@nocobase/plugin-idp-oauth 2.1.0-alpha.10

package/dist/node_modules/oidc-provider/lib/actions/registration.js

@@ -0,0 +1,274 @@
+import omitBy from '../helpers/_/omit_by.js';
+import constantEquals from '../helpers/constant_equals.js';
+import noCache from '../shared/no_cache.js';
+import { json as parseBody } from '../shared/selective_body.js';
+import epochTime from '../helpers/epoch_time.js';
+import { InvalidToken, InvalidRequest } from '../helpers/errors.js';
+import instance from '../helpers/weak_cache.js';
+import getSetWWWAuthenticateHeader from '../shared/set_www_authenticate_header.js';
+import addClient from '../helpers/add_client.js';
+
+const setWWWAuthenticate = getSetWWWAuthenticateHeader({ dpop: false });
+
+const FORBIDDEN = [
+  'registration_access_token',
+  'registration_client_uri',
+  'client_secret_expires_at',
+  'client_id_issued_at',
+];
+
+async function validateRegistrationAccessToken(ctx, next) {
+  const regAccessToken = await ctx.oidc.provider.RegistrationAccessToken.find(
+    ctx.oidc.getAccessToken(),
+  );
+  ctx.assert(regAccessToken, new InvalidToken('registration access token not found'));
+
+  const client = await ctx.oidc.provider.Client.find(ctx.params.clientId);
+
+  if (client?.clientId !== regAccessToken.clientId) {
+    await regAccessToken.destroy();
+    throw new InvalidToken('client mismatch');
+  }
+
+  ctx.oidc.entity('Client', client);
+  ctx.oidc.entity('RegistrationAccessToken', regAccessToken);
+
+  await next();
+}
+
+export const post = [
+  noCache,
+  parseBody,
+  setWWWAuthenticate,
+  async function validateInitialAccessToken(ctx, next) {
+    const { oidc: { provider } } = ctx;
+    const { initialAccessToken } = instance(provider).features.registration;
+    switch (initialAccessToken && typeof initialAccessToken) {
+      case 'boolean': {
+        const iat = await provider.InitialAccessToken.find(ctx.oidc.getAccessToken());
+        ctx.assert(iat, new InvalidToken('initial access token not found'));
+        ctx.oidc.entity('InitialAccessToken', iat);
+        break;
+      }
+      case 'string': {
+        const valid = constantEquals(
+          initialAccessToken,
+          ctx.oidc.getAccessToken(),
+          1000,
+        );
+        ctx.assert(valid, new InvalidToken('invalid initial access token value'));
+        break;
+      }
+      default:
+    }
+
+    await next();
+  },
+  async function registrationResponse(ctx) {
+    const { oidc: { provider } } = ctx;
+    const {
+      idFactory, secretFactory, issueRegistrationAccessToken,
+    } = instance(provider).features.registration;
+    const properties = {};
+    const clientId = idFactory(ctx);
+
+    let rat;
+
+    if (
+      issueRegistrationAccessToken === true
+      || (typeof issueRegistrationAccessToken === 'function' && issueRegistrationAccessToken(ctx))
+    ) {
+      rat = new provider.RegistrationAccessToken({ clientId });
+      ctx.oidc.entity('RegistrationAccessToken', rat);
+    }
+
+    Object.assign(properties, ctx.oidc.body, {
+      client_id: clientId,
+      client_id_issued_at: epochTime(),
+    });
+
+    const { Client } = provider;
+    const secretRequired = Client.needsSecret(properties);
+
+    if (secretRequired) {
+      Object.assign(properties, {
+        client_secret: await secretFactory(ctx),
+        client_secret_expires_at: 0,
+      });
+    } else {
+      delete properties.client_secret;
+      delete properties.client_secret_expires_at;
+    }
+
+    if (
+      ctx.oidc.entities.InitialAccessToken?.policies
+    ) {
+      const { policies } = ctx.oidc.entities.InitialAccessToken;
+      const implementations = instance(provider).features.registration.policies;
+      for (const policy of policies) {
+        await implementations[policy](ctx, properties);
+      }
+
+      if (rat && !('policies' in rat)) {
+        rat.policies = policies;
+      }
+    }
+
+    const client = await addClient(provider, properties, { store: true, ctx });
+    ctx.oidc.entity('Client', client);
+
+    ctx.body = client.metadata();
+
+    if (rat) {
+      Object.assign(ctx.body, {
+        registration_client_uri: ctx.oidc.urlFor('client', {
+          clientId: properties.client_id,
+        }),
+        registration_access_token: await rat.save(),
+      });
+    }
+
+    ctx.status = 201;
+
+    provider.emit('registration_create.success', ctx, client);
+  },
+];
+
+export const get = [
+  noCache,
+  setWWWAuthenticate,
+  validateRegistrationAccessToken,
+
+  async function clientReadResponse(ctx) {
+    if (ctx.oidc.client.noManage) {
+      throw new InvalidRequest('client does not have permission to read its record', 403);
+    }
+
+    ctx.body = ctx.oidc.client.metadata();
+
+    Object.assign(ctx.body, {
+      registration_access_token: ctx.oidc.getAccessToken(),
+      registration_client_uri: ctx.oidc.urlFor('client', {
+        clientId: ctx.params.clientId,
+      }),
+    });
+  },
+];
+
+export const put = [
+  noCache,
+  setWWWAuthenticate,
+  validateRegistrationAccessToken,
+  parseBody,
+
+  async function forbiddenFields(ctx, next) {
+    const hit = FORBIDDEN.find((field) => ctx.oidc.body[field] !== undefined);
+    ctx.assert(!hit, new InvalidRequest(`request MUST NOT include the ${hit} field`));
+    await next();
+  },
+
+  async function equalChecks(ctx, next) {
+    ctx.assert(ctx.oidc.body.client_id === ctx.oidc.client.clientId, new InvalidRequest('provided client_id does not match the authenticated client\'s one'));
+
+    if ('client_secret' in ctx.oidc.body) {
+      const clientSecretValid = constantEquals(
+        typeof ctx.oidc.body.client_secret === 'string' ? ctx.oidc.body.client_secret : '',
+        ctx.oidc.client.clientSecret || '',
+        1000,
+      );
+
+      ctx.assert(clientSecretValid, new InvalidRequest('provided client_secret does not match the authenticated client\'s one'));
+    }
+
+    await next();
+  },
+
+  async function clientUpdateResponse(ctx) {
+    if (ctx.oidc.client.noManage) {
+      throw new InvalidRequest('client does not have permission to update its record', 403);
+    }
+
+    const properties = omitBy({
+      client_id: ctx.oidc.client.clientId,
+      client_id_issued_at: ctx.oidc.client.clientIdIssuedAt,
+      ...ctx.oidc.body,
+    }, (value) => value === null || value === '');
+
+    const { oidc: { provider } } = ctx;
+    const { secretFactory } = instance(provider).features.registration;
+
+    const secretRequired = !ctx.oidc.client.clientSecret
+      && provider.Client.needsSecret(properties);
+
+    if (secretRequired) {
+      Object.assign(properties, {
+        client_secret: await secretFactory(ctx),
+        client_secret_expires_at: 0,
+      });
+    } else {
+      Object.assign(properties, {
+        client_secret: ctx.oidc.client.clientSecret,
+        client_secret_expires_at: ctx.oidc.client.clientSecretExpiresAt,
+      });
+    }
+
+    if (ctx.oidc.entities.RegistrationAccessToken.policies) {
+      const { policies } = ctx.oidc.entities.RegistrationAccessToken;
+      const implementations = instance(provider).features.registration.policies;
+      for (const policy of policies) {
+        await implementations[policy](ctx, properties);
+      }
+    }
+
+    const client = await addClient(provider, properties, { store: true, ctx });
+
+    ctx.body = client.metadata();
+
+    Object.assign(ctx.body, {
+      registration_access_token: ctx.oidc.getAccessToken(),
+      registration_client_uri: ctx.oidc.urlFor('client', {
+        clientId: ctx.params.clientId,
+      }),
+    });
+
+    const management = instance(provider).features.registrationManagement;
+    if (
+      management.rotateRegistrationAccessToken === true
+      || (typeof management.rotateRegistrationAccessToken === 'function' && await management.rotateRegistrationAccessToken(ctx))
+    ) {
+      ctx.oidc.entity('RotatedRegistrationAccessToken', ctx.oidc.entities.RegistrationAccessToken);
+      const rat = new provider.RegistrationAccessToken({
+        client: ctx.oidc.client,
+        policies: ctx.oidc.entities.RegistrationAccessToken.policies,
+      });
+
+      await ctx.oidc.registrationAccessToken.destroy();
+
+      ctx.oidc.entity('RegistrationAccessToken', rat);
+      ctx.body.registration_access_token = await rat.save();
+    }
+
+    provider.emit('registration_update.success', ctx, ctx.oidc.client);
+  },
+];
+
+export const del = [
+  noCache,
+  setWWWAuthenticate,
+  validateRegistrationAccessToken,
+
+  async function clientRemoveResponse(ctx) {
+    if (ctx.oidc.client.noManage) {
+      throw new InvalidRequest('client does not have permission to delete its record', 403);
+    }
+
+    const { oidc: { provider } } = ctx;
+
+    await provider.Client.adapter.destroy(ctx.oidc.client.clientId);
+    await ctx.oidc.entities.RegistrationAccessToken.destroy();
+
+    ctx.status = 204;
+
+    provider.emit('registration_delete.success', ctx, ctx.oidc.client);
+  },
+];

package/dist/node_modules/oidc-provider/lib/actions/revocation.js

@@ -0,0 +1,81 @@
+import presence from '../helpers/validate_presence.js';
+import instance from '../helpers/weak_cache.js';
+import getClientAuth from '../shared/client_auth.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
+import rejectDupes from '../shared/reject_dupes.js';
+import paramsMiddleware from '../shared/assemble_params.js';
+import rejectStructuredTokens from '../shared/reject_structured_tokens.js';
+import revoke from '../helpers/revoke.js';
+import { checkAttestBinding } from '../helpers/check_attest_binding.js';
+import { createTokenFinder } from '../helpers/token_find.js';
+
+const revokeable = new Set(['AccessToken', 'ClientCredentials', 'RefreshToken']);
+
+export default function revocationAction(provider) {
+  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
+  const PARAM_LIST = new Set(['token', 'token_type_hint', ...authParams]);
+  const { grantTypeHandlers, configuration } = instance(provider);
+  const {
+    features: {
+      revocation: { allowedPolicy },
+    },
+  } = configuration;
+
+  const findToken = createTokenFinder(provider, grantTypeHandlers);
+
+  return [
+    parseBody,
+    paramsMiddleware.bind(undefined, PARAM_LIST),
+    ...clientAuth,
+    rejectDupes.bind(undefined, {}),
+
+    async function validateTokenPresence(ctx, next) {
+      presence(ctx, 'token');
+      await next();
+    },
+
+    rejectStructuredTokens,
+
+    async function renderTokenResponse(ctx, next) {
+      ctx.status = 200;
+      ctx.body = '';
+      await next();
+    },
+
+    async function revokeToken(ctx) {
+      const { params } = ctx.oidc;
+
+      const token = await findToken(params.token, params.token_type_hint);
+
+      if (!token) return;
+
+      if (revokeable.has(token.kind)) {
+        ctx.oidc.entity(token.kind, token);
+      } else {
+        return;
+      }
+
+      if (
+        token.kind === 'RefreshToken'
+        && ctx.oidc.client.clientId === token.clientId
+        && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
+      ) {
+        try {
+          await checkAttestBinding(ctx, token);
+        } catch {
+          return;
+        }
+      }
+
+      if (!(await allowedPolicy(ctx, ctx.oidc.client, token))) {
+        return;
+      }
+
+      await token.destroy();
+
+      if (token.kind === 'RefreshToken' || token.kind === 'AccessToken') {
+        await revoke(ctx, token.grantId);
+      }
+    },
+  ];
+}

package/dist/node_modules/oidc-provider/lib/actions/token.js

@@ -0,0 +1,74 @@
+import presence from '../helpers/validate_presence.js';
+import instance from '../helpers/weak_cache.js';
+import { UnsupportedGrantType, InvalidRequest } from '../helpers/errors.js';
+import noCache from '../shared/no_cache.js';
+import getClientAuth from '../shared/client_auth.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
+import rejectDupes from '../shared/reject_dupes.js';
+import paramsMiddleware from '../shared/assemble_params.js';
+
+const grantTypeSet = new Set(['grant_type']);
+
+export default function tokenAction(provider) {
+  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
+  const { grantTypeParams } = instance(provider);
+
+  return [
+    noCache,
+    parseBody,
+    paramsMiddleware.bind(undefined, grantTypeParams.get(undefined)),
+    ...clientAuth,
+
+    rejectDupes.bind(undefined, { only: grantTypeSet }),
+
+    async function stripGrantIrrelevantParams(ctx, next) {
+      const grantParams = grantTypeParams.get(ctx.oidc.params.grant_type);
+      if (grantParams) {
+        Object.keys(ctx.oidc.params).forEach((key) => {
+          if (!(authParams.has(key) || grantParams.has(key))) {
+            delete ctx.oidc.params[key];
+          }
+        });
+      }
+      await next();
+    },
+
+    async function supportedGrantTypeCheck(ctx, next) {
+      presence(ctx, 'grant_type');
+
+      const supported = instance(provider).configuration.grantTypes;
+
+      if (!supported.has(ctx.oidc.params.grant_type) || ctx.oidc.params.grant_type === 'implicit') {
+        throw new UnsupportedGrantType();
+      }
+
+      await next();
+    },
+
+    async function allowedGrantTypeCheck(ctx, next) {
+      if (!ctx.oidc.client.grantTypeAllowed(ctx.oidc.params.grant_type)) {
+        throw new InvalidRequest('requested grant type is not allowed for this client');
+      }
+
+      await next();
+    },
+
+    async function rejectDupesOptionalExcept(ctx, next) {
+      const { grantTypeDupes } = instance(provider);
+      const grantType = ctx.oidc.params.grant_type;
+      if (grantTypeDupes.has(grantType)) {
+        return rejectDupes({ except: grantTypeDupes.get(grantType) }, ctx, next);
+      }
+      return rejectDupes({}, ctx, next);
+    },
+
+    async function callTokenHandler(ctx) {
+      const grantType = ctx.oidc.params.grant_type;
+
+      const { grantTypeHandlers } = instance(provider);
+
+      await grantTypeHandlers.get(grantType)(ctx);
+      provider.emit('grant.success', ctx);
+    },
+  ];
+}

package/dist/node_modules/oidc-provider/lib/actions/userinfo.js

@@ -0,0 +1,183 @@
+import difference from '../helpers/_/difference.js';
+import bodyParser from '../shared/conditional_body.js';
+import rejectDupes from '../shared/reject_dupes.js';
+import paramsMiddleware from '../shared/assemble_params.js';
+import noCache from '../shared/no_cache.js';
+import certificateThumbprint from '../helpers/certificate_thumbprint.js';
+import instance from '../helpers/weak_cache.js';
+import filterClaims from '../helpers/filter_claims.js';
+import dpopValidate, { CHALLENGE_OK_WINDOW } from '../helpers/validate_dpop.js';
+import epochTime from '../helpers/epoch_time.js';
+import { InvalidToken, InsufficientScope } from '../helpers/errors.js';
+import getCtxAccountClaims from '../helpers/account_claims.js';
+import getSetWWWAuthenticateHeader from '../shared/set_www_authenticate_header.js';
+
+const PARAM_LIST = new Set([
+  'scope',
+  'access_token',
+]);
+
+const parseBody = bodyParser.bind(undefined, 'application/x-www-form-urlencoded');
+
+export default [
+  noCache,
+
+  getSetWWWAuthenticateHeader(),
+
+  parseBody,
+  paramsMiddleware.bind(undefined, PARAM_LIST),
+  rejectDupes.bind(undefined, {}),
+
+  async function validateAccessToken(ctx, next) {
+    const accessTokenValue = ctx.oidc.getAccessToken({ acceptDPoP: true });
+
+    const dPoP = await dpopValidate(ctx, accessTokenValue);
+
+    const accessToken = await ctx.oidc.provider.AccessToken.find(accessTokenValue);
+
+    ctx.assert(accessToken, new InvalidToken('access token not found'));
+
+    ctx.oidc.entity('AccessToken', accessToken);
+
+    const { scopes } = accessToken;
+    if (!scopes.size || !scopes.has('openid')) {
+      throw new InsufficientScope('access token missing openid scope', 'openid');
+    }
+
+    if (accessToken['x5t#S256']) {
+      const { getCertificate } = instance(ctx.oidc.provider).features.mTLS;
+      const cert = getCertificate(ctx);
+      if (!cert || accessToken['x5t#S256'] !== certificateThumbprint(cert)) {
+        throw new InvalidToken('failed x5t#S256 verification');
+      }
+    }
+
+    if (dPoP) {
+      const { allowReplay } = instance(ctx.oidc.provider).features.dPoP;
+
+      if (!allowReplay) {
+        const unique = await ctx.oidc.provider.ReplayDetection.unique(
+          accessToken.clientId,
+          dPoP.jti,
+          epochTime() + CHALLENGE_OK_WINDOW,
+        );
+
+        ctx.assert(unique, new InvalidToken('DPoP proof JWT Replay detected'));
+      }
+
+      if (!accessToken.jkt) {
+        throw new InvalidToken('access token is not sender-constrained but proof of possession was provided');
+      }
+    }
+
+    if (accessToken.jkt && (!dPoP || accessToken.jkt !== dPoP.thumbprint)) {
+      throw new InvalidToken('failed jkt verification');
+    }
+
+    await next();
+  },
+
+  function validateAudience(ctx, next) {
+    const { oidc: { entities: { AccessToken: accessToken } } } = ctx;
+
+    if (accessToken.aud !== undefined) {
+      throw new InvalidToken('token audience prevents accessing the userinfo endpoint');
+    }
+
+    return next();
+  },
+
+  async function validateScope(ctx, next) {
+    if (ctx.oidc.params.scope) {
+      const missing = difference(ctx.oidc.params.scope.split(' '), [...ctx.oidc.accessToken.scopes]);
+
+      if (missing.length !== 0) {
+        throw new InsufficientScope('access token missing requested scope', missing.join(' '));
+      }
+    }
+    await next();
+  },
+
+  async function loadClient(ctx, next) {
+    const client = await ctx.oidc.provider.Client.find(ctx.oidc.accessToken.clientId);
+    ctx.assert(client, new InvalidToken('associated client not found'));
+
+    ctx.oidc.entity('Client', client);
+
+    await next();
+  },
+
+  async function loadAccount(ctx, next) {
+    const account = await instance(ctx.oidc.provider).configuration.findAccount(
+      ctx,
+      ctx.oidc.accessToken.accountId,
+      ctx.oidc.accessToken,
+    );
+
+    ctx.assert(account, new InvalidToken('associated account not found'));
+    ctx.oidc.entity('Account', account);
+
+    await next();
+  },
+
+  async function loadGrant(ctx, next) {
+    const grant = await ctx.oidc.provider.Grant.find(ctx.oidc.accessToken.grantId, {
+      ignoreExpiration: true,
+    });
+
+    if (!grant) {
+      throw new InvalidToken('grant not found');
+    }
+
+    if (grant.isExpired) {
+      throw new InvalidToken('grant is expired');
+    }
+
+    if (grant.clientId !== ctx.oidc.accessToken.clientId) {
+      throw new InvalidToken('clientId mismatch');
+    }
+
+    if (grant.accountId !== ctx.oidc.accessToken.accountId) {
+      throw new InvalidToken('accountId mismatch');
+    }
+
+    ctx.oidc.entity('Grant', grant);
+
+    await next();
+  },
+
+  async function respond(ctx) {
+    const claims = filterClaims(ctx.oidc.accessToken.claims, 'userinfo', ctx.oidc.grant);
+    const rejected = ctx.oidc.grant.getRejectedOIDCClaims();
+    const scope = ctx.oidc.grant.getOIDCScopeFiltered(new Set((ctx.oidc.params.scope || ctx.oidc.accessToken.scope).split(' ')));
+    const { client } = ctx.oidc;
+
+    if (client.userinfoSignedResponseAlg || client.userinfoEncryptedResponseAlg) {
+      const token = new ctx.oidc.provider.IdToken(
+        await getCtxAccountClaims(ctx, 'userinfo', scope, claims, rejected),
+        { ctx },
+      );
+
+      token.scope = scope;
+      token.mask = claims;
+      token.rejected = rejected;
+
+      ctx.body = await token.issue({
+        expiresAt: ctx.oidc.accessToken.exp,
+        use: 'userinfo',
+      });
+      ctx.type = 'application/jwt; charset=utf-8';
+    } else {
+      const mask = new ctx.oidc.provider.Claims(
+        await getCtxAccountClaims(ctx, 'userinfo', scope, claims, rejected),
+        { ctx },
+      );
+
+      mask.scope(scope);
+      mask.mask(claims);
+      mask.rejected(rejected);
+
+      ctx.body = await mask.result();
+    }
+  },
+];

package/dist/node_modules/oidc-provider/lib/adapters/memory_adapter.js

@@ -0,0 +1,95 @@
+import QuickLRU from 'quick-lru';
+
+import epochTime from '../helpers/epoch_time.js';
+
+let storage = new QuickLRU({ maxSize: 1000 });
+
+function grantKeyFor(id) {
+  return `grant:${id}`;
+}
+
+function sessionUidKeyFor(id) {
+  return `sessionUid:${id}`;
+}
+
+function userCodeKeyFor(userCode) {
+  return `userCode:${userCode}`;
+}
+
+const grantable = new Set([
+  'AccessToken',
+  'AuthorizationCode',
+  'RefreshToken',
+  'DeviceCode',
+  'BackchannelAuthenticationRequest',
+]);
+
+class MemoryAdapter {
+  constructor(model) {
+    this.model = model;
+  }
+
+  key(id) {
+    return `${this.model}:${id}`;
+  }
+
+  async destroy(id) {
+    const key = this.key(id);
+    storage.delete(key);
+  }
+
+  async consume(id) {
+    storage.get(this.key(id)).consumed = epochTime();
+  }
+
+  async find(id) {
+    return storage.get(this.key(id));
+  }
+
+  async findByUid(uid) {
+    const id = storage.get(sessionUidKeyFor(uid));
+    return this.find(id);
+  }
+
+  async findByUserCode(userCode) {
+    const id = storage.get(userCodeKeyFor(userCode));
+    return this.find(id);
+  }
+
+  async upsert(id, payload, expiresIn) {
+    const key = this.key(id);
+
+    if (this.model === 'Session') {
+      storage.set(sessionUidKeyFor(payload.uid), id, expiresIn * 1000);
+    }
+
+    const { grantId, userCode } = payload;
+    if (grantable.has(this.model) && grantId) {
+      const grantKey = grantKeyFor(grantId);
+      const grant = storage.get(grantKey);
+      if (!grant) {
+        storage.set(grantKey, [key]);
+      } else {
+        grant.push(key);
+      }
+    }
+
+    if (userCode) {
+      storage.set(userCodeKeyFor(userCode), id, expiresIn * 1000);
+    }
+
+    storage.set(key, payload, expiresIn * 1000);
+  }
+
+  async revokeByGrantId(grantId) { // eslint-disable-line class-methods-use-this
+    const grantKey = grantKeyFor(grantId);
+    const grant = storage.get(grantKey);
+    if (grant) {
+      grant.forEach((token) => storage.delete(token));
+      storage.delete(grantKey);
+    }
+  }
+}
+
+export default MemoryAdapter;
+export function setStorage(store) { storage = store; }