@muze-nl/metro-oidc 0.3.4 → 0.3.6

package/README.md

@@ -5,10 +5,10 @@
 The OpenID Connect middleware allows you to configure a [metro client](https://github.com/muze-nl/metro) to handle authorization and authentication using OpenID Connect:
 
 ```javascript
-import oidcmw from '@muze-nl/metro-oidc'
+import oidc from '@muze-nl/metro-oidc'
 
 const client = metro.client('https://oauth2api.example.com')
-.with( oidcmw({
+.with( oidc.oidcmw({
 	client_info: {
 		client_name: 'My Client',
 		redirect_uris: [
@@ -23,6 +23,8 @@ async function fetchMovies() {
 }
 ````
 
+_Note_: If your client has more than 1 possible `redirect_uri`, all will be used to register that client, but the first one will be used for this session. So make sure to put the `redirect_uri` you want to use now at `redirect_uris[0]``.
+
 The OIDC middleware will automatically discover the configuration of the issuer, as well as do a dynamic client registration, if you haven't set a `client_info.client_id`.
 It will then configure the correct OAuth2 settings and handle the request with [metro oauth2](https://github.com/muze-nl/metro-oauth2) middleware. It may redirect the browser to let the user login with the OIDC issuer. You can skip the automatic configuration step, if you provide the `openid_configuration` parameter set yourself. If you don't, the oidcmw middleware will only run the discovery process once, and store the information in localStorage. The same with the client_info and dynamic registration.
 

package/dist/browser.js

@@ -1093,12 +1093,12 @@
         search.response_mode = oauth22.response_mode;
       }
       options.state.set(search.state);
-      if (oauth22.client_secret) {
-        search.client_secret = oauth22.client_secret;
-      }
       if (oauth22.code_verifier) {
+        options.tokens.set("code_verifier", oauth22.code_verifier);
         search.code_challenge = await generateCodeChallenge(oauth22.code_verifier);
         search.code_challenge_method = "S256";
+      } else if (oauth22.client_secret) {
+        search.client_secret = oauth22.client_secret;
       }
       if (oauth22.scope) {
         search.scope = oauth22.scope;
@@ -1121,10 +1121,10 @@
         grant_type: grant_type || oauth22.grant_type,
         client_id: oauth22.client_id
       };
-      if (oauth22.code_verifier) {
-        params2.code_verifier = oauth22.code_verifier;
-      }
-      if (oauth22.client_secret) {
+      const code_verifier = options.tokens.get("code_verifier");
+      if (code_verifier) {
+        params2.code_verifier = code_verifier;
+      } else if (oauth22.client_secret) {
         params2.client_secret = oauth22.client_secret;
       }
       if (oauth22.scope) {
@@ -1167,9 +1167,15 @@
     throw new TypeError("Unknown expires type " + duration);
   }
   function generateCodeVerifier(size = 64) {
-    const code_verifier = new Uint8Array(size);
-    globalThis.crypto.getRandomValues(code_verifier);
-    return base64url_encode(code_verifier);
+    size = Math.min(43, Math.max(128, size));
+    const allowed = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    const random = new Uint8Array(size);
+    globalThis.crypto.getRandomValues(random);
+    const code_verifier = Array.from(random).map((b) => {
+      let c = allowed[b % allowed.length];
+      return c;
+    }).join("");
+    return code_verifier;
   }
   async function generateCodeChallenge(code_verifier) {
     const encoder2 = new TextEncoder();
@@ -1772,7 +1778,7 @@
   }
 
   // node_modules/@muze-nl/metro-oauth2/src/browser.mjs
-  var oauth2 = Object.assign(oauth2_exports, {
+  var oauth2 = Object.assign({}, oauth2_exports, {
     oauth2mw,
     mockserver: oauth2_mockserver_exports,
     discover: oauth2_discovery_exports,
@@ -2038,11 +2044,16 @@
             scope,
             //FIXME: should only use scopes supported by server
             redirect_uri: options.client_info.redirect_uris[0]
-            //FIXME: find the best match?
           }
         }
         //...
       );
+      const pkceSupported = options.openid_configuration.code_challenge_methods_supported.length;
+      if (pkceSupported) {
+        delete oauth2Options.oauth2_configuration.client_secret;
+      } else {
+        oauth2Options.oauth2_configuration.code_verifier = false;
+      }
       const storeIdToken = async (req2, next2) => {
         const res2 = await next2(req2);
         const contentType = res2.headers.get("content-type");