@udibo/oauth2 0.26.0 → 0.28.0

package/README.md

@@ -85,12 +85,14 @@ The package implements these specifications, with the limits noted:
   [RFC 8628](https://www.rfc-editor.org/rfc/rfc8628) device authorization.
 - [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) `iss` in authorization
   responses. `DirectClient` and the BFF check it when the client is configured
-  with an `issuer`.
+  with an `issuer`, and so do the external sign-in connectors.
 - [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068) JWT access tokens, opt-in;
   access tokens are opaque by default.
 - [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html):
-  the authorization code flow, ES256 ID tokens, `nonce`, and UserInfo. The
-  server does not act on `prompt` or `max_age`.
+  the authorization code flow, ES256 ID tokens, `nonce`, UserInfo, and the
+  `prompt`, `max_age` and `acr_values` controls, with `auth_time` and `acr` in
+  the ID token. Your login callback performs any re-authentication they need,
+  and there is no `claims` request parameter.
 - OpenID Connect [Discovery 1.0](https://openid.net/specs/openid-connect-discovery-1_0.html)
   and [RP-Initiated Logout 1.0](https://openid.net/specs/openid-connect-rpinitiated-1_0.html).
 - [OpenID Connect Back-Channel Logout 1.0](https://openid.net/specs/openid-connect-backchannel-1_0.html),

package/dist/adapters/hono/authorization-server.d.ts

@@ -35,7 +35,7 @@
 import { Hono } from "hono";
 import type { Context, Handler, MiddlewareHandler } from "hono";
 import type { RequireConditions } from "../../models/authorization.ts";
-import type { AuthenticationContext } from "../../models/authentication.ts";
+import type { AuthenticationContext, AuthenticationRequest } from "../../models/authentication.ts";
 import type { ClientInterface } from "../../models/client.ts";
 import type { AbstractScope, BasicScope } from "../../models/scope.ts";
 import { AuthorizationServer, type AuthorizationServerOptions } from "../../server/authorization-server.ts";
@@ -47,20 +47,29 @@ import type { AuthenticatedContext } from "../../server/resource-server.ts";
  * or session variables without reconstructing a {@link Request}. Return one
  * of:
  *
- * - `{ user, authorizedScope?, authenticationContext? }` — user is authenticated;
- *   the authorize flow continues. Supply only verified event claims in
- *   `authenticationContext`; the code and its tokens retain that snapshot.
+ * - `{ user, authorizedScope?, authenticationContext?, reauthenticated? }` —
+ *   user is authenticated; the authorize flow continues. Supply only verified
+ *   event claims in `authenticationContext`; the code and its tokens retain
+ *   that snapshot. Set `reauthenticated: true` only when the user actively
+ *   authenticated in response to this authorization request.
  * - `null` — explicit denial; the framework redirects to `redirect_uri` with
  *   `error=access_denied`.
  * - A `Response` (typically `c.redirect(...)` to a login page) —
  *   short-circuits the authorize flow and is returned to the browser as-is.
  *   This is how login redirects, interstitials, etc. are wired without
- *   wrapping the framework handler.
+ *   wrapping the framework handler. Under `prompt=none` the server answers
+ *   `login_required` instead.
+ *
+ * The second argument, always passed, carries the request's validated
+ * `prompt`, `max_age` and `acr_values`. The server answers `login_required`
+ * when the returned user fails `satisfiesAuthenticationRequest`, so send the
+ * user to sign in again whenever the session cannot meet it.
  */
-export type HonoAuthenticateUserFn<User> = (c: Context) => Promise<{
+export type HonoAuthenticateUserFn<User> = (c: Context, authentication?: AuthenticationRequest) => Promise<{
     user: User;
     authorizedScope?: AbstractScope;
     authenticationContext?: AuthenticationContext;
+    reauthenticated?: boolean;
 } | Response | null>;
 /**
  * Collects consent from the resource owner for the requested scope.
@@ -76,9 +85,13 @@ export type HonoAuthenticateUserFn<User> = (c: Context) => Promise<{
  * - A `Response` (typically `c.html(...)` rendering a consent page) —
  *   short-circuits the authorize flow and is returned to the browser as-is.
  *   The consent UI should resubmit to the authorize endpoint with a
- *   decision parameter the callback can read on the next request.
+ *   decision parameter the callback can read on the next request. Under
+ *   `prompt=none` the server answers `consent_required` instead.
+ *
+ * With `prompt=consent` the server calls it even when the scope is already
+ * authorized, and the fifth argument, always passed, says so.
  */
-export type HonoHandleConsentFn<Client extends ClientInterface, S extends AbstractScope> = (c: Context, client: Client, requestedScope: S | undefined, user: unknown) => Promise<{
+export type HonoHandleConsentFn<Client extends ClientInterface, S extends AbstractScope> = (c: Context, client: Client, requestedScope: S | undefined, user: unknown, authentication?: AuthenticationRequest) => Promise<{
     approved: boolean;
     scope?: S;
 } | Response>;

package/dist/adapters/hono/authorization-server.js

@@ -104,9 +104,9 @@ export class HonoAuthorizationServer extends AuthorizationServer {
     authorizeHandler(options) {
         const { authenticateUser, handleConsent } = options;
         return (c) => {
-            const auth = () => authenticateUser(c);
+            const auth = (_request, authentication) => authenticateUser(c, authentication);
             const consent = handleConsent
-                ? (client, requestedScope, user) => handleConsent(c, client, requestedScope, user)
+                ? (client, requestedScope, user, authentication) => handleConsent(c, client, requestedScope, user, authentication)
                 : undefined;
             return this.handleAuthorizeRequest(c.req.raw, auth, consent);
         };

package/dist/adapters/hono/bff/bff.d.ts

@@ -296,7 +296,9 @@ export interface BffCallbackError {
      * `resolveOrigin` threw, so `iss` could not be checked; the description is
      * fixed and the failure is in `cause`), or `invalid_grant`
      * (the code exchange failed — expired/replayed code, unknown `state` — or
-     * a later step threw: `resolveUser` or the session store).
+     * a later step threw: `resolveUser` or the session store), or
+     * `login_required` (a pinned `max_age` and an ID token whose `auth_time`
+     * does not satisfy it — see {@link HonoBffOptions.extraParams}).
      */
     error: string;
     /** Human-readable description; never contains secrets. */
@@ -514,7 +516,18 @@ export interface HonoBffOptions {
      * value, name it in {@link forwardedParams} instead.
      *
      * `prompt` is an ordinary name here — pin `{ prompt: "login" }` to make
-     * every sign-in re-authenticate. A pinned `scope` is accepted only when
+     * every sign-in re-authenticate. A pinned `max_age` must be a non-negative
+     * integer, and `/auth/callback` then checks the ID token's `auth_time`
+     * (OpenID Connect Core §3.1.3.7): a sign-in whose `auth_time` is missing,
+     * more than 60 seconds in the future, or older than `max_age` plus those
+     * 60 seconds (an allowance for clock skew between the BFF and the
+     * authorization server) fails with
+     * `login_required`. `max_age=0` means `prompt=login`, so it needs
+     * `auth_time` but no particular age. A token response without an ID token
+     * is not checked, unless {@link HonoBffOptions.forwardedParams} names
+     * `scope`: the browser could then leave out `openid` to skip the check, so
+     * a missing ID token fails with `login_required` too. A pinned `scope` is
+     * accepted only when
      * {@link scope} is unset; setting both would leave which one applies
      * ambiguous. Either configuration supplies the scope the login flow records
      * for its authorization request.
@@ -744,9 +757,10 @@ export declare class HonoBff {
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed
      * form (`" state"` and `"organization "` are refused rather than trimmed),
-     * names the same parameter in both, or pins `scope` in
+     * names the same parameter in both, pins `scope` in
      * {@linkcode HonoBffOptions.extraParams} while
-     * {@linkcode HonoBffOptions.scope} is also set.
+     * {@linkcode HonoBffOptions.scope} is also set, or pins a `max_age` that is
+     * not a non-negative integer.
      */
     constructor(options: HonoBffOptions);
     /**

package/dist/adapters/hono/bff/bff.js

@@ -150,6 +150,47 @@ const RESERVED_AUTHORIZE_PARAMS = [
     "request_uri",
 ];
 const RESERVED_AUTHORIZE_PARAM_SET = new Set(RESERVED_AUTHORIZE_PARAMS);
+const AUTH_TIME_LEEWAY_SECONDS = 60;
+function pinnedMaxAge(fixed) {
+    let strictest;
+    for (const [name, value] of Object.entries(fixed)) {
+        if (name.toLowerCase() !== "max_age" || value === "")
+            continue;
+        const seconds = Number(value);
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(seconds)) {
+            throw new Error(`extraParams pins ${JSON.stringify(name)} to ${JSON.stringify(value)}, ` +
+                "which is not a non-negative integer number of seconds. The " +
+                "authorization server refuses such a max_age, and the callback " +
+                "could not check the ID token's auth_time against it.");
+        }
+        strictest =
+            strictest === undefined ? seconds : Math.min(strictest, seconds);
+    }
+    return strictest;
+}
+class CallbackRefusal extends Error {
+    refusal;
+    constructor(refusal) {
+        super(refusal.error_description);
+        this.refusal = refusal;
+    }
+}
+function authTimeShortfall(claims, maxAge, now) {
+    const authTime = typeof claims === "object" && claims !== null
+        ? claims.auth_time
+        : undefined;
+    if (typeof authTime !== "number" || !Number.isFinite(authTime)) {
+        return "the ID token has no auth_time, which the max_age this sign-in requested requires";
+    }
+    const age = Math.floor(now / 1000) - authTime;
+    if (age < -AUTH_TIME_LEEWAY_SECONDS) {
+        return "the ID token's auth_time is in the future";
+    }
+    if (maxAge > 0 && age > maxAge + AUTH_TIME_LEEWAY_SECONDS) {
+        return "the ID token's auth_time is older than the max_age this sign-in requested";
+    }
+    return undefined;
+}
 function assertUsableAuthorizeParamName(name, option) {
     if (name === "" || name !== name.trim()) {
         throw new Error(`${option} may not use ${JSON.stringify(name)} as an ` +
@@ -207,7 +248,12 @@ function resolveExtraAuthorizeParams(options) {
                 "alone.");
         }
     }
-    return { fixed, forwarded };
+    return {
+        fixed,
+        forwarded,
+        maxAge: pinnedMaxAge(fixed),
+        scopeForwarded: forwarded.some((name) => name.toLowerCase() === "scope"),
+    };
 }
 function authorizeParamsForRequest(resolved, requestParams) {
     const entries = Object.entries(resolved.fixed);
@@ -365,9 +411,10 @@ export class HonoBff {
      * {@linkcode HonoBffOptions.forwardedParams} names a reserved authorize
      * parameter, gives one a name that is empty or not equal to its trimmed
      * form (`" state"` and `"organization "` are refused rather than trimmed),
-     * names the same parameter in both, or pins `scope` in
+     * names the same parameter in both, pins `scope` in
      * {@linkcode HonoBffOptions.extraParams} while
-     * {@linkcode HonoBffOptions.scope} is also set.
+     * {@linkcode HonoBffOptions.scope} is also set, or pins a `max_age` that is
+     * not a non-negative integer.
      */
     constructor(options) {
         assertStoresConfigured(options);
@@ -737,6 +784,23 @@ export class HonoBff {
                 let user = null;
                 let sid;
                 const idToken = raw.id_token;
+                const { maxAge, scopeForwarded } = this.#extraAuthorizeParams;
+                if (maxAge !== undefined && (idToken || scopeForwarded)) {
+                    let claims;
+                    try {
+                        claims = idToken ? this.#client.decodeIdToken(idToken) : undefined;
+                    }
+                    catch {
+                        claims = undefined;
+                    }
+                    const shortfall = authTimeShortfall(claims, maxAge, Date.now());
+                    if (shortfall) {
+                        throw new CallbackRefusal({
+                            error: "login_required",
+                            error_description: shortfall,
+                        });
+                    }
+                }
                 if (idToken) {
                     try {
                         const claims = this.#client.decodeIdToken(idToken);
@@ -774,6 +838,8 @@ export class HonoBff {
                 return c.redirect(this.#safeReturnTo(returnTo));
             }
             catch (cause) {
+                if (cause instanceof CallbackRefusal)
+                    return await fail(cause.refusal);
                 return await fail({
                     error: "invalid_grant",
                     error_description: "code exchange failed",

package/dist/cli/idp/server.js

@@ -21,6 +21,7 @@ import { AuthorizationCodeGrant } from "../../server/grants/authorization-code.j
 import { ClientCredentialsGrant } from "../../server/grants/client-credentials.js";
 import { PasswordGrant } from "../../server/grants/password.js";
 import { RefreshTokenGrant } from "../../server/grants/refresh-token.js";
+import { satisfiesAuthenticationRequest } from "../../server/authentication-request.js";
 import { StaticSigningKeyProvider, } from "../../server/signing-keys.js";
 import { generateCodeChallenge, generateCodeVerifier, generateState, } from "../../utils/pkce.js";
 import { DEFAULT_MAX_BODY_BYTES, readBoundedBody } from "../../utils/_body.js";
@@ -43,6 +44,14 @@ const WILDCARD_HOSTNAMES = new Set(["0.0.0.0", "::", "[::]"]);
 export function isLoopbackHostname(hostname) {
     return LOOPBACK_HOSTNAMES.has(hostname) || hostname.startsWith("127.");
 }
+const REAUTHENTICATION_WINDOW_SECONDS = 600;
+function newSession(userId, signedInFor) {
+    return {
+        userId,
+        authTime: Math.floor(Date.now() / 1000),
+        ...(signedInFor === undefined ? {} : { signedInFor }),
+    };
+}
 async function createState(config, signingKey, issuer) {
     const userService = new MemoryUserService();
     const clientService = new MemoryClientService(userService);
@@ -181,21 +190,33 @@ function formValue(form, name) {
     const value = form.get(name);
     return typeof value === "string" ? value : undefined;
 }
-async function currentUser(state, request) {
+function currentSession(state, request) {
     const sessionId = readCookie(request, SESSION_COOKIE);
-    if (!sessionId)
-        return undefined;
-    const userId = state.sessions.get(sessionId);
-    if (!userId)
-        return undefined;
-    return await state.userService.get(userId);
+    return sessionId ? state.sessions.get(sessionId) : undefined;
+}
+async function currentUser(state, request) {
+    const session = currentSession(state, request);
+    return session ? await state.userService.get(session.userId) : undefined;
 }
 function authenticateUserFor(state, config, request) {
-    return async () => {
-        const user = await currentUser(state, request);
-        if (user)
-            return { user };
-        return htmlResponse(loginPage({ returnTo: pathAndQuery(request), users: config.users }));
+    return async (_request, authentication) => {
+        const returnTo = pathAndQuery(request);
+        const session = currentSession(state, request);
+        const user = session && (await state.userService.get(session.userId));
+        if (session && user) {
+            const result = {
+                user,
+                authenticationContext: { auth_time: session.authTime },
+                reauthenticated: session.signedInFor === returnTo &&
+                    Math.floor(Date.now() / 1000) - session.authTime <=
+                        REAUTHENTICATION_WINDOW_SECONDS,
+            };
+            if (!authentication ||
+                satisfiesAuthenticationRequest(authentication, result)) {
+                return result;
+            }
+        }
+        return htmlResponse(loginPage({ returnTo, users: config.users }));
     };
 }
 function handleConsentFor(state, request) {
@@ -258,7 +279,7 @@ async function handleLoginSubmission(state, config, request) {
         return htmlResponse(loginPage({ returnTo, users: config.users, error }), 401);
     }
     const sessionId = crypto.randomUUID();
-    state.sessions.set(sessionId, user.id);
+    state.sessions.set(sessionId, newSession(user.id, returnTo));
     return redirect(returnTo, {
         "set-cookie": cookie(SESSION_COOKIE, sessionId),
     });
@@ -334,7 +355,7 @@ async function handleAdminSession(state, request) {
         return jsonError(400, 'no seeded user matched "userId" or "username"');
     }
     const sessionId = crypto.randomUUID();
-    state.sessions.set(sessionId, user.id);
+    state.sessions.set(sessionId, newSession(user.id));
     return new Response(JSON.stringify({
         sessionId,
         cookie: SESSION_COOKIE,

package/dist/client/_http.d.ts

@@ -6,11 +6,16 @@
  *
  * @module
  */
-import { type OAuth2Error } from "../errors.ts";
+import { type OAuth2Error, type OAuth2ErrorClass as OAuth2ErrorClassType } from "../errors.ts";
 /** Response bytes accepted from an endpoint before the call is refused. */
 export declare const MAX_RESPONSE_BYTES: number;
 /** Wall-clock budget for one call, covering the connect and the body read. */
 export declare const REQUEST_TIMEOUT_MS = 10000;
+/**
+ * The typed error class for an OAuth2 or OpenID Connect error code, or the
+ * generic `OAuth2Error` for a code without one.
+ */
+export declare function errorClassForCode(code: string): OAuth2ErrorClassType;
 /** How a call describes itself in an error message, e.g. `"token endpoint"`. */
 export type Endpoint = string;
 /** How {@link sendGuarded} treats a `3xx`. */

package/dist/client/_http.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { AccessDeniedError, AuthorizationPendingError, ExpiredTokenError, InsufficientScopeError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, OAuth2Error as OAuth2ErrorClass, ServerError, SlowDownError, TemporarilyUnavailableError, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";
+import { AccessDeniedError, AccountSelectionRequiredError, AuthorizationPendingError, ConsentRequiredError, ExpiredTokenError, InsufficientScopeError, InteractionRequiredError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, LoginRequiredError, OAuth2Error as OAuth2ErrorClass, ServerError, SlowDownError, TemporarilyUnavailableError, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";
 import { packageDeadlineSignal } from "../utils/_default-fetch.js";
 import { sanitizeProviderText } from "../utils/text.js";
 /** Response bytes accepted from an endpoint before the call is refused. */
@@ -15,14 +15,18 @@ export const MAX_RESPONSE_BYTES = 64 * 1024;
 export const REQUEST_TIMEOUT_MS = 10_000;
 const ERROR_CLASS_BY_CODE = {
     access_denied: AccessDeniedError,
+    account_selection_required: AccountSelectionRequiredError,
     authorization_pending: AuthorizationPendingError,
+    consent_required: ConsentRequiredError,
     expired_token: ExpiredTokenError,
     insufficient_scope: InsufficientScopeError,
+    interaction_required: InteractionRequiredError,
     invalid_client: InvalidClientError,
     invalid_grant: InvalidGrantError,
     invalid_request: InvalidRequestError,
     invalid_scope: InvalidScopeError,
     invalid_token: InvalidTokenError,
+    login_required: LoginRequiredError,
     server_error: ServerError,
     slow_down: SlowDownError,
     temporarily_unavailable: TemporarilyUnavailableError,
@@ -31,6 +35,15 @@ const ERROR_CLASS_BY_CODE = {
     unsupported_response_type: UnsupportedResponseTypeError,
     unsupported_token_type: UnsupportedTokenTypeError,
 };
+/**
+ * The typed error class for an OAuth2 or OpenID Connect error code, or the
+ * generic `OAuth2Error` for a code without one.
+ */
+export function errorClassForCode(code) {
+    return Object.hasOwn(ERROR_CLASS_BY_CODE, code)
+        ? ERROR_CLASS_BY_CODE[code]
+        : OAuth2ErrorClass;
+}
 /**
  * Sends one request with a deadline.
  *
@@ -228,7 +241,7 @@ function reportedError(value) {
     };
 }
 function buildError(reported, status) {
-    const ErrorClass = ERROR_CLASS_BY_CODE[reported.error] ?? OAuth2ErrorClass;
+    const ErrorClass = errorClassForCode(reported.error);
     return new ErrorClass(reported.description ?? reported.error, {
         status: status !== undefined && status >= 400 ? status : undefined,
         extensions: {

package/dist/client/_issuer-refusal.d.ts

@@ -1,3 +1,10 @@
 import { type OAuth2Error } from "../errors.ts";
 export declare function issuerRefusal(message: string): OAuth2Error;
 export declare function isIssuerRefusal(error: unknown): error is OAuth2Error;
+export declare const DUPLICATE_ISS_PROBLEM = "the authorization response carries more than one `iss` (RFC 9207)";
+/**
+ * Why an authorization response's `iss` values (RFC 9207 §2.4) are refused, or
+ * `undefined` when they are accepted: more than one value, none when
+ * `required`, or one that is not exactly one of `accepted`.
+ */
+export declare function authorizationResponseIssuerProblem(received: readonly string[], accepted: readonly string[], required: boolean): string | undefined;

package/dist/client/_issuer-refusal.js

@@ -8,3 +8,25 @@ export function issuerRefusal(message) {
 export function isIssuerRefusal(error) {
     return error instanceof Error && refusals.has(error);
 }
+export const DUPLICATE_ISS_PROBLEM = "the authorization response carries more than one `iss` (RFC 9207)";
+/**
+ * Why an authorization response's `iss` values (RFC 9207 §2.4) are refused, or
+ * `undefined` when they are accepted: more than one value, none when
+ * `required`, or one that is not exactly one of `accepted`.
+ */
+export function authorizationResponseIssuerProblem(received, accepted, required) {
+    if (received.length > 1)
+        return DUPLICATE_ISS_PROBLEM;
+    const [iss] = received;
+    if (iss === undefined) {
+        if (!required)
+            return undefined;
+        return ("the authorization response is missing `iss`, which the issuer " +
+            "advertises with `authorization_response_iss_parameter_supported` " +
+            "(RFC 9207 §2.4)");
+    }
+    if (accepted.includes(iss))
+        return undefined;
+    return ("the authorization response `iss` does not match the issuer the " +
+        "request was sent to (RFC 9207 §2.4)");
+}

package/dist/client/direct-client.d.ts

@@ -423,7 +423,8 @@ export declare class DirectClient extends OAuth2ClientBase {
      * reached or its response does not arrive in full before the deadline;
      * `cause` is the transport failure.
      * @throws {OAuth2Error} when the callback carries `?error=…`, or the token
-     * exchange fails.
+     * exchange fails. A code with a typed class, such as `login_required`
+     * (`LoginRequiredError`), is thrown as that class.
      * @throws {InvalidRequestError} when the response's `iss` is refused.
      * @throws {TypeError} when `code` or `state` is missing, or outside a
      * browser when the client has no `authRequestStorage` or no

package/dist/client/direct-client.js

@@ -10,16 +10,16 @@
  *
  * @module
  */
-import { AccessDeniedError, InvalidGrantError, isOAuth2Error, OAuth2Error as OAuth2ErrorClass, ServerError, } from "../errors.js";
+import { AccessDeniedError, InvalidGrantError, isOAuth2Error, ServerError, } from "../errors.js";
 import { challengeMethods, generateCodeVerifier, generateState, } from "../utils/pkce.js";
 import { encodeBasicAuth } from "../utils/basic-auth.js";
 import { base64urlDecode } from "../utils/crypto.js";
 import { delay } from "../utils/_delay.js";
 import { sanitizeProviderText } from "../utils/text.js";
-import { assertField, assertTokenResponse, errorFromResponse, receiveJson, sendGuarded, } from "./_http.js";
+import { assertField, assertTokenResponse, errorClassForCode, errorFromResponse, receiveJson, sendGuarded, } from "./_http.js";
 import { mergedHeaders, OAuth2ClientBase, SIGNED_OUT, } from "./base.js";
 import { SessionStorageAuthRequestStorage } from "./browser-storage.js";
-import { issuerRefusal } from "./_issuer-refusal.js";
+import { authorizationResponseIssuerProblem, issuerRefusal, } from "./_issuer-refusal.js";
 import { DEFAULT_DISCOVERY_TTL_MS, } from "./discovery-cache.js";
 import { MemoryAuthRequestStorage, MemoryRefreshTokenStorage, MemoryTokenStorage, } from "./storage.js";
 const REFRESH_SKEW_MS = 30_000;
@@ -396,7 +396,8 @@ export class DirectClient extends OAuth2ClientBase {
      * reached or its response does not arrive in full before the deadline;
      * `cause` is the transport failure.
      * @throws {OAuth2Error} when the callback carries `?error=…`, or the token
-     * exchange fails.
+     * exchange fails. A code with a typed class, such as `login_required`
+     * (`LoginRequiredError`), is thrown as that class.
      * @throws {InvalidRequestError} when the response's `iss` is refused.
      * @throws {TypeError} when `code` or `state` is missing, or outside a
      * browser when the client has no `authRequestStorage` or no
@@ -501,26 +502,11 @@ export class DirectClient extends OAuth2ClientBase {
         if (!this.#issuer)
             return undefined;
         const metadata = await this.discover();
-        const received = params.getAll("iss");
-        if (received.length > 1) {
-            return issuerRefusal("the authorization response carries more than one `iss` (RFC 9207)");
-        }
-        const [iss] = received;
-        if (iss === undefined) {
-            if (metadata.authorization_response_iss_parameter_supported !== true) {
-                return undefined;
-            }
-            return issuerRefusal("the authorization response is missing `iss`, which the issuer " +
-                "advertises with `authorization_response_iss_parameter_supported` " +
-                "(RFC 9207 §2.4)");
-        }
         const accepted = [metadata.issuer];
         if (origin)
             accepted.push(issuerAtOrigin(metadata.issuer, origin));
-        if (accepted.includes(iss))
-            return undefined;
-        return issuerRefusal("the authorization response `iss` does not match the issuer the " +
-            "request was sent to (RFC 9207 §2.4)");
+        const problem = authorizationResponseIssuerProblem(params.getAll("iss"), accepted, metadata.authorization_response_iss_parameter_supported === true);
+        return problem === undefined ? undefined : issuerRefusal(problem);
     }
     /**
      * **Advanced (BFF / multi-session servers).** SPA, mobile, and CLI consumers
@@ -1322,7 +1308,8 @@ function metadataToEndpoints(meta) {
 }
 function authorizationResponseError(error, params) {
     const description = params.get("error_description") ?? undefined;
-    return new OAuth2ErrorClass(description ?? "authorization error", {
+    const ErrorClass = errorClassForCode(error);
+    return new ErrorClass(description ?? "authorization error", {
         extensions: {
             error,
             error_description: description,

package/dist/errors.d.ts

@@ -6,6 +6,7 @@
  * - RFC 6749 Section 5.2 (Token errors)
  * - RFC 6750 Section 3.1 (Bearer token errors)
  * - RFC 8628 Section 3.5 (Device flow errors)
+ * - OpenID Connect Core 1.0 Section 3.1.2.6 (Authentication errors)
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
@@ -204,3 +205,36 @@ export declare const SlowDownError: OAuth2ErrorClass;
  * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
  */
 export declare const ExpiredTokenError: OAuth2ErrorClass;
+/**
+ * The authorization request requires the user to authenticate, and the server
+ * cannot show a login page (`prompt=none`) or cannot re-authenticate the user
+ * as `prompt=login` or `max_age` requires.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export declare const LoginRequiredError: OAuth2ErrorClass;
+/**
+ * The authorization request requires the user's consent, and the server
+ * cannot obtain it: `prompt=none` forbids the consent page, or `prompt=consent`
+ * reached a server with no consent handler.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export declare const ConsentRequiredError: OAuth2ErrorClass;
+/**
+ * The authorization request requires user interaction other than login or
+ * consent, and `prompt=none` forbids showing it. Throw it from
+ * `authenticateUser` or `handleConsent` for an interstitial the request
+ * cannot skip.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export declare const InteractionRequiredError: OAuth2ErrorClass;
+/**
+ * The user must choose among several accounts and the server cannot ask:
+ * `prompt=none` with more than one signed-in account, or `prompt=select_account`
+ * that the application cannot honor.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export declare const AccountSelectionRequiredError: OAuth2ErrorClass;

package/dist/errors.js

@@ -6,6 +6,7 @@
  * - RFC 6749 Section 5.2 (Token errors)
  * - RFC 6750 Section 3.1 (Bearer token errors)
  * - RFC 8628 Section 3.5 (Device flow errors)
+ * - OpenID Connect Core 1.0 Section 3.1.2.6 (Authentication errors)
  *
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
  * @see https://datatracker.ietf.org/doc/html/rfc6750#section-3.1
@@ -286,3 +287,60 @@ export const ExpiredTokenError = createHttpErrorClass({
         error: "expired_token",
     },
 });
+/**
+ * The authorization request requires the user to authenticate, and the server
+ * cannot show a login page (`prompt=none`) or cannot re-authenticate the user
+ * as `prompt=login` or `max_age` requires.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export const LoginRequiredError = createHttpErrorClass({
+    name: "Login Required",
+    status: 400,
+    extensions: {
+        error: "login_required",
+    },
+});
+/**
+ * The authorization request requires the user's consent, and the server
+ * cannot obtain it: `prompt=none` forbids the consent page, or `prompt=consent`
+ * reached a server with no consent handler.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export const ConsentRequiredError = createHttpErrorClass({
+    name: "Consent Required",
+    status: 400,
+    extensions: {
+        error: "consent_required",
+    },
+});
+/**
+ * The authorization request requires user interaction other than login or
+ * consent, and `prompt=none` forbids showing it. Throw it from
+ * `authenticateUser` or `handleConsent` for an interstitial the request
+ * cannot skip.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export const InteractionRequiredError = createHttpErrorClass({
+    name: "Interaction Required",
+    status: 400,
+    extensions: {
+        error: "interaction_required",
+    },
+});
+/**
+ * The user must choose among several accounts and the server cannot ask:
+ * `prompt=none` with more than one signed-in account, or `prompt=select_account`
+ * that the application cannot honor.
+ *
+ * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError
+ */
+export const AccountSelectionRequiredError = createHttpErrorClass({
+    name: "Account Selection Required",
+    status: 400,
+    extensions: {
+        error: "account_selection_required",
+    },
+});