@muze-nl/metro-oidc 0.1.5 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@muze-nl/metro-oidc",
-  "version": "0.1.5",
+  "version": "0.3.0",
   "description": "oidc client middleware for @muze-nl/metro",
   "type": "module",
   "source": [
@@ -48,7 +48,7 @@
   ],
   "dependencies": {
     "@muze-nl/assert": "^0.3.3",
-    "@muze-nl/metro": "^0.5.5",
-    "@muze-nl/metro-oauth2": "^0.3.5"
+    "@muze-nl/metro": "^0.6.0",
+    "@muze-nl/metro-oauth2": "^0.5.0"
   }
 }

package/src/oidc.discovery.mjs

@@ -89,7 +89,7 @@ export default async function oidcDiscovery(options={}) {
 		// note: this allows path components in the options.issuer url
 		configURL
 	)
-	const openid_config = response.body[Symbol.metroSource]
+	const openid_config = response.data
 	assert(openid_config, openid_provider_metadata)
 
 	// https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationValidation

package/src/oidc.register.mjs

@@ -63,7 +63,7 @@ export default async function register(options)
 		.post(options.registration_endpoint, {
 			body: options.client_info
 		})
-	let info = response.body
+	let info = response.data
 	if (!info.client_id || !info.client_secret) {
 		throw metro.metroError('metro.oidc: Error: dynamic registration of client failed, no client_id or client_secret returned', response)
 	}

package/src/oidcmw.mjs

@@ -67,6 +67,7 @@ export default function oidcmw(options={}) {
 
 		// now initialize an oauth2 client stack, using options.client as default
 		// with forceAuthentication: true
+		const scope = options.scope || 'openid'
 		const oauth2Options = Object.assign(
 			{
 				site: options.issuer,
@@ -75,11 +76,12 @@ export default function oidcmw(options={}) {
 				oauth2_configuration: {
 					client_id: options.client_info.client_id,
 					client_secret: options.client_info.client_secret,
-					code_verifier: false, //FIXME: detect pkce support
 					grant_type: 'authorization_code',
+					response_type: 'code',
+					response_mode: 'query',
 					authorization_endpoint: options.openid_configuration.authorization_endpoint,
 					token_endpoint: options.openid_configuration.token_endpoint,
-					scope: options.openid_configuration.scope || 'openid',
+					scope, //FIXME: should only use scopes supported by server
 					redirect_uri: options.client_info.redirect_uris[0] //FIXME: find the best match?
 				}
 			}
@@ -87,6 +89,7 @@ export default function oidcmw(options={}) {
 		)
 
 		const dpopOptions = {
+			site: options.issuer,
 			authorization_endpoint: options.openid_configuration.authorization_endpoint,
 			token_endpoint: options.openid_configuration.token_endpoint,
 			dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported
@@ -96,6 +99,7 @@ export default function oidcmw(options={}) {
 			const res = await next(req)
 			const contentType = res.headers.get('content-type')
 			if (contentType?.startsWith('application/json')) {
+				//FIXME; check that this is actually the token endpoint
 				const res2 = res.clone() // otherwise res.body can't be read again
 				try {
 					let data = await res2.json()