@udibo/oauth2 0.28.0 → 0.30.0

package/dist/server/authorization-server.d.ts

@@ -678,6 +678,8 @@ export declare class AuthorizationServer<Client extends ClientInterface, User, S
      * authenticate through the same implementation, so a request that fails here
      * fails identically at the token endpoint.
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method (RFC 6749 Section 2.3)
      * @throws {InvalidClientError} If client authentication fails
      */
     authenticateClient(request: Request, body: FormData, services: AuthorizationServerServices<Client, User, S>): Promise<Client>;

package/dist/server/authorization-server.js

@@ -970,6 +970,8 @@ export class AuthorizationServer extends ResourceServer {
      * authenticate through the same implementation, so a request that fails here
      * fails identically at the token endpoint.
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method (RFC 6749 Section 2.3)
      * @throws {InvalidClientError} If client authentication fails
      */
     async authenticateClient(request, body, services) {

package/dist/server/client-authentication.d.ts

@@ -9,13 +9,19 @@
 import type { ClientCredentials, ClientInterface } from "../models/client.ts";
 import type { ClientServiceInterface } from "./services/client.ts";
 /**
- * Reads the credentials a request presents: HTTP Basic first (RFC 6749 Section
- * 2.3.1), then `client_id`/`client_secret` in `body`, the form body the
- * endpoint already parsed. An `Authorization` header that is not usable Basic
- * falls through to the body, so a request that also carries body credentials
- * authenticates by the method it did present.
+ * Reads the credentials a request presents by the one client-authentication
+ * method it uses: HTTP Basic (RFC 6749 Section 2.3.1), or
+ * `client_id`/`client_secret` in `body`, the form body the endpoint already
+ * parsed. A `client_id` alone identifies a public client. An `Authorization`
+ * header with a scheme other than Basic is not client authentication and is
+ * ignored.
  *
- * @throws {InvalidClientError} If the request presents no usable credentials.
+ * @throws {InvalidRequestError} If the request uses more than one method —
+ *   Basic plus a body `client_secret` or a `client_assertion`, or a body
+ *   `client_secret` plus a `client_assertion` — or sends Basic credentials
+ *   with a body `client_id` naming a different client.
+ * @throws {InvalidClientError} If the request presents no usable credentials,
+ *   or its Basic header is malformed.
  */
 export declare function extractClientCredentials(request: Request, body: FormData): ClientCredentials;
 /**

package/dist/server/client-authentication.js

@@ -6,34 +6,54 @@
  * @see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3
  * @module
  */
-import { InvalidClientError } from "../errors.js";
-import { parseBasicAuth, tryParseBasicAuth } from "../utils/basic-auth.js";
+import { InvalidClientError, InvalidRequestError } from "../errors.js";
+import { parseBasicAuth } from "../utils/basic-auth.js";
+const BASIC_SCHEME = /(?:^|,)[ \t]*basic(?:[ \t]|$)/i;
 /**
- * Reads the credentials a request presents: HTTP Basic first (RFC 6749 Section
- * 2.3.1), then `client_id`/`client_secret` in `body`, the form body the
- * endpoint already parsed. An `Authorization` header that is not usable Basic
- * falls through to the body, so a request that also carries body credentials
- * authenticates by the method it did present.
+ * Reads the credentials a request presents by the one client-authentication
+ * method it uses: HTTP Basic (RFC 6749 Section 2.3.1), or
+ * `client_id`/`client_secret` in `body`, the form body the endpoint already
+ * parsed. A `client_id` alone identifies a public client. An `Authorization`
+ * header with a scheme other than Basic is not client authentication and is
+ * ignored.
  *
- * @throws {InvalidClientError} If the request presents no usable credentials.
+ * @throws {InvalidRequestError} If the request uses more than one method —
+ *   Basic plus a body `client_secret` or a `client_assertion`, or a body
+ *   `client_secret` plus a `client_assertion` — or sends Basic credentials
+ *   with a body `client_id` naming a different client.
+ * @throws {InvalidClientError} If the request presents no usable credentials,
+ *   or its Basic header is malformed.
  */
 export function extractClientCredentials(request, body) {
     const authorization = request.headers.get("authorization");
-    const basicAuth = tryParseBasicAuth(authorization);
-    if (basicAuth) {
+    const usesBasic = !!authorization && BASIC_SCHEME.test(authorization);
+    const clientId = body.get("client_id");
+    const clientSecret = body.get("client_secret");
+    const methods = [
+        usesBasic,
+        clientSecret !== null,
+        body.has("client_assertion") || body.has("client_assertion_type"),
+    ].filter(Boolean).length;
+    if (methods > 1) {
+        throw new InvalidRequestError("multiple client authentication methods");
+    }
+    if (usesBasic) {
+        const basicAuth = parseBasicAuth(authorization);
+        if (clientId !== null && clientId !== basicAuth.name) {
+            throw new InvalidRequestError("client_id does not match the Basic credentials");
+        }
         return { clientId: basicAuth.name, clientSecret: basicAuth.pass };
     }
-    const clientId = body.get("client_id");
     if (typeof clientId === "string") {
         const credentials = { clientId };
-        const clientSecret = body.get("client_secret");
         if (typeof clientSecret === "string") {
             credentials.clientSecret = clientSecret;
         }
         return credentials;
     }
-    if (authorization)
-        throw parseBasicAuth(authorization);
+    if (authorization) {
+        throw new InvalidClientError("unsupported authorization header");
+    }
     throw new InvalidClientError("client authentication required");
 }
 /**

package/dist/server/grants/grant.d.ts

@@ -116,11 +116,13 @@ export declare abstract class AbstractGrant<Client extends ClientInterface, User
      */
     acceptedScope(client: Client, user: User | undefined, scope: Scope | null | undefined, tokenService: TokenServiceInterface<Client, User, Scope>): Promise<Scope | null | undefined>;
     /**
-     * Extracts client credentials from a request: HTTP Basic first, then the
-     * `client_id`/`client_secret` of the already-parsed `body`. Override to add
-     * grant-specific credential rules (as the authorization-code grant does for
-     * PKCE).
+     * Extracts client credentials from a request by the one method it uses: HTTP
+     * Basic, or the `client_id`/`client_secret` of the already-parsed `body`.
+     * Override to add grant-specific credential rules (as the authorization-code
+     * grant does for PKCE).
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method.
      * @throws {InvalidClientError} If the request presents no usable credentials.
      */
     protected getClientCredentials(request: Request, body: FormData): ClientCredentials;

package/dist/server/grants/grant.js

@@ -70,11 +70,13 @@ export class AbstractGrant {
         return acceptedScope ?? scope;
     }
     /**
-     * Extracts client credentials from a request: HTTP Basic first, then the
-     * `client_id`/`client_secret` of the already-parsed `body`. Override to add
-     * grant-specific credential rules (as the authorization-code grant does for
-     * PKCE).
+     * Extracts client credentials from a request by the one method it uses: HTTP
+     * Basic, or the `client_id`/`client_secret` of the already-parsed `body`.
+     * Override to add grant-specific credential rules (as the authorization-code
+     * grant does for PKCE).
      *
+     * @throws {InvalidRequestError} If the request uses more than one client
+     *   authentication method.
      * @throws {InvalidClientError} If the request presents no usable credentials.
      */
     getClientCredentials(request, body) {

package/dist/server/jwks-token-reader.d.ts

@@ -2,10 +2,11 @@
  * Token reader that validates JWT access tokens locally against the
  * issuer's published JWKS, with no per-request network hop.
  *
- * This is the validating half of RFC 9068 (`at+jwt`): the authorization
- * server signs access tokens and publishes its public keys at a `jwks_uri`;
- * the resource server fetches those keys once, caches them, and verifies
- * every subsequent token in-process. Signature verification uses Web Crypto
+ * It validates RFC 9068 (`at+jwt`) access tokens: the authorization server
+ * signs access tokens and publishes its public keys at a `jwks_uri`; the
+ * resource server fetches those keys once, caches them, and verifies every
+ * subsequent token in-process, including the `typ` header and every claim
+ * RFC 9068 §2.2 makes REQUIRED. Signature verification uses Web Crypto
  * only — the package takes no JOSE dependency.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc9068
@@ -27,19 +28,25 @@ import type { TokenReaderInterface } from "./services/token.ts";
 export interface JwtAccessTokenClaims {
     /** Issuer that signed the token. Verified against the configured issuer. */
     iss: string;
-    /** Subject — the end user, or the client itself for client-credentials tokens. */
-    sub?: string;
+    /** Subject — the end user, or the client itself for client-credentials tokens. Required. */
+    sub: string;
     /** Audience(s) the token is intended for. Verified against the configured audience. */
     aud: string | string[];
     /** Expiration time, seconds since the epoch. */
     exp: number;
-    /** Issued-at time, seconds since the epoch. */
-    iat?: number;
+    /** Issued-at time, seconds since the epoch. Required. */
+    iat: number;
     /** Not-before time, seconds since the epoch. */
     nbf?: number;
-    /** Unique token identifier. */
+    /**
+     * Unique token identifier. Required unless
+     * {@linkcode JwksTokenReaderOptions.tokenIdClaim} names another claim.
+     */
     jti?: string;
-    /** Client the token was issued to. */
+    /**
+     * Client the token was issued to. Required unless
+     * {@linkcode JwksTokenReaderOptions.clientIdClaim} names another claim.
+     */
     client_id?: string;
     /** Space-delimited granted scopes. */
     scope?: string;
@@ -105,9 +112,18 @@ export interface JwksTokenReaderOptions<Client extends ClientInterface, User, S
      * §2.2 makes `client_id` REQUIRED, and its absence is what tells an
      * `id_token` apart from an access token). Defaults to `"client_id"`; point
      * it at the vendor claim for issuers that deviate — Okta's `cid`, Azure
-     * AD v1's `appid`. There is deliberately no way to drop the requirement.
+     * AD v1's `appid`. The requirement cannot be turned off, but pointing this
+     * at a claim every token carries defeats it.
      */
     clientIdClaim?: string;
+    /**
+     * Claim carrying the unique token identifier, required on every accepted
+     * token (RFC 9068 §2.2 makes `jti` REQUIRED). Defaults to `"jti"`; point it
+     * at the vendor claim for issuers that deviate — Microsoft Entra ID's
+     * `uti`. The requirement cannot be turned off, but pointing this at a claim
+     * every token carries defeats it.
+     */
+    tokenIdClaim?: string;
     /**
      * Leeway in seconds applied to `exp` and `nbf` to absorb clock drift
      * between the issuer and this server. Defaults to 30. Must be finite and
@@ -239,7 +255,8 @@ export declare class JwksTokenReader<Client extends ClientInterface, User, S ext
     #private;
     /**
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
-     * required as `typ`, `client_id` as the required client-id claim, 30
+     * required as `typ`, `client_id` as the required client-id claim, `jti` as
+     * the required token-identifier claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
      * between fetches, a 5-second request deadline, a 256 KiB response cap,
      * {@linkcode BasicScope}, and the global `fetch`.

package/dist/server/jwks-token-reader.js

@@ -2,10 +2,11 @@
  * Token reader that validates JWT access tokens locally against the
  * issuer's published JWKS, with no per-request network hop.
  *
- * This is the validating half of RFC 9068 (`at+jwt`): the authorization
- * server signs access tokens and publishes its public keys at a `jwks_uri`;
- * the resource server fetches those keys once, caches them, and verifies
- * every subsequent token in-process. Signature verification uses Web Crypto
+ * It validates RFC 9068 (`at+jwt`) access tokens: the authorization server
+ * signs access tokens and publishes its public keys at a `jwks_uri`; the
+ * resource server fetches those keys once, caches them, and verifies every
+ * subsequent token in-process, including the `typ` header and every claim
+ * RFC 9068 §2.2 makes REQUIRED. Signature verification uses Web Crypto
  * only — the package takes no JOSE dependency.
  *
  * @see https://datatracker.ietf.org/doc/html/rfc9068
@@ -208,6 +209,7 @@ export class JwksTokenReader {
     #algorithms;
     #types;
     #clientIdClaim;
+    #tokenIdClaim;
     #clockSkewSeconds;
     #cacheMaxAgeMs;
     #minFetchIntervalMs;
@@ -225,7 +227,8 @@ export class JwksTokenReader {
     #inFlight;
     /**
      * Defaults: every Web Crypto asymmetric algorithm accepted, `at+jwt`
-     * required as `typ`, `client_id` as the required client-id claim, 30
+     * required as `typ`, `client_id` as the required client-id claim, `jti` as
+     * the required token-identifier claim, 30
      * seconds of clock skew, a 10-minute cache with a 30-second minimum
      * between fetches, a 5-second request deadline, a 256 KiB response cap,
      * {@linkcode BasicScope}, and the global `fetch`.
@@ -254,6 +257,7 @@ export class JwksTokenReader {
         }
         this.#types = (options.types ?? ["at+jwt"]).map(normalizeType);
         this.#clientIdClaim = options.clientIdClaim ?? "client_id";
+        this.#tokenIdClaim = options.tokenIdClaim ?? "jti";
         this.#clockSkewSeconds = options.clockSkewSeconds ?? 30;
         assertClockSkewSeconds(this.#clockSkewSeconds);
         this.#cacheMaxAgeMs = options.cacheMaxAgeMs ?? 600_000;
@@ -336,9 +340,14 @@ export class JwksTokenReader {
     #validClaims(claims) {
         if (claims.iss !== this.#issuer)
             return false;
-        const clientId = claims[this.#clientIdClaim];
-        if (typeof clientId !== "string" || !clientId)
+        for (const claim of [this.#clientIdClaim, this.#tokenIdClaim, "sub"]) {
+            const value = claims[claim];
+            if (typeof value !== "string" || !value)
+                return false;
+        }
+        if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat)) {
             return false;
+        }
         for (const claim of ID_TOKEN_ONLY_CLAIMS) {
             if (claims[claim] !== undefined)
                 return false;

package/dist/utils/pkce.d.ts

@@ -113,6 +113,9 @@ export declare function validateCodeChallenge(challenge: string, method?: string
  * own, callable properties of `methods` resolve here; every other name is
  * `undefined`, including names inherited from a prototype.
  *
+ * An omitted method means `S256`, deliberately not RFC 7636 §4.3's `plain`,
+ * following OAuth 2.1.
+ *
  * @param methods The challenge methods the server allows
  * @param method The client-supplied method name; defaults to `S256`
  * @returns The transform for that method, or `undefined` when it is not allowed

package/dist/utils/pkce.js

@@ -127,6 +127,9 @@ export function validateCodeChallenge(challenge, method) {
  * own, callable properties of `methods` resolve here; every other name is
  * `undefined`, including names inherited from a prototype.
  *
+ * An omitted method means `S256`, deliberately not RFC 7636 §4.3's `plain`,
+ * following OAuth 2.1.
+ *
  * @param methods The challenge methods the server allows
  * @param method The client-supplied method name; defaults to `S256`
  * @returns The transform for that method, or `undefined` when it is not allowed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "keywords": [
     "authorization-server",