@nocobase/plugin-idp-oauth 2.1.0-alpha.10

package/dist/node_modules/oidc-provider/lib/actions/grants/refresh_token.js

@@ -0,0 +1,229 @@
+import difference from '../../helpers/_/difference.js';
+import { InvalidRequest, InvalidGrant, InvalidScope } from '../../helpers/errors.js';
+import presence from '../../helpers/validate_presence.js';
+import instance from '../../helpers/weak_cache.js';
+import revoke from '../../helpers/revoke.js';
+import certificateThumbprint from '../../helpers/certificate_thumbprint.js';
+import * as formatters from '../../helpers/formatters.js';
+import dpopValidate, { CHALLENGE_OK_WINDOW } from '../../helpers/validate_dpop.js';
+import resolveResource from '../../helpers/resolve_resource.js';
+import epochTime from '../../helpers/epoch_time.js';
+import checkRar from '../../shared/check_rar.js';
+import { checkAttestBinding } from '../../helpers/check_attest_binding.js';
+import {
+  checkDpopRequired,
+  validateGrant,
+  validateAccount,
+  checkAccountMismatch,
+  createAccessToken,
+  applyMtlsBinding,
+  issueIdToken,
+  buildTokenResponse,
+} from '../../helpers/grant_common.js';
+
+import { gty as deviceCodeGty } from './device_code.js';
+
+function rarSupported(token) {
+  const [origin] = token.gty.split(' ');
+  return origin !== deviceCodeGty;
+}
+
+const gty = 'refresh_token';
+
+export const handler = async function refreshTokenHandler(ctx) {
+  presence(ctx, 'refresh_token');
+
+  const {
+    findAccount,
+    conformIdTokenClaims,
+    rotateRefreshToken,
+    features: {
+      userinfo,
+      mTLS: { getCertificate },
+      dPoP: { allowReplay },
+      resourceIndicators,
+      richAuthorizationRequests,
+    },
+  } = instance(ctx.oidc.provider).configuration;
+
+  const {
+    RefreshToken, AccessToken, ReplayDetection,
+  } = ctx.oidc.provider;
+  const { client } = ctx.oidc;
+
+  const dPoP = await dpopValidate(ctx);
+
+  let refreshTokenValue = ctx.oidc.params.refresh_token;
+  let refreshToken = await RefreshToken.find(refreshTokenValue, { ignoreExpiration: true });
+
+  if (!refreshToken) {
+    throw new InvalidGrant('refresh token not found');
+  }
+
+  if (refreshToken.clientId !== client.clientId) {
+    throw new InvalidGrant('client mismatch');
+  }
+
+  if (refreshToken.isExpired) {
+    throw new InvalidGrant('refresh token is expired');
+  }
+
+  let cert;
+  if (client.tlsClientCertificateBoundAccessTokens || refreshToken['x5t#S256']) {
+    cert = getCertificate(ctx);
+    if (!cert) {
+      throw new InvalidGrant('mutual TLS client certificate not provided');
+    }
+  }
+
+  checkDpopRequired(ctx, dPoP);
+
+  if (refreshToken['x5t#S256'] && refreshToken['x5t#S256'] !== certificateThumbprint(cert)) {
+    throw new InvalidGrant('failed x5t#S256 verification');
+  }
+
+  const grant = await validateGrant(ctx, refreshToken.grantId);
+
+  if (ctx.oidc.params.scope) {
+    const missing = difference([...ctx.oidc.requestParamScopes], [...refreshToken.scopes]);
+
+    if (missing.length !== 0) {
+      throw new InvalidScope(`refresh token missing requested ${formatters.pluralize('scope', missing.length)}`, missing.join(' '));
+    }
+  }
+
+  if (dPoP && !allowReplay) {
+    const unique = await ReplayDetection.unique(
+      client.clientId,
+      dPoP.jti,
+      epochTime() + CHALLENGE_OK_WINDOW,
+    );
+
+    ctx.assert(unique, new InvalidGrant('DPoP proof JWT Replay detected'));
+  }
+
+  if (refreshToken.jkt && (!dPoP || refreshToken.jkt !== dPoP.thumbprint)) {
+    throw new InvalidGrant('failed jkt verification');
+  }
+
+  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
+    await checkAttestBinding(ctx, refreshToken);
+  }
+
+  ctx.oidc.entity('RefreshToken', refreshToken);
+  ctx.oidc.entity('Grant', grant);
+
+  const account = await validateAccount(ctx, findAccount, refreshToken, 'refresh token');
+  checkAccountMismatch(refreshToken, grant);
+
+  ctx.oidc.entity('Account', account);
+
+  if (refreshToken.consumed) {
+    await Promise.all([
+      refreshToken.destroy(),
+      revoke(ctx, refreshToken.grantId),
+    ]);
+    throw new InvalidGrant('refresh token already used');
+  }
+
+  if (ctx.oidc.params.authorization_details && !rarSupported(refreshToken)) {
+    throw new InvalidRequest('authorization_details is unsupported for this refresh token');
+  }
+
+  if (
+    rotateRefreshToken === true
+    || (typeof rotateRefreshToken === 'function' && await rotateRefreshToken(ctx))
+  ) {
+    await refreshToken.consume();
+    ctx.oidc.entity('RotatedRefreshToken', refreshToken);
+
+    refreshToken = new RefreshToken({
+      accountId: refreshToken.accountId,
+      acr: refreshToken.acr,
+      amr: refreshToken.amr,
+      authTime: refreshToken.authTime,
+      claims: refreshToken.claims,
+      client,
+      expiresWithSession: refreshToken.expiresWithSession,
+      iiat: refreshToken.iiat,
+      grantId: refreshToken.grantId,
+      gty: refreshToken.gty,
+      nonce: refreshToken.nonce,
+      resource: refreshToken.resource,
+      rotations: typeof refreshToken.rotations === 'number' ? refreshToken.rotations + 1 : 1,
+      scope: refreshToken.scope,
+      sessionUid: refreshToken.sessionUid,
+      sid: refreshToken.sid,
+      rar: refreshToken.rar,
+      'x5t#S256': refreshToken['x5t#S256'],
+      jkt: refreshToken.jkt,
+      attestationJkt: refreshToken.attestationJkt,
+    });
+
+    if (refreshToken.gty && !refreshToken.gty.endsWith(gty)) {
+      refreshToken.gty = `${refreshToken.gty} ${gty}`;
+    }
+
+    ctx.oidc.entity('RefreshToken', refreshToken);
+    refreshTokenValue = await refreshToken.save();
+  }
+
+  const at = createAccessToken(ctx, AccessToken, {
+    accountId: account.accountId,
+    expiresWithSession: refreshToken.expiresWithSession,
+    grantId: refreshToken.grantId,
+    sessionUid: refreshToken.sessionUid,
+    sid: refreshToken.sid,
+  }, refreshToken.gty);
+
+  applyMtlsBinding(at, cert);
+
+  if (dPoP) {
+    at.setThumbprint('jkt', dPoP.thumbprint);
+  }
+
+  if (at.gty && !at.gty.endsWith(gty)) {
+    at.gty = `${at.gty} ${gty}`;
+  }
+
+  const scope = ctx.oidc.params.scope ? ctx.oidc.requestParamScopes : refreshToken.scopes;
+  await checkRar(ctx, () => {});
+  const resource = await resolveResource(
+    ctx,
+    refreshToken,
+    { userinfo, resourceIndicators },
+    scope,
+  );
+
+  if (resource) {
+    const resourceServerInfo = await resourceIndicators
+      .getResourceServerInfo(ctx, resource, ctx.oidc.client);
+    at.resourceServer = new ctx.oidc.provider.ResourceServer(resource, resourceServerInfo);
+    at.scope = grant.getResourceScopeFiltered(
+      resource,
+      [...scope].filter(Set.prototype.has.bind(at.resourceServer.scopes)),
+    );
+  } else {
+    at.claims = refreshToken.claims;
+    at.scope = grant.getOIDCScopeFiltered(scope);
+  }
+
+  if (richAuthorizationRequests.enabled && at.resourceServer) {
+    at.rar = await richAuthorizationRequests.rarForRefreshTokenResponse(ctx, at.resourceServer);
+  }
+
+  ctx.oidc.entity('AccessToken', at);
+  const accessToken = await at.save();
+
+  const idToken = await issueIdToken(ctx, refreshToken, at, grant, {
+    conformIdTokenClaims, userinfo,
+  }, scope);
+
+  ctx.body = buildTokenResponse(at, accessToken, {
+    idToken, refreshToken: refreshTokenValue, source: refreshToken, rar: at.rar,
+  });
+};
+
+export const parameters = new Set(['refresh_token', 'scope']);
+
+export const grantType = gty;

package/dist/node_modules/oidc-provider/lib/actions/index.js

@@ -0,0 +1,25 @@
+import getAuthorization from './authorization/index.js';
+import userinfo from './userinfo.js';
+import getToken from './token.js';
+import jwks from './jwks.js';
+import * as registration from './registration.js';
+import getRevocation from './revocation.js';
+import getIntrospection from './introspection.js';
+import discovery from './discovery.js';
+import challenge from './challenge.js';
+import * as endSession from './end_session.js';
+import * as codeVerification from './code_verification.js';
+
+export {
+  getAuthorization,
+  userinfo,
+  getToken,
+  jwks,
+  registration,
+  getRevocation,
+  getIntrospection,
+  discovery,
+  endSession,
+  codeVerification,
+  challenge,
+};

package/dist/node_modules/oidc-provider/lib/actions/interaction.js

@@ -0,0 +1,150 @@
+import { strict as assert } from 'node:assert';
+import * as querystring from 'node:querystring';
+import { inspect } from 'node:util';
+
+import * as attention from '../helpers/attention.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
+import * as views from '../views/index.js';
+import instance from '../helpers/weak_cache.js';
+import noCache from '../shared/no_cache.js';
+import { defaults } from '../helpers/defaults.js';
+
+const { interactions: { url: defaultInteractionUri } } = defaults;
+const keys = new Set();
+const dbg = (obj) => querystring.stringify(Object.entries(obj).reduce((acc, [key, value]) => {
+  keys.add(key);
+  acc[key] = inspect(value, { depth: null });
+  return acc;
+}, {}), '<br/>', ': ', {
+  encodeURIComponent(value) { return keys.has(value) ? `<strong>${value}</strong>` : value; },
+});
+
+export default function devInteractions(provider) {
+  /* eslint-disable no-multi-str */
+  attention.warn('a quick start development-only feature devInteractions is enabled, \
+you are expected to disable these interactions and provide your own');
+
+  const configuration = instance(provider).configuration.interactions;
+
+  if (configuration.url !== defaultInteractionUri) {
+    attention.warn('you\'ve configured your own interactions.url but devInteractions are still enabled, \
+your configuration is not in effect');
+  }
+  /* eslint-enable */
+
+  configuration.url = (ctx, interaction) => new URL(ctx.oidc.urlFor('interaction', { uid: interaction.uid })).pathname;
+
+  return {
+    render: [
+      noCache,
+      async function interactionRender(ctx) {
+        const {
+          uid, prompt, params, session,
+        } = await provider.interactionDetails(ctx.req, ctx.res);
+        const client = await provider.Client.find(params.client_id);
+
+        let view;
+        let title;
+
+        switch (prompt.name) {
+          case 'login':
+            view = 'login';
+            title = 'Sign-in';
+            break;
+          case 'consent':
+            view = 'interaction';
+            title = 'Authorize';
+            break;
+          default:
+            ctx.throw(501, 'not implemented');
+        }
+
+        const locals = {
+          client,
+          uid,
+          abortUrl: ctx.oidc.urlFor('abort', { uid }),
+          submitUrl: ctx.oidc.urlFor('submit', { uid }),
+          details: prompt.details,
+          prompt: prompt.name,
+          params,
+          title,
+          session: session ? dbg(session) : undefined,
+          dbg: {
+            params: dbg(params),
+            prompt: dbg(prompt),
+          },
+        };
+
+        locals.body = views[view](locals);
+
+        ctx.type = 'html';
+        ctx.body = views.layout(locals);
+      },
+    ],
+    abort: [
+      noCache,
+      function interactionAbort(ctx) {
+        const result = {
+          error: 'access_denied',
+          error_description: 'End-User aborted interaction',
+        };
+
+        return provider.interactionFinished(ctx.req, ctx.res, result, {
+          mergeWithLastSubmission: false,
+        });
+      },
+    ],
+    submit: [
+      noCache,
+      parseBody,
+      async function interactionSubmit(ctx) {
+        const {
+          prompt: { name, details }, grantId, session, params,
+        } = await provider.interactionDetails(ctx.req, ctx.res);
+        switch (ctx.oidc.body.prompt) { // eslint-disable-line default-case
+          case 'login': {
+            assert.equal(name, 'login');
+            await provider.interactionFinished(ctx.req, ctx.res, {
+              login: { accountId: ctx.oidc.body.login },
+            }, { mergeWithLastSubmission: false });
+            break;
+          }
+          case 'consent': {
+            assert.equal(name, 'consent');
+
+            let grant;
+            if (grantId) {
+              // we'll be modifying existing grant in existing session
+              grant = await provider.Grant.find(grantId);
+            } else {
+              // we're establishing a new grant
+              grant = new provider.Grant({
+                accountId: session.accountId,
+                clientId: params.client_id,
+              });
+            }
+
+            if (details.missingOIDCScope) {
+              grant.addOIDCScope(details.missingOIDCScope.join(' '));
+            }
+            if (details.missingOIDCClaims) {
+              grant.addOIDCClaims(details.missingOIDCClaims);
+            }
+            if (details.missingResourceScopes) {
+              for (const [indicator, scope] of Object.entries(details.missingResourceScopes)) {
+                grant.addResourceScope(indicator, scope.join(' '));
+              }
+            }
+            const result = { consent: { grantId: await grant.save() } };
+            await provider.interactionFinished(ctx.req, ctx.res, result, {
+              mergeWithLastSubmission: true,
+            });
+            break;
+          }
+          default:
+            ctx.throw(501, 'not implemented');
+        }
+      },
+    ],
+  };
+}

package/dist/node_modules/oidc-provider/lib/actions/introspection.js

@@ -0,0 +1,164 @@
+import presence from '../helpers/validate_presence.js';
+import getClientAuth from '../shared/client_auth.js';
+import noCache from '../shared/no_cache.js';
+import instance from '../helpers/weak_cache.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
+import rejectDupes from '../shared/reject_dupes.js';
+import paramsMiddleware from '../shared/assemble_params.js';
+import { InvalidRequest } from '../helpers/errors.js';
+import rejectStructuredTokens from '../shared/reject_structured_tokens.js';
+import { checkAttestBinding } from '../helpers/check_attest_binding.js';
+import { createTokenFinder } from '../helpers/token_find.js';
+
+const introspectable = new Set(['AccessToken', 'ClientCredentials', 'RefreshToken']);
+const JWT = 'application/token-introspection+jwt';
+
+export default function introspectionAction(provider) {
+  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
+  const PARAM_LIST = new Set(['token', 'token_type_hint', ...authParams]);
+  const { configuration } = instance(provider);
+  const {
+    pairwiseIdentifier,
+    features: {
+      introspection: { allowedPolicy },
+      jwtIntrospection,
+      richAuthorizationRequests,
+    },
+  } = configuration;
+  const { grantTypeHandlers } = instance(provider);
+  const {
+    IdToken, Client,
+  } = provider;
+
+  const findToken = createTokenFinder(provider, grantTypeHandlers);
+
+  return [
+    noCache,
+    parseBody,
+    paramsMiddleware.bind(undefined, PARAM_LIST),
+    ...clientAuth,
+    rejectDupes.bind(undefined, {}),
+
+    async function validateTokenPresence(ctx, next) {
+      presence(ctx, 'token');
+      await next();
+    },
+
+    rejectStructuredTokens,
+
+    async function jwtIntrospectionResponse(ctx, next) {
+      if (jwtIntrospection.enabled) {
+        const { client } = ctx.oidc;
+
+        const {
+          introspectionEncryptedResponseAlg: encrypt,
+          introspectionSignedResponseAlg: sign,
+        } = client;
+
+        const accepts = ctx.accepts('json', JWT);
+        if (encrypt && accepts !== JWT) {
+          throw new InvalidRequest(`introspection must be requested with Accept: ${JWT} for this client`);
+        }
+
+        await next();
+
+        if ((encrypt || sign) && accepts === JWT) {
+          const token = new IdToken({}, { ctx });
+          token.extra = {
+            token_introspection: ctx.body,
+            aud: ctx.body.aud,
+          };
+
+          ctx.body = await token.issue({ use: 'introspection' });
+          ctx.type = 'application/token-introspection+jwt; charset=utf-8';
+        }
+      } else {
+        await next();
+      }
+    },
+
+    async function renderTokenResponse(ctx) {
+      const { params } = ctx.oidc;
+
+      ctx.body = { active: false };
+
+      const token = await findToken(params.token, params.token_type_hint);
+
+      if (!token?.isValid) {
+        return;
+      }
+
+      if (token.grantId) {
+        const grant = await ctx.oidc.provider.Grant.find(token.grantId, {
+          ignoreExpiration: true,
+        });
+
+        if (!grant) return;
+        if (grant.isExpired) return;
+        if (grant.clientId !== token.clientId) return;
+        if (grant.accountId !== token.accountId) return;
+
+        ctx.oidc.entity('Grant', grant);
+      }
+
+      if (introspectable.has(token.kind)) {
+        ctx.oidc.entity(token.kind, token);
+      } else {
+        return;
+      }
+
+      if (
+        token.kind === 'RefreshToken'
+        && ctx.oidc.client.clientId === token.clientId
+        && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
+      ) {
+        try {
+          await checkAttestBinding(ctx, token);
+        } catch {
+          return;
+        }
+      }
+
+      if (!(await allowedPolicy(ctx, ctx.oidc.client, token))) {
+        return;
+      }
+
+      if (token.accountId) {
+        ctx.body.sub = token.accountId;
+        if (token.clientId !== ctx.oidc.client.clientId) {
+          const client = await Client.find(token.clientId);
+          if (client.subjectType === 'pairwise') {
+            ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, client);
+          }
+        } else if (ctx.oidc.client.subjectType === 'pairwise') {
+          ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, ctx.oidc.client);
+        }
+      }
+
+      Object.assign(ctx.body, {
+        ...token.extra,
+        active: true,
+        client_id: token.clientId,
+        exp: token.exp,
+        iat: token.iat,
+        sid: token.sid,
+        iss: provider.issuer,
+        jti: token.jti !== params.token ? token.jti : undefined,
+        aud: token.aud,
+        authorization_details: token.rar
+          ? await richAuthorizationRequests.rarForIntrospectionResponse(ctx, token) : undefined,
+        scope: token.scope || undefined,
+        cnf: token.isSenderConstrained() ? {} : undefined,
+        token_type: token.kind !== 'RefreshToken' ? token.tokenType : undefined,
+      });
+
+      if (token['x5t#S256']) {
+        ctx.body.cnf['x5t#S256'] = token['x5t#S256'];
+      }
+
+      if (token.jkt) {
+        ctx.body.cnf.jkt = token.jkt;
+      }
+    },
+  ];
+}

package/dist/node_modules/oidc-provider/lib/actions/jwks.js

@@ -0,0 +1,7 @@
+import instance from '../helpers/weak_cache.js';
+
+export default function renderJWKS(ctx) {
+  const { keys } = instance(ctx.oidc.provider).jwks;
+  ctx.body = { keys };
+  ctx.type = 'application/jwk-set+json; charset=utf-8';
+}