@hapi/bell 13.0.2 → 13.2.0

package/lib/index.d.ts

@@ -30,7 +30,6 @@ export type Provider =
     | 'live'
     | 'medium'
     | 'meetup'
-    | 'mixer'
     | 'nest'
     | 'okta'
     | 'phabricator'
@@ -89,7 +88,7 @@ export interface OptionalOptions {
      * * Twitter supports `force_login`, `screen_name`.
      * * Linkedin supports `fields`.
      */
-    providerParams?: StringLikeMap | ((request: Request) => StringLikeMap) | undefined;
+    providerParams?: StringLikeMap | ((request: Request) => StringLikeMap | Promise<StringLikeMap>) | undefined;
     /**
      * allows passing query parameters from a bell protected endpoint to the auth request.
      * It will merge the query params you pass along with the providerParams and any other predefined ones.
@@ -125,6 +124,12 @@ export interface OptionalOptions {
         | { extendedProfile?: boolean | undefined; getMethod?: string | undefined }
         | { uri?: string | undefined }
         | undefined;
+    /**
+     * provider-specific query parameters for the token endpoint.
+     * It may be passed either as an object to merge into the query string,
+     * or a function which takes the client's request and returns an object.
+    */
+    tokenParams?: StringLikeMap | ((request: Request) => StringLikeMap | Promise<StringLikeMap>) | undefined;
     /**
      * an object of key-value pairs that specify additional
      * URL query parameters to send with the profile request to the provider.
@@ -199,6 +204,12 @@ export interface Credentials2 extends Credentials {
     expiresIn?: number | undefined;
 }
 
+/**
+ * an endpoint URI, or a function of the request returning one.
+ * @param request the hapi request object being authenticated.
+ */
+export type ProviderUri = string | ((request: Request) => string | Promise<string>);
+
 export interface CustomProtocol {
     /**
      * The name of the protocol.
@@ -208,11 +219,11 @@ export interface CustomProtocol {
     /**
      * the authorization endpoint URI.
      */
-    auth: string;
+    auth: ProviderUri;
     /**
      * the access token endpoint URI.
      */
-    token: string;
+    token: ProviderUri;
     /**
      * a headers object with additional headers required by the provider
      * (e.g. GitHub required the 'User-Agent' header which is set by default).
@@ -228,12 +239,14 @@ export interface CustomProtocol {
  * Change the object directly within the function (profile information is typically stored under credentials.profile).
  * @param params the parsed information received from the provider (e.g. token, secret, and other custom fields).
  * @param get an OAuth helper function to make authenticated requests using the credentials received.
+ * @param request the hapi request object of the authorization callback.
  */
 export type ProfileGetter<C extends Credentials> = (
     this: CustomProviderOptions,
     credentials: C,
     params: { [key: string]: string },
     get: AuthedRequest,
+    request: Request,
 ) => Promise<void>;
 
 export interface CustomProtocol1 extends CustomProtocol {
@@ -251,7 +264,7 @@ export interface CustomProtocol1 extends CustomProtocol {
     /**
      * the temporary credentials (request token) endpoint).
      */
-    temporary?: string | undefined;
+    temporary?: ProviderUri | undefined;
 
     profile: ProfileGetter<Credentials1>;
 }
@@ -302,4 +315,4 @@ export function simulate(credentialsFunc: RequestPassThrough): void;
  * [See docs](https://github.com/hapijs/bell/blob/master/API.md#simulated-authentication)
  * Disables simulation mode
  */
-export function simulate(state: false): void;
+export function simulate(state: false): void;

package/lib/index.js

@@ -9,6 +9,7 @@ const Providers = require('./providers');
 
 const internals = {
     simulate: false,
+    endpoint: Joi.alternatives(Joi.string(), Joi.func()),
     flexBoolean: Joi.boolean().truthy('yes', 1, '1').falsy('no', 0, '0')
 };
 
@@ -38,8 +39,8 @@ exports.plugin = {
 internals.provider = Joi.object({
     name: Joi.string().optional().default('custom'),
     protocol: ['oauth', 'oauth2'],
-    auth: Joi.string().required(),
-    token: Joi.string().required(),
+    auth: internals.endpoint.required(),
+    token: internals.endpoint.required(),
     headers: Joi.object(),
     profile: Joi.func(),
     profileMethod: Joi.valid('get', 'post').default('get')
@@ -47,7 +48,7 @@ internals.provider = Joi.object({
     .when('.protocol', {
         is: 'oauth',
         then: Joi.object({
-            temporary: Joi.string().required(),
+            temporary: internals.endpoint.required(),
             signatureMethod: Joi.valid('HMAC-SHA1', 'RSA-SHA1').default('HMAC-SHA1')
         }),
         otherwise: Joi.object({
@@ -104,6 +105,8 @@ internals.schema = Joi.object({
 
     config: Joi.object(),
 
+    tokenParams: Joi.alternatives(Joi.object(), Joi.func()),
+
     profileParams: Joi.object(),
 
     skipProfile: internals.flexBoolean.optional().default(false),

package/lib/oauth.js

@@ -19,10 +19,16 @@ const internals = {
 
 exports.v1 = function (settings) {
 
-    const client = new internals.Client(settings);
+    // The client uses temporary and token, so we can share one unless either is a function
+
+    const shared = [settings.provider.temporary, settings.provider.token].some((endpoint) => typeof endpoint === 'function') ?
+        null :
+        new internals.Client(settings);
 
     return async function (request, h) {
 
+        const client = shared ?? await internals.client(request, settings);
+
         const cookie = settings.cookie;
         const name = settings.name;
         const protocol = internals.getProtocol(request, settings);
@@ -72,14 +78,14 @@ exports.v1 = function (settings) {
 
             h.state(cookie, state);
 
-            const authQuery = internals.resolveProviderParams(request, settings.providerParams);
-            authQuery.oauth_token = temp.oauth_token;
-
-            if (settings.allowRuntimeProviderParams) {
-                Hoek.merge(authQuery, request.query);
-            }
+            const authQuery = {
+                ...await internals.resolveProviderParams(request, settings.providerParams),
+                oauth_token: temp.oauth_token,
+                ...(settings.allowRuntimeProviderParams && request.query)
+            };
 
-            return h.redirect(settings.provider.auth + '?' + internals.queryString(authQuery)).takeover();
+            const authUri = await internals.resolveProviderUri(request, settings.provider.auth);
+            return h.redirect(authUri + '?' + internals.queryString(authQuery)).takeover();
         }
 
         // Authorization callback
@@ -123,7 +129,7 @@ exports.v1 = function (settings) {
         const get = async (uri, params = {}) => {
 
             if (settings.profileParams) {
-                Hoek.merge(params, settings.profileParams);
+                Object.assign(params, settings.profileParams);
             }
 
             const { payload: resource } = await client.resource('get', uri, params, { token: token.oauth_token, secret: token.oauth_token_secret });
@@ -131,7 +137,7 @@ exports.v1 = function (settings) {
         };
 
         try {
-            await settings.provider.profile.call(settings, credentials, token, get);
+            await settings.provider.profile.call(settings, credentials, token, get, request);
         }
         catch (err) {
             return h.unauthenticated(err, { credentials });
@@ -178,16 +184,14 @@ exports.v2 = function (settings) {
             credentials.query = request.query;
 
             const nonce = Cryptiles.randomAlphanumString(internals.nonceLength);
-            const query = internals.resolveProviderParams(request, settings.providerParams);
-
-            if (settings.allowRuntimeProviderParams) {
-                Hoek.merge(query, request.query);
-            }
-
-            query.client_id = settings.clientId;
-            query.response_type = 'code';
-            query.redirect_uri = internals.location(request, protocol, settings.location);
-            query.state = nonce;
+            const query = {
+                ...await internals.resolveProviderParams(request, settings.providerParams),
+                ...(settings.allowRuntimeProviderParams && request.query),
+                client_id: settings.clientId,
+                response_type: 'code',
+                redirect_uri: internals.location(request, protocol, settings.location),
+                state: nonce
+            };
 
             if (settings.runtimeStateCallback) {
                 const runtimeState = settings.runtimeStateCallback(request);
@@ -230,7 +234,9 @@ exports.v2 = function (settings) {
             }
 
             h.state(cookie, state);
-            return h.redirect(settings.provider.auth + '?' + internals.queryString(query)).takeover();
+
+            const authUri = await internals.resolveProviderUri(request, settings.provider.auth);
+            return h.redirect(authUri + '?' + internals.queryString(query)).takeover();
         }
 
         // Authorization callback
@@ -251,7 +257,8 @@ exports.v2 = function (settings) {
         const query = {
             grant_type: 'authorization_code',
             code: request.query.code,
-            redirect_uri: internals.location(request, protocol, settings.location)
+            redirect_uri: internals.location(request, protocol, settings.location),
+            ...await internals.resolveProviderParams(request, settings.tokenParams)
         };
 
         if (settings.provider.pkce) {
@@ -289,8 +296,9 @@ exports.v2 = function (settings) {
 
         // Obtain token
 
+        const tokenUri = await internals.resolveProviderUri(request, settings.provider.token);
         try {
-            var { res: tokenRes, payload } = await Wreck.post(settings.provider.token, requestOptions);
+            var { res: tokenRes, payload } = await Wreck.post(tokenUri, requestOptions);
         }
         catch (err) {
             return h.unauthenticated(Boom.internal('Failed obtaining ' + name + ' access token', err), { credentials });
@@ -360,7 +368,7 @@ exports.v2 = function (settings) {
         };
 
         try {
-            await settings.provider.profile.call(settings, credentials, payload, get);
+            await settings.provider.profile.call(settings, credentials, payload, get, request);
         }
         catch (err) {
             return h.unauthenticated(err, { credentials });
@@ -729,8 +737,25 @@ internals.getProtocol = function (request, settings) {
 };
 
 
-internals.resolveProviderParams = function (request, params) {
+internals.resolveProviderParams = async function (request, params) {
+
+    return (typeof params === 'function' ? await params(request) : params) ?? {};
+};
+
+
+internals.resolveProviderUri = async function (request, uri) {
+
+    return typeof uri === 'function' ? await uri(request) : uri;
+};
+
+
+internals.client = async function (request, settings) {
+
+    const provider = {
+        ...settings.provider,
+        temporary: await internals.resolveProviderUri(request, settings.provider.temporary),
+        token: await internals.resolveProviderUri(request, settings.provider.token)
+    };
 
-    const obj = typeof params === 'function' ? params(request) : params;
-    return obj ? Hoek.clone(obj) : {};
+    return new internals.Client({ ...settings, provider });
 };

package/lib/providers/index.js

@@ -25,7 +25,6 @@ exports = module.exports = {
     live: require('./live'),
     medium: require('./medium'),
     meetup: require('./meetup'),
-    mixer: require('./mixer'),
     nest: require('./nest'),
     okta: require('./okta'),
     phabricator: require('./phabricator'),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hapi/bell",
   "description": "Third-party login plugin for hapi",
-  "version": "13.0.2",
+  "version": "13.2.0",
   "repository": "git://github.com/hapijs/bell",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -51,21 +51,21 @@
   },
   "dependencies": {
     "@hapi/boom": "^10.0.1",
-    "@hapi/bounce": "^3.0.1",
-    "@hapi/cryptiles": "^6.0.1",
-    "@hapi/hoek": "^11.0.2",
-    "@hapi/wreck": "^18.0.1",
-    "joi": "^17.7.1"
+    "@hapi/bounce": "^3.0.2",
+    "@hapi/cryptiles": "^6.0.3",
+    "@hapi/hoek": "^11.0.7",
+    "@hapi/wreck": "^18.1.2",
+    "joi": "^17.13.7"
   },
   "devDependencies": {
     "@hapi/code": "^9.0.3",
-    "@hapi/eslint-plugin": "*",
-    "@hapi/hapi": "^21.2.1",
+    "@hapi/eslint-plugin": "^6.0.0",
+    "@hapi/hapi": "^21.4.10",
     "@hapi/hawk": "^8.0.0",
-    "@hapi/lab": "^25.0.1",
-    "@hapi/teamwork": "^6.0.0",
-    "@types/node": "^20.11.30",
-    "typescript": "^5.4.2"
+    "@hapi/lab": "^25.3.2",
+    "@hapi/teamwork": "^6.0.1",
+    "@types/node": "^20.19.43",
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "test": "lab -a @hapi/code -t 100 -L -m 3000 -Y",

package/lib/providers/mixer.js

@@ -1,25 +0,0 @@
-'use strict';
-
-const internals = {};
-
-
-exports = module.exports = function (options) {
-
-    return {
-        protocol: 'oauth2',
-        useParamsAuth: true,
-        auth: 'https://mixer.com/oauth/authorize',
-        token: 'https://mixer.com/api/v1/oauth/token',
-        scope: ['user:details:self'],
-        scopeSeparator: ' ',
-        profile: async function (credentials, params, get) {
-
-            const queryOptions = {
-                oauth_token: params.access_token
-            };
-
-            const profile = await get('https://mixer.com/api/v1/users/current', queryOptions);
-            credentials.profile = profile;
-        }
-    };
-};