@opengovsg/mockpass 4.0.5 → 4.0.7

package/lib/express/oidc/v2-ndi.js

@@ -49,22 +49,40 @@ function config(app, { showLoginPage }) {
       } = req.query
 
       if (scope !== 'openid') {
-        return res.status(400).send(`Unknown scope ${scope}`)
+        return res.status(400).send({
+          error: 'invalid_scope',
+          error_description: `Unknown scope ${scope}`,
+        })
       }
       if (response_type !== 'code') {
-        return res.status(400).send(`Unknown response_type ${response_type}`)
+        return res.status(400).send({
+          error: 'unsupported_response_type',
+          error_description: `Unknown response_type ${response_type}`,
+        })
       }
       if (!client_id) {
-        return res.status(400).send('Missing client_id')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing client_id',
+        })
       }
       if (!redirectURI) {
-        return res.status(400).send('Missing redirect_uri')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing redirect_uri',
+        })
       }
       if (!nonce) {
-        return res.status(400).send('Missing nonce')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing nonce',
+        })
       }
       if (!state) {
-        return res.status(400).send('Missing state')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing state',
+        })
       }
 
       // Identical to OIDC v1
@@ -128,27 +146,43 @@ function config(app, { showLoginPage }) {
 
         // Only SP requires client_id
         if (idp === 'singPass' && !client_id) {
-          return res.status(400).send('Missing client_id')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing client_id',
+          })
         }
         if (!redirectURI) {
-          return res.status(400).send('Missing redirect_uri')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing redirect_uri',
+          })
         }
         if (grant_type !== 'authorization_code') {
-          return res.status(400).send(`Unknown grant_type ${grant_type}`)
+          return res.status(400).send({
+            error: 'unsupported_grant_type',
+            error_description: `Unknown grant_type ${grant_type}`,
+          })
         }
         if (!authCode) {
-          return res.status(400).send('Missing code')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing code',
+          })
         }
         if (
           client_assertion_type !==
           'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
         ) {
-          return res
-            .status(400)
-            .send(`Unknown client_assertion_type ${client_assertion_type}`)
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: `Unknown client_assertion_type ${client_assertion_type}`,
+          })
         }
         if (!clientAssertion) {
-          return res.status(400).send('Missing client_assertion')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing client_assertion',
+          })
         }
 
         // Step 0: Get the RP keyset
@@ -165,11 +199,10 @@ function config(app, { showLoginPage }) {
               method: 'GET',
             }).then((response) => response.text())
           } catch (e) {
-            return res
-              .status(400)
-              .send(
-                `Failed to fetch RP JWKS from specified endpoint: ${e.message}`,
-              )
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: `Failed to fetch RP JWKS from specified endpoint: ${e.message}`,
+            })
           }
         } else {
           // If the endpoint is not defined, default to the sample keyset we provided.
@@ -180,7 +213,10 @@ function config(app, { showLoginPage }) {
         try {
           rpKeysetJson = JSON.parse(rpKeysetString)
         } catch (e) {
-          return res.status(400).send(`Unable to parse RP keyset: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to parse RP keyset: ${e.message}`,
+          })
         }
 
         const rpKeyset = await jose.JWK.asKeyStore(rpKeysetJson)
@@ -192,33 +228,37 @@ function config(app, { showLoginPage }) {
             rpKeyset,
           ).verify(clientAssertion)
         } catch (e) {
-          return res
-            .status(400)
-            .send(`Unable to verify client_assertion: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to verify client_assertion: ${e.message}`,
+          })
         }
 
         let clientAssertionClaims
         try {
           clientAssertionClaims = JSON.parse(clientAssertionVerified.payload)
         } catch (e) {
-          return res
-            .status(400)
-            .send(`Unable to parse client_assertion: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to parse client_assertion: ${e.message}`,
+          })
         }
 
         if (idp === 'singPass') {
           if (clientAssertionClaims['sub'] !== client_id) {
-            return res
-              .status(400)
-              .send('Incorrect sub in client_assertion claims')
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: 'Incorrect sub in client_assertion claims',
+            })
           }
         } else {
           // Since client_id is not given for corpPass, sub claim is required in
           // order to get aud for id_token.
           if (!clientAssertionClaims['sub']) {
-            return res
-              .status(400)
-              .send('Missing sub in client_assertion claims')
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: 'Missing sub in client_assertion claims',
+            })
           }
         }
 
@@ -228,9 +268,10 @@ function config(app, { showLoginPage }) {
         )}/${idp.toLowerCase()}/v2`
 
         if (clientAssertionClaims['aud'] !== iss) {
-          return res
-            .status(400)
-            .send('Incorrect aud in client_assertion claims')
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: 'Incorrect aud in client_assertion claims',
+          })
         }
 
         // Step 1: Obtain profile for which the auth code requested data for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/mockpass",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "description": "A mock SingPass/CorpPass server for dev purposes",
   "main": "index.js",
   "bin": {
@@ -60,7 +60,7 @@
     "eslint-plugin-prettier": "^4.0.0",
     "husky": "^8.0.1",
     "lint-staged": "^13.0.3",
-    "nodemon": "^2.0.4",
+    "nodemon": "^3.0.1",
     "pinst": "^3.0.0",
     "prettier": "^2.0.5"
   },

package/public/mockpass/resources/js/login-common.js

@@ -398,7 +398,7 @@ function redirectID() {
     const optionsList = document.getElementById("id-datalist");
     let optionsMap = new Map();
     for (let i=0; i<optionsList.options.length; i++) {
-        optionsMap.set(optionsList.options[i].value, optionsList.options[i].dataset.assertURL);
+        optionsMap.set(optionsList.options[i].value, optionsList.options[i].dataset.asserturl);
     }
     if (optionsMap.has(idInput.value)) {
         const assertURL = optionsMap.get(idInput.value);

package/static/html/login-page.html

@@ -169,7 +169,7 @@
                                                                 <input id="id-input" list="id-datalist" class="btn btn-secondary dropdown-toggle" oninput="redirectID()" placeholder= "Select Username" style="width: 100%; border: 2px solid #ccc; border-radius: 5px; background: white; color: rgb(42, 45, 51); text-align: left;">
                                                                 <datalist class="dropdown-menu" id="id-datalist" aria-labelledby="id-input" >
                                                                     {{#values}}
-                                                                        <option value="{{ id }}" data-assertURL="{{ assertURL }}">{{ id }}</option>
+                                                                        <option value="{{ id }}" data-asserturl="{{ assertURL }}">{{ id }}</option>
                                                                     {{/values}}
                                                                 </datalist>
                                                             </div>