@axa-fr/react-oidc 7.1.0-alpha.1005 → 7.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -53,11 +53,21 @@ The service worker catch **access_token** and **refresh_token** that will never
|
|
|
53
53
|
```sh
|
|
54
54
|
npm install @axa-fr/react-oidc --save
|
|
55
55
|
|
|
56
|
+
# To install or update OidcServiceWorker.js file, you can run
|
|
57
|
+
node .\node_modules\@axa-fr\react-oidc\bin\copy-service-worker-files.mjs
|
|
58
|
+
|
|
56
59
|
# If you have a "public" folder, the 2 files will be created :
|
|
57
60
|
# ./public/OidcServiceWorker.js <-- will be updated at each "npm install"
|
|
58
61
|
# ./public/OidcTrustedDomains.js <-- won't be updated if already exist
|
|
59
62
|
```
|
|
60
63
|
|
|
64
|
+
WARNING : If you use Service Worker mode, the OidcServiceWorker.js file should always be up to date with the version of the library. You may setup a postinstall script in your package.json file to update it at each npm install. For example :
|
|
65
|
+
```sh
|
|
66
|
+
"scripts": {
|
|
67
|
+
...
|
|
68
|
+
"postinstall": "node .\\node_modules\\@axa-fr\\oidc-client\\bin\\copy-service-worker-files.mjs public"
|
|
69
|
+
},
|
|
70
|
+
```
|
|
61
71
|
If you need a very secure mode where refresh_token and access_token will be hide behind a service worker that will proxify requests.
|
|
62
72
|
The only file you should edit is "OidcTrustedDomains.js".
|
|
63
73
|
|
|
@@ -1,5 +1,6 @@
|
|
|
1
|
-
import path from 'path';
|
|
1
|
+
import path from 'path';
|
|
2
2
|
import fs from 'fs';
|
|
3
|
+
import { fileURLToPath } from 'url';
|
|
3
4
|
|
|
4
5
|
try {
|
|
5
6
|
|
|
@@ -29,10 +30,11 @@ try {
|
|
|
29
30
|
return !!fs.existsSync(path);
|
|
30
31
|
};
|
|
31
32
|
|
|
32
|
-
const initPath = process.
|
|
33
|
-
|
|
34
|
-
const srcDir = '
|
|
35
|
-
const
|
|
33
|
+
const initPath = process.cwd();
|
|
34
|
+
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
35
|
+
const srcDir = path.join(__dirname, "..", 'node_modules', '@axa-fr' ,'oidc-client-service-worker', 'dist') ;
|
|
36
|
+
const destinationFolder = process.argv.length >= 3 ? process.argv[2] : 'public';
|
|
37
|
+
const destinationDir = path.join(initPath, destinationFolder);
|
|
36
38
|
|
|
37
39
|
const files = [
|
|
38
40
|
{
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@axa-fr/react-oidc",
|
|
3
|
-
"version": "7.
|
|
3
|
+
"version": "7.2.0",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.umd.cjs",
|
|
@@ -35,13 +35,13 @@
|
|
|
35
35
|
"serve": "vite preview",
|
|
36
36
|
"test": "vitest --root . --coverage",
|
|
37
37
|
"clean": "rimraf dist",
|
|
38
|
-
"postinstall": "
|
|
38
|
+
"postinstall": "echo 'WARNING keep sink OidcServiceWorker.js version file'",
|
|
39
39
|
"prepare": "pnpm run clean && pnpm run copy-service-worker && pnpm run build",
|
|
40
40
|
"lint": "eslint src"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@axa-fr/oidc-client-service-worker": "7.
|
|
44
|
-
"@axa-fr/oidc-client": "7.
|
|
43
|
+
"@axa-fr/oidc-client-service-worker": "7.2.0",
|
|
44
|
+
"@axa-fr/oidc-client": "7.2.0",
|
|
45
45
|
"base64-js": "1.5.1"
|
|
46
46
|
},
|
|
47
47
|
"peerDependencies": {
|
|
@@ -1,567 +0,0 @@
|
|
|
1
|
-
const scriptFilename = "OidcTrustedDomains.js";
|
|
2
|
-
const acceptAnyDomainToken = "*";
|
|
3
|
-
const TOKEN = {
|
|
4
|
-
REFRESH_TOKEN: "REFRESH_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
|
|
5
|
-
ACCESS_TOKEN: "ACCESS_TOKEN_SECURED_BY_OIDC_SERVICE_WORKER",
|
|
6
|
-
NONCE_TOKEN: "NONCE_SECURED_BY_OIDC_SERVICE_WORKER",
|
|
7
|
-
CODE_VERIFIER: "CODE_VERIFIER_SECURED_BY_OIDC_SERVICE_WORKER"
|
|
8
|
-
};
|
|
9
|
-
const TokenRenewMode = {
|
|
10
|
-
access_token_or_id_token_invalid: "access_token_or_id_token_invalid",
|
|
11
|
-
access_token_invalid: "access_token_invalid",
|
|
12
|
-
id_token_invalid: "id_token_invalid"
|
|
13
|
-
};
|
|
14
|
-
const openidWellknownUrlEndWith = "/.well-known/openid-configuration";
|
|
15
|
-
const version = "7.1.0-alpha.1005";
|
|
16
|
-
function checkDomain(domains, endpoint) {
|
|
17
|
-
if (!endpoint) {
|
|
18
|
-
return;
|
|
19
|
-
}
|
|
20
|
-
const domain = domains.find((domain2) => {
|
|
21
|
-
var _a;
|
|
22
|
-
let testable;
|
|
23
|
-
if (typeof domain2 === "string") {
|
|
24
|
-
testable = new RegExp(`^${domain2}`);
|
|
25
|
-
} else {
|
|
26
|
-
testable = domain2;
|
|
27
|
-
}
|
|
28
|
-
return (_a = testable.test) == null ? void 0 : _a.call(testable, endpoint);
|
|
29
|
-
});
|
|
30
|
-
if (!domain) {
|
|
31
|
-
throw new Error(
|
|
32
|
-
"Domain " + endpoint + " is not trusted, please add domain in " + scriptFilename
|
|
33
|
-
);
|
|
34
|
-
}
|
|
35
|
-
}
|
|
36
|
-
const getDomains = (trustedDomain, type) => {
|
|
37
|
-
if (Array.isArray(trustedDomain)) {
|
|
38
|
-
return trustedDomain;
|
|
39
|
-
}
|
|
40
|
-
return trustedDomain[`${type}Domains`] ?? trustedDomain.domains ?? [];
|
|
41
|
-
};
|
|
42
|
-
const getCurrentDatabaseDomain = (database2, url, trustedDomains2) => {
|
|
43
|
-
var _a;
|
|
44
|
-
if (url.endsWith(openidWellknownUrlEndWith)) {
|
|
45
|
-
return null;
|
|
46
|
-
}
|
|
47
|
-
for (const [key, currentDatabase] of Object.entries(database2)) {
|
|
48
|
-
const oidcServerConfiguration = currentDatabase.oidcServerConfiguration;
|
|
49
|
-
if (!oidcServerConfiguration) {
|
|
50
|
-
continue;
|
|
51
|
-
}
|
|
52
|
-
if (oidcServerConfiguration.tokenEndpoint && url === oidcServerConfiguration.tokenEndpoint) {
|
|
53
|
-
continue;
|
|
54
|
-
}
|
|
55
|
-
if (oidcServerConfiguration.revocationEndpoint && url === oidcServerConfiguration.revocationEndpoint) {
|
|
56
|
-
continue;
|
|
57
|
-
}
|
|
58
|
-
const trustedDomain = trustedDomains2 == null ? [] : trustedDomains2[key];
|
|
59
|
-
const domains = getDomains(trustedDomain, "accessToken");
|
|
60
|
-
const domainsToSendTokens = oidcServerConfiguration.userInfoEndpoint ? [oidcServerConfiguration.userInfoEndpoint, ...domains] : [...domains];
|
|
61
|
-
let hasToSendToken = false;
|
|
62
|
-
if (domainsToSendTokens.find((f) => f === acceptAnyDomainToken)) {
|
|
63
|
-
hasToSendToken = true;
|
|
64
|
-
} else {
|
|
65
|
-
for (let i = 0; i < domainsToSendTokens.length; i++) {
|
|
66
|
-
let domain = domainsToSendTokens[i];
|
|
67
|
-
if (typeof domain === "string") {
|
|
68
|
-
domain = new RegExp(`^${domain}`);
|
|
69
|
-
}
|
|
70
|
-
if ((_a = domain.test) == null ? void 0 : _a.call(domain, url)) {
|
|
71
|
-
hasToSendToken = true;
|
|
72
|
-
break;
|
|
73
|
-
}
|
|
74
|
-
}
|
|
75
|
-
}
|
|
76
|
-
if (hasToSendToken) {
|
|
77
|
-
if (!currentDatabase.tokens) {
|
|
78
|
-
return null;
|
|
79
|
-
}
|
|
80
|
-
return currentDatabase;
|
|
81
|
-
}
|
|
82
|
-
}
|
|
83
|
-
return null;
|
|
84
|
-
};
|
|
85
|
-
function serializeHeaders(headers) {
|
|
86
|
-
const headersObj = {};
|
|
87
|
-
for (const key of headers.keys()) {
|
|
88
|
-
if (headers.has(key)) {
|
|
89
|
-
headersObj[key] = headers.get(key);
|
|
90
|
-
}
|
|
91
|
-
}
|
|
92
|
-
return headersObj;
|
|
93
|
-
}
|
|
94
|
-
const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
|
|
95
|
-
function countLetter(str, find) {
|
|
96
|
-
return str.split(find).length - 1;
|
|
97
|
-
}
|
|
98
|
-
function parseJwt(token) {
|
|
99
|
-
return JSON.parse(
|
|
100
|
-
b64DecodeUnicode(token.split(".")[1].replace("-", "+").replace("_", "/"))
|
|
101
|
-
);
|
|
102
|
-
}
|
|
103
|
-
function b64DecodeUnicode(str) {
|
|
104
|
-
return decodeURIComponent(
|
|
105
|
-
Array.prototype.map.call(
|
|
106
|
-
atob(str),
|
|
107
|
-
(c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)
|
|
108
|
-
).join("")
|
|
109
|
-
);
|
|
110
|
-
}
|
|
111
|
-
function computeTimeLeft(refreshTimeBeforeTokensExpirationInSecond, expiresAt) {
|
|
112
|
-
const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
|
|
113
|
-
return Math.round(
|
|
114
|
-
expiresAt - refreshTimeBeforeTokensExpirationInSecond - currentTimeUnixSecond
|
|
115
|
-
);
|
|
116
|
-
}
|
|
117
|
-
function isTokensValid(tokens) {
|
|
118
|
-
if (!tokens) {
|
|
119
|
-
return false;
|
|
120
|
-
}
|
|
121
|
-
return computeTimeLeft(0, tokens.expiresAt) > 0;
|
|
122
|
-
}
|
|
123
|
-
const extractTokenPayload = (token) => {
|
|
124
|
-
try {
|
|
125
|
-
if (!token) {
|
|
126
|
-
return null;
|
|
127
|
-
}
|
|
128
|
-
if (countLetter(token, ".") === 2) {
|
|
129
|
-
return parseJwt(token);
|
|
130
|
-
} else {
|
|
131
|
-
return null;
|
|
132
|
-
}
|
|
133
|
-
} catch (e) {
|
|
134
|
-
console.warn(e);
|
|
135
|
-
}
|
|
136
|
-
return null;
|
|
137
|
-
};
|
|
138
|
-
const isTokensOidcValid = (tokens, nonce, oidcServerConfiguration) => {
|
|
139
|
-
if (tokens.idTokenPayload) {
|
|
140
|
-
const idTokenPayload = tokens.idTokenPayload;
|
|
141
|
-
if (oidcServerConfiguration.issuer !== idTokenPayload.iss) {
|
|
142
|
-
return { isValid: false, reason: "Issuer does not match" };
|
|
143
|
-
}
|
|
144
|
-
const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
|
|
145
|
-
if (idTokenPayload.exp && idTokenPayload.exp < currentTimeUnixSecond) {
|
|
146
|
-
return { isValid: false, reason: "Token expired" };
|
|
147
|
-
}
|
|
148
|
-
const timeInSevenDays = 60 * 60 * 24 * 7;
|
|
149
|
-
if (idTokenPayload.iat && idTokenPayload.iat + timeInSevenDays < currentTimeUnixSecond) {
|
|
150
|
-
return { isValid: false, reason: "Token is used from too long time" };
|
|
151
|
-
}
|
|
152
|
-
if (nonce && idTokenPayload.nonce && idTokenPayload.nonce !== nonce) {
|
|
153
|
-
return { isValid: false, reason: "Nonce does not match" };
|
|
154
|
-
}
|
|
155
|
-
}
|
|
156
|
-
return { isValid: true, reason: "" };
|
|
157
|
-
};
|
|
158
|
-
function _hideTokens(tokens, currentDatabaseElement, configurationName) {
|
|
159
|
-
if (!tokens.issued_at) {
|
|
160
|
-
const currentTimeUnixSecond = (/* @__PURE__ */ new Date()).getTime() / 1e3;
|
|
161
|
-
tokens.issued_at = currentTimeUnixSecond;
|
|
162
|
-
} else if (typeof tokens.issued_at == "string") {
|
|
163
|
-
tokens.issued_at = parseInt(tokens.issued_at, 10);
|
|
164
|
-
}
|
|
165
|
-
const accessTokenPayload = extractTokenPayload(tokens.access_token);
|
|
166
|
-
const secureTokens = {
|
|
167
|
-
...tokens,
|
|
168
|
-
accessTokenPayload
|
|
169
|
-
};
|
|
170
|
-
if (currentDatabaseElement.hideAccessToken) {
|
|
171
|
-
secureTokens.access_token = TOKEN.ACCESS_TOKEN + "_" + configurationName;
|
|
172
|
-
}
|
|
173
|
-
tokens.accessTokenPayload = accessTokenPayload;
|
|
174
|
-
let _idTokenPayload = null;
|
|
175
|
-
if (tokens.id_token) {
|
|
176
|
-
_idTokenPayload = extractTokenPayload(tokens.id_token);
|
|
177
|
-
tokens.idTokenPayload = { ..._idTokenPayload };
|
|
178
|
-
if (_idTokenPayload.nonce && currentDatabaseElement.nonce != null) {
|
|
179
|
-
const keyNonce = TOKEN.NONCE_TOKEN + "_" + currentDatabaseElement.configurationName;
|
|
180
|
-
_idTokenPayload.nonce = keyNonce;
|
|
181
|
-
}
|
|
182
|
-
secureTokens.idTokenPayload = _idTokenPayload;
|
|
183
|
-
}
|
|
184
|
-
if (tokens.refresh_token) {
|
|
185
|
-
secureTokens.refresh_token = TOKEN.REFRESH_TOKEN + "_" + configurationName;
|
|
186
|
-
}
|
|
187
|
-
const expireIn = typeof tokens.expires_in == "string" ? parseInt(tokens.expires_in, 10) : tokens.expires_in;
|
|
188
|
-
const idTokenExpiresAt = _idTokenPayload && _idTokenPayload.exp ? _idTokenPayload.exp : Number.MAX_VALUE;
|
|
189
|
-
const accessTokenExpiresAt = accessTokenPayload && accessTokenPayload.exp ? accessTokenPayload.exp : tokens.issued_at + expireIn;
|
|
190
|
-
let expiresAt;
|
|
191
|
-
const tokenRenewMode = currentDatabaseElement.oidcConfiguration.token_renew_mode;
|
|
192
|
-
if (tokenRenewMode === TokenRenewMode.access_token_invalid) {
|
|
193
|
-
expiresAt = accessTokenExpiresAt;
|
|
194
|
-
} else if (tokenRenewMode === TokenRenewMode.id_token_invalid) {
|
|
195
|
-
expiresAt = idTokenExpiresAt;
|
|
196
|
-
} else {
|
|
197
|
-
expiresAt = idTokenExpiresAt < accessTokenExpiresAt ? idTokenExpiresAt : accessTokenExpiresAt;
|
|
198
|
-
}
|
|
199
|
-
secureTokens.expiresAt = expiresAt;
|
|
200
|
-
tokens.expiresAt = expiresAt;
|
|
201
|
-
const nonce = currentDatabaseElement.nonce ? currentDatabaseElement.nonce.nonce : null;
|
|
202
|
-
const { isValid, reason } = isTokensOidcValid(
|
|
203
|
-
tokens,
|
|
204
|
-
nonce,
|
|
205
|
-
currentDatabaseElement.oidcServerConfiguration
|
|
206
|
-
);
|
|
207
|
-
if (!isValid) {
|
|
208
|
-
throw Error(`Tokens are not OpenID valid, reason: ${reason}`);
|
|
209
|
-
}
|
|
210
|
-
if (currentDatabaseElement.tokens != null && "refresh_token" in currentDatabaseElement.tokens && !("refresh_token" in tokens)) {
|
|
211
|
-
const refreshToken = currentDatabaseElement.tokens.refresh_token;
|
|
212
|
-
currentDatabaseElement.tokens = {
|
|
213
|
-
...tokens,
|
|
214
|
-
refresh_token: refreshToken
|
|
215
|
-
};
|
|
216
|
-
} else {
|
|
217
|
-
currentDatabaseElement.tokens = tokens;
|
|
218
|
-
}
|
|
219
|
-
currentDatabaseElement.status = "LOGGED_IN";
|
|
220
|
-
return secureTokens;
|
|
221
|
-
}
|
|
222
|
-
function hideTokens(currentDatabaseElement) {
|
|
223
|
-
const configurationName = currentDatabaseElement.configurationName;
|
|
224
|
-
return (response) => {
|
|
225
|
-
if (response.status !== 200) {
|
|
226
|
-
return response;
|
|
227
|
-
}
|
|
228
|
-
return response.json().then((tokens) => {
|
|
229
|
-
const secureTokens = _hideTokens(tokens, currentDatabaseElement, configurationName);
|
|
230
|
-
const body = JSON.stringify(secureTokens);
|
|
231
|
-
return new Response(body, response);
|
|
232
|
-
});
|
|
233
|
-
};
|
|
234
|
-
}
|
|
235
|
-
function replaceCodeVerifier(codeVerifier, newCodeVerifier) {
|
|
236
|
-
const regex = /code_verifier=[A-Za-z0-9_-]+/i;
|
|
237
|
-
return codeVerifier.replace(regex, `code_verifier=${newCodeVerifier}`);
|
|
238
|
-
}
|
|
239
|
-
const _self = self;
|
|
240
|
-
_self.importScripts(scriptFilename);
|
|
241
|
-
const id = Math.round((/* @__PURE__ */ new Date()).getTime() / 1e3).toString();
|
|
242
|
-
const keepAliveJsonFilename = "OidcKeepAliveServiceWorker.json";
|
|
243
|
-
const handleInstall = (event) => {
|
|
244
|
-
console.log("[OidcServiceWorker] service worker installed " + id);
|
|
245
|
-
event.waitUntil(_self.skipWaiting());
|
|
246
|
-
};
|
|
247
|
-
const handleActivate = (event) => {
|
|
248
|
-
console.log("[OidcServiceWorker] service worker activated " + id);
|
|
249
|
-
event.waitUntil(_self.clients.claim());
|
|
250
|
-
};
|
|
251
|
-
let currentLoginCallbackConfigurationName = null;
|
|
252
|
-
const database = {
|
|
253
|
-
default: {
|
|
254
|
-
configurationName: "default",
|
|
255
|
-
tokens: null,
|
|
256
|
-
status: null,
|
|
257
|
-
state: null,
|
|
258
|
-
codeVerifier: null,
|
|
259
|
-
nonce: null,
|
|
260
|
-
oidcServerConfiguration: null,
|
|
261
|
-
hideAccessToken: true
|
|
262
|
-
}
|
|
263
|
-
};
|
|
264
|
-
const getCurrentDatabasesTokenEndpoint = (database2, url) => {
|
|
265
|
-
const databases = [];
|
|
266
|
-
for (const [, value] of Object.entries(database2)) {
|
|
267
|
-
if (value.oidcServerConfiguration != null && url.startsWith(value.oidcServerConfiguration.tokenEndpoint)) {
|
|
268
|
-
databases.push(value);
|
|
269
|
-
} else if (value.oidcServerConfiguration != null && value.oidcServerConfiguration.revocationEndpoint && url.startsWith(value.oidcServerConfiguration.revocationEndpoint)) {
|
|
270
|
-
databases.push(value);
|
|
271
|
-
}
|
|
272
|
-
}
|
|
273
|
-
return databases;
|
|
274
|
-
};
|
|
275
|
-
const keepAliveAsync = async (event) => {
|
|
276
|
-
const originalRequest = event.request;
|
|
277
|
-
const isFromVanilla = originalRequest.headers.has("oidc-vanilla");
|
|
278
|
-
const init = { status: 200, statusText: "oidc-service-worker" };
|
|
279
|
-
const response = new Response("{}", init);
|
|
280
|
-
if (!isFromVanilla) {
|
|
281
|
-
const originalRequestUrl = new URL(originalRequest.url);
|
|
282
|
-
const minSleepSeconds = Number(originalRequestUrl.searchParams.get("minSleepSeconds")) || 240;
|
|
283
|
-
for (let i = 0; i < minSleepSeconds; i++) {
|
|
284
|
-
await sleep(1e3 + Math.floor(Math.random() * 1e3));
|
|
285
|
-
const cache = await caches.open("oidc_dummy_cache");
|
|
286
|
-
await cache.put(event.request, response.clone());
|
|
287
|
-
}
|
|
288
|
-
}
|
|
289
|
-
return response;
|
|
290
|
-
};
|
|
291
|
-
const handleFetch = async (event) => {
|
|
292
|
-
const originalRequest = event.request;
|
|
293
|
-
const url = originalRequest.url;
|
|
294
|
-
if (originalRequest.url.includes(keepAliveJsonFilename)) {
|
|
295
|
-
event.respondWith(keepAliveAsync(event));
|
|
296
|
-
return;
|
|
297
|
-
}
|
|
298
|
-
const currentDatabaseForRequestAccessToken = getCurrentDatabaseDomain(
|
|
299
|
-
database,
|
|
300
|
-
originalRequest.url,
|
|
301
|
-
trustedDomains
|
|
302
|
-
);
|
|
303
|
-
if (currentDatabaseForRequestAccessToken && currentDatabaseForRequestAccessToken.tokens && currentDatabaseForRequestAccessToken.tokens.access_token) {
|
|
304
|
-
while (currentDatabaseForRequestAccessToken.tokens && !isTokensValid(currentDatabaseForRequestAccessToken.tokens)) {
|
|
305
|
-
await sleep(200);
|
|
306
|
-
}
|
|
307
|
-
const newRequest = originalRequest.mode === "navigate" ? new Request(originalRequest, {
|
|
308
|
-
headers: {
|
|
309
|
-
...serializeHeaders(originalRequest.headers),
|
|
310
|
-
authorization: "Bearer " + currentDatabaseForRequestAccessToken.tokens.access_token
|
|
311
|
-
}
|
|
312
|
-
}) : new Request(originalRequest, {
|
|
313
|
-
headers: {
|
|
314
|
-
...serializeHeaders(originalRequest.headers),
|
|
315
|
-
authorization: "Bearer " + currentDatabaseForRequestAccessToken.tokens.access_token
|
|
316
|
-
},
|
|
317
|
-
mode: currentDatabaseForRequestAccessToken.oidcConfiguration.service_worker_convert_all_requests_to_cors ? "cors" : originalRequest.mode
|
|
318
|
-
});
|
|
319
|
-
event.waitUntil(event.respondWith(fetch(newRequest)));
|
|
320
|
-
return;
|
|
321
|
-
}
|
|
322
|
-
if (event.request.method !== "POST") {
|
|
323
|
-
return;
|
|
324
|
-
}
|
|
325
|
-
let currentDatabase = null;
|
|
326
|
-
const currentDatabases = getCurrentDatabasesTokenEndpoint(
|
|
327
|
-
database,
|
|
328
|
-
originalRequest.url
|
|
329
|
-
);
|
|
330
|
-
const numberDatabase = currentDatabases.length;
|
|
331
|
-
if (numberDatabase > 0) {
|
|
332
|
-
const maPromesse = new Promise((resolve, reject) => {
|
|
333
|
-
const clonedRequest = originalRequest.clone();
|
|
334
|
-
const response = clonedRequest.text().then((actualBody) => {
|
|
335
|
-
if (actualBody.includes(TOKEN.REFRESH_TOKEN) || actualBody.includes(TOKEN.ACCESS_TOKEN)) {
|
|
336
|
-
let newBody = actualBody;
|
|
337
|
-
for (let i = 0; i < numberDatabase; i++) {
|
|
338
|
-
const currentDb = currentDatabases[i];
|
|
339
|
-
if (currentDb && currentDb.tokens != null) {
|
|
340
|
-
const keyRefreshToken = TOKEN.REFRESH_TOKEN + "_" + currentDb.configurationName;
|
|
341
|
-
if (actualBody.includes(keyRefreshToken)) {
|
|
342
|
-
newBody = newBody.replace(
|
|
343
|
-
keyRefreshToken,
|
|
344
|
-
encodeURIComponent(currentDb.tokens.refresh_token)
|
|
345
|
-
);
|
|
346
|
-
currentDatabase = currentDb;
|
|
347
|
-
break;
|
|
348
|
-
}
|
|
349
|
-
const keyAccessToken = TOKEN.ACCESS_TOKEN + "_" + currentDb.configurationName;
|
|
350
|
-
if (actualBody.includes(keyAccessToken)) {
|
|
351
|
-
newBody = newBody.replace(
|
|
352
|
-
keyAccessToken,
|
|
353
|
-
encodeURIComponent(currentDb.tokens.access_token)
|
|
354
|
-
);
|
|
355
|
-
currentDatabase = currentDb;
|
|
356
|
-
break;
|
|
357
|
-
}
|
|
358
|
-
}
|
|
359
|
-
}
|
|
360
|
-
const fetchPromise = fetch(originalRequest, {
|
|
361
|
-
body: newBody,
|
|
362
|
-
method: clonedRequest.method,
|
|
363
|
-
headers: {
|
|
364
|
-
...serializeHeaders(originalRequest.headers)
|
|
365
|
-
},
|
|
366
|
-
mode: clonedRequest.mode,
|
|
367
|
-
cache: clonedRequest.cache,
|
|
368
|
-
redirect: clonedRequest.redirect,
|
|
369
|
-
referrer: clonedRequest.referrer,
|
|
370
|
-
credentials: clonedRequest.credentials,
|
|
371
|
-
integrity: clonedRequest.integrity
|
|
372
|
-
});
|
|
373
|
-
if (currentDatabase && currentDatabase.oidcServerConfiguration != null && currentDatabase.oidcServerConfiguration.revocationEndpoint && url.startsWith(
|
|
374
|
-
currentDatabase.oidcServerConfiguration.revocationEndpoint
|
|
375
|
-
)) {
|
|
376
|
-
return fetchPromise.then(async (response2) => {
|
|
377
|
-
const text = await response2.text();
|
|
378
|
-
return new Response(text, response2);
|
|
379
|
-
});
|
|
380
|
-
}
|
|
381
|
-
return fetchPromise.then(hideTokens(currentDatabase));
|
|
382
|
-
} else if (actualBody.includes("code_verifier=") && currentLoginCallbackConfigurationName) {
|
|
383
|
-
currentDatabase = database[currentLoginCallbackConfigurationName];
|
|
384
|
-
currentLoginCallbackConfigurationName = null;
|
|
385
|
-
let newBody = actualBody;
|
|
386
|
-
if (currentDatabase && currentDatabase.codeVerifier != null) {
|
|
387
|
-
newBody = replaceCodeVerifier(newBody, currentDatabase.codeVerifier);
|
|
388
|
-
}
|
|
389
|
-
return fetch(originalRequest, {
|
|
390
|
-
body: newBody,
|
|
391
|
-
method: clonedRequest.method,
|
|
392
|
-
headers: {
|
|
393
|
-
...serializeHeaders(originalRequest.headers)
|
|
394
|
-
},
|
|
395
|
-
mode: clonedRequest.mode,
|
|
396
|
-
cache: clonedRequest.cache,
|
|
397
|
-
redirect: clonedRequest.redirect,
|
|
398
|
-
referrer: clonedRequest.referrer,
|
|
399
|
-
credentials: clonedRequest.credentials,
|
|
400
|
-
integrity: clonedRequest.integrity
|
|
401
|
-
}).then(hideTokens(currentDatabase));
|
|
402
|
-
}
|
|
403
|
-
return fetch(originalRequest, {
|
|
404
|
-
body: actualBody,
|
|
405
|
-
method: clonedRequest.method,
|
|
406
|
-
headers: {
|
|
407
|
-
...serializeHeaders(originalRequest.headers)
|
|
408
|
-
},
|
|
409
|
-
mode: clonedRequest.mode,
|
|
410
|
-
cache: clonedRequest.cache,
|
|
411
|
-
redirect: clonedRequest.redirect,
|
|
412
|
-
referrer: clonedRequest.referrer,
|
|
413
|
-
credentials: clonedRequest.credentials,
|
|
414
|
-
integrity: clonedRequest.integrity
|
|
415
|
-
});
|
|
416
|
-
});
|
|
417
|
-
response.then((r) => {
|
|
418
|
-
resolve(r);
|
|
419
|
-
}).catch((err) => {
|
|
420
|
-
reject(err);
|
|
421
|
-
});
|
|
422
|
-
});
|
|
423
|
-
event.waitUntil(event.respondWith(maPromesse));
|
|
424
|
-
}
|
|
425
|
-
};
|
|
426
|
-
const trustedDomainsShowAccessToken = {};
|
|
427
|
-
const handleMessage = (event) => {
|
|
428
|
-
const port = event.ports[0];
|
|
429
|
-
const data = event.data;
|
|
430
|
-
const configurationName = data.configurationName;
|
|
431
|
-
let currentDatabase = database[configurationName];
|
|
432
|
-
if (trustedDomains == null) {
|
|
433
|
-
trustedDomains = {};
|
|
434
|
-
}
|
|
435
|
-
if (!currentDatabase) {
|
|
436
|
-
if (trustedDomainsShowAccessToken[configurationName] === void 0) {
|
|
437
|
-
const trustedDomain = trustedDomains[configurationName];
|
|
438
|
-
trustedDomainsShowAccessToken[configurationName] = Array.isArray(trustedDomain) ? false : trustedDomain.showAccessToken;
|
|
439
|
-
}
|
|
440
|
-
database[configurationName] = {
|
|
441
|
-
tokens: null,
|
|
442
|
-
state: null,
|
|
443
|
-
codeVerifier: null,
|
|
444
|
-
oidcServerConfiguration: null,
|
|
445
|
-
oidcConfiguration: void 0,
|
|
446
|
-
nonce: null,
|
|
447
|
-
status: null,
|
|
448
|
-
configurationName,
|
|
449
|
-
hideAccessToken: !trustedDomainsShowAccessToken[configurationName]
|
|
450
|
-
};
|
|
451
|
-
currentDatabase = database[configurationName];
|
|
452
|
-
if (!trustedDomains[configurationName]) {
|
|
453
|
-
trustedDomains[configurationName] = [];
|
|
454
|
-
}
|
|
455
|
-
}
|
|
456
|
-
switch (data.type) {
|
|
457
|
-
case "clear":
|
|
458
|
-
currentDatabase.tokens = null;
|
|
459
|
-
currentDatabase.state = null;
|
|
460
|
-
currentDatabase.codeVerifier = null;
|
|
461
|
-
currentDatabase.status = data.data.status;
|
|
462
|
-
port.postMessage({ configurationName });
|
|
463
|
-
return;
|
|
464
|
-
case "init": {
|
|
465
|
-
const oidcServerConfiguration = data.data.oidcServerConfiguration;
|
|
466
|
-
const trustedDomain = trustedDomains[configurationName];
|
|
467
|
-
const domains = getDomains(trustedDomain, "oidc");
|
|
468
|
-
if (!domains.find((f) => f === acceptAnyDomainToken)) {
|
|
469
|
-
[
|
|
470
|
-
oidcServerConfiguration.tokenEndpoint,
|
|
471
|
-
oidcServerConfiguration.revocationEndpoint,
|
|
472
|
-
oidcServerConfiguration.userInfoEndpoint,
|
|
473
|
-
oidcServerConfiguration.issuer
|
|
474
|
-
].forEach((url) => {
|
|
475
|
-
checkDomain(domains, url);
|
|
476
|
-
});
|
|
477
|
-
}
|
|
478
|
-
currentDatabase.oidcServerConfiguration = oidcServerConfiguration;
|
|
479
|
-
currentDatabase.oidcConfiguration = data.data.oidcConfiguration;
|
|
480
|
-
const where = data.data.where;
|
|
481
|
-
if (where === "loginCallbackAsync" || where === "tryKeepExistingSessionAsync") {
|
|
482
|
-
currentLoginCallbackConfigurationName = configurationName;
|
|
483
|
-
} else {
|
|
484
|
-
currentLoginCallbackConfigurationName = null;
|
|
485
|
-
}
|
|
486
|
-
if (!currentDatabase.tokens) {
|
|
487
|
-
port.postMessage({
|
|
488
|
-
tokens: null,
|
|
489
|
-
status: currentDatabase.status,
|
|
490
|
-
configurationName,
|
|
491
|
-
version
|
|
492
|
-
});
|
|
493
|
-
} else {
|
|
494
|
-
const tokens = {
|
|
495
|
-
...currentDatabase.tokens
|
|
496
|
-
};
|
|
497
|
-
if (currentDatabase.hideAccessToken) {
|
|
498
|
-
tokens.access_token = TOKEN.ACCESS_TOKEN + "_" + configurationName;
|
|
499
|
-
}
|
|
500
|
-
if (tokens.refresh_token) {
|
|
501
|
-
tokens.refresh_token = TOKEN.REFRESH_TOKEN + "_" + configurationName;
|
|
502
|
-
}
|
|
503
|
-
if (tokens.idTokenPayload && tokens.idTokenPayload.nonce && currentDatabase.nonce != null) {
|
|
504
|
-
tokens.idTokenPayload.nonce = TOKEN.NONCE_TOKEN + "_" + configurationName;
|
|
505
|
-
}
|
|
506
|
-
port.postMessage({
|
|
507
|
-
tokens,
|
|
508
|
-
status: currentDatabase.status,
|
|
509
|
-
configurationName,
|
|
510
|
-
version
|
|
511
|
-
});
|
|
512
|
-
}
|
|
513
|
-
return;
|
|
514
|
-
}
|
|
515
|
-
case "setState":
|
|
516
|
-
currentDatabase.state = data.data.state;
|
|
517
|
-
port.postMessage({ configurationName });
|
|
518
|
-
return;
|
|
519
|
-
case "getState": {
|
|
520
|
-
const state = currentDatabase.state;
|
|
521
|
-
port.postMessage({ configurationName, state });
|
|
522
|
-
return;
|
|
523
|
-
}
|
|
524
|
-
case "setCodeVerifier":
|
|
525
|
-
currentDatabase.codeVerifier = data.data.codeVerifier;
|
|
526
|
-
port.postMessage({ configurationName });
|
|
527
|
-
return;
|
|
528
|
-
case "getCodeVerifier": {
|
|
529
|
-
port.postMessage({
|
|
530
|
-
configurationName,
|
|
531
|
-
codeVerifier: currentDatabase.codeVerifier != null ? TOKEN.CODE_VERIFIER + "_" + configurationName : null
|
|
532
|
-
});
|
|
533
|
-
return;
|
|
534
|
-
}
|
|
535
|
-
case "setSessionState":
|
|
536
|
-
currentDatabase.sessionState = data.data.sessionState;
|
|
537
|
-
port.postMessage({ configurationName });
|
|
538
|
-
return;
|
|
539
|
-
case "getSessionState": {
|
|
540
|
-
const sessionState = currentDatabase.sessionState;
|
|
541
|
-
port.postMessage({ configurationName, sessionState });
|
|
542
|
-
return;
|
|
543
|
-
}
|
|
544
|
-
case "setNonce": {
|
|
545
|
-
const nonce = data.data.nonce;
|
|
546
|
-
if (nonce) {
|
|
547
|
-
currentDatabase.nonce = nonce;
|
|
548
|
-
}
|
|
549
|
-
port.postMessage({ configurationName });
|
|
550
|
-
return;
|
|
551
|
-
}
|
|
552
|
-
case "getNonce": {
|
|
553
|
-
const keyNonce = TOKEN.NONCE_TOKEN + "_" + configurationName;
|
|
554
|
-
const nonce = currentDatabase.nonce ? keyNonce : null;
|
|
555
|
-
port.postMessage({ configurationName, nonce });
|
|
556
|
-
return;
|
|
557
|
-
}
|
|
558
|
-
default:
|
|
559
|
-
currentDatabase.items = { ...data.data };
|
|
560
|
-
port.postMessage({ configurationName });
|
|
561
|
-
}
|
|
562
|
-
};
|
|
563
|
-
_self.addEventListener("install", handleInstall);
|
|
564
|
-
_self.addEventListener("activate", handleActivate);
|
|
565
|
-
_self.addEventListener("fetch", handleFetch);
|
|
566
|
-
_self.addEventListener("message", handleMessage);
|
|
567
|
-
//# sourceMappingURL=OidcServiceWorker.js.map
|