@adonis-agora/authkit-client 0.19.1 → 0.20.0

package/build/providers/authkit_client_provider.js

@@ -6,7 +6,7 @@ import { configProvider } from '@adonisjs/core';
 import { RuntimeException } from '@adonisjs/core/exceptions';
 import { decodeJwt } from 'jose';
 import { Authenticator } from '../src/authenticator.js';
-import { completeAuthorization, createAuthorizationRequest, } from '../src/authorization.js';
+import { assertCallbackBelongs, completeAuthorization, createAuthorizationRequest, } from '../src/authorization.js';
 import { validateLogoutToken } from '../src/backchannel_logout.js';
 import { conventionEndpoints, discoverEndpoints, mergeEndpoints, } from '../src/discovery.js';
 import { validateIdToken, } from '../src/id_token.js';
@@ -111,6 +111,8 @@ export class AuthkitClientManager {
      * Throws `OidcCallbackError`; `error.restartable` means "send them back to login".
      */
     async completeAuthorization(params) {
+        // Before discovery: a stale or forged callback is restartable even while the IdP is down.
+        assertCallbackBelongs(params.pending, params.callbackParams);
         const { endpoints, keys } = await this.#idp();
         return completeAuthorization({
             ...params,
@@ -463,7 +465,7 @@ export default class AuthkitClientProvider {
     }
     register() {
         // Bound by class, like the first-party packages do, so `@inject()` works with
-        // `AuthkitClientManager` as a constructor type. The string key stays as an alias.
+        // `AuthkitClientManager` as a constructor type.
         this.app.container.singleton(AuthkitClientManager, async (resolver) => {
             const value = this.app.config.get('authkit_client');
             const config = (await configProvider.resolve(this.app, value));
@@ -473,7 +475,12 @@ export default class AuthkitClientProvider {
             const logger = await resolver.make('logger');
             return new AuthkitClientManager(config, { logger });
         });
-        this.app.container.alias('authkit.client', AuthkitClientManager);
+        // The string key resolves the class binding on every lookup — the same singleton — rather
+        // than being an `alias`: the container follows an alias before it checks bound values, so
+        // `bindValue('authkit.client', fake)`, how apps replaced the manager in tests before it was
+        // bound by class, would silently get the real one. Not cached here, so a `swap` of the class
+        // also reaches the string key, even after its first use.
+        this.app.container.bind('authkit.client', (resolver) => resolver.make(AuthkitClientManager));
     }
 }
 /** `sub` of a stored id_token, or undefined when there is none / it is unreadable. */

package/build/src/authorization.d.ts

@@ -115,6 +115,13 @@ export interface CompletedAuthorization {
     /** Validated id_token claims. */
     claims: IdTokenClaims;
 }
+/**
+ * The checks that say whether a callback belongs to this browser's pending authorization at all
+ * (`missing_pending`, `state_mismatch`). They need nothing from the IdP, so a caller that has to
+ * discover the IdP's endpoints first runs them before that: a stale or forged callback is
+ * restartable even while the IdP is unreachable, rather than surfacing as a discovery failure.
+ */
+export declare function assertCallbackBelongs(pending: PendingAuthorization | null | undefined, callbackParams: Record<string, unknown>): asserts pending is PendingAuthorization;
 /**
  * Finishes the authorization-code flow: checks `state` and `iss`, exchanges the
  * code (with the PKCE verifier) and validates the id_token, `nonce` included.

package/build/src/authorization.js

@@ -71,6 +71,21 @@ export class OidcCallbackError extends Error {
             this.code === 'missing_code');
     }
 }
+const str = (v) => (typeof v === 'string' && v ? v : undefined);
+/**
+ * The checks that say whether a callback belongs to this browser's pending authorization at all
+ * (`missing_pending`, `state_mismatch`). They need nothing from the IdP, so a caller that has to
+ * discover the IdP's endpoints first runs them before that: a stale or forged callback is
+ * restartable even while the IdP is unreachable, rather than surfacing as a discovery failure.
+ */
+export function assertCallbackBelongs(pending, callbackParams) {
+    if (!pending?.state || !pending.nonce || !pending.codeVerifier) {
+        throw new OidcCallbackError('missing_pending', 'No pending authorization for this callback');
+    }
+    if (str(callbackParams.state) !== pending.state) {
+        throw new OidcCallbackError('state_mismatch', 'Callback state does not match');
+    }
+}
 /**
  * Finishes the authorization-code flow: checks `state` and `iss`, exchanges the
  * code (with the PKCE verifier) and validates the id_token, `nonce` included.
@@ -80,15 +95,9 @@ export class OidcCallbackError extends Error {
  */
 export async function completeAuthorization(p) {
     const q = p.callbackParams;
-    const str = (v) => (typeof v === 'string' && v ? v : undefined);
-    const { issuer, tokenEndpoint, jwksUri } = p.endpoints ?? conventionEndpoints(p.issuer);
     const pending = p.pending;
-    if (!pending?.state || !pending.nonce || !pending.codeVerifier) {
-        throw new OidcCallbackError('missing_pending', 'No pending authorization for this callback');
-    }
-    if (str(q.state) !== pending.state) {
-        throw new OidcCallbackError('state_mismatch', 'Callback state does not match');
-    }
+    assertCallbackBelongs(pending, q);
+    const { issuer, tokenEndpoint, jwksUri } = p.endpoints ?? conventionEndpoints(p.issuer);
     const iss = str(q.iss);
     if (iss !== undefined && iss !== issuer) {
         throw new OidcCallbackError('issuer_mismatch', `Callback iss ${iss} is not ${issuer}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.19.1",
+  "version": "0.20.0",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -60,6 +60,9 @@
       "@adonis-agora/authkit-client/commands"
     ]
   },
+  "engines": {
+    "node": ">=24"
+  },
   "peerDependencies": {
     "@adonis-agora/resilience": ">=0.1.0 <1.0.0",
     "@adonisjs/auth": "^10.1.0",
@@ -79,11 +82,11 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "0.9.0",
+    "@adonis-agora/authkit-core": "0.10.0",
     "jose": "6.2.12"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "0.80.2",
+    "@adonis-agora/authkit-server": "0.81.0",
     "@adonis-agora/resilience": "0.3.7",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.5.0",