@nocobase/plugin-idp-oauth 2.3.0-beta.12 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/models/access_token.js

@@ -1,23 +1,16 @@
-import apply from './mixins/apply.js';
-import hasFormat from './mixins/has_format.js';
-import hasGrantType from './mixins/has_grant_type.js';
-import hasGrantId from './mixins/has_grant_id.js';
-import isSenderConstrained from './mixins/is_sender_constrained.js';
-import isSessionBound from './mixins/is_session_bound.js';
-import setAudience from './mixins/set_audience.js';
-
-export default (provider) => class AccessToken extends apply([
-  hasGrantType,
-  hasGrantId,
-  isSenderConstrained,
-  isSessionBound(provider),
-  setAudience,
-  hasFormat(provider, 'AccessToken', provider.BaseToken),
-]) {
+import { generateTokenId, getValueAndPayload } from './formats/index.js';
+import { checkSessionBinding, setThumbprint, setAudience } from './token_helpers.js';
+
+export default (provider) => class AccessToken extends provider.BaseToken {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
-
+      'gty',
+      'grantId',
+      'x5t#S256',
+      'jkt',
+      'sessionUid',
+      'expiresWithSession',
       'accountId',
       'aud',
       'rar',
@@ -28,4 +21,36 @@ export default (provider) => class AccessToken extends apply([
       'sid',
     ];
   }
+
+  static async find(...args) {
+    return checkSessionBinding(provider, await super.find(...args), args[1]);
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+
+  setThumbprint(prop, input) {
+    setThumbprint(this, prop, input);
+  }
+
+  isSenderConstrained() {
+    return !!(this.jkt || this['x5t#S256']);
+  }
+
+  get tokenType() {
+    return this.jkt ? 'DPoP' : 'Bearer';
+  }
+
+  setAudience(audience) {
+    setAudience(this, audience);
+  }
+
+  generateTokenId() {
+    return generateTokenId(provider, this);
+  }
+
+  async getValueAndPayload() {
+    return getValueAndPayload(provider, this);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/authorization_code.js

@@ -1,27 +1,49 @@
-import apply from './mixins/apply.js';
-import consumable from './mixins/consumable.js';
-import hasFormat from './mixins/has_format.js';
-import hasGrantId from './mixins/has_grant_id.js';
-import isAttestationConstrained from './mixins/is_attestation_constrained.js';
-import isSessionBound from './mixins/is_session_bound.js';
-import storesAuth from './mixins/stores_auth.js';
-import storesPKCE from './mixins/stores_pkce.js';
+import { checkSessionBinding, setAttestBinding } from './token_helpers.js';
 
-export default (provider) => class AuthorizationCode extends apply([
-  consumable,
-  isSessionBound(provider),
-  hasGrantId,
-  isAttestationConstrained,
-  storesAuth,
-  storesPKCE,
-  hasFormat(provider, 'AuthorizationCode', provider.BaseToken),
-]) {
+export default (provider) => class AuthorizationCode extends provider.BaseToken {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
+      'consumed',
+      'sessionUid',
+      'expiresWithSession',
+      'grantId',
+      'attestationJkt',
+      'accountId',
+      'acr',
+      'amr',
+      'authTime',
+      'claims',
+      'nonce',
+      'resource',
+      'scope',
+      'sid',
+      'codeChallenge',
+      'codeChallengeMethod',
       'redirectUri',
       'dpopJkt',
       'rar',
     ];
   }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  static async find(...args) {
+    return checkSessionBinding(provider, await super.find(...args), args[1]);
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+
+  async setAttestBinding(ctx) {
+    await setAttestBinding(this, ctx);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/backchannel_authentication_request.js

@@ -1,26 +1,48 @@
-import apply from './mixins/apply.js';
-import consumable from './mixins/consumable.js';
-import hasFormat from './mixins/has_format.js';
-import hasGrantId from './mixins/has_grant_id.js';
-import isAttestationConstrained from './mixins/is_attestation_constrained.js';
-import isSessionBound from './mixins/is_session_bound.js';
-import storesAuth from './mixins/stores_auth.js';
+import { checkSessionBinding, setAttestBinding } from './token_helpers.js';
 
-export default (provider) => class BackchannelAuthenticationRequest extends apply([
-  consumable,
-  hasGrantId,
-  isAttestationConstrained,
-  isSessionBound(provider),
-  storesAuth,
-  hasFormat(provider, 'BackchannelAuthenticationRequest', provider.BaseToken),
-]) {
+export default (provider) => class BackchannelAuthenticationRequest extends provider.BaseToken {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
+      'consumed',
+      'grantId',
+      'attestationJkt',
+      'sessionUid',
+      'expiresWithSession',
+      'accountId',
+      'acr',
+      'amr',
+      'authTime',
+      'claims',
+      'nonce',
+      'resource',
+      'scope',
+      'sid',
       'error',
       'errorDescription',
       'params',
       'rar',
     ];
   }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  static async find(...args) {
+    return checkSessionBinding(provider, await super.find(...args), args[1]);
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+
+  async setAttestBinding(ctx) {
+    await setAttestBinding(this, ctx);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/base_model.js

@@ -1,12 +1,10 @@
-/* eslint-disable max-classes-per-file */
-
 import snakeCase from '../helpers/_/snake_case.js';
 import epochTime from '../helpers/epoch_time.js';
-import pickBy from '../helpers/_/pick_by.js';
-import instance from '../helpers/weak_cache.js';
 import isConstructable from '../helpers/type_validators.js';
+import instance from '../helpers/weak_cache.js';
 
-import hasFormat from './mixins/has_format.js';
+import * as opaque from './formats/opaque.js';
+import pickPayload from './payload.js';
 
 const IN_PAYLOAD = [
   'iat',
@@ -32,12 +30,25 @@ export default function getBaseModel(provider) {
     return adapterCache.get(obj);
   }
 
-  class Class {
-    constructor({ jti, kind, ...payload } = {}) {
-      Object.assign(this, pickBy(
-        payload,
-        (val, key) => this.constructor.IN_PAYLOAD.includes(key),
-      ));
+  class BaseModel {
+    constructor(input = {}) {
+      const payload = pickPayload(this.constructor, input);
+      const { jti, kind } = payload;
+
+      for (const key of Object.keys(payload)) {
+        if (key !== 'jti' && key !== 'kind') {
+          if (key === '__proto__') {
+            Object.defineProperty(this, key, {
+              configurable: true,
+              enumerable: true,
+              value: payload[key],
+              writable: true,
+            });
+          } else {
+            this[key] = payload[key];
+          }
+        }
+      }
 
       if (kind && kind !== this.constructor.name) {
         throw new TypeError('kind mismatch');
@@ -51,12 +62,24 @@ export default function getBaseModel(provider) {
       return new this(payload);
     }
 
+    generateTokenId() {
+      return opaque.generateTokenId(provider, this);
+    }
+
+    async getValueAndPayload() {
+      return opaque.getValueAndPayload(provider, this);
+    }
+
+    static async verify(stored, options = {}) {
+      return opaque.verify(provider, stored, options);
+    }
+
     async save(ttl) {
       if (!this.jti) {
         this.jti = this.generateTokenId();
       }
 
-      // this is true for all BaseToken descendants
+      
       if (typeof this.constructor.expiresIn !== 'function') {
         this.exp = epochTime() + ttl;
       }
@@ -102,7 +125,7 @@ export default function getBaseModel(provider) {
         const payload = await this.verify(stored, { ignoreExpiration });
 
         return this.instantiate(payload);
-      } catch (err) {
+      } catch {
         return undefined;
       }
     }
@@ -111,12 +134,12 @@ export default function getBaseModel(provider) {
       provider.emit(`${snakeCase(this.kind)}.${eventName}`, this);
     }
 
-    /*
-     * ttlPercentagePassed
-     * returns a Number (0 to 100) with the value being percentage of the token's ttl already
-     * passed. The higher the percentage the older the token is. At 0 the token is fresh, at a 100
-     * it is expired.
-     */
+    
+
+
+
+
+
     ttlPercentagePassed() {
       const now = epochTime();
       const percentage = Math.floor(100 * ((now - this.iat) / (this.exp - this.iat)));
@@ -135,7 +158,5 @@ export default function getBaseModel(provider) {
     }
   }
 
-  class BaseModel extends hasFormat(provider, 'base', Class) {}
-
   return BaseModel;
 }

package/dist/node_modules/oidc-provider/lib/models/base_token.js

@@ -1,5 +1,6 @@
-import instance from '../helpers/weak_cache.js';
 import als from '../helpers/als.js';
+import { positiveInteger } from '../helpers/configuration_result.js';
+import instance from '../helpers/weak_cache.js';
 
 export default function getBaseToken(provider) {
   class BaseToken extends instance(provider).BaseModel {
@@ -42,13 +43,14 @@ export default function getBaseToken(provider) {
 
     static expiresIn(...args) {
       const ttl = instance(provider).configuration.ttl[this.name];
+      const path = `ttl.${this.name}`;
 
       if (typeof ttl === 'number') {
-        return ttl;
+        return positiveInteger(ttl, path);
       }
 
       if (typeof ttl === 'function') {
-        return ttl(...args);
+        return positiveInteger(ttl(...args), path);
       }
 
       return undefined;

package/dist/node_modules/oidc-provider/lib/models/client.js

@@ -1,4 +1,3 @@
-/* eslint-disable max-classes-per-file */
 import * as crypto from 'node:crypto';
 import { STATUS_CODES } from 'node:http';
 
@@ -24,9 +23,57 @@ import fetchRequest from '../helpers/fetch_request.js';
 import fetchBodyCheck from '../helpers/fetch_body_check.js';
 import { isValidClientIdUrl, resolveClientByMetadataDocument } from '../helpers/client_id_metadata_document.js';
 
-// intentionally ignore x5t#S256 so that they are left to be calculated by the library
+
 const EC_CURVES = new Set(['P-256', 'P-384', 'P-521']);
 const OKP_SUBTYPES = new Set(['Ed25519', 'X25519']);
+const CLIENT_JWK_REQUIREMENTS = new Map([
+  ['EC', { required: ['x', 'y'], privateParameters: ['d'], subtype: { parameter: 'crv', values: EC_CURVES } }],
+  ['OKP', { required: ['x'], privateParameters: ['d'], subtype: { parameter: 'crv', values: OKP_SUBTYPES } }],
+  ['AKP', { required: ['alg', 'pub'], privateParameters: ['priv'] }],
+  ['RSA', { required: ['e', 'n'], privateParameters: ['d', 'p', 'q', 'dp', 'dq', 'qi', 'oth'] }],
+]);
+
+function stripLoopbackPort(uri) {
+  const parsed = URL.parse(uri);
+  if (!parsed || parsed.protocol !== 'http:' || !LOOPBACKS.has(parsed.hostname)) {
+    return undefined;
+  }
+
+  const schemeEnd = uri.indexOf('://');
+  if (schemeEnd === -1) {
+    return undefined;
+  }
+
+  const authorityStart = schemeEnd + 3;
+  const authorityEndOffset = uri.slice(authorityStart).search(/[/?#]/u);
+  const authorityEnd = authorityEndOffset === -1
+    ? uri.length
+    : authorityStart + authorityEndOffset;
+  const authority = uri.slice(authorityStart, authorityEnd);
+  const hostStart = authority.lastIndexOf('@') + 1;
+  const hostAndPort = authority.slice(hostStart);
+
+  let portStart;
+  if (hostAndPort.startsWith('[')) {
+    const bracketEnd = hostAndPort.indexOf(']');
+    if (bracketEnd === -1 || hostAndPort[bracketEnd + 1] !== ':') {
+      return uri;
+    }
+    portStart = hostStart + bracketEnd + 1;
+  } else {
+    const portOffset = hostAndPort.lastIndexOf(':');
+    if (portOffset === -1) {
+      return uri;
+    }
+    portStart = hostStart + portOffset;
+  }
+
+  if (!/^\d*$/u.test(authority.slice(portStart + 1))) {
+    return undefined;
+  }
+
+  return `${uri.slice(0, authorityStart + portStart)}${uri.slice(authorityEnd)}`;
+}
 
 const validateJWKS = (jwks) => {
   if (jwks !== undefined) {
@@ -69,54 +116,63 @@ function isHmac(prop) {
   return /^HS/.test(value);
 }
 
-function checkJWK(jwk) {
+function checkJWK(jwk, i) {
+  const prefix = `jwks.keys[${i}]`;
+
   try {
-    if (!(isPlainObject(jwk))) throw new Error();
-    if (!(typeof jwk.kty === 'string' && jwk.kty)) throw new Error();
-
-    switch (jwk.kty) {
-      case 'EC':
-        if (!(typeof jwk.crv === 'string' && jwk.crv)) throw new Error();
-        if (!EC_CURVES.has(jwk.crv)) return undefined;
-        if (!(typeof jwk.x === 'string' && jwk.x)) throw new Error();
-        if (!(typeof jwk.y === 'string' && jwk.y)) throw new Error();
-        if (jwk.d !== undefined) throw new Error();
-        break;
-      case 'OKP':
-        if (!(typeof jwk.crv === 'string' && jwk.crv)) throw new Error();
-        if (!OKP_SUBTYPES.has(jwk.crv)) return undefined;
-        if (!(typeof jwk.x === 'string' && jwk.x)) throw new Error();
-        if (jwk.d !== undefined) throw new Error();
-        break;
-      case 'AKP':
-        if (!(typeof jwk.alg === 'string' && jwk.alg)) throw new Error();
-        if (!(typeof jwk.pub === 'string' && jwk.pub)) throw new Error();
-        if (jwk.priv !== undefined) throw new Error();
-        break;
-      case 'RSA':
-        if (!(typeof jwk.e === 'string' && jwk.e)) throw new Error();
-        if (!(typeof jwk.n === 'string' && jwk.n)) throw new Error();
-        if (jwk.d !== undefined) throw new Error();
-        break;
-      case 'oct':
-        throw new Error();
-      default:
-        return undefined;
+    const invalid = (message) => {
+      throw new Error(message, { cause: jwk });
+    };
+    const requireString = (parameter, { keyType, optional = false } = {}) => {
+      if (optional && jwk[parameter] === undefined) return;
+
+      if (!(typeof jwk[parameter] === 'string' && jwk[parameter])) {
+        const qualifier = keyType ? ` for ${keyType} keys` : optional ? ' if provided' : '';
+        invalid(`${prefix}.${parameter} must be a non-empty string${qualifier}`);
+      }
+    };
+
+    if (!(isPlainObject(jwk))) invalid(`${prefix} must be a plain object`);
+    requireString('kty');
+
+    const requirements = CLIENT_JWK_REQUIREMENTS.get(jwk.kty);
+    if (!requirements) {
+      if (jwk.kty === 'oct') invalid(`${prefix} must not contain symmetric keys`);
+      return undefined;
     }
 
-    if (!(jwk.alg === undefined || (typeof jwk.alg === 'string' && jwk.alg))) throw new Error();
-    if (!(jwk.kid === undefined || (typeof jwk.kid === 'string' && jwk.kid))) throw new Error();
-    if (!(jwk.use === undefined || (typeof jwk.use === 'string' && jwk.use))) throw new Error();
-    if (!(jwk.x5c === undefined || (Array.isArray(jwk.x5c) && jwk.x5c.every((x) => typeof x === 'string' && x)))) throw new Error();
-  } catch {
-    throw new InvalidClientMetadata('client JSON Web Key Set is invalid');
+    const keyType = jwk.kty;
+    if (requirements.subtype) {
+      requireString(requirements.subtype.parameter, { keyType });
+      if (!requirements.subtype.values.has(jwk[requirements.subtype.parameter])) return undefined;
+    }
+
+    for (const parameter of requirements.required) {
+      requireString(parameter, { keyType });
+    }
+
+    for (const parameter of requirements.privateParameters) {
+      if (jwk[parameter] !== undefined) {
+        invalid(`${prefix}.${parameter} must not be provided for ${keyType} keys`);
+      }
+    }
+
+    for (const parameter of ['alg', 'kid', 'use']) {
+      requireString(parameter, { optional: true });
+    }
+
+    if (!(jwk.x5c === undefined || (Array.isArray(jwk.x5c) && jwk.x5c.every((x) => typeof x === 'string' && x)))) {
+      invalid(`${prefix}.x5c must be an array of non-empty strings if provided`);
+    }
+  } catch (cause) {
+    throw new InvalidClientMetadata('client JSON Web Key Set is invalid', { cause });
   }
 
   return jwk;
 }
 
 function deriveEncryptionKey(secret, length) {
-  const digest = length <= 32 ? 'sha256' : length <= 48 ? 'sha384' : length <= 64 ? 'sha512' : false; // eslint-disable-line no-nested-ternary
+  const digest = length <= 32 ? 'sha256' : length <= 48 ? 'sha384' : length <= 64 ? 'sha512' : false;
   if (!digest) {
     throw new Error('unsupported symmetric encryption key derivation');
   }
@@ -159,7 +215,6 @@ export default function getClient(provider) {
 
     add(key) {
       if (this.client.clientAuthMethod === 'self_signed_tls_client_auth' && Array.isArray(key.x5c) && key.x5c.length) {
-        // eslint-disable-next-line no-param-reassign
         key['x5t#S256'] = certificateThumbprint(key.x5c[0]);
       }
       super.add(key);
@@ -181,7 +236,7 @@ export default function getClient(provider) {
           const body = JSON.parse(buf.toString());
           const { headers, status } = response;
 
-          // min refetch in 60 seconds unless cache headers say a longer response ttl
+          
           const freshUntil = [epochTime() + 60];
 
           if (headers.has('expires')) {
@@ -196,7 +251,7 @@ export default function getClient(provider) {
           this.freshUntil = Math.max(...freshUntil.filter(Boolean));
 
           if (status !== 200) {
-            throw new Error(`unexpected jwks_uri response status code, expected 200 OK, got ${status} ${STATUS_CODES[status]}`);
+            throw new Error(`unexpected jwks_uri response status code, expected 200 OK, got ${status} ${STATUS_CODES[status]}`, { cause: response });
           }
 
           validateJWKS(body);
@@ -208,9 +263,9 @@ export default function getClient(provider) {
             .forEach(ClientKeyStore.prototype.add.bind(this));
 
           delete this.lock;
-        })().catch((err) => {
+        })().catch((cause) => {
           delete this.lock;
-          throw new InvalidClientMetadata('client JSON Web Key Set failed to be refreshed', err.error_description || err.message);
+          throw new InvalidClientMetadata('client JSON Web Key Set failed to be refreshed', { cause });
         });
       }
 
@@ -325,7 +380,7 @@ export default function getClient(provider) {
     constructor(metadata, ctx, { cimd } = {}) {
       const schema = new Client.Schema(metadata, ctx, undefined, cimd);
 
-      Object.assign(this, mapKeys(schema, (value, key) => {
+      Object.assign(this, mapKeys(schema, (_value, key) => {
         if (!instance(provider).RECOGNIZED_METADATA.includes(key)) {
           return key;
         }
@@ -416,7 +471,6 @@ export default function getClient(provider) {
       return this.responseTypes.includes(type);
     }
 
-    // eslint-disable-next-line no-unused-vars
     responseModeAllowed(responseMode, responseType, fapiProfile) {
       if (fapiProfile === '1.0 Final' && !responseType.includes('id_token') && !responseMode.includes('jwt')) {
         return false;
@@ -430,28 +484,20 @@ export default function getClient(provider) {
     }
 
     #redirectAllowed(value, allowedUris) {
-      const parsed = URL.parse(value);
-      if (!parsed) return false;
+      if (allowedUris.includes(value)) {
+        return true;
+      }
 
-      const match = allowedUris.find((allowed) => URL.parse(allowed)?.href === parsed.href);
-      if (
-        !!match
-        || this.applicationType !== 'native'
-        || parsed.protocol !== 'http:'
-        || !LOOPBACKS.has(parsed.hostname)
-      ) {
-        return !!match;
+      if (this.applicationType !== 'native') {
+        return false;
       }
 
-      parsed.port = '';
+      const withoutPort = stripLoopbackPort(value);
+      if (withoutPort === undefined) {
+        return false;
+      }
 
-      return !!allowedUris
-        .find((allowed) => {
-          const registered = URL.parse(allowed);
-          if (!registered) return false;
-          registered.port = '';
-          return parsed.href === registered.href;
-        });
+      return allowedUris.some((allowed) => stripLoopbackPort(allowed) === withoutPort);
     }
 
     redirectUriAllowed(value) {
@@ -471,7 +517,7 @@ export default function getClient(provider) {
     }
 
     metadata() {
-      return mapKeys(this, (value, key) => {
+      return mapKeys(this, (_value, key) => {
         const snaked = snakeCase(key);
         if (!instance(provider).RECOGNIZED_METADATA.includes(snaked)) {
           return key;

package/dist/node_modules/oidc-provider/lib/models/client_credentials.js

@@ -1,19 +1,40 @@
-import setAudience from './mixins/set_audience.js';
-import hasFormat from './mixins/has_format.js';
-import isSenderConstrained from './mixins/is_sender_constrained.js';
-import apply from './mixins/apply.js';
+import { generateTokenId, getValueAndPayload } from './formats/index.js';
+import { setThumbprint, setAudience } from './token_helpers.js';
 
-export default (provider) => class ClientCredentials extends apply([
-  setAudience,
-  isSenderConstrained,
-  hasFormat(provider, 'ClientCredentials', provider.BaseToken),
-]) {
+export default (provider) => class ClientCredentials extends provider.BaseToken {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
+      'x5t#S256',
+      'jkt',
       'aud',
       'extra',
+      'rar',
       'scope',
     ];
   }
+
+  setThumbprint(prop, input) {
+    setThumbprint(this, prop, input);
+  }
+
+  isSenderConstrained() {
+    return !!(this.jkt || this['x5t#S256']);
+  }
+
+  get tokenType() {
+    return this.jkt ? 'DPoP' : 'Bearer';
+  }
+
+  setAudience(audience) {
+    setAudience(this, audience);
+  }
+
+  generateTokenId() {
+    return generateTokenId(provider, this);
+  }
+
+  async getValueAndPayload() {
+    return getValueAndPayload(provider, this);
+  }
 };