@inrupt/solid-client-authn-browser 1.11.9-alpha.1 → 1.11.9-alpha.4

package/dist/index.js

@@ -3,7 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var solidClientAuthnCore = require('@inrupt/solid-client-authn-core');
-var oidcClient = require('@inrupt/oidc-client');
+var uuid = require('uuid');
+var oidcClientExt = require('@inrupt/oidc-client-ext');
 
 var domain;
 
@@ -477,362 +478,12 @@ function unwrapListeners(arr) {
   return ret;
 }
 
-// Unique ID creation requires a high quality random # generator. In the browser we therefore
-// require the crypto API and do not support built-in fallback to lower quality random number
-// generators (like Math.random()).
-var getRandomValues;
-var rnds8 = new Uint8Array(16);
-function rng() {
-  // lazy load so that environments that need to polyfill have a chance to do so
-  if (!getRandomValues) {
-    // getRandomValues needs to be invoked in a context where "this" is a Crypto implementation. Also,
-    // find the complete implementation of crypto (msCrypto) on IE11.
-    getRandomValues = typeof crypto !== 'undefined' && crypto.getRandomValues && crypto.getRandomValues.bind(crypto) || typeof msCrypto !== 'undefined' && typeof msCrypto.getRandomValues === 'function' && msCrypto.getRandomValues.bind(msCrypto);
-
-    if (!getRandomValues) {
-      throw new Error('crypto.getRandomValues() not supported. See https://github.com/uuidjs/uuid#getrandomvalues-not-supported');
-    }
-  }
-
-  return getRandomValues(rnds8);
-}
-
-var REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000)$/i;
-
-function validate(uuid) {
-  return typeof uuid === 'string' && REGEX.test(uuid);
-}
-
-/**
- * Convert array of 16 byte values to UUID string format of the form:
- * XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
- */
-
-var byteToHex = [];
-
-for (var i = 0; i < 256; ++i) {
-  byteToHex.push((i + 0x100).toString(16).substr(1));
-}
-
-function stringify(arr) {
-  var offset = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
-  // Note: Be careful editing this code!  It's been tuned for performance
-  // and works in ways you may not expect. See https://github.com/uuidjs/uuid/pull/434
-  var uuid = (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + '-' + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + '-' + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + '-' + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + '-' + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase(); // Consistency check for valid UUID.  If this throws, it's likely due to one
-  // of the following:
-  // - One or more input array values don't map to a hex octet (leading to
-  // "undefined" in the uuid)
-  // - Invalid input values for the RFC `version` or `variant` fields
-
-  if (!validate(uuid)) {
-    throw TypeError('Stringified UUID is invalid');
-  }
-
-  return uuid;
-}
-
-function v4(options, buf, offset) {
-  options = options || {};
-  var rnds = options.random || (options.rng || rng)(); // Per 4.4, set bits for version and `clock_seq_hi_and_reserved`
-
-  rnds[6] = rnds[6] & 0x0f | 0x40;
-  rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
-
-  if (buf) {
-    offset = offset || 0;
-
-    for (var i = 0; i < 16; ++i) {
-      buf[offset + i] = rnds[i];
-    }
-
-    return buf;
-  }
-
-  return stringify(rnds);
-}
-
 class StorageUtilityBrowser extends solidClientAuthnCore.StorageUtility {
     constructor(secureStorage, insecureStorage) {
         super(secureStorage, insecureStorage);
     }
 }
 
-function processErrorResponse(responseBody, options) {
-    var _a, _b, _c, _d;
-    if (responseBody.error === "invalid_redirect_uri") {
-        throw new Error(`Dynamic client registration failed: the provided redirect uri [${(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()}] is invalid - ${(_b = responseBody.error_description) !== null && _b !== void 0 ? _b : ""}`);
-    }
-    if (responseBody.error === "invalid_client_metadata") {
-        throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${(_c = responseBody.error_description) !== null && _c !== void 0 ? _c : ""}`);
-    }
-    throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${(_d = responseBody.error_description) !== null && _d !== void 0 ? _d : ""}`);
-}
-function validateRegistrationResponse(responseBody, options) {
-    if (responseBody.client_id === undefined) {
-        throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);
-    }
-    if (options.redirectUrl &&
-        (responseBody.redirect_uris === undefined ||
-            responseBody.redirect_uris[0] !== options.redirectUrl.toString())) {
-        throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([
-            options.redirectUrl.toString(),
-        ])}`);
-    }
-}
-async function registerClient(options, issuerConfig) {
-    var _a;
-    if (!issuerConfig.registrationEndpoint) {
-        throw new Error("Dynamic Registration could not be completed because the issuer has no registration endpoint.");
-    }
-    if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {
-        throw new Error("The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.");
-    }
-    const signingAlg = solidClientAuthnCore.determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, solidClientAuthnCore.PREFERRED_SIGNING_ALG);
-    const config = {
-        client_name: options.clientName,
-        application_type: "web",
-        redirect_uris: [(_a = options.redirectUrl) === null || _a === void 0 ? void 0 : _a.toString()],
-        subject_type: "public",
-        token_endpoint_auth_method: "client_secret_basic",
-        id_token_signed_response_alg: signingAlg,
-        grant_types: ["authorization_code", "refresh_token"],
-    };
-    const headers = {
-        "Content-Type": "application/json",
-    };
-    if (options.registrationAccessToken) {
-        headers.Authorization = `Bearer ${options.registrationAccessToken}`;
-    }
-    const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {
-        method: "POST",
-        headers,
-        body: JSON.stringify(config),
-    });
-    if (registerResponse.ok) {
-        const responseBody = await registerResponse.json();
-        validateRegistrationResponse(responseBody, options);
-        return {
-            clientId: responseBody.client_id,
-            clientSecret: responseBody.client_secret,
-            idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,
-            clientType: "dynamic",
-        };
-    }
-    if (registerResponse.status === 400) {
-        processErrorResponse(await registerResponse.json(), options);
-    }
-    throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);
-}
-
-function hasError(value) {
-    return value.error !== undefined && typeof value.error === "string";
-}
-function hasErrorDescription(value) {
-    return (value.error_description !== undefined &&
-        typeof value.error_description === "string");
-}
-function hasErrorUri(value) {
-    return value.error_uri !== undefined && typeof value.error_uri === "string";
-}
-function hasAccessToken(value) {
-    return (value.access_token !== undefined && typeof value.access_token === "string");
-}
-function hasIdToken(value) {
-    return value.id_token !== undefined && typeof value.id_token === "string";
-}
-function hasRefreshToken(value) {
-    return (value.refresh_token !== undefined && typeof value.refresh_token === "string");
-}
-function hasTokenType(value) {
-    return value.token_type !== undefined && typeof value.token_type === "string";
-}
-function hasExpiresIn(value) {
-    return value.expires_in === undefined || typeof value.expires_in === "number";
-}
-function validatePreconditions(issuer, data) {
-    if (data.grantType &&
-        (!issuer.grantTypesSupported ||
-            !issuer.grantTypesSupported.includes(data.grantType))) {
-        throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);
-    }
-    if (!issuer.tokenEndpoint) {
-        throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);
-    }
-}
-function validateTokenEndpointResponse(tokenResponse, dpop) {
-    if (hasError(tokenResponse)) {
-        throw new solidClientAuthnCore.OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)
-            ? `: ${tokenResponse.error_description}`
-            : ""}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : ""}`, tokenResponse.error, hasErrorDescription(tokenResponse)
-            ? tokenResponse.error_description
-            : undefined);
-    }
-    if (!hasAccessToken(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["access_token"]);
-    }
-    if (!hasIdToken(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["id_token"]);
-    }
-    if (!hasTokenType(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["token_type"]);
-    }
-    if (!hasExpiresIn(tokenResponse)) {
-        throw new solidClientAuthnCore.InvalidResponseError(["expires_in"]);
-    }
-    if (!dpop && tokenResponse.token_type.toLowerCase() !== "bearer") {
-        throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);
-    }
-    return tokenResponse;
-}
-async function getTokens(issuer, client, data, dpop) {
-    validatePreconditions(issuer, data);
-    const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-    };
-    let dpopKey;
-    if (dpop) {
-        dpopKey = await solidClientAuthnCore.generateDpopKeyPair();
-        headers.DPoP = await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey);
-    }
-    if (client.clientSecret) {
-        headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;
-    }
-    const requestBody = {
-        grant_type: data.grantType,
-        redirect_uri: data.redirectUrl,
-        code: data.code,
-        code_verifier: data.codeVerifier,
-        client_id: client.clientId,
-    };
-    const tokenRequestInit = {
-        method: "POST",
-        headers,
-        body: new URLSearchParams(requestBody).toString(),
-    };
-    const rawTokenResponse = await await fetch(issuer.tokenEndpoint, tokenRequestInit);
-    const jsonTokenResponse = (await rawTokenResponse.json());
-    const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);
-    const webId = await solidClientAuthnCore.getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: tokenResponse.access_token,
-        idToken: tokenResponse.id_token,
-        refreshToken: hasRefreshToken(tokenResponse)
-            ? tokenResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: tokenResponse.expires_in,
-    };
-}
-async function getBearerToken(redirectUrl) {
-    let signinResponse;
-    try {
-        const client = new oidcClient.OidcClient({
-            response_mode: "query",
-            loadUserInfo: false,
-        });
-        signinResponse = await client.processSigninResponse(redirectUrl);
-        if (client.settings.metadata === undefined) {
-            throw new Error("Cannot retrieve issuer metadata from client information in storage.");
-        }
-        if (client.settings.metadata.jwks_uri === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'jwks_uri' is undefined");
-        }
-        if (client.settings.metadata.issuer === undefined) {
-            throw new Error("Missing some issuer metadata from client information in storage: 'issuer' is undefined");
-        }
-        if (client.settings.client_id === undefined) {
-            throw new Error("Missing some client information in storage: 'client_id' is undefined");
-        }
-        const webId = await solidClientAuthnCore.getWebidFromTokenPayload(signinResponse.id_token, client.settings.metadata.jwks_uri, client.settings.metadata.issuer, client.settings.client_id);
-        return {
-            accessToken: signinResponse.access_token,
-            idToken: signinResponse.id_token,
-            webId,
-            refreshToken: signinResponse.refresh_token,
-        };
-    }
-    catch (err) {
-        throw new Error(`Problem handling Auth Code Grant (Flow) redirect - URL [${redirectUrl}]: ${err}`);
-    }
-}
-async function getDpopToken(issuer, client, data) {
-    return getTokens(issuer, client, data, true);
-}
-
-async function refresh(refreshToken, issuer, client, dpopKey) {
-    const requestBody = {
-        grant_type: "refresh_token",
-        refresh_token: refreshToken,
-        scope: "openid offline_access",
-    };
-    let dpopHeader = {};
-    if (dpopKey !== undefined) {
-        dpopHeader = {
-            DPoP: await solidClientAuthnCore.createDpopHeader(issuer.tokenEndpoint, "POST", dpopKey),
-        };
-    }
-    let authHeader = {};
-    if (client.clientSecret !== undefined) {
-        authHeader = {
-            Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,
-        };
-    }
-    const rawResponse = await fetch(issuer.tokenEndpoint, {
-        method: "POST",
-        body: new URLSearchParams(requestBody).toString(),
-        headers: {
-            ...dpopHeader,
-            ...authHeader,
-            "Content-Type": "application/x-www-form-urlencoded",
-        },
-    });
-    let response;
-    try {
-        response = await rawResponse.json();
-    }
-    catch (e) {
-        throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);
-    }
-    const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);
-    const webId = await solidClientAuthnCore.getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);
-    return {
-        accessToken: validatedResponse.access_token,
-        idToken: validatedResponse.id_token,
-        refreshToken: typeof validatedResponse.refresh_token === "string"
-            ? validatedResponse.refresh_token
-            : undefined,
-        webId,
-        dpopKey,
-        expiresIn: validatedResponse.expires_in,
-    };
-}
-
-function removeOidcQueryParam(redirectUrl) {
-    const cleanedUrl = new URL(redirectUrl);
-    cleanedUrl.searchParams.delete("code");
-    cleanedUrl.searchParams.delete("state");
-    cleanedUrl.hash = "";
-    return cleanedUrl.toString();
-}
-async function clearOidcPersistentStorage() {
-    const client = new oidcClient.OidcClient({
-        response_mode: "query",
-    });
-    await client.clearStaleState(new oidcClient.WebStorageStateStore({}));
-    const myStorage = window.localStorage;
-    const itemsToRemove = [];
-    for (let i = 0; i <= myStorage.length; i += 1) {
-        const key = myStorage.key(i);
-        if (key &&
-            (key.match(/^oidc\..+$/) ||
-                key.match(/^solidClientAuthenticationUser:.+$/))) {
-            itemsToRemove.push(key);
-        }
-    }
-    itemsToRemove.forEach((key) => myStorage.removeItem(key));
-}
-
 const globalFetch = (request, init) => window.fetch(request, init);
 class ClientAuthentication {
     constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {
@@ -844,7 +495,7 @@ class ClientAuthentication {
         this.login = async (options, eventEmitter) => {
             var _a, _b;
             await this.sessionInfoManager.clear(options.sessionId);
-            const redirectUrl = removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
+            const redirectUrl = oidcClientExt.removeOidcQueryParam((_a = options.redirectUrl) !== null && _a !== void 0 ? _a : window.location.href);
             await this.loginHandler.handle({
                 ...options,
                 redirectUrl,
@@ -962,7 +613,7 @@ class AuthorizationCodeWithPkceOidcHandler {
             code_verifier: true,
             prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
         };
-        const oidcClientLibrary = new oidcClient.OidcClient(oidcOptions);
+        const oidcClientLibrary = new oidcClientExt.OidcClient(oidcOptions);
         const { redirector } = this;
         const storage = this.storageUtility;
         try {
@@ -1118,7 +769,7 @@ class IssuerConfigFetcher {
 function getUnauthenticatedSession() {
     return {
         isLoggedIn: false,
-        sessionId: v4(),
+        sessionId: uuid.v4(),
         fetch,
     };
 }
@@ -1128,7 +779,7 @@ async function clear(sessionId, storage) {
         storage.deleteAllUserData(sessionId, { secure: true }),
         storage.delete("clientKey", { secure: false }),
     ]);
-    await clearOidcPersistentStorage();
+    await oidcClientExt.clearOidcPersistentStorage();
 }
 class SessionInfoManager {
     constructor(storageUtility) {
@@ -1266,7 +917,7 @@ class AuthCodeRedirectHandler {
         let tokens;
         const tokenCreatedAt = Date.now();
         if (isDpop) {
-            tokens = await getDpopToken(issuerConfig, client, {
+            tokens = await oidcClientExt.getDpopToken(issuerConfig, client, {
                 grantType: "authorization_code",
                 code: url.searchParams.get("code"),
                 codeVerifier,
@@ -1275,7 +926,7 @@ class AuthCodeRedirectHandler {
             window.localStorage.removeItem(`oidc.${oauthState}`);
         }
         else {
-            tokens = await getBearerToken(url.toString());
+            tokens = await oidcClientExt.getBearerToken(url.toString());
         }
         let refreshOptions;
         if (tokens.refreshToken !== undefined) {
@@ -1414,7 +1065,7 @@ class ClientRegistrar {
         extendedOptions.registrationAccessToken =
             (_a = extendedOptions.registrationAccessToken) !== null && _a !== void 0 ? _a : (await this.storageUtility.getForUser(options.sessionId, "registrationAccessToken"));
         try {
-            const registeredClient = await registerClient(extendedOptions, issuerConfig);
+            const registeredClient = await oidcClientExt.registerClient(extendedOptions, issuerConfig);
             const infoToSave = {
                 clientId: registeredClient.clientId,
             };
@@ -1471,7 +1122,7 @@ class TokenRefresher {
         if (oidcContext.dpop && dpopKey === undefined) {
             throw new Error(`For session [${sessionId}], the key bound to the DPoP access token must be provided to refresh said access token.`);
         }
-        const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
+        const tokenSet = await oidcClientExt.refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
         if (tokenSet.refreshToken !== undefined) {
             eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(solidClientAuthnCore.EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
             await this.storageUtility.setForUser(sessionId, {
@@ -1612,7 +1263,7 @@ class Session extends EventEmitter {
         }
         else {
             this.info = {
-                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : uuid.v4(),
                 isLoggedIn: false,
             };
         }
@@ -1715,3 +1366,4 @@ exports.logout = logout;
 exports.onLogin = onLogin;
 exports.onLogout = onLogout;
 exports.onSessionRestore = onSessionRestore;
+//# sourceMappingURL=index.js.map