@c9up/transit 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/Oauth1Driver.d.ts.map +1 -1
- package/dist/Oauth1Driver.js +3 -2
- package/dist/Oauth1Driver.js.map +1 -1
- package/dist/Oauth2Driver.d.ts.map +1 -1
- package/dist/Oauth2Driver.js +3 -2
- package/dist/Oauth2Driver.js.map +1 -1
- package/dist/TransitProvider.d.ts +1 -0
- package/dist/TransitProvider.d.ts.map +1 -1
- package/dist/TransitProvider.js +1 -0
- package/dist/TransitProvider.js.map +1 -1
- package/dist/augmentations.d.ts +24 -0
- package/dist/augmentations.d.ts.map +1 -0
- package/dist/augmentations.js +18 -0
- package/dist/augmentations.js.map +1 -0
- package/dist/drivers/OidcDriver.d.ts.map +1 -1
- package/dist/drivers/OidcDriver.js +4 -3
- package/dist/drivers/OidcDriver.js.map +1 -1
- package/dist/dsig.d.ts.map +1 -1
- package/dist/dsig.js +17 -11
- package/dist/dsig.js.map +1 -1
- package/dist/httpTimeout.d.ts +17 -0
- package/dist/httpTimeout.d.ts.map +1 -0
- package/dist/httpTimeout.js +25 -0
- package/dist/httpTimeout.js.map +1 -0
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/jwt.d.ts.map +1 -1
- package/dist/jwt.js +18 -2
- package/dist/jwt.js.map +1 -1
- package/dist/oidc.d.ts.map +1 -1
- package/dist/oidc.js +5 -4
- package/dist/oidc.js.map +1 -1
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +19 -1
- package/dist/types.js.map +1 -1
- package/package.json +8 -3
- package/src/Oauth1Driver.ts +3 -2
- package/src/Oauth2Driver.ts +3 -2
- package/src/TransitProvider.ts +1 -0
- package/src/augmentations.ts +28 -0
- package/src/drivers/OidcDriver.ts +5 -4
- package/src/dsig.ts +26 -15
- package/src/httpTimeout.ts +30 -0
- package/src/index.ts +2 -0
- package/src/jwt.ts +21 -3
- package/src/oidc.ts +5 -4
- package/src/types.ts +20 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Oauth1Driver.d.ts","sourceRoot":"","sources":["../src/Oauth1Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;
|
|
1
|
+
{"version":3,"file":"Oauth1Driver.d.ts","sourceRoot":"","sources":["../src/Oauth1Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,MAAM,YAAY,CAAC;AAGpB,8BAAsB,YAAa,YAAW,aAAa;;IAY9C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW;IAXlD,iEAAiE;IACjE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC7C,0EAA0E;IAC1E,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACpD,+BAA+B;IAC/B,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IACjD,6DAA6D;IAC7D,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IACnD,iCAAiC;IACjC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,MAAM,EAAE,WAAW;IAElD,yEAAyE;IACzE,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIlD,6EAA6E;IAC7E,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;IAErE;;;;OAIG;IACH,WAAW,IAAI,MAAM;IAMrB;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,eAAe,CAAC;IA2BvC;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAsBpD;;;OAGG;IACG,aAAa,CAClB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC;IASvB,0CAA0C;cAC1B,SAAS,CACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;CA8DvB"}
|
package/dist/Oauth1Driver.js
CHANGED
|
@@ -17,6 +17,7 @@
|
|
|
17
17
|
* the code, the returned token is the state, and the request-token secret is
|
|
18
18
|
* the secret kept from `begin()`.
|
|
19
19
|
*/
|
|
20
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
20
21
|
import { authorizationHeader, baseOauthParams, nonce, parseFormBody, } from "./oauth1.js";
|
|
21
22
|
import { assertOAuthState } from "./types.js";
|
|
22
23
|
export class Oauth1Driver {
|
|
@@ -97,7 +98,7 @@ export class Oauth1Driver {
|
|
|
97
98
|
const params = this.userInfoParams();
|
|
98
99
|
const query = new URLSearchParams(params).toString();
|
|
99
100
|
const url = query ? `${this.userInfoUrl}?${query}` : this.userInfoUrl;
|
|
100
|
-
const response = await
|
|
101
|
+
const response = await fetchWithTimeout(url, {
|
|
101
102
|
headers: {
|
|
102
103
|
Authorization: authorizationHeader({
|
|
103
104
|
method: "GET",
|
|
@@ -125,7 +126,7 @@ export class Oauth1Driver {
|
|
|
125
126
|
}
|
|
126
127
|
/** A signed POST to one of the token endpoints, whose body is form-encoded. */
|
|
127
128
|
async #post(url, oauth, tokenSecret) {
|
|
128
|
-
const response = await
|
|
129
|
+
const response = await fetchWithTimeout(url, {
|
|
129
130
|
method: "POST",
|
|
130
131
|
headers: {
|
|
131
132
|
Authorization: authorizationHeader({
|
package/dist/Oauth1Driver.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Oauth1Driver.js","sourceRoot":"","sources":["../src/Oauth1Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,KAAK,EAEL,aAAa,GACb,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,OAAgB,YAAY;IAYF;IAA/B,YAA+B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEtD,yEAAyE;IAC/D,cAAc;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAKD;;;;OAIG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,0GAA0G,CACpI,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YAC9C,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,mDAAmD,IAAI,CAAC,MAAM,CAAC,WAAW,qCAAqC,CAC/H,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,0CAA0C,CAC1D,CAAC;QACH,CAAC;QAED,OAAO;YACN,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE;YACpE,KAAK,EAAE,KAAK;YACZ,MAAM;SACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,+FAA+F,CACzH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,WAAoB;QAEpB,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,2FAA2F,CACrH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,0CAA0C;IAChC,KAAK,CAAC,SAAS,CACxB,WAAmB,EACnB,WAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAEtE,MAAM,QAAQ,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"Oauth1Driver.js","sourceRoot":"","sources":["../src/Oauth1Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,KAAK,EAEL,aAAa,GACb,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,OAAgB,YAAY;IAYF;IAA/B,YAA+B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEtD,yEAAyE;IAC/D,cAAc;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAKD;;;;OAIG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,0GAA0G,CACpI,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YAC9C,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,mDAAmD,IAAI,CAAC,MAAM,CAAC,WAAW,qCAAqC,CAC/H,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,0CAA0C,CAC1D,CAAC;QACH,CAAC;QAED,OAAO;YACN,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE;YACpE,KAAK,EAAE,KAAK;YACZ,MAAM;SACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,+FAA+F,CACzH,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAClB,WAAmB,EACnB,WAAoB;QAEpB,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,2FAA2F,CACrH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IAED,0CAA0C;IAChC,KAAK,CAAC,SAAS,CACxB,WAAmB,EACnB,WAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAEtE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YAC5C,OAAO,EAAE;gBACR,aAAa,EAAE,mBAAmB,CAAC;oBAClC,MAAM,EAAE,KAAK;oBACb,GAAG;oBACH,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;oBAC/B,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;oBACxC,WAAW;iBACX,CAAC;gBACF,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC,CAAC;IACzE,CAAC;IAED,sDAAsD;IACtD,MAAM,CAAC,KAAc;QACpB,OAAO,eAAe,CAAC;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YACjC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACxC,KAAK,EAAE,KAAK,EAAE;SACd,CAAC,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,KAAK,CACV,GAAW,EACX,KAAc,EACd,WAAoB;QAEpB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YAC5C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,aAAa,EAAE,mBAAmB,CAAC;oBAClC,MAAM,EAAE,MAAM;oBACd,GAAG;oBACH,KAAK;oBACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;oBACxC,WAAW;iBACX,CAAC;gBACF,cAAc,EAAE,mCAAmC;aACnD;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CACxE,CAAC;QACH,CAAC;QACD,kDAAkD;QAClD,OAAO,aAAa,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;CACD"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Oauth2Driver.d.ts","sourceRoot":"","sources":["../src/Oauth2Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;
|
|
1
|
+
{"version":3,"file":"Oauth2Driver.d.ts","sourceRoot":"","sources":["../src/Oauth2Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,MAAM,YAAY,CAAC;AAGpB,0DAA0D;AAC1D,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,8BAAsB,YAAa,YAAW,aAAa;;IAwB9C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW;IAvBlD,iEAAiE;IACjE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC7C,yCAAyC;IACzC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IACjD,6DAA6D;IAC7D,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IACnD,iCAAiC;IACjC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAChD,mDAAmD;IACnD,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE7D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAS;IAEjD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAU;gBAEzB,MAAM,EAAE,WAAW;IAElD,iEAAiE;IACjE,SAAS,CAAC,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAInD,yEAAyE;IACzE,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIlD,6EAA6E;IAC7E,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;IAErE,MAAM,IAAI,MAAM,EAAE;IAIlB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAwBpD;;;;;OAKG;IACG,KAAK,CAAC,KAAK,GAAE,MAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAM7D,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAapD;;;OAGG;IACG,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9D,wDAAwD;cACxC,QAAQ,CACvB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,CAAC;IA0CzB,uEAAuE;cACvD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAOpE,+EAA+E;cAC/D,OAAO,CACtB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACjC,OAAO,CAAC,OAAO,EAAE,CAAC;IAKrB,4DAA4D;cAC5C,GAAG,CAClB,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CA2BnC;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAeD,6EAA6E;AAC7E,wBAAgB,GAAG,CAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,MAAM,GACT,MAAM,GAAG,SAAS,CAGpB"}
|
package/dist/Oauth2Driver.js
CHANGED
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
* lets one driver serve several concurrent sign-ins.
|
|
14
14
|
*/
|
|
15
15
|
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
|
16
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
16
17
|
import { assertOAuthState } from "./types.js";
|
|
17
18
|
/**
|
|
18
19
|
* Mint a PKCE code verifier.
|
|
@@ -124,7 +125,7 @@ export class Oauth2Driver {
|
|
|
124
125
|
body.set("client_id", this.config.clientId);
|
|
125
126
|
body.set("client_secret", this.config.clientSecret);
|
|
126
127
|
}
|
|
127
|
-
const response = await
|
|
128
|
+
const response = await fetchWithTimeout(this.accessTokenUrl, {
|
|
128
129
|
method: "POST",
|
|
129
130
|
headers,
|
|
130
131
|
body,
|
|
@@ -160,7 +161,7 @@ export class Oauth2Driver {
|
|
|
160
161
|
/** The authenticated GET itself, before anything is assumed of the body. */
|
|
161
162
|
async #requestJson(url, accessToken, params = {}) {
|
|
162
163
|
const query = new URLSearchParams(params).toString();
|
|
163
|
-
const response = await
|
|
164
|
+
const response = await fetchWithTimeout(query ? `${url}?${query}` : url, {
|
|
164
165
|
headers: {
|
|
165
166
|
Authorization: `Bearer ${accessToken}`,
|
|
166
167
|
Accept: "application/json",
|
package/dist/Oauth2Driver.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Oauth2Driver.js","sourceRoot":"","sources":["../src/Oauth2Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"Oauth2Driver.js","sourceRoot":"","sources":["../src/Oauth2Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAQpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK9C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IACjC,sEAAsE;IACtE,0DAA0D;IAC1D,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAgB,YAAY;IAwBF;IAZ/B;;;OAGG;IACgB,YAAY,GAAY,KAAK,CAAC;IAEjD;;;OAGG;IACgB,SAAS,GAAqB,MAAM,CAAC;IAExD,YAA+B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEtD,iEAAiE;IACvD,eAAe;QACxB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,yEAAyE;IAC/D,cAAc;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAKD,MAAM;QACL,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAe;QAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe;YAC9B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,6IAA6I,CACvK,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,0EAA0E,CACpG,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,wDAAwD;IAC9C,KAAK,CAAC,QAAQ,CACvB,IAAY,EACZ,MAAe;QAEf,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,GAA2B;YACvC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACnD,CAAC;QAEF,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC9B,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACrD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,aAAa,GAAG,SAAS,WAAW,EAAE,CAAC;YAC/C,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CACxE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,uEAAuE;IAC7D,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE;YACzD,GAAG,IAAI,CAAC,cAAc,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IACrE,KAAK,CAAC,OAAO,CACtB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,4DAA4D;IAClD,KAAK,CAAC,GAAG,CAClB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACvE,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CACjB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;YACxE,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;CACD;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,MAAqB,EAAE,WAAmB;IAC5D,OAAO;QACN,WAAW;QACX,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAClB,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}
|
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* duck-typed below, which is what keeps the package publishable on its own and
|
|
6
6
|
* usable from a host that is not Ream.
|
|
7
7
|
*/
|
|
8
|
+
import "./augmentations.js";
|
|
8
9
|
interface TransitContainer {
|
|
9
10
|
singleton(token: unknown, factory: () => unknown): void;
|
|
10
11
|
resolve<T = unknown>(token: unknown): Promise<T>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TransitProvider.d.ts","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"TransitProvider.d.ts","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,oBAAoB,CAAC;AAK5B,UAAU,gBAAgB;IACzB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjD;AAED,UAAU,kBAAkB;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,CAAC,OAAO,OAAO,eAAe;IACvB,SAAS,CAAC,GAAG,EAAE,iBAAiB;gBAAtB,GAAG,EAAE,iBAAiB;IAE5C,QAAQ,IAAI,IAAI;IAgBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAK3B"}
|
package/dist/TransitProvider.js
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* duck-typed below, which is what keeps the package publishable on its own and
|
|
6
6
|
* usable from a host that is not Ream.
|
|
7
7
|
*/
|
|
8
|
+
import "./augmentations.js";
|
|
8
9
|
import { setTransit } from "./services/main.js";
|
|
9
10
|
import { TransitManager } from "./TransitManager.js";
|
|
10
11
|
export default class TransitProvider {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TransitProvider.js","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;
|
|
1
|
+
{"version":3,"file":"TransitProvider.js","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,MAAM,CAAC,OAAO,OAAO,eAAe;IACb;IAAtB,YAAsB,GAAsB;QAAtB,QAAG,GAAH,GAAG,CAAmB;IAAG,CAAC;IAEhD,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAiB,cAAc,CAAC,CAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,UAAU,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAiB,cAAc,CAAC,CAChE,CAAC;IACH,CAAC;CACD"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Teach ream's `ContainerBindings` what `container.make(...)` returns for the
|
|
3
|
+
* tokens transit binds.
|
|
4
|
+
*
|
|
5
|
+
* ream declares that interface open on purpose: it registers its own entries
|
|
6
|
+
* and expects each package to contribute the ones it owns. Nothing filled
|
|
7
|
+
* these in, so resolving by the string token answered `unknown` and every call
|
|
8
|
+
* site had to assert a type it could not prove.
|
|
9
|
+
*
|
|
10
|
+
* Loaded from the package barrel, so importing Transit anywhere in the
|
|
11
|
+
* application is enough — nobody writes a `declare module` of their own.
|
|
12
|
+
*
|
|
13
|
+
* Type-only, and ream stays an OPTIONAL peer: nothing here reaches a runtime
|
|
14
|
+
* import, and a `declare module` for a specifier that does not resolve is
|
|
15
|
+
* simply inert.
|
|
16
|
+
*/
|
|
17
|
+
import type { TransitManager } from "./TransitManager.js";
|
|
18
|
+
declare module "@c9up/ream/types" {
|
|
19
|
+
interface ContainerBindings {
|
|
20
|
+
/** The SSO manager, bound by `TransitProvider`. */
|
|
21
|
+
transit: TransitManager;
|
|
22
|
+
}
|
|
23
|
+
}
|
|
24
|
+
//# sourceMappingURL=augmentations.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"augmentations.d.ts","sourceRoot":"","sources":["../src/augmentations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,QAAQ,kBAAkB,CAAC;IACjC,UAAU,iBAAiB;QAC1B,mDAAmD;QACnD,OAAO,EAAE,cAAc,CAAC;KACxB;CACD"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Teach ream's `ContainerBindings` what `container.make(...)` returns for the
|
|
3
|
+
* tokens transit binds.
|
|
4
|
+
*
|
|
5
|
+
* ream declares that interface open on purpose: it registers its own entries
|
|
6
|
+
* and expects each package to contribute the ones it owns. Nothing filled
|
|
7
|
+
* these in, so resolving by the string token answered `unknown` and every call
|
|
8
|
+
* site had to assert a type it could not prove.
|
|
9
|
+
*
|
|
10
|
+
* Loaded from the package barrel, so importing Transit anywhere in the
|
|
11
|
+
* application is enough — nobody writes a `declare module` of their own.
|
|
12
|
+
*
|
|
13
|
+
* Type-only, and ream stays an OPTIONAL peer: nothing here reaches a runtime
|
|
14
|
+
* import, and a `declare module` for a specifier that does not resolve is
|
|
15
|
+
* simply inert.
|
|
16
|
+
*/
|
|
17
|
+
export {};
|
|
18
|
+
//# sourceMappingURL=augmentations.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"augmentations.js","sourceRoot":"","sources":["../src/augmentations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"OidcDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"OidcDriver.d.ts","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,UAAU;IAC1B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,KAAK,CAAC,EAAE,aAAa,CAAC;CACtB;AASD,qBAAa,UAAW,YAAW,aAAa;;gBAKnC,MAAM,EAAE,UAAU;IAM9B;;;OAGG;IACH,WAAW,IAAI,MAAM;IAMf,KAAK,CAAC,KAAK,GAAE,MAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmC7D,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAgCpD,iFAAiF;IAC3E,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAY9D;;;OAGG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW;CA0J5D;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAkBrE"}
|
|
@@ -12,6 +12,7 @@
|
|
|
12
12
|
* what `jwt.ts` does and what most of this class exists to feed.
|
|
13
13
|
*/
|
|
14
14
|
import { randomUUID } from "node:crypto";
|
|
15
|
+
import { fetchWithTimeout } from "../httpTimeout.js";
|
|
15
16
|
import { assertIdTokenClaims, decodeJws, isSupportedAlg, verifyJwsSignature, } from "../jwt.js";
|
|
16
17
|
import { challengeFor, createCodeVerifier } from "../Oauth2Driver.js";
|
|
17
18
|
import { JwksCache, OidcDiscovery, } from "../oidc.js";
|
|
@@ -131,7 +132,7 @@ export class OidcDriver {
|
|
|
131
132
|
// Only when a challenge was actually sent.
|
|
132
133
|
...(verifier === "" ? {} : { code_verifier: verifier }),
|
|
133
134
|
});
|
|
134
|
-
const response = await
|
|
135
|
+
const response = await fetchWithTimeout(metadata.token_endpoint, {
|
|
135
136
|
method: "POST",
|
|
136
137
|
headers: {
|
|
137
138
|
Accept: "application/json",
|
|
@@ -201,7 +202,7 @@ export class OidcDriver {
|
|
|
201
202
|
if (this.#config.userinfo === false ||
|
|
202
203
|
!metadata.userinfo_endpoint ||
|
|
203
204
|
accessToken === "") {
|
|
204
|
-
return claims;
|
|
205
|
+
return { ...claims };
|
|
205
206
|
}
|
|
206
207
|
const info = await this.#userinfo(metadata.userinfo_endpoint, accessToken);
|
|
207
208
|
if (info.sub !== claims.sub) {
|
|
@@ -210,7 +211,7 @@ export class OidcDriver {
|
|
|
210
211
|
return { ...claims, ...info };
|
|
211
212
|
}
|
|
212
213
|
async #userinfo(endpoint, accessToken) {
|
|
213
|
-
const response = await
|
|
214
|
+
const response = await fetchWithTimeout(endpoint, {
|
|
214
215
|
headers: {
|
|
215
216
|
Authorization: `Bearer ${accessToken}`,
|
|
216
217
|
Accept: "application/json",
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"OidcDriver.js","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,mBAAmB,EACnB,SAAS,EAET,cAAc,EAEd,kBAAkB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACN,SAAS,EACT,aAAa,GAGb,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA4B/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,OAAO,UAAU;IACb,OAAO,CAAa;IACpB,UAAU,CAAgB;IAC1B,KAAK,CAAY;IAE1B,YAAY,MAAkB;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,8HAA8H,CAC9H,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,KAAK;YACL,KAAK;YACL,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe;SAC/B,CAAC,CAAC;QAEH,mEAAmE;QACnE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,IAAI,GACT,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;QACvE,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,gCAAgC;QAChC,OAAO;YACN,GAAG,EAAE,GAAG,QAAQ,CAAC,sBAAsB,IAAI,MAAM,EAAE;YACnD,KAAK;YACL,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,GAAG,KAAK,EAAE;SAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAEnE,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE;gBACN,WAAW;gBACX,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;oBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;oBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACN;SACD,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,mFAAmF,CACpH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAClB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,OAAO,CAAC,GAA4B;QAC7C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,CAAC;IAED,OAAO;QACN,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAsB,EACtB,IAAY,EACZ,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE;YACzC,2CAA2C;YAC3C,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,
|
|
1
|
+
{"version":3,"file":"OidcDriver.js","sourceRoot":"","sources":["../../src/drivers/OidcDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,mBAAmB,EACnB,SAAS,EAET,cAAc,EAEd,kBAAkB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACN,SAAS,EACT,aAAa,GAGb,MAAM,YAAY,CAAC;AAOpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA4B/C;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,OAAO,UAAU;IACb,OAAO,CAAa;IACpB,UAAU,CAAgB;IAC1B,KAAK,CAAY;IAE1B,YAAY,MAAkB;QAC7B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,WAAW;QACV,MAAM,IAAI,KAAK,CACd,8HAA8H,CAC9H,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,KAAK;YACL,KAAK;YACL,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe;SAC/B,CAAC,CAAC;QAEH,mEAAmE;QACnE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,IAAI,GACT,QAAQ,CAAC,gCAAgC,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC;QACvE,IAAI,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,gCAAgC;QAChC,OAAO;YACN,GAAG,EAAE,GAAG,QAAQ,CAAC,sBAAsB,IAAI,MAAM,EAAE;YACnD,KAAK;YACL,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,gBAAgB,GAAG,KAAK,EAAE;SAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAEnE,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE;gBACN,WAAW;gBACX,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;oBAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;oBACxC,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;oBACxC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACN;SACD,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,mFAAmF,CACpH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAClB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,OAAO,CAAC,GAA4B;QAC7C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,aAAa;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,CAAC;IAED,OAAO;QACN,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5E,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAsB,EACtB,IAAY,EACZ,QAAgB;QAEhB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACtC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE;YACzC,2CAA2C;YAC3C,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,cAAc,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,mCAAmC;aACnD;YACD,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,wDAAwD,QAAQ,CAAC,MAAM,GAAG,CAC1E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CACnB,QAAsB,EACtB,OAAe,EACf,KAAa;QAEb,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,GAAG,GACR,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAErE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE;YACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,KAAK;YACL,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;SACzC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAsB,EAAE,SAAkB;QACvD,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,qCAAqC,IAAI;YAClE,OAAO;SACP,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM,2DAA2D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CACvJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACd,iCAAiC,MAAM,CAAC,SAAS,CAAC,4EAA4E,CAC9H,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,iCAAiC,SAAS,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,iCAAiC,CAC3G,CAAC;QACH,CAAC;QACD,sEAAsE;QACtE,6DAA6D;QAC7D,0DAA0D;QAC1D,OAAO,SAAS,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,QAAsB,EACtB,WAAmB,EACnB,MAAqB;QAErB,IACC,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC/B,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,WAAW,KAAK,EAAE,EACjB,CAAC;YACF,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACd,iFAAiF,CACjF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CACd,QAAgB,EAChB,WAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE;YACjD,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,0DAA0D,QAAQ,CAAC,MAAM,GAAG,CAC5E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;CACD;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,GAA4B;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO;QACN,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACnE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,KAAK;QACjD,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;QAC9B,sBAAsB,EACrB,KAAK,KAAK,SAAS;YAClB,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,GAAG,CAAC,cAAc,KAAK,IAAI;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY;QACjB,GAAG;KACH,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,0DAA0D;AAC1D,SAAS,WAAW,CAAC,MAA0B;IAI9C,MAAM,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACd,wHAAwH,CACxH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC"}
|
package/dist/dsig.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsig.d.ts","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,OAAO,EAIN,KAAK,UAAU,EAEf,MAAM,UAAU,CAAC;AAElB,eAAO,MAAM,OAAO,uCAAuC,CAAC;AAyC5D,qBAAa,cAAe,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,aAAa;IAC7B;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,GACpB,UAAU,
|
|
1
|
+
{"version":3,"file":"dsig.d.ts","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,OAAO,EAIN,KAAK,UAAU,EAEf,MAAM,UAAU,CAAC;AAElB,eAAO,MAAM,OAAO,uCAAuC,CAAC;AAyC5D,qBAAa,cAAe,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,aAAa;IAC7B;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,aAAa,GACpB,UAAU,CAqEZ"}
|
package/dist/dsig.js
CHANGED
|
@@ -109,8 +109,9 @@ export function verifyXmlSignature(root, options) {
|
|
|
109
109
|
withComments: canonicalizationMethod === EXC_C14N_COMMENTS,
|
|
110
110
|
}), "utf8");
|
|
111
111
|
const signatureValue = Buffer.from(textOf(only(signature, "SignatureValue")).replace(/\s+/g, ""), "base64");
|
|
112
|
-
|
|
113
|
-
|
|
112
|
+
// `some` stops at the first key that holds. Any of the provider's listed
|
|
113
|
+
// certificates is an acceptable signer; none of them is attacker-supplied.
|
|
114
|
+
const holds = resolveKeys(signature, options.certificates).some((key) => verifySignature(spec.hash, signedBytes, spec.kind === "ec" ? { key, dsaEncoding: "ieee-p1363" } : key, signatureValue));
|
|
114
115
|
if (!holds) {
|
|
115
116
|
throw new SignatureError("the signature does not verify");
|
|
116
117
|
}
|
|
@@ -202,13 +203,20 @@ function readTransforms(reference, signature) {
|
|
|
202
203
|
return { inclusivePrefixes, withComments };
|
|
203
204
|
}
|
|
204
205
|
/**
|
|
205
|
-
* The
|
|
206
|
+
* The keys to verify with — the caller's, from the provider's metadata.
|
|
206
207
|
*
|
|
207
|
-
* When the document carries a certificate it must be one of them
|
|
208
|
-
* gives a clear error instead of an opaque "does
|
|
209
|
-
* has rotated and the metadata has not been
|
|
208
|
+
* When the document carries a certificate it must be one of them, and that one
|
|
209
|
+
* alone is returned. The check gives a clear error instead of an opaque "does
|
|
210
|
+
* not verify" when a provider has rotated and the metadata has not been
|
|
211
|
+
* updated.
|
|
212
|
+
*
|
|
213
|
+
* Without one, every certificate the metadata lists is a candidate. A provider
|
|
214
|
+
* mid-rotation publishes the outgoing and the incoming certificate together and
|
|
215
|
+
* signs with either; trying only the first would reject every assertion signed
|
|
216
|
+
* with the other, for the whole rotation window, under a message blaming the
|
|
217
|
+
* signature. `certificates` is plural for this reason.
|
|
210
218
|
*/
|
|
211
|
-
function
|
|
219
|
+
function resolveKeys(signature, certificates) {
|
|
212
220
|
if (certificates.length === 0) {
|
|
213
221
|
throw new SignatureError("no certificate was supplied — the key has to come from the provider's metadata, never from the document itself");
|
|
214
222
|
}
|
|
@@ -219,11 +227,9 @@ function resolveKey(signature, certificates) {
|
|
|
219
227
|
if (!match) {
|
|
220
228
|
throw new SignatureError("the document is signed with a certificate the provider's metadata does not list");
|
|
221
229
|
}
|
|
222
|
-
return match.publicKey;
|
|
230
|
+
return [match.publicKey];
|
|
223
231
|
}
|
|
224
|
-
|
|
225
|
-
// the safer of the two cases.
|
|
226
|
-
return known[0].publicKey;
|
|
232
|
+
return known.map((cert) => cert.publicKey);
|
|
227
233
|
}
|
|
228
234
|
function embeddedCertificate(signature) {
|
|
229
235
|
for (const element of walk(signature)) {
|
package/dist/dsig.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsig.js","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACN,UAAU,EAEV,MAAM,IAAI,eAAe,EACzB,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,aAAa,EACb,MAAM,EACN,IAAI,GAGJ,MAAM,UAAU,CAAC;AAElB,MAAM,CAAC,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAC5D,MAAM,QAAQ,GAAG,yCAAyC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAChF,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,KAAK,GAAG,yCAAyC,CAAC;AAExD,mEAAmE;AACnE,MAAM,OAAO,GAA2B;IACvC,yCAAyC,EAAE,QAAQ;IACnD,+CAA+C,EAAE,QAAQ;IACzD,yCAAyC,EAAE,QAAQ;CACnD,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,GAAyD;IACxE,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;CACD,CAAC;AAEF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAgB,EAChB,OAAsB;IAEtB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACxC,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,mEAAmE;QACnE,4BAA4B;QAC5B,MAAM,IAAI,cAAc,CACvB,wBAAwB,UAAU,CAAC,MAAM,mDAAmD,CAC5F,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAe,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,UAAU,CAAC,IAAI,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,uBAAuB,MAAM,IAAI,cAAc,0EAA0E,CACzH,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,IAAI,CAClC,UAAU,EACV,wBAAwB,CACxB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC;IACzD,IACC,sBAAsB,KAAK,QAAQ;QACnC,sBAAsB,KAAK,iBAAiB,EAC3C,CAAC;QACF,MAAM,IAAI,cAAc,CACvB,qCAAqC,sBAAsB,IAAI,SAAS,iDAAiD,CACzH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC9B,YAAY,CAAC,UAAU,EAAE;QACxB,YAAY,EAAE,sBAAsB,KAAK,iBAAiB;KAC1D,CAAC,EACF,MAAM,CACN,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAC7D,QAAQ,CACR,CAAC;IAEF,MAAM,
|
|
1
|
+
{"version":3,"file":"dsig.js","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACN,UAAU,EAEV,MAAM,IAAI,eAAe,EACzB,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,aAAa,EACb,MAAM,EACN,IAAI,GAGJ,MAAM,UAAU,CAAC;AAElB,MAAM,CAAC,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAC5D,MAAM,QAAQ,GAAG,yCAAyC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAChF,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,KAAK,GAAG,yCAAyC,CAAC;AAExD,mEAAmE;AACnE,MAAM,OAAO,GAA2B;IACvC,yCAAyC,EAAE,QAAQ;IACnD,+CAA+C,EAAE,QAAQ;IACzD,yCAAyC,EAAE,QAAQ;CACnD,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,GAAyD;IACxE,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;CACD,CAAC;AAEF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAgB,EAChB,OAAsB;IAEtB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACxC,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,mEAAmE;QACnE,4BAA4B;QAC5B,MAAM,IAAI,cAAc,CACvB,wBAAwB,UAAU,CAAC,MAAM,mDAAmD,CAC5F,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAe,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,UAAU,CAAC,IAAI,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,uBAAuB,MAAM,IAAI,cAAc,0EAA0E,CACzH,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,IAAI,CAClC,UAAU,EACV,wBAAwB,CACxB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC;IACzD,IACC,sBAAsB,KAAK,QAAQ;QACnC,sBAAsB,KAAK,iBAAiB,EAC3C,CAAC;QACF,MAAM,IAAI,cAAc,CACvB,qCAAqC,sBAAsB,IAAI,SAAS,iDAAiD,CACzH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC9B,YAAY,CAAC,UAAU,EAAE;QACxB,YAAY,EAAE,sBAAsB,KAAK,iBAAiB;KAC1D,CAAC,EACF,MAAM,CACN,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAC7D,QAAQ,CACR,CAAC;IAEF,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACvE,eAAe,CACd,IAAI,CAAC,IAAI,EACT,WAAW,EACX,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,EAC7D,cAAc,CACd,CACD,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,IAAgB,EAChB,SAAqB,EACrB,UAAsB;IAEtB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACvB,sBAAsB,UAAU,CAAC,MAAM,oCAAoC,CAC3E,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAe,CAAC;IAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,cAAc,CACvB,4BAA4B,GAAG,IAAI,SAAS,sDAAsD,CAClG,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAExB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAClD,OAAO,CAAC,UAAU,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CACxE,CACD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACvB,wBAAwB,EAAE,iCAAiC,CAC3D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,mEAAmE;QACnE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,IAAI,cAAc,CACvB,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAAE,2DAA2D,CACzG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAe,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CACvB,0FAA0F,CAC1F,CAAC;IACH,CAAC;IAED,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,cAAc,CACzD,SAAS,EACT,SAAS,CACT,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,UAAU,CAAC,IAAI,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;IACT,MAAM,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,oBAAoB,YAAY,IAAI,cAAc,+CAA+C,CACjG,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,IAAI,GAAyB,IAAI,GAAG,CAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;SAC7B,MAAM,CACN,YAAY,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAC/D,MAAM,CACN;SACA,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CACvB,6EAA6E,CAC7E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CACtB,SAAqB,EACrB,SAAqB;IAErB,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;IAEN,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,iBAAiB,GAAa,EAAE,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;QACT,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC/D,YAAY,GAAG,SAAS,KAAK,iBAAiB,CAAC;YAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAC/B,EAAE,KAAK,CAAC;YACT,IAAI,QAAQ,EAAE,CAAC;gBACd,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS;QACV,CAAC;QACD,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,IAAI,cAAc,CACvB,yCAAyC,SAAS,IAAI,QAAQ,uBAAuB,CACrF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACzE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,IAAI,cAAc,CACvB,qGAAqG,CACrG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CACnB,SAAqB,EACrB,YAAsB;IAEtB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CACvB,gHAAgH,CAChH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CACvB,iFAAiF,CACjF,CAAC;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,mBAAmB,CAC3B,SAAqB;IAErB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IACC,OAAO,CAAC,YAAY,KAAK,OAAO;YAChC,OAAO,CAAC,KAAK,KAAK,iBAAiB,EAClC,CAAC;YACF,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,gCAAgC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,6BAA6B,CAAC;IACxH,IAAI,CAAC;QACJ,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,cAAc,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;AACF,CAAC;AAED,2DAA2D;AAC3D,SAAS,IAAI,CAAC,MAAkB,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,iBAAiB,KAAK,YAAY,MAAM,CAAC,KAAK,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAChF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAe,CAAC;AAC/B,CAAC;AAED,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,QAAoB,EAAE,UAAsB;IAC7D,KACC,IAAI,IAAI,GAA2B,UAAU,EAC7C,IAAI,KAAK,SAAS,EAClB,IAAI,GAAG,IAAI,CAAC,MAAM,EACjB,CAAC;QACF,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;AAC3D,CAAC"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Every outbound call this package makes, with a deadline on it.
|
|
3
|
+
*
|
|
4
|
+
* None of them had one. A provider that accepts the connection and then never
|
|
5
|
+
* answers held a request open indefinitely — discovery, JWKS, the token
|
|
6
|
+
* exchange, the callback — and the only thing that eventually freed it was the
|
|
7
|
+
* caller's own infrastructure, if it had any. An identity provider is the one
|
|
8
|
+
* dependency an application cannot route around, so it is the one that most
|
|
9
|
+
* needs a bound.
|
|
10
|
+
*
|
|
11
|
+
* Ten seconds, matching what the LDAP client already used, so the package has
|
|
12
|
+
* one answer rather than two.
|
|
13
|
+
*/
|
|
14
|
+
export declare const DEFAULT_TIMEOUT_MS = 10000;
|
|
15
|
+
/** `fetch`, refusing to wait forever. */
|
|
16
|
+
export declare function fetchWithTimeout(input: string | URL, init?: RequestInit, timeoutMs?: number): Promise<Response>;
|
|
17
|
+
//# sourceMappingURL=httpTimeout.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"httpTimeout.d.ts","sourceRoot":"","sources":["../src/httpTimeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,yCAAyC;AACzC,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,IAAI,GAAE,WAAgB,EACtB,SAAS,GAAE,MAA2B,GACpC,OAAO,CAAC,QAAQ,CAAC,CASnB"}
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Every outbound call this package makes, with a deadline on it.
|
|
3
|
+
*
|
|
4
|
+
* None of them had one. A provider that accepts the connection and then never
|
|
5
|
+
* answers held a request open indefinitely — discovery, JWKS, the token
|
|
6
|
+
* exchange, the callback — and the only thing that eventually freed it was the
|
|
7
|
+
* caller's own infrastructure, if it had any. An identity provider is the one
|
|
8
|
+
* dependency an application cannot route around, so it is the one that most
|
|
9
|
+
* needs a bound.
|
|
10
|
+
*
|
|
11
|
+
* Ten seconds, matching what the LDAP client already used, so the package has
|
|
12
|
+
* one answer rather than two.
|
|
13
|
+
*/
|
|
14
|
+
export const DEFAULT_TIMEOUT_MS = 10_000;
|
|
15
|
+
/** `fetch`, refusing to wait forever. */
|
|
16
|
+
export async function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_TIMEOUT_MS) {
|
|
17
|
+
const deadline = AbortSignal.timeout(timeoutMs);
|
|
18
|
+
// A caller's own signal still cancels: the deadline is added to it, never
|
|
19
|
+
// substituted for it.
|
|
20
|
+
const signal = init.signal === null || init.signal === undefined
|
|
21
|
+
? deadline
|
|
22
|
+
: AbortSignal.any([init.signal, deadline]);
|
|
23
|
+
return fetch(input, { ...init, signal });
|
|
24
|
+
}
|
|
25
|
+
//# sourceMappingURL=httpTimeout.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"httpTimeout.js","sourceRoot":"","sources":["../src/httpTimeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAAmB,EACnB,OAAoB,EAAE,EACtB,YAAoB,kBAAkB;IAEtC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,0EAA0E;IAC1E,sBAAsB;IACtB,MAAM,MAAM,GACX,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAChD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1C,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* application does not own. Today that is OAuth1 and OAuth2, and the providers
|
|
6
6
|
* that speak them.
|
|
7
7
|
*/
|
|
8
|
+
import "./augmentations.js";
|
|
8
9
|
export { type AppleKey, appleClientSecret, parseAppleUser } from "./apple.js";
|
|
9
10
|
export { type CanonicalizeOptions, canonicalize } from "./c14n.js";
|
|
10
11
|
export type { TransitConfig, TransitDriverFactory, TransitProviderEntry, } from "./config.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnE,YAAY,EACX,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EACN,cAAc,EACd,KAAK,SAAS,EACd,SAAS,EACT,KAAK,UAAU,EACf,KAAK,WAAW,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACN,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,OAAO,GACZ,MAAM,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAE,KAAK,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnE,YAAY,EACX,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EACN,cAAc,EACd,KAAK,SAAS,EACd,SAAS,EACT,KAAK,UAAU,EACf,KAAK,WAAW,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACN,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,OAAO,GACZ,MAAM,UAAU,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* application does not own. Today that is OAuth1 and OAuth2, and the providers
|
|
6
6
|
* that speak them.
|
|
7
7
|
*/
|
|
8
|
+
import "./augmentations.js";
|
|
8
9
|
export { appleClientSecret, parseAppleUser } from "./apple.js";
|
|
9
10
|
export { canonicalize } from "./c14n.js";
|
|
10
11
|
export { defineConfig, ldap, oidc, saml, socials } from "./config.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAiB,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAA4B,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAoB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAmB,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACN,cAAc,EAEd,SAAS,GAGT,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAEN,0BAA0B,EAC1B,yBAAyB,EAGzB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EAGT,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAWlE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,GAKN,MAAM,UAAU,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,oBAAoB,CAAC;AAE5B,OAAO,EAAiB,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAA4B,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAoB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAmB,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACN,cAAc,EAEd,SAAS,GAGT,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAEN,0BAA0B,EAC1B,yBAAyB,EAGzB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EAGT,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAWlE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,GAKN,MAAM,UAAU,CAAC"}
|
package/dist/jwt.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,+CAA+C;AAC/C,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAad,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAElD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,uDAAuD;AACvD,UAAU,KAAK;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAgB9C;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,YAAY,GACf,OAAO,CAgCT;AAED,MAAM,WAAW,iBAAiB;IACjC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,iBAAiB,GACzB,aAAa,
|
|
1
|
+
{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,+CAA+C;AAC/C,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAad,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAElD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,uDAAuD;AACvD,UAAU,KAAK;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAgB9C;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,YAAY,GACf,OAAO,CAgCT;AAED,MAAM,WAAW,iBAAiB;IACjC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,iBAAiB,GACzB,aAAa,CAkEf"}
|
package/dist/jwt.js
CHANGED
|
@@ -93,7 +93,7 @@ export function assertIdTokenClaims(payload, expected) {
|
|
|
93
93
|
const leeway = expected.leewaySeconds ?? 60;
|
|
94
94
|
const now = expected.now ?? Math.floor(Date.now() / 1000);
|
|
95
95
|
const iss = payload.iss;
|
|
96
|
-
if (iss !== expected.issuer) {
|
|
96
|
+
if (typeof iss !== "string" || iss !== expected.issuer) {
|
|
97
97
|
throw new Error(`[transit] id_token issuer mismatch: expected '${expected.issuer}'`);
|
|
98
98
|
}
|
|
99
99
|
const sub = payload.sub;
|
|
@@ -101,6 +101,12 @@ export function assertIdTokenClaims(payload, expected) {
|
|
|
101
101
|
throw new Error("[transit] id_token carries no subject");
|
|
102
102
|
}
|
|
103
103
|
const aud = payload.aud;
|
|
104
|
+
if (!isAudience(aud)) {
|
|
105
|
+
// Checked, not assumed: `includes` below would pass on a list holding the
|
|
106
|
+
// right string among arbitrary junk, and the claim would then be handed
|
|
107
|
+
// on described as a string it is not.
|
|
108
|
+
throw new Error("[transit] id_token audience is not a string or a list of strings");
|
|
109
|
+
}
|
|
104
110
|
const audiences = Array.isArray(aud) ? aud : [aud];
|
|
105
111
|
if (!audiences.includes(expected.audience)) {
|
|
106
112
|
throw new Error("[transit] id_token was not issued for this client — check the audience");
|
|
@@ -129,7 +135,17 @@ export function assertIdTokenClaims(payload, expected) {
|
|
|
129
135
|
// at the same provider can be replayed into a fresh session.
|
|
130
136
|
throw new Error("[transit] id_token nonce does not match this sign-in");
|
|
131
137
|
}
|
|
132
|
-
|
|
138
|
+
// Built from the locals each check narrowed, not asserted over the bag it
|
|
139
|
+
// came from. The cast that used to stand here promised `iss`, `sub`, `aud`
|
|
140
|
+
// and `exp` were strings and numbers on the strength of the checks above —
|
|
141
|
+
// and `iss` was never actually type-checked, only compared.
|
|
142
|
+
return { ...payload, iss, sub, aud, exp };
|
|
143
|
+
}
|
|
144
|
+
/** An `aud` claim, in the two shapes the spec allows. */
|
|
145
|
+
function isAudience(value) {
|
|
146
|
+
if (typeof value === "string")
|
|
147
|
+
return true;
|
|
148
|
+
return Array.isArray(value) && value.every((one) => typeof one === "string");
|
|
133
149
|
}
|
|
134
150
|
function decodeSegment(segment, what) {
|
|
135
151
|
let parsed;
|
package/dist/jwt.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,SAAS,EACT,eAAe,EACf,YAAY,EACZ,MAAM,IAAI,eAAe,GACzB,MAAM,aAAa,CAAC;AAsBrB;;;;;GAKG;AACH,MAAM,SAAS,GAAG;IACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;CAI9D,CAAC;AAIF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,SAAS,CAAC;AACxD,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAIzD,CAAC;IACF,OAAO;QACN,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC9C,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC;QACjD,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;KACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAY,EACZ,GAAQ,EACR,GAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,
|
|
1
|
+
{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,SAAS,EACT,eAAe,EACf,YAAY,EACZ,MAAM,IAAI,eAAe,GACzB,MAAM,aAAa,CAAC;AAsBrB;;;;;GAKG;AACH,MAAM,SAAS,GAAG;IACjB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;IAClD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE;IACtD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC9D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;CAI9D,CAAC;AAIF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,SAAS,CAAC;AACxD,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,QAIzD,CAAC;IACF,OAAO;QACN,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC9C,OAAO,EAAE,aAAa,CAAC,cAAc,EAAE,SAAS,CAAC;QACjD,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;QAClD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;KACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAY,EACZ,GAAQ,EACR,GAAiB;IAEjB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxB,uEAAuE;QACvE,mDAAmD;QACnD,OAAO,eAAe,CACrB,IAAI,CAAC,IAAI,EACT,IAAI,EACJ,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAClC,KAAK,CAAC,SAAS,CACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,eAAe,CACrB,IAAI,CAAC,IAAI,EACT,IAAI,EACJ;YACC,GAAG;YACH,OAAO,EAAE,SAAS,CAAC,qBAAqB;YACxC,UAAU,EAAE,SAAS,CAAC,sBAAsB;SAC5C,EACD,KAAK,CAAC,SAAS,CACf,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,CAAC;IACf,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,OAAgC,EAChC,QAA2B;IAE3B,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACd,iDAAiD,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,0EAA0E;QAC1E,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,IAAI,KAAK,CACd,kEAAkE,CAClE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACd,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/D,yEAAyE;QACzE,qEAAqE;QACrE,SAAS;QACT,MAAM,IAAI,KAAK,CACd,wEAAwE,CACxE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;QACnD,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtC,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACzE,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4DAA4D;IAC5D,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,mBAAmB,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAiC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,GAAQ,EAAE,GAAiB;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,aAAa,GAAG,YAAY,IAAI,CAAC,GAAG,sCAAsC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAC/F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACd,aAAa,GAAG,oBAAoB,KAAK,uBAAuB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CACjF,CAAC;IACH,CAAC;AACF,CAAC"}
|
package/dist/oidc.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;
|
|
1
|
+
{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qCAAqC,CAAC,EAAE,MAAM,EAAE,CAAC;IACjD,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC7B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yBAAyB;IACzB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAKD;;;;;;;GAOG;AACH,qBAAa,aAAa;;gBAOb,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB;IAQvD,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,IAAI,GAAG,IAAI,MAAM,CAEhB;IAEK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BvC;AAED;;;GAGG;AACH,qBAAa,SAAS;;gBAOT,OAAO,GAAE,aAAkB;IAKvC;;;;;;OAMG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;CAwD7D"}
|
package/dist/oidc.js
CHANGED
|
@@ -8,6 +8,7 @@
|
|
|
8
8
|
* key hands anyone a way to make this application hammer the provider. The
|
|
9
9
|
* middle is a rate limit.
|
|
10
10
|
*/
|
|
11
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
11
12
|
const DEFAULT_TTL_MS = 3_600_000;
|
|
12
13
|
const DEFAULT_MIN_REFETCH_MS = 300_000;
|
|
13
14
|
/**
|
|
@@ -50,7 +51,7 @@ export class OidcDiscovery {
|
|
|
50
51
|
return this.#inFlight;
|
|
51
52
|
}
|
|
52
53
|
async #fetch() {
|
|
53
|
-
const response = await
|
|
54
|
+
const response = await fetchWithTimeout(this.url, {
|
|
54
55
|
headers: { Accept: "application/json" },
|
|
55
56
|
});
|
|
56
57
|
if (!response.ok) {
|
|
@@ -91,7 +92,7 @@ export class JwksCache {
|
|
|
91
92
|
this.#now() - this.#fetchedAt < this.#minRefetchMs) {
|
|
92
93
|
throw new Error(`[transit] id_token names a signing key ('${kid ?? "no kid"}') the provider did not publish`);
|
|
93
94
|
}
|
|
94
|
-
await this.#
|
|
95
|
+
await this.#fetchKeys(uri);
|
|
95
96
|
const refreshed = this.#find(kid);
|
|
96
97
|
if (!refreshed) {
|
|
97
98
|
throw new Error(`[transit] id_token names a signing key ('${kid ?? "no kid"}') the provider did not publish`);
|
|
@@ -105,14 +106,14 @@ export class JwksCache {
|
|
|
105
106
|
// No `kid` is only unambiguous when the provider publishes one key.
|
|
106
107
|
return usable.length === 1 ? usable[0] : undefined;
|
|
107
108
|
}
|
|
108
|
-
async #
|
|
109
|
+
async #fetchKeys(uri) {
|
|
109
110
|
this.#inFlight ??= this.#fetchOnce(uri).finally(() => {
|
|
110
111
|
this.#inFlight = undefined;
|
|
111
112
|
});
|
|
112
113
|
return this.#inFlight;
|
|
113
114
|
}
|
|
114
115
|
async #fetchOnce(uri) {
|
|
115
|
-
const response = await
|
|
116
|
+
const response = await fetchWithTimeout(uri, {
|
|
116
117
|
headers: { Accept: "application/json" },
|
|
117
118
|
});
|
|
118
119
|
if (!response.ok) {
|
package/dist/oidc.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;
|
|
1
|
+
{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAuBpD,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IAChB,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,OAAO,CAA4D;IACnE,SAAS,CAAoC;IAE7C,YAAY,MAAc,EAAE,UAAyB,EAAE;QACtD,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED,IAAI,MAAM;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,IAAI,GAAG;QACN,OAAO,GAAG,IAAI,CAAC,OAAO,mCAAmC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,QAAQ;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC;QACxB,CAAC;QACD,iEAAiE;QACjE,0CAA0C;QAC1C,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE;YACjD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,kDAAkD,IAAI,CAAC,OAAO,WAAW,QAAQ,CAAC,MAAM,GAAG,CAC3F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC;IACjB,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,OAAO,SAAS;IACZ,aAAa,CAAS;IACtB,IAAI,CAAe;IAC5B,KAAK,GAAU,EAAE,CAAC;IAClB,UAAU,GAAG,CAAC,CAAC;IACf,SAAS,CAA6B;IAEtC,YAAY,UAAyB,EAAE;QACtC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,GAAuB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,IACC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACrB,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,EACjD,CAAC;YACF,MAAM,IAAI,KAAK,CACd,4CAA4C,GAAG,IAAI,QAAQ,iCAAiC,CAC5F,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACd,4CAA4C,GAAG,IAAI,QAAQ,iCAAiC,CAC5F,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,GAAuB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CACnD,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACpE,oEAAoE;QACpE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACpD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC3B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YAC5C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,+DAA+D,QAAQ,CAAC,MAAM,GAAG,CACjF,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC;IACnB,CAAC;CACD;AAED,SAAS,KAAK,CAAC,KAAc;IAC5B,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,QAAQ,CAC7C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACtB,IAA2B,EAC3B,cAAsB;IAEtB,KAAK,MAAM,KAAK,IAAI;QACnB,QAAQ;QACR,wBAAwB;QACxB,gBAAgB;QAChB,UAAU;KACD,EAAE,CAAC;QACZ,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACd,wCAAwC,cAAc,YAAY,KAAK,EAAE,CACzE,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACd,4CAA4C,IAAI,CAAC,MAAM,WAAW,cAAc,qDAAqD,CACrI,CAAC;IACH,CAAC;IACD,OAAO,IAAoB,CAAC;AAC7B,CAAC"}
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrD;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;IACrD;;;;OAIG;IACH,aAAa,CAAC,CACb,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACvE;AAED,mDAAmD;AACnD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,eAAe,CAAC;AAE3D,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,eAAe,CAKzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,aAAa,EAAE,MAAM,GAAG,SAAS,GAC/B,IAAI,CAUN"}
|
package/dist/types.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* The shapes every provider answers with, whatever protocol it speaks.
|
|
3
3
|
*/
|
|
4
|
+
import { timingSafeEqual } from "node:crypto";
|
|
4
5
|
/** Whether an entry verifies credentials rather than redirecting. */
|
|
5
6
|
export function isDirectory(entry) {
|
|
6
7
|
return (typeof entry.authenticate === "function" &&
|
|
@@ -20,8 +21,25 @@ export function assertOAuthState(state, expectedState) {
|
|
|
20
21
|
throw new Error("[transit] OAuth callback requires expectedState for CSRF protection. " +
|
|
21
22
|
"Store the state given to redirectUrl() in the session and pass it here.");
|
|
22
23
|
}
|
|
23
|
-
if (state
|
|
24
|
+
if (state === undefined || !sameSecret(state, expectedState)) {
|
|
24
25
|
throw new Error("OAuth state mismatch — possible CSRF attack");
|
|
25
26
|
}
|
|
26
27
|
}
|
|
28
|
+
/**
|
|
29
|
+
* Compare two states without leaking where they diverge.
|
|
30
|
+
*
|
|
31
|
+
* `!==` on strings stops at the first differing byte, and the state is the only
|
|
32
|
+
* thing standing between an attacker's authorization code and the victim's
|
|
33
|
+
* session. The leak is small against network noise, but every other secret
|
|
34
|
+
* comparison in the framework is already constant-time and this one is the
|
|
35
|
+
* outlier.
|
|
36
|
+
*
|
|
37
|
+
* The lengths are checked first because `timingSafeEqual` throws when they
|
|
38
|
+
* differ. A state's length is not the secret; its content is.
|
|
39
|
+
*/
|
|
40
|
+
function sameSecret(given, expected) {
|
|
41
|
+
const left = Buffer.from(given, "utf8");
|
|
42
|
+
const right = Buffer.from(expected, "utf8");
|
|
43
|
+
return left.length === right.length && timingSafeEqual(left, right);
|
|
44
|
+
}
|
|
27
45
|
//# sourceMappingURL=types.js.map
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoH9C,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,KAAmB;IAC9C,OAAO,CACN,OAAQ,KAAyB,CAAC,YAAY,KAAK,UAAU;QAC7D,OAAQ,KAAuB,CAAC,QAAQ,KAAK,UAAU,CACvD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAyB,EACzB,aAAiC;IAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACd,uEAAuE;YACtE,yEAAyE,CAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAChE,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,QAAgB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@c9up/transit",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "Transit — federated sign-in for the Ream framework: SAML 2.0, LDAP, OpenID Connect, OAuth1, OAuth2",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -37,14 +37,19 @@
|
|
|
37
37
|
"@types/node": "^22.19.15",
|
|
38
38
|
"@vitest/coverage-v8": "^4.1.5",
|
|
39
39
|
"typescript": "^6.0.2",
|
|
40
|
-
"vitest": "^4.1.2"
|
|
40
|
+
"vitest": "^4.1.2",
|
|
41
|
+
"@c9up/ream": "^0.2.0"
|
|
41
42
|
},
|
|
42
43
|
"peerDependencies": {
|
|
43
|
-
"@c9up/quasar": "^0.1.0"
|
|
44
|
+
"@c9up/quasar": "^0.1.0",
|
|
45
|
+
"@c9up/ream": "^0.2.0"
|
|
44
46
|
},
|
|
45
47
|
"peerDependenciesMeta": {
|
|
46
48
|
"@c9up/quasar": {
|
|
47
49
|
"optional": true
|
|
50
|
+
},
|
|
51
|
+
"@c9up/ream": {
|
|
52
|
+
"optional": true
|
|
48
53
|
}
|
|
49
54
|
},
|
|
50
55
|
"engines": {
|
package/src/Oauth1Driver.ts
CHANGED
|
@@ -18,6 +18,7 @@
|
|
|
18
18
|
* the secret kept from `begin()`.
|
|
19
19
|
*/
|
|
20
20
|
|
|
21
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
21
22
|
import {
|
|
22
23
|
authorizationHeader,
|
|
23
24
|
baseOauthParams,
|
|
@@ -156,7 +157,7 @@ export abstract class Oauth1Driver implements TransitDriver {
|
|
|
156
157
|
const query = new URLSearchParams(params).toString();
|
|
157
158
|
const url = query ? `${this.userInfoUrl}?${query}` : this.userInfoUrl;
|
|
158
159
|
|
|
159
|
-
const response = await
|
|
160
|
+
const response = await fetchWithTimeout(url, {
|
|
160
161
|
headers: {
|
|
161
162
|
Authorization: authorizationHeader({
|
|
162
163
|
method: "GET",
|
|
@@ -192,7 +193,7 @@ export abstract class Oauth1Driver implements TransitDriver {
|
|
|
192
193
|
oauth: Param[],
|
|
193
194
|
tokenSecret?: string,
|
|
194
195
|
): Promise<Record<string, string>> {
|
|
195
|
-
const response = await
|
|
196
|
+
const response = await fetchWithTimeout(url, {
|
|
196
197
|
method: "POST",
|
|
197
198
|
headers: {
|
|
198
199
|
Authorization: authorizationHeader({
|
package/src/Oauth2Driver.ts
CHANGED
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
*/
|
|
15
15
|
|
|
16
16
|
import { createHash, randomBytes, randomUUID } from "node:crypto";
|
|
17
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
17
18
|
import type {
|
|
18
19
|
OAuthConfig,
|
|
19
20
|
OAuthToken,
|
|
@@ -174,7 +175,7 @@ export abstract class Oauth2Driver implements TransitDriver {
|
|
|
174
175
|
body.set("client_secret", this.config.clientSecret);
|
|
175
176
|
}
|
|
176
177
|
|
|
177
|
-
const response = await
|
|
178
|
+
const response = await fetchWithTimeout(this.accessTokenUrl, {
|
|
178
179
|
method: "POST",
|
|
179
180
|
headers,
|
|
180
181
|
body,
|
|
@@ -228,7 +229,7 @@ export abstract class Oauth2Driver implements TransitDriver {
|
|
|
228
229
|
params: Record<string, string> = {},
|
|
229
230
|
): Promise<unknown> {
|
|
230
231
|
const query = new URLSearchParams(params).toString();
|
|
231
|
-
const response = await
|
|
232
|
+
const response = await fetchWithTimeout(query ? `${url}?${query}` : url, {
|
|
232
233
|
headers: {
|
|
233
234
|
Authorization: `Bearer ${accessToken}`,
|
|
234
235
|
Accept: "application/json",
|
package/src/TransitProvider.ts
CHANGED
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Teach ream's `ContainerBindings` what `container.make(...)` returns for the
|
|
3
|
+
* tokens transit binds.
|
|
4
|
+
*
|
|
5
|
+
* ream declares that interface open on purpose: it registers its own entries
|
|
6
|
+
* and expects each package to contribute the ones it owns. Nothing filled
|
|
7
|
+
* these in, so resolving by the string token answered `unknown` and every call
|
|
8
|
+
* site had to assert a type it could not prove.
|
|
9
|
+
*
|
|
10
|
+
* Loaded from the package barrel, so importing Transit anywhere in the
|
|
11
|
+
* application is enough — nobody writes a `declare module` of their own.
|
|
12
|
+
*
|
|
13
|
+
* Type-only, and ream stays an OPTIONAL peer: nothing here reaches a runtime
|
|
14
|
+
* import, and a `declare module` for a specifier that does not resolve is
|
|
15
|
+
* simply inert.
|
|
16
|
+
*/
|
|
17
|
+
|
|
18
|
+
// Referenced so the augmentation below resolves the module it augments.
|
|
19
|
+
import type {} from "@c9up/ream/types";
|
|
20
|
+
|
|
21
|
+
import type { TransitManager } from "./TransitManager.js";
|
|
22
|
+
|
|
23
|
+
declare module "@c9up/ream/types" {
|
|
24
|
+
interface ContainerBindings {
|
|
25
|
+
/** The SSO manager, bound by `TransitProvider`. */
|
|
26
|
+
transit: TransitManager;
|
|
27
|
+
}
|
|
28
|
+
}
|
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
*/
|
|
14
14
|
|
|
15
15
|
import { randomUUID } from "node:crypto";
|
|
16
|
+
import { fetchWithTimeout } from "../httpTimeout.js";
|
|
16
17
|
import {
|
|
17
18
|
assertIdTokenClaims,
|
|
18
19
|
decodeJws,
|
|
@@ -211,7 +212,7 @@ export class OidcDriver implements TransitDriver {
|
|
|
211
212
|
// Only when a challenge was actually sent.
|
|
212
213
|
...(verifier === "" ? {} : { code_verifier: verifier }),
|
|
213
214
|
});
|
|
214
|
-
const response = await
|
|
215
|
+
const response = await fetchWithTimeout(metadata.token_endpoint, {
|
|
215
216
|
method: "POST",
|
|
216
217
|
headers: {
|
|
217
218
|
Accept: "application/json",
|
|
@@ -305,7 +306,7 @@ export class OidcDriver implements TransitDriver {
|
|
|
305
306
|
!metadata.userinfo_endpoint ||
|
|
306
307
|
accessToken === ""
|
|
307
308
|
) {
|
|
308
|
-
return claims
|
|
309
|
+
return { ...claims };
|
|
309
310
|
}
|
|
310
311
|
const info = await this.#userinfo(metadata.userinfo_endpoint, accessToken);
|
|
311
312
|
if (info.sub !== claims.sub) {
|
|
@@ -313,14 +314,14 @@ export class OidcDriver implements TransitDriver {
|
|
|
313
314
|
"[transit] the userinfo response describes a different subject than the id_token",
|
|
314
315
|
);
|
|
315
316
|
}
|
|
316
|
-
return { ...
|
|
317
|
+
return { ...claims, ...info };
|
|
317
318
|
}
|
|
318
319
|
|
|
319
320
|
async #userinfo(
|
|
320
321
|
endpoint: string,
|
|
321
322
|
accessToken: string,
|
|
322
323
|
): Promise<Record<string, unknown>> {
|
|
323
|
-
const response = await
|
|
324
|
+
const response = await fetchWithTimeout(endpoint, {
|
|
324
325
|
headers: {
|
|
325
326
|
Authorization: `Bearer ${accessToken}`,
|
|
326
327
|
Accept: "application/json",
|
package/src/dsig.ts
CHANGED
|
@@ -164,12 +164,15 @@ export function verifyXmlSignature(
|
|
|
164
164
|
"base64",
|
|
165
165
|
);
|
|
166
166
|
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
167
|
+
// `some` stops at the first key that holds. Any of the provider's listed
|
|
168
|
+
// certificates is an acceptable signer; none of them is attacker-supplied.
|
|
169
|
+
const holds = resolveKeys(signature, options.certificates).some((key) =>
|
|
170
|
+
verifySignature(
|
|
171
|
+
spec.hash,
|
|
172
|
+
signedBytes,
|
|
173
|
+
spec.kind === "ec" ? { key, dsaEncoding: "ieee-p1363" } : key,
|
|
174
|
+
signatureValue,
|
|
175
|
+
),
|
|
173
176
|
);
|
|
174
177
|
if (!holds) {
|
|
175
178
|
throw new SignatureError("the signature does not verify");
|
|
@@ -318,13 +321,23 @@ function readTransforms(
|
|
|
318
321
|
}
|
|
319
322
|
|
|
320
323
|
/**
|
|
321
|
-
* The
|
|
324
|
+
* The keys to verify with — the caller's, from the provider's metadata.
|
|
325
|
+
*
|
|
326
|
+
* When the document carries a certificate it must be one of them, and that one
|
|
327
|
+
* alone is returned. The check gives a clear error instead of an opaque "does
|
|
328
|
+
* not verify" when a provider has rotated and the metadata has not been
|
|
329
|
+
* updated.
|
|
322
330
|
*
|
|
323
|
-
*
|
|
324
|
-
*
|
|
325
|
-
*
|
|
331
|
+
* Without one, every certificate the metadata lists is a candidate. A provider
|
|
332
|
+
* mid-rotation publishes the outgoing and the incoming certificate together and
|
|
333
|
+
* signs with either; trying only the first would reject every assertion signed
|
|
334
|
+
* with the other, for the whole rotation window, under a message blaming the
|
|
335
|
+
* signature. `certificates` is plural for this reason.
|
|
326
336
|
*/
|
|
327
|
-
function
|
|
337
|
+
function resolveKeys(
|
|
338
|
+
signature: XmlElement,
|
|
339
|
+
certificates: string[],
|
|
340
|
+
): KeyObject[] {
|
|
328
341
|
if (certificates.length === 0) {
|
|
329
342
|
throw new SignatureError(
|
|
330
343
|
"no certificate was supplied — the key has to come from the provider's metadata, never from the document itself",
|
|
@@ -339,11 +352,9 @@ function resolveKey(signature: XmlElement, certificates: string[]): KeyObject {
|
|
|
339
352
|
"the document is signed with a certificate the provider's metadata does not list",
|
|
340
353
|
);
|
|
341
354
|
}
|
|
342
|
-
return match.publicKey;
|
|
355
|
+
return [match.publicKey];
|
|
343
356
|
}
|
|
344
|
-
|
|
345
|
-
// the safer of the two cases.
|
|
346
|
-
return (known[0] as X509Certificate).publicKey;
|
|
357
|
+
return known.map((cert) => cert.publicKey);
|
|
347
358
|
}
|
|
348
359
|
|
|
349
360
|
function embeddedCertificate(
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Every outbound call this package makes, with a deadline on it.
|
|
3
|
+
*
|
|
4
|
+
* None of them had one. A provider that accepts the connection and then never
|
|
5
|
+
* answers held a request open indefinitely — discovery, JWKS, the token
|
|
6
|
+
* exchange, the callback — and the only thing that eventually freed it was the
|
|
7
|
+
* caller's own infrastructure, if it had any. An identity provider is the one
|
|
8
|
+
* dependency an application cannot route around, so it is the one that most
|
|
9
|
+
* needs a bound.
|
|
10
|
+
*
|
|
11
|
+
* Ten seconds, matching what the LDAP client already used, so the package has
|
|
12
|
+
* one answer rather than two.
|
|
13
|
+
*/
|
|
14
|
+
export const DEFAULT_TIMEOUT_MS = 10_000;
|
|
15
|
+
|
|
16
|
+
/** `fetch`, refusing to wait forever. */
|
|
17
|
+
export async function fetchWithTimeout(
|
|
18
|
+
input: string | URL,
|
|
19
|
+
init: RequestInit = {},
|
|
20
|
+
timeoutMs: number = DEFAULT_TIMEOUT_MS,
|
|
21
|
+
): Promise<Response> {
|
|
22
|
+
const deadline = AbortSignal.timeout(timeoutMs);
|
|
23
|
+
// A caller's own signal still cancels: the deadline is added to it, never
|
|
24
|
+
// substituted for it.
|
|
25
|
+
const signal =
|
|
26
|
+
init.signal === null || init.signal === undefined
|
|
27
|
+
? deadline
|
|
28
|
+
: AbortSignal.any([init.signal, deadline]);
|
|
29
|
+
return fetch(input, { ...init, signal });
|
|
30
|
+
}
|
package/src/index.ts
CHANGED
package/src/jwt.ts
CHANGED
|
@@ -113,7 +113,7 @@ export function verifyJwsSignature(
|
|
|
113
113
|
): boolean {
|
|
114
114
|
const spec = SUPPORTED[alg];
|
|
115
115
|
assertKeyMatchesAlg(jwk, alg);
|
|
116
|
-
const key = createPublicKey({ key: jwk
|
|
116
|
+
const key = createPublicKey({ key: jwk, format: "jwk" });
|
|
117
117
|
|
|
118
118
|
const data = Buffer.from(parts.signingInput, "ascii");
|
|
119
119
|
if (spec.kind === "ec") {
|
|
@@ -173,7 +173,7 @@ export function assertIdTokenClaims(
|
|
|
173
173
|
const now = expected.now ?? Math.floor(Date.now() / 1000);
|
|
174
174
|
|
|
175
175
|
const iss = payload.iss;
|
|
176
|
-
if (iss !== expected.issuer) {
|
|
176
|
+
if (typeof iss !== "string" || iss !== expected.issuer) {
|
|
177
177
|
throw new Error(
|
|
178
178
|
`[transit] id_token issuer mismatch: expected '${expected.issuer}'`,
|
|
179
179
|
);
|
|
@@ -185,6 +185,14 @@ export function assertIdTokenClaims(
|
|
|
185
185
|
}
|
|
186
186
|
|
|
187
187
|
const aud = payload.aud;
|
|
188
|
+
if (!isAudience(aud)) {
|
|
189
|
+
// Checked, not assumed: `includes` below would pass on a list holding the
|
|
190
|
+
// right string among arbitrary junk, and the claim would then be handed
|
|
191
|
+
// on described as a string it is not.
|
|
192
|
+
throw new Error(
|
|
193
|
+
"[transit] id_token audience is not a string or a list of strings",
|
|
194
|
+
);
|
|
195
|
+
}
|
|
188
196
|
const audiences = Array.isArray(aud) ? aud : [aud];
|
|
189
197
|
if (!audiences.includes(expected.audience)) {
|
|
190
198
|
throw new Error(
|
|
@@ -221,7 +229,17 @@ export function assertIdTokenClaims(
|
|
|
221
229
|
throw new Error("[transit] id_token nonce does not match this sign-in");
|
|
222
230
|
}
|
|
223
231
|
|
|
224
|
-
|
|
232
|
+
// Built from the locals each check narrowed, not asserted over the bag it
|
|
233
|
+
// came from. The cast that used to stand here promised `iss`, `sub`, `aud`
|
|
234
|
+
// and `exp` were strings and numbers on the strength of the checks above —
|
|
235
|
+
// and `iss` was never actually type-checked, only compared.
|
|
236
|
+
return { ...payload, iss, sub, aud, exp };
|
|
237
|
+
}
|
|
238
|
+
|
|
239
|
+
/** An `aud` claim, in the two shapes the spec allows. */
|
|
240
|
+
function isAudience(value: unknown): value is string | string[] {
|
|
241
|
+
if (typeof value === "string") return true;
|
|
242
|
+
return Array.isArray(value) && value.every((one) => typeof one === "string");
|
|
225
243
|
}
|
|
226
244
|
|
|
227
245
|
function decodeSegment(segment: string, what: string): Record<string, unknown> {
|
package/src/oidc.ts
CHANGED
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
* middle is a rate limit.
|
|
10
10
|
*/
|
|
11
11
|
|
|
12
|
+
import { fetchWithTimeout } from "./httpTimeout.js";
|
|
12
13
|
import type { Jwk } from "./jwt.js";
|
|
13
14
|
|
|
14
15
|
/** The slice of the discovery document this reads. */
|
|
@@ -79,7 +80,7 @@ export class OidcDiscovery {
|
|
|
79
80
|
}
|
|
80
81
|
|
|
81
82
|
async #fetch(): Promise<OidcMetadata> {
|
|
82
|
-
const response = await
|
|
83
|
+
const response = await fetchWithTimeout(this.url, {
|
|
83
84
|
headers: { Accept: "application/json" },
|
|
84
85
|
});
|
|
85
86
|
if (!response.ok) {
|
|
@@ -130,7 +131,7 @@ export class JwksCache {
|
|
|
130
131
|
);
|
|
131
132
|
}
|
|
132
133
|
|
|
133
|
-
await this.#
|
|
134
|
+
await this.#fetchKeys(uri);
|
|
134
135
|
const refreshed = this.#find(kid);
|
|
135
136
|
if (!refreshed) {
|
|
136
137
|
throw new Error(
|
|
@@ -149,7 +150,7 @@ export class JwksCache {
|
|
|
149
150
|
return usable.length === 1 ? usable[0] : undefined;
|
|
150
151
|
}
|
|
151
152
|
|
|
152
|
-
async #
|
|
153
|
+
async #fetchKeys(uri: string): Promise<Jwk[]> {
|
|
153
154
|
this.#inFlight ??= this.#fetchOnce(uri).finally(() => {
|
|
154
155
|
this.#inFlight = undefined;
|
|
155
156
|
});
|
|
@@ -157,7 +158,7 @@ export class JwksCache {
|
|
|
157
158
|
}
|
|
158
159
|
|
|
159
160
|
async #fetchOnce(uri: string): Promise<Jwk[]> {
|
|
160
|
-
const response = await
|
|
161
|
+
const response = await fetchWithTimeout(uri, {
|
|
161
162
|
headers: { Accept: "application/json" },
|
|
162
163
|
});
|
|
163
164
|
if (!response.ok) {
|
package/src/types.ts
CHANGED
|
@@ -2,6 +2,7 @@
|
|
|
2
2
|
* The shapes every provider answers with, whatever protocol it speaks.
|
|
3
3
|
*/
|
|
4
4
|
|
|
5
|
+
import { timingSafeEqual } from "node:crypto";
|
|
5
6
|
export interface OAuthConfig {
|
|
6
7
|
clientId: string;
|
|
7
8
|
clientSecret: string;
|
|
@@ -144,7 +145,25 @@ export function assertOAuthState(
|
|
|
144
145
|
"Store the state given to redirectUrl() in the session and pass it here.",
|
|
145
146
|
);
|
|
146
147
|
}
|
|
147
|
-
if (state
|
|
148
|
+
if (state === undefined || !sameSecret(state, expectedState)) {
|
|
148
149
|
throw new Error("OAuth state mismatch — possible CSRF attack");
|
|
149
150
|
}
|
|
150
151
|
}
|
|
152
|
+
|
|
153
|
+
/**
|
|
154
|
+
* Compare two states without leaking where they diverge.
|
|
155
|
+
*
|
|
156
|
+
* `!==` on strings stops at the first differing byte, and the state is the only
|
|
157
|
+
* thing standing between an attacker's authorization code and the victim's
|
|
158
|
+
* session. The leak is small against network noise, but every other secret
|
|
159
|
+
* comparison in the framework is already constant-time and this one is the
|
|
160
|
+
* outlier.
|
|
161
|
+
*
|
|
162
|
+
* The lengths are checked first because `timingSafeEqual` throws when they
|
|
163
|
+
* differ. A state's length is not the secret; its content is.
|
|
164
|
+
*/
|
|
165
|
+
function sameSecret(given: string, expected: string): boolean {
|
|
166
|
+
const left = Buffer.from(given, "utf8");
|
|
167
|
+
const right = Buffer.from(expected, "utf8");
|
|
168
|
+
return left.length === right.length && timingSafeEqual(left, right);
|
|
169
|
+
}
|