@vouchington/utils 0.7.5 → 0.9.0

package/dist/oauth-providers-github.mjs

@@ -0,0 +1,46 @@
+import { OAuthProviderError, asRecord, compact, isRecord, nowOf, parseTokens, requestJson, str, } from './oauth-providers-core.mjs';
+/** JSON token exchange; the verified email is the primary verified address from `/user/emails`. */
+export function githubProvider(config) {
+    return {
+        id: 'github',
+        async redeem(input, ctx) {
+            const tokenPayload = await requestJson('github', 'GitHub token exchange', ctx, 'https://github.com/login/oauth/access_token', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+                body: JSON.stringify({
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code: input.code,
+                    redirect_uri: input.redirectUri,
+                    ...(input.codeVerifier ? { code_verifier: input.codeVerifier } : {}),
+                }),
+            });
+            const tokens = parseTokens('github', tokenPayload, nowOf(ctx));
+            const { accessToken } = tokens;
+            const init = {
+                headers: { Authorization: `Bearer ${accessToken}`, Accept: 'application/vnd.github+json' },
+            };
+            const [userPayload, emailsPayload] = await Promise.all([
+                requestJson('github', 'GitHub /user request', ctx, 'https://api.github.com/user', init),
+                requestJson('github', 'GitHub /user/emails request', ctx, 'https://api.github.com/user/emails', init),
+            ]);
+            const user = asRecord('github', userPayload, 'GitHub /user response');
+            if (typeof user.id !== 'number' && !str(user.id)) {
+                throw new OAuthProviderError('github', 'malformed', 'GitHub /user response is missing id');
+            }
+            if (!Array.isArray(emailsPayload)) {
+                throw new OAuthProviderError('github', 'malformed', 'GitHub emails response is not a list');
+            }
+            const primary = emailsPayload.find((entry) => isRecord(entry) && entry.primary === true && entry.verified === true);
+            const login = str(user.login);
+            return {
+                tokens,
+                profile: {
+                    providerUserId: String(user.id),
+                    verifiedEmail: str(primary?.email) ?? null,
+                    data: compact({ login, name: str(user.name) ?? login, avatar_url: str(user.avatar_url) }),
+                },
+            };
+        },
+    };
+}

package/dist/oauth-providers-google.d.mts

@@ -0,0 +1,7 @@
+import { type OAuthProvider } from './oauth-providers-core.mts';
+export interface GoogleProviderConfig {
+    clientId: string;
+    clientSecret: string;
+}
+/** Confidential code exchange with required PKCE, then OIDC userinfo keyed by `sub`. */
+export declare function googleProvider(config: GoogleProviderConfig): OAuthProvider;

package/dist/oauth-providers-google.mjs

@@ -0,0 +1,43 @@
+import { OAuthProviderError, asRecord, compact, formBody, nowOf, parseTokens, requestJson, requireCodeVerifier, str, } from './oauth-providers-core.mjs';
+/** Confidential code exchange with required PKCE, then OIDC userinfo keyed by `sub`. */
+export function googleProvider(config) {
+    return {
+        id: 'google',
+        async redeem(input, ctx) {
+            const codeVerifier = requireCodeVerifier('google', input);
+            const tokenPayload = await requestJson('google', 'Google token exchange', ctx, 'https://oauth2.googleapis.com/token', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: formBody({
+                    grant_type: 'authorization_code',
+                    code: input.code,
+                    redirect_uri: input.redirectUri,
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code_verifier: codeVerifier,
+                }),
+            });
+            const tokens = parseTokens('google', tokenPayload, nowOf(ctx));
+            const infoPayload = await requestJson('google', 'Google UserInfo request', ctx, 'https://openidconnect.googleapis.com/v1/userinfo', { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+            const info = asRecord('google', infoPayload, 'Google UserInfo response');
+            const sub = str(info.sub);
+            if (!sub)
+                throw new OAuthProviderError('google', 'malformed', 'Google UserInfo is missing sub');
+            const email = str(info.email);
+            return {
+                tokens,
+                profile: {
+                    providerUserId: sub,
+                    verifiedEmail: info.email_verified === true ? (email ?? null) : null,
+                    data: compact({
+                        name: str(info.name),
+                        email,
+                        picture: str(info.picture),
+                        given_name: str(info.given_name),
+                        family_name: str(info.family_name),
+                    }),
+                },
+            };
+        },
+    };
+}

package/dist/oauth-providers-linkedin.d.mts

@@ -0,0 +1,7 @@
+import { type OAuthProvider } from './oauth-providers-core.mts';
+export interface LinkedinProviderConfig {
+    clientId: string;
+    clientSecret: string;
+}
+/** Form token exchange (optional PKCE) and OIDC userinfo gated on `email_verified`. */
+export declare function linkedinProvider(config: LinkedinProviderConfig): OAuthProvider;

package/dist/oauth-providers-linkedin.mjs

@@ -0,0 +1,42 @@
+import { OAuthProviderError, asRecord, compact, formBody, nowOf, parseTokens, requestJson, str, } from './oauth-providers-core.mjs';
+/** Form token exchange (optional PKCE) and OIDC userinfo gated on `email_verified`. */
+export function linkedinProvider(config) {
+    return {
+        id: 'linkedin',
+        async redeem(input, ctx) {
+            const tokenPayload = await requestJson('linkedin', 'LinkedIn token exchange', ctx, 'https://www.linkedin.com/oauth/v2/accessToken', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: formBody({
+                    grant_type: 'authorization_code',
+                    code: input.code,
+                    redirect_uri: input.redirectUri,
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code_verifier: input.codeVerifier,
+                }),
+            });
+            const tokens = parseTokens('linkedin', tokenPayload, nowOf(ctx));
+            const infoPayload = await requestJson('linkedin', 'LinkedIn userinfo request', ctx, 'https://api.linkedin.com/v2/userinfo', { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+            const info = asRecord('linkedin', infoPayload, 'LinkedIn userinfo response');
+            const sub = str(info.sub);
+            if (!sub)
+                throw new OAuthProviderError('linkedin', 'malformed', 'LinkedIn userinfo is missing sub');
+            const email = str(info.email);
+            return {
+                tokens,
+                profile: {
+                    providerUserId: sub,
+                    verifiedEmail: info.email_verified === true ? (email ?? null) : null,
+                    data: compact({
+                        name: str(info.name),
+                        email,
+                        picture: str(info.picture),
+                        given_name: str(info.given_name),
+                        family_name: str(info.family_name),
+                    }),
+                },
+            };
+        },
+    };
+}

package/dist/oauth-providers-microsoft.d.mts

@@ -0,0 +1,11 @@
+import { type OAuthProvider } from './oauth-providers-core.mts';
+export interface MicrosoftProviderConfig {
+    clientId: string;
+    clientSecret: string;
+    /** Defaults to `common`. */
+    tenantId?: string;
+}
+/** Request these scopes in the authorization URL for ID-token email and Graph /me. */
+export declare const microsoftAuthorizationScopes = "openid email User.Read";
+/** v2.0 code exchange with PKCE, signed ID-token email proof, and Graph profile data. */
+export declare function microsoftProvider(config: MicrosoftProviderConfig): OAuthProvider;

package/dist/oauth-providers-microsoft.mjs

@@ -0,0 +1,76 @@
+import { createOidcIdTokenVerifier } from './oidc-id-token.mjs';
+import { microsoftProfileFromClaims } from './oidc-id-token-profiles.mjs';
+import { OAuthProviderError, asRecord, compact, formBody, nowOf, parseTokens, requestJson, requireCodeVerifier, str, } from './oauth-providers-core.mjs';
+const TENANT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Request these scopes in the authorization URL for ID-token email and Graph /me. */
+export const microsoftAuthorizationScopes = 'openid email User.Read';
+/** v2.0 code exchange with PKCE, signed ID-token email proof, and Graph profile data. */
+export function microsoftProvider(config) {
+    return {
+        id: 'microsoft',
+        async redeem(input, ctx) {
+            const codeVerifier = requireCodeVerifier('microsoft', input);
+            const tenant = config.tenantId || 'common';
+            const login = `https://login.microsoftonline.com/${tenant}`;
+            const tokenPayload = await requestJson('microsoft', 'Microsoft token exchange', ctx, `${login}/oauth2/v2.0/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: formBody({
+                    grant_type: 'authorization_code',
+                    code: input.code,
+                    redirect_uri: input.redirectUri,
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    code_verifier: codeVerifier,
+                    scope: microsoftAuthorizationScopes,
+                }),
+            });
+            const tokens = parseTokens('microsoft', tokenPayload, nowOf(ctx));
+            const body = asRecord('microsoft', tokenPayload, 'Microsoft token response');
+            const idToken = str(body.id_token);
+            if (!idToken) {
+                throw new OAuthProviderError('microsoft', 'malformed', 'Token response is missing id_token');
+            }
+            const alias = tenant === 'common' || tenant === 'organizations';
+            const verifier = createOidcIdTokenVerifier({
+                jwksUri: `${login}/discovery/v2.0/keys`,
+                issuers: [],
+                issuerMatches: (claims, keyIssuer) => {
+                    const tid = claims.tid;
+                    if (typeof tid !== 'string' || !TENANT_ID.test(tid))
+                        return false;
+                    const issuer = `https://login.microsoftonline.com/${tid}/v2.0`;
+                    return ((alias || tid === tenant) &&
+                        claims.iss === issuer &&
+                        (keyIssuer === undefined || keyIssuer.replace('{tenantid}', tid) === issuer));
+                },
+                audiences: () => [config.clientId],
+                fetch: ctx.fetch,
+                ...(ctx.now ? { now: ctx.now } : {}),
+            });
+            const claims = await verifier.verify(idToken, ctx.signal ? { signal: ctx.signal } : {});
+            const mePayload = await requestJson('microsoft', 'Microsoft Graph /me request', ctx, 'https://graph.microsoft.com/v1.0/me', { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+            const me = asRecord('microsoft', mePayload, 'Microsoft Graph /me response');
+            const id = str(me.id);
+            if (!id)
+                throw new OAuthProviderError('microsoft', 'malformed', 'Microsoft user is missing id');
+            if (claims.oid !== id) {
+                throw new OAuthProviderError('microsoft', 'malformed', 'ID token user does not match Graph user');
+            }
+            const signedProfile = microsoftProfileFromClaims(claims);
+            return {
+                tokens,
+                profile: {
+                    providerUserId: id,
+                    verifiedEmail: signedProfile.verifiedEmail,
+                    data: compact({
+                        name: str(me.displayName),
+                        email: str(me.mail),
+                        given_name: str(me.givenName),
+                        family_name: str(me.surname),
+                    }),
+                },
+            };
+        },
+    };
+}

package/dist/oauth-providers-x.d.mts

@@ -0,0 +1,7 @@
+import { type OAuthProvider } from './oauth-providers-core.mts';
+export interface XProviderConfig {
+    clientId: string;
+    clientSecret: string;
+}
+/** Basic-auth token exchange; PKCE is required and X exposes no verified email. */
+export declare function xProvider(config: XProviderConfig): OAuthProvider;

package/dist/oauth-providers-x.mjs

@@ -0,0 +1,41 @@
+import { OAuthProviderError, asRecord, compact, formBody, nowOf, parseTokens, requestJson, requireCodeVerifier, str, } from './oauth-providers-core.mjs';
+/** Basic-auth token exchange; PKCE is required and X exposes no verified email. */
+export function xProvider(config) {
+    return {
+        id: 'x',
+        async redeem(input, ctx) {
+            const codeVerifier = requireCodeVerifier('x', input);
+            const tokenPayload = await requestJson('x', 'X token exchange', ctx, 'https://api.x.com/2/oauth2/token', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`,
+                },
+                body: formBody({
+                    grant_type: 'authorization_code',
+                    code: input.code,
+                    redirect_uri: input.redirectUri,
+                    code_verifier: codeVerifier,
+                }),
+            });
+            const tokens = parseTokens('x', tokenPayload, nowOf(ctx));
+            const userPayload = await requestJson('x', 'X /users/me request', ctx, 'https://api.x.com/2/users/me?user.fields=profile_image_url', { headers: { Authorization: `Bearer ${tokens.accessToken}` } });
+            const user = asRecord('x', asRecord('x', userPayload, 'X /users/me response').data, 'X user');
+            const id = str(user.id);
+            if (!id)
+                throw new OAuthProviderError('x', 'malformed', 'X user is missing id');
+            return {
+                tokens,
+                profile: {
+                    providerUserId: id,
+                    verifiedEmail: null,
+                    data: compact({
+                        name: user.name,
+                        username: user.username,
+                        profile_image_url: str(user.profile_image_url),
+                    }),
+                },
+            };
+        },
+    };
+}

package/dist/oauth-providers.d.mts

@@ -0,0 +1,8 @@
+export type { OAuthFetch, OAuthProfile } from './oauth-types.mts';
+export { OAuthProviderError, type AuthorizationCodeInput, type OAuthCallContext, type OAuthProvider, type OAuthProviderErrorKind, type OAuthTokens, } from './oauth-providers-core.mts';
+export { facebookProvider, type FacebookProviderConfig } from './oauth-providers-facebook.mts';
+export { githubProvider, type GithubProviderConfig } from './oauth-providers-github.mts';
+export { googleProvider, type GoogleProviderConfig } from './oauth-providers-google.mts';
+export { linkedinProvider, type LinkedinProviderConfig } from './oauth-providers-linkedin.mts';
+export { microsoftAuthorizationScopes, microsoftProvider, type MicrosoftProviderConfig, } from './oauth-providers-microsoft.mts';
+export { xProvider, type XProviderConfig } from './oauth-providers-x.mts';

package/dist/oauth-providers.mjs

@@ -0,0 +1,7 @@
+export { OAuthProviderError, } from './oauth-providers-core.mjs';
+export { facebookProvider } from './oauth-providers-facebook.mjs';
+export { githubProvider } from './oauth-providers-github.mjs';
+export { googleProvider } from './oauth-providers-google.mjs';
+export { linkedinProvider } from './oauth-providers-linkedin.mjs';
+export { microsoftAuthorizationScopes, microsoftProvider, } from './oauth-providers-microsoft.mjs';
+export { xProvider } from './oauth-providers-x.mjs';

package/dist/oauth-types.d.mts

@@ -0,0 +1,8 @@
+/** Injected transport. Egress guards, dispatchers and timeouts belong to the caller. */
+export type OAuthFetch = (input: string, init?: RequestInit) => Promise<Response>;
+export interface OAuthProfile {
+    providerUserId: string;
+    /** Only set when the provider asserts the address is verified. */
+    verifiedEmail: string | null;
+    data: Record<string, unknown>;
+}

package/dist/oauth-types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/oidc-id-token-profiles.d.mts

@@ -0,0 +1,23 @@
+import type { OAuthProfile } from './oauth-types.mts';
+export interface OidcClaims {
+    iss: string;
+    aud: string | string[];
+    sub: string;
+    exp: number;
+    iat: number;
+    nonce?: string;
+    email?: string;
+    email_verified?: boolean | string;
+    name?: string;
+    picture?: string;
+    given_name?: string;
+    family_name?: string;
+    [claim: string]: unknown;
+}
+export declare function googleProfileFromClaims(claims: OidcClaims): OAuthProfile;
+/** Microsoft verifies an email only when the signed domain-owner claim is boolean true. */
+export declare function microsoftProfileFromClaims(claims: OidcClaims): OAuthProfile;
+/** Apple sends `email_verified` as a boolean or the string `'true'`. */
+export declare function appleProfileFromClaims(claims: OidcClaims, userData?: {
+    name?: string;
+}): OAuthProfile;

package/dist/oidc-id-token-profiles.mjs

@@ -0,0 +1,42 @@
+function isTrue(value) {
+    return value === true || value === 'true';
+}
+export function googleProfileFromClaims(claims) {
+    const data = {};
+    for (const key of ['name', 'email', 'picture', 'given_name', 'family_name']) {
+        if (claims[key])
+            data[key] = claims[key];
+    }
+    return {
+        providerUserId: claims.sub,
+        verifiedEmail: claims.email_verified === true ? (claims.email ?? null) : null,
+        data,
+    };
+}
+/** Microsoft verifies an email only when the signed domain-owner claim is boolean true. */
+export function microsoftProfileFromClaims(claims) {
+    const data = {};
+    for (const key of ['name', 'email', 'given_name', 'family_name']) {
+        if (claims[key])
+            data[key] = claims[key];
+    }
+    const oid = claims.oid;
+    return {
+        providerUserId: typeof oid === 'string' && oid.length > 0 ? oid : claims.sub,
+        verifiedEmail: claims.xms_edov === true ? (claims.email ?? null) : null,
+        data,
+    };
+}
+/** Apple sends `email_verified` as a boolean or the string `'true'`. */
+export function appleProfileFromClaims(claims, userData) {
+    const data = {};
+    if (userData?.name)
+        data.name = userData.name;
+    if (claims.email)
+        data.email = claims.email;
+    return {
+        providerUserId: claims.sub,
+        verifiedEmail: isTrue(claims.email_verified) ? (claims.email ?? null) : null,
+        data,
+    };
+}

package/dist/oidc-id-token-util.d.mts

@@ -0,0 +1,6 @@
+/**
+ * Rejects with the signal's reason when it aborts; the underlying promise keeps running.
+ * An already-aborted signal rejects at once, and the abandoned promise gets a no-op handler so
+ * a later failure is not an unhandled rejection.
+ */
+export declare function abortable<T>(promise: Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/oidc-id-token-util.mjs

@@ -0,0 +1,18 @@
+/**
+ * Rejects with the signal's reason when it aborts; the underlying promise keeps running.
+ * An already-aborted signal rejects at once, and the abandoned promise gets a no-op handler so
+ * a later failure is not an unhandled rejection.
+ */
+export function abortable(promise, signal) {
+    if (!signal)
+        return promise;
+    if (signal.aborted) {
+        promise.catch(() => undefined);
+        return Promise.reject(signal.reason);
+    }
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason);
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.finally(() => signal.removeEventListener('abort', onAbort)).then(resolve, reject);
+    });
+}

package/dist/oidc-id-token.d.mts

@@ -0,0 +1,33 @@
+import type { OAuthFetch } from './oauth-types.mts';
+import type { OidcClaims } from './oidc-id-token-profiles.mts';
+export { appleProfileFromClaims, googleProfileFromClaims, microsoftProfileFromClaims, type OidcClaims, } from './oidc-id-token-profiles.mts';
+export type OidcVerificationCode = 'format' | 'alg' | 'key_not_found' | 'signature' | 'expired' | 'future_iat' | 'not_yet_valid' | 'issuer' | 'audience' | 'nonce' | 'nonce_missing' | 'jwks_fetch';
+export declare class OidcVerificationError extends Error {
+    readonly code: OidcVerificationCode;
+    constructor(code: OidcVerificationCode, message: string);
+}
+export interface OidcIdTokenVerifierOptions {
+    jwksUri: string;
+    issuers: readonly string[];
+    /** Additional issuer rule evaluated only after the token signature is verified. */
+    issuerMatches?: (claims: OidcClaims, keyIssuer?: string) => boolean;
+    /** Read on every verification so configuration can change at runtime. */
+    audiences: () => readonly string[];
+    fetch: OAuthFetch;
+    /** JWKS cache lifetime; defaults to one hour. */
+    cacheTtlMs?: number;
+    /** Allowed `iat` skew in seconds; defaults to 300. */
+    maxIatSkewSeconds?: number;
+    /** Minimum time between JWKS fetches triggered by an unknown `kid`; defaults to one minute. */
+    refreshCooldownMs?: number;
+    now?: () => number;
+}
+export interface OidcVerifyOptions {
+    /** Raw nonce; compared with the `nonce` claim (hashed first when `nonceHash` is set). */
+    nonce?: string;
+    nonceHash?: 'sha256-hex';
+    signal?: AbortSignal;
+}
+export declare function createOidcIdTokenVerifier(options: OidcIdTokenVerifierOptions): {
+    verify(idToken: string, verify?: OidcVerifyOptions): Promise<OidcClaims>;
+};

package/dist/oidc-id-token.mjs

@@ -0,0 +1,141 @@
+import { createHash, createPublicKey, createVerify } from 'node:crypto';
+import { abortable } from './oidc-id-token-util.mjs';
+export { appleProfileFromClaims, googleProfileFromClaims, microsoftProfileFromClaims, } from './oidc-id-token-profiles.mjs';
+export class OidcVerificationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'OidcVerificationError';
+        this.code = code;
+    }
+}
+function decodePart(part) {
+    try {
+        const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // Reported below as a format error.
+    }
+    throw new OidcVerificationError('format', 'ID token is malformed');
+}
+export function createOidcIdTokenVerifier(options) {
+    const now = options.now ?? Date.now;
+    const ttl = options.cacheTtlMs ?? 60 * 60 * 1000;
+    const skew = options.maxIatSkewSeconds ?? 300;
+    const cooldown = options.refreshCooldownMs ?? 60 * 1000;
+    let keys = null;
+    let cachedAt = 0;
+    function loadKeys(forceRefresh) {
+        const age = now() - cachedAt;
+        // A forced refresh is skipped inside the cooldown, which also joins concurrent callers.
+        if (keys && age < ttl && (!forceRefresh || age < cooldown))
+            return keys;
+        // The shared fetch ignores any caller's signal; callers cancel only their own wait.
+        const pending = options
+            .fetch(options.jwksUri)
+            .then(async (response) => {
+            if (!response.ok) {
+                throw new OidcVerificationError('jwks_fetch', `JWKS request failed: ${response.status}`);
+            }
+            const body = (await response.json());
+            if (!Array.isArray(body.keys)) {
+                throw new OidcVerificationError('jwks_fetch', 'JWKS response has no keys');
+            }
+            return body.keys;
+        })
+            .catch((error) => {
+            keys = null;
+            throw error;
+        });
+        cachedAt = now();
+        keys = pending;
+        return pending;
+    }
+    async function findKey(kid, signal) {
+        const match = (list) => list.find((key) => key.kid === kid);
+        // Never start a load for a caller that is already cancelled: nobody would observe its failure.
+        signal?.throwIfAborted();
+        const found = match(await abortable(loadKeys(false), signal));
+        if (found)
+            return found;
+        // The key may have rotated inside the cache window: refresh, at most once per cooldown.
+        const refreshed = match(await abortable(loadKeys(true), signal));
+        if (!refreshed)
+            throw new OidcVerificationError('key_not_found', 'Signing key not found');
+        return refreshed;
+    }
+    function checkSignature(signed, signature, key) {
+        let valid = false;
+        try {
+            const publicKey = createPublicKey({
+                key: { kty: key.kty, n: key.n, e: key.e },
+                format: 'jwk',
+            });
+            valid = createVerify('SHA256')
+                .update(signed)
+                .verify(publicKey, Buffer.from(signature, 'base64url'));
+        }
+        catch {
+            // An unusable key is reported as an invalid signature.
+        }
+        if (!valid)
+            throw new OidcVerificationError('signature', 'ID token signature is invalid');
+    }
+    function checkClaims(claims, verify, key) {
+        if (typeof claims.exp !== 'number' || typeof claims.iat !== 'number') {
+            throw new OidcVerificationError('format', 'ID token is missing exp or iat');
+        }
+        if (claims.nbf !== undefined && typeof claims.nbf !== 'number') {
+            throw new OidcVerificationError('format', 'ID token nbf is not a number');
+        }
+        if (typeof claims.sub !== 'string' || claims.sub.length === 0) {
+            throw new OidcVerificationError('format', 'ID token is missing sub');
+        }
+        const seconds = Math.floor(now() / 1000);
+        if (claims.exp < seconds)
+            throw new OidcVerificationError('expired', 'ID token has expired');
+        if (claims.iat > seconds + skew) {
+            throw new OidcVerificationError('future_iat', 'ID token was issued in the future');
+        }
+        if (claims.nbf !== undefined && claims.nbf > seconds + skew) {
+            throw new OidcVerificationError('not_yet_valid', 'ID token is not valid yet');
+        }
+        if (!options.issuers.includes(claims.iss) && !options.issuerMatches?.(claims, key.issuer)) {
+            throw new OidcVerificationError('issuer', 'ID token issuer is invalid');
+        }
+        const accepted = options.audiences();
+        const presented = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
+        if (!presented.some((audience) => accepted.includes(audience))) {
+            throw new OidcVerificationError('audience', 'ID token audience is invalid');
+        }
+        if (verify.nonce === undefined)
+            return;
+        if (!claims.nonce)
+            throw new OidcVerificationError('nonce_missing', 'ID token has no nonce');
+        const expected = verify.nonceHash === 'sha256-hex'
+            ? createHash('sha256').update(verify.nonce).digest('hex')
+            : verify.nonce;
+        if (claims.nonce !== expected) {
+            throw new OidcVerificationError('nonce', 'ID token nonce is invalid');
+        }
+    }
+    return {
+        async verify(idToken, verify = {}) {
+            const [header, payload, signature, ...rest] = idToken.split('.');
+            if (!header || !payload || !signature || rest.length > 0) {
+                throw new OidcVerificationError('format', 'ID token is malformed');
+            }
+            const { alg, kid } = decodePart(header);
+            if (alg !== 'RS256')
+                throw new OidcVerificationError('alg', 'Unsupported ID token algorithm');
+            const key = await findKey(kid, verify.signal);
+            checkSignature(`${header}.${payload}`, signature, key);
+            const claims = decodePart(payload);
+            checkClaims(claims, verify, key);
+            return claims;
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vouchington/utils",
-  "version": "0.7.5",
+  "version": "0.9.0",
   "description": "Dependency-free runtime utilities for Vouchington-style applications.",
   "homepage": "https://github.com/vouchington/vouchington-platform/tree/main/packages/utils#readme",
   "bugs": {
@@ -235,6 +235,16 @@
       "import": "./dist/observability.mjs",
       "default": "./dist/observability.mjs"
     },
+    "./error-tree": {
+      "types": "./dist/error-tree.d.mts",
+      "import": "./dist/error-tree.mjs",
+      "default": "./dist/error-tree.mjs"
+    },
+    "./job-data-scrub": {
+      "types": "./dist/job-data-scrub.d.mts",
+      "import": "./dist/job-data-scrub.mjs",
+      "default": "./dist/job-data-scrub.mjs"
+    },
     "./hashtags": {
       "types": "./dist/hashtags.d.mts",
       "import": "./dist/hashtags.mjs",
@@ -260,6 +270,26 @@
       "import": "./dist/http-link-pagination.mjs",
       "default": "./dist/http-link-pagination.mjs"
     },
+    "./oauth-pkce": {
+      "types": "./dist/oauth-pkce.d.mts",
+      "import": "./dist/oauth-pkce.mjs",
+      "default": "./dist/oauth-pkce.mjs"
+    },
+    "./oauth-popup": {
+      "types": "./dist/oauth-popup.d.mts",
+      "import": "./dist/oauth-popup.mjs",
+      "default": "./dist/oauth-popup.mjs"
+    },
+    "./oauth-providers": {
+      "types": "./dist/oauth-providers.d.mts",
+      "import": "./dist/oauth-providers.mjs",
+      "default": "./dist/oauth-providers.mjs"
+    },
+    "./oidc-id-token": {
+      "types": "./dist/oidc-id-token.d.mts",
+      "import": "./dist/oidc-id-token.mjs",
+      "default": "./dist/oidc-id-token.mjs"
+    },
     "./http-signatures": {
       "types": "./dist/http-signatures.d.mts",
       "import": "./dist/http-signatures.mjs",