@nocobase/plugin-idp-oauth 2.3.0-beta.12 → 2.3.0-beta.13

package/dist/node_modules/oidc-provider/lib/models/id_token.js

@@ -1,13 +1,12 @@
-/* eslint-disable no-unused-expressions */
-import { format } from 'node:util';
 import * as crypto from 'node:crypto';
-
+import { format } from 'node:util';
+import isPlainObject from '../helpers/_/is_plain_object.js';
 import merge from '../helpers/_/merge.js';
+import { positiveInteger } from '../helpers/configuration_result.js';
 import epochTime from '../helpers/epoch_time.js';
-import * as JWT from '../helpers/jwt.js';
 import { InvalidClientMetadata } from '../helpers/errors.js';
+import * as JWT from '../helpers/jwt.js';
 import instance from '../helpers/weak_cache.js';
-import isPlainObject from '../helpers/_/is_plain_object.js';
 
 const hashes = ['at_hash', 'c_hash', 's_hash'];
 
@@ -28,7 +27,7 @@ function getHashArgs(alg) {
     case 'ES512':
     case 'HS512':
     case 'Ed25519':
-    case 'EdDSA': // alias for Ed25519, Ed448 is not supported
+    case 'EdDSA': 
       return 'sha512';
     case 'ML-DSA-44':
     case 'ML-DSA-65':
@@ -70,10 +69,10 @@ export default function getIdToken(provider) {
       const ttl = instance(provider).configuration.ttl[this.name];
 
       if (typeof ttl === 'number') {
-        return ttl;
+        return positiveInteger(ttl, `ttl.${this.name}`);
       }
 
-      return ttl(...args);
+      return positiveInteger(ttl(...args), `ttl.${this.name}`);
     }
 
     set(key, value) { this.extra[key] = value; }
@@ -169,12 +168,12 @@ export default function getIdToken(provider) {
 
       const signed = await (async () => {
         if (typeof alg !== 'string') {
-          throw new Error();
+          throw new Error(`${use} signing algorithm must be a string`, { cause: client });
         }
         let jwk;
         let key;
         if (alg.startsWith('HS')) {
-          if (use !== 'authorization') { // handled in checkResponseMode
+          if (use !== 'authorization') { 
             client.checkClientSecretExpiration(format(messages.sig[use], alg));
           }
           [jwk] = client.symmetricKeyStore.selectForSign({ alg, use: 'sig' });
@@ -208,7 +207,7 @@ export default function getIdToken(provider) {
       }
 
       if (/^(A|dir$)/.test(encryption.alg)) {
-        if (use !== 'authorization') { // handled in checkResponseMode
+        if (use !== 'authorization') { 
           client.checkClientSecretExpiration(format(messages.enc[use], encryption.alg));
         }
       }
@@ -217,14 +216,14 @@ export default function getIdToken(provider) {
       let encryptionKey;
       if (encryption.alg === 'dir') {
         [jwk] = client.symmetricKeyStore.selectForEncrypt({ alg: encryption.enc, use: 'enc' });
-        jwk && (encryptionKey = client.symmetricKeyStore.getKeyObject(jwk, true));
+        if (jwk) encryptionKey = client.symmetricKeyStore.getKeyObject(jwk, true);
       } else if (encryption.alg.startsWith('A')) {
         [jwk] = client.symmetricKeyStore.selectForEncrypt({ alg: encryption.alg, use: 'enc' });
-        jwk && (encryptionKey = client.symmetricKeyStore.getKeyObject(jwk, true));
+        if (jwk) encryptionKey = client.symmetricKeyStore.getKeyObject(jwk, true);
       } else {
         await client.asymmetricKeyStore.refresh();
         [jwk] = client.asymmetricKeyStore.selectForEncrypt({ alg: encryption.alg, use: 'enc' });
-        jwk && (encryptionKey = client.asymmetricKeyStore.getKeyObject(jwk, true));
+        if (jwk) encryptionKey = client.asymmetricKeyStore.getKeyObject(jwk, true);
       }
 
       if (!encryptionKey) {

package/dist/node_modules/oidc-provider/lib/models/index.js

@@ -10,6 +10,7 @@ import getIdToken from './id_token.js';
 import getInitialAccessToken from './initial_access_token.js';
 import getInteraction from './interaction.js';
 import getPushedAuthorizationRequest from './pushed_authorization_request.js';
+import getPreAuthorizedCode from './pre_authorized_code.js';
 import getRefreshToken from './refresh_token.js';
 import getRegistrationAccessToken from './registration_access_token.js';
 import getReplayDetection from './replay_detection.js';
@@ -28,6 +29,7 @@ export {
   getIdToken,
   getInitialAccessToken,
   getInteraction,
+  getPreAuthorizedCode,
   getPushedAuthorizationRequest,
   getRefreshToken,
   getRegistrationAccessToken,

package/dist/node_modules/oidc-provider/lib/models/initial_access_token.js

@@ -1,12 +1,18 @@
-import apply from './mixins/apply.js';
-import hasFormat from './mixins/has_format.js';
-import hasPolicies from './mixins/has_policies.js';
+import { validatePolicies } from './token_helpers.js';
 
-export default (provider) => class InitialAccessToken extends apply([
-  hasPolicies(provider),
-  hasFormat(provider, 'InitialAccessToken', provider.BaseToken),
-]) {
+export default (provider) => class InitialAccessToken extends provider.BaseToken {
   static get IN_PAYLOAD() {
-    return super.IN_PAYLOAD.filter((v) => v !== 'clientId');
+    return [...super.IN_PAYLOAD, 'policies'].filter((v) => v !== 'clientId');
+  }
+
+  async save() {
+    if (typeof this.policies !== 'undefined') validatePolicies(provider, this.policies);
+    return super.save();
+  }
+
+  static async find(...args) {
+    const result = await super.find(...args);
+    if (result && typeof result.policies !== 'undefined') validatePolicies(provider, result.policies);
+    return result;
   }
 };

package/dist/node_modules/oidc-provider/lib/models/interaction.js

@@ -1,11 +1,9 @@
 import instance from '../helpers/weak_cache.js';
 import epochTime from '../helpers/epoch_time.js';
 
-import hasFormat from './mixins/has_format.js';
-
-export default (provider) => class Interaction extends hasFormat(provider, 'Interaction', instance(provider).BaseModel) {
+export default (provider) => class Interaction extends instance(provider).BaseModel {
   constructor(jti, payload) {
-    if (arguments.length === 2) {
+    if (payload !== undefined) {
       if (payload.session instanceof instance(provider).BaseModel) {
         const { session } = payload;
         Object.assign(payload, session.accountId ? {

package/dist/node_modules/oidc-provider/lib/models/payload.js

@@ -0,0 +1,33 @@
+const cache = new WeakMap();
+
+function properties(Model) {
+  let result = cache.get(Model);
+  if (result === undefined) {
+    result = new Set(Model.IN_PAYLOAD);
+    cache.set(Model, result);
+  }
+  return result;
+}
+
+export default function pick(Model, input) {
+  if (input === null) {
+    throw new TypeError('invalid model payload');
+  }
+
+  const source = Object(input);
+  const allowed = properties(Model);
+  const result = {};
+
+  for (const key of Object.keys(source)) {
+    if (allowed.has(key)) {
+      Object.defineProperty(result, key, {
+        configurable: true,
+        enumerable: true,
+        value: source[key],
+        writable: true,
+      });
+    }
+  }
+
+  return result;
+}

package/dist/node_modules/oidc-provider/lib/models/pre_authorized_code.js

@@ -0,0 +1,28 @@
+export default (provider) => class PreAuthorizedCode extends provider.BaseToken {
+  static get IN_PAYLOAD() {
+    return [
+      ...super.IN_PAYLOAD,
+      'consumed',
+      'grantId',
+      'accountId',
+      'claims',
+      'rar',
+      'resource',
+      'scope',
+      'txCode',
+    ];
+  }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+};

package/dist/node_modules/oidc-provider/lib/models/pushed_authorization_request.js

@@ -1,21 +1,29 @@
 import instance from '../helpers/weak_cache.js';
 
-import apply from './mixins/apply.js';
-import hasFormat from './mixins/has_format.js';
-import consumable from './mixins/consumable.js';
-import isAttestationConstrained from './mixins/is_attestation_constrained.js';
+import { setAttestBinding } from './token_helpers.js';
 
-export default (provider) => class PushedAuthorizationRequest extends apply([
-  consumable,
-  isAttestationConstrained,
-  hasFormat(provider, 'PushedAuthorizationRequest', instance(provider).BaseModel),
-]) {
+export default (provider) => class PushedAuthorizationRequest extends instance(provider).BaseModel {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
+      'consumed',
+      'attestationJkt',
       'request',
       'dpopJkt',
       'trusted',
     ];
   }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  async setAttestBinding(ctx) {
+    await setAttestBinding(this, ctx);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/refresh_token.js

@@ -1,25 +1,8 @@
 import epochTime from '../helpers/epoch_time.js';
 
-import apply from './mixins/apply.js';
-import consumable from './mixins/consumable.js';
-import hasFormat from './mixins/has_format.js';
-import hasGrantId from './mixins/has_grant_id.js';
-import hasGrantType from './mixins/has_grant_type.js';
-import isSenderConstrained from './mixins/is_sender_constrained.js';
-import isAttestationConstrained from './mixins/is_attestation_constrained.js';
-import isSessionBound from './mixins/is_session_bound.js';
-import storesAuth from './mixins/stores_auth.js';
-
-export default (provider) => class RefreshToken extends apply([
-  consumable,
-  hasGrantType,
-  hasGrantId,
-  isSenderConstrained,
-  isAttestationConstrained,
-  isSessionBound(provider),
-  storesAuth,
-  hasFormat(provider, 'RefreshToken', provider.BaseToken),
-]) {
+import { checkSessionBinding, setThumbprint, setAttestBinding } from './token_helpers.js';
+
+export default (provider) => class RefreshToken extends provider.BaseToken {
   constructor(...args) {
     super(...args);
     if (!this.iiat) {
@@ -30,18 +13,67 @@ export default (provider) => class RefreshToken extends apply([
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
-
+      'consumed',
+      'gty',
+      'grantId',
+      'x5t#S256',
+      'jkt',
+      'attestationJkt',
+      'sessionUid',
+      'expiresWithSession',
+      'accountId',
+      'acr',
+      'amr',
+      'authTime',
+      'claims',
+      'nonce',
+      'resource',
+      'scope',
+      'sid',
       'rar',
       'rotations',
       'iiat',
     ];
   }
 
-  /*
-   * totalLifetime()
-   * number of seconds since the very first refresh token chain iat
-   */
+  
+
+
+
   totalLifetime() {
     return epochTime() - this.iiat;
   }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  static async find(...args) {
+    return checkSessionBinding(provider, await super.find(...args), args[1]);
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+
+  setThumbprint(prop, input) {
+    setThumbprint(this, prop, input);
+  }
+
+  isSenderConstrained() {
+    return !!(this.jkt || this['x5t#S256']);
+  }
+
+  get tokenType() {
+    return this.jkt ? 'DPoP' : 'Bearer';
+  }
+
+  async setAttestBinding(ctx) {
+    await setAttestBinding(this, ctx);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/registration_access_token.js

@@ -1,8 +1,21 @@
-import apply from './mixins/apply.js';
-import hasFormat from './mixins/has_format.js';
-import hasPolicies from './mixins/has_policies.js';
+import { validatePolicies } from './token_helpers.js';
 
-export default (provider) => class RegistrationAccessToken extends apply([
-  hasPolicies(provider),
-  hasFormat(provider, 'RegistrationAccessToken', provider.BaseToken),
-]) {};
+export default (provider) => class RegistrationAccessToken extends provider.BaseToken {
+  static get IN_PAYLOAD() {
+    return [
+      ...super.IN_PAYLOAD,
+      'policies',
+    ];
+  }
+
+  async save() {
+    if (typeof this.policies !== 'undefined') validatePolicies(provider, this.policies);
+    return super.save();
+  }
+
+  static async find(...args) {
+    const result = await super.find(...args);
+    if (result && typeof result.policies !== 'undefined') validatePolicies(provider, result.policies);
+    return result;
+  }
+};

package/dist/node_modules/oidc-provider/lib/models/replay_detection.js

@@ -3,9 +3,7 @@ import * as crypto from 'node:crypto';
 import instance from '../helpers/weak_cache.js';
 import epochTime from '../helpers/epoch_time.js';
 
-import hasFormat from './mixins/has_format.js';
-
-export default (provider) => class ReplayDetection extends hasFormat(provider, 'ReplayDetection', instance(provider).BaseModel) {
+export default (provider) => class ReplayDetection extends instance(provider).BaseModel {
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,

package/dist/node_modules/oidc-provider/lib/models/session.js

@@ -1,12 +1,8 @@
-/* eslint-disable prefer-rest-params */
-
 import nanoid from '../helpers/nanoid.js';
 import epochTime from '../helpers/epoch_time.js';
 import instance from '../helpers/weak_cache.js';
 
-import hasFormat from './mixins/has_format.js';
-
-export default (provider) => class Session extends hasFormat(provider, 'Session', instance(provider).BaseModel) {
+export default (provider) => class Session extends instance(provider).BaseModel {
   constructor(payload) {
     super(payload);
     if (!payload) {
@@ -46,7 +42,7 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
     try {
       const payload = await this.verify(stored);
       return this.instantiate(payload);
-    } catch (err) {
+    } catch {
       return undefined;
     }
   }
@@ -56,7 +52,7 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
       ? ctx.oidc.cookies : provider.createContext(ctx.req, ctx.res).cookies;
     cookies.secure = !cookies.secure && ctx.secure ? true : cookies.secure;
 
-    // is there supposed to be a session bound? generate if not
+    
     const cookieSessionId = cookies.get(
       provider.cookieName('session'),
       instance(provider).configuration.cookies.long,
@@ -70,9 +66,9 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
 
     if (!session) {
       if (cookieSessionId) {
-        // underlying session was removed since we have a session id in cookie, let's assign an
-        // empty data so that session.new is not true and cookie will get written even if nothing
-        // gets written to it
+        
+        
+        
         session = this.instantiate({});
       } else {
         session = this.instantiate();
@@ -90,7 +86,7 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
     if (typeof ttl !== 'number') {
       throw new TypeError('"ttl" argument must be a number');
     }
-    // one by one adapter ops to allow for uid to have a unique index
+    
     if (this.oldId) {
       await this.adapter.destroy(this.oldId);
     }
@@ -134,9 +130,9 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
     return true;
   }
 
-  authorizationFor(clientId) {
-    // the call will not set, let's not modify the session object
-    if (arguments.length === 1 && !this.authorizations) {
+  authorizationFor(clientId, value) {
+    
+    if (value === undefined && !this.authorizations) {
       return {};
     }
 
@@ -149,7 +145,7 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
   }
 
   sidFor(clientId, value) {
-    const authorization = this.authorizationFor(...arguments);
+    const authorization = this.authorizationFor(clientId, value);
 
     if (value) {
       authorization.sid = value;
@@ -160,7 +156,7 @@ export default (provider) => class Session extends hasFormat(provider, 'Session'
   }
 
   grantIdFor(clientId, value) {
-    const authorization = this.authorizationFor(...arguments);
+    const authorization = this.authorizationFor(clientId, value);
 
     if (value) {
       authorization.grantId = value;

package/dist/node_modules/oidc-provider/lib/models/token_helpers.js

@@ -0,0 +1,79 @@
+import * as jose from 'jose';
+
+import certificateThumbprint from '../helpers/certificate_thumbprint.js';
+import { InvalidRequest, InvalidTarget } from '../helpers/errors.js';
+import instance from '../helpers/weak_cache.js';
+
+export async function checkSessionBinding(provider, token, options) {
+  const ignoreSessionBinding = options && options.ignoreSessionBinding === true;
+  if (!token?.expiresWithSession || ignoreSessionBinding) {
+    return token;
+  }
+
+  const session = await provider.Session.findByUid(token.sessionUid);
+  if (!session
+      || token.accountId !== session.accountId
+      || token.grantId !== session.grantIdFor(token.clientId)) {
+    return undefined;
+  }
+
+  return token;
+}
+
+export function validatePolicies(provider, policies) {
+  if (!Array.isArray(policies)) {
+    throw new TypeError('policies must be an array');
+  }
+  if (!policies.length) {
+    throw new TypeError('policies must not be empty');
+  }
+  policies.forEach((policy) => {
+    if (typeof policy !== 'string') {
+      throw new TypeError('policies must be strings');
+    }
+    if (!instance(provider).features.registration.policies[policy]) {
+      throw new TypeError(`policy ${policy} not configured`);
+    }
+  });
+}
+
+export async function setAttestBinding(token, ctx) {
+  const { cnf: { jwk } } = jose.decodeJwt(ctx.get('oauth-client-attestation'));
+  token.attestationJkt = await jose.calculateJwkThumbprint(jwk);
+}
+
+export function setThumbprint(token, prop, input) {
+  switch (prop) {
+    case 'x5t':
+      if (token.jkt) {
+        throw new InvalidRequest('multiple proof-of-possession mechanisms are not allowed');
+      }
+      token['x5t#S256'] = certificateThumbprint(input);
+      break;
+    case 'jkt':
+      if (token['x5t#S256']) {
+        throw new InvalidRequest('multiple proof-of-possession mechanisms are not allowed');
+      }
+      token.jkt = input;
+      break;
+    default:
+      throw new Error('unsupported');
+  }
+}
+
+export function setAudience(token, audience) {
+  if (Array.isArray(audience)) {
+    if (audience.length === 0) {
+      return;
+    }
+    if (audience.length > 1) {
+      throw new InvalidTarget('only a single audience value is supported');
+    }
+
+    [audience] = audience;
+  } else if (typeof audience !== 'string' || !audience) {
+    throw new InvalidTarget();
+  }
+
+  token.aud = audience;
+}