@opengovsg/mockpass 3.0.0 → 3.0.2

package/README.md

@@ -18,22 +18,18 @@ A mock SingPass/CorpPass/MyInfo server for dev purposes
 Configure your application to point to the following endpoints:
 
 SingPass:
- - http://localhost:5156/singpass/logininitial - SAML login redirect with optional page
- - http://localhost:5156/singpass/soap - receives SAML artifact and returns assertion
  - http://localhost:5156/singpass/authorize - OIDC login redirect with optional page
  - http://localhost:5156/singpass/token - receives OIDC authorization code and returns id_token
 
 CorpPass:
- - http://localhost:5156/corppass/logininitial
- - http://localhost:5156/corppass/soap
  - http://localhost:5156/corppass/authorize - OIDC login redirect with optional page
  - http://localhost:5156/corppass/token - receives OIDC authorization code and returns id_token
 
 MyInfo:
- - http://localhost:5156/myinfo/{v2,v3}/person-basic (exclusive to government systems)
- - http://localhost:5156/myinfo/{v2,v3}/authorise
- - http://localhost:5156/myinfo/{v2,v3}/token
- - http://localhost:5156/myinfo/{v2,v3}/person
+ - http://localhost:5156/myinfo/v3/person-basic (exclusive to government systems)
+ - http://localhost:5156/myinfo/v3/authorise
+ - http://localhost:5156/myinfo/v3/token
+ - http://localhost:5156/myinfo/v3/person
 
 sgID:
  - http://localhost:5156/sgid/v1/oauth/authorize
@@ -49,11 +45,6 @@ Alternatively, provide the paths to your app cert as env vars
 ```
 $ npm install @opengovsg/mockpass
 
-# Some familiarity with SAML Artifact Binding is assumed
-# Optional: Configure where MockPass should send SAML artifact to, default endpoint will be `PartnerId` in request query parameter.
-$ export SINGPASS_ASSERT_ENDPOINT=http://localhost:5000/singpass/assert
-$ export CORPPASS_ASSERT_ENDPOINT=http://localhost:5000/corppass/assert
-
 # All values shown here are defaults
 $ export MOCKPASS_PORT=5156
 
@@ -69,7 +60,7 @@ $ export ENCRYPT_ASSERTION=false
 $ export SIGN_RESPONSE=false
 $ export RESOLVE_ARTIFACT_REQUEST_SIGNED=false
 
-# Encrypt payloads returned by /myinfo/*/{person, person-basic},
+# Encrypt payloads returned by /myinfo/v3/{person, person-basic},
 # equivalent to MyInfo Auth Level L2 (testing and production)
 $ export ENCRYPT_MYINFO=false
 
@@ -89,7 +80,7 @@ who then need to connect to the staging servers hosted by SingPass/CorpPass,
 which may not always be available (eg, down for maintenance, or no Internet).
 
 MockPass tries to solves this by providing an extremely lightweight implementation
-of a SAML 2.0 Identity Provider that returns mock SingPass and CorpPass assertions.
+of an OIDC Provider that returns mock SingPass and CorpPass assertions.
 It optionally provides a mock login page that (badly) mimics the SingPass/CorpPass
 login experience.
 

package/index.js

@@ -9,16 +9,6 @@ const { configOIDC, configMyInfo, configSGID } = require('./lib/express')
 
 const PORT = process.env.MOCKPASS_PORT || process.env.PORT || 5156
 
-if (
-  !process.env.SINGPASS_ASSERT_ENDPOINT &&
-  !process.env.CORPPASS_ASSERT_ENDPOINT
-) {
-  console.warn(
-    'SINGPASS_ASSERT_ENDPOINT or CORPPASS_ASSERT_ENDPOINT is not set. ' +
-      'Value of `PartnerId` request query parameter in redirect URL will be used.',
-  )
-}
-
 const serviceProvider = {
   cert: fs.readFileSync(
     path.resolve(

package/lib/crypto/myinfo-signature.js

@@ -1,4 +1,5 @@
 const _ = require('lodash')
+const qs = require('node:querystring')
 
 const pki = function pki(authHeader, req, context = {}) {
   const authHeaderFieldPairs = _(authHeader)
@@ -6,67 +7,38 @@ const pki = function pki(authHeader, req, context = {}) {
     .split(',')
     .map((v) => v.replace('=', '~').split('~'))
 
-  const authHeaderFields = _(authHeaderFieldPairs)
-    .fromPairs()
-    .mapKeys((_v, k) => _.camelCase(k))
-    .value()
+  const authHeaderFields = Object.fromEntries(authHeaderFieldPairs)
 
   const url = `${req.protocol}://${req.get('host')}${req.baseUrl}${req.path}`
 
-  const { clientSecret, redirectURI } = context
-
-  const {
-    method: httpMethod,
-    query: { attributes, sp_esvcId },
-  } = req
-
-  const { code } = req.body || {}
-
-  const {
-    signature,
-    appId,
-    appId: clientId,
-    nonce,
-    timestamp,
-  } = authHeaderFields
-  return {
-    signature,
-    baseString: req.path.endsWith('/token')
-      ? httpMethod.toUpperCase() +
-        '&' +
-        url +
-        '&app_id=' +
-        appId +
-        '&client_id=' +
-        clientId +
-        '&client_secret=' +
-        clientSecret +
-        '&code=' +
-        code +
-        '&grant_type=authorization_code' +
-        '&nonce=' +
-        nonce +
-        '&redirect_uri=' +
-        redirectURI +
-        '&signature_method=RS256' +
-        '&timestamp=' +
-        timestamp
-      : httpMethod.toUpperCase() +
-        '&' +
-        url +
-        '&app_id=' +
-        appId +
-        '&attributes=' +
-        attributes +
-        '&client_id=' +
-        clientId +
-        '&nonce=' +
-        nonce +
-        '&signature_method=RS256' +
-        (req.path.includes('/person-basic') ? '&sp_esvcId=' + sp_esvcId : '') +
-        '&timestamp=' +
-        timestamp,
-  }
+  const { method: httpMethod, query } = req
+
+  const { signature, app_id, nonce, timestamp } = authHeaderFields
+
+  const params = Object.assign(
+    {},
+    query,
+    {
+      nonce,
+      app_id,
+      signature_method: 'RS256',
+      timestamp,
+    },
+    context.client_secret && context.redirect_uri ? context : {},
+  )
+
+  const sortedParams = Object.fromEntries(
+    Object.entries(params).sort(([k1], [k2]) => k1.localeCompare(k2)),
+  )
+
+  const baseString =
+    httpMethod.toUpperCase() +
+    '&' +
+    url +
+    '&' +
+    qs.unescape(qs.stringify(sortedParams))
+
+  return { signature, baseString }
 }
 
 module.exports = { pki }

package/lib/express/myinfo/controllers.js

@@ -132,14 +132,14 @@ module.exports =
         type: 'application/x-www-form-urlencoded',
       }),
       (req, res) => {
-        const [tokenTemplate, redirectURI] =
+        const [tokenTemplate, redirect_uri] =
           consent.authorizations[req.body.code]
         const [, authHeader] = (req.get('Authorization') || '').split(' ')
 
         const { signature, baseString } = MYINFO_SECRET
           ? myInfoSignature(authHeader, req, {
-              clientSecret: MYINFO_SECRET,
-              redirectURI,
+              client_secret: MYINFO_SECRET,
+              redirect_uri,
             })
           : {}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/mockpass",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "A mock SingPass/CorpPass server for dev purposes",
   "main": "index.js",
   "bin": {
@@ -36,7 +36,6 @@
     "node": ">=8.0.0"
   },
   "dependencies": {
-    "@xmldom/xmldom": "^0.8.0",
     "base-64": "^1.0.0",
     "cookie-parser": "^1.4.3",
     "dotenv": "^16.0.0",