@udibo/oauth2 0.28.0 → 0.29.0

package/dist/server/authorization-server.d.ts

@@ -678,6 +678,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * authenticate through the same implementation, so a request that fails here
      * fails identically at the token endpoint.
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method (RFC 6749 Section 2.3)
      * @throws {InvalidClientError} If client authentication fails
      */
     authenticateClient(request: Request, body: FormData, services: AuthorizationServerServices<Client, User, S>): Promise<Client>;

package/dist/server/authorization-server.js

@@ -970,6 +970,8 @@ export class AuthorizationServer extends ResourceServer {
      * authenticate through the same implementation, so a request that fails here
      * fails identically at the token endpoint.
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method (RFC 6749 Section 2.3)
      * @throws {InvalidClientError} If client authentication fails
      */
     async authenticateClient(request, body, services) {

package/dist/server/client-authentication.d.ts

@@ -9,13 +9,19 @@
 import type { ClientCredentials, ClientInterface } from "../models/client.ts";
 import type { ClientServiceInterface } from "./services/client.ts";
 /**
- * Reads the credentials a request presents: HTTP Basic first (RFC 6749 Section
- * 2.3.1), then `client_id`/`client_secret` in `body`, the form body the
- * endpoint already parsed. An `Authorization` header that is not usable Basic
- * falls through to the body, so a request that also carries body credentials
- * authenticates by the method it did present.
+ * Reads the credentials a request presents by the one client-authentication
+ * method it uses: HTTP Basic (RFC 6749 Section 2.3.1), or
+ * `client_id`/`client_secret` in `body`, the form body the endpoint already
+ * parsed. A `client_id` alone identifies a public client. An `Authorization`
+ * header with a scheme other than Basic is not client authentication and is
+ * ignored.
  *
- * @throws {InvalidClientError} If the request presents no usable credentials.
+ * @throws {InvalidRequestError} If the request uses more than one method —
+ *   Basic plus a body `client_secret` or a `client_assertion`, or a body
+ *   `client_secret` plus a `client_assertion` — or sends Basic credentials
+ *   with a body `client_id` naming a different client.
+ * @throws {InvalidClientError} If the request presents no usable credentials,
+ *   or its Basic header is malformed.
  */
 export declare function extractClientCredentials(request: Request, body: FormData): ClientCredentials;
 /**

package/dist/server/client-authentication.js

@@ -6,34 +6,54 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
  * @module
  */
-import { InvalidClientError } from "../errors.js";
-import { parseBasicAuth, tryParseBasicAuth } from "../utils/basic-auth.js";
+import { InvalidClientError, InvalidRequestError } from "../errors.js";
+import { parseBasicAuth } from "../utils/basic-auth.js";
+const BASIC_SCHEME = /(?:^|,)[ \t]*basic(?:[ \t]|$)/i;
 /**
- * Reads the credentials a request presents: HTTP Basic first (RFC 6749 Section
- * 2.3.1), then `client_id`/`client_secret` in `body`, the form body the
- * endpoint already parsed. An `Authorization` header that is not usable Basic
- * falls through to the body, so a request that also carries body credentials
- * authenticates by the method it did present.
+ * Reads the credentials a request presents by the one client-authentication
+ * method it uses: HTTP Basic (RFC 6749 Section 2.3.1), or
+ * `client_id`/`client_secret` in `body`, the form body the endpoint already
+ * parsed. A `client_id` alone identifies a public client. An `Authorization`
+ * header with a scheme other than Basic is not client authentication and is
+ * ignored.
  *
- * @throws {InvalidClientError} If the request presents no usable credentials.
+ * @throws {InvalidRequestError} If the request uses more than one method —
+ *   Basic plus a body `client_secret` or a `client_assertion`, or a body
+ *   `client_secret` plus a `client_assertion` — or sends Basic credentials
+ *   with a body `client_id` naming a different client.
+ * @throws {InvalidClientError} If the request presents no usable credentials,
+ *   or its Basic header is malformed.
  */
 export function extractClientCredentials(request, body) {
     const authorization = request.headers.get("authorization");
-    const basicAuth = tryParseBasicAuth(authorization);
-    if (basicAuth) {
+    const usesBasic = !!authorization && BASIC_SCHEME.test(authorization);
+    const clientId = body.get("client_id");
+    const clientSecret = body.get("client_secret");
+    const methods = [
+        usesBasic,
+        clientSecret !== null,
+        body.has("client_assertion") || body.has("client_assertion_type"),
+    ].filter(Boolean).length;
+    if (methods > 1) {
+        throw new InvalidRequestError("multiple client authentication methods");
+    }
+    if (usesBasic) {
+        const basicAuth = parseBasicAuth(authorization);
+        if (clientId !== null && clientId !== basicAuth.name) {
+            throw new InvalidRequestError("client_id does not match the Basic credentials");
+        }
         return { clientId: basicAuth.name, clientSecret: basicAuth.pass };
     }
-    const clientId = body.get("client_id");
     if (typeof clientId === "string") {
         const credentials = { clientId };
-        const clientSecret = body.get("client_secret");
         if (typeof clientSecret === "string") {
             credentials.clientSecret = clientSecret;
         }
         return credentials;
     }
-    if (authorization)
-        throw parseBasicAuth(authorization);
+    if (authorization) {
+        throw new InvalidClientError("unsupported authorization header");
+    }
     throw new InvalidClientError("client authentication required");
 }
 /**

package/dist/server/grants/grant.d.ts

@@ -116,11 +116,13 @@ export declare abstract class AbstractGrant<Client extends ClientInterface, User
      */
     acceptedScope(client: Client, user: User | undefined, scope: Scope | null | undefined, tokenService: TokenServiceInterface<Client, User, Scope>): Promise<Scope | null | undefined>;
     /**
-     * Extracts client credentials from a request: HTTP Basic first, then the
-     * `client_id`/`client_secret` of the already-parsed `body`. Override to add
-     * grant-specific credential rules (as the authorization-code grant does for
-     * PKCE).
+     * Extracts client credentials from a request by the one method it uses: HTTP
+     * Basic, or the `client_id`/`client_secret` of the already-parsed `body`.
+     * Override to add grant-specific credential rules (as the authorization-code
+     * grant does for PKCE).
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method.
      * @throws {InvalidClientError} If the request presents no usable credentials.
      */
     protected getClientCredentials(request: Request, body: FormData): ClientCredentials;

package/dist/server/grants/grant.js

@@ -70,11 +70,13 @@ export class AbstractGrant {
         return acceptedScope ?? scope;
     }
     /**
-     * Extracts client credentials from a request: HTTP Basic first, then the
-     * `client_id`/`client_secret` of the already-parsed `body`. Override to add
-     * grant-specific credential rules (as the authorization-code grant does for
-     * PKCE).
+     * Extracts client credentials from a request by the one method it uses: HTTP
+     * Basic, or the `client_id`/`client_secret` of the already-parsed `body`.
+     * Override to add grant-specific credential rules (as the authorization-code
+     * grant does for PKCE).
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method.
      * @throws {InvalidClientError} If the request presents no usable credentials.
      */
     getClientCredentials(request, body) {

package/dist/utils/pkce.d.ts

@@ -113,6 +113,9 @@ export declare function validateCodeChallenge(challenge: string, method?: string
  * own, callable properties of `methods` resolve here; every other name is
  * `undefined`, including names inherited from a prototype.
  *
+ * An omitted method means `S256`, deliberately not RFC 7636 §4.3's `plain`,
+ * following OAuth 2.1.
+ *
  * @param methods The challenge methods the server allows
  * @param method The client-supplied method name; defaults to `S256`
  * @returns The transform for that method, or `undefined` when it is not allowed

package/dist/utils/pkce.js

@@ -127,6 +127,9 @@ export function validateCodeChallenge(challenge, method) {
  * own, callable properties of `methods` resolve here; every other name is
  * `undefined`, including names inherited from a prototype.
  *
+ * An omitted method means `S256`, deliberately not RFC 7636 §4.3's `plain`,
+ * following OAuth 2.1.
+ *
  * @param methods The challenge methods the server allows
  * @param method The client-supplied method name; defaults to `S256`
  * @returns The transform for that method, or `undefined` when it is not allowed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",