@opengovsg/mockpass 4.5.0 → 4.5.2

package/.github/workflows/publish.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v3
@@ -15,10 +17,10 @@ jobs:
           cache: 'npm'
           cache-dependency-path: '**/package-lock.json'
           registry-url: https://registry.npmjs.org/
+      - name: Update npm
+        run: npm install -g npm@latest # Get the latest npm for OIDC support
       - run: npm ci
       - run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
   publish-docker:
     runs-on: ubuntu-latest
     steps:

package/README.md

@@ -21,7 +21,7 @@ Configure your application to point to the following endpoints:
 
 - http://localhost:5156/singpass/v2/.well-known/openid-configuration
 - http://localhost:5156/singpass/v2/.well-known/keys
-- http://localhost:5156/singpass/v2/authorize
+- http://localhost:5156/singpass/v2/auth
 - http://localhost:5156/singpass/v2/token
 
 Configure your application (or MockPass) with keys:
@@ -45,7 +45,7 @@ Configure your application to point to the following endpoints:
 
 - http://localhost:5156/corppass/v2/.well-known/openid-configuration
 - http://localhost:5156/corppass/v2/.well-known/keys
-- http://localhost:5156/corppass/v2/authorize
+- http://localhost:5156/corppass/v2/auth
 - http://localhost:5156/corppass/v2/token
 
 Configure your application (or MockPass) with keys:

package/lib/assertions.js

@@ -70,6 +70,7 @@ const oidc = {
     ...Object.keys(myinfo.v3.personas).map((nric) => ({
       nric,
       uuid: myinfo.v3.personas[nric].uuid.value,
+      claims: myinfo.v3.personas[nric],
     })),
   ],
   corpPass: [

package/lib/express/oidc/v2-ndi.js

@@ -157,7 +157,7 @@ function config(app, { showLoginPage, isStateless }) {
     const defaultProfile =
       profiles.find((p) => p.nric === process.env.MOCKPASS_NRIC) || profiles[0]
 
-    app.get(`/${idp.toLowerCase()}/v2/authorize`, (req, res) => {
+    app.get(`/${idp.toLowerCase()}/v2/auth`, (req, res) => {
       const {
         scope: scopes,
         response_type,
@@ -227,7 +227,7 @@ function config(app, { showLoginPage, isStateless }) {
         const response = render(LOGIN_TEMPLATE, {
           values,
           customProfileConfig: {
-            endpoint: `/${idp.toLowerCase()}/v2/authorize/custom-profile`,
+            endpoint: `/${idp.toLowerCase()}/v2/auth/custom-profile`,
             showUuid: true,
             showUen: idp === 'corpPass',
             redirectURI,
@@ -250,7 +250,7 @@ function config(app, { showLoginPage, isStateless }) {
       }
     })
 
-    app.get(`/${idp.toLowerCase()}/v2/authorize/custom-profile`, (req, res) => {
+    app.get(`/${idp.toLowerCase()}/v2/auth/custom-profile`, (req, res) => {
       const { nric, uuid, uen, redirectURI, state, nonce } = req.query
 
       const profile = { nric, uuid }
@@ -423,14 +423,9 @@ function config(app, { showLoginPage, isStateless }) {
           redirect_uri: redirectURI,
         })
 
-        const { idTokenClaims } = await assertions.oidc.create[idp](
-          profile,
-          iss,
-          aud,
-          nonce,
-        )
-
-        const accessToken = authCode
+        const { idTokenClaims, accessToken } = await assertions.oidc.create[
+          idp
+        ](profile, iss, aud, nonce, authCode)
 
         // Step 3: Sign ID token with ASP signing key
         const aspKeyset = JSON.parse(aspSecret)
@@ -517,7 +512,7 @@ function config(app, { showLoginPage, isStateless }) {
         // Note: does not support backchannel auth
         const data = {
           issuer: baseUrl,
-          authorization_endpoint: `${baseUrl}/authorize`,
+          authorization_endpoint: `${baseUrl}/auth`,
           jwks_uri: `${baseUrl}/.well-known/keys`,
           response_types_supported: ['code'],
           scopes_supported: ['openid'],
@@ -551,6 +546,9 @@ function config(app, { showLoginPage, isStateless }) {
             ...data['scopes_supported'],
             'uinfin',
             'name',
+            'email',
+            'mobileno',
+            'regadd',
           ]
           data['userinfo_endpoint'] = `${baseUrl}/userinfo`
           data['userinfo_signing_alg_values_supported'] = ['ES256']
@@ -573,16 +571,27 @@ function config(app, { showLoginPage, isStateless }) {
 
       const authCode = extractBearerTokenFromHeader(headers, res)
 
-      const { profile, scopes, clientId } = lookUpByAuthCode(authCode, {
+      const found = lookUpByAuthCode(authCode, {
         isStateless,
       })
 
+      if (!found || !found.scopes) {
+        return res.status(400).send({
+          error: 'invalid_request',
+          error_description:
+            'Myinfo profile has yet to be provisioned for the user',
+        })
+      }
+
+      const {
+        profile: { uuid },
+        scopes,
+        clientId,
+      } = found
       const scopesArr = scopes.split(' ')
       console.log('userinfo scopes: ', scopesArr)
 
-      const { uuid } = profile
-      const { nric } = assertions.oidc.singPass.find((p) => p.uuid === uuid)
-      const name = `USER ${nric}`
+      const profile = assertions.oidc.singPass.find((p) => p.uuid === uuid)
 
       const iss = `${protocol}://${host}/${idp.toLowerCase()}/v2`
       const aud = clientId
@@ -599,10 +608,14 @@ function config(app, { showLoginPage, isStateless }) {
         iat,
       }
 
-      const claimMap = { uinfin: nric, name }
+      const claimMap = profile.claims || {
+        uinfin: makeClaim(profile.nric),
+        name: makeClaim(`USER ${profile.nric}`),
+      }
+
       for (const [claim, value] of Object.entries(claimMap)) {
         if (scopesArr.includes(claim)) {
-          attachClaim(userinfoPayload, claim, value)
+          userinfoPayload[claim] = value
         }
       }
 
@@ -647,7 +660,7 @@ function config(app, { showLoginPage, isStateless }) {
         alg: rpEncryptionKey.alg,
         typ: 'JWT',
         kid: rpEncryptionKey.kid,
-        enc: 'A256CBC-HS512',
+        enc: 'A256GCM',
         cty: 'JWT',
       }
 
@@ -739,13 +752,11 @@ const extractBearerTokenFromHeader = (headers, res) => {
   return tokenParts[1]
 }
 
-const attachClaim = (payload, key, value) => {
-  payload[key] = {
-    lastupdated: '2023-03-23',
-    source: '1',
-    classification: 'C',
-    value,
-  }
-}
+const makeClaim = (value) => ({
+  lastupdated: '2023-03-23',
+  source: '1',
+  classification: 'C',
+  value,
+})
 
 module.exports = config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/mockpass",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "description": "A mock SingPass/CorpPass server for dev purposes",
   "main": "app.js",
   "bin": {