@nocobase/plugin-idp-oauth 2.1.0-alpha.10

package/dist/node_modules/oidc-provider/lib/consts/client_attributes.js

@@ -0,0 +1,211 @@
+const RECOGNIZED_METADATA = [
+  'application_type',
+  'client_id_issued_at',
+  'client_id',
+  'client_name',
+  'client_secret_expires_at',
+  'client_secret',
+  'client_uri',
+  'contacts',
+  'default_acr_values',
+  'default_max_age',
+  'grant_types',
+  'id_token_signed_response_alg',
+  'initiate_login_uri',
+  'jwks_uri',
+  'jwks',
+  'logo_uri',
+  'policy_uri',
+  'redirect_uris',
+  'require_auth_time',
+  'response_types',
+  'response_modes',
+  'scope',
+  'sector_identifier_uri',
+  'subject_type',
+  'token_endpoint_auth_method',
+  'tos_uri',
+];
+
+const DEFAULTS = {
+  application_type: 'web',
+  authorization_signed_response_alg: 'RS256',
+  backchannel_logout_session_required: false,
+  backchannel_user_code_parameter: false,
+  grant_types: ['authorization_code'],
+  id_token_signed_response_alg: 'RS256',
+  introspection_signed_response_alg: 'RS256',
+  post_logout_redirect_uris: [],
+  require_auth_time: false,
+  require_pushed_authorization_requests: false,
+  require_signed_request_object: false,
+  dpop_bound_access_tokens: false,
+  response_types: ['code'],
+  subject_type: 'public',
+  tls_client_certificate_bound_access_tokens: false,
+  token_endpoint_auth_method: 'client_secret_basic',
+  authorization_details_types: [],
+};
+
+const REQUIRED = [
+  'client_id',
+  // 'client_secret', => validated elsewhere and only needed somewhen
+  // 'redirect_uris', => validated elsewhere and handled elsewhere
+];
+
+const BOOL = [
+  'backchannel_logout_session_required',
+  'backchannel_user_code_parameter',
+  'dpop_bound_access_tokens',
+  'require_auth_time',
+  'require_pushed_authorization_requests',
+  'require_signed_request_object',
+  'tls_client_certificate_bound_access_tokens',
+  'use_mtls_endpoint_aliases',
+];
+
+const ARYS = [
+  'contacts',
+  'default_acr_values',
+  'grant_types',
+  'post_logout_redirect_uris',
+  'redirect_uris',
+  'response_types',
+  'response_modes',
+  'authorization_details_types',
+];
+
+const STRING = [
+  'application_type',
+  'authorization_encrypted_response_alg',
+  'authorization_encrypted_response_enc',
+  'authorization_signed_response_alg',
+  'backchannel_authentication_request_signing_alg',
+  'backchannel_client_notification_endpoint',
+  'backchannel_logout_uri',
+  'backchannel_token_delivery_mode',
+  'client_id',
+  'client_name',
+  'client_secret',
+  'client_uri',
+  'id_token_encrypted_response_alg',
+  'id_token_encrypted_response_enc',
+  'id_token_signed_response_alg',
+  'initiate_login_uri',
+  'introspection_encrypted_response_alg',
+  'introspection_encrypted_response_enc',
+  'introspection_signed_response_alg',
+  'jwks_uri',
+  'logo_uri',
+  'policy_uri',
+  'request_object_encryption_alg',
+  'request_object_encryption_enc',
+  'request_object_signing_alg',
+  'scope',
+  'sector_identifier_uri',
+  'subject_type',
+  'tls_client_auth_san_dns',
+  'tls_client_auth_san_email',
+  'tls_client_auth_san_ip',
+  'tls_client_auth_san_uri',
+  'tls_client_auth_subject_dn',
+  'token_endpoint_auth_method',
+  'tos_uri',
+  'userinfo_encrypted_response_alg',
+  'userinfo_encrypted_response_enc',
+  'userinfo_signed_response_alg',
+
+  // in arrays
+  'contacts',
+  'default_acr_values',
+  'grant_types',
+  'post_logout_redirect_uris',
+  'redirect_uris',
+  'response_types',
+  'response_modes',
+  'authorization_details_types',
+];
+
+const WHEN = {
+  authorization_encrypted_response_enc: ['authorization_encrypted_response_alg', 'A128CBC-HS256'],
+  id_token_encrypted_response_enc: ['id_token_encrypted_response_alg', 'A128CBC-HS256'],
+  introspection_encrypted_response_enc: ['introspection_encrypted_response_alg', 'A128CBC-HS256'],
+  request_object_encryption_enc: ['request_object_encryption_alg', 'A128CBC-HS256'],
+  userinfo_encrypted_response_enc: ['userinfo_encrypted_response_alg', 'A128CBC-HS256'],
+
+  id_token_encrypted_response_alg: ['id_token_signed_response_alg'],
+  userinfo_encrypted_response_alg: ['userinfo_signed_response_alg'],
+  introspection_encrypted_response_alg: ['introspection_signed_response_alg'],
+  authorization_encrypted_response_alg: ['authorization_signed_response_alg'],
+};
+
+const WEB_URI = [
+  'backchannel_client_notification_endpoint',
+  'backchannel_logout_uri',
+  'client_uri',
+  'initiate_login_uri',
+  'jwks_uri',
+  'logo_uri',
+  'policy_uri',
+  'sector_identifier_uri',
+  'tos_uri',
+];
+
+const HTTPS_URI = [
+  'backchannel_client_notification_endpoint',
+  'initiate_login_uri',
+  'sector_identifier_uri',
+];
+
+const LOOPBACKS = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+const ENUM = {
+  application_type: () => ['native', 'web'],
+};
+
+export const noVSCHAR = /[^\x20-\x7E]/;
+// const noNQCHAR = /[^\x21\x23-\x5B\x5D-\x7E]/;
+// const noNQSCHAR = /[^\x20-\x21\x23-\x5B\x5D-\x7E]/;
+
+const SYNTAX = {
+  client_id: noVSCHAR,
+  client_secret: noVSCHAR,
+};
+
+const CHOICES = {
+  authorization_encrypted_response_alg: 'authorization_encryption_alg_values_supported',
+  authorization_encrypted_response_enc: 'authorization_encryption_enc_values_supported',
+  authorization_signed_response_alg: 'authorization_signing_alg_values_supported',
+  backchannel_authentication_request_signing_alg: 'backchannel_authentication_request_signing_alg_values_supported',
+  id_token_encrypted_response_alg: 'id_token_encryption_alg_values_supported',
+  id_token_encrypted_response_enc: 'id_token_encryption_enc_values_supported',
+  id_token_signed_response_alg: 'id_token_signing_alg_values_supported',
+  introspection_encrypted_response_alg: 'introspection_encryption_alg_values_supported',
+  introspection_encrypted_response_enc: 'introspection_encryption_enc_values_supported',
+  introspection_signed_response_alg: 'introspection_signing_alg_values_supported',
+  request_object_encryption_alg: 'request_object_encryption_alg_values_supported',
+  request_object_encryption_enc: 'request_object_encryption_enc_values_supported',
+  request_object_signing_alg: 'request_object_signing_alg_values_supported',
+  subject_type: 'subject_types_supported',
+  token_endpoint_auth_method: 'token_endpoint_auth_methods_supported',
+  token_endpoint_auth_signing_alg: 'token_endpoint_auth_signing_alg_values_supported',
+  userinfo_encrypted_response_alg: 'userinfo_encryption_alg_values_supported',
+  userinfo_encrypted_response_enc: 'userinfo_encryption_enc_values_supported',
+  userinfo_signed_response_alg: 'userinfo_signing_alg_values_supported',
+};
+
+export {
+  ARYS,
+  BOOL,
+  DEFAULTS,
+  ENUM,
+  HTTPS_URI,
+  LOOPBACKS,
+  RECOGNIZED_METADATA,
+  REQUIRED,
+  STRING,
+  SYNTAX,
+  WEB_URI,
+  WHEN,
+  CHOICES,
+};

package/dist/node_modules/oidc-provider/lib/consts/dev_keystore.js

@@ -0,0 +1,18 @@
+export default {
+  keys: [
+    {
+      alg: 'RS256',
+      d: 'VEZOsY07JTFzGTqv6cC2Y32vsfChind2I_TTuvV225_-0zrSej3XLRg8iE_u0-3GSgiGi4WImmTwmEgLo4Qp3uEcxCYbt4NMJC7fwT2i3dfRZjtZ4yJwFl0SIj8TgfQ8ptwZbFZUlcHGXZIr4nL8GXyQT0CK8wy4COfmymHrrUoyfZA154ql_OsoiupSUCRcKVvZj2JHL2KILsq_sh_l7g2dqAN8D7jYfJ58MkqlknBMa2-zi5I0-1JUOwztVNml_zGrp27UbEU60RqV3GHjoqwI6m01U7K0a8Q_SQAKYGqgepbAYOA-P4_TLl5KC4-WWBZu_rVfwgSENwWNEhw8oQ',
+      dp: 'E1Y-SN4bQqX7kP-bNgZ_gEv-pixJ5F_EGocHKfS56jtzRqQdTurrk4jIVpI-ZITA88lWAHxjD-OaoJUh9Jupd_lwD5Si80PyVxOMI2xaGQiF0lbKJfD38Sh8frRpgelZVaK_gm834B6SLfxKdNsP04DsJqGKktODF_fZeaGFPH0',
+      dq: 'F90JPxevQYOlAgEH0TUt1-3_hyxY6cfPRU2HQBaahyWrtCWpaOzenKZnvGFZdg-BuLVKjCchq3G_70OLE-XDP_ol0UTJmDTT-WyuJQdEMpt_WFF9yJGoeIu8yohfeLatU-67ukjghJ0s9CBzNE_LrGEV6Cup3FXywpSYZAV3iqc',
+      e: 'AQAB',
+      kid: 'keystore-CHANGE-ME',
+      kty: 'RSA',
+      n: 'xwQ72P9z9OYshiQ-ntDYaPnnfwG6u9JAdLMZ5o0dmjlcyrvwQRdoFIKPnO65Q8mh6F_LDSxjxa2Yzo_wdjhbPZLjfUJXgCzm54cClXzT5twzo7lzoAfaJlkTsoZc2HFWqmcri0BuzmTFLZx2Q7wYBm0pXHmQKF0V-C1O6NWfd4mfBhbM-I1tHYSpAMgarSm22WDMDx-WWI7TEzy2QhaBVaENW9BKaKkJklocAZCxk18WhR0fckIGiWiSM5FcU1PY2jfGsTmX505Ub7P5Dz75Ygqrutd5tFrcqyPAtPTFDk8X1InxkkUwpP3nFU5o50DGhwQolGYKPGtQ-ZtmbOfcWQ',
+      p: '5wC6nY6Ev5FqcLPCqn9fC6R9KUuBej6NaAVOKW7GXiOJAq2WrileGKfMc9kIny20zW3uWkRLm-O-3Yzze1zFpxmqvsvCxZ5ERVZ6leiNXSu3tez71ZZwp0O9gys4knjrI-9w46l_vFuRtjL6XEeFfHEZFaNJpz-lcnb3w0okrbM',
+      q: '3I1qeEDslZFB8iNfpKAdWtz_Wzm6-jayT_V6aIvhvMj5mnU-Xpj75zLPQSGa9wunMlOoZW9w1wDO1FVuDhwzeOJaTm-Ds0MezeC4U6nVGyyDHb4CUA3ml2tzt4yLrqGYMT7XbADSvuWYADHw79OFjEi4T3s3tJymhaBvy1ulv8M',
+      qi: 'wSbXte9PcPtr788e713KHQ4waE26CzoXx-JNOgN0iqJMN6C4_XJEX-cSvCZDf4rh7xpXN6SGLVd5ibIyDJi7bbi5EQ5AXjazPbLBjRthcGXsIuZ3AtQyR0CEWNSdM7EyM5TRdyZQ9kftfz9nI03guW3iKKASETqX2vh0Z8XRjyU',
+      use: 'sig',
+    },
+  ],
+};

package/dist/node_modules/oidc-provider/lib/consts/index.js

@@ -0,0 +1,13 @@
+import PARAM_LIST from './param_list.js';
+import DEV_KEYSTORE from './dev_keystore.js';
+import * as CLIENT_ATTRIBUTES from './client_attributes.js';
+import * as JWA from './jwa.js';
+
+export const PUSHED_REQUEST_URN = 'urn:ietf:params:oauth:request_uri:';
+
+export {
+  CLIENT_ATTRIBUTES,
+  DEV_KEYSTORE,
+  JWA,
+  PARAM_LIST,
+};

package/dist/node_modules/oidc-provider/lib/consts/jwa.js

@@ -0,0 +1,47 @@
+const signingAlgValues = [
+  'HS256', 'HS384', 'HS512',
+  'RS256', 'RS384', 'RS512',
+  'PS256', 'PS384', 'PS512',
+  'ES256', 'ES384', 'ES512',
+  'Ed25519', 'EdDSA',
+];
+
+const version = globalThis.process?.version?.substring(1).split('.').map((i) => parseInt(i, 10));
+
+if (version[0] > 24 || (version[0] === 24 && version[1] >= 7)) {
+  signingAlgValues.push('ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87');
+}
+
+const encryptionAlgValues = [
+  // asymmetric
+  'RSA-OAEP',
+  'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
+  'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
+  // symmetric
+  'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
+  // direct
+  'dir',
+];
+
+const encryptionEncValues = [
+  'A128CBC-HS256', 'A128GCM', 'A192CBC-HS384', 'A192GCM', 'A256CBC-HS512', 'A256GCM',
+];
+
+export const clientAuthSigningAlgValues = [...signingAlgValues];
+export const idTokenSigningAlgValues = [...signingAlgValues];
+export const requestObjectSigningAlgValues = [...signingAlgValues];
+export const userinfoSigningAlgValues = [...signingAlgValues];
+export const introspectionSigningAlgValues = [...signingAlgValues];
+export const authorizationSigningAlgValues = [...signingAlgValues];
+export const idTokenEncryptionAlgValues = [...encryptionAlgValues];
+export const requestObjectEncryptionAlgValues = [...encryptionAlgValues];
+export const userinfoEncryptionAlgValues = [...encryptionAlgValues];
+export const introspectionEncryptionAlgValues = [...encryptionAlgValues];
+export const authorizationEncryptionAlgValues = [...encryptionAlgValues];
+export const idTokenEncryptionEncValues = [...encryptionEncValues];
+export const requestObjectEncryptionEncValues = [...encryptionEncValues];
+export const userinfoEncryptionEncValues = [...encryptionEncValues];
+export const introspectionEncryptionEncValues = [...encryptionEncValues];
+export const authorizationEncryptionEncValues = [...encryptionEncValues];
+export const dPoPSigningAlgValues = [...signingAlgValues].filter((alg) => !alg.startsWith('HS'));
+export const attestSigningAlgValues = [...signingAlgValues].filter((alg) => !alg.startsWith('HS'));

package/dist/node_modules/oidc-provider/lib/consts/non_rejectable_claims.js

@@ -0,0 +1 @@
+export const NON_REJECTABLE_CLAIMS = new Set(['sub', 'sid', 'auth_time', 'acr', 'amr', 'iss']);

package/dist/node_modules/oidc-provider/lib/consts/param_list.js

@@ -0,0 +1,23 @@
+export default [
+  'acr_values',
+  // 'claims', // added conditionally depending on feature flag
+  'claims_locales',
+  'client_id',
+  'code_challenge',
+  'code_challenge_method',
+  'display',
+  'id_token_hint',
+  'login_hint',
+  'max_age',
+  'nonce',
+  'prompt',
+  'redirect_uri',
+  'registration',
+  'request',
+  'request_uri',
+  'response_mode',
+  'response_type',
+  'scope',
+  'state',
+  'ui_locales',
+];

package/dist/node_modules/oidc-provider/lib/helpers/_/camel_case.js

@@ -0,0 +1 @@
+export default (str = '') => str.replace(/(_\w)/g, (x) => x.replace('_', '').toUpperCase());

package/dist/node_modules/oidc-provider/lib/helpers/_/defaults.js

@@ -0,0 +1,28 @@
+/* eslint-disable no-continue, no-param-reassign */
+
+import isPlainObject from './is_plain_object.js';
+
+function defaults(deep, target, ...sources) {
+  for (const source of sources) {
+    if (!isPlainObject(source)) {
+      continue;
+    }
+    for (const [key, value] of Object.entries(source)) {
+      if (key === '__proto__' || key === 'constructor') {
+        continue;
+      }
+      if (typeof target[key] === 'undefined' && typeof value !== 'undefined') {
+        target[key] = value;
+      }
+
+      if (deep && isPlainObject(target[key]) && isPlainObject(value)) {
+        defaults(true, target[key], value);
+      }
+    }
+  }
+
+  return target;
+}
+
+export default defaults.bind(undefined, false);
+export const deep = defaults.bind(undefined, true);

package/dist/node_modules/oidc-provider/lib/helpers/_/difference.js

@@ -0,0 +1 @@
+export default (array, values) => array.filter((value) => values.indexOf(value) === -1);

package/dist/node_modules/oidc-provider/lib/helpers/_/is_plain_object.js

@@ -0,0 +1 @@
+export default (a) => !!a && a.constructor === Object;

package/dist/node_modules/oidc-provider/lib/helpers/_/map_keys.js

@@ -0,0 +1,9 @@
+export default (object, iteratee) => {
+  const result = {};
+
+  Object.entries(object).forEach(([key, value]) => {
+    result[iteratee(value, key, object)] = value;
+  });
+
+  return result;
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/merge.js

@@ -0,0 +1,25 @@
+/* eslint-disable no-param-reassign, no-continue */
+
+import isPlainObject from './is_plain_object.js';
+
+function merge(target, ...sources) {
+  for (const source of sources) {
+    if (!isPlainObject(source)) {
+      continue;
+    }
+    for (const [key, value] of Object.entries(source)) {
+      if (key === '__proto__' || key === 'constructor') {
+        continue;
+      }
+      if (isPlainObject(target[key]) && isPlainObject(value)) {
+        target[key] = merge(target[key], value);
+      } else if (typeof value !== 'undefined') {
+        target[key] = value;
+      }
+    }
+  }
+
+  return target;
+}
+
+export default merge;

package/dist/node_modules/oidc-provider/lib/helpers/_/omit_by.js

@@ -0,0 +1,11 @@
+/* eslint-disable no-param-reassign */
+
+export default (object, predicate) => {
+  Object.entries(object).forEach(([key, value]) => {
+    if (predicate(value, key)) {
+      delete object[key];
+    }
+  });
+
+  return object;
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/pick.js

@@ -0,0 +1,10 @@
+export default (object = {}, ...properties) => {
+  const result = {};
+  properties.forEach((property) => {
+    if (Object.prototype.hasOwnProperty.call(object, property)) {
+      result[property] = object[property];
+    }
+  });
+
+  return result;
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/pick_by.js

@@ -0,0 +1,10 @@
+export default (object, predicate) => {
+  const result = {};
+  Object.entries(object).forEach(([key, value]) => {
+    if (predicate(value, key)) {
+      result[key] = value;
+    }
+  });
+
+  return result;
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/remove.js

@@ -0,0 +1,9 @@
+export default (array, predicate) => {
+  const remove = [];
+  array.forEach((value, index) => {
+    if (predicate(value, index, array)) {
+      remove.unshift(index);
+    }
+  });
+  remove.forEach((i) => array.splice(i, 1));
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/set.js

@@ -0,0 +1,18 @@
+import isPlainObject from './is_plain_object.js';
+
+export default (object, path, value) => {
+  const properties = path.split('.');
+  if (properties.includes('__proto__') || properties.includes('constructor')) {
+    throw new TypeError('__proto__ and constructor cannot be set');
+  }
+  let current = object;
+  properties.forEach((property, i) => {
+    if (i + 1 === properties.length) {
+      current[property] = value;
+    } else if (!(property in current) || !isPlainObject(current[property])) {
+      current[property] = {};
+    }
+
+    current = current[property];
+  });
+};

package/dist/node_modules/oidc-provider/lib/helpers/_/snake_case.js

@@ -0,0 +1 @@
+export default (str = '') => str.replace(/([A-Z][a-z])/g, (x) => `_${x}`.toLowerCase()).replace(/^_+/, '');

package/dist/node_modules/oidc-provider/lib/helpers/_/upper_first.js

@@ -0,0 +1 @@
+export default (str = '') => `${str.charAt(0).toUpperCase()}${str.slice(1)}`;

package/dist/node_modules/oidc-provider/lib/helpers/account_claims.js

@@ -0,0 +1,6 @@
+export default async function getCtxAccountClaims(ctx, use, scope, claims, rejected) {
+  return {
+    ...await ctx.oidc.account.claims(use, scope, claims, rejected),
+    sub: ctx.oidc.account.accountId,
+  };
+}

package/dist/node_modules/oidc-provider/lib/helpers/add_client.js

@@ -0,0 +1,14 @@
+import sectorValidate from './sector_validate.js';
+
+export default async function add(provider, metadata, { ctx, store = false } = {}) {
+  const client = new provider.Client(metadata, ctx); // eslint-disable-line no-use-before-define
+
+  if (client.sectorIdentifierUri !== undefined) {
+    await sectorValidate(provider, client);
+  }
+
+  if (store) {
+    await provider.Client.adapter.upsert(client.clientId, client.metadata());
+  }
+  return client;
+}

package/dist/node_modules/oidc-provider/lib/helpers/als.js

@@ -0,0 +1,3 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+export default new AsyncLocalStorage();

package/dist/node_modules/oidc-provider/lib/helpers/append_www_authenticate.js

@@ -0,0 +1,9 @@
+import omitBy from './_/omit_by.js';
+
+export default function appendWWWAuthenticate(ctx, scheme, fields) {
+  const parameters = Object.entries(omitBy(fields, (v) => v === undefined))
+    .map(([key, val]) => `${key}="${val.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`)
+    .join(', ');
+
+  ctx.append('WWW-Authenticate', `${scheme} ${parameters}`);
+}

package/dist/node_modules/oidc-provider/lib/helpers/attention.js

@@ -0,0 +1,23 @@
+const SET_BOLD_YELLOW_TEXT = '\x1b[33;1m';
+const SET_BOLD_RED_TEXT = '\x1b[31;1m';
+const RESET_ALL_ATTRIBUTES = '\x1b[0m';
+
+let stdout;
+if (globalThis.process?.stdout?.isTTY) {
+  stdout = (str) => `${SET_BOLD_YELLOW_TEXT}${str}${RESET_ALL_ATTRIBUTES}`;
+}
+
+let stderr;
+if (globalThis.process?.stderr?.isTTY) {
+  stderr = (str) => `${SET_BOLD_RED_TEXT}${str}${RESET_ALL_ATTRIBUTES}`;
+}
+
+export function info(str) {
+  const notice = `oidc-provider NOTICE: ${str}`;
+  console.info(stdout ? stdout(notice) : notice); // eslint-disable-line no-console
+}
+
+export function warn(str) {
+  const warning = `oidc-provider WARNING: ${str}`;
+  console.warn(stderr ? stderr(warning) : warning); // eslint-disable-line no-console
+}

package/dist/node_modules/oidc-provider/lib/helpers/base64url.js

@@ -0,0 +1,11 @@
+export function encode(input, encoding = 'utf8') {
+  return Buffer.from(input, encoding).toString('base64url');
+}
+
+export function encodeBuffer(buf) {
+  return Buffer.prototype.base64urlSlice.call(buf);
+}
+
+export function decode(input) {
+  return Buffer.from(input, 'base64').toString('utf8');
+}

package/dist/node_modules/oidc-provider/lib/helpers/certificate_thumbprint.js

@@ -0,0 +1,15 @@
+import * as crypto from 'node:crypto';
+
+export default function certThumbprint(cert) {
+  let data;
+  if (cert instanceof crypto.X509Certificate) {
+    data = cert.raw;
+  } else {
+    data = Buffer.from(
+      cert.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s|=)/g, ''),
+      'base64',
+    );
+  }
+
+  return crypto.hash('sha256', data, 'base64url');
+}

package/dist/node_modules/oidc-provider/lib/helpers/challenge.js

@@ -0,0 +1,111 @@
+/* eslint-disable no-plusplus, no-bitwise, no-param-reassign */
+
+import { hkdfSync } from 'node:crypto';
+
+import * as base64url from './base64url.js';
+
+function sixfourbeify(value) {
+  const buf = Buffer.alloc(8);
+  for (let i = buf.length - 1; i >= 0; i--) {
+    buf[i] = value & 0xff;
+    value >>= 8;
+  }
+
+  return buf;
+}
+
+function compute(secret, info, step) {
+  return base64url.encodeBuffer(
+    Buffer.from(
+      hkdfSync('sha256', secret, sixfourbeify(step), info, 32),
+    ),
+  );
+}
+
+function compare(server, client) {
+  let result = 0;
+
+  if (server.length !== client.length) {
+    result = 1;
+    client = server;
+  }
+
+  for (let i = 0; i < server.length; i++) {
+    result |= server.charCodeAt(i) ^ client.charCodeAt(i);
+  }
+
+  return result;
+}
+
+const STEP = 60;
+export const CHALLENGE_OK_WINDOW = STEP * 5;
+
+export default class ServerChallenge {
+  #counter;
+
+  #info;
+
+  #secret;
+
+  #prevprev;
+
+  #prev;
+
+  #now;
+
+  #next;
+
+  #nextnext;
+
+  constructor(secret, info) {
+    if (!Buffer.isBuffer(secret) || secret.byteLength !== 32) {
+      throw new TypeError('Challenge secret must be a 32-byte Buffer instance');
+    }
+
+    if (typeof info !== 'string' || !info.length) {
+      throw new TypeError('Challenge info must be a non-empty string');
+    }
+
+    this.#info = info;
+    this.#secret = Uint8Array.prototype.slice.call(secret);
+    this.#counter = Math.floor(Date.now() / 1000 / STEP);
+
+    [this.#prevprev, this.#prev, this.#now, this.#next, this.#nextnext] = [
+      this.#counter - 2,
+      this.#counter - 1,
+      this.#counter,
+      this.#counter + 1,
+      this.#counter++ + 2,
+    ].map(compute.bind(undefined, this.#secret, this.#info));
+
+    setInterval(() => {
+      [
+        this.#prevprev,
+        this.#prev,
+        this.#now,
+        this.#next,
+        this.#nextnext,
+      ] = [
+        this.#prev,
+        this.#now,
+        this.#next,
+        this.#nextnext,
+        compute(this.#secret, this.#info, this.#counter++ + 2),
+      ];
+    }, STEP * 1000).unref();
+  }
+
+  nextChallenge() {
+    return this.#next;
+  }
+
+  checkChallenge(challenge) {
+    let result = 0;
+
+    for (const server of [this.#prevprev, this.#prev, this.#now, this.#next, this.#nextnext]) {
+      result ^= compare(server, challenge);
+    }
+
+    return result === 0;
+  }
+}