@inrupt/solid-client-authn-browser 2.2.7 → 2.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "2.2.7",
+  "version": "2.4.0",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -26,18 +26,18 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "devDependencies": {
-    "@types/node": "^22.7.9",
+    "@types/node": "^22.14.1",
     "@types/uuid": "^10.0.0"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^2.2.7",
-    "@inrupt/solid-client-authn-core": "^2.2.7",
+    "@inrupt/oidc-client-ext": "^2.4.0",
+    "@inrupt/solid-client-authn-core": "^2.4.0",
     "events": "^3.3.0",
     "jose": "^5.1.3",
-    "uuid": "^10.0.0"
+    "uuid": "^11.1.0"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "3b3e6fb05cc81db4baceab8c1cf9eccb8c7592a2"
+  "gitHead": "1bfff9da8474e38a1d87216aa6aff1d1c7065d1b"
 }

package/src/ClientAuthentication.spec.ts

@@ -230,6 +230,35 @@ describe("ClientAuthentication", () => {
       ).resolves.toBeUndefined();
     });
 
+    it("should not clear the local storage when logging in with prompt set to none", async () => {
+      const nonEmptyStorage = mockStorageUtility({
+        someUser: { someKey: "someValue" },
+      });
+      await nonEmptyStorage.setForUser(
+        "someUser",
+        { someKey: "someValue" },
+        { secure: false },
+      );
+      const clientAuthn = getClientAuthentication({
+        sessionInfoManager: mockSessionInfoManager(nonEmptyStorage),
+      });
+      await clientAuthn.login(
+        {
+          sessionId: "someUser",
+          tokenType: "DPoP",
+          clientId: "coolApp",
+          clientName: "coolApp Name",
+          redirectUrl: "https://coolapp.com/redirect",
+          oidcIssuer: "https://idp.com",
+          prompt: "none",
+        },
+        mockEmitter,
+      );
+      await expect(
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false }),
+      ).resolves.toBe("someValue");
+    });
+
     it("throws if the redirect IRI is a malformed URL", async () => {
       const clientAuthn = getClientAuthentication();
       await expect(() =>

package/src/ClientAuthentication.ts

@@ -49,12 +49,11 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     eventEmitter: EventEmitter,
   ): Promise<void> => {
     // In order to get a clean start, make sure that the session is logged out
-    // on login.
-    // But we may want to preserve our client application info, particularly if
-    // we used Dynamic Client Registration to register (since we don't
-    // necessarily want the user to have to register this app each time they
-    // login).
-    await this.sessionInfoManager.clear(options.sessionId);
+    // on login, except when doing a silent login so that Dynamic Client information
+    // is preserved.
+    if (options.prompt !== "none") {
+      await this.sessionInfoManager.clear(options.sessionId);
+    }
 
     // In the case of the user hitting the 'back' button in their browser, they
     // could return to a previous redirect URL that contains OIDC params that

package/src/Session.spec.ts

@@ -63,7 +63,7 @@ const mockLocation = (mockedLocation: string) => {
   delete (window as any).history.replaceState;
 
   // Set our window's location to our test value.
-  window.location = {
+  (window as any).location = {
     href: mockedLocation,
   } as Location;
   window.history.replaceState = jest.fn();

package/src/login/oidc/ClientRegistrar.spec.ts

@@ -25,9 +25,17 @@ import {
 } from "@inrupt/solid-client-authn-core/mocks";
 import { jest, it, describe, expect } from "@jest/globals";
 import { randomUUID } from "crypto";
+import type * as OidcClientExt from "@inrupt/oidc-client-ext";
+import type { IOpenIdDynamicClient } from "core";
 import ClientRegistrar from "./ClientRegistrar";
 import { IssuerConfigFetcherFetchConfigResponse } from "./__mocks__/IssuerConfigFetcher";
 
+jest.mock("@inrupt/oidc-client-ext", () => {
+  return {
+    registerClient: jest.fn(),
+  };
+});
+
 /**
  * Test for ClientRegistrar
  */
@@ -42,24 +50,19 @@ describe("ClientRegistrar", () => {
   }
 
   describe("getClient", () => {
-    it("properly performs dynamic registration", async () => {
-      const clientId = randomUUID();
-      const clientSecret = randomUUID();
-      // FIXME: this should mock out oidc-client-ext, instead of mimicking the
-      // actual OIDC provider response.
-      const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
-        /* eslint-disable camelcase */
-        new Response(
-          JSON.stringify({
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uris: ["https://example.com"],
-            id_token_signed_response_alg: "RS256",
-          }),
-        ),
-        /* eslint-enable camelcase */
-      );
-      global.fetch = mockFetch;
+    it("performs dynamic registration if no client is in storage", async () => {
+      // Setup registration mock.
+      const client: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientSecret: randomUUID(),
+        expiresAt: Date.now() + 1000,
+        clientType: "dynamic",
+      };
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockResolvedValueOnce(client);
+
       const clientRegistrar = getClientRegistrar({
         storage: mockStorageUtility({}),
       });
@@ -75,40 +78,20 @@ describe("ClientRegistrar", () => {
             registrationEndpoint: registrationUrl,
           },
         ),
-      ).toMatchObject({
-        clientId,
-        clientSecret,
-      });
-      expect(mockFetch).toHaveBeenCalledWith(registrationUrl.toString(), {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-        },
-        body: JSON.stringify({
-          /* eslint-disable camelcase */
-          application_type: "web",
-          redirect_uris: ["https://example.com"],
-          subject_type: "public",
-          token_endpoint_auth_method: "client_secret_basic",
-          id_token_signed_response_alg: "RS256",
-          grant_types: ["authorization_code", "refresh_token"],
-          /* eslint-enable camelcase */
-        }),
-      });
+      ).toMatchObject(client);
     });
 
     it("can register a public client without secret", async () => {
-      const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
-        /* eslint-disable camelcase */
-        new Response(
-          JSON.stringify({
-            client_id: "abcd",
-            redirect_uris: ["https://example.com"],
-          }),
-        ),
-        /* eslint-enable camelcase */
-      );
-      global.fetch = mockFetch;
+      // Setup registration mock.
+      const client: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientType: "dynamic",
+      };
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockResolvedValueOnce(client);
+
       const clientRegistrar = getClientRegistrar({
         storage: mockStorageUtility({}),
       });
@@ -138,20 +121,18 @@ describe("ClientRegistrar", () => {
           },
           IssuerConfigFetcherFetchConfigResponse,
         ),
-      ).rejects.toThrow(
-        "Dynamic Registration could not be completed because the issuer has no registration endpoint.",
-      );
+      ).rejects.toThrow();
     });
 
     it("handles a failure to dynamically register elegantly", async () => {
-      const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
-        /* eslint-disable camelcase */
-        new Response('{"error":"bad stuff that\'s an error"}', {
-          status: 400,
-        }),
-        /* eslint-enable camelcase */
+      // Setup registration mock.
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockRejectedValueOnce(
+        new Error("Dynamic client registration failed"),
       );
-      global.fetch = mockFetch;
+
       const clientRegistrar = getClientRegistrar({
         storage: mockStorageUtility({}),
       });
@@ -167,20 +148,20 @@ describe("ClientRegistrar", () => {
             registrationEndpoint: registrationUrl,
           },
         ),
-      ).rejects.toThrow(
-        "Client registration failed: [Error: Dynamic client registration failed: bad stuff that's an error - ]",
-      );
+      ).rejects.toThrow("Client registration failed");
     });
 
     it("retrieves client id and secret from storage if they are present", async () => {
       const clientId = randomUUID();
       const clientSecret = randomUUID();
+      const expiresAt = Math.ceil((Date.now() + 100_000) / 1000);
       const clientRegistrar = getClientRegistrar({
         storage: mockStorageUtility(
           {
             "solidClientAuthenticationUser:mySession": {
               clientId,
               clientSecret,
+              expiresAt: String(expiresAt),
               clientType: "dynamic",
             },
           },
@@ -198,23 +179,115 @@ describe("ClientRegistrar", () => {
       );
       expect(client.clientId).toBe(clientId);
       expect(client.clientSecret).toBe(clientSecret);
+      expect(client.clientType).toBe("dynamic");
+      expect((client as IOpenIdDynamicClient).expiresAt).toBe(expiresAt);
     });
 
-    it("saves dynamic registration information", async () => {
-      const clientId = randomUUID();
-      const clientSecret = randomUUID();
-      const mockFetch = (jest.fn() as any).mockResolvedValueOnce(
-        /* eslint-disable camelcase */
-        new Response(
-          JSON.stringify({
-            client_id: clientId,
-            client_secret: clientSecret,
-            redirect_uris: ["https://example.com"],
-          }),
+    it("performs dynamic registration if an expired client is present in storage", async () => {
+      // Setup the registration mock.
+      const renewedClient: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientSecret: randomUUID(),
+        // Date.now is in ms, and the expiration date is in seconds.
+        expiresAt: Math.ceil((Date.now() + 100_000) / 1000),
+        clientType: "dynamic",
+      };
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockResolvedValueOnce(renewedClient);
+      const expiredClient: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientSecret: randomUUID(),
+        // Date.now is in ms, and the expiration date is in seconds.
+        expiresAt: Math.ceil((Date.now() - 100_000) / 1000),
+        clientType: "dynamic",
+      };
+
+      // Setup the expired client in storage mock.
+      const clientRegistrar = getClientRegistrar({
+        storage: mockStorageUtility(
+          {
+            "solidClientAuthenticationUser:mySession": {
+              clientId: expiredClient.clientId,
+              clientSecret: expiredClient.clientSecret,
+              expiresAt: String(expiredClient.expiresAt),
+              clientType: expiredClient.clientType,
+            },
+          },
+          false,
         ),
-        /* eslint-enable camelcase */
-      );
-      global.fetch = mockFetch;
+      });
+      const registrationUrl = "https://idp.com/register";
+      expect(
+        await clientRegistrar.getClient(
+          {
+            sessionId: "mySession",
+            redirectUrl: "https://example.com",
+          },
+          {
+            ...IssuerConfigFetcherFetchConfigResponse,
+            registrationEndpoint: registrationUrl,
+          },
+        ),
+      ).toMatchObject(renewedClient);
+    });
+
+    it("performs dynamic registration if a confidential client is missing an expiration date (legacy case)", async () => {
+      // Setup the registration mock.
+      const renewedClient: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientSecret: randomUUID(),
+        expiresAt: Date.now() + 1000,
+        clientType: "dynamic",
+      };
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockResolvedValueOnce(renewedClient);
+
+      // Setup the legacy client in storage mock.
+      const clientRegistrar = getClientRegistrar({
+        storage: mockStorageUtility(
+          {
+            "solidClientAuthenticationUser:mySession": {
+              clientId: randomUUID(),
+              clientSecret: randomUUID(),
+              clientType: "dynamic",
+              // The expiration date is missing.
+            },
+          },
+          false,
+        ),
+      });
+      const registrationUrl = "https://idp.com/register";
+      expect(
+        await clientRegistrar.getClient(
+          {
+            sessionId: "mySession",
+            redirectUrl: "https://example.com",
+          },
+          {
+            ...IssuerConfigFetcherFetchConfigResponse,
+            registrationEndpoint: registrationUrl,
+          },
+        ),
+      ).toMatchObject(renewedClient);
+    });
+
+    it("saves dynamic registration information", async () => {
+      // Setup registration mock.
+      const client: IOpenIdDynamicClient = {
+        clientId: randomUUID(),
+        clientSecret: randomUUID(),
+        expiresAt: Math.ceil((Date.now() + 10_000) / 1000),
+        clientType: "dynamic",
+      };
+      const { registerClient: mockedRegisterClient } = jest.requireMock(
+        "@inrupt/oidc-client-ext",
+      ) as jest.Mocked<typeof OidcClientExt>;
+      mockedRegisterClient.mockResolvedValueOnce(client);
+
       const myStorage = mockStorageUtility({});
       const clientRegistrar = getClientRegistrar({
         storage: myStorage,
@@ -234,10 +307,13 @@ describe("ClientRegistrar", () => {
 
       await expect(
         myStorage.getForUser("mySession", "clientId", { secure: false }),
-      ).resolves.toBe(clientId);
+      ).resolves.toBe(client.clientId);
       await expect(
         myStorage.getForUser("mySession", "clientSecret", { secure: false }),
-      ).resolves.toBe(clientSecret);
+      ).resolves.toBe(client.clientSecret);
+      await expect(
+        myStorage.getForUser("mySession", "expiresAt", { secure: false }),
+      ).resolves.toBe(String(client.expiresAt));
     });
   });
 });

package/src/login/oidc/ClientRegistrar.ts

@@ -50,6 +50,7 @@ export default class ClientRegistrar implements IClientRegistrar {
     const [
       storedClientId,
       storedClientSecret,
+      expiresAt,
       storedClientName,
       storedClientType,
     ] = await Promise.all([
@@ -59,6 +60,9 @@ export default class ClientRegistrar implements IClientRegistrar {
       this.storageUtility.getForUser(options.sessionId, "clientSecret", {
         secure: false,
       }),
+      this.storageUtility.getForUser(options.sessionId, "expiresAt", {
+        secure: false,
+      }),
       this.storageUtility.getForUser(options.sessionId, "clientName", {
         secure: false,
       }),
@@ -66,14 +70,32 @@ export default class ClientRegistrar implements IClientRegistrar {
         secure: false,
       }),
     ]);
-    if (storedClientId && isKnownClientType(storedClientType)) {
-      return {
-        clientId: storedClientId,
-        clientSecret: storedClientSecret,
-        clientName: storedClientName,
-        // Note: static clients are not applicable in a browser context.
-        clientType: storedClientType,
-      } as IClient;
+    // -1 is used as a default to identify legacy cases when a value should
+    // have been stored, but wasn't. It will be treated as an expired client.
+    const expirationDate =
+      expiresAt !== undefined ? Number.parseInt(expiresAt, 10) : -1;
+    // Expiration is only applicable to confidential clients.
+    // Note that Date.now() is in milliseconds, and expirationDate in seconds.
+    const expired =
+      storedClientSecret !== undefined &&
+      Math.floor(Date.now() / 1000) > expirationDate;
+    if (storedClientId && isKnownClientType(storedClientType) && !expired) {
+      return storedClientSecret !== undefined
+        ? {
+            clientId: storedClientId,
+            clientSecret: storedClientSecret,
+            clientName: storedClientName,
+            // Note: static clients are not applicable in a browser context.
+            clientType: "dynamic",
+            expiresAt: expirationDate,
+          }
+        : ({
+            clientId: storedClientId,
+            clientName: storedClientName,
+            // Note: static clients are not applicable in a browser context.
+            clientType: storedClientType,
+            // The type assertion is required even though the type should match the declaration.
+          } as IClient);
     }
 
     try {
@@ -83,8 +105,9 @@ export default class ClientRegistrar implements IClientRegistrar {
         clientId: registeredClient.clientId,
         clientType: "dynamic",
       };
-      if (registeredClient.clientSecret) {
+      if (registeredClient.clientSecret !== undefined) {
         infoToSave.clientSecret = registeredClient.clientSecret;
+        infoToSave.expiresAt = String(registeredClient.expiresAt);
       }
       if (registeredClient.idTokenSignedResponseAlg) {
         infoToSave.idTokenSignedResponseAlg =
@@ -98,7 +121,7 @@ export default class ClientRegistrar implements IClientRegistrar {
       });
       return registeredClient;
     } catch (error) {
-      throw new Error(`Client registration failed: [${error}]`);
+      throw new Error(`Client registration failed.`, { cause: error });
     }
   }
 }

package/src/login/oidc/Redirector.spec.ts

@@ -49,14 +49,14 @@ describe("Redirector", () => {
       // eslint-disable-next-line @typescript-eslint/ban-ts-comment
       // @ts-ignore
       delete window.history.replaceState;
-      window.location = {
+      (window as any).location = {
         href: "https://coolSite.com",
       } as Location;
       window.history.replaceState = jest.fn();
     });
 
     afterEach(() => {
-      window.location = location;
+      (window as any).location = location;
       window.history.replaceState = replaceState;
     });
 

package/src/login/oidc/__mocks__/ClientRegistrar.ts

@@ -31,6 +31,8 @@ export const ClientRegistrarResponse: IClient = {
   clientId: "abcde",
   clientSecret: "12345",
   clientType: "dynamic",
+  // 5000-01-07
+  expiresAt: 95618140501000,
 };
 
 export const PublicClientRegistrarResponse: IClient = {

package/src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts

@@ -160,7 +160,7 @@ export class AuthCodeRedirectHandler implements IIncomingRedirectHandler {
       };
     }
 
-    const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
+    const authFetch = buildAuthenticatedFetch(tokens.accessToken, {
       dpopKey: tokens.dpopKey,
       refreshOptions,
       eventEmitter,

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -264,6 +264,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
           ...standardOidcOptions.client,
           clientType: "dynamic",
           clientSecret: "I can't cook because I only drink Soylent",
+          expiresAt: 95618140501000,
         },
         issuerConfiguration: {
           ...standardOidcOptions.issuerConfiguration,

package/tsconfig.json

@@ -2,7 +2,7 @@
   "extends": "../../tsconfig.build.json",
 
   "compilerOptions": {
-    "lib": ["es2018", "dom"],
+    "lib": ["es2022", "dom"],
     "outDir": "./dist"
   },