@nocobase/plugin-idp-oauth 2.2.17 → 2.2.19

package/dist/node_modules/oidc-provider/lib/shared/cors.js

@@ -1,17 +1,55 @@
-import cors from '@koa/cors';
-
+import { boolean } from '../helpers/configuration_result.js';
 import { InvalidRequest } from '../helpers/errors.js';
 import instance from '../helpers/weak_cache.js';
 
+const list = (value) => (Array.isArray(value) ? value.join(',') : value);
+
+
+
+
+
+
+
+
+
+
+function corsMiddleware({ allowMethods, maxAge, exposeHeaders }) {
+  const methods = list(allowMethods) ?? 'GET,HEAD,PUT,POST,DELETE,PATCH';
+  const expose = typeof exposeHeaders === 'function' ? exposeHeaders : list(exposeHeaders);
+  const age = maxAge ? String(maxAge) : undefined;
+
+  return async (ctx, next) => {
+    ctx.vary('Origin');
+
+    const origin = ctx.get('Origin') || '*';
+
+    if (ctx.method !== 'OPTIONS') {
+      ctx.set('Access-Control-Allow-Origin', origin);
+      const headers = typeof expose === 'function' ? list(expose(ctx)) : expose;
+      if (headers) ctx.set('Access-Control-Expose-Headers', headers);
+      return next();
+    }
+
+    
+    if (!ctx.get('Access-Control-Request-Method')) return next();
+
+    ctx.set('Access-Control-Allow-Origin', origin);
+    if (age) ctx.set('Access-Control-Max-Age', age);
+    if (methods) ctx.set('Access-Control-Allow-Methods', methods);
+
+    const allowHeaders = ctx.get('Access-Control-Request-Headers');
+    if (allowHeaders) ctx.set('Access-Control-Allow-Headers', allowHeaders);
+
+    ctx.status = 204;
+    return undefined;
+  };
+}
+
 function checkClientCORS(ctx, client) {
   const origin = ctx.get('Origin');
   const { clientBasedCORS } = instance(ctx.oidc.provider).configuration;
 
-  const allowed = clientBasedCORS(ctx, origin, client);
-
-  if (typeof allowed !== 'boolean') {
-    throw new Error('clientBasedCORS helper must be a synchronous function returning a Boolean');
-  }
+  const allowed = boolean(clientBasedCORS(ctx, origin, client), 'clientBasedCORS');
 
   if (!allowed) {
     ctx.remove('Access-Control-Allow-Origin');
@@ -20,24 +58,18 @@ function checkClientCORS(ctx, client) {
 }
 
 export default ({ clientBased = false, ...options }) => {
-  const builtin = cors({
-    keepHeadersOnError: false,
-    origin(ctx) {
-      return ctx.get('Origin') || '*';
-    },
-    ...options,
-  });
+  const builtin = corsMiddleware(options);
 
   return async (ctx, next) => {
     const headers = Object.keys(ctx.response.headers);
 
-    // ignore built in CORS handling since the developer wants to do it their way
+    
     if (headers.find((x) => x.toLowerCase().startsWith('access-control-'))) {
       return next();
     }
 
     ctx.vary('Origin');
-    // preflights or generally available (e.g. discovery) -> CORS is allowed
+    
     if (ctx.method === 'OPTIONS' || !clientBased || !ctx.get('Origin')) {
       return builtin(ctx, next);
     }

package/dist/node_modules/oidc-provider/lib/shared/error_handler.js

@@ -7,14 +7,23 @@ import errOut from '../helpers/err_out.js';
 
 import { generateXsrf } from './xsrf.js';
 
+
+
+
+
+
+
+
+
 const debugError = debug('oidc-provider:error');
 const serverError = debug('oidc-provider:server_error');
 const serverErrorTrace = debug('oidc-provider:server_error:trace');
 
 const userInputRoutes = new Set(['code_verification', 'device_resume']);
 
-export default function getErrorHandler(provider, eventName) {
+export default function getErrorHandler(eventName) {
   return async function errorHandler(ctx, next) {
+    const { provider } = ctx.oidc;
     const {
       features: { deviceFlow: { charset, userCodeInputSource } },
     } = instance(provider).configuration;
@@ -37,12 +46,12 @@ export default function getErrorHandler(provider, eventName) {
         const { secret } = ctx.oidc.session.state;
 
         await userCodeInputSource(ctx, formHtml.input(ctx.oidc.urlFor('code_verification'), secret, err.userCode, charset), out, err);
-        if (err instanceof ReRenderError) { // render without emit
+        if (err instanceof ReRenderError) { 
           return;
         }
       } else if (ctx.accepts('json', 'html') === 'html') {
-        // this ^^ makes */* requests respond with json (curl, xhr, request libraries), while in
-        // browser requests end up rendering the html error instead
+        
+        
         const { renderError } = instance(provider).configuration;
         await renderError(ctx, out, err);
       } else {

package/dist/node_modules/oidc-provider/lib/shared/jwt_client_auth.js

@@ -10,7 +10,13 @@ export default async function jwtClientAuth(ctx, keystore, filter) {
   } = instance(ctx.oidc.provider).configuration;
 
   const acceptedAud = ctx.oidc.clientJwtAuthExpectedAudience();
-  const { header, payload } = JWT.decode(ctx.oidc.params.client_assertion);
+  let decoded;
+  try {
+    decoded = JWT.decode(ctx.oidc.params.client_assertion);
+  } catch (cause) {
+    throw new InvalidClientAuth({ cause });
+  }
+  const { header, payload } = decoded;
 
   if (ctx.oidc.client.clientAuthSigningAlg) {
     if (header.alg !== ctx.oidc.client.clientAuthSigningAlg) {
@@ -56,8 +62,8 @@ export default async function jwtClientAuth(ctx, keystore, filter) {
       clockTolerance,
       ignoreAzp: true,
     });
-  } catch (err) {
-    throw new InvalidClientAuth(err.message);
+  } catch (cause) {
+    throw new InvalidClientAuth({ cause });
   }
 
   await assertJwtClientAuthClaimsAndHeader(

package/dist/node_modules/oidc-provider/lib/shared/reject_dupes.js

@@ -1,43 +1,23 @@
 import { InvalidRequest } from '../helpers/errors.js';
 import * as formatters from '../helpers/formatters.js';
 
-function exceptMap([key, value]) {
-  if (Array.isArray(value) && !this.has(key)) {
-    return key;
-  }
-  return undefined;
-}
-
-function onlyMap([key, value]) {
-  if (Array.isArray(value) && this.has(key)) {
-    return key;
-  }
-  return undefined;
-}
+export default function rejectDupes({ except, only } = {}, ctx, next) {
+  const params = [];
 
-function defaultMap([key, value]) {
-  return Array.isArray(value) ? key : undefined;
-}
+  for (const [key, value] of Object.entries(ctx.oidc.params)) {
+    if (!Array.isArray(value)) {
+      continue;
+    }
 
-// eslint-disable-next-line default-param-last
-export default function rejectDupes({ except, only } = {}, ctx, next) {
-  let mapFn;
+    if (except ? except.has(key) : only && !only.has(key)) {
+      continue;
+    }
 
-  if (except) {
-    mapFn = exceptMap.bind(except);
-  } else if (only) {
-    mapFn = onlyMap.bind(only);
-  } else {
-    mapFn = defaultMap;
+    params.push(key);
+    ctx.oidc.params[key] = undefined;
   }
 
-  const dupes = Object.entries(ctx.oidc.params).map(mapFn);
-
-  if (dupes.some(Boolean)) {
-    const params = dupes.filter(Boolean);
-    params.forEach((param) => {
-      ctx.oidc.params[param] = undefined;
-    });
+  if (params.length) {
     throw new InvalidRequest(`${formatters.formatList(params)} ${formatters.pluralize('parameter', params.length)} must not be provided twice`);
   }
 

package/dist/node_modules/oidc-provider/lib/shared/selective_body.js

@@ -1,30 +1,64 @@
 import * as querystring from 'node:querystring';
 
-import raw from 'raw-body';
-
 import * as attention from '../helpers/attention.js';
 import { InvalidRequest } from '../helpers/errors.js';
 
 let warned;
 
+const LIMIT = 56 * 1024;
+
+
+
+
+
+
+
+
+
+async function readBody(req, length, charset) {
+  if (req.readableEncoding) {
+    throw new Error('stream encoding should not be set');
+  }
+
+  if (length !== undefined && length > LIMIT) {
+    throw new Error('request entity too large');
+  }
+
+  const chunks = [];
+  let received = 0;
+
+  for await (const chunk of req.iterator({ destroyOnReturn: false })) {
+    received += chunk.length;
+    if (received > LIMIT) {
+      throw new Error('request entity too large');
+    }
+    if (length !== undefined && received > length) {
+      throw new Error('request size did not match content length');
+    }
+    chunks.push(chunk);
+  }
+
+  if (length !== undefined && received !== length) {
+    throw new Error('request size did not match content length');
+  }
+
+  const body = Buffer.concat(chunks, received);
+
+  return charset ? new TextDecoder(charset).decode(body) : body;
+}
+
 async function selectiveBody(cty, ctx, next) {
   if (ctx.is(cty)) {
     try {
       let usedFallback;
       const body = await (() => {
         if (ctx.req.readable) {
-          return raw(ctx.req, {
-            length: ctx.request.length,
-            limit: '56kb',
-            encoding: ctx.charset,
-          });
+          return readBody(ctx.req, ctx.request.length, ctx.charset);
         }
         if (!warned) {
           warned = true;
-          /* eslint-disable no-multi-str */
           attention.warn('already parsed request body detected, having upstream middleware parser \
 is not recommended, resolving to use req.body or request.body instead');
-          /* eslint-enable */
         }
         usedFallback = true;
         return ctx.req.body || ctx.request.body;
@@ -37,13 +71,13 @@ is not recommended, resolving to use req.body or request.body instead');
           ctx.oidc.body = querystring.parse(body.toString());
         }
       } else if (usedFallback && cty === 'application/x-www-form-urlencoded') {
-        // get rid of possible upstream parsers that parse querystring with objects, arrays, etc
+        
         ctx.oidc.body = querystring.parse(querystring.stringify(body));
       } else {
         ctx.oidc.body = body;
       }
-    } catch (err) {
-      throw new InvalidRequest('failed to parse the request body');
+    } catch (cause) {
+      throw new InvalidRequest('failed to parse the request body', undefined, { cause });
     }
 
     await next();
@@ -55,6 +89,12 @@ is not recommended, resolving to use req.body or request.body instead');
   }
 }
 
-export default selectiveBody;
 export const json = selectiveBody.bind(undefined, 'application/json');
-export const urlencoded = selectiveBody.bind(undefined, 'application/x-www-form-urlencoded');
+
+export async function urlencoded(ctx, next) {
+  if (ctx.method === 'POST') {
+    await selectiveBody('application/x-www-form-urlencoded', ctx, next);
+  } else {
+    await next();
+  }
+}

package/dist/node_modules/oidc-provider/lib/shared/session.js

@@ -1,3 +1,4 @@
+import { positiveInteger } from '../helpers/configuration_result.js';
 import instance from '../helpers/weak_cache.js';
 
 export default async function sessionHandler(ctx, next) {
@@ -11,11 +12,10 @@ export default async function sessionHandler(ctx, next) {
           Reflect.defineProperty(obj, 'destroyed', { configurable: false, writable: true, value });
           Reflect.defineProperty(obj, 'touched', { configurable: false, writable: false, value: false });
           break;
-        case 'accountId':
-          if (typeof value !== 'string' || !value) {
+        default:
+          if (prop === 'accountId' && (typeof value !== 'string' || !value)) {
             throw new TypeError(`accountId must be a non-empty string, got: ${typeof value}`);
           }
-        default: // eslint-disable-line no-fallthrough
           Reflect.set(obj, prop, value);
           Reflect.defineProperty(obj, 'touched', { writable: true, value: true });
       }
@@ -30,7 +30,7 @@ export default async function sessionHandler(ctx, next) {
     const sessionCookieName = ctx.oidc.provider.cookieName('session');
     const longRegExp = new RegExp(`^${sessionCookieName}(?:\\.sig)?=`);
 
-    // refresh the session duration
+    
     if ((!ctx.oidc.session.new || ctx.oidc.session.touched) && !ctx.oidc.session.destroyed) {
       let ttl = instance(ctx.oidc.provider).configuration.ttl.Session;
 
@@ -38,6 +38,8 @@ export default async function sessionHandler(ctx, next) {
         ttl = ttl(ctx, ctx.oidc.session);
       }
 
+      ttl = positiveInteger(ttl, 'ttl.Session');
+
       ctx.oidc.cookies.set(
         sessionCookieName,
         ctx.oidc.session.id,
@@ -52,7 +54,6 @@ export default async function sessionHandler(ctx, next) {
         setCookie = [setCookie];
       }
       setCookie.forEach((cookie, index, ary) => {
-        /* eslint-disable no-param-reassign */
         if (
           !cookie.includes('expires=Thu, 01 Jan 1970')
           && cookie.match(longRegExp)
@@ -61,7 +62,6 @@ export default async function sessionHandler(ctx, next) {
         ) {
           ary[index] += `; expires=${new Date(ctx.oidc.session.exp * 1000).toUTCString()}`;
         }
-        /* eslint-enable */
       });
     }
   }

package/dist/node_modules/oidc-provider/lib/shared/set_www_authenticate_header.js

@@ -31,9 +31,8 @@ export default function getSetWWWAuthenticateHeader({ tokenProperty = 'accessTok
           scheme = 'DPoP';
         }
 
-        // DPoP proof validation errors are not 401 by default, make them so
+        
         if (err instanceof InvalidDpopProof || err instanceof UseDpopNonce) {
-          // eslint-disable-next-line no-multi-assign
           err.status = err.statusCode = 401;
         }
       }

package/dist/node_modules/oidc-provider/lib/shared/validate_json_body.js

@@ -0,0 +1,11 @@
+export default function getValidateJsonBody(ErrorClass, errorDescription) {
+  return async function validateJsonBody(ctx, next) {
+    if (ctx.oidc.body === null
+        || typeof ctx.oidc.body !== 'object'
+        || Array.isArray(ctx.oidc.body)) {
+      throw new ErrorClass(errorDescription);
+    }
+
+    return next();
+  };
+}

package/dist/node_modules/oidc-provider/lib/views/index.js

@@ -1,22 +1,51 @@
-import { Eta } from 'eta/core';
-
+import interactionTemplate from './interaction.js';
 import layoutTemplate from './layout.js';
 import loginTemplate from './login.js';
-import interactionTemplate from './interaction.js';
 
-let eta;
 
-export const interaction = (locals) => {
-  eta ||= new Eta();
-  return eta.render(interactionTemplate, locals);
-};
 
-export const layout = (locals) => {
-  eta ||= new Eta();
-  return eta.render(layoutTemplate, locals);
+
+
+
+
+
+
+
+
+const ESCAPE = {
+  '&': '&',
+  '<': '&lt;',
+  '>': '&gt;',
+  '"': '&quot;',
+  "'": '&#39;',
 };
 
-export const login = (locals) => {
-  eta ||= new Eta();
-  return eta.render(loginTemplate, locals);
+export function escapeFunction(value) {
+  const string = String(value);
+  return /[&<>"']/.test(string) ? string.replace(/[&<>"']/g, (char) => ESCAPE[char]) : string;
+}
+
+
+
+
+
+
+
+
+
+
+const unsupported = () => { throw new Error('views do not support includes or layouts'); };
+
+const eta = {
+  config: { escapeFunction, filterFunction: String },
+  render: unsupported,
+  renderAsync: unsupported,
 };
+
+const render = (template, locals) => template.call(eta, locals, { async: false });
+
+export const interaction = (locals) => render(interactionTemplate, locals);
+
+export const layout = (locals) => render(layoutTemplate, locals);
+
+export const login = (locals) => render(loginTemplate, locals);