAAkB,IAAI,kCAAiC;IAEvD,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,yBAAwB;IAE9C,cAIC;CACF;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,SAAkB,IAAI,6BAA4B;IAElD,cAIC;CACF;AAED,uCAAuC;AACvC,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,qBAAoB;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACpE,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;IAChD,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EASxC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,sCAAsC;QACtC,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,yBAAyB;QACzB,IAAI,EAAE,MAAM,CAAA;QACZ,kCAAkC;QAClC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,+BAA+B;QAC/B,OAAO,EAAE,MAAM,CAAA;QACf,4CAA4C;QAC5C,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;QAC5D,sEAAsE;QACtE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,0EAA0E;QAC1E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC9B,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAA;QACd,uBAAuB;QACvB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;IAED,gEAAgE;IAChE,KAAK,MAAM,GACP,kBAAkB,GAClB,iBAAiB,GACjB,YAAY,GACZ,uBAAuB,GACvB,+BAA+B,GAC/B,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,gCAAgC,GAChC,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,cAAc,GACd,cAAc,GACd,wBAAwB,GACxB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,GACrB,sBAAsB,GACtB,aAAa,GACb,eAAe,GACf,gBAAgB,GAChB,4BAA4B,GAC5B,cAAc,GACd,oBAAoB,GACpB,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,eAAe,GACf,oBAAoB,GACpB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,wBAAwB,GACxB,aAAa,GACb,qBAAqB,GACrB,oBAAoB,GACpB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,eAAe,GACf,sBAAsB,GACtB,uBAAuB,GACvB,gCAAgC,GAChC,kBAAkB,GAClB,oCAAoC,GACpC,iBAAiB,GACjB,YAAY,GACZ,+BAA+B,GAC/B,cAAc,GACd,cAAc,GACd,cAAc,GACd,2BAA2B,GAC3B,oBAAoB,GACpB,UAAU,GACV,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GACpB,uBAAuB,GACvB,uBAAuB,GACvB,oBAAoB,GACpB,uBAAuB,GACvB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,aAAa,GACb,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,CAAA;CACxB;AAED,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,qBAAoB;IAE1C,YAAY,OAAO,EAAE,YAAY,CAAC,OAAO,EAExC;CACF;AAED,MAAM,CAAC,OAAO,WAAW,YAAY,CAAC;IACpC,KAAK,OAAO,GAAG;QACb,gCAAgC;QAChC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;KACzB,CAAA;CACF;AAED,wEAAwE;AACxE,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,uBAAsB;IAE5C,cAEC;CACF;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAkB,IAAI,wBAAuB;IAE7C,cAIC;CACF;AAED,+EAA+E;AAC/E,MAAM,MAAM,MAAM,GAAG;IACnB,wFAAwF;IACxF,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC,MAAM,GAAG,SAAS,CAAA;IACpD;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IACvB,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;IAC3C;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD;;;;OAIG;IACH,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACzB,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;IACzB,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,EAAE,CACZ,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,IACjE,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;IACxB,kEAAkE;IAClE,OAAO,EAAE;QACP;;;WAGG;QACH,GAAG,EAAE,CACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,KACpC,OAAO,CAAC,YAAY,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;QACnD;;;;WAIG;QACH,OAAO,EAAE,CACP,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,KACxC,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;KACxC,CAAA;IACD;;;;OAIG;IACH,SAAS,EAAE,CACT,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,KACnC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACvC,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,0CAA0C;IAC1C,OAAO,EAAE;QACP;;;;;WAKG;QACH,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,SAAS,CAAA;QACzD;;;;;;;WAOG;QACH,GAAG,EAAE,CACH,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,KACpC,OAAO,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QACzC;;;WAGG;QACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAA;QACnD;;;;WAIG;QACH,MAAM,EAAE,eAAe,CAAC,MAAM,CAAA;QAC9B,6FAA6F;QAC7F,SAAS,EAAE,CACT,QAAQ,EAAE,CACR,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,EACpC,QAAQ,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,KAClC,IAAI,KACN,MAAM,IAAI,CAAA;KAChB,CAAA;IACD;;;;;;OAMG;IACH,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE;QACrB,gGAAgG;QAChG,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KACjC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpB,CAAA;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,IAAI,CAAC,OAAY,GAAG,MAAM,CAqBvD;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC,GAAG;QAClE,kGAAkG;QAClG,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,yDAAyD;QACzD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QACzB,6FAA6F;QAC7F,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,0CAA0C;QAC1C,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzB,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,EACxE,OAAO,GAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAM,GACpC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAiN7B;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,CACV,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,MAAM,CAAC,MAAM,EAAE,IACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG;QAC9B;;;;;WAKG;QACH,SAAS,CAAC,EAAE,WAAW,GAAG,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;QACrE;;;WAGG;QACH,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC9B,CAAA;CACF;AAED,+EAA+E;AAC/E,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,IAG7D,MAAM,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAChC,OAAO,GACP,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GACtE,SAAS,CAAC,GAAG,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAC3C,OAAO,CAAA;AAEf,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,IAE9D,MAAM,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAChC,OAAO,GACP,SAAS,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GACrC,OAAO,GACP,SAAS,CAAC,GAAG,OAAO,EAAE,UAAU,CAAC,OAAO,OAAO,CAAC,CAAC,CAAA"}
|
package/dist/Id.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Id.js","sourceRoot":"","sources":["../src/Id.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAK9C,8GAA8G;AAC9G,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAsC;QAChD,KAAK,CACH,mCAAmC,OAAO,CAAC,OAAO,2EAA2E,CAC9H,CAAA;IACH,CAAC;CACF;AASD,gGAAgG;AAChG,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,6BAA6B,CAAA;IAEtD;QACE,KAAK,CACH,4JAA4J,CAC7J,CAAA;IACH,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,0BAA0B,CAAA;IAEnD;QACE,KAAK,CACH,gIAAgI,CACjI,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChC,IAAI,GAAG,8BAA8B,CAAA;IAEvD;QACE,KAAK,CACH,yHAAyH,CAC1H,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,qBAAqB,CAAA;IAE9C;QACE,KAAK,CACH,uIAAuI,CACxI,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,yBAAyB,CAAA;IAElD;QACE,KAAK,CACH,8GAA8G,CAC/G,CAAA;IACH,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,iBAAiB,CAAA;IAC1C,qEAAqE;IAC5D,IAAI,CAAQ;IACrB,oDAAoD;IAC3C,KAAK,CAAoB;IAClC,+FAA+F;IACtF,IAAI,CAAuD;IACpE,mDAAmD;IAC1C,MAAM,CAAiC;IAChD,+EAA+E;IACtE,QAAQ,CAAS;IAC1B,8DAA8D;IACrD,MAAM,CAAQ;IACvB,wCAAwC;IAC/B,GAAG,CAAoB;IAEhC,YAAY,OAA6B;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACxB,CAAC;CACF;
|
|
1
|
+
{"version":3,"file":"Id.js","sourceRoot":"","sources":["../src/Id.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAA;AAClD,OAAO,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC1C,OAAO,KAAK,aAAa,MAAM,6BAA6B,CAAA;AAC5D,OAAO,KAAK,YAAY,MAAM,4BAA4B,CAAA;AAC1D,OAAO,KAAK,eAAe,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAK9C,8GAA8G;AAC9G,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,0BAA0B,CAAA;IAEnD,YAAY,OAAsC;QAChD,KAAK,CACH,mCAAmC,OAAO,CAAC,OAAO,2EAA2E,CAC9H,CAAA;IACH,CAAC;CACF;AASD,gGAAgG;AAChG,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAC/B,IAAI,GAAG,6BAA6B,CAAA;IAEtD;QACE,KAAK,CACH,4JAA4J,CAC7J,CAAA;IACH,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5B,IAAI,GAAG,0BAA0B,CAAA;IAEnD;QACE,KAAK,CACH,gIAAgI,CACjI,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChC,IAAI,GAAG,8BAA8B,CAAA;IAEvD;QACE,KAAK,CACH,yHAAyH,CAC1H,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,qBAAqB,CAAA;IAE9C;QACE,KAAK,CACH,uIAAuI,CACxI,CAAA;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3B,IAAI,GAAG,yBAAyB,CAAA;IAElD;QACE,KAAK,CACH,8GAA8G,CAC/G,CAAA;IACH,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,iBAAiB,CAAA;IAC1C,qEAAqE;IAC5D,IAAI,CAAQ;IACrB,oDAAoD;IAC3C,KAAK,CAAoB;IAClC,+FAA+F;IACtF,IAAI,CAAuD;IACpE,mDAAmD;IAC1C,MAAM,CAAiC;IAChD,+EAA+E;IACtE,QAAQ,CAAS;IAC1B,8DAA8D;IACrD,MAAM,CAAQ;IACvB,wCAAwC;IAC/B,GAAG,CAAoB;IAEhC,YAAY,OAA6B;QACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACxB,CAAC;CACF;AA2HD,0EAA0E;AAC1E,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,iBAAiB,CAAA;IAE1C,YAAY,OAA6B;QACvC,KAAK,CAAC,kBAAkB,OAAO,CAAC,SAAS,sBAAsB,CAAC,CAAA;IAClE,CAAC;CACF;AASD,wEAAwE;AACxE,MAAM,OAAO,cAAe,SAAQ,KAAK;IACrB,IAAI,GAAG,mBAAmB,CAAA;IAE5C;QACE,KAAK,CAAC,6DAA6D,CAAC,CAAA;IACtE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACtB,IAAI,GAAG,oBAAoB,CAAA;IAE7C;QACE,KAAK,CACH,wFAAwF,CACzF,CAAA;IACH,CAAC;CACF;AA6ID;;;;;;;;;;GAUG;AACH,MAAM,UAAU,IAAI,CAAC,OAAO,GAAiB,EAAE;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,GAAG,gBAAgB,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAExE,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;QACvC,iGAAiG;QACjG,qFAAqF;QACrF,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,QAAQ,KAAK,WAAW;YACpE,OAAO,QAAQ,CAAC,MAAM,CAAA;QACxB,MAAM,IAAI,qBAAqB,EAAE,CAAA;IACnC,CAAC,CAAC,EAAE,CAAA;IAEJ,0FAA0F;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QACnE,QAAQ;QACR,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7D,GAAG,EAAE,GAAG,IAAI,UAAU;KACvB,CAAA;AACH,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,MAAM,CACpB,OAAO,GAA4B,EAAE;IAErC,MAAM,EACJ,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,OAAO,GAAG,EAAE,EACrB,GAAG,IAAI,EACR,GAAG,OAAO,CAAA;IACX,+FAA+F;IAC/F,gBAAgB;IAChB,MAAM,SAAS,GACb,OAAO,gBAAgB,KAAK,UAAU;QACpC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAA;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,0FAA0F;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAChE,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,EAAE,EACF,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,EAC3C,KAAK,CACU,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,8FAA8F;IAC9F,oFAAoF;IACpF,MAAM,OAAO,GAA6B,CAAC,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACnC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CACvC,CAAA;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC;YACjE,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;QACzB,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,EAAE,CAAA;IACJ,kGAAkG;IAClG,oCAAoC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,WAAW,CAAA;IAE9E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,CAAC,EAAE,iEAAiE,CACjG,CAAA;QACH,+FAA+F;QAC/F,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,CAAC,EAAE,2FAA2F,CAC3H,CAAA;QACH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACpB,CAAC;IAED,6FAA6F;IAC7F,0FAA0F;IAC1F,MAAM,IAAI,GAAG,oBAAoB,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;IAChH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAE5C,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC;QACrC,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI;QACJ,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,KAAK,MAAM,MAAM,IAAI,OAAO;gBAC1B,MAAM,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,SAAS;YACb,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,OAAO,CAAC,CAAA;QAC3E,CAAC;QACD,gGAAgG;QAChG,2FAA2F;QAC3F,4FAA4F;QAC5F,+FAA+F;QAC/F,8FAA8F;QAC9F,6EAA6E;QAC7E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;YACrC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;YACjE,6FAA6F;YAC7F,yFAAyF;YACzF,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;gBAChC,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAA;gBAC/B,IAAI,CAAC,KAAK,EAAE,YAAY;oBAAE,OAAO,SAAS,CAAA;gBAC1C,4FAA4F;gBAC5F,2FAA2F;gBAC3F,wBAAwB;gBACxB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACvE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAClE,KAAK,IAAI,EAAE;oBACT,MAAM,SAAS,EAAE,EAAE,CAAA;oBACnB,OAAO,SAAS,CAAA;gBAClB,CAAC,EACD,KAAK,EAAE,KAAc,EAAE,EAAE;oBACvB,2FAA2F;oBAC3F,MAAM,UAAU,GACd,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC;wBAChC,KAAK,CAAC,MAAM,KAAK,CAAC;wBAClB,KAAK,CAAC,MAAM,KAAK,GAAG;wBACpB,KAAK,CAAC,MAAM,IAAI,GAAG,CAAA;oBACrB,IAAI,UAAU;wBAAE,OAAO,EAAE,KAAK,EAAE,CAAA;oBAChC,MAAM,SAAS,EAAE,EAAE,CAAA;oBACnB,OAAO,SAAS,CAAA;gBAClB,CAAC,CACF,CAAA;YACH,CAAC,CAAC,EAAE,CAAA;YACJ,8FAA8F;YAC9F,2FAA2F;YAC3F,wDAAwD;YACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACjE,IAAI,SAAS;gBACX,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;YACzE,8FAA8F;YAC9F,qBAAqB;YACrB,IAAI,OAAO,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC;gBAC5D,MAAM,OAAO,CAAC,KAAK,CAAA;QACvB,CAAC;QACD,KAAK;KACN,CAAC,CAAA;IAEF,MAAM,OAAO,GAAmB;QAC9B,SAAS;QACT,MAAM;QACN,OAAO,EAAE;YACP,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB;KACF,CAAA;IAED,MAAM,UAAU,GAA4B,EAAE,CAAA;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,yFAAyF;QACzF,IAAI,MAAM,CAAC,OAAO;YAChB,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;gBAC3C,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC9B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;QACJ,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAA;IACzB,CAAC;IAED,MAAM,QAAQ,GAA4B;QACxC,GAAG,UAAU;QACb,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,UAAuC,EAAE,EAAE,CAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC;YACtC,OAAO,EAAE,CAAC,UAA2C,EAAE,EAAE,CACvD,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC;SAC3C;QACD,SAAS,EAAE,CAAC,UAAsC,EAAE,EAAE,CACpD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC;QACrC,MAAM;QACN,OAAO,EAAE;YACP,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,CAAC,UAAU,GAA+B,EAAE,EAAE,EAAE,CACnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;gBACvB,GAAG,UAAU;gBACb,KAAK,CAAC,OAAO;oBACX,KAAK,MAAM,MAAM,IAAI,OAAO;wBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;gBACtE,CAAC;gBACD,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;YACJ,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,KAAK,CAAC,OAAO,CAAC,UAAU,GAA8C,EAAE;YACtE,8FAA8F;YAC9F,wBAAwB;YACxB,IAAI,UAAU,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC/D,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACvC,gGAAgG;YAChG,+EAA+E;YAC/E,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;gBACzB,KAAK,MAAM,MAAM,IAAI,OAAO;oBAC1B,MAAM,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC,CAAA;YAChD,CAAC,CAAC,EAAE,CAAA;YACJ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC7B,uFAAuF;YACvF,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBACnC,MAAM,KAAK,CAAA;YACb,CAAC;YACD,MAAM,MAAM,CAAA;YACZ,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,OAAO,CAAC,CAAA;QAC3E,CAAC;KACF,CAAA;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,SAAQ;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAc,EAAE,OAAO,CAGpD,CAAA;QACD,4FAA4F;QAC5F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,IAAI,IAAI,IAAI,QAAQ;gBAClB,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,IAAI,CAAC,gEAAgE,MAAM,CAAC,EAAE,uBAAuB,CACvI,CAAA;QACL,0FAA0F;QAC1F,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9E,CAAC;IAED,OAAO,QAAuC,CAAA;AAChD,CAAC;AAwCD,4DAA4D;AAC5D,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEzC,sEAAsE;AACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,SAAS;IACT,SAAS;CACV,CAAC,CAAA"}
|
package/dist/actions/oauth.d.ts
CHANGED
|
@@ -7,12 +7,20 @@ import type { User } from '../User.js';
|
|
|
7
7
|
/**
|
|
8
8
|
* Checks whether a token is active (RFC 7662). Unlike local verification against {@link jwks}, it
|
|
9
9
|
* reports a revoked token inactive at once. The client secret authenticates the request, so only a
|
|
10
|
-
* backend calls it.
|
|
10
|
+
* backend calls it. An active token can name another API in `audience`, such as a registered
|
|
11
|
+
* resource, which holds every token that it receives. So a backend accepts a token only when every
|
|
12
|
+
* `audience` entry is its own audience or the `userinfo` URL.
|
|
11
13
|
*
|
|
12
14
|
* @example
|
|
13
15
|
* ```ts
|
|
16
|
+
* const own = ['https://id.tempo.xyz', 'https://id.tempo.xyz/oauth2/userinfo']
|
|
14
17
|
* const result = await Actions.oauth.introspect(auth, { token: accessToken })
|
|
15
|
-
* if (
|
|
18
|
+
* if (
|
|
19
|
+
* !result.active ||
|
|
20
|
+
* !result.audience.includes(own[0]!) ||
|
|
21
|
+
* result.audience.some((entry) => !own.includes(entry))
|
|
22
|
+
* )
|
|
23
|
+
* return c.json({ error: 'Sign in again.' }, 401)
|
|
16
24
|
* ```
|
|
17
25
|
*/
|
|
18
26
|
export declare function introspect(auth: Config, options: introspect.Options): Promise<introspect.ReturnType>;
|
|
@@ -30,6 +38,11 @@ export declare namespace introspect {
|
|
|
30
38
|
} | {
|
|
31
39
|
/** The token is active. */
|
|
32
40
|
active: true;
|
|
41
|
+
/**
|
|
42
|
+
* The APIs that the token is for, from its `aud`: Tempo ID's origin, or registered resources,
|
|
43
|
+
* with the `userinfo` URL for the `openid` scope. Empty for a token without `aud`.
|
|
44
|
+
*/
|
|
45
|
+
audience: readonly string[];
|
|
33
46
|
/** The app the token was issued to. */
|
|
34
47
|
clientId: string | undefined;
|
|
35
48
|
/** When the token expires, in milliseconds. */
|
|
@@ -79,7 +92,7 @@ export declare namespace introspect {
|
|
|
79
92
|
* }
|
|
80
93
|
*
|
|
81
94
|
* const { payload } = await verify(accessToken)
|
|
82
|
-
* // Every app
|
|
95
|
+
* // Every app may request a token for the audience, so allow each app by its `client_id`.
|
|
83
96
|
* if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
|
|
84
97
|
* ```
|
|
85
98
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/actions/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC
|
|
1
|
+
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/actions/oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,CAAC,OAAO,GAC1B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAgChC;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,OAAO,GAAG;QACb,kDAAkD;QAClD,KAAK,EAAE,MAAM,CAAA;QACb,qDAAqD;QACrD,aAAa,CAAC,EAAE,cAAc,GAAG,eAAe,GAAG,SAAS,CAAA;KAC7D,CAAA;IAED,iFAAiF;IACjF,KAAK,UAAU,GACX;QACE,sDAAsD;QACtD,MAAM,EAAE,KAAK,CAAA;KACd,GACD;QACE,2BAA2B;QAC3B,MAAM,EAAE,IAAI,CAAA;QACZ;;;WAGG;QACH,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;QAC3B,uCAAuC;QACvC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,+CAA+C;QAC/C,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;QAC7B,kDAAkD;QAClD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,2CAA2C;QAC3C,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,mDAAmD;QACnD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAC3B,CAAA;CACN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAIjE;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,yCAAyC;IACzC,KAAK,UAAU,GAAG;QAChB,iCAAiC;QACjC,IAAI,EAAE,UAAU,EAAE,CAAA;KACnB,CAAA;CACF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,QAAQ,CAAC,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,MAAM,CAAC,OAAO,WAAW,QAAQ,CAAC;IAChC,KAAK,OAAO,GAAG;QACb,oDAAoD;QACpD,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF"}
|
package/dist/actions/oauth.js
CHANGED
|
@@ -2,12 +2,20 @@ import * as Api from '../internal/api.js';
|
|
|
2
2
|
/**
|
|
3
3
|
* Checks whether a token is active (RFC 7662). Unlike local verification against {@link jwks}, it
|
|
4
4
|
* reports a revoked token inactive at once. The client secret authenticates the request, so only a
|
|
5
|
-
* backend calls it.
|
|
5
|
+
* backend calls it. An active token can name another API in `audience`, such as a registered
|
|
6
|
+
* resource, which holds every token that it receives. So a backend accepts a token only when every
|
|
7
|
+
* `audience` entry is its own audience or the `userinfo` URL.
|
|
6
8
|
*
|
|
7
9
|
* @example
|
|
8
10
|
* ```ts
|
|
11
|
+
* const own = ['https://id.tempo.xyz', 'https://id.tempo.xyz/oauth2/userinfo']
|
|
9
12
|
* const result = await Actions.oauth.introspect(auth, { token: accessToken })
|
|
10
|
-
* if (
|
|
13
|
+
* if (
|
|
14
|
+
* !result.active ||
|
|
15
|
+
* !result.audience.includes(own[0]!) ||
|
|
16
|
+
* result.audience.some((entry) => !own.includes(entry))
|
|
17
|
+
* )
|
|
18
|
+
* return c.json({ error: 'Sign in again.' }, 401)
|
|
11
19
|
* ```
|
|
12
20
|
*/
|
|
13
21
|
export async function introspect(auth, options) {
|
|
@@ -26,6 +34,7 @@ export async function introspect(auth, options) {
|
|
|
26
34
|
return { active: false };
|
|
27
35
|
return {
|
|
28
36
|
active: true,
|
|
37
|
+
audience: typeof body.aud === 'string' ? [body.aud] : (body.aud ?? []),
|
|
29
38
|
clientId: body.client_id,
|
|
30
39
|
expiresAt: body.exp === undefined ? undefined : body.exp * 1000,
|
|
31
40
|
issuedAt: body.iat === undefined ? undefined : body.iat * 1000,
|
|
@@ -70,7 +79,7 @@ export async function introspect(auth, options) {
|
|
|
70
79
|
* }
|
|
71
80
|
*
|
|
72
81
|
* const { payload } = await verify(accessToken)
|
|
73
|
-
* // Every app
|
|
82
|
+
* // Every app may request a token for the audience, so allow each app by its `client_id`.
|
|
74
83
|
* if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
|
|
75
84
|
* ```
|
|
76
85
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/actions/oauth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC
|
|
1
|
+
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/actions/oauth.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AAGzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CASzB,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACnE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,GAAG,CAAC,MAAM,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK;YACL,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;QACF,MAAM,EAAE,MAAM;KACf,CAAC,CACH,CAAA;IACD,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1C,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QACtE,QAAQ,EAAE,IAAI,CAAC,SAAS;QACxB,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC/D,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI;QAC9D,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,GAAG;KACjB,CAAA;AACH,CAAC;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAY;IACrC,OAAO,GAAG,CAAC,IAAI,CACb,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAC/D,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE;QAChD,OAAO,EAAE,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,KAAK;YACb,GAAG;SACJ,CAAC;KACH,CAAC,CAAA;IACF,gGAAgG;IAChG,iEAAiE;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QACzB,MAAM,GAAG,CAAC,KAAK,CACb;YACE,KAAK,EAAE,eAAe;YACtB,iBAAiB,EACf,wEAAwE;SAC3E,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAiC,QAAQ,CAAC,CAAA;IACvE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC"}
|
package/package.json
CHANGED
package/src/AccessToken.ts
CHANGED
|
@@ -74,6 +74,9 @@ export function create(
|
|
|
74
74
|
timeout = 5_000,
|
|
75
75
|
} = options
|
|
76
76
|
const issuer = new URL(options.issuer ?? auth.url).origin
|
|
77
|
+
const audience = options.audience ?? issuer
|
|
78
|
+
// The issuer adds its `userinfo` URL to the audience of every token with the `openid` scope.
|
|
79
|
+
const own = [audience, `${issuer}/oauth2/userinfo`]
|
|
77
80
|
// jose shares a fetch in flight outside Workers, and on Workers each request fetches the set itself.
|
|
78
81
|
const keys = createRemoteJWKSet(new URL('/oauth2/jwks', auth.url), {
|
|
79
82
|
cacheMaxAge: maxAge,
|
|
@@ -86,7 +89,7 @@ export function create(
|
|
|
86
89
|
async verify(verifyOptions) {
|
|
87
90
|
const { payload } = await jwtVerify(verifyOptions.accessToken, keys, {
|
|
88
91
|
algorithms: ['RS256'],
|
|
89
|
-
audience
|
|
92
|
+
audience,
|
|
90
93
|
issuer,
|
|
91
94
|
requiredClaims: ['client_id', 'exp', 'sub'],
|
|
92
95
|
typ: 'at+jwt',
|
|
@@ -97,7 +100,13 @@ export function create(
|
|
|
97
100
|
throw new InvalidError({ cause: error })
|
|
98
101
|
throw unavailable(error)
|
|
99
102
|
})
|
|
100
|
-
//
|
|
103
|
+
// jose admits an `aud` that names the audience among others. Another API that a token names
|
|
104
|
+
// holds the token, so a token for any other audience, also beside this one, throws.
|
|
105
|
+
const audiences =
|
|
106
|
+
typeof payload.aud === 'string' ? [payload.aud] : (payload.aud ?? [])
|
|
107
|
+
if (audiences.some((entry) => !own.includes(entry)))
|
|
108
|
+
throw new InvalidError()
|
|
109
|
+
// Every app may request a token for the audience, so the app's `client_id` decides.
|
|
101
110
|
if (
|
|
102
111
|
typeof payload.client_id !== 'string' ||
|
|
103
112
|
!clientIds.includes(payload.client_id)
|
|
@@ -120,6 +129,13 @@ export function create(
|
|
|
120
129
|
|
|
121
130
|
export declare namespace create {
|
|
122
131
|
type Options = {
|
|
132
|
+
/**
|
|
133
|
+
* The resource that the API serves, which each token that it accepts names in `aud`: Tempo ID's
|
|
134
|
+
* origin, or a [registered resource](https://github.com/tempoxyz/id/blob/main/docs/resources.md),
|
|
135
|
+
* such as `https://mercator.sh/mcp`. A token that names any other audience, also beside this
|
|
136
|
+
* one, throws. The issuer's `userinfo` URL is allowed beside it. Defaults to `issuer`.
|
|
137
|
+
*/
|
|
138
|
+
audience?: string | undefined
|
|
123
139
|
/**
|
|
124
140
|
* The client IDs of the apps whose tokens the API accepts. Every other app's token throws.
|
|
125
141
|
* Defaults to the instance's `clientId`.
|
|
@@ -147,8 +163,9 @@ export declare namespace create {
|
|
|
147
163
|
/** The verifier. */
|
|
148
164
|
type ReturnType = {
|
|
149
165
|
/**
|
|
150
|
-
* Verifies an access token: its RS256 signature over the issuer's keys, `typ: at+jwt`, `iss`
|
|
151
|
-
*
|
|
166
|
+
* Verifies an access token: its RS256 signature over the issuer's keys, `typ: at+jwt`, `iss` of
|
|
167
|
+
* the issuer, an `aud` of `audience` and nothing else but the `userinfo` URL, an `exp` that has
|
|
168
|
+
* not passed, and a `client_id` of `clientIds`.
|
|
152
169
|
* @throws {InvalidError} For a token that does not verify, or another app's token.
|
|
153
170
|
* @throws {Id.RequestError} With status 0, when the key set cannot be fetched or imported, such
|
|
154
171
|
* as during an issuer outage.
|
package/src/Id.ts
CHANGED
|
@@ -170,7 +170,6 @@ export declare namespace RequestError {
|
|
|
170
170
|
/** Each refusal's stable name, as `docs/errors.md` explains. */
|
|
171
171
|
type Reason =
|
|
172
172
|
| 'access_key_taken'
|
|
173
|
-
| 'allowance_redeemed'
|
|
174
173
|
| 'already_decided'
|
|
175
174
|
| 'app_exists'
|
|
176
175
|
| 'authorization_expired'
|
|
@@ -207,6 +206,8 @@ export declare namespace RequestError {
|
|
|
207
206
|
| 'invalid_public_key'
|
|
208
207
|
| 'invalid_realm'
|
|
209
208
|
| 'invalid_recipients'
|
|
209
|
+
| 'invalid_resource'
|
|
210
|
+
| 'invalid_target'
|
|
210
211
|
| 'invalid_token'
|
|
211
212
|
| 'limit_exceeds_maximum'
|
|
212
213
|
| 'localhost_not_permitted'
|
|
@@ -236,6 +237,7 @@ export declare namespace RequestError {
|
|
|
236
237
|
| 'registrar_required'
|
|
237
238
|
| 'rejected'
|
|
238
239
|
| 'relying_party_taken'
|
|
240
|
+
| 'resource_exists'
|
|
239
241
|
| 'scope_without_limit'
|
|
240
242
|
| 'session_changed'
|
|
241
243
|
| 'session_required'
|
|
@@ -245,13 +247,13 @@ export declare namespace RequestError {
|
|
|
245
247
|
| 'signing_key_in_use'
|
|
246
248
|
| 'too_many_signing_keys'
|
|
247
249
|
| 'unexpected'
|
|
248
|
-
| 'unknown_allowance'
|
|
249
250
|
| 'unknown_app'
|
|
250
251
|
| 'unknown_code'
|
|
251
252
|
| 'unknown_endpoint'
|
|
252
253
|
| 'unknown_key'
|
|
253
254
|
| 'unknown_order'
|
|
254
255
|
| 'unknown_realm'
|
|
256
|
+
| 'unknown_resource'
|
|
255
257
|
| 'unknown_screening'
|
|
256
258
|
| 'unknown_session'
|
|
257
259
|
| 'unknown_signing_key'
|
package/src/actions/oauth.ts
CHANGED
|
@@ -9,12 +9,20 @@ import type { User } from '../User.js'
|
|
|
9
9
|
/**
|
|
10
10
|
* Checks whether a token is active (RFC 7662). Unlike local verification against {@link jwks}, it
|
|
11
11
|
* reports a revoked token inactive at once. The client secret authenticates the request, so only a
|
|
12
|
-
* backend calls it.
|
|
12
|
+
* backend calls it. An active token can name another API in `audience`, such as a registered
|
|
13
|
+
* resource, which holds every token that it receives. So a backend accepts a token only when every
|
|
14
|
+
* `audience` entry is its own audience or the `userinfo` URL.
|
|
13
15
|
*
|
|
14
16
|
* @example
|
|
15
17
|
* ```ts
|
|
18
|
+
* const own = ['https://id.tempo.xyz', 'https://id.tempo.xyz/oauth2/userinfo']
|
|
16
19
|
* const result = await Actions.oauth.introspect(auth, { token: accessToken })
|
|
17
|
-
* if (
|
|
20
|
+
* if (
|
|
21
|
+
* !result.active ||
|
|
22
|
+
* !result.audience.includes(own[0]!) ||
|
|
23
|
+
* result.audience.some((entry) => !own.includes(entry))
|
|
24
|
+
* )
|
|
25
|
+
* return c.json({ error: 'Sign in again.' }, 401)
|
|
18
26
|
* ```
|
|
19
27
|
*/
|
|
20
28
|
export async function introspect(
|
|
@@ -24,6 +32,7 @@ export async function introspect(
|
|
|
24
32
|
const { token, tokenTypeHint } = options
|
|
25
33
|
const body = await Api.json<{
|
|
26
34
|
active: boolean
|
|
35
|
+
aud?: string | readonly string[] | undefined
|
|
27
36
|
client_id?: string | undefined
|
|
28
37
|
exp?: number | undefined
|
|
29
38
|
iat?: number | undefined
|
|
@@ -44,6 +53,7 @@ export async function introspect(
|
|
|
44
53
|
if (!body.active) return { active: false }
|
|
45
54
|
return {
|
|
46
55
|
active: true,
|
|
56
|
+
audience: typeof body.aud === 'string' ? [body.aud] : (body.aud ?? []),
|
|
47
57
|
clientId: body.client_id,
|
|
48
58
|
expiresAt: body.exp === undefined ? undefined : body.exp * 1000,
|
|
49
59
|
issuedAt: body.iat === undefined ? undefined : body.iat * 1000,
|
|
@@ -69,6 +79,11 @@ export declare namespace introspect {
|
|
|
69
79
|
| {
|
|
70
80
|
/** The token is active. */
|
|
71
81
|
active: true
|
|
82
|
+
/**
|
|
83
|
+
* The APIs that the token is for, from its `aud`: Tempo ID's origin, or registered resources,
|
|
84
|
+
* with the `userinfo` URL for the `openid` scope. Empty for a token without `aud`.
|
|
85
|
+
*/
|
|
86
|
+
audience: readonly string[]
|
|
72
87
|
/** The app the token was issued to. */
|
|
73
88
|
clientId: string | undefined
|
|
74
89
|
/** When the token expires, in milliseconds. */
|
|
@@ -119,7 +134,7 @@ export declare namespace introspect {
|
|
|
119
134
|
* }
|
|
120
135
|
*
|
|
121
136
|
* const { payload } = await verify(accessToken)
|
|
122
|
-
* // Every app
|
|
137
|
+
* // Every app may request a token for the audience, so allow each app by its `client_id`.
|
|
123
138
|
* if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
|
|
124
139
|
* ```
|
|
125
140
|
*/
|