@inrupt/solid-client-authn-browser 1.17.5 → 2.1.0

package/src/login/oidc/ClientRegistrar.spec.ts

@@ -24,7 +24,6 @@ import {
   mockStorageUtility,
 } from "@inrupt/solid-client-authn-core/mocks";
 import { jest, it, describe, expect } from "@jest/globals";
-import { Response as NodeResponse } from "@inrupt/universal-fetch";
 import ClientRegistrar from "./ClientRegistrar";
 import { IssuerConfigFetcherFetchConfigResponse } from "./__mocks__/IssuerConfigFetcher";
 
@@ -47,14 +46,14 @@ describe("ClientRegistrar", () => {
       // actual OIDC provider response.
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "abcd",
             client_secret: "1234",
             redirect_uris: ["https://example.com"],
             id_token_signed_response_alg: "RS256",
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -98,12 +97,12 @@ describe("ClientRegistrar", () => {
     it("can register a public client without secret", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "abcd",
             redirect_uris: ["https://example.com"],
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -144,9 +143,9 @@ describe("ClientRegistrar", () => {
     it("handles a failure to dynamically register elegantly", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse('{"error":"bad stuff that\'s an error"}', {
+        new Response('{"error":"bad stuff that\'s an error"}', {
           status: 400,
-        }) as unknown as Response,
+        }),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;
@@ -177,6 +176,7 @@ describe("ClientRegistrar", () => {
             "solidClientAuthenticationUser:mySession": {
               clientId: "an id",
               clientSecret: "a secret",
+              clientType: "dynamic",
             },
           },
           false,
@@ -198,13 +198,13 @@ describe("ClientRegistrar", () => {
     it("saves dynamic registration information", async () => {
       const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
         /* eslint-disable camelcase */
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             client_id: "some id",
             client_secret: "some secret",
             redirect_uris: ["https://example.com"],
           }),
-        ) as unknown as Response,
+        ),
         /* eslint-enable camelcase */
       );
       global.fetch = mockFetch;

package/src/login/oidc/ClientRegistrar.ts

@@ -31,6 +31,7 @@ import type {
   IClient,
   IClientRegistrarOptions,
 } from "@inrupt/solid-client-authn-core";
+import { isKnownClientType } from "@inrupt/solid-client-authn-core";
 import { registerClient } from "@inrupt/oidc-client-ext";
 
 /**
@@ -49,7 +50,8 @@ export default class ClientRegistrar implements IClientRegistrar {
     const [
       storedClientId,
       storedClientSecret,
-      // storedClientName,
+      storedClientName,
+      storedClientType,
     ] = await Promise.all([
       this.storageUtility.getForUser(options.sessionId, "clientId", {
         secure: false,
@@ -57,17 +59,21 @@ export default class ClientRegistrar implements IClientRegistrar {
       this.storageUtility.getForUser(options.sessionId, "clientSecret", {
         secure: false,
       }),
-      // this.storageUtility.getForUser(options.sessionId, "clientName", {
-      //   // FIXME: figure out how to persist secure storage at reload
-      //   secure: false,
-      // }),
+      this.storageUtility.getForUser(options.sessionId, "clientName", {
+        secure: false,
+      }),
+      this.storageUtility.getForUser(options.sessionId, "clientType", {
+        secure: false,
+      }),
     ]);
-    if (storedClientId) {
+    if (storedClientId && isKnownClientType(storedClientType)) {
       return {
         clientId: storedClientId,
         clientSecret: storedClientSecret,
-        clientType: "dynamic",
-      };
+        clientName: storedClientName,
+        // Note: static clients are not applicable in a browser context.
+        clientType: storedClientType,
+      } as IClient;
     }
 
     try {
@@ -75,6 +81,7 @@ export default class ClientRegistrar implements IClientRegistrar {
       // Save info
       const infoToSave: Record<string, string> = {
         clientId: registeredClient.clientId,
+        clientType: "dynamic",
       };
       if (registeredClient.clientSecret) {
         infoToSave.clientSecret = registeredClient.clientSecret;

package/src/login/oidc/IssuerConfigFetcher.spec.ts

@@ -21,24 +21,22 @@
 
 import { jest, it, describe, expect } from "@jest/globals";
 import { mockStorageUtility } from "@inrupt/solid-client-authn-core";
-import { Response as NodeResponse } from "@inrupt/universal-fetch";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import IssuerConfigFetcher from "./IssuerConfigFetcher";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 /**
  * Test for IssuerConfigFetcher
  */
 describe("IssuerConfigFetcher", () => {
+  let mockFetch: jest.SpiedFunction<typeof fetch>;
+
+  beforeEach(() => {
+    mockFetch = jest.spyOn(globalThis, "fetch");
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   const defaultMocks = {
     storageUtility: mockStorageUtility({}),
   };
@@ -55,11 +53,9 @@ describe("IssuerConfigFetcher", () => {
     const configFetcher = getIssuerConfigFetcher({
       storageUtility: mockStorageUtility({}),
     });
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
+
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -83,10 +79,7 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should throw an error if the fetched config could not be converted to JSON", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
-    mockFetch.mockResolvedValueOnce(new NodeResponse("Not JSON."));
+    mockFetch.mockResolvedValueOnce(new Response("Not JSON."));
     const configFetcher = new IssuerConfigFetcher(mockStorageUtility({}));
 
     await expect(configFetcher.fetchConfig("https://some.url")).rejects.toThrow(
@@ -95,11 +88,8 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should return a config including the support for solid-oidc if present in the discovery profile", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -120,11 +110,8 @@ describe("IssuerConfigFetcher", () => {
   });
 
   it("should return a default value for the supported scopes if not advertized by the OpenID provider", async () => {
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
     mockFetch.mockResolvedValueOnce(
-      new NodeResponse(
+      new Response(
         JSON.stringify({
           issuer: "https://example.com",
           // eslint-disable-next-line camelcase
@@ -143,12 +130,10 @@ describe("IssuerConfigFetcher", () => {
 
   it("should append the .well-known/openid-configuration path at the end of the issuer URL", async () => {
     // The response value is irrelevant to this test.
-    const { fetch: mockFetch } = jest.requireMock(
-      "@inrupt/universal-fetch",
-    ) as jest.Mocked<typeof UniversalFetch>;
+
     mockFetch.mockImplementation(
       async () =>
-        new NodeResponse(
+        new Response(
           JSON.stringify({
             issuer: "https://example.com",
             // eslint-disable-next-line camelcase

package/src/login/oidc/IssuerConfigFetcher.ts

@@ -33,7 +33,6 @@ import type {
   IStorageUtility,
 } from "@inrupt/solid-client-authn-core";
 import { ConfigurationError } from "@inrupt/solid-client-authn-core";
-import { fetch as uniFetch } from "@inrupt/universal-fetch";
 
 export const WELL_KNOWN_OPENID_CONFIG = ".well-known/openid-configuration";
 
@@ -172,10 +171,7 @@ export default class IssuerConfigFetcher implements IIssuerConfigFetcher {
       // includes the full issuer path. See https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig.
       issuer.endsWith("/") ? issuer : `${issuer}/`,
     ).href;
-    const issuerConfigRequestBody = await uniFetch.call(
-      globalThis,
-      openIdConfigUrl,
-    );
+    const issuerConfigRequestBody = await fetch(openIdConfigUrl);
     // Check the validity of the fetched config
     try {
       issuerConfig = processConfig(await issuerConfigRequestBody.json());

package/src/login/oidc/OidcLoginHandler.spec.ts

@@ -77,9 +77,10 @@ describe("OidcLoginHandler", () => {
       mockStorage({}),
       mockStorage({
         "solidClientAuthenticationUser:mySession": {
-          // The value of the client ID doesn't matter here, and it could be a WebID.
+          // The value of the client ID doesn't matter.
           // This checks it gets passed through from storage to the handler.
-          clientId: "some client ID",
+          clientId: "https://example.org/some-client-id",
+          clientType: "solid-oidc",
         },
       }),
     );
@@ -99,7 +100,9 @@ describe("OidcLoginHandler", () => {
     expect(actualHandler.handle.mock.calls).toHaveLength(1);
 
     const calledWith = actualHandler.handle.mock.calls[0][0];
-    expect(calledWith.client.clientId).toBe("some client ID");
+    expect(calledWith.client.clientId).toBe(
+      "https://example.org/some-client-id",
+    );
   });
 
   it("should lookup client ID if not provided, if not found do DCR", async () => {

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.spec.ts

@@ -33,10 +33,7 @@ import {
   mockStorageUtility,
 } from "@inrupt/solid-client-authn-core/mocks";
 import { jest, it, describe, expect } from "@jest/globals";
-import { getBearerToken } from "@inrupt/oidc-client-ext";
 import type * as OidcClientExt from "@inrupt/oidc-client-ext";
-import { fetch, Response, Headers } from "@inrupt/universal-fetch";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import type { JWK } from "jose";
 import { importJWK } from "jose";
 import type { KeyObject } from "crypto";
@@ -48,15 +45,7 @@ import {
   mockTokenRefresher,
 } from "../refresh/__mocks__/TokenRefresher";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<typeof fetch>(),
-  };
-});
+const mockedFetch = jest.spyOn(globalThis, "fetch");
 
 const mockJwk = (): JWK => {
   return {
@@ -160,16 +149,22 @@ jest.mock("@inrupt/oidc-client-ext");
 
 jest.useFakeTimers();
 
-function mockOidcClient(): typeof OidcClientExt {
+function mockOidcClient(
+  tokenType: "dpop" | "bearer" = "dpop",
+): typeof OidcClientExt {
   const mockedOidcClient = jest.requireMock<typeof OidcClientExt>(
     "@inrupt/oidc-client-ext",
   );
-  mockedOidcClient.getDpopToken = jest
-    .fn<typeof mockedOidcClient.getDpopToken>()
-    .mockImplementationOnce(mockTokenEndpointDpopResponse);
-  mockedOidcClient.getBearerToken = jest
-    .fn<typeof mockedOidcClient.getBearerToken>()
-    .mockResolvedValue(mockTokenEndpointBearerResponse());
+  mockedOidcClient.getTokens = jest
+    .fn<typeof mockedOidcClient.getTokens>()
+    .mockImplementationOnce(
+      tokenType === "dpop"
+        ? mockTokenEndpointDpopResponse
+        : () =>
+            new Promise<OidcClientExt.CodeExchangeResult>((resolve) => {
+              resolve(mockTokenEndpointBearerResponse());
+            }),
+    );
   mockedOidcClient.refresh = jest
     .fn<typeof mockedOidcClient.refresh>()
     .mockResolvedValueOnce({
@@ -202,9 +197,6 @@ function mockClientRegistrar(client: IClient): IClientRegistrar {
 }
 
 const mockFetch = (response: Response) => {
-  const { fetch: mockedFetch } = jest.requireMock(
-    "@inrupt/universal-fetch",
-  ) as jest.Mocked<typeof UniversalFetch>;
   mockedFetch.mockResolvedValueOnce(response);
   return mockedFetch;
 };
@@ -331,13 +323,14 @@ describe("AuthCodeRedirectHandler", () => {
 
       await authCodeRedirectHandler.handle(mockRedirectUrl());
 
-      expect(mockedOidcClient.getDpopToken).toHaveBeenCalledWith(
+      expect(mockedOidcClient.getTokens).toHaveBeenCalledWith(
         expect.anything(),
         expect.anything(),
         expect.objectContaining({
           codeVerifier: DEFAULT_CODE_VERIFIER,
           redirectUrl: DEFAULT_REDIRECT_URL,
         }),
+        expect.anything(),
       );
     });
 
@@ -415,8 +408,7 @@ describe("AuthCodeRedirectHandler", () => {
     });
 
     it("returns an authenticated bearer fetch if requested", async () => {
-      mockOidcClient();
-      const mockedFetch = jest.mocked<typeof fetch>(fetch);
+      mockOidcClient("bearer");
       mockedFetch.mockResolvedValueOnce(
         new Response("", {
           status: 200,
@@ -427,9 +419,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockDefaultStorageUtility({ dpop: false }),
       });
 
-      const redirectInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const redirectInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       // This will call the oidc-client-ext module, which is mocked at
       // the top of this file. The purpose of this test is to check that, if
@@ -444,7 +435,6 @@ describe("AuthCodeRedirectHandler", () => {
 
     it("returns an authenticated DPoP fetch if requested", async () => {
       mockOidcClient();
-      const mockedFetch = jest.mocked<typeof fetch>(fetch);
       mockedFetch.mockResolvedValueOnce(
         new Response("", {
           status: 200,
@@ -454,9 +444,8 @@ describe("AuthCodeRedirectHandler", () => {
       const authCodeRedirectHandler = getAuthCodeRedirectHandler({
         storageUtility: mockDefaultStorageUtility({ dpop: true }),
       });
-      const redirectInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const redirectInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
       await redirectInfo.fetch("https://some.other.url");
 
       const header = new Headers(mockedFetch.mock.calls[0][1]?.headers);
@@ -525,9 +514,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockDefaultStorageUtility(),
       });
 
-      const sessionInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const sessionInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       expect(sessionInfo.expirationDate).toBe(
         MOCK_TIMESTAMP + MOCK_EXPIRE_TIME * 1000,
@@ -535,10 +523,10 @@ describe("AuthCodeRedirectHandler", () => {
     });
 
     it("returns null for the expiration time if none was provided", async () => {
-      const mockedOidcClient = mockOidcClient();
+      const mockedOidcClient = mockOidcClient("bearer");
       mockFetch(new Response());
-      mockedOidcClient.getBearerToken = jest
-        .fn(getBearerToken)
+      mockedOidcClient.getTokens = jest
+        .fn<(typeof OidcClientExt)["getTokens"]>()
         .mockResolvedValueOnce({
           accessToken: mockAccessTokenBearer(),
           idToken: mockIdToken(),
@@ -552,9 +540,8 @@ describe("AuthCodeRedirectHandler", () => {
         storageUtility: mockedStorage,
       });
 
-      const sessionInfo = await authCodeRedirectHandler.handle(
-        mockRedirectUrl(),
-      );
+      const sessionInfo =
+        await authCodeRedirectHandler.handle(mockRedirectUrl());
 
       expect(sessionInfo.expirationDate).toBeUndefined();
     });
@@ -598,7 +585,6 @@ describe("AuthCodeRedirectHandler", () => {
     await authCodeRedirectHandler.handle(mockRedirectUrl());
 
     expect(mockAuthenticatedFetchBuild).toHaveBeenCalledWith(
-      expect.anything(),
       expect.anything(),
       expect.objectContaining({
         refreshOptions: {

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts

@@ -23,12 +23,6 @@
  * @hidden
  * @packageDocumentation
  */
-// FIXME: The following doesn't work in the browser, it results in all the fetches
-// being unauthenticated. This should be looked into when migrating to universal-fetch.
-// import { fetch } from "cross-fetch";
-
-import { fetch as uniFetch } from "@inrupt/universal-fetch";
-
 import type {
   IClient,
   IClientRegistrar,
@@ -45,13 +39,9 @@ import {
   loadOidcContextFromStorage,
   maybeBuildRpInitiatedLogout,
 } from "@inrupt/solid-client-authn-core";
-import type { CodeExchangeResult } from "@inrupt/oidc-client-ext";
-import { getDpopToken, getBearerToken } from "@inrupt/oidc-client-ext";
+import { getTokens } from "@inrupt/oidc-client-ext";
 import type { EventEmitter } from "events";
 
-const globalFetch: typeof uniFetch = (...args) =>
-  uniFetch.call(globalThis, ...args);
-
 /**
  * @hidden
  */
@@ -141,26 +131,24 @@ export class AuthCodeRedirectHandler implements IIncomingRedirectHandler {
       issuerConfig,
     );
 
-    let tokens: CodeExchangeResult;
     const tokenCreatedAt = Date.now();
-
-    if (isDpop) {
-      tokens = await getDpopToken(issuerConfig, client, {
+    const tokens = await getTokens(
+      issuerConfig,
+      client,
+      {
         grantType: "authorization_code",
         // We rely on our 'canHandle' function checking that the OAuth 'code'
         // parameter is present in our query string.
         code: url.searchParams.get("code") as string,
         codeVerifier,
         redirectUrl: storedRedirectIri,
-      });
-
-      // Delete oidc-client-specific session information from storage. This is
-      // done automatically when retrieving a bearer token, but since the DPoP
-      // binding uses our custom code, this needs to be done manually.
-      window.localStorage.removeItem(`oidc.${oauthState}`);
-    } else {
-      tokens = await getBearerToken(url.toString());
-    }
+      },
+      isDpop,
+    );
+
+    // Delete oidc-client-specific session information from storage. oidc-client
+    // is no longer used for the token exchange, so it doesn't perform this automatically.
+    window.localStorage.removeItem(`oidc.${oauthState}`);
 
     let refreshOptions: RefreshOptions | undefined;
     if (tokens.refreshToken !== undefined) {
@@ -171,16 +159,12 @@ export class AuthCodeRedirectHandler implements IIncomingRedirectHandler {
       };
     }
 
-    const authFetch = await buildAuthenticatedFetch(
-      globalFetch,
-      tokens.accessToken,
-      {
-        dpopKey: tokens.dpopKey,
-        refreshOptions,
-        eventEmitter,
-        expiresIn: tokens.expiresIn,
-      },
-    );
+    const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
+      dpopKey: tokens.dpopKey,
+      refreshOptions,
+      eventEmitter,
+      expiresIn: tokens.expiresIn,
+    });
 
     await this.storageUtility.setForUser(
       storedSessionId,

package/src/login/oidc/incomingRedirectHandler/ErrorOidcHandler.spec.ts

@@ -22,19 +22,8 @@
 import { jest, it, describe, expect } from "@jest/globals";
 import { EventEmitter } from "events";
 import { EVENTS } from "@inrupt/solid-client-authn-core";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
 import { ErrorOidcHandler } from "./ErrorOidcHandler";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 describe("ErrorOidcHandler", () => {
   describe("canHandle", () => {
     it("Does not handle IRIs without an error parameter", async () => {

package/src/login/oidc/incomingRedirectHandler/FallbackRedirectHandler.spec.ts

@@ -19,20 +19,9 @@
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 
-import { jest, it, describe, expect } from "@jest/globals";
-import type * as UniversalFetch from "@inrupt/universal-fetch";
+import { it, describe, expect } from "@jest/globals";
 import { FallbackRedirectHandler } from "./FallbackRedirectHandler";
 
-jest.mock("@inrupt/universal-fetch", () => {
-  const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch",
-  ) as typeof UniversalFetch;
-  return {
-    ...fetchModule,
-    fetch: jest.fn<(typeof UniversalFetch)["fetch"]>(),
-  };
-});
-
 describe("FallbackRedirectHandler", () => {
   describe("canHandle", () => {
     it("always accept the given IRI", async () => {

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -262,6 +262,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
         ...standardOidcOptions,
         client: {
           ...standardOidcOptions.client,
+          clientType: "dynamic",
           clientSecret: "I can't cook because I only drink Soylent",
         },
         issuerConfiguration: {

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.ts

@@ -53,8 +53,7 @@ export default class AuthorizationCodeWithPkceOidcHandler
       authority: oidcLoginOptions.issuer.toString(),
       client_id: oidcLoginOptions.client.clientId,
       client_secret: oidcLoginOptions.client.clientSecret,
-      redirect_uri: oidcLoginOptions.redirectUrl.toString(),
-      post_logout_redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+      redirect_uri: oidcLoginOptions.redirectUrl,
       response_type: "code",
       scope: DEFAULT_SCOPES,
       filterProtocolClaims: true,

package/.prettierignore

@@ -1,3 +0,0 @@
-# TODO: figure out why the root .prettierignore file isn't detected:
-docs/**/*.md
-examples/**/*.md

package/sampleFlows/authorization-code-with-pkce.seqdiag

@@ -1,46 +0,0 @@
-title: Authorization Code Flow with PKCE
-
-note left of RP: AUTHORIZATION
-note over RP: 1.Alice uses the decentphotos app
-note over RP: 2. Alice selets her OP or WebID
-RP->Alice's Pod (RS): 2.1 Retrieve Profile
-Alice's Pod (RS)->RP:
-RP->Alice's OP: 3. Requests OP configuration
-Alice's OP->RP: 4. Returns OP configuration
-RP->Alice's OP: 5. Requests OP JWKS
-Alice's OP->RP: 6. Returns OP JWKS
-note over RP: 7. Generates Private/Public key pair
-note over RP: 8. Generates PKCE nonce
-note over RP: 9. Saves both to local storage
-RP->Alice's OP: 10. Authorization Request
-Alice's OP->Decentphotos WebID: 11. Retrieves WebID
-Decentphotos WebID->Alice's OP:
-note over Alice's OP: 11. Validates redirect protocol with WebID
-note over Alice's OP: 12. Gets Alice's consent
-note over Alice's OP: 13. Generates an id_vc
-Alice's OP->RP: 12. Sends code to redirect protocol
-RP->Alice's OP: 13. Token requst with code and nonce proof
-note over Alice's OP: 14. Validates nonce proof
-Alice's OP->RP: 15. Sends id_vc inside id_token
-
-
-note left of RP: SENDING REQUEST
-note over RP: 1. Creates a pop_token
-RP->Bob's Pod (RS): 2. Request sent
-note over Bob's Pod (RS): 3. Checks pop_token Audience
-note over Bob's Pod (RS): 4. Checks client signature
-Bob's Pod (RS)->Alice's Pod (RS): 5. Retrieves Profile
-Alice's Pod (RS)->Bob's Pod (RS):
-note over Bob's Pod (RS): 6. Checks Issuer
-Bob's Pod (RS)->Alice's OP: 7. Retrieves OP configuration
-Alice's OP->Bob's Pod (RS):
-Bob's Pod (RS)->Alice's OP: 8. Requests JWKS
-Alice's OP->Bob's Pod (RS):
-note over Bob's Pod (RS): 9. Performs Authentication
-note over Bob's Pod (RS): 10. Performs Authorization
-Bob's Pod (RS)->RP: 11. Returns Result
-
-note left of RP: REFRESH TOKEN
-Bob's Pod (RS)->RP: 1. 401: token expired
-RP->Alice's OP: 2. Refresh token auth request
-Alice's OP->RP: 3. Return updated token