@connectid-tools/rp-nodejs-sdk 4.1.0 → 4.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +230 -169
  2. package/config.js +2 -2
  3. package/package.json +9 -6
  4. package/relying-party-client-sdk.js +3 -3
  5. package/utils/cert-utils.d.ts +1 -1
  6. package/utils/user-agent.d.ts +1 -1
  7. package/utils/user-agent.js +2 -4
package/README.md CHANGED
@@ -13,6 +13,7 @@ npm install @connectid-tools/rp-nodejs-sdk
13
13
  ```
14
14
 
15
15
  Update your `package.json` to use `module`:
16
+
16
17
  ```json
17
18
  {
18
19
  .
@@ -25,10 +26,10 @@ Update your `package.json` to use `module`:
25
26
  You can then import and instantiate an instance of the rp-nodejs-sdk using:
26
27
 
27
28
  ```javascript
28
- import { config } from './config.js';
29
- import RelyingPartyClientSdk from './relying-party-client-sdk';
29
+ import { config } from './config.js'
30
+ import RelyingPartyClientSdk from './relying-party-client-sdk'
30
31
 
31
- const rpClient = new RelyingPartyClientSdk(config);
32
+ const rpClient = new RelyingPartyClientSdk(config)
32
33
  ```
33
34
 
34
35
  The above code assumes that you have a config file called `config.js` in your project folder that contains
@@ -36,12 +37,15 @@ the configuration required for the sdk, eg: the location of the certificate file
36
37
  the callback urls, etc. The configuration attributes are described below.
37
38
 
38
39
  ## Using Typescript
40
+
39
41
  To use Node SDK with Typescript you need to make the following changes in your `tsconfig.json`:
40
- * Set `"target: "es2016"` or higher
41
- * Have `"module": "ES2015"` or higher
42
- * Have `"moduleResolution": "Bundler"`
42
+
43
+ - Set `"target: "es2016"` or higher
44
+ - Have `"module": "ES2015"` or higher
45
+ - Have `"moduleResolution": "Bundler"`
43
46
 
44
47
  Sample tsconfig:
48
+
45
49
  ```json
46
50
  {
47
51
  "compilerOptions": {
@@ -49,13 +53,16 @@ Sample tsconfig:
49
53
  "module": "ES2015",
50
54
  "moduleResolution": "Bundler",
51
55
  "strictNullChecks": true,
52
- "outDir": "dist/",
56
+ "outDir": "dist/"
53
57
  },
54
58
  "include": ["**/*.ts"]
55
59
  }
56
60
  ```
61
+
57
62
  ### Setting up SDK config options
63
+
58
64
  `RelyingPartyClientSdkConfig` has some fixed values, specially inside `client` object, to be able to set the config options for the SDK some type gymnastics will be needed as shown below (see `as const`):
65
+
59
66
  ```typescript
60
67
  // index.ts
61
68
  import RelyingPartyClientSdk from '@connectid-tools/rp-nodejs-sdk'
@@ -112,13 +119,13 @@ the configuration properties is available from: <https://github.com/connectid-to
112
119
  The simplest way to pass in the configuration is shown below (assumes the `config.js` file is in the project directory):
113
120
 
114
121
  ```javascript
115
- const config = require('./config');
116
- const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk');
117
- const rpClient = new RelyingPartyClientSdk(config);
122
+ const config = require('./config')
123
+ const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk')
124
+ const rpClient = new RelyingPartyClientSdk(config)
118
125
  ```
119
126
 
120
127
  | Property | Description | Example value |
121
- |---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
128
+ | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
122
129
  | `ca_pem` | The collection of trusted root certificates that can be used for certification validation. May be an absolute or relative path. | `'./conf/ca.pem' ` |
123
130
  | `ca_pem_content` | The collection of trusted root certificates content (string) that can be used for certification validation. Overrides `ca_pem`. | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
124
131
  | `signing_kid` | The id for the signing key in the JWKS. This can be found in the registry via Software Statements -> Client Details -> Certificates | `'Xf1Pf-GXyhryOY5wwg0ddL5yzUicIcQrOIxja0yHhpg'` |
@@ -149,21 +156,21 @@ The expected interactions between the Relying Party and RP Connector as part of
149
156
 
150
157
  The key steps are:
151
158
 
152
- * Retrieve the list of Participants so the user can be prompted to choose their bank
153
- * Send a pushed authorisation request to the selected bank with the requested claims and redirect the user to their bank
154
- * Use the callback querystring to retrieve the access token and identity token with the claims the user has consented to share
159
+ - Retrieve the list of Participants so the user can be prompted to choose their bank
160
+ - Send a pushed authorisation request to the selected bank with the requested claims and redirect the user to their bank
161
+ - Use the callback querystring to retrieve the access token and identity token with the claims the user has consented to share
155
162
 
156
163
  ```mermaid
157
164
  sequenceDiagram
158
165
  Customer->>+Relying Party: Use Digital ID
159
166
  Relying Party->>+rp-nodejs-sdk: getParticipants()
160
167
  rp-nodejs-sdk-->>-Relying Party: Participant metadata
161
- Relying Party-->>-Customer: Display Bank Selector
168
+ Relying Party-->>-Customer: Display Bank Selector
162
169
  Customer->>+Relying Party: Select Bank
163
170
  Relying Party->>+rp-nodejs-sdk: sendPushedAuthorisationRequest()
164
171
  rp-nodejs-sdk-->>-Relying Party: authUrl, codeVerifier, state, nonce
165
172
  Note right of Relying Party: The RP must associate the codeVerifier,<br/>state and nonce with the user<br/>to use when retrieving claims
166
- Relying Party-->>-Customer: redirect to Bank using authUrl
173
+ Relying Party-->>-Customer: redirect to Bank using authUrl
167
174
  Customer->>+Bank: redirect to AuthUrl
168
175
  Bank->>Bank: Authenticate & Capture Consent
169
176
  Bank-->>-Customer: Redirect customer to RP callback URI
@@ -188,126 +195,126 @@ You may also set the `required_claims` and `required_participant_certifications`
188
195
  based on the needs of your use case (eg: if you require IDPs to be TDIF certified).
189
196
 
190
197
  ```javascript
191
- const idps = await rpClient.getParticipants();
198
+ const idps = await rpClient.getParticipants()
192
199
  ```
193
200
 
194
201
  The response will contain an array of Organisations and their Authorisation Server, with an object structure similar to below.
195
202
 
196
203
  They key fields of interest are:
197
204
 
198
- * `CustomerFriendlyName` - this is the name of the Bank to display to the customer
199
- * `CustomerFriendlyLogoUri` - this is a logo for the Bank that can be displayed alongside the bank name
200
- * `AuthorisationServerId` - this uniquely identifies the authorisation server. It will be needed as part of the next call
201
- in the flow to identify the Authorisation Server to send the PAR to.
205
+ - `CustomerFriendlyName` - this is the name of the Bank to display to the customer
206
+ - `CustomerFriendlyLogoUri` - this is a logo for the Bank that can be displayed alongside the bank name
207
+ - `AuthorisationServerId` - this uniquely identifies the authorisation server. It will be needed as part of the next call
208
+ in the flow to identify the Authorisation Server to send the PAR to.
202
209
 
203
210
  Note that in the response there may be:
204
211
 
205
- * multiple organisations - each Bank will be its own organisation
206
- * multiple authorisation servers per bank - a Bank may have different authorisation servers for its different brands (or potentially
207
- to differentiate Business Banking from Retail Banking)
212
+ - multiple organisations - each Bank will be its own organisation
213
+ - multiple authorisation servers per bank - a Bank may have different authorisation servers for its different brands (or potentially
214
+ to differentiate Business Banking from Retail Banking)
208
215
 
209
216
  ```json
210
- [
217
+ [
218
+ {
219
+ "Status": "Active",
220
+ "OrgDomainRoleClaims": [],
221
+ "AuthorisationServers": [
211
222
  {
212
- "Status": "Active",
213
- "OrgDomainRoleClaims": [],
214
- "AuthorisationServers": [
215
- {
216
- "PayloadSigningCertLocationUri": "https://auth.bank4.directory.sandbox.connectid.com.au/na",
217
- "ParentAuthorisationServerId": null,
218
- "OpenIDDiscoveryDocument": "https://auth.bank4.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
219
- "CustomerFriendlyName": "Bank W",
220
- "CustomerFriendlyDescription": "Bank4",
221
- "TermsOfServiceUri": null,
222
- "ApiResources": [],
223
- "AutoRegistrationSupported": true,
224
- "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankW.svg",
225
- "SupportsDCR": false,
226
- "AuthorisationServerCertifications": [],
227
- "SupportsCiba": false,
228
- "DeveloperPortalUri": null,
229
- "NotificationWebhookAddedDate": null,
230
- "AuthorisationServerId": "cde44c30-9138-4b58-ba50-221833d14319"
231
- },
232
- {
233
- "PayloadSigningCertLocationUri": "https://auth.bank3.directory.sandbox.connectid.com.au/na",
234
- "ParentAuthorisationServerId": null,
235
- "OpenIDDiscoveryDocument": "https://auth.bank3.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
236
- "CustomerFriendlyName": "Bank N",
237
- "CustomerFriendlyDescription": "Bank3",
238
- "TermsOfServiceUri": null,
239
- "ApiResources": [],
240
- "AutoRegistrationSupported": true,
241
- "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankN.svg",
242
- "SupportsDCR": false,
243
- "AuthorisationServerCertifications": [],
244
- "SupportsCiba": false,
245
- "DeveloperPortalUri": null,
246
- "NotificationWebhookAddedDate": null,
247
- "AuthorisationServerId": "22c2d67e-4d95-414a-b51a-ca863e9d691d"
248
- }
249
- ],
250
- "OrgDomainClaims": [],
251
- "Size": null,
252
- "RegistrationId": null,
253
- "OrganisationId": "ed63c5b4-4dcb-4867-bd8b-e2b04a0ab04b",
254
- "City": "Banksville",
255
- "Postcode": "4103",
256
- "AddressLine2": "Bank Town",
257
- "RegisteredName": "RefBank",
258
- "AddressLine1": "1 Reference Bank Street",
259
- "LegalEntityName": "Reference Bank",
260
- "OrganisationName": "Reference Banks",
261
- "Country": "AU",
262
- "RegistrationNumber": "ABN 123 456 7890",
263
- "CreatedOn": "2021-12-14T23:09:03.581Z",
264
- "Tag": null,
265
- "ParentOrganisationReference": "",
266
- "CompanyRegister": "ABN",
267
- "CountryOfRegistration": "AU"
223
+ "PayloadSigningCertLocationUri": "https://auth.bank4.directory.sandbox.connectid.com.au/na",
224
+ "ParentAuthorisationServerId": null,
225
+ "OpenIDDiscoveryDocument": "https://auth.bank4.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
226
+ "CustomerFriendlyName": "Bank W",
227
+ "CustomerFriendlyDescription": "Bank4",
228
+ "TermsOfServiceUri": null,
229
+ "ApiResources": [],
230
+ "AutoRegistrationSupported": true,
231
+ "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankW.svg",
232
+ "SupportsDCR": false,
233
+ "AuthorisationServerCertifications": [],
234
+ "SupportsCiba": false,
235
+ "DeveloperPortalUri": null,
236
+ "NotificationWebhookAddedDate": null,
237
+ "AuthorisationServerId": "cde44c30-9138-4b58-ba50-221833d14319"
268
238
  },
269
239
  {
270
- "Status": "Active",
271
- "OrgDomainRoleClaims": [],
272
- "AuthorisationServers": [
273
- {
274
- "PayloadSigningCertLocationUri": "https://mtls.partner.idp.test.commbank.com.au/pf/JWKS",
275
- "ParentAuthorisationServerId": null,
276
- "OpenIDDiscoveryDocument": "https://mtls.partner.idp.test.commbank.com.au/.well-known/openid-configuration",
277
- "CustomerFriendlyName": "Commonwealth Bank",
278
- "CustomerFriendlyDescription": "Test IDP for CBA",
279
- "TermsOfServiceUri": null,
280
- "ApiResources": [],
281
- "AutoRegistrationSupported": true,
282
- "CustomerFriendlyLogoUri": "https://www.commbank.com.au/test.svg",
283
- "SupportsDCR": false,
284
- "AuthorisationServerCertifications": [],
285
- "SupportsCiba": false,
286
- "DeveloperPortalUri": null,
287
- "NotificationWebhookAddedDate": null,
288
- "AuthorisationServerId": "355df9aa-bf8f-4cec-aa4d-78b10356762e"
289
- }
290
- ],
291
- "OrgDomainClaims": [],
292
- "Size": null,
293
- "RegistrationId": "",
294
- "OrganisationId": "adf2af89-2782-4058-86d9-ff3a9068e4a5",
295
- "City": "Sydney",
296
- "Postcode": "2000",
297
- "AddressLine2": "201 Sussex Street",
298
- "RegisteredName": "Commonwealth Bank of Australia",
299
- "AddressLine1": "Ground Floor Tower 1",
300
- "LegalEntityName": "Commonwealth Bank of Australia",
301
- "OrganisationName": "Commonwealth Bank of Australia",
302
- "Country": "AU",
303
- "RegistrationNumber": "ABN 48 123 123 124",
304
- "CreatedOn": "2022-03-14T00:42:29.202Z",
305
- "Tag": null,
306
- "ParentOrganisationReference": "",
307
- "CompanyRegister": "ABN",
308
- "CountryOfRegistration": "AU"
240
+ "PayloadSigningCertLocationUri": "https://auth.bank3.directory.sandbox.connectid.com.au/na",
241
+ "ParentAuthorisationServerId": null,
242
+ "OpenIDDiscoveryDocument": "https://auth.bank3.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
243
+ "CustomerFriendlyName": "Bank N",
244
+ "CustomerFriendlyDescription": "Bank3",
245
+ "TermsOfServiceUri": null,
246
+ "ApiResources": [],
247
+ "AutoRegistrationSupported": true,
248
+ "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankN.svg",
249
+ "SupportsDCR": false,
250
+ "AuthorisationServerCertifications": [],
251
+ "SupportsCiba": false,
252
+ "DeveloperPortalUri": null,
253
+ "NotificationWebhookAddedDate": null,
254
+ "AuthorisationServerId": "22c2d67e-4d95-414a-b51a-ca863e9d691d"
309
255
  }
310
- ]
256
+ ],
257
+ "OrgDomainClaims": [],
258
+ "Size": null,
259
+ "RegistrationId": null,
260
+ "OrganisationId": "ed63c5b4-4dcb-4867-bd8b-e2b04a0ab04b",
261
+ "City": "Banksville",
262
+ "Postcode": "4103",
263
+ "AddressLine2": "Bank Town",
264
+ "RegisteredName": "RefBank",
265
+ "AddressLine1": "1 Reference Bank Street",
266
+ "LegalEntityName": "Reference Bank",
267
+ "OrganisationName": "Reference Banks",
268
+ "Country": "AU",
269
+ "RegistrationNumber": "ABN 123 456 7890",
270
+ "CreatedOn": "2021-12-14T23:09:03.581Z",
271
+ "Tag": null,
272
+ "ParentOrganisationReference": "",
273
+ "CompanyRegister": "ABN",
274
+ "CountryOfRegistration": "AU"
275
+ },
276
+ {
277
+ "Status": "Active",
278
+ "OrgDomainRoleClaims": [],
279
+ "AuthorisationServers": [
280
+ {
281
+ "PayloadSigningCertLocationUri": "https://mtls.partner.idp.test.commbank.com.au/pf/JWKS",
282
+ "ParentAuthorisationServerId": null,
283
+ "OpenIDDiscoveryDocument": "https://mtls.partner.idp.test.commbank.com.au/.well-known/openid-configuration",
284
+ "CustomerFriendlyName": "Commonwealth Bank",
285
+ "CustomerFriendlyDescription": "Test IDP for CBA",
286
+ "TermsOfServiceUri": null,
287
+ "ApiResources": [],
288
+ "AutoRegistrationSupported": true,
289
+ "CustomerFriendlyLogoUri": "https://www.commbank.com.au/test.svg",
290
+ "SupportsDCR": false,
291
+ "AuthorisationServerCertifications": [],
292
+ "SupportsCiba": false,
293
+ "DeveloperPortalUri": null,
294
+ "NotificationWebhookAddedDate": null,
295
+ "AuthorisationServerId": "355df9aa-bf8f-4cec-aa4d-78b10356762e"
296
+ }
297
+ ],
298
+ "OrgDomainClaims": [],
299
+ "Size": null,
300
+ "RegistrationId": "",
301
+ "OrganisationId": "adf2af89-2782-4058-86d9-ff3a9068e4a5",
302
+ "City": "Sydney",
303
+ "Postcode": "2000",
304
+ "AddressLine2": "201 Sussex Street",
305
+ "RegisteredName": "Commonwealth Bank of Australia",
306
+ "AddressLine1": "Ground Floor Tower 1",
307
+ "LegalEntityName": "Commonwealth Bank of Australia",
308
+ "OrganisationName": "Commonwealth Bank of Australia",
309
+ "Country": "AU",
310
+ "RegistrationNumber": "ABN 48 123 123 124",
311
+ "CreatedOn": "2022-03-14T00:42:29.202Z",
312
+ "Tag": null,
313
+ "ParentOrganisationReference": "",
314
+ "CompanyRegister": "ABN",
315
+ "CountryOfRegistration": "AU"
316
+ }
317
+ ]
311
318
  ```
312
319
 
313
320
  ## getFallbackProviderParticipants()
@@ -323,13 +330,12 @@ Note that there is only expected to be a single Fallback Provider for the scheme
323
330
  auth server should be returned here).
324
331
 
325
332
  ```javascript
326
- const fallbackProviders = await rpClient.getFallbackProviderParticipants();
333
+ const fallbackProviders = await rpClient.getFallbackProviderParticipants()
327
334
  ```
328
335
 
329
336
  The response will contain an array of Organisations and their Authorisation Servers, with the structure the same
330
337
  as that for `getParticipants()`.
331
338
 
332
-
333
339
  ## sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = '{default value from config}')
334
340
 
335
341
  This sends a Pushed Authorisation Request to the specified Identity Server requesting the list of supplied claims. The response
@@ -338,24 +344,24 @@ process.
338
344
 
339
345
  The required function parameters are:
340
346
 
341
- * `authorisationServerId` - identifies the authorisation server to send the PAR to
342
- * `essentialClaims` - a list of the identity essential claim names that being requested for the user.
343
- Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
344
- When the IDP is obtaining user consent, the only method for a user to opt out of consenting to an `essential` claim is to cancel the entire transaction.
345
- * `voluntaryClaims` - a list of the identity voluntary claim names that are being requested for the user.
346
- Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
347
- When the IDP is obtaining user consent, they may allow the user to opt out of consenting to providing each of the `voluntary` claims, while still consenting to all `essential` claims.
348
- If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
349
- * `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
347
+ - `authorisationServerId` - identifies the authorisation server to send the PAR to
348
+ - `essentialClaims` - a list of the identity essential claim names that being requested for the user.
349
+ Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
350
+ When the IDP is obtaining user consent, the only method for a user to opt out of consenting to an `essential` claim is to cancel the entire transaction.
351
+ - `voluntaryClaims` - a list of the identity voluntary claim names that are being requested for the user.
352
+ Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
353
+ When the IDP is obtaining user consent, they may allow the user to opt out of consenting to providing each of the `voluntary` claims, while still consenting to all `essential` claims.
354
+ If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
355
+ - `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
350
356
 
351
357
  The method will return: `{ authUrl, code_verifier, state, nonce, xFapiInteractionId }`. The fields are:
352
358
 
353
- * `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
354
- * `codeVerifier`
355
- * `state`
356
- * `nonce`
357
- * `xFapiInteractionId` - a unique identifier for this interaction with the Authorisation Server, that was sent in the `x-fapi-interaction-id` request
358
- header to the server. Intended as a correlation id for diagnosing issues between the client and the authorisation server.
359
+ - `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
360
+ - `codeVerifier`
361
+ - `state`
362
+ - `nonce`
363
+ - `xFapiInteractionId` - a unique identifier for this interaction with the Authorisation Server, that was sent in the `x-fapi-interaction-id` request
364
+ header to the server. Intended as a correlation id for diagnosing issues between the client and the authorisation server.
359
365
 
360
366
  The `codeVerifier`, `state` and `nonce` are all associated with this specific PAR and are required when retrieving the
361
367
  token claims when the user has authorised the request. You must securely associate these with your user request
@@ -365,19 +371,19 @@ so that you can use them on the subsequent call.
365
371
 
366
372
  ```typescript
367
373
  interface CallbackParamsType {
368
- access_token?: string;
369
- code?: string;
370
- error?: string;
371
- error_description?: string;
372
- error_uri?: string;
373
- expires_in?: string;
374
- id_token?: string;
375
- state?: string;
376
- token_type?: string;
377
- session_state?: string;
378
- response?: string;
379
-
380
- [key: string]: unknown;
374
+ access_token?: string
375
+ code?: string
376
+ error?: string
377
+ error_description?: string
378
+ error_uri?: string
379
+ expires_in?: string
380
+ id_token?: string
381
+ state?: string
382
+ token_type?: string
383
+ session_state?: string
384
+ response?: string
385
+
386
+ [key: string]: unknown
381
387
  }
382
388
  ```
383
389
 
@@ -387,11 +393,11 @@ identity token with the claims. The tokens are then returned to the API caller.
387
393
 
388
394
  The required function parameters are:
389
395
 
390
- * `authorisationServerId` - identifies the authorisation server providing the user information
391
- * `requestParams` - the full querystring from the callback to the Relying Party callback address
392
- * `codeVerifier` - from the response to the PAR for this identity request
393
- * `state` - from the response to the PAR for this identity request
394
- * `nonce` - from the response to the PAR for this identity request
396
+ - `authorisationServerId` - identifies the authorisation server providing the user information
397
+ - `requestParams` - the full querystring from the callback to the Relying Party callback address
398
+ - `codeVerifier` - from the response to the PAR for this identity request
399
+ - `state` - from the response to the PAR for this identity request
400
+ - `nonce` - from the response to the PAR for this identity request
395
401
 
396
402
  The method will return a `ConsolidatedTokenSet` which extends [Tokenset](https://github.com/panva/node-openid-client/blob/main/docs/README.md#class-tokenset)
397
403
  that contains the access_token and id_token. The user identity claims can be retrieved using the utility method `claims()`
@@ -408,33 +414,49 @@ All user identity claims will be provided as part of the `id_token` returned by
408
414
 
409
415
  The required function parameters are:
410
416
 
411
- * `authorisationServerId` - identifies the authorisation server providing the user information
412
- * `accessToken` - the access token provided by `retrieveTokens`
417
+ - `authorisationServerId` - identifies the authorisation server providing the user information
418
+ - `accessToken` - the access token provided by `retrieveTokens`
413
419
 
414
420
  # Release Notes
415
421
 
416
- ### 4.1.0 (Feb 25, 2024)
422
+ ### 4.2.1 (Nov 27, 2025)
423
+
424
+ - Updated dependencies.
425
+
426
+ ### 4.2.0 (Aug 8, 2025)
427
+
428
+ - `cba_loyalty` claim.
429
+
430
+ ### 4.1.0 (Feb 25, 2025)
431
+
417
432
  - Implemented user-agent support.
418
433
 
419
- ### 4.0.5 (Feb 24, 2024)
434
+ ### 4.0.5 (Feb 24, 2025)
435
+
420
436
  - Add README.md and license files to bundle.
421
437
 
422
- ### 4.0.4 (Feb 21, 2024)
438
+ ### 4.0.4 (Feb 21, 2025)
439
+
423
440
  - Remove `declarationMap`.
424
441
 
425
442
  ### 4.0.3 (Nov 29, 2024)
443
+
426
444
  - Issuer value for aud in private_key_jwt.
427
445
 
428
446
  ### 4.0.2 (Oct 22, 2024)
447
+
429
448
  - Single string audience in the private key jwt.
430
449
 
431
450
  ### 4.0.1 (Oct 1, 2024)
451
+
432
452
  - Changed type of `ApiResources` from `str` to `ApiResource`.
433
453
 
434
454
  ### 4.0.0 (Sep 2, 2024)
455
+
435
456
  - Breaking change: removed essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` then you need to provide the claims explicitly. Otherwise, no need to change anything.
436
457
 
437
458
  How it was:
459
+
438
460
  ```typescript
439
461
  const defaultClaimList: string[] = ['given_name', 'middle_name', 'family_name', 'phone_number', 'email', 'address', 'birthdate', 'txn']
440
462
 
@@ -442,37 +464,47 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
442
464
  ```
443
465
 
444
466
  How it is now:
467
+
445
468
  ```typescript
446
469
  async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = this.purpose) {
447
470
  ```
448
471
 
449
472
  ### 4.0.0 (Sep 23, 2024)
473
+
450
474
  - Updated Node version to 20.x.
451
- - Removed jest and axios dependencies.
475
+ - Removed jest and axios dependencies.
452
476
 
453
477
  ### 3.0.0 (Aug 27, 2024)
478
+
454
479
  - Breaking change: removed `name` from essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` and use `name` claim then you need to provide `name` claim explicitly. Otherwise, no need to change anything.
455
480
 
456
481
  ### 2.15.0 (Jun 20, 2024)
482
+
457
483
  - Updated purpose statement.
458
484
  - Dependencies updated.
459
485
 
460
486
  ### 2.14.1 (Jun 17, 2024)
487
+
461
488
  - Removed `got` dependency and used `fetch` instead.
462
489
 
463
490
  ### 2.14.0 (Jun 12, 2024)
464
- - Added cache to `getParticipants()` method.
491
+
492
+ - Added cache to `getParticipants()` method.
465
493
 
466
494
  ### 2.13.0 (April 17, 2024)
495
+
467
496
  - Updated dependencies
468
497
 
469
498
  ### 2.12.3 (Nov 8, 2023)
499
+
470
500
  - `nonce` should have 43 chars.
471
501
 
472
502
  ### 2.12.2 (Nov 8, 2023)
503
+
473
504
  - Updated README.md to include `tsconfig` suggestion.
474
505
 
475
506
  ### 2.12.1 (Nov 7, 2023)
507
+
476
508
  - Made `ca_pem` optional. Although either `ca_pem` or `ca_pem_content` must be provided.
477
509
  - Made `signing_key` optional. Although either `signing_key` or `signing_key_content` must be provided.
478
510
  - Made `signing_pem` optional. Although either `signing_pem` or `signing_pem_content` must be provided.
@@ -480,97 +512,126 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
480
512
  - Made `transport_pem` optional. Although either `transport_pem` or `transport_pem_content` must be provided.
481
513
 
482
514
  ### 2.12.0 (October 19, 2023)
515
+
483
516
  - Added support to Node 18.
484
517
 
485
518
  ### 2.11.2 (August 22, 2023)
519
+
486
520
  - Conformance test succeed on warnings.
487
521
 
488
522
  ### 2.11.1 (August 3, 2023)
523
+
489
524
  - Added automated Conformance test.
490
525
 
491
526
  ### 2.11.0 (August 1, 2023)
527
+
492
528
  - Updated trust_framework in the PAR to contain an object `{ value: 'au_connectid' }` instead of having a string value. This
493
- is to bring it inline with OIDC4A spec that requires trust_framework to contain an object.
529
+ is to bring it inline with OIDC4A spec that requires trust_framework to contain an object.
494
530
 
495
531
  ### 2.10.0 (July 31, 2023)
532
+
496
533
  - Updated documentation to include `registry_participants_uri` parameter.
497
534
  - Updated two testcases.
498
535
 
499
536
  ### 2.9.0 (July 17, 2023)
537
+
500
538
  - Updated `getParticipants()` so it only returns participants that are active in the network by default. Can be
501
- overridden using config to return all if required. Also allow filtering of Auth Servers by capabilities.
539
+ overridden using config to return all if required. Also allow filtering of Auth Servers by capabilities.
502
540
  - Added `getFallbackProviderParticipants()` to return the manual verification authorisation server.
503
541
  - Note that `sendPushedAuthorisationRequest()` will require the auth server id to be valid for the current filter config (eg: Active auth servers).
504
542
 
505
543
  ### 2.8.0 (June 7, 2023)
544
+
506
545
  - Ensured that the `txn` claim is always requested so clients always have a reference for the transaction.
507
546
 
508
547
  ### 2.7.2 (June 6, 2023)
548
+
509
549
  - Removed `redirect_url` and `response_type` authorization request parameters from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
510
550
 
511
551
  ### 2.7.1 (June 5, 2023)
552
+
512
553
  - Removed `scope` authorization request parameter from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
513
554
 
514
555
  ### 2.7.0 (May 31, 2023)
556
+
515
557
  - Enhanced logging so x-fapi-interaction-id logged for PAR and token requests.
516
558
 
517
559
  ### 2.6.1 (May 29, 2023)
560
+
518
561
  - Fixed invalid main file definition.
519
562
 
520
563
  ### 2.6.0 (May 29, 2023)
564
+
521
565
  - Added support for `purpose` as request object parameter on PAR requests. Can be supplied per request or use the default supplied via config.
522
566
 
523
567
  ### 2.5.0 (May 24, 2023)
568
+
524
569
  - Added support for `x-fapi-interaction-id` headers on PAR, token and userinfo requests.
525
570
 
526
571
  ### 2.4.1 (May 5, 2023)
572
+
527
573
  - Updated clientId details for testing and documentation to use a federated clientId.
528
574
 
529
575
  ### 2.4.0 (March 28, 2023)
576
+
530
577
  - Reimplemented extended claims, which now supports the following claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account_au`, `beneficiary_account_au_payid`, `beneficiary_account_international`.
531
578
  - Implemented strict mode for TypeScript to prevent the use of `any` type and other unsafe types.
532
579
  - Fix for `ClaimsRequest` type to support non-verified claims in the type definition.
533
580
 
534
581
  ### 2.3.0 (March 10, 2023)
582
+
535
583
  - Added support for the following extended claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account`, `pay_id`.
536
584
 
537
585
  ### 2.2.0 (Feb 20, 2023)
586
+
538
587
  - Maintenance update of dependencies to address CVE-2022-36083 in JOSE library.
539
588
 
540
589
  ### 2.1.0 (Feb 13, 2023)
590
+
541
591
  - Moved `prompt=consent` parameter to pushed authorisation request object instead of a URL parameter.
542
592
 
543
593
  ### 2.0.7 (Dec 22, 2022)
594
+
544
595
  - Run on Node 14 and 16 (openid-client lib does not support Node 18 yet).
545
-
596
+
546
597
  ### 2.0.6 (Dec 21, 2022)
598
+
547
599
  - Removed the need to use `--experimental-specifier-resolution=node` flag when importing the SDK.
548
600
  - Log SDK version.
549
-
601
+
550
602
  ### 2.0.5 (Dec 20, 2022)
603
+
551
604
  - Updated documentation.
552
605
 
553
606
  ### 2.0.4 (Dec 20, 2022)
607
+
554
608
  - Fixed `RelyingPartyClientSdk is not a constructor`.
555
609
 
556
610
  ### 2.0.3 (Dec 20, 2022)
611
+
557
612
  - Made `ca_pem_content, signing_key_content, signing_pem_content, transport_key_content, transport_pem_content` from `RelyingPartyClientSdkConfig` optional.
558
613
 
559
614
  ### 2.0.2 (Dec 20, 2022)
615
+
560
616
  - Removed version logging when SDK is created.
561
617
 
562
618
  ### 2.0.1 (Dec 20, 2022)
619
+
563
620
  - Fixed npm publish.
564
621
 
565
622
  ### 2.0.0 (Dec 19, 2022)
566
- - Typescript support.
623
+
624
+ - Typescript support.
567
625
  - Breaking change: SDK imported using `require` will need to add a `default` at the end of the import.
626
+
568
627
  ```javascript
569
628
  const RelyingPartyClientSdk = require('@idmvp/rp-nodejs-sdk').default
570
629
  ```
571
-
630
+
572
631
  ### 1.2.3 (Oct 24, 2022)
632
+
573
633
  - Code formatting. See `.prettierrc.json`.
574
634
 
575
635
  ### 1.2.2
636
+
576
637
  \<starting point\>
package/config.js CHANGED
@@ -1,7 +1,7 @@
1
1
  export const config = {
2
2
  data: {
3
3
  // Set the signing Key Id based on what is contained in the JWKS
4
- signing_kid: 'roHtgBlRFapqTHbc8EzXIIgO_bu5YHlEjx75vIcaxfE',
4
+ signing_kid: 'lHf9shwoF1wEES2sB9TBafbs0AVrLiU-1_ntzCrBo8A',
5
5
  // The location of the signing certificate and key that are used for signing purposes
6
6
  signing_key: './certs/signing.key',
7
7
  signing_pem: './certs/signing.pem', // TODO not being used atm
@@ -9,7 +9,7 @@ export const config = {
9
9
  transport_key: './certs/transport.key',
10
10
  transport_pem: './certs/transport.pem',
11
11
  // The location of the root certificate for the trust authority
12
- ca_pem: './certs/connectid-sandbox-ca.pem',
12
+ ca_pem: './certs/ca.pem',
13
13
  // This is the URL that this application is actually running on and using for callbacks (noting that multiple may be registered for the client)
14
14
  application_redirect_uri: 'https://tpp.localhost/cb',
15
15
  // The registry API endpoint that will list all participants with their auth server details
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@connectid-tools/rp-nodejs-sdk",
3
- "version": "4.1.0",
3
+ "version": "4.2.1",
4
4
  "description": "Digital Identity Relying Party Node SDK",
5
5
  "main": "relying-party-client-sdk.js",
6
6
  "types": "relying-party-client-sdk.d.ts",
@@ -36,13 +36,16 @@
36
36
  "winston": "^3.17.0"
37
37
  },
38
38
  "devDependencies": {
39
- "@types/node": "^20.17.19",
39
+ "@types/node": "^20.19.9",
40
40
  "@types/openid-client": "^3.7.0",
41
41
  "add-js-extension": "^1.0.4",
42
- "eslint": "^9.21.0",
43
- "prettier": "^3.5.2",
42
+ "eslint": "^9.32.0",
43
+ "prettier": "^3.6.2",
44
44
  "replace-in-files-cli": "^2.2.0",
45
- "tsx": "^4.19.3",
46
- "typescript": "^5.7.3"
45
+ "tsx": "^4.20.3",
46
+ "typescript": "^5.9.2"
47
+ },
48
+ "overrides": {
49
+ "node-forge": "^1.3.2"
47
50
  }
48
51
  }
package/relying-party-client-sdk.js CHANGED
@@ -17,7 +17,7 @@ import { illegalPurposeChars, isValidCertificate, validatePurpose } from './vali
17
17
  import { generatePushAuthorisationRequestParams } from './utils/request-utils.js';
18
18
  import { buildUserAgent } from './utils/user-agent.js';
19
19
  // The extended list of claims which can be requested for a user
20
- const extendedClaimList = ['over16', 'over18', 'over21', 'over25', 'over65', 'beneficiary_account_au', 'beneficiary_account_au_payid', 'beneficiary_account_international'];
20
+ const extendedClaimList = ['over16', 'over18', 'over21', 'over25', 'over65', 'beneficiary_account_au', 'beneficiary_account_au_payid', 'beneficiary_account_international', 'cba_loyalty'];
21
21
  export default class RelyingPartyClientSdk {
22
22
  constructor(config) {
23
23
  this.purpose = 'verifying your identity';
@@ -43,7 +43,7 @@ export default class RelyingPartyClientSdk {
43
43
  this.signingKey = getCertificate(this.config.data.signing_key, this.config.data.signing_key_content);
44
44
  this.caPem = getCertificate(this.config.data.ca_pem, this.config.data.ca_pem_content);
45
45
  this.logger = getLogger(this.config.data.log_level);
46
- this.logger.info(`Creating RelyingPartyClientSdk - version 4.1.0`);
46
+ this.logger.info(`Creating RelyingPartyClientSdk - version 4.2.1`);
47
47
  if (this.config.data.purpose) {
48
48
  const purposeValidation = validatePurpose(this.config.data.purpose);
49
49
  if (purposeValidation === 'INVALID_LENGTH') {
@@ -75,7 +75,7 @@ export default class RelyingPartyClientSdk {
75
75
  globalAgent.options.key = this.transportKey;
76
76
  globalAgent.options.ca = [this.caPem, ...rootCertificates];
77
77
  custom.setHttpOptionsDefaults({ timeout: 10000 });
78
- // 4.1.0 is replaced with `postbuild` script in package.json (see replace-in-files)
78
+ // 4.2.1 is replaced with `postbuild` script in package.json (see replace-in-files)
79
79
  this.logger.info(`Using ${this.config.data.transport_key_content ? 'transport_key_content' : 'transport_key'} config prop`);
80
80
  this.logger.info(`Using ${this.config.data.transport_pem_content ? 'transport_pem_content' : 'transport_pem'} config prop`);
81
81
  this.logger.info(`Using ${this.config.data.ca_pem_content ? 'ca_pem_content' : 'ca_pem'} config prop`);
package/utils/cert-utils.d.ts CHANGED
@@ -1 +1 @@
1
- export declare const getCertificate: (certificatePath?: string, certificateContent?: string) => string | Buffer<ArrayBufferLike>;
1
+ export declare const getCertificate: (certificatePath?: string, certificateContent?: string) => string | NonSharedBuffer;
package/utils/user-agent.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- export declare const packageJsonVersion = "4.1.0";
1
+ export declare const packageJsonVersion = "4.2.1";
2
2
  export declare const buildUserAgent: (clientId: string) => string;
package/utils/user-agent.js CHANGED
@@ -1,6 +1,4 @@
1
1
  import { getSystemInformation } from './system-information.js';
2
2
  // important: Update this every time the package version changes
3
- export const packageJsonVersion = '4.1.0';
4
- export const buildUserAgent = (clientId) => {
5
- return `cid-rp-nodejs-sdk/${packageJsonVersion} ${getSystemInformation()} +${clientId}`;
6
- };
3
+ export const packageJsonVersion = '4.2.1';
4
+ export const buildUserAgent = (clientId) => `cid-rp-nodejs-sdk/${packageJsonVersion} ${getSystemInformation()} +${clientId}`;