@marktiderman/genesis-connect 0.2.0 → 0.3.0

package/dist/index.js

@@ -108,7 +108,12 @@ function identityFromTokenEndpoint(idToken, expect) {
   const audiences = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud : [];
   if (!audiences.includes(expect.clientId))
     return { reason: "audience mismatch" };
-  if (audiences.length > 1 && claims["azp"] !== expect.clientId)
+  if (audiences.some(
+    (a) => a !== expect.clientId && !(typeof a === "string" && expect.trustedAudiences.includes(a))
+  ))
+    return { reason: "untrusted audience" };
+  const azp = claims["azp"];
+  if (azp !== void 0 && azp !== expect.clientId || audiences.length > 1 && azp === void 0)
     return { reason: "authorized party mismatch" };
   const exp = claims["exp"];
   if (typeof exp !== "number" || exp * 1e3 <= expect.now)
@@ -183,6 +188,21 @@ function checkOrigin(value, what) {
   }
   return origin;
 }
+function checkEndpoint(value, what) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ConnectError("config", `The provider's ${what} is not a URL`);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && isLocal(url.hostname))) {
+    throw new ConnectError(
+      "config",
+      `The provider's ${what} must be https (http only on localhost)`
+    );
+  }
+  return value;
+}
 function checkPath(value, what) {
   if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//") || /[\\\s\x00-\x1f\x7f]/.test(value) || value.length > 512) {
     throw new ConnectError(
@@ -219,6 +239,7 @@ function scopeList(scopes, separator) {
   return list;
 }
 var DEFAULT_TIMEOUT_MS = 1e4;
+var ABANDON_TIMEOUT_MS = 3e3;
 async function timedFetch(deps, url, init, signal) {
   const timeout = AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS);
   const combined = signal ? anySignal([timeout, signal]) : timeout;
@@ -288,6 +309,8 @@ function createConnector(config) {
       "config",
       "The provider needs an id, an authorize URL and a token URL"
     );
+  checkEndpoint(provider.tokenUrl, "token URL");
+  if (provider.revokeUrl) checkEndpoint(provider.revokeUrl, "revoke URL");
   if (!config.clientId || !config.clientSecret)
     throw new ConnectError(
       "config",
@@ -357,6 +380,21 @@ function createConnector(config) {
   );
   const aliases = provider.scopeAliases ?? {};
   const normalScope = (scope) => aliases[scope] ?? scope;
+  const asksOpenid = (scopes) => scopes.some((scope) => normalScope(scope) === "openid");
+  const issuers = (typeof provider.issuer === "string" ? [provider.issuer] : provider.issuer ?? []).filter((issuer) => typeof issuer === "string" && issuer.trim() !== "");
+  if (config.requireIdentity) {
+    if (issuers.length === 0)
+      throw new ConnectError(
+        "config",
+        `requireIdentity needs the ${provider.id} provider's issuer`
+      );
+    if (!asksOpenid(defaultScopes))
+      throw new ConnectError(
+        "config",
+        "requireIdentity needs the openid scope in the connector's scopes"
+      );
+  }
+  const trustedAudiences = [...config.trustedAudiences ?? []];
   const now = () => config.now?.() ?? Date.now();
   const log = (event) => {
     try {
@@ -607,6 +645,46 @@ ${refreshToken}`);
       tokenCache.set(await cacheKey(plain), entry);
     }
   }
+  async function revokeToken(token, hint, signal) {
+    if (!provider.revokeUrl) return false;
+    const body = new URLSearchParams({ token, token_type_hint: hint });
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded",
+      accept: "application/json"
+    };
+    if (provider.revokeWithClientAuth) clientAuth(body, headers);
+    try {
+      const response = await timedFetch(
+        config,
+        provider.revokeUrl,
+        { method: "POST", headers, body: body.toString() },
+        signal
+      );
+      let gone = response.ok;
+      if (!gone && response.status === 400) {
+        gone = errorCode(await jsonBody(response)) === "invalid_token";
+      } else {
+        discard(response);
+      }
+      log({
+        step: "revoke",
+        result: gone ? "revoked" : "failed",
+        ...gone ? {} : { detail: `revoke endpoint answered ${response.status}` }
+      });
+      return gone;
+    } catch {
+      log({ step: "revoke", result: "unavailable" });
+      return false;
+    }
+  }
+  function abandonGrant(refreshToken, accessToken) {
+    if (config.revokeFailedGrants !== true) return;
+    const [token, hint] = typeof refreshToken === "string" && refreshToken ? [refreshToken, "refresh_token"] : [accessToken, "access_token"];
+    revokeToken(token, hint, AbortSignal.timeout(ABANDON_TIMEOUT_MS)).catch(
+      () => {
+      }
+    );
+  }
   return {
     provider,
     redirectUri,
@@ -639,6 +717,11 @@ ${refreshToken}`);
           "usage",
           "No scopes to ask for: give the connector or start some"
         );
+      if (config.requireIdentity && !asksOpenid(scopes))
+        throw new ConnectError(
+          "usage",
+          "requireIdentity needs the openid scope: start's scopes leave it out"
+        );
       const nonce = randomToken(16);
       const verifier = randomToken(32);
       const state = await signState({
@@ -742,8 +825,10 @@ ${refreshToken}`);
         return back(request, state, "failed", {}, "no access token");
       }
       const { scope, scopes } = granted(body, state.scopes);
-      if (!state.scopes.every((s) => scopes.includes(normalScope(s))))
+      if (!state.scopes.every((s) => scopes.includes(normalScope(s)))) {
+        abandonGrant(refreshToken, accessToken);
         return back(request, state, "scope");
+      }
       if ((config.requireRefreshToken ?? true) && (typeof refreshToken !== "string" || !refreshToken)) {
         return back(
           request,
@@ -754,16 +839,19 @@ ${refreshToken}`);
         );
       }
       const idToken = typeof body["id_token"] === "string" ? body["id_token"] : void 0;
-      const issuer = config.provider.issuer;
-      const read = idToken ? identityFromTokenEndpoint(idToken, {
-        issuers: typeof issuer === "string" ? [issuer] : issuer ?? [],
+      const wantsIdentity = config.requireIdentity === true || asksOpenid(state.scopes);
+      const read = !wantsIdentity ? void 0 : idToken ? identityFromTokenEndpoint(idToken, {
+        issuers,
         clientId: config.clientId,
+        trustedAudiences,
         now: now()
-      }) : { reason: "no ID token (is openid asked for?)" };
-      const identity = "subject" in read ? read : void 0;
-      const identityNote = "reason" in read ? `no identity: ${read.reason}` : void 0;
-      if (!identity && config.requireIdentity)
+      }) : { reason: "no ID token" };
+      const identity = read && "subject" in read ? read : void 0;
+      const identityNote = read && "reason" in read ? `no identity: ${read.reason}` : void 0;
+      if (!identity && config.requireIdentity) {
+        abandonGrant(refreshToken, accessToken);
         return back(request, state, "failed", {}, identityNote);
+      }
       let extra;
       try {
         const id = config.randomId?.() ?? crypto.randomUUID();
@@ -819,39 +907,7 @@ ${refreshToken}`);
     async revoke(sealedRefreshToken, aad, options = {}) {
       const refreshToken = await config.secrets.open(sealedRefreshToken, aad);
       tokenCache.delete(await cacheKey(refreshToken));
-      if (!provider.revokeUrl) return false;
-      const body = new URLSearchParams({
-        token: refreshToken,
-        token_type_hint: "refresh_token"
-      });
-      const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-        accept: "application/json"
-      };
-      if (provider.revokeWithClientAuth) clientAuth(body, headers);
-      try {
-        const response = await timedFetch(
-          config,
-          provider.revokeUrl,
-          { method: "POST", headers, body: body.toString() },
-          options.signal
-        );
-        let gone = response.ok;
-        if (!gone && response.status === 400) {
-          gone = errorCode(await jsonBody(response)) === "invalid_token";
-        } else {
-          discard(response);
-        }
-        log({
-          step: "revoke",
-          result: gone ? "revoked" : "failed",
-          ...gone ? {} : { detail: `revoke endpoint answered ${response.status}` }
-        });
-        return gone;
-      } catch {
-        log({ step: "revoke", result: "unavailable" });
-        return false;
-      }
+      return revokeToken(refreshToken, "refresh_token", options.signal);
     }
   };
 }