Register at the AS

One registration per resource. The binding key is your IdP redirect URI — same value you registered there. jwt-bearer never actually redirects; the URI is just the shared identifier the IdP uses to re-derive your client_id here.

\n`));\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const redirectUri = body.redirect_uri as string;\n const resource = body.resource as string;\n if (!redirectUri || !resource) {\n return c.json({ error: \"invalid_request\", error_description: \"redirect_uri and resource required\" }, 400);\n }\n return c.json(await register(AS_PREFIX, URLS.as, redirectUri, resource));\n});\n\n// ─── /token — jwt-bearer ────────────────────────────────────────────────────\n// Validation order: client auth → typ → sig via IdP JWKS → iss/aud/clock →\n// client_id binding. Then mint an access-JWT aud-bound to the ID-JAG's\n// `resource` claim (not a hardcoded RS — we front multiple resources).\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({ error: \"unsupported_grant_type\", error_description: String(body.grant_type) }, 400);\n }\n\n // Client auth — basic or post\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n if (!clientId || !clientSecret || !(await validateSecret(clientId, clientSecret))) {\n return c.json({ error: \"invalid_client\", error_description: \"client authentication failed\" }, 401);\n }\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({ error: \"invalid_request\", error_description: \"missing assertion\" }, 400);\n }\n\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== ID_JAG_TYP) {\n return c.json({ error: \"invalid_grant\", error_description: `typ must be ${ID_JAG_TYP}, got ${header.typ}` }, 400);\n }\n\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, idpJwks, {\n issuer: URLS.idp,\n audience: [URLS.as, `${URLS.as}/`],\n clockTolerance: 30,\n });\n claims = payload;\n } catch (e) {\n return c.json({ error: \"invalid_grant\", error_description: `ID-JAG verification failed: ${e instanceof Error ? e.message : e}` }, 400);\n }\n\n // The IdP put your AS client_id in here. If it doesn't match who you\n // authenticated as just now, something's off.\n if (claims.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG client_id (${claims.client_id}) does not match authenticating client (${clientId})`,\n }, 400);\n }\n\n const resource = claims.resource as string;\n if (!resource) {\n return c.json({ error: \"invalid_grant\", error_description: \"ID-JAG missing resource claim\" }, 400);\n }\n\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as)\n .setAudience(resource)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({ access_token: accessToken, token_type: \"Bearer\", expires_in: 3600 });\n});\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n { method: \"GET\", path: \"/register\", note: \"same redirect_uri as at the IdP\" },\n { method: \"POST\", path: \"/token\", note: \"jwt-bearer\" },\n ],\n })));\n\napp.onError((err) => { throw err; });\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3002 }, app.fetch);\n","deleted","label",[100],"permalink","https://www.val.town/x/pcarleton/xaa-mcp-as/code/http.ts","extension","actionData","errors"]