@inrupt/solid-client-authn-browser 1.11.9-alpha.0 → 1.11.9-alpha.3

package/dist/solid-client-authn.bundle.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@inrupt/solid-client-authn-core'), require('@inrupt/oidc-client')) :
-  typeof define === 'function' && define.amd ? define(['exports', '@inrupt/solid-client-authn-core', '@inrupt/oidc-client'], factory) :
-  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.solidClientAuthentication = {}, global.solidClientAuthnCore, global.oidcClient));
-})(this, (function (exports, solidClientAuthnCore, oidcClient) { 'use strict';
+  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@inrupt/solid-client-authn-core'), require('uuid'), require('@inrupt/oidc-client-ext')) :
+  typeof define === 'function' && define.amd ? define(['exports', '@inrupt/solid-client-authn-core', 'uuid', '@inrupt/oidc-client-ext'], factory) :
+  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.solidClientAuthentication = {}, global.solidClientAuthnCore, global.uuid, global.oidcClientExt));
+})(this, (function (exports, solidClientAuthnCore, uuid, oidcClientExt) { 'use strict';
 
   var domain;
 
@@ -476,362 +476,12 @@
     return ret;
   }
 
-  // Unique ID creation requires a high quality random # generator. In the browser we therefore
-  // require the crypto API and do not support built-in fallback to lower quality random number
-  // generators (like Math.random()).
-  var getRandomValues;
-  var rnds8 = new Uint8Array(16);
-  function rng() {
-    // lazy load so that environments that need to polyfill have a chance to do so
-    if (!getRandomValues) {
-      // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
-      // find the complete implementation of crypto (msCrypto) on IE11.
-      getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
-
-      if (!getRandomValues) {
-        throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
-      }
-    }
-
-    return getRandomValues(rnds8);
-  }
-
-  var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-
-  function validate(uuid) {
-    return typeof uuid === 'string' && REGEX.test(uuid);
-  }
-
-  /**
-   * Convert array of 16 byte values to UUID string format of the form:
-   * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
-   */
-
-  var byteToHex = [];
-
-  for (var i = 0; i < 256; ++i) {
-    byteToHex.push((i + 0x100).toString(16).substr(1));
-  }
-
-  function stringify(arr) {
-    var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
-    // Note: Be careful editing this code!  It's been tuned for performance
-    // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
-    var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
-    // of the following:
-    // - One or more input array values don't map to a hex octet (leading to
-    // "undefined" in the uuid)
-    // - Invalid input values for the RFC `version` or `variant` fields
-
-    if (!validate(uuid)) {
-      throw TypeError('Stringified UUID is invalid');
-    }
-
-    return uuid;
-  }
-
-  function v4(options, buf, offset) {
-    options = options || {};
-    var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
-
-    rnds[6] = rnds[6] & 0x0f | 0x40;
-    rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
-
-    if (buf) {
-      offset = offset || 0;
-
-      for (var i = 0; i < 16; ++i) {
-        buf[offset + i] = rnds[i];
-      }
-
-      return buf;
-    }
-
-    return stringify(rnds);
-  }
-
   class StorageUtilityBrowser extends solidClientAuthnCore.StorageUtility {
       constructor(secureStorage, insecureStorage) {
           super(secureStorage, insecureStorage);
       }
   }
 
-  function processErrorResponse(responseBody, options) {
-      var _a, _b, _c, _d;
-      if (responseBody.error === "invalid_redirect_uri") {
-          throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
-      }
-      if (responseBody.error === "invalid_client_metadata") {
-          throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
-      }
-      throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
-  }
-  function validateRegistrationResponse(responseBody, options) {
-      if (responseBody.client_id === undefined) {
-          throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
-      }
-      if (options.redirectUrl &&
-          (responseBody.redirect_uris === undefined ||
-              responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
-          throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
-            options.redirectUrl.toString(),
-        ])}`);
-      }
-  }
-  async function registerClient(options, issuerConfig) {
-      var _a;
-      if (!issuerConfig.registrationEndpoint) {
-          throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
-      }
-      if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
-          throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
-      }
-      const signingAlg = solidClientAuthnCore.determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, solidClientAuthnCore.PREFERRED_SIGNING_ALG);
-      const config = {
-          client_name: options.clientName,
-          application_type: "web",
-          redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
-          subject_type: "public",
-          token_endpoint_auth_method: "client_secret_basic",
-          id_token_signed_response_alg: signingAlg,
-          grant_types: ["authorization_code", "refresh_token"],
-      };
-      const headers = {
-          "Content-Type": "application/json",
-      };
-      if (options.registrationAccessToken) {
-          headers.Authorization = `Bearer ${options.registrationAccessToken}`;
-      }
-      const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
-          method: "POST",
-          headers,
-          body: JSON.stringify(config),
-      });
-      if (registerResponse.ok) {
-          const responseBody = await registerResponse.json();
-          validateRegistrationResponse(responseBody, options);
-          return {
-              clientId: responseBody.client_id,
-              clientSecret: responseBody.client_secret,
-              idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
-              clientType: "dynamic",
-          };
-      }
-      if (registerResponse.status === 400) {
-          processErrorResponse(await registerResponse.json(), options);
-      }
-      throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
-  }
-
-  function hasError(value) {
-      return value.error !== undefined && typeof value.error === "string";
-  }
-  function hasErrorDescription(value) {
-      return (value.error_description !== undefined &&
-          typeof value.error_description === "string");
-  }
-  function hasErrorUri(value) {
-      return value.error_uri !== undefined && typeof value.error_uri === "string";
-  }
-  function hasAccessToken(value) {
-      return (value.access_token !== undefined && typeof value.access_token === "string");
-  }
-  function hasIdToken(value) {
-      return value.id_token !== undefined && typeof value.id_token === "string";
-  }
-  function hasRefreshToken(value) {
-      return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
-  }
-  function hasTokenType(value) {
-      return value.token_type !== undefined && typeof value.token_type === "string";
-  }
-  function hasExpiresIn(value) {
-      return value.expires_in === undefined || typeof value.expires_in === "number";
-  }
-  function validatePreconditions(issuer, data) {
-      if (data.grantType &&
-          (!issuer.grantTypesSupported ||
-              !issuer.grantTypesSupported.includes(data.grantType))) {
-          throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
-      }
-      if (!issuer.tokenEndpoint) {
-          throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
-      }
-  }
-  function validateTokenEndpointResponse(tokenResponse, dpop) {
-      if (hasError(tokenResponse)) {
-          throw new solidClientAuthnCore.OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
-            ? `: ${tokenResponse.error_description}`
-            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
-              ? tokenResponse.error_description
-              : undefined);
-      }
-      if (!hasAccessToken(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["access_token"]);
-      }
-      if (!hasIdToken(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["id_token"]);
-      }
-      if (!hasTokenType(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["token_type"]);
-      }
-      if (!hasExpiresIn(tokenResponse)) {
-          throw new solidClientAuthnCore.InvalidResponseError(["expires_in"]);
-      }
-      if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
-          throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
-      }
-      return tokenResponse;
-  }
-  async function getTokens(issuer, client, data, dpop) {
-      validatePreconditions(issuer, data);
-      const headers = {
-          "content-type": "application/x-www-form-urlencoded",
-      };
-      let dpopKey;
-      if (dpop) {
-          dpopKey = await solidClientAuthnCore.generateDpopKeyPair();
-          headers.DPoP = await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
-      }
-      if (client.clientSecret) {
-          headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
-      }
-      const requestBody = {
-          grant_type: data.grantType,
-          redirect_uri: data.redirectUrl,
-          code: data.code,
-          code_verifier: data.codeVerifier,
-          client_id: client.clientId,
-      };
-      const tokenRequestInit = {
-          method: "POST",
-          headers,
-          body: new URLSearchParams(requestBody).toString(),
-      };
-      const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
-      const jsonTokenResponse = (await rawTokenResponse.json());
-      const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
-      const webId = await solidClientAuthnCore.getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-      return {
-          accessToken: tokenResponse.access_token,
-          idToken: tokenResponse.id_token,
-          refreshToken: hasRefreshToken(tokenResponse)
-              ? tokenResponse.refresh_token
-              : undefined,
-          webId,
-          dpopKey,
-          expiresIn: tokenResponse.expires_in,
-      };
-  }
-  async function getBearerToken(redirectUrl) {
-      let signinResponse;
-      try {
-          const client = new oidcClient.OidcClient({
-              response_mode: "query",
-              loadUserInfo: false,
-          });
-          signinResponse = await client.processSigninResponse(redirectUrl);
-          if (client.settings.metadata === undefined) {
-              throw new Error("Cannot retrieve issuer metadata from client information in storage.");
-          }
-          if (client.settings.metadata.jwks_uri === undefined) {
-              throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
-          }
-          if (client.settings.metadata.issuer === undefined) {
-              throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
-          }
-          if (client.settings.client_id === undefined) {
-              throw new Error("Missing some client information in storage: 'client_id' is undefined");
-          }
-          const webId = await solidClientAuthnCore.getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
-          return {
-              accessToken: signinResponse.access_token,
-              idToken: signinResponse.id_token,
-              webId,
-              refreshToken: signinResponse.refresh_token,
-          };
-      }
-      catch (err) {
-          throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
-      }
-  }
-  async function getDpopToken(issuer, client, data) {
-      return getTokens(issuer, client, data, true);
-  }
-
-  async function refresh(refreshToken, issuer, client, dpopKey) {
-      const requestBody = {
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          scope: "openid offline_access",
-      };
-      let dpopHeader = {};
-      if (dpopKey !== undefined) {
-          dpopHeader = {
-              DPoP: await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
-          };
-      }
-      let authHeader = {};
-      if (client.clientSecret !== undefined) {
-          authHeader = {
-              Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
-          };
-      }
-      const rawResponse = await fetch(issuer.tokenEndpoint, {
-          method: "POST",
-          body: new URLSearchParams(requestBody).toString(),
-          headers: {
-              ...dpopHeader,
-              ...authHeader,
-              "Content-Type": "application/x-www-form-urlencoded",
-          },
-      });
-      let response;
-      try {
-          response = await rawResponse.json();
-      }
-      catch (e) {
-          throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
-      }
-      const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
-      const webId = await solidClientAuthnCore.getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-      return {
-          accessToken: validatedResponse.access_token,
-          idToken: validatedResponse.id_token,
-          refreshToken: typeof validatedResponse.refresh_token === "string"
-              ? validatedResponse.refresh_token
-              : undefined,
-          webId,
-          dpopKey,
-          expiresIn: validatedResponse.expires_in,
-      };
-  }
-
-  function removeOidcQueryParam(redirectUrl) {
-      const cleanedUrl = new URL(redirectUrl);
-      cleanedUrl.searchParams.delete("code");
-      cleanedUrl.searchParams.delete("state");
-      cleanedUrl.hash = "";
-      return cleanedUrl.toString();
-  }
-  async function clearOidcPersistentStorage() {
-      const client = new oidcClient.OidcClient({
-          response_mode: "query",
-      });
-      await client.clearStaleState(new oidcClient.WebStorageStateStore({}));
-      const myStorage = window.localStorage;
-      const itemsToRemove = [];
-      for (let i = 0; i <= myStorage.length; i += 1) {
-          const key = myStorage.key(i);
-          if (key &&
-              (key.match(/^oidc\..+$/) ||
-                  key.match(/^solidClientAuthenticationUser:.+$/))) {
-              itemsToRemove.push(key);
-          }
-      }
-      itemsToRemove.forEach((key) => myStorage.removeItem(key));
-  }
-
   const globalFetch = (request, init) => window.fetch(request, init);
   class ClientAuthentication {
       constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
@@ -843,7 +493,7 @@
           this.login = async (options, eventEmitter) => {
               var _a, _b;
               await this.sessionInfoManager.clear(options.sessionId);
-              const redirectUrl = removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
+              const redirectUrl = oidcClientExt.removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
               await this.loginHandler.handle({
                   ...options,
                   redirectUrl,
@@ -961,7 +611,7 @@
               code_verifier: true,
               prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
           };
-          const oidcClientLibrary = new oidcClient.OidcClient(oidcOptions);
+          const oidcClientLibrary = new oidcClientExt.OidcClient(oidcOptions);
           const { redirector } = this;
           const storage = this.storageUtility;
           try {
@@ -1117,7 +767,7 @@
   function getUnauthenticatedSession() {
       return {
           isLoggedIn: false,
-          sessionId: v4(),
+          sessionId: uuid.v4(),
           fetch,
       };
   }
@@ -1127,7 +777,7 @@
           storage.deleteAllUserData(sessionId, { secure: true }),
           storage.delete("clientKey", { secure: false }),
       ]);
-      await clearOidcPersistentStorage();
+      await oidcClientExt.clearOidcPersistentStorage();
   }
   class SessionInfoManager {
       constructor(storageUtility) {
@@ -1265,7 +915,7 @@
           let tokens;
           const tokenCreatedAt = Date.now();
           if (isDpop) {
-              tokens = await getDpopToken(issuerConfig, client, {
+              tokens = await oidcClientExt.getDpopToken(issuerConfig, client, {
                   grantType: "authorization_code",
                   code: url.searchParams.get("code"),
                   codeVerifier,
@@ -1274,7 +924,7 @@
               window.localStorage.removeItem(`oidc.${oauthState}`);
           }
           else {
-              tokens = await getBearerToken(url.toString());
+              tokens = await oidcClientExt.getBearerToken(url.toString());
           }
           let refreshOptions;
           if (tokens.refreshToken !== undefined) {
@@ -1413,7 +1063,7 @@
           extendedOptions.registrationAccessToken =
               (_a = extendedOptions.registrationAccessToken) !== null && _a !== void 0 ? _a : (await this.storageUtility.getForUser(options.sessionId, "registrationAccessToken"));
           try {
-              const registeredClient = await registerClient(extendedOptions, issuerConfig);
+              const registeredClient = await oidcClientExt.registerClient(extendedOptions, issuerConfig);
               const infoToSave = {
                   clientId: registeredClient.clientId,
               };
@@ -1470,7 +1120,7 @@
           if (oidcContext.dpop && dpopKey === undefined) {
               throw new Error(`For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`);
           }
-          const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
+          const tokenSet = await oidcClientExt.refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
           if (tokenSet.refreshToken !== undefined) {
               eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(solidClientAuthnCore.EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
               await this.storageUtility.setForUser(sessionId, {
@@ -1611,7 +1261,7 @@
           }
           else {
               this.info = {
-                  sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                  sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : uuid.v4(),
                   isLoggedIn: false,
               };
           }
@@ -1718,3 +1368,4 @@
   Object.defineProperty(exports, '__esModule', { value: true });
 
 }));
+//# sourceMappingURL=solid-client-authn.bundle.js.map