@nocobase/plugin-idp-oauth 2.2.16 → 2.2.18

package/dist/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/login.js

@@ -1,5 +1,3 @@
-/* eslint-disable camelcase */
-
 import * as errors from '../../errors.js';
 import instance from '../../weak_cache.js';
 import Prompt from '../prompt.js';
@@ -41,7 +39,7 @@ export default () => new Prompt(
       return Check.REQUEST_PROMPT;
     }
 
-    if (oidc.session.past(oidc.params.max_age) && (!ctx.oidc.result || !ctx.oidc.result.login)) {
+    if (oidc.session.past(oidc.params.max_age) && (!ctx.oidc.result?.login)) {
       return Check.REQUEST_PROMPT;
     }
 
@@ -87,8 +85,7 @@ export default () => new Prompt(
       const { oidc } = ctx;
 
       if (
-        !oidc.claims.id_token
-          || !oidc.claims.id_token.sub
+        !oidc.claims.id_token?.sub
           || !('value' in oidc.claims.id_token.sub)
       ) {
         return Check.NO_NEED_TO_PROMPT;
@@ -118,7 +115,7 @@ export default () => new Prompt(
 
   new Check(
     'essential_acrs',
-    'none of the requested ACRs could not be obtained',
+    'none of the requested ACRs could be obtained',
     (ctx) => {
       const { oidc } = ctx;
       const request = oidc.claims?.id_token?.acr ?? {};

package/dist/node_modules/oidc-provider/lib/helpers/is_valid_scope.js

@@ -0,0 +1,5 @@
+const SCOPE_SYNTAX = /^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$/u;
+
+export default function isValidScope(scope) {
+  return scope === undefined || (typeof scope === 'string' && SCOPE_SYNTAX.test(scope));
+}

package/dist/node_modules/oidc-provider/lib/helpers/jwt.js

@@ -56,7 +56,7 @@ export async function sign(payload, key, alg, options = {}) {
     .sign(key);
 }
 
-export function decode(input) {
+function normalizeInput(input) {
   let jwt;
 
   if (Buffer.isBuffer(input)) {
@@ -67,20 +67,24 @@ export function decode(input) {
     jwt = input;
   }
 
-  const { 0: protectedHeader, 1: payload, length } = jwt.split('.');
+  return jwt;
+}
 
-  if (length !== 3) {
-    throw new TypeError('invalid JWT.decode input');
-  }
+export function decode(input) {
+  const jwt = normalizeInput(input);
 
   return {
-    header: JSON.parse(base64url.decode(protectedHeader)),
-    payload: JSON.parse(base64url.decode(payload)),
+    header: decodeProtectedHeader(jwt),
+    payload: decodeJwt(jwt),
   };
 }
 
 export function header(jwt) {
-  return JSON.parse(base64url.decode(jwt.toString().split('.')[0]));
+  return decodeProtectedHeader(normalizeInput(jwt));
+}
+
+export function payload(jwt) {
+  return decodeJwt(normalizeInput(jwt));
 }
 
 export function assertPayload(payload, {
@@ -90,7 +94,9 @@ export function assertPayload(payload, {
 } = {}) {
   const timestamp = epochTime();
 
-  if (typeof payload !== 'object') throw new Error('payload is not of JWT type (JSON serialized object)');
+  if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+    throw new Error('payload is not of JWT type (JSON serialized object)');
+  }
 
   if (payload.nbf !== undefined && !ignoreNotBefore) {
     if (typeof payload.nbf !== 'number') throw new Error('invalid nbf value');
@@ -117,6 +123,14 @@ export function assertPayload(payload, {
     throw new Error('invalid iss value');
   }
 
+  if (
+    payload.aud !== undefined
+    && typeof payload.aud !== 'string'
+    && (!Array.isArray(payload.aud) || payload.aud.some((aud) => typeof aud !== 'string'))
+  ) {
+    throw new Error('invalid aud value');
+  }
+
   if (subject && typeof payload.sub !== 'string') {
     throw new Error('invalid sub value');
   }
@@ -149,6 +163,7 @@ export async function verify(jwt, keystore, options = {}) {
             await keystore.getKeyObject(key, true),
             { algorithms: options.algorithm ? [options.algorithm] : undefined },
           );
+          break;
         } catch {}
       }
     }
@@ -162,8 +177,7 @@ export async function verify(jwt, keystore, options = {}) {
     }
 
     await keystore.refresh();
-    // eslint-disable-next-line prefer-rest-params
-    return verify(...arguments);
+    return verify(jwt, keystore, options);
   }
 
   const payload = decodeJwt(jwt);
@@ -199,6 +213,7 @@ export async function decrypt(jwe, keystore) {
           keystore.getKeyObject(key),
           { maxDecompressedLength: 0 },
         );
+        break;
       } catch {}
     }
   }

package/dist/node_modules/oidc-provider/lib/helpers/keystore.js

@@ -1,5 +1,3 @@
-/* eslint-disable class-methods-use-this, max-classes-per-file, no-plusplus */
-
 export class ExternalSigningKey {
   #publicJwk;
 
@@ -106,7 +104,7 @@ const getKtyFromJWSAlg = (alg) => {
     case 'Ed': return 'OKP';
     case 'ML': return 'AKP';
     default:
-      throw new Error();
+      throw new Error(`unsupported JWS algorithm (${alg})`);
   }
 };
 
@@ -134,7 +132,7 @@ const getKtyFromJWEAlg = (alg, epk) => {
       return ['OKP', 'EC'];
     }
     default:
-      throw new Error();
+      throw new Error(`unsupported JWE key management algorithm (${alg})`);
   }
 };
 

package/dist/node_modules/oidc-provider/lib/helpers/lru.js

@@ -0,0 +1,111 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export default class LRU {
+  #maxSize;
+
+  #recent = new Map();
+
+  #stale = new Map();
+
+  #size = 0;
+
+  constructor({ maxSize }) {
+    if (!(maxSize && maxSize > 0)) {
+      throw new TypeError('`maxSize` must be a number greater than 0');
+    }
+    this.#maxSize = maxSize;
+  }
+
+  #expired(key, entry) {
+    if (typeof entry.expiry === 'number' && entry.expiry <= Date.now()) {
+      this.delete(key);
+      return true;
+    }
+    return false;
+  }
+
+  #insert(key, entry) {
+    this.#recent.set(key, entry);
+    this.#size += 1;
+
+    if (this.#size >= this.#maxSize) {
+      this.#size = 0;
+      this.#stale = this.#recent;
+      this.#recent = new Map();
+    }
+  }
+
+  get(key) {
+    if (this.#recent.has(key)) {
+      const entry = this.#recent.get(key);
+      return this.#expired(key, entry) ? undefined : entry.value;
+    }
+
+    if (this.#stale.has(key)) {
+      const entry = this.#stale.get(key);
+      if (this.#expired(key, entry)) return undefined;
+      this.#stale.delete(key);
+      this.#insert(key, entry);
+      return entry.value;
+    }
+
+    return undefined;
+  }
+
+  set(key, value, { maxAge } = {}) {
+    const expiry = typeof maxAge === 'number' && maxAge !== Number.POSITIVE_INFINITY
+      ? Date.now() + maxAge
+      : undefined;
+
+    if (this.#recent.has(key)) {
+      this.#recent.set(key, { value, expiry });
+    } else {
+      this.#insert(key, { value, expiry });
+    }
+
+    return this;
+  }
+
+  has(key) {
+    if (this.#recent.has(key)) return !this.#expired(key, this.#recent.get(key));
+    if (this.#stale.has(key)) return !this.#expired(key, this.#stale.get(key));
+    return false;
+  }
+
+  delete(key) {
+    const deleted = this.#recent.delete(key);
+    if (deleted) this.#size -= 1;
+    return this.#stale.delete(key) || deleted;
+  }
+
+  clear() {
+    this.#recent.clear();
+    this.#stale.clear();
+    this.#size = 0;
+  }
+
+  get size() {
+    if (!this.#size) return this.#stale.size;
+
+    let stale = 0;
+    for (const key of this.#stale.keys()) {
+      if (!this.#recent.has(key)) stale += 1;
+    }
+
+    return Math.min(this.#size + stale, this.#maxSize);
+  }
+}

package/dist/node_modules/oidc-provider/lib/helpers/nanoid.js

@@ -1,5 +1,82 @@
-import { customAlphabet, urlAlphabet } from 'nanoid';
+import { randomFillSync } from 'node:crypto';
 
-const nanoid = customAlphabet(urlAlphabet, 43);
+export const urlAlphabet = 'useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict';
 
-export default nanoid;
+const POOL_SIZE = 4096;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+export function customAlphabet(alphabet, defaultSize) {
+  const { length } = alphabet;
+  for (let i = 0; i < length; i += 1) {
+    if (alphabet.charCodeAt(i) > 255) throw new TypeError('alphabet must be latin1');
+  }
+  const charCodes = Uint8Array.from(alphabet, (char) => char.charCodeAt(0));
+
+  const mask = (2 << (31 - Math.clz32((length - 1) | 1))) - 1;
+  const exact = mask === length - 1;
+
+  const pool = Buffer.allocUnsafe(POOL_SIZE);
+  let offset = POOL_SIZE;
+
+  function refill() {
+    if (exact) {
+      randomFillSync(pool);
+      for (let i = 0; i < POOL_SIZE; i += 1) pool[i] = charCodes[pool[i] & mask];
+    } else {
+      const scratch = Buffer.allocUnsafe(Math.ceil((1.6 * (mask + 1) * POOL_SIZE) / length));
+      let accepted = 0;
+      while (accepted < POOL_SIZE) {
+        randomFillSync(scratch);
+        for (let i = 0; i < scratch.length && accepted < POOL_SIZE; i += 1) {
+          const index = scratch[i] & mask;
+          if (index < length) {
+            pool[accepted] = charCodes[index];
+            accepted += 1;
+          }
+        }
+      }
+    }
+    offset = 0;
+  }
+
+  return (size = defaultSize) => {
+    
+    
+    
+    size |= 0; 
+    if (size < 0) throw new RangeError('Wrong ID size');
+    if (size === 0) return '';
+
+    let id = '';
+    let remaining = size;
+    while (remaining > 0) {
+      if (offset === POOL_SIZE) refill();
+      const take = Math.min(remaining, POOL_SIZE - offset);
+      
+      id += pool.toString('latin1', offset, offset + take);
+      offset += take;
+      remaining -= take;
+    }
+    return id;
+  };
+}
+
+export default customAlphabet(urlAlphabet, 43);

package/dist/node_modules/oidc-provider/lib/helpers/normalize_authorization_details.js

@@ -0,0 +1,54 @@
+import isPlainObject from './_/is_plain_object.js';
+
+const ARRAY_FIELDS = ['locations', 'actions', 'datatypes', 'privileges'];
+
+export default function normalizeAuthorizationDetails(details, {
+  ErrorConstructor = TypeError,
+  label = 'authorization details policy result',
+} = {}) {
+  if (details === undefined || (Array.isArray(details) && details.length === 0)) {
+    return undefined;
+  }
+
+  if (!Array.isArray(details)) {
+    throw new ErrorConstructor(`${label} should be a JSON array`);
+  }
+
+  let i = 0;
+  for (const detail of details) {
+    if (!isPlainObject(detail)) {
+      throw new ErrorConstructor(`${label} members should be a JSON object`);
+    }
+
+    if (
+      !Object.hasOwn(detail, 'type')
+      || typeof detail.type !== 'string'
+      || !detail.type.length
+    ) {
+      throw new ErrorConstructor(`${label} members' type attribute must be a non-empty string (authorization details index ${i})`);
+    }
+
+    for (const field of ARRAY_FIELDS) {
+      if (
+        field in detail
+        && (
+          !Array.isArray(detail[field])
+          || detail[field].some((value) => typeof value !== 'string' || !value.length)
+        )
+      ) {
+        throw new ErrorConstructor(`'${field}' must be an array of non-empty strings (authorization details index ${i})`);
+      }
+    }
+
+    if (
+      'identifier' in detail
+      && (typeof detail.identifier !== 'string' || !detail.identifier.length)
+    ) {
+      throw new ErrorConstructor(`'identifier' must be a non-empty string (authorization details index ${i})`);
+    }
+
+    i++;
+  }
+
+  return details;
+}

package/dist/node_modules/oidc-provider/lib/helpers/oidc_context.js

@@ -1,7 +1,6 @@
-/* eslint-disable max-classes-per-file */
 import * as events from 'node:events';
 
-import isPlainObject from './_/is_plain_object.js';
+import isJsonObject from './_/is_json_object.js';
 import omitBy from './_/omit_by.js';
 import { InvalidRequest, InvalidToken } from './errors.js';
 import instance from './weak_cache.js';
@@ -12,20 +11,12 @@ const COOKIES = Symbol();
 export class NoAccessTokenProvided extends InvalidToken {
   constructor() {
     super();
-    // eslint-disable-next-line no-multi-assign
     this.error_detail = this.error_description = 'no access token provided';
   }
 }
 
 export default function getContext(provider) {
-  const {
-    acceptQueryParamAccessTokens,
-    features: {
-      dPoP: dPoPConfig,
-      fapi,
-    },
-    scopes: oidcScopes,
-  } = instance(provider).configuration;
+  const state = instance(provider);
 
   class OIDCContext extends events.EventEmitter {
     #requestParamClaims = null;
@@ -56,7 +47,7 @@ export default function getContext(provider) {
 
     get fapiProfile() {
       if (this.#fapiProfile === null) {
-        this.#fapiProfile = fapi.profile(this.ctx, this.client);
+        this.#fapiProfile = state.configuration.features.fapi.profile(this.ctx, this.client);
       }
 
       return this.#fapiProfile;
@@ -67,11 +58,11 @@ export default function getContext(provider) {
       return i !== -1 ? oneOf[i] : undefined;
     }
 
-    get issuer() { // eslint-disable-line class-methods-use-this
+    get issuer() {
       return provider.issuer;
     }
 
-    get provider() { // eslint-disable-line class-methods-use-this
+    get provider() {
       return provider;
     }
 
@@ -86,9 +77,9 @@ export default function getContext(provider) {
     urlFor(name, opt) {
       const { originalUrl } = this.ctx.req;
       const mountPath = originalUrl?.substring(0, originalUrl?.indexOf(this.ctx.request.url))
-        || this.ctx.mountPath // koa-mount
-        || this.ctx.req.baseUrl // expressApp.use('/op', provider.callback());
-        || ''; // no mount
+        || this.ctx.mountPath 
+        || this.ctx.req.baseUrl 
+        || ''; 
 
       return new URL(provider.pathFor(name, { mountPath, ...opt }), this.ctx.href).href;
     }
@@ -101,7 +92,7 @@ export default function getContext(provider) {
         return should.has(name);
       }
 
-      // first pass
+      
       return this.prompts.has(name);
     }
 
@@ -116,10 +107,10 @@ export default function getContext(provider) {
           userinfo, id_token: idToken,
         } = JSON.parse(this.params.claims);
 
-        const claims = instance(provider).configuration.claimsSupported;
+        const claims = state.configuration.claimsSupported;
         if (userinfo) {
           Object.entries(userinfo).forEach(([claim, value]) => {
-            if (claims.has(claim) && (value === null || isPlainObject(value))) {
+            if (claims.has(claim) && (value === null || isJsonObject(value))) {
               requestParamClaims.add(claim);
             }
           });
@@ -127,7 +118,7 @@ export default function getContext(provider) {
 
         if (idToken) {
           Object.entries(idToken).forEach(([claim, value]) => {
-            if (claims.has(claim) && (value === null || isPlainObject(value))) {
+            if (claims.has(claim) && (value === null || isJsonObject(value))) {
               requestParamClaims.add(claim);
             }
           });
@@ -148,15 +139,7 @@ export default function getContext(provider) {
     }
 
     get requestParamOIDCScopes() {
-      return new Set(this.params.scope?.split(' ').filter(Set.prototype.has.bind(oidcScopes)));
-    }
-
-    resolvedClaims() {
-      const rejected = this.session.rejectedClaimsFor(this.params.client_id);
-      const claims = structuredClone(this.claims);
-      claims.rejected = [...rejected];
-
-      return claims;
+      return new Set(this.params.scope?.split(' ').filter(Set.prototype.has.bind(state.configuration.scopes)));
     }
 
     get responseMode() {
@@ -216,7 +199,9 @@ export default function getContext(provider) {
     }
 
     getAccessToken({
-      acceptDPoP = false, acceptQueryParam = acceptQueryParamAccessTokens && !fapi.enabled,
+      acceptDPoP = false,
+      acceptQueryParam = state.configuration.acceptQueryParamAccessTokens
+        && !state.configuration.features.fapi.enabled,
     } = {}) {
       if (this.#accessToken) {
         return this.#accessToken;
@@ -235,7 +220,7 @@ export default function getContext(provider) {
 
       try {
         ({ 0: [mechanism, token], length } = Object.entries(mechanisms));
-      } catch (err) {}
+      } catch {}
 
       if (!length) {
         throw new NoAccessTokenProvided();
@@ -249,7 +234,7 @@ export default function getContext(provider) {
         throw new InvalidRequest('access tokens must not be provided via query parameter');
       }
 
-      const dpop = acceptDPoP && dPoPConfig.enabled && ctx.get('DPoP');
+      const dpop = acceptDPoP && state.configuration.features.dPoP.enabled && ctx.get('DPoP');
 
       if (mechanism === 'header') {
         const header = token;

package/dist/node_modules/oidc-provider/lib/helpers/params.js

@@ -2,26 +2,15 @@ import { strict as assert } from 'node:assert';
 
 import omitBy from './_/omit_by.js';
 
-const cache = new WeakMap();
-
-export default function getParams(allowList) {
-  if (!cache.has(allowList)) {
+export default class Params {
+  constructor(allowList, params) {
     assert(allowList, 'allowList must be present');
-
-    const klass = class Params {
-      constructor(params) {
-        allowList.forEach((prop) => {
-          this[prop] = params[prop] || undefined;
-        });
-      }
-
-      toPlainObject() {
-        return omitBy({ ...this }, (val) => typeof val === 'undefined');
-      }
-    };
-
-    cache.set(allowList, klass);
+    allowList.forEach((prop) => {
+      this[prop] = params[prop] || undefined;
+    });
   }
 
-  return cache.get(allowList);
+  toPlainObject() {
+    return omitBy({ ...this }, (val) => typeof val === 'undefined');
+  }
 }

package/dist/node_modules/oidc-provider/lib/helpers/pkce.js

@@ -12,19 +12,19 @@ export default function checkPKCE(verifier, challenge, method) {
   if (verifier || challenge) {
     try {
       let expected = verifier;
-      if (!expected) throw new Error();
+      if (!expected) throw new Error('code_verifier must be provided');
 
       if (method === 'S256') {
         expected = crypto.hash('sha256', expected, 'base64url');
       } else {
-        throw new Error();
+        throw new Error('unsupported code_challenge_method');
       }
 
       if (!constantEquals(challenge, expected)) {
-        throw new Error();
+        throw new Error('code_verifier does not match code_challenge');
       }
-    } catch (err) {
-      throw new InvalidGrant('PKCE verification failed');
+    } catch (cause) {
+      throw new InvalidGrant({ cause });
     }
   }
 }

package/dist/node_modules/oidc-provider/lib/helpers/process_response_types.js

@@ -1,8 +1,10 @@
+import getCtxAccountClaims from './account_claims.js';
+import combinedScope from './combined_scope.js';
+import { boolean } from './configuration_result.js';
 import { InvalidTarget } from './errors.js';
-import instance from './weak_cache.js';
 import filterClaims from './filter_claims.js';
-import combinedScope from './combined_scope.js';
-import getCtxAccountClaims from './account_claims.js';
+import normalizeAuthorizationDetails from './normalize_authorization_details.js';
+import instance from './weak_cache.js';
 
 async function tokenHandler(ctx) {
   const { accountId } = ctx.oidc.session;
@@ -44,7 +46,7 @@ async function tokenHandler(ctx) {
   }
 
   if (!token.resourceServer || token.resourceServer.accessTokenFormat === 'opaque') {
-    if (await expiresWithSession(ctx, token)) {
+    if (boolean(await expiresWithSession(ctx, token), 'expiresWithSession')) {
       token.expiresWithSession = true;
     } else {
       ctx.oidc.session.authorizationFor(ctx.oidc.client.clientId).persistsLogout = true;
@@ -97,15 +99,10 @@ async function codeHandler(ctx) {
     code.attestationJkt = ctx.oidc.entities.PushedAuthorizationRequest.attestationJkt;
   }
 
-  if (richAuthorizationRequests.enabled) {
-    code.rar = await richAuthorizationRequests.rarForAuthorizationCode(ctx);
-  }
-
   if (Object.keys(code.claims).length === 0) {
     delete code.claims;
   }
 
-  // eslint-disable-next-line default-case
   switch (code.resource.length) {
     case 0:
       delete code.resource;
@@ -115,7 +112,7 @@ async function codeHandler(ctx) {
       break;
   }
 
-  if (await expiresWithSession(ctx, code)) {
+  if (boolean(await expiresWithSession(ctx, code), 'expiresWithSession')) {
     code.expiresWithSession = true;
   } else {
     ctx.oidc.session.authorizationFor(ctx.oidc.client.clientId).persistsLogout = true;
@@ -125,6 +122,18 @@ async function codeHandler(ctx) {
     code.sid = ctx.oidc.session.sidFor(ctx.oidc.client.clientId);
   }
 
+  if (
+    richAuthorizationRequests.enabled
+    && (
+      ctx.oidc.params.authorization_details !== undefined
+      || grant.rar?.length
+    )
+  ) {
+    code.rar = normalizeAuthorizationDetails(
+      await richAuthorizationRequests.authorizationDetailsForGrantSource(ctx, code),
+    );
+  }
+
   ctx.oidc.entity('AuthorizationCode', code);
 
   return { code: await code.save() };
@@ -163,10 +172,10 @@ async function idTokenHandler(ctx) {
   return { id_token: idToken };
 }
 
-/*
- * Resolves each requested response type to a single response object. If one of the hybrid
- * response types is used an appropriate _hash is also pushed on to the id_token.
- */
+
+
+
+
 export default async function processResponseTypes(ctx) {
   const responses = ctx.oidc.params.response_type.split(' ');
   const response = Object.assign({}, ...await Promise.all(responses.map((responseType) => {