@nocobase/plugin-idp-oauth 2.1.0-alpha.16 → 2.1.0-alpha.18

package/dist/node_modules/undici/types/webidl.d.ts

@@ -0,0 +1,347 @@
+// These types are not exported, and are only used internally
+import { BufferSource } from 'node:stream/web'
+import * as undici from './index'
+
+/**
+ * Take in an unknown value and return one that is of type T
+ */
+type Converter<T> = (object: unknown) => T
+
+type SequenceConverter<T> = (object: unknown, iterable?: IterableIterator<T>) => T[]
+
+type RecordConverter<K extends string, V> = (object: unknown) => Record<K, V>
+
+interface WebidlErrors {
+  /**
+   * @description Instantiate an error
+   */
+  exception (opts: { header: string, message: string }): TypeError
+  /**
+   * @description Instantiate an error when conversion from one type to another has failed
+   */
+  conversionFailed (opts: {
+    prefix: string
+    argument: string
+    types: string[]
+  }): TypeError
+  /**
+   * @description Throw an error when an invalid argument is provided
+   */
+  invalidArgument (opts: {
+    prefix: string
+    value: string
+    type: string
+  }): TypeError
+}
+
+interface WebIDLTypes {
+  UNDEFINED: 1,
+  BOOLEAN: 2,
+  STRING: 3,
+  SYMBOL: 4,
+  NUMBER: 5,
+  BIGINT: 6,
+  NULL: 7
+  OBJECT: 8
+}
+
+interface WebidlUtil {
+  /**
+   * @see https://tc39.es/ecma262/#sec-ecmascript-data-types-and-values
+   */
+  Type (object: unknown): WebIDLTypes[keyof WebIDLTypes]
+
+  TypeValueToString (o: unknown):
+    | 'Undefined'
+    | 'Boolean'
+    | 'String'
+    | 'Symbol'
+    | 'Number'
+    | 'BigInt'
+    | 'Null'
+    | 'Object'
+
+  Types: WebIDLTypes
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#abstract-opdef-converttoint
+   */
+  ConvertToInt (
+    V: unknown,
+    bitLength: number,
+    signedness: 'signed' | 'unsigned',
+    flags?: number
+  ): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#abstract-opdef-integerpart
+   */
+  IntegerPart (N: number): number
+
+  /**
+   * Stringifies {@param V}
+   */
+  Stringify (V: any): string
+
+  MakeTypeAssertion <I>(I: I): (arg: any) => arg is I
+
+  /**
+   * Mark a value as uncloneable for Node.js.
+   * This is only effective in some newer Node.js versions.
+   */
+  markAsUncloneable (V: any): void
+
+  IsResizableArrayBuffer (V: ArrayBufferLike): boolean
+
+  HasFlag (flag: number, attributes: number): boolean
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#dfn-get-buffer-source-copy
+   */
+  getCopyOfBytesHeldByBufferSource (bufferSource: BufferSource): Uint8Array
+}
+
+interface WebidlConverters {
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-DOMString
+   */
+  DOMString (V: unknown, prefix: string, argument: string, flags?: number): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-ByteString
+   */
+  ByteString (V: unknown, prefix: string, argument: string): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-USVString
+   */
+  USVString (V: unknown): string
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-boolean
+   */
+  boolean (V: unknown): boolean
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-any
+   */
+  any <Value>(V: Value): Value
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-long-long
+   */
+  ['long long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-long-long
+   */
+  ['unsigned long long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-long
+   */
+  ['unsigned long'] (V: unknown): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-unsigned-short
+   */
+  ['unsigned short'] (V: unknown, flags?: number): number
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#idl-ArrayBuffer
+   */
+  ArrayBuffer (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    options?: { allowResizable: boolean }
+  ): ArrayBuffer
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#idl-SharedArrayBuffer
+   */
+  SharedArrayBuffer (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    options?: { allowResizable: boolean }
+  ): SharedArrayBuffer
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-buffer-source-types
+   */
+  TypedArray (
+    V: unknown,
+    T: new () => NodeJS.TypedArray,
+    prefix: string,
+    argument: string,
+    flags?: number
+  ): NodeJS.TypedArray
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-buffer-source-types
+   */
+  DataView (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    flags?: number
+  ): DataView
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-buffer-source-types
+   */
+  ArrayBufferView (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    flags?: number
+  ): NodeJS.ArrayBufferView
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#BufferSource
+   */
+  BufferSource (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    flags?: number
+  ): ArrayBuffer | NodeJS.ArrayBufferView
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#AllowSharedBufferSource
+   */
+  AllowSharedBufferSource (
+    V: unknown,
+    prefix: string,
+    argument: string,
+    flags?: number
+  ): ArrayBuffer | SharedArrayBuffer | NodeJS.ArrayBufferView
+
+  ['sequence<ByteString>']: SequenceConverter<string>
+
+  ['sequence<sequence<ByteString>>']: SequenceConverter<string[]>
+
+  ['record<ByteString, ByteString>']: RecordConverter<string, string>
+
+  /**
+  * @see https://fetch.spec.whatwg.org/#requestinfo
+  */
+  RequestInfo (V: unknown): undici.Request | string
+
+  /**
+   * @see https://fetch.spec.whatwg.org/#requestinit
+   */
+  RequestInit (V: unknown): undici.RequestInit
+
+  /**
+   * @see https://html.spec.whatwg.org/multipage/webappapis.html#eventhandlernonnull
+   */
+  EventHandlerNonNull (V: unknown): Function | null
+
+  WebSocketStreamWrite (V: unknown): ArrayBuffer | NodeJS.TypedArray | string
+
+  [Key: string]: (...args: any[]) => unknown
+}
+
+type WebidlIsFunction<T> = (arg: any) => arg is T
+
+interface WebidlIs {
+  Request: WebidlIsFunction<undici.Request>
+  Response: WebidlIsFunction<undici.Response>
+  ReadableStream: WebidlIsFunction<ReadableStream>
+  Blob: WebidlIsFunction<Blob>
+  URLSearchParams: WebidlIsFunction<URLSearchParams>
+  File: WebidlIsFunction<File>
+  FormData: WebidlIsFunction<undici.FormData>
+  URL: WebidlIsFunction<URL>
+  WebSocketError: WebidlIsFunction<undici.WebSocketError>
+  AbortSignal: WebidlIsFunction<AbortSignal>
+  MessagePort: WebidlIsFunction<MessagePort>
+  USVString: WebidlIsFunction<string>
+  /**
+   * @see https://webidl.spec.whatwg.org/#BufferSource
+   */
+  BufferSource: WebidlIsFunction<ArrayBuffer | NodeJS.TypedArray>
+}
+
+export interface Webidl {
+  errors: WebidlErrors
+  util: WebidlUtil
+  converters: WebidlConverters
+  is: WebidlIs
+  attributes: WebIDLExtendedAttributes
+
+  /**
+   * @description Performs a brand-check on {@param V} to ensure it is a
+   * {@param cls} object.
+   */
+  brandCheck <Interface extends new () => unknown>(V: unknown, cls: Interface): asserts V is Interface
+
+  brandCheckMultiple <Interfaces extends (new () => unknown)[]> (list: Interfaces): (V: any) => asserts V is Interfaces[number]
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-sequence
+   * @description Convert a value, V, to a WebIDL sequence type.
+   */
+  sequenceConverter <Type>(C: Converter<Type>): SequenceConverter<Type>
+
+  illegalConstructor (): never
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#es-to-record
+   * @description Convert a value, V, to a WebIDL record type.
+   */
+  recordConverter <K extends string, V>(
+    keyConverter: Converter<K>,
+    valueConverter: Converter<V>
+  ): RecordConverter<K, V>
+
+  /**
+   * Similar to {@link Webidl.brandCheck} but allows skipping the check if third party
+   * interfaces are allowed.
+   */
+  interfaceConverter <Interface>(typeCheck: WebidlIsFunction<Interface>, name: string): (
+    V: unknown,
+    prefix: string,
+    argument: string
+  ) => asserts V is Interface
+
+  // TODO(@KhafraDev): a type could likely be implemented that can infer the return type
+  // from the converters given?
+  /**
+   * Converts a value, V, to a WebIDL dictionary types. Allows limiting which keys are
+   * allowed, values allowed, optional and required keys. Auto converts the value to
+   * a type given a converter.
+   */
+  dictionaryConverter (converters: {
+    key: string,
+    defaultValue?: () => unknown,
+    required?: boolean,
+    converter: (...args: unknown[]) => unknown,
+    allowedValues?: unknown[]
+  }[]): (V: unknown) => Record<string, unknown>
+
+  /**
+   * @see https://webidl.spec.whatwg.org/#idl-nullable-type
+   * @description allows a type, V, to be null
+   */
+  nullableConverter <T>(
+    converter: Converter<T>
+  ): (V: unknown) => ReturnType<typeof converter> | null
+
+  argumentLengthCheck (args: { length: number }, min: number, context: string): void
+}
+
+interface WebIDLExtendedAttributes {
+  /** https://webidl.spec.whatwg.org/#Clamp */
+  Clamp: number
+  /** https://webidl.spec.whatwg.org/#EnforceRange */
+  EnforceRange: number
+  /** https://webidl.spec.whatwg.org/#AllowShared */
+  AllowShared: number
+  /** https://webidl.spec.whatwg.org/#AllowResizable */
+  AllowResizable: number
+  /** https://webidl.spec.whatwg.org/#LegacyNullToEmptyString */
+  LegacyNullToEmptyString: number
+}

package/dist/node_modules/undici/types/websocket.d.ts

@@ -0,0 +1,188 @@
+/// <reference types="node" />
+
+import type { Blob } from 'node:buffer'
+import type { ReadableStream, WritableStream } from 'node:stream/web'
+import type { MessagePort } from 'node:worker_threads'
+import {
+  EventInit,
+  EventListenerOptions,
+  AddEventListenerOptions,
+  EventListenerOrEventListenerObject
+} from './patch'
+import Dispatcher from './dispatcher'
+import { HeadersInit } from './fetch'
+
+export type BinaryType = 'blob' | 'arraybuffer'
+
+interface WebSocketEventMap {
+  close: CloseEvent
+  error: ErrorEvent
+  message: MessageEvent
+  open: Event
+}
+
+interface WebSocket extends EventTarget {
+  binaryType: BinaryType
+
+  readonly bufferedAmount: number
+  readonly extensions: string
+
+  onclose: ((this: WebSocket, ev: WebSocketEventMap['close']) => any) | null
+  onerror: ((this: WebSocket, ev: WebSocketEventMap['error']) => any) | null
+  onmessage: ((this: WebSocket, ev: WebSocketEventMap['message']) => any) | null
+  onopen: ((this: WebSocket, ev: WebSocketEventMap['open']) => any) | null
+
+  readonly protocol: string
+  readonly readyState: number
+  readonly url: string
+
+  close(code?: number, reason?: string): void
+  send(data: string | ArrayBufferLike | Blob | ArrayBufferView): void
+
+  readonly CLOSED: number
+  readonly CLOSING: number
+  readonly CONNECTING: number
+  readonly OPEN: number
+
+  addEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | AddEventListenerOptions
+  ): void
+  addEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    options?: boolean | AddEventListenerOptions
+  ): void
+  removeEventListener<K extends keyof WebSocketEventMap>(
+    type: K,
+    listener: (this: WebSocket, ev: WebSocketEventMap[K]) => any,
+    options?: boolean | EventListenerOptions
+  ): void
+  removeEventListener(
+    type: string,
+    listener: EventListenerOrEventListenerObject,
+    options?: boolean | EventListenerOptions
+  ): void
+}
+
+export declare const WebSocket: {
+  prototype: WebSocket
+  new (url: string | URL, protocols?: string | string[] | WebSocketInit): WebSocket
+  readonly CLOSED: number
+  readonly CLOSING: number
+  readonly CONNECTING: number
+  readonly OPEN: number
+}
+
+interface CloseEventInit extends EventInit {
+  code?: number
+  reason?: string
+  wasClean?: boolean
+}
+
+interface CloseEvent extends Event {
+  readonly code: number
+  readonly reason: string
+  readonly wasClean: boolean
+}
+
+export declare const CloseEvent: {
+  prototype: CloseEvent
+  new (type: string, eventInitDict?: CloseEventInit): CloseEvent
+}
+
+interface MessageEventInit<T = any> extends EventInit {
+  data?: T
+  lastEventId?: string
+  origin?: string
+  ports?: MessagePort[]
+  source?: MessagePort | null
+}
+
+interface MessageEvent<T = any> extends Event {
+  readonly data: T
+  readonly lastEventId: string
+  readonly origin: string
+  readonly ports: readonly MessagePort[]
+  readonly source: MessagePort | null
+  initMessageEvent(
+    type: string,
+    bubbles?: boolean,
+    cancelable?: boolean,
+    data?: any,
+    origin?: string,
+    lastEventId?: string,
+    source?: MessagePort | null,
+    ports?: MessagePort[]
+  ): void;
+}
+
+export declare const MessageEvent: {
+  prototype: MessageEvent
+  new<T>(type: string, eventInitDict?: MessageEventInit<T>): MessageEvent<T>
+}
+
+interface ErrorEventInit extends EventInit {
+  message?: string
+  filename?: string
+  lineno?: number
+  colno?: number
+  error?: any
+}
+
+interface ErrorEvent extends Event {
+  readonly message: string
+  readonly filename: string
+  readonly lineno: number
+  readonly colno: number
+  readonly error: Error
+}
+
+export declare const ErrorEvent: {
+  prototype: ErrorEvent
+  new (type: string, eventInitDict?: ErrorEventInit): ErrorEvent
+}
+
+interface WebSocketInit {
+  protocols?: string | string[],
+  dispatcher?: Dispatcher,
+  headers?: HeadersInit
+}
+
+interface WebSocketStreamOptions {
+  protocols?: string | string[]
+  signal?: AbortSignal
+}
+
+interface WebSocketCloseInfo {
+  closeCode: number
+  reason: string
+}
+
+interface WebSocketStream {
+  closed: Promise<WebSocketCloseInfo>
+  opened: Promise<{
+    extensions: string
+    protocol: string
+    readable: ReadableStream
+    writable: WritableStream
+  }>
+  url: string
+
+  close(options?: Partial<WebSocketCloseInfo>): void
+}
+
+export declare const WebSocketStream: {
+  prototype: WebSocketStream
+  new (url: string | URL, options?: WebSocketStreamOptions): WebSocketStream
+}
+
+interface WebSocketError extends Event, WebSocketCloseInfo {}
+
+export declare const WebSocketError: {
+  prototype: WebSocketError
+  new (type: string, init?: WebSocketCloseInfo): WebSocketError
+}
+
+export declare const ping: (ws: WebSocket, body?: Buffer) => void

package/dist/server/plugin.d.ts

@@ -10,6 +10,7 @@ import { Plugin } from '@nocobase/server';
 import { IdpOauthService } from './service';
 export declare class PluginIdpOauthServer extends Plugin {
     service: IdpOauthService;
+    private registerDefaultApiResource;
     load(): Promise<void>;
     remove(): Promise<void>;
 }

package/dist/server/plugin.js

@@ -38,6 +38,16 @@ var import_service = require("./service");
 var import_utils = require("./utils");
 class PluginIdpOauthServer extends import_server.Plugin {
   service;
+  registerDefaultApiResource() {
+    this.service.registerResourceServer("api", {
+      path: "/",
+      scope: "api",
+      accessTokenFormat: "jwt",
+      jwt: {
+        sign: { alg: "RS256" }
+      }
+    });
+  }
   async load() {
     const bridgeTokenCache = await this.app.cacheManager.createCache({
       name: "idp-oauth-token",
@@ -45,6 +55,7 @@ class PluginIdpOauthServer extends import_server.Plugin {
       store: "memory"
     });
     this.service = new import_service.IdpOauthService(this.app, bridgeTokenCache);
+    this.registerDefaultApiResource();
     const paths = (0, import_paths.createIdpOauthPaths)();
     this.app.use(
       async (ctx, next) => {
@@ -99,6 +110,8 @@ class PluginIdpOauthServer extends import_server.Plugin {
     );
   }
   async remove() {
+    var _a, _b;
+    (_b = (_a = this.service) == null ? void 0 : _a.unregisterResourceServer) == null ? void 0 : _b.call(_a, "api");
   }
 }
 var plugin_default = PluginIdpOauthServer;

package/dist/server/service.js

@@ -62,6 +62,7 @@ function getJoseModule() {
 }
 const defaultSupportedScopes = ["openid", "offline_access", "profile", "email"];
 const envJwksKeys = ["IDP_OAUTH_JWKS", "OAUTH_JWKS"];
+const MAX_CACHE_TTL_MS = 2147483647;
 class IdpOauthService {
   constructor(app, bridgeTokenCache) {
     this.app = app;
@@ -214,9 +215,16 @@ class IdpOauthService {
     return `${(0, import_utils.normalizeBasePath)(process.env.API_BASE_PATH || "/api")}${normalizedPath}`;
   }
   getRequestResourceConfig(ctx) {
+    const requestPath = (0, import_utils.normalizeBasePath)(ctx.path || this.getRequestPath(ctx) || "/");
     for (const config of this.resourceServers.values()) {
-      const requestPath = this.getResourcePath(config);
-      if (requestPath && ctx.path === requestPath) {
+      const resourcePath = this.getResourcePath(config);
+      if (!resourcePath) {
+        continue;
+      }
+      const normalizedResourcePath = (0, import_utils.normalizeBasePath)(resourcePath);
+      const isRootResource = normalizedResourcePath === (0, import_utils.normalizeBasePath)(`${this.getApiBasePath()}/`);
+      const matches = requestPath === normalizedResourcePath || requestPath.startsWith(`${normalizedResourcePath}/`) || isRootResource && requestPath.startsWith(`${this.getApiBasePath()}/`);
+      if (matches) {
         return config;
       }
     }
@@ -432,7 +440,7 @@ class IdpOauthService {
     const cachedInternalToken = await this.bridgeTokenCache.get(bridgeTokenCacheKey);
     const internalToken = cachedInternalToken || await this.issueInternalToken(user.id, oauthExpiresInMs);
     if (!cachedInternalToken && typeof oauthExpiresInMs === "number" && oauthExpiresInMs > 0) {
-      await this.bridgeTokenCache.set(bridgeTokenCacheKey, internalToken, oauthExpiresInMs);
+      await this.bridgeTokenCache.set(bridgeTokenCacheKey, internalToken, Math.min(oauthExpiresInMs, MAX_CACHE_TTL_MS));
     }
     const authorizationHeader = `Bearer ${internalToken}`;
     ctx.req.headers.authorization = authorizationHeader;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-idp-oauth",
-  "version": "2.1.0-alpha.16",
+  "version": "2.1.0-alpha.18",
   "main": "dist/server/index.js",
   "displayName": "IdP: OAuth",
   "displayName.zh-CN": "IdP: OAuth",
@@ -20,5 +20,5 @@
   "keywords": [
     "Authentication"
   ],
-  "gitHead": "14cf3dbdb9f0a9669602de4ad21a9464fa27c105"
+  "gitHead": "e75843d4c557117bbcced047b88ed11d601ff86d"
 }