@nocobase/plugin-idp-oauth 2.2.16 → 2.2.18

package/dist/node_modules/oidc-provider/lib/helpers/grant_common.js

@@ -1,64 +1,32 @@
 import upperFirst from './_/upper_first.js';
 import camelCase from './_/camel_case.js';
 import * as errors from './errors.js';
-import { CHALLENGE_OK_WINDOW } from './validate_dpop.js';
-import epochTime from './epoch_time.js';
+import { checkDpopReplay } from './validate_dpop.js';
 import filterClaims from './filter_claims.js';
-import resolveResource from './resolve_resource.js';
 import getCtxAccountClaims from './account_claims.js';
-import { setRefreshTokenBindings } from './set_rt_bindings.js';
+import instance from './weak_cache.js';
+import assertProviderContext from './assert_provider_context.js';
+import { findAccount } from './grant_source.js';
+import {
+  applyRefreshTokenBindings,
+  shouldIssueRefreshToken,
+} from './grant_refresh_token.js';
 
 const { InvalidGrant } = errors;
+const errorMap = { ...errors };
 
 export function throwIfAsyncGrantError(entity) {
   if (entity.error) {
     const className = upperFirst(camelCase(entity.error));
-    if (errors[className]) {
-      throw new errors[className](entity.errorDescription);
+    if (errorMap[className]) {
+      throw new errorMap[className](entity.errorDescription);
     }
     throw new errors.CustomOIDCProviderError(entity.error, entity.errorDescription);
   }
 }
 
-export function checkMtlsCert(ctx, getCertificate) {
-  if (ctx.oidc.client.tlsClientCertificateBoundAccessTokens) {
-    const cert = getCertificate(ctx);
-    if (!cert) {
-      throw new InvalidGrant('mutual TLS client certificate not provided');
-    }
-    return cert;
-  }
-  return undefined;
-}
-
-export function checkDpopRequired(ctx, dPoP) {
-  if (!dPoP && ctx.oidc.client.dpopBoundAccessTokens) {
-    throw new InvalidGrant('DPoP proof JWT not provided');
-  }
-}
-
-export async function validateGrant(ctx, grantId) {
-  const grant = await ctx.oidc.provider.Grant.find(grantId, {
-    ignoreExpiration: true,
-  });
-
-  if (!grant) {
-    throw new InvalidGrant('grant not found');
-  }
-
-  if (grant.isExpired) {
-    throw new InvalidGrant('grant is expired');
-  }
-
-  if (grant.clientId !== ctx.oidc.client.clientId) {
-    throw new InvalidGrant('client mismatch');
-  }
-
-  return grant;
-}
-
-export async function validateAccount(ctx, findAccount, code, entityLabel) {
-  const account = await findAccount(ctx, code.accountId, code);
+export async function validateAccount(provider, ctx, code, entityLabel) {
+  const account = await findAccount(provider, ctx, code.accountId, code);
 
   if (!account) {
     throw new InvalidGrant(`${entityLabel} invalid (referenced account not found)`);
@@ -73,13 +41,16 @@ export function checkAccountMismatch(code, grant) {
   }
 }
 
-export function createAccessToken(ctx, AccessToken, source, gty) {
-  return new AccessToken({
+export function createAccessToken(provider, ctx, source, gty) {
+  assertProviderContext(provider, ctx);
+
+  return new provider.AccessToken({
     accountId: source.accountId,
     client: ctx.oidc.client,
     expiresWithSession: source.expiresWithSession,
     grantId: source.grantId,
     gty,
+    rar: source.rar,
     sessionUid: source.sessionUid,
     sid: source.sid,
   });
@@ -91,48 +62,49 @@ export function applyMtlsBinding(at, cert) {
   }
 }
 
-export async function applyDpopBinding(ctx, dPoP, at, allowReplay) {
-  if (dPoP) {
-    if (!allowReplay) {
-      const { ReplayDetection } = ctx.oidc.provider;
-      const unique = await ReplayDetection.unique(
-        ctx.oidc.client.clientId,
-        dPoP.jti,
-        epochTime() + CHALLENGE_OK_WINDOW,
-      );
-
-      ctx.assert(unique, new InvalidGrant('DPoP proof JWT Replay detected'));
-    }
+export async function applyDpopBinding(provider, ctx, dPoP, at) {
+  assertProviderContext(provider, ctx);
 
+  if (dPoP) {
+    await checkDpopReplay(provider, ctx, dPoP, ctx.oidc.client.clientId, InvalidGrant);
     at.setThumbprint('jkt', dPoP.thumbprint);
   }
 }
 
-export async function resolveAndApplyResource(ctx, source, at, grant, {
-  userinfo, resourceIndicators,
-}, scope) {
-  const resource = await resolveResource(ctx, source, { userinfo, resourceIndicators }, scope);
-
-  /* eslint-disable no-param-reassign */
-  if (resource) {
-    const resourceServerInfo = await resourceIndicators
-      .getResourceServerInfo(ctx, resource, ctx.oidc.client);
-    at.resourceServer = new ctx.oidc.provider.ResourceServer(resource, resourceServerInfo);
-    at.scope = grant.getResourceScopeFiltered(resource, scope || source.scopes);
-  } else {
-    at.claims = source.claims;
-    at.scope = grant.getOIDCScopeFiltered(scope || source.scopes);
+export async function issueTokens(
+  provider, helpers, ctx, source, grant, { gty, entityLabel, cert, dPoP },
+) {
+  const { resolveAndApplyResource, applyAuthorizationDetails, buildTokenResponse } = helpers;
+  const account = await validateAccount(provider, ctx, source, entityLabel);
+  checkAccountMismatch(source, grant);
+
+  ctx.oidc.entity('Account', account);
+
+  const at = createAccessToken(provider, ctx, { ...source, accountId: account.accountId }, gty);
+  applyMtlsBinding(at, cert);
+
+  if (gty === 'authorization_code' && source.dpopJkt && !dPoP) {
+    throw new InvalidGrant('missing DPoP proof JWT');
   }
-  /* eslint-enable no-param-reassign */
 
-  return resource;
-}
+  await applyDpopBinding(provider, ctx, dPoP, at);
+
+  if (
+    gty === 'authorization_code'
+    && dPoP && source.dpopJkt && source.dpopJkt !== dPoP.thumbprint
+  ) {
+    throw new InvalidGrant('DPoP proof key thumbprint does not match dpop_jkt');
+  }
 
-export async function createRefreshToken(ctx, source, at, gty, {
-  issueRefreshToken, RefreshToken,
-}) {
-  if (await issueRefreshToken(ctx, ctx.oidc.client, source)) {
-    const rt = new RefreshToken({
+  await resolveAndApplyResource(ctx, source, at, grant);
+  await applyAuthorizationDetails(ctx, at, source);
+
+  ctx.oidc.entity('AccessToken', at);
+  const accessToken = await at.save();
+
+  let refreshToken;
+  if (await shouldIssueRefreshToken(provider, ctx, source)) {
+    const rt = new provider.RefreshToken({
       accountId: source.accountId,
       acr: source.acr,
       amr: source.amr,
@@ -151,31 +123,47 @@ export async function createRefreshToken(ctx, source, at, gty, {
       rar: source.rar,
     });
 
-    await setRefreshTokenBindings(ctx, at, rt);
+    await applyRefreshTokenBindings(provider, ctx, at, rt);
 
     ctx.oidc.entity('RefreshToken', rt);
-    return rt.save();
+    refreshToken = await rt.save();
   }
 
-  return undefined;
+  const idToken = gty === 'pre_authorized_code'
+    ? undefined
+    : await issueIdToken(provider, ctx, source, at, grant);
+
+  ctx.body = buildTokenResponse({
+    accessToken,
+    authorizationDetails: at.rar,
+    expiresIn: at.expiration,
+    ...(gty === 'pre_authorized_code' ? {} : { idToken }),
+    refreshToken,
+    scope: source.scope ? at.scope : (at.scope || undefined),
+    tokenType: at.tokenType,
+  });
 }
 
-export async function issueIdToken(ctx, source, at, grant, {
-  conformIdTokenClaims, userinfo,
-}, scopeOverride) {
+export async function issueIdToken(provider, ctx, source, at, grant, scopeOverride) {
+  assertProviderContext(provider, ctx);
+
+  const {
+    conformIdTokenClaims,
+    features: { userinfo },
+  } = instance(provider).configuration;
   const scopes = scopeOverride || source.scopes;
   if (!scopes.has('openid')) {
     return undefined;
   }
 
-  const { IdToken } = ctx.oidc.provider;
+  const { IdToken } = provider;
   const claims = filterClaims(source.claims, 'id_token', grant);
   const rejected = grant.getRejectedOIDCClaims();
   const token = new IdToken({
     ...await getCtxAccountClaims(
       ctx,
       'id_token',
-      typeof source.scope === 'string' ? source.scope : [...scopes].join(' '),
+      !scopeOverride && typeof source.scope === 'string' ? source.scope : [...scopes].join(' '),
       claims,
       rejected,
     ),
@@ -198,17 +186,3 @@ export async function issueIdToken(ctx, source, at, grant, {
 
   return token.issue({ use: 'idtoken' });
 }
-
-export function buildTokenResponse(at, accessToken, {
-  idToken, refreshToken, source, rar,
-}) {
-  return {
-    access_token: accessToken,
-    expires_in: at.expiration,
-    id_token: idToken,
-    refresh_token: refreshToken,
-    scope: source.scope ? at.scope : (at.scope || undefined),
-    token_type: at.tokenType,
-    authorization_details: rar,
-  };
-}

package/dist/node_modules/oidc-provider/lib/helpers/grant_refresh_token.js

@@ -0,0 +1,22 @@
+import assertProviderContext from './assert_provider_context.js';
+import { boolean } from './configuration_result.js';
+import { setRefreshTokenBindings } from './set_rt_bindings.js';
+import instance from './weak_cache.js';
+
+export async function shouldIssueRefreshToken(provider, ctx, source) {
+  assertProviderContext(provider, ctx);
+
+  return boolean(
+    await instance(provider).configuration.issueRefreshToken(
+      ctx,
+      ctx.oidc.client,
+      source,
+    ),
+    'issueRefreshToken',
+  );
+}
+
+export function applyRefreshTokenBindings(provider, ctx, accessToken, refreshToken) {
+  assertProviderContext(provider, ctx);
+  return setRefreshTokenBindings(ctx, accessToken, refreshToken);
+}

package/dist/node_modules/oidc-provider/lib/helpers/grant_response.js

@@ -0,0 +1,58 @@
+import isPlainObject from './_/is_plain_object.js';
+
+const reserved = new Set([
+  'access_token',
+  'authorization_details',
+  'expires_in',
+  'id_token',
+  'issued_token_type',
+  'refresh_token',
+  'scope',
+  'token_type',
+]);
+
+export function buildTokenResponse(provider, {
+  accessToken,
+  authorizationDetails,
+  expiresIn,
+  idToken,
+  issuedTokenType,
+  parameters = {},
+  refreshToken,
+  scope,
+  tokenType,
+} = {}) {
+  if (!provider || typeof provider !== 'object') {
+    throw new TypeError('provider must be an oidc-provider instance');
+  }
+
+  if (typeof accessToken !== 'string' || !accessToken) {
+    throw new TypeError('accessToken must be a non-empty string');
+  }
+
+  if (typeof tokenType !== 'string' || !tokenType) {
+    throw new TypeError('tokenType must be a non-empty string');
+  }
+
+  if (!isPlainObject(parameters)) {
+    throw new TypeError('parameters must be a plain object');
+  }
+
+  for (const name of Object.keys(parameters)) {
+    if (reserved.has(name)) {
+      throw new TypeError(`parameters must not contain reserved member ${name}`);
+    }
+  }
+
+  return Object.fromEntries(Object.entries({
+    ...parameters,
+    access_token: accessToken,
+    expires_in: expiresIn,
+    id_token: idToken,
+    issued_token_type: issuedTokenType,
+    refresh_token: refreshToken,
+    scope,
+    token_type: tokenType,
+    authorization_details: authorizationDetails,
+  }).filter(([, value]) => value !== undefined));
+}

package/dist/node_modules/oidc-provider/lib/helpers/grant_source.js

@@ -0,0 +1,60 @@
+import assertProviderContext from './assert_provider_context.js';
+import { account } from './configuration_result.js';
+import { InvalidGrant } from './errors.js';
+import revoke from './revoke.js';
+import instance from './weak_cache.js';
+
+export async function findGrantSource(provider, ctx, Model, value, label) {
+  assertProviderContext(provider, ctx);
+
+  const source = await Model.find(value, { ignoreExpiration: true });
+
+  if (!source) {
+    throw new InvalidGrant(`${label} not found`);
+  }
+
+  if (source.clientId !== ctx.oidc.client.clientId) {
+    throw new InvalidGrant('client mismatch');
+  }
+
+  return source;
+}
+
+export async function consumeGrantSource(provider, ctx, source, label) {
+  assertProviderContext(provider, ctx);
+
+  if (source.consumed) {
+    await revoke(ctx, source.grantId);
+    throw new InvalidGrant(`${label} already consumed`);
+  }
+
+  await source.consume();
+}
+
+export async function validateGrant(provider, ctx, grantId) {
+  assertProviderContext(provider, ctx);
+
+  const grant = await provider.Grant.find(grantId, {
+    ignoreExpiration: true,
+  });
+
+  if (!grant) {
+    throw new InvalidGrant('grant not found');
+  }
+
+  if (grant.isExpired) {
+    throw new InvalidGrant('grant is expired');
+  }
+
+  if (grant.clientId !== ctx.oidc.client.clientId) {
+    throw new InvalidGrant('client mismatch');
+  }
+
+  return grant;
+}
+
+export async function findAccount(provider, ctx, accountId, source) {
+  assertProviderContext(provider, ctx);
+
+  return account(await instance(provider).configuration.findAccount(ctx, accountId, source));
+}

package/dist/node_modules/oidc-provider/lib/helpers/grants.js

@@ -0,0 +1,33 @@
+
+
+
+
+
+
+
+
+
+
+
+export {
+  consumeGrantSource,
+  findAccount,
+  findGrantSource,
+  validateGrant,
+} from './grant_source.js';
+export {
+  checkDpopRequired,
+  checkMtlsCert,
+} from './sender_constraints.js';
+export { default as validateDpop, checkDpopReplay } from './validate_dpop.js';
+export {
+  applyAuthorizationDetails,
+  resolveAndApplyResource,
+  resolveRequestedResources,
+  validateClientScope,
+} from './grant_authorization.js';
+export {
+  applyRefreshTokenBindings,
+  shouldIssueRefreshToken,
+} from './grant_refresh_token.js';
+export { buildTokenResponse } from './grant_response.js';

package/dist/node_modules/oidc-provider/lib/helpers/initialize_adapter.js

@@ -1,16 +1,18 @@
 import * as util from 'node:util';
 
-import MemoryAdapter from '../adapters/memory_adapter.js';
+import MemoryAdapter, { createMemoryAdapter } from '../adapters/memory_adapter.js';
 
 import instance from './weak_cache.js';
 import * as attention from './attention.js';
 import isConstructable from './type_validators.js';
 
 export default function initializeAdapter(adapter = MemoryAdapter) {
+  let Adapter = adapter;
   if (adapter === MemoryAdapter) {
     attention.warn('a quick start development-only in-memory adapter is used, you MUST change it in'
     + ' order to not lose all stateful provider data upon restart and to be able to share these'
     + ' between processes');
+    Adapter = createMemoryAdapter(instance(this).configuration.clockTolerance);
   } else {
     const constructable = isConstructable(adapter);
     const executable = typeof adapter === 'function' && !util.types.isAsyncFunction(adapter);
@@ -20,5 +22,5 @@ export default function initializeAdapter(adapter = MemoryAdapter) {
     }
   }
 
-  instance(this).Adapter = adapter;
+  instance(this).Adapter = Adapter;
 }