@boxyhq/saml-jackson 1.1.4 → 1.1.5

package/dist/controller/oauth.js

@@ -294,7 +294,7 @@ class OAuthController {
                     publicKey: samlConfig.certs.publicKey,
                 });
                 const sessionId = crypto_1.default.randomBytes(16).toString('hex');
-                const requested = { client_id, state };
+                const requested = { client_id, state, redirect_uri };
                 if (requestedTenant) {
                     requested.tenant = requestedTenant;
                 }
@@ -542,8 +542,9 @@ class OAuthController {
      *             expires_in: 300
      */
     token(body) {
+        var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
-            const { client_id, client_secret, code_verifier, code, grant_type = 'authorization_code' } = body;
+            const { client_id, client_secret, code_verifier, code, grant_type = 'authorization_code', redirect_uri, } = body;
             metrics.increment('oauthToken');
             if (grant_type !== 'authorization_code') {
                 throw new error_1.JacksonError('Unsupported grant_type', 400);
@@ -555,6 +556,11 @@ class OAuthController {
             if (!codeVal || !codeVal.profile) {
                 throw new error_1.JacksonError('Invalid code', 403);
             }
+            if ((_a = codeVal.requested) === null || _a === void 0 ? void 0 : _a.redirect_uri) {
+                if (redirect_uri !== codeVal.requested.redirect_uri) {
+                    throw new error_1.JacksonError(`Invalid request: ${!redirect_uri ? 'redirect_uri missing' : 'redirect_uri mismatch'}`, 400);
+                }
+            }
             if (code_verifier) {
                 // PKCE flow
                 let cv = code_verifier;
@@ -594,8 +600,8 @@ class OAuthController {
             // store details against a token
             const token = crypto_1.default.randomBytes(20).toString('hex');
             const tokenVal = Object.assign(Object.assign({}, codeVal.profile), { requested: codeVal.requested });
-            const requestedOIDCFlow = !!codeVal.requested.oidc;
-            const requestHasNonce = !!codeVal.requested.nonce;
+            const requestedOIDCFlow = !!((_b = codeVal.requested) === null || _b === void 0 ? void 0 : _b.oidc);
+            const requestHasNonce = !!((_c = codeVal.requested) === null || _c === void 0 ? void 0 : _c.nonce);
             if (requestedOIDCFlow) {
                 const { jwtSigningKeys, jwsAlg } = this.opts.openid;
                 if (!jwtSigningKeys || !(0, utils_1.isJWSKeyPairLoaded)(jwtSigningKeys)) {

package/dist/typings.d.ts

@@ -4,8 +4,8 @@ export declare type IdPConfig = {
     redirectUrl: string[] | string;
     tenant: string;
     product: string;
-    name: string;
-    description: string;
+    name?: string;
+    description?: string;
     rawMetadata?: string;
     encodedRawMetadata?: string;
 };
@@ -89,6 +89,7 @@ export interface OAuthTokenReq {
     code_verifier: string;
     code: string;
     grant_type: 'authorization_code';
+    redirect_uri?: string;
 }
 export interface OAuthTokenRes {
     access_token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "description": "SAML Jackson library",
   "keywords": [
     "SAML 2.0"