fix(oauth-provider): evaluate all ACR selectors

packages/oauth-provider/src/authorize.test.ts

@@ -664,6 +664,32 @@ describe("oauth authorize - ACR requests", async () => {
 				expect.any(String),
 			);
 		});
+
+		it("accepts matching value and values selectors", async () => {
+			const location = await redirectFor(undefined, {
+				essential: true,
+				value: "0",
+				values: ["0"],
+			});
+			const callbackRedirect = new URL(location);
+
+			expect(callbackRedirect.searchParams.get("error")).toBeNull();
+			expect(callbackRedirect.searchParams.get("code")).toEqual(
+				expect.any(String),
+			);
+		});
+
+		it("rejects conflicting value and values selectors", async () => {
+			const location = await redirectFor(undefined, {
+				essential: true,
+				value: "0",
+				values: ["1"],
+			});
+			const callbackRedirect = new URL(location);
+
+			expect(callbackRedirect.searchParams.get("error")).toBe("access_denied");
+			expect(callbackRedirect.searchParams.get("code")).toBeNull();
+		});
 	});
 });
 

packages/oauth-provider/src/claims-request.ts

@@ -68,13 +68,11 @@ export function canSatisfyEssentialAcrRequest(
 	const acrRequest = claimsRequest.id_token?.acr;
 	if (!acrRequest || acrRequest.essential !== true) return true;
 
-	if (typeof acrRequest.value === "string") {
-		return acrRequest.value === currentAcr;
-	}
-	if (Array.isArray(acrRequest.values)) {
-		return acrRequest.values.includes(currentAcr);
-	}
-	return acrRequest.value === undefined && acrRequest.values === undefined;
+	const valueMatches =
+		acrRequest.value === undefined || acrRequest.value === currentAcr;
+	const valuesMatch =
+		acrRequest.values === undefined || acrRequest.values.includes(currentAcr);
+	return valueMatches && valuesMatch;
 }
 
 export function filterClaimsRequestUserInfoClaims(