@axa-fr/oidc-client-service-worker 7.27.3 → 7.27.7

package/src/__tests__/oidcConfig.spec.ts

@@ -1,7 +1,12 @@
 import { describe, expect, it } from 'vitest';
 
-import { getCurrentDatabasesTokenEndpoint } from '../oidcConfig';
-import { Database } from '../types';
+import {
+  getCurrentDatabasesTokenEndpoint,
+  isAccessTokenDomainRequest,
+  isOidcServerRequest,
+  shouldBypassNonOidcRequest,
+} from '../oidcConfig';
+import { Database, TrustedDomains } from '../types';
 
 const oidcConfigDefaults = {
   demonstratingProofOfPossessionConfiguration: null,
@@ -18,6 +23,7 @@ const oidcConfigDefaults = {
   demonstratingProofOfPossessionJwkJson: null,
   demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,
   allowMultiTabLogin: true,
+  bypassAllNonOidcRequests: false,
 };
 
 const oidcServerConfigDefault = {
@@ -152,3 +158,114 @@ describe('getCurrentDatabasesTokenEndpoint', () => {
     expect(result).toHaveLength(0);
   });
 });
+
+describe('shouldBypassNonOidcRequest', () => {
+  const database: Database = {
+    config1: {
+      ...oidcConfigDefaults,
+      bypassAllNonOidcRequests: true,
+      oidcServerConfiguration: {
+        ...oidcServerConfigDefault,
+        issuer: 'https://oidc.example.com',
+        authorizationEndpoint: 'https://oidc.example.com/connect/authorize',
+        tokenEndpoint: 'https://oidc.example.com/connect/token',
+        revocationEndpoint: 'https://oidc.example.com/connect/revoke',
+        userInfoEndpoint: 'https://oidc.example.com/connect/userinfo',
+      },
+    },
+  };
+
+  it('should bypass non-OIDC requests when enabled', () => {
+    expect(shouldBypassNonOidcRequest(database, 'https://api.example.com/users', null)).toBe(true);
+  });
+
+  it.each([
+    'https://oidc.example.com/.well-known/openid-configuration',
+    'https://oidc.example.com/connect/authorize',
+    'https://oidc.example.com/connect/token',
+    'https://oidc.example.com/connect/revoke',
+    'https://oidc.example.com/connect/userinfo',
+  ])('should never bypass OIDC server request %s', url => {
+    expect(isOidcServerRequest(database, url)).toBe(true);
+    expect(shouldBypassNonOidcRequest(database, url, null)).toBe(false);
+  });
+
+  it('should keep existing behavior when disabled', () => {
+    expect(
+      shouldBypassNonOidcRequest(
+        {
+          config1: {
+            ...database.config1,
+            bypassAllNonOidcRequests: false,
+          },
+        },
+        'https://api.example.com/users',
+        null,
+      ),
+    ).toBe(false);
+  });
+
+  it('should keep existing behavior until OIDC server configuration is initialized', () => {
+    expect(
+      shouldBypassNonOidcRequest(
+        {
+          config1: {
+            ...oidcConfigDefaults,
+            bypassAllNonOidcRequests: true,
+            oidcServerConfiguration: null,
+          },
+        },
+        'https://api.example.com/users',
+        null,
+      ),
+    ).toBe(false);
+  });
+
+  it('should keep accessTokenDomains requests intercepted when bypass is enabled', () => {
+    const trustedDomains: TrustedDomains = {
+      config1: {
+        accessTokenDomains: ['https://api.example.com'],
+        showAccessToken: false,
+      },
+    };
+
+    expect(
+      isAccessTokenDomainRequest(database, 'https://api.example.com/users', trustedDomains),
+    ).toBe(true);
+    expect(
+      shouldBypassNonOidcRequest(database, 'https://api.example.com/users', trustedDomains),
+    ).toBe(false);
+  });
+
+  it('should keep domains fallback requests intercepted when bypass is enabled', () => {
+    const trustedDomains: TrustedDomains = {
+      config1: {
+        domains: ['https://api.example.com'],
+        showAccessToken: false,
+      },
+    };
+
+    expect(
+      shouldBypassNonOidcRequest(database, 'https://api.example.com/users', trustedDomains),
+    ).toBe(false);
+  });
+
+  it('should keep existing behavior unless all initialized configurations enable bypass', () => {
+    expect(
+      shouldBypassNonOidcRequest(
+        {
+          ...database,
+          config2: {
+            ...oidcConfigDefaults,
+            oidcServerConfiguration: {
+              ...oidcServerConfigDefault,
+              issuer: 'https://other-oidc.example.com',
+            },
+          },
+        },
+        'https://api.example.com/users',
+        null,
+      ),
+    ).toBe(false);
+  });
+});

package/src/oidcConfig.ts

@@ -1,5 +1,85 @@
-import { Database, OidcConfig } from './types';
-import { normalizeUrl } from './utils';
+import { acceptAnyDomainToken } from './constants';
+import { Database, Domain, OidcConfig, OidcServerConfiguration, TrustedDomains } from './types';
+import { getDomains, normalizeUrl } from './utils';
+
+const getOidcServerUrls = (oidcServerConfiguration: OidcServerConfiguration): string[] => {
+  return [
+    oidcServerConfiguration.issuer,
+    oidcServerConfiguration.authorizationEndpoint,
+    oidcServerConfiguration.tokenEndpoint,
+    oidcServerConfiguration.revocationEndpoint,
+    oidcServerConfiguration.userInfoEndpoint,
+  ]
+    .filter(Boolean)
+    .map(normalizeUrl);
+};
+
+const isOidcServerRequest = (database: Database, normalizedUrl: string): boolean => {
+  return Object.values(database).some(config => {
+    const { oidcServerConfiguration } = config || {};
+    if (!oidcServerConfiguration) {
+      return false;
+    }
+
+    return getOidcServerUrls(oidcServerConfiguration).some(oidcUrl =>
+      normalizedUrl.startsWith(oidcUrl),
+    );
+  });
+};
+
+const isDomainMatchingUrl = (domain: Domain, normalizedUrl: string): boolean => {
+  if (typeof domain === 'string') {
+    domain = new RegExp(`^${domain}`);
+  }
+
+  return domain.test?.(normalizedUrl) ?? false;
+};
+
+const isAccessTokenDomainRequest = (
+  database: Database,
+  normalizedUrl: string,
+  trustedDomains: TrustedDomains,
+): boolean => {
+  return Object.entries(database).some(([key, currentDatabase]) => {
+    if (!currentDatabase.oidcServerConfiguration) {
+      return false;
+    }
+
+    const trustedDomain = trustedDomains?.[key.split('#')[0]] ?? [];
+    const domains = getDomains(trustedDomain, 'accessToken');
+
+    if (domains.some(domain => domain === acceptAnyDomainToken)) {
+      return true;
+    }
+
+    return domains.some(domain => isDomainMatchingUrl(domain, normalizedUrl));
+  });
+};
+
+const shouldBypassNonOidcRequest = (
+  database: Database,
+  normalizedUrl: string,
+  trustedDomains: TrustedDomains,
+): boolean => {
+  const configurations = Object.values(database);
+
+  if (configurations.length === 0) {
+    return false;
+  }
+
+  if (!configurations.every(config => config.bypassAllNonOidcRequests)) {
+    return false;
+  }
+
+  if (!configurations.every(config => config.oidcServerConfiguration != null)) {
+    return false;
+  }
+
+  return (
+    !isOidcServerRequest(database, normalizedUrl) &&
+    !isAccessTokenDomainRequest(database, normalizedUrl, trustedDomains)
+  );
+};
 
 const getMatchingOidcConfigurations = (database: Database, url: string): OidcConfig[] => {
   return Object.values(database).filter(config => {
@@ -14,4 +94,9 @@ const getMatchingOidcConfigurations = (database: Database, url: string): OidcCon
   });
 };
 
-export { getMatchingOidcConfigurations as getCurrentDatabasesTokenEndpoint };
+export {
+  getMatchingOidcConfigurations as getCurrentDatabasesTokenEndpoint,
+  isAccessTokenDomainRequest,
+  isOidcServerRequest,
+  shouldBypassNonOidcRequest,
+};

package/src/types.ts

@@ -9,6 +9,7 @@ export type DomainDetails = {
   demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent?: boolean;
   demonstratingProofOfPossessionConfiguration?: DemonstratingProofOfPossessionConfiguration;
   allowMultiTabLogin?: boolean;
+  bypassAllNonOidcRequests?: boolean;
 };
 
 export interface DemonstratingProofOfPossessionConfiguration {
@@ -43,11 +44,6 @@ export type OidcConfiguration = {
   demonstrating_proof_of_possession: boolean;
 };
 
-// Uncertain why the Headers interface in lib.webworker.d.ts does not have a keys() function, so extending
-export interface FetchHeaders extends Headers {
-  keys(): string[];
-}
-
 export type Status =
   | 'LOGGED'
   | 'LOGGED_IN'
@@ -117,6 +113,7 @@ export type OidcConfig = {
   demonstratingProofOfPossessionJwkJson: string | null;
   demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: boolean;
   allowMultiTabLogin: boolean;
+  bypassAllNonOidcRequests: boolean;
 };
 
 export type IdTokenPayload = {

package/src/utils/__tests__/domains.spec.ts

@@ -57,6 +57,7 @@ describe('domains', () => {
           demonstratingProofOfPossessionConfiguration: null,
           demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,
           allowMultiTabLogin: true,
+          bypassAllNonOidcRequests: false,
         },
       };
     });

package/src/utils/__tests__/testHelper.ts

@@ -127,6 +127,7 @@ class OidcConfigBuilder {
     demonstratingProofOfPossessionConfiguration: null,
     demonstratingProofOfPossessionOnlyWhenDpopHeaderPresent: false,
     allowMultiTabLogin: true,
+    bypassAllNonOidcRequests: false,
   };
 
   public withTestingDefault(): OidcConfigBuilder {

package/src/utils/serializeHeaders.ts

@@ -1,8 +1,6 @@
-import { FetchHeaders } from '../types';
-
 function serializeHeaders(headers: Headers) {
   const headersObj: Record<string, string> = {};
-  for (const key of (headers as FetchHeaders).keys()) {
+  for (const key of headers.keys()) {
     if (headers.has(key)) {
       headersObj[key] = headers.get(key) as string;
     }

package/src/version.ts

@@ -1 +1 @@
-export default '7.27.3';
+export default '7.27.7';