@nocobase/plugin-idp-oauth 2.2.17 → 2.2.18

package/dist/node_modules/oidc-provider/lib/actions/authorization/assign_claims.js

@@ -1,28 +0,0 @@
-import merge from '../../helpers/_/merge.js';
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Merges requested claims with auth_time as requested if max_age is provided or require_auth_time
- * is configured for the client.
- *
- * Merges requested claims with acr as requested if acr_values is provided
- */
-export default function assignClaims(ctx, next) {
-  const { params } = ctx.oidc;
-
-  if (params.claims !== undefined && instance(ctx.oidc.provider).features.claimsParameter.enabled) {
-    ctx.oidc.claims = JSON.parse(params.claims);
-  }
-
-  if (params.max_age !== undefined || ctx.oidc.client.requireAuthTime || ctx.oidc.prompts.has('login')) {
-    merge(ctx.oidc.claims, { id_token: { auth_time: { essential: true } } });
-  }
-
-  const acrValues = params.acr_values;
-
-  if (acrValues) {
-    merge(ctx.oidc.claims, { id_token: { acr: { values: acrValues.split(' ') } } });
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/assign_defaults.js

@@ -1,17 +0,0 @@
-/*
- * assign max_age and acr_values if it is not provided explictly but is configured with default
- * values on the client
- */
-export default function assignDefaults(ctx, next) {
-  const { params, client } = ctx.oidc;
-
-  if (!params.acr_values && client.defaultAcrValues) {
-    params.acr_values = client.defaultAcrValues.join(' ');
-  }
-
-  if (params.max_age === undefined && client.defaultMaxAge !== undefined) {
-    params.max_age = client.defaultMaxAge.toString();
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/authenticated_client_id.js

@@ -1,6 +0,0 @@
-export default function deviceAuthorizationResponse(ctx, next) {
-  if (!ctx.oidc.body.client_id) {
-    ctx.oidc.body.client_id = ctx.oidc.client.clientId;
-  }
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/backchannel_request_remap_errors.js

@@ -1,17 +0,0 @@
-import { InvalidRequestObject } from '../../helpers/errors.js';
-
-/*
- * Remaps the Backchannel Authentication Endpoint errors thrown in downstream middlewares.
- */
-export default async function requestObjectRemapErrors(ctx, next) {
-  return next().catch((err) => {
-    if (err instanceof InvalidRequestObject) {
-      Object.assign(err, {
-        message: 'invalid_request',
-        error: 'invalid_request',
-      });
-    }
-
-    throw err;
-  });
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/backchannel_request_response.js

@@ -1,41 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-export default async function backchannelRequestResponse(ctx) {
-  const { BackchannelAuthenticationRequest } = ctx.oidc.provider;
-  const { ciba } = instance(ctx.oidc.provider).features;
-
-  const request = new BackchannelAuthenticationRequest({
-    accountId: ctx.oidc.account.accountId,
-    claims: ctx.oidc.claims,
-    client: ctx.oidc.client,
-    nonce: ctx.oidc.params.nonce,
-    params: ctx.oidc.params.toPlainObject(),
-    resource: Object.keys(ctx.oidc.resourceServers),
-    scope: [...ctx.oidc.requestParamScopes].join(' '),
-  });
-
-  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
-    await request.setAttestBinding(ctx);
-  }
-
-  // eslint-disable-next-line default-case
-  switch (request.resource.length) {
-    case 0:
-      delete request.resource;
-      break;
-    case 1:
-      [request.resource] = request.resource;
-      break;
-  }
-
-  ctx.oidc.entity('BackchannelAuthenticationRequest', request);
-
-  const id = await request.save();
-
-  ctx.body = {
-    expires_in: request.expiration,
-    auth_req_id: id,
-  };
-
-  await ciba.triggerAuthenticationDevice(ctx, request, ctx.oidc.account, ctx.oidc.client);
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_ciba_context.js

@@ -1,12 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-export default async function checkCibaContext(ctx, next) {
-  const { ciba } = instance(ctx.oidc.provider).features;
-
-  await Promise.all([
-    ciba.validateRequestContext(ctx, ctx.oidc.params.request_context),
-    ciba.validateBindingMessage(ctx, ctx.oidc.params.binding_message),
-  ]);
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_claims.js

@@ -1,68 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-import isPlainObject from '../../helpers/_/is_plain_object.js';
-
-/*
- * If claims parameter is provided and supported handles its validation
- * - should not be combined with rt none
- * - should be JSON serialized object with id_token or userinfo properties as objects
- * - claims.userinfo should not be used if authorization result is not access_token
- *
- * Merges requested claims with auth_time as requested if max_age is provided or require_auth_time
- * is configured for the client.
- *
- * Merges requested claims with acr as requested if acr_values is provided
- */
-export default async function checkClaims(ctx, next) {
-  const { params } = ctx.oidc;
-
-  if (params.claims !== undefined) {
-    const { claimsParameter, userinfo } = instance(ctx.oidc.provider).features;
-
-    if (claimsParameter.enabled) {
-      if (params.response_type === 'none') {
-        throw new InvalidRequest('claims parameter should not be combined with response_type none');
-      }
-
-      let claims;
-
-      try {
-        claims = JSON.parse(params.claims);
-      } catch (err) {
-        throw new InvalidRequest('could not parse the claims parameter JSON');
-      }
-
-      if (!isPlainObject(claims)) {
-        throw new InvalidRequest('claims parameter should be a JSON object');
-      }
-
-      if (claims.userinfo === undefined && claims.id_token === undefined) {
-        throw new InvalidRequest('claims parameter should have userinfo or id_token properties');
-      }
-
-      if (claims.userinfo !== undefined && !isPlainObject(claims.userinfo)) {
-        throw new InvalidRequest('claims.userinfo should be an object');
-      }
-
-      if (claims.id_token !== undefined && !isPlainObject(claims.id_token)) {
-        throw new InvalidRequest('claims.id_token should be an object');
-      }
-
-      if (claims.userinfo && !userinfo.enabled) {
-        throw new InvalidRequest('claims.userinfo should not be used since userinfo endpoint is not supported');
-      }
-
-      if (params.response_type === 'id_token' && claims.userinfo) {
-        throw new InvalidRequest('claims.userinfo should not be used if access_token is not issued');
-      }
-
-      await claimsParameter.assertClaimsParameter?.(
-        ctx,
-        claims,
-        ctx.oidc.client,
-      );
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_client.js

@@ -1,21 +0,0 @@
-import presence from '../../helpers/validate_presence.js';
-import { InvalidClient } from '../../helpers/errors.js';
-
-/*
- * Checks client_id
- */
-export default async function checkClient(ctx, next) {
-  presence(ctx, 'client_id');
-
-  const client = await ctx.oidc.provider.Client.find(ctx.oidc.params.client_id);
-
-  if (!client) {
-    // there's no point in checking again in authorization error handler
-    ctx.oidc.noclient = true;
-    throw new InvalidClient('client is invalid', 'client not found');
-  }
-
-  ctx.oidc.entity('Client', client);
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_client_grant_type.js

@@ -1,21 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-export default function checkClientGrantType({ oidc: { route, client } }, next) {
-  let grantType;
-  switch (route) {
-    case 'device_authorization':
-      grantType = 'urn:ietf:params:oauth:grant-type:device_code';
-      break;
-    case 'backchannel_authentication':
-      grantType = 'urn:openid:params:grant-type:ciba';
-      break;
-    default:
-      throw new Error('not implemented');
-  }
-
-  if (!client.grantTypeAllowed(grantType)) {
-    throw new InvalidRequest(`${grantType} is not allowed for this client`);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_dpop_jkt.js

@@ -1,35 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-import dpopValidate, { CHALLENGE_OK_WINDOW } from '../../helpers/validate_dpop.js';
-import epochTime from '../../helpers/epoch_time.js';
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Validates dpop_jkt equals the used DPoP proof thumbprint
- * when provided, otherwise defaults dpop_jkt to it.
- */
-export default async function checkDpopJkt(ctx, next) {
-  const { params } = ctx.oidc;
-
-  const dPoP = await dpopValidate(ctx);
-  if (dPoP) {
-    const { allowReplay } = instance(ctx.oidc.provider).features.dPoP;
-    if (!allowReplay) {
-      const { ReplayDetection } = ctx.oidc.provider;
-      const unique = await ReplayDetection.unique(
-        ctx.oidc.client.clientId,
-        dPoP.jti,
-        epochTime() + CHALLENGE_OK_WINDOW,
-      );
-
-      ctx.assert(unique, new InvalidRequest('DPoP proof JWT Replay detected'));
-    }
-
-    if (params.dpop_jkt && params.dpop_jkt !== dPoP.thumbprint) {
-      throw new InvalidRequest('DPoP proof key thumbprint does not match dpop_jkt');
-    } else if (!params.dpop_jkt) {
-      params.dpop_jkt = dPoP.thumbprint;
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_extra_params.js

@@ -1,18 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Executes registered extraParams validators.
- */
-export default async function checkExtraParams(ctx, next) {
-  const { extraParamsValidations } = instance(ctx.oidc.provider).configuration;
-
-  if (!extraParamsValidations) {
-    return next();
-  }
-
-  for (const [param, validator] of extraParamsValidations) {
-    await validator(ctx, ctx.oidc.params[param], ctx.oidc.client);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_id_token_hint.js

@@ -1,23 +0,0 @@
-import { InvalidRequest, OIDCProviderError } from '../../helpers/errors.js';
-
-/*
- * Validates the incoming id_token_hint
- */
-export default async function checkIdTokenHint(ctx, next) {
-  const { oidc } = ctx;
-  if (oidc.params.id_token_hint !== undefined) {
-    let idTokenHint;
-    try {
-      idTokenHint = await oidc.provider.IdToken.validate(oidc.params.id_token_hint, oidc.client);
-    } catch (err) {
-      if (err instanceof OIDCProviderError) {
-        throw err;
-      }
-
-      throw new InvalidRequest('could not validate id_token_hint', undefined, err.message);
-    }
-    ctx.oidc.entity('IdTokenHint', idTokenHint);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_max_age.js

@@ -1,25 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-/*
- * Validates the max_age parameter and handles max_age=0 to prompt=login translation
- */
-export default function checkMaxAge(ctx, next) {
-  if (ctx.oidc.params.max_age !== undefined) {
-    const maxAge = +ctx.oidc.params.max_age;
-
-    if (!Number.isSafeInteger(maxAge) || Math.sign(maxAge) === -1) {
-      throw new InvalidRequest('invalid max_age parameter value');
-    }
-
-    if (maxAge === 0) {
-      const { prompts } = ctx.oidc;
-      ctx.oidc.params.max_age = undefined;
-      if (!prompts.has('login')) {
-        prompts.add('login');
-        ctx.oidc.params.prompt = [...prompts].join(' ');
-      }
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_openid_scope.js

@@ -1,47 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-const GATED_CLIENT = Object.entries({
-  defaultAcrValues: 'default_acr_values',
-  defaultMaxAge: 'default_max_age',
-  requireAuthTime: 'require_auth_time',
-});
-
-const GATED = [
-  'acr_values',
-  'claims',
-  'claims_locales',
-  'id_token_hint',
-  'max_age',
-  'nonce',
-];
-
-/*
- * Validates that openid scope is requested when openid specific parameters are provided
- */
-export default function checkOpenIdScope(PARAM_LIST, ctx, next) {
-  if (ctx.oidc.params.scope?.split(' ').includes('openid')) {
-    return next();
-  }
-
-  if (PARAM_LIST.has('response_type') && ctx.oidc.params.response_type.includes('id_token')) {
-    throw new InvalidRequest('openid scope must be requested for this response_type');
-  }
-
-  GATED_CLIENT.forEach(([prop, msg]) => {
-    if (ctx.oidc.client[prop]) {
-      throw new InvalidRequest(`openid scope must be requested for clients with ${msg}`);
-    }
-  });
-
-  GATED.forEach((param) => {
-    if (ctx.oidc.params[param] !== undefined) {
-      throw new InvalidRequest(`openid scope must be requested when using the ${param} parameter`);
-    }
-  });
-
-  if (ctx.oidc.route === 'backchannel_authentication') {
-    throw new InvalidRequest('openid scope must be requested for this request');
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_prompt.js

@@ -1,25 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Checks that all requested prompts are supported and validates prompt none is not combined with
- * other prompts
- */
-export default function checkPrompt(ctx, next) {
-  if (ctx.oidc.params.prompt !== undefined) {
-    const { prompts } = ctx.oidc;
-    const supported = instance(ctx.oidc.provider).configuration.prompts;
-
-    for (const prompt of prompts) {
-      if (!supported.has(prompt)) {
-        throw new InvalidRequest('unsupported prompt value requested');
-      }
-    }
-
-    if (prompts.has('none') && prompts.size !== 1) {
-      throw new InvalidRequest('prompt none must only be used alone');
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_redirect_uri.js

@@ -1,41 +0,0 @@
-import { InvalidRedirectUri, InvalidRequest } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-
-function allowUnregisteredUri(ctx) {
-  const { pushedAuthorizationRequests } = instance(ctx.oidc.provider).features;
-
-  return (ctx.oidc.route === 'pushed_authorization_request' || ('PushedAuthorizationRequest' in ctx.oidc.entities))
-    && pushedAuthorizationRequests.allowUnregisteredRedirectUris
-    && ctx.oidc.client.sectorIdentifierUri === undefined
-    && ctx.oidc.client.clientAuthMethod !== 'none';
-}
-
-function validateUnregisteredUri(ctx) {
-  const { redirectUris: validator } = ctx.oidc.provider.Client.Schema.prototype;
-
-  validator.call({
-    ...ctx.oidc.client.metadata(),
-    invalidate(detail) {
-      throw new InvalidRequest(detail.replace('redirect_uris', 'redirect_uri'));
-    },
-  }, [ctx.oidc.params.redirect_uri]);
-
-  return true;
-}
-
-/*
- * Checks that provided redirect_uri is allowed
- */
-export default function checkRedirectUri(ctx, next) {
-  if (!ctx.oidc.client.redirectUriAllowed(ctx.oidc.params.redirect_uri)) {
-    if (!allowUnregisteredUri(ctx)) {
-      throw new InvalidRedirectUri();
-    }
-
-    validateUnregisteredUri(ctx);
-  }
-
-  ctx.oidc.redirectUriCheckPerformed = true;
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_requested_expiry.js

@@ -1,16 +0,0 @@
-import { InvalidRequest } from '../../helpers/errors.js';
-
-/*
- * Validates the requested_expiry parameter
- */
-export default function checkRequestedExpiry(ctx, next) {
-  if (ctx.oidc.params.requested_expiry !== undefined) {
-    const requestedExpiry = +ctx.oidc.params.requested_expiry;
-
-    if (!Number.isSafeInteger(requestedExpiry) || Math.sign(requestedExpiry) !== 1) {
-      throw new InvalidRequest('invalid requested_expiry parameter value');
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_response_mode.js

@@ -1,54 +0,0 @@
-import { InvalidRequest, UnsupportedResponseMode } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-import { isFrontChannel } from '../../helpers/resolve_response_mode.js';
-
-/*
- * Resolves and assigns params.response_mode if it was not explicitly requested. Validates id_token
- * and token containing responses do not use response_mode query.
- */
-export default function checkResponseMode(ctx, next) {
-  const { params, client } = ctx.oidc;
-
-  const frontChannel = isFrontChannel(params.response_type);
-
-  const mode = ctx.oidc.responseMode;
-
-  if (
-    mode !== undefined
-    && !instance(ctx.oidc.provider).responseModes.has(mode)
-  ) {
-    params.response_mode = undefined;
-    throw new UnsupportedResponseMode();
-  }
-
-  if (!ctx.oidc.client.responseModeAllowed(mode, params.response_type, ctx.oidc.fapiProfile)) {
-    throw new InvalidRequest('requested response_mode is not allowed for this client or request');
-  }
-
-  const JWT = /jwt/.test(mode);
-
-  if (
-    mode !== undefined && JWT
-    && (
-      /^HS/.test(client.authorizationSignedResponseAlg)
-      || /^(A|dir$)/.test(client.authorizationEncryptedResponseAlg)
-    )
-  ) {
-    try {
-      client.checkClientSecretExpiration('client secret is expired, cannot issue a JWT Authorization response');
-    } catch (err) {
-      const [explicit] = mode === 'jwt' ? [undefined] : mode.split('.');
-      params.response_mode = explicit || undefined;
-      throw err;
-    }
-  }
-
-  const msg = 'requested response_mode is not allowed for the requested response_type';
-  if (mode === 'query' && frontChannel) {
-    throw new InvalidRequest(msg);
-  } else if (mode === 'query.jwt' && frontChannel && !client.authorizationEncryptedResponseAlg) {
-    throw new InvalidRequest(`${msg} unless encrypted`);
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_response_type.js

@@ -1,26 +0,0 @@
-import instance from '../../helpers/weak_cache.js';
-import {
-  UnsupportedResponseType,
-  InvalidRequest,
-} from '../../helpers/errors.js';
-
-/*
- * Validates requested response_type is supported by the provided and allowed in the client
- * configuration
- */
-export default function checkResponseType(ctx, next) {
-  const { params } = ctx.oidc;
-  const supported = instance(ctx.oidc.provider).configuration.responseTypes;
-
-  params.response_type = [...new Set(params.response_type.split(' '))].sort().join(' ');
-
-  if (!supported.includes(params.response_type)) {
-    throw new UnsupportedResponseType();
-  }
-
-  if (!ctx.oidc.client.responseTypeAllowed(params.response_type)) {
-    throw new InvalidRequest('requested response_type is not allowed for this client');
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/check_scope.js

@@ -1,53 +0,0 @@
-import { InvalidScope } from '../../helpers/errors.js';
-import instance from '../../helpers/weak_cache.js';
-
-/*
- * Validates that all requested scopes are supported by the provider, and that offline_access prompt
- * is requested together with consent prompt
- */
-export default async function checkScope(PARAM_LIST, ctx, next) {
-  const { scopes: statics } = instance(ctx.oidc.provider).configuration;
-  const { prompts, client } = ctx.oidc;
-
-  const scopes = [...new Set(ctx.oidc.params.scope?.split(' '))];
-
-  const responseType = ctx.oidc.params.response_type;
-
-  /*
-   * Upon receipt of a scope parameter containing the offline_access value, the Authorization Server
-   *
-   * MUST ensure that the prompt parameter contains consent
-   * MUST ignore the offline_access request unless the Client is using a response_type value that
-   *  would result in an Authorization Code being returned,
-   *
-   * Furthermore no offline_access will be granted if the client doesn't have the grant allowed
-   */
-
-  if (scopes.includes('offline_access')) {
-    if (
-      (PARAM_LIST.has('response_type') && !responseType.includes('code'))
-      || (PARAM_LIST.has('prompt') && !prompts.has('consent'))
-      || !client.grantTypeAllowed('refresh_token')
-    ) {
-      scopes.splice(scopes.indexOf('offline_access'), 1);
-    }
-  }
-
-  if (scopes.length) {
-    ctx.oidc.params.scope = scopes.join(' ');
-  } else {
-    ctx.oidc.params.scope = undefined;
-  }
-
-  if (client.scope) {
-    const allowList = new Set(client.scope.split(' '));
-
-    for (const scope of scopes.filter(Set.prototype.has.bind(statics))) {
-      if (!allowList.has(scope)) {
-        throw new InvalidScope('requested scope is not allowed', scope);
-      }
-    }
-  }
-
-  return next();
-}

package/dist/node_modules/oidc-provider/lib/actions/authorization/ciba_load_account.js

@@ -1,58 +0,0 @@
-import { InvalidRequest, UnknownUserId } from '../../helpers/errors.js';
-import omitBy from '../../helpers/_/omit_by.js';
-import instance from '../../helpers/weak_cache.js';
-
-import checkIdTokenHint from './check_id_token_hint.js';
-
-export default async function cibaLoadAccount(ctx, next) {
-  const mechanisms = omitBy({
-    login_hint_token: ctx.oidc.params.login_hint_token,
-    id_token_hint: ctx.oidc.params.id_token_hint,
-    login_hint: ctx.oidc.params.login_hint,
-  }, (value) => typeof value !== 'string' || !value);
-
-  let mechanism;
-  let length;
-  let value;
-
-  try {
-    ({ 0: [mechanism, value], length } = Object.entries(mechanisms));
-  } catch (err) {}
-
-  if (!length) {
-    throw new InvalidRequest('missing one of required parameters login_hint_token, id_token_hint, or login_hint');
-  } else if (length !== 1) {
-    throw new InvalidRequest('only one of required parameters login_hint_token, id_token_hint, or login_hint must be provided');
-  }
-
-  const { findAccount, features } = instance(ctx.oidc.provider).configuration;
-  const { ciba } = features;
-
-  let accountId;
-  // eslint-disable-next-line default-case
-  switch (mechanism) {
-    case 'id_token_hint':
-      await checkIdTokenHint(ctx, () => {});
-      ({ payload: { sub: accountId } } = ctx.oidc.entities.IdTokenHint);
-      break;
-    case 'login_hint_token':
-      accountId = await ciba.processLoginHintToken(ctx, value);
-      break;
-    case 'login_hint':
-      accountId = await ciba.processLoginHint(ctx, value);
-      break;
-  }
-
-  if (!accountId) {
-    throw new UnknownUserId('could not identify end-user');
-  }
-  const account = await findAccount(ctx, accountId);
-  if (!account) {
-    throw new UnknownUserId('could not identify end-user');
-  }
-  ctx.oidc.entity('Account', account);
-
-  await ciba.verifyUserCode(ctx, account, value);
-
-  return next();
-}