@nihplod/sso-sdk 1.4.1 → 1.6.0

package/dist/index.mjs

@@ -100,18 +100,25 @@ function createMemoryStorageAdapter() {
     },
     remove(key) {
       store.delete(key);
+    },
+    keys() {
+      return [...store.keys()];
     }
   };
 }
 var memoryStorageAdapter = createMemoryStorageAdapter();
 var localStorageAdapter = {
   get(key) {
-    if (typeof localStorage === "undefined") return null;
-    return localStorage.getItem(STORAGE_PREFIX + key);
+    try {
+      if (typeof localStorage === "undefined") return null;
+      return localStorage.getItem(STORAGE_PREFIX + key);
+    } catch {
+      return null;
+    }
   },
   set(key, value) {
-    if (typeof localStorage === "undefined") return;
     try {
+      if (typeof localStorage === "undefined") return;
       localStorage.setItem(STORAGE_PREFIX + key, value);
     } catch (err) {
       console.warn(
@@ -120,34 +127,68 @@ var localStorageAdapter = {
     }
   },
   remove(key) {
-    if (typeof localStorage === "undefined") return;
-    localStorage.removeItem(STORAGE_PREFIX + key);
+    try {
+      if (typeof localStorage === "undefined") return;
+      localStorage.removeItem(STORAGE_PREFIX + key);
+    } catch {
+    }
+  },
+  keys() {
+    try {
+      if (typeof localStorage === "undefined") return [];
+      const result = [];
+      for (let i = 0; i < localStorage.length; i++) {
+        const key = localStorage.key(i);
+        if (key?.startsWith(STORAGE_PREFIX)) result.push(key.slice(STORAGE_PREFIX.length));
+      }
+      return result;
+    } catch {
+      return [];
+    }
   }
 };
 function createSessionStorageAdapter() {
   const fallback = /* @__PURE__ */ new Map();
   return {
     get(key) {
-      if (typeof sessionStorage !== "undefined") {
-        return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;
+      try {
+        if (typeof sessionStorage !== "undefined") {
+          return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;
+        }
+      } catch {
       }
       return fallback.get(key) ?? null;
     },
     set(key, value) {
-      if (typeof sessionStorage === "undefined") {
-        fallback.set(key, value);
-        return;
-      }
       try {
-        sessionStorage.setItem(STORAGE_PREFIX + key, value);
+        if (typeof sessionStorage !== "undefined") {
+          sessionStorage.setItem(STORAGE_PREFIX + key, value);
+          return;
+        }
       } catch {
-        fallback.set(key, value);
       }
+      fallback.set(key, value);
     },
     remove(key) {
       fallback.delete(key);
-      if (typeof sessionStorage === "undefined") return;
-      sessionStorage.removeItem(STORAGE_PREFIX + key);
+      try {
+        if (typeof sessionStorage === "undefined") return;
+        sessionStorage.removeItem(STORAGE_PREFIX + key);
+      } catch {
+      }
+    },
+    keys() {
+      const result = new Set(fallback.keys());
+      try {
+        if (typeof sessionStorage !== "undefined") {
+          for (let i = 0; i < sessionStorage.length; i++) {
+            const key = sessionStorage.key(i);
+            if (key?.startsWith(STORAGE_PREFIX)) result.add(key.slice(STORAGE_PREFIX.length));
+          }
+        }
+      } catch {
+      }
+      return [...result];
     }
   };
 }
@@ -249,23 +290,44 @@ function clearAllSsoData(clientId) {
   removeReturnUrl();
   removeLogoutState();
   removeSilentProbe();
-  const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;
-  const stores = [
-    typeof sessionStorage !== "undefined" ? sessionStorage : null,
-    typeof localStorage !== "undefined" ? localStorage : null
-  ];
+  const stores = [];
+  try {
+    if (typeof sessionStorage !== "undefined") stores.push(sessionStorage);
+  } catch {
+  }
+  try {
+    if (typeof localStorage !== "undefined") stores.push(localStorage);
+  } catch {
+  }
+  const abstractKeys = /* @__PURE__ */ new Set();
   for (const store of stores) {
-    if (!store) continue;
     const keys = [];
-    for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) keys.push(key);
+    try {
+      for (let i = 0; i < store.length; i++) {
+        const key = store.key(i);
+        if (key?.startsWith(STORAGE_PREFIX)) keys.push(key);
+      }
+    } catch {
+      continue;
     }
     for (const key of keys) {
-      _transient.remove(key.slice(STORAGE_PREFIX.length));
-      store.removeItem(key);
+      abstractKeys.add(key.slice(STORAGE_PREFIX.length));
+      try {
+        store.removeItem(key);
+      } catch {
+      }
     }
   }
+  for (const store of [_transient, _storage]) {
+    try {
+      for (const key of store.keys?.() ?? []) abstractKeys.add(key);
+    } catch {
+    }
+  }
+  for (const key of abstractKeys) {
+    _transient.remove(key);
+    _storage.remove(key);
+  }
 }
 function clearVerifiersForClients(clientIds) {
   for (const clientId of clientIds) {
@@ -274,12 +336,17 @@ function clearVerifiersForClients(clientIds) {
 }
 
 // src/core/security.ts
+var UNSAFE_URL_CHAR_PATTERN = /[\\\u0000-\u001F\u007F]/;
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
-  if (url.includes("\\")) return false;
-  if (url.startsWith("/") && !url.startsWith("//")) return true;
+  if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;
+  if (url.startsWith("//")) return false;
+  if (url.startsWith("/")) return true;
   try {
-    return new URL(url).origin === currentOrigin;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+    if (parsed.username || parsed.password) return false;
+    return parsed.origin === currentOrigin;
   } catch {
     return false;
   }
@@ -491,7 +558,10 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
-  if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
+  if (typeof payload.iat !== "number") {
+    throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 iat \u58F0\u660E");
+  }
+  if (payload.iat * 1e3 > Date.now() + 6e4) {
     throw new SsoError("id_token_invalid", "ID Token iat \u5728\u672A\u6765\uFF0C\u7591\u4F3C\u4F2A\u9020\u6216\u65F6\u949F\u5F02\u5E38");
   }
   if (typeof payload.sub !== "string" || !payload.sub) {
@@ -508,11 +578,47 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
     if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
       throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
     }
+  } else if (typeof payload.nonce === "string" && payload.nonce) {
+    throw new SsoError(
+      "id_token_nonce_mismatch",
+      "ID Token \u643A\u5E26 nonce \u4F46\u672C\u5730\u65E0\u671F\u671B\u503C\uFF08\u53EF\u80FD\u975E\u672C\u6B21\u767B\u5F55\u4F1A\u8BDD\u7B7E\u53D1\uFF09"
+    );
   }
   return { sub: payload.sub };
 }
 
+// src/core/http.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/core/SsoClient.ts
+var REVOKE_TIMEOUT_MS = 3e3;
+var EXPIRY_SKEW_MS = 1e4;
+function assertValidTokenResponse(data, requireRefreshToken) {
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new SsoError("token_request_failed", "Token \u54CD\u5E94\u7F3A\u5C11 access_token");
+  }
+  if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
+    throw new SsoError(
+      "token_request_failed",
+      `Token \u54CD\u5E94 expires_in \u975E\u6CD5: ${String(data.expires_in)}`
+    );
+  }
+  if (requireRefreshToken && (typeof data.refresh_token !== "string" || !data.refresh_token)) {
+    throw new SsoError(
+      "token_request_failed",
+      "Token \u54CD\u5E94\u7F3A\u5C11 refresh_token\uFF08authorization_code \u4EA4\u6362\u5FC5\u987B\u8FD4\u56DE\uFF09"
+    );
+  }
+}
 var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set([
   "login_required",
   "consent_required",
@@ -523,6 +629,8 @@ var _SsoClient = class _SsoClient {
     this._discovery = null;
     this._discoveryFetchedAt = 0;
     this._refreshLock = null;
+    /** Discovery 端点 origin 校验失败只告警一次（拒绝的文档不缓存，避免每次调用刷屏） */
+    this._discoveryOriginWarned = false;
     if (!config.clientId) throw new SsoError("invalid_config", "clientId \u4E0D\u80FD\u4E3A\u7A7A");
     if (!config.redirectUri) throw new SsoError("invalid_config", "redirectUri \u4E0D\u80FD\u4E3A\u7A7A");
     if (!config.ssoBaseUrl) throw new SsoError("invalid_config", "ssoBaseUrl \u4E0D\u80FD\u4E3A\u7A7A");
@@ -531,8 +639,67 @@ var _SsoClient = class _SsoClient {
     this._serverBase = (config.serverBaseUrl ?? base).replace(/\/+$/, "");
   }
   // ============================================
+  // 调试日志
+  // ============================================
+  /**
+   * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：
+   * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。
+   * 不会输出 token/授权码等敏感值。
+   */
+  debugLog(...args) {
+    if (this.config.debug) {
+      console.warn("[SSO SDK]", ...args);
+    }
+  }
+  // ============================================
   // 内部方法
   // ============================================
+  /**
+   * 校验 Discovery 文档端点 origin（防文档被篡改后 token/code 被导向攻击者服务器）：
+   * - authorization_endpoint 必须与 ssoBaseUrl 同源（浏览器跳转目标）；
+   * - token_endpoint / userinfo_endpoint 必须与 ssoBaseUrl 同源，
+   *   或（配置了 serverBaseUrl 时）与内网地址同源。
+   * 任一不匹配：告警并返回 null（上层回退到默认端点，fail-safe）。
+   * 可通过 config.allowCrossOriginDiscoveryEndpoints 关闭（见配置项警告）。
+   */
+  _sanitizeDiscovery(d) {
+    if (this.config.allowCrossOriginDiscoveryEndpoints) return d;
+    const allowedOrigins = /* @__PURE__ */ new Set();
+    try {
+      allowedOrigins.add(new URL(this.config.ssoBaseUrl).origin);
+      allowedOrigins.add(new URL(this._serverBase).origin);
+    } catch {
+      return null;
+    }
+    const sameOrigin = (endpoint) => {
+      try {
+        return allowedOrigins.has(new URL(endpoint).origin);
+      } catch {
+        return false;
+      }
+    };
+    const publicOrigin = new URL(this.config.ssoBaseUrl).origin;
+    let authorizationOk = false;
+    try {
+      authorizationOk = new URL(d.authorization_endpoint).origin === publicOrigin;
+    } catch {
+      authorizationOk = false;
+    }
+    const bad = [];
+    if (!authorizationOk) bad.push("authorization_endpoint");
+    if (!sameOrigin(d.token_endpoint)) bad.push("token_endpoint");
+    if (!sameOrigin(d.userinfo_endpoint)) bad.push("userinfo_endpoint");
+    if (bad.length > 0) {
+      if (!this._discoveryOriginWarned) {
+        this._discoveryOriginWarned = true;
+        console.warn(
+          `[SSO SDK] OIDC Discovery \u7AEF\u70B9 origin \u4E0E ssoBaseUrl/serverBaseUrl \u4E0D\u5339\u914D\uFF08${bad.join(", ")}\uFF09\uFF0C\u5DF2\u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9\u3002\u82E5 SSO \u4E2D\u5FC3\u786E\u5B9E\u6258\u7BA1\u8DE8\u6E90\u7AEF\u70B9\uFF0C\u8BF7\u8BBE\u7F6E allowCrossOriginDiscoveryEndpoints: true`
+        );
+      }
+      return null;
+    }
+    return d;
+  }
   /**
    * 获取 OIDC Discovery 文档（带缓存 + 超时）
    *
@@ -559,7 +726,10 @@ var _SsoClient = class _SsoClient {
         );
         return null;
       }
-      this._discovery = await res.json();
+      const doc = await res.json();
+      const sanitized = this._sanitizeDiscovery(doc);
+      if (!sanitized) return null;
+      this._discovery = sanitized;
       this._discoveryFetchedAt = now;
       return this._discovery;
     } catch (err) {
@@ -910,7 +1080,7 @@ var _SsoClient = class _SsoClient {
     }
     let res;
     try {
-      res = await fetch(tokenEndpoint, {
+      res = await fetchWithTimeout(tokenEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: body.toString()
@@ -919,6 +1089,10 @@ var _SsoClient = class _SsoClient {
       throw new SsoError("network_error", "\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25", err);
     }
     if (!res.ok) {
+      removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       let errData = {};
       try {
         errData = await res.json();
@@ -931,6 +1105,19 @@ var _SsoClient = class _SsoClient {
       );
     }
     const data = await res.json();
+    assertValidTokenResponse(data, true);
+    const requestedScopes = (this.config.scopes || "openid profile").split(" ").filter(Boolean);
+    if (requestedScopes.includes("openid") && !data.id_token) {
+      removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
+      removeTokenData(this.config.clientId);
+      throw new SsoError(
+        "id_token_invalid",
+        "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09"
+      );
+    }
     if (data.id_token) {
       try {
         await validateIdToken(
@@ -960,6 +1147,7 @@ var _SsoClient = class _SsoClient {
       expires_at: now + data.expires_in * 1e3
     };
     saveTokenData(tokenData, this.config.clientId);
+    this.debugLog("handleCallback: token \u4EA4\u6362\u6210\u529F", { clientId: this.config.clientId });
     return tokenData;
   }
   /**
@@ -995,7 +1183,7 @@ var _SsoClient = class _SsoClient {
     let lastErr;
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        res = await fetch(tokenEndpoint, {
+        res = await fetchWithTimeout(tokenEndpoint, {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
           body: body.toString()
@@ -1017,15 +1205,20 @@ var _SsoClient = class _SsoClient {
       } catch {
       }
       const errorCode = errData.error || "";
-      if (errorCode === "invalid_grant" || res.status === 401) {
+      if (errorCode === "invalid_grant") {
         removeTokenData(this.config.clientId);
       }
+      this.debugLog("refreshToken: \u5237\u65B0\u5931\u8D25", { status: res.status, error: errorCode });
+      if (!errorCode && res.status === 401) {
+        throw new SsoError("sso_server_error", "\u5237\u65B0 Token \u5931\u8D25\uFF08\u7F51\u5173\u5F02\u5E38\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+      }
       throw new SsoError(
         mapOAuthErrorToSsoCode(errorCode, "refresh"),
         errData.error_description || `\u5237\u65B0 Token \u5931\u8D25: HTTP ${res.status}`
       );
     }
     const data = await res.json();
+    assertValidTokenResponse(data, false);
     if (data.id_token) {
       try {
         await validateIdToken(
@@ -1063,13 +1256,13 @@ var _SsoClient = class _SsoClient {
     if (!tokenData) {
       throw new SsoError("not_authenticated", "\u672A\u767B\u5F55");
     }
-    if (Date.now() >= tokenData.expires_at) {
+    if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {
       tokenData = await this.refreshToken();
     }
     const userinfoEndpoint = await this._getUserinfoEndpoint();
     let res;
     try {
-      res = await fetch(userinfoEndpoint, {
+      res = await fetchWithTimeout(userinfoEndpoint, {
         headers: {
           Authorization: `Bearer ${tokenData.access_token}`
         }
@@ -1098,7 +1291,7 @@ var _SsoClient = class _SsoClient {
   async getAccessToken() {
     let tokenData = getTokenData(this.config.clientId);
     if (!tokenData) return null;
-    if (Date.now() >= tokenData.expires_at) {
+    if (Date.now() >= tokenData.expires_at - EXPIRY_SKEW_MS) {
       tokenData = await this.refreshToken();
     }
     return tokenData.access_token;
@@ -1107,6 +1300,9 @@ var _SsoClient = class _SsoClient {
    * 检查是否已认证（不发起网络请求）
    *
    * 仅检查本地是否存在未过期的 access_token。
+   * 故意不做 EXPIRY_SKEW_MS 提前量：这是同步的 UI 提示判定（是否显示"已登录"），
+   * 提前 10s 翻转 false 会让调用方在 token 仍有效时误显示未登录；真正发请求的
+   * getAccessToken/getUserInfo 已带提前量。
    */
   isAuthenticated() {
     const tokenData = getTokenData(this.config.clientId);
@@ -1126,6 +1322,10 @@ var _SsoClient = class _SsoClient {
     const refreshToken = tokenData?.refresh_token;
     const idTokenHint = tokenData?.id_token;
     clearAllSsoData(this.config.clientId);
+    this.debugLog("logout: \u672C\u5730\u6570\u636E\u5DF2\u6E05\u9664", {
+      clientId: this.config.clientId,
+      redirectToSso
+    });
     if (refreshToken && this.config.clientId) {
       try {
         const discovery = this.config.serverBaseUrl ? null : await this._getDiscovery();
@@ -1138,11 +1338,15 @@ var _SsoClient = class _SsoClient {
         if (this.config.clientSecret) {
           revokeBody.set("client_secret", this.config.clientSecret);
         }
-        await fetch(revokeUrl, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: revokeBody.toString()
-        });
+        await fetchWithTimeout(
+          revokeUrl,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: revokeBody.toString()
+          },
+          REVOKE_TIMEOUT_MS
+        );
       } catch {
       }
     }