@muze-nl/metro-oidc 0.3.1 → 0.3.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023-2025 Auke van Slooten
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,47 @@
+# Metro OpenID Connect middleware
+
+[![Project stage: Experimental][project-stage-badge: Experimental]][project-stage-page]
+
+The OpenID Connect middleware allows you to configure a [metro client](https://github.com/muze-nl/metro) to handle authorization and authentication using OpenID Connect:
+
+```javascript
+import oidcmw from '@muze-nl/metro-oidc'
+
+const client = metro.client('https://oauth2api.example.com')
+.with( oidcmw({
+	client_info: {
+		client_name: 'My Client',
+		redirect_uris: [
+			'https://www.example.com/my_app.html'
+		]
+	},
+	issuer: 'https://solidcommunity.net/'
+}) )
+
+async function fetchMovies() {
+	return await client.get('https://example.solidcommunity.net/movies/')
+}
+````
+
+The OIDC middleware will automatically discover the configuration of the issuer, as well as do a dynamic client registration, if you haven't set a `client_info.client_id`.
+It will then configure the correct OAuth2 settings and handle the request with [metro oauth2](https://github.com/muze-nl/metro-oauth2) middleware. It may redirect the browser to let the user login with the OIDC issuer. You can skip the automatic configuration step, if you provide the `openid_configuration` parameter set yourself. If you don't, the oidcmw middleware will only run the discovery process once, and store the information in localStorage. The same with the client_info and dynamic registration.
+
+## Security features
+
+metro.oidc uses OAuth2.1 by default, including PKCE and DPoP. The Keypair used in DPoP is created non-extractable, so they cannot be leaked. This means that the access_token and refresh_token, even if leaked, cannot be used anywhere else.
+
+You can disable PCKE by setting `options.client_info.code_verifier` to false.
+You can disable DPoP by setting `options.use_dpop` to false.
+
+## id_token
+
+The metro oidc middleware doesn't use the id_token, or verify any of its contents. This is left up to you, if you need it. You can retrieve the id_token by calling the `idToken` function, after the user is logged in:
+
+```javascript
+	import oidc from '@muze-nl/metro-oidc'
+
+	let id_token = oidc.idToken()
+```
+
+[project-stage-badge: Experimental]: https://img.shields.io/badge/Project%20Stage-Experimental-yellow.svg
+[project-stage-page]: https://blog.pother.ca/project-stages/

package/dist/browser.js

@@ -591,19 +591,21 @@
       thrower
     }
   });
-  globalThis.metro = metro;
+  if (!globalThis.metro) {
+    globalThis.metro = metro;
+  }
   var everything_default = metro;
 
   // node_modules/@muze-nl/metro-oauth2/src/oauth2.mjs
   var oauth2_exports = {};
   __export(oauth2_exports, {
-    authorizePopup: () => authorizePopup,
     base64url_encode: () => base64url_encode,
     createState: () => createState,
     default: () => oauth2mw,
     generateCodeChallenge: () => generateCodeChallenge,
     generateCodeVerifier: () => generateCodeVerifier,
     getExpires: () => getExpires,
+    isAuthorized: () => isAuthorized,
     isExpired: () => isExpired,
     isRedirected: () => isRedirected
   });
@@ -630,15 +632,15 @@
         return false;
       }
     }
-    return error("data does not match oneOf patterns", data, patterns);
+    return error2("data does not match oneOf patterns", data, patterns);
   };
   var anyOf = (...patterns) => (data) => {
     if (!Array.isArray(data)) {
-      return error("data is not an array", data, "anyOf");
+      return error2("data is not an array", data, "anyOf");
     }
     for (let value of data) {
       if (oneOf(...patterns)(value)) {
-        return error("data does not match anyOf patterns", value, patterns);
+        return error2("data does not match anyOf patterns", value, patterns);
       }
     }
     return false;
@@ -650,10 +652,10 @@
       }
       let url2 = new URL(data);
       if (url2.href != data) {
-        return error("data is not a valid url", data, "validURL");
+        return error2("data is not a valid url", data, "validURL");
       }
     } catch (e) {
-      return error("data is not a valid url", data, "validURL");
+      return error2("data is not a valid url", data, "validURL");
     }
     return false;
   }
@@ -664,28 +666,28 @@
     let problems = [];
     if (pattern === Boolean) {
       if (typeof data != "boolean") {
-        problems.push(error("data is not a boolean", data, pattern));
+        problems.push(error2("data is not a boolean", data, pattern));
       }
     } else if (pattern === Number) {
       if (typeof data != "number") {
-        problems.push(error("data is not a number", data, pattern));
+        problems.push(error2("data is not a number", data, pattern));
       }
     } else if (pattern instanceof RegExp) {
       if (Array.isArray(data)) {
         let index = data.findIndex((element) => fails(element, pattern, root));
         if (index > -1) {
-          problems.push(error("data[" + index + "] does not match pattern", data[index], pattern));
+          problems.push(error2("data[" + index + "] does not match pattern", data[index], pattern));
         }
       } else if (!pattern.test(data)) {
-        problems.push(error("data does not match pattern", data, pattern));
+        problems.push(error2("data does not match pattern", data, pattern));
       }
     } else if (pattern instanceof Function) {
       if (pattern(data, root)) {
-        problems.push(error("data does not match function", data, pattern));
+        problems.push(error2("data does not match function", data, pattern));
       }
     } else if (Array.isArray(pattern)) {
       if (!Array.isArray(data)) {
-        problems.push(error("data is not an array", data, []));
+        problems.push(error2("data is not an array", data, []));
       }
       for (p of pattern) {
         let problem = fails(data, p, root);
@@ -699,10 +701,10 @@
       if (Array.isArray(data)) {
         let index = data.findIndex((element) => fails(element, pattern, root));
         if (index > -1) {
-          problems.push(error("data[" + index + "] does not match pattern", data[index], pattern));
+          problems.push(error2("data[" + index + "] does not match pattern", data[index], pattern));
         }
       } else if (!data || typeof data != "object") {
-        problems.push(error("data is not an object, pattern is", data, pattern));
+        problems.push(error2("data is not an object, pattern is", data, pattern));
       } else {
         if (data instanceof URLSearchParams) {
           data = Object.fromEntries(data);
@@ -713,7 +715,7 @@
           if (result) {
             if (!p2 || typeof p2 == "string") {
               p2 = {};
-              problems.push(error(p2, data[wKey], wVal));
+              problems.push(error2(p2, data[wKey], wVal));
             }
             p2[wKey] = result.problems;
           }
@@ -721,7 +723,7 @@
       }
     } else {
       if (pattern != data) {
-        problems.push(error("data and pattern are not equal", data, pattern));
+        problems.push(error2("data and pattern are not equal", data, pattern));
       }
     }
     if (problems.length) {
@@ -736,7 +738,7 @@
       this.details = details;
     }
   };
-  function error(message, found, expected) {
+  function error2(message, found, expected) {
     return {
       message,
       found,
@@ -1106,13 +1108,19 @@
     }
     return true;
   }
-  async function authorizePopup(authorizationCodeURL) {
-    return new Promise((resolve, reject) => {
-      addEventListener("oauth2authorized", (evt) => {
-        resolve(event.authorization_code);
-      }, { once: true });
-      window.open(authorizationCodeURL);
-    });
+  function isAuthorized(tokens) {
+    if (typeof tokens == "string") {
+      tokens = tokenStore(tokens).tokens;
+    }
+    let accessToken = tokens.get("access_token");
+    if (accessToken && !isExpired(accessToken)) {
+      return true;
+    }
+    let refreshToken = tokens.get("refresh_token");
+    if (refreshToken) {
+      return true;
+    }
+    return false;
   }
 
   // node_modules/@muze-nl/metro-oauth2/src/oauth2.mockserver.mjs
@@ -1127,7 +1135,7 @@
       "Content-Type": "application/json"
     }
   };
-  var badRequest = (error4) => {
+  var badRequest = (error5) => {
     return {
       status: 400,
       statusText: "Bad Request",
@@ -1136,11 +1144,11 @@
       },
       body: JSON.stringify({
         error: "invalid_request",
-        error_description: error4
+        error_description: error5
       })
     };
   };
-  var error2;
+  var error3;
   var pkce = {};
   function oauth2mockserver(options = {}) {
     const defaultOptions = {
@@ -1152,12 +1160,12 @@
       let url2 = everything_default.url(req.url);
       switch (url2.pathname) {
         case "/authorize/":
-          if (error2 = fails(url2.searchParams, {
+          if (error3 = fails(url2.searchParams, {
             response_type: "code",
             client_id: "mockClientId",
             state: Optional(/.*/)
           })) {
-            return everything_default.response(badRequest(error2));
+            return everything_default.response(badRequest(error3));
           }
           if (url2.searchParams.has("code_challenge")) {
             if (!url2.searchParams.has("code_challenge_method")) {
@@ -1179,17 +1187,17 @@
             req.data.forEach((value, key) => body[key] = value);
             req = req.with({ body });
           }
-          if (error2 = fails(req, {
+          if (error3 = fails(req, {
             method: "POST",
             data: {
               grant_type: oneOf("refresh_token", "authorization_code")
             }
           })) {
-            return everything_default.response(badRequest(error2));
+            return everything_default.response(badRequest(error3));
           }
           switch (req.data.grant_type) {
             case "refresh_token":
-              if (error2 = fails(req.data, oneOf({
+              if (error3 = fails(req.data, oneOf({
                 refresh_token: "mockRefreshToken",
                 client_id: "mockClientId",
                 client_secret: "mockClientSecret"
@@ -1198,11 +1206,11 @@
                 client_id: "mockClientId",
                 code_verifier: /.+/
               }))) {
-                return everything_default.response(badRequest(error2));
+                return everything_default.response(badRequest(error3));
               }
               break;
             case "access_token":
-              if (error2 = fails(req.data, oneOf({
+              if (error3 = fails(req.data, oneOf({
                 client_id: "mockClientId",
                 client_secret: "mockClientSecret"
               }, {
@@ -1211,7 +1219,7 @@
                 //FIXME: check that this matches code_verifier
                 code_challenge_method: "S256"
               }))) {
-                return everything_default.response(badRequest(error2));
+                return everything_default.response(badRequest(error3));
               }
               break;
           }
@@ -1327,6 +1335,43 @@
     throw everything_default.metroError("metro.oidcmw: Error while fetching " + issuer + ".wellknown/oauth_authorization_server", res);
   }
 
+  // node_modules/@muze-nl/metro-oauth2/src/oauth2.popup.mjs
+  function handleRedirect() {
+    let params2 = new URLSearchParams(window.location.search);
+    if (!params2.has("code") && window.location.hash) {
+      let query = window.location.hash.substr(1);
+      params2 = new URLSearchParams("?" + query);
+    }
+    let parent = window.parent ? window.parent : window.opener;
+    if (params2.has("code")) {
+      parent.postMessage({
+        authorization_code: params2.get("code")
+      }, window.location.origin);
+    } else if (params2.has("error")) {
+      parent.postMessage({
+        error
+      }, window.location.origin);
+    } else {
+      parent.postMessage({
+        error: "Could not find an authorization_code"
+      }, window.location.origin);
+    }
+  }
+  function authorizePopup(authorizationCodeURL) {
+    return new Promise((resolve, reject) => {
+      addEventListener("message", (evt) => {
+        if (event.data.authorization_code) {
+          resolve(event.data.authorization_code);
+        } else if (event.data.error) {
+          reject(event.data.error);
+        } else {
+          reject("Unknown authorization error");
+        }
+      }, { once: true });
+      window.open(authorizationCodeURL);
+    });
+  }
+
   // node_modules/@muze-nl/metro-oauth2/src/keysstore.mjs
   function keysStore() {
     return new Promise((resolve, reject) => {
@@ -1636,7 +1681,9 @@
     discover: oauth2_discovery_exports,
     tokenstore: tokenStore,
     dpopmw,
-    keysstore: keysStore
+    keysstore: keysStore,
+    authorizePopup,
+    popupHandleRedirect: handleRedirect
   });
   if (!globalThis.metro.oauth2) {
     globalThis.metro.oauth2 = oauth2;
@@ -1665,7 +1712,7 @@
   function Required2(pattern) {
     return function _Required(data, root, path) {
       if (data == null || typeof data == "undefined") {
-        return error3("data is required", data, pattern || "any value", path);
+        return error4("data is required", data, pattern || "any value", path);
       } else if (typeof pattern != "undefined") {
         return fails2(data, pattern, root, path);
       } else {
@@ -1690,17 +1737,17 @@
           return false;
         }
       }
-      return error3("data does not match oneOf patterns", data, patterns, path);
+      return error4("data does not match oneOf patterns", data, patterns, path);
     };
   }
   function anyOf2(...patterns) {
     return function _anyOf(data, root, path) {
       if (!Array.isArray(data)) {
-        return error3("data is not an array", data, "anyOf", path);
+        return error4("data is not an array", data, "anyOf", path);
       }
       for (let value of data) {
         if (oneOf2(...patterns)(value)) {
-          return error3("data does not match anyOf patterns", value, patterns, path);
+          return error4("data does not match anyOf patterns", value, patterns, path);
         }
       }
       return false;
@@ -1714,7 +1761,7 @@
       }
       problems = problems.filter(Boolean);
       if (problems.length) {
-        return error3("data does not match all given patterns", data, patterns, path, problems);
+        return error4("data does not match all given patterns", data, patterns, path, problems);
       }
     };
   }
@@ -1726,29 +1773,29 @@
       let url2 = new URL(data);
       if (url2.href != data) {
         if (!(url2.href + "/" == data || url2.href == data + "/")) {
-          return error3("data is not a valid url", data, "validURL", path);
+          return error4("data is not a valid url", data, "validURL", path);
         }
       }
     } catch (e) {
-      return error3("data is not a valid url", data, "validURL", path);
+      return error4("data is not a valid url", data, "validURL", path);
     }
   }
   function validEmail(data, root, path) {
     if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data)) {
-      return error3("data is not a valid email", data, "validEmail", path);
+      return error4("data is not a valid email", data, "validEmail", path);
     }
   }
   function instanceOf(constructor) {
     return function _instanceOf(data, root, path) {
       if (!(data instanceof constructor)) {
-        return error3("data is not an instanceof pattern", data, constructor, path);
+        return error4("data is not an instanceof pattern", data, constructor, path);
       }
     };
   }
   function not(pattern) {
     return function _not(data, root, path) {
       if (!fails2(data, pattern, root, path)) {
-        return error3("data matches pattern, when required not to", data, pattern, path);
+        return error4("data matches pattern, when required not to", data, pattern, path);
       }
     };
   }
@@ -1759,29 +1806,29 @@
     let problems = [];
     if (pattern === Boolean) {
       if (typeof data != "boolean" && !(data instanceof Boolean)) {
-        problems.push(error3("data is not a boolean", data, pattern, path));
+        problems.push(error4("data is not a boolean", data, pattern, path));
       }
     } else if (pattern === Number) {
       if (typeof data != "number" && !(data instanceof Number)) {
-        problems.push(error3("data is not a number", data, pattern, path));
+        problems.push(error4("data is not a number", data, pattern, path));
       }
     } else if (pattern === String) {
       if (typeof data != "string" && !(data instanceof String)) {
-        problems.push(error3("data is not a string", data, pattern, path));
+        problems.push(error4("data is not a string", data, pattern, path));
       }
       if (data == "") {
-        problems.push(error3("data is an empty string, which is not allowed", data, pattern, path));
+        problems.push(error4("data is an empty string, which is not allowed", data, pattern, path));
       }
     } else if (pattern instanceof RegExp) {
       if (Array.isArray(data)) {
         let index = data.findIndex((element, index2) => fails2(element, pattern, root, path + "[" + index2 + "]"));
         if (index > -1) {
-          problems.push(error3("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
+          problems.push(error4("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
         }
       } else if (typeof data == "undefined") {
-        problems.push(error3("data is undefined, should match pattern", data, pattern, path));
+        problems.push(error4("data is undefined, should match pattern", data, pattern, path));
       } else if (!pattern.test(data)) {
-        problems.push(error3("data does not match pattern", data, pattern, path));
+        problems.push(error4("data does not match pattern", data, pattern, path));
       }
     } else if (pattern instanceof Function) {
       let problem = pattern(data, root, path);
@@ -1794,7 +1841,7 @@
       }
     } else if (Array.isArray(pattern)) {
       if (!Array.isArray(data)) {
-        problems.push(error3("data is not an array", data, [], path));
+        problems.push(error4("data is not an array", data, [], path));
       }
       for (let p2 of pattern) {
         for (let index of data.keys()) {
@@ -1810,10 +1857,10 @@
       if (Array.isArray(data)) {
         let index = data.findIndex((element, index2) => fails2(element, pattern, root, path + "[" + index2 + "]"));
         if (index > -1) {
-          problems.push(error3("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
+          problems.push(error4("data[" + index + "] does not match pattern", data[index], pattern, path + "[" + index + "]"));
         }
       } else if (!data || typeof data != "object") {
-        problems.push(error3("data is not an object, pattern is", data, pattern, path));
+        problems.push(error4("data is not an object, pattern is", data, pattern, path));
       } else {
         if (data instanceof URLSearchParams) {
           data = Object.fromEntries(data);
@@ -1834,7 +1881,7 @@
       }
     } else {
       if (pattern != data) {
-        problems.push(error3("data and pattern are not equal", data, pattern, path));
+        problems.push(error4("data and pattern are not equal", data, pattern, path));
       }
     }
     if (problems.length) {
@@ -1842,7 +1889,7 @@
     }
     return false;
   }
-  function error3(message, found, expected, path, problems) {
+  function error4(message, found, expected, path, problems) {
     let result = {
       message,
       found,
@@ -1860,13 +1907,13 @@
     if (options.filter((o) => root.hasOwnKey(o)).length > 0) {
       return false;
     }
-    return error3("root data must have all of", root, options);
+    return error4("root data must have all of", root, options);
   };
   var MustInclude = (...options) => (value) => {
     if (Array.isArray(value) && options.filter((o) => !value.includes(o)).length == 0) {
       return false;
     } else {
-      return error3("data must be an array which includes", value, options);
+      return error4("data must be an array which includes", value, options);
     }
   };
   var validJWA = [