98
return body;
99
}
101
>
//#region types
102
>
103
>
/**
104
>
* Base OAuth 2.0 error codes as specified in RFC 6749.
105
>
*/
106
>
export const enum AuthorizationErrorType {
107
>
InvalidRequest = 'invalid_request',
108
>
InvalidClient = 'invalid_client',
109
>
InvalidGrant = 'invalid_grant',
110
>
UnauthorizedClient = 'unauthorized_client',
111
>
UnsupportedGrantType = 'unsupported_grant_type',
112
>
InvalidScope = 'invalid_scope'
113
>
}
114
>
115
>
/**
116
>
* Device authorization grant specific error codes as specified in RFC 8628 section 3.5.
117
>
*/
118
>
export const enum AuthorizationDeviceCodeErrorType {
119
>
/**
120
>
* The authorization request is still pending as the end user hasn't completed the user interaction steps.
121
>
*/
122
>
AuthorizationPending = 'authorization_pending',
123
>
/**
124
>
* A variant of "authorization_pending", polling should continue but interval must be increased by 5 seconds.
125
>
*/
126
>
SlowDown = 'slow_down',
127
>
/**
128
>
* The authorization request was denied.
129
>
*/
130
>
AccessDenied = 'access_denied',
131
>
/**
132
>
* The "device_code" has expired and the device authorization session has concluded.
133
>
*/
134
>
ExpiredToken = 'expired_token'
135
>
}
136
>
137
>
/**
138
>
* Dynamic client registration specific error codes as specified in RFC 7591.
139
>
*/
140
>
export const enum AuthorizationRegistrationErrorType {
141
>
/**
142
>
* The value of one or more redirection URIs is invalid.
143
>
*/
144
>
InvalidRedirectUri = 'invalid_redirect_uri',
145
>
/**
146
>
* The value of one of the client metadata fields is invalid and the server has rejected this request.
147
>
*/
148
>
InvalidClientMetadata = 'invalid_client_metadata',
149
>
/**
150
>
* The software statement presented is invalid.
151
>
*/
152
>
InvalidSoftwareStatement = 'invalid_software_statement',
153
>
/**
154
>
* The software statement presented is not approved for use by this authorization server.
155
>
*/
156
>
UnapprovedSoftwareStatement = 'unapproved_software_statement'
157
>
}
158
>
159
>
/**
160
>
* Metadata about a protected resource.
161
>
*/
162
>
export interface IAuthorizationProtectedResourceMetadata {
163
>
/**
164
>
* REQUIRED. The protected resource's resource identifier URL that uses https scheme and has no fragment components.
165
>
*/
166
>
resource: string;
167
>
168
>
/**
169
>
* OPTIONAL. Human-readable name of the protected resource intended for display to the end user.
170
>
*/
171
>
resource_name?: string;
172
>
173
>
/**
174
>
* OPTIONAL. JSON array containing a list of OAuth authorization server identifiers.
175
>
*/
176
>
authorization_servers?: string[];
177
>
178
>
/**
179
>
* OPTIONAL. URL of the protected resource's JWK Set document.
180
>
*/
181
>
jwks_uri?: string;
182
>
183
>
/**
184
>
* RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values used in authorization requests.
185
>
*/
186
>
scopes_supported?: string[];
187
>
188
>
/**
189
>
* OPTIONAL. JSON array containing a list of the OAuth 2.0 Bearer Token presentation methods supported.
190
>
*/
191
>
bearer_methods_supported?: string[];
192
>
193
>
/**
194
>
* OPTIONAL. JSON array containing a list of the JWS signing algorithms supported.
195
>
*/
196
>
resource_signing_alg_values_supported?: string[];
197
>
198
>
/**
199
>
* OPTIONAL. JSON array containing a list of the JWE encryption algorithms supported.
200
>
*/
201
>
resource_encryption_alg_values_supported?: string[];
202
>
203
>
/**
204
>
* OPTIONAL. JSON array containing a list of the JWE encryption algorithms supported.
205
>
*/
206
>
resource_encryption_enc_values_supported?: string[];
207
>
208
>
/**
209
>
* OPTIONAL. URL of a page containing human-readable documentation.
210
>
*/
211
>
resource_documentation?: string;
212
>
213
>
/**
214
>
* OPTIONAL. URL that provides the resource's requirements on how clients can use the data.
215
>
*/
216
>
resource_policy_uri?: string;
217
>
218
>
/**
219
>
* OPTIONAL. URL that provides the resource's terms of service.
220
>
*/
221
>
resource_tos_uri?: string;
222
>
}
223
>
224
>
/**
225
>
* Metadata about an OAuth 2.0 Authorization Server.
226
>
*/
227
>
export interface IAuthorizationServerMetadata {
228
>
/**
229
>
* REQUIRED. The authorization server's issuer identifier URL that uses https scheme and has no query or fragment components.
230
>
*/
231
>
issuer: string;
232
>
233
>
/**
234
>
* URL of the authorization server's authorization endpoint.
235
>
* This is REQUIRED unless no grant types are supported that use the authorization endpoint.
236
>
*/
237
>
authorization_endpoint?: string;
238
>
239
>
/**
240
>
* URL of the authorization server's token endpoint.
241
>
* This is REQUIRED unless only the implicit grant type is supported.
242
>
*/
243
>
token_endpoint?: string;
244
>
245
>
/**
246
>
* OPTIONAL. URL of the authorization server's device code endpoint.
247
>
*/
248
>
device_authorization_endpoint?: string;
249
>
250
>
/**
251
>
* OPTIONAL. URL of the authorization server's JWK Set document containing signing keys.
252
>
*/
253
>
jwks_uri?: string;
254
>
255
>
/**
256
>
* OPTIONAL. URL of the authorization server's OAuth 2.0 Dynamic Client Registration endpoint.
257
>
*/
258
>
registration_endpoint?: string;
259
>
260
>
/**
261
>
* RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values supported.
262
>
*/
263
>
scopes_supported?: string[];
264
>
265
>
/**
266
>
* REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values supported.
267
>
*/
268
>
response_types_supported: string[];
269
>
270
>
/**
271
>
* OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values supported.
272
>
* Default is ["query", "fragment"].
273
>
*/
274
>
response_modes_supported?: string[];
275
>
276
>
/**
277
>
* OPTIONAL. JSON array containing a list of OAuth 2.0 grant type values supported.
278
>
* Default is ["authorization_code", "implicit"].
279
>
*/
280
>
grant_types_supported?: string[];
281
>
282
>
/**
283
>
* OPTIONAL. JSON array containing a list of client authentication methods supported by the token endpoint.
284
>
* Default is "client_secret_basic".
285
>
*/
286
>
token_endpoint_auth_methods_supported?: string[];
287
>
288
>
/**
289
>
* OPTIONAL. JSON array containing a list of JWS signing algorithms supported by the token endpoint.
290
>
*/
291
>
token_endpoint_auth_signing_alg_values_supported?: string[];
292
>
293
>
/**
294
>
* OPTIONAL. URL of a page containing human-readable documentation for developers.
295
>
*/
296
>
service_documentation?: string;
297
>
298
>
/**
299
>
* OPTIONAL. Languages and scripts supported for the user interface, as a JSON array of BCP 47 language tags.
300
>
*/
301
>
ui_locales_supported?: string[];
302
>
303
>
/**
304
>
* OPTIONAL. URL that the authorization server provides to read about the authorization server's requirements.
305
>
*/
306
>
op_policy_uri?: string;
307
>
308
>
/**
309
>
* OPTIONAL. URL that the authorization server provides to read about the authorization server's terms of service.
310
>
*/
311
>
op_tos_uri?: string;
312
>
313
>
/**
314
>
* OPTIONAL. URL of the authorization server's OAuth 2.0 revocation endpoint.
315
>
*/
316
>
revocation_endpoint?: string;
317
>
318
>
/**
319
>
* OPTIONAL. JSON array containing a list of client authentication methods supported by the revocation endpoint.
320
>
*/
321
>
revocation_endpoint_auth_methods_supported?: string[];
322
>
323
>
/**
324
>
* OPTIONAL. JSON array containing a list of JWS signing algorithms supported by the revocation endpoint.
325
>
*/
326
>
revocation_endpoint_auth_signing_alg_values_supported?: string[];
327
>
328
>
/**
329
>
* OPTIONAL. URL of the authorization server's OAuth 2.0 introspection endpoint.
330
>
*/
331
>
introspection_endpoint?: string;
332
>
333
>
/**
334
>
* OPTIONAL. JSON array containing a list of client authentication methods supported by the introspection endpoint.
335
>
*/
336
>
introspection_endpoint_auth_methods_supported?: string[];
337
>
338
>
/**
339
>
* OPTIONAL. JSON array containing a list of JWS signing algorithms supported by the introspection endpoint.
340
>
*/
341
>
introspection_endpoint_auth_signing_alg_values_supported?: string[];
342
>
343
>
/**
344
>
* OPTIONAL. JSON array containing a list of PKCE code challenge methods supported.
345
>
*/
346
>
code_challenge_methods_supported?: string[];
347
>
348
>
/**
349
>
* OPTIONAL. Boolean flag indicating whether the authorization server supports the
350
>
* client_id_metadata document.
351
>
* ref https://datatracker.ietf.org/doc/html/draft-parecki-oauth-client-id-metadata-document-03
352
>
*/
353
>
client_id_metadata_document_supported?: boolean;
354
>
}
355
>
356
>
/**
357
>
* Request for the dynamic client registration endpoint.
358
>
* @see https://datatracker.ietf.org/doc/html/rfc7591#section-2
359
>
*/
360
>
export interface IAuthorizationDynamicClientRegistrationRequest {
361
>
/**
362
>
* OPTIONAL. Array of redirection URI strings for use in redirect-based flows
363
>
* such as the authorization code and implicit flows.
364
>
*/
365
>
redirect_uris?: string[];
366
>
367
>
/**
368
>
* OPTIONAL. String indicator of the requested authentication method for the token endpoint.
369
>
* Values: "none", "client_secret_post", "client_secret_basic".
370
>
* Default is "client_secret_basic".
371
>
*/
372
>
token_endpoint_auth_method?: string;
373
>
374
>
/**
375
>
* OPTIONAL. Array of OAuth 2.0 grant type strings that the client can use at the token endpoint.
376
>
* Default is ["authorization_code"].
377
>
*/
378
>
grant_types?: string[];
379
>
380
>
/**
381
>
* OPTIONAL. Array of the OAuth 2.0 response type strings that the client can use at the authorization endpoint.
382
>
* Default is ["code"].
383
>
*/
384
>
response_types?: string[];
385
>
386
>
/**
387
>
* OPTIONAL. Human-readable string name of the client to be presented to the end-user during authorization.
388
>
*/
389
>
client_name?: string;
390
>
391
>
/**
392
>
* OPTIONAL. URL string of a web page providing information about the client.
393
>
*/
394
>
client_uri?: string;
395
>
396
>
/**
397
>
* OPTIONAL. URL string that references a logo for the client.
398
>
*/
399
>
logo_uri?: string;
400
>
401
>
/**
402
>
* OPTIONAL. String containing a space-separated list of scope values that the client can use when requesting access tokens.
403
>
*/
404
>
scope?: string;
405
>
406
>
/**
407
>
* OPTIONAL. Array of strings representing ways to contact people responsible for this client, typically email addresses.
408
>
*/
409
>
contacts?: string[];
410
>
411
>
/**
412
>
* OPTIONAL. URL string that points to a human-readable terms of service document for the client.
413
>
*/
414
>
tos_uri?: string;
415
>
416
>
/**
417
>
* OPTIONAL. URL string that points to a human-readable privacy policy document.
418
>
*/
419
>
policy_uri?: string;
420
>
421
>
/**
422
>
* OPTIONAL. URL string referencing the client's JSON Web Key (JWK) Set document.
423
>
*/
424
>
jwks_uri?: string;
425
>
426
>
/**
427
>
* OPTIONAL. Client's JSON Web Key Set document value.
428
>
*/
429
>
jwks?: object;
430
>
431
>
/**
432
>
* OPTIONAL. A unique identifier string assigned by the client developer or software publisher.
433
>
*/
434
>
software_id?: string;
435
>
436
>
/**
437
>
* OPTIONAL. A version identifier string for the client software.
438
>
*/
439
>
software_version?: string;
440
>
441
>
/**
442
>
* OPTIONAL. A software statement containing client metadata values about the client software as claims.
443
>
*/
444
>
software_statement?: string;
445
>
446
>
/**
447
>
* OPTIONAL. Application type. Usually "native" for OAuth clients.
448
>
* https://openid.net/specs/openid-connect-registration-1_0.html
449
>
*/
450
>
application_type?: 'native' | 'web' | string;
451
>
452
>
/**
453
>
* OPTIONAL. Additional metadata fields as defined by extensions.
454
>
*/
455
>
[key: string]: unknown;
456
>
}
457
>
458
>
/**
459
>
* Response from the dynamic client registration endpoint.
460
>
*/
461
>
export interface IAuthorizationDynamicClientRegistrationResponse {
462
>
/**
463
>
* REQUIRED. The client identifier issued by the authorization server.
464
>
*/
465
>
client_id: string;
466
>
467
>
/**
468
>
* OPTIONAL. The client secret issued by the authorization server.
469
>
* Not returned for public clients.
470
>
*/
471
>
client_secret?: string;
472
>
473
>
/**
474
>
* OPTIONAL. Time at which the client secret will expire in seconds since the Unix Epoch.
475
>
*/
476
>
client_secret_expires_at?: number;
477
>
478
>
/**
479
>
* OPTIONAL. Client name as provided during registration.
480
>
*/
481
>
client_name?: string;
482
>
483
>
/**
484
>
* OPTIONAL. Client URI as provided during registration.
485
>
*/
486
>
client_uri?: string;
487
>
488
>
/**
489
>
* OPTIONAL. Array of redirection URIs as provided during registration.
490
>
*/
491
>
redirect_uris?: string[];
492
>
493
>
/**
494
>
* OPTIONAL. Array of grant types allowed for the client.
495
>
*/
496
>
grant_types?: string[];
497
>
498
>
/**
499
>
* OPTIONAL. Array of response types allowed for the client.
500
>
*/
501
>
response_types?: string[];
502
>
503
>
/**
504
>
* OPTIONAL. Type of authentication method used by the client.
505
>
*/
506
>
token_endpoint_auth_method?: string;
507
>
}
508
>
509
>
/**
510
>
* Response from the authorization endpoint.
511
>
* Typically returned as query parameters in a redirect.
512
>
*/
513
>
export interface IAuthorizationAuthorizeResponse {
514
>
/**
515
>
* REQUIRED. The authorization code generated by the authorization server.
516
>
*/
517
>
code: string;
518
>
519
>
/**
520
>
* REQUIRED. The state value that was sent in the authorization request.
521
>
* Used to prevent CSRF attacks.
522
>
*/
523
>
state: string;
524
>
}
525
>
526
>
/**
527
>
* Error response from the authorization endpoint.
528
>
*/
529
>
export interface IAuthorizationAuthorizeErrorResponse {
530
>
/**
531
>
* REQUIRED. Error code as specified in OAuth 2.0.
532
>
*/
533
>
error: string;
534
>
535
>
/**
536
>
* OPTIONAL. Human-readable description of the error.
537
>
*/
538
>
error_description?: string;
539
>
540
>
/**
541
>
* OPTIONAL. URI to a human-readable web page with more information about the error.
542
>
*/
543
>
error_uri?: string;
544
>
545
>
/**
546
>
* REQUIRED. The state value that was sent in the authorization request.
547
>
*/
548
>
state: string;
549
>
}
550
>
551
>
/**
552
>
* Response from the token endpoint.
553
>
*/
554
>
export interface IAuthorizationTokenResponse {
555
>
/**
556
>
* REQUIRED. The access token issued by the authorization server.
557
>
*/
558
>
access_token: string;
559
>
560
>
/**
561
>
* REQUIRED. The type of the token issued. Usually "Bearer".
562
>
*/
563
>
token_type: string;
564
>
565
>
/**
566
>
* RECOMMENDED. The lifetime in seconds of the access token.
567
>
*/
568
>
expires_in?: number;
569
>
570
>
/**
571
>
* OPTIONAL. The refresh token, which can be used to obtain new access tokens.
572
>
*/
573
>
refresh_token?: string;
574
>
575
>
/**
576
>
* OPTIONAL. The scope of the access token as a space-delimited list of strings.
577
>
*/
578
>
scope?: string;
579
>
580
>
/**
581
>
* OPTIONAL. ID Token value associated with the authenticated session for OpenID Connect flows.
582
>
*/
583
>
id_token?: string;
584
>
}
585
>
586
>
/**
587
>
* Error response from the token endpoint.
588
>
*/
589
>
export interface IAuthorizationTokenErrorResponse {
590
>
/**
591
>
* REQUIRED. Error code as specified in OAuth 2.0.
592
>
*/
593
>
error: string;
594
>
595
>
/**
596
>
* OPTIONAL. Human-readable description of the error.
597
>
*/
598
>
error_description?: string;
599
>
600
>
/**
601
>
* OPTIONAL. URI to a human-readable web page with more information about the error.
602
>
*/
603
>
error_uri?: string;
604
>
}
605
>
606
>
/**
607
>
* Response from the device authorization endpoint as per RFC 8628 section 3.2.
608
>
*/
609
>
export interface IAuthorizationDeviceResponse {
610
>
/**
611
>
* REQUIRED. The device verification code.
612
>
*/
613
>
device_code: string;
614
>
615
>
/**
616
>
* REQUIRED. The end-user verification code.
617
>
*/
618
>
user_code: string;
619
>
620
>
/**
621
>
* REQUIRED. The end-user verification URI on the authorization server.
622
>
*/
623
>
verification_uri: string;
624
>
625
>
/**
626
>
* OPTIONAL. A verification URI that includes the user_code, designed for non-textual transmission.
627
>
*/
628
>
verification_uri_complete?: string;
629
>
630
>
/**
631
>
* REQUIRED. The lifetime in seconds of the device_code and user_code.
632
>
*/
633
>
expires_in: number;
634
>
635
>
/**
636
>
* OPTIONAL. The minimum amount of time in seconds that the client should wait between polling requests.
637
>
* If no value is provided, clients must use 5 as the default.
638
>
*/
639
>
interval?: number;
640
>
}
641
>
642
>
/**
643
>
* Error response from the token endpoint when using device authorization grant.
644
>
* As defined in RFC 8628 section 3.5.
645
>
*/
646
>
export interface IAuthorizationErrorResponse {
647
>
/**
648
>
* REQUIRED. Error code as specified in OAuth 2.0 or in RFC 8628 section 3.5.
649
>
*/
650
>
error: AuthorizationErrorType | string;
651
>
652
>
/**
653
>
* OPTIONAL. Human-readable description of the error.
654
>
*/
655
>
error_description?: string;
656
>
657
>
/**
658
>
* OPTIONAL. URI to a human-readable web page with more information about the error.
659
>
*/
660
>
error_uri?: string;
661
>
}
662
>
663
>
/**
664
>
* Error response from the token endpoint when using device authorization grant.
665
>
* As defined in RFC 8628 section 3.5.
666
>
*/
667
>
export interface IAuthorizationDeviceTokenErrorResponse extends IAuthorizationErrorResponse {
668
>
/**
669
>
* REQUIRED. Error code as specified in OAuth 2.0 or in RFC 8628 section 3.5.
670
>
*/
671
>
error: AuthorizationErrorType | AuthorizationDeviceCodeErrorType | string;
672
>
}
673
>
674
>
export interface IAuthorizationRegistrationErrorResponse {
675
>
/**
676
>
* REQUIRED. Error code as specified in OAuth 2.0 or Dynamic Client Registration.
677
>
*/
678
>
error: AuthorizationRegistrationErrorType | string;
679
>
680
>
/**
681
>
* OPTIONAL. Human-readable description of the error.
682
>
*/
683
>
error_description?: string;
684
>
}
685
>
686
>
export interface IAuthorizationJWTClaims {
687
>
/**
688
>
* REQUIRED. JWT ID. Unique identifier for the token.
689
>
*/
690
>
jti: string;
691
>
692
>
/**
693
>
* REQUIRED. Subject. Principal about which the token asserts information.
694
>
*/
695
>
sub: string;
696
>
697
>
/**
698
>
* REQUIRED. Issuer. Entity that issued the token.
699
>
*/
700
>
iss: string;
701
>
702
>
/**
703
>
* OPTIONAL. Audience. Recipients that the token is intended for.
704
>
*/
705
>
aud?: string | string[];
706
>
707
>
/**
708
>
* OPTIONAL. Expiration time. Time after which the token is invalid (seconds since Unix epoch).
709
>
*/
710
>
exp?: number;
711
>
712
>
/**
713
>
* OPTIONAL. Not before time. Time before which the token is not valid (seconds since Unix epoch).
714
>
*/
715
>
nbf?: number;
716
>
717
>
/**
718
>
* OPTIONAL. Issued at time when the token was issued (seconds since Unix epoch).
719
>
*/
720
>
iat?: number;
721
>
722
>
/**
723
>
* OPTIONAL. Authorized party. The party to which the token was issued.
724
>
*/
725
>
azp?: string;
726
>
727
>
/**
728
>
* OPTIONAL. Scope values for which the token is valid.
729
>
*/
730
>
scope?: string;
731
>
732
>
/**
733
>
* OPTIONAL. Full name of the user.
734
>
*/
735
>
name?: string;
736
>
737
>
/**
738
>
* OPTIONAL. Given or first name of the user.
739
>
*/
740
>
given_name?: string;
741
>
742
>
/**
743
>
* OPTIONAL. Family name or last name of the user.
744
>
*/
745
>
family_name?: string;
746
>
747
>
/**
748
>
* OPTIONAL. Middle name of the user.
749
>
*/
750
>
middle_name?: string;
751
>
752
>
/**
753
>
* OPTIONAL. Preferred username or email the user wishes to be referred to.
754
>
*/
755
>
preferred_username?: string;
756
>
757
>
/**
758
>
* OPTIONAL. Email address of the user.
759
>
*/
760
>
email?: string;
761
>
762
>
/**
763
>
* OPTIONAL. True if the user's email has been verified.
764
>
*/
765
>
email_verified?: boolean;
766
>
767
>
/**
768
>
* OPTIONAL. User's profile picture URL.
769
>
*/
770
>
picture?: string;
771
>
772
>
/**
773
>
* OPTIONAL. Authentication time. Time when the user authentication occurred.
774
>
*/
775
>
auth_time?: number;
776
>
777
>
/**
778
>
* OPTIONAL. Authentication context class reference.
779
>
*/
780
>
acr?: string;
781
>
782
>
/**
783
>
* OPTIONAL. Authentication methods references.
784
>
*/
785
>
amr?: string[];
786
>
787
>
/**
788
>
* OPTIONAL. Session ID. String identifier for a session.
789
>
*/
790
>
sid?: string;
791
>
792
>
/**
793
>
* OPTIONAL. Address component.
794
>
*/
795
>
address?: {
796
>
formatted?: string;
797
>
street_address?: string;
798
>
locality?: string;
799
>
region?: string;
800
>
postal_code?: string;
801
>
country?: string;
802
>
};
803
>
804
>
/**
805
>
* OPTIONAL. Groups that the user belongs to.
806
>
*/
807
>
groups?: string[];
808
>
809
>
/**
810
>
* OPTIONAL. Roles assigned to the user.
811
>
*/
812
>
roles?: string[];
813
>
814
>
/**
815
>
* OPTIONAL. Handles optional claims that are not explicitly defined in the standard.
816
>
*/
817
>
[key: string]: unknown;
818
>
}
819
>
820
>
//#endregion
821
>
822
>
//#region is functions
823
>
824
>
export function isAuthorizationProtectedResourceMetadata(obj: unknown): obj is IAuthorizationProtectedResourceMetadata {
825
if (typeof obj !== 'object' || obj === null) {
826
return false;