@inrupt/solid-client-authn-browser 3.0.0 → 3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -26,12 +26,12 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "devDependencies": {
-    "@types/node": "^24.0.7",
+    "@types/node": "^24.0.10",
     "@types/uuid": "^10.0.0"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^3.0.0",
-    "@inrupt/solid-client-authn-core": "^3.0.0",
+    "@inrupt/oidc-client-ext": "^3.1.0",
+    "@inrupt/solid-client-authn-core": "^3.1.0",
     "events": "^3.3.0",
     "jose": "^5.1.3",
     "uuid": "^11.1.0"
@@ -39,5 +39,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "af698e70dec2fe50f82ec6b85f7192161bbef482"
+  "gitHead": "c30be8b6ddd243ed45ef93cbb3a27daf4e3faab0"
 }

package/src/login/oidc/OidcLoginHandler.spec.ts

@@ -58,6 +58,18 @@ describe("OidcLoginHandler", () => {
     );
   }
 
+  const oidcHandlerWithMocks = () => {
+    const actualHandler = defaultMocks.oidcHandler;
+    const issuerConfig = IssuerConfigFetcherFetchConfigResponse;
+    const handler = getInitialisedHandler({
+      issuerConfigFetcher: mockIssuerConfigFetcher(
+        issuerConfig,
+      ) as jest.Mocked<IIssuerConfigFetcher>,
+      oidcHandler: actualHandler,
+    });
+    return { handler, mockOidcHandler: actualHandler };
+  };
+
   it("should call the actual handler when an Oidc Issuer is provided", async () => {
     const actualHandler = defaultMocks.oidcHandler;
     const handler = getInitialisedHandler({ oidcHandler: actualHandler });
@@ -322,4 +334,67 @@ describe("OidcLoginHandler", () => {
       }),
     );
   });
+
+  it("ignores malformed scopes", async () => {
+    const { handler, mockOidcHandler } = oidcHandlerWithMocks();
+    await handler.handle({
+      sessionId: "mySession",
+      oidcIssuer: "https://arbitrary.url",
+      redirectUrl: "https://app.com/redirect",
+      tokenType: "DPoP",
+      keepAlive: false,
+      customScopes: [
+        // @ts-expect-error This tests misuse of the API.
+        { not: "a string" },
+        "some invalid scope including spaces",
+        "valid_scope",
+      ],
+    });
+    expect(mockOidcHandler.handle).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scopes: ["openid", "offline_access", "webid", "valid_scope"],
+      }),
+    );
+  });
+
+  it("adds provided scopes to default ones", async () => {
+    const { handler, mockOidcHandler } = oidcHandlerWithMocks();
+    await handler.handle({
+      sessionId: "mySession",
+      oidcIssuer: "https://arbitrary.url",
+      redirectUrl: "https://app.com/redirect",
+      tokenType: "DPoP",
+      keepAlive: false,
+      customScopes: ["scope_1", "scope_2", "scope_3"],
+    });
+    expect(mockOidcHandler.handle).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scopes: [
+          "openid",
+          "offline_access",
+          "webid",
+          "scope_1",
+          "scope_2",
+          "scope_3",
+        ],
+      }),
+    );
+  });
+
+  it("de-dupes scopes", async () => {
+    const { handler, mockOidcHandler } = oidcHandlerWithMocks();
+    await handler.handle({
+      sessionId: "mySession",
+      oidcIssuer: "https://arbitrary.url",
+      redirectUrl: "https://app.com/redirect",
+      tokenType: "DPoP",
+      keepAlive: false,
+      customScopes: ["webid", "custom_scope", "custom_scope"],
+    });
+    expect(mockOidcHandler.handle).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scopes: ["openid", "offline_access", "webid", "custom_scope"],
+      }),
+    );
+  });
 });

package/src/login/oidc/OidcLoginHandler.ts

@@ -42,6 +42,7 @@ import type {
 import {
   ConfigurationError,
   handleRegistration,
+  normalizeScopes,
 } from "@inrupt/solid-client-authn-core";
 
 function hasIssuer(
@@ -116,6 +117,7 @@ export default class OidcLoginHandler implements ILoginHandler {
       ...options,
       issuerConfiguration: issuerConfig,
       client: clientRegistration,
+      scopes: normalizeScopes(options.customScopes),
     };
 
     // Call proper OIDC Handler

package/src/login/oidc/__mocks__/IOidcOptions.ts

@@ -19,7 +19,10 @@
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 
-import type { IOidcOptions } from "@inrupt/solid-client-authn-core";
+import {
+  DEFAULT_SCOPES,
+  type IOidcOptions,
+} from "@inrupt/solid-client-authn-core";
 import { jest } from "@jest/globals";
 
 export const standardOidcOptions: IOidcOptions = {
@@ -42,4 +45,5 @@ export const standardOidcOptions: IOidcOptions = {
     clientId: "coolApp",
     clientType: "dynamic",
   },
+  scopes: DEFAULT_SCOPES,
 };

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -235,7 +235,7 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
       );
     });
 
-    it("requests both openid, offline_access and webid scopes", async () => {
+    it("includes the provided scopes in the authorization request", async () => {
       const oidcModule = mockOidcModule();
       const authorizationCodeWithPkceOidcHandler =
         getAuthorizationCodeWithPkceOidcHandler();
@@ -245,11 +245,12 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
           ...standardOidcOptions.issuerConfiguration,
           grantTypesSupported: ["authorization_code"],
         },
+        scopes: ["openid", "webid", "custom_scope"],
       };
       await authorizationCodeWithPkceOidcHandler.handle(oidcOptions);
       expect(oidcModule.OidcClient).toHaveBeenCalledWith(
         expect.objectContaining({
-          scope: "openid offline_access webid",
+          scope: "openid webid custom_scope",
         }),
       );
     });

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.ts

@@ -32,10 +32,7 @@ import type {
   IOidcOptions,
   LoginResult,
 } from "@inrupt/solid-client-authn-core";
-import {
-  DEFAULT_SCOPES,
-  AuthorizationCodeWithPkceOidcHandlerBase,
-} from "@inrupt/solid-client-authn-core";
+import { AuthorizationCodeWithPkceOidcHandlerBase } from "@inrupt/solid-client-authn-core";
 import { OidcClient } from "@inrupt/oidc-client-ext";
 
 /**
@@ -55,7 +52,7 @@ export default class AuthorizationCodeWithPkceOidcHandler
       client_secret: oidcLoginOptions.client.clientSecret,
       redirect_uri: oidcLoginOptions.redirectUrl,
       response_type: "code",
-      scope: DEFAULT_SCOPES,
+      scope: oidcLoginOptions.scopes.join(" "),
       filterProtocolClaims: true,
       // The userinfo endpoint on NSS fails, so disable this for now
       // Note that in Solid, information should be retrieved from the