@nocobase/plugin-idp-oauth 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/actions/introspection.js

@@ -1,164 +1,160 @@
+import { checkAttestBinding } from '../helpers/check_attest_binding.js';
+import { boolean } from '../helpers/configuration_result.js';
+import { InvalidRequest } from '../helpers/errors.js';
+import normalizeAuthorizationDetails from '../helpers/normalize_authorization_details.js';
+import { findToken } from '../helpers/token_find.js';
 import presence from '../helpers/validate_presence.js';
-import getClientAuth from '../shared/client_auth.js';
-import noCache from '../shared/no_cache.js';
 import instance from '../helpers/weak_cache.js';
-import { urlencoded as parseBody } from '../shared/selective_body.js';
-import rejectDupes from '../shared/reject_dupes.js';
 import paramsMiddleware from '../shared/assemble_params.js';
-import { InvalidRequest } from '../helpers/errors.js';
+import clientAuth, { getClientAuthParams } from '../shared/client_auth.js';
+import noCache from '../shared/no_cache.js';
+import rejectDupes from '../shared/reject_dupes.js';
 import rejectStructuredTokens from '../shared/reject_structured_tokens.js';
-import { checkAttestBinding } from '../helpers/check_attest_binding.js';
-import { createTokenFinder } from '../helpers/token_find.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
 
 const introspectable = new Set(['AccessToken', 'ClientCredentials', 'RefreshToken']);
 const JWT = 'application/token-introspection+jwt';
 
-export default function introspectionAction(provider) {
-  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
-  const PARAM_LIST = new Set(['token', 'token_type_hint', ...authParams]);
-  const { configuration } = instance(provider);
-  const {
-    pairwiseIdentifier,
-    features: {
-      introspection: { allowedPolicy },
-      jwtIntrospection,
-      richAuthorizationRequests,
-    },
-  } = configuration;
-  const { grantTypeHandlers } = instance(provider);
-  const {
-    IdToken, Client,
-  } = provider;
-
-  const findToken = createTokenFinder(provider, grantTypeHandlers);
-
-  return [
-    noCache,
-    parseBody,
-    paramsMiddleware.bind(undefined, PARAM_LIST),
-    ...clientAuth,
-    rejectDupes.bind(undefined, {}),
-
-    async function validateTokenPresence(ctx, next) {
-      presence(ctx, 'token');
-      await next();
-    },
-
-    rejectStructuredTokens,
-
-    async function jwtIntrospectionResponse(ctx, next) {
-      if (jwtIntrospection.enabled) {
-        const { client } = ctx.oidc;
-
-        const {
-          introspectionEncryptedResponseAlg: encrypt,
-          introspectionSignedResponseAlg: sign,
-        } = client;
-
-        const accepts = ctx.accepts('json', JWT);
-        if (encrypt && accepts !== JWT) {
-          throw new InvalidRequest(`introspection must be requested with Accept: ${JWT} for this client`);
-        }
-
-        await next();
-
-        if ((encrypt || sign) && accepts === JWT) {
-          const token = new IdToken({}, { ctx });
-          token.extra = {
-            token_introspection: ctx.body,
-            aud: ctx.body.aud,
-          };
-
-          ctx.body = await token.issue({ use: 'introspection' });
-          ctx.type = 'application/token-introspection+jwt; charset=utf-8';
-        }
-      } else {
-        await next();
+export default [
+  noCache,
+  parseBody,
+  function assembleTokenParams(ctx, next) {
+    const params = new Set(['token', 'token_type_hint', ...getClientAuthParams(ctx)]);
+    return paramsMiddleware(params, ctx, next);
+  },
+  ...clientAuth,
+  rejectDupes.bind(undefined, {}),
+
+  async function validateTokenPresence(ctx, next) {
+    presence(ctx, 'token');
+    await next();
+  },
+
+  rejectStructuredTokens,
+
+  async function jwtIntrospectionResponse(ctx, next) {
+    const { provider } = ctx.oidc;
+    const { features: { jwtIntrospection } } = instance(provider).configuration;
+    if (jwtIntrospection.enabled) {
+      const { client } = ctx.oidc;
+
+      const {
+        introspectionEncryptedResponseAlg: encrypt,
+        introspectionSignedResponseAlg: sign,
+      } = client;
+
+      const accepts = ctx.accepts('json', JWT);
+      if (encrypt && accepts !== JWT) {
+        throw new InvalidRequest(`introspection must be requested with Accept: ${JWT} for this client`);
       }
-    },
-
-    async function renderTokenResponse(ctx) {
-      const { params } = ctx.oidc;
 
-      ctx.body = { active: false };
+      await next();
 
-      const token = await findToken(params.token, params.token_type_hint);
+      if ((encrypt || sign) && accepts === JWT) {
+        const token = new provider.IdToken({}, { ctx });
+        token.extra = {
+          token_introspection: ctx.body,
+          aud: ctx.body.aud,
+        };
 
-      if (!token?.isValid) {
-        return;
+        ctx.body = await token.issue({ use: 'introspection' });
+        ctx.type = 'application/token-introspection+jwt; charset=utf-8';
       }
+    } else {
+      await next();
+    }
+  },
 
-      if (token.grantId) {
-        const grant = await ctx.oidc.provider.Grant.find(token.grantId, {
-          ignoreExpiration: true,
-        });
+  async function renderTokenResponse(ctx) {
+    const { params, provider } = ctx.oidc;
+    const {
+      pairwiseIdentifier,
+      features: { introspection: { allowedPolicy }, richAuthorizationRequests },
+    } = instance(provider).configuration;
 
-        if (!grant) return;
-        if (grant.isExpired) return;
-        if (grant.clientId !== token.clientId) return;
-        if (grant.accountId !== token.accountId) return;
+    ctx.body = { active: false };
 
-        ctx.oidc.entity('Grant', grant);
-      }
+    const token = await findToken(provider, params.token, params.token_type_hint);
 
-      if (introspectable.has(token.kind)) {
-        ctx.oidc.entity(token.kind, token);
-      } else {
-        return;
-      }
+    if (!token?.isValid) {
+      return;
+    }
 
-      if (
-        token.kind === 'RefreshToken'
-        && ctx.oidc.client.clientId === token.clientId
-        && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
-      ) {
-        try {
-          await checkAttestBinding(ctx, token);
-        } catch {
-          return;
-        }
-      }
+    if (token.grantId) {
+      const grant = await provider.Grant.find(token.grantId, {
+        ignoreExpiration: true,
+      });
 
-      if (!(await allowedPolicy(ctx, ctx.oidc.client, token))) {
+      if (!grant) return;
+      if (grant.isExpired) return;
+      if (grant.clientId !== token.clientId) return;
+      if (grant.accountId !== token.accountId) return;
+
+      ctx.oidc.entity('Grant', grant);
+    }
+
+    if (introspectable.has(token.kind)) {
+      ctx.oidc.entity(token.kind, token);
+    } else {
+      return;
+    }
+
+    if (
+      token.kind === 'RefreshToken'
+      && ctx.oidc.client.clientId === token.clientId
+      && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
+    ) {
+      try {
+        await checkAttestBinding(ctx, token);
+      } catch {
         return;
       }
-
-      if (token.accountId) {
-        ctx.body.sub = token.accountId;
-        if (token.clientId !== ctx.oidc.client.clientId) {
-          const client = await Client.find(token.clientId);
-          if (client.subjectType === 'pairwise') {
-            ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, client);
-          }
-        } else if (ctx.oidc.client.subjectType === 'pairwise') {
-          ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, ctx.oidc.client);
+    }
+
+    if (!boolean(
+      await allowedPolicy(ctx, ctx.oidc.client, token),
+      'features.introspection.allowedPolicy',
+    )) {
+      return;
+    }
+
+    if (token.accountId) {
+      ctx.body.sub = token.accountId;
+      if (token.clientId !== ctx.oidc.client.clientId) {
+        const client = await provider.Client.find(token.clientId);
+        if (client.subjectType === 'pairwise') {
+          ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, client);
         }
+      } else if (ctx.oidc.client.subjectType === 'pairwise') {
+        ctx.body.sub = await pairwiseIdentifier(ctx, ctx.body.sub, ctx.oidc.client);
       }
-
-      Object.assign(ctx.body, {
-        ...token.extra,
-        active: true,
-        client_id: token.clientId,
-        exp: token.exp,
-        iat: token.iat,
-        sid: token.sid,
-        iss: provider.issuer,
-        jti: token.jti !== params.token ? token.jti : undefined,
-        aud: token.aud,
-        authorization_details: token.rar
-          ? await richAuthorizationRequests.rarForIntrospectionResponse(ctx, token) : undefined,
-        scope: token.scope || undefined,
-        cnf: token.isSenderConstrained() ? {} : undefined,
-        token_type: token.kind !== 'RefreshToken' ? token.tokenType : undefined,
-      });
-
-      if (token['x5t#S256']) {
-        ctx.body.cnf['x5t#S256'] = token['x5t#S256'];
-      }
-
-      if (token.jkt) {
-        ctx.body.cnf.jkt = token.jkt;
-      }
-    },
-  ];
-}
+    }
+
+    Object.assign(ctx.body, {
+      ...token.extra,
+      active: true,
+      client_id: token.clientId,
+      exp: token.exp,
+      iat: token.iat,
+      sid: token.sid,
+      iss: provider.issuer,
+      jti: token.jti !== params.token ? token.jti : undefined,
+      aud: token.aud,
+      authorization_details: token.rar
+        ? normalizeAuthorizationDetails(
+          await richAuthorizationRequests.authorizationDetailsForIntrospection(ctx, token),
+        ) : undefined,
+      scope: token.scope || undefined,
+      cnf: token.isSenderConstrained() ? {} : undefined,
+      token_type: token.kind !== 'RefreshToken' ? token.tokenType : undefined,
+    });
+
+    if (token['x5t#S256']) {
+      ctx.body.cnf['x5t#S256'] = token['x5t#S256'];
+    }
+
+    if (token.jkt) {
+      ctx.body.cnf.jkt = token.jkt;
+    }
+  },
+];

package/dist/node_modules/oidc-provider/lib/actions/openid_credential_issuer.js

@@ -0,0 +1,17 @@
+import defaults from '../helpers/_/defaults.js';
+import instance from '../helpers/weak_cache.js';
+
+export default function openidCredentialIssuer(ctx) {
+  const { openid4vci } = instance(ctx.oidc.provider).configuration.features;
+
+  const { credentialConfigurationsSupported } = openid4vci;
+
+  ctx.body = {
+    credential_issuer: ctx.oidc.issuer,
+    credential_endpoint: ctx.oidc.urlFor('credential'),
+    nonce_endpoint: ctx.oidc.urlFor('challenge'),
+    credential_configurations_supported: credentialConfigurationsSupported,
+  };
+
+  defaults(ctx.body, openid4vci.metadata);
+}

package/dist/node_modules/oidc-provider/lib/actions/registration.js

@@ -1,14 +1,24 @@
 import omitBy from '../helpers/_/omit_by.js';
+import addClient from '../helpers/add_client.js';
+import { boolean } from '../helpers/configuration_result.js';
 import constantEquals from '../helpers/constant_equals.js';
-import noCache from '../shared/no_cache.js';
-import { json as parseBody } from '../shared/selective_body.js';
 import epochTime from '../helpers/epoch_time.js';
-import { InvalidToken, InvalidRequest } from '../helpers/errors.js';
+import { InvalidRequest, InvalidToken } from '../helpers/errors.js';
 import instance from '../helpers/weak_cache.js';
+import noCache from '../shared/no_cache.js';
+import { json as parseBody } from '../shared/selective_body.js';
 import getSetWWWAuthenticateHeader from '../shared/set_www_authenticate_header.js';
-import addClient from '../helpers/add_client.js';
+import getValidateJsonBody from '../shared/validate_json_body.js';
 
 const setWWWAuthenticate = getSetWWWAuthenticateHeader({ dpop: false });
+const validateRegistrationBody = getValidateJsonBody(
+  InvalidRequest,
+  'client registration request must be a JSON object',
+);
+const validateClientUpdateBody = getValidateJsonBody(
+  InvalidRequest,
+  'client update request must be a JSON object',
+);
 
 const FORBIDDEN = [
   'registration_access_token',
@@ -39,6 +49,7 @@ async function validateRegistrationAccessToken(ctx, next) {
 export const post = [
   noCache,
   parseBody,
+  validateRegistrationBody,
   setWWWAuthenticate,
   async function validateInitialAccessToken(ctx, next) {
     const { oidc: { provider } } = ctx;
@@ -76,7 +87,13 @@ export const post = [
 
     if (
       issueRegistrationAccessToken === true
-      || (typeof issueRegistrationAccessToken === 'function' && issueRegistrationAccessToken(ctx))
+      || (
+        typeof issueRegistrationAccessToken === 'function'
+        && boolean(
+          await issueRegistrationAccessToken(ctx),
+          'features.registration.issueRegistrationAccessToken',
+        )
+      )
     ) {
       rat = new provider.RegistrationAccessToken({ clientId });
       ctx.oidc.entity('RegistrationAccessToken', rat);
@@ -160,6 +177,7 @@ export const put = [
   setWWWAuthenticate,
   validateRegistrationAccessToken,
   parseBody,
+  validateClientUpdateBody,
 
   async function forbiddenFields(ctx, next) {
     const hit = FORBIDDEN.find((field) => ctx.oidc.body[field] !== undefined);
@@ -234,7 +252,13 @@ export const put = [
     const management = instance(provider).features.registrationManagement;
     if (
       management.rotateRegistrationAccessToken === true
-      || (typeof management.rotateRegistrationAccessToken === 'function' && await management.rotateRegistrationAccessToken(ctx))
+      || (
+        typeof management.rotateRegistrationAccessToken === 'function'
+        && boolean(
+          await management.rotateRegistrationAccessToken(ctx),
+          'features.registrationManagement.rotateRegistrationAccessToken',
+        )
+      )
     ) {
       ctx.oidc.entity('RotatedRegistrationAccessToken', ctx.oidc.entities.RegistrationAccessToken);
       const rat = new provider.RegistrationAccessToken({

package/dist/node_modules/oidc-provider/lib/actions/revocation.js

@@ -1,81 +1,76 @@
+import { checkAttestBinding } from '../helpers/check_attest_binding.js';
+import { boolean } from '../helpers/configuration_result.js';
+import revoke from '../helpers/revoke.js';
+import { findToken } from '../helpers/token_find.js';
 import presence from '../helpers/validate_presence.js';
 import instance from '../helpers/weak_cache.js';
-import getClientAuth from '../shared/client_auth.js';
-import { urlencoded as parseBody } from '../shared/selective_body.js';
-import rejectDupes from '../shared/reject_dupes.js';
 import paramsMiddleware from '../shared/assemble_params.js';
+import clientAuth, { getClientAuthParams } from '../shared/client_auth.js';
+import rejectDupes from '../shared/reject_dupes.js';
 import rejectStructuredTokens from '../shared/reject_structured_tokens.js';
-import revoke from '../helpers/revoke.js';
-import { checkAttestBinding } from '../helpers/check_attest_binding.js';
-import { createTokenFinder } from '../helpers/token_find.js';
+import { urlencoded as parseBody } from '../shared/selective_body.js';
 
 const revokeable = new Set(['AccessToken', 'ClientCredentials', 'RefreshToken']);
 
-export default function revocationAction(provider) {
-  const { params: authParams, middleware: clientAuth } = getClientAuth(provider);
-  const PARAM_LIST = new Set(['token', 'token_type_hint', ...authParams]);
-  const { grantTypeHandlers, configuration } = instance(provider);
-  const {
-    features: {
-      revocation: { allowedPolicy },
-    },
-  } = configuration;
-
-  const findToken = createTokenFinder(provider, grantTypeHandlers);
+export default [
+  parseBody,
+  function assembleTokenParams(ctx, next) {
+    const params = new Set(['token', 'token_type_hint', ...getClientAuthParams(ctx)]);
+    return paramsMiddleware(params, ctx, next);
+  },
+  ...clientAuth,
+  rejectDupes.bind(undefined, {}),
 
-  return [
-    parseBody,
-    paramsMiddleware.bind(undefined, PARAM_LIST),
-    ...clientAuth,
-    rejectDupes.bind(undefined, {}),
+  async function validateTokenPresence(ctx, next) {
+    presence(ctx, 'token');
+    await next();
+  },
 
-    async function validateTokenPresence(ctx, next) {
-      presence(ctx, 'token');
-      await next();
-    },
+  rejectStructuredTokens,
 
-    rejectStructuredTokens,
+  async function renderTokenResponse(ctx, next) {
+    ctx.status = 200;
+    ctx.body = '';
+    await next();
+  },
 
-    async function renderTokenResponse(ctx, next) {
-      ctx.status = 200;
-      ctx.body = '';
-      await next();
-    },
+  async function revokeToken(ctx) {
+    const { params, provider } = ctx.oidc;
+    const { features: { revocation: { allowedPolicy } } } = instance(provider).configuration;
 
-    async function revokeToken(ctx) {
-      const { params } = ctx.oidc;
+    const token = await findToken(provider, params.token, params.token_type_hint);
 
-      const token = await findToken(params.token, params.token_type_hint);
+    if (!token) return;
 
-      if (!token) return;
+    if (revokeable.has(token.kind)) {
+      ctx.oidc.entity(token.kind, token);
+    } else {
+      return;
+    }
 
-      if (revokeable.has(token.kind)) {
-        ctx.oidc.entity(token.kind, token);
-      } else {
+    if (
+      token.kind === 'RefreshToken'
+      && ctx.oidc.client.clientId === token.clientId
+      && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
+    ) {
+      try {
+        await checkAttestBinding(ctx, token);
+      } catch {
         return;
       }
+    }
 
-      if (
-        token.kind === 'RefreshToken'
-        && ctx.oidc.client.clientId === token.clientId
-        && ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth'
-      ) {
-        try {
-          await checkAttestBinding(ctx, token);
-        } catch {
-          return;
-        }
-      }
+    if (!boolean(
+      await allowedPolicy(ctx, ctx.oidc.client, token),
+      'features.revocation.allowedPolicy',
+    )) {
+      return;
+    }
 
-      if (!(await allowedPolicy(ctx, ctx.oidc.client, token))) {
-        return;
-      }
-
-      await token.destroy();
+    await token.destroy();
 
-      if (token.kind === 'RefreshToken' || token.kind === 'AccessToken') {
-        await revoke(ctx, token.grantId);
-      }
-    },
-  ];
-}
+    if (token.kind === 'RefreshToken' || token.kind === 'AccessToken') {
+      await revoke(ctx, token.grantId);
+    }
+  },
+];