@hapi/bell 13.1.0 → 13.2.0

package/lib/index.d.ts

@@ -88,7 +88,7 @@ export interface OptionalOptions {
      * * Twitter supports `force_login`, `screen_name`.
      * * Linkedin supports `fields`.
      */
-    providerParams?: StringLikeMap | ((request: Request) => StringLikeMap) | undefined;
+    providerParams?: StringLikeMap | ((request: Request) => StringLikeMap | Promise<StringLikeMap>) | undefined;
     /**
      * allows passing query parameters from a bell protected endpoint to the auth request.
      * It will merge the query params you pass along with the providerParams and any other predefined ones.
@@ -129,7 +129,7 @@ export interface OptionalOptions {
      * It may be passed either as an object to merge into the query string,
      * or a function which takes the client's request and returns an object.
     */
-    tokenParams?: StringLikeMap | ((request: Request) => StringLikeMap) | undefined;
+    tokenParams?: StringLikeMap | ((request: Request) => StringLikeMap | Promise<StringLikeMap>) | undefined;
     /**
      * an object of key-value pairs that specify additional
      * URL query parameters to send with the profile request to the provider.
@@ -204,6 +204,12 @@ export interface Credentials2 extends Credentials {
     expiresIn?: number | undefined;
 }
 
+/**
+ * an endpoint URI, or a function of the request returning one.
+ * @param request the hapi request object being authenticated.
+ */
+export type ProviderUri = string | ((request: Request) => string | Promise<string>);
+
 export interface CustomProtocol {
     /**
      * The name of the protocol.
@@ -213,11 +219,11 @@ export interface CustomProtocol {
     /**
      * the authorization endpoint URI.
      */
-    auth: string;
+    auth: ProviderUri;
     /**
      * the access token endpoint URI.
      */
-    token: string;
+    token: ProviderUri;
     /**
      * a headers object with additional headers required by the provider
      * (e.g. GitHub required the 'User-Agent' header which is set by default).
@@ -233,12 +239,14 @@ export interface CustomProtocol {
  * Change the object directly within the function (profile information is typically stored under credentials.profile).
  * @param params the parsed information received from the provider (e.g. token, secret, and other custom fields).
  * @param get an OAuth helper function to make authenticated requests using the credentials received.
+ * @param request the hapi request object of the authorization callback.
  */
 export type ProfileGetter<C extends Credentials> = (
     this: CustomProviderOptions,
     credentials: C,
     params: { [key: string]: string },
     get: AuthedRequest,
+    request: Request,
 ) => Promise<void>;
 
 export interface CustomProtocol1 extends CustomProtocol {
@@ -256,7 +264,7 @@ export interface CustomProtocol1 extends CustomProtocol {
     /**
      * the temporary credentials (request token) endpoint).
      */
-    temporary?: string | undefined;
+    temporary?: ProviderUri | undefined;
 
     profile: ProfileGetter<Credentials1>;
 }
@@ -307,4 +315,4 @@ export function simulate(credentialsFunc: RequestPassThrough): void;
  * [See docs](https://github.com/hapijs/bell/blob/master/API.md#simulated-authentication)
  * Disables simulation mode
  */
-export function simulate(state: false): void;
+export function simulate(state: false): void;

package/lib/index.js

@@ -9,6 +9,7 @@ const Providers = require('./providers');
 
 const internals = {
     simulate: false,
+    endpoint: Joi.alternatives(Joi.string(), Joi.func()),
     flexBoolean: Joi.boolean().truthy('yes', 1, '1').falsy('no', 0, '0')
 };
 
@@ -38,8 +39,8 @@ exports.plugin = {
 internals.provider = Joi.object({
     name: Joi.string().optional().default('custom'),
     protocol: ['oauth', 'oauth2'],
-    auth: Joi.string().required(),
-    token: Joi.string().required(),
+    auth: internals.endpoint.required(),
+    token: internals.endpoint.required(),
     headers: Joi.object(),
     profile: Joi.func(),
     profileMethod: Joi.valid('get', 'post').default('get')
@@ -47,7 +48,7 @@ internals.provider = Joi.object({
     .when('.protocol', {
         is: 'oauth',
         then: Joi.object({
-            temporary: Joi.string().required(),
+            temporary: internals.endpoint.required(),
             signatureMethod: Joi.valid('HMAC-SHA1', 'RSA-SHA1').default('HMAC-SHA1')
         }),
         otherwise: Joi.object({

package/lib/oauth.js

@@ -19,10 +19,16 @@ const internals = {
 
 exports.v1 = function (settings) {
 
-    const client = new internals.Client(settings);
+    // The client uses temporary and token, so we can share one unless either is a function
+
+    const shared = [settings.provider.temporary, settings.provider.token].some((endpoint) => typeof endpoint === 'function') ?
+        null :
+        new internals.Client(settings);
 
     return async function (request, h) {
 
+        const client = shared ?? await internals.client(request, settings);
+
         const cookie = settings.cookie;
         const name = settings.name;
         const protocol = internals.getProtocol(request, settings);
@@ -73,12 +79,13 @@ exports.v1 = function (settings) {
             h.state(cookie, state);
 
             const authQuery = {
-                ...internals.resolveProviderParams(request, settings.providerParams),
+                ...await internals.resolveProviderParams(request, settings.providerParams),
                 oauth_token: temp.oauth_token,
                 ...(settings.allowRuntimeProviderParams && request.query)
             };
 
-            return h.redirect(settings.provider.auth + '?' + internals.queryString(authQuery)).takeover();
+            const authUri = await internals.resolveProviderUri(request, settings.provider.auth);
+            return h.redirect(authUri + '?' + internals.queryString(authQuery)).takeover();
         }
 
         // Authorization callback
@@ -130,7 +137,7 @@ exports.v1 = function (settings) {
         };
 
         try {
-            await settings.provider.profile.call(settings, credentials, token, get);
+            await settings.provider.profile.call(settings, credentials, token, get, request);
         }
         catch (err) {
             return h.unauthenticated(err, { credentials });
@@ -178,7 +185,7 @@ exports.v2 = function (settings) {
 
             const nonce = Cryptiles.randomAlphanumString(internals.nonceLength);
             const query = {
-                ...internals.resolveProviderParams(request, settings.providerParams),
+                ...await internals.resolveProviderParams(request, settings.providerParams),
                 ...(settings.allowRuntimeProviderParams && request.query),
                 client_id: settings.clientId,
                 response_type: 'code',
@@ -227,7 +234,9 @@ exports.v2 = function (settings) {
             }
 
             h.state(cookie, state);
-            return h.redirect(settings.provider.auth + '?' + internals.queryString(query)).takeover();
+
+            const authUri = await internals.resolveProviderUri(request, settings.provider.auth);
+            return h.redirect(authUri + '?' + internals.queryString(query)).takeover();
         }
 
         // Authorization callback
@@ -249,7 +258,7 @@ exports.v2 = function (settings) {
             grant_type: 'authorization_code',
             code: request.query.code,
             redirect_uri: internals.location(request, protocol, settings.location),
-            ...internals.resolveProviderParams(request, settings.tokenParams)
+            ...await internals.resolveProviderParams(request, settings.tokenParams)
         };
 
         if (settings.provider.pkce) {
@@ -287,8 +296,9 @@ exports.v2 = function (settings) {
 
         // Obtain token
 
+        const tokenUri = await internals.resolveProviderUri(request, settings.provider.token);
         try {
-            var { res: tokenRes, payload } = await Wreck.post(settings.provider.token, requestOptions);
+            var { res: tokenRes, payload } = await Wreck.post(tokenUri, requestOptions);
         }
         catch (err) {
             return h.unauthenticated(Boom.internal('Failed obtaining ' + name + ' access token', err), { credentials });
@@ -358,7 +368,7 @@ exports.v2 = function (settings) {
         };
 
         try {
-            await settings.provider.profile.call(settings, credentials, payload, get);
+            await settings.provider.profile.call(settings, credentials, payload, get, request);
         }
         catch (err) {
             return h.unauthenticated(err, { credentials });
@@ -727,7 +737,25 @@ internals.getProtocol = function (request, settings) {
 };
 
 
-internals.resolveProviderParams = function (request, params) {
+internals.resolveProviderParams = async function (request, params) {
+
+    return (typeof params === 'function' ? await params(request) : params) ?? {};
+};
+
+
+internals.resolveProviderUri = async function (request, uri) {
+
+    return typeof uri === 'function' ? await uri(request) : uri;
+};
+
+
+internals.client = async function (request, settings) {
+
+    const provider = {
+        ...settings.provider,
+        temporary: await internals.resolveProviderUri(request, settings.provider.temporary),
+        token: await internals.resolveProviderUri(request, settings.provider.token)
+    };
 
-    return (typeof params === 'function' ? params(request) : params) ?? {};
+    return new internals.Client({ ...settings, provider });
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hapi/bell",
   "description": "Third-party login plugin for hapi",
-  "version": "13.1.0",
+  "version": "13.2.0",
   "repository": "git://github.com/hapijs/bell",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -51,21 +51,21 @@
   },
   "dependencies": {
     "@hapi/boom": "^10.0.1",
-    "@hapi/bounce": "^3.0.1",
-    "@hapi/cryptiles": "^6.0.1",
-    "@hapi/hoek": "^11.0.2",
-    "@hapi/wreck": "^18.0.1",
-    "joi": "^17.7.1"
+    "@hapi/bounce": "^3.0.2",
+    "@hapi/cryptiles": "^6.0.3",
+    "@hapi/hoek": "^11.0.7",
+    "@hapi/wreck": "^18.1.2",
+    "joi": "^17.13.7"
   },
   "devDependencies": {
     "@hapi/code": "^9.0.3",
     "@hapi/eslint-plugin": "^6.0.0",
-    "@hapi/hapi": "^21.2.1",
+    "@hapi/hapi": "^21.4.10",
     "@hapi/hawk": "^8.0.0",
-    "@hapi/lab": "^25.0.1",
-    "@hapi/teamwork": "^6.0.0",
-    "@types/node": "^20.11.30",
-    "typescript": "^5.4.2"
+    "@hapi/lab": "^25.3.2",
+    "@hapi/teamwork": "^6.0.1",
+    "@types/node": "^20.19.43",
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "test": "lab -a @hapi/code -t 100 -L -m 3000 -Y",