@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/lib/helpers/re_render_errors.js

@@ -1,8 +1,6 @@
-/* eslint-disable max-classes-per-file */
-
 export class ReRenderError extends Error {
-  constructor(message, userCode) {
-    super(message);
+  constructor(message, userCode, options = undefined) {
+    super(message, options);
     if (userCode) this.userCode = userCode;
     this.message = message;
     this.name = this.constructor.name;
@@ -23,8 +21,8 @@ export class ExpiredError extends ReRenderError {
   }
 }
 export class AbortedError extends ReRenderError {
-  constructor() {
-    super('the interaction was aborted');
+  constructor(options = undefined) {
+    super('the interaction was aborted', undefined, options);
   }
 }
 export class AlreadyUsedError extends ReRenderError {

package/dist/node_modules/oidc-provider/lib/helpers/resolve_resource.js

@@ -1,9 +1,9 @@
+import { boolean } from './configuration_result.js';
 import { InvalidTarget } from './errors.js';
 
 export default async (ctx, model, config, scopes = model.scopes) => {
   let resource;
   if (config.resourceIndicators.enabled) {
-    // eslint-disable-next-line default-case
     switch (true) {
       case !!ctx.oidc.params.resource:
         resource = ctx.oidc.params.resource;
@@ -11,7 +11,10 @@ export default async (ctx, model, config, scopes = model.scopes) => {
       case !model.resource:
       case Array.isArray(model.resource) && model.resource.length === 0:
         break;
-      case model.resource && !!(await config.resourceIndicators.useGrantedResource(ctx, model)):
+      case model.resource && boolean(
+        await config.resourceIndicators.useGrantedResource(ctx, model),
+        'features.resourceIndicators.useGrantedResource',
+      ):
       case !ctx.oidc.params.resource && (!config.userinfo.enabled || !scopes.has('openid')):
         resource = model.resource;
         break;

package/dist/node_modules/oidc-provider/lib/helpers/resource_server.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-underscore-dangle */
-
 export default class ResourceServer {
   constructor(identifier, data) {
     this._identifier = identifier;

package/dist/node_modules/oidc-provider/lib/helpers/revoke.js

@@ -1,14 +1,20 @@
+import { boolean } from './configuration_result.js';
 import instance from './weak_cache.js';
 
 export default async function revoke(ctx, grantId) {
+  if (!grantId) {
+    return;
+  }
+
   const { oidc: { client, provider } } = ctx;
   const { grantTypes, revokeGrantPolicy } = instance(provider).configuration;
   const refreshToken = client ? client.grantTypeAllowed('refresh_token') : grantTypes.has('refresh_token');
   const authorizationCode = client ? client.grantTypeAllowed('authorization_code') : grantTypes.has('authorization_code');
   const deviceCode = client ? client.grantTypeAllowed('urn:ietf:params:oauth:grant-type:device_code') : grantTypes.has('urn:ietf:params:oauth:grant-type:device_code');
   const backchannelAuthenticationRequest = client ? client.grantTypeAllowed('urn:openid:params:grant-type:ciba') : grantTypes.has('urn:openid:params:grant-type:ciba');
+  const preAuthorizedCode = client ? client.grantTypeAllowed('urn:ietf:params:oauth:grant-type:pre-authorized_code') : grantTypes.has('urn:ietf:params:oauth:grant-type:pre-authorized_code');
 
-  const revokeGrant = await revokeGrantPolicy(ctx);
+  const revokeGrant = boolean(await revokeGrantPolicy(ctx), 'revokeGrantPolicy');
 
   await Promise.all(
     [
@@ -17,8 +23,9 @@ export default async function revoke(ctx, grantId) {
       authorizationCode ? provider.AuthorizationCode : undefined,
       deviceCode ? provider.DeviceCode : undefined,
       backchannelAuthenticationRequest ? provider.BackchannelAuthenticationRequest : undefined,
+      preAuthorizedCode ? provider.PreAuthorizedCode : undefined,
     ]
-      .map((model) => model && model.revokeByGrantId(grantId))
+      .map((model) => model?.revokeByGrantId(grantId))
       .concat(revokeGrant ? provider.Grant.adapter.destroy(grantId) : undefined),
   );
   if (revokeGrant) {

package/dist/node_modules/oidc-provider/lib/helpers/router.js

@@ -0,0 +1,221 @@
+import * as querystring from 'node:querystring';
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+function compose(middleware) {
+  return function composed(ctx, next) {
+    let index = -1;
+    function dispatch(i) {
+      if (i <= index) return Promise.reject(new Error('next() called multiple times'));
+      index = i;
+      const fn = i === middleware.length ? next : middleware[i];
+      if (!fn) return Promise.resolve();
+      try {
+        return Promise.resolve(fn(ctx, dispatch.bind(null, i + 1)));
+      } catch (err) {
+        return Promise.reject(err);
+      }
+    }
+    return dispatch(0);
+  };
+}
+
+function decode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+
+
+
+
+
+
+
+
+function fold(value) {
+  for (let i = 0; i < value.length; i += 1) {
+    if (value.charCodeAt(i) > 127) {
+      let out = '';
+      for (const char of value) {
+        const upper = char.toUpperCase();
+        out += upper.length === 1 && !(char.codePointAt(0) > 127 && upper.codePointAt(0) < 128)
+          ? upper
+          : char;
+      }
+      return out;
+    }
+  }
+  return value.toUpperCase();
+}
+
+export default class Router {
+  #static = new Map();
+
+  #dynamic = [];
+
+  #names = new Map();
+
+  #register(method, name, path, middleware) {
+    
+    
+    if (!this.#names.has(name)) this.#names.set(name, path);
+
+    const route = { name, path, run: compose(middleware) };
+    
+    const methods = method === 'GET' ? ['GET', 'HEAD'] : [method];
+
+    if (!path.includes('/:')) {
+      const key = fold(path);
+      let byMethod = this.#static.get(key);
+      if (!byMethod) {
+        byMethod = new Map();
+        this.#static.set(key, byMethod);
+      }
+      for (const verb of methods) if (!byMethod.has(verb)) byMethod.set(verb, route);
+      return;
+    }
+
+    const raw = path.split('/');
+    
+    
+    const segments = raw.map((s) => (s.charCodeAt(0) === 0x3a ? null : fold(s)));
+    const keys = raw.map((s) => (s.charCodeAt(0) === 0x3a ? s.slice(1) : null));
+    for (const verb of methods) this.#dynamic.push({ verb, segments, keys, route });
+  }
+
+  get(name, path, ...middleware) { this.#register('GET', name, path, middleware); return this; }
+
+  post(name, path, ...middleware) { this.#register('POST', name, path, middleware); return this; }
+
+  put(name, path, ...middleware) { this.#register('PUT', name, path, middleware); return this; }
+
+  delete(name, path, ...middleware) { this.#register('DELETE', name, path, middleware); return this; }
+
+  options(name, path, ...middleware) { this.#register('OPTIONS', name, path, middleware); return this; }
+
+  #lookup(method, path) {
+    const folded = fold(path);
+
+    const route = this.#static.get(folded)?.get(method);
+    if (route) return { route, params: {} };
+
+    if (this.#dynamic.length) {
+      
+      const parts = path.split('/');
+      const foldedParts = folded.split('/');
+
+      for (const candidate of this.#dynamic) {
+        if (candidate.verb !== method || candidate.segments.length !== parts.length) continue;
+
+        let params;
+        let matched = true;
+        for (let i = 0; i < candidate.segments.length; i += 1) {
+          const segment = candidate.segments[i];
+          if (segment === null) {
+            if (!parts[i]) { matched = false; break; }
+            params ??= {};
+            params[candidate.keys[i]] = decode(parts[i]);
+          } else if (segment !== foldedParts[i]) {
+            matched = false;
+            break;
+          }
+        }
+
+        if (matched) return { route: candidate.route, params: params ?? {} };
+      }
+    }
+
+    return undefined;
+  }
+
+  match(method, path) {
+    
+    
+    
+    const exact = this.#lookup(method, path);
+    if (exact) return exact;
+
+    if (path.length > 1 && path.charCodeAt(path.length - 1) === 0x2f  ) {
+      return this.#lookup(method, path.slice(0, -1));
+    }
+
+    return undefined;
+  }
+
+  url(name, params = {}, options) {
+    const path = this.#names.get(name);
+    if (path === undefined) return new Error(`No route found for name: ${name}`);
+
+    
+    
+    
+    let values = params;
+    let query = options?.query;
+    if (!options && params && params.query) {
+      ({ query, ...values } = params);
+    }
+
+    const url = path.replace(/\/:([^/]+)/g, (_, key) => {
+      
+      if (values[key] === undefined || values[key] === null) {
+        throw new TypeError(`Missing parameters: ${key}`);
+      }
+      return `/${encodeURIComponent(values[key])}`;
+    });
+
+    if (query === undefined) return url;
+
+    const search = typeof query === 'string'
+      ? query.replace(/^\?/, '')
+      : querystring.stringify(query);
+
+    return search ? `${url}?${search}` : url;
+  }
+
+  routes() {
+    const router = this;
+    return function dispatch(ctx, next) {
+      const matched = router.match(ctx.method, ctx.path);
+      if (!matched) return next();
+
+      
+      
+      ctx.params = { ...ctx.params, ...matched.params };
+      if (ctx.request) ctx.request.params = ctx.params;
+      ctx.router = router;
+      ctx.routerName = matched.route.name;
+      ctx.routerPath = matched.route.path;
+      ctx._matchedRoute = matched.route.path;
+      ctx._matchedRouteName = matched.route.name;
+
+      return matched.route.run(ctx, next);
+    };
+  }
+}

package/dist/node_modules/oidc-provider/lib/helpers/sector_validate.js

@@ -1,12 +1,15 @@
 import { STATUS_CODES } from 'node:http';
-
-import instance from './weak_cache.js';
+import { boolean } from './configuration_result.js';
 import { InvalidClientMetadata } from './errors.js';
-import fetchRequest from './fetch_request.js';
 import fetchBodyCheck from './fetch_body_check.js';
+import fetchRequest from './fetch_request.js';
+import instance from './weak_cache.js';
 
 export default async function sectorValidate(provider, client) {
-  if (!instance(provider).configuration.sectorIdentifierUriValidate(client)) {
+  if (!boolean(
+    instance(provider).configuration.sectorIdentifierUriValidate(client),
+    'sectorIdentifierUriValidate',
+  )) {
     return;
   }
 
@@ -15,29 +18,32 @@ export default async function sectorValidate(provider, client) {
     headers: {
       accept: 'application/json',
     },
-  }).catch((err) => {
-    throw new InvalidClientMetadata('could not load sector_identifier_uri response', err.message);
+  }).catch((cause) => {
+    throw new InvalidClientMetadata('could not load sector_identifier_uri response', { cause });
   });
 
   if (response.status !== 200) {
-    throw new InvalidClientMetadata(`unexpected sector_identifier_uri response status code, expected 200 OK, got ${response.status} ${STATUS_CODES[response.status]}`);
+    throw new InvalidClientMetadata(`unexpected sector_identifier_uri response status code, expected 200 OK, got ${response.status} ${STATUS_CODES[response.status]}`, { cause: response });
   }
 
   let body;
   try {
     body = (await fetchBodyCheck(provider, 'sector_identifier_uri', response)).toString();
-  } catch (err) {
-    throw new InvalidClientMetadata('could not load sector_identifier_uri response', err.message);
+  } catch (cause) {
+    throw new InvalidClientMetadata('could not load sector_identifier_uri response', { cause });
   }
 
   try {
     body = JSON.parse(body);
-  } catch (err) {
-    throw new InvalidClientMetadata('failed to parse sector_identifier_uri JSON response', err.message);
+  } catch (cause) {
+    throw new InvalidClientMetadata('failed to parse sector_identifier_uri JSON response', { cause });
   }
 
   try {
     if (!Array.isArray(body)) throw new Error('sector_identifier_uri must return single JSON array');
+    if (body.some((value) => typeof value !== 'string')) {
+      throw new Error('sector_identifier_uri must return an array of redirect_uri values');
+    }
     if (client.responseTypes.length) {
       const match = client.redirectUris.every((uri) => body.includes(uri));
       if (!match) throw new Error('all registered redirect_uris must be included in the sector_identifier_uri response');
@@ -49,7 +55,7 @@ export default async function sectorValidate(provider, client) {
     ) {
       if (!body.includes(client.jwksUri)) throw new Error("client's jwks_uri must be included in the sector_identifier_uri response");
     }
-  } catch (err) {
-    throw new InvalidClientMetadata(err.message);
+  } catch (cause) {
+    throw new InvalidClientMetadata(cause.message, { cause });
   }
 }

package/dist/node_modules/oidc-provider/lib/helpers/sender_constraints.js

@@ -0,0 +1,24 @@
+import { InvalidGrant } from './errors.js';
+import instance from './weak_cache.js';
+import assertProviderContext from './assert_provider_context.js';
+
+export function checkMtlsCert(provider, ctx, ErrorClass = InvalidGrant) {
+  assertProviderContext(provider, ctx);
+
+  if (ctx.oidc.client.tlsClientCertificateBoundAccessTokens) {
+    const certificate = instance(provider).configuration.features.mTLS.getCertificate(ctx);
+    if (!certificate) {
+      throw new ErrorClass('mutual TLS client certificate not provided');
+    }
+    return certificate;
+  }
+  return undefined;
+}
+
+export function checkDpopRequired(provider, ctx, dPoP, ErrorClass = InvalidGrant) {
+  assertProviderContext(provider, ctx);
+
+  if (!dPoP && ctx.oidc.client.dpopBoundAccessTokens) {
+    throw new ErrorClass('DPoP proof JWT not provided');
+  }
+}

package/dist/node_modules/oidc-provider/lib/helpers/set_rt_bindings.js

@@ -1,5 +1,3 @@
-/* eslint-disable no-param-reassign */
-
 export async function setRefreshTokenBindings(ctx, at, rt) {
   switch (ctx.oidc.client.clientAuthMethod) {
     case 'none':

package/dist/node_modules/oidc-provider/lib/helpers/token_find.js

@@ -1,51 +1,44 @@
-export function createTokenFinder(provider, grantTypeHandlers) {
-  const { AccessToken, ClientCredentials, RefreshToken } = provider;
+import instance from './weak_cache.js';
 
-  function getAccessToken(token) {
-    return AccessToken.find(token);
+function getClientCredentials(provider, token) {
+  if (!instance(provider).grantTypeHandlers.has('client_credentials')) {
+    return undefined;
   }
+  return provider.ClientCredentials.find(token);
+}
 
-  function getClientCredentials(token) {
-    if (!grantTypeHandlers.has('client_credentials')) {
-      return undefined;
-    }
-    return ClientCredentials.find(token);
+function getRefreshToken(provider, token) {
+  if (!instance(provider).grantTypeHandlers.has('refresh_token')) {
+    return undefined;
   }
+  return provider.RefreshToken.find(token);
+}
 
-  function getRefreshToken(token) {
-    if (!grantTypeHandlers.has('refresh_token')) {
-      return undefined;
-    }
-    return RefreshToken.find(token);
-  }
+function findResult(results) {
+  return results.find((found) => !!found);
+}
 
-  function findResult(results) {
-    return results.find((found) => !!found);
+export async function findToken(provider, tokenValue, tokenTypeHint) {
+  switch (tokenTypeHint) {
+    case 'access_token':
+    case 'urn:ietf:params:oauth:token-type:access_token':
+      return Promise.all([
+        provider.AccessToken.find(tokenValue),
+        getClientCredentials(provider, tokenValue),
+      ])
+        .then(findResult)
+        .then((result) => result || getRefreshToken(provider, tokenValue));
+    case 'refresh_token':
+    case 'urn:ietf:params:oauth:token-type:refresh_token':
+      return await getRefreshToken(provider, tokenValue) || Promise.all([
+        provider.AccessToken.find(tokenValue),
+        getClientCredentials(provider, tokenValue),
+      ]).then(findResult);
+    default:
+      return Promise.all([
+        provider.AccessToken.find(tokenValue),
+        getClientCredentials(provider, tokenValue),
+        getRefreshToken(provider, tokenValue),
+      ]).then(findResult);
   }
-
-  return async function findTokenByHint(tokenValue, tokenTypeHint) {
-    switch (tokenTypeHint) {
-      case 'access_token':
-      case 'urn:ietf:params:oauth:token-type:access_token':
-        return Promise.all([
-          getAccessToken(tokenValue),
-          getClientCredentials(tokenValue),
-        ])
-          .then(findResult)
-          .then((result) => result || getRefreshToken(tokenValue));
-      case 'refresh_token':
-      case 'urn:ietf:params:oauth:token-type:refresh_token':
-        return getRefreshToken(tokenValue)
-          .then((result) => result || Promise.all([
-            getAccessToken(tokenValue),
-            getClientCredentials(tokenValue),
-          ]).then(findResult));
-      default:
-        return Promise.all([
-          getAccessToken(tokenValue),
-          getClientCredentials(tokenValue),
-          getRefreshToken(tokenValue),
-        ]).then(findResult);
-    }
-  };
 }

package/dist/node_modules/oidc-provider/lib/helpers/user_codes.js

@@ -1,4 +1,4 @@
-import { customAlphabet } from 'nanoid';
+import { customAlphabet } from './nanoid.js';
 
 const CHARSETS = {
   'base-20': 'BCDFGHJKLMNPQRSTVWXZ',

package/dist/node_modules/oidc-provider/lib/helpers/validate_dpop.js

@@ -1,21 +1,38 @@
 import * as crypto from 'node:crypto';
 
 import {
-  jwtVerify,
-  EmbeddedJWK,
   calculateJwkThumbprint,
+  EmbeddedJWK,
+  jwtVerify,
 } from 'jose';
-
-import { InvalidDpopProof, UseDpopNonce } from './errors.js';
-import instance from './weak_cache.js';
-import epochTime from './epoch_time.js';
+import assertProviderContext from './assert_provider_context.js';
 import { CHALLENGE_OK_WINDOW } from './challenge.js';
-
-export { CHALLENGE_OK_WINDOW };
+import { boolean } from './configuration_result.js';
+import epochTime from './epoch_time.js';
+import { InvalidDpopProof, InvalidGrant, UseDpopNonce } from './errors.js';
+import instance from './weak_cache.js';
 
 const weakMap = new WeakMap();
 
-export default async (ctx, accessToken) => {
+export async function checkDpopReplay(provider, ctx, dPoP, clientId, ErrorClass = InvalidGrant) {
+  assertProviderContext(provider, ctx);
+
+  if (!dPoP || instance(provider).features.dPoP.allowReplay) {
+    return;
+  }
+
+  const unique = await provider.ReplayDetection.unique(
+    clientId,
+    dPoP.jti,
+    epochTime() + CHALLENGE_OK_WINDOW,
+  );
+
+  ctx.assert(unique, new ErrorClass('DPoP proof JWT Replay detected'));
+}
+
+export default async function validateDpop(provider, ctx, accessToken) {
+  assertProviderContext(provider, ctx);
+
   if (weakMap.has(ctx)) {
     return weakMap.get(ctx);
   }
@@ -23,7 +40,7 @@ export default async (ctx, accessToken) => {
   const {
     features: { dPoP: dPoPConfig },
     dPoPSigningAlgValues,
-  } = instance(ctx.oidc.provider).configuration;
+  } = instance(provider).configuration;
 
   if (!dPoPConfig.enabled) {
     return undefined;
@@ -35,12 +52,9 @@ export default async (ctx, accessToken) => {
     return undefined;
   }
 
-  const { DPoPNonces } = instance(ctx.oidc.provider);
+  const { DPoPNonces } = instance(provider);
 
-  const requireNonce = dPoPConfig.requireNonce(ctx);
-  if (typeof requireNonce !== 'boolean') {
-    throw new Error('features.dPoP.requireNonce must return a boolean');
-  }
+  const requireNonce = boolean(dPoPConfig.requireNonce(ctx), 'features.dPoP.requireNonce');
   if (requireNonce && !DPoPNonces) {
     throw new Error('features.dPoP.nonceSecret configuration is missing');
   }
@@ -83,8 +97,13 @@ export default async (ctx, accessToken) => {
 
     {
       const expected = new URL(ctx.oidc.urlFor(ctx.oidc.route)).href;
+      if (typeof payload.htu !== 'string') {
+        throw new InvalidDpopProof('DPoP proof htu mismatch');
+      }
       const actual = URL.parse(payload.htu);
-      if (!actual) return false;
+      if (!actual) {
+        throw new InvalidDpopProof('DPoP proof htu mismatch');
+      }
       actual.hash = '';
       actual.search = '';
 
@@ -99,11 +118,11 @@ export default async (ctx, accessToken) => {
         throw new InvalidDpopProof('DPoP proof ath mismatch');
       }
     }
-  } catch (err) {
-    if (err instanceof InvalidDpopProof || err instanceof UseDpopNonce) {
-      throw err;
+  } catch (cause) {
+    if (cause instanceof InvalidDpopProof || cause instanceof UseDpopNonce) {
+      throw cause;
     }
-    throw new InvalidDpopProof('invalid DPoP key binding', err.message);
+    throw new InvalidDpopProof('invalid DPoP key binding', { cause });
   }
 
   if (!payload.nonce && requireNonce) {
@@ -126,4 +145,4 @@ export default async (ctx, accessToken) => {
   weakMap.set(ctx, result);
 
   return result;
-};
+}

package/dist/node_modules/oidc-provider/lib/helpers/weak_cache.js

@@ -1,11 +1,11 @@
-const map = new WeakMap();
+let read = () => undefined;
 
 export function get(ctx) {
-  return map.get(ctx);
+  return read(ctx);
 }
 
-export function set(ctx, value) {
-  return map.set(ctx, value);
+export function setReader(reader) {
+  read = reader;
 }
 
 export default get;

package/dist/node_modules/oidc-provider/lib/index.js

@@ -1,5 +1,3 @@
-/* eslint-disable import/first */
-// eslint-disable-next-line import/order
 import * as attention from './helpers/attention.js';
 
 const deno = typeof Deno !== 'undefined';
@@ -8,7 +6,7 @@ const workerd = typeof navigator !== 'undefined' && navigator.userAgent === 'Clo
 
 const minimal = 'Jod';
 const release = globalThis.process?.release;
-if (!release?.lts || release?.lts.charCodeAt(0) < minimal.charCodeAt(0) || deno || bun || workerd) {
+if (deno || bun || workerd || !release?.lts || release.lts.charCodeAt(0) < minimal.charCodeAt(0)) {
   attention.warn('Unsupported runtime. Use Node.js v22.x LTS, or a later LTS release.');
 }