@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/lib/models/device_code.js

@@ -1,21 +1,8 @@
 import constantEquals from '../helpers/constant_equals.js';
 
-import apply from './mixins/apply.js';
-import consumable from './mixins/consumable.js';
-import hasFormat from './mixins/has_format.js';
-import hasGrantId from './mixins/has_grant_id.js';
-import isAttestationConstrained from './mixins/is_attestation_constrained.js';
-import isSessionBound from './mixins/is_session_bound.js';
-import storesAuth from './mixins/stores_auth.js';
-
-export default (provider) => class DeviceCode extends apply([
-  consumable,
-  hasGrantId,
-  isAttestationConstrained,
-  isSessionBound(provider),
-  storesAuth,
-  hasFormat(provider, 'DeviceCode', provider.BaseToken),
-]) {
+import { checkSessionBinding, setAttestBinding } from './token_helpers.js';
+
+export default (provider) => class DeviceCode extends provider.BaseToken {
   static async findByUserCode(userCode, { ignoreExpiration = false } = {}) {
     const stored = await this.adapter.findByUserCode(userCode);
     if (!stored) return undefined;
@@ -25,7 +12,7 @@ export default (provider) => class DeviceCode extends apply([
         return undefined;
       }
       return this.instantiate(payload);
-    } catch (err) {
+    } catch {
       return undefined;
     }
   }
@@ -33,12 +20,48 @@ export default (provider) => class DeviceCode extends apply([
   static get IN_PAYLOAD() {
     return [
       ...super.IN_PAYLOAD,
+      'consumed',
+      'grantId',
+      'attestationJkt',
+      'sessionUid',
+      'expiresWithSession',
+      'accountId',
+      'acr',
+      'amr',
+      'authTime',
+      'claims',
+      'nonce',
+      'resource',
+      'scope',
+      'sid',
       'error',
       'errorDescription',
       'params',
+      'rar',
       'userCode',
       'inFlight',
       'deviceInfo',
     ];
   }
+
+  async consume() {
+    await this.adapter.consume(this.jti);
+    this.emit('consumed');
+  }
+
+  get isValid() {
+    return !this.consumed && !this.isExpired;
+  }
+
+  static async find(...args) {
+    return checkSessionBinding(provider, await super.find(...args), args[1]);
+  }
+
+  static async revokeByGrantId(grantId) {
+    await this.adapter.revokeByGrantId(grantId);
+  }
+
+  async setAttestBinding(ctx) {
+    await setAttestBinding(this, ctx);
+  }
 };

package/dist/node_modules/oidc-provider/lib/models/formats/index.js

@@ -1,14 +1,22 @@
-import opaque from './opaque.js';
-import jwt from './jwt.js';
-import dynamic from './dynamic.js';
+import * as opaque from './opaque.js';
+import * as jwt from './jwt.js';
 
-export default (provider) => {
-  const result = {
-    opaque: opaque(provider), // no dependencies
-  };
+export function generateTokenId(provider, token) {
+  const format = token.resourceServer?.accessTokenFormat ?? 'opaque';
+  if (format !== 'opaque' && format !== 'jwt') {
+    throw new Error('invalid format resolved');
+  }
+  token.format = format;
+  return format === 'jwt' ? jwt.generateTokenId() : opaque.generateTokenId(provider, token);
+}
 
-  result.jwt = jwt(provider, result); // depends on opaque
-  result.dynamic = dynamic(provider, result); // depends on all
-
-  return result;
-};
+export async function getValueAndPayload(provider, token) {
+  switch (token.format) {
+    case 'opaque':
+      return opaque.getValueAndPayload(provider, token);
+    case 'jwt':
+      return jwt.getValueAndPayload(provider, token);
+    default:
+      throw new Error('invalid format resolved');
+  }
+}

package/dist/node_modules/oidc-provider/lib/models/formats/jwt.js

@@ -5,194 +5,193 @@ import instance from '../../helpers/weak_cache.js';
 import nanoid from '../../helpers/nanoid.js';
 import als from '../../helpers/als.js';
 
-export default (provider, { opaque }) => {
-  async function getResourceServerConfig(token) {
-    const { keystore, configuration } = instance(provider);
-    const { clientDefaults: { id_token_signed_response_alg: defaultAlg } } = configuration;
-
-    let sign;
-    let encrypt;
-
-    {
-      let alg;
-      let key;
-      let kid;
-
-      if (token.resourceServer) {
-        if (token.resourceServer.jwt?.sign) {
-          ({ alg = defaultAlg, key, kid } = token.resourceServer.jwt.sign);
-        } else if (
-          !token.resourceServer.jwt
-          || (!token.resourceServer.jwt.sign && !token.resourceServer.jwt.encrypt)
-        ) {
-          alg = defaultAlg;
-        }
+import { getValueAndPayload as getOpaqueValueAndPayload } from './opaque.js';
+
+async function getResourceServerConfig(provider, token) {
+  const { keystore, configuration } = instance(provider);
+  const { clientDefaults: { id_token_signed_response_alg: defaultAlg } } = configuration;
+
+  let sign;
+  let encrypt;
+
+  {
+    let alg;
+    let key;
+    let kid;
+
+    if (token.resourceServer) {
+      if (token.resourceServer.jwt?.sign) {
+        ({ alg = defaultAlg, key, kid } = token.resourceServer.jwt.sign);
+      } else if (
+        !token.resourceServer.jwt
+        || (!token.resourceServer.jwt.sign && !token.resourceServer.jwt.encrypt)
+      ) {
+        alg = defaultAlg;
       }
+    }
 
-      if (alg === 'none') {
-        throw new Error('JWT Access Tokens may not use JWS algorithm "none"');
-      } else if (alg) {
-        if (alg.startsWith('HS')) {
-          if (!key) {
-            throw new Error('missing jwt.sign.key Resource Server configuration');
-          }
-          if (!(key instanceof crypto.KeyObject || key instanceof CryptoKey)) {
-            key = crypto.createSecretKey(key);
-          }
-          if (key.type !== 'secret') {
-            throw new Error('jwt.sign.key Resource Server configuration must be a secret (symmetric) key');
-          }
-        } else {
-          [key] = keystore.selectForVerify({ alg, use: 'sig', kid });
-          if (!key) {
-            throw new Error('resolved Resource Server jwt configuration has no corresponding key in the provider\'s keystore');
-          }
-          kid = key.kid;
-          key = keystore.getKeyObject(key);
+    if (alg === 'none') {
+      throw new Error('JWT Access Tokens may not use JWS algorithm "none"');
+    } else if (alg) {
+      if (alg.startsWith('HS')) {
+        if (!key) {
+          throw new Error('missing jwt.sign.key Resource Server configuration');
+        }
+        if (!(key instanceof crypto.KeyObject || key instanceof CryptoKey)) {
+          key = crypto.createSecretKey(key);
         }
-        if (kid !== undefined && typeof kid !== 'string') {
-          throw new Error('jwt.sign.kid must be a string when provided');
+        if (key.type !== 'secret') {
+          throw new Error('jwt.sign.key Resource Server configuration must be a secret (symmetric) key');
         }
-        sign = { alg, key, kid };
+      } else {
+        [key] = keystore.selectForSign({ alg, use: 'sig', kid });
+        if (!key) {
+          throw new Error('resolved Resource Server jwt configuration has no corresponding key in the provider\'s keystore');
+        }
+        kid = key.kid;
+        key = keystore.getKeyObject(key);
+      }
+      if (kid !== undefined && typeof kid !== 'string') {
+        throw new Error('jwt.sign.kid must be a string when provided');
       }
+      sign = { alg, key, kid };
     }
+  }
 
-    if (token.resourceServer?.jwt?.encrypt) {
-      const { alg, enc, kid } = token.resourceServer.jwt.encrypt;
-      let { key } = token.resourceServer.jwt.encrypt;
+  if (token.resourceServer?.jwt?.encrypt) {
+    const { alg, enc, kid } = token.resourceServer.jwt.encrypt;
+    let { key } = token.resourceServer.jwt.encrypt;
 
-      if (!alg) {
-        throw new Error('missing jwt.encrypt.alg Resource Server configuration');
-      }
-      if (!enc) {
-        throw new Error('missing jwt.encrypt.enc Resource Server configuration');
-      }
-      if (!key) {
-        throw new Error('missing jwt.encrypt.key Resource Server configuration');
-      }
+    if (!alg) {
+      throw new Error('missing jwt.encrypt.alg Resource Server configuration');
+    }
+    if (!enc) {
+      throw new Error('missing jwt.encrypt.enc Resource Server configuration');
+    }
+    if (!key) {
+      throw new Error('missing jwt.encrypt.key Resource Server configuration');
+    }
 
-      if (!(key instanceof crypto.KeyObject || key instanceof CryptoKey) && /^(A|dir$)/.test(alg)) {
-        key = crypto.createSecretKey(key);
-      }
+    if (!(key instanceof crypto.KeyObject || key instanceof CryptoKey) && /^(A|dir$)/.test(alg)) {
+      key = crypto.createSecretKey(key);
+    }
 
-      if (key.type === 'private') throw new Error('jwt.encrypt.key Resource Server configuration must be a secret (symmetric) or a public key');
-      if (key.type === 'public' && !sign) throw new Error('missing jwt.sign Resource Server configuration');
+    if (key.type === 'private') throw new Error('jwt.encrypt.key Resource Server configuration must be a secret (symmetric) or a public key');
+    if (key.type === 'public' && !sign) throw new Error('missing jwt.sign Resource Server configuration');
 
-      if (kid !== undefined && typeof kid !== 'string') {
-        throw new Error('jwt.encrypt.kid must be a string when provided');
-      }
-      encrypt = {
-        alg, enc, key, kid,
-      };
+    if (kid !== undefined && typeof kid !== 'string') {
+      throw new Error('jwt.encrypt.kid must be a string when provided');
     }
-
-    return { sign, encrypt };
+    encrypt = {
+      alg, enc, key, kid,
+    };
   }
 
-  return {
-    generateTokenId() {
-      return nanoid();
-    },
-    async getValueAndPayload() {
-      const { payload } = await opaque.getValueAndPayload.call(this);
-      const {
-        aud, jti, iat, exp, scope, clientId, 'x5t#S256': x5t, jkt, extra, rar,
-      } = payload;
-      let { accountId: sub } = payload;
-
-      if (sub) {
-        const { client } = this;
-        if (client?.clientId !== clientId) {
-          throw new TypeError('clientId and client mismatch');
-        }
-        if (client.subjectType === 'pairwise') {
-          const { pairwiseIdentifier } = instance(provider).configuration;
-          sub = await pairwiseIdentifier(als.getStore(), sub, client);
-        }
-      }
+  return { sign, encrypt };
+}
 
-      const tokenPayload = {
-        ...extra,
-        jti,
-        sub: sub || clientId,
-        iat,
-        exp,
-        authorization_details: rar,
-        scope: scope || undefined,
-        client_id: clientId,
-        iss: provider.issuer,
-        aud,
-        ...(x5t || jkt ? { cnf: {} } : undefined),
-      };
+export function generateTokenId() {
+  return nanoid();
+}
 
-      if (x5t) {
-        tokenPayload.cnf['x5t#S256'] = x5t;
-      }
-      if (jkt) {
-        tokenPayload.cnf.jkt = jkt;
-      }
+export async function getValueAndPayload(provider, token) {
+  const { payload } = await getOpaqueValueAndPayload(provider, token);
+  const {
+    aud, jti, iat, exp, scope, clientId, 'x5t#S256': x5t, jkt, extra, rar,
+  } = payload;
+  let { accountId: sub } = payload;
 
-      const structuredToken = {
-        header: undefined,
-        payload: tokenPayload,
-      };
+  if (sub) {
+    const { client } = token;
+    if (client?.clientId !== clientId) {
+      throw new TypeError('clientId and client mismatch');
+    }
+    if (client.subjectType === 'pairwise') {
+      const { pairwiseIdentifier } = instance(provider).configuration;
+      sub = await pairwiseIdentifier(als.getStore(), sub, client);
+    }
+  }
 
-      const customizer = instance(provider).configuration.formats.customizers.jwt;
-      if (customizer) {
-        await customizer(als.getStore(), this, structuredToken);
-      }
+  const tokenPayload = {
+    ...extra,
+    jti,
+    sub: sub || clientId,
+    iat,
+    exp,
+    authorization_details: rar,
+    scope: scope || undefined,
+    client_id: clientId,
+    iss: provider.issuer,
+    aud,
+    ...(x5t || jkt ? { cnf: {} } : undefined),
+  };
 
-      if (!structuredToken.payload.aud) {
-        throw new Error('JWT Access Tokens must contain an audience, for Access Tokens without audience (only usable at the userinfo_endpoint) use an opaque format');
-      }
+  if (x5t) {
+    tokenPayload.cnf['x5t#S256'] = x5t;
+  }
+  if (jkt) {
+    tokenPayload.cnf.jkt = jkt;
+  }
 
-      const config = await getResourceServerConfig(this);
+  const structuredToken = {
+    header: undefined,
+    payload: tokenPayload,
+  };
 
-      let signed;
-      if (config.sign) {
-        signed = await JWT.sign(structuredToken.payload, config.sign.key, config.sign.alg, {
-          typ: 'at+jwt',
-          fields: { kid: config.sign.kid, ...structuredToken.header },
-        });
-      }
+  const customizer = instance(provider).configuration.formats.customizers.jwt;
+  if (customizer) {
+    await customizer(als.getStore(), token, structuredToken);
+  }
 
-      if (config.sign && config.encrypt) {
-        const encrypted = await JWT.encrypt(signed, config.encrypt.key, {
-          fields: {
-            kid: config.encrypt.kid,
-            iss: provider.issuer,
-            aud: structuredToken.payload.aud,
-            cty: 'at+jwt',
-          },
-          enc: config.encrypt.enc,
-          alg: config.encrypt.alg,
-        });
-
-        return { value: encrypted };
-      }
+  if (!structuredToken.payload.aud) {
+    throw new Error('JWT Access Tokens must contain an audience, for Access Tokens without audience (only usable at the userinfo_endpoint) use an opaque format');
+  }
 
-      if (config.sign) {
-        return { value: signed };
-      }
+  const config = await getResourceServerConfig(provider, token);
 
-      if (config.encrypt) {
-        const cleartext = JSON.stringify(structuredToken.payload);
-        const encrypted = await JWT.encrypt(cleartext, config.encrypt.key, {
-          fields: {
-            kid: config.encrypt.kid,
-            iss: provider.issuer,
-            aud: structuredToken.payload.aud,
-            typ: 'at+jwt',
-            ...structuredToken.header,
-          },
-          enc: config.encrypt.enc,
-          alg: config.encrypt.alg,
-        });
-
-        return { value: encrypted };
-      }
+  let signed;
+  if (config.sign) {
+    signed = await JWT.sign(structuredToken.payload, config.sign.key, config.sign.alg, {
+      typ: 'at+jwt',
+      fields: { kid: config.sign.kid, ...structuredToken.header },
+    });
+  }
 
-      throw new Error('invalid Resource Server jwt configuration');
-    },
-  };
-};
+  if (config.sign && config.encrypt) {
+    const encrypted = await JWT.encrypt(signed, config.encrypt.key, {
+      fields: {
+        kid: config.encrypt.kid,
+        iss: provider.issuer,
+        aud: structuredToken.payload.aud,
+        cty: 'at+jwt',
+      },
+      enc: config.encrypt.enc,
+      alg: config.encrypt.alg,
+    });
+
+    return { value: encrypted };
+  }
+
+  if (config.sign) {
+    return { value: signed };
+  }
+
+  if (config.encrypt) {
+    const cleartext = JSON.stringify(structuredToken.payload);
+    const encrypted = await JWT.encrypt(cleartext, config.encrypt.key, {
+      fields: {
+        kid: config.encrypt.kid,
+        iss: provider.issuer,
+        aud: structuredToken.payload.aud,
+        typ: 'at+jwt',
+        ...structuredToken.header,
+      },
+      enc: config.encrypt.enc,
+      alg: config.encrypt.alg,
+    });
+
+    return { value: encrypted };
+  }
+
+  throw new Error('invalid Resource Server jwt configuration');
+}

package/dist/node_modules/oidc-provider/lib/models/formats/opaque.js

@@ -1,58 +1,67 @@
-import pickBy from '../../helpers/_/pick_by.js';
-import { assertPayload } from '../../helpers/jwt.js';
+import als from '../../helpers/als.js';
+import { extraTokenClaims } from '../../helpers/configuration_result.js';
 import epochTime from '../../helpers/epoch_time.js';
-import instance from '../../helpers/weak_cache.js';
+import { assertPayload } from '../../helpers/jwt.js';
 import nanoid from '../../helpers/nanoid.js';
-import als from '../../helpers/als.js';
+import instance from '../../helpers/weak_cache.js';
+import pickPayload from '../payload.js';
 
 const withExtra = new Set(['AccessToken', 'ClientCredentials']);
 const bitsPerSymbol = Math.log2(64);
 const tokenLength = (i) => Math.ceil(i / bitsPerSymbol);
 
-export default (provider) => ({
-  generateTokenId() {
-    let length;
-    if (this.kind !== 'PushedAuthorizationRequest') {
-      const { bitsOfOpaqueRandomness } = instance(provider).configuration.formats;
-      if (typeof bitsOfOpaqueRandomness === 'function') {
-        length = tokenLength(bitsOfOpaqueRandomness(als.getStore(), this));
-      } else {
-        length = tokenLength(bitsOfOpaqueRandomness);
-      }
+export function generateTokenId(provider, token) {
+  let length;
+  if (token.kind !== 'PushedAuthorizationRequest') {
+    const { bitsOfOpaqueRandomness } = instance(provider).configuration.formats;
+    if (typeof bitsOfOpaqueRandomness === 'function') {
+      length = tokenLength(bitsOfOpaqueRandomness(als.getStore(), token));
+    } else {
+      length = tokenLength(bitsOfOpaqueRandomness);
     }
-    return nanoid(length);
-  },
-  async getValueAndPayload() {
-    const { configuration } = instance(provider);
-    const now = epochTime();
-    const exp = this.exp || now + this.expiration;
-    const payload = {
-      iat: this.iat || epochTime(),
-      ...(exp ? { exp } : undefined),
-      ...pickBy(
-        this,
-        (val, key) => this.constructor.IN_PAYLOAD.includes(key) && typeof val !== 'undefined',
-      ),
-    };
-
-    if (withExtra.has(this.kind)) {
-      // eslint-disable-next-line no-multi-assign
-      payload.extra = this.extra = await configuration.extraTokenClaims(als.getStore(), this);
+  }
+  return nanoid(length);
+}
+
+export async function getValueAndPayload(provider, token) {
+  const { configuration } = instance(provider);
+  const now = epochTime();
+  const exp = token.exp || now + token.expiration;
+  const payload = {
+    iat: token.iat || epochTime(),
+    ...(exp ? { exp } : undefined),
+  };
+  const modelPayload = pickPayload(token.constructor, token);
+  for (const [key, value] of Object.entries(modelPayload)) {
+    if (typeof value !== 'undefined') {
+      Object.defineProperty(payload, key, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true,
+      });
     }
+  }
+
+  if (withExtra.has(token.kind)) {
+    payload.extra = token.extra = extraTokenClaims(
+      await configuration.extraTokenClaims(als.getStore(), token),
+    );
+  }
+
+  return { value: token.jti, payload };
+}
+
+export async function verify(provider, stored, { ignoreExpiration } = {}) {
+  
+  if (('jwt' in stored) || ('jwt-ietf' in stored) || ('paseto' in stored)) throw new TypeError();
+  if (('format' in stored) && stored.format !== 'opaque') throw new TypeError();
+
+  const { configuration } = instance(provider);
+  assertPayload(stored, {
+    ignoreExpiration,
+    clockTolerance: configuration.clockTolerance,
+  });
 
-    return { value: this.jti, payload };
-  },
-  async verify(stored, { ignoreExpiration } = {}) {
-    // checks that legacy tokens aren't accepted as opaque when their jti is passed
-    if (('jwt' in stored) || ('jwt-ietf' in stored) || ('paseto' in stored)) throw new TypeError();
-    if (('format' in stored) && stored.format !== 'opaque') throw new TypeError();
-
-    const { configuration } = instance(provider);
-    assertPayload(stored, {
-      ignoreExpiration,
-      clockTolerance: configuration.clockTolerance,
-    });
-
-    return stored;
-  },
-});
+  return stored;
+}

package/dist/node_modules/oidc-provider/lib/models/grant.js

@@ -1,14 +1,6 @@
-/* eslint-disable no-unused-expressions */
-/* eslint-disable no-param-reassign */
-
 import { NON_REJECTABLE_CLAIMS } from '../consts/non_rejectable_claims.js';
 
-import apply from './mixins/apply.js';
-import hasFormat from './mixins/has_format.js';
-
-export default (provider) => class Grant extends apply([
-  hasFormat(provider, 'Grant', provider.BaseToken),
-]) {
+export default (provider) => class Grant extends provider.BaseToken {
   static get IN_PAYLOAD() {
     return [
       'accountId',