@udibo/oauth2 0.41.0 → 0.43.0

package/dist/react/components/sign-in-form.d.ts

@@ -2,14 +2,14 @@
  * {@link SignInForm} — a default, accessible, unstyled sign-in form built on
  * {@link useAuthForm}. Collects an identifier and password (optionally a
  * "remember me" checkbox), renders "Continue with …" social buttons when
- * providers are supplied, and reports the outcome through the injected
- * `onSubmit`.
+ * providers are supplied and a passkey button when `passkey` is, and reports
+ * the outcome through the injected `onSubmit`.
  *
  * @module
  */
 import type { ReactNode } from "react";
 import type { AuthFormState } from "./use-auth-form.ts";
-import type { BaseAuthFormProps, SocialProvidersProps } from "./types.ts";
+import type { BaseAuthFormProps, PasskeyOption, SocialProvidersProps } from "./types.ts";
 /** Values collected by {@link SignInForm}. */
 export type SignInValues = {
     /** Email address or username. */
@@ -42,6 +42,14 @@ export interface SignInFormProps extends BaseAuthFormProps<SignInValues>, Social
     forgotPasswordHref?: string;
     /** Text overrides. */
     labels?: SignInLabels;
+    /**
+     * Offer passkey sign-in: renders a "Sign in with a passkey" button and marks
+     * the identifier field `autocomplete="username webauthn"`, so a browser
+     * running a conditional-mediation request (`mediation: "conditional"`)
+     * offers saved passkeys in the field's autofill. Start that request
+     * yourself on mount; the form only provides the field.
+     */
+    passkey?: PasskeyOption;
     /**
      * Render-prop escape hatch. When provided, you own the markup and receive
      * the live {@link AuthFormState}; the component still owns state and submit.

package/dist/react/components/sign-in-form.js

@@ -1,6 +1,6 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useAuthForm } from "./use-auth-form.js";
-import { AuthFormShell, SocialButtons, SubmitButton, TextField, useFocusFirstError, } from "./internal.js";
+import { AuthFormShell, PasskeyButton, SocialButtons, SubmitButton, TextField, useFocusFirstError, } from "./internal.js";
 import { useAuthFormClassNames } from "./class-names.js";
 /**
  * A ready-to-use sign-in form. Wire `onSubmit` to your auth endpoint; pass
@@ -26,7 +26,7 @@ import { useAuthFormClassNames } from "./class-names.js";
  * ```
  */
 export function SignInForm(props) {
-    const { onSubmit, className, socialProviders, onSocialSelect, socialHref, showRemember = false, forgotPasswordHref, labels, children, } = props;
+    const { onSubmit, className, socialProviders, onSocialSelect, socialHref, showRemember = false, forgotPasswordHref, labels, passkey, children, } = props;
     const form = useAuthForm({
         initialValues: { identifier: "", password: "", remember: false },
         onSubmit,
@@ -35,5 +35,5 @@ export function SignInForm(props) {
     useFocusFirstError(form);
     const classNames = useAuthFormClassNames(props.classNames);
     const rememberField = form.getFieldProps("remember");
-    return (_jsxs(AuthFormShell, { name: "sign-in", form: form, className: className, classNames: classNames, render: children, action: props.action, method: props.method, formRef: props.formRef, aboveForm: _jsx(SocialButtons, { socialProviders: socialProviders, onSocialSelect: onSocialSelect, socialHref: socialHref }), children: [_jsx(TextField, { fieldProps: form.getFieldProps("identifier"), label: labels?.identifier ?? "Email or username", autoComplete: "username", required: true, error: form.errors.identifier }), _jsx(TextField, { fieldProps: form.getFieldProps("password"), label: labels?.password ?? "Password", type: "password", autoComplete: "current-password", required: true, error: form.errors.password, children: forgotPasswordHref ? (_jsx("a", { href: forgotPasswordHref, "data-oauth2-forgot-password": "", className: classNames.hint, children: labels?.forgotPassword ?? "Forgot password?" })) : null }), showRemember ? (_jsx("div", { "data-oauth2-field": "remember", className: classNames.field, children: _jsxs("label", { htmlFor: rememberField.id, "data-oauth2-label": "", className: classNames.label, children: [_jsx("input", { ...rememberField, type: "checkbox", "data-oauth2-input": "", className: classNames.input }), labels?.remember ?? "Remember me"] }) })) : null, _jsx(SubmitButton, { isSubmitting: form.isSubmitting, label: labels?.submit ?? "Sign in", submittingLabel: labels?.submitting ?? "Signing in…" })] }));
+    return (_jsxs(AuthFormShell, { name: "sign-in", form: form, className: className, classNames: classNames, render: children, action: props.action, method: props.method, formRef: props.formRef, aboveForm: _jsxs(_Fragment, { children: [_jsx(PasskeyButton, { option: passkey, defaultLabel: "Sign in with a passkey" }), _jsx(SocialButtons, { socialProviders: socialProviders, onSocialSelect: onSocialSelect, socialHref: socialHref })] }), children: [_jsx(TextField, { fieldProps: form.getFieldProps("identifier"), label: labels?.identifier ?? "Email or username", autoComplete: passkey ? "username webauthn" : "username", required: true, error: form.errors.identifier }), _jsx(TextField, { fieldProps: form.getFieldProps("password"), label: labels?.password ?? "Password", type: "password", autoComplete: "current-password", required: true, error: form.errors.password, children: forgotPasswordHref ? (_jsx("a", { href: forgotPasswordHref, "data-oauth2-forgot-password": "", className: classNames.hint, children: labels?.forgotPassword ?? "Forgot password?" })) : null }), showRemember ? (_jsx("div", { "data-oauth2-field": "remember", className: classNames.field, children: _jsxs("label", { htmlFor: rememberField.id, "data-oauth2-label": "", className: classNames.label, children: [_jsx("input", { ...rememberField, type: "checkbox", "data-oauth2-input": "", className: classNames.input }), labels?.remember ?? "Remember me"] }) })) : null, _jsx(SubmitButton, { isSubmitting: form.isSubmitting, label: labels?.submit ?? "Sign in", submittingLabel: labels?.submitting ?? "Signing in…" })] }));
 }

package/dist/react/components/types.d.ts

@@ -70,6 +70,18 @@ export interface SocialProvidersProps {
     /** Builds the href for a provider; renders anchors instead of buttons. */
     socialHref?: (provider: SocialProvider) => string;
 }
+/**
+ * A passkey button for a sign-in or challenge form. The component never runs
+ * the WebAuthn ceremony itself: `onSelect` fetches options from your server,
+ * calls `navigator.credentials.get()` (or `startAuthentication` from
+ * `@simplewebauthn/browser`), and posts the result back.
+ */
+export interface PasskeyOption {
+    /** Runs the passkey ceremony when the button is pressed. */
+    onSelect: () => void | Promise<void>;
+    /** Button text. Defaults to the form's own wording. */
+    label?: string;
+}
 /**
  * The class hook every prebuilt component shares. Component-specific class-name
  * maps ({@link AuthFormClassNames}, `UserMenuClassNames`) extend this, so `root`

package/dist/server/_resource-indicator.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read zero or one absolute resource URI without a fragment, preserving its
+ * exact spelling. Multiple values, including equal repeats, are refused.
+ * Call only after opting into the single-resource policy.
+ * @throws {InvalidTargetError} For an empty, repeated, non-string or malformed value.
+ */
+export declare function resourceIndicatorOf(body: FormData): string | undefined;

package/dist/server/_resource-indicator.js

@@ -0,0 +1,67 @@
+/** Single-resource syntax for opted-in machine issuance. @module */
+import { InvalidTargetError } from "../errors.js";
+const PATH = /^(?:[A-Za-z0-9._~!$&'()*+,;=:@/-]|%[A-Fa-f0-9]{2})*$/;
+const QUERY = /^(?:[A-Za-z0-9._~!$&'()*+,;=:@/?-]|%[A-Fa-f0-9]{2})*$/;
+const USER_INFO = /^(?:[A-Za-z0-9._~!$&'()*+,;=:-]|%[A-Fa-f0-9]{2})*$/;
+const REG_NAME = /^(?:[A-Za-z0-9._~!$&'()*+,;=-]|%[A-Fa-f0-9]{2})*$/;
+const IP_FUTURE = /^v[0-9a-f]+\.[A-Za-z0-9._~!$&'()*+,;=:-]+$/i;
+function validAuthority(authority) {
+    const at = authority.indexOf("@");
+    if (at !== authority.lastIndexOf("@"))
+        return false;
+    if (at !== -1 && !USER_INFO.test(authority.slice(0, at)))
+        return false;
+    const hostPort = authority.slice(at + 1);
+    if (hostPort.startsWith("[")) {
+        const end = hostPort.indexOf("]");
+        if (end === -1 || !/^(?::[0-9]*)?$/.test(hostPort.slice(end + 1)))
+            return false;
+        const literal = hostPort.slice(1, end);
+        if (IP_FUTURE.test(literal))
+            return true;
+        try {
+            // Native parsing validates an IPv6 literal; no lookup or request occurs.
+            return new URL(`http://[${literal}]`).hostname.startsWith("[");
+        }
+        catch {
+            return false;
+        }
+    }
+    const colon = hostPort.lastIndexOf(":");
+    return colon === -1
+        ? REG_NAME.test(hostPort)
+        : REG_NAME.test(hostPort.slice(0, colon)) &&
+            /^[0-9]*$/.test(hostPort.slice(colon + 1));
+}
+function absoluteUri(value) {
+    const uri = /^[A-Za-z][A-Za-z0-9+.-]*:([^?#]*)(?:\?([^#]*))?$/.exec(value);
+    if (!uri || (uri[2] !== undefined && !QUERY.test(uri[2])))
+        return false;
+    let path = uri[1];
+    if (path.startsWith("//")) {
+        const slash = path.indexOf("/", 2);
+        const authority = slash === -1 ? path.slice(2) : path.slice(2, slash);
+        if (!validAuthority(authority))
+            return false;
+        path = slash === -1 ? "" : path.slice(slash);
+    }
+    return PATH.test(path);
+}
+/**
+ * Read zero or one absolute resource URI without a fragment, preserving its
+ * exact spelling. Multiple values, including equal repeats, are refused.
+ * Call only after opting into the single-resource policy.
+ * @throws {InvalidTargetError} For an empty, repeated, non-string or malformed value.
+ */
+export function resourceIndicatorOf(body) {
+    const values = body.getAll("resource");
+    if (values.length === 0)
+        return undefined;
+    const resource = values[0];
+    if (values.length !== 1 ||
+        typeof resource !== "string" ||
+        !absoluteUri(resource)) {
+        throw new InvalidTargetError("invalid resource");
+    }
+    return resource;
+}

package/dist/server/authorization-server.js

@@ -1162,6 +1162,8 @@ export class AuthorizationServer extends ResourceServer {
                 if (tokenType === "access_token") {
                     response.token_type = "Bearer";
                 }
+                if (token.resource !== undefined)
+                    response.aud = token.resource;
                 if (token.scope) {
                     response.scope = token.scope.toString();
                 }

package/dist/server/grants/client-credentials.d.ts

@@ -70,7 +70,13 @@ export declare class ClientCredentialsGrant<Client extends ClientInterface, User
      * `ClientServiceInterface.getUser` resolves for the client, and is left
      * unset when it resolves nothing — a user-less machine token, not a failure.
      *
+     * Resource indicators are opt-in through `tokenService.acceptedResource`:
+     * its presence validates one absolute resource URI and requires explicit
+     * policy acceptance. Its absence preserves legacy extension handling.
+     *
      * @throws {InvalidScopeError} If the requested scope is rejected.
+     * @throws {InvalidTargetError} If opted-in resource validation or policy refuses.
+     * @throws {ServerError} If storage drops or changes an accepted target.
      */
     token(request: Request, client: Client, body: FormData): Promise<Token<Client, User, S>>;
 }

package/dist/server/grants/client-credentials.js

@@ -3,7 +3,8 @@
  * RFC 6749 Section 4.4.
  * @module
  */
-import { InvalidClientError } from "../../errors.js";
+import { InvalidClientError, InvalidTargetError, ServerError, } from "../../errors.js";
+import { resourceIndicatorOf } from "../_resource-indicator.js";
 import { authenticateClientCredentials } from "../client-authentication.js";
 import { AbstractGrant, } from "./grant.js";
 /**
@@ -71,7 +72,13 @@ export class ClientCredentialsGrant extends AbstractGrant {
      * `ClientServiceInterface.getUser` resolves for the client, and is left
      * unset when it resolves nothing — a user-less machine token, not a failure.
      *
+     * Resource indicators are opt-in through `tokenService.acceptedResource`:
+     * its presence validates one absolute resource URI and requires explicit
+     * policy acceptance. Its absence preserves legacy extension handling.
+     *
      * @throws {InvalidScopeError} If the requested scope is rejected.
+     * @throws {InvalidTargetError} If opted-in resource validation or policy refuses.
+     * @throws {ServerError} If storage drops or changes an accepted target.
      */
     async token(request, client, body) {
         const { tokenService, clientService } = await this.resolveServices(request);
@@ -80,7 +87,19 @@ export class ClientCredentialsGrant extends AbstractGrant {
         const user = await clientService.getUser(client);
         const acceptedScope = await this.acceptedScope(client, user, scope, tokenService);
         scope = acceptedScope ?? undefined;
-        const token = await this.generateToken(client, user, scope, tokenService);
-        return await tokenService.save(token);
+        let resource;
+        const resourcePolicy = tokenService.acceptedResource;
+        if (resourcePolicy !== undefined) {
+            resource = resourceIndicatorOf(body);
+            if ((await resourcePolicy.call(tokenService, client, user, resource, scope)) !== true) {
+                throw new InvalidTargetError("invalid resource");
+            }
+        }
+        const token = await this.generateToken(client, user, scope, tokenService, undefined, undefined, resource);
+        const saved = await tokenService.save(token);
+        if (resourcePolicy !== undefined && saved.resource !== resource) {
+            throw new ServerError("token storage did not preserve resource");
+        }
+        return saved;
     }
 }

package/dist/server/grants/grant.d.ts

@@ -150,9 +150,11 @@ export declare abstract class AbstractGrant<Client extends ClientInterface, User
      * for tokens with no user. `familyExpiresAt` is the ceiling of an existing
      * rotation family the token joins (the refresh grant passes it); the
      * expiries are clamped to it before the access token string is generated,
-     * so a signed token's `exp` matches the stored expiry.
+     * so a signed token's `exp` matches the stored expiry. `resource` is the
+     * exact URI accepted by the client-credentials resource policy; it is
+     * retained in the token and passed to audience-aware generation.
      */
-    generateToken(client: Client, user: User | undefined, scope: Scope | null | undefined, tokenService: TokenServiceInterface<Client, User, Scope>, authenticationContext?: AuthenticationContext, familyExpiresAt?: Date): Promise<Token<Client, User, Scope>>;
+    generateToken(client: Client, user: User | undefined, scope: Scope | null | undefined, tokenService: TokenServiceInterface<Client, User, Scope>, authenticationContext?: AuthenticationContext, familyExpiresAt?: Date, resource?: string): Promise<Token<Client, User, Scope>>;
     /**
      * Authenticates the client presenting this grant's token request against the
      * grant's own `clientService`, from the credentials the request presents.

package/dist/server/grants/grant.js

@@ -118,13 +118,17 @@ export class AbstractGrant {
      * for tokens with no user. `familyExpiresAt` is the ceiling of an existing
      * rotation family the token joins (the refresh grant passes it); the
      * expiries are clamped to it before the access token string is generated,
-     * so a signed token's `exp` matches the stored expiry.
+     * so a signed token's `exp` matches the stored expiry. `resource` is the
+     * exact URI accepted by the client-credentials resource policy; it is
+     * retained in the token and passed to audience-aware generation.
      */
-    async generateToken(client, user, scope, tokenService, authenticationContext, familyExpiresAt) {
+    async generateToken(client, user, scope, tokenService, authenticationContext, familyExpiresAt, resource) {
         const event = user === undefined
             ? undefined
             : snapshotAuthenticationContext(authenticationContext);
         const token = { accessToken: "", client };
+        if (resource !== undefined)
+            token.resource = resource;
         if (event)
             token.authenticationContext = event;
         if (user !== undefined)
@@ -162,7 +166,17 @@ export class AbstractGrant {
         }
         if (ceiling)
             this.capAtFamilyExpiry(result, ceiling);
-        result.accessToken = await tokenService.generateAccessToken(client, user, scope, event, result.accessTokenExpiresAt);
+        const generation = [
+            client,
+            user,
+            scope,
+            event,
+            result.accessTokenExpiresAt,
+        ];
+        result.accessToken =
+            resource === undefined
+                ? await tokenService.generateAccessToken(...generation)
+                : await tokenService.generateAccessToken(...generation, resource);
         return result;
     }
     /**

package/dist/server/grants/refresh-token.d.ts

@@ -115,6 +115,8 @@ export declare class RefreshTokenGrant<Client extends ClientInterface, User, S e
      * claimed it.
      * @throws {InvalidClientError} If the token was issued to another client.
      * @throws {InvalidScopeError} If the requested scope exceeds the original grant.
+     * @throws {InvalidTargetError} If a stored parent is resource-bound; refreshing
+     * such a grant is unsupported and refuses before spending the parent.
      */
     token(request: Request, client: Client, body: FormData): Promise<RefreshToken<Client, User, S>>;
 }

package/dist/server/grants/refresh-token.js

@@ -3,7 +3,7 @@
  * RFC 6749 Section 6.
  * @module
  */
-import { InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, } from "../../errors.js";
+import { InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTargetError, } from "../../errors.js";
 import { AbstractGrant, } from "./grant.js";
 const REPLAY_GRACE_CLOCK_TOLERANCE_SECONDS = 300;
 /**
@@ -56,6 +56,8 @@ export class RefreshTokenGrant extends AbstractGrant {
      * claimed it.
      * @throws {InvalidClientError} If the token was issued to another client.
      * @throws {InvalidScopeError} If the requested scope exceeds the original grant.
+     * @throws {InvalidTargetError} If a stored parent is resource-bound; refreshing
+     * such a grant is unsupported and refuses before spending the parent.
      */
     async token(request, client, body) {
         const { tokenService } = await this.resolveServices(request);
@@ -92,6 +94,11 @@ export class RefreshTokenGrant extends AbstractGrant {
         if (client.id.toString() !== tokenClient.id.toString()) {
             throw new InvalidClientError("refresh_token was issued to another client");
         }
+        if (currentToken.resource !== undefined) {
+            // Resource-bound refresh is not implemented. Never spend the parent or
+            // issue a successor that silently loses its audience restriction.
+            throw new InvalidTargetError("resource-bound refresh is not supported");
+        }
         // RFC 6749 §6: a requested scope may only narrow, never exceed, the original grant.
         let nextScope = scope;
         const requestedScopeText = body.get("scope");

package/dist/server/mod.d.ts

@@ -15,7 +15,7 @@ export { AbstractScope, BasicScope } from "../models/scope.ts";
 export type { ScopeConstructor } from "../models/scope.ts";
 export { Authorization, authorizationFromClaims, } from "../models/authorization.ts";
 export type { AuthorizationFailure, AuthorizationInit, OrganizationContext, RequireConditions, } from "../models/authorization.ts";
-export { AccessDeniedError, AccountSelectionRequiredError, AuthorizationPendingError, ConsentRequiredError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InteractionRequiredError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, isOAuth2Error, LoginRequiredError, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.ts";
+export { AccessDeniedError, AccountSelectionRequiredError, AuthorizationPendingError, ConsentRequiredError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InteractionRequiredError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, InvalidTargetError, isOAuth2Error, LoginRequiredError, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.ts";
 export type { OAuth2ErrorClass, OAuth2ProblemDetailsExtensions, } from "../errors.ts";
 export { type AuthenticationOutcome, satisfiesAuthenticationRequest, } from "./authentication-request.ts";
 export type { TokenReaderInterface } from "./services/token.ts";

package/dist/server/mod.js

@@ -10,6 +10,6 @@
  */
 export { AbstractScope, BasicScope } from "../models/scope.js";
 export { Authorization, authorizationFromClaims, } from "../models/authorization.js";
-export { AccessDeniedError, AccountSelectionRequiredError, AuthorizationPendingError, ConsentRequiredError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InteractionRequiredError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, isOAuth2Error, LoginRequiredError, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";
+export { AccessDeniedError, AccountSelectionRequiredError, AuthorizationPendingError, ConsentRequiredError, ExpiredTokenError, InsufficientPermissionsError, InsufficientScopeError, InteractionRequiredError, InvalidClientError, InvalidGrantError, InvalidRequestError, InvalidScopeError, InvalidTokenError, InvalidTargetError, isOAuth2Error, LoginRequiredError, OAuth2Error, ServerError, SlowDownError, TemporarilyUnavailableError, toOAuth2Error, UnauthorizedClientError, UnsupportedGrantTypeError, UnsupportedResponseTypeError, UnsupportedTokenTypeError, } from "../errors.js";
 export { satisfiesAuthenticationRequest, } from "./authentication-request.js";
 export { checkRedirectUriPattern, isRedirectUriPattern, matchRedirectUri, } from "./redirect-uri.js";

package/dist/server/services/token.d.ts

@@ -49,6 +49,19 @@ export interface TokenServiceInterface<Client extends ClientInterface, User, Sco
      * @returns The accepted scope, null/undefined to accept as-is, or false to reject.
      */
     acceptedScope(client: Client, user: User | undefined, scope?: Scope | null): Promise<Scope | null | undefined | false>;
+    /**
+     * Opts client-credentials issuance into one RFC 8707 resource per token.
+     * Called after client authentication and scope acceptance, even when no
+     * resource was supplied. Only `true` accepts; other results refuse with
+     * `invalid_target`. The URI is validated and passed unchanged; decide
+     * resource availability, client authority and scope compatibility here.
+     *
+     * Leave this method absent to preserve legacy extension-parameter behavior.
+     * Enabling it requires persisting `Token.resource` and forwarding the sixth
+     * `generateAccessToken` argument to signed-token generation. Other grants
+     * do not support resource indicators yet.
+     */
+    acceptedResource?(client: Client, user: User | undefined, resource: string | undefined, scope?: Scope | null): Promise<boolean>;
     /**
      * Generates an access token string. `user` is `undefined` for a client
      * acting as its own resource owner (client credentials) — a signed-token
@@ -60,8 +73,11 @@ export interface TokenServiceInterface<Client extends ClientInterface, User, Sco
      * a signed token's `exp` never outlives what the server itself honors; the
      * grants always pass it, and a wrapper that drops it leaves offline
      * verifiers accepting the token past its stored expiry.
+     * `resource`, when supplied by an opted-in machine grant, is the accepted
+     * target URI. A signed token must restrict its audience to this value;
+     * dropping it can issue a token for a different API.
      */
-    generateAccessToken(client: Client, user: User | undefined, scope?: Scope | null, authenticationContext?: AuthenticationContext, expiresAt?: Date): Promise<string>;
+    generateAccessToken(client: Client, user: User | undefined, scope?: Scope | null, authenticationContext?: AuthenticationContext, expiresAt?: Date, resource?: string): Promise<string>;
     /** Generates a refresh token string. */
     generateRefreshToken(client: Client, user: User, scope?: Scope | null): Promise<string | undefined>;
     /**
@@ -99,6 +115,8 @@ export interface TokenServiceInterface<Client extends ClientInterface, User, Sco
      * Persists either token kind and returns the saved record. Preserve
      * `authenticationContext` on save and every read, including refresh and
      * revoked records; never reconstruct it from a user's current session.
+     * Preserve `resource` exactly too when resource policy is enabled. The
+     * client-credentials grant refuses a saved result that loses its binding.
      */
     save(token: Token<Client, User, Scope> | RefreshToken<Client, User, Scope>): Promise<Token<Client, User, Scope> | RefreshToken<Client, User, Scope>>;
     /** Revokes a token record. Resolves true if a token was revoked. */
@@ -342,7 +360,7 @@ export declare abstract class AbstractTokenService<Client extends ClientInterfac
      */
     acceptedScope(_client: Client, _user: User | undefined, scope?: Scope | null): Promise<Scope | null | undefined | false>;
     /** Generates an opaque access token string. Override to issue a different format. */
-    generateAccessToken(_client: Client, _user: User | undefined, _scope?: Scope | null, _authenticationContext?: AuthenticationContext, _expiresAt?: Date): Promise<string>;
+    generateAccessToken(_client: Client, _user: User | undefined, _scope?: Scope | null, _authenticationContext?: AuthenticationContext, _expiresAt?: Date, _resource?: string): Promise<string>;
     /** Generates an opaque refresh token string. Override to issue a different format. */
     generateRefreshToken(_client: Client, _user: User, _scope?: Scope | null): Promise<string | undefined>;
     /** Computes the access token expiry as now plus {@linkcode accessTokenLifetime}. */

package/dist/server/services/token.js

@@ -52,7 +52,7 @@ export class AbstractTokenService {
         return Promise.resolve(scope);
     }
     /** Generates an opaque access token string. Override to issue a different format. */
-    generateAccessToken(_client, _user, _scope, _authenticationContext, _expiresAt) {
+    generateAccessToken(_client, _user, _scope, _authenticationContext, _expiresAt, _resource) {
         return Promise.resolve(crypto.randomUUID());
     }
     /** Generates an opaque refresh token string. Override to issue a different format. */

package/dist/server/signing-keys.d.ts

@@ -180,6 +180,8 @@ export declare function createJwtAccessTokenGenerator(options: {
      * The `aud` claim — per RFC 9068 an identifier of the resource server(s)
      * the token is intended for (e.g. `https://api.example.com`). Defaults to
      * the client id, which single-resource validators must then accept.
+     * An accepted resource passed as the returned function's sixth argument
+     * overrides this default, restricting the JWT to that exact target.
      */
     audience?: string;
     /**
@@ -214,4 +216,4 @@ export declare function createJwtAccessTokenGenerator(options: {
     id: string;
 }, user: unknown, scope?: {
     toString(): string;
-} | null, authenticationContext?: AuthenticationContext, expiresAt?: Date) => Promise<string>;
+} | null, authenticationContext?: AuthenticationContext, expiresAt?: Date, resource?: string) => Promise<string>;

package/dist/server/signing-keys.js

@@ -212,7 +212,7 @@ export async function verifyJwt(jwt, publicJwk, options = {}) {
 export function createJwtAccessTokenGenerator(options) {
     const lifetime = options.lifetimeSeconds ?? 3600;
     const subjectOf = options.subjectOf ?? defaultSubjectOf;
-    return async (client, user, scope, authenticationContext, expiresAt) => {
+    return async (client, user, scope, authenticationContext, expiresAt, resource) => {
         const event = user
             ? snapshotAuthenticationContext(authenticationContext)
             : undefined;
@@ -229,7 +229,7 @@ export function createJwtAccessTokenGenerator(options) {
             iss: options.issuer,
             sub: user ? subjectOf(user) : client.id,
             client_id: client.id,
-            aud: options.audience ?? client.id,
+            aud: resource ?? options.audience ?? client.id,
             iat: now,
             exp: Math.min(now + lifetime, storedExp),
             jti: crypto.randomUUID(),

package/dist/testing/contract/mod.d.ts

@@ -10,11 +10,12 @@
  * fixtures and shipped token readers internally, so consumers and the
  * library are tested by the exact same checks.
  *
- * The identity layer's storage seams — `MfaStore`, `TokenFlowStore`,
- * `OtpStore`, `RateLimitStore`, `LockoutStore` — and the client's
+ * The identity layer's storage seams — `MfaStore`, `PasskeyStore`,
+ * `PasskeyChallengeStore`, `TokenFlowStore`, `OtpStore`, `RateLimitStore`,
+ * `LockoutStore` — and the client's
  * `AuthRequestStorage` have runners of their own. Those interfaces document
  * methods that **must be atomic** (single-use recovery codes, single-use
- * links, the TOTP replay guard, the guess and failure budgets, the
+ * links and passkey challenges, the passkey cap and sign count, the TOTP replay guard, the guess and failure budgets, the
  * single-use claim of a login's `state`), and each suite checks that claim
  * with overlapping calls: a read-modify-write implementation passes every
  * sequential case and fails the concurrent one, which is the whole
@@ -50,6 +51,7 @@ export { runTokenReaderContractTests, type TokenReaderContractFixture, type Toke
 export { type AuthorizationCodeServiceContractOptions, runAuthorizationCodeServiceContractTests, } from "./authorization-code.ts";
 export { type DeviceAuthorizationServiceContractOptions, runDeviceAuthorizationServiceContractTests, } from "./device-authorization.ts";
 export { type MfaStoreContractOptions, runMfaStoreContractTests, } from "./mfa-store.ts";
+export { type PasskeyChallengeStoreContractOptions, type PasskeyStoreContractOptions, runPasskeyChallengeStoreContractTests, runPasskeyStoreContractTests, } from "./passkey-store.ts";
 export { runTokenFlowStoreContractTests, type TokenFlowStoreContractOptions, } from "./token-flow-store.ts";
 export { type OtpStoreContractOptions, runOtpStoreContractTests, } from "./otp-store.ts";
 export { type RateLimitStoreContractOptions, runRateLimitStoreContractTests, } from "./rate-limit-store.ts";

package/dist/testing/contract/mod.js

@@ -10,11 +10,12 @@
  * fixtures and shipped token readers internally, so consumers and the
  * library are tested by the exact same checks.
  *
- * The identity layer's storage seams — `MfaStore`, `TokenFlowStore`,
- * `OtpStore`, `RateLimitStore`, `LockoutStore` — and the client's
+ * The identity layer's storage seams — `MfaStore`, `PasskeyStore`,
+ * `PasskeyChallengeStore`, `TokenFlowStore`, `OtpStore`, `RateLimitStore`,
+ * `LockoutStore` — and the client's
  * `AuthRequestStorage` have runners of their own. Those interfaces document
  * methods that **must be atomic** (single-use recovery codes, single-use
- * links, the TOTP replay guard, the guess and failure budgets, the
+ * links and passkey challenges, the passkey cap and sign count, the TOTP replay guard, the guess and failure budgets, the
  * single-use claim of a login's `state`), and each suite checks that claim
  * with overlapping calls: a read-modify-write implementation passes every
  * sequential case and fails the concurrent one, which is the whole
@@ -50,6 +51,7 @@ export { runTokenReaderContractTests, } from "./token-reader.js";
 export { runAuthorizationCodeServiceContractTests, } from "./authorization-code.js";
 export { runDeviceAuthorizationServiceContractTests, } from "./device-authorization.js";
 export { runMfaStoreContractTests, } from "./mfa-store.js";
+export { runPasskeyChallengeStoreContractTests, runPasskeyStoreContractTests, } from "./passkey-store.js";
 export { runTokenFlowStoreContractTests, } from "./token-flow-store.js";
 export { runOtpStoreContractTests, } from "./otp-store.js";
 export { runRateLimitStoreContractTests, } from "./rate-limit-store.js";

package/dist/testing/contract/passkey-store.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Contract test suites for {@link PasskeyStore} and
+ * {@link PasskeyChallengeStore} implementations.
+ *
+ * `PasskeyService` relies on three atomic operations: `addPasskey` (credential
+ * uniqueness and the per-user cap in one step), `recordUse` (compare-and-set
+ * on the sign count), and the challenge store's `take` (read-and-delete, which
+ * makes a challenge single-use). These suites check each with concurrent
+ * calls.
+ *
+ * @example Verify database-backed stores
+ * ```ts
+ * import {
+ *   runPasskeyChallengeStoreContractTests,
+ *   runPasskeyStoreContractTests,
+ * } from "@udibo/oauth2/testing/contract";
+ * import type {
+ *   PasskeyChallengeStore,
+ *   PasskeyStore,
+ * } from "@udibo/oauth2/identity/passkeys";
+ *
+ * declare function freshPasskeyStore(): Promise<PasskeyStore>;
+ * declare function freshChallengeStore(): Promise<PasskeyChallengeStore>;
+ *
+ * runPasskeyStoreContractTests({ makeStore: freshPasskeyStore });
+ * runPasskeyChallengeStoreContractTests({ makeStore: freshChallengeStore });
+ * ```
+ *
+ * @module
+ */
+import type { PasskeyChallengeStore, PasskeyStore } from "../../identity/passkeys/service.ts";
+/** Options for {@link runPasskeyStoreContractTests}. */
+export interface PasskeyStoreContractOptions {
+    /** Returns a fresh, empty store for each test. */
+    makeStore(): Promise<PasskeyStore> | PasskeyStore;
+    /**
+     * The user the cases act on, in your application's id format; it must name
+     * a user that exists when your rows reference a users table. Defaults to
+     * `"user-1"`.
+     */
+    userId?: string;
+    /** A second, distinct user. Defaults to `"user-2"`. */
+    otherUserId?: string;
+    /** Overrides the outer `describe` name. Defaults to `"PasskeyStore contract"`. */
+    describeName?: string;
+}
+/** Options for {@link runPasskeyChallengeStoreContractTests}. */
+export interface PasskeyChallengeStoreContractOptions {
+    /** Returns a fresh, empty store for each test. */
+    makeStore(): Promise<PasskeyChallengeStore> | PasskeyChallengeStore;
+    /**
+     * Overrides the outer `describe` name. Defaults to
+     * `"PasskeyChallengeStore contract"`.
+     */
+    describeName?: string;
+}
+/**
+ * Runs the {@link PasskeyStore} contract suite. Call it from your own test
+ * file; it registers `describe` / `it` blocks.
+ */
+export declare function runPasskeyStoreContractTests(options: PasskeyStoreContractOptions): void;
+/**
+ * Runs the {@link PasskeyChallengeStore} contract suite. Call it from your own
+ * test file; it registers `describe` / `it` blocks.
+ */
+export declare function runPasskeyChallengeStoreContractTests(options: PasskeyChallengeStoreContractOptions): void;