@nocobase/plugin-idp-oauth 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/actions/authorization/pushed_authorization_requests.js

@@ -0,0 +1,127 @@
+import { UnsecuredJWT } from 'jose';
+
+import { InvalidRequestUri, RequestUriNotSupported, InvalidRedirectUri, InvalidRequest } from '../../helpers/errors.js';
+import instance from '../../helpers/weak_cache.js';
+import { PUSHED_REQUEST_URN } from '../../consts/index.js';
+import epochTime from '../../helpers/epoch_time.js';
+import * as JWT from '../../helpers/jwt.js';
+
+
+
+
+export async function loadPushedAuthorizationRequest(ctx, next) {
+  const { pushedAuthorizationRequests } = instance(ctx.oidc.provider).features;
+  const { params, provider: { PushedAuthorizationRequest } } = ctx.oidc;
+
+  rejectRequestAndUri(ctx, () => {});
+
+  if (params.request_uri !== undefined) {
+    if (pushedAuthorizationRequests.enabled && params.request_uri.startsWith(PUSHED_REQUEST_URN)) {
+      if (!URL.canParse(params.request_uri)) {
+        throw new InvalidRequestUri('invalid request_uri');
+      }
+      const [, id] = params.request_uri.split(PUSHED_REQUEST_URN);
+      const pushedAuthorizationRequest = await PushedAuthorizationRequest.find(id, {
+        ignoreExpiration: true,
+      });
+      if (!pushedAuthorizationRequest?.isValid) {
+        throw new InvalidRequestUri('request_uri is invalid, expired, or was already used');
+      }
+      ctx.oidc.entity('PushedAuthorizationRequest', pushedAuthorizationRequest);
+      params.request = pushedAuthorizationRequest.request;
+    } else {
+      throw new RequestUriNotSupported();
+    }
+  }
+
+  return next();
+}
+
+
+
+
+async function requestObjectRemapErrors(_ctx, next) {
+  return next().catch((err) => {
+    if (err instanceof InvalidRedirectUri) {
+      Object.assign(err, {
+        message: 'invalid_request',
+        error: 'invalid_request',
+      });
+    }
+
+    throw err;
+  });
+}
+
+const MAX_TTL = 60;
+
+export async function pushedAuthorizationRequestResponse(ctx) {
+  let request;
+  let ttl;
+  let dpopJkt;
+  const now = epochTime();
+  if (ctx.oidc.body.request) {
+    ({ request } = ctx.oidc.body);
+    const { payload: { exp, dpop_jkt: thumbprint } } = JWT.decode(request);
+    ttl = exp - now;
+
+    if (!Number.isInteger(ttl) || ttl > MAX_TTL) {
+      ttl = MAX_TTL;
+    }
+    dpopJkt = thumbprint || ctx.oidc.params.dpop_jkt;
+  } else {
+    ttl = MAX_TTL;
+    const payload = { ...ctx.oidc.params };
+
+    if (payload.claims) {
+      payload.claims = JSON.parse(payload.claims);
+    }
+
+    if (payload.authorization_details) {
+      payload.authorization_details = JSON.parse(payload.authorization_details);
+    }
+
+    request = new UnsecuredJWT(payload)
+      .setIssuedAt(now)
+      .setIssuer(ctx.oidc.client.clientId)
+      .setAudience(ctx.oidc.issuer)
+      .setExpirationTime(now + MAX_TTL)
+      .setNotBefore(now)
+      .encode();
+    dpopJkt = ctx.oidc.params.dpop_jkt;
+  }
+
+  const requestObject = new ctx.oidc.provider.PushedAuthorizationRequest({
+    request,
+    dpopJkt,
+    trusted: ctx.oidc.client.clientAuthMethod !== 'none' || !!ctx.oidc.trusted?.length,
+  });
+
+  if (ctx.oidc.client.clientAuthMethod === 'attest_jwt_client_auth') {
+    await requestObject.setAttestBinding(ctx);
+  }
+
+  const id = await requestObject.save(ttl);
+
+  ctx.oidc.entity('PushedAuthorizationRequest', requestObject);
+
+  ctx.status = 201;
+  ctx.body = {
+    expires_in: ttl,
+    request_uri: `${PUSHED_REQUEST_URN}${id}`,
+  };
+  ctx.oidc.provider.emit('pushed_authorization_request.success', ctx, ctx.oidc.client);
+}
+
+
+
+
+export function rejectRequestAndUri(ctx, next) {
+  if (ctx.oidc.params.request !== undefined && ctx.oidc.params.request_uri !== undefined) {
+    throw new InvalidRequest('request and request_uri parameters MUST NOT be used together');
+  }
+
+  return next();
+}
+
+export { requestObjectRemapErrors as pushedAuthorizationRequestRemapErrors };

package/dist/node_modules/oidc-provider/lib/actions/authorization/request_parameters.js

@@ -0,0 +1,188 @@
+import {
+  InvalidRequest,
+  RequestNotSupported,
+  RequestUriNotSupported,
+  RegistrationNotSupported,
+} from '../../helpers/errors.js';
+import instance from '../../helpers/weak_cache.js';
+import { PARAM_LIST } from '../../consts/index.js';
+import assembleParams from '../../shared/assemble_params.js';
+import rejectDupes from '../../shared/reject_dupes.js';
+
+const requestParams = new WeakMap();
+const nonFrontchannelRoutes = new Set([
+  'device_authorization', 'code_verification', 'device_resume', 'backchannel_authentication',
+]);
+const frontchannelParams = [
+  'web_message_uri', 'response_type', 'response_mode', 'code_challenge_method',
+  'code_challenge', 'state', 'redirect_uri', 'prompt',
+];
+const cibaParams = [
+  'client_notification_token', 'login_hint_token', 'binding_message',
+  'user_code', 'request_context', 'requested_expiry',
+];
+const dpopRoutes = new Set(['authorization', 'resume', 'pushed_authorization_request']);
+const resourceDupes = { except: new Set(['resource']) };
+
+export function getAuthorizationParams(ctx) {
+  if (requestParams.has(ctx)) {
+    return requestParams.get(ctx);
+  }
+
+  const { features, extraParams } = instance(ctx.oidc.provider).configuration;
+  const { route } = ctx.oidc;
+  const allowList = new Set(PARAM_LIST);
+
+  if (features.webMessageResponseMode.enabled) {
+    allowList.add('web_message_uri'); 
+  }
+  if (features.claimsParameter.enabled) allowList.add('claims');
+  if (features.resourceIndicators.enabled) allowList.add('resource');
+  if (features.richAuthorizationRequests.enabled) allowList.add('authorization_details');
+
+  extraParams.forEach(Set.prototype.add.bind(allowList));
+
+  if (nonFrontchannelRoutes.has(route)) {
+    for (const param of frontchannelParams) allowList.delete(param);
+  }
+  if (route === 'backchannel_authentication') {
+    for (const param of cibaParams) allowList.add(param);
+  }
+  if (features.dPoP.enabled && dpopRoutes.has(route)) allowList.add('dpop_jkt');
+
+  requestParams.set(ctx, allowList);
+  return allowList;
+}
+
+export function assembleAuthorizationParams(ctx, next) {
+  return assembleParams(getAuthorizationParams(ctx), ctx, next);
+}
+
+export function rejectAuthorizationDupes(ctx, next) {
+  const { resourceIndicators } = instance(ctx.oidc.provider).features;
+  return rejectDupes(resourceIndicators.enabled ? resourceDupes : undefined, ctx, next);
+}
+
+
+
+
+export function rejectUnsupported(ctx, next) {
+  const {
+    requestObjects,
+    pushedAuthorizationRequests,
+    webMessageResponseMode,
+  } = instance(ctx.oidc.provider).features;
+  const { params } = ctx.oidc;
+
+  if (params.request !== undefined && !requestObjects.enabled) {
+    throw new RequestNotSupported();
+  }
+
+  if (
+    params.request_uri !== undefined
+    && (ctx.oidc.route !== 'authorization' || !pushedAuthorizationRequests.enabled)
+  ) {
+    throw new RequestUriNotSupported();
+  }
+
+  if (webMessageResponseMode.enabled && params.response_mode?.includes('web_message') && params.web_message_uri) {
+    const error = new InvalidRequest('Web Message Response Mode Relay Mode is not supported');
+    error.allow_redirect = false;
+    throw error;
+  }
+
+  return next();
+}
+
+
+
+
+export function rejectRegistration(ctx, next) {
+  if (ctx.oidc.params.registration !== undefined) {
+    throw new RegistrationNotSupported();
+  }
+
+  return next();
+}
+
+
+
+
+
+export function assignDefaults(ctx, next) {
+  const { params, client } = ctx.oidc;
+
+  if (!params.acr_values && client.defaultAcrValues) {
+    params.acr_values = client.defaultAcrValues.join(' ');
+  }
+
+  if (params.max_age === undefined && client.defaultMaxAge !== undefined) {
+    params.max_age = client.defaultMaxAge.toString();
+  }
+
+  return next();
+}
+
+
+
+
+
+export function checkPrompt(ctx, next) {
+  if (ctx.oidc.params.prompt !== undefined) {
+    const { prompts } = ctx.oidc;
+    const supported = instance(ctx.oidc.provider).configuration.prompts;
+
+    for (const prompt of prompts) {
+      if (!supported.has(prompt)) {
+        throw new InvalidRequest('unsupported prompt value requested');
+      }
+    }
+
+    if (prompts.has('none') && prompts.size !== 1) {
+      throw new InvalidRequest('prompt none must only be used alone');
+    }
+  }
+
+  return next();
+}
+
+
+
+
+export function checkMaxAge(ctx, next) {
+  if (ctx.oidc.params.max_age !== undefined) {
+    const maxAge = +ctx.oidc.params.max_age;
+
+    if (!Number.isSafeInteger(maxAge) || Math.sign(maxAge) === -1) {
+      throw new InvalidRequest('invalid max_age parameter value');
+    }
+
+    if (maxAge === 0) {
+      const { prompts } = ctx.oidc;
+      ctx.oidc.params.max_age = undefined;
+      if (!prompts.has('login')) {
+        prompts.add('login');
+        ctx.oidc.params.prompt = [...prompts].join(' ');
+      }
+    }
+  }
+
+  return next();
+}
+
+
+
+
+export async function checkExtraParams(ctx, next) {
+  const { extraParamsValidations } = instance(ctx.oidc.provider).configuration;
+
+  if (!extraParamsValidations) {
+    return next();
+  }
+
+  for (const [param, validator] of extraParamsValidations) {
+    await validator(ctx, ctx.oidc.params[param], ctx.oidc.client);
+  }
+
+  return next();
+}

package/dist/node_modules/oidc-provider/lib/actions/authorization/respond.js

@@ -1,16 +1,17 @@
+import omitBy from '../../helpers/_/omit_by.js';
 import instance from '../../helpers/weak_cache.js';
 import { InvalidRequestUri } from '../../helpers/errors.js';
 import processResponseTypes from '../../helpers/process_response_types.js';
 
-/*
- * Based on the authorization request response mode either redirects with parameters in query or
- * fragment or renders auto-submitting form with the response members as hidden fields.
- *
- * If session management is supported stores User-Agent readable cookie with the session stated
- * used by the OP iframe to detect session state changes.
- *
- * @emits: authorization.success
- */
+
+
+
+
+
+
+
+
+
 export default async function respond(ctx) {
   let pushedAuthorizationRequest = ctx.oidc.entities.PushedAuthorizationRequest;
 
@@ -42,5 +43,9 @@ export default async function respond(ctx) {
   ctx.oidc.provider.emit('authorization.success', ctx, out);
 
   const handler = instance(ctx.oidc.provider).responseModes.get(responseMode);
-  await handler(ctx, params.redirect_uri, out);
+  
+  
+  
+  
+  await handler(ctx, params.redirect_uri, omitBy(out, (value) => value === undefined));
 }

package/dist/node_modules/oidc-provider/lib/actions/authorization/response_parameters.js

@@ -0,0 +1,175 @@
+import {
+  InvalidRequest,
+  UnsupportedResponseMode,
+  UnsupportedResponseType,
+  InvalidRedirectUri,
+} from '../../helpers/errors.js';
+import instance from '../../helpers/weak_cache.js';
+import { isFrontChannel } from '../../helpers/resolve_response_mode.js';
+import presence from '../../helpers/validate_presence.js';
+
+
+
+
+
+export function checkResponseMode(ctx, next) {
+  const { params, client } = ctx.oidc;
+
+  const frontChannel = isFrontChannel(params.response_type);
+
+  const mode = ctx.oidc.responseMode;
+
+  if (
+    mode !== undefined
+    && !instance(ctx.oidc.provider).responseModes.has(mode)
+  ) {
+    params.response_mode = undefined;
+    throw new UnsupportedResponseMode();
+  }
+
+  if (!ctx.oidc.client.responseModeAllowed(mode, params.response_type, ctx.oidc.fapiProfile)) {
+    throw new InvalidRequest('requested response_mode is not allowed for this client or request');
+  }
+
+  const JWT = /jwt/.test(mode);
+
+  if (
+    mode !== undefined && JWT
+    && (
+      /^HS/.test(client.authorizationSignedResponseAlg)
+      || /^(A|dir$)/.test(client.authorizationEncryptedResponseAlg)
+    )
+  ) {
+    try {
+      client.checkClientSecretExpiration('client secret is expired, cannot issue a JWT Authorization response');
+    } catch (err) {
+      const [explicit] = mode === 'jwt' ? [undefined] : mode.split('.');
+      params.response_mode = explicit || undefined;
+      throw err;
+    }
+  }
+
+  const msg = 'requested response_mode is not allowed for the requested response_type';
+  if (mode === 'query' && frontChannel) {
+    throw new InvalidRequest(msg);
+  } else if (mode === 'query.jwt' && frontChannel && !client.authorizationEncryptedResponseAlg) {
+    throw new InvalidRequest(`${msg} unless encrypted`);
+  }
+
+  return next();
+}
+
+
+
+
+
+export function checkResponseType(ctx, next) {
+  const { params } = ctx.oidc;
+  const supported = instance(ctx.oidc.provider).configuration.responseTypes;
+
+  params.response_type = [...new Set(params.response_type.split(' '))].sort().join(' ');
+
+  if (!supported.includes(params.response_type)) {
+    throw new UnsupportedResponseType();
+  }
+
+  if (!ctx.oidc.client.responseTypeAllowed(params.response_type)) {
+    throw new InvalidRequest('requested response_type is not allowed for this client');
+  }
+
+  return next();
+}
+
+function allowUnregisteredUri(ctx) {
+  const { pushedAuthorizationRequests } = instance(ctx.oidc.provider).features;
+
+  return (ctx.oidc.route === 'pushed_authorization_request' || ('PushedAuthorizationRequest' in ctx.oidc.entities))
+    && pushedAuthorizationRequests.allowUnregisteredRedirectUris
+    && ctx.oidc.client.sectorIdentifierUri === undefined
+    && ctx.oidc.client.clientAuthMethod !== 'none';
+}
+
+function validateUnregisteredUri(ctx) {
+  const { redirectUris: validator } = ctx.oidc.provider.Client.Schema.prototype;
+
+  validator.call({
+    ...ctx.oidc.client.metadata(),
+    invalidate(detail) {
+      throw new InvalidRequest(detail.replace('redirect_uris', 'redirect_uri'));
+    },
+  }, [ctx.oidc.params.redirect_uri]);
+
+  return true;
+}
+
+
+
+
+export function checkRedirectUri(ctx, next) {
+  if (!ctx.oidc.client.redirectUriAllowed(ctx.oidc.params.redirect_uri)) {
+    if (!allowUnregisteredUri(ctx)) {
+      throw new InvalidRedirectUri();
+    }
+
+    validateUnregisteredUri(ctx);
+  }
+
+  ctx.oidc.redirectUriCheckPerformed = true;
+
+  return next();
+}
+
+
+
+
+
+export function oneRedirectUriClients(ctx, next) {
+  if (!instance(ctx.oidc.provider).configuration.allowOmittingSingleRegisteredRedirectUri || ctx.oidc.isFapi('2.0')) {
+    return next();
+  }
+
+  const { params, client } = ctx.oidc;
+
+  if (params.redirect_uri === undefined && client.redirectUris.length === 1) {
+    ctx.oidc.redirectUriCheckPerformed = true;
+    [params.redirect_uri] = client.redirectUris;
+  }
+
+  return next();
+}
+
+
+
+
+export function oauthRequired(ctx, next) {
+  
+  presence(ctx, 'response_type', 'client_id');
+
+  return next();
+}
+
+
+
+
+
+
+export function oidcRequired(ctx, next) {
+  const { params } = ctx.oidc;
+
+  const required = new Set(['redirect_uri']);
+
+  
+  
+  if (typeof params.response_type === 'string' && params.response_type.includes('id_token')) {
+    required.add('nonce');
+  }
+
+  
+  if (ctx.oidc.isFapi('1.0 Final')) {
+    required.add(ctx.oidc.requestParamScopes.has('openid') ? 'nonce' : 'state');
+  }
+
+  presence(ctx, ...required);
+
+  return next();
+}

package/dist/node_modules/oidc-provider/lib/actions/authorization/resume.js

@@ -6,8 +6,12 @@ import instance from '../../helpers/weak_cache.js';
 import Params from '../../helpers/params.js';
 import formPost from '../../response_modes/form_post.js';
 import epochTime from '../../helpers/epoch_time.js';
+import { getAuthorizationParams } from './request_parameters.js';
 
-export default async function resumeAction(allowList, resumeRouteName, ctx, next) {
+const errorMap = { ...errors };
+
+export default async function resumeAction(ctx, next) {
+  const resumeRouteName = ctx.oidc.route === 'device_resume' ? 'device_resume' : 'resume';
   const cookieOptions = instance(ctx.oidc.provider).configuration.cookies.short;
 
   const cookieId = ctx.cookies.get(
@@ -68,7 +72,7 @@ export default async function resumeAction(allowList, resumeRouteName, ctx, next
 
   await interactionSession.destroy();
 
-  const params = new (Params(allowList))(storedParams);
+  const params = new Params(getAuthorizationParams(ctx), storedParams);
   ctx.oidc.params = params;
   ctx.oidc.trusted = trusted;
   ctx.oidc.redirectUriCheckPerformed = true;
@@ -85,8 +89,8 @@ export default async function resumeAction(allowList, resumeRouteName, ctx, next
 
   if (result?.error) {
     const className = upperFirst(camelCase(result.error));
-    if (errors[className]) {
-      throw new errors[className](result.error_description);
+    if (errorMap[className]) {
+      throw new errorMap[className](result.error_description);
     }
     throw new errors.CustomOIDCProviderError(result.error, result.error_description);
   }

package/dist/node_modules/oidc-provider/lib/actions/authorization/scopes.js

@@ -0,0 +1,109 @@
+import { InvalidScope, InvalidRequest } from '../../helpers/errors.js';
+import isValidScope from '../../helpers/is_valid_scope.js';
+import instance from '../../helpers/weak_cache.js';
+import { getAuthorizationParams } from './request_parameters.js';
+
+
+
+
+
+export async function checkScope(ctx, next) {
+  const PARAM_LIST = getAuthorizationParams(ctx);
+  const { scopes: statics } = instance(ctx.oidc.provider).configuration;
+  const { prompts, client } = ctx.oidc;
+
+  if (!isValidScope(ctx.oidc.params.scope)) {
+    throw new InvalidScope('scope contains invalid characters');
+  }
+
+  const scopes = [...new Set(ctx.oidc.params.scope?.split(' '))];
+
+  const responseType = ctx.oidc.params.response_type;
+
+  
+
+
+
+
+
+
+
+
+
+  if (scopes.includes('offline_access')) {
+    if (
+      (PARAM_LIST.has('response_type') && !responseType.includes('code'))
+      || (PARAM_LIST.has('prompt') && !prompts.has('consent'))
+      || !client.grantTypeAllowed('refresh_token')
+    ) {
+      scopes.splice(scopes.indexOf('offline_access'), 1);
+    }
+  }
+
+  if (scopes.length) {
+    ctx.oidc.params.scope = scopes.join(' ');
+  } else {
+    ctx.oidc.params.scope = undefined;
+  }
+
+  if (client.scope) {
+    const allowList = new Set(client.scope.split(' '));
+
+    for (const scope of scopes.filter(Set.prototype.has.bind(statics))) {
+      if (!allowList.has(scope)) {
+        throw new InvalidScope('requested scope is not allowed', scope);
+      }
+    }
+  }
+
+  return next();
+}
+
+const GATED_CLIENT = Object.entries({
+  defaultAcrValues: 'default_acr_values',
+  defaultMaxAge: 'default_max_age',
+  requireAuthTime: 'require_auth_time',
+});
+
+const GATED = [
+  'acr_values',
+  'claims',
+  'claims_locales',
+  'id_token_hint',
+  'max_age',
+  'nonce',
+];
+
+
+
+
+function checkOpenIdScope(ctx, next) {
+  const PARAM_LIST = getAuthorizationParams(ctx);
+  if (ctx.oidc.params.scope?.split(' ').includes('openid')) {
+    return next();
+  }
+
+  if (PARAM_LIST.has('response_type') && ctx.oidc.params.response_type.includes('id_token')) {
+    throw new InvalidRequest('openid scope must be requested for this response_type');
+  }
+
+  GATED_CLIENT.forEach(([prop, msg]) => {
+    if (ctx.oidc.client[prop]) {
+      throw new InvalidRequest(`openid scope must be requested for clients with ${msg}`);
+    }
+  });
+
+  GATED.forEach((param) => {
+    if (ctx.oidc.params[param] !== undefined) {
+      throw new InvalidRequest(`openid scope must be requested when using the ${param} parameter`);
+    }
+  });
+
+  if (ctx.oidc.route === 'backchannel_authentication') {
+    throw new InvalidRequest('openid scope must be requested for this request');
+  }
+
+  return next();
+}
+
+export { checkOpenIdScope as checkOpenidScope };