@nocobase/plugin-idp-oauth 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/helpers/configuration.js

@@ -1,14 +1,14 @@
 import { JWA } from '../consts/index.js';
-
 import isPlainObject from './_/is_plain_object.js';
-import remove from './_/remove.js';
 import merge from './_/merge.js';
 import pick from './_/pick.js';
+import remove from './_/remove.js';
 import set from './_/set.js';
-import * as formatters from './formatters.js';
-import getDefaults from './defaults.js';
-import { STABLE, EXPERIMENTS } from './features.js';
 import * as attention from './attention.js';
+import getDefaults from './defaults.js';
+import { InvalidAuthorizationDetails } from './errors.js';
+import { EXPERIMENTS, STABLE } from './features.js';
+import * as formatters from './formatters.js';
 
 function featuresTypeErrorCheck({ features }) {
   for (const value of Object.values(features)) {
@@ -18,20 +18,116 @@ function featuresTypeErrorCheck({ features }) {
   }
 }
 
+const requiredFeatureMembers = {
+  attestClientAuth: ['additionalSecuritySignal'],
+  ciba: ['deliveryModes'],
+};
+
+const requiredEnabledFeatureMembers = {
+  deviceFlow: ['enabled', 'charset', 'mask'],
+  fapi: ['enabled', 'profile'],
+  openid4vci: [
+    'enabled',
+    'metadata',
+    'preAuthorizedCodeGrant',
+    'credentialConfigurationsSupported',
+    'credentialConfigurationPolicy',
+    'issueCredential',
+  ],
+  richAuthorizationRequests: ['enabled', 'types'],
+};
+
+function checkFeatureConfigurationOwnProperties({ features }) {
+  const featureNames = [
+    ...Object.keys(requiredFeatureMembers),
+    ...Object.keys(requiredEnabledFeatureMembers),
+  ];
+
+  if (features && !isPlainObject(features) && ['object', 'function'].includes(typeof features)) {
+    for (const name of featureNames) {
+      if (!Object.hasOwn(features, name)) {
+        throw new TypeError(`features.${name} must be an own property`);
+      }
+    }
+  }
+
+  for (const [name, members] of Object.entries(requiredFeatureMembers)) {
+    const feature = features?.[name];
+    if (feature && !isPlainObject(feature) && ['object', 'function'].includes(typeof feature)) {
+      for (const member of members) {
+        if (!Object.hasOwn(feature, member)) {
+          throw new TypeError(`features.${name}.${member} must be an own property`);
+        }
+      }
+    }
+  }
+
+  for (const [name, members] of Object.entries(requiredEnabledFeatureMembers)) {
+    const feature = features?.[name];
+    if (feature && !isPlainObject(feature)
+        && ['object', 'function'].includes(typeof feature)) {
+      if (!Object.hasOwn(feature, 'enabled')) {
+        throw new TypeError(`features.${name}.enabled must be an own property`);
+      }
+
+      if (feature.enabled) {
+        for (const member of members) {
+          if (!Object.hasOwn(feature, member)) {
+            throw new TypeError(`features.${name}.${member} must be an own property`);
+          }
+        }
+      }
+    }
+  }
+}
+
+function checkKeyAttestationsRequired(proofTypeConfig, prefix) {
+  if (proofTypeConfig === undefined) {
+    return;
+  }
+  if (proofTypeConfig === null) {
+    throw new TypeError(`${prefix} must be an object`);
+  }
+
+  const { key_attestations_required: keyAttestationsRequired } = proofTypeConfig;
+  if (keyAttestationsRequired !== undefined) {
+    if (!isPlainObject(keyAttestationsRequired)) {
+      throw new TypeError(
+        `${prefix}.key_attestations_required must be a plain object`,
+      );
+    }
+
+    for (const claim of ['key_storage', 'user_authentication']) {
+      const values = keyAttestationsRequired[claim];
+      if (values !== undefined) {
+        if (
+          !Array.isArray(values)
+          || values.length === 0
+          || !values.every((v) => typeof v === 'string' && v.length > 0)
+        ) {
+          throw new TypeError(
+            `${prefix}.key_attestations_required.${claim} must be a non-empty array of non-empty strings`,
+          );
+        }
+      }
+    }
+  }
+}
+
 function filterHS(alg) {
   return alg.startsWith('HS');
 }
 
 function filterAsymmetricSig(alg) {
   switch (alg.slice(0, 2)) {
-    case 'ML': // ML-DSA-*, ML-KEM-*
-    case 'RS': // RS\d{3}, RSA-OAEP
-    case 'PS': // PS\d{3}
-    case 'ES': // ECDSA
-    case 'EC': // ECDH
-    case 'Ed': // Ed*
-    case 'X2': // X25519
-    case 'X4': // X448
+    case 'ML': 
+    case 'RS': 
+    case 'PS': 
+    case 'ES': 
+    case 'EC': 
+    case 'Ed': 
+    case 'X2': 
+    case 'X4': 
       return true;
     default:
       return false;
@@ -41,15 +137,71 @@ function filterAsymmetricSig(alg) {
 const supportedResponseTypes = new Set(['none', 'code', 'id_token', 'token']);
 const fapiProfiles = new Set(['1.0 Final', '2.0']);
 
+function cloneConfiguration(value) {
+  if (Array.isArray(value)) {
+    return value.map(cloneConfiguration);
+  }
+
+  if (value instanceof Set) {
+    return new Set([...value].map(cloneConfiguration));
+  }
+
+  if (isPlainObject(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, cloneConfiguration(entry)]),
+    );
+  }
+
+  return value;
+}
+
+function validateOpenid4vciClaims(claims) {
+  if (!Array.isArray(claims) || claims.length === 0) {
+    throw new InvalidAuthorizationDetails("'claims' must be a non-empty array when provided");
+  }
+
+  for (const claim of claims) {
+    if (!isPlainObject(claim)) {
+      throw new InvalidAuthorizationDetails('claims description entries must be JSON objects');
+    }
+
+    if (!Array.isArray(claim.path) || claim.path.length === 0) {
+      throw new InvalidAuthorizationDetails('claims description path must be a non-empty array');
+    }
+
+    for (const component of claim.path) {
+      const valid = (
+        (typeof component === 'string' && component.length)
+        || component === null
+        || (Number.isInteger(component) && component >= 0)
+      );
+
+      if (!valid) {
+        throw new InvalidAuthorizationDetails('claims description path entries must be non-empty strings, null, or non-negative integers');
+      }
+    }
+
+    if ('mandatory' in claim && typeof claim.mandatory !== 'boolean') {
+      throw new InvalidAuthorizationDetails('claims description mandatory must be a boolean when provided');
+    }
+  }
+}
+
 class Configuration {
   #defaults = getDefaults();
 
   constructor(config) {
-    Object.assign(this, merge({}, this.#defaults, pick(config, ...Object.keys(this.#defaults))));
-
+    const recognizedFeatures = { ...this.#defaults.features };
+    const recognizedRichAuthorizationRequestOptions = new Set(
+      Object.keys(this.#defaults.features.richAuthorizationRequests),
+    );
+    const input = cloneConfiguration(pick(config, ...Object.keys(this.#defaults)));
+    Object.assign(this, merge({}, this.#defaults, input));
+
+    checkFeatureConfigurationOwnProperties(this);
     featuresTypeErrorCheck(this);
 
-    this.logDraftNotice();
+    this.logDraftNotice(recognizedFeatures);
 
     this.registerExtraParamsValidations();
     this.ensureSets();
@@ -68,10 +220,12 @@ class Configuration {
     this.checkSubjectTypes();
     this.checkDependantFeatures();
     this.checkDeviceFlow();
+    this.checkAttestClientAuth();
     this.checkAuthMethods();
     this.checkTTL();
     this.checkCibaDeliveryModes();
-    this.checkRichAuthorizationRequests();
+    this.checkRichAuthorizationRequests(recognizedRichAuthorizationRequestOptions);
+    this.checkOpenid4vci();
     this.checkPostMethods();
     this.checkFetchResponseBodyLimits();
 
@@ -80,17 +234,58 @@ class Configuration {
     delete this.cookies.short.maxAge;
     delete this.cookies.short.expires;
 
-    // release #defaults
+    
     this.#defaults = undefined;
   }
 
-  checkRichAuthorizationRequests() {
+  checkRichAuthorizationRequests(recognizedOptions) {
+    const { richAuthorizationRequests } = this.features;
+
+    for (const option of Object.keys(richAuthorizationRequests)) {
+      if (!recognizedOptions.has(option)) {
+        throw new TypeError(`Unknown feature configuration: richAuthorizationRequests.${option}`);
+      }
+    }
+
+    for (const option of [
+      'authorizationDetailsForGrantSource',
+      'authorizationDetailsForAccessToken',
+      'authorizationDetailsForIntrospection',
+    ]) {
+      const callback = richAuthorizationRequests[option];
+      if (
+        typeof callback !== 'function'
+        || !['Function', 'AsyncFunction'].includes(callback.constructor.name)
+      ) {
+        throw new TypeError(`features.richAuthorizationRequests.${option} must be a function`);
+      }
+    }
+
     if (this.features.richAuthorizationRequests.enabled) {
-      if (!isPlainObject(this.features.richAuthorizationRequests.types)) {
+      const { openid4vci } = this.features;
+
+      if (!isPlainObject(richAuthorizationRequests.types)) {
         throw new TypeError('features.richAuthorizationRequests.types must be an object');
       }
 
-      for (const [k, v] of Object.entries(this.features.richAuthorizationRequests.types)) {
+      if (openid4vci.enabled && !Object.hasOwn(richAuthorizationRequests.types, 'openid_credential')) {
+        richAuthorizationRequests.types.openid_credential = {
+          validate(_ctx, detail) {
+            if (typeof detail.credential_configuration_id !== 'string' || !detail.credential_configuration_id.length) {
+              throw new InvalidAuthorizationDetails("'credential_configuration_id' must be a non-empty string");
+            }
+            if (!Object.hasOwn(openid4vci.credentialConfigurationsSupported, detail.credential_configuration_id)) {
+              throw new InvalidAuthorizationDetails("'credential_configuration_id' must reference an entry in credential_configurations_supported");
+            }
+
+            if ('claims' in detail) {
+              validateOpenid4vciClaims(detail.claims);
+            }
+          },
+        };
+      }
+
+      for (const [k, v] of Object.entries(richAuthorizationRequests.types)) {
         if (!isPlainObject(v)) {
           throw new TypeError('features.richAuthorizationRequests.types attribute values must be objects');
         }
@@ -101,6 +296,126 @@ class Configuration {
     }
   }
 
+  checkOpenid4vci() {
+    const { openid4vci } = this.features;
+
+    if (!openid4vci.enabled) {
+      return;
+    }
+
+    if (!isPlainObject(openid4vci.metadata)) {
+      throw new TypeError('features.openid4vci.metadata must be an object');
+    }
+
+    if (typeof openid4vci.preAuthorizedCodeGrant !== 'boolean') {
+      throw new TypeError('features.openid4vci.preAuthorizedCodeGrant must be a boolean');
+    }
+
+    const batchCredentialIssuance = openid4vci.metadata.batch_credential_issuance;
+    if (batchCredentialIssuance !== undefined) {
+      if (!isPlainObject(batchCredentialIssuance)) {
+        throw new TypeError('features.openid4vci.metadata.batch_credential_issuance must be an object');
+      }
+
+      if (
+        !Number.isSafeInteger(batchCredentialIssuance.batch_size)
+        || batchCredentialIssuance.batch_size < 2
+      ) {
+        throw new TypeError('features.openid4vci.metadata.batch_credential_issuance.batch_size must be an integer greater than or equal to 2');
+      }
+    }
+
+    if (
+      !isPlainObject(openid4vci.credentialConfigurationsSupported)
+      || !Object.keys(openid4vci.credentialConfigurationsSupported).length
+    ) {
+      throw new TypeError('features.openid4vci.credentialConfigurationsSupported must be a non-empty object');
+    }
+
+    for (
+      const [credentialConfigurationId, credentialConfiguration]
+      of Object.entries(openid4vci.credentialConfigurationsSupported)
+    ) {
+      if (!isPlainObject(credentialConfiguration)) {
+        throw new TypeError(`features.openid4vci.credentialConfigurationsSupported['${credentialConfigurationId}'] must be an object`);
+      }
+
+      const ccPrefix = `features.openid4vci.credentialConfigurationsSupported['${credentialConfigurationId}']`;
+
+      if (typeof credentialConfiguration.format !== 'string' || !credentialConfiguration.format.length) {
+        throw new TypeError(`${ccPrefix}.format must be a non-empty string`);
+      }
+
+      const proofTypesSupported = credentialConfiguration.proof_types_supported;
+      if (isPlainObject(proofTypesSupported)) {
+        const supportedProofTypes = new Set(['jwt', 'attestation']);
+        const unsupportedProofTypes = Object.keys(proofTypesSupported)
+          .filter((t) => !supportedProofTypes.has(t));
+        if (unsupportedProofTypes.length) {
+          throw new TypeError(
+            `${ccPrefix}.proof_types_supported contains unsupported proof type(s): ${unsupportedProofTypes.join(', ')}`,
+          );
+        }
+
+        if (Object.hasOwn(proofTypesSupported, 'jwt')) {
+          const cryptographicBindingMethodsSupported = credentialConfiguration
+            .cryptographic_binding_methods_supported;
+
+          if (
+            !Array.isArray(cryptographicBindingMethodsSupported)
+            || !cryptographicBindingMethodsSupported.includes('jwk')
+          ) {
+            throw new TypeError(
+              `${ccPrefix}.cryptographic_binding_methods_supported must include 'jwk' when jwt proofs are supported`,
+            );
+          }
+
+          checkKeyAttestationsRequired(proofTypesSupported.jwt, `${ccPrefix}.proof_types_supported.jwt`);
+        }
+
+        if (Object.hasOwn(proofTypesSupported, 'attestation')) {
+          checkKeyAttestationsRequired(proofTypesSupported.attestation, `${ccPrefix}.proof_types_supported.attestation`);
+        }
+      }
+
+      
+      const cryptographicBindingMethodsSupported = credentialConfiguration
+        .cryptographic_binding_methods_supported;
+      if (Array.isArray(cryptographicBindingMethodsSupported)) {
+        const unsupportedMethods = cryptographicBindingMethodsSupported.filter((m) => m !== 'jwk');
+        if (unsupportedMethods.length) {
+          throw new TypeError(
+            `${ccPrefix}.cryptographic_binding_methods_supported contains unsupported method(s): ${unsupportedMethods.join(', ')}`,
+          );
+        }
+      }
+
+      
+      if (credentialConfiguration.credential_response_encryption !== undefined) {
+        throw new TypeError(
+          `${ccPrefix}.credential_response_encryption is not supported`,
+        );
+      }
+    }
+
+    
+    if (openid4vci.metadata.credential_response_encryption !== undefined) {
+      throw new TypeError(
+        'features.openid4vci.metadata.credential_response_encryption is not supported',
+      );
+    }
+
+    const policy = openid4vci.credentialConfigurationPolicy;
+    if (typeof policy !== 'function' || !['Function', 'AsyncFunction'].includes(policy.constructor.name)) {
+      throw new TypeError('features.openid4vci.credentialConfigurationPolicy must be a function');
+    }
+
+    const { issueCredential } = openid4vci;
+    if (typeof issueCredential !== 'function' || !['Function', 'AsyncFunction'].includes(issueCredential.constructor.name)) {
+      throw new TypeError('features.openid4vci.issueCredential must be a function');
+    }
+  }
+
   registerExtraParamsValidations() {
     if (!isPlainObject(this.extraParams)) {
       return;
@@ -185,6 +500,10 @@ class Configuration {
     if (this.features.ciba.enabled) {
       this.grantTypes.add('urn:openid:params:grant-type:ciba');
     }
+
+    if (this.features.openid4vci.enabled && this.features.openid4vci.preAuthorizedCodeGrant) {
+      this.grantTypes.add('urn:ietf:params:oauth:grant-type:pre-authorized_code');
+    }
   }
 
   collectScopes() {
@@ -250,6 +569,10 @@ class Configuration {
   }
 
   checkAllowedJWA() {
+    if (this.enabledJWA === null) {
+      throw new TypeError('enabledJWA must be an object');
+    }
+
     Object.entries(this.enabledJWA).forEach(([key, value]) => {
       if (!JWA[key]) {
         throw new TypeError(`invalid property enabledJWA.${key} provided`);
@@ -359,26 +682,26 @@ class Configuration {
     const { features } = this;
 
     if (features.jwtIntrospection.enabled && !features.introspection.enabled) {
-      throw new TypeError('jwtIntrospection is only available in conjuction with introspection');
+      throw new TypeError('jwtIntrospection is only available in conjunction with introspection');
     }
 
     if (features.jwtUserinfo.enabled && !features.userinfo.enabled) {
-      throw new TypeError('jwtUserinfo is only available in conjuction with userinfo');
+      throw new TypeError('jwtUserinfo is only available in conjunction with userinfo');
     }
 
     if (features.registrationManagement.enabled && !features.registration.enabled) {
-      throw new TypeError('registrationManagement is only available in conjuction with registration');
+      throw new TypeError('registrationManagement is only available in conjunction with registration');
     }
 
     if (
       (features.registration.enabled && features.registration.policies)
       && !features.registration.initialAccessToken
     ) {
-      throw new TypeError('registration policies are only available in conjuction with adapter-backed initial access tokens');
+      throw new TypeError('registration policies are only available in conjunction with adapter-backed initial access tokens');
     }
 
     if (features.richAuthorizationRequests.enabled && !features.resourceIndicators.enabled) {
-      throw new TypeError('richAuthorizationRequests is only available in conjuction with enabled resourceIndicators');
+      throw new TypeError('richAuthorizationRequests is only available in conjunction with enabled resourceIndicators');
     }
   }
 
@@ -396,7 +719,7 @@ class Configuration {
             valid = true;
           }
           break;
-        case 'undefined': // does not expire
+        case 'undefined': 
           valid = true;
           break;
         default:
@@ -434,6 +757,18 @@ class Configuration {
     }
   }
 
+  checkAttestClientAuth() {
+    const { additionalSecuritySignal } = this.features.attestClientAuth;
+
+    if (
+      additionalSecuritySignal !== false
+      && additionalSecuritySignal !== 'optional'
+      && additionalSecuritySignal !== 'required'
+    ) {
+      throw new TypeError('features.attestClientAuth.additionalSecuritySignal must be false, optional, or required');
+    }
+  }
+
   checkAuthMethods() {
     const authMethods = new Set([
       'none',
@@ -489,12 +824,11 @@ class Configuration {
     }
   }
 
-  logDraftNotice() {
+  logDraftNotice(recognizedFeatures = getDefaults().features) {
     const ENABLED_EXPERIMENTS = new Set();
     let throwExperiment = false;
 
     Object.entries(this.features).forEach(([flag, { enabled, ack }]) => {
-      const { features: recognizedFeatures } = getDefaults();
       if (!(flag in recognizedFeatures)) {
         throw new TypeError(`Unknown feature configuration: ${flag}`);
       }

package/dist/node_modules/oidc-provider/lib/helpers/configuration_result.js

@@ -0,0 +1,84 @@
+import isPlainObject from './_/is_plain_object.js';
+
+function invalid(path, expected) {
+  return new TypeError(`${path} must ${expected}`);
+}
+
+function ignoreThenableRejection(value) {
+  if (value !== null && (typeof value === 'object' || typeof value === 'function')) {
+    if (typeof value.then === 'function') {
+      Promise.resolve(value).catch(() => {});
+    }
+  }
+}
+
+export function boolean(value, path) {
+  if (typeof value !== 'boolean') {
+    ignoreThenableRejection(value);
+    throw invalid(path, 'return a Boolean');
+  }
+
+  return value;
+}
+
+export function positiveInteger(value, path) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    ignoreThenableRejection(value);
+    throw invalid(path, 'return a positive integer');
+  }
+
+  return value;
+}
+
+export function account(value, path = 'findAccount') {
+  if (value === undefined) {
+    return value;
+  }
+
+  if (
+    value === null
+    || typeof value !== 'object'
+    || typeof value.accountId !== 'string'
+    || value.accountId.length === 0
+    || typeof value.claims !== 'function'
+  ) {
+    throw invalid(path, 'return undefined or an object with a non-empty accountId and a claims function');
+  }
+
+  return value;
+}
+
+export function resourceServer(value, path = 'features.resourceIndicators.getResourceServerInfo') {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    throw invalid(path, 'return an object');
+  }
+
+  if (typeof value.scope !== 'string') {
+    throw invalid(path, 'return an object with a scope string');
+  }
+
+  if (value.audience !== undefined && typeof value.audience !== 'string') {
+    throw invalid(path, 'return an object whose audience is a string when provided');
+  }
+
+  if (value.accessTokenTTL !== undefined) {
+    positiveInteger(value.accessTokenTTL, `${path}.accessTokenTTL`);
+  }
+
+  if (
+    value.accessTokenFormat !== undefined
+    && !['opaque', 'jwt'].includes(value.accessTokenFormat)
+  ) {
+    throw invalid(path, 'return an object whose accessTokenFormat is "opaque" or "jwt" when provided');
+  }
+
+  return value;
+}
+
+export function extraTokenClaims(value, path = 'extraTokenClaims') {
+  if (value !== undefined && !isPlainObject(value)) {
+    throw invalid(path, 'return undefined or a plain object');
+  }
+
+  return value;
+}

package/dist/node_modules/oidc-provider/lib/helpers/constant_equals.js

@@ -13,7 +13,7 @@ function constantEquals(a, b, minComp = 0) {
   if (typeof a !== 'string' || typeof b !== 'string') {
     throw new TypeError('arguments must be strings');
   }
-  const length = Math.max(a.length, b.length, minComp);
+  const length = Math.max(Buffer.byteLength(a), Buffer.byteLength(b), minComp);
   return timingSafeEqual(paddedBuffer(a, length), paddedBuffer(b, length));
 }