@nocobase/plugin-idp-oauth 2.2.17 → 2.2.18

package/dist/node_modules/oidc-provider/lib/actions/authorization/index.js

@@ -1,58 +1,59 @@
+import { strict as assert } from 'node:assert';
+
 import noCache from '../../shared/no_cache.js';
-import bodyParser from '../../shared/conditional_body.js';
-import rejectDupes from '../../shared/reject_dupes.js';
+import { urlencoded as parseBody } from '../../shared/selective_body.js';
 import paramsMiddleware from '../../shared/assemble_params.js';
 import sessionMiddleware from '../../shared/session.js';
-import instance from '../../helpers/weak_cache.js';
-import { PARAM_LIST } from '../../consts/index.js';
 import checkRar from '../../shared/check_rar.js';
 import checkResource from '../../shared/check_resource.js';
-import getClientAuth from '../../shared/client_auth.js';
+import clientAuth, { getClientAuthParams } from '../../shared/client_auth.js';
 
-import checkClient from './check_client.js';
-import checkResponseMode from './check_response_mode.js';
-import rejectUnsupported from './reject_unsupported.js';
-import rejectRegistration from './reject_registration.js';
-import oauthRequired from './oauth_required.js';
-import oneRedirectUriClients from './one_redirect_uri_clients.js';
-import loadPushedAuthorizationRequest from './load_pushed_authorization_request.js';
-import processRequestObject from './process_request_object.js';
-import oidcRequired from './oidc_required.js';
-import cibaRequired from './ciba_required.js';
-import checkPrompt from './check_prompt.js';
-import checkMaxAge from './check_max_age.js';
-import checkIdTokenHint from './check_id_token_hint.js';
-import checkScope from './check_scope.js';
-import checkResponseType from './check_response_type.js';
-import checkRedirectUri from './check_redirect_uri.js';
-import assignDefaults from './assign_defaults.js';
-import checkClaims from './check_claims.js';
-import assignClaims from './assign_claims.js';
-import loadAccount from './load_account.js';
-import loadGrant from './load_grant.js';
-import interactions from './interactions.js';
+import processRequestObject, { stripOutsideJarParams } from './process_request_object.js';
+import interactions, { interactionEmit } from './interactions.js';
 import respond from './respond.js';
-import checkPKCE from './check_pkce.js';
-import interactionEmit from './interaction_emit.js';
 import getResume from './resume.js';
-import checkClientGrantType from './check_client_grant_type.js';
-import checkOpenidScope from './check_openid_scope.js';
-import deviceAuthorizationResponse from './device_authorization_response.js';
-import authenticatedClientId from './authenticated_client_id.js';
-import deviceUserFlow from './device_user_flow.js';
-import deviceUserFlowErrors from './device_user_flow_errors.js';
-import deviceUserFlowResponse from './device_user_flow_response.js';
-import pushedAuthorizationRequestRemapErrors from './pushed_authorization_request_remap_errors.js';
-import backchannelRequestRemapErrors from './backchannel_request_remap_errors.js';
-import stripOutsideJarParams from './strip_outside_jar_params.js';
-import pushedAuthorizationRequestResponse from './pushed_authorization_request_response.js';
-import cibaLoadAccount from './ciba_load_account.js';
-import checkRequestedExpiry from './check_requested_expiry.js';
-import backchannelRequestResponse from './backchannel_request_response.js';
-import checkCibaContext from './check_ciba_context.js';
-import checkDpopJkt from './check_dpop_jkt.js';
-import checkExtraParams from './check_extra_params.js';
-import unsupportedRar from './unsupported_rar.js';
+import { checkClient, checkClientGrantType, authenticatedClientId } from './client.js';
+import {
+  checkResponseMode,
+  oauthRequired,
+  oneRedirectUriClients,
+  oidcRequired,
+  checkResponseType,
+  checkRedirectUri,
+} from './response_parameters.js';
+import {
+  assembleAuthorizationParams,
+  rejectAuthorizationDupes,
+  rejectUnsupported,
+  rejectRegistration,
+  checkPrompt,
+  checkMaxAge,
+  assignDefaults,
+  checkExtraParams,
+} from './request_parameters.js';
+import {
+  loadPushedAuthorizationRequest,
+  pushedAuthorizationRequestRemapErrors,
+  pushedAuthorizationRequestResponse,
+} from './pushed_authorization_requests.js';
+import {
+  cibaRequired,
+  backchannelRequestRemapErrors,
+  cibaLoadAccount,
+  checkRequestedExpiry,
+  backchannelRequestResponse,
+  checkCibaContext,
+} from './ciba.js';
+import { checkIdTokenHint, checkClaims, assignClaims } from './claims.js';
+import { checkScope, checkOpenidScope } from './scopes.js';
+import { loadAccount, loadGrant } from './session.js';
+import { checkPKCE, checkDpopJkt } from './sender_constraints.js';
+import {
+  deviceAuthorizationResponse,
+  deviceUserFlow,
+  deviceUserFlowErrors,
+  deviceUserFlowResponse,
+} from './device.js';
 
 const A = 'authorization';
 const R = 'resume';
@@ -64,137 +65,85 @@ const BA = 'backchannel_authentication';
 
 const authRequired = new Set([DA, PAR, BA]);
 
-const parseBody = bodyParser.bind(undefined, 'application/x-www-form-urlencoded');
-
-export default function authorizationAction(provider, endpoint) {
-  const {
-    features: {
-      claimsParameter,
-      dPoP,
-      resourceIndicators,
-      richAuthorizationRequests,
-      webMessageResponseMode,
-    },
-    extraParams,
-  } = instance(provider).configuration;
-
-  const allowList = new Set(PARAM_LIST);
-
-  if (webMessageResponseMode.enabled) {
-    allowList.add('web_message_uri'); // adding it just so that it can be rejected when detected
-  }
-
-  if (claimsParameter.enabled) {
-    allowList.add('claims');
-  }
-
-  let rejectDupesMiddleware = rejectDupes.bind(undefined, {});
-  if (resourceIndicators.enabled) {
-    allowList.add('resource');
-    rejectDupesMiddleware = rejectDupes.bind(undefined, { except: new Set(['resource']) });
-  }
-
-  if (richAuthorizationRequests.enabled) {
-    allowList.add('authorization_details');
-  }
-
-  extraParams.forEach(Set.prototype.add.bind(allowList));
+function assembleClientAuthParams(ctx, next) {
+  return paramsMiddleware(getClientAuthParams(ctx), ctx, next);
+}
 
-  if ([DA, CV, DR, BA].includes(endpoint)) {
-    allowList.delete('web_message_uri');
-    allowList.delete('response_type');
-    allowList.delete('response_mode');
-    allowList.delete('code_challenge_method');
-    allowList.delete('code_challenge');
-    allowList.delete('state');
-    allowList.delete('redirect_uri');
-    allowList.delete('prompt');
-  }
+const stacks = new Map([A, R, DA, CV, DR, PAR, BA].map((endpoint) => [endpoint, undefined]));
 
-  if (endpoint === BA) {
-    allowList.add('client_notification_token');
-    allowList.add('login_hint_token');
-    allowList.add('binding_message');
-    allowList.add('user_code');
-    allowList.add('request_context');
-    allowList.add('requested_expiry');
-  }
+export default function authorizationAction(endpoint) {
+  assert(stacks.has(endpoint), 'invalid authorization endpoint');
 
-  if (dPoP && [A, R, PAR].includes(endpoint)) {
-    allowList.add('dpop_jkt');
+  const cached = stacks.get(endpoint);
+  if (cached) {
+    return cached;
   }
 
   const stack = [];
 
   const use = (middleware, ...only) => {
     if (only.includes(endpoint)) {
-      stack.push(middleware());
+      stack.push(middleware);
     }
   };
-  const returnTo = /^(code|device)_/.test(endpoint) ? 'device_resume' : 'resume';
 
-  /* eslint-disable no-multi-spaces, space-in-parens, function-paren-newline */
-  use(() => noCache,                                        A, DA, R, CV, DR, PAR, BA);
-  use(() => sessionMiddleware,                              A,     R,     DR         );
-  use(() => deviceUserFlowErrors,                                     CV, DR         );
-  use(() => getResume.bind(undefined, allowList, returnTo),        R,     DR         );
-  use(() => deviceUserFlow.bind(undefined, allowList),                CV, DR         );
-  use(() => parseBody,                                      A, DA,            PAR, BA);
+  use(noCache,                               A, DA, R, CV, DR, PAR, BA);
+  use(sessionMiddleware,                     A,     R,     DR         );
+  use(deviceUserFlowErrors,                            CV, DR         );
+  use(getResume,                                    R,     DR         );
+  use(deviceUserFlow,                                  CV, DR         );
+  use(parseBody,                             A, DA,            PAR, BA);
   if (authRequired.has(endpoint)) {
-    const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
-    use(() => paramsMiddleware.bind(undefined, authParams),    DA,            PAR, BA);
+    use(assembleClientAuthParams,               DA,            PAR, BA);
     for (const clientAuthMiddlware of clientAuth) {
-      use(() => clientAuthMiddlware,                           DA,            PAR, BA);
+      use(clientAuthMiddlware,                  DA,            PAR, BA);
     }
   }
-  use(() => authenticatedClientId,                             DA,                 BA);
-  use(() => paramsMiddleware.bind(undefined, allowList),    A, DA,            PAR, BA);
-  use(() => rejectDupesMiddleware,                          A, DA,            PAR, BA);
-  use(() => rejectUnsupported,                              A, DA,            PAR, BA);
-  use(() => stripOutsideJarParams,                                            PAR, BA);
-  use(() => checkClient,                                    A, DA, R, CV, DR         );
-  use(() => checkClientGrantType,                              DA,                 BA);
-  use(() => pushedAuthorizationRequestRemapErrors,                            PAR    );
-  use(() => backchannelRequestRemapErrors,                                         BA);
-  use(() => loadPushedAuthorizationRequest,                 A                        );
-  use(() => processRequestObject.bind(
-    undefined, allowList, rejectDupesMiddleware,
-  ),                                                        A, DA,            PAR, BA);
-  use(() => checkResponseMode,                              A,                PAR    );
-  use(() => oneRedirectUriClients,                          A,                PAR    );
-  use(() => oauthRequired,                                  A,                PAR    );
-  use(() => rejectRegistration,                             A, DA,            PAR, BA);
-  use(() => checkResponseType,                              A,                PAR    );
-  use(() => oidcRequired,                                   A,                PAR    );
-  use(() => cibaRequired,                                                          BA);
-  use(() => assignDefaults,                                 A, DA,                 BA);
-  use(() => checkPrompt,                                    A,                PAR    );
-  use(() => checkScope.bind(undefined, allowList),          A, DA,            PAR, BA);
-  use(() => checkOpenidScope.bind(undefined, allowList),    A, DA,            PAR, BA);
-  use(() => checkRedirectUri,                               A,                PAR    );
-  use(() => checkPKCE,                                      A,                PAR    );
-  use(() => checkClaims,                                    A, DA,            PAR, BA);
-  use(() => unsupportedRar,                                    DA                    );
-  use(() => checkRar,                                       A,                PAR, BA);
-  use(() => checkResource,                                  A, DA, R, CV, DR, PAR, BA);
-  use(() => checkMaxAge,                                    A, DA,            PAR, BA);
-  use(() => checkRequestedExpiry,                                                  BA);
-  use(() => checkCibaContext,                                                      BA);
-  use(() => checkIdTokenHint,                               A, DA,            PAR    );
-  use(() => checkDpopJkt,                                                     PAR    );
-  use(() => checkExtraParams,                               A, DA,            PAR, BA);
-  use(() => interactionEmit,                                     A,     R, CV, DR    );
-  use(() => assignClaims,                                   A,     R, CV, DR,      BA);
-  use(() => cibaLoadAccount,                                                       BA);
-  use(() => loadAccount,                                    A,     R, CV, DR         );
-  use(() => loadGrant,                                      A,     R, CV, DR         );
-  use(() => interactions.bind(undefined, returnTo),         A,     R, CV, DR         );
-  use(() => respond,                                        A,     R                 );
-  use(() => deviceAuthorizationResponse,                       DA                    );
-  use(() => deviceUserFlowResponse,                                   CV, DR         );
-  use(() => pushedAuthorizationRequestResponse,                               PAR    );
-  use(() => backchannelRequestResponse,                                            BA);
-  /* eslint-enable no-multi-spaces, space-in-parens, function-paren-newline */
-
+  use(authenticatedClientId,                    DA,                 BA);
+  use(assembleAuthorizationParams,           A, DA,            PAR, BA);
+  use(rejectAuthorizationDupes,              A, DA,            PAR, BA);
+  use(rejectUnsupported,                     A, DA,            PAR, BA);
+  use(stripOutsideJarParams,                                   PAR, BA);
+  use(checkClient,                           A, DA, R, CV, DR         );
+  use(checkClientGrantType,                     DA,                 BA);
+  use(pushedAuthorizationRequestRemapErrors,                   PAR    );
+  use(backchannelRequestRemapErrors,                                BA);
+  use(loadPushedAuthorizationRequest,        A                        );
+  use(processRequestObject,                  A, DA,            PAR, BA);
+  use(checkResponseMode,                     A,                PAR    );
+  use(oneRedirectUriClients,                 A,                PAR    );
+  use(oauthRequired,                         A,                PAR    );
+  use(rejectRegistration,                    A, DA,            PAR, BA);
+  use(checkResponseType,                     A,                PAR    );
+  use(oidcRequired,                          A,                PAR    );
+  use(cibaRequired,                                                 BA);
+  use(assignDefaults,                        A, DA,                 BA);
+  use(checkPrompt,                           A,                PAR    );
+  use(checkScope,                            A, DA,            PAR, BA);
+  use(checkOpenidScope,                      A, DA,            PAR, BA);
+  use(checkRedirectUri,                      A,                PAR    );
+  use(checkPKCE,                             A,                PAR    );
+  use(checkClaims,                           A, DA,            PAR, BA);
+  use(checkRar,                              A, DA,            PAR, BA);
+  use(checkResource,                         A, DA, R, CV, DR, PAR, BA);
+  use(checkMaxAge,                           A, DA,            PAR, BA);
+  use(checkRequestedExpiry,                                         BA);
+  use(checkCibaContext,                                             BA);
+  use(checkIdTokenHint,                      A, DA,            PAR    );
+  use(checkDpopJkt,                                            PAR    );
+  use(checkExtraParams,                      A, DA,            PAR, BA);
+  use(interactionEmit,                       A,     R, CV, DR         );
+  use(assignClaims,                          A,     R, CV, DR,      BA);
+  use(cibaLoadAccount,                                              BA);
+  use(loadAccount,                           A,     R, CV, DR         );
+  use(loadGrant,                             A,     R, CV, DR         );
+  use(interactions,                          A,     R, CV, DR         );
+  use(respond,                               A,     R                 );
+  use(deviceAuthorizationResponse,              DA                    );
+  use(deviceUserFlowResponse,                          CV, DR         );
+  use(pushedAuthorizationRequestResponse,                      PAR    );
+  use(backchannelRequestResponse,                                   BA);
+
+  stacks.set(endpoint, stack);
   return stack;
 }

package/dist/node_modules/oidc-provider/lib/actions/authorization/interactions.js

@@ -1,10 +1,13 @@
-import upperFirst from '../../helpers/_/upper_first.js';
 import camelCase from '../../helpers/_/camel_case.js';
+import upperFirst from '../../helpers/_/upper_first.js';
+import { boolean, positiveInteger } from '../../helpers/configuration_result.js';
 import * as errors from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
 import nanoid from '../../helpers/nanoid.js';
+import instance from '../../helpers/weak_cache.js';
+
+const errorMap = { ...errors };
 
-export default async function interactions(resumeRouteName, ctx, next) {
+export default async function interactions(ctx, next) {
   const { oidc } = ctx;
   let failedCheck;
   let prompt;
@@ -15,7 +18,10 @@ export default async function interactions(resumeRouteName, ctx, next) {
     let results = (await Promise.all([...checks].map(async ({
       reason, description, error, details, check,
     }) => {
-      if (await check(ctx)) {
+      if (boolean(
+        await check(ctx),
+        `interactions.policy.${name}.checks.${reason}.check`,
+      )) {
         return {
           [reason]: { error, description, details: await details(ctx) },
         };
@@ -45,17 +51,17 @@ export default async function interactions(resumeRouteName, ctx, next) {
     }
   }
 
-  // no interaction requested
+  
   if (!prompt) {
-    // check there's an accountId to continue
+    
     if (!oidc.session.accountId) {
       throw new errors.AccessDenied(undefined, 'authorization request resolved without requesting interactions but no account id was resolved');
     }
 
-    // check there's something granted to continue
-    // if only claims parameter is used then it must be combined with openid scope anyway
-    // when no scope parameter was provided and none is injected by the AS policy access is
-    // denied rather then issuing a code/token without scopes
+    
+    
+    
+    
     if (
       !oidc.grant.getOIDCScopeFiltered(oidc.requestParamOIDCScopes)
       && Object.keys(ctx.oidc.resourceServers)
@@ -72,12 +78,12 @@ export default async function interactions(resumeRouteName, ctx, next) {
     return;
   }
 
-  // if interaction needed but prompt=none => throw;
+  
   try {
     if (oidc.promptPending('none')) {
       const className = upperFirst(camelCase(failedCheck.error));
-      if (errors[className]) {
-        throw new errors[className](failedCheck.error_description);
+      if (errorMap[className]) {
+        throw new errorMap[className](failedCheck.error_description);
       }
       throw new errors.CustomOIDCProviderError(failedCheck.error, failedCheck.error_description);
     }
@@ -92,6 +98,7 @@ export default async function interactions(resumeRouteName, ctx, next) {
   const uid = nanoid();
 
   const cookieOptions = instance(oidc.provider).configuration.cookies.short;
+  const resumeRouteName = /^(code|device)_/.test(oidc.route) ? 'device_resume' : 'resume';
   const returnTo = oidc.urlFor(resumeRouteName, {
     uid,
   });
@@ -116,6 +123,8 @@ export default async function interactions(resumeRouteName, ctx, next) {
     ttl = ttl(ctx, interactionSession);
   }
 
+  ttl = positiveInteger(ttl, 'ttl.Interaction');
+
   await interactionSession.save(ttl);
   ctx.oidc.entity('Interaction', interactionSession);
 
@@ -147,3 +156,13 @@ export default async function interactions(resumeRouteName, ctx, next) {
   ctx.status = 303;
   ctx.redirect(destination);
 }
+
+const resumeRoutes = new Set(['resume', 'device_resume']);
+
+export function interactionEmit(ctx, next) {
+  if (resumeRoutes.has(ctx.oidc.route)) {
+    ctx.oidc.provider.emit('interaction.ended', ctx);
+  }
+
+  return next();
+}

package/dist/node_modules/oidc-provider/lib/actions/authorization/process_request_object.js

@@ -1,13 +1,15 @@
 import * as JWT from '../../helpers/jwt.js';
 import instance from '../../helpers/weak_cache.js';
 import { InvalidRequest, InvalidRequestObject, OIDCProviderError } from '../../helpers/errors.js';
-import isPlainObject from '../../helpers/_/is_plain_object.js';
+import isJsonObject from '../../helpers/_/is_json_object.js';
+import { getAuthorizationParams, rejectAuthorizationDupes } from './request_parameters.js';
 
-/*
- * Decrypts and validates the content of provided request parameter and replaces the parameters
- * provided via OAuth2.0 authorization request with these
- */
-export default async function processRequestObject(PARAM_LIST, rejectDupesMiddleware, ctx, next) {
+
+
+
+
+export default async function processRequestObject(ctx, next) {
+  const PARAM_LIST = getAuthorizationParams(ctx);
   const { params, client, route } = ctx.oidc;
 
   const pushedRequestObject = 'PushedAuthorizationRequest' in ctx.oidc.entities;
@@ -32,7 +34,7 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
     return next();
   }
 
-  let trusted = false; // signed or encrypted by client confidential material
+  let trusted = false; 
 
   if (features.encryption.enabled && params.request.split('.').length === 5) {
     if (isBackchannelAuthentication) {
@@ -63,12 +65,12 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
       if (ctx.oidc.body) {
         ctx.oidc.body.request = params.request;
       }
-    } catch (err) {
-      if (err instanceof OIDCProviderError) {
-        throw err;
+    } catch (cause) {
+      if (cause instanceof OIDCProviderError) {
+        throw cause;
       }
 
-      throw new InvalidRequestObject('could not decrypt request object', err.message);
+      throw new InvalidRequestObject('could not decrypt request object', { cause });
     }
   }
 
@@ -76,15 +78,15 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
 
   try {
     decoded = JWT.decode(params.request);
-  } catch (err) {
-    throw new InvalidRequestObject('could not parse Request Object', err.message);
+  } catch (cause) {
+    throw new InvalidRequestObject('could not parse Request Object', { cause });
   }
 
   const { payload, header: { alg } } = decoded;
 
   const request = Object.entries(payload).reduce((acc, [key, value]) => {
     if (PARAM_LIST.has(key)) {
-      if (key === 'claims' && isPlainObject(value)) {
+      if (key === 'claims' && isJsonObject(value)) {
         acc[key] = JSON.stringify(value);
       } else if (key === 'authorization_details' && Array.isArray(value)) {
         acc[key] = JSON.stringify(value);
@@ -100,7 +102,7 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
     return acc;
   }, {});
 
-  rejectDupesMiddleware({ oidc: { params: request } }, () => {});
+  rejectAuthorizationDupes({ oidc: { params: request, provider: ctx.oidc.provider } }, () => {});
 
   const original = {};
   for (const param of ['state', 'response_mode', 'response_type']) {
@@ -158,8 +160,8 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
 
   try {
     JWT.assertPayload(payload, opts);
-  } catch (err) {
-    throw new InvalidRequestObject('Request Object claims are invalid', err.message);
+  } catch (cause) {
+    throw new InvalidRequestObject('Request Object claims are invalid', { cause });
   }
 
   await features.requestObjects.assertJwtClaimsAndHeader(
@@ -170,7 +172,7 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
   );
 
   if (pushedRequestObject) {
-    ({ trusted } = pushedRequestObject);
+    ({ trusted } = ctx.oidc.entities.PushedAuthorizationRequest);
   } else {
     try {
       if (alg.startsWith('HS')) {
@@ -180,12 +182,12 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
         await JWT.verify(params.request, client.asymmetricKeyStore, opts);
       }
       trusted = true;
-    } catch (err) {
-      if (err instanceof OIDCProviderError) {
-        throw err;
+    } catch (cause) {
+      if (cause instanceof OIDCProviderError) {
+        throw cause;
       }
 
-      throw new InvalidRequestObject('could not validate Request Object', err.message);
+      throw new InvalidRequestObject('could not validate Request Object', { cause });
     }
   }
 
@@ -197,10 +199,10 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
 
   Object.keys(params).forEach((key) => {
     if (key in request) {
-      // use value from Request Object
-      params[key] = request[key];
+      
+      params[key] = request[key] || undefined;
     } else {
-      // ignore all OAuth 2.0 parameters outside of Request Object
+      
       params[key] = undefined;
     }
   });
@@ -212,3 +214,23 @@ export default async function processRequestObject(PARAM_LIST, rejectDupesMiddle
 
   return next();
 }
+
+
+
+
+
+
+
+export function stripOutsideJarParams(ctx, next) {
+  const JAR = !!ctx.oidc.params.request;
+
+  for (const [param, value] of Object.entries(ctx.oidc.params)) {
+    if (value !== undefined) {
+      if (JAR && (param !== 'client_id' && param !== 'request')) {
+        ctx.oidc.params[param] = undefined;
+      }
+    }
+  }
+
+  return next();
+}