@inrupt/solid-client-authn-browser 1.17.1 → 1.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -25,19 +25,19 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "devDependencies": {
-    "@types/node": "^20.1.0",
+    "@types/node": "^20.6.0",
     "@types/uuid": "^9.0.1"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.17.1",
-    "@inrupt/solid-client-authn-core": "^1.17.1",
+    "@inrupt/oidc-client-ext": "^1.17.2",
+    "@inrupt/solid-client-authn-core": "^1.17.2",
     "@inrupt/universal-fetch": "^1.0.2",
     "events": "^3.3.0",
-    "jose": "^4.3.7",
+    "jose": "^4.14.6",
     "uuid": "^9.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "0c27ce0ae0da67838526a538adc78b2f96f9b96b"
+  "gitHead": "5818a79b875812ca93235fca64c65d2ba5b59fc3"
 }

package/rollup.config.mjs

@@ -7,7 +7,7 @@ import { createRequire } from "node:module";
 import { nodeResolve } from '@rollup/plugin-node-resolve';
 import commonjs from '@rollup/plugin-commonjs';
 import terser from '@rollup/plugin-terser';
-import createConfig, { createSharedConfig } from '../../rollup.common.mjs';
+import createConfig, { createSharedConfig } from '@inrupt/base-rollup-config';
 
 const require = createRequire(import.meta.url);
 const pkg = require("./package.json");

package/src/ClientAuthentication.spec.ts

@@ -50,7 +50,7 @@ import { mockDefaultIssuerConfigFetcher } from "./login/oidc/__mocks__/IssuerCon
 
 jest.mock("@inrupt/universal-fetch", () => {
   const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch"
+    "@inrupt/universal-fetch",
   ) as typeof UniversalFetch;
   return {
     ...fetchModule,
@@ -60,7 +60,7 @@ jest.mock("@inrupt/universal-fetch", () => {
 
 jest.mock("@inrupt/solid-client-authn-core", () => {
   const actualCoreModule = jest.requireActual(
-    "@inrupt/solid-client-authn-core"
+    "@inrupt/solid-client-authn-core",
   ) as typeof SolidClientAuthnCore;
   return {
     ...actualCoreModule,
@@ -78,7 +78,7 @@ const mockSessionStorage = async (
   options: SessionStorageOptions = {
     clientId: "https://some.app/registration",
     issuer: "https://some.issuer",
-  }
+  },
 ): Promise<StorageUtility> => {
   return new StorageUtility(
     mockStorage({
@@ -92,7 +92,7 @@ const mockSessionStorage = async (
         clientId: options.clientId,
         issuer: options.issuer,
       },
-    })
+    }),
   );
 };
 
@@ -107,14 +107,14 @@ describe("ClientAuthentication", () => {
   };
 
   function getClientAuthentication(
-    mocks: Partial<typeof defaultMocks> = defaultMocks
+    mocks: Partial<typeof defaultMocks> = defaultMocks,
   ): ClientAuthentication {
     return new ClientAuthentication(
       mocks.loginHandler ?? defaultMocks.loginHandler,
       mocks.redirectHandler ?? defaultMocks.redirectHandler,
       mocks.logoutHandler ?? defaultMocks.logoutHandler,
       mocks.sessionInfoManager ?? defaultMocks.sessionInfoManager,
-      mocks.issuerConfigFetcher ?? defaultMocks.issuerConfigFetcher
+      mocks.issuerConfigFetcher ?? defaultMocks.issuerConfigFetcher,
     );
   }
 
@@ -144,7 +144,7 @@ describe("ClientAuthentication", () => {
           clientId: "coolApp",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -167,7 +167,7 @@ describe("ClientAuthentication", () => {
           redirectUrl: "https://coolapp.com/redirect",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -192,7 +192,7 @@ describe("ClientAuthentication", () => {
           oidcIssuer: "https://idp.com",
           tokenType: "Bearer",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -214,7 +214,7 @@ describe("ClientAuthentication", () => {
       await nonEmptyStorage.setForUser(
         "someUser",
         { someKey: "someValue" },
-        { secure: true }
+        { secure: true },
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(nonEmptyStorage),
@@ -228,17 +228,17 @@ describe("ClientAuthentication", () => {
           redirectUrl: "https://coolapp.com/redirect",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       await expect(
-        nonEmptyStorage.getForUser("someUser", "someKey", { secure: true })
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: true }),
       ).resolves.toBeUndefined();
       await expect(
-        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false })
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false }),
       ).resolves.toBeUndefined();
       // This test is only necessary until the key is stored safely
       await expect(
-        nonEmptyStorage.get("clientKey", { secure: false })
+        nonEmptyStorage.get("clientKey", { secure: false }),
       ).resolves.toBeUndefined();
     });
 
@@ -253,8 +253,8 @@ describe("ClientAuthentication", () => {
             redirectUrl: "not a valid URL",
             oidcIssuer: "https://idp.com",
           },
-          mockEmitter
-        )
+          mockEmitter,
+        ),
       ).rejects.toThrow();
     });
 
@@ -269,11 +269,39 @@ describe("ClientAuthentication", () => {
             redirectUrl: "https://example.org/redirect#some-fragment",
             oidcIssuer: "https://idp.com",
           },
-          mockEmitter
-        )
+          mockEmitter,
+        ),
       ).rejects.toThrow("hash fragment");
     });
 
+    it("throws if the redirect IRI contains a reserved query parameter, with a helpful message", async () => {
+      const clientAuthn = getClientAuthentication();
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "https://example.org/redirect?state=1234",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter,
+        ),
+      ).rejects.toThrow("query parameter");
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "https://example.org/redirect?code=1234",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter,
+        ),
+      ).rejects.toThrow("query parameter");
+    });
+
     it("does not normalize the redirect URL if provided by the user", async () => {
       const clientAuthn = getClientAuthentication();
       await clientAuthn.login(
@@ -285,12 +313,12 @@ describe("ClientAuthentication", () => {
           oidcIssuer: "https://idp.com",
           tokenType: "Bearer",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith(
         expect.objectContaining({
           redirectUrl: "https://example.org",
-        })
+        }),
       );
     });
   });
@@ -337,7 +365,7 @@ describe("ClientAuthentication", () => {
     it("creates a session for the global user", async () => {
       const clientAuthn = getClientAuthentication();
       await expect(() => clientAuthn.getAllSessionInfo()).rejects.toThrow(
-        "Not implemented"
+        "Not implemented",
       );
     });
   });
@@ -355,8 +383,8 @@ describe("ClientAuthentication", () => {
             {
               "solidClientAuthenticationUser:mySession": { ...sessionInfo },
             },
-            true
-          )
+            true,
+          ),
         ),
       });
       const session = await clientAuthn.getSessionInfo("mySession");
@@ -383,7 +411,7 @@ describe("ClientAuthentication", () => {
         "https://coolapp.com/redirect?state=userId&id_token=idToken&access_token=accessToken";
       const redirectInfo = await clientAuthn.handleIncomingRedirect(
         url,
-        mockEmitter
+        mockEmitter,
       );
 
       // Our injected mocked response may also contain internal-only data (for
@@ -395,11 +423,11 @@ describe("ClientAuthentication", () => {
       expect(redirectInfo?.webId).toEqual(expectedResult.webId);
       expect(redirectInfo?.isLoggedIn).toEqual(expectedResult.isLoggedIn);
       expect(redirectInfo?.expirationDate).toEqual(
-        expectedResult.expirationDate
+        expectedResult.expirationDate,
       );
       expect(defaultMocks.redirectHandler.handle).toHaveBeenCalledWith(
         url,
-        mockEmitter
+        mockEmitter,
       );
 
       // Calling the redirect handler should have updated the fetch.
@@ -418,7 +446,7 @@ describe("ClientAuthentication", () => {
       expect(history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
@@ -428,7 +456,7 @@ describe("ClientAuthentication", () => {
       history.replaceState = jest.fn();
 
       mockHandleIncomingRedirect.mockImplementationOnce(() =>
-        Promise.reject(new Error("Something went wrong"))
+        Promise.reject(new Error("Something went wrong")),
       );
 
       const clientAuthn = getClientAuthentication();
@@ -440,13 +468,13 @@ describe("ClientAuthentication", () => {
       expect(history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
 
       expect(mockEmitter.emit).toHaveBeenCalledWith(
         EVENTS.ERROR,
         "redirect",
-        new Error("Something went wrong")
+        new Error("Something went wrong"),
       );
     });
 
@@ -461,7 +489,7 @@ describe("ClientAuthentication", () => {
       expect(history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
@@ -477,7 +505,7 @@ describe("ClientAuthentication", () => {
       expect(history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect?someQuery=someValue"
+        "https://coolapp.com/redirect?someQuery=someValue",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
@@ -497,14 +525,14 @@ describe("ClientAuthentication", () => {
           [`${USER_SESSION_PREFIX}:${sessionId}`]: {
             clientId: "https://some.app/registration",
           },
-        })
+        }),
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(mockedStorage),
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toBeNull();
     });
 
@@ -519,14 +547,14 @@ describe("ClientAuthentication", () => {
         }),
         mockStorage({
           [`${USER_SESSION_PREFIX}:${sessionId}`]: {},
-        })
+        }),
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(mockedStorage),
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toBeNull();
     });
 
@@ -542,14 +570,14 @@ describe("ClientAuthentication", () => {
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toStrictEqual(
         expect.objectContaining({
           issuer: "https://some.issuer",
           clientAppId: "https://some.app/registration",
           sessionId,
           webId: "https://my.pod/profile#me",
-        })
+        }),
       );
     });
   });

package/src/ClientAuthentication.ts

@@ -45,7 +45,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
   // Isn't Javascript fun?
   login = async (
     options: ILoginOptions,
-    eventEmitter: EventEmitter
+    eventEmitter: EventEmitter,
   ): Promise<void> => {
     // In order to get a clean start, make sure that the session is logged out
     // on login.
@@ -65,7 +65,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       options.redirectUrl ?? removeOidcQueryParam(window.location.href);
     if (!isValidRedirectUrl(redirectUrl)) {
       throw new Error(
-        `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI or it includes a hash fragment.`
+        `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`,
       );
     }
     await this.loginHandler.handle({
@@ -82,7 +82,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
   // Note that the ID token is not stored, which means the session information
   // cannot be validated at this point.
   validateCurrentSession = async (
-    currentSessionId: string
+    currentSessionId: string,
   ): Promise<(ISessionInfo & ISessionInternalInfo) | null> => {
     const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
     if (
@@ -97,7 +97,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
 
   handleIncomingRedirect = async (
     url: string,
-    eventEmitter: EventEmitter
+    eventEmitter: EventEmitter,
   ): Promise<ISessionInfo | undefined> => {
     try {
       const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);