@muze-nl/metro-oidc 0.1.5 → 0.2.0

package/dist/browser.js

@@ -1382,7 +1382,7 @@
     }
     async function fetchAccessToken() {
       if (oauth22.grant_type === "authorization_code" && !options.tokens.has("authorization_code")) {
-        let authReqURL = getAuthorizationCodeURL();
+        let authReqURL = await getAuthorizationCodeURL();
         if (!options.callbacks.authorize || typeof options.callbacks.authorize !== "function") {
           throw everything_default.metroError("oauth2mw: oauth2 with grant_type:authorization_code requires a callback function in client options.options.callbacks.authorize");
         }
@@ -1437,7 +1437,7 @@
       }
       return data;
     }
-    function getAuthorizationCodeURL() {
+    async function getAuthorizationCodeURL() {
       if (!oauth22.authorization_endpoint) {
         throw everything_default.metroError("oauth2mw: Missing options.oauth2_configuration.authorization_endpoint");
       }
@@ -1455,17 +1455,26 @@
         state: oauth22.state || createState(40)
         // OAuth2.1 RFC says optional, but its a good idea to always add/check it
       };
+      if (oauth22.response_type) {
+        search.response_type = oauth22.response_type;
+      }
+      if (oauth22.response_mode) {
+        search.response_mode = oauth22.response_mode;
+      }
       options.state.set(search.state);
       if (oauth22.client_secret) {
         search.client_secret = oauth22.client_secret;
       }
       if (oauth22.code_verifier) {
-        search.code_challenge = generateCodeChallenge(oauth22.code_verifier);
+        search.code_challenge = base64url_encode(await generateCodeChallenge(oauth22.code_verifier));
         search.code_challenge_method = "S256";
       }
       if (oauth22.scope) {
         search.scope = oauth22.scope;
       }
+      if (oauth22.prompt) {
+        search.prompt = oauth22.prompt;
+      }
       return everything_default.url(url2, { search });
     }
     function getAccessTokenRequest(grant_type = null) {
@@ -1782,6 +1791,57 @@
     throw everything_default.metroError("metro.oidcmw: Error while fetching " + issuer + ".wellknown/oauth_authorization_server", res);
   }
 
+  // node_modules/@muze-nl/metro-oauth2/src/keysstore.mjs
+  function keysStore() {
+    return new Promise((resolve, reject) => {
+      const request2 = globalThis.indexedDB.open("metro", 1);
+      request2.onupgradeneeded = () => request2.result.createObjectStore("keyPairs", { keyPath: "domain" });
+      request2.onerror = (event) => {
+        reject(event);
+      };
+      request2.onsuccess = (event) => {
+        const db = event.target.result;
+        resolve({
+          set: function(value, key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite", { durability: "strict" });
+              const objectStore = tx.objectStore("keyPairs");
+              tx.oncomplete = () => {
+                resolve2();
+              };
+              tx.onerror = reject2;
+              objectStore.put(value, key);
+            });
+          },
+          get: function(key) {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readonly");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.get(key);
+              request3.onsuccess = () => {
+                resolve2(request3.result);
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          },
+          clear: function() {
+            return new Promise((resolve2, reject2) => {
+              const tx = db.transaction("keyPairs", "readwrite");
+              const objectStore = tx.objectStore("keyPairs");
+              const request3 = objectStore.clear();
+              request3.onsuccess = () => {
+                resolve2();
+              };
+              request3.onerror = reject2;
+              tx.onerror = reject2;
+            });
+          }
+        });
+      };
+    });
+  }
+
   // node_modules/dpop/build/index.js
   var encoder = new TextEncoder();
   var decoder = new TextDecoder();
@@ -1982,62 +2042,24 @@
     return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, ["sign", "verify"]);
   }
 
-  // node_modules/@muze-nl/metro-oauth2/src/keysstore.mjs
-  function keysStore() {
-    return new Promise((resolve, reject) => {
-      const request2 = globalThis.indexedDB.open("metro", 1);
-      request2.onupgradeneeded = () => request2.result.createObjectStore("keyPairs", { keyPath: "domain" });
-      request2.onerror = (event) => {
-        reject(event);
-      };
-      request2.onsuccess = (event) => {
-        const db = event.target.result;
-        resolve({
-          set: function(value, key) {
-            return new Promise((resolve2, reject2) => {
-              const tx = db.transaction("keyPairs", "readwriteflush", { durability: "strict" });
-              const objectStore = tx.objectStore("keyPairs");
-              tx.oncomplete = () => {
-                resolve2();
-              };
-              tx.onerror = reject2;
-              objectStore.put(value, key);
-            });
-          },
-          get: function(key) {
-            return new Promise((resolve2, reject2) => {
-              const tx = db.transaction("keyPairs", "readonly");
-              const objectStore = tx.objectStore("keyPairs");
-              const request3 = objectStore.get(key);
-              request3.onsuccess = () => {
-                resolve2(request3.result);
-              };
-              request3.onerror = reject2;
-              tx.onerror = reject2;
-            });
-          }
-        });
-      };
-    });
-  }
-
   // node_modules/@muze-nl/metro-oauth2/src/oauth2.dpop.mjs
   function dpopmw(options) {
     assert2(options, {
+      site: Required2(validURL2),
       authorization_endpoint: Required2(validURL2),
       token_endpoint: Required2(validURL2)
       //		dpop_signing_alg_values_supported: Required([]) // this property is unfortunately rarely supported
     });
     return async (req, next) => {
       const keys = await keysStore();
-      const url2 = everything_default.url(req.url);
-      let keyInfo = await keys.get(url2.host);
+      let keyInfo = await keys.get(options.site);
       if (!keyInfo) {
         let keyPair = await generateKeyPair("ES256");
-        keyInfo = { domain: url2.host, keyPair };
+        keyInfo = { domain: options.site, keyPair };
         await keys.set(keyInfo);
       }
-      if (url2.href.startsWith(options.authorization_endpoint) || url2.href.startsWith(options.token_endpoint)) {
+      const url2 = everything_default.url(req.url);
+      if (req.url.startsWith(options.authorization_endpoint) || req.url.startsWith(options.token_endpoint)) {
         const dpopHeader = await DPoP(keyInfo.keyPair, req.url, req.method);
         req = req.with({
           headers: {
@@ -2050,6 +2072,8 @@
         const dpopHeader = await DPoP(keyInfo.keyPair, req.url, req.method, nonce, accessToken);
         req = req.with({
           headers: {
+            "Authorization": "DPoP " + accessToken,
+            //solidcommunity server sends accesstoken with type Bearer
             "DPoP": dpopHeader
           }
         });
@@ -2067,8 +2091,10 @@
     mockserver: oauth2_mockserver_exports,
     discovery: oauth2_discovery_exports,
     tokenstore: tokenStore,
-    dpopmw
+    dpopmw,
+    keysstore: keysStore
   });
+  globalThis.oauth2 = oauth2;
   var browser_default = oauth2;
 
   // src/oidc.store.mjs
@@ -2146,6 +2172,7 @@
         });
         options.store.set("client_info", options.client_info);
       }
+      const scope = options.scope || "openid";
       const oauth2Options = Object.assign(
         {
           site: options.issuer,
@@ -2154,12 +2181,13 @@
           oauth2_configuration: {
             client_id: options.client_info.client_id,
             client_secret: options.client_info.client_secret,
-            code_verifier: false,
-            //FIXME: detect pkce support
             grant_type: "authorization_code",
+            response_type: "code",
+            response_mode: "query",
             authorization_endpoint: options.openid_configuration.authorization_endpoint,
             token_endpoint: options.openid_configuration.token_endpoint,
-            scope: options.openid_configuration.scope || "openid",
+            scope,
+            //FIXME: should only use scopes supported by server
             redirect_uri: options.client_info.redirect_uris[0]
             //FIXME: find the best match?
           }
@@ -2167,6 +2195,7 @@
         //...
       );
       const dpopOptions = {
+        site: options.issuer,
         authorization_endpoint: options.openid_configuration.authorization_endpoint,
         token_endpoint: options.openid_configuration.token_endpoint,
         dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported