npm - @lvce-editor/auth-worker - Versions diffs - 1.12.0 → 1.14.0 - Mend

@lvce-editor/auth-worker 1.12.0 → 1.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/authWorkerMain.js +143 -47
package/package.json +1 -1

package/dist/authWorkerMain.js CHANGED Viewed

@@ -1261,6 +1261,115 @@ const waitForBackendLogin = async (backendUrl, timeoutMs = 30_000, pollIntervalM
   return getLoggedOutBackendAuthState(lastErrorMessage);
 };
+if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) ;
+const ERR_INVALID_ARG_VALUE = 'ERR_INVALID_ARG_VALUE';
+const ERR_INVALID_ARG_TYPE = 'ERR_INVALID_ARG_TYPE';
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, {
+    cause
+  });
+  Object.assign(err, {
+    code
+  });
+  return err;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function buf(input) {
+  if (typeof input === 'string') {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+let encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = input => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({
+      alphabet: 'base64url',
+      omitPadding: true
+    });
+  };
+} else {
+  const CHUNK_SIZE = 0x8000;
+  encodeBase64Url = input => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join('')).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+  };
+}
+let decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = input => {
+    try {
+      return Uint8Array.fromBase64(input, {
+        alphabet: 'base64url'
+      });
+    } catch (cause) {
+      throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = input => {
+    try {
+      const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, ''));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === 'string') {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== 'string') {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    throw err;
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, 'codeVerifier');
+  return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));
+}
+// cspell:ignore pkce
+const createPkceValues = async () => {
+  const codeVerifier = generateRandomCodeVerifier();
+  const codeChallenge = await calculatePKCECodeChallenge(codeVerifier);
+  return {
+    codeChallenge,
+    codeVerifier
+  };
+};
 const getCurrentHref = async () => {
   try {
     return await invoke('Layout.getHref');
@@ -1521,7 +1630,7 @@ const errorHtml = `<!doctype html>
 const getElectronRedirectUri = async uid => {
   const localOauthServerPort = await invoke$2('OAuthServer.create', String(uid), successHtml, errorHtml);
-  return `http://localhost:${localOauthServerPort}`;
+  return `http://localhost:${localOauthServerPort}/callback`;
 };
 const getEffectiveRedirectUri = async (platform, uid, redirectUri) => {
@@ -1534,13 +1643,29 @@ const getEffectiveRedirectUri = async (platform, uid, redirectUri) => {
   return getCurrentHref();
 };
-const getBackendLoginRequest = async (backendUrl, platform = 0, uid = 0, redirectUri = '') => {
-  const loginUrl = new URL(getBackendAuthUrl(backendUrl, '/login'));
+const oidcClientId = 'lvce-editor-native';
+const oidcScope = 'openid offline_access profile email';
+const getBackendLoginRequest = async (backendUrl, platform = 0, uid = 0, redirectUri = '', createPkceValuesFn = createPkceValues, createRandomUuid = () => globalThis.crypto.randomUUID()) => {
   const effectiveRedirectUri = await getEffectiveRedirectUri(platform, uid, redirectUri);
+  const {
+    codeChallenge,
+    codeVerifier
+  } = await createPkceValuesFn();
+  const loginUrl = new URL(getBackendAuthUrl(backendUrl, '/oidc/auth'));
+  loginUrl.searchParams.set('client_id', oidcClientId);
+  loginUrl.searchParams.set('code_challenge', codeChallenge);
+  loginUrl.searchParams.set('code_challenge_method', 'S256');
+  loginUrl.searchParams.set('nonce', createRandomUuid());
+  loginUrl.searchParams.set('prompt', 'consent');
+  loginUrl.searchParams.set('response_type', 'code');
+  loginUrl.searchParams.set('scope', oidcScope);
+  loginUrl.searchParams.set('state', createRandomUuid());
   if (effectiveRedirectUri) {
     loginUrl.searchParams.set('redirect_uri', effectiveRedirectUri);
   }
   return {
+    codeVerifier,
     loginUrl: loginUrl.toString(),
     redirectUri: effectiveRedirectUri
   };
@@ -1566,52 +1691,23 @@ const isLoginResponse = value => {
   return true;
 };
-const getBackendNativeExchangeUrl = backendUrl => {
-  return getBackendAuthUrl(backendUrl, '/auth/native/exchange');
-};
-const getExchangeErrorMessage = async response => {
-  try {
-    const payload = await response.json();
-    if (payload && typeof payload === 'object' && typeof payload.error === 'string' && payload.error) {
-      return payload.error;
-    }
-  } catch {
-    // ignore
-  }
-  return 'Backend authentication failed.';
-};
-const exchangeElectronAuthorizationCode = async (backendUrl, code, redirectUri) => {
-  const response = await fetch(getBackendNativeExchangeUrl(backendUrl), {
-    body: JSON.stringify({
-      code,
-      redirectUri
-    }),
-    credentials: 'include',
-    headers: {
-      Accept: 'application/json',
-      'Content-Type': 'application/json'
-    },
-    method: 'POST'
-  });
-  if (!response.ok) {
-    throw new Error(await getExchangeErrorMessage(response));
-  }
-};
 const hasAuthorizationCode = value => {
   return typeof value === 'string' && value.length > 0;
 };
-const waitForElectronBackendLogin = async (backendUrl, uid, redirectUri, timeoutMs = 30_000, pollIntervalMs = 1000) => {
-  const started = Date.now();
-  const deadline = started + timeoutMs;
+const getElectronAuthorizationCode = async uid => {
+  return invoke$2('OAuthServer.getCode', String(uid));
+};
+const waitForElectronBackendLogin = async (uid, codeVerifier, timeoutMs = 30_000, pollIntervalMs = 1000, getAuthorizationCode = getElectronAuthorizationCode) => {
+  const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const authorizationCode = await invoke$2('OAuthServer.getCode', String(uid));
+    const authorizationCode = await getAuthorizationCode(uid);
     if (hasAuthorizationCode(authorizationCode)) {
-      const elapsed = Date.now() - started;
-      const remainingTime = Math.max(0, timeoutMs - elapsed);
-      await exchangeElectronAuthorizationCode(backendUrl, authorizationCode, redirectUri);
-      return waitForBackendLogin(backendUrl, remainingTime, pollIntervalMs);
+      return {
+        authCode: authorizationCode,
+        authCodeVerifier: codeVerifier,
+        authErrorMessage: '',
+        userState: 'loggedOut'
+      };
     }
     await delay(pollIntervalMs);
   }
@@ -1653,11 +1749,11 @@ const handleClickLogin = async options => {
     }
     const uid = 0;
     const {
-      loginUrl,
-      redirectUri
+      codeVerifier,
+      loginUrl
     } = await getBackendLoginRequest(backendUrl, platform, uid);
     await invoke$1('Open.openUrl', loginUrl, platform, authUseRedirect);
-    const authState = platform === Electron ? await waitForElectronBackendLogin(backendUrl, uid, redirectUri) : await waitForBackendLogin(backendUrl);
+    const authState = platform === Electron ? await waitForElectronBackendLogin(uid, codeVerifier) : await waitForBackendLogin(backendUrl);
     return {
       ...authState
     };

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/auth-worker",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Auth Worker",
   "repository": {
     "type": "git",