@mongodb-js/oidc-plugin 1.1.7 → 2.0.0

package/dist/plugin.js

@@ -15,25 +15,35 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MongoDBOIDCPluginImpl = exports.automaticRefreshTimeoutMS = void 0;
+exports.MongoDBOIDCPluginImpl = void 0;
+exports.automaticRefreshTimeoutMS = automaticRefreshTimeoutMS;
 const types_1 = require("./types");
 const util_1 = require("./util");
-const openid_client_1 = require("openid-client");
-const openid_client_2 = require("openid-client");
 const rfc_8252_http_server_1 = require("./rfc-8252-http-server");
-const util_2 = require("util");
-const crypto_1 = require("crypto");
 const events_1 = require("events");
 const api_1 = require("./api");
 const child_process_1 = require("child_process");
+const openid_client_1 = require("openid-client");
+const https_1 = require("https");
+const http_1 = require("http");
 // eslint-disable-next-line @typescript-eslint/consistent-type-imports
 let _electron = undefined;
 async function getDefaultOpenBrowser() {
@@ -41,7 +51,7 @@ async function getDefaultOpenBrowser() {
     // to open a browser.
     if (process.versions.electron && _electron !== 'cannot-require') {
         try {
-            _electron ?? (_electron = await Promise.resolve().then(() => __importStar(require('electron'))));
+            _electron ??= await Promise.resolve().then(() => __importStar(require('electron')));
             return ({ url }) => 
             // eslint-disable-next-line @typescript-eslint/consistent-type-imports
             _electron.shell.openExternal(url);
@@ -88,17 +98,17 @@ function tokenExpiryInSeconds(tokenSet = {}, passIdTokenAsAccessToken = false, n
     // specifies the token expiry. Otherwise, we assume that the `expires_at`
     // value presented by the OIDC provider is correct, since OIDC clients are
     // not supposed to inspect access tokens and treat them as opaque.
-    const expiresAt = (tokenSet.id_token &&
+    const expiresAt = (tokenSet.idTokenClaims?.exp !== undefined &&
         passIdTokenAsAccessToken &&
-        tokenSet.claims?.().exp) ||
-        tokenSet.expires_at ||
+        tokenSet.idTokenClaims?.exp) ||
+        tokenSet.expiresAt ||
         0;
     return Math.max(0, (expiresAt ?? 0) - now / 1000);
 }
 /** @internal Exported for testing only */
 function automaticRefreshTimeoutMS(tokenSet, passIdTokenAsAccessToken = false, now = Date.now()) {
     const expiresIn = tokenExpiryInSeconds(tokenSet, passIdTokenAsAccessToken, now);
-    if (!tokenSet.refresh_token || !expiresIn)
+    if (!tokenSet.refreshToken || !expiresIn)
         return;
     // If the tokens expire in more than 1 minute, automatically register
     // a refresh handler. (They should not expire in less; however,
@@ -110,9 +120,9 @@ function automaticRefreshTimeoutMS(tokenSet, passIdTokenAsAccessToken = false, n
         return Math.max(expiresIn - 300 /* 5 minutes */, expiresIn / 2) * 1000;
     }
 }
-exports.automaticRefreshTimeoutMS = automaticRefreshTimeoutMS;
 const kEnableFallback = Symbol.for('@@mdb.oidcplugin.kEnableFallback');
 let updateIdCounter = 0;
+let authStateIdCounter = 0;
 function allowFallbackIfFailed(promise) {
     return promise.catch((err) => {
         // Tell the outer logic here to fallback to device auth flow if it is
@@ -125,9 +135,13 @@ function allowFallbackIfFailed(promise) {
 }
 /** @internal */
 class MongoDBOIDCPluginImpl {
+    options;
+    logger;
+    mapIdpToAuthState = new Map();
+    mongoClientOptions;
+    timers;
+    destroyed = false;
     constructor(options) {
-        this.mapIdpToAuthState = new Map();
-        this.destroyed = false;
         this.options = options;
         this.logger = options.logger ?? new events_1.EventEmitter();
         this.mongoClientOptions = {
@@ -140,6 +154,12 @@ class MongoDBOIDCPluginImpl {
             this._deserialize(options.serializedState);
         }
     }
+    /** @internal Public for testing only. */
+    static createOIDCAuthStateId() {
+        // Use an ID for the OIDC auth state, so that we can distinguish
+        // between different auth states in logs.
+        return `${Date.now().toString(32)}-${authStateIdCounter++}`;
+    }
     _deserialize(serialized) {
         try {
             let original;
@@ -147,13 +167,14 @@ class MongoDBOIDCPluginImpl {
                 original = JSON.parse(Buffer.from(serialized, 'base64').toString('utf8'));
             }
             catch (err) {
-                throw new types_1.MongoDBOIDCError(`Stored OIDC data could not be deserialized: ${err.message}`);
+                throw new types_1.MongoDBOIDCError(`Stored OIDC data could not be deserialized: ${err.message}`, { cause: err, codeName: 'DeserializeFormatMismatch' });
             }
-            if (original.oidcPluginStateVersion !== 0) {
-                throw new types_1.MongoDBOIDCError(`Stored OIDC data could not be deserialized because of a version mismatch (got ${JSON.stringify(original.oidcPluginStateVersion)}, expected 0)`);
+            if (original.oidcPluginStateVersion !== 1) {
+                throw new types_1.MongoDBOIDCError(`Stored OIDC data could not be deserialized because of a version mismatch (got ${JSON.stringify(original.oidcPluginStateVersion)}, expected 1)`, { codeName: 'DeserializeVersionMismatch' });
             }
             for (const [key, serializedState] of original.state) {
                 const state = {
+                    id: serializedState.id ?? MongoDBOIDCPluginImpl.createOIDCAuthStateId(),
                     serverOIDCMetadata: { ...serializedState.serverOIDCMetadata },
                     currentAuthAttempt: null,
                     currentTokenSet: null,
@@ -162,7 +183,9 @@ class MongoDBOIDCPluginImpl {
                         : undefined,
                     discardingTokenSets: serializedState.discardingTokenSets,
                 };
-                this.updateStateWithTokenSet(state, new openid_client_1.TokenSet(serializedState.currentTokenSet.set));
+                if (serializedState.currentTokenSet.set) {
+                    this.updateStateWithTokenSet(state, util_1.TokenSet.fromSerialized(serializedState.currentTokenSet.set));
+                }
                 this.mapIdpToAuthState.set(key, state);
             }
         }
@@ -180,16 +203,17 @@ class MongoDBOIDCPluginImpl {
     // Separate method so we can re-use the inferred return type in _deserialize()
     _serialize() {
         return {
-            oidcPluginStateVersion: 0,
+            oidcPluginStateVersion: 1,
             state: [...this.mapIdpToAuthState]
                 .filter(([, state]) => !!state.currentTokenSet)
                 .map(([key, state]) => {
                 return [
                     key,
                     {
+                        id: state.id,
                         serverOIDCMetadata: { ...state.serverOIDCMetadata },
                         currentTokenSet: {
-                            set: { ...state.currentTokenSet?.set },
+                            set: state.currentTokenSet?.set?.serialize(),
                         },
                         lastIdTokenClaims: state.lastIdTokenClaims
                             ? { ...state.lastIdTokenClaims }
@@ -222,11 +246,13 @@ class MongoDBOIDCPluginImpl {
     // or create a new one if none exists.
     getAuthState(serverMetadata) {
         if (!serverMetadata.issuer || typeof serverMetadata.issuer !== 'string') {
-            throw new types_1.MongoDBOIDCError(`'issuer' is missing`);
+            throw new types_1.MongoDBOIDCError(`'issuer' is missing`, {
+                codeName: 'MissingIssuer',
+            });
         }
         (0, util_1.validateSecureHTTPUrl)(serverMetadata.issuer, 'issuer');
         if (!serverMetadata.clientId) {
-            throw new types_1.MongoDBOIDCError('No clientId passed in server OIDC metadata object');
+            throw new types_1.MongoDBOIDCError('No clientId passed in server OIDC metadata object', { codeName: 'MissingClientId' });
         }
         const key = JSON.stringify({
             // If any part of the server metadata changes, we should probably use
@@ -238,101 +264,109 @@ class MongoDBOIDCPluginImpl {
             return existing;
         const newState = {
             serverOIDCMetadata: serverMetadata,
+            id: MongoDBOIDCPluginImpl.createOIDCAuthStateId(),
             currentAuthAttempt: null,
             currentTokenSet: null,
         };
         this.mapIdpToAuthState.set(key, newState);
         return newState;
     }
-    getSupportedDefaultScopes(issuer) {
+    getSupportedDefaultScopes(idpMetadata) {
         return ['openid', 'offline_access'].filter((scope) => {
             // Only add `openid` / `offline_access` if the IdP announces support
             // for those scopes, or if the IdP does not provide a list of scopes
             // and we cannot tell which it supports.
             // https://jira.mongodb.org/browser/COMPASS-7437
-            return (!Array.isArray(issuer.metadata.scopes_supported) ||
-                issuer.metadata.scopes_supported.includes(scope));
+            return (!Array.isArray(idpMetadata.scopes_supported) ||
+                idpMetadata.scopes_supported.includes(scope));
         });
     }
-    // prettier does not understand the return type syntax, TS does
-    getIssuerClass() {
-        var _a, _b;
-        const oidcPluginCustomHttpOptionsProvider = (urlObject, options) => {
-            const url = urlObject.toString();
-            this.logger.emit('mongodb-oidc-plugin:outbound-http-request', { url });
-            (0, util_1.validateSecureHTTPUrl)(url, '<generic>');
-            const { customHttpOptions } = this.options;
-            if (customHttpOptions && typeof customHttpOptions === 'object')
-                return customHttpOptions;
-            else
-                return customHttpOptions?.(url, options) ?? {};
-        };
-        class CustomIssuer extends openid_client_2.Issuer {
-            constructor(...params) {
-                super(...params);
-                this[_a] = oidcPluginCustomHttpOptionsProvider;
-                this.Client[openid_client_1.custom.http_options] = oidcPluginCustomHttpOptionsProvider;
-                this.Client.prototype[openid_client_1.custom.http_options] =
-                    oidcPluginCustomHttpOptionsProvider;
-            }
-            static async discover(issuer) {
-                return new this((await super.discover(issuer)).metadata);
+    fetch = async (url, init) => {
+        this.logger.emit('mongodb-oidc-plugin:outbound-http-request', { url });
+        if (this.options.customFetch) {
+            return await this.options.customFetch(url, init);
+        }
+        const options = typeof this.options.customHttpOptions === 'function'
+            ? this.options.customHttpOptions(url, {})
+            : this.options.customHttpOptions;
+        // Same comments as in getDefaultOpenBrowser() apply regarding the import/eval fallbacks here.
+        // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+        let fetch;
+        try {
+            fetch = (await Promise.resolve().then(() => __importStar(require('node-fetch')))).default;
+        }
+        catch (err) {
+            if (err &&
+                typeof err === 'object' &&
+                'code' in err &&
+                err.code === 'ERR_REQUIRE_ESM' &&
+                typeof __webpack_require__ === 'undefined') {
+                fetch = (await eval('import("node-fetch")')).default;
             }
-            static async webfinger(input) {
-                return new this((await super.discover(input)).metadata);
+            else {
+                throw err;
             }
         }
-        _a = openid_client_1.custom.http_options, _b = openid_client_1.custom.http_options;
-        CustomIssuer[_b] = oidcPluginCustomHttpOptionsProvider;
-        return CustomIssuer;
-    }
-    async getOIDCClient(state, redirectURIs) {
+        const AgentClass = new URL(url).protocol === 'https:' ? https_1.Agent : http_1.Agent;
+        return (await fetch(url, {
+            ...init,
+            agent: options?.agent ?? new AgentClass(options),
+            ...options,
+            headers: { ...options?.headers },
+            // TS is not convinced that node-fetch and built-in fetch are compatible enough
+        }));
+    };
+    async getOIDCClientConfiguration(state, redirectURI) {
         const serverMetadata = state.serverOIDCMetadata;
-        const makeScope = (issuer) => [
+        const makeScope = (idpMetadata) => [
             ...new Set([
-                ...this.getSupportedDefaultScopes(issuer),
+                ...this.getSupportedDefaultScopes(idpMetadata),
                 ...(serverMetadata.requestScopes ?? []),
             ]),
         ].join(' ');
-        if (state.client) {
+        if (state.config) {
+            const config = new openid_client_1.Configuration(state.config.serverMetadata(), state.config.clientMetadata().client_id, {
+                ...state.config.clientMetadata(),
+                redirect_uri: redirectURI,
+            });
+            if ((0, util_1.validateSecureHTTPUrl)(config.serverMetadata().issuer, 'issuer') ===
+                'http-allowed') {
+                (0, openid_client_1.allowInsecureRequests)(config);
+            }
             return {
-                scope: makeScope(state.client.issuer),
-                issuer: state.client.issuer,
-                // need to re-create Client here because redirect_uris might
-                // differ between calls to this method
-                client: new state.client.issuer.Client({
-                    ...state.client.metadata,
-                    redirect_uris: redirectURIs,
-                }),
+                scope: makeScope(config.serverMetadata()),
+                config,
             };
         }
-        (0, util_1.validateSecureHTTPUrl)(serverMetadata.issuer, 'issuer');
-        let issuer;
+        const httpAllowed = (0, util_1.validateSecureHTTPUrl)(serverMetadata.issuer, 'issuer');
+        const discoveryOptions = {
+            [openid_client_1.customFetch]: this.fetch,
+            execute: httpAllowed === 'http-allowed' ? [openid_client_1.allowInsecureRequests] : [],
+        };
+        let config;
         try {
-            issuer = await this.getIssuerClass().discover(serverMetadata.issuer);
+            config = await (0, openid_client_1.discovery)(new URL(serverMetadata.issuer), serverMetadata.clientId, {
+                redirect_uri: redirectURI,
+            }, (0, openid_client_1.None)(), discoveryOptions);
+            // NB: The fact that `customFetch` is transfered from `discoveryOptions` to `config`
+            // is tested by our unit tests when they verify that all outgoing HTTP calls are logged.
         }
         catch (err) {
             // openid-client just forwards the raw Node.js HTTP error, we'll want to
             // at least include the target URL here
             throw new types_1.MongoDBOIDCError(`Unable to fetch issuer metadata for ${JSON.stringify(serverMetadata.issuer)}: ${(0, util_1.messageFromError)(err)}`, {
                 cause: err,
+                codeName: 'IssuerMetadataDiscoveryFailed',
             });
         }
-        (0, util_1.validateSecureHTTPUrl)(issuer.metadata.authorization_endpoint, 'authorization_endpoint');
-        (0, util_1.validateSecureHTTPUrl)(issuer.metadata.device_authorization_endpoint, 'device_authorization_endpoint');
-        (0, util_1.validateSecureHTTPUrl)(issuer.metadata.token_endpoint, 'token_endpoint');
-        (0, util_1.validateSecureHTTPUrl)(issuer.metadata.jwks_uri, 'jwks_uri');
-        const client = new issuer.Client({
-            client_id: serverMetadata.clientId,
-            redirect_uris: redirectURIs,
-            response_types: ['code'],
-            token_endpoint_auth_method: 'none',
-        });
-        state.client = client;
+        (0, util_1.validateSecureHTTPUrl)(config.serverMetadata().authorization_endpoint, 'authorization_endpoint');
+        (0, util_1.validateSecureHTTPUrl)(config.serverMetadata().device_authorization_endpoint, 'device_authorization_endpoint');
+        (0, util_1.validateSecureHTTPUrl)(config.serverMetadata().token_endpoint, 'token_endpoint');
+        (0, util_1.validateSecureHTTPUrl)(config.serverMetadata().jwks_uri, 'jwks_uri');
+        state.config = config;
         return {
-            scope: makeScope(issuer),
-            issuer,
-            client,
+            scope: makeScope(config.serverMetadata()),
+            config,
         };
     }
     async openBrowser(options) {
@@ -344,14 +378,14 @@ class MongoDBOIDCPluginImpl {
         // URL has this format.
         new URL(options.url);
         if (!/^[a-zA-Z0-9%/:;_.,=@-]+$/.test(options.url)) {
-            throw new types_1.MongoDBOIDCError(`Unexpected format for internally generated URL: '${options.url}'`);
+            throw new types_1.MongoDBOIDCError(`Unexpected format for internally generated URL: '${options.url}'`, { codeName: 'GeneratedUrlInvalidForOpenBrowserCommand' });
         }
         this.logger.emit('mongodb-oidc-plugin:open-browser', {
             customOpener: !!this.options.openBrowser,
         });
         if (this.options.openBrowser === false) {
             // We should never really get to this point
-            throw new types_1.MongoDBOIDCError('Cannot open browser if `openBrowser` is false');
+            throw new types_1.MongoDBOIDCError('Cannot open browser if `openBrowser` is false', { codeName: 'OpenBrowserDisabled' });
         }
         if (typeof this.options.openBrowser === 'function') {
             return await this.options.openBrowser(options);
@@ -370,13 +404,15 @@ class MongoDBOIDCPluginImpl {
             child.unref();
             return child;
         }
-        throw new types_1.MongoDBOIDCError('Unknown format for `openBrowser`');
+        throw new types_1.MongoDBOIDCError('Unknown format for `openBrowser`', {
+            codeName: 'OpenBrowserOptionFormatUnknown',
+        });
     }
     async notifyDeviceFlow(deviceFlowInformation) {
         (0, util_1.validateSecureHTTPUrl)(deviceFlowInformation.verificationUrl, 'verificationUrl');
         if (!this.options.notifyDeviceFlow) {
             // Should never happen.
-            throw new types_1.MongoDBOIDCError('notifyDeviceFlow() requested but not provided');
+            throw new types_1.MongoDBOIDCError('notifyDeviceFlow() requested but not provided', { codeName: 'DeviceFlowNotEnabled' });
         }
         this.logger.emit('mongodb-oidc-plugin:notify-device-flow');
         await this.options.notifyDeviceFlow(deviceFlowInformation);
@@ -388,18 +424,22 @@ class MongoDBOIDCPluginImpl {
         // for client A, the token expires before it is requested again by client A,
         // then the plugin is passed to client B which requests a token, and we
         // receive mismatching tokens for different users or different audiences.
-        if (!tokenSet.id_token &&
+        if (!tokenSet.idToken &&
             state.lastIdTokenClaims &&
             !state.lastIdTokenClaims.noIdToken) {
-            throw new types_1.MongoDBOIDCError(`ID token expected, but not found. Expected claims: ${JSON.stringify(state.lastIdTokenClaims)}`);
+            throw new types_1.MongoDBOIDCError(`ID token expected, but not found. Expected claims: ${JSON.stringify(state.lastIdTokenClaims)}`, { codeName: 'IDTokenClaimsMismatchTokenMissing' });
         }
-        if (tokenSet.id_token &&
+        if (tokenSet.idToken &&
             state.lastIdTokenClaims &&
             state.lastIdTokenClaims.noIdToken) {
-            throw new types_1.MongoDBOIDCError(`Unexpected ID token received.`);
+            throw new types_1.MongoDBOIDCError(`Unexpected ID token received.`, {
+                codeName: 'IDTokenClaimsMismatchTokenUnexpectedlyPresent',
+            });
         }
-        if (tokenSet.id_token) {
-            const idTokenClaims = tokenSet.claims();
+        if (tokenSet.idToken) {
+            const idTokenClaims = tokenSet.idTokenClaims;
+            if (!idTokenClaims)
+                throw new types_1.MongoDBOIDCError('Internal error: id_token set but claims() unavailable', { codeName: 'IDTokenClaimsUnavailable' });
             if (state.lastIdTokenClaims && !state.lastIdTokenClaims.noIdToken) {
                 for (const claim of ['aud', 'sub']) {
                     const normalize = (value) => {
@@ -408,7 +448,7 @@ class MongoDBOIDCPluginImpl {
                     const knownClaim = normalize(state.lastIdTokenClaims[claim]);
                     const newClaim = normalize(idTokenClaims[claim]);
                     if (knownClaim !== newClaim) {
-                        throw new types_1.MongoDBOIDCError(`Unexpected '${claim}' field in id token: Expected ${knownClaim}, saw ${newClaim}`);
+                        throw new types_1.MongoDBOIDCError(`Unexpected '${claim}' field in id token: Expected ${knownClaim}, saw ${newClaim}`, { codeName: 'IDTokenClaimsMismatchClaimMismatch' });
                     }
                 }
             }
@@ -421,7 +461,7 @@ class MongoDBOIDCPluginImpl {
             state.lastIdTokenClaims = { noIdToken: true };
             this.logger.emit('mongodb-oidc-plugin:missing-id-token');
         }
-        const refreshTokenId = (0, util_1.getRefreshTokenId)(tokenSet.refresh_token);
+        const refreshTokenId = (0, util_1.getRefreshTokenId)(tokenSet.refreshToken);
         const updateId = updateIdCounter++;
         const timerDuration = automaticRefreshTimeoutMS(tokenSet, this.options.passIdTokenAsAccessToken);
         // Use `.call()` because in browsers, `setTimeout()` requires that it is called
@@ -443,7 +483,7 @@ class MongoDBOIDCPluginImpl {
                 this.logger.emit('mongodb-oidc-plugin:refresh-skipped', {
                     triggeringUpdateId: updateId,
                     expectedRefreshToken: refreshTokenId,
-                    actualRefreshToken: (0, util_1.getRefreshTokenId)(state.currentTokenSet?.set?.refresh_token),
+                    actualRefreshToken: (0, util_1.getRefreshTokenId)(state.currentTokenSet?.set?.refreshToken),
                 });
                 return false;
             }
@@ -452,15 +492,17 @@ class MongoDBOIDCPluginImpl {
                     triggeringUpdateId: updateId,
                     refreshToken: refreshTokenId,
                 });
-                const { client } = await this.getOIDCClient(state);
-                const refreshedTokens = await client.refresh(tokenSet);
+                if (!tokenSet.refreshToken)
+                    return false;
+                const { config } = await this.getOIDCClientConfiguration(state);
+                const refreshedTokens = await (0, openid_client_1.refreshTokenGrant)(config, tokenSet.refreshToken);
                 // Check again to avoid race conditions.
                 if (state.currentTokenSet?.set === tokenSet) {
                     this.logger.emit('mongodb-oidc-plugin:refresh-succeeded', {
                         triggeringUpdateId: updateId,
                         refreshToken: refreshTokenId,
                     });
-                    this.updateStateWithTokenSet(state, refreshedTokens);
+                    this.updateStateWithTokenSet(state, new util_1.TokenSet(refreshedTokens));
                     return true;
                 }
             }
@@ -480,14 +522,15 @@ class MongoDBOIDCPluginImpl {
         this.logger.emit('mongodb-oidc-plugin:state-updated', {
             updateId,
             timerDuration,
-            tokenSetId: (0, util_1.getStableTokenSetId)(tokenSet),
+            tokenSetId: tokenSet.stableId(),
         });
     }
+    static defaultRedirectURI = 'http://localhost:27097/redirect';
     async authorizationCodeFlow(state, signal) {
         const configuredRedirectURI = this.options.redirectURI ?? MongoDBOIDCPluginImpl.defaultRedirectURI;
-        const codeVerifier = openid_client_2.generators.codeVerifier();
-        const codeChallenge = openid_client_2.generators.codeChallenge(codeVerifier);
-        const oidcStateParam = (await (0, util_2.promisify)(crypto_1.randomBytes)(16)).toString('hex');
+        const codeVerifier = (0, openid_client_1.randomPKCECodeVerifier)();
+        const codeChallenge = await (0, openid_client_1.calculatePKCECodeChallenge)(codeVerifier);
+        const oidcStateParam = (0, openid_client_1.randomState)();
         const server = new rfc_8252_http_server_1.RFC8252HTTPServer({
             redirectUrl: configuredRedirectURI,
             logger: this.logger,
@@ -496,11 +539,11 @@ class MongoDBOIDCPluginImpl {
         });
         let paramsUrl = '';
         let scope;
-        let client;
+        let config;
         let actualRedirectURI;
         const nonce = this.options.skipNonceInAuthCodeRequest
             ? undefined
-            : openid_client_2.generators.nonce();
+            : (0, openid_client_1.randomNonce)();
         try {
             await (0, util_1.withAbortCheck)(signal, async ({ signalCheck, signalPromise }) => {
                 // We mark the operations that we want to allow to result in a fallback
@@ -514,18 +557,17 @@ class MongoDBOIDCPluginImpl {
                     signalPromise,
                 ]);
                 actualRedirectURI = server.listeningRedirectUrl;
-                ({ scope, client } = await this.getOIDCClient(state, [
-                    actualRedirectURI,
-                ]));
-                const authCodeFlowUrl = client.authorizationUrl({
+                ({ scope, config } = await this.getOIDCClientConfiguration(state, actualRedirectURI));
+                const authCodeFlowUrl = (0, openid_client_1.buildAuthorizationUrl)(config, {
                     scope,
                     code_challenge: codeChallenge,
                     code_challenge_method: 'S256',
                     state: oidcStateParam,
-                    nonce,
+                    ...(nonce ? { nonce } : {}),
+                    redirect_uri: actualRedirectURI,
                 });
                 (0, util_1.validateSecureHTTPUrl)(authCodeFlowUrl, 'authCodeFlowUrl');
-                const { localUrl, onAccessed: onLocalUrlAccessed } = await server.addRedirect(authCodeFlowUrl);
+                const { localUrl, onAccessed: onLocalUrlAccessed } = await server.addRedirect(authCodeFlowUrl.toString());
                 signalCheck();
                 // Handle errors from opening a browser but do not await the Promise
                 // in case it only resolves when the browser exits (which is the case
@@ -537,10 +579,10 @@ class MongoDBOIDCPluginImpl {
                         const extraErrorInfo = () => browserHandle?.spawnargs
                             ? ` (${JSON.stringify(browserHandle.spawnargs)})`
                             : '';
-                        browserHandle?.once('error', (err) => reject(new types_1.MongoDBOIDCError(`Opening browser failed with '${(0, util_1.messageFromError)(err)}'${extraErrorInfo()}`, { cause: err })));
+                        browserHandle?.once('error', (err) => reject(new types_1.MongoDBOIDCError(`Opening browser failed with '${(0, util_1.messageFromError)(err)}'${extraErrorInfo()}`, { cause: err, codeName: 'BrowserOpenFailedSpawnError' })));
                         browserHandle?.once('exit', (code) => {
                             if (code !== 0)
-                                reject(new types_1.MongoDBOIDCError(`Opening browser failed with exit code ${code}${extraErrorInfo()}`));
+                                reject(new types_1.MongoDBOIDCError(`Opening browser failed with exit code ${code}${extraErrorInfo()}`, { codeName: 'BrowserOpenFailedNonZeroExit' }));
                         });
                     })
                         .catch(reject);
@@ -548,7 +590,9 @@ class MongoDBOIDCPluginImpl {
                 const timeout = allowFallbackIfFailed(new Promise((resolve, reject) => {
                     if (this.options.openBrowserTimeout !== 0) {
                         this.timers.setTimeout
-                            .call(null, () => reject(new types_1.MongoDBOIDCError('Opening browser timed out')), this.options.openBrowserTimeout ?? api_1.kDefaultOpenBrowserTimeout)
+                            .call(null, () => reject(new types_1.MongoDBOIDCError('Opening browser timed out', {
+                            codeName: 'BrowserOpenTimeout',
+                        })), this.options.openBrowserTimeout ?? api_1.kDefaultOpenBrowserTimeout)
                             ?.unref?.();
                     }
                 }));
@@ -570,20 +614,18 @@ class MongoDBOIDCPluginImpl {
         finally {
             await server.close();
         }
-        const params = client.callbackParams(paramsUrl);
-        const tokenSet = await client.callback(actualRedirectURI, params, {
-            code_verifier: codeVerifier,
-            state: oidcStateParam,
-            nonce,
+        const tokenSet = await (0, openid_client_1.authorizationCodeGrant)(config, new URL(paramsUrl), {
+            pkceCodeVerifier: codeVerifier,
+            expectedState: oidcStateParam,
+            expectedNonce: nonce,
         });
-        this.updateStateWithTokenSet(state, tokenSet);
+        this.updateStateWithTokenSet(state, new util_1.TokenSet(tokenSet));
     }
     async deviceAuthorizationFlow(state, signal) {
-        const { scope, client } = await this.getOIDCClient(state);
+        const { scope, config } = await this.getOIDCClientConfiguration(state);
         await (0, util_1.withAbortCheck)(signal, async ({ signalCheck, signalPromise }) => {
             const deviceFlowHandle = await Promise.race([
-                client.deviceAuthorization({
-                    client_id: client.metadata.client_id,
+                (0, openid_client_1.initiateDeviceAuthorization)(config, {
                     scope,
                 }),
                 signalPromise,
@@ -593,8 +635,8 @@ class MongoDBOIDCPluginImpl {
                 userCode: deviceFlowHandle.user_code,
                 verificationUrl: deviceFlowHandle.verification_uri,
             });
-            const tokenSet = await deviceFlowHandle.poll({ signal });
-            this.updateStateWithTokenSet(state, tokenSet);
+            const tokenSet = await (0, openid_client_1.pollDeviceAuthorizationGrant)(config, deviceFlowHandle, {}, { signal });
+            this.updateStateWithTokenSet(state, new util_1.TokenSet(tokenSet));
         });
     }
     async initiateAuthAttempt(state, driverAbortSignal, { forceRefreshOrReauth = false } = {}) {
@@ -619,12 +661,14 @@ class MongoDBOIDCPluginImpl {
                     tokenExpiryInSeconds(state.currentTokenSet?.set, passIdTokenAsAccessToken) >
                         5 * 60) {
                     this.logger.emit('mongodb-oidc-plugin:skip-auth-attempt', {
+                        authStateId: state.id,
                         reason: 'not-expired',
                     });
                     break get_tokens;
                 }
                 if (await state.currentTokenSet?.tryRefresh?.()) {
                     this.logger.emit('mongodb-oidc-plugin:skip-auth-attempt', {
+                        authStateId: state.id,
                         reason: 'refresh-succeeded',
                     });
                     break get_tokens;
@@ -635,15 +679,19 @@ class MongoDBOIDCPluginImpl {
                 if (currentAllowedFlowSet.includes('auth-code')) {
                     try {
                         this.logger.emit('mongodb-oidc-plugin:auth-attempt-started', {
+                            authStateId: state.id,
                             flow: 'auth-code',
                         });
                         await this.authorizationCodeFlow(state, signal);
-                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded');
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded', {
+                            authStateId: state.id,
+                        });
                         break get_tokens;
                     }
                     catch (err) {
                         error = err;
                         this.logger.emit('mongodb-oidc-plugin:auth-attempt-failed', {
+                            authStateId: state.id,
                             error: (0, util_1.errorString)(err),
                         });
                         // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -654,14 +702,18 @@ class MongoDBOIDCPluginImpl {
                 if (currentAllowedFlowSet.includes('device-auth')) {
                     try {
                         this.logger.emit('mongodb-oidc-plugin:auth-attempt-started', {
+                            authStateId: state.id,
                             flow: 'device-auth',
                         });
                         await this.deviceAuthorizationFlow(state, signal);
-                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded');
+                        this.logger.emit('mongodb-oidc-plugin:auth-attempt-succeeded', {
+                            authStateId: state.id,
+                        });
                         break get_tokens;
                     }
                     catch (err) {
                         this.logger.emit('mongodb-oidc-plugin:auth-attempt-failed', {
+                            authStateId: state.id,
                             error: (0, util_1.errorString)(err),
                         });
                         throw err;
@@ -670,15 +722,20 @@ class MongoDBOIDCPluginImpl {
                 if (error)
                     throw error;
             }
-            if (passIdTokenAsAccessToken && !state.currentTokenSet?.set?.id_token) {
-                throw new types_1.MongoDBOIDCError('Could not retrieve valid ID token');
+            if (passIdTokenAsAccessToken && !state.currentTokenSet?.set?.idToken) {
+                throw new types_1.MongoDBOIDCError('Could not retrieve valid ID token', {
+                    codeName: 'IDTokenMissingFromTokenSet',
+                });
             }
-            else if (!state.currentTokenSet?.set?.access_token) {
-                throw new types_1.MongoDBOIDCError('Could not retrieve valid access token');
+            else if (!state.currentTokenSet?.set?.accessToken) {
+                throw new types_1.MongoDBOIDCError('Could not retrieve valid access token', {
+                    codeName: 'AccessTokenMissingFromTokenSet',
+                });
             }
         }
         catch (err) {
             this.logger.emit('mongodb-oidc-plugin:auth-failed', {
+                authStateId: state.id,
                 error: (0, util_1.errorString)(err),
             });
             throw err;
@@ -687,21 +744,23 @@ class MongoDBOIDCPluginImpl {
             this.options.signal?.removeEventListener('abort', optionsAbortCb);
             driverAbortSignal?.removeEventListener('abort', driverAbortCb);
         }
-        const { token_type, expires_at, access_token, id_token, refresh_token } = state.currentTokenSet.set;
-        const tokenSetId = (0, util_1.getStableTokenSetId)(state.currentTokenSet.set);
+        const { tokenType, accessToken, idToken, refreshToken } = state.currentTokenSet.set;
+        const expiresAt = state.currentTokenSet.set.expiresAt;
+        const tokenSetId = state.currentTokenSet.set.stableId();
         // We would not want to return the access token or ID token of a token set whose
         // accompanying refresh token was passed to us by the driver
         const willRetryWithForceRefreshOrReauth = !forceRefreshOrReauth &&
             !!state.discardingTokenSets?.includes(tokenSetId);
         this.logger.emit('mongodb-oidc-plugin:auth-succeeded', {
-            tokenType: token_type ?? null,
-            refreshToken: (0, util_1.getRefreshTokenId)(refresh_token),
-            expiresAt: expires_at ? new Date(expires_at * 1000).toISOString() : null,
+            authStateId: state.id,
+            tokenType: tokenType ?? null, // DPoP or Bearer
+            refreshToken: (0, util_1.getRefreshTokenId)(refreshToken),
+            expiresAt: expiresAt ? new Date(expiresAt * 1000).toISOString() : null,
             passIdTokenAsAccessToken: !!passIdTokenAsAccessToken,
             tokens: {
-                accessToken: access_token,
-                idToken: id_token,
-                refreshToken: refresh_token,
+                accessToken: accessToken,
+                idToken: idToken,
+                refreshToken: refreshToken,
             },
             tokenSetId,
             forceRefreshOrReauth,
@@ -713,7 +772,7 @@ class MongoDBOIDCPluginImpl {
             });
         }
         return {
-            accessToken: passIdTokenAsAccessToken ? id_token || '' : access_token,
+            accessToken: passIdTokenAsAccessToken ? idToken || '' : accessToken,
             refreshToken: tokenSetId,
             // Passing `expiresInSeconds: 0` results in the driver not caching the token.
             // We perform our own caching here inside the plugin, so interactions with the
@@ -731,22 +790,33 @@ class MongoDBOIDCPluginImpl {
         if (params.version !== 1) {
             throw new types_1.MongoDBOIDCError(
             // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
-            `OIDC MongoDB driver protocol mismatch: unknown version ${params.version}`);
+            `OIDC MongoDB driver protocol mismatch: unknown version ${params.version}`, { codeName: 'ProtocolVersionMismatch' });
         }
         if (this.destroyed) {
-            throw new types_1.MongoDBOIDCError('This OIDC plugin instance has been destroyed and is no longer active');
+            throw new types_1.MongoDBOIDCError('This OIDC plugin instance has been destroyed and is no longer active', { codeName: 'PluginInstanceDestroyed' });
         }
         if (!params.idpInfo) {
-            throw new types_1.MongoDBOIDCError('No IdP information provided');
+            throw new types_1.MongoDBOIDCError('No IdP information provided', {
+                codeName: 'IdPInfoMissing',
+            });
         }
         const state = this.getAuthState({
             ...params.idpInfo,
             username: params.username,
         });
+        this.logger.emit('mongodb-oidc-plugin:request-token-started', {
+            authStateId: state.id,
+            isCurrentAuthAttemptSet: !!state.currentAuthAttempt,
+            tokenSetId: params.refreshToken,
+            username: state.serverOIDCMetadata.username,
+            issuer: state.serverOIDCMetadata.issuer,
+            clientId: state.serverOIDCMetadata.clientId,
+            requestScopes: state.serverOIDCMetadata.requestScopes,
+        });
         // If the driver called us with a refresh token, that means that its corresponding
         // access token has become invalid and we should always return a new one.
         if (params.refreshToken) {
-            (state.discardingTokenSets ?? (state.discardingTokenSets = [])).push(params.refreshToken);
+            (state.discardingTokenSets ??= []).push(params.refreshToken);
             this.logger.emit('mongodb-oidc-plugin:discarding-token-set', {
                 tokenSetId: params.refreshToken,
             });
@@ -766,6 +836,15 @@ class MongoDBOIDCPluginImpl {
             }
         }
         finally {
+            this.logger.emit('mongodb-oidc-plugin:request-token-ended', {
+                authStateId: state.id,
+                isCurrentAuthAttemptSet: !!state.currentAuthAttempt,
+                tokenSetId: params.refreshToken,
+                username: state.serverOIDCMetadata.username,
+                issuer: state.serverOIDCMetadata.issuer,
+                clientId: state.serverOIDCMetadata.clientId,
+                requestScopes: state.serverOIDCMetadata.requestScopes,
+            });
             if (params.refreshToken) {
                 const index = state.discardingTokenSets?.indexOf(params.refreshToken) ?? -1;
                 if (index > 0) {
@@ -787,5 +866,4 @@ class MongoDBOIDCPluginImpl {
     }
 }
 exports.MongoDBOIDCPluginImpl = MongoDBOIDCPluginImpl;
-MongoDBOIDCPluginImpl.defaultRedirectURI = 'http://localhost:27097/redirect';
 //# sourceMappingURL=plugin.js.map