CommunitySolidServer · elf-pavlik · Aug 15, 2025 · Aug 16, 2025 · Aug 18, 2025 · Aug 18, 2025
diff --git a/config/identity/handler/base/provider-factory.json b/config/identity/handler/base/provider-factory.json
@@ -26,6 +26,12 @@
       "showStackTrace": { "@id": "urn:solid-server:default:variable:showStackTrace" },
       "errorHandler": { "@id": "urn:solid-server:default:ErrorHandler" },
       "responseWriter": { "@id": "urn:solid-server:default:ResponseWriter" },
+      "jwtAssertionsGrantHandler": {
+        "@id": "urn:solid-server:default:JwtAssertionsGrantHandler",
+        "@type": "JwtAssertionsGrantHandler",
+        "jwkGenerator": { "@id": "urn:solid-server:default:JwkGenerator" },
+        "jwtAssertionsStore": { "@id": "urn:solid-server:default:JwtAssertionsStore" }
+      },
       "interactionRoute": { "@id": "urn:solid-server:default:IndexRoute" },
       "config": {
         "claims": {

diff --git a/config/identity/handler/default.json b/config/identity/handler/default.json
@@ -7,6 +7,7 @@
 
     "css:config/identity/handler/enable/account.json",
     "css:config/identity/handler/enable/client-credentials.json",
+    "css:config/identity/handler/enable/jwt-assertions.json",
     "css:config/identity/handler/enable/password.json",
     "css:config/identity/handler/enable/pod.json",
     "css:config/identity/handler/enable/webid.json"

diff --git a/config/identity/handler/enable/jwt-assertions.json b/config/identity/handler/enable/jwt-assertions.json
@@ -0,0 +1,43 @@
+{
+  "@context": "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/components/context.jsonld",
+  "@graph": [
+    {
+      "comment": "Enable JWT assertions creation."
+    },
+    {
+      "@id": "urn:solid-server:default:InteractionRouteHandler",
+      "@type": "WaterfallHandler",
+      "handlers": [{ "@id": "urn:solid-server:default:AccountJwtAssertionsRouter" }]
+    },
+
+    {
+      "@id": "urn:solid-server:default:AccountControlHandler",
+      "@type": "ControlHandler",
+      "controls": [{
+        "ControlHandler:_controls_key": "jwtAssertions",
+        "ControlHandler:_controls_value": { "@id": "urn:solid-server:default:AccountJwtAssertionsRoute" }
+      }]
+    },
+
+    {
+      "@id": "urn:solid-server:default:HtmlViewHandler",
+      "@type": "HtmlViewHandler",
+      "templates": [{
+        "@id": "urn:solid-server:default:CreateJwtAssertionsHtml",
+        "@type": "HtmlViewEntry",
+        "filePath": "@css:templates/identity/account/create-jwt-assertions.html.ejs",
+        "route": { "@id": "urn:solid-server:default:AccountJwtAssertionsRoute" }
+      }]
+    },
+    {
+      "ControlHandler:_controls_value": {
+        "@id": "urn:solid-server:default:AccountHtmlControlHandler",
+        "@type": "ControlHandler",
+        "controls": [{
+          "ControlHandler:_controls_key": "createJwtAssertions",
+          "ControlHandler:_controls_value": { "@id": "urn:solid-server:default:AccountJwtAssertionsRoute" }
+        }]
+      }
+    }
+  ]
+}
diff --git a/config/identity/handler/routing/default.json b/config/identity/handler/routing/default.json
@@ -4,6 +4,8 @@
     "css:config/identity/handler/routing/account/main.json",
     "css:config/identity/handler/routing/client-credentials/create.json",
     "css:config/identity/handler/routing/client-credentials/resource.json",
+    "css:config/identity/handler/routing/jwt-assertions/create.json",
+    "css:config/identity/handler/routing/jwt-assertions/resource.json",
     "css:config/identity/handler/routing/core/main.json",
     "css:config/identity/handler/routing/oidc/main.json",
     "css:config/identity/handler/routing/password/main.json",

diff --git a/config/identity/handler/routing/jwt-assertions/create.json b/config/identity/handler/routing/jwt-assertions/create.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/components/context.jsonld",
+  "@graph": [
+    {
+      "comment": "Handles JWT assertions. These can be used to automate clients. See documentation for more info.",
+      "@id": "urn:solid-server:default:AccountJwtAssertionsRouter",
+      "@type": "AuthorizedRouteHandler",
+      "route": {
+        "@id": "urn:solid-server:default:AccountJwtAssertionsRoute",
+        "@type": "RelativePathInteractionRoute",
+        "base": { "@id": "urn:solid-server:default:AccountIdRoute" },
+        "relativePath": "jwt-assertions/"
+      },
+      "source": {
+        "@type": "ViewInteractionHandler",
+        "source": {
+          "@id": "urn:solid-server:default:CreateJwtAssertionsHandler",
+          "@type": "CreateJwtAssertionsHandler",
+          "webIdStore": { "@id": "urn:solid-server:default:WebIdStore" },
+          "jwtAssertionsStore": { "@id": "urn:solid-server:default:JwtAssertionsStore" },
+          "jwtAssertionsRoute": { "@id": "urn:solid-server:default:AccountJwtAssertionsIdRoute" }
+        }
+      }
+    }
+  ]
+}
diff --git a/config/identity/handler/routing/jwt-assertions/resource.json b/config/identity/handler/routing/jwt-assertions/resource.json
@@ -0,0 +1,45 @@
+{
+  "@context": "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/components/context.jsonld",
+  "@graph": [
+    {
+      "comment": "Handles the JWT assertions link details such as deletion.",
+      "@id": "urn:solid-server:default:AccountJwtAssertionsIdRouter",
+      "@type": "AuthorizedRouteHandler",
+      "route": {
+        "@id": "urn:solid-server:default:AccountJwtAssertionsIdRoute",
+        "@type": "BaseJwtAssertionsIdRoute",
+        "base": { "@id": "urn:solid-server:default:AccountJwtAssertionsRoute" }
+      },
+      "source": {
+        "@id": "urn:solid-server:default:JwtAssertionsResourceHandler",
+        "@type": "WaterfallHandler",
+        "handlers": [
+          {
+            "@type": "MethodFilterHandler",
+            "methods": [ "GET" ],
+            "source": {
+              "@type": "JwtAssertionsDetailsHandler",
+              "jwtAssertionsRoute": { "@id": "urn:solid-server:default:AccountJwtAssertionsIdRoute" },
+              "jwtAssertionsStore": { "@id": "urn:solid-server:default:JwtAssertionsStore" }
+            }
+          },
+          {
+            "@type": "MethodFilterHandler",
+            "methods": [ "DELETE" ],
+            "source": {
+              "@type": "DeleteJwtAssertionsHandler",
+              "jwtAssertionsRoute": { "@id": "urn:solid-server:default:AccountJwtAssertionsIdRoute" },
+              "jwtAssertionsStore": { "@id": "urn:solid-server:default:JwtAssertionsStore" }
+            }
+          }
+        ]
+      }
+    },
+
+    {
+      "@id": "urn:solid-server:default:InteractionRouteHandler",
+      "@type": "WaterfallHandler",
+      "handlers": [{ "@id": "urn:solid-server:default:AccountJwtAssertionsIdRouter" }]
+    }
+  ]
+}
diff --git a/config/identity/handler/storage/default.json b/config/identity/handler/storage/default.json
@@ -59,13 +59,21 @@
       "storage": { "@id": "urn:solid-server:default:AccountStorage" }
     },
 
+    {
+      "@id": "urn:solid-server:default:JwtAssertionsStore",
+      "@type": "BaseJwtAssertionsStore",
+      "storage": { "@id": "urn:solid-server:default:AccountStorage" },
+      "jwkGenerator": { "@id": "urn:solid-server:default:JwkGenerator" }
+    },
+
     {
       "comment": "Initialize all the stores. Also necessary on primary thread for pod seeding.",
       "@id": "urn:solid-server:default:PrimaryParallelInitializer",
       "@type": "ParallelHandler",
       "handlers": [
         { "@id": "urn:solid-server:default:AccountStore" },
         { "@id": "urn:solid-server:default:ClientCredentialsStore" },
+        { "@id": "urn:solid-server:default:JwtAssertionsStore" },
         { "@id": "urn:solid-server:default:PodStore" },
         { "@id": "urn:solid-server:default:WebIdStore" }
       ]
@@ -77,6 +85,7 @@
       "handlers": [
         { "@id": "urn:solid-server:default:AccountStore" },
         { "@id": "urn:solid-server:default:ClientCredentialsStore" },
+        { "@id": "urn:solid-server:default:JwtAssertionsStore" },
         { "@id": "urn:solid-server:default:PodStore" },
         { "@id": "urn:solid-server:default:WebIdStore" }
       ]

diff --git a/src/identity/IdentityUtil.ts b/src/identity/IdentityUtil.ts
@@ -16,3 +16,19 @@
   }
   return import('oidc-provider');
 }
+
+export function importDpopValidate(): CanBePromise<any> {
+  if (process.env.JEST_WORKER_ID ?? process.env.NODE_ENV === 'test') {
+    return jest.requireActual('oidc-provider/lib/helpers/validate_dpop.js');
+  }
+  // @ts-expect-error
+  return import('oidc-provider/lib/helpers/validate_dpop.js');
+}
+
+export function importCheckResource(): CanBePromise<any> {
+  if (process.env.JEST_WORKER_ID ?? process.env.NODE_ENV === 'test') {
+    return jest.requireActual('oidc-provider/lib/shared/check_resource.js');
+  }
+  // @ts-expect-error
+  return import('oidc-provider/lib/shared/check_resource.js');
+}
diff --git a/src/identity/configuration/IdentityProviderFactory.ts b/src/identity/configuration/IdentityProviderFactory.ts
@@ -29,6 +29,7 @@
 import type { AlgJwk, JwkGenerator } from './JwkGenerator';
 import type { PromptFactory } from './PromptFactory';
 import type { ProviderFactory } from './ProviderFactory';
+import type { JwtAssertionsGrantHandler } from './JwtAssertionsGrantHandler';
 
 export interface IdentityProviderFactoryArgs {
   /**
@@ -75,6 +76,11 @@
    * Used to write out errors thrown by the OIDC library.
    */
   responseWriter: ResponseWriter;
+
+  /**
+   * Handles JWT Assertion Grant.
+   */
+  jwtAssertionsGrantHandler: JwtAssertionsGrantHandler;
 }
 
 const COOKIES_KEY = 'cookie-secret';
@@ -101,6 +107,7 @@
   private readonly showStackTrace: boolean;
   private readonly errorHandler: ErrorHandler;
   private readonly responseWriter: ResponseWriter;
+  private readonly jwtAssertionsGrantHandler: JwtAssertionsGrantHandler;
 
   private provider?: Provider;
 
@@ -122,6 +129,7 @@
     this.showStackTrace = args.showStackTrace;
     this.errorHandler = args.errorHandler;
     this.responseWriter = args.responseWriter;
+    this.jwtAssertionsGrantHandler = args.jwtAssertionsGrantHandler;
   }
 
   public async getProvider(): Promise<Provider> {
@@ -162,6 +170,9 @@
     // Allow provider to interpret reverse proxy headers.
     provider.proxy = true;
 
+    // Custom grant type with JWT assertions
+    provider.registerGrantType(this.jwtAssertionsGrantHandler.grantType, this.jwtAssertionsGrantHandler.handler.bind(this.jwtAssertionsGrantHandler), this.jwtAssertionsGrantHandler.parameters);
+
     this.captureErrorResponses(provider);
 
     return provider;
@@ -276,7 +287,7 @@
     // Some fields are still missing, see https://github.com/CommunitySolidServer/CommunitySolidServer/issues/1154#issuecomment-1040233385
     config.findAccount = async(ctx: KoaContextWithOIDC, sub: string): Promise<Account> => ({
       accountId: sub,
-      async claims(): Promise<{ sub: string; [key: string]: unknown }> {
+      async claims(): Promise<{ sub: string;[key: string]: unknown }> {
         return { sub, webid: sub, azp: ctx.oidc.client?.clientId };
       },
     });
@@ -288,6 +299,12 @@
       if (this.isAccessToken(token)) {
         return { webid: token.accountId };
       }
+
+      // {@link JwtAssertionsGrantHandler} passes webid in extra
+      if (token.extra) {
+        return token.extra;
+      }
+
       const clientId = token.client?.clientId;
       if (!clientId) {
         throw new BadRequestHttpError('Missing client ID from client credentials.');

diff --git a/src/identity/configuration/JwtAssertionsGrantHandler.ts b/src/identity/configuration/JwtAssertionsGrantHandler.ts
@@ -0,0 +1,88 @@
+import { importJWK, jwtVerify } from 'jose';
+import type {
+  KoaContextWithOIDC,
+} from '../../../templates/types/oidc-provider';
+import { importCheckResource, importDpopValidate } from '../IdentityUtil';
+import type { JwtAssertionsStore } from '../interaction/jwt-assertions/util/JwtAssertionsStore';
+import type { JwkGenerator } from './JwkGenerator';
+
+// Const epochTime = (date = Date.now()) => Math.floor(date / 1000);
+
+export class JwtAssertionsGrantHandler {
+  public constructor(
+    private readonly jwkGenerator: JwkGenerator,
+    private readonly jwtAssertionsStore: JwtAssertionsStore,
+  ) {}
+
+  public parameters = [
+    'client_id',
+    'scope',
+    'assertion',
+  ];
+
+  public grantType = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+
+  public async handler(ctx: KoaContextWithOIDC) {
+    const { ClientCredentials, ReplayDetection } = ctx.oidc.provider;
+    const { client } = ctx.oidc;
+
+    // Validate DPoP
+    const dpopValidate = await importDpopValidate().default;
+    const dPoP = await dpopValidate(ctx);
+    // TODO
+    // const unique = await ReplayDetection.unique(client!.clientId, dPoP.jti, epochTime() + 300);
+    // ctx.assert(unique, new InvalidGrant('DPoP proof JWT Replay detected'));
+    //
+
+    // this is required to trigger resourceIndicators in IdentityProviderFactory
+    const checkResource = await importCheckResource().default;
+    await checkResource(ctx, () => {});
+
+    // Validate assertion
+    // TODO: duplicate check if we check verbatim JWT below
+    const assertion = ctx.oidc.params?.assertion;
+    if (!assertion) {
+      // TODO: set correct error resonse
+      return;
+    }
+    const publicKey = await this.jwkGenerator.getPublicKey();
+    const publicKeyObject = await importJWK(publicKey);
+
+    // TODO: better handling of failure
+    const assertedData = await jwtVerify(assertion as string, publicKeyObject);
+
+    // TODO: check revocation
+    // set correct error
+    // duplicate check of signature above if we check stored JWT here
+    const existing = await this.jwtAssertionsStore.findByJwt(assertion as string);
+    if (!existing) {
+      return;
+    }
+
+    // Issue access_token
+    const claims = {
+      client: client!,
+      scope: 'webid',
+      extra: {
+        webid: assertedData.payload.agent,
+      },
+    };
+    const token = new ClientCredentials(claims);
+
+    // @ts-expect-error
+    token.setThumbprint('jkt', dPoP.thumbprint);
+
+    // Somehow related to generating JWT instead of opaque token
+    token.resourceServer = Object.values(ctx.oidc.resourceServers!)[0];
+
+    ctx.oidc.entity('ClientCredentials', token);
+    const value = await token.save();
+
+    ctx.body = {
+      access_token: value,
+      expires_in: token.expiration,
+      token_type: token.tokenType,
+      scope: token.scope || undefined,
+    };
+  }
+}