Register at AS2

You bring the client_id — whatever your IdP stamps in the JAG's client_id claim. For Okta that's the resource app's Okta client_id (e.g. 0oa10m6h81mEkTVXn698). For the demo IdP it's your idp_id_....

We bind a secret to (idp_issuer, client_id, resource). At /token we re-derive the secret from the JAG claims — that's the trust gate. No separate issuer allowlist.

\n`,\n ),\n);\n\napp.post(\"/register\", async (c) => {\n const body = await c.req.parseBody();\n const idpIssuer = (body.idp_issuer as string)?.replace(/\\/$/, \"\");\n const jagClientId = body.jag_client_id as string;\n const resource = body.resource as string;\n if (!idpIssuer || !jagClientId || !resource) {\n return c.json({\n error: \"invalid_request\",\n error_description: \"idp_issuer, jag_client_id, resource required\",\n }, 400);\n }\n const client_secret = await deriveAs2Secret(idpIssuer, jagClientId, resource);\n return c.json({\n client_id: jagClientId,\n client_secret,\n idp_issuer: idpIssuer,\n resource,\n });\n});\n\n// ─── /token — jwt-bearer ────────────────────────────────────────────────────\n// The secret IS the trust decision. Re-derive from JAG.iss + authenticating\n// client_id + resource; if the presented secret matches, you registered for\n// exactly this tuple. Then verify the JAG sig against that issuer's JWKS.\n\napp.post(\"/token\", async (c) => {\n const body = await c.req.parseBody();\n if (body.grant_type !== JWT_BEARER_GRANT) {\n return c.json({\n error: \"unsupported_grant_type\",\n error_description: String(body.grant_type),\n }, 400);\n }\n\n let clientId: string | undefined, clientSecret: string | undefined;\n const authz = c.req.header(\"Authorization\");\n if (authz?.startsWith(\"Basic \")) {\n const decoded = atob(authz.slice(6));\n const sep = decoded.indexOf(\":\");\n clientId = decodeURIComponent(decoded.slice(0, sep));\n clientSecret = decodeURIComponent(decoded.slice(sep + 1));\n } else {\n clientId = body.client_id as string;\n clientSecret = body.client_secret as string;\n }\n if (!clientId || !clientSecret) {\n return c.json({\n error: \"invalid_client\",\n error_description: \"missing client credentials\",\n }, 401);\n }\n\n const assertion = body.assertion as string;\n if (!assertion) {\n return c.json({\n error: \"invalid_request\",\n error_description: \"missing assertion\",\n }, 400);\n }\n\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== ID_JAG_TYP) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `typ must be ${ID_JAG_TYP}, got ${header.typ}`,\n }, 400);\n }\n\n // Unsafe decode — sig verified below, AFTER the secret check proves we\n // trust this issuer for this client.\n const unverified = jose.decodeJwt(assertion);\n const iss = (unverified.iss ?? \"\").replace(/\\/$/, \"\");\n if (!iss) {\n return c.json({\n error: \"invalid_grant\",\n error_description: \"ID-JAG missing iss\",\n }, 400);\n }\n // Spec §3.1: `resource` in the JAG is OPTIONAL. Okta may omit it.\n // Fall back to the RFC 8707 request param — CC always sends it.\n const jagResource = (unverified.resource as string | undefined) ??\n (body.resource as string | undefined);\n if (!jagResource) {\n return c.json({\n error: \"invalid_grant\",\n error_description:\n \"no resource: ID-JAG omits the claim and request lacks the parameter\",\n }, 400);\n }\n\n // Spec binding — JAG says it's for client_id X, you must be authing as X.\n // Cheap check; do it before crypto.\n if (unverified.client_id !== clientId) {\n return c.json({\n error: \"invalid_grant\",\n error_description:\n `ID-JAG client_id (${unverified.client_id}) != authenticating client (${clientId})`,\n }, 400);\n }\n\n // Trust gate. Re-derive the secret from (JAG.iss, clientId, resource).\n // A match means: you registered for exactly this tuple. That's our ACL.\n if (clientSecret !== await deriveAs2Secret(iss, clientId, jagResource)) {\n return c.json({\n error: \"invalid_client\",\n error_description:\n `secret not bound to (iss=${iss}, client_id, resource). Register at ${URLS.as2}/register`,\n }, 401);\n }\n\n // Now we trust `iss` enough to fetch its keys.\n let claims: jose.JWTPayload;\n try {\n const { payload } = await jose.jwtVerify(assertion, await jwksFor(iss), {\n issuer: iss,\n audience: [URLS.as2, `${URLS.as2}/`],\n clockTolerance: 30,\n });\n claims = payload;\n } catch (e) {\n return c.json({\n error: \"invalid_grant\",\n error_description: `ID-JAG verify failed (iss=${iss}): ${\n e instanceof Error ? e.message : e\n }`,\n }, 400);\n }\n\n const accessToken = await new jose.SignJWT({})\n .setProtectedHeader({ alg: \"ES256\", kid: kp.kid })\n .setIssuer(URLS.as2)\n .setAudience(jagResource)\n .setSubject(claims.sub!)\n .setIssuedAt()\n .setExpirationTime(\"1h\")\n .sign(kp.privateKey);\n\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n });\n});\n\n// ─── Debug — demo-IdP path only (can't mint Okta id_tokens) ─────────────────\n\napp.get(\"/debug/context\", async (c) => {\n const idToken = await fetch(`${URLS.idp}/debug/mint-id-token`).then((r) =>\n r.text()\n );\n const { idp, as } = await debugCredsAs2();\n return c.json({\n client_id: as.client_id,\n client_secret: as.client_secret,\n idp_client_id: idp.client_id,\n idp_client_secret: idp.client_secret,\n idp_id_token: idToken,\n idp_token_endpoint: `${URLS.idp}/token`,\n });\n});\n\n// ─── Index ──────────────────────────────────────────────────────────────────\n\napp.get(\"/\", (c) =>\n c.html(indexPage({\n role: \"AS\",\n name: \"xaa-mcp-as2\",\n endpoints: [\n { method: \"GET\", path: \"/.well-known/oauth-authorization-server\" },\n { method: \"GET\", path: \"/.well-known/jwks.json\" },\n {\n method: \"GET\",\n path: \"/register\",\n note:\n \"bring your own client_id; we bind a secret to (iss, id, resource)\",\n },\n {\n method: \"POST\",\n path: \"/token\",\n note: \"jwt-bearer; secret-as-trust, no static issuer list\",\n },\n {\n method: \"GET\",\n path: \"/debug/context\",\n note: \"conformance ctx (demo-IdP path)\",\n },\n ],\n })));\n\napp.onError((err) => {\n throw err;\n});\n\nexport default app.fetch;\nif (import.meta.main) Deno.serve({ port: 3005 }, app.fetch);","deleted","label",[102],"permalink","https://www.val.town/x/pcarleton/xaa-mcp-as2/code/http.ts","extension","actionData","errors"]