@opengovsg/mockpass 4.0.6 → 4.0.8

package/lib/express/myinfo/controllers.js

@@ -5,7 +5,7 @@ const path = require('path')
 const express = require('express')
 const { pick, partition } = require('lodash')
 
-const jose = require('node-jose')
+const jose = require('jose')
 const jwt = require('jsonwebtoken')
 
 const assertions = require('../../assertions')
@@ -31,16 +31,27 @@ module.exports =
     }
 
     const encryptPersona = async (persona) => {
-      const signedPersona = jwt.sign(persona, MOCKPASS_PRIVATE_KEY, {
-        algorithm: 'RS256',
-      })
-      const serviceCertAsKey = await jose.JWK.asKey(serviceProvider.cert, 'pem')
-      const encryptedAndSignedPersona = await jose.JWE.createEncrypt(
-        { format: 'compact' },
-        serviceCertAsKey,
+      /*
+       * We sign and encrypt the persona. It's important to note that although a signature is
+       * usually derived from the payload hash and is thus much smaller than the payload itself,
+       * we're specifically contructeding a JWT, which contains the original payload.
+       *
+       * We then construct a JWE and provide two headers specifying the encryption algorithms used.
+       * You can read about them here: https://www.rfc-editor.org/rfc/inline-errata/rfc7518.html
+       *
+       * These values weren't picked arbitrarily; they were the defaults used by a library we
+       * formerly used: node-jose. We opted to continue using them for backwards compatibility.
+       */
+      const privateKey = await jose.importPKCS8(MOCKPASS_PRIVATE_KEY.toString())
+      const sign = await new jose.SignJWT(persona)
+        .setProtectedHeader({ alg: 'RS256' })
+        .sign(privateKey)
+      const publicKey = await jose.importX509(serviceProvider.cert.toString())
+      const encryptedAndSignedPersona = await new jose.CompactEncrypt(
+        Buffer.from(sign),
       )
-        .update(JSON.stringify(signedPersona))
-        .final()
+        .setProtectedHeader({ alg: 'RSA-OAEP', enc: 'A128CBC-HS256' })
+        .encrypt(publicKey)
       return encryptedAndSignedPersona
     }
 
@@ -142,7 +153,6 @@ module.exports =
               redirect_uri,
             })
           : {}
-
         if (!tokenTemplate) {
           res.status(400).send({
             code: 400,

package/lib/express/oidc/v2-ndi.js

@@ -49,22 +49,40 @@ function config(app, { showLoginPage }) {
       } = req.query
 
       if (scope !== 'openid') {
-        return res.status(400).send(`Unknown scope ${scope}`)
+        return res.status(400).send({
+          error: 'invalid_scope',
+          error_description: `Unknown scope ${scope}`,
+        })
       }
       if (response_type !== 'code') {
-        return res.status(400).send(`Unknown response_type ${response_type}`)
+        return res.status(400).send({
+          error: 'unsupported_response_type',
+          error_description: `Unknown response_type ${response_type}`,
+        })
       }
       if (!client_id) {
-        return res.status(400).send('Missing client_id')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing client_id',
+        })
       }
       if (!redirectURI) {
-        return res.status(400).send('Missing redirect_uri')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing redirect_uri',
+        })
       }
       if (!nonce) {
-        return res.status(400).send('Missing nonce')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing nonce',
+        })
       }
       if (!state) {
-        return res.status(400).send('Missing state')
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description: 'Missing state',
+        })
       }
 
       // Identical to OIDC v1
@@ -128,27 +146,43 @@ function config(app, { showLoginPage }) {
 
         // Only SP requires client_id
         if (idp === 'singPass' && !client_id) {
-          return res.status(400).send('Missing client_id')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing client_id',
+          })
         }
         if (!redirectURI) {
-          return res.status(400).send('Missing redirect_uri')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing redirect_uri',
+          })
         }
         if (grant_type !== 'authorization_code') {
-          return res.status(400).send(`Unknown grant_type ${grant_type}`)
+          return res.status(400).send({
+            error: 'unsupported_grant_type',
+            error_description: `Unknown grant_type ${grant_type}`,
+          })
         }
         if (!authCode) {
-          return res.status(400).send('Missing code')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing code',
+          })
         }
         if (
           client_assertion_type !==
           'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
         ) {
-          return res
-            .status(400)
-            .send(`Unknown client_assertion_type ${client_assertion_type}`)
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: `Unknown client_assertion_type ${client_assertion_type}`,
+          })
         }
         if (!clientAssertion) {
-          return res.status(400).send('Missing client_assertion')
+          return res.status(400).send({
+            error: 'invalid_request',
+            error_description: 'Missing client_assertion',
+          })
         }
 
         // Step 0: Get the RP keyset
@@ -165,11 +199,10 @@ function config(app, { showLoginPage }) {
               method: 'GET',
             }).then((response) => response.text())
           } catch (e) {
-            return res
-              .status(400)
-              .send(
-                `Failed to fetch RP JWKS from specified endpoint: ${e.message}`,
-              )
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: `Failed to fetch RP JWKS from specified endpoint: ${e.message}`,
+            })
           }
         } else {
           // If the endpoint is not defined, default to the sample keyset we provided.
@@ -180,7 +213,10 @@ function config(app, { showLoginPage }) {
         try {
           rpKeysetJson = JSON.parse(rpKeysetString)
         } catch (e) {
-          return res.status(400).send(`Unable to parse RP keyset: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to parse RP keyset: ${e.message}`,
+          })
         }
 
         const rpKeyset = await jose.JWK.asKeyStore(rpKeysetJson)
@@ -192,33 +228,37 @@ function config(app, { showLoginPage }) {
             rpKeyset,
           ).verify(clientAssertion)
         } catch (e) {
-          return res
-            .status(400)
-            .send(`Unable to verify client_assertion: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to verify client_assertion: ${e.message}`,
+          })
         }
 
         let clientAssertionClaims
         try {
           clientAssertionClaims = JSON.parse(clientAssertionVerified.payload)
         } catch (e) {
-          return res
-            .status(400)
-            .send(`Unable to parse client_assertion: ${e.message}`)
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: `Unable to parse client_assertion: ${e.message}`,
+          })
         }
 
         if (idp === 'singPass') {
           if (clientAssertionClaims['sub'] !== client_id) {
-            return res
-              .status(400)
-              .send('Incorrect sub in client_assertion claims')
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: 'Incorrect sub in client_assertion claims',
+            })
           }
         } else {
           // Since client_id is not given for corpPass, sub claim is required in
           // order to get aud for id_token.
           if (!clientAssertionClaims['sub']) {
-            return res
-              .status(400)
-              .send('Missing sub in client_assertion claims')
+            return res.status(400).send({
+              error: 'invalid_client',
+              error_description: 'Missing sub in client_assertion claims',
+            })
           }
         }
 
@@ -228,9 +268,10 @@ function config(app, { showLoginPage }) {
         )}/${idp.toLowerCase()}/v2`
 
         if (clientAssertionClaims['aud'] !== iss) {
-          return res
-            .status(400)
-            .send('Incorrect aud in client_assertion claims')
+          return res.status(400).send({
+            error: 'invalid_client',
+            error_description: 'Incorrect aud in client_assertion claims',
+          })
         }
 
         // Step 1: Obtain profile for which the auth code requested data for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/mockpass",
-  "version": "4.0.6",
+  "version": "4.0.8",
   "description": "A mock SingPass/CorpPass server for dev purposes",
   "main": "index.js",
   "bin": {
@@ -41,6 +41,7 @@
     "dotenv": "^16.0.0",
     "expiry-map": "^2.0.0",
     "express": "^4.16.3",
+    "jose": "^4.14.4",
     "jsonwebtoken": "^9.0.0",
     "lodash": "^4.17.11",
     "morgan": "^1.9.1",
@@ -60,7 +61,7 @@
     "eslint-plugin-prettier": "^4.0.0",
     "husky": "^8.0.1",
     "lint-staged": "^13.0.3",
-    "nodemon": "^2.0.4",
+    "nodemon": "^3.0.1",
     "pinst": "^3.0.0",
     "prettier": "^2.0.5"
   },