@nocobase/plugin-idp-oauth 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/helpers/initialize_app.js

@@ -1,50 +1,69 @@
 import { strict as assert } from 'node:assert';
 
-import Router from '@koa/router';
+import Router from './router.js';
 
-import devInteractions from '../actions/interaction.js';
+import * as devInteractions from '../actions/interaction.js';
 import cors from '../shared/cors.js';
 import * as grants from '../actions/grants/index.js';
 import * as responseModes from '../response_modes/index.js';
 import error from '../shared/error_handler.js';
-import getAuthError from '../shared/authorization_error_handler.js';
+import authError from '../shared/authorization_error_handler.js';
 import {
-  getAuthorization, userinfo, getToken, jwks, registration, getRevocation,
-  getIntrospection, discovery, endSession, codeVerification, challenge,
+  getAuthorization, userinfo, token, jwks, registration, revocation,
+  introspection, discovery, endSession, codeVerification, challenge,
+  openidCredentialIssuer, credential,
 } from '../actions/index.js';
 
 import als from './als.js';
+import * as grantHelpers from './grants.js';
 import instance from './weak_cache.js';
 
-export default function initializeApp() {
-  const { configuration, features } = instance(this);
-  const maxAge = 3600;
-  function exposeHeaders({
-    dpop = features.dPoP.enabled && features.dPoP.nonceSecret,
-    attest = features.attestClientAuth.enabled,
-    wwwAuth = true,
-  } = {}) {
+const maxAge = 3600;
+function exposeHeaders({
+  dpop = true,
+  attest = true,
+  wwwAuth = true,
+} = {}) {
+  return (ctx) => {
+    const { features } = instance(ctx.oidc.provider);
     return [
-      dpop ? 'DPoP-Nonce' : undefined,
-      attest ? 'OAuth-Client-Attestation-Challenge' : undefined,
+      dpop && features.dPoP.enabled && features.dPoP.nonceSecret ? 'DPoP-Nonce' : undefined,
+      attest && features.attestClientAuth.enabled ? 'OAuth-Client-Attestation-Challenge' : undefined,
       wwwAuth ? 'WWW-Authenticate' : undefined,
     ].filter(Boolean);
+  };
+}
+
+const CORS = {
+  open: cors({ allowMethods: 'GET', maxAge }),
+  challenge: cors({ allowMethods: 'POST', maxAge, exposeHeaders: exposeHeaders({ wwwAuth: false }) }),
+  userinfo: cors({
+    allowMethods: 'GET,POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders({ attest: false }),
+  }),
+  client: cors({
+    allowMethods: 'POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders({ dpop: false }),
+  }),
+  clientWithDPoP: cors({
+    allowMethods: 'POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders(),
+  }),
+  credential: cors({
+    allowMethods: 'POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders({ attest: false }),
+  }),
+  respond: () => {},
+};
+
+async function ensureSessionSave(ctx, next) {
+  try {
+    await next();
+  } finally {
+    if (ctx.oidc.session?.touched && !ctx.oidc.session.destroyed) {
+      await ctx.oidc.session.persist();
+    }
   }
+}
 
-  const CORS = {
-    open: cors({ allowMethods: 'GET', maxAge }),
-    challenge: cors({ allowMethods: 'POST', maxAge, exposeHeaders: exposeHeaders({ wwwAuth: false }) }),
-    userinfo: cors({
-      allowMethods: 'GET,POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders({ attest: false }),
-    }),
-    client: cors({
-      allowMethods: 'POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders({ dpop: false }),
-    }),
-    clientWithDPoP: cors({
-      allowMethods: 'POST', clientBased: true, maxAge, exposeHeaders: exposeHeaders(),
-    }),
-    respond: () => {},
-  };
+export default function initializeApp() {
+  const { configuration, features } = instance(this);
 
   const router = new Router();
   instance(this).router = router;
@@ -64,62 +83,62 @@ export default function initializeApp() {
   function normalizeRoute(name, route, ...stack) {
     assert(typeof name === 'string' && name.charAt(0) !== '/', `invalid route name ${name}`);
     assert(typeof route === 'string' && route.charAt(0) === '/', `invalid route ${route}`);
-    route = route.replace(/\/\//g, '/'); // eslint-disable-line no-param-reassign
-    stack.forEach((middleware) => assert.equal(typeof middleware, 'function'), 'invalid middleware');
+    route = route.replace(/\/\//g, '/');
+    stack.forEach((middleware) => { assert.equal(typeof middleware, 'function', 'invalid middleware'); });
     routeMap.set(name, route);
     return route;
   }
-  async function ensureSessionSave(ctx, next) {
-    try {
-      await next();
-    } finally {
-      if (ctx.oidc.session?.touched && !ctx.oidc.session.destroyed) {
-        await ctx.oidc.session.persist();
-      }
-    }
-  }
 
   const get = (name, route, ...stack) => {
-    route = normalizeRoute(name, route, ...stack); // eslint-disable-line no-param-reassign
+    route = normalizeRoute(name, route, ...stack);
     router.get(name, route, ensureOIDC, ensureSessionSave, ...stack);
   };
   const post = (name, route, ...stack) => {
-    route = normalizeRoute(name, route, ...stack); // eslint-disable-line no-param-reassign
+    route = normalizeRoute(name, route, ...stack);
     router.post(name, route, ensureOIDC, ensureSessionSave, ...stack);
   };
   const del = (name, route, ...stack) => {
-    route = normalizeRoute(name, route, ...stack); // eslint-disable-line no-param-reassign
+    route = normalizeRoute(name, route, ...stack);
     router.delete(name, route, ensureOIDC, ...stack);
   };
   const put = (name, route, ...stack) => {
-    route = normalizeRoute(name, route, ...stack); // eslint-disable-line no-param-reassign
+    route = normalizeRoute(name, route, ...stack);
     router.put(name, route, ensureOIDC, ...stack);
   };
   const options = (name, route, ...stack) => {
-    route = normalizeRoute(name, route, ...stack); // eslint-disable-line no-param-reassign
+    route = normalizeRoute(name, route, ...stack);
     router.options(name, route, ensureOIDC, ...stack);
   };
 
   const { routes, enableHttpPostMethods } = configuration;
+  const boundGrantHelpers = Object.fromEntries(
+    Object.entries(grantHelpers).map(([name, helper]) => [name, helper.bind(undefined, this)]),
+  );
 
   for (const { handler, parameters, grantType } of Object.values(grants)) {
     const { grantTypeHandlers } = instance(this);
     if (configuration.grantTypes.has(grantType) && !grantTypeHandlers.has(grantType)) {
+      const grantParameters = new Set(parameters);
       let dupes;
       if (features.resourceIndicators.enabled) {
-        parameters.add('resource');
+        grantParameters.add('resource');
         dupes = new Set(['resource']);
       }
       if (features.richAuthorizationRequests.enabled) {
-        parameters.add('authorization_details');
+        grantParameters.add('authorization_details');
       }
-      this.registerGrantType(grantType, handler, parameters, dupes);
+      this.registerGrantType(
+        grantType,
+        handler.bind(undefined, this, boundGrantHelpers),
+        grantParameters,
+        dupes,
+      );
     }
   }
 
-  ['query', 'fragment', 'form_post'].forEach((mode) => {
-    this.registerResponseMode(mode, responseModes[mode]);
-  });
+  this.registerResponseMode('query', responseModes.query);
+  this.registerResponseMode('fragment', responseModes.fragment);
+  this.registerResponseMode('form_post', responseModes.form_post);
 
   if (features.webMessageResponseMode.enabled) {
     this.registerResponseMode('web_message', responseModes.webMessage);
@@ -137,106 +156,111 @@ export default function initializeApp() {
     }
   }
 
-  const authorization = getAuthorization(this, 'authorization');
-  const authError = getAuthError(this);
+  const authorization = getAuthorization('authorization');
   get('authorization', routes.authorization, authError, ...authorization);
   if (enableHttpPostMethods) {
     post('authorization', routes.authorization, authError, ...authorization);
   }
 
-  const resume = getAuthorization(this, 'resume');
+  const resume = getAuthorization('resume');
   get('resume', `${routes.authorization}/:uid`, authError, ...resume);
 
   if (features.userinfo.enabled) {
-    get('userinfo', routes.userinfo, CORS.userinfo, error(this, 'userinfo.error'), ...userinfo);
-    post('userinfo', routes.userinfo, CORS.userinfo, error(this, 'userinfo.error'), ...userinfo);
+    get('userinfo', routes.userinfo, CORS.userinfo, error('userinfo.error'), ...userinfo);
+    post('userinfo', routes.userinfo, CORS.userinfo, error('userinfo.error'), ...userinfo);
     options('cors.userinfo', routes.userinfo, CORS.userinfo, CORS.respond);
   }
 
-  const token = getToken(this);
-  post('token', routes.token, error(this, 'grant.error'), CORS.clientWithDPoP, ...token);
+  post('token', routes.token, error('grant.error'), CORS.clientWithDPoP, ...token);
   options('cors.token', routes.token, CORS.clientWithDPoP, CORS.respond);
 
-  get('jwks', routes.jwks, CORS.open, error(this, 'jwks.error'), jwks);
+  get('jwks', routes.jwks, CORS.open, error('jwks.error'), jwks);
   options('cors.jwks', routes.jwks, CORS.open, CORS.respond);
 
   const oauthDiscoveryRoute = '/.well-known/oauth-authorization-server';
-  get('discovery', oauthDiscoveryRoute, CORS.open, error(this, 'discovery.error'), discovery);
+  get('discovery', oauthDiscoveryRoute, CORS.open, error('discovery.error'), discovery);
   options('cors.discovery', oauthDiscoveryRoute, CORS.open, CORS.respond);
 
   const openidDiscoveryRoute = '/.well-known/openid-configuration';
-  get('discovery', openidDiscoveryRoute, CORS.open, error(this, 'discovery.error'), discovery);
+  get('discovery', openidDiscoveryRoute, CORS.open, error('discovery.error'), discovery);
   options('cors.discovery', openidDiscoveryRoute, CORS.open, CORS.respond);
 
-  if (features.attestClientAuth.enabled) {
-    post('challenge', routes.challenge, error(this, 'challenge.error'), CORS.challenge, ...challenge);
+  if (features.openid4vci.enabled) {
+    const credentialIssuerRoute = '/.well-known/openid-credential-issuer';
+    get('openid_credential_issuer', credentialIssuerRoute, CORS.open, error('openid_credential_issuer.error'), openidCredentialIssuer);
+    options('cors.openid_credential_issuer', credentialIssuerRoute, CORS.open, CORS.respond);
+
+    post('credential', routes.credential, error('credential.error'), CORS.credential, ...credential);
+    options('cors.credential', routes.credential, CORS.credential, CORS.respond);
+  }
+
+  if (features.attestClientAuth.enabled || features.openid4vci.enabled) {
+    post('challenge', routes.challenge, error('challenge.error'), CORS.challenge, ...challenge);
     options('cors.challenge', routes.challenge, CORS.challenge, CORS.respond);
   }
 
   if (features.registration.enabled) {
     const clientRoute = `${routes.registration}/:clientId`;
 
-    post('registration', routes.registration, error(this, 'registration_create.error'), ...registration.post);
-    get('client', clientRoute, error(this, 'registration_read.error'), ...registration.get);
+    post('registration', routes.registration, error('registration_create.error'), ...registration.post);
+    get('client', clientRoute, error('registration_read.error'), ...registration.get);
 
     if (features.registrationManagement.enabled) {
-      put('client_update', clientRoute, error(this, 'registration_update.error'), ...registration.put);
-      del('client_delete', clientRoute, error(this, 'registration_delete.error'), ...registration.del);
+      put('client_update', clientRoute, error('registration_update.error'), ...registration.put);
+      del('client_delete', clientRoute, error('registration_delete.error'), ...registration.del);
     }
   }
 
   if (features.revocation.enabled) {
-    const revocation = getRevocation(this);
-    post('revocation', routes.revocation, error(this, 'revocation.error'), CORS.client, ...revocation);
+    post('revocation', routes.revocation, error('revocation.error'), CORS.client, ...revocation);
     options('cors.revocation', routes.revocation, CORS.client, CORS.respond);
   }
 
   if (features.introspection.enabled) {
-    const introspection = getIntrospection(this);
-    post('introspection', routes.introspection, error(this, 'introspection.error'), CORS.client, ...introspection);
+    post('introspection', routes.introspection, error('introspection.error'), CORS.client, ...introspection);
     options('cors.introspection', routes.introspection, CORS.client, CORS.respond);
   }
 
-  post('end_session_confirm', `${routes.end_session}/confirm`, error(this, 'end_session_confirm.error'), ...endSession.confirm);
+  post('end_session_confirm', `${routes.end_session}/confirm`, error('end_session_confirm.error'), ...endSession.confirm);
 
   if (features.rpInitiatedLogout.enabled) {
     if (enableHttpPostMethods) {
-      post('end_session', routes.end_session, error(this, 'end_session.error'), ...endSession.init);
+      post('end_session', routes.end_session, error('end_session.error'), ...endSession.init);
     }
-    get('end_session', routes.end_session, error(this, 'end_session.error'), ...endSession.init);
-    get('end_session_success', `${routes.end_session}/success`, error(this, 'end_session_success.error'), ...endSession.success);
+    get('end_session', routes.end_session, error('end_session.error'), ...endSession.init);
+    get('end_session_success', `${routes.end_session}/success`, error('end_session_success.error'), ...endSession.success);
   }
 
   if (features.deviceFlow.enabled) {
-    const deviceAuthorization = getAuthorization(this, 'device_authorization');
-    post('device_authorization', routes.device_authorization, error(this, 'device_authorization.error'), CORS.client, ...deviceAuthorization);
+    const deviceAuthorization = getAuthorization('device_authorization');
+    post('device_authorization', routes.device_authorization, error('device_authorization.error'), CORS.client, ...deviceAuthorization);
     options('cors.device_authorization', routes.device_authorization, CORS.client, CORS.respond);
 
-    const postCodeVerification = getAuthorization(this, 'code_verification');
-    get('code_verification', routes.code_verification, error(this, 'code_verification.error'), ...codeVerification.get);
-    post('code_verification', routes.code_verification, error(this, 'code_verification.error'), ...codeVerification.post, ...postCodeVerification);
+    const postCodeVerification = getAuthorization('code_verification');
+    get('code_verification', routes.code_verification, error('code_verification.error'), ...codeVerification.get);
+    post('code_verification', routes.code_verification, error('code_verification.error'), ...codeVerification.post, ...postCodeVerification);
 
-    const deviceResume = getAuthorization(this, 'device_resume');
-    get('device_resume', `${routes.code_verification}/:uid`, error(this, 'device_resume.error'), ...deviceResume);
+    const deviceResume = getAuthorization('device_resume');
+    get('device_resume', `${routes.code_verification}/:uid`, error('device_resume.error'), ...deviceResume);
   }
 
   if (features.pushedAuthorizationRequests.enabled) {
-    const pushedAuthorizationRequests = getAuthorization(this, 'pushed_authorization_request');
-    post('pushed_authorization_request', routes.pushed_authorization_request, error(this, 'pushed_authorization_request.error'), CORS.clientWithDPoP, ...pushedAuthorizationRequests);
+    const pushedAuthorizationRequests = getAuthorization('pushed_authorization_request');
+    post('pushed_authorization_request', routes.pushed_authorization_request, error('pushed_authorization_request.error'), CORS.clientWithDPoP, ...pushedAuthorizationRequests);
     options('cors.pushed_authorization_request', routes.pushed_authorization_request, CORS.clientWithDPoP, CORS.respond);
   }
 
   if (features.ciba.enabled) {
-    const ciba = getAuthorization(this, 'backchannel_authentication');
-    post('backchannel_authentication', routes.backchannel_authentication, error(this, 'backchannel_authentication.error'), ...ciba);
+    const ciba = getAuthorization('backchannel_authentication');
+    post('backchannel_authentication', routes.backchannel_authentication, error('backchannel_authentication.error'), ...ciba);
   }
 
   if (features.devInteractions.enabled) {
-    const interaction = devInteractions(this);
+    devInteractions.initialize(this);
 
-    get('interaction', '/interaction/:uid', error(this), ...interaction.render);
-    post('submit', '/interaction/:uid', error(this), ...interaction.submit);
-    get('abort', '/interaction/:uid/abort', error(this), ...interaction.abort);
+    get('interaction', '/interaction/:uid', error(), ...devInteractions.render);
+    post('submit', '/interaction/:uid', error(), ...devInteractions.submit);
+    get('abort', '/interaction/:uid/abort', error(), ...devInteractions.abort);
   }
 
   return router.routes();

package/dist/node_modules/oidc-provider/lib/helpers/initialize_keystore.js

@@ -1,4 +1,3 @@
-import { strict as assert } from 'node:assert';
 import * as crypto from 'node:crypto';
 
 import { DEV_KEYSTORE } from '../consts/index.js';
@@ -39,6 +38,12 @@ const calculateKid = (jwk) => {
 };
 const KEY_TYPES = new Set(['RSA', 'EC', 'OKP', 'AKP']);
 
+function check(condition, message, cause) {
+  if (!condition) {
+    throw new Error(message, { cause });
+  }
+}
+
 const jwkSignatureAlgorithms = (jwk) => {
   if (jwk.use !== 'sig' && jwk.use !== undefined) {
     return [];
@@ -86,7 +91,7 @@ const jwkSignatureAlgorithms = (jwk) => {
   }
 
   if (jwk.alg) {
-    if (available && available.includes(jwk.alg)) {
+    if (available?.includes(jwk.alg)) {
       return [jwk.alg];
     }
     return [];
@@ -128,7 +133,7 @@ const jwkEncryptionAlgorithms = (jwk) => {
   }
 
   if (jwk.alg) {
-    if (available && available.includes(jwk.alg)) {
+    if (available?.includes(jwk.alg)) {
       return [jwk.alg];
     }
     return [];
@@ -137,10 +142,6 @@ const jwkEncryptionAlgorithms = (jwk) => {
   return available || [];
 };
 
-function checkString(value, property, i) {
-  assert(typeof value === 'string' && value, `jwks.keys[${i}].${property} configuration must be a non-empty string`);
-}
-
 function isExternal(key) {
   return key instanceof ExternalSigningKey;
 }
@@ -150,51 +151,59 @@ function registerKey(input, i, keystore, kids) {
 
   let key;
   if (isExternal(input)) {
-    assert(features.externalSigningSupport.enabled, 'features.externalSigningSupport must be enabled for ExternalSigningKey support');
+    check(
+      features.externalSigningSupport.enabled,
+      'features.externalSigningSupport must be enabled for ExternalSigningKey support',
+      input,
+    );
     key = input;
   } else {
     key = structuredClone(input);
   }
-  assert(KEY_TYPES.has(key.kty), `only RSA, EC, OKP, or AKP keys should be part of jwks configuration (index ${i})`);
+
+  const checkKey = (condition, message) => check(condition, message, input);
+  const checkString = (property) => checkKey(
+    typeof key?.[property] === 'string' && key[property],
+    `jwks.keys[${i}].${property} configuration must be a non-empty string`,
+  );
+
+  checkKey(KEY_TYPES.has(key?.kty), `only RSA, EC, OKP, or AKP keys should be part of jwks configuration (index ${i})`);
   key.kid ??= calculateKid(key);
-  checkString(key.kid, 'kid', i);
+  checkString('kid');
 
-  assert(!kids.has(key.kid), 'jwks.keys configuration must not contain duplicate "kid" values');
+  checkKey(!kids.has(key.kid), 'jwks.keys configuration must not contain duplicate "kid" values');
   kids.add(key.kid);
 
   switch (key.kty) {
     case 'AKP':
-      checkString(key.alg, 'alg', i);
-      checkString(key.pub, 'pub', i);
+      checkString('alg');
+      checkString('pub');
       if (!(key instanceof ExternalSigningKey)) {
-        checkString(key.priv, 'priv', i);
+        checkString('priv');
       }
       break;
     case 'OKP':
-      checkString(key.crv, 'crv', i);
-      checkString(key.x, 'x', i);
+      checkString('crv');
+      checkString('x');
       if (!(key instanceof ExternalSigningKey)) {
-        checkString(key.d, 'd', i);
+        checkString('d');
       }
       break;
     case 'EC':
-      checkString(key.crv, 'crv', i);
-      checkString(key.x, 'x', i);
-      checkString(key.y, 'y', i);
+      checkString('crv');
+      checkString('x');
+      checkString('y');
       if (!(key instanceof ExternalSigningKey)) {
-        checkString(key.d, 'd', i);
+        checkString('d');
       }
       break;
     case 'RSA':
-      checkString(key.e, 'e', i);
-      checkString(key.n, 'n', i);
+      checkString('e');
+      checkString('n');
       if (!(key instanceof ExternalSigningKey)) {
-        checkString(key.d, 'd', i);
-        checkString(key.p, 'p', i);
-        checkString(key.q, 'q', i);
-        checkString(key.dp, 'dp', i);
-        checkString(key.dq, 'dq', i);
-        checkString(key.qi, 'qi', i);
+        for (const parameter of ['d', 'p', 'q', 'dp', 'dq', 'qi']) {
+          checkString(parameter);
+        }
       }
       break;
     default:
@@ -202,15 +211,21 @@ function registerKey(input, i, keystore, kids) {
   }
 
   if (key instanceof ExternalSigningKey) {
-    assert(key.use === 'sig', `jwks.keys[${i}] configuration "use" must be "sig"`);
+    checkKey(key.use === 'sig', `jwks.keys[${i}] configuration "use" must be "sig"`);
   }
 
   if (key.key_ops !== undefined) {
-    assert(Array.isArray(key.key_ops) && key.key_ops.length && key.key_ops.every((x) => typeof x === 'string' && x), `jwks.keys[${i}].key_ops configuration must be an array of strings`);
+    checkKey(
+      Array.isArray(key.key_ops) && key.key_ops.length && key.key_ops.every((x) => typeof x === 'string' && x),
+      `jwks.keys[${i}].key_ops configuration must be an array of strings`,
+    );
   }
 
   if (key.x5c !== undefined) {
-    assert(Array.isArray(key.x5c) && key.x5c.length && key.x5c.every((x) => typeof x === 'string' && x), `jwks.keys[${i}].x5c configuration must be an array of strings`);
+    checkKey(
+      Array.isArray(key.x5c) && key.x5c.length && key.x5c.every((x) => typeof x === 'string' && x),
+      `jwks.keys[${i}].x5c configuration must be an array of strings`,
+    );
   }
 
   let encryptionAlgs;
@@ -218,9 +233,9 @@ function registerKey(input, i, keystore, kids) {
     encryptionAlgs = jwkEncryptionAlgorithms(key);
 
     [
-      // 'idTokenEncryptionAlgValues',
+      
       'requestObjectEncryptionAlgValues',
-      // 'userinfoEncryptionAlgValues',
+      
     ].forEach((prop) => {
       configuration[prop] = [...new Set([...configuration[prop], ...encryptionAlgs])]
         .filter((v) => configuration.enabledJWA[prop].includes(v));
@@ -230,8 +245,8 @@ function registerKey(input, i, keystore, kids) {
   const signingAlgs = jwkSignatureAlgorithms(key);
   [
     'idTokenSigningAlgValues',
-    // 'requestObjectSigningAlgValues' uses client's keystore
-    // 'tokenEndpointAuthSigningAlgValues' uses client's keystore
+    
+    
     'userinfoSigningAlgValues',
     'introspectionSigningAlgValues',
     'authorizationSigningAlgValues',
@@ -242,13 +257,12 @@ function registerKey(input, i, keystore, kids) {
 
   const combined = signingAlgs.concat(encryptionAlgs).filter(Boolean);
 
-  /* eslint-disable no-param-reassign */
   if (combined.length === 1 && key.alg !== combined[0]) {
     [key.alg] = combined;
   }
 
   if (isExternal(key) && combined.length > 1) {
-    checkString(key.alg, 'alg', i);
+    checkString('alg');
   }
 
   if (encryptionAlgs?.length && !signingAlgs.length && key.use !== 'enc') {
@@ -261,34 +275,27 @@ function registerKey(input, i, keystore, kids) {
     delete key.x5c;
   }
 
-  assert(combined.length, `jwks.keys[${i}] is of no use given the other configuration, remove it`);
+  checkKey(combined.length, `jwks.keys[${i}] is of no use given the other configuration, remove it`);
   keystore.add(key);
-  /* eslint-enable */
 }
 
 export default function initialize(jwks) {
   if (jwks === undefined) {
-    // eslint-disable-next-line no-param-reassign
     jwks = structuredClone(DEV_KEYSTORE);
-    /* eslint-disable no-multi-str */
-    attention.warn('a quick start development-only signing keys are used, you are expected to \
+    attention.warn('quick start development-only signing keys are used, you are expected to \
 provide your own in the configuration "jwks" property');
-    /* eslint-enable */
   }
 
   const keystore = new KeyStore();
   const kids = new Set();
 
-  try {
-    if (!Array.isArray(jwks.keys)) {
-      throw new Error();
-    }
-    // eslint-disable-next-line no-plusplus
-    for (let i = 0; i < jwks.keys.length; i++) {
-      registerKey.call(this, jwks.keys[i], i, keystore, kids);
-    }
-  } catch (err) {
-    throw new Error(err.message || 'keystore must be a JSON Web Key Set formatted object', { cause: err });
+  check(
+    jwks !== null && typeof jwks === 'object' && Array.isArray(jwks.keys),
+    'keystore must be a JSON Web Key Set formatted object',
+    jwks,
+  );
+  for (let i = 0; i < jwks.keys.length; i++) {
+    registerKey.call(this, jwks.keys[i], i, keystore, kids);
   }
 
   instance(this).keystore = keystore;

package/dist/node_modules/oidc-provider/lib/helpers/interaction_policy/check.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-param-reassign */
-
 class Check {
   constructor(reason, description, error, check = () => {}, details = () => {}) {
     if (typeof error === 'function') {

package/dist/node_modules/oidc-provider/lib/helpers/interaction_policy/index.js

@@ -18,7 +18,9 @@ const base = () => {
       throw new TypeError('name must be a string');
     }
     const i = this.findIndex((p) => p.name === name);
-    this.splice(i, 1);
+    if (i !== -1) {
+      this.splice(i, 1);
+    }
   };
 
   DEFAULT.clear = function clearAll() {

package/dist/node_modules/oidc-provider/lib/helpers/interaction_policy/prompt.js

@@ -1,9 +1,6 @@
-/* eslint-disable no-param-reassign */
-
 import Check from './check.js';
 
 class Prompt {
-  // eslint-disable-next-line default-param-last
   constructor({ name, requestable = false } = {}, details, ...checks) {
     if (typeof requestable !== 'boolean') {
       throw new Error('requestable argument must be provided as Boolean');
@@ -70,7 +67,9 @@ class Prompt {
             throw new TypeError('reason must be a string');
           }
           const i = this.findIndex((p) => p.reason === reason);
-          this.splice(i, 1);
+          if (i !== -1) {
+            this.splice(i, 1);
+          }
         },
       },
       clear: {

package/dist/node_modules/oidc-provider/lib/helpers/interaction_policy/prompts/consent.js

@@ -1,6 +1,3 @@
-/* eslint-disable no-unused-expressions */
-/* eslint-disable camelcase */
-
 import Prompt from '../prompt.js';
 import Check from '../check.js';
 
@@ -64,7 +61,7 @@ export default () => new Prompt(
     return Check.NO_NEED_TO_PROMPT;
   }, ({ oidc }) => ({ missingOIDCClaims: oidc[missingOIDCClaims] })),
 
-  // checks resource server scopes
+  
   new Check('rs_scopes_missing', 'requested scopes not granted', (ctx) => {
     const { oidc } = ctx;
 
@@ -92,7 +89,7 @@ export default () => new Prompt(
     return Check.NO_NEED_TO_PROMPT;
   }, ({ oidc }) => ({ missingResourceScopes: oidc[missingResourceScopes] })),
 
-  // checks authorization_details
+  
   new Check('rar_prompt', 'authorization_details were requested', (ctx) => {
     const { oidc } = ctx;