@inrupt/solid-client-authn-browser 1.17.5 → 2.0.0

package/src/login/oidc/ClientRegistrar.spec.ts

@@ -24,7 +24,6 @@ import {
   mockStorageUtility,
 } from "@inrupt/solid-client-authn-core/mocks";
 import { jest, it, describe, expect } from "@jest/globals";
-import { Response as NodeResponse } from "@inrupt/universal-fetch";
 import ClientRegistrar from "./ClientRegistrar";
 import { IssuerConfigFetcherFetchConfigResponse } from "./__mocks__/IssuerConfigFetcher";
 
@@ -47,14 +46,14 @@ describe("ClientRegistrar", () => {
       // actual OIDC provider response.
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "abcd",
             client_secret: "1234",
             redirect_uris: ["https://example.com"],
             id_token_signed_response_alg: "RS256",
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -98,12 +97,12 @@ describe("ClientRegistrar", () => {
     it("can register a public client without secret", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "abcd",
             redirect_uris: ["https://example.com"],
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -144,9 +143,9 @@ describe("ClientRegistrar", () => {
     it("handles a failure to dynamically register elegantly", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse('{"error":"bad stuff that\'s an error"}', {
+        new Response('{"error":"bad stuff that\'s an error"}', {
           status: 400,
-        }) as unknown as Response,
+        }),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -198,13 +197,13 @@ describe("ClientRegistrar", () => {
     it("saves dynamic registration information", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "some id",
             client_secret: "some secret",
             redirect_uris: ["https://example.com"],
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;

package/src/login/oidc/IssuerConfigFetcher.spec.ts

@@ -21,24 +21,22 @@
 
 import { jest, it, describe, expect } from "@jest/globals";
 import { mockStorageUtility } from "@inrupt/solid-client-authn-core";
-import { Response as NodeResponse } from "@inrupt/universal-fetch";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import IssuerConfigFetcher from "./IssuerConfigFetcher";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 /**
  * Test for IssuerConfigFetcher
  */
 describe("IssuerConfigFetcher", () => {
+  let mockFetch: jest.SpiedFunction<typeof fetch>;
+
+  beforeEach(() => {
+    mockFetch = jest.spyOn(globalThis, "fetch");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   const defaultMocks = {
     storageUtility: mockStorageUtility({}),
   };
@@ -55,11 +53,9 @@ describe("IssuerConfigFetcher", () => {
     const configFetcher = getIssuerConfigFetcher({
       storageUtility: mockStorageUtility({}),
     });
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
+
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -83,10 +79,7 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should throw an error if the fetched config could not be converted to JSON", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
-    mockFetch.mockResolvedValueOnce(new NodeResponse("Not JSON."));
+    mockFetch.mockResolvedValueOnce(new Response("Not JSON."));
     const configFetcher = new IssuerConfigFetcher(mockStorageUtility({}));
 
     await expect(configFetcher.fetchConfig("https://some.url")).rejects.toThrow(
@@ -95,11 +88,8 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should return a config including the support for solid-oidc if present in the discovery profile", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -120,11 +110,8 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should return a default value for the supported scopes if not advertized by the OpenID provider", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -143,12 +130,10 @@ describe("IssuerConfigFetcher", () => {
 
   it("should append the .well-known/openid-configuration path at the end of the issuer URL", async () => {
     // The response value is irrelevant to this test.
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
+
     mockFetch.mockImplementation(
       async () =>
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             issuer: "https://example.com",
             // eslint-disable-next-line camelcase

package/src/login/oidc/IssuerConfigFetcher.ts

@@ -33,7 +33,6 @@ import type {
   IStorageUtility,
 } from "@inrupt/solid-client-authn-core";
 import { ConfigurationError } from "@inrupt/solid-client-authn-core";
-import { fetch as uniFetch } from "@inrupt/universal-fetch";
 
 export const WELL_KNOWN_OPENID_CONFIG = ".well-known/openid-configuration";
 
@@ -172,10 +171,7 @@ export default class IssuerConfigFetcher implements IIssuerConfigFetcher {
       // includes the full issuer path. See https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig.
       issuer.endsWith("/") ? issuer : `${issuer}/`,
     ).href;
-    const issuerConfigRequestBody = await uniFetch.call(
-      globalThis,
-      openIdConfigUrl,
-    );
+    const issuerConfigRequestBody = await fetch(openIdConfigUrl);
     // Check the validity of the fetched config
     try {
       issuerConfig = processConfig(await issuerConfigRequestBody.json());

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.spec.ts

@@ -35,8 +35,6 @@ import {
 import { jest, it, describe, expect } from "@jest/globals";
 import { getBearerToken } from "@inrupt/oidc-client-ext";
 import type * as OidcClientExt from "@inrupt/oidc-client-ext";
-import { fetch, Response, Headers } from "@inrupt/universal-fetch";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import type { JWK } from "jose";
 import { importJWK } from "jose";
 import type { KeyObject } from "crypto";
@@ -48,15 +46,7 @@ import {
   mockTokenRefresher,
 } from "../refresh/__mocks__/TokenRefresher";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<typeof fetch>(),
-  };
-});
+const mockedFetch = jest.spyOn(globalThis, "fetch");
 
 const mockJwk = (): JWK => {
   return {
@@ -202,9 +192,6 @@ function mockClientRegistrar(client: IClient): IClientRegistrar {
 }
 
 const mockFetch = (response: Response) => {
-  const { fetch: mockedFetch } = jest.requireMock(
-    "@inrupt/universal-fetch",
-  ) as jest.Mocked<typeof UniversalFetch>;
   mockedFetch.mockResolvedValueOnce(response);
   return mockedFetch;
 };
@@ -416,7 +403,6 @@ describe("AuthCodeRedirectHandler", () => {
 
     it("returns an authenticated bearer fetch if requested", async () => {
       mockOidcClient();
-      const mockedFetch = jest.mocked<typeof fetch>(fetch);
       mockedFetch.mockResolvedValueOnce(
         new Response("", {
           status: 200,
@@ -427,9 +413,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockDefaultStorageUtility({ dpop: false }),
       });
 
-      const redirectInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const redirectInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       // This will call the oidc-client-ext module, which is mocked at
       // the top of this file. The purpose of this test is to check that, if
@@ -444,7 +429,6 @@ describe("AuthCodeRedirectHandler", () => {
 
     it("returns an authenticated DPoP fetch if requested", async () => {
       mockOidcClient();
-      const mockedFetch = jest.mocked<typeof fetch>(fetch);
       mockedFetch.mockResolvedValueOnce(
         new Response("", {
           status: 200,
@@ -454,9 +438,8 @@ describe("AuthCodeRedirectHandler", () => {
       const authCodeRedirectHandler = getAuthCodeRedirectHandler({
         storageUtility: mockDefaultStorageUtility({ dpop: true }),
       });
-      const redirectInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const redirectInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
       await redirectInfo.fetch("https://some.other.url");
 
       const header = new Headers(mockedFetch.mock.calls[0][1]?.headers);
@@ -525,9 +508,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockDefaultStorageUtility(),
       });
 
-      const sessionInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const sessionInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       expect(sessionInfo.expirationDate).toBe(
         MOCK_TIMESTAMP + MOCK_EXPIRE_TIME * 1000,
@@ -552,9 +534,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockedStorage,
       });
 
-      const sessionInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const sessionInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       expect(sessionInfo.expirationDate).toBeUndefined();
     });
@@ -598,7 +579,6 @@ describe("AuthCodeRedirectHandler", () => {
     await authCodeRedirectHandler.handle(mockRedirectUrl());
 
     expect(mockAuthenticatedFetchBuild).toHaveBeenCalledWith(
-      expect.anything(),
       expect.anything(),
       expect.objectContaining({
         refreshOptions: {

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts

@@ -23,12 +23,6 @@
  * @hidden
  * @packageDocumentation
  */
-// FIXME: The following doesn't work in the browser, it results in all the fetches
-// being unauthenticated. This should be looked into when migrating to universal-fetch.
-// import { fetch } from "cross-fetch";
-
-import { fetch as uniFetch } from "@inrupt/universal-fetch";
-
 import type {
   IClient,
   IClientRegistrar,
@@ -49,9 +43,6 @@ import type { CodeExchangeResult } from "@inrupt/oidc-client-ext";
 import { getDpopToken, getBearerToken } from "@inrupt/oidc-client-ext";
 import type { EventEmitter } from "events";
 
-const globalFetch: typeof uniFetch = (...args) =>
-  uniFetch.call(globalThis, ...args);
-
 /**
  * @hidden
  */
@@ -171,16 +162,12 @@ export class AuthCodeRedirectHandler implements IIncomingRedirectHandler {
       };
     }
 
-    const authFetch = await buildAuthenticatedFetch(
-      globalFetch,
-      tokens.accessToken,
-      {
-        dpopKey: tokens.dpopKey,
-        refreshOptions,
-        eventEmitter,
-        expiresIn: tokens.expiresIn,
-      },
-    );
+    const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
+      dpopKey: tokens.dpopKey,
+      refreshOptions,
+      eventEmitter,
+      expiresIn: tokens.expiresIn,
+    });
 
     await this.storageUtility.setForUser(
       storedSessionId,

package/src/login/oidc/incomingRedirectHandler/ErrorOidcHandler.spec.ts

@@ -22,19 +22,8 @@
 import { jest, it, describe, expect } from "@jest/globals";
 import { EventEmitter } from "events";
 import { EVENTS } from "@inrupt/solid-client-authn-core";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import { ErrorOidcHandler } from "./ErrorOidcHandler";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 describe("ErrorOidcHandler", () => {
   describe("canHandle", () => {
     it("Does not handle IRIs without an error parameter", async () => {

package/src/login/oidc/incomingRedirectHandler/FallbackRedirectHandler.spec.ts

@@ -19,20 +19,9 @@
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 
-import { jest, it, describe, expect } from "@jest/globals";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
+import { it, describe, expect } from "@jest/globals";
 import { FallbackRedirectHandler } from "./FallbackRedirectHandler";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 describe("FallbackRedirectHandler", () => {
   describe("canHandle", () => {
     it("always accept the given IRI", async () => {

package/.prettierignore

@@ -1,3 +0,0 @@
-# TODO: figure out why the root .prettierignore file isn't detected:
-docs/**/*.md
-examples/**/*.md

package/sampleFlows/authorization-code-with-pkce.seqdiag

@@ -1,46 +0,0 @@
-title: Authorization Code Flow with PKCE
-
-note left of RP: AUTHORIZATION
-note over RP: 1.Alice uses the decentphotos app
-note over RP: 2. Alice selets her OP or WebID
-RP->Alice's Pod (RS): 2.1 Retrieve Profile
-Alice's Pod (RS)->RP:
-RP->Alice's OP: 3. Requests OP configuration
-Alice's OP->RP: 4. Returns OP configuration
-RP->Alice's OP: 5. Requests OP JWKS
-Alice's OP->RP: 6. Returns OP JWKS
-note over RP: 7. Generates Private/Public key pair
-note over RP: 8. Generates PKCE nonce
-note over RP: 9. Saves both to local storage
-RP->Alice's OP: 10. Authorization Request
-Alice's OP->Decentphotos WebID: 11. Retrieves WebID
-Decentphotos WebID->Alice's OP:
-note over Alice's OP: 11. Validates redirect protocol with WebID
-note over Alice's OP: 12. Gets Alice's consent
-note over Alice's OP: 13. Generates an id_vc
-Alice's OP->RP: 12. Sends code to redirect protocol
-RP->Alice's OP: 13. Token requst with code and nonce proof
-note over Alice's OP: 14. Validates nonce proof
-Alice's OP->RP: 15. Sends id_vc inside id_token
-
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's Pod (RS): 5. Retrieves Profile
-Alice's Pod (RS)->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 7. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 8. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result
-
-note left of RP: REFRESH TOKEN
-Bob's Pod (RS)->RP: 1. 401: token expired
-RP->Alice's OP: 2. Refresh token auth request
-Alice's OP->RP: 3. Return updated token

package/sampleFlows/authorization-code.seqdiag

@@ -1,50 +0,0 @@
-title: Authorization Code Grant
-
-note left of Alice's Browser: Authorization
-note over Decentphotos Server: 1. Has a public/private keypair
-note over Decentphotos WebID: 1. Has pub key cert
-note over Alice's Browser: 2. Alice navigates to decentphotos.example
-Alice's Browser->Decentphotos Server: 3. Retrieves webpage with session
-Decentphotos Server->Alice's Browser:
-note over Alice's Browser: 4. Alice selets her OP or WebID
-Alice's Browser->Decentphotos Server: 5. Requests login with OP / WebID
-Decentphotos Server->Alice's Pod (RS): 5.1 Retrieve Profile
-Alice's Pod (RS)->Decentphotos Server:
-Decentphotos Server->Alice's OP: 6. Requests OP configuration
-Alice's OP->Decentphotos Server:
-Decentphotos Server->Alice's OP: 7. Requests OP JWKS
-Alice's OP->Decentphotos Server:
-Decentphotos Server->Alice's Browser: 8. Redirects to Auth endpoint
-Alice's Browser->Alice's OP: 9. Authorization Request
-note over Alice's OP: 10. Gets Alice's consent
-Alice's OP->Alice's Browser: 11. Returns to redirect_url with access_code
-Alice's Browser-> Decentphotos Server: 12. Transfers Access Code
-Decentphotos Server->Alice's OP: 13. Auth request with proof of private key
-Alice's OP->Decentphotos WebID: 14. Retrieves app WebID
-Decentphotos WebID->Alice's OP:
-note over Alice's OP: 15. Validates cert with WebID
-note over Alice's OP: 16. Generates an access_code
-Alice's OP->Decentphotos Server: 17. Returns access_code and refresh_token
-
-note left of Alice's Browser: SENDING REQUEST
-Alice's Browser->Decentphotos Server: 1. Sends Request details
-note over Decentphotos Server: 2. Creates a pop_token
-Decentphotos Server->Bob's Pod (RS): 3. Request sent
-note over Bob's Pod (RS): 4. Checks pop_token Audience
-note over Bob's Pod (RS): 5. Checks client signature
-Bob's Pod (RS)->Alice's Pod (RS): 6. Retrieves Profile
-Alice's Pod (RS)->Bob's Pod (RS):
-note over Bob's Pod (RS): 7. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 8. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 9. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 10. Performs Authentication
-note over Bob's Pod (RS): 11. Performs Authorization
-Bob's Pod (RS)->Decentphotos Server: 12. Returns Result
-Decentphotos Server->Alice's Browser: 13. Returns result
-
-note left of Alice's Browser: REFRESH pop_token
-Bob's Pod (RS)->Decentphotos Server: 1. 401: token expired
-Decentphotos Server->Alice's OP: 2. Refresh token auth request
-Alice's OP->Decentphotos Server: 3. Return updated token

package/sampleFlows/client-credentials.seqdiag

@@ -1,38 +0,0 @@
-title: Client Credentials Grant
-
-note left of RP: AUTHORIZATION
-note over RP: 1. Alice's server knows a client_secret and OP
-RP->Alice's OP: 2. Requests OP configuration
-Alice's OP->RP: 3. Returns OP configuration
-RP->Alice's OP: 4. Requests OP JWKS
-Alice's OP->RP: 5. Returns OP JWKS
-note over RP: 6. Generates Private/Public key pair
-note over RP: 7. Saves Private/Public key pair to local storage
-RP->Alice's OP: 8. Authorization Request
-Alice's OP->RP WebID: 9. Retrieves WebID
-RP WebID->Alice's OP:
-note over Alice's OP: 10. Validates redirect_url with WebID
-note over Alice's OP: 11. Validate Client Secret
-note over Alice's OP: 12. Generates an access_token
-Alice's OP->RP: 12. Returns to redirect_url
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's Pod (RS): 5. Retrieves Profile
-Alice's Pod (RS)->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 7. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 8. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result
-
-note left of RP: REFRESH TOKEN
-Bob's Pod (RS)->RP: 1. 401: token expired
-RP->Alice's OP: 2. Refresh token auth request
-Alice's OP->RP: 3. Return updated token

package/sampleFlows/legacy-implicit-flow.seqdiag

@@ -1,43 +0,0 @@
-title: Legacy Implicit Flow
-
-note left of RP: AUTHORIZATION
-note over RP: 1. Alice navigates to decentphotos.example
-note over RP: 2. Alice selets her OP or WebID
-RP->Alice's Pod (RS): 2.1 Retrieve Profile
-Alice's Pod (RS)->RP:
-RP->Alice's OP: 3. Requests OP configuration
-Alice's OP->RP: 4. Returns OP configuration
-RP->Alice's OP: 5. Requests OP JWKS
-Alice's OP->RP: 6. Returns OP JWKS
-note over RP: 7. Generates Private/Public key pair
-note over RP: 8. Saves Private/Public key pair to local storage
-RP->Alice's OP: 9. Authorization Request
-Alice's OP->Decentphotos WebID: 10. Retrieves WebID
-Decentphotos WebID->Alice's OP:
-note over Alice's OP: 11. Validates redirect_url with WebID
-note over Alice's OP: 12. Gets Alice's consent
-note over Alice's OP: 13. Generates an access_token
-Alice's OP->RP: 12. Returns to redirect_url
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's Pod (RS): 5. Retrieves Profile
-Alice's Pod (RS)->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 7. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 8. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result
-
-note left of RP: SILENT REFRESH
-Bob's Pod (RS)->RP: 1. 401: token expired
-note over RP: 2. Opens iFrame to OP
-RP->Alice's OP: 3. Authorization Request with prompt=none
-Alice's OP->RP: 4. Return updated token
-

package/sampleFlows/self-signed.seqdiag

@@ -1,49 +0,0 @@
-title: Self Issued Flow
-
-note left of RP: AUTHENTICATION
-note over RP: 1. Alice uses the Decentphotos App
-note over OP: 2. Alice has a self-signed app installed 
-note over OP: It knows Alice's private key
-note over Alice's WebID: 3. issuer: selfissued.me
-note over Alice's WebID: Knows Alice's pub cert
-note over RP: 4. Alice selects her OP or WebID
-RP->Alice's WebID: 4.1 Gets WebID
-Alice's WebID->RP:
-RP->OP: 5. Requests OP configuration
-OP->RP:
-RP->OP: 6. Requests OP JWKS
-OP->RP:
-note over RP: 7. Generates Private/Public key pair
-note over RP: 8. Generates PKCE nonce
-note over RP: 9. Saves both to local storage
-RP->OP: 10. Authorization Request
-OP->Decentphotos WebID: 11. Retrieves WebID
-Decentphotos WebID->OP:
-note over OP: 11. Validates redirect protocol with WebID
-note over OP: 12. Gets Alice's consent
-note over OP: 13. Generates an access_code
-OP->RP: 12. Sends code to redirect protocol
-RP->OP: 13. Token requst with code and nonce proof
-note over OP: 14. Validates nonce proof
-OP->RP: 15. Sends access_token
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's WebID: 5. Retrieves Profile
-Alice's WebID->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks that access_token cert matches WebID
-Bob's Pod (RS)->OP: 7. Retrieves OP configuration
-OP->Bob's Pod (RS):
-Bob's Pod (RS)->OP: 8. Requests JWKS
-OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result
-
-note left of RP: REFRESH TOKEN
-Bob's Pod (RS)->RP: 1. 401: token expired
-RP->OP: 2. Refresh token auth request
-OP->RP: 3. Return updated token

package/sampleFlows/signatory-access-control.seqdiag

@@ -1,36 +0,0 @@
-title: Legacy Implicit Flow
-
-note left of RP: AUTHORIZATION
-note over RP: 1. Alice navigates to badguys.com
-note over RP: 2. Alice selects her OP or WebID
-RP->Alice's WebId: 2.1 Retrieve Profile
-Alice's WebId->RP:
-RP->Alice's OP: 3. Get OP configuration
-Alice's OP->RP:
-RP->Alice's OP: 4. Get OP JWKS
-Alice's OP->RP:
-note over RP: 5. Generates Private/Public key pair
-note over RP: 6. Saves Private/Public key pair to local storage
-RP->Alice's OP: 7. Authorization Request
-Alice's OP->badguys.com WebId: 8. Retrieves WebID
-badguys.com WebId->Alice's OP:
-note over Alice's OP: 9. Validates redirect_url with WebID
-note over Alice's OP: 10. Gets Alice's consent
-note over Alice's OP: 11. Generates an access_token
-Alice's OP->RP: 12. Returns to redirect_url
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's WebId: 5. Retrieves Subject Profile
-Alice's WebId->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 7. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 8. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result