@opengovsg/mockpass 4.6.0 → 4.6.1

package/README.md

@@ -34,7 +34,7 @@ Limitations:
 - `client_id` and `redirect_uri` can be set to anything.
 - Mockpass will not check if ephemeral keys, state, and nonce are reused.
 - Only Login is supported for now. Userinfo endpoint is not supported. 
-- Only `openid` is supported for the `scope` parameter.
+- Only `openid` `user.identity` `uinfin` is supported for the `scope` parameter.
 - Only `urn:singpass:authentication:loa:1` is supported for the `acr_values` parameter.
 
 ### Helper functions

package/lib/auth-code.js

@@ -18,10 +18,10 @@ const generateAuthCode = (
   return authCode
 }
 
-const generateAuthCodeForFapi = ({ profile, clientId = '' }) => {
+const generateAuthCodeForFapi = ({ profile, clientId = '', authRequest }) => {
   const authCode = crypto.randomBytes(45).toString('base64url')
 
-  profileAndNonceStore.set(authCode, { profile, clientId })
+  profileAndNonceStore.set(authCode, { profile, clientId, authRequest })
   return authCode
 }
 

package/lib/express/fapi/fapi.service.js

@@ -42,27 +42,28 @@ class FapiService {
       dpopJkt,
     }
 
-    this.map.set(req.body.client_id, object)
+    this.map.set(request_uri, object)
 
     return request_uri
   }
 
   async handleAuthorizationRequest(req) {
-    const authRequest = this.map.get(req.query.client_id)
+    const authRequest = this.map.get(req.query.request_uri)
     if (!authRequest) throw new Error('No PAR request found in session')
     verifyAuthRequestBody(req, authRequest)
     return authRequest
   }
 
   async handleTokenRequest(req) {
-    //Due to Mockpass limitations, we are using clientid for session management.
-    const client_id = await verifyClientAssertion(req)
-    const authRequest = this.map.get(client_id)
-    if (!authRequest) throw new Error('No auth request found in session')
-
+    const authCodeSession = lookUpByAuthCode(req.body.code, {
+      isStateless: false,
+    })
+    if (!authCodeSession) throw new Error('No auth request found in session')
+    const { authRequest } = authCodeSession
     verifyTokenRequestBody(req, authRequest)
     const tokenEndpoint =
       FapiUtils.getFapiOpenIdConfiguration(req).token_endpoint
+    await verifyClientAssertion(req)
     await verifyDpop(req.headers['dpop'], authRequest.dpopJkt, tokenEndpoint)
     return await this.generateIdToken(req, authRequest)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengovsg/mockpass",
-  "version": "4.6.0",
+  "version": "4.6.1",
   "description": "A mock SingPass/CorpPass server for dev purposes",
   "main": "app.js",
   "bin": {