@inrupt/solid-client-authn-browser 2.0.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -25,12 +25,12 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "devDependencies": {
-    "@types/node": "^20.10.3",
-    "@types/uuid": "^9.0.4"
+    "@types/node": "^20.12.7",
+    "@types/uuid": "^9.0.8"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^2.0.0",
-    "@inrupt/solid-client-authn-core": "^2.0.0",
+    "@inrupt/oidc-client-ext": "^2.2.0",
+    "@inrupt/solid-client-authn-core": "^2.2.0",
     "events": "^3.3.0",
     "jose": "^5.1.3",
     "uuid": "^9.0.1"
@@ -38,5 +38,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "80d9c4b81829762cabbd5ffc1564636efe45000c"
+  "gitHead": "8c3bd6871831c4fa14b593021bbb830cf68e332f"
 }

package/src/ClientAuthentication.spec.ts

@@ -53,7 +53,6 @@ jest.mock("@inrupt/solid-client-authn-core", () => {
   ) as typeof SolidClientAuthnCore;
   return {
     ...actualCoreModule,
-    fetchJwks: jest.fn(),
   };
 });
 
@@ -425,6 +424,7 @@ describe("ClientAuthentication", () => {
       expect(defaultMocks.redirectHandler.handle).toHaveBeenCalledWith(
         url,
         mockEmitter,
+        undefined,
       );
 
       // Calling the redirect handler should have updated the fetch.

package/src/ClientAuthentication.ts

@@ -101,7 +101,11 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     eventEmitter: EventEmitter,
   ): Promise<ISessionInfo | undefined> => {
     try {
-      const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);
+      const redirectInfo = await this.redirectHandler.handle(
+        url,
+        eventEmitter,
+        undefined,
+      );
       // The `FallbackRedirectHandler` directly returns the global `fetch` for
       // his value, so we should ensure it's bound to `window` rather than to
       // ClientAuthentication, to avoid the following error:

package/src/Session.ts

@@ -115,7 +115,7 @@ function isLoggedIn(
 }
 
 /**
- * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling acces to private resources after login for instance.
+ * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling access to private resources after login for instance.
  */
 export class Session implements IHasSessionEventListener {
   /**

package/src/login/oidc/ClientRegistrar.spec.ts

@@ -176,6 +176,7 @@ describe("ClientRegistrar", () => {
             "solidClientAuthenticationUser:mySession": {
               clientId: "an id",
               clientSecret: "a secret",
+              clientType: "dynamic",
             },
           },
           false,

package/src/login/oidc/ClientRegistrar.ts

@@ -31,6 +31,7 @@ import type {
   IClient,
   IClientRegistrarOptions,
 } from "@inrupt/solid-client-authn-core";
+import { isKnownClientType } from "@inrupt/solid-client-authn-core";
 import { registerClient } from "@inrupt/oidc-client-ext";
 
 /**
@@ -49,7 +50,8 @@ export default class ClientRegistrar implements IClientRegistrar {
     const [
       storedClientId,
       storedClientSecret,
-      // storedClientName,
+      storedClientName,
+      storedClientType,
     ] = await Promise.all([
       this.storageUtility.getForUser(options.sessionId, "clientId", {
         secure: false,
@@ -57,17 +59,21 @@ export default class ClientRegistrar implements IClientRegistrar {
       this.storageUtility.getForUser(options.sessionId, "clientSecret", {
         secure: false,
       }),
-      // this.storageUtility.getForUser(options.sessionId, "clientName", {
-      //   // FIXME: figure out how to persist secure storage at reload
-      //   secure: false,
-      // }),
+      this.storageUtility.getForUser(options.sessionId, "clientName", {
+        secure: false,
+      }),
+      this.storageUtility.getForUser(options.sessionId, "clientType", {
+        secure: false,
+      }),
     ]);
-    if (storedClientId) {
+    if (storedClientId && isKnownClientType(storedClientType)) {
       return {
         clientId: storedClientId,
         clientSecret: storedClientSecret,
-        clientType: "dynamic",
-      };
+        clientName: storedClientName,
+        // Note: static clients are not applicable in a browser context.
+        clientType: storedClientType,
+      } as IClient;
     }
 
     try {
@@ -75,6 +81,7 @@ export default class ClientRegistrar implements IClientRegistrar {
       // Save info
       const infoToSave: Record<string, string> = {
         clientId: registeredClient.clientId,
+        clientType: "dynamic",
       };
       if (registeredClient.clientSecret) {
         infoToSave.clientSecret = registeredClient.clientSecret;

package/src/login/oidc/OidcLoginHandler.spec.ts

@@ -77,9 +77,10 @@ describe("OidcLoginHandler", () => {
       mockStorage({}),
       mockStorage({
         "solidClientAuthenticationUser:mySession": {
-          // The value of the client ID doesn't matter here, and it could be a WebID.
+          // The value of the client ID doesn't matter.
           // This checks it gets passed through from storage to the handler.
-          clientId: "some client ID",
+          clientId: "https://example.org/some-client-id",
+          clientType: "solid-oidc",
         },
       }),
     );
@@ -99,7 +100,9 @@ describe("OidcLoginHandler", () => {
     expect(actualHandler.handle.mock.calls).toHaveLength(1);
 
     const calledWith = actualHandler.handle.mock.calls[0][0];
-    expect(calledWith.client.clientId).toBe("some client ID");
+    expect(calledWith.client.clientId).toBe(
+      "https://example.org/some-client-id",
+    );
   });
 
   it("should lookup client ID if not provided, if not found do DCR", async () => {

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.spec.ts

@@ -33,7 +33,6 @@ import {
   mockStorageUtility,
 } from "@inrupt/solid-client-authn-core/mocks";
 import { jest, it, describe, expect } from "@jest/globals";
-import { getBearerToken } from "@inrupt/oidc-client-ext";
 import type * as OidcClientExt from "@inrupt/oidc-client-ext";
 import type { JWK } from "jose";
 import { importJWK } from "jose";
@@ -150,16 +149,22 @@ jest.mock("@inrupt/oidc-client-ext");
 
 jest.useFakeTimers();
 
-function mockOidcClient(): typeof OidcClientExt {
+function mockOidcClient(
+  tokenType: "dpop" | "bearer" = "dpop",
+): typeof OidcClientExt {
   const mockedOidcClient = jest.requireMock<typeof OidcClientExt>(
     "@inrupt/oidc-client-ext",
   );
-  mockedOidcClient.getDpopToken = jest
-    .fn<typeof mockedOidcClient.getDpopToken>()
-    .mockImplementationOnce(mockTokenEndpointDpopResponse);
-  mockedOidcClient.getBearerToken = jest
-    .fn<typeof mockedOidcClient.getBearerToken>()
-    .mockResolvedValue(mockTokenEndpointBearerResponse());
+  mockedOidcClient.getTokens = jest
+    .fn<typeof mockedOidcClient.getTokens>()
+    .mockImplementationOnce(
+      tokenType === "dpop"
+        ? mockTokenEndpointDpopResponse
+        : () =>
+            new Promise<OidcClientExt.CodeExchangeResult>((resolve) => {
+              resolve(mockTokenEndpointBearerResponse());
+            }),
+    );
   mockedOidcClient.refresh = jest
     .fn<typeof mockedOidcClient.refresh>()
     .mockResolvedValueOnce({
@@ -318,13 +323,14 @@ describe("AuthCodeRedirectHandler", () => {
 
       await authCodeRedirectHandler.handle(mockRedirectUrl());
 
-      expect(mockedOidcClient.getDpopToken).toHaveBeenCalledWith(
+      expect(mockedOidcClient.getTokens).toHaveBeenCalledWith(
         expect.anything(),
         expect.anything(),
         expect.objectContaining({
           codeVerifier: DEFAULT_CODE_VERIFIER,
           redirectUrl: DEFAULT_REDIRECT_URL,
         }),
+        expect.anything(),
       );
     });
 
@@ -402,7 +408,7 @@ describe("AuthCodeRedirectHandler", () => {
     });
 
     it("returns an authenticated bearer fetch if requested", async () => {
-      mockOidcClient();
+      mockOidcClient("bearer");
       mockedFetch.mockResolvedValueOnce(
         new Response("", {
           status: 200,
@@ -517,10 +523,10 @@ describe("AuthCodeRedirectHandler", () => {
     });
 
     it("returns null for the expiration time if none was provided", async () => {
-      const mockedOidcClient = mockOidcClient();
+      const mockedOidcClient = mockOidcClient("bearer");
       mockFetch(new Response());
-      mockedOidcClient.getBearerToken = jest
-        .fn(getBearerToken)
+      mockedOidcClient.getTokens = jest
+        .fn<(typeof OidcClientExt)["getTokens"]>()
         .mockResolvedValueOnce({
           accessToken: mockAccessTokenBearer(),
           idToken: mockIdToken(),

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts

@@ -39,8 +39,7 @@ import {
   loadOidcContextFromStorage,
   maybeBuildRpInitiatedLogout,
 } from "@inrupt/solid-client-authn-core";
-import type { CodeExchangeResult } from "@inrupt/oidc-client-ext";
-import { getDpopToken, getBearerToken } from "@inrupt/oidc-client-ext";
+import { getTokens } from "@inrupt/oidc-client-ext";
 import type { EventEmitter } from "events";
 
 /**
@@ -132,26 +131,24 @@ export class AuthCodeRedirectHandler implements IIncomingRedirectHandler {
       issuerConfig,
     );
 
-    let tokens: CodeExchangeResult;
     const tokenCreatedAt = Date.now();
-
-    if (isDpop) {
-      tokens = await getDpopToken(issuerConfig, client, {
+    const tokens = await getTokens(
+      issuerConfig,
+      client,
+      {
         grantType: "authorization_code",
         // We rely on our 'canHandle' function checking that the OAuth 'code'
         // parameter is present in our query string.
         code: url.searchParams.get("code") as string,
         codeVerifier,
         redirectUrl: storedRedirectIri,
-      });
-
-      // Delete oidc-client-specific session information from storage. This is
-      // done automatically when retrieving a bearer token, but since the DPoP
-      // binding uses our custom code, this needs to be done manually.
-      window.localStorage.removeItem(`oidc.${oauthState}`);
-    } else {
-      tokens = await getBearerToken(url.toString());
-    }
+      },
+      isDpop,
+    );
+
+    // Delete oidc-client-specific session information from storage. oidc-client
+    // is no longer used for the token exchange, so it doesn't perform this automatically.
+    window.localStorage.removeItem(`oidc.${oauthState}`);
 
     let refreshOptions: RefreshOptions | undefined;
     if (tokens.refreshToken !== undefined) {

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -262,6 +262,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
         ...standardOidcOptions,
         client: {
           ...standardOidcOptions.client,
+          clientType: "dynamic",
           clientSecret: "I can't cook because I only drink Soylent",
         },
         issuerConfiguration: {

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.ts

@@ -53,8 +53,7 @@ export default class AuthorizationCodeWithPkceOidcHandler
       authority: oidcLoginOptions.issuer.toString(),
       client_id: oidcLoginOptions.client.clientId,
       client_secret: oidcLoginOptions.client.clientSecret,
-      redirect_uri: oidcLoginOptions.redirectUrl.toString(),
-      post_logout_redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+      redirect_uri: oidcLoginOptions.redirectUrl,
       response_type: "code",
       scope: DEFAULT_SCOPES,
       filterProtocolClaims: true,