oauth4webapi 2.0.0 → 2.0.2

package/README.md

@@ -39,7 +39,7 @@ import * as oauth2 from 'oauth4webapi'
 **`example`** Deno import
 
 ```js
-import * as oauth2 from 'https://deno.land/x/oauth4webapi/mod.ts'
+import * as oauth2 from 'https://deno.land/x/oauth4webapi@v2.0.2/mod.ts'
 ```
 
 - Authorization Code Flow - OpenID Connect [source](examples/code.ts), or plain OAuth 2 [source](examples/oauth.ts)
@@ -71,5 +71,4 @@ These are _(this is not an exhaustive list)_:
 - Implicit, Hybrid, and Resource Owner Password Credentials Flows
 - Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
 - JSON Web Encryption (JWE)
-- JSON Web Signature (JWS) rarely used algorithms and HMAC
 - Automatic polyfills of any kind

package/build/index.d.ts

@@ -1,9 +1,9 @@
-declare type JsonObject = {
+type JsonObject = {
     [Key in string]?: JsonValue;
 };
-declare type JsonArray = JsonValue[];
-declare type JsonPrimitive = string | number | boolean | null;
-declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
+type JsonArray = JsonValue[];
+type JsonPrimitive = string | number | boolean | null;
+type JsonValue = JsonPrimitive | JsonObject | JsonArray;
 /**
  * Interface to pass an asymmetric private key and, optionally, its associated JWK Key ID to be
  * added as a `kid` JOSE Header Parameter.
@@ -41,7 +41,7 @@ export interface PrivateKey {
  * @see [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
  * @see [OAuth Token Endpoint Authentication Methods](https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method)
  */
-export declare type ClientAuthenticationMethod = 'client_secret_basic' | 'client_secret_post' | 'private_key_jwt' | 'none';
+export type ClientAuthenticationMethod = 'client_secret_basic' | 'client_secret_post' | 'private_key_jwt' | 'none';
 /**
  * Supported JWS `alg` Algorithm identifiers.
  *
@@ -84,7 +84,7 @@ export declare type ClientAuthenticationMethod = 'client_secret_basic' | 'client
  * }
  * ```
  */
-export declare type JWSAlgorithm = 'PS256' | 'ES256' | 'RS256' | 'EdDSA';
+export type JWSAlgorithm = 'PS256' | 'ES256' | 'RS256' | 'EdDSA';
 /**
  * Authorization Server Metadata
  *
@@ -1014,7 +1014,7 @@ declare class CallbackParameters extends URLSearchParams {
  * @see [RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification](https://www.rfc-editor.org/rfc/rfc9207.html)
  */
 export declare function validateAuthResponse(as: AuthorizationServer, client: Client, parameters: URLSearchParams | URL, expectedState?: string | typeof expectNoState | typeof skipStateCheck): CallbackParameters | OAuth2Error;
-declare type ReturnTypes = TokenEndpointResponse | OAuth2TokenEndpointResponse | OpenIDTokenEndpointResponse | ClientCredentialsGrantResponse | DeviceAuthorizationResponse | IntrospectionResponse | OAuth2Error | PushedAuthorizationResponse | URLSearchParams | UserInfoResponse;
+type ReturnTypes = TokenEndpointResponse | OAuth2TokenEndpointResponse | OpenIDTokenEndpointResponse | ClientCredentialsGrantResponse | DeviceAuthorizationResponse | IntrospectionResponse | OAuth2Error | PushedAuthorizationResponse | URLSearchParams | UserInfoResponse;
 export interface DeviceAuthorizationRequestOptions extends HttpRequestOptions, AuthenticatedRequestOptions {
 }
 /**

package/build/index.js

@@ -1,7 +1,7 @@
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'oauth4webapi';
-    const VERSION = 'v2.0.0';
+    const VERSION = 'v2.0.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 const encoder = new TextEncoder();
@@ -432,6 +432,21 @@ export async function issueRequestObject(as, client, parameters, privateKey) {
         resource.length > 1) {
         claims.resource = resource;
     }
+    if (parameters.has('claims')) {
+        const value = parameters.get('claims');
+        if (value === '[object Object]') {
+            throw new OPE('"claims" parameter must be passed as a UTF-8 encoded JSON');
+        }
+        try {
+            claims.claims = JSON.parse(value);
+        }
+        catch {
+            throw new OPE('failed to parse the "claims" parameter as JSON');
+        }
+        if (!isJsonObject(claims.claims)) {
+            throw new OPE('"claims" parameter must be a top level object');
+        }
+    }
     return jwt({
         alg: determineJWSAlgorithm(key),
         typ: 'oauth-authz-req+jwt',
@@ -469,9 +484,14 @@ async function dpopProofJwt(headers, options, url, htm, accessToken) {
     }, privateKey);
     headers.set('dpop', proof);
 }
+const jwkCache = Symbol();
 async function publicJwk(key) {
+    if (key[jwkCache]) {
+        return key[jwkCache];
+    }
     const { kty, e, n, x, y, crv } = await crypto.subtle.exportKey('jwk', key);
-    return { kty, crv, e, n, x, y };
+    const jwk = (key[jwkCache] = { kty, e, n, x, y, crv });
+    return jwk;
 }
 export async function pushedAuthorizationRequest(as, client, parameters, options) {
     assertAs(as);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauth4webapi",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "OAuth 2 / OpenID Connect for Web Platform API JavaScript runtimes",
   "keywords": [
     "auth",