@nihplod/sso-sdk 1.2.1 → 1.3.1

package/dist/index.d.mts

@@ -7,7 +7,7 @@
  *   整页跳转与刷新后登录态保留，关闭标签页自动清除；SSR / 隐私模式写入失败时
  *   降级为内存 Map。对需要多 Tab 共享 token 或 BFF/Confidential Client 场景，
  *   可通过 setTokenStorage() 注入 localStorage 实现（如 createSecureStorage({ persist: true })）。
- * - 临时数据（PKCE verifier / state / returnUrl / popup nonce）：必须跨整页重定向存活
+ * - 临时数据（PKCE verifier / state / OIDC nonce / returnUrl / popup nonce）：必须跨整页重定向存活
  *   （login() 会 302 跳转到 SSO 中心再回来），因此默认写入 sessionStorage；
  *   SSR 等无 sessionStorage 环境自动降级为内存 Map。
  *
@@ -110,6 +110,13 @@ interface SsoClientConfig {
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
     postLogoutRedirectUri?: string;
+    /**
+     * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。
+     * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；
+     * 浏览器跳转（authorize、end-session）始终使用 ssoBaseUrl 公网地址。
+     * 仅在 BFF/服务端场景配置；浏览器端（Public Client）不要配置。
+     */
+    serverBaseUrl?: string;
 }
 /** 用户信息 */
 interface SsoUser {
@@ -123,6 +130,8 @@ interface SsoUser {
     /** 生日（ISO 8601，需 birthday scope，未设置时为 null） */
     birthday?: string | null;
     membership_level?: string;
+    /** 累计消费金额（单位：元，需 membership scope，与 membership_level 同源下发） */
+    total_spent?: number;
     total_points?: number;
 }
 /** Token 响应 */
@@ -150,6 +159,8 @@ interface OidcDiscovery {
 }
 declare class SsoClient {
     readonly config: SsoClientConfig;
+    /** 服务器间调用的基准地址（未配置 serverBaseUrl 时等于 ssoBaseUrl） */
+    private readonly _serverBase;
     private _discovery;
     private _discoveryFetchedAt;
     private _refreshLock;
@@ -167,9 +178,9 @@ declare class SsoClient {
     private _getDiscovery;
     /** 获取 authorize 端点 URL（优先 Discovery，回退默认） */
     private _getAuthorizeEndpoint;
-    /** 获取 token 端点 URL（优先 Discovery，回退默认） */
+    /** 获取 token 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
     private _getTokenEndpoint;
-    /** 获取 userinfo 端点 URL（优先 Discovery，回退默认） */
+    /** 获取 userinfo 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
     private _getUserinfoEndpoint;
     /**
      * 开放重定向防护：仅保存相对路径或与当前页面同源的 returnUrl，
@@ -348,7 +359,7 @@ declare function generateState(): string;
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch";
 /**
  * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode
  *

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  *   整页跳转与刷新后登录态保留，关闭标签页自动清除；SSR / 隐私模式写入失败时
  *   降级为内存 Map。对需要多 Tab 共享 token 或 BFF/Confidential Client 场景，
  *   可通过 setTokenStorage() 注入 localStorage 实现（如 createSecureStorage({ persist: true })）。
- * - 临时数据（PKCE verifier / state / returnUrl / popup nonce）：必须跨整页重定向存活
+ * - 临时数据（PKCE verifier / state / OIDC nonce / returnUrl / popup nonce）：必须跨整页重定向存活
  *   （login() 会 302 跳转到 SSO 中心再回来），因此默认写入 sessionStorage；
  *   SSR 等无 sessionStorage 环境自动降级为内存 Map。
  *
@@ -110,6 +110,13 @@ interface SsoClientConfig {
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
     postLogoutRedirectUri?: string;
+    /**
+     * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。
+     * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；
+     * 浏览器跳转（authorize、end-session）始终使用 ssoBaseUrl 公网地址。
+     * 仅在 BFF/服务端场景配置；浏览器端（Public Client）不要配置。
+     */
+    serverBaseUrl?: string;
 }
 /** 用户信息 */
 interface SsoUser {
@@ -123,6 +130,8 @@ interface SsoUser {
     /** 生日（ISO 8601，需 birthday scope，未设置时为 null） */
     birthday?: string | null;
     membership_level?: string;
+    /** 累计消费金额（单位：元，需 membership scope，与 membership_level 同源下发） */
+    total_spent?: number;
     total_points?: number;
 }
 /** Token 响应 */
@@ -150,6 +159,8 @@ interface OidcDiscovery {
 }
 declare class SsoClient {
     readonly config: SsoClientConfig;
+    /** 服务器间调用的基准地址（未配置 serverBaseUrl 时等于 ssoBaseUrl） */
+    private readonly _serverBase;
     private _discovery;
     private _discoveryFetchedAt;
     private _refreshLock;
@@ -167,9 +178,9 @@ declare class SsoClient {
     private _getDiscovery;
     /** 获取 authorize 端点 URL（优先 Discovery，回退默认） */
     private _getAuthorizeEndpoint;
-    /** 获取 token 端点 URL（优先 Discovery，回退默认） */
+    /** 获取 token 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
     private _getTokenEndpoint;
-    /** 获取 userinfo 端点 URL（优先 Discovery，回退默认） */
+    /** 获取 userinfo 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
     private _getUserinfoEndpoint;
     /**
      * 开放重定向防护：仅保存相对路径或与当前页面同源的 returnUrl，
@@ -348,7 +359,7 @@ declare function generateState(): string;
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch";
 /**
  * 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode
  *

package/dist/index.js

@@ -136,6 +136,7 @@ var STORAGE_PREFIX = "nihplod_sso_";
 var TOKEN_KEY = "token";
 var VERIFIER_KEY_PREFIX = "pkce_verifier_";
 var STATE_KEY = "oauth_state";
+var NONCE_KEY = "oidc_nonce";
 var RETURN_URL_KEY = "return_url";
 var LOGOUT_STATE_KEY = "logout_state";
 function buildKey(base, clientId) {
@@ -247,6 +248,15 @@ function getOAuthState(clientId) {
 function removeOAuthState(clientId) {
   _transient.remove(buildKey(STATE_KEY, clientId));
 }
+function saveOAuthNonce(nonce, clientId) {
+  _transient.set(buildKey(NONCE_KEY, clientId), nonce);
+}
+function getOAuthNonce(clientId) {
+  return _transient.get(buildKey(NONCE_KEY, clientId));
+}
+function removeOAuthNonce(clientId) {
+  _transient.remove(buildKey(NONCE_KEY, clientId));
+}
 function saveLogoutState(state, clientId) {
   _transient.set(buildKey(LOGOUT_STATE_KEY, clientId), state);
 }
@@ -269,6 +279,7 @@ function clearAllSsoData(clientId) {
   if (clientId) {
     removeTokenData(clientId);
     removeOAuthState(clientId);
+    removeOAuthNonce(clientId);
     removeReturnUrl(clientId);
     removeLogoutState(clientId);
     removePkceVerifier(clientId);
@@ -277,6 +288,7 @@ function clearAllSsoData(clientId) {
   }
   removeTokenData();
   removeOAuthState();
+  removeOAuthNonce();
   removeReturnUrl();
   removeLogoutState();
   const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;
@@ -367,18 +379,21 @@ function normalizeIssuer(url) {
 var cachedJwks = null;
 var cachedDiscovery = null;
 var JWKS_CACHE_TTL_MS = 5 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1e4;
 async function fetchDiscoveryDoc(baseUrl) {
   const now = Date.now();
   if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {
     return cachedDiscovery.doc;
   }
   try {
-    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`);
-    const doc = res.ok ? await res.json() : null;
+    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const doc = await res.json();
     cachedDiscovery = { baseUrl, doc, fetchedAt: now };
     return doc;
   } catch {
-    cachedDiscovery = { baseUrl, doc: null, fetchedAt: now };
     return null;
   }
 }
@@ -390,7 +405,10 @@ async function fetchJwks(baseUrl, options = {}) {
   const discovery = await fetchDiscoveryDoc(baseUrl);
   const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
   try {
-    const res = await fetch(jwksUri, options.forceRefresh ? { cache: "no-cache" } : void 0);
+    const res = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      ...options.forceRefresh ? { cache: "no-cache" } : {}
+    });
     if (!res.ok) return null;
     const jwks = await res.json();
     cachedJwks = { baseUrl, jwks, fetchedAt: now };
@@ -437,7 +455,7 @@ async function computeAtHash(accessToken) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function validateIdToken(idToken, accessToken, expectedIssuer, expectedClientId, options = {}) {
-  const { rejectHs256WhenRs256Available = true } = options;
+  const { rejectHs256WhenRs256Available = true, expectedNonce } = options;
   const header = decodeJwtHeader(idToken);
   if (!header) {
     throw new SsoError("id_token_invalid", "ID Token \u683C\u5F0F\u9519\u8BEF");
@@ -527,6 +545,12 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
       throw new SsoError("id_token_at_hash_mismatch", "ID Token at_hash \u4E0D\u5339\u914D");
     }
   }
+  if (expectedNonce !== void 0) {
+    const tokenNonce = typeof payload.nonce === "string" ? payload.nonce : "";
+    if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
+      throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
+    }
+  }
   return { sub: payload.sub };
 }
 
@@ -541,6 +565,7 @@ var _SsoClient = class _SsoClient {
     if (!config.ssoBaseUrl) throw new SsoError("invalid_config", "ssoBaseUrl \u4E0D\u80FD\u4E3A\u7A7A");
     const base = config.ssoBaseUrl.replace(/\/+$/, "");
     this.config = { ...config, ssoBaseUrl: base };
+    this._serverBase = (config.serverBaseUrl ?? base).replace(/\/+$/, "");
   }
   // ============================================
   // 内部方法
@@ -556,7 +581,7 @@ var _SsoClient = class _SsoClient {
     if (this._discovery && now - this._discoveryFetchedAt < _SsoClient.DISCOVERY_TTL_MS) {
       return this._discovery;
     }
-    const url = `${this.config.ssoBaseUrl}/api/oauth/.well-known/openid-configuration`;
+    const url = `${this._serverBase}/api/oauth/.well-known/openid-configuration`;
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(
@@ -587,14 +612,16 @@ var _SsoClient = class _SsoClient {
     if (d) return d.authorization_endpoint;
     return `${this.config.ssoBaseUrl}/api/oauth/authorize`;
   }
-  /** 获取 token 端点 URL（优先 Discovery，回退默认） */
+  /** 获取 token 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
   async _getTokenEndpoint() {
+    if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/token`;
     const d = await this._getDiscovery();
     if (d) return d.token_endpoint;
     return `${this.config.ssoBaseUrl}/api/oauth/token`;
   }
-  /** 获取 userinfo 端点 URL（优先 Discovery，回退默认） */
+  /** 获取 userinfo 端点 URL（服务器间调用：serverBaseUrl 直连优先，其次 Discovery，回退默认） */
   async _getUserinfoEndpoint() {
+    if (this.config.serverBaseUrl) return `${this._serverBase}/api/oauth/userinfo`;
     const d = await this._getDiscovery();
     if (d) return d.userinfo_endpoint;
     return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;
@@ -630,8 +657,10 @@ var _SsoClient = class _SsoClient {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
     if (returnUrl) {
       this._saveReturnUrlIfTrusted(returnUrl);
     }
@@ -642,6 +671,7 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
     window.location.href = `${authorizeEndpoint}?${params.toString()}`;
@@ -659,8 +689,10 @@ var _SsoClient = class _SsoClient {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
     if (returnUrl) this._saveReturnUrlIfTrusted(returnUrl);
     const authorizeEndpoint = await this._getAuthorizeEndpoint();
     const params = new URLSearchParams();
@@ -669,6 +701,7 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
     return `${authorizeEndpoint}?${params.toString()}`;
@@ -710,9 +743,11 @@ var _SsoClient = class _SsoClient {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     const popupNonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
     savePkceVerifier(`${this.config.clientId}_popup_nonce`, popupNonce);
     if (options.returnUrl) {
       this._saveReturnUrlIfTrusted(options.returnUrl);
@@ -724,6 +759,7 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
     params.set("popup_nonce", popupNonce);
@@ -748,6 +784,7 @@ var _SsoClient = class _SsoClient {
     if (!popup) {
       removePkceVerifier(this.config.clientId);
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
       throw new SsoError(
         "popup_blocked",
@@ -767,6 +804,13 @@ var _SsoClient = class _SsoClient {
           const savedNonce = getPkceVerifier(`${this.config.clientId}_popup_nonce`);
           if (!savedNonce || !timingSafeEqualString(event.data.nonce ?? "", savedNonce)) return;
           removePkceVerifier(`${this.config.clientId}_popup_nonce`);
+          try {
+            event.source?.postMessage(
+              { type: "nihplod_sso_popup_ack", nonce: savedNonce },
+              event.origin
+            );
+          } catch {
+          }
           completed = true;
           cleanup();
           if (popup && !popup.closed) {
@@ -798,6 +842,7 @@ var _SsoClient = class _SsoClient {
     } catch (err) {
       removePkceVerifier(this.config.clientId);
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
       throw err;
     }
@@ -817,6 +862,7 @@ var _SsoClient = class _SsoClient {
     const error = params.get("error");
     if (error) {
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
       const desc = params.get("error_description") || error;
       throw new SsoError(mapOAuthErrorToSsoCode(error), `\u6388\u6743\u5931\u8D25: ${desc}`);
@@ -825,18 +871,21 @@ var _SsoClient = class _SsoClient {
     const returnedState = params.get("state");
     if (!code) {
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
       throw new SsoError("token_request_failed", "\u56DE\u8C03 URL \u4E2D\u7F3A\u5C11 authorization code");
     }
     const savedState = getOAuthState(this.config.clientId);
     if (!savedState || !timingSafeEqualString(savedState, returnedState ?? "")) {
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
       throw new SsoError(
         "state_mismatch",
         "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
       );
     }
+    const expectedNonce = getOAuthNonce(this.config.clientId) ?? void 0;
     const verifier = getPkceVerifier(this.config.clientId);
     if (!verifier) {
       throw new SsoError(
@@ -883,7 +932,8 @@ var _SsoClient = class _SsoClient {
           data.id_token,
           data.access_token,
           this.config.ssoBaseUrl,
-          this.config.clientId
+          this.config.clientId,
+          { expectedNonce }
         );
       } catch (err) {
         removeTokenData(this.config.clientId);
@@ -891,6 +941,7 @@ var _SsoClient = class _SsoClient {
       }
     }
     removeOAuthState(this.config.clientId);
+    removeOAuthNonce(this.config.clientId);
     removePkceVerifier(this.config.clientId);
     const now = Date.now();
     const tokenData = {
@@ -1071,8 +1122,8 @@ var _SsoClient = class _SsoClient {
     clearAllSsoData(this.config.clientId);
     if (refreshToken && this.config.clientId) {
       try {
-        const discovery = await this._getDiscovery();
-        const revokeUrl = discovery?.revocation_endpoint || `${this.config.ssoBaseUrl}/api/oauth/revoke`;
+        const discovery = this.config.serverBaseUrl ? null : await this._getDiscovery();
+        const revokeUrl = this.config.serverBaseUrl ? `${this._serverBase}/api/oauth/revoke` : discovery?.revocation_endpoint || `${this.config.ssoBaseUrl}/api/oauth/revoke`;
         const revokeBody = new URLSearchParams({
           token: refreshToken,
           token_type_hint: "refresh_token",