@nocobase/plugin-idp-oauth 2.1.0-alpha.10

package/dist/node_modules/oidc-provider/lib/helpers/check_attest_binding.js

@@ -0,0 +1,10 @@
+import * as jose from 'jose';
+
+import { InvalidGrant } from './errors.js';
+
+export async function checkAttestBinding(ctx, model) {
+  const { cnf: { jwk } } = jose.decodeJwt(ctx.get('oauth-client-attestation'));
+  if (model.attestationJkt !== await jose.calculateJwkThumbprint(jwk)) {
+    throw new InvalidGrant('oauth-client-attestation instance public key mismatch');
+  }
+}

package/dist/node_modules/oidc-provider/lib/helpers/claims.js

@@ -0,0 +1,79 @@
+import instance from './weak_cache.js';
+import pick from './_/pick.js';
+import merge from './_/merge.js';
+import isPlainObject from './_/is_plain_object.js';
+
+export default function getClaims(provider) {
+  const {
+    claims: claimConfig, claimsSupported, pairwiseIdentifier,
+  } = instance(provider).configuration;
+
+  return class Claims {
+    constructor(available, { ctx, client = ctx ? ctx.oidc.client : undefined }) {
+      if (!isPlainObject(available)) {
+        throw new TypeError('expected claims to be an object, are you sure claims() method resolves with or returns one?');
+      }
+      if (!(client instanceof provider.Client)) {
+        throw new TypeError('second argument must be a Client instance');
+      }
+      this.available = available;
+      this.client = client;
+      this.ctx = ctx;
+      this.filter = {};
+    }
+
+    scope(value = '') {
+      if (Object.keys(this.filter).length) {
+        throw new Error('scope cannot be assigned after mask has been set');
+      }
+      value.split(' ').forEach((scope) => {
+        this.mask(claimConfig[scope]);
+      });
+      return this;
+    }
+
+    mask(value) {
+      merge(this.filter, value);
+    }
+
+    rejected(value = []) {
+      value.forEach((claim) => {
+        delete this.filter[claim];
+      });
+    }
+
+    async result() {
+      const { available } = this;
+      const include = Object.entries(this.filter)
+        .map(([key, value]) => {
+          if (value === null || isPlainObject(value)) {
+            return key;
+          }
+
+          return undefined;
+        })
+        .filter((key) => key && claimsSupported.has(key));
+
+      const claims = pick(available, ...include);
+
+      if (available._claim_names && available._claim_sources) {
+        claims._claim_names = pick(available._claim_names, ...include);
+        claims._claim_sources = pick(
+          available._claim_sources,
+          ...Object.values(claims._claim_names),
+        );
+
+        if (!Object.keys(claims._claim_names).length) {
+          delete claims._claim_names;
+          delete claims._claim_sources;
+        }
+      }
+
+      if (this.client.subjectType === 'pairwise' && claims.sub) {
+        claims.sub = await pairwiseIdentifier(this.ctx, claims.sub, this.client);
+      }
+
+      return claims;
+    }
+  };
+}

package/dist/node_modules/oidc-provider/lib/helpers/client_id_metadata_document.js

@@ -0,0 +1,198 @@
+import { WEB_URI } from '../consts/client_attributes.js';
+
+import instance from './weak_cache.js';
+import addClient from './add_client.js';
+import als from './als.js';
+import { InvalidClient, InvalidClientMetadata } from './errors.js';
+import fetchBodyCheck from './fetch_body_check.js';
+import fetchRequest from './fetch_request.js';
+
+const FORBIDDEN_AUTH_METHODS = new Set([
+  'client_secret_basic',
+  'client_secret_post',
+  'client_secret_jwt',
+]);
+
+const cache = new WeakMap();
+
+function getCache(provider) {
+  let entries = cache.get(provider);
+  if (!entries) {
+    entries = new Map();
+    cache.set(provider, entries);
+  }
+  return entries;
+}
+
+export function isValidClientIdUrl(id) {
+  const url = URL.parse(id);
+
+  if (!url) {
+    return false;
+  }
+
+  // MUST have an "https" scheme
+  if (url.protocol !== 'https:') {
+    return false;
+  }
+
+  // MUST contain a path component (not just "/")
+  if (!url.pathname || url.pathname === '/') {
+    return false;
+  }
+
+  // MUST NOT contain single-dot or double-dot path segments
+  // URL.parse normalizes dot segments, so check the raw input
+  const rawPath = id.replace(/^https:\/\/[^/]*/i, '').split('?')[0].split('#')[0];
+  const rawSegments = rawPath.split('/');
+  if (rawSegments.some((seg) => seg === '.' || seg === '..')) {
+    return false;
+  }
+
+  // MUST NOT contain a fragment component
+  if (url.hash) {
+    return false;
+  }
+
+  // MUST NOT contain a username or password
+  if (url.username || url.password) {
+    return false;
+  }
+
+  return true;
+}
+
+function parseCacheDuration(response, { min, max }) {
+  let duration;
+
+  const cacheControl = response.headers.get('cache-control');
+  if (cacheControl) {
+    const maxAgeMatch = cacheControl.match(/(?:^|,)\s*max-age\s*=\s*(\d+)/i);
+    if (maxAgeMatch) {
+      duration = parseInt(maxAgeMatch[1], 10);
+    }
+  }
+
+  if (duration === undefined) {
+    const expires = response.headers.get('expires');
+    if (expires) {
+      const expiresDate = Date.parse(expires);
+      if (!Number.isNaN(expiresDate)) {
+        duration = Math.floor((expiresDate - Date.now()) / 1000);
+      }
+    }
+  }
+
+  if (duration === undefined) {
+    duration = min;
+  }
+
+  return Math.max(min, Math.min(max, duration));
+}
+
+export async function resolveClientByMetadataDocument(provider, id) {
+  const {
+    features: { clientIdMetadataDocument: feature },
+  } = instance(provider).configuration;
+
+  const ctx = als.getStore();
+
+  const entries = getCache(provider);
+
+  // Check cache
+  const cached = entries.get(id);
+  if (cached && cached.freshUntil > Date.now()) {
+    const client = await addClient(provider, cached.properties, { store: false });
+    Object.defineProperty(client, 'clientIdMetadataDocument', { value: true });
+
+    if (!(await feature.allowClient(ctx, client))) {
+      throw new InvalidClient('client is not allowed');
+    }
+
+    return client;
+  }
+
+  // Gate the fetch
+  if (!(await feature.allowFetch(ctx, id))) {
+    throw new InvalidClient('client_id metadata document fetch not allowed');
+  }
+
+  let response;
+  try {
+    response = await fetchRequest(provider, id, {
+      method: 'GET',
+      headers: {
+        accept: 'application/json',
+      },
+      redirect: 'manual',
+    });
+  } catch (err) {
+    throw new InvalidClient('client_id metadata document fetch failed', err.message);
+  }
+
+  if (response.status !== 200) {
+    throw new InvalidClient('client_id metadata document fetch failed', `unexpected response status ${response.status}`);
+  }
+
+  let bodyText;
+  try {
+    bodyText = (await fetchBodyCheck(provider, 'client_id metadata document', response)).toString();
+  } catch (err) {
+    throw new InvalidClient('client_id metadata document fetch failed', err.message);
+  }
+
+  let properties;
+  try {
+    properties = JSON.parse(bodyText);
+  } catch {
+    throw new InvalidClient('client_id metadata document fetch failed', 'invalid JSON');
+  }
+
+  if (typeof properties !== 'object' || properties === null || Array.isArray(properties)) {
+    throw new InvalidClientMetadata('client_id metadata document is not a JSON object');
+  }
+
+  // client_id property MUST match the URL via simple string comparison
+  if (properties.client_id !== id) {
+    throw new InvalidClientMetadata('client_id metadata document client_id does not match the expected value');
+  }
+
+  // token_endpoint_auth_method MUST NOT be a shared-secret method
+  if (FORBIDDEN_AUTH_METHODS.has(properties.token_endpoint_auth_method)) {
+    throw new InvalidClientMetadata('client_id metadata document must not use shared-secret token endpoint authentication methods');
+  }
+
+  // client_secret and client_secret_expires_at MUST NOT be present
+  if ('client_secret' in properties || 'client_secret_expires_at' in properties) {
+    throw new InvalidClientMetadata('client_id metadata document must not contain client_secret or client_secret_expires_at');
+  }
+
+  // URI properties MUST be absolute URIs using the https: scheme
+  for (const prop of WEB_URI) {
+    if (prop in properties) {
+      const uri = URL.parse(properties[prop]);
+      if (!uri || uri.protocol !== 'https:') {
+        throw new InvalidClientMetadata(`client_id metadata document ${prop} must be an https: URL`);
+      }
+    }
+  }
+
+  // Compute cache TTL
+  const ttl = parseCacheDuration(response, feature.cacheDuration);
+
+  const client = await addClient(provider, properties, { store: false });
+
+  Object.defineProperty(client, 'clientIdMetadataDocument', { value: true });
+
+  // Cache the valid properties
+  entries.set(id, {
+    properties,
+    freshUntil: Date.now() + (ttl * 1000),
+  });
+
+  if (!(await feature.allowClient(ctx, client))) {
+    throw new InvalidClient('client is not allowed');
+  }
+
+  return client;
+}