@nocobase/plugin-idp-oauth 2.3.0-beta.11 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/actions/grants/pre_authorized_code.js

@@ -0,0 +1,70 @@
+import {
+  InvalidGrant, InvalidRequest,
+} from '../../helpers/errors.js';
+import presence from '../../helpers/validate_presence.js';
+import revoke from '../../helpers/revoke.js';
+import constantEquals from '../../helpers/constant_equals.js';
+import { issueTokens } from '../../helpers/grant_common.js';
+
+export const gty = 'pre_authorized_code';
+
+export const handler = async function preAuthorizedCodeHandler(provider, helpers, ctx) {
+  const {
+    checkDpopRequired,
+    checkMtlsCert,
+    validateDpop,
+    findGrantSource,
+    consumeGrantSource,
+    validateGrant,
+  } = helpers;
+
+  presence(ctx, 'pre-authorized_code');
+
+  const dPoP = await validateDpop(ctx);
+
+  const code = await findGrantSource(
+    ctx,
+    provider.PreAuthorizedCode,
+    ctx.oidc.params['pre-authorized_code'],
+    'pre-authorized code',
+  );
+
+  const cert = checkMtlsCert(ctx);
+  checkDpopRequired(ctx, dPoP);
+
+  if (code.isExpired) {
+    throw new InvalidGrant('pre-authorized code is expired');
+  }
+
+  if (code.txCode !== undefined) {
+    presence(ctx, 'tx_code');
+  } else if (ctx.oidc.params.tx_code !== undefined) {
+    throw new InvalidRequest('tx_code is not expected for this pre-authorized code');
+  }
+
+  await consumeGrantSource(ctx, code, 'pre-authorized code');
+
+  if (
+    code.txCode !== undefined
+    && (
+      typeof ctx.oidc.params.tx_code !== 'string'
+      || !constantEquals(code.txCode, ctx.oidc.params.tx_code, 1000)
+    )
+  ) {
+    await revoke(ctx, code.grantId);
+    throw new InvalidGrant('invalid tx_code provided');
+  }
+
+  const grant = await validateGrant(ctx, code.grantId);
+
+  ctx.oidc.entity('PreAuthorizedCode', code);
+  ctx.oidc.entity('Grant', grant);
+
+  await issueTokens(provider, helpers, ctx, code, grant, {
+    gty, entityLabel: 'pre-authorized code', cert, dPoP,
+  });
+};
+
+export const parameters = new Set(['pre-authorized_code', 'tx_code']);
+
+export const grantType = 'urn:ietf:params:oauth:grant-type:pre-authorized_code';

package/dist/node_modules/oidc-provider/lib/actions/grants/refresh_token.js

@@ -1,57 +1,51 @@
 import difference from '../../helpers/_/difference.js';
-import { InvalidRequest, InvalidGrant, InvalidScope } from '../../helpers/errors.js';
-import presence from '../../helpers/validate_presence.js';
-import instance from '../../helpers/weak_cache.js';
-import revoke from '../../helpers/revoke.js';
 import certificateThumbprint from '../../helpers/certificate_thumbprint.js';
-import * as formatters from '../../helpers/formatters.js';
-import dpopValidate, { CHALLENGE_OK_WINDOW } from '../../helpers/validate_dpop.js';
-import resolveResource from '../../helpers/resolve_resource.js';
-import epochTime from '../../helpers/epoch_time.js';
-import checkRar from '../../shared/check_rar.js';
 import { checkAttestBinding } from '../../helpers/check_attest_binding.js';
 import {
-  checkDpopRequired,
-  validateGrant,
-  validateAccount,
+  boolean,
+  resourceServer as validateResourceServer,
+} from '../../helpers/configuration_result.js';
+import { InvalidGrant, InvalidScope } from '../../helpers/errors.js';
+import * as formatters from '../../helpers/formatters.js';
+import {
+  applyMtlsBinding,
   checkAccountMismatch,
   createAccessToken,
-  applyMtlsBinding,
   issueIdToken,
-  buildTokenResponse,
+  validateAccount,
 } from '../../helpers/grant_common.js';
-
-import { gty as deviceCodeGty } from './device_code.js';
-
-function rarSupported(token) {
-  const [origin] = token.gty.split(' ');
-  return origin !== deviceCodeGty;
-}
+import resolveResource from '../../helpers/resolve_resource.js';
+import revoke from '../../helpers/revoke.js';
+import presence from '../../helpers/validate_presence.js';
+import instance from '../../helpers/weak_cache.js';
 
 const gty = 'refresh_token';
 
-export const handler = async function refreshTokenHandler(ctx) {
+export const handler = async function refreshTokenHandler(provider, helpers, ctx) {
+  const {
+    checkDpopReplay,
+    checkDpopRequired,
+    validateDpop,
+    validateGrant,
+    applyAuthorizationDetails,
+    buildTokenResponse,
+  } = helpers;
+
   presence(ctx, 'refresh_token');
 
   const {
-    findAccount,
-    conformIdTokenClaims,
     rotateRefreshToken,
     features: {
       userinfo,
       mTLS: { getCertificate },
-      dPoP: { allowReplay },
       resourceIndicators,
-      richAuthorizationRequests,
     },
-  } = instance(ctx.oidc.provider).configuration;
+  } = instance(provider).configuration;
 
-  const {
-    RefreshToken, AccessToken, ReplayDetection,
-  } = ctx.oidc.provider;
+  const { RefreshToken } = provider;
   const { client } = ctx.oidc;
 
-  const dPoP = await dpopValidate(ctx);
+  const dPoP = await validateDpop(ctx);
 
   let refreshTokenValue = ctx.oidc.params.refresh_token;
   let refreshToken = await RefreshToken.find(refreshTokenValue, { ignoreExpiration: true });
@@ -92,15 +86,7 @@ export const handler = async function refreshTokenHandler(ctx) {
     }
   }
 
-  if (dPoP && !allowReplay) {
-    const unique = await ReplayDetection.unique(
-      client.clientId,
-      dPoP.jti,
-      epochTime() + CHALLENGE_OK_WINDOW,
-    );
-
-    ctx.assert(unique, new InvalidGrant('DPoP proof JWT Replay detected'));
-  }
+  await checkDpopReplay(ctx, dPoP, client.clientId, InvalidGrant);
 
   if (refreshToken.jkt && (!dPoP || refreshToken.jkt !== dPoP.thumbprint)) {
     throw new InvalidGrant('failed jkt verification');
@@ -113,7 +99,7 @@ export const handler = async function refreshTokenHandler(ctx) {
   ctx.oidc.entity('RefreshToken', refreshToken);
   ctx.oidc.entity('Grant', grant);
 
-  const account = await validateAccount(ctx, findAccount, refreshToken, 'refresh token');
+  const account = await validateAccount(provider, ctx, refreshToken, 'refresh token');
   checkAccountMismatch(refreshToken, grant);
 
   ctx.oidc.entity('Account', account);
@@ -126,13 +112,12 @@ export const handler = async function refreshTokenHandler(ctx) {
     throw new InvalidGrant('refresh token already used');
   }
 
-  if (ctx.oidc.params.authorization_details && !rarSupported(refreshToken)) {
-    throw new InvalidRequest('authorization_details is unsupported for this refresh token');
-  }
-
   if (
     rotateRefreshToken === true
-    || (typeof rotateRefreshToken === 'function' && await rotateRefreshToken(ctx))
+    || (
+      typeof rotateRefreshToken === 'function'
+      && boolean(await rotateRefreshToken(ctx), 'rotateRefreshToken')
+    )
   ) {
     await refreshToken.consume();
     ctx.oidc.entity('RotatedRefreshToken', refreshToken);
@@ -168,7 +153,7 @@ export const handler = async function refreshTokenHandler(ctx) {
     refreshTokenValue = await refreshToken.save();
   }
 
-  const at = createAccessToken(ctx, AccessToken, {
+  const at = createAccessToken(provider, ctx, {
     accountId: account.accountId,
     expiresWithSession: refreshToken.expiresWithSession,
     grantId: refreshToken.grantId,
@@ -187,7 +172,6 @@ export const handler = async function refreshTokenHandler(ctx) {
   }
 
   const scope = ctx.oidc.params.scope ? ctx.oidc.requestParamScopes : refreshToken.scopes;
-  await checkRar(ctx, () => {});
   const resource = await resolveResource(
     ctx,
     refreshToken,
@@ -196,9 +180,10 @@ export const handler = async function refreshTokenHandler(ctx) {
   );
 
   if (resource) {
-    const resourceServerInfo = await resourceIndicators
-      .getResourceServerInfo(ctx, resource, ctx.oidc.client);
-    at.resourceServer = new ctx.oidc.provider.ResourceServer(resource, resourceServerInfo);
+    const resourceServerInfo = validateResourceServer(
+      await resourceIndicators.getResourceServerInfo(ctx, resource, ctx.oidc.client),
+    );
+    at.resourceServer = new provider.ResourceServer(resource, resourceServerInfo);
     at.scope = grant.getResourceScopeFiltered(
       resource,
       [...scope].filter(Set.prototype.has.bind(at.resourceServer.scopes)),
@@ -208,19 +193,21 @@ export const handler = async function refreshTokenHandler(ctx) {
     at.scope = grant.getOIDCScopeFiltered(scope);
   }
 
-  if (richAuthorizationRequests.enabled && at.resourceServer) {
-    at.rar = await richAuthorizationRequests.rarForRefreshTokenResponse(ctx, at.resourceServer);
-  }
+  await applyAuthorizationDetails(ctx, at, refreshToken);
 
   ctx.oidc.entity('AccessToken', at);
   const accessToken = await at.save();
 
-  const idToken = await issueIdToken(ctx, refreshToken, at, grant, {
-    conformIdTokenClaims, userinfo,
-  }, scope);
+  const idToken = await issueIdToken(provider, ctx, refreshToken, at, grant, scope);
 
-  ctx.body = buildTokenResponse(at, accessToken, {
-    idToken, refreshToken: refreshTokenValue, source: refreshToken, rar: at.rar,
+  ctx.body = buildTokenResponse({
+    accessToken,
+    authorizationDetails: at.rar,
+    expiresIn: at.expiration,
+    idToken,
+    refreshToken: refreshTokenValue,
+    scope: refreshToken.scope ? at.scope : (at.scope || undefined),
+    tokenType: at.tokenType,
   });
 };
 

package/dist/node_modules/oidc-provider/lib/actions/index.js

@@ -1,25 +1,29 @@
 import getAuthorization from './authorization/index.js';
 import userinfo from './userinfo.js';
-import getToken from './token.js';
+import token from './token.js';
 import jwks from './jwks.js';
 import * as registration from './registration.js';
-import getRevocation from './revocation.js';
-import getIntrospection from './introspection.js';
+import revocation from './revocation.js';
+import introspection from './introspection.js';
 import discovery from './discovery.js';
 import challenge from './challenge.js';
 import * as endSession from './end_session.js';
 import * as codeVerification from './code_verification.js';
+import openidCredentialIssuer from './openid_credential_issuer.js';
+import credential from './credential.js';
 
 export {
   getAuthorization,
   userinfo,
-  getToken,
+  token,
   jwks,
   registration,
-  getRevocation,
-  getIntrospection,
+  revocation,
+  introspection,
   discovery,
   endSession,
   codeVerification,
   challenge,
+  openidCredentialIssuer,
+  credential,
 };

package/dist/node_modules/oidc-provider/lib/actions/interaction.js

@@ -3,12 +3,17 @@ import * as querystring from 'node:querystring';
 import { inspect } from 'node:util';
 
 import * as attention from '../helpers/attention.js';
+import htmlSafe from '../helpers/html_safe.js';
 import { urlencoded as parseBody } from '../shared/selective_body.js';
 import * as views from '../views/index.js';
 import instance from '../helpers/weak_cache.js';
 import noCache from '../shared/no_cache.js';
 import { defaults } from '../helpers/defaults.js';
 
+
+
+const viewMap = { login: views.login, interaction: views.interaction };
+
 const { interactions: { url: defaultInteractionUri } } = defaults;
 const keys = new Set();
 const dbg = (obj) => querystring.stringify(Object.entries(obj).reduce((acc, [key, value]) => {
@@ -16,11 +21,10 @@ const dbg = (obj) => querystring.stringify(Object.entries(obj).reduce((acc, [key
   acc[key] = inspect(value, { depth: null });
   return acc;
 }, {}), '<br/>', ': ', {
-  encodeURIComponent(value) { return keys.has(value) ? `<strong>${value}</strong>` : value; },
+  encodeURIComponent(value) { return keys.has(value) ? `<strong>${value}</strong>` : htmlSafe(value); },
 });
 
-export default function devInteractions(provider) {
-  /* eslint-disable no-multi-str */
+export function initialize(provider) {
   attention.warn('a quick start development-only feature devInteractions is enabled, \
 you are expected to disable these interactions and provide your own');
 
@@ -30,121 +34,128 @@ you are expected to disable these interactions and provide your own');
     attention.warn('you\'ve configured your own interactions.url but devInteractions are still enabled, \
 your configuration is not in effect');
   }
-  /* eslint-enable */
 
   configuration.url = (ctx, interaction) => new URL(ctx.oidc.urlFor('interaction', { uid: interaction.uid })).pathname;
+}
 
-  return {
-    render: [
-      noCache,
-      async function interactionRender(ctx) {
-        const {
-          uid, prompt, params, session,
-        } = await provider.interactionDetails(ctx.req, ctx.res);
-        const client = await provider.Client.find(params.client_id);
-
-        let view;
-        let title;
-
-        switch (prompt.name) {
-          case 'login':
-            view = 'login';
-            title = 'Sign-in';
-            break;
-          case 'consent':
-            view = 'interaction';
-            title = 'Authorize';
-            break;
-          default:
-            ctx.throw(501, 'not implemented');
-        }
+export const render = [
+  noCache,
+  async function interactionRender(ctx) {
+    const { provider } = ctx.oidc;
+    const {
+      uid, prompt, params, session,
+    } = await provider.interactionDetails(ctx.req, ctx.res);
+    const client = await provider.Client.find(params.client_id);
 
-        const locals = {
-          client,
-          uid,
-          abortUrl: ctx.oidc.urlFor('abort', { uid }),
-          submitUrl: ctx.oidc.urlFor('submit', { uid }),
-          details: prompt.details,
-          prompt: prompt.name,
-          params,
-          title,
-          session: session ? dbg(session) : undefined,
-          dbg: {
-            params: dbg(params),
-            prompt: dbg(prompt),
-          },
-        };
-
-        locals.body = views[view](locals);
-
-        ctx.type = 'html';
-        ctx.body = views.layout(locals);
-      },
-    ],
-    abort: [
-      noCache,
-      function interactionAbort(ctx) {
-        const result = {
-          error: 'access_denied',
-          error_description: 'End-User aborted interaction',
-        };
-
-        return provider.interactionFinished(ctx.req, ctx.res, result, {
-          mergeWithLastSubmission: false,
-        });
+    let view;
+    let title;
+
+    switch (prompt.name) {
+      case 'login':
+        view = 'login';
+        title = 'Sign-in';
+        break;
+      case 'consent':
+        view = 'interaction';
+        title = 'Authorize';
+        break;
+      default:
+        ctx.throw(501, 'not implemented');
+    }
+
+    const locals = {
+      client,
+      uid,
+      abortUrl: ctx.oidc.urlFor('abort', { uid }),
+      submitUrl: ctx.oidc.urlFor('submit', { uid }),
+      details: prompt.details,
+      prompt: prompt.name,
+      params,
+      title,
+      session: session ? dbg(session) : undefined,
+      dbg: {
+        params: dbg(params),
+        prompt: dbg(prompt),
       },
-    ],
-    submit: [
-      noCache,
-      parseBody,
-      async function interactionSubmit(ctx) {
-        const {
-          prompt: { name, details }, grantId, session, params,
-        } = await provider.interactionDetails(ctx.req, ctx.res);
-        switch (ctx.oidc.body.prompt) { // eslint-disable-line default-case
-          case 'login': {
-            assert.equal(name, 'login');
-            await provider.interactionFinished(ctx.req, ctx.res, {
-              login: { accountId: ctx.oidc.body.login },
-            }, { mergeWithLastSubmission: false });
-            break;
+    };
+
+    locals.body = viewMap[view](locals);
+
+    ctx.type = 'html';
+    ctx.body = views.layout(locals);
+  },
+];
+
+export const abort = [
+  noCache,
+  function interactionAbort(ctx) {
+    const { provider } = ctx.oidc;
+    const result = {
+      error: 'access_denied',
+      error_description: 'End-User aborted interaction',
+    };
+
+    return provider.interactionFinished(ctx.req, ctx.res, result, {
+      mergeWithLastSubmission: false,
+    });
+  },
+];
+
+export const submit = [
+  noCache,
+  parseBody,
+  async function interactionSubmit(ctx) {
+    const { provider } = ctx.oidc;
+    const {
+      prompt: { name, details }, grantId, session, params,
+    } = await provider.interactionDetails(ctx.req, ctx.res);
+    switch (ctx.oidc.body.prompt) {
+      case 'login': {
+        assert.equal(name, 'login');
+        await provider.interactionFinished(ctx.req, ctx.res, {
+          login: { accountId: ctx.oidc.body.login },
+        }, { mergeWithLastSubmission: false });
+        break;
+      }
+      case 'consent': {
+        assert.equal(name, 'consent');
+
+        let grant;
+        if (grantId) {
+          
+          grant = await provider.Grant.find(grantId);
+        } else {
+          
+          grant = new provider.Grant({
+            accountId: session.accountId,
+            clientId: params.client_id,
+          });
+        }
+
+        if (details.missingOIDCScope) {
+          grant.addOIDCScope(details.missingOIDCScope.join(' '));
+        }
+        if (details.missingOIDCClaims) {
+          grant.addOIDCClaims(details.missingOIDCClaims);
+        }
+        if (details.missingResourceScopes) {
+          for (const [indicator, scope] of Object.entries(details.missingResourceScopes)) {
+            grant.addResourceScope(indicator, scope.join(' '));
           }
-          case 'consent': {
-            assert.equal(name, 'consent');
-
-            let grant;
-            if (grantId) {
-              // we'll be modifying existing grant in existing session
-              grant = await provider.Grant.find(grantId);
-            } else {
-              // we're establishing a new grant
-              grant = new provider.Grant({
-                accountId: session.accountId,
-                clientId: params.client_id,
-              });
-            }
-
-            if (details.missingOIDCScope) {
-              grant.addOIDCScope(details.missingOIDCScope.join(' '));
-            }
-            if (details.missingOIDCClaims) {
-              grant.addOIDCClaims(details.missingOIDCClaims);
-            }
-            if (details.missingResourceScopes) {
-              for (const [indicator, scope] of Object.entries(details.missingResourceScopes)) {
-                grant.addResourceScope(indicator, scope.join(' '));
-              }
-            }
-            const result = { consent: { grantId: await grant.save() } };
-            await provider.interactionFinished(ctx.req, ctx.res, result, {
-              mergeWithLastSubmission: true,
-            });
-            break;
+        }
+        if (details.rar) {
+          for (const detail of details.rar) {
+            grant.addRar(detail);
           }
-          default:
-            ctx.throw(501, 'not implemented');
         }
-      },
-    ],
-  };
-}
+        const result = { consent: { grantId: await grant.save() } };
+        await provider.interactionFinished(ctx.req, ctx.res, result, {
+          mergeWithLastSubmission: true,
+        });
+        break;
+      }
+      default:
+        ctx.throw(501, 'not implemented');
+    }
+  },
+];