@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/lib/helpers/challenge.js

@@ -1,8 +1,7 @@
-/* eslint-disable no-plusplus, no-bitwise, no-param-reassign */
-
 import { hkdfSync } from 'node:crypto';
 
 import * as base64url from './base64url.js';
+import epochTime from './epoch_time.js';
 
 function sixfourbeify(value) {
   const buf = Buffer.alloc(8);
@@ -41,21 +40,13 @@ const STEP = 60;
 export const CHALLENGE_OK_WINDOW = STEP * 5;
 
 export default class ServerChallenge {
-  #counter;
-
   #info;
 
   #secret;
 
-  #prevprev;
-
-  #prev;
-
-  #now;
-
-  #next;
+  #step;
 
-  #nextnext;
+  #values;
 
   constructor(secret, info) {
     if (!Buffer.isBuffer(secret) || secret.byteLength !== 32) {
@@ -68,44 +59,40 @@ export default class ServerChallenge {
 
     this.#info = info;
     this.#secret = Uint8Array.prototype.slice.call(secret);
-    this.#counter = Math.floor(Date.now() / 1000 / STEP);
-
-    [this.#prevprev, this.#prev, this.#now, this.#next, this.#nextnext] = [
-      this.#counter - 2,
-      this.#counter - 1,
-      this.#counter,
-      this.#counter + 1,
-      this.#counter++ + 2,
-    ].map(compute.bind(undefined, this.#secret, this.#info));
-
-    setInterval(() => {
-      [
-        this.#prevprev,
-        this.#prev,
-        this.#now,
-        this.#next,
-        this.#nextnext,
-      ] = [
-        this.#prev,
-        this.#now,
-        this.#next,
-        this.#nextnext,
-        compute(this.#secret, this.#info, this.#counter++ + 2),
-      ];
-    }, STEP * 1000).unref();
+  }
+
+  
+  
+  
+  #window() {
+    const step = Math.floor(epochTime() / STEP);
+
+    if (step !== this.#step) {
+      this.#step = step;
+      this.#values = [
+        step - 2,
+        step - 1,
+        step,
+        step + 1,
+        step + 2,
+      ].map(compute.bind(undefined, this.#secret, this.#info));
+    }
+
+    return this.#values;
   }
 
   nextChallenge() {
-    return this.#next;
+    return this.#window()[3];
   }
 
   checkChallenge(challenge) {
-    let result = 0;
+    let matched = 0;
 
-    for (const server of [this.#prevprev, this.#prev, this.#now, this.#next, this.#nextnext]) {
-      result ^= compare(server, challenge);
+    for (const server of this.#window()) {
+      const result = compare(server, challenge);
+      matched |= ((result | -result) >>> 31) ^ 1;
     }
 
-    return result === 0;
+    return matched === 1;
   }
 }

package/dist/node_modules/oidc-provider/lib/helpers/claims.js

@@ -2,6 +2,7 @@ import instance from './weak_cache.js';
 import pick from './_/pick.js';
 import merge from './_/merge.js';
 import isPlainObject from './_/is_plain_object.js';
+import isJsonObject from './_/is_json_object.js';
 
 export default function getClaims(provider) {
   const {
@@ -46,7 +47,7 @@ export default function getClaims(provider) {
       const { available } = this;
       const include = Object.entries(this.filter)
         .map(([key, value]) => {
-          if (value === null || isPlainObject(value)) {
+          if (value === null || isJsonObject(value)) {
             return key;
           }
 

package/dist/node_modules/oidc-provider/lib/helpers/client_id_metadata_document.js

@@ -1,11 +1,12 @@
 import { WEB_URI } from '../consts/client_attributes.js';
-
-import instance from './weak_cache.js';
 import addClient from './add_client.js';
 import als from './als.js';
+import { boolean } from './configuration_result.js';
 import { InvalidClient, InvalidClientMetadata } from './errors.js';
 import fetchBodyCheck from './fetch_body_check.js';
 import fetchRequest from './fetch_request.js';
+import LRU from './lru.js';
+import instance from './weak_cache.js';
 
 const FORBIDDEN_AUTH_METHODS = new Set([
   'client_secret_basic',
@@ -13,49 +14,84 @@ const FORBIDDEN_AUTH_METHODS = new Set([
   'client_secret_jwt',
 ]);
 
+function hasForbiddenRawUrlCodePoint(input) {
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code <= 0x20 || code === 0x5c || code === 0x7f) {
+      return true;
+    }
+  }
+  return false;
+}
+
 const cache = new WeakMap();
+const pending = new WeakMap();
 
 function getCache(provider) {
   let entries = cache.get(provider);
   if (!entries) {
-    entries = new Map();
+    entries = new LRU({ maxSize: 100 });
     cache.set(provider, entries);
   }
   return entries;
 }
 
+function getPending(provider) {
+  let requests = pending.get(provider);
+  if (!requests) {
+    requests = new Map();
+    pending.set(provider, requests);
+  }
+  return requests;
+}
+
 export function isValidClientIdUrl(id) {
+  if (
+    !/^https:\/\//iu.test(id)
+    || hasForbiddenRawUrlCodePoint(id)
+  ) {
+    return false;
+  }
+
   const url = URL.parse(id);
 
   if (!url) {
     return false;
   }
 
-  // MUST have an "https" scheme
+  
   if (url.protocol !== 'https:') {
     return false;
   }
 
-  // MUST contain a path component (not just "/")
-  if (!url.pathname || url.pathname === '/') {
+  const afterScheme = id.slice('https://'.length);
+  const authorityEnd = afterScheme.search(/[/?#]/u);
+  const authority = authorityEnd === -1 ? afterScheme : afterScheme.slice(0, authorityEnd);
+  if (!authority) {
     return false;
   }
 
-  // MUST NOT contain single-dot or double-dot path segments
-  // URL.parse normalizes dot segments, so check the raw input
-  const rawPath = id.replace(/^https:\/\/[^/]*/i, '').split('?')[0].split('#')[0];
+  
+  
+  const pathStart = afterScheme.search(/[/?#]/u);
+  const rawPath = pathStart !== -1 && afterScheme[pathStart] === '/'
+    ? afterScheme.slice(pathStart).split('?')[0].split('#')[0]
+    : '/';
   const rawSegments = rawPath.split('/');
-  if (rawSegments.some((seg) => seg === '.' || seg === '..')) {
+  if (rawSegments.some((seg) => {
+    const dotNormalized = seg.replace(/%2e/giu, '.');
+    return dotNormalized === '.' || dotNormalized === '..';
+  })) {
     return false;
   }
 
-  // MUST NOT contain a fragment component
-  if (url.hash) {
+  
+  if (id.includes('#')) {
     return false;
   }
 
-  // MUST NOT contain a username or password
-  if (url.username || url.password) {
+  
+  if (authority.includes('@')) {
     return false;
   }
 
@@ -90,33 +126,7 @@ function parseCacheDuration(response, { min, max }) {
   return Math.max(min, Math.min(max, duration));
 }
 
-export async function resolveClientByMetadataDocument(provider, id) {
-  const {
-    features: { clientIdMetadataDocument: feature },
-  } = instance(provider).configuration;
-
-  const ctx = als.getStore();
-
-  const entries = getCache(provider);
-
-  // Check cache
-  const cached = entries.get(id);
-  if (cached && cached.freshUntil > Date.now()) {
-    const client = await addClient(provider, cached.properties, { cimd: true });
-    Object.defineProperty(client, 'clientIdMetadataDocument', { value: true });
-
-    if (!(await feature.allowClient(ctx, client))) {
-      throw new InvalidClient('client is not allowed');
-    }
-
-    return client;
-  }
-
-  // Gate the fetch
-  if (!(await feature.allowFetch(ctx, id))) {
-    throw new InvalidClient('client_id metadata document fetch not allowed');
-  }
-
+async function fetchMetadataDocument(provider, id, cacheDuration) {
   let response;
   try {
     response = await fetchRequest(provider, id, {
@@ -126,48 +136,48 @@ export async function resolveClientByMetadataDocument(provider, id) {
       },
       redirect: 'manual',
     });
-  } catch (err) {
-    throw new InvalidClient('client_id metadata document fetch failed', err.message);
+  } catch (cause) {
+    throw new InvalidClient('client_id metadata document fetch failed', { cause });
   }
 
   if (response.status !== 200) {
-    throw new InvalidClient('client_id metadata document fetch failed', `unexpected response status ${response.status}`);
+    throw new InvalidClient('client_id metadata document fetch failed', `unexpected response status ${response.status}`, { cause: response });
   }
 
   let bodyText;
   try {
     bodyText = (await fetchBodyCheck(provider, 'client_id metadata document', response)).toString();
-  } catch (err) {
-    throw new InvalidClient('client_id metadata document fetch failed', err.message);
+  } catch (cause) {
+    throw new InvalidClient('client_id metadata document fetch failed', { cause });
   }
 
   let properties;
   try {
     properties = JSON.parse(bodyText);
-  } catch {
-    throw new InvalidClient('client_id metadata document fetch failed', 'invalid JSON');
+  } catch (cause) {
+    throw new InvalidClient('client_id metadata document fetch failed', { cause });
   }
 
   if (typeof properties !== 'object' || properties === null || Array.isArray(properties)) {
     throw new InvalidClientMetadata('client_id metadata document is not a JSON object');
   }
 
-  // client_id property MUST match the URL via simple string comparison
+  
   if (properties.client_id !== id) {
     throw new InvalidClientMetadata('client_id metadata document client_id does not match the expected value');
   }
 
-  // token_endpoint_auth_method MUST NOT be a shared-secret method
+  
   if (FORBIDDEN_AUTH_METHODS.has(properties.token_endpoint_auth_method)) {
     throw new InvalidClientMetadata('client_id metadata document must not use shared-secret token endpoint authentication methods');
   }
 
-  // client_secret and client_secret_expires_at MUST NOT be present
+  
   if ('client_secret' in properties || 'client_secret_expires_at' in properties) {
     throw new InvalidClientMetadata('client_id metadata document must not contain client_secret or client_secret_expires_at');
   }
 
-  // URI properties MUST be absolute URIs using the https: scheme
+  
   for (const prop of WEB_URI) {
     if (prop in properties) {
       const uri = URL.parse(properties[prop]);
@@ -177,22 +187,81 @@ export async function resolveClientByMetadataDocument(provider, id) {
     }
   }
 
-  // Compute cache TTL
-  const ttl = parseCacheDuration(response, feature.cacheDuration);
+  return {
+    properties,
+    maxAge: parseCacheDuration(response, cacheDuration) * 1000,
+  };
+}
 
+async function createClient(provider, properties) {
   const client = await addClient(provider, properties, { cimd: true });
-
   Object.defineProperty(client, 'clientIdMetadataDocument', { value: true });
+  return client;
+}
 
-  // Cache the valid properties
-  entries.set(id, {
-    properties,
-    freshUntil: Date.now() + (ttl * 1000),
-  });
-
-  if (!(await feature.allowClient(ctx, client))) {
+async function assertClientAllowed(feature, ctx, client) {
+  if (!boolean(
+    await feature.allowClient(ctx, client),
+    'features.clientIdMetadataDocument.allowClient',
+  )) {
     throw new InvalidClient('client is not allowed');
   }
+}
+
+async function resolveCachedClient(provider, feature, ctx, properties) {
+  const client = await createClient(provider, properties);
+  await assertClientAllowed(feature, ctx, client);
+  return client;
+}
+
+export async function resolveClientByMetadataDocument(provider, id) {
+  const {
+    features: { clientIdMetadataDocument: feature },
+  } = instance(provider).configuration;
+
+  const ctx = als.getStore();
+  const entries = getCache(provider);
+
+  let properties = entries.get(id);
+  if (properties) {
+    return resolveCachedClient(provider, feature, ctx, properties);
+  }
+
+  if (!boolean(
+    await feature.allowFetch(ctx, id),
+    'features.clientIdMetadataDocument.allowFetch',
+  )) {
+    throw new InvalidClient('client_id metadata document fetch not allowed');
+  }
+
+  
+  properties = entries.get(id);
+  if (properties) {
+    return resolveCachedClient(provider, feature, ctx, properties);
+  }
+
+  const requests = getPending(provider);
+  let request = requests.get(id);
+  if (!request) {
+    request = fetchMetadataDocument(provider, id, feature.cacheDuration);
+    requests.set(id, request);
+  }
+
+  let client;
+  try {
+    const fetched = await request;
+    client = await createClient(provider, fetched.properties);
+
+    if (!entries.has(id)) {
+      entries.set(id, fetched.properties, { maxAge: fetched.maxAge });
+    }
+  } finally {
+    if (requests.get(id) === request) {
+      requests.delete(id);
+    }
+  }
+
+  await assertClientAllowed(feature, ctx, client);
 
   return client;
 }

package/dist/node_modules/oidc-provider/lib/helpers/client_schema.js

@@ -1,14 +1,14 @@
 import { CLIENT_ATTRIBUTES } from '../consts/index.js';
-
-import * as validUrl from './valid_url.js';
+import omitBy from './_/omit_by.js';
+import pick from './_/pick.js';
 import { InvalidClientMetadata } from './errors.js';
+import * as formatters from './formatters.js';
 import sectorIdentifier from './sector_identifier.js';
+import * as validUrl from './valid_url.js';
 import instance from './weak_cache.js';
-import * as formatters from './formatters.js';
-import pick from './_/pick.js';
-import omitBy from './_/omit_by.js';
 
 const W3CEmailRegExp = /^[a-zA-Z0-9.!#$%&’*+/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*$/;
+const FORBIDDEN_SCHEMES = new Set(['javascript:', 'vbscript:', 'data:', 'blob:', 'file:', 'about:']);
 const needsJwks = {
   jwe: /^(RSA|ECDH)/,
   jws: /^(?:(?:P|E|R)S(?:256|384|512)|Ed(?:DSA|25519)|ML-DSA-(?:44|65|87))$/,
@@ -30,6 +30,15 @@ function isUndefined(value) {
   return value === undefined;
 }
 
+function isDenseArray(value) {
+  for (let index = 0; index < value.length; index++) {
+    if (!Object.hasOwn(value, index)) {
+      return false;
+    }
+  }
+  return true;
+}
+
 export default function getSchema(provider) {
   const { configuration, features } = instance(provider);
   const { scopes } = configuration;
@@ -268,7 +277,7 @@ export default function getSchema(provider) {
       this.jarPolicy();
       this.parPolicy();
 
-      // max_age and client_secret_expires_at format
+      
       ['default_max_age', 'client_secret_expires_at'].forEach((prop) => {
         if (this[prop] !== undefined) {
           if (!Number.isSafeInteger(this[prop]) || Math.sign(this[prop]) === -1) {
@@ -277,7 +286,7 @@ export default function getSchema(provider) {
         }
       });
 
-      const responseTypes = new Set(this.response_types.map((rt) => rt.split(' ')).flat());
+      const responseTypes = new Set(this.response_types.flatMap((rt) => rt.split(' ')));
 
       if (responseTypes.size && !this.redirect_uris.length) {
         const { pushedAuthorizationRequests: par } = features;
@@ -353,7 +362,7 @@ export default function getSchema(provider) {
         }
       }
 
-      // SECTOR IDENTIFIER VALIDATION
+      
       sectorIdentifier(this);
 
       if (this.jwks !== undefined && this.jwks_uri !== undefined) {
@@ -367,6 +376,9 @@ export default function getSchema(provider) {
           if (!Array.isArray(this[choice])) {
             this.invalidate(`${choice} must be an array`);
           }
+          if (!isDenseArray(this[choice])) {
+            this.invalidate(`${choice} must only contain strings`);
+          }
           const choices = new Set(this[choice]);
 
           if (this[target] !== undefined && !choices.has(this[target])) {
@@ -375,9 +387,9 @@ export default function getSchema(provider) {
 
           const only = ENUM[target](this);
 
-          // test the options in the following order:
-          // - explicit value (if provided)
-          // - ...rest
+          
+          
+          
           const options = new Set();
           if (this[target]) {
             options.add(this[target]);
@@ -406,7 +418,7 @@ export default function getSchema(provider) {
       }
     }
 
-    invalidate(message, code) { // eslint-disable-line class-methods-use-this, no-unused-vars
+    invalidate(message, _code) {
       throw new InvalidClientMetadata(message);
     }
 
@@ -496,9 +508,9 @@ export default function getSchema(provider) {
         if (this[prop] !== undefined) {
           const isAry = ARYS.includes(prop);
           (isAry ? this[prop] : [this[prop]]).forEach((val) => {
-            const method = HTTPS_URI.includes(prop) ? 'isHttpsUri' : 'isWebUri';
-            const type = method === 'isWebUri' ? 'web' : 'https';
-            if (!validUrl[method](val)) {
+            const method = HTTPS_URI.includes(prop) ? validUrl.isHttpsUri : validUrl.isWebUri;
+            const type = method === validUrl.isWebUri ? 'web' : 'https';
+            if (!method(val)) {
               this.invalidate(isAry
                 ? `${prop} must only contain ${type} uris`
                 : `${prop} must be a ${type} uri`);
@@ -514,6 +526,9 @@ export default function getSchema(provider) {
           if (!Array.isArray(this[prop])) {
             this.invalidate(`${prop} must be an array`);
           }
+          if (!isDenseArray(this[prop])) {
+            this.invalidate(`${prop} must only contain strings`);
+          }
           this[prop] = [...new Set(this[prop])];
         }
       });
@@ -600,13 +615,13 @@ export default function getSchema(provider) {
           this.invalidate(`${label} must only contain valid uris`);
         }
 
-        const { hostname, protocol, hash } = parsed;
+        const { hostname, protocol } = parsed;
 
-        if (hash) {
+        if (parsed.href.includes('#')) {
           this.invalidate(`${label} must not contain fragments`);
         }
 
-        switch (this.application_type) { // eslint-disable-line default-case
+        switch (this.application_type) {
           case 'web': {
             if (!['https:', 'http:'].includes(protocol)) {
               this.invalidate(`${label} must only contain web uris`);
@@ -625,20 +640,23 @@ export default function getSchema(provider) {
           }
           case 'native': {
             switch (protocol) {
-              case 'http:': // Loopback Interface Redirection
+              case 'http:': 
                 if (!LOOPBACKS.has(hostname)) {
                   this.invalidate(`${label} for native clients using http as a protocol can only use loopback addresses as hostnames`);
                 }
                 break;
-              case 'https:': // Claimed HTTPS URI Redirection
+              case 'https:': 
                 if (LOOPBACKS.has(hostname)) {
                   this.invalidate(`${label} for native clients using claimed HTTPS URIs must not be using ${hostname} as hostname`);
                 }
                 break;
-              default: // Private-use URI Scheme Redirection
-                if (!protocol.includes('.')) {
-                  this.invalidate(`${label} for native clients using Custom URI scheme should use reverse domain name based scheme`);
+              default: 
+                if (FORBIDDEN_SCHEMES.has(protocol)) {
+                  this.invalidate(`${label} must not use the ${protocol.slice(0, -1)} URI scheme`);
                 }
+                
+                
+                break;
             }
             break;
           }
@@ -658,7 +676,11 @@ export default function getSchema(provider) {
 
     processCustomMetadata(ctx) {
       configuration.extraClientMetadata.properties.forEach((prop) => {
-        configuration.extraClientMetadata.validator(ctx, prop, this[prop], this);
+        const result = configuration.extraClientMetadata.validator(ctx, prop, this[prop], this);
+        if (result && typeof result.then === 'function') {
+          Promise.resolve(result).catch(() => {});
+          throw new TypeError('extraClientMetadata.validator must be a synchronous function');
+        }
       });
     }