@arbiter/oauth-core (0.1.0)

Published 2026-08-06 08:40:39 +00:00 by Dvorak

Set up this registry in your project .npmrc file:

@arbiter:registry=https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/

To install the package using npm, run the following command:

npm install @arbiter/oauth-core@0.1.0

or add it to the package.json file:

"@arbiter/oauth-core": "0.1.0"

For more information on the npm registry, see the documentation.

@arbiter/oauth-core

Pure OAuth core spec domain models — no HTTP layer, no storage, no transport.

RFC 8628 device authorization grant (DA-001..008)
RFC 8693 token exchange (TE-001..018)
RFC 9396 rich authorization requests / authorization_details (RAR-001..019)
draft-ietf-oauth-client-id-metadata-document (CMD-001..008)
draft-mw-spice-actor-chain (SPICE-01/03/11/12)
draft-ietf-oauth-par pushed authorization request object binding (PAR / RAR-015/016/017/018)
OAuth 2.1 PKCE primitives (O21-005)

src/domain/DeviceAuthorizationDomainModel.js — RFC 8628 device polling state machine
src/domain/TokenExchangeDomainPolicy.js — RFC 8693 exchange input validation + SPICE actor-chain outcome
src/domain/AuthorizationDetailsPolicy.js — RFC 9396 RAR schema validation
src/domain/ClientMetadataResolver.js — client-id metadata document discovery/validation
src/domain/PushedAuthorizationRequestPolicy.js — PAR request-object parse + parameter merge
src/domain/JoseSecurityProfile.js — JOSE key ring, revoked-kid, algorithm policy
src/utils/ip-utils.js — IP classification (SSRF egress policy)

npm test           # rigor property campaigns
npm run test:rigor # campaigns only

File	Campaigns
`oauth-rfc8628-device.rigor.test.js`	DA-001..007: response contract, scope validation, polling state machine (pending→slow_down→issued / denied→access_denied / expired_token)
`oauth-rfc8693-token-exchange.rigor.test.js`	TE-001..017: input validation (subject/type/actor pairing, URI, invalid_target), outcome auth (expired, scope, actor, chain-depth, profile transition, actor append, may_act)
`oauth-rfc9396-rar-cmd.rigor.test.js`	RAR-001..014: details shape/type/field/value/required/injection; CMD-001/004/005/006/008: URL scheme, secret fields, client_id match, IP egress; PAR RAR-017/018 merge binding
`oauth21-pkce.rigor.test.js`	O21-005: verifier/challenge grammar, S256 round-trip, wrong-verifier binding

Development Dependencies

ID	Version
@rigor/core	^3.1.2

oauth oauth2 device-authorization token-exchange rar authorization-details spice oauth21

Details

npm

2026-08-06 08:40:39 +00:00

ISC

latest

11 KiB

Assets (1)

oauth-core-0.1.0.tgz 11 KiB

Versions (1) View all

0.1.0

2026-08-06