oauth4webapi 1.2.1 → 1.2.2

package/README.md

@@ -67,7 +67,7 @@ The supported JavaScript runtimes include ones that
 - These are (not an exhaustive list):
   - Browsers
   - Cloudflare Workers
-  - Deno (^1.21.0)
+  - Deno
   - Electron
   - Next.js Middlewares
   - Node.js ([runtime flags may be needed](https://github.com/panva/oauth4webapi/issues/8))

package/build/index.d.ts

@@ -537,7 +537,7 @@ export interface DPoPOptions extends CryptoKeyPair {
      * Its algorithm must be compatible with a supported {@link JWSAlgorithm JWS `alg` Algorithm}.
      */
     privateKey: CryptoKey;
-    /** The public key corresponding to {@link DPoPOptions.privateKey} */
+    /** The public key corresponding to {@link DPoPOptions.privateKey}. */
     publicKey: CryptoKey;
     /**
      * Server-Provided Nonce to use in the request. This option serves as an override in case the

package/build/index.js

@@ -1,7 +1,7 @@
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'oauth4webapi';
-    const VERSION = 'v1.2.1';
+    const VERSION = 'v1.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 const encoder = new TextEncoder();
@@ -151,11 +151,17 @@ function prepareHeaders(input) {
     return headers;
 }
 function signal(value) {
-    return typeof value === 'function' ? value() : value;
+    if (typeof value === 'function') {
+        value = value();
+    }
+    if (!(value instanceof AbortSignal)) {
+        throw new TypeError('"options.signal" must return or be an instance of AbortSignal');
+    }
+    return value;
 }
 export async function discoveryRequest(issuerIdentifier, options) {
     if (!(issuerIdentifier instanceof URL)) {
-        throw new TypeError('"issuer" must be an instance of URL');
+        throw new TypeError('"issuerIdentifier" must be an instance of URL');
     }
     if (issuerIdentifier.protocol !== 'https:' && issuerIdentifier.protocol !== 'http:') {
         throw new TypeError('"issuer.protocol" must be "https:" or "http:"');
@@ -315,20 +321,20 @@ async function privateKeyJwt(as, client, key, kid) {
         kid,
     }, clientAssertion(as, client), key);
 }
-function assertIssuer(metadata) {
-    if (typeof metadata !== 'object' || metadata === null) {
-        throw new TypeError('"issuer" must be an object');
+function assertAs(as) {
+    if (typeof as !== 'object' || as === null) {
+        throw new TypeError('"as" must be an object');
     }
-    if (!validateString(metadata.issuer)) {
-        throw new TypeError('"issuer.issuer" property must be a non-empty string');
+    if (!validateString(as.issuer)) {
+        throw new TypeError('"as.issuer" property must be a non-empty string');
     }
     return true;
 }
-function assertClient(metadata) {
-    if (typeof metadata !== 'object' || metadata === null) {
+function assertClient(client) {
+    if (typeof client !== 'object' || client === null) {
         throw new TypeError('"client" must be an object');
     }
-    if (!validateString(metadata.client_id)) {
+    if (!validateString(client.client_id)) {
         throw new TypeError('"client.client_id" property must be a non-empty string');
     }
     return true;
@@ -399,7 +405,7 @@ async function jwt(header, claimsSet, key) {
     return `${input}.${signature}`;
 }
 export async function issueRequestObject(as, client, parameters, privateKey) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(parameters instanceof URLSearchParams)) {
         throw new TypeError('"parameters" must be an instance of URLSearchParams');
@@ -468,13 +474,13 @@ async function publicJwk(key) {
     return { kty, crv, e, n, x, y };
 }
 export async function pushedAuthorizationRequest(as, client, parameters, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(parameters instanceof URLSearchParams)) {
         throw new TypeError('"parameters" must be an instance of URLSearchParams');
     }
     if (typeof as.pushed_authorization_request_endpoint !== 'string') {
-        throw new TypeError('"issuer.pushed_authorization_request_endpoint" must be a string');
+        throw new TypeError('"as.pushed_authorization_request_endpoint" must be a string');
     }
     const url = new URL(as.pushed_authorization_request_endpoint);
     const body = new URLSearchParams(parameters);
@@ -555,7 +561,7 @@ export function parseWwwAuthenticateChallenges(response) {
     return challenges;
 }
 export async function processPushedAuthorizationResponse(as, client, response) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(response instanceof Response)) {
         throw new TypeError('"response" must be an instance of Response');
@@ -609,10 +615,10 @@ export async function protectedResourceRequest(accessToken, method, url, headers
     }).then(processDpopNonce);
 }
 export async function userInfoRequest(as, client, accessToken, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (typeof as.userinfo_endpoint !== 'string') {
-        throw new TypeError('"issuer.userinfo_endpoint" must be a string');
+        throw new TypeError('"as.userinfo_endpoint" must be a string');
     }
     const url = new URL(as.userinfo_endpoint);
     const headers = prepareHeaders(options?.headers);
@@ -716,7 +722,7 @@ function getContentType(response) {
     return response.headers.get('content-type')?.split(';')[0];
 }
 export async function processUserInfoResponse(as, client, expectedSubject, response, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(response instanceof Response)) {
         throw new TypeError('"response" must be an instance of Response');
@@ -727,7 +733,7 @@ export async function processUserInfoResponse(as, client, expectedSubject, respo
     let json;
     if (getContentType(response) === 'application/jwt') {
         if (typeof as.jwks_uri !== 'string') {
-            throw new TypeError('"issuer.jwks_uri" must be a string');
+            throw new TypeError('"as.jwks_uri" must be a string');
         }
         const { claims } = await validateJwt(await preserveBodyStream(response).text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options))
             .then(validateOptionalAudience.bind(undefined, client.client_id))
@@ -813,7 +819,7 @@ async function authenticatedRequest(as, client, method, url, body, headers, opti
 }
 async function tokenEndpointRequest(as, client, grantType, parameters, options) {
     if (typeof as.token_endpoint !== 'string') {
-        throw new TypeError('"issuer.token_endpoint" must be a string');
+        throw new TypeError('"as.token_endpoint" must be a string');
     }
     const url = new URL(as.token_endpoint);
     parameters.set('grant_type', grantType);
@@ -825,7 +831,7 @@ async function tokenEndpointRequest(as, client, grantType, parameters, options)
     return authenticatedRequest(as, client, 'POST', url, parameters, headers, options);
 }
 export async function refreshTokenGrantRequest(as, client, refreshToken, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!validateString(refreshToken)) {
         throw new TypeError('"refreshToken" must be a non-empty string');
@@ -842,7 +848,7 @@ export function getValidatedIdTokenClaims(ref) {
     return idTokenClaims.get(ref);
 }
 async function processGenericAccessTokenResponse(as, client, response, options, ignoreIdToken = false, ignoreRefreshToken = false) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(response instanceof Response)) {
         throw new TypeError('"response" must be an instance of Response');
@@ -892,7 +898,7 @@ async function processGenericAccessTokenResponse(as, client, response, options,
         }
         if (json.id_token) {
             if (typeof as.jwks_uri !== 'string') {
-                throw new TypeError('"issuer.jwks_uri" must be a string');
+                throw new TypeError('"as.jwks_uri" must be a string');
             }
             const { header, claims } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options))
                 .then(validatePresence.bind(undefined, ['aud', 'exp', 'iat', 'iss', 'sub']))
@@ -948,7 +954,7 @@ function validateIssuer(expected, result) {
     return result;
 }
 export async function authorizationCodeGrantRequest(as, client, callbackParameters, redirectUri, codeVerifier, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(callbackParameters instanceof CallbackParameters)) {
         throw new TypeError('"callbackParameters" must be an instance of CallbackParameters obtained from "validateAuthResponse()", or "validateJwtAuthResponse()');
@@ -1050,7 +1056,7 @@ function checkJwtType(expected, result) {
     return result;
 }
 export async function clientCredentialsGrantRequest(as, client, parameters, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     return tokenEndpointRequest(as, client, 'client_credentials', new URLSearchParams(parameters), options);
 }
@@ -1062,13 +1068,13 @@ export async function processClientCredentialsResponse(as, client, response) {
     return result;
 }
 export async function revocationRequest(as, client, token, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!validateString(token)) {
         throw new TypeError('"token" must be a non-empty string');
     }
     if (typeof as.revocation_endpoint !== 'string') {
-        throw new TypeError('"issuer.revocation_endpoint" must be a string');
+        throw new TypeError('"as.revocation_endpoint" must be a string');
     }
     const url = new URL(as.revocation_endpoint);
     const body = new URLSearchParams(options?.additionalParameters);
@@ -1096,13 +1102,13 @@ function assertReadableResponse(response) {
     }
 }
 export async function introspectionRequest(as, client, token, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!validateString(token)) {
         throw new TypeError('"token" must be a non-empty string');
     }
     if (typeof as.introspection_endpoint !== 'string') {
-        throw new TypeError('"issuer.introspection_endpoint" must be a string');
+        throw new TypeError('"as.introspection_endpoint" must be a string');
     }
     const url = new URL(as.introspection_endpoint);
     const body = new URLSearchParams(options?.additionalParameters);
@@ -1117,7 +1123,7 @@ export async function introspectionRequest(as, client, token, options) {
     return authenticatedRequest(as, client, 'POST', url, body, headers, options);
 }
 export async function processIntrospectionResponse(as, client, response, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(response instanceof Response)) {
         throw new TypeError('"response" must be an instance of Response');
@@ -1132,7 +1138,7 @@ export async function processIntrospectionResponse(as, client, response, options
     let json;
     if (getContentType(response) === 'application/token-introspection+jwt') {
         if (typeof as.jwks_uri !== 'string') {
-            throw new TypeError('"issuer.jwks_uri" must be a string');
+            throw new TypeError('"as.jwks_uri" must be a string');
         }
         const { claims } = await validateJwt(await preserveBodyStream(response).text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options))
             .then(checkJwtType.bind(undefined, 'token-introspection+jwt'))
@@ -1161,9 +1167,9 @@ export async function processIntrospectionResponse(as, client, response, options
     return json;
 }
 export async function jwksRequest(as, options) {
-    assertIssuer(as);
+    assertAs(as);
     if (typeof as.jwks_uri !== 'string') {
-        throw new TypeError('"issuer.jwks_uri" must be a string');
+        throw new TypeError('"as.jwks_uri" must be a string');
     }
     const url = new URL(as.jwks_uri);
     const headers = prepareHeaders(options?.headers);
@@ -1328,7 +1334,7 @@ async function validateJwt(jws, checkAlg, getKey) {
     return { header, claims };
 }
 export async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (parameters instanceof URL) {
         parameters = parameters.searchParams;
@@ -1341,7 +1347,7 @@ export async function validateJwtAuthResponse(as, client, parameters, expectedSt
         throw new OPE('"parameters" does not contain a JARM response');
     }
     if (typeof as.jwks_uri !== 'string') {
-        throw new TypeError('"issuer.jwks_uri" must be a string');
+        throw new TypeError('"as.jwks_uri" must be a string');
     }
     const { claims } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported), getPublicSigKeyFromIssuerJwksUri.bind(undefined, as, options))
         .then(validatePresence.bind(undefined, ['aud', 'exp', 'iss']))
@@ -1384,7 +1390,7 @@ export const expectNoState = Symbol();
 class CallbackParameters extends URLSearchParams {
 }
 export function validateAuthResponse(as, client, parameters, expectedState) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (parameters instanceof URL) {
         parameters = parameters.searchParams;
@@ -1460,13 +1466,13 @@ async function importJwk(jwk) {
     return crypto.subtle.importKey('jwk', key, algorithm, true, ['verify']);
 }
 export async function deviceAuthorizationRequest(as, client, parameters, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(parameters instanceof URLSearchParams)) {
         throw new TypeError('"parameters" must be an instance of URLSearchParams');
     }
     if (typeof as.device_authorization_endpoint !== 'string') {
-        throw new TypeError('"issuer.device_authorization_endpoint" must be a string');
+        throw new TypeError('"as.device_authorization_endpoint" must be a string');
     }
     const url = new URL(as.device_authorization_endpoint);
     const body = new URLSearchParams(parameters);
@@ -1476,7 +1482,7 @@ export async function deviceAuthorizationRequest(as, client, parameters, options
     return authenticatedRequest(as, client, 'POST', url, body, headers, options);
 }
 export async function processDeviceAuthorizationResponse(as, client, response) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!(response instanceof Response)) {
         throw new TypeError('"response" must be an instance of Response');
@@ -1520,7 +1526,7 @@ export async function processDeviceAuthorizationResponse(as, client, response) {
     return json;
 }
 export async function deviceCodeGrantRequest(as, client, deviceCode, options) {
-    assertIssuer(as);
+    assertAs(as);
     assertClient(client);
     if (!validateString(deviceCode)) {
         throw new TypeError('"deviceCode" must be a non-empty string');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauth4webapi",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "OAuth 2 / OpenID Connect for Web Platform API JavaScript runtimes",
   "keywords": [
     "auth",
@@ -43,35 +43,33 @@
   "scripts": {
     "_format": "find src test tap examples conformance -type f -name '*.ts' -o -name '*.mjs' | xargs prettier",
     "build": "rm -rf build && tsc && tsc --declaration true --emitDeclarationOnly true --removeComments false && tsc -p test && tsc -p examples && tsc -p conformance && tsc -p tap",
-    "conformance": "patch-package && NODE_OPTIONS='--no-warnings --loader=@esbuild-kit/esm-loader' ava --config conformance/ava.config.ts",
-    "coverage": "patch-package && c8 ava",
+    "conformance": "bash -c 'patch-package && source .node_flags.sh && ava --config conformance/ava.config.ts'",
     "docs": "patch-package && typedoc",
     "format": "npm run _format -- --write",
     "format-check": "npm run _format -- --check",
     "prepack": "npm run format && npm run docs && ./examples/.update-diffs.sh && git diff --quiet && npm run test && npm run build",
     "tap:deno": "./tap/.deno.sh",
     "tap:edge-runtime": "./tap/.edge-runtime.sh",
-    "tap:node": "./tap/.node.sh",
+    "tap:node": "bash -c './tap/.node.sh'",
     "tap:workers": "./tap/.workers.sh",
     "tap:browsers": "./tap/.browsers.sh",
-    "test": "ava"
+    "test": "bash -c 'source .node_flags.sh && ava'"
   },
   "devDependencies": {
     "@esbuild-kit/esm-loader": "^2.5.0",
-    "@types/node": "^18.8.3",
+    "@types/node": "^18.11.2",
     "@types/qunit": "^2.19.3",
     "ava": "^4.3.3",
-    "c8": "^7.12.0",
-    "edge-runtime": "^1.1.0-beta.31",
+    "edge-runtime": "^1.1.0-beta.40",
     "jose": "^4.10.0",
     "patch-package": "^6.4.7",
     "prettier": "^2.7.1",
     "prettier-plugin-jsdoc": "^0.4.2",
-    "qunit": "^2.19.1",
+    "qunit": "^2.19.2",
     "testcafe": "^2.0.1",
     "testcafe-browser-provider-browserstack": "^1.14.0",
     "timekeeper": "^2.2.0",
-    "typedoc": "^0.23.15",
+    "typedoc": "^0.23.17",
     "typedoc-plugin-markdown": "^3.13.6",
     "typescript": "^4.8.4",
     "undici": "^5.11.0",