@connectid-tools/rp-nodejs-sdk 4.2.0 → 4.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +224 -166
  2. package/package.json +4 -1
  3. package/relying-party-client-sdk.js +2 -2
  4. package/utils/user-agent.d.ts +1 -1
  5. package/utils/user-agent.js +2 -4
package/README.md CHANGED
@@ -13,6 +13,7 @@ npm install @connectid-tools/rp-nodejs-sdk
13
13
  ```
14
14
 
15
15
  Update your `package.json` to use `module`:
16
+
16
17
  ```json
17
18
  {
18
19
  .
@@ -25,10 +26,10 @@ Update your `package.json` to use `module`:
25
26
  You can then import and instantiate an instance of the rp-nodejs-sdk using:
26
27
 
27
28
  ```javascript
28
- import { config } from './config.js';
29
- import RelyingPartyClientSdk from './relying-party-client-sdk';
29
+ import { config } from './config.js'
30
+ import RelyingPartyClientSdk from './relying-party-client-sdk'
30
31
 
31
- const rpClient = new RelyingPartyClientSdk(config);
32
+ const rpClient = new RelyingPartyClientSdk(config)
32
33
  ```
33
34
 
34
35
  The above code assumes that you have a config file called `config.js` in your project folder that contains
@@ -36,12 +37,15 @@ the configuration required for the sdk, eg: the location of the certificate file
36
37
  the callback urls, etc. The configuration attributes are described below.
37
38
 
38
39
  ## Using Typescript
40
+
39
41
  To use Node SDK with Typescript you need to make the following changes in your `tsconfig.json`:
40
- * Set `"target: "es2016"` or higher
41
- * Have `"module": "ES2015"` or higher
42
- * Have `"moduleResolution": "Bundler"`
42
+
43
+ - Set `"target: "es2016"` or higher
44
+ - Have `"module": "ES2015"` or higher
45
+ - Have `"moduleResolution": "Bundler"`
43
46
 
44
47
  Sample tsconfig:
48
+
45
49
  ```json
46
50
  {
47
51
  "compilerOptions": {
@@ -49,13 +53,16 @@ Sample tsconfig:
49
53
  "module": "ES2015",
50
54
  "moduleResolution": "Bundler",
51
55
  "strictNullChecks": true,
52
- "outDir": "dist/",
56
+ "outDir": "dist/"
53
57
  },
54
58
  "include": ["**/*.ts"]
55
59
  }
56
60
  ```
61
+
57
62
  ### Setting up SDK config options
63
+
58
64
  `RelyingPartyClientSdkConfig` has some fixed values, specially inside `client` object, to be able to set the config options for the SDK some type gymnastics will be needed as shown below (see `as const`):
65
+
59
66
  ```typescript
60
67
  // index.ts
61
68
  import RelyingPartyClientSdk from '@connectid-tools/rp-nodejs-sdk'
@@ -112,13 +119,13 @@ the configuration properties is available from: <https://github.com/connectid-to
112
119
  The simplest way to pass in the configuration is shown below (assumes the `config.js` file is in the project directory):
113
120
 
114
121
  ```javascript
115
- const config = require('./config');
116
- const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk');
117
- const rpClient = new RelyingPartyClientSdk(config);
122
+ const config = require('./config')
123
+ const RelyingPartyClientSdk = require('@connectid-tools/rp-nodejs-sdk')
124
+ const rpClient = new RelyingPartyClientSdk(config)
118
125
  ```
119
126
 
120
127
  | Property | Description | Example value |
121
- |---------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|
128
+ | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
122
129
  | `ca_pem` | The collection of trusted root certificates that can be used for certification validation. May be an absolute or relative path. | `'./conf/ca.pem' ` |
123
130
  | `ca_pem_content` | The collection of trusted root certificates content (string) that can be used for certification validation. Overrides `ca_pem`. | `'-----BEGIN CERTIFICATE----- MIIFnTCCBIWgAwIBAgIUKl2OAbHVc1r9isRs6WIExS/1BLgwDQYJKoZIhvcNAQEL...'` |
124
131
  | `signing_kid` | The id for the signing key in the JWKS. This can be found in the registry via Software Statements -> Client Details -> Certificates | `'Xf1Pf-GXyhryOY5wwg0ddL5yzUicIcQrOIxja0yHhpg'` |
@@ -149,21 +156,21 @@ The expected interactions between the Relying Party and RP Connector as part of
149
156
 
150
157
  The key steps are:
151
158
 
152
- * Retrieve the list of Participants so the user can be prompted to choose their bank
153
- * Send a pushed authorisation request to the selected bank with the requested claims and redirect the user to their bank
154
- * Use the callback querystring to retrieve the access token and identity token with the claims the user has consented to share
159
+ - Retrieve the list of Participants so the user can be prompted to choose their bank
160
+ - Send a pushed authorisation request to the selected bank with the requested claims and redirect the user to their bank
161
+ - Use the callback querystring to retrieve the access token and identity token with the claims the user has consented to share
155
162
 
156
163
  ```mermaid
157
164
  sequenceDiagram
158
165
  Customer->>+Relying Party: Use Digital ID
159
166
  Relying Party->>+rp-nodejs-sdk: getParticipants()
160
167
  rp-nodejs-sdk-->>-Relying Party: Participant metadata
161
- Relying Party-->>-Customer: Display Bank Selector
168
+ Relying Party-->>-Customer: Display Bank Selector
162
169
  Customer->>+Relying Party: Select Bank
163
170
  Relying Party->>+rp-nodejs-sdk: sendPushedAuthorisationRequest()
164
171
  rp-nodejs-sdk-->>-Relying Party: authUrl, codeVerifier, state, nonce
165
172
  Note right of Relying Party: The RP must associate the codeVerifier,<br/>state and nonce with the user<br/>to use when retrieving claims
166
- Relying Party-->>-Customer: redirect to Bank using authUrl
173
+ Relying Party-->>-Customer: redirect to Bank using authUrl
167
174
  Customer->>+Bank: redirect to AuthUrl
168
175
  Bank->>Bank: Authenticate & Capture Consent
169
176
  Bank-->>-Customer: Redirect customer to RP callback URI
@@ -188,126 +195,126 @@ You may also set the `required_claims` and `required_participant_certifications`
188
195
  based on the needs of your use case (eg: if you require IDPs to be TDIF certified).
189
196
 
190
197
  ```javascript
191
- const idps = await rpClient.getParticipants();
198
+ const idps = await rpClient.getParticipants()
192
199
  ```
193
200
 
194
201
  The response will contain an array of Organisations and their Authorisation Server, with an object structure similar to below.
195
202
 
196
203
  They key fields of interest are:
197
204
 
198
- * `CustomerFriendlyName` - this is the name of the Bank to display to the customer
199
- * `CustomerFriendlyLogoUri` - this is a logo for the Bank that can be displayed alongside the bank name
200
- * `AuthorisationServerId` - this uniquely identifies the authorisation server. It will be needed as part of the next call
201
- in the flow to identify the Authorisation Server to send the PAR to.
205
+ - `CustomerFriendlyName` - this is the name of the Bank to display to the customer
206
+ - `CustomerFriendlyLogoUri` - this is a logo for the Bank that can be displayed alongside the bank name
207
+ - `AuthorisationServerId` - this uniquely identifies the authorisation server. It will be needed as part of the next call
208
+ in the flow to identify the Authorisation Server to send the PAR to.
202
209
 
203
210
  Note that in the response there may be:
204
211
 
205
- * multiple organisations - each Bank will be its own organisation
206
- * multiple authorisation servers per bank - a Bank may have different authorisation servers for its different brands (or potentially
207
- to differentiate Business Banking from Retail Banking)
212
+ - multiple organisations - each Bank will be its own organisation
213
+ - multiple authorisation servers per bank - a Bank may have different authorisation servers for its different brands (or potentially
214
+ to differentiate Business Banking from Retail Banking)
208
215
 
209
216
  ```json
210
- [
217
+ [
218
+ {
219
+ "Status": "Active",
220
+ "OrgDomainRoleClaims": [],
221
+ "AuthorisationServers": [
211
222
  {
212
- "Status": "Active",
213
- "OrgDomainRoleClaims": [],
214
- "AuthorisationServers": [
215
- {
216
- "PayloadSigningCertLocationUri": "https://auth.bank4.directory.sandbox.connectid.com.au/na",
217
- "ParentAuthorisationServerId": null,
218
- "OpenIDDiscoveryDocument": "https://auth.bank4.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
219
- "CustomerFriendlyName": "Bank W",
220
- "CustomerFriendlyDescription": "Bank4",
221
- "TermsOfServiceUri": null,
222
- "ApiResources": [],
223
- "AutoRegistrationSupported": true,
224
- "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankW.svg",
225
- "SupportsDCR": false,
226
- "AuthorisationServerCertifications": [],
227
- "SupportsCiba": false,
228
- "DeveloperPortalUri": null,
229
- "NotificationWebhookAddedDate": null,
230
- "AuthorisationServerId": "cde44c30-9138-4b58-ba50-221833d14319"
231
- },
232
- {
233
- "PayloadSigningCertLocationUri": "https://auth.bank3.directory.sandbox.connectid.com.au/na",
234
- "ParentAuthorisationServerId": null,
235
- "OpenIDDiscoveryDocument": "https://auth.bank3.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
236
- "CustomerFriendlyName": "Bank N",
237
- "CustomerFriendlyDescription": "Bank3",
238
- "TermsOfServiceUri": null,
239
- "ApiResources": [],
240
- "AutoRegistrationSupported": true,
241
- "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankN.svg",
242
- "SupportsDCR": false,
243
- "AuthorisationServerCertifications": [],
244
- "SupportsCiba": false,
245
- "DeveloperPortalUri": null,
246
- "NotificationWebhookAddedDate": null,
247
- "AuthorisationServerId": "22c2d67e-4d95-414a-b51a-ca863e9d691d"
248
- }
249
- ],
250
- "OrgDomainClaims": [],
251
- "Size": null,
252
- "RegistrationId": null,
253
- "OrganisationId": "ed63c5b4-4dcb-4867-bd8b-e2b04a0ab04b",
254
- "City": "Banksville",
255
- "Postcode": "4103",
256
- "AddressLine2": "Bank Town",
257
- "RegisteredName": "RefBank",
258
- "AddressLine1": "1 Reference Bank Street",
259
- "LegalEntityName": "Reference Bank",
260
- "OrganisationName": "Reference Banks",
261
- "Country": "AU",
262
- "RegistrationNumber": "ABN 123 456 7890",
263
- "CreatedOn": "2021-12-14T23:09:03.581Z",
264
- "Tag": null,
265
- "ParentOrganisationReference": "",
266
- "CompanyRegister": "ABN",
267
- "CountryOfRegistration": "AU"
223
+ "PayloadSigningCertLocationUri": "https://auth.bank4.directory.sandbox.connectid.com.au/na",
224
+ "ParentAuthorisationServerId": null,
225
+ "OpenIDDiscoveryDocument": "https://auth.bank4.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
226
+ "CustomerFriendlyName": "Bank W",
227
+ "CustomerFriendlyDescription": "Bank4",
228
+ "TermsOfServiceUri": null,
229
+ "ApiResources": [],
230
+ "AutoRegistrationSupported": true,
231
+ "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankW.svg",
232
+ "SupportsDCR": false,
233
+ "AuthorisationServerCertifications": [],
234
+ "SupportsCiba": false,
235
+ "DeveloperPortalUri": null,
236
+ "NotificationWebhookAddedDate": null,
237
+ "AuthorisationServerId": "cde44c30-9138-4b58-ba50-221833d14319"
268
238
  },
269
239
  {
270
- "Status": "Active",
271
- "OrgDomainRoleClaims": [],
272
- "AuthorisationServers": [
273
- {
274
- "PayloadSigningCertLocationUri": "https://mtls.partner.idp.test.commbank.com.au/pf/JWKS",
275
- "ParentAuthorisationServerId": null,
276
- "OpenIDDiscoveryDocument": "https://mtls.partner.idp.test.commbank.com.au/.well-known/openid-configuration",
277
- "CustomerFriendlyName": "Commonwealth Bank",
278
- "CustomerFriendlyDescription": "Test IDP for CBA",
279
- "TermsOfServiceUri": null,
280
- "ApiResources": [],
281
- "AutoRegistrationSupported": true,
282
- "CustomerFriendlyLogoUri": "https://www.commbank.com.au/test.svg",
283
- "SupportsDCR": false,
284
- "AuthorisationServerCertifications": [],
285
- "SupportsCiba": false,
286
- "DeveloperPortalUri": null,
287
- "NotificationWebhookAddedDate": null,
288
- "AuthorisationServerId": "355df9aa-bf8f-4cec-aa4d-78b10356762e"
289
- }
290
- ],
291
- "OrgDomainClaims": [],
292
- "Size": null,
293
- "RegistrationId": "",
294
- "OrganisationId": "adf2af89-2782-4058-86d9-ff3a9068e4a5",
295
- "City": "Sydney",
296
- "Postcode": "2000",
297
- "AddressLine2": "201 Sussex Street",
298
- "RegisteredName": "Commonwealth Bank of Australia",
299
- "AddressLine1": "Ground Floor Tower 1",
300
- "LegalEntityName": "Commonwealth Bank of Australia",
301
- "OrganisationName": "Commonwealth Bank of Australia",
302
- "Country": "AU",
303
- "RegistrationNumber": "ABN 48 123 123 124",
304
- "CreatedOn": "2022-03-14T00:42:29.202Z",
305
- "Tag": null,
306
- "ParentOrganisationReference": "",
307
- "CompanyRegister": "ABN",
308
- "CountryOfRegistration": "AU"
240
+ "PayloadSigningCertLocationUri": "https://auth.bank3.directory.sandbox.connectid.com.au/na",
241
+ "ParentAuthorisationServerId": null,
242
+ "OpenIDDiscoveryDocument": "https://auth.bank3.directory.sandbox.connectid.com.au/.well-known/openid-configuration",
243
+ "CustomerFriendlyName": "Bank N",
244
+ "CustomerFriendlyDescription": "Bank3",
245
+ "TermsOfServiceUri": null,
246
+ "ApiResources": [],
247
+ "AutoRegistrationSupported": true,
248
+ "CustomerFriendlyLogoUri": "https://static.relyingparty.net/BankN.svg",
249
+ "SupportsDCR": false,
250
+ "AuthorisationServerCertifications": [],
251
+ "SupportsCiba": false,
252
+ "DeveloperPortalUri": null,
253
+ "NotificationWebhookAddedDate": null,
254
+ "AuthorisationServerId": "22c2d67e-4d95-414a-b51a-ca863e9d691d"
255
+ }
256
+ ],
257
+ "OrgDomainClaims": [],
258
+ "Size": null,
259
+ "RegistrationId": null,
260
+ "OrganisationId": "ed63c5b4-4dcb-4867-bd8b-e2b04a0ab04b",
261
+ "City": "Banksville",
262
+ "Postcode": "4103",
263
+ "AddressLine2": "Bank Town",
264
+ "RegisteredName": "RefBank",
265
+ "AddressLine1": "1 Reference Bank Street",
266
+ "LegalEntityName": "Reference Bank",
267
+ "OrganisationName": "Reference Banks",
268
+ "Country": "AU",
269
+ "RegistrationNumber": "ABN 123 456 7890",
270
+ "CreatedOn": "2021-12-14T23:09:03.581Z",
271
+ "Tag": null,
272
+ "ParentOrganisationReference": "",
273
+ "CompanyRegister": "ABN",
274
+ "CountryOfRegistration": "AU"
275
+ },
276
+ {
277
+ "Status": "Active",
278
+ "OrgDomainRoleClaims": [],
279
+ "AuthorisationServers": [
280
+ {
281
+ "PayloadSigningCertLocationUri": "https://mtls.partner.idp.test.commbank.com.au/pf/JWKS",
282
+ "ParentAuthorisationServerId": null,
283
+ "OpenIDDiscoveryDocument": "https://mtls.partner.idp.test.commbank.com.au/.well-known/openid-configuration",
284
+ "CustomerFriendlyName": "Commonwealth Bank",
285
+ "CustomerFriendlyDescription": "Test IDP for CBA",
286
+ "TermsOfServiceUri": null,
287
+ "ApiResources": [],
288
+ "AutoRegistrationSupported": true,
289
+ "CustomerFriendlyLogoUri": "https://www.commbank.com.au/test.svg",
290
+ "SupportsDCR": false,
291
+ "AuthorisationServerCertifications": [],
292
+ "SupportsCiba": false,
293
+ "DeveloperPortalUri": null,
294
+ "NotificationWebhookAddedDate": null,
295
+ "AuthorisationServerId": "355df9aa-bf8f-4cec-aa4d-78b10356762e"
309
296
  }
310
- ]
297
+ ],
298
+ "OrgDomainClaims": [],
299
+ "Size": null,
300
+ "RegistrationId": "",
301
+ "OrganisationId": "adf2af89-2782-4058-86d9-ff3a9068e4a5",
302
+ "City": "Sydney",
303
+ "Postcode": "2000",
304
+ "AddressLine2": "201 Sussex Street",
305
+ "RegisteredName": "Commonwealth Bank of Australia",
306
+ "AddressLine1": "Ground Floor Tower 1",
307
+ "LegalEntityName": "Commonwealth Bank of Australia",
308
+ "OrganisationName": "Commonwealth Bank of Australia",
309
+ "Country": "AU",
310
+ "RegistrationNumber": "ABN 48 123 123 124",
311
+ "CreatedOn": "2022-03-14T00:42:29.202Z",
312
+ "Tag": null,
313
+ "ParentOrganisationReference": "",
314
+ "CompanyRegister": "ABN",
315
+ "CountryOfRegistration": "AU"
316
+ }
317
+ ]
311
318
  ```
312
319
 
313
320
  ## getFallbackProviderParticipants()
@@ -323,13 +330,12 @@ Note that there is only expected to be a single Fallback Provider for the scheme
323
330
  auth server should be returned here).
324
331
 
325
332
  ```javascript
326
- const fallbackProviders = await rpClient.getFallbackProviderParticipants();
333
+ const fallbackProviders = await rpClient.getFallbackProviderParticipants()
327
334
  ```
328
335
 
329
336
  The response will contain an array of Organisations and their Authorisation Servers, with the structure the same
330
337
  as that for `getParticipants()`.
331
338
 
332
-
333
339
  ## sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = '{default value from config}')
334
340
 
335
341
  This sends a Pushed Authorisation Request to the specified Identity Server requesting the list of supplied claims. The response
@@ -338,24 +344,24 @@ process.
338
344
 
339
345
  The required function parameters are:
340
346
 
341
- * `authorisationServerId` - identifies the authorisation server to send the PAR to
342
- * `essentialClaims` - a list of the identity essential claim names that being requested for the user.
343
- Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
344
- When the IDP is obtaining user consent, the only method for a user to opt out of consenting to an `essential` claim is to cancel the entire transaction.
345
- * `voluntaryClaims` - a list of the identity voluntary claim names that are being requested for the user.
346
- Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
347
- When the IDP is obtaining user consent, they may allow the user to opt out of consenting to providing each of the `voluntary` claims, while still consenting to all `essential` claims.
348
- If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
349
- * `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
347
+ - `authorisationServerId` - identifies the authorisation server to send the PAR to
348
+ - `essentialClaims` - a list of the identity essential claim names that being requested for the user.
349
+ Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
350
+ When the IDP is obtaining user consent, the only method for a user to opt out of consenting to an `essential` claim is to cancel the entire transaction.
351
+ - `voluntaryClaims` - a list of the identity voluntary claim names that are being requested for the user.
352
+ Note that permitted claim names are defined in section 6 of the [Digital ID API Security Profile](https://docs.sandbox.connectid.com.au/docs/network-documentation/technical-specifications/) specification.
353
+ When the IDP is obtaining user consent, they may allow the user to opt out of consenting to providing each of the `voluntary` claims, while still consenting to all `essential` claims.
354
+ If a user does not consent to `voluntary` claims, but does consent to `essential` claims, this will result in a successful transaction.
355
+ - `purpose` - the purpose to be displayed to the consumer on the IDP consent screen to indicate why their data is being requested to be shared. If not supplied, the default purpose configured in the SDK config will be used.
350
356
 
351
357
  The method will return: `{ authUrl, code_verifier, state, nonce, xFapiInteractionId }`. The fields are:
352
358
 
353
- * `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
354
- * `codeVerifier`
355
- * `state`
356
- * `nonce`
357
- * `xFapiInteractionId` - a unique identifier for this interaction with the Authorisation Server, that was sent in the `x-fapi-interaction-id` request
358
- header to the server. Intended as a correlation id for diagnosing issues between the client and the authorisation server.
359
+ - `authUrl` - the URL the user must be redirected to in order to complete the authorisation process with their Identity Provider
360
+ - `codeVerifier`
361
+ - `state`
362
+ - `nonce`
363
+ - `xFapiInteractionId` - a unique identifier for this interaction with the Authorisation Server, that was sent in the `x-fapi-interaction-id` request
364
+ header to the server. Intended as a correlation id for diagnosing issues between the client and the authorisation server.
359
365
 
360
366
  The `codeVerifier`, `state` and `nonce` are all associated with this specific PAR and are required when retrieving the
361
367
  token claims when the user has authorised the request. You must securely associate these with your user request
@@ -365,19 +371,19 @@ so that you can use them on the subsequent call.
365
371
 
366
372
  ```typescript
367
373
  interface CallbackParamsType {
368
- access_token?: string;
369
- code?: string;
370
- error?: string;
371
- error_description?: string;
372
- error_uri?: string;
373
- expires_in?: string;
374
- id_token?: string;
375
- state?: string;
376
- token_type?: string;
377
- session_state?: string;
378
- response?: string;
379
-
380
- [key: string]: unknown;
374
+ access_token?: string
375
+ code?: string
376
+ error?: string
377
+ error_description?: string
378
+ error_uri?: string
379
+ expires_in?: string
380
+ id_token?: string
381
+ state?: string
382
+ token_type?: string
383
+ session_state?: string
384
+ response?: string
385
+
386
+ [key: string]: unknown
381
387
  }
382
388
  ```
383
389
 
@@ -387,11 +393,11 @@ identity token with the claims. The tokens are then returned to the API caller.
387
393
 
388
394
  The required function parameters are:
389
395
 
390
- * `authorisationServerId` - identifies the authorisation server providing the user information
391
- * `requestParams` - the full querystring from the callback to the Relying Party callback address
392
- * `codeVerifier` - from the response to the PAR for this identity request
393
- * `state` - from the response to the PAR for this identity request
394
- * `nonce` - from the response to the PAR for this identity request
396
+ - `authorisationServerId` - identifies the authorisation server providing the user information
397
+ - `requestParams` - the full querystring from the callback to the Relying Party callback address
398
+ - `codeVerifier` - from the response to the PAR for this identity request
399
+ - `state` - from the response to the PAR for this identity request
400
+ - `nonce` - from the response to the PAR for this identity request
395
401
 
396
402
  The method will return a `ConsolidatedTokenSet` which extends [Tokenset](https://github.com/panva/node-openid-client/blob/main/docs/README.md#class-tokenset)
397
403
  that contains the access_token and id_token. The user identity claims can be retrieved using the utility method `claims()`
@@ -408,36 +414,49 @@ All user identity claims will be provided as part of the `id_token` returned by
408
414
 
409
415
  The required function parameters are:
410
416
 
411
- * `authorisationServerId` - identifies the authorisation server providing the user information
412
- * `accessToken` - the access token provided by `retrieveTokens`
417
+ - `authorisationServerId` - identifies the authorisation server providing the user information
418
+ - `accessToken` - the access token provided by `retrieveTokens`
413
419
 
414
420
  # Release Notes
415
421
 
422
+ ### 4.2.1 (Nov 27, 2025)
423
+
424
+ - Updated dependencies.
425
+
416
426
  ### 4.2.0 (Aug 8, 2025)
427
+
417
428
  - `cba_loyalty` claim.
418
429
 
419
430
  ### 4.1.0 (Feb 25, 2025)
431
+
420
432
  - Implemented user-agent support.
421
433
 
422
434
  ### 4.0.5 (Feb 24, 2025)
435
+
423
436
  - Add README.md and license files to bundle.
424
437
 
425
438
  ### 4.0.4 (Feb 21, 2025)
439
+
426
440
  - Remove `declarationMap`.
427
441
 
428
442
  ### 4.0.3 (Nov 29, 2024)
443
+
429
444
  - Issuer value for aud in private_key_jwt.
430
445
 
431
446
  ### 4.0.2 (Oct 22, 2024)
447
+
432
448
  - Single string audience in the private key jwt.
433
449
 
434
450
  ### 4.0.1 (Oct 1, 2024)
451
+
435
452
  - Changed type of `ApiResources` from `str` to `ApiResource`.
436
453
 
437
454
  ### 4.0.0 (Sep 2, 2024)
455
+
438
456
  - Breaking change: removed essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` then you need to provide the claims explicitly. Otherwise, no need to change anything.
439
457
 
440
458
  How it was:
459
+
441
460
  ```typescript
442
461
  const defaultClaimList: string[] = ['given_name', 'middle_name', 'family_name', 'phone_number', 'email', 'address', 'birthdate', 'txn']
443
462
 
@@ -445,37 +464,47 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
445
464
  ```
446
465
 
447
466
  How it is now:
467
+
448
468
  ```typescript
449
469
  async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: string[], voluntaryClaims: string[] = [], purpose: string = this.purpose) {
450
470
  ```
451
471
 
452
472
  ### 4.0.0 (Sep 23, 2024)
473
+
453
474
  - Updated Node version to 20.x.
454
- - Removed jest and axios dependencies.
475
+ - Removed jest and axios dependencies.
455
476
 
456
477
  ### 3.0.0 (Aug 27, 2024)
478
+
457
479
  - Breaking change: removed `name` from essential claims default value. If you are relying on essential claims default value calling `sendPushedAuthorisationRequest` and use `name` claim then you need to provide `name` claim explicitly. Otherwise, no need to change anything.
458
480
 
459
481
  ### 2.15.0 (Jun 20, 2024)
482
+
460
483
  - Updated purpose statement.
461
484
  - Dependencies updated.
462
485
 
463
486
  ### 2.14.1 (Jun 17, 2024)
487
+
464
488
  - Removed `got` dependency and used `fetch` instead.
465
489
 
466
490
  ### 2.14.0 (Jun 12, 2024)
467
- - Added cache to `getParticipants()` method.
491
+
492
+ - Added cache to `getParticipants()` method.
468
493
 
469
494
  ### 2.13.0 (April 17, 2024)
495
+
470
496
  - Updated dependencies
471
497
 
472
498
  ### 2.12.3 (Nov 8, 2023)
499
+
473
500
  - `nonce` should have 43 chars.
474
501
 
475
502
  ### 2.12.2 (Nov 8, 2023)
503
+
476
504
  - Updated README.md to include `tsconfig` suggestion.
477
505
 
478
506
  ### 2.12.1 (Nov 7, 2023)
507
+
479
508
  - Made `ca_pem` optional. Although either `ca_pem` or `ca_pem_content` must be provided.
480
509
  - Made `signing_key` optional. Although either `signing_key` or `signing_key_content` must be provided.
481
510
  - Made `signing_pem` optional. Although either `signing_pem` or `signing_pem_content` must be provided.
@@ -483,97 +512,126 @@ async sendPushedAuthorisationRequest(authServerId: string, essentialClaims: stri
483
512
  - Made `transport_pem` optional. Although either `transport_pem` or `transport_pem_content` must be provided.
484
513
 
485
514
  ### 2.12.0 (October 19, 2023)
515
+
486
516
  - Added support to Node 18.
487
517
 
488
518
  ### 2.11.2 (August 22, 2023)
519
+
489
520
  - Conformance test succeed on warnings.
490
521
 
491
522
  ### 2.11.1 (August 3, 2023)
523
+
492
524
  - Added automated Conformance test.
493
525
 
494
526
  ### 2.11.0 (August 1, 2023)
527
+
495
528
  - Updated trust_framework in the PAR to contain an object `{ value: 'au_connectid' }` instead of having a string value. This
496
- is to bring it inline with OIDC4A spec that requires trust_framework to contain an object.
529
+ is to bring it inline with OIDC4A spec that requires trust_framework to contain an object.
497
530
 
498
531
  ### 2.10.0 (July 31, 2023)
532
+
499
533
  - Updated documentation to include `registry_participants_uri` parameter.
500
534
  - Updated two testcases.
501
535
 
502
536
  ### 2.9.0 (July 17, 2023)
537
+
503
538
  - Updated `getParticipants()` so it only returns participants that are active in the network by default. Can be
504
- overridden using config to return all if required. Also allow filtering of Auth Servers by capabilities.
539
+ overridden using config to return all if required. Also allow filtering of Auth Servers by capabilities.
505
540
  - Added `getFallbackProviderParticipants()` to return the manual verification authorisation server.
506
541
  - Note that `sendPushedAuthorisationRequest()` will require the auth server id to be valid for the current filter config (eg: Active auth servers).
507
542
 
508
543
  ### 2.8.0 (June 7, 2023)
544
+
509
545
  - Ensured that the `txn` claim is always requested so clients always have a reference for the transaction.
510
546
 
511
547
  ### 2.7.2 (June 6, 2023)
548
+
512
549
  - Removed `redirect_url` and `response_type` authorization request parameters from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
513
550
 
514
551
  ### 2.7.1 (June 5, 2023)
552
+
515
553
  - Removed `scope` authorization request parameter from the request to the authorization endpoint to comply with FAPI2 Security Profile Implementers Draft 3.
516
554
 
517
555
  ### 2.7.0 (May 31, 2023)
556
+
518
557
  - Enhanced logging so x-fapi-interaction-id logged for PAR and token requests.
519
558
 
520
559
  ### 2.6.1 (May 29, 2023)
560
+
521
561
  - Fixed invalid main file definition.
522
562
 
523
563
  ### 2.6.0 (May 29, 2023)
564
+
524
565
  - Added support for `purpose` as request object parameter on PAR requests. Can be supplied per request or use the default supplied via config.
525
566
 
526
567
  ### 2.5.0 (May 24, 2023)
568
+
527
569
  - Added support for `x-fapi-interaction-id` headers on PAR, token and userinfo requests.
528
570
 
529
571
  ### 2.4.1 (May 5, 2023)
572
+
530
573
  - Updated clientId details for testing and documentation to use a federated clientId.
531
574
 
532
575
  ### 2.4.0 (March 28, 2023)
576
+
533
577
  - Reimplemented extended claims, which now supports the following claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account_au`, `beneficiary_account_au_payid`, `beneficiary_account_international`.
534
578
  - Implemented strict mode for TypeScript to prevent the use of `any` type and other unsafe types.
535
579
  - Fix for `ClaimsRequest` type to support non-verified claims in the type definition.
536
580
 
537
581
  ### 2.3.0 (March 10, 2023)
582
+
538
583
  - Added support for the following extended claims: `over16`, `over18`, `over21`, `over25`, `over65`, `beneficiary_account`, `pay_id`.
539
584
 
540
585
  ### 2.2.0 (Feb 20, 2023)
586
+
541
587
  - Maintenance update of dependencies to address CVE-2022-36083 in JOSE library.
542
588
 
543
589
  ### 2.1.0 (Feb 13, 2023)
590
+
544
591
  - Moved `prompt=consent` parameter to pushed authorisation request object instead of a URL parameter.
545
592
 
546
593
  ### 2.0.7 (Dec 22, 2022)
594
+
547
595
  - Run on Node 14 and 16 (openid-client lib does not support Node 18 yet).
548
-
596
+
549
597
  ### 2.0.6 (Dec 21, 2022)
598
+
550
599
  - Removed the need to use `--experimental-specifier-resolution=node` flag when importing the SDK.
551
600
  - Log SDK version.
552
-
601
+
553
602
  ### 2.0.5 (Dec 20, 2022)
603
+
554
604
  - Updated documentation.
555
605
 
556
606
  ### 2.0.4 (Dec 20, 2022)
607
+
557
608
  - Fixed `RelyingPartyClientSdk is not a constructor`.
558
609
 
559
610
  ### 2.0.3 (Dec 20, 2022)
611
+
560
612
  - Made `ca_pem_content, signing_key_content, signing_pem_content, transport_key_content, transport_pem_content` from `RelyingPartyClientSdkConfig` optional.
561
613
 
562
614
  ### 2.0.2 (Dec 20, 2022)
615
+
563
616
  - Removed version logging when SDK is created.
564
617
 
565
618
  ### 2.0.1 (Dec 20, 2022)
619
+
566
620
  - Fixed npm publish.
567
621
 
568
622
  ### 2.0.0 (Dec 19, 2022)
569
- - Typescript support.
623
+
624
+ - Typescript support.
570
625
  - Breaking change: SDK imported using `require` will need to add a `default` at the end of the import.
626
+
571
627
  ```javascript
572
628
  const RelyingPartyClientSdk = require('@idmvp/rp-nodejs-sdk').default
573
629
  ```
574
-
630
+
575
631
  ### 1.2.3 (Oct 24, 2022)
632
+
576
633
  - Code formatting. See `.prettierrc.json`.
577
634
 
578
635
  ### 1.2.2
636
+
579
637
  \<starting point\>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@connectid-tools/rp-nodejs-sdk",
3
- "version": "4.2.0",
3
+ "version": "4.2.1",
4
4
  "description": "Digital Identity Relying Party Node SDK",
5
5
  "main": "relying-party-client-sdk.js",
6
6
  "types": "relying-party-client-sdk.d.ts",
@@ -44,5 +44,8 @@
44
44
  "replace-in-files-cli": "^2.2.0",
45
45
  "tsx": "^4.20.3",
46
46
  "typescript": "^5.9.2"
47
+ },
48
+ "overrides": {
49
+ "node-forge": "^1.3.2"
47
50
  }
48
51
  }
package/relying-party-client-sdk.js CHANGED
@@ -43,7 +43,7 @@ export default class RelyingPartyClientSdk {
43
43
  this.signingKey = getCertificate(this.config.data.signing_key, this.config.data.signing_key_content);
44
44
  this.caPem = getCertificate(this.config.data.ca_pem, this.config.data.ca_pem_content);
45
45
  this.logger = getLogger(this.config.data.log_level);
46
- this.logger.info(`Creating RelyingPartyClientSdk - version 4.2.0`);
46
+ this.logger.info(`Creating RelyingPartyClientSdk - version 4.2.1`);
47
47
  if (this.config.data.purpose) {
48
48
  const purposeValidation = validatePurpose(this.config.data.purpose);
49
49
  if (purposeValidation === 'INVALID_LENGTH') {
@@ -75,7 +75,7 @@ export default class RelyingPartyClientSdk {
75
75
  globalAgent.options.key = this.transportKey;
76
76
  globalAgent.options.ca = [this.caPem, ...rootCertificates];
77
77
  custom.setHttpOptionsDefaults({ timeout: 10000 });
78
- // 4.2.0 is replaced with `postbuild` script in package.json (see replace-in-files)
78
+ // 4.2.1 is replaced with `postbuild` script in package.json (see replace-in-files)
79
79
  this.logger.info(`Using ${this.config.data.transport_key_content ? 'transport_key_content' : 'transport_key'} config prop`);
80
80
  this.logger.info(`Using ${this.config.data.transport_pem_content ? 'transport_pem_content' : 'transport_pem'} config prop`);
81
81
  this.logger.info(`Using ${this.config.data.ca_pem_content ? 'ca_pem_content' : 'ca_pem'} config prop`);
package/utils/user-agent.d.ts CHANGED
@@ -1,2 +1,2 @@
1
- export declare const packageJsonVersion = "4.2.0";
1
+ export declare const packageJsonVersion = "4.2.1";
2
2
  export declare const buildUserAgent: (clientId: string) => string;
package/utils/user-agent.js CHANGED
@@ -1,6 +1,4 @@
1
1
  import { getSystemInformation } from './system-information.js';
2
2
  // important: Update this every time the package version changes
3
- export const packageJsonVersion = '4.2.0';
4
- export const buildUserAgent = (clientId) => {
5
- return `cid-rp-nodejs-sdk/${packageJsonVersion} ${getSystemInformation()} +${clientId}`;
6
- };
3
+ export const packageJsonVersion = '4.2.1';
4
+ export const buildUserAgent = (clientId) => `cid-rp-nodejs-sdk/${packageJsonVersion} ${getSystemInformation()} +${clientId}`;