@nocobase/plugin-idp-oauth 2.2.16 → 2.2.18

package/dist/node_modules/oidc-provider/lib/actions/authorization/ciba_required.js

@@ -1,13 +0,0 @@
-import presence from '../../helpers/validate_presence.js';
-
-export default function oidcRequired(ctx, next) {
-  const required = new Set(['scope']);
-
-  if (ctx.oidc.client.backchannelTokenDeliveryMode !== 'poll') {
-    required.add('client_notification_token');
-  }
-
-  presence(ctx, ...required);
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/device_authorization_response.js

@@ -1,31 +0,0 @@
-import { generate, normalize } from '../../helpers/user_codes.js';
-import instance from '../../helpers/weak_cache.js';
-
-export default async function deviceAuthorizationResponse(ctx) {
-  const { charset, mask, deviceInfo } = instance(ctx.oidc.provider).features.deviceFlow;
-  const userCode = generate(charset, mask);
-
-  const dc = new ctx.oidc.provider.DeviceCode({
-    client: ctx.oidc.client,
-    deviceInfo: deviceInfo(ctx),
-    params: ctx.oidc.params.toPlainObject(),
-    userCode: normalize(userCode),
-  });
-
-  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
-    await dc.setAttestBinding(ctx);
-  }
-
-  ctx.oidc.entity('DeviceCode', dc);
-  ctx.body = {
-    device_code: await dc.save(),
-    user_code: userCode,
-    verification_uri: ctx.oidc.urlFor('code_verification'),
-    verification_uri_complete: ctx.oidc.urlFor('code_verification', {
-      query: { user_code: userCode },
-    }),
-    expires_in: dc.expiration,
-  };
-
-  ctx.oidc.provider.emit('device_authorization.success', ctx, ctx.body);
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/device_user_flow.js

@@ -1,31 +0,0 @@
-import Params from '../../helpers/params.js';
-import {
-  NotFoundError, ExpiredError, AlreadyUsedError,
-} from '../../helpers/re_render_errors.js';
-
-export default async function deviceUserFlow(allowList, ctx, next) {
-  if (ctx.oidc.route === 'device_resume') {
-    const code = await ctx.oidc.provider.DeviceCode.find(
-      ctx.oidc.entities.Interaction.deviceCode,
-      { ignoreExpiration: true, ignoreSessionBinding: true },
-    );
-
-    if (!code) {
-      throw new NotFoundError();
-    }
-
-    if (code.isExpired) {
-      throw new ExpiredError();
-    }
-
-    if (code.error || code.accountId) {
-      throw new AlreadyUsedError();
-    }
-
-    ctx.oidc.entity('DeviceCode', code);
-  } else {
-    ctx.oidc.params = new (Params(allowList))(ctx.oidc.deviceCode.params);
-  }
-
-  await next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/device_user_flow_errors.js

@@ -1,37 +0,0 @@
-import { AccessDenied } from '../../helpers/errors.js';
-import errOut from '../../helpers/err_out.js';
-import {
-  ReRenderError, AbortedError,
-} from '../../helpers/re_render_errors.js';
-
-export default async function deviceUserFlowErrors(ctx, next) {
-  try {
-    await next();
-  } catch (err) {
-    if (!(err instanceof ReRenderError)) {
-      const out = errOut(err);
-
-      let code = ctx.oidc.deviceCode;
-
-      if (!code && ctx.oidc.entities.Interaction?.deviceCode) {
-        code = await ctx.oidc.provider.DeviceCode.find(
-          ctx.oidc.entities.Interaction.deviceCode,
-          { ignoreExpiration: true, ignoreSessionBinding: true },
-        );
-      }
-
-      if (code) {
-        Object.assign(code, {
-          error: out.error,
-          errorDescription: out.error_description,
-        });
-        await code.save();
-        if (err instanceof AccessDenied) {
-          throw new AbortedError();
-        }
-      }
-    }
-
-    throw err;
-  }
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/device_user_flow_response.js

@@ -1,55 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-import combinedScope from '../../helpers/combined_scope.js';
-
-export default async function deviceVerificationResponse(ctx) {
-  const { configuration, features } = instance(ctx.oidc.provider);
-  const code = ctx.oidc.deviceCode;
-
-  const scopeSet = combinedScope(
-    ctx.oidc.grant,
-    ctx.oidc.requestParamScopes,
-    ctx.oidc.resourceServers,
-  );
-
-  Object.assign(code, {
-    accountId: ctx.oidc.session.accountId,
-    acr: ctx.oidc.acr,
-    amr: ctx.oidc.amr,
-    authTime: ctx.oidc.session.authTime(),
-    claims: ctx.oidc.claims,
-    grantId: ctx.oidc.session.grantIdFor(ctx.oidc.client.clientId),
-    scope: [...scopeSet].join(' '),
-    sessionUid: ctx.oidc.session.uid,
-    resource: Object.keys(ctx.oidc.resourceServers),
-  });
-
-  if (Object.keys(code.claims).length === 0) {
-    delete code.claims;
-  }
-
-  // eslint-disable-next-line default-case
-  switch (code.resource.length) {
-    case 0:
-      delete code.resource;
-      break;
-    case 1:
-      [code.resource] = code.resource;
-      break;
-  }
-
-  if (await configuration.expiresWithSession(ctx, code)) {
-    code.expiresWithSession = true;
-  } else {
-    ctx.oidc.session.authorizationFor(ctx.oidc.client.clientId).persistsLogout = true;
-  }
-
-  if (ctx.oidc.client.includeSid() || (ctx.oidc.claims.id_token && 'sid' in ctx.oidc.claims.id_token)) {
-    code.sid = ctx.oidc.session.sidFor(ctx.oidc.client.clientId);
-  }
-
-  await code.save();
-
-  await features.deviceFlow.successSource(ctx);
-
-  ctx.oidc.provider.emit('authorization.success', ctx);
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/interaction_emit.js

@@ -1,9 +0,0 @@
-const resumeRoutes = new Set(['resume', 'device_resume']);
-
-export default function interactionEmit(ctx, next) {
-  if (resumeRoutes.has(ctx.oidc.route)) {
-    ctx.oidc.provider.emit('interaction.ended', ctx);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/load_account.js

@@ -1,15 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Loads the End-User's account referenced by the session.
- */
-export default async function loadAccount(ctx, next) {
-  const { accountId } = ctx.oidc.session;
-
-  if (accountId) {
-    const account = await instance(ctx.oidc.provider).configuration.findAccount(ctx, accountId);
-    ctx.oidc.entity('Account', account);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/load_pushed_authorization_request.js

@@ -1,36 +0,0 @@
-import { InvalidRequestUri, RequestUriNotSupported } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-import { PUSHED_REQUEST_URN } from '../../consts/index.js';
-
-import rejectRequestAndUri from './reject_request_and_uri.js';
-
-/*
- * Validates request_uri is a PAR one when PAR is enabled and loads it. Throws
- */
-export default async function loadPushedAuthorizationRequest(ctx, next) {
-  const { pushedAuthorizationRequests } = instance(ctx.oidc.provider).features;
-  const { params, provider: { PushedAuthorizationRequest } } = ctx.oidc;
-
-  rejectRequestAndUri(ctx, () => {});
-
-  if (params.request_uri !== undefined) {
-    if (pushedAuthorizationRequests.enabled && params.request_uri.startsWith(PUSHED_REQUEST_URN)) {
-      if (!URL.canParse(params.request_uri)) {
-        throw new InvalidRequestUri('invalid request_uri');
-      }
-      const [, id] = params.request_uri.split(PUSHED_REQUEST_URN);
-      const pushedAuthorizationRequest = await PushedAuthorizationRequest.find(id, {
-        ignoreExpiration: true,
-      });
-      if (!pushedAuthorizationRequest?.isValid) {
-        throw new InvalidRequestUri('request_uri is invalid, expired, or was already used');
-      }
-      ctx.oidc.entity('PushedAuthorizationRequest', pushedAuthorizationRequest);
-      params.request = pushedAuthorizationRequest.request;
-    } else {
-      throw new RequestUriNotSupported();
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/oauth_required.js

@@ -1,11 +0,0 @@
-import presence from '../../helpers/validate_presence.js';
-
-/*
- * Validates presence of mandatory OAuth2.0 parameters response_type, client_id and scope.
- */
-export default function oauthRequired(ctx, next) {
-  // Validate: required oauth params
-  presence(ctx, 'response_type', 'client_id');
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/oidc_required.js

@@ -1,27 +0,0 @@
-import presence from '../../helpers/validate_presence.js';
-
-/*
- * Validates presence of redirect_uri and conditionally nonce if specific implicit or hybrid flow
- * are used.
- * Validates that openid scope is present is OpenID Connect specific parameters are provided.
- */
-export default function oidcRequired(ctx, next) {
-  const { params } = ctx.oidc;
-
-  const required = new Set(['redirect_uri']);
-
-  // Check for nonce if implicit or hybrid flow responding with id_token issued by the authorization
-  // endpoint
-  if (typeof params.response_type === 'string' && params.response_type.includes('id_token')) {
-    required.add('nonce');
-  }
-
-  // TODO: move this to a new helper function
-  if (ctx.oidc.isFapi('1.0 Final')) {
-    required.add(ctx.oidc.requestParamScopes.has('openid') ? 'nonce' : 'state');
-  }
-
-  presence(ctx, ...required);
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/one_redirect_uri_clients.js

@@ -1,20 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * If no redirect_uri is provided and client only pre-registered one unique value it is assumed
- * to be the requested redirect_uri and used as if it was explicitly provided;
- */
-export default function oneRedirectUriClients(ctx, next) {
-  if (!instance(ctx.oidc.provider).configuration.allowOmittingSingleRegisteredRedirectUri || ctx.oidc.isFapi('2.0')) {
-    return next();
-  }
-
-  const { params, client } = ctx.oidc;
-
-  if (params.redirect_uri === undefined && client.redirectUris.length === 1) {
-    ctx.oidc.redirectUriCheckPerformed = true;
-    [params.redirect_uri] = client.redirectUris;
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/pushed_authorization_request_remap_errors.js

@@ -1,17 +0,0 @@
-import { InvalidRedirectUri } from '../../helpers/errors.js';
-
-/*
- * Remaps the Pushed Authorization Request Endpoint errors thrown in downstream middlewares.
- */
-export default async function requestObjectRemapErrors(ctx, next) {
-  return next().catch((err) => {
-    if (err instanceof InvalidRedirectUri) {
-      Object.assign(err, {
-        message: 'invalid_request',
-        error: 'invalid_request',
-      });
-    }
-
-    throw err;
-  });
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/pushed_authorization_request_response.js

@@ -1,65 +0,0 @@
-import { UnsecuredJWT } from 'jose';
-
-import { PUSHED_REQUEST_URN } from '../../consts/index.js';
-import epochTime from '../../helpers/epoch_time.js';
-import * as JWT from '../../helpers/jwt.js';
-
-const MAX_TTL = 60;
-
-export default async function pushedAuthorizationRequestResponse(ctx) {
-  let request;
-  let ttl;
-  let dpopJkt;
-  const now = epochTime();
-  if (ctx.oidc.body.request) {
-    ({ request } = ctx.oidc.body);
-    const { payload: { exp, dpop_jkt: thumbprint } } = JWT.decode(request);
-    ttl = exp - now;
-
-    if (!Number.isInteger(ttl) || ttl > MAX_TTL) {
-      ttl = MAX_TTL;
-    }
-    dpopJkt = thumbprint || ctx.oidc.params.dpop_jkt;
-  } else {
-    ttl = MAX_TTL;
-    const payload = { ...ctx.oidc.params };
-
-    if (payload.claims) {
-      payload.claims = JSON.parse(payload.claims);
-    }
-
-    if (payload.authorization_details) {
-      payload.authorization_details = JSON.parse(payload.authorization_details);
-    }
-
-    request = new UnsecuredJWT(payload)
-      .setIssuedAt(now)
-      .setIssuer(ctx.oidc.client.clientId)
-      .setAudience(ctx.oidc.issuer)
-      .setExpirationTime(now + MAX_TTL)
-      .setNotBefore(now)
-      .encode();
-    dpopJkt = ctx.oidc.params.dpop_jkt;
-  }
-
-  const requestObject = new ctx.oidc.provider.PushedAuthorizationRequest({
-    request,
-    dpopJkt,
-    trusted: ctx.oidc.client.clientAuthMethod !== 'none' || !!ctx.oidc.trusted?.length,
-  });
-
-  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
-    await requestObject.setAttestBinding(ctx);
-  }
-
-  const id = await requestObject.save(ttl);
-
-  ctx.oidc.entity('PushedAuthorizationRequest', requestObject);
-
-  ctx.status = 201;
-  ctx.body = {
-    expires_in: ttl,
-    request_uri: `${PUSHED_REQUEST_URN}${id}`,
-  };
-  ctx.oidc.provider.emit('pushed_authorization_request.success', ctx, ctx.oidc.client);
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/reject_registration.js

@@ -1,12 +0,0 @@
-import { RegistrationNotSupported } from '../../helpers/errors.js';
-
-/*
- * Rejects registration parameter as not supported.
- */
-export default function rejectRegistration(ctx, next) {
-  if (ctx.oidc.params.registration !== undefined) {
-    throw new RegistrationNotSupported();
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/reject_request_and_uri.js

@@ -1,12 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-/*
- * Rejects when request and request_uri are used together.
- */
-export default function rejectRequestAndUri(ctx, next) {
-  if (ctx.oidc.params.request !== undefined && ctx.oidc.params.request_uri !== undefined) {
-    throw new InvalidRequest('request and request_uri parameters MUST NOT be used together');
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/reject_unsupported.js

@@ -1,33 +0,0 @@
-import { InvalidRequest, RequestNotSupported, RequestUriNotSupported } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Rejects request and request_uri parameters when not supported. Also rejects wmrm's relay mode.
- */
-export default function rejectUnsupported(ctx, next) {
-  const {
-    requestObjects,
-    pushedAuthorizationRequests,
-    webMessageResponseMode,
-  } = instance(ctx.oidc.provider).features;
-  const { params } = ctx.oidc;
-
-  if (params.request !== undefined && !requestObjects.enabled) {
-    throw new RequestNotSupported();
-  }
-
-  if (
-    params.request_uri !== undefined
-    && (ctx.oidc.route !== 'authorization' || !pushedAuthorizationRequests.enabled)
-  ) {
-    throw new RequestUriNotSupported();
-  }
-
-  if (webMessageResponseMode.enabled && params.response_mode?.includes('web_message') && params.web_message_uri) {
-    const error = new InvalidRequest('Web Message Response Mode Relay Mode is not supported');
-    error.allow_redirect = false;
-    throw error;
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/strip_outside_jar_params.js

@@ -1,19 +0,0 @@
-/*
- * Makes sure that
- * - unauthenticated clients send the JAR Request Object
- * - either JAR or plain request is provided
- * - request_uri is not used
- */
-export default function stripOutsideJarParams(ctx, next) {
-  const JAR = !!ctx.oidc.params.request;
-
-  for (const [param, value] of Object.entries(ctx.oidc.params)) {
-    if (value !== undefined) {
-      if (JAR && (param !== 'client_id' && param !== 'request')) {
-        ctx.oidc.params[param] = undefined;
-      }
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/unsupported_rar.js

@@ -1,9 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-export default async function unsupportedRar(ctx, next) {
-  if (ctx.oidc.params.authorization_details !== undefined) {
-    throw new InvalidRequest(`authorization_details is unsupported at the ${ctx.oidc.route}_endpoint`);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/helpers/_/pick_by.js

@@ -1,10 +0,0 @@
-export default (object, predicate) => {
-  const result = {};
-  Object.entries(object).forEach(([key, value]) => {
-    if (predicate(value, key)) {
-      result[key] = value;
-    }
-  });
-
-  return result;
-};

package/dist/node_modules/oidc-provider/lib/models/formats/dynamic.js

@@ -1,21 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-import als from '../../helpers/als.js';
-
-export default (provider, formats) => ({
-  generateTokenId(...args) {
-    const resolver = instance(provider).dynamic[this.constructor.name];
-    const format = resolver(als.getStore(), this);
-    if (!formats[format] || format === 'dynamic') {
-      throw new Error('invalid format resolved');
-    }
-    this.format = format;
-    return formats[format].generateTokenId.apply(this, args);
-  },
-  async getValueAndPayload(...args) {
-    const { format } = this;
-    if (!formats[format] || format === 'dynamic') {
-      throw new Error('invalid format resolved');
-    }
-    return formats[format].getValueAndPayload.apply(this, args);
-  },
-});

package/dist/node_modules/oidc-provider/lib/models/mixins/apply.js

@@ -1,4 +0,0 @@
-export default function apply(mixins) {
-  const klass = mixins.pop();
-  return mixins.reduce((mixed, mixin) => mixin(mixed), klass);
-}

package/dist/node_modules/oidc-provider/lib/models/mixins/consumable.js

@@ -1,17 +0,0 @@
-export default (superclass) => class extends superclass {
-  static get IN_PAYLOAD() {
-    return [
-      ...super.IN_PAYLOAD,
-      'consumed',
-    ];
-  }
-
-  async consume() {
-    await this.adapter.consume(this.jti);
-    this.emit('consumed');
-  }
-
-  get isValid() {
-    return !this.consumed && !this.isExpired;
-  }
-};

package/dist/node_modules/oidc-provider/lib/models/mixins/has_format.js

@@ -1,46 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-import formatsGenerator from '../formats/index.js';
-
-const DEFAULT = 'opaque';
-
-function AccessTokenFormat(ctx, token) {
-  return token.resourceServer?.accessTokenFormat ?? 'opaque';
-}
-
-export default (provider, type, superclass) => {
-  const formats = formatsGenerator(provider);
-
-  let FORMAT;
-  if (type === 'AccessToken' || type === 'ClientCredentials') {
-    FORMAT = AccessTokenFormat;
-  } else {
-    FORMAT = DEFAULT;
-  }
-
-  if (FORMAT !== DEFAULT || type === 'base') {
-    const dynamic = typeof FORMAT === 'function';
-    if (!dynamic) {
-      if (!formats[FORMAT]) throw new TypeError(`unsupported format specified (${FORMAT})`);
-      if (FORMAT === 'dynamic') throw new TypeError('dynamic format must be configured as a function');
-    }
-
-    const {
-      generateTokenId,
-      getValueAndPayload,
-    } = formats[dynamic ? 'dynamic' : FORMAT];
-
-    const klass = class extends superclass {};
-    klass.prototype.generateTokenId = generateTokenId;
-    klass.prototype.getValueAndPayload = getValueAndPayload;
-    klass.prototype.constructor.verify = formats.opaque.verify;
-
-    if (dynamic) {
-      instance(provider).dynamic ||= {};
-      instance(provider).dynamic[type] = FORMAT;
-    }
-
-    return klass;
-  }
-
-  return superclass;
-};

package/dist/node_modules/oidc-provider/lib/models/mixins/has_grant_id.js

@@ -1,12 +0,0 @@
-export default (superclass) => class extends superclass {
-  static async revokeByGrantId(grantId) {
-    await this.adapter.revokeByGrantId(grantId);
-  }
-
-  static get IN_PAYLOAD() {
-    return [
-      ...super.IN_PAYLOAD,
-      'grantId',
-    ];
-  }
-};

package/dist/node_modules/oidc-provider/lib/models/mixins/has_grant_type.js

@@ -1,8 +0,0 @@
-export default (superclass) => class extends superclass {
-  static get IN_PAYLOAD() {
-    return [
-      ...super.IN_PAYLOAD,
-      'gty',
-    ];
-  }
-};

package/dist/node_modules/oidc-provider/lib/models/mixins/has_policies.js

@@ -1,38 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-function validate(provider, policies) {
-  if (!Array.isArray(policies)) {
-    throw new TypeError('policies must be an array');
-  }
-  if (!policies.length) {
-    throw new TypeError('policies must not be empty');
-  }
-  policies.forEach((policy) => {
-    if (typeof policy !== 'string') {
-      throw new TypeError('policies must be strings');
-    }
-    if (!instance(provider).features.registration.policies[policy]) {
-      throw new TypeError(`policy ${policy} not configured`);
-    }
-  });
-}
-
-export default (provider) => (superclass) => class extends superclass {
-  async save() {
-    if (typeof this.policies !== 'undefined') validate(provider, this.policies);
-    return super.save();
-  }
-
-  static async find(...args) {
-    const result = await super.find(...args);
-    if (result && typeof result.policies !== 'undefined') validate(provider, result.policies);
-    return result;
-  }
-
-  static get IN_PAYLOAD() {
-    return [
-      ...super.IN_PAYLOAD,
-      'policies',
-    ];
-  }
-};

package/dist/node_modules/oidc-provider/lib/models/mixins/is_attestation_constrained.js

@@ -1,15 +0,0 @@
-import * as jose from 'jose';
-
-export default (superclass) => class extends superclass {
-  static get IN_PAYLOAD() {
-    return [
-      ...super.IN_PAYLOAD,
-      'attestationJkt',
-    ];
-  }
-
-  async setAttestBinding(ctx) {
-    const { cnf: { jwk } } = jose.decodeJwt(ctx.get('oauth-client-attestation'));
-    this.attestationJkt = await jose.calculateJwkThumbprint(jwk);
-  }
-};