@muze-nl/metro-oidc 0.6.0 → 0.9.0

package/src/oidcmw.mjs

@@ -1,10 +1,13 @@
-import * as metro from '@muze-nl/metro/src/metro.mjs'
-import oauth2mw, * as oauth2 from '@muze-nl/metro-oauth2/src/oauth2.mjs'
-import dpopmw from '@muze-nl/metro-oauth2/src/oauth2.dpop.mjs'
+import * as metro from '@muze-nl/metro-core'
+import oauth2mw, * as oauth2 from '@muze-nl/metro-oauth2/oauth2'
+import dpopmw from '@muze-nl/metro-oauth2/dpop'
 import { assert, Required, Optional, validURL, instanceOf } from '@muze-nl/assert'
 import discover from './oidc.discovery.mjs'
 import register from './oidc.register.mjs'
 import oidcStore from './oidc.store.mjs'
+import jsonmw from '@muze-nl/metro-middleware/json'
+import throwermw from '@muze-nl/metro-middleware/thrower'
+import { validateIdToken } from './oidc.jwt.mjs'
 
 export default function oidcmw(options={}) {
 
@@ -21,6 +24,7 @@ export default function oidcmw(options={}) {
 	}
 
 	options = Object.assign({}, defaultOptions, options)
+	const requestedClientInfo = options.client_info
 
 	assert(options, {
 		client: Required(instanceOf(metro.client().constructor)), // required because it is set in defaultOptions
@@ -37,7 +41,10 @@ export default function oidcmw(options={}) {
 		options.openid_configuration = options.store.get('openid_configuration')
 	}
 	if (!options.client_info?.client_id && options.store.has('client_info')) {
-		options.client_info = options.store.get('client_info')
+		const storedClientInfo = options.store.get('client_info')
+		if (clientInfoMatchesRequest(storedClientInfo, requestedClientInfo)) {
+			options.client_info = storedClientInfo
+		}
 	}
 
 	return async (req, next) => {
@@ -46,7 +53,8 @@ export default function oidcmw(options={}) {
 			try {
 				res = await next(req)
 			} catch(err) {
-				if (res.status!=401 && res.status!=403) {
+				res = err?.cause
+				if (!res || (res.status!=401 && res.status!=403)) {
 					throw err
 				}
 			}
@@ -56,7 +64,8 @@ export default function oidcmw(options={}) {
 		}
 		if (!options.openid_configuration) {
 			options.openid_configuration = await discover({
-				issuer: options.issuer
+				issuer: options.issuer,
+				client: options.client.with(options.issuer)
 			})
 			options.store.set('openid_configuration', options.openid_configuration)
 		}
@@ -67,6 +76,7 @@ export default function oidcmw(options={}) {
 			}
 			options.client_info = await register({
 				registration_endpoint: options.openid_configuration.registration_endpoint,
+				client: options.client,
 				client_info: options.client_info
 			})
 			options.store.set('client_info', options.client_info)
@@ -75,6 +85,8 @@ export default function oidcmw(options={}) {
 		// now initialize an oauth2 client stack, using options.client as default
 		// with forceAuthentication: true
 		const scope = options.scope || 'openid'
+		const nonce = options.nonce || oauth2.generateCodeVerifier(32)
+		options.store.set('pending_nonce', nonce)
 
 		const oauth2Options = Object.assign(
 			{
@@ -91,7 +103,8 @@ export default function oidcmw(options={}) {
 					authorization_endpoint: options.openid_configuration.authorization_endpoint,
 					token_endpoint: options.openid_configuration.token_endpoint,
 					scope, //FIXME: should only use scopes supported by server
-					redirect_uri: options.client_info.redirect_uris[0]
+					redirect_uri: options.client_info.redirect_uris[0],
+					nonce
 				}
 			}
 			//...
@@ -99,28 +112,45 @@ export default function oidcmw(options={}) {
 		
 		const storeIdToken = async (req, next) => {
 			const res = await next(req)
+			const tokenEndpoint = metro.url(options.openid_configuration.token_endpoint, { hash: '' }).href
+			const requestUrl = metro.url(req.url, { hash: '' }).href
+			if (requestUrl !== tokenEndpoint) {
+				return res
+			}
 			const contentType = res.headers.get('content-type')
-			if (contentType?.startsWith('application/json')) {
-				//FIXME: check that this is actually the token endpoint
-				let id_token = res.data?.id_token
-				if (!id_token) {
-					const res2 = res.clone() // otherwise res.body can't be read again
-					try {
-						let data = await res2.json()
-						if (data && data.id_token) {
-							id_token = data.id_token
-						}
-					} catch(e) {
-						// ignore errors
-					}
-				}
-				if (id_token) {
-					options.store.set('id_token', id_token)
-				}
+			if (!contentType?.startsWith('application/json')) {
+				return res
 			}
+
+			let data = res.data && typeof res.data === 'object' ? res.data : null
+			if (!data) {
+				const res2 = res.clone() // otherwise res.body can't be read again
+				data = await res2.json()
+			}
+
+			const id_token = data?.id_token
+			const jwks = await getJwks()
+			const validation = await validateIdToken(id_token, {
+				issuer: options.openid_configuration.issuer,
+				client_id: options.client_info.client_id,
+				jwks,
+				openid_configuration: options.openid_configuration,
+				nonce: options.store.get('pending_nonce')
+			})
+			options.store.set('id_token', id_token)
+			options.store.set('id_token_claims', validation.claims)
 			return res
 		}
 
+		const getJwks = async () => {
+			if (!options.jwks) {
+				const jwksClient = options.client.with(throwermw()).with(jsonmw())
+				const response = await jwksClient.get(options.openid_configuration.jwks_uri)
+				options.jwks = response.data
+			}
+			return options.jwks
+		}
+
 		let oauth2client = options.client.with(options.issuer).with(storeIdToken)
 
 		if (options.use_dpop) {
@@ -131,8 +161,8 @@ export default function oidcmw(options={}) {
 				dpop_signing_alg_values_supported: options.openid_configuration.dpop_signing_alg_values_supported
 			}
 			oauth2client = oauth2client.with(dpopmw(dpopOptions)) // add DPoP headers in requests with Authorization headers
-			oauth2Options.client = oauth2client // make sure oath2 token request use dpop
 		}
+		oauth2Options.client = oauth2client // make sure token requests use the OIDC token-observing stack
 
 		oauth2client = oauth2client.with(oauth2mw(oauth2Options))
 
@@ -143,6 +173,17 @@ export default function oidcmw(options={}) {
 
 }
 
+function clientInfoMatchesRequest(storedClientInfo, requestedClientInfo) {
+	if (!storedClientInfo?.client_id) {
+		return false
+	}
+	if (!Array.isArray(requestedClientInfo?.redirect_uris)) {
+		return true
+	}
+	const storedRedirectUris = new Set(storedClientInfo.redirect_uris || [])
+	return requestedClientInfo.redirect_uris.every(uri => storedRedirectUris.has(uri))
+}
+
 export function isRedirected() {
 	return oauth2.isRedirected()
 }
@@ -156,3 +197,13 @@ export function idToken(options) {
 	}
 	return options.store.get('id_token')
 }
+
+export function idTokenClaims(options) {
+	if (!options.store) {
+		if (!options.issuer) {
+			throw metro.metroError('Must supply options.issuer or options.store to get the id_token claims')
+		}
+		options.store = oidcStore(options.issuer)
+	}
+	return options.store.get('id_token_claims')
+}

package/src/testing.mjs

@@ -0,0 +1,4 @@
+import oidcmockserver from './oidc.mockserver.mjs'
+export * from './oidc.mockserver.mjs'
+export { oidcmockserver }
+export default oidcmockserver