@nocobase/plugin-idp-oauth 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/oidc-provider/lib/shared/check_rar.js

@@ -1,6 +1,6 @@
 import { InvalidAuthorizationDetails, InvalidRequest } from '../helpers/errors.js';
 import instance from '../helpers/weak_cache.js';
-import isPlainObject from '../helpers/_/is_plain_object.js';
+import normalizeAuthorizationDetails from '../helpers/normalize_authorization_details.js';
 
 export default async function checkRar(ctx, next) {
   const { params, client } = ctx.oidc;
@@ -21,51 +21,36 @@ export default async function checkRar(ctx, next) {
 
       try {
         details = JSON.parse(params.authorization_details);
-      } catch (err) {
-        throw new InvalidRequest('could not parse the authorization_details parameter JSON');
+      } catch (cause) {
+        throw new InvalidAuthorizationDetails(
+          'could not parse the authorization_details parameter JSON',
+          { cause },
+        );
       }
 
-      if (!Array.isArray(details)) {
-        throw new InvalidRequest('authorization_details parameter should be a JSON array');
-      }
+      details = normalizeAuthorizationDetails(details, {
+        ErrorConstructor: InvalidAuthorizationDetails,
+        label: 'authorization_details parameter',
+      });
 
-      if (!details.length) {
+      if (details === undefined) {
         params.authorization_details = undefined;
         return next();
       }
 
       let i = 0;
       for (const detail of details) {
-        if (!isPlainObject(detail)) {
-          throw new InvalidRequest('authorization_details parameter members should be a JSON object');
-        }
-
-        if (typeof detail.type !== 'string' || !detail.type.length) {
-          throw new InvalidAuthorizationDetails(`authorization_details parameter members' type attribute must be a non-empty string (authorization details index ${i})`);
-        }
-
-        const config = richAuthorizationRequests.types[detail.type];
-        if (!config) {
+        if (!Object.hasOwn(richAuthorizationRequests.types, detail.type)) {
           throw new InvalidAuthorizationDetails(`unsupported authorization details type value (authorization details index ${i})`);
         }
+        const config = richAuthorizationRequests.types[detail.type];
 
         if (client.authorizationDetailsTypes?.includes(detail.type) === false) {
           throw new InvalidAuthorizationDetails(`authorization details type '${detail.type}' is not allowed for this client`);
         }
 
-        // check common data fields
-        for (const field of ['locations', 'actions', 'datatypes', 'privileges']) {
-          if (field in detail && (!Array.isArray(detail[field]) || detail[field].some((value) => typeof value !== 'string' || !value.length))) {
-            throw new InvalidAuthorizationDetails(`'${field}' must be an array of non-empty strings (authorization details index ${i})`);
-          }
-        }
-        if ('identifier' in detail && (typeof detail.identifier !== 'string' || !detail.identifier.length)) {
-          throw new InvalidAuthorizationDetails(`'identifier' must be a non-empty string (authorization details index ${i})`);
-        }
-
         await config.validate(ctx, detail, client);
 
-        // eslint-disable-next-line no-plusplus
         i++;
       }
     }

package/dist/node_modules/oidc-provider/lib/shared/check_resource.js

@@ -1,6 +1,7 @@
-/* eslint-disable no-underscore-dangle */
-import instance from '../helpers/weak_cache.js';
+import assertProviderContext from '../helpers/assert_provider_context.js';
+import { resourceServer as validateResourceServer } from '../helpers/configuration_result.js';
 import { InvalidTarget } from '../helpers/errors.js';
+import instance from '../helpers/weak_cache.js';
 
 const filterStatics = (ctx) => {
   if (ctx.oidc.params.scope && !ctx.oidc.params.resource) {
@@ -12,11 +13,12 @@ function emptyResource(params) {
   return !params.resource || (Array.isArray(params.resource) && !params.resource.length);
 }
 
-export default async function checkResource(ctx, next) {
+export async function resolveRequestedResources(provider, ctx) {
+  assertProviderContext(provider, ctx);
+
   const {
     oidc: {
       params,
-      provider,
       client,
       resourceServers,
     },
@@ -30,7 +32,7 @@ export default async function checkResource(ctx, next) {
 
   if (!enabled) {
     filterStatics(ctx);
-    return next();
+    return Object.values(resourceServers);
   }
 
   if (params.resource === undefined) {
@@ -43,13 +45,13 @@ export default async function checkResource(ctx, next) {
 
   if (params.scope && emptyResource(params)) {
     filterStatics(ctx);
-    return next();
+    return Object.values(resourceServers);
   }
 
   let { resource } = params;
 
   if (params.resource === undefined) {
-    return next();
+    return Object.values(resourceServers);
   }
 
   if (!Array.isArray(params.resource)) {
@@ -63,15 +65,22 @@ export default async function checkResource(ctx, next) {
       throw new InvalidTarget('resource indicator must be an absolute URI');
     }
 
-    // NOTE: we don't check for new URL() => search of hash because of an edge case
-    // new URL('https://example.com?#') => search and hash are empty, seems like an inconsistent validation
+    
+    
     if (href.includes('#')) {
       throw new InvalidTarget('resource indicator must not contain a fragment component');
     }
 
-    const resourceServer = await getResourceServerInfo(ctx, identifier, client);
-    resourceServers[identifier] = new ctx.oidc.provider.ResourceServer(identifier, resourceServer);
+    const resourceServer = validateResourceServer(
+      await getResourceServerInfo(ctx, identifier, client),
+    );
+    resourceServers[identifier] = new provider.ResourceServer(identifier, resourceServer);
   }
 
+  return Object.values(resourceServers);
+}
+
+export default async function checkResource(ctx, next) {
+  await resolveRequestedResources(ctx.oidc.provider, ctx);
   return next();
 }

package/dist/node_modules/oidc-provider/lib/shared/client_auth.js

@@ -1,17 +1,32 @@
-import { InvalidRequest, InvalidClientAuth } from '../helpers/errors.js';
+import { noVSCHAR } from '../consts/client_attributes.js';
 import appendWWWAuthenticate from '../helpers/append_www_authenticate.js';
+import certificateThumbprint from '../helpers/certificate_thumbprint.js';
+import { boolean } from '../helpers/configuration_result.js';
+import { InvalidClientAuth, InvalidRequest } from '../helpers/errors.js';
 import * as JWT from '../helpers/jwt.js';
 import instance from '../helpers/weak_cache.js';
-import certificateThumbprint from '../helpers/certificate_thumbprint.js';
-import { noVSCHAR } from '../consts/client_attributes.js';
-
-import rejectDupes from './reject_dupes.js';
+import attestClientAuth, { validateClientAttestationJwtAndPop } from './attest_client_auth.js';
 import jwtClientAuth from './jwt_client_auth.js';
-import attestClientAuth from './attest_client_auth.js';
+import rejectDupes from './reject_dupes.js';
 
 const assertionType = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
 
-// see https://tools.ietf.org/html/rfc6749#appendix-B
+function isValidBase64(input) {
+  const match = /^([A-Za-z0-9+/]*)(={0,2})$/u.exec(input);
+  if (!match?.[1]) {
+    return false;
+  }
+
+  const remainder = match[1].length % 4;
+  if (!match[2]) {
+    return remainder !== 1;
+  }
+
+  return (match[1].length + match[2].length) % 4 === 0
+    && match[2].length === 4 - remainder;
+}
+
+
 function decodeAuthToken(token) {
   const authToken = decodeURIComponent(token.replace(/\+/g, '%20'));
   if (noVSCHAR.test(authToken)) {
@@ -20,11 +35,11 @@ function decodeAuthToken(token) {
   return authToken;
 }
 
-export default function clientAuthentication(provider) {
+export function getClientAuthParams(ctx) {
   const authParams = new Set(['client_id']);
-  const { configuration, features } = instance(provider);
+  const { clientAuthMethods } = instance(ctx.oidc.provider).configuration;
 
-  configuration.clientAuthMethods.forEach((method) => {
+  clientAuthMethods.forEach((method) => {
     switch (method) {
       case 'client_secret_post':
         authParams.add('client_secret');
@@ -38,226 +53,275 @@ export default function clientAuthentication(provider) {
     }
   });
 
-  authParams.forEach(Set.prototype.add.bind(instance(provider).grantTypeParams.get(undefined)));
-
-  return {
-    params: authParams,
-    middleware: [
-      rejectDupes.bind(undefined, { only: authParams }),
-      async function setWWWAuthenticateHeader(ctx, next) {
-        try {
-          await next();
-        } catch (err) {
-          if (err.statusCode === 401 && ctx.headers.authorization !== undefined) {
-            appendWWWAuthenticate(ctx, 'Basic', {
-              realm: provider.issuer,
-              error: err.message,
-              error_description: err.error_description,
-            });
-          }
-          throw err;
-        }
-      },
-      async function authenticateClient(ctx, next) {
-        let methods;
-        let clientId;
-        let clientSecret;
-
-        const setClientId = (value) => {
-          if (clientId !== undefined && value !== clientId) {
-            throw new InvalidRequest('client_id mismatch');
-          }
-          clientId = value;
-        };
-
-        const { length } = [
-          ctx.headers.authorization,
-          ctx.headers['oauth-client-attestation'],
-          ctx.oidc.params.client_assertion,
-          ctx.oidc.params.client_secret,
-        ].filter(Boolean);
-
-        if (length > 1) {
-          throw new InvalidRequest('client authentication must only be provided using one mechanism');
-        }
+  return authParams;
+}
 
-        if (ctx.oidc.params.client_id !== undefined) {
-          setClientId(ctx.oidc.params.client_id);
-        }
+function rejectClientAuthDupes(ctx, next) {
+  return rejectDupes({ only: getClientAuthParams(ctx) }, ctx, next);
+}
 
-        if (ctx.oidc.params.client_secret) {
-          clientSecret = ctx.oidc.params.client_secret;
-          methods = ['client_secret_basic', 'client_secret_post'];
-        } else if (ctx.headers.authorization !== undefined) {
-          const parts = ctx.headers.authorization.split(' ');
-          if (parts.length !== 2 || parts[0].toLowerCase() !== 'basic') {
-            throw new InvalidRequest('invalid authorization header value format');
-          }
+async function setWWWAuthenticateHeader(ctx, next) {
+  try {
+    await next();
+  } catch (err) {
+    if (err.statusCode === 401 && ctx.headers.authorization !== undefined) {
+      appendWWWAuthenticate(ctx, 'Basic', {
+        realm: ctx.oidc.provider.issuer,
+        error: err.message,
+        error_description: err.error_description,
+      });
+    }
+    throw err;
+  }
+}
 
-          const basic = Buffer.from(parts[1], 'base64').toString('utf8');
-          const i = basic.indexOf(':');
+async function authenticateClient(ctx, next) {
+  const { provider } = ctx.oidc;
+  const { features } = instance(provider);
+  let methods;
+  let clientId;
+  let clientSecret;
 
-          if (i === -1) {
-            throw new InvalidRequest('invalid authorization header value format');
-          }
+  const setClientId = (value) => {
+    if (clientId !== undefined && value !== clientId) {
+      throw new InvalidRequest('client_id mismatch');
+    }
+    clientId = value;
+  };
 
-          let basicClientId;
-          try {
-            basicClientId = decodeAuthToken(basic.slice(0, i));
-            clientSecret = decodeAuthToken(basic.slice(i + 1));
-          } catch (err) {
-            throw new InvalidRequest('client_id and client_secret in the authorization header are not properly encoded');
-          }
+  const hasAttestation = ctx.headers['oauth-client-attestation'] !== undefined;
+  const hasAttestationPop = ctx.headers['oauth-client-attestation-pop'] !== undefined;
+  const { additionalSecuritySignal } = features.attestClientAuth;
+  const { length } = [
+    ctx.headers.authorization,
+    ctx.oidc.params.client_assertion,
+    ctx.oidc.params.client_secret,
+  ].filter(Boolean);
+
+  if (length > 1) {
+    throw new InvalidRequest('client authentication must only be provided using one mechanism');
+  }
 
-          setClientId(basicClientId);
+  if (length && (hasAttestation || hasAttestationPop) && !additionalSecuritySignal) {
+    throw new InvalidRequest('client authentication must only be provided using one mechanism');
+  }
 
-          if (!clientSecret) {
-            throw new InvalidRequest('client_secret must be provided in the Authorization header');
-          }
+  if (ctx.oidc.params.client_id !== undefined) {
+    setClientId(ctx.oidc.params.client_id);
+  }
 
-          methods = ['client_secret_basic', 'client_secret_post'];
-        } else if (ctx.headers['oauth-client-attestation'] !== undefined) {
-          let sub;
-          try {
-            ({ payload: { sub } } = JWT.decode(ctx.headers['oauth-client-attestation']));
-          } catch (err) {
-            throw new InvalidRequest('invalid OAuth-Client-Attestation format');
-          }
+  if (ctx.oidc.params.client_secret) {
+    clientSecret = ctx.oidc.params.client_secret;
+    methods = ['client_secret_basic', 'client_secret_post'];
+  } else if (ctx.headers.authorization !== undefined) {
+    const parts = ctx.headers.authorization.split(' ');
+    if (parts.length !== 2 || parts[0].toLowerCase() !== 'basic') {
+      throw new InvalidRequest('invalid authorization header value format');
+    }
 
-          if (!sub) {
-            throw new InvalidClientAuth('sub (JWT subject) must be provided in the OAuth-Client-Attestation JWT');
-          }
+    if (!isValidBase64(parts[1])) {
+      throw new InvalidRequest('invalid authorization header value format');
+    }
 
-          setClientId(sub);
-          methods = ['attest_jwt_client_auth'];
-        } else if (ctx.oidc.params.client_assertion !== undefined) {
-          let sub;
-          try {
-            ({ payload: { sub } } = JWT.decode(ctx.oidc.params.client_assertion));
-          } catch (err) {
-            throw new InvalidRequest('invalid client_assertion format');
-          }
+    const basic = Buffer.from(parts[1], 'base64').toString('utf8');
+    const i = basic.indexOf(':');
 
-          if (!sub) {
-            throw new InvalidClientAuth('sub (JWT subject) must be provided in the client_assertion JWT');
-          }
+    if (i === -1) {
+      throw new InvalidRequest('invalid authorization header value format');
+    }
 
-          if (ctx.oidc.params.client_assertion_type === undefined) {
-            throw new InvalidRequest('client_assertion_type must be provided');
-          }
+    let basicClientId;
+    try {
+      basicClientId = decodeAuthToken(basic.slice(0, i));
+      clientSecret = decodeAuthToken(basic.slice(i + 1));
+    } catch (cause) {
+      throw new InvalidRequest(
+        'client_id and client_secret in the authorization header are not properly encoded',
+        undefined,
+        { cause },
+      );
+    }
 
-          if (ctx.oidc.params.client_assertion_type !== assertionType) {
-            throw new InvalidRequest(`client_assertion_type must have value ${assertionType}`);
-          }
+    setClientId(basicClientId);
 
-          setClientId(sub);
-          methods = ['client_secret_jwt', 'private_key_jwt'];
-        } else {
-          methods = ['none', 'tls_client_auth', 'self_signed_tls_client_auth'];
-        }
+    if (!clientSecret) {
+      throw new InvalidRequest('client_secret must be provided in the Authorization header');
+    }
 
-        if (!clientId) {
-          throw new InvalidRequest('no client authentication mechanism provided');
-        }
+    methods = ['client_secret_basic', 'client_secret_post'];
+  } else if (hasAttestation && (!clientId || !additionalSecuritySignal)) {
+    let sub;
+    try {
+      ({ sub } = JWT.payload(ctx.headers['oauth-client-attestation']));
+    } catch (cause) {
+      throw new InvalidRequest(
+        'invalid OAuth-Client-Attestation format',
+        undefined,
+        { cause },
+      );
+    }
 
-        const client = await provider.Client.find(clientId);
+    if (!sub) {
+      throw new InvalidClientAuth('sub (JWT subject) must be provided in the OAuth-Client-Attestation JWT');
+    }
 
-        if (!client) {
-          throw new InvalidClientAuth('client not found');
-        }
+    setClientId(sub);
+    methods = ['attest_jwt_client_auth'];
+  } else if (ctx.oidc.params.client_assertion !== undefined) {
+    let sub;
+    try {
+      ({ sub } = JWT.payload(ctx.oidc.params.client_assertion));
+    } catch (cause) {
+      throw new InvalidRequest('invalid client_assertion format', undefined, { cause });
+    }
+
+    if (!sub) {
+      throw new InvalidClientAuth('sub (JWT subject) must be provided in the client_assertion JWT');
+    }
 
-        ctx.oidc.entity('Client', client);
+    if (ctx.oidc.params.client_assertion_type === undefined) {
+      throw new InvalidRequest('client_assertion_type must be provided');
+    }
 
-        if (methods?.includes(ctx.oidc.client.clientAuthMethod) !== true) {
-          throw new InvalidClientAuth('the provided authentication mechanism does not match the registered client authentication method');
-        }
+    if (ctx.oidc.params.client_assertion_type !== assertionType) {
+      throw new InvalidRequest(`client_assertion_type must have value ${assertionType}`);
+    }
 
-        switch (ctx.oidc.client.clientAuthMethod) { // eslint-disable-line default-case
-          case 'none':
-            break;
+    setClientId(sub);
+    methods = ['client_secret_jwt', 'private_key_jwt'];
+  } else {
+    methods = ['none', 'tls_client_auth', 'self_signed_tls_client_auth'];
+    if (hasAttestation && additionalSecuritySignal) {
+      methods.push('attest_jwt_client_auth');
+    }
+  }
 
-          case 'client_secret_basic':
-          case 'client_secret_post': {
-            ctx.oidc.client.checkClientSecretExpiration('could not authenticate the client - its client secret is expired');
-            const matches = await ctx.oidc.client.compareClientSecret(clientSecret);
-            if (!matches) {
-              throw new InvalidClientAuth('invalid secret provided');
-            }
+  if (!clientId) {
+    throw new InvalidRequest('no client authentication mechanism provided');
+  }
 
-            break;
-          }
+  const client = await provider.Client.find(clientId);
 
-          case 'client_secret_jwt':
-            ctx.oidc.client.checkClientSecretExpiration('could not authenticate the client - its client secret used for the client_assertion is expired');
-            await jwtClientAuth(ctx, ctx.oidc.client.symmetricKeyStore, (alg) => alg.startsWith('HS'));
-
-            break;
-
-          case 'private_key_jwt':
-            await jwtClientAuth(ctx, ctx.oidc.client.asymmetricKeyStore, (alg) => !alg.startsWith('HS'));
-
-            break;
-
-          case 'tls_client_auth': {
-            const {
-              getCertificate, certificateAuthorized, certificateSubjectMatches,
-            } = features.mTLS;
-
-            const cert = getCertificate(ctx);
-
-            if (!cert) {
-              throw new InvalidClientAuth('client certificate was not provided');
-            }
-
-            if (!certificateAuthorized(ctx)) {
-              throw new InvalidClientAuth('client certificate was not verified');
-            }
-
-            for (const [prop, key] of Object.entries({
-              tlsClientAuthSubjectDn: 'tls_client_auth_subject_dn',
-              tlsClientAuthSanDns: 'tls_client_auth_san_dns',
-              tlsClientAuthSanIp: 'tls_client_auth_san_ip',
-              tlsClientAuthSanEmail: 'tls_client_auth_san_email',
-              tlsClientAuthSanUri: 'tls_client_auth_san_uri',
-            })) {
-              const value = ctx.oidc.client[prop];
-              if (value) {
-                if (!certificateSubjectMatches(ctx, key, value)) {
-                  throw new InvalidClientAuth('certificate subject value does not match the registered one');
-                }
-                break;
-              }
-            }
-
-            break;
-          }
-          case 'self_signed_tls_client_auth': {
-            const { getCertificate } = features.mTLS;
-            const cert = getCertificate(ctx);
+  if (!client) {
+    throw new InvalidClientAuth('client not found');
+  }
 
-            if (!cert) {
-              throw new InvalidClientAuth('client certificate was not provided');
-            }
+  ctx.oidc.entity('Client', client);
 
-            await ctx.oidc.client.asymmetricKeyStore.refresh();
-            const expected = certificateThumbprint(cert);
-            const match = [...ctx.oidc.client.asymmetricKeyStore].find(({ 'x5t#S256': actual }) => actual === expected);
+  if (
+    (hasAttestation || hasAttestationPop)
+    && !additionalSecuritySignal
+    && ctx.oidc.params.client_id !== undefined
+    && ctx.oidc.client.clientAuthMethod !== 'attest_jwt_client_auth'
+  ) {
+    throw new InvalidRequest('client authentication must only be provided using one mechanism');
+  }
 
-            if (!match) {
-              throw new InvalidClientAuth('unregistered client certificate provided');
-            }
+  if (methods?.includes(ctx.oidc.client.clientAuthMethod) !== true) {
+    throw new InvalidClientAuth('the provided authentication mechanism does not match the registered client authentication method');
+  }
 
-            break;
-          }
-          case 'attest_jwt_client_auth': {
-            await attestClientAuth(ctx);
+  switch (ctx.oidc.client.clientAuthMethod) {
+    case 'none':
+      break;
+
+    case 'client_secret_basic':
+    case 'client_secret_post': {
+      ctx.oidc.client.checkClientSecretExpiration('could not authenticate the client - its client secret is expired');
+      const matches = await ctx.oidc.client.compareClientSecret(clientSecret);
+      if (!matches) {
+        throw new InvalidClientAuth('invalid secret provided');
+      }
+
+      break;
+    }
 
-            break;
+    case 'client_secret_jwt':
+      ctx.oidc.client.checkClientSecretExpiration('could not authenticate the client - its client secret used for the client_assertion is expired');
+      await jwtClientAuth(ctx, ctx.oidc.client.symmetricKeyStore, (alg) => alg.startsWith('HS'));
+
+      break;
+
+    case 'private_key_jwt':
+      await jwtClientAuth(ctx, ctx.oidc.client.asymmetricKeyStore, (alg) => !alg.startsWith('HS'));
+
+      break;
+
+    case 'tls_client_auth': {
+      const {
+        getCertificate, certificateAuthorized, certificateSubjectMatches,
+      } = features.mTLS;
+
+      const cert = getCertificate(ctx);
+
+      if (!cert) {
+        throw new InvalidClientAuth('client certificate was not provided');
+      }
+
+      if (!boolean(
+        certificateAuthorized(ctx),
+        'features.mTLS.certificateAuthorized',
+      )) {
+        throw new InvalidClientAuth('client certificate was not verified');
+      }
+
+      for (const [prop, key] of Object.entries({
+        tlsClientAuthSubjectDn: 'tls_client_auth_subject_dn',
+        tlsClientAuthSanDns: 'tls_client_auth_san_dns',
+        tlsClientAuthSanIp: 'tls_client_auth_san_ip',
+        tlsClientAuthSanEmail: 'tls_client_auth_san_email',
+        tlsClientAuthSanUri: 'tls_client_auth_san_uri',
+      })) {
+        const value = ctx.oidc.client[prop];
+        if (value) {
+          if (!boolean(
+            certificateSubjectMatches(ctx, key, value),
+            'features.mTLS.certificateSubjectMatches',
+          )) {
+            throw new InvalidClientAuth('certificate subject value does not match the registered one');
           }
+          break;
         }
+      }
 
-        await next();
-      },
-    ],
-  };
+      break;
+    }
+    case 'self_signed_tls_client_auth': {
+      const { getCertificate } = features.mTLS;
+      const cert = getCertificate(ctx);
+
+      if (!cert) {
+        throw new InvalidClientAuth('client certificate was not provided');
+      }
+
+      await ctx.oidc.client.asymmetricKeyStore.refresh();
+      const expected = certificateThumbprint(cert);
+      const match = [...ctx.oidc.client.asymmetricKeyStore].find(({ 'x5t#S256': actual }) => actual === expected);
+
+      if (!match) {
+        throw new InvalidClientAuth('unregistered client certificate provided');
+      }
+
+      break;
+    }
+    case 'attest_jwt_client_auth': {
+      await attestClientAuth(ctx);
+
+      break;
+    }
+  }
+
+  if (
+    ctx.oidc.client.clientAuthMethod !== 'attest_jwt_client_auth'
+    && (
+      additionalSecuritySignal === 'required'
+      || (additionalSecuritySignal === 'optional' && (hasAttestation || hasAttestationPop))
+    )
+  ) {
+    await validateClientAttestationJwtAndPop(ctx, { signal: true });
+  }
+
+  await next();
 }
+
+export default [rejectClientAuthDupes, setWWWAuthenticateHeader, authenticateClient];