@nocobase/plugin-idp-oauth 2.2.17 → 2.2.18

package/dist/node_modules/oidc-provider/lib/actions/token.js

@@ -1,74 +1,118 @@
 import presence from '../helpers/validate_presence.js';
 import instance from '../helpers/weak_cache.js';
-import { UnsupportedGrantType, InvalidRequest } from '../helpers/errors.js';
+import isValidScope from '../helpers/is_valid_scope.js';
+import {
+  InvalidRequest,
+  InvalidScope,
+  InvalidTarget,
+  UnsupportedGrantType,
+} from '../helpers/errors.js';
 import noCache from '../shared/no_cache.js';
-import getClientAuth from '../shared/client_auth.js';
+import clientAuth, { getClientAuthParams } from '../shared/client_auth.js';
 import { urlencoded as parseBody } from '../shared/selective_body.js';
 import rejectDupes from '../shared/reject_dupes.js';
 import paramsMiddleware from '../shared/assemble_params.js';
+import checkRar from '../shared/check_rar.js';
 
 const grantTypeSet = new Set(['grant_type']);
 
-export default function tokenAction(provider) {
-  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
-  const { grantTypeParams } = instance(provider);
-
-  return [
-    noCache,
-    parseBody,
-    paramsMiddleware.bind(undefined, grantTypeParams.get(undefined)),
-    ...clientAuth,
-
-    rejectDupes.bind(undefined, { only: grantTypeSet }),
-
-    async function stripGrantIrrelevantParams(ctx, next) {
-      const grantParams = grantTypeParams.get(ctx.oidc.params.grant_type);
-      if (grantParams) {
-        Object.keys(ctx.oidc.params).forEach((key) => {
-          if (!(authParams.has(key) || grantParams.has(key))) {
-            delete ctx.oidc.params[key];
-          }
-        });
-      }
-      await next();
-    },
+export default [
+  noCache,
+  parseBody,
+  function assembleTokenParams(ctx, next) {
+    const { grantTypeParams } = instance(ctx.oidc.provider);
+    const allowList = new Set([
+      ...grantTypeParams.get(undefined),
+      ...getClientAuthParams(ctx),
+    ]);
+    return paramsMiddleware(allowList, ctx, next);
+  },
+  ...clientAuth,
 
-    async function supportedGrantTypeCheck(ctx, next) {
-      presence(ctx, 'grant_type');
+  rejectDupes.bind(undefined, { only: grantTypeSet }),
 
-      const supported = instance(provider).configuration.grantTypes;
+  async function stripGrantIrrelevantParams(ctx, next) {
+    const { grantTypeParams } = instance(ctx.oidc.provider);
+    const authParams = getClientAuthParams(ctx);
+    const grantParams = grantTypeParams.get(ctx.oidc.params.grant_type);
+    if (grantParams) {
+      Object.keys(ctx.oidc.params).forEach((key) => {
+        if (!(authParams.has(key) || grantParams.has(key))) {
+          delete ctx.oidc.params[key];
+        }
+      });
+    }
+    await next();
+  },
 
-      if (!supported.has(ctx.oidc.params.grant_type) || ctx.oidc.params.grant_type === 'implicit') {
-        throw new UnsupportedGrantType();
-      }
+  async function supportedGrantTypeCheck(ctx, next) {
+    presence(ctx, 'grant_type');
 
-      await next();
-    },
+    const supported = instance(ctx.oidc.provider).configuration.grantTypes;
 
-    async function allowedGrantTypeCheck(ctx, next) {
-      if (!ctx.oidc.client.grantTypeAllowed(ctx.oidc.params.grant_type)) {
-        throw new InvalidRequest('requested grant type is not allowed for this client');
-      }
+    if (!supported.has(ctx.oidc.params.grant_type) || ctx.oidc.params.grant_type === 'implicit') {
+      throw new UnsupportedGrantType();
+    }
+
+    await next();
+  },
+
+  async function allowedGrantTypeCheck(ctx, next) {
+    if (!ctx.oidc.client.grantTypeAllowed(ctx.oidc.params.grant_type)) {
+      throw new InvalidRequest('requested grant type is not allowed for this client');
+    }
+
+    await next();
+  },
 
-      await next();
-    },
+  async function rejectDupesOptionalExcept(ctx, next) {
+    const { grantTypeDupes } = instance(ctx.oidc.provider);
+    const grantType = ctx.oidc.params.grant_type;
+    if (grantTypeDupes.has(grantType)) {
+      return rejectDupes({ except: grantTypeDupes.get(grantType) }, ctx, next);
+    }
+    return rejectDupes({}, ctx, next);
+  },
 
-    async function rejectDupesOptionalExcept(ctx, next) {
-      const { grantTypeDupes } = instance(provider);
-      const grantType = ctx.oidc.params.grant_type;
-      if (grantTypeDupes.has(grantType)) {
-        return rejectDupes({ except: grantTypeDupes.get(grantType) }, ctx, next);
+  async function validateScope(ctx, next) {
+    if (!isValidScope(ctx.oidc.params.scope)) {
+      throw new InvalidScope('scope contains invalid characters');
+    }
+
+    return next();
+  },
+
+  checkRar,
+
+  async function ensureRarResource(ctx, next) {
+    if (ctx.oidc.params.authorization_details !== undefined) {
+      if (ctx.oidc.params.resource === undefined) {
+        const { defaultResource } = instance(ctx.oidc.provider).features.resourceIndicators;
+        ctx.oidc.params.resource = await defaultResource(ctx, ctx.oidc.client);
       }
-      return rejectDupes({}, ctx, next);
-    },
 
-    async function callTokenHandler(ctx) {
-      const grantType = ctx.oidc.params.grant_type;
+      if (
+        !ctx.oidc.params.resource
+        || (
+          Array.isArray(ctx.oidc.params.resource)
+          && ctx.oidc.params.resource.length === 0
+        )
+      ) {
+        throw new InvalidTarget(
+          'resource indicator must be provided or defaulted to when Rich Authorization Requests are used',
+        );
+      }
+    }
+
+    return next();
+  },
+
+  async function callTokenHandler(ctx) {
+    const grantType = ctx.oidc.params.grant_type;
 
-      const { grantTypeHandlers } = instance(provider);
+    const { grantTypeHandlers } = instance(ctx.oidc.provider);
 
-      await grantTypeHandlers.get(grantType)(ctx);
-      provider.emit('grant.success', ctx);
-    },
-  ];
-}
+    await grantTypeHandlers.get(grantType)(ctx);
+    ctx.oidc.provider.emit('grant.success', ctx);
+  },
+];

package/dist/node_modules/oidc-provider/lib/actions/userinfo.js

@@ -1,23 +1,32 @@
 import difference from '../helpers/_/difference.js';
-import bodyParser from '../shared/conditional_body.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
 import rejectDupes from '../shared/reject_dupes.js';
 import paramsMiddleware from '../shared/assemble_params.js';
 import noCache from '../shared/no_cache.js';
-import certificateThumbprint from '../helpers/certificate_thumbprint.js';
-import instance from '../helpers/weak_cache.js';
 import filterClaims from '../helpers/filter_claims.js';
-import dpopValidate, { CHALLENGE_OK_WINDOW } from '../helpers/validate_dpop.js';
-import epochTime from '../helpers/epoch_time.js';
-import { InvalidToken, InsufficientScope } from '../helpers/errors.js';
+import isValidScope from '../helpers/is_valid_scope.js';
+import { InvalidRequest, InvalidToken, InsufficientScope } from '../helpers/errors.js';
 import getCtxAccountClaims from '../helpers/account_claims.js';
 import getSetWWWAuthenticateHeader from '../shared/set_www_authenticate_header.js';
+import {
+  getValidateAccessToken,
+  loadAccessTokenAccount,
+  loadAccessTokenClient,
+  loadAccessTokenGrant,
+} from '../shared/access_token.js';
 
 const PARAM_LIST = new Set([
   'scope',
   'access_token',
 ]);
 
-const parseBody = bodyParser.bind(undefined, 'application/x-www-form-urlencoded');
+const validateAccessToken = getValidateAccessToken({
+  afterFind(_ctx, accessToken) {
+    if (!accessToken.scopes.size || !accessToken.scopes.has('openid')) {
+      throw new InsufficientScope('access token missing openid scope', 'openid');
+    }
+  },
+});
 
 export default [
   noCache,
@@ -28,54 +37,7 @@ export default [
   paramsMiddleware.bind(undefined, PARAM_LIST),
   rejectDupes.bind(undefined, {}),
 
-  async function validateAccessToken(ctx, next) {
-    const accessTokenValue = ctx.oidc.getAccessToken({ acceptDPoP: true });
-
-    const dPoP = await dpopValidate(ctx, accessTokenValue);
-
-    const accessToken = await ctx.oidc.provider.AccessToken.find(accessTokenValue);
-
-    ctx.assert(accessToken, new InvalidToken('access token not found'));
-
-    ctx.oidc.entity('AccessToken', accessToken);
-
-    const { scopes } = accessToken;
-    if (!scopes.size || !scopes.has('openid')) {
-      throw new InsufficientScope('access token missing openid scope', 'openid');
-    }
-
-    if (accessToken['x5t#S256']) {
-      const { getCertificate } = instance(ctx.oidc.provider).features.mTLS;
-      const cert = getCertificate(ctx);
-      if (!cert || accessToken['x5t#S256'] !== certificateThumbprint(cert)) {
-        throw new InvalidToken('failed x5t#S256 verification');
-      }
-    }
-
-    if (dPoP) {
-      const { allowReplay } = instance(ctx.oidc.provider).features.dPoP;
-
-      if (!allowReplay) {
-        const unique = await ctx.oidc.provider.ReplayDetection.unique(
-          accessToken.clientId,
-          dPoP.jti,
-          epochTime() + CHALLENGE_OK_WINDOW,
-        );
-
-        ctx.assert(unique, new InvalidToken('DPoP proof JWT Replay detected'));
-      }
-
-      if (!accessToken.jkt) {
-        throw new InvalidToken('access token is not sender-constrained but proof of possession was provided');
-      }
-    }
-
-    if (accessToken.jkt && (!dPoP || accessToken.jkt !== dPoP.thumbprint)) {
-      throw new InvalidToken('failed jkt verification');
-    }
-
-    await next();
-  },
+  validateAccessToken,
 
   function validateAudience(ctx, next) {
     const { oidc: { entities: { AccessToken: accessToken } } } = ctx;
@@ -89,6 +51,10 @@ export default [
 
   async function validateScope(ctx, next) {
     if (ctx.oidc.params.scope) {
+      if (!isValidScope(ctx.oidc.params.scope)) {
+        throw new InvalidRequest('scope contains invalid characters');
+      }
+
       const missing = difference(ctx.oidc.params.scope.split(' '), [...ctx.oidc.accessToken.scopes]);
 
       if (missing.length !== 0) {
@@ -98,53 +64,9 @@ export default [
     await next();
   },
 
-  async function loadClient(ctx, next) {
-    const client = await ctx.oidc.provider.Client.find(ctx.oidc.accessToken.clientId);
-    ctx.assert(client, new InvalidToken('associated client not found'));
-
-    ctx.oidc.entity('Client', client);
-
-    await next();
-  },
-
-  async function loadAccount(ctx, next) {
-    const account = await instance(ctx.oidc.provider).configuration.findAccount(
-      ctx,
-      ctx.oidc.accessToken.accountId,
-      ctx.oidc.accessToken,
-    );
-
-    ctx.assert(account, new InvalidToken('associated account not found'));
-    ctx.oidc.entity('Account', account);
-
-    await next();
-  },
-
-  async function loadGrant(ctx, next) {
-    const grant = await ctx.oidc.provider.Grant.find(ctx.oidc.accessToken.grantId, {
-      ignoreExpiration: true,
-    });
-
-    if (!grant) {
-      throw new InvalidToken('grant not found');
-    }
-
-    if (grant.isExpired) {
-      throw new InvalidToken('grant is expired');
-    }
-
-    if (grant.clientId !== ctx.oidc.accessToken.clientId) {
-      throw new InvalidToken('clientId mismatch');
-    }
-
-    if (grant.accountId !== ctx.oidc.accessToken.accountId) {
-      throw new InvalidToken('accountId mismatch');
-    }
-
-    ctx.oidc.entity('Grant', grant);
-
-    await next();
-  },
+  loadAccessTokenClient,
+  loadAccessTokenAccount,
+  loadAccessTokenGrant,
 
   async function respond(ctx) {
     const claims = filterClaims(ctx.oidc.accessToken.claims, 'userinfo', ctx.oidc.grant);

package/dist/node_modules/oidc-provider/lib/adapters/memory_adapter.js

@@ -1,8 +1,12 @@
-import QuickLRU from 'quick-lru';
+import LRU from '../helpers/lru.js';
 
 import epochTime from '../helpers/epoch_time.js';
 
-let storage = new QuickLRU({ maxSize: 1000 });
+function createStorage() {
+  return new LRU({ maxSize: 1000 });
+}
+
+let storage = createStorage();
 
 function grantKeyFor(id) {
   return `grant:${id}`;
@@ -22,11 +26,71 @@ const grantable = new Set([
   'RefreshToken',
   'DeviceCode',
   'BackchannelAuthenticationRequest',
+  'PreAuthorizedCode',
 ]);
 
+function storageOptions(expiresIn, clockTolerance) {
+  if (typeof expiresIn === 'number') {
+    return { maxAge: (expiresIn + clockTolerance) * 1000 };
+  }
+  return undefined;
+}
+
+function getGrantMembers(store, grantId) {
+  const stored = store.get(grantKeyFor(grantId));
+  if (stored instanceof Map) {
+    return stored;
+  }
+  return new Map([...stored ?? []].map((key) => [key, Infinity]));
+}
+
+function setGrantMembers(store, grantId, members) {
+  const now = Date.now();
+  for (const [key, expiresAt] of members) {
+    if (expiresAt <= now) {
+      members.delete(key);
+    }
+  }
+
+  const grantKey = grantKeyFor(grantId);
+  if (members.size === 0) {
+    store.delete(grantKey);
+    return;
+  }
+
+  const expiresAt = Math.max(...members.values());
+  const options = Number.isFinite(expiresAt) ? { maxAge: expiresAt - now } : undefined;
+  store.set(grantKey, members, options);
+}
+
+function removeSecondaryIndexes(store, id, payload) {
+  if (payload.uid && store.get(sessionUidKeyFor(payload.uid)) === id) {
+    store.delete(sessionUidKeyFor(payload.uid));
+  }
+  if (payload.userCode && store.get(userCodeKeyFor(payload.userCode)) === id) {
+    store.delete(userCodeKeyFor(payload.userCode));
+  }
+}
+
+function removeIndexes(store, model, id, key, payload) {
+  removeSecondaryIndexes(store, id, payload);
+
+  if (grantable.has(model) && payload.grantId) {
+    const members = getGrantMembers(store, payload.grantId);
+    members.delete(key);
+    setGrantMembers(store, payload.grantId, members);
+  }
+}
+
 class MemoryAdapter {
-  constructor(model) {
+  constructor(model, store, clockTolerance = 0) {
     this.model = model;
+    this.store = store;
+    this.clockTolerance = clockTolerance;
+  }
+
+  get storage() {
+    return this.store ?? storage;
   }
 
   key(id) {
@@ -35,61 +99,81 @@ class MemoryAdapter {
 
   async destroy(id) {
     const key = this.key(id);
-    storage.delete(key);
+    const payload = this.storage.get(key);
+    this.storage.delete(key);
+    if (payload) {
+      removeIndexes(this.storage, this.model, id, key, payload);
+    }
   }
 
   async consume(id) {
-    storage.get(this.key(id)).consumed = epochTime();
+    this.storage.get(this.key(id)).consumed = epochTime();
   }
 
   async find(id) {
-    return storage.get(this.key(id));
+    return this.storage.get(this.key(id));
   }
 
   async findByUid(uid) {
-    const id = storage.get(sessionUidKeyFor(uid));
+    const id = this.storage.get(sessionUidKeyFor(uid));
     return this.find(id);
   }
 
   async findByUserCode(userCode) {
-    const id = storage.get(userCodeKeyFor(userCode));
+    const id = this.storage.get(userCodeKeyFor(userCode));
     return this.find(id);
   }
 
   async upsert(id, payload, expiresIn) {
     const key = this.key(id);
+    const options = storageOptions(expiresIn, this.clockTolerance);
+    const previous = this.storage.get(key);
+
+    if (previous) {
+      removeIndexes(this.storage, this.model, id, key, previous);
+    }
 
     if (this.model === 'Session') {
-      storage.set(sessionUidKeyFor(payload.uid), id, expiresIn * 1000);
+      this.storage.set(sessionUidKeyFor(payload.uid), id, options);
     }
 
     const { grantId, userCode } = payload;
     if (grantable.has(this.model) && grantId) {
-      const grantKey = grantKeyFor(grantId);
-      const grant = storage.get(grantKey);
-      if (!grant) {
-        storage.set(grantKey, [key]);
-      } else {
-        grant.push(key);
-      }
+      const members = getGrantMembers(this.storage, grantId);
+      const expiresAt = typeof expiresIn === 'number'
+        ? Date.now() + ((expiresIn + this.clockTolerance) * 1000)
+        : Infinity;
+      members.set(key, expiresAt);
+      setGrantMembers(this.storage, grantId, members);
     }
 
     if (userCode) {
-      storage.set(userCodeKeyFor(userCode), id, expiresIn * 1000);
+      this.storage.set(userCodeKeyFor(userCode), id, options);
     }
 
-    storage.set(key, payload, expiresIn * 1000);
+    this.storage.set(key, payload, options);
   }
 
-  async revokeByGrantId(grantId) { // eslint-disable-line class-methods-use-this
+  async revokeByGrantId(grantId) {
     const grantKey = grantKeyFor(grantId);
-    const grant = storage.get(grantKey);
-    if (grant) {
-      grant.forEach((token) => storage.delete(token));
-      storage.delete(grantKey);
+    const members = getGrantMembers(this.storage, grantId);
+    if (members.size) {
+      for (const token of members.keys()) {
+        const payload = this.storage.get(token);
+        this.storage.delete(token);
+        if (payload) {
+          const id = payload.jti ?? token.slice(token.indexOf(':') + 1);
+          removeSecondaryIndexes(this.storage, id, payload);
+        }
+      }
+      this.storage.delete(grantKey);
     }
   }
 }
 
 export default MemoryAdapter;
+export function createMemoryAdapter(clockTolerance = 0) {
+  const store = createStorage();
+  return (model) => new MemoryAdapter(model, store, clockTolerance);
+}
 export function setStorage(store) { storage = store; }

package/dist/node_modules/oidc-provider/lib/consts/client_attributes.js

@@ -49,8 +49,8 @@ const DEFAULTS = {
 
 const REQUIRED = [
   'client_id',
-  // 'client_secret', => validated elsewhere and only needed somewhen
-  // 'redirect_uris', => validated elsewhere and handled elsewhere
+  
+  
 ];
 
 const BOOL = [
@@ -115,7 +115,7 @@ const STRING = [
   'userinfo_encrypted_response_enc',
   'userinfo_signed_response_alg',
 
-  // in arrays
+  
   'contacts',
   'default_acr_values',
   'grant_types',
@@ -164,8 +164,8 @@ const ENUM = {
 };
 
 export const noVSCHAR = /[^\x20-\x7E]/;
-// const noNQCHAR = /[^\x21\x23-\x5B\x5D-\x7E]/;
-// const noNQSCHAR = /[^\x20-\x21\x23-\x5B\x5D-\x7E]/;
+
+
 
 const SYNTAX = {
   client_id: noVSCHAR,

package/dist/node_modules/oidc-provider/lib/consts/jwa.js

@@ -13,13 +13,13 @@ if (version[0] > 24 || (version[0] === 24 && version[1] >= 7)) {
 }
 
 const encryptionAlgValues = [
-  // asymmetric
+  
   'RSA-OAEP',
   'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512',
   'ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW',
-  // symmetric
+  
   'A128GCMKW', 'A192GCMKW', 'A256GCMKW', 'A128KW', 'A192KW', 'A256KW',
-  // direct
+  
   'dir',
 ];
 

package/dist/node_modules/oidc-provider/lib/consts/param_list.js

@@ -1,6 +1,6 @@
 export default [
   'acr_values',
-  // 'claims', // added conditionally depending on feature flag
+  
   'claims_locales',
   'client_id',
   'code_challenge',

package/dist/node_modules/oidc-provider/lib/helpers/_/defaults.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-continue, no-param-reassign */
-
 import isPlainObject from './is_plain_object.js';
 
 function defaults(deep, target, ...sources) {

package/dist/node_modules/oidc-provider/lib/helpers/_/is_json_object.js

@@ -0,0 +1 @@
+export default (value) => value !== null && typeof value === 'object' && !Array.isArray(value);

package/dist/node_modules/oidc-provider/lib/helpers/_/merge.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-param-reassign, no-continue */
-
 import isPlainObject from './is_plain_object.js';
 
 function merge(target, ...sources) {

package/dist/node_modules/oidc-provider/lib/helpers/_/omit_by.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-param-reassign */
-
 export default (object, predicate) => {
   Object.entries(object).forEach(([key, value]) => {
     if (predicate(value, key)) {

package/dist/node_modules/oidc-provider/lib/helpers/_/pick.js

@@ -1,7 +1,7 @@
 export default (object = {}, ...properties) => {
   const result = {};
   properties.forEach((property) => {
-    if (Object.prototype.hasOwnProperty.call(object, property)) {
+    if (Object.hasOwn(object, property)) {
       result[property] = object[property];
     }
   });

package/dist/node_modules/oidc-provider/lib/helpers/_/remove.js

@@ -5,5 +5,5 @@ export default (array, predicate) => {
       remove.unshift(index);
     }
   });
-  remove.forEach((i) => array.splice(i, 1));
+  remove.forEach((i) => { array.splice(i, 1); });
 };

package/dist/node_modules/oidc-provider/lib/helpers/add_client.js

@@ -1,4 +1,3 @@
-/* eslint-disable no-param-reassign */
 import sectorValidate from './sector_validate.js';
 
 export default async function add(provider, metadata, { ctx, store, cimd } = {}) {

package/dist/node_modules/oidc-provider/lib/helpers/assert_provider_context.js

@@ -0,0 +1,5 @@
+export default function assertProviderContext(provider, ctx) {
+  if (ctx?.oidc?.provider !== provider) {
+    throw new TypeError('provider does not match ctx.oidc.provider');
+  }
+}

package/dist/node_modules/oidc-provider/lib/helpers/attention.js

@@ -14,10 +14,10 @@ if (globalThis.process?.stderr?.isTTY) {
 
 export function info(str) {
   const notice = `oidc-provider NOTICE: ${str}`;
-  console.info(stdout ? stdout(notice) : notice); // eslint-disable-line no-console
+  console.info(stdout ? stdout(notice) : notice);
 }
 
 export function warn(str) {
   const warning = `oidc-provider WARNING: ${str}`;
-  console.warn(stderr ? stderr(warning) : warning); // eslint-disable-line no-console
+  console.warn(stderr ? stderr(warning) : warning);
 }