@nocobase/plugin-idp-oauth 2.2.17 → 2.2.18

package/dist/node_modules/oidc-provider/lib/provider.js

@@ -1,7 +1,7 @@
 import { strict as assert } from 'node:assert';
 import * as util from 'node:util';
 
-import QuickLRU from 'quick-lru';
+import LRU from './helpers/lru.js';
 import Koa from 'koa';
 
 import Configuration from './helpers/configuration.js';
@@ -20,6 +20,12 @@ import * as models from './models/index.js';
 import ServerChallenge from './helpers/challenge.js';
 import als from './helpers/als.js';
 
+const featuresDescriptor = {
+  enumerable: true,
+  configurable: true,
+  get() { return this.configuration.features; },
+};
+
 export class Provider extends Koa {
   #AccessToken;
 
@@ -49,6 +55,8 @@ export class Provider extends Koa {
 
   #OIDCContext;
 
+  #PreAuthorizedCode;
+
   #PushedAuthorizationRequest;
 
   #RefreshToken;
@@ -61,9 +69,18 @@ export class Provider extends Koa {
 
   #exec;
 
-  #int = {
-    dynamicClients: new QuickLRU({ maxSize: 100 }),
-  };
+  #int = Object.defineProperty({
+    dynamicClients: new LRU({ maxSize: 100 }),
+  }, 'features', featuresDescriptor);
+
+  static {
+    instance.setReader((provider) => {
+      if (provider === null || (typeof provider !== 'object' && typeof provider !== 'function')) {
+        return undefined;
+      }
+      return #int in provider ? provider.#int : undefined;
+    });
+  }
 
   constructor(issuer, setup) {
     assert(issuer, 'first argument must be the Issuer Identifier, i.e. https://op.example.com');
@@ -83,10 +100,8 @@ export class Provider extends Koa {
     this.issuer = issuer;
 
     const configuration = new Configuration(setup);
-    instance.set(this, this.#int);
 
     this.#int.configuration = configuration;
-    this.#int.features = configuration.features;
 
     if (Array.isArray(configuration.cookies.keys)) {
       if (configuration.cookies.keys.length) {
@@ -118,6 +133,17 @@ export class Provider extends Koa {
       }
     }
 
+    if (configuration.features.openid4vci.enabled) {
+      try {
+        this.#int.CNonceChallenges = new ServerChallenge(
+          configuration.features.openid4vci.nonceSecret,
+          'OpenID4VCI c_nonce',
+        );
+      } catch (cause) {
+        throw new TypeError('features.openid4vci.nonceSecret secret must be a 32-byte Buffer instance', { cause });
+      }
+    }
+
     this.#int.responseModes = new Map();
     this.#int.grantTypeHandlers = new Map();
     this.#int.grantTypeDupes = new Map();
@@ -191,10 +217,10 @@ export class Provider extends Koa {
     return [mountPath, routerUrl].join('');
   }
 
-  /**
-   * @name interactionResult
-   * @api public
-   */
+  
+
+
+
   async interactionResult(req, res, result, { mergeWithLastSubmission = true } = {}) {
     const interaction = await this.#getInteraction.call(this, req, res);
 
@@ -209,23 +235,23 @@ export class Provider extends Koa {
     return interaction.returnTo;
   }
 
-  /**
-   * @name interactionFinished
-   * @api public
-   */
+  
+
+
+
   async interactionFinished(req, res, result, { mergeWithLastSubmission = true } = {}) {
     const returnTo = await this.interactionResult(req, res, result, { mergeWithLastSubmission });
 
-    res.statusCode = 303; // eslint-disable-line no-param-reassign
+    res.statusCode = 303;
     res.setHeader('Location', returnTo);
     res.setHeader('Content-Length', '0');
     res.end();
   }
 
-  /**
-   * @name interactionDetails
-   * @api public
-   */
+  
+
+
+
   async interactionDetails(req, res) {
     return this.#getInteraction.call(this, req, res);
   }
@@ -240,7 +266,6 @@ export class Provider extends Koa {
     rar,
   } = {}) {
     if (typeof request === 'string' && request) {
-      // eslint-disable-next-line no-param-reassign
       request = await this.BackchannelAuthenticationRequest.find(request, {
         ignoreExpiration: true,
       });
@@ -257,7 +282,6 @@ export class Provider extends Koa {
     }
 
     if (typeof result === 'string' && result) {
-      // eslint-disable-next-line no-param-reassign
       result = await this.Grant.find(result);
       if (!result) {
         throw new Error('Grant not found');
@@ -382,6 +406,11 @@ export class Provider extends Koa {
     return this.#BackchannelAuthenticationRequest;
   }
 
+  get PreAuthorizedCode() {
+    this.#PreAuthorizedCode ||= models.getPreAuthorizedCode(this);
+    return this.#PreAuthorizedCode;
+  }
+
   get PushedAuthorizationRequest() {
     this.#PushedAuthorizationRequest ||= models.getPushedAuthorizationRequest(this);
     return this.#PushedAuthorizationRequest;
@@ -392,7 +421,6 @@ export class Provider extends Koa {
     return this.#ReplayDetection;
   }
 
-  // eslint-disable-next-line class-methods-use-this
   get ResourceServer() { return ResourceServer; }
 
   async #getInteraction(req, res) {
@@ -428,7 +456,6 @@ export class Provider extends Koa {
     return this;
   }
 
-  // eslint-disable-next-line class-methods-use-this
   get [Symbol.toStringTag]() {
     return 'Provider';
   }

package/dist/node_modules/oidc-provider/lib/response_modes/index.js

@@ -1,5 +1,3 @@
-/* eslint-disable camelcase */
-
 import form_post from './form_post.js';
 import fragment from './fragment.js';
 import query from './query.js';

package/dist/node_modules/oidc-provider/lib/response_modes/jwt.js

@@ -1,4 +1,3 @@
-/* eslint-disable camelcase */
 import query from './query.js';
 import fragment from './fragment.js';
 import form_post from './form_post.js';

package/dist/node_modules/oidc-provider/lib/response_modes/web_message.js

@@ -1,9 +1,18 @@
-import jsesc from 'jsesc';
-
 import pushInlineSha from '../helpers/script_src_sha.js';
 
 const statusCodes = new Set([200, 400, 500]);
 
+
+
+
+
+
+
+
+
+const SCRIPT_UNSAFE = /[<>&\u2028\u2029]/g;
+const escapeScriptContext = (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, '0').toUpperCase()}`;
+
 export default function webMessage(ctx, redirectUri, response) {
   ctx.type = 'html';
 
@@ -19,15 +28,16 @@ export default function webMessage(ctx, redirectUri, response) {
       .join(';'));
   }
 
-  const data = jsesc({
+  const data = JSON.stringify({
     response,
     redirect_uri: redirectUri,
-  }, { json: true, isScriptContext: true });
+  }).replace(SCRIPT_UNSAFE, escapeScriptContext);
 
   ctx.body = `<!DOCTYPE html>
 <html>
 <head>
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <meta charset="utf-8">
   <title>Web Message Response</title>
 </head>
 <body>

package/dist/node_modules/oidc-provider/lib/shared/access_token.js

@@ -0,0 +1,85 @@
+import certificateThumbprint from '../helpers/certificate_thumbprint.js';
+import { account as validateAccount } from '../helpers/configuration_result.js';
+import { InvalidToken } from '../helpers/errors.js';
+import dpopValidate, { checkDpopReplay } from '../helpers/validate_dpop.js';
+import instance from '../helpers/weak_cache.js';
+
+export function getValidateAccessToken({ afterFind } = {}) {
+  return async function validateAccessToken(ctx, next) {
+    const value = ctx.oidc.getAccessToken({ acceptDPoP: true });
+    const dPoP = await dpopValidate(ctx.oidc.provider, ctx, value);
+    const accessToken = await ctx.oidc.provider.AccessToken.find(value);
+
+    ctx.assert(accessToken, new InvalidToken('access token not found'));
+    ctx.oidc.entity('AccessToken', accessToken);
+
+    await afterFind?.(ctx, accessToken);
+
+    if (accessToken['x5t#S256']) {
+      const { getCertificate } = instance(ctx.oidc.provider).features.mTLS;
+      const cert = getCertificate(ctx);
+      if (!cert || accessToken['x5t#S256'] !== certificateThumbprint(cert)) {
+        throw new InvalidToken('failed x5t#S256 verification');
+      }
+    }
+
+    await checkDpopReplay(ctx.oidc.provider, ctx, dPoP, accessToken.clientId, InvalidToken);
+
+    if (dPoP && !accessToken.jkt) {
+      throw new InvalidToken(
+        'access token is not sender-constrained but proof of possession was provided',
+      );
+    }
+
+    if (accessToken.jkt && (!dPoP || accessToken.jkt !== dPoP.thumbprint)) {
+      throw new InvalidToken('failed jkt verification');
+    }
+
+    await next();
+  };
+}
+
+export async function loadAccessTokenClient(ctx, next) {
+  const client = await ctx.oidc.provider.Client.find(ctx.oidc.accessToken.clientId);
+  ctx.assert(client, new InvalidToken('associated client not found'));
+  ctx.oidc.entity('Client', client);
+  await next();
+}
+
+export async function loadAccessTokenAccount(ctx, next) {
+  const account = validateAccount(
+    await instance(ctx.oidc.provider).configuration.findAccount(
+      ctx,
+      ctx.oidc.accessToken.accountId,
+      ctx.oidc.accessToken,
+    ),
+  );
+  ctx.assert(account, new InvalidToken('associated account not found'));
+  ctx.oidc.entity('Account', account);
+  await next();
+}
+
+export async function loadAccessTokenGrant(ctx, next) {
+  const grant = await ctx.oidc.provider.Grant.find(ctx.oidc.accessToken.grantId, {
+    ignoreExpiration: true,
+  });
+
+  if (!grant) {
+    throw new InvalidToken('grant not found');
+  }
+
+  if (grant.isExpired) {
+    throw new InvalidToken('grant is expired');
+  }
+
+  if (grant.clientId !== ctx.oidc.accessToken.clientId) {
+    throw new InvalidToken('clientId mismatch');
+  }
+
+  if (grant.accountId !== ctx.oidc.accessToken.accountId) {
+    throw new InvalidToken('accountId mismatch');
+  }
+
+  ctx.oidc.entity('Grant', grant);
+  await next();
+}

package/dist/node_modules/oidc-provider/lib/shared/assemble_params.js

@@ -2,6 +2,6 @@ import Params from '../helpers/params.js';
 
 export default function assembleParams(allowList, ctx, next) {
   const params = ctx.method === 'POST' ? ctx.oidc.body : ctx.query;
-  ctx.oidc.params = new (Params(allowList))(params);
+  ctx.oidc.params = new Params(allowList, params);
   return next();
 }

package/dist/node_modules/oidc-provider/lib/shared/attest_client_auth.js

@@ -1,11 +1,19 @@
 import * as jose from 'jose';
 
-import { InvalidClientAuth, UseAttestationChallenge } from '../helpers/errors.js';
+import { InvalidClientAuth, InvalidClientAttestation, UseAttestationChallenge } from '../helpers/errors.js';
 import instance from '../helpers/weak_cache.js';
 import { CHALLENGE_OK_WINDOW } from '../helpers/challenge.js';
 import epochTime from '../helpers/epoch_time.js';
 
-export default async function attestationClientAuth(ctx) {
+function invalid(ErrorClass, options) {
+  if (ErrorClass === InvalidClientAuth) {
+    return new ErrorClass(options);
+  }
+
+  return new ErrorClass(undefined, options);
+}
+
+export async function validateClientAttestationJwtAndPop(ctx, { signal = false } = {}) {
   const {
     configuration: {
       clockTolerance,
@@ -15,29 +23,31 @@ export default async function attestationClientAuth(ctx) {
     AttestChallenges,
   } = instance(ctx.oidc.provider);
 
+  const ErrorClass = signal ? InvalidClientAttestation : InvalidClientAuth;
   const nextChallenge = AttestChallenges.nextChallenge();
 
   const attestation = ctx.get('oauth-client-attestation');
+  if (!attestation) {
+    throw invalid(ErrorClass, 'oauth-client-attestation missing');
+  }
+
   let verifiedAttestation;
   try {
     verifiedAttestation = await jose.jwtVerify(
       attestation,
       async (header) => {
         const payload = jose.decodeJwt(attestation);
-        if (typeof payload.iss !== 'string') {
-          throw new Error('iss must be a string');
-        }
         const key = await attestClientAuth.getAttestationSignaturePublicKey(
           ctx,
-          payload.iss,
           header,
+          payload,
           ctx.oidc.client,
         );
         return key;
       },
       {
         algorithms: attestSigningAlgValues,
-        requiredClaims: ['iss', 'sub', 'exp', 'cnf'],
+        requiredClaims: ['sub', 'exp', 'cnf'],
         typ: 'oauth-client-attestation+jwt',
         clockTolerance,
         subject: ctx.oidc.client.clientId,
@@ -54,13 +64,13 @@ export default async function attestationClientAuth(ctx) {
     ) {
       throw new Error('invalid cnf.jwk');
     }
-  } catch (err) {
-    throw new InvalidClientAuth(`failed to validate oauth-client-attestation: ${err.message}`);
+  } catch (cause) {
+    throw invalid(ErrorClass, { cause });
   }
 
   const pop = ctx.get('oauth-client-attestation-pop');
   if (!pop) {
-    throw new InvalidClientAuth('oauth-client-attestation-pop missing');
+    throw invalid(ErrorClass, 'oauth-client-attestation-pop missing');
   }
   let verifiedPoP;
   try {
@@ -69,18 +79,20 @@ export default async function attestationClientAuth(ctx) {
       async (header) => jose.importJWK(verifiedAttestation.payload.cnf.jwk, header.alg),
       {
         algorithms: attestSigningAlgValues,
-        requiredClaims: ['iss', 'aud', 'jti'], // challenge is checked later
+        requiredClaims: ['aud', 'jti', 'iat'], 
         typ: 'oauth-client-attestation-pop+jwt',
         clockTolerance,
-        issuer: ctx.oidc.client.clientId,
         audience: ctx.oidc.issuer,
       },
     );
     if (typeof verifiedPoP.payload.aud !== 'string') {
       throw new Error('aud must be a string');
     }
-  } catch (err) {
-    throw new InvalidClientAuth(`failed to validate oauth-client-attestation-pop: ${err.message}`);
+    if (typeof verifiedPoP.payload.jti !== 'string' || !verifiedPoP.payload.jti) {
+      throw new Error('jti must be a non-empty string');
+    }
+  } catch (cause) {
+    throw invalid(ErrorClass, { cause });
   }
 
   await attestClientAuth.assertAttestationJwtAndPop(
@@ -91,13 +103,13 @@ export default async function attestationClientAuth(ctx) {
   );
 
   const unique = await ctx.oidc.provider.ReplayDetection.unique(
-    verifiedPoP.payload.iss,
+    ctx.oidc.client.clientId,
     verifiedPoP.payload.jti,
     epochTime() + CHALLENGE_OK_WINDOW,
   );
 
   if (!unique) {
-    throw new InvalidClientAuth('oauth-client-attestation-pop tokens must only be used once');
+    throw invalid(ErrorClass, 'oauth-client-attestation-pop tokens must only be used once');
   }
 
   if (typeof verifiedPoP.payload.challenge !== 'string' || !AttestChallenges.checkChallenge(verifiedPoP.payload.challenge)) {
@@ -108,4 +120,15 @@ export default async function attestationClientAuth(ctx) {
   if (verifiedPoP.payload.challenge !== nextChallenge) {
     ctx.set('oauth-client-attestation-challenge', nextChallenge);
   }
+
+  ctx.oidc.clientAttestation = {
+    method: 'attestation_pop_jwt',
+    signal,
+    attestation: verifiedAttestation,
+    pop: verifiedPoP,
+  };
+}
+
+export default function attestationClientAuth(ctx) {
+  return validateClientAttestationJwtAndPop(ctx);
 }

package/dist/node_modules/oidc-provider/lib/shared/authorization_error_handler.js

@@ -1,104 +1,106 @@
 import debug from 'debug';
 
 import { InvalidRedirectUri } from '../helpers/errors.js';
+import omitBy from '../helpers/_/omit_by.js';
 import instance from '../helpers/weak_cache.js';
 import errOut from '../helpers/err_out.js';
 import resolveResponseMode from '../helpers/resolve_response_mode.js';
-import oneRedirectUriClients from '../actions/authorization/one_redirect_uri_clients.js';
+import { oneRedirectUriClients } from '../actions/authorization/response_parameters.js';
 
 const debugError = debug('oidc-provider:authentication:error');
 const serverError = debug('oidc-provider:server_error');
 const serverErrorTrace = debug('oidc-provider:server_error:trace');
 
-export default (provider) => {
-  const AD_ACTA_CHECKS = Object.entries({
-    redirect_uri: {
-      Err: InvalidRedirectUri,
-      method: 'redirectUriAllowed',
-      check: 'redirectUriCheckPerformed',
-      recovery: oneRedirectUriClients,
-    },
-  });
+const AD_ACTA_CHECKS = Object.entries({
+  redirect_uri: {
+    Err: InvalidRedirectUri,
+    method: 'redirectUriAllowed',
+    check: 'redirectUriCheckPerformed',
+    recovery: oneRedirectUriClients,
+  },
+});
 
-  function getOutAndEmit(ctx, err, state) {
-    const out = { ...errOut(err, state), iss: ctx.oidc.provider.issuer };
+function getOutAndEmit(ctx, err, state) {
+  const { provider } = ctx.oidc;
+  const out = { ...errOut(err, state), iss: ctx.oidc.provider.issuer };
 
-    if (err.expose) {
-      provider.emit('authorization.error', ctx, err);
-      debugError('%o', out);
-    } else {
-      provider.emit('server_error', ctx, err);
-      serverError('path=%s method=%s error=%o', ctx.path, ctx.method, err);
-      serverErrorTrace(err);
-    }
-
-    return out;
+  if (err.expose) {
+    provider.emit('authorization.error', ctx, err);
+    debugError('%o', out);
+  } else {
+    provider.emit('server_error', ctx, err);
+    serverError('path=%s method=%s error=%o', ctx.path, ctx.method, err);
+    serverErrorTrace(err);
   }
 
-  function safe(param) {
-    if (param && typeof param === 'string') {
-      return param;
-    }
-    return undefined;
+  return out;
+}
+
+function safe(param) {
+  if (param && typeof param === 'string') {
+    return param;
   }
+  return undefined;
+}
 
-  return async function authorizationErrorHandler(ctx, next) {
-    try {
-      await next();
-    } catch (caught) {
-      let err = caught;
-      ctx.status = err.statusCode || 500;
-      const { oidc } = ctx;
+export default async function authorizationErrorHandler(ctx, next) {
+  const { provider } = ctx.oidc;
+  try {
+    await next();
+  } catch (caught) {
+    let err = caught;
+    ctx.status = err.statusCode || 500;
+    const { oidc } = ctx;
 
-      const { params = (ctx.method === 'POST' ? oidc.body : ctx.query) || {} } = oidc;
+    const { params = (ctx.method === 'POST' ? oidc.body : ctx.query) || {} } = oidc;
 
-      if (!oidc.client && safe(params.client_id) && !ctx.oidc.noclient) {
-        try {
-          oidc.entity('Client', await provider.Client.find(safe(params.client_id)));
-        } catch (e) {}
-      }
+    if (!oidc.client && safe(params.client_id) && !ctx.oidc.noclient) {
+      try {
+        oidc.entity('Client', await provider.Client.find(safe(params.client_id)));
+      } catch {}
+    }
 
-      for (const [param, {
-        Err, check, flag, method, recovery,
-      }] of AD_ACTA_CHECKS) {
-        if (
-          (!flag || instance(provider).configuration[flag])
-          && !(err instanceof Err) && oidc.client
-          && !oidc[check]
-        ) {
-          if (recovery && !safe(params[param])) {
-            recovery(ctx, () => {});
-          }
+    for (const [param, {
+      Err, check, flag, method, recovery,
+    }] of AD_ACTA_CHECKS) {
+      if (
+        (!flag || instance(provider).configuration[flag])
+        && !(err instanceof Err) && oidc.client
+        && !oidc[check]
+      ) {
+        if (recovery && !safe(params[param])) {
+          recovery(ctx, () => {});
+        }
 
-          if (safe(params[param]) && !oidc.client[method](params[param])) {
-            getOutAndEmit(ctx, caught, safe(params.state));
-            err = new Err();
-            ctx.status = err.statusCode;
-            break;
-          }
+        if (safe(params[param]) && !oidc.client[method](params[param])) {
+          getOutAndEmit(ctx, caught, safe(params.state));
+          err = new Err();
+          ctx.status = err.statusCode;
+          break;
         }
       }
+    }
 
-      const out = getOutAndEmit(ctx, err, safe(params.state));
+    const out = getOutAndEmit(ctx, err, safe(params.state));
 
-      // in case redirect_uri or client could not be verified no successful
-      // response should happen, render instead
-      if (
-        !safe(params.client_id)
-        || (safe(params.client_id) && !oidc.client)
-        || !safe(params.redirect_uri)
-        || !err.allow_redirect
-      ) {
-        const { renderError } = instance(provider).configuration;
-        await renderError(ctx, out, err);
-      } else {
-        let mode = safe(params.response_mode);
-        if (!instance(provider).responseModes.has(mode)) {
-          mode = resolveResponseMode(safe(params.response_type));
-        }
-        const handler = instance(provider).responseModes.get(mode);
-        await handler(ctx, safe(params.redirect_uri), out);
+    
+    
+    if (
+      !safe(params.client_id)
+      || (safe(params.client_id) && !oidc.client)
+      || !safe(params.redirect_uri)
+      || !err.allow_redirect
+    ) {
+      const { renderError } = instance(provider).configuration;
+      await renderError(ctx, out, err);
+    } else {
+      let mode = safe(params.response_mode);
+      if (!instance(provider).responseModes.has(mode)) {
+        mode = resolveResponseMode(safe(params.response_type));
       }
+      const handler = instance(provider).responseModes.get(mode);
+      
+      await handler(ctx, safe(params.redirect_uri), omitBy(out, (value) => value === undefined));
     }
-  };
-};
+  }
+}