@api-client/core 0.20.10 → 0.21.1

package/src/authorization/lib/SecurityProcessor.ts

@@ -1,294 +0,0 @@
-/* eslint-disable @typescript-eslint/no-extraneous-class */
-import {
-  IApiKeyAuthorization,
-  IBasicAuthorization,
-  IBearerAuthorization,
-  ICCAuthorization,
-  IOAuth2Authorization,
-  IOidcAuthorization,
-  IOidcTokenInfo,
-  IPassThroughAuthorization,
-  IRamlCustomAuthorization,
-} from '../../models/Authorization.js'
-import { IRequestAuthorization, RequestAuthorization } from '../../models/RequestAuthorization.js'
-import { IHttpRequest } from '../../models/HttpRequest.js'
-import { IProperty } from '../../models/Property.js'
-import { Headers } from '../../lib/headers/Headers.js'
-import { HttpCertificate } from '../../models/ClientCertificate.js'
-import { UrlProcessor } from '../../lib/parsers/UrlProcessor.js'
-import { UrlEncoder } from '../../lib/parsers/UrlEncoder.js'
-import { hasBuffer } from '../../Platform.js'
-import {
-  normalizeType,
-  METHOD_BASIC,
-  METHOD_BEARER,
-  METHOD_OAUTH2,
-  METHOD_OIDC,
-  METHOD_CUSTOM,
-  METHOD_API_KEY,
-  METHOD_PASS_THROUGH,
-} from './Utils.js'
-
-export interface IAuthApplyOptions {
-  /**
-   * When set it won't change the originating authorization objects.
-   * By default it sets the authorization's `enabled` property to `false` after applying the
-   * value to the request.
-   */
-  immutable?: boolean
-}
-
-export class SecurityProcessor {
-  /**
-   * Applies authorization configuration to the request object.
-   */
-  static applyAuthorization(
-    request: IHttpRequest,
-    authorization?: (IRequestAuthorization | RequestAuthorization)[],
-    opts: IAuthApplyOptions = {}
-  ): void {
-    if (!Array.isArray(authorization) || !authorization.length) {
-      return
-    }
-
-    for (const auth of authorization) {
-      if (!auth.enabled || !auth.config) {
-        continue
-      }
-
-      switch (normalizeType(auth.type)) {
-        case METHOD_BASIC:
-          SecurityProcessor.applyBasicAuth(request, auth.config as IBasicAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_OAUTH2:
-          SecurityProcessor.applyOAuth2(request, auth.config as IOAuth2Authorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_OIDC:
-          SecurityProcessor.applyOpenId(request, auth.config as IOidcAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_BEARER:
-          SecurityProcessor.applyBearer(request, auth.config as IBearerAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_CUSTOM:
-          SecurityProcessor.applyCustomAuth(request, auth.config as IRamlCustomAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_API_KEY:
-          SecurityProcessor.applyApiKeys(request, auth.config as IApiKeyAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        case METHOD_PASS_THROUGH:
-          SecurityProcessor.applyPassThrough(request, auth.config as IPassThroughAuthorization)
-          if (!opts.immutable) {
-            auth.enabled = false
-          }
-          break
-        default:
-      }
-    }
-  }
-
-  /**
-   * Injects basic auth header into the request headers.
-   */
-  static applyBasicAuth(request: IHttpRequest, config: IBasicAuthorization): void {
-    const { username, password = '' } = config
-    if (!username) {
-      return
-    }
-    const hash = `${username}:${password}`
-    const value = hasBuffer ? Buffer.from(hash).toString('base64') : btoa(hash)
-    this.applyHeader(request, 'authorization', `Basic ${value}`)
-  }
-
-  /**
-   * Injects oauth 2 auth header into the request headers.
-   */
-  static applyOAuth2(request: IHttpRequest, config: IOAuth2Authorization): void {
-    const { accessToken, tokenType = 'Bearer', deliveryMethod = 'header', deliveryName = 'authorization' } = config
-    if (!accessToken) {
-      return
-    }
-    const value = `${tokenType} ${accessToken}`
-    if (deliveryMethod === 'header') {
-      this.applyHeader(request, deliveryName, value)
-    } else if (deliveryMethod === 'query') {
-      const { url } = request
-      try {
-        const parser = new UrlProcessor(url)
-        parser.search.append(
-          UrlEncoder.encodeQueryString(deliveryName, true),
-          UrlEncoder.encodeQueryString(value, true)
-        )
-        request.url = parser.toString()
-      } catch {
-        // ...
-      }
-    }
-  }
-
-  /**
-   * Injects OpenID Connect auth header into the request headers.
-   */
-  static applyOpenId(request: IHttpRequest, config: IOidcAuthorization): void {
-    const { accessToken, tokens, tokenInUse } = config
-    if (accessToken) {
-      SecurityProcessor.applyOAuth2(request, config)
-    } else if (Array.isArray(tokens) && typeof tokenInUse === 'number') {
-      const data = tokens[tokenInUse] as IOidcTokenInfo
-      if (data && data.accessToken) {
-        const copy = { ...config }
-        copy.accessToken = data.accessToken
-        SecurityProcessor.applyOAuth2(request, copy)
-      }
-    }
-  }
-
-  /**
-   * Injects bearer auth header into the request headers.
-   */
-  static applyBearer(request: IHttpRequest, config: IBearerAuthorization): void {
-    const { token } = config
-    if (!token) {
-      return
-    }
-    const value = `Bearer ${token}`
-    this.applyHeader(request, 'authorization', value)
-  }
-
-  /**
-   * Injects the RAML custom configuration into the request
-   */
-  static applyCustomAuth(request: IHttpRequest, config: IRamlCustomAuthorization): void {
-    const { header, query } = config
-    this.applyQueryParams(request, query)
-    this.applyHeaders(request, header)
-  }
-
-  /**
-   * Injects the ApiKey configuration into the request
-   */
-  static applyApiKeys(request: IHttpRequest, config: IApiKeyAuthorization): void {
-    const { header, query } = config
-    this.applyQueryParams(request, query)
-    this.applyHeaders(request, header)
-  }
-
-  /**
-   * Injects the PassThrough configuration into the request
-   */
-  static applyPassThrough(request: IHttpRequest, config: IPassThroughAuthorization): void {
-    const { header, query } = config
-    this.applyQueryParams(request, query)
-    this.applyHeaders(request, header)
-  }
-
-  static applyHeader(request: IHttpRequest, name: string, value: string): void {
-    const { headers, headersModel } = request
-    if (headersModel && !headers) {
-      const disabled = headersModel.filter((i) => !i.enabled)
-      const parser = Headers.fromPropertyArray(headersModel.filter((i) => !!i.enabled))
-      parser.append(name, value)
-      request.headersModel = [...parser.toPropertyArray(), ...disabled]
-    } else {
-      const parser = new Headers(headers)
-      parser.append(name, value)
-      request.headers = parser.toString()
-    }
-  }
-
-  /**
-   * Applies a map of query parameters to the request object.
-   * @param request The request object
-   * @param params A map of query parameters to apply to the request
-   */
-  static applyQueryParams(request: IHttpRequest, params?: Record<string, string>): void {
-    if (typeof params !== 'object') {
-      return
-    }
-    const keys = Object.keys(params)
-    if (!keys.length) {
-      return
-    }
-
-    try {
-      const parser = new UrlProcessor(request.url)
-      keys.forEach((name) => {
-        const value = params[name]
-        parser.search.set(UrlEncoder.encodeQueryString(name, true), UrlEncoder.encodeQueryString(value, true))
-      })
-      request.url = parser.toString()
-    } catch {
-      // ...
-    }
-  }
-
-  /**
-   * Applies a map of headers to the request object.
-   * @param request The request object
-   * @param headers A map of headers to apply to the request
-   */
-  static applyHeaders(request: IHttpRequest, headers?: Record<string, string>): void {
-    if (typeof headers !== 'object') {
-      return
-    }
-    const keys = Object.keys(headers)
-    if (!keys.length) {
-      return
-    }
-
-    let parser: Headers
-    let disabled: IProperty[] | undefined
-    const usesModel = !!request.headersModel && !request.headers
-    if (usesModel) {
-      const model = request.headersModel as IProperty[]
-      disabled = model.filter((i) => !i.enabled)
-      parser = Headers.fromPropertyArray(model.filter((i) => !!i.enabled))
-    } else {
-      parser = new Headers(request.headers)
-    }
-    keys.forEach((name) => {
-      const value = headers[name]
-      parser.append(name, value)
-    })
-    if (usesModel) {
-      request.headersModel = [...parser.toPropertyArray(), ...(disabled || [])]
-    } else {
-      request.headers = parser.toString()
-    }
-  }
-
-  /**
-   * Reads the client certificate from the authorization configuration.
-   *
-   * @param authorization The HTTP request authorization configuration.
-   * @returns The certificate to use with the HTTP request or undefined when not configured.
-   */
-  static readCertificate(authorization?: IRequestAuthorization[]): HttpCertificate | undefined {
-    if (!Array.isArray(authorization) || !authorization.length) {
-      return undefined
-    }
-    const item = authorization.find((i) => i.enabled !== false && i.type === 'client certificate')
-    if (!item || !item.config) {
-      return undefined
-    }
-    const init = item.config as ICCAuthorization
-    return init.certificate
-  }
-}

package/src/authorization/lib/Tokens.ts

@@ -1,135 +0,0 @@
-/* eslint-disable @typescript-eslint/no-non-null-assertion */
-/* eslint-disable @typescript-eslint/no-extraneous-class */
-import { IOidcTokenInfo, ITokenInfo } from '../../models/Authorization.js'
-
-export class Tokens {
-  /**
-   * Creates a OidcTokenInfo object for the corresponding response type.
-   *
-   * @param responseType The response type of the token to prepare the info for.
-   * @param params params received from the authorization endpoint.
-   * @param time Timestamp when the tokens were created
-   * @param requestedScopes The list of requested scopes. Optional.
-   * @returns
-   */
-  static createTokenInfo(
-    responseType: string,
-    params: URLSearchParams,
-    time: number,
-    requestedScopes?: string[]
-  ): IOidcTokenInfo | null {
-    switch (responseType) {
-      case 'code':
-        return Tokens.createCodeToken(params, time, requestedScopes)
-      case 'token':
-        return Tokens.createTokenToken(params, time, requestedScopes)
-      case 'id_token':
-        return Tokens.createIdTokenToken(params, time, requestedScopes)
-      default:
-        return null
-    }
-  }
-
-  /**
-   * Creates a "code" response type token info.
-   * @param params
-   * @param time Timestamp when the tokens were created
-   * @param requestedScopes The list of requested scopes. Optional.
-   * @returns
-   */
-  static createBaseToken(params: URLSearchParams, time: number, requestedScopes?: string[]): IOidcTokenInfo {
-    const scope = Tokens.computeTokenInfoScopes(requestedScopes, params.get('scope')!)
-    const tokenInfo: IOidcTokenInfo = {
-      state: params.get('state')!,
-      expiresIn: Number(params.get('expires_in')),
-      tokenType: params.get('token_type')!,
-      scope,
-      time,
-      responseType: '',
-    }
-    return tokenInfo
-  }
-
-  /**
-   * Creates a "code" response type token info.
-   * @param params
-   * @param time Timestamp when the tokens were created
-   * @param requestedScopes The list of requested scopes. Optional.
-   * @returns
-   */
-  static createCodeToken(params: URLSearchParams, time: number, requestedScopes?: string[]): IOidcTokenInfo {
-    const token = Tokens.createBaseToken(params, time, requestedScopes)
-    token.responseType = 'code'
-    token.code = params.get('code')!
-    return token
-  }
-
-  /**
-   * Creates a "token" response type token info.
-   * @param params
-   * @param time Timestamp when the tokens were created
-   * @param requestedScopes The list of requested scopes. Optional.
-   * @returns
-   */
-  static createTokenToken(params: URLSearchParams, time: number, requestedScopes?: string[]): IOidcTokenInfo {
-    const token = Tokens.createBaseToken(params, time, requestedScopes)
-    token.responseType = 'token'
-    token.accessToken = params.get('access_token')!
-    token.refreshToken = params.get('refresh_token')!
-    return token
-  }
-
-  /**
-   * Creates a "id_token" response type token info.
-   * @param time Timestamp when the tokens were created
-   * @param requestedScopes The list of requested scopes. Optional.
-   */
-  static createIdTokenToken(params: URLSearchParams, time: number, requestedScopes?: string[]): IOidcTokenInfo {
-    const token = Tokens.createBaseToken(params, time, requestedScopes)
-    token.responseType = 'id_token'
-    token.accessToken = params.get('access_token')!
-    token.refreshToken = params.get('refresh_token')!
-    token.idToken = params.get('id_token')!
-    return token
-  }
-
-  /**
-   * Computes the final list of granted scopes.
-   * It is a list of scopes received in the response or the list of requested scopes.
-   * Because the user may change the list of scopes during the authorization process
-   * the received list of scopes can be different than the one requested by the user.
-   *
-   * @param requestedScopes The list of requested scopes. Optional.
-   * @param tokenScopes The `scope` parameter received with the response. It's null safe.
-   * @returns The list of scopes for the token.
-   */
-  static computeTokenInfoScopes(requestedScopes?: string[], tokenScopes?: string): string[] {
-    if (!tokenScopes && requestedScopes) {
-      return requestedScopes
-    }
-    let listScopes: string[] = []
-    if (typeof tokenScopes === 'string') {
-      listScopes = tokenScopes.split(' ')
-    }
-    return listScopes
-  }
-
-  static fromTokenInfo(info: ITokenInfo): IOidcTokenInfo {
-    const result: IOidcTokenInfo = {
-      responseType: '',
-      state: info.state,
-      accessToken: info.accessToken,
-      time: Date.now(),
-    }
-    if (info.scope) {
-      result.scope = info.scope
-    }
-    if (info.tokenType) {
-      result.tokenType = info.tokenType
-    }
-    if (info.expiresIn) {
-      result.expiresIn = info.expiresIn
-    }
-    return result
-  }
-}

package/src/authorization/lib/Utils.ts

@@ -1,95 +0,0 @@
-/**
- * Normalizes type name to a string identifier.
- * It casts input to a string and lowercase it.
- * @param type Type value
- * @return Normalized value.
- */
-export const normalizeType = (type?: string): string => String(type).toLowerCase()
-
-export const METHOD_BASIC = 'basic'
-export const METHOD_BEARER = 'bearer'
-export const METHOD_NTLM = 'ntlm'
-export const METHOD_DIGEST = 'digest'
-export const METHOD_OAUTH2 = 'oauth 2'
-export const METHOD_OIDC = 'open id'
-export const METHOD_CC = 'client certificate'
-export const METHOD_API_KEY = 'api key'
-export const METHOD_CUSTOM = 'custom'
-export const METHOD_PASS_THROUGH = 'pass through'
-export const CUSTOM_CREDENTIALS = 'Custom credentials'
-
-/**
- * @param value The value to validate
- * @returns True if the redirect URI can be considered valid.
- */
-export function validateRedirectUri(value: unknown): boolean {
-  let result = true
-  if (!value || typeof value !== 'string') {
-    result = false
-  }
-  // the redirect URI can have any value, especially for installed apps which
-  // may use custom schemes. We do very basic sanity check for any script content
-  // validation to make sure we are not passing any script.
-  if (result) {
-    const u = String(value).toLowerCase()
-    if (u.startsWith('javascript:') || u.startsWith('data:') || u.startsWith('vbscript:')) {
-      result = false
-    }
-  }
-  return result
-}
-
-/**
- * Generates client nonce for Digest authorization.
- *
- * @return Generated client nonce.
- */
-export function generateCnonce(): string {
-  const characters = 'abcdef0123456789'
-  let token = ''
-  for (let i = 0; i < 16; i++) {
-    const randNum = Math.round(Math.random() * characters.length)
-    token += characters.substring(randNum, 1)
-  }
-  return token
-}
-
-/**
- * Generates `state` parameter for the OAuth2 call.
- *
- * @return Generated state string.
- */
-export function generateState(): string {
-  let text = ''
-  const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
-  for (let i = 0; i < 6; i++) {
-    text += possible.charAt(Math.floor(Math.random() * possible.length))
-  }
-  return text
-}
-
-/**
- * When defined and the `url` is a relative path staring with `/` then it
- * adds base URI to the path and returns concatenated value.
- *
- * @param url The URL to process
- * @param baseUri Base URI to use.
- * @returns Final URL value.
- */
-export function readUrlValue(url?: string, baseUri?: string): string {
-  if (!url) {
-    return ''
-  }
-  const result = String(url)
-  if (!baseUri) {
-    return result
-  }
-  if (result[0] === '/') {
-    let uri = baseUri
-    if (uri[uri.length - 1] === '/') {
-      uri = uri.substring(0, uri.length - 1)
-    }
-    return `${uri}${result}`
-  }
-  return result
-}