@taico/taico 0.5.1 → 0.6.0

package/dist/authorization-server/client-assertion.service.js

@@ -0,0 +1,136 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ClientAssertionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAssertionService = void 0;
+const common_1 = require("@nestjs/common");
+const jose_1 = require("jose");
+const token_errors_1 = require("./errors/token.errors");
+const client_metadata_document_fetcher_1 = require("./client-metadata-document.fetcher");
+const cache_control_1 = require("./utils/cache-control");
+const client_assertion_1 = require("./utils/client-assertion");
+const CLOCK_TOLERANCE_SECONDS = 30;
+const MAX_CACHED_KEY_SETS = 500;
+const MAX_KEY_SET_CACHE_SECONDS = 60 * 60;
+let ClientAssertionService = ClientAssertionService_1 = class ClientAssertionService {
+    fetcher;
+    logger = new common_1.Logger(ClientAssertionService_1.name);
+    keySets = new Map();
+    constructor(fetcher) {
+        this.fetcher = fetcher;
+    }
+    async authenticate(client, request, audiences) {
+        const reject = (reason) => {
+            this.logger.warn(`Client assertion refused for ${client.clientId}: ${reason}`);
+            throw new token_errors_1.InvalidClientAssertionError(reason);
+        };
+        if (!request.client_assertion) {
+            reject('this client must authenticate with a client_assertion');
+        }
+        if (request.client_assertion_type !== client_assertion_1.JWT_BEARER_CLIENT_ASSERTION_TYPE) {
+            reject(`client_assertion_type must be ${client_assertion_1.JWT_BEARER_CLIENT_ASSERTION_TYPE}`);
+        }
+        const assertion = request.client_assertion;
+        const verify = async (keys) => (0, jose_1.jwtVerify)(assertion, (0, jose_1.createLocalJWKSet)(keys), {
+            issuer: client.clientId,
+            subject: client.clientId,
+            audience: audiences,
+            algorithms: client.tokenEndpointAuthSigningAlg
+                ? [client.tokenEndpointAuthSigningAlg]
+                : client_assertion_1.CLIENT_ASSERTION_SIGNING_ALGORITHMS,
+            requiredClaims: ['exp'],
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+        });
+        try {
+            try {
+                await verify(await this.keysOf(client, false));
+            }
+            catch (error) {
+                if (!(error instanceof jose_1.errors.JWKSNoMatchingKey) ||
+                    !this.mayRefetch(client)) {
+                    throw error;
+                }
+                await verify(await this.keysOf(client, true));
+            }
+        }
+        catch (error) {
+            if (error instanceof token_errors_1.InvalidClientAssertionError) {
+                throw error;
+            }
+            if (error instanceof client_metadata_document_fetcher_1.ClientMetadataFetchError) {
+                return reject(`the client's keys could not be fetched: ${error.message}`);
+            }
+            if (error instanceof jose_1.errors.JWTClaimValidationFailed) {
+                this.logger.warn(`Assertion "${error.claim}" was ${JSON.stringify(error.payload?.[error.claim])}, accepted audiences: ${audiences.join(', ')}`);
+            }
+            if (error instanceof jose_1.errors.JOSEError) {
+                return reject(describe(error));
+            }
+            throw error;
+        }
+    }
+    mayRefetch(client) {
+        const cached = client.jwksUri ? this.keySets.get(client.jwksUri) : null;
+        return (!!cached &&
+            Date.now() - cached.fetchedAt >= this.fetcher.minKeySetRefetchIntervalMs);
+    }
+    async keysOf(client, refetch) {
+        if (client.jwks) {
+            return client.jwks;
+        }
+        if (!client.jwksUri) {
+            throw new token_errors_1.InvalidClientAssertionError('the client has published no keys');
+        }
+        const cached = this.keySets.get(client.jwksUri);
+        if (cached && !refetch && cached.expiresAt > Date.now()) {
+            return cached.keys;
+        }
+        const fetched = await this.fetcher.fetchKeySet(new URL(client.jwksUri));
+        const keys = (0, client_assertion_1.parsePublicJwks)(fetched.body, (reason) => {
+            throw new token_errors_1.InvalidClientAssertionError(`the client's key set is invalid: ${reason}`);
+        });
+        if (this.keySets.size >= MAX_CACHED_KEY_SETS) {
+            this.keySets.clear();
+        }
+        this.keySets.set(client.jwksUri, {
+            keys,
+            fetchedAt: Date.now(),
+            expiresAt: Date.now() +
+                Math.min((0, cache_control_1.cacheSeconds)(fetched.cacheControl), MAX_KEY_SET_CACHE_SECONDS) *
+                    1000,
+        });
+        return keys;
+    }
+};
+exports.ClientAssertionService = ClientAssertionService;
+exports.ClientAssertionService = ClientAssertionService = ClientAssertionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [client_metadata_document_fetcher_1.ClientMetadataDocumentFetcher])
+], ClientAssertionService);
+function describe(error) {
+    if (error instanceof jose_1.errors.JWTExpired) {
+        return 'the assertion has expired';
+    }
+    if (error instanceof jose_1.errors.JWTClaimValidationFailed) {
+        return `the assertion's "${error.claim}" claim is not acceptable`;
+    }
+    if (error instanceof jose_1.errors.JWKSNoMatchingKey) {
+        return "the assertion is not signed with one of the client's keys";
+    }
+    if (error instanceof jose_1.errors.JWSSignatureVerificationFailed) {
+        return 'the assertion signature is invalid';
+    }
+    if (error instanceof jose_1.errors.JOSEAlgNotAllowed) {
+        return 'the assertion is signed with an algorithm that is not allowed';
+    }
+    return 'the assertion is not a valid signed JWT';
+}
+//# sourceMappingURL=client-assertion.service.js.map

package/dist/authorization-server/client-assertion.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-assertion.service.js","sourceRoot":"","sources":["../../src/authorization-server/client-assertion.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,+BAA2E;AAE3E,wDAAoE;AACpE,yFAG4C;AAC5C,yDAAqD;AACrD,+DAIkC;AAElC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAGhC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAqBnC,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IAKJ;IAJZ,MAAM,GAAG,IAAI,eAAM,CAAC,wBAAsB,CAAC,IAAI,CAAC,CAAC;IAEjD,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE3D,YAA6B,OAAsC;QAAtC,YAAO,GAAP,OAAO,CAA+B;IAAG,CAAC;IAOvE,KAAK,CAAC,YAAY,CAChB,MAA8B,EAC9B,OAAwB,EACxB,SAAmB;QAEnB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gCAAgC,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAC7D,CAAC;YACF,MAAM,IAAI,0CAA2B,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,MAAM,CAAC,uDAAuD,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,qBAAqB,KAAK,mDAAgC,EAAE,CAAC;YACvE,MAAM,CACJ,iCAAiC,mDAAgC,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAiB,CAAC;QAE5C,MAAM,MAAM,GAAG,KAAK,EAAE,IAAmB,EAAE,EAAE,CAC3C,IAAA,gBAAS,EAAC,SAAS,EAAE,IAAA,wBAAiB,EAAC,IAAI,CAAC,EAAE;YAE5C,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,OAAO,EAAE,MAAM,CAAC,QAAQ;YACxB,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,MAAM,CAAC,2BAA2B;gBAC5C,CAAC,CAAC,CAAC,MAAM,CAAC,2BAA2B,CAAC;gBACtC,CAAC,CAAC,sDAAmC;YACvC,cAAc,EAAE,CAAC,KAAK,CAAC;YACvB,cAAc,EAAE,uBAAuB;SACxC,CAAC,CAAC;QAEL,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAEf,IACE,CAAC,CAAC,KAAK,YAAY,aAAM,CAAC,iBAAiB,CAAC;oBAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EACxB,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,0CAA2B,EAAE,CAAC;gBACjD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,2DAAwB,EAAE,CAAC;gBAC9C,OAAO,MAAM,CACX,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAC3D,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,YAAY,aAAM,CAAC,wBAAwB,EAAE,CAAC;gBAGrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,cAAc,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,yBAAyB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9H,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,YAAY,aAAM,CAAC,SAAS,EAAE,CAAC;gBACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAA8B;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO,CACL,CAAC,CAAC,MAAM;YACR,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,0BAA0B,CACzE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,MAA8B,EAC9B,OAAgB;QAEhB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAgC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,0CAA2B,CAAC,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,IAAA,kCAAe,EAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YACpD,MAAM,IAAI,0CAA2B,CACnC,oCAAoC,MAAM,EAAE,CAC7C,CAAC;QACJ,CAAC,CAA6B,CAAC;QAE/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE;YAC/B,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EACP,IAAI,CAAC,GAAG,EAAE;gBACV,IAAI,CAAC,GAAG,CACN,IAAA,4BAAY,EAAC,OAAO,CAAC,YAAY,CAAC,EAClC,yBAAyB,CAC1B;oBACC,IAAI;SACT,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlIY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAM2B,gEAA6B;GALxD,sBAAsB,CAkIlC;AAED,SAAS,QAAQ,CAAC,KAAuB;IACvC,IAAI,KAAK,YAAY,aAAM,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,2BAA2B,CAAC;IACrC,CAAC;IACD,IAAI,KAAK,YAAY,aAAM,CAAC,wBAAwB,EAAE,CAAC;QACrD,OAAO,oBAAoB,KAAK,CAAC,KAAK,2BAA2B,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,YAAY,aAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,2DAA2D,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,YAAY,aAAM,CAAC,8BAA8B,EAAE,CAAC;QAC3D,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,YAAY,aAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,+DAA+D,CAAC;IACzE,CAAC;IACD,OAAO,yCAAyC,CAAC;AACnD,CAAC"}

package/dist/authorization-server/client-id-metadata.service.d.ts

@@ -0,0 +1,17 @@
+import { Repository } from 'typeorm';
+import { RegisteredClientEntity } from './entities/registered-client.entity';
+import { ClientMetadataDocumentFetcher } from './client-metadata-document.fetcher';
+export declare class ClientIdMetadataService {
+    private readonly clientRepository;
+    private readonly fetcher;
+    private readonly logger;
+    constructor(clientRepository: Repository<RegisteredClientEntity>, fetcher: ClientMetadataDocumentFetcher);
+    isMetadataDocumentClientId(clientId: string): boolean;
+    resolveClient(clientId: string): Promise<RegisteredClientEntity>;
+    private findClient;
+    private parseClientIdUrl;
+    private parseDocument;
+    private parseAuthentication;
+    private parseJwksUri;
+    private parseStringArray;
+}

package/dist/authorization-server/client-id-metadata.service.js

@@ -0,0 +1,253 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ClientIdMetadataService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientIdMetadataService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const registered_client_entity_1 = require("./entities/registered-client.entity");
+const enums_1 = require("./enums");
+const client_registration_errors_1 = require("./errors/client-registration.errors");
+const client_metadata_document_fetcher_1 = require("./client-metadata-document.fetcher");
+const cache_control_1 = require("./utils/cache-control");
+const client_assertion_1 = require("./utils/client-assertion");
+const redirect_uri_1 = require("./utils/redirect-uri");
+const MAX_CLIENT_NAME_LENGTH = 200;
+const MAX_REDIRECT_URIS = 20;
+const MAX_CLIENT_ID_LENGTH = 2048;
+let ClientIdMetadataService = ClientIdMetadataService_1 = class ClientIdMetadataService {
+    clientRepository;
+    fetcher;
+    logger = new common_1.Logger(ClientIdMetadataService_1.name);
+    constructor(clientRepository, fetcher) {
+        this.clientRepository = clientRepository;
+        this.fetcher = fetcher;
+    }
+    isMetadataDocumentClientId(clientId) {
+        return (clientId.startsWith('https://') ||
+            (this.fetcher.allowsInsecureLoopback && clientId.startsWith('http://')));
+    }
+    async resolveClient(clientId) {
+        const url = this.parseClientIdUrl(clientId);
+        const cached = await this.findClient(clientId);
+        if (cached?.metadataExpiresAt && cached.metadataExpiresAt > new Date()) {
+            return cached;
+        }
+        let document;
+        try {
+            document = await this.fetcher.fetch(url);
+        }
+        catch (error) {
+            if (error instanceof client_metadata_document_fetcher_1.ClientMetadataFetchError) {
+                throw new client_registration_errors_1.InvalidClientMetadataError(clientId, error.message);
+            }
+            throw error;
+        }
+        const metadata = this.parseDocument(clientId, document.body);
+        const metadataExpiresAt = new Date(Date.now() + (0, cache_control_1.cacheSeconds)(document.cacheControl) * 1000);
+        const client = cached ??
+            this.clientRepository.create({
+                clientId,
+                clientSecret: null,
+                registrationMethod: enums_1.ClientRegistrationMethod.METADATA_DOCUMENT,
+                scopes: [],
+                contacts: null,
+            });
+        Object.assign(client, metadata, { metadataExpiresAt });
+        try {
+            return await this.clientRepository.save(client);
+        }
+        catch (error) {
+            const winner = await this.findClient(clientId);
+            if (winner) {
+                return winner;
+            }
+            throw error;
+        }
+    }
+    findClient(clientId) {
+        return this.clientRepository.findOne({
+            where: {
+                clientId,
+                registrationMethod: enums_1.ClientRegistrationMethod.METADATA_DOCUMENT,
+            },
+        });
+    }
+    parseClientIdUrl(clientId) {
+        const reject = (reason) => {
+            throw new client_registration_errors_1.InvalidClientMetadataError(clientId, reason);
+        };
+        if (clientId.length > MAX_CLIENT_ID_LENGTH) {
+            reject('the client_id URL is too long');
+        }
+        let url;
+        try {
+            url = new URL(clientId);
+        }
+        catch {
+            return reject('the client_id is not a valid URL');
+        }
+        if (url.protocol !== 'https:' &&
+            !(this.fetcher.allowsInsecureLoopback && url.protocol === 'http:')) {
+            reject('the client_id URL must use https');
+        }
+        if (url.username || url.password) {
+            reject('the client_id URL must not contain credentials');
+        }
+        if (clientId.includes('#')) {
+            reject('the client_id URL must not contain a fragment');
+        }
+        if (url.pathname === '/' || url.pathname === '') {
+            reject('the client_id URL must contain a path');
+        }
+        const rawPath = clientId.split(/[?#]/)[0];
+        if (/\/(\.|%2e){1,2}(\/|$)/i.test(rawPath)) {
+            reject('the client_id URL must not contain dot segments');
+        }
+        return url;
+    }
+    parseDocument(clientId, body) {
+        const reject = (reason) => {
+            throw new client_registration_errors_1.InvalidClientMetadataError(clientId, reason);
+        };
+        if (typeof body !== 'object' || body === null || Array.isArray(body)) {
+            return reject('the document is not a JSON object');
+        }
+        const document = body;
+        if (document.client_id !== clientId) {
+            reject('its client_id does not match the URL it was fetched from');
+        }
+        if ('client_secret' in document || 'client_secret_expires_at' in document) {
+            reject('it must not contain a client secret');
+        }
+        const authentication = this.parseAuthentication(clientId, document);
+        const clientName = typeof document.client_name === 'string'
+            ?
+                document.client_name.replace(/[\u0000-\u001f\u007f]/g, ' ').trim()
+            : '';
+        if (!clientName) {
+            reject('client_name is required');
+        }
+        const redirectUris = document.redirect_uris;
+        if (!Array.isArray(redirectUris) ||
+            redirectUris.length === 0 ||
+            !redirectUris.every((uri) => typeof uri === 'string')) {
+            return reject('redirect_uris must be a non-empty array of strings');
+        }
+        if (redirectUris.length > MAX_REDIRECT_URIS) {
+            reject(`redirect_uris has more than ${MAX_REDIRECT_URIS} entries`);
+        }
+        for (const uri of redirectUris) {
+            if (!(0, redirect_uri_1.isAcceptableRedirectUri)(uri)) {
+                reject(`redirect URI ${JSON.stringify(uri)} must be https, http on localhost, or an app scheme, without a fragment`);
+            }
+            if (uri.includes(',')) {
+                reject(`redirect URI ${JSON.stringify(uri)} must not contain a comma`);
+            }
+        }
+        const grantTypes = this.parseStringArray(clientId, document, 'grant_types') ?? [enums_1.GrantType.AUTHORIZATION_CODE];
+        if (!grantTypes.includes(enums_1.GrantType.AUTHORIZATION_CODE)) {
+            reject('grant_types must include authorization_code');
+        }
+        const responseTypes = this.parseStringArray(clientId, document, 'response_types');
+        if (responseTypes && !responseTypes.includes('code')) {
+            reject('response_types must include code');
+        }
+        return {
+            clientName: clientName.slice(0, MAX_CLIENT_NAME_LENGTH),
+            redirectUris,
+            grantTypes: Object.values(enums_1.GrantType).filter((grantType) => grantTypes.includes(grantType)),
+            ...authentication,
+        };
+    }
+    parseAuthentication(clientId, document) {
+        const reject = (reason) => {
+            throw new client_registration_errors_1.InvalidClientMetadataError(clientId, reason);
+        };
+        const authMethod = document.token_endpoint_auth_method ?? enums_1.TokenEndpointAuthMethod.NONE;
+        if (authMethod === enums_1.TokenEndpointAuthMethod.NONE) {
+            return {
+                tokenEndpointAuthMethod: enums_1.TokenEndpointAuthMethod.NONE,
+                jwksUri: null,
+                jwks: null,
+                tokenEndpointAuthSigningAlg: null,
+            };
+        }
+        if (authMethod !== enums_1.TokenEndpointAuthMethod.PRIVATE_KEY_JWT) {
+            return reject(`token_endpoint_auth_method must be "none" or "private_key_jwt", got ${JSON.stringify(authMethod)}`);
+        }
+        const signingAlg = document.token_endpoint_auth_signing_alg;
+        if (signingAlg !== undefined &&
+            (typeof signingAlg !== 'string' ||
+                !client_assertion_1.CLIENT_ASSERTION_SIGNING_ALGORITHMS.includes(signingAlg))) {
+            reject(`token_endpoint_auth_signing_alg ${JSON.stringify(signingAlg)} is not supported`);
+        }
+        const hasJwksUri = document.jwks_uri !== undefined;
+        const hasJwks = document.jwks !== undefined;
+        if (hasJwksUri === hasJwks) {
+            reject('private_key_jwt needs exactly one of jwks_uri and jwks');
+        }
+        return {
+            tokenEndpointAuthMethod: enums_1.TokenEndpointAuthMethod.PRIVATE_KEY_JWT,
+            jwksUri: hasJwksUri
+                ? this.parseJwksUri(clientId, document.jwks_uri)
+                : null,
+            jwks: hasJwks ? (0, client_assertion_1.parsePublicJwks)(document.jwks, reject) : null,
+            tokenEndpointAuthSigningAlg: signingAlg ?? null,
+        };
+    }
+    parseJwksUri(clientId, jwksUri) {
+        const reject = (reason) => {
+            throw new client_registration_errors_1.InvalidClientMetadataError(clientId, reason);
+        };
+        if (typeof jwksUri !== 'string' || jwksUri.length > MAX_CLIENT_ID_LENGTH) {
+            return reject('jwks_uri must be a URL');
+        }
+        let url;
+        try {
+            url = new URL(jwksUri);
+        }
+        catch {
+            return reject('jwks_uri must be a URL');
+        }
+        if (url.protocol !== 'https:' &&
+            !(this.fetcher.allowsInsecureLoopback && url.protocol === 'http:')) {
+            reject('jwks_uri must use https');
+        }
+        if (url.username || url.password) {
+            reject('jwks_uri must not contain credentials');
+        }
+        return jwksUri;
+    }
+    parseStringArray(clientId, document, field) {
+        const value = document[field];
+        if (value === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(value) ||
+            !value.every((item) => typeof item === 'string')) {
+            throw new client_registration_errors_1.InvalidClientMetadataError(clientId, `${field} must be an array of strings`);
+        }
+        return value;
+    }
+};
+exports.ClientIdMetadataService = ClientIdMetadataService;
+exports.ClientIdMetadataService = ClientIdMetadataService = ClientIdMetadataService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(registered_client_entity_1.RegisteredClientEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        client_metadata_document_fetcher_1.ClientMetadataDocumentFetcher])
+], ClientIdMetadataService);
+//# sourceMappingURL=client-id-metadata.service.js.map

package/dist/authorization-server/client-id-metadata.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-id-metadata.service.js","sourceRoot":"","sources":["../../src/authorization-server/client-id-metadata.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,kFAA6E;AAC7E,mCAIiB;AACjB,oFAAiF;AACjF,yFAG4C;AAC5C,yDAAqD;AACrD,+DAGkC;AAClC,uDAA+D;AAE/D,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAsB3B,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAKf;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAEmB,gBAAoD,EACpD,OAAsC;QADtC,qBAAgB,GAAhB,gBAAgB,CAAoC;QACpD,YAAO,GAAP,OAAO,CAA+B;IACtD,CAAC;IAGJ,0BAA0B,CAAC,QAAgB;QACzC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,QAAqE,CAAC;QAC1E,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2DAAwB,EAAE,CAAC;gBAC9C,MAAM,IAAI,uDAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAChC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,4BAAY,EAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CACxD,CAAC;QAEF,MAAM,MAAM,GACV,MAAM;YACN,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;gBAC3B,QAAQ;gBACR,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,gCAAwB,CAAC,iBAAiB;gBAC9D,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAGf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE;gBACL,QAAQ;gBACR,kBAAkB,EAAE,gCAAwB,CAAC,iBAAiB;aAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAGO,gBAAgB,CAAC,QAAgB;QACvC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,MAAM,IAAI,uDAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAC3C,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACpD,CAAC;QACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAClE,CAAC;YACD,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,gDAAgD,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAGO,aAAa,CAAC,QAAgB,EAAE,IAAa;QACnD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,MAAM,IAAI,uDAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,IAA+B,CAAC;QAGjD,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,eAAe,IAAI,QAAQ,IAAI,0BAA0B,IAAI,QAAQ,EAAE,CAAC;YAC1E,MAAM,CAAC,qCAAqC,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEpE,MAAM,UAAU,GACd,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC;gBACC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE;YACpE,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC5C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EACpE,CAAC;YACD,OAAO,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YAC5C,MAAM,CAAC,+BAA+B,iBAAiB,UAAU,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAA,sCAAuB,EAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,CACJ,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yEAAyE,CAC7G,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CACtC,QAAQ,EACR,QAAQ,EACR,aAAa,CACd,IAAI,CAAC,iBAAS,CAAC,kBAAkB,CAAC,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,iBAAS,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,6CAA6C,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CACzC,QAAQ,EACR,QAAQ,EACR,gBAAgB,CACjB,CAAC;QACF,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC;YACvD,YAAY;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAS,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACxD,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC/B;YACD,GAAG,cAAc;SAClB,CAAC;IACJ,CAAC;IAQO,mBAAmB,CACzB,QAAgB,EAChB,QAAiC;QAEjC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,MAAM,IAAI,uDAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,MAAM,UAAU,GACd,QAAQ,CAAC,0BAA0B,IAAI,+BAAuB,CAAC,IAAI,CAAC;QAEtE,IAAI,UAAU,KAAK,+BAAuB,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO;gBACL,uBAAuB,EAAE,+BAAuB,CAAC,IAAI;gBACrD,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI;gBACV,2BAA2B,EAAE,IAAI;aAClC,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,KAAK,+BAAuB,CAAC,eAAe,EAAE,CAAC;YAC3D,OAAO,MAAM,CACX,uEAAuE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACpG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,+BAA+B,CAAC;QAC5D,IACE,UAAU,KAAK,SAAS;YACxB,CAAC,OAAO,UAAU,KAAK,QAAQ;gBAC7B,CAAC,sDAAmC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,CACJ,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mBAAmB,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;QAC5C,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACnE,CAAC;QAED,OAAO;YACL,uBAAuB,EAAE,+BAAuB,CAAC,eAAe;YAChE,OAAO,EAAE,UAAU;gBACjB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAChD,CAAC,CAAC,IAAI;YACR,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,kCAAe,EAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,2BAA2B,EAAG,UAAiC,IAAI,IAAI;SACxE,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,QAAgB,EAAE,OAAgB;QACrD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,MAAM,IAAI,uDAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC;QACF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;YACzE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC1C,CAAC;QACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EAClE,CAAC;YACD,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,uCAAuC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,gBAAgB,CACtB,QAAgB,EAChB,QAAiC,EACjC,KAAa;QAEb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAChE,CAAC;YACD,MAAM,IAAI,uDAA0B,CAClC,QAAQ,EACR,GAAG,KAAK,8BAA8B,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AA3SY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,iDAAsB,CAAC,CAAA;qCACN,oBAAU;QACnB,gEAA6B;GAN9C,uBAAuB,CA2SnC"}

package/dist/authorization-server/client-metadata-document.fetcher.d.ts

@@ -0,0 +1,25 @@
+import { LookupAddress } from 'dns';
+export declare const CLIENT_METADATA_FETCH_OPTIONS: unique symbol;
+export type ClientMetadataFetchOptions = {
+    allowInsecureLoopback: boolean;
+    timeoutMs: number;
+    maxBytes: number;
+    maxKeySetBytes: number;
+    minKeySetRefetchIntervalMs: number;
+};
+export declare const DEFAULT_CLIENT_METADATA_FETCH_OPTIONS: ClientMetadataFetchOptions;
+export type FetchedClientMetadataDocument = {
+    body: unknown;
+    cacheControl: string | null;
+};
+export declare class ClientMetadataFetchError extends Error {
+}
+export declare class ClientMetadataDocumentFetcher {
+    private readonly options;
+    constructor(options: ClientMetadataFetchOptions);
+    get allowsInsecureLoopback(): boolean;
+    get minKeySetRefetchIntervalMs(): number;
+    fetchKeySet(url: URL): Promise<FetchedClientMetadataDocument>;
+    fetch(url: URL, maxBytes?: number): Promise<FetchedClientMetadataDocument>;
+}
+export declare function allowedAddressesOf(addresses: LookupAddress[], isAllowedAddress: (address: string) => boolean): LookupAddress[];

package/dist/authorization-server/client-metadata-document.fetcher.js

@@ -0,0 +1,176 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientMetadataDocumentFetcher = exports.ClientMetadataFetchError = exports.DEFAULT_CLIENT_METADATA_FETCH_OPTIONS = exports.CLIENT_METADATA_FETCH_OPTIONS = void 0;
+exports.allowedAddressesOf = allowedAddressesOf;
+const common_1 = require("@nestjs/common");
+const dns_1 = require("dns");
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const net_1 = require("net");
+const public_address_1 = require("./utils/public-address");
+exports.CLIENT_METADATA_FETCH_OPTIONS = Symbol('CLIENT_METADATA_FETCH_OPTIONS');
+exports.DEFAULT_CLIENT_METADATA_FETCH_OPTIONS = {
+    allowInsecureLoopback: false,
+    timeoutMs: 5000,
+    maxBytes: 5 * 1024,
+    maxKeySetBytes: 64 * 1024,
+    minKeySetRefetchIntervalMs: 60 * 1000,
+};
+class ClientMetadataFetchError extends Error {
+}
+exports.ClientMetadataFetchError = ClientMetadataFetchError;
+let ClientMetadataDocumentFetcher = class ClientMetadataDocumentFetcher {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    get allowsInsecureLoopback() {
+        return this.options.allowInsecureLoopback;
+    }
+    get minKeySetRefetchIntervalMs() {
+        return this.options.minKeySetRefetchIntervalMs;
+    }
+    fetchKeySet(url) {
+        return this.fetch(url, this.options.maxKeySetBytes);
+    }
+    async fetch(url, maxBytes = this.options.maxBytes) {
+        const { allowInsecureLoopback, timeoutMs } = this.options;
+        if (url.protocol !== 'https:' &&
+            !(allowInsecureLoopback && url.protocol === 'http:')) {
+            throw new ClientMetadataFetchError('the URL must use https');
+        }
+        const isAllowedAddress = (address) => url.protocol === 'https:'
+            ? (0, public_address_1.isPublicAddress)(address) ||
+                (allowInsecureLoopback && (0, public_address_1.isLoopbackAddress)(address))
+            : (0, public_address_1.isLoopbackAddress)(address);
+        const host = url.hostname.replace(/^\[|\]$/g, '');
+        if ((0, net_1.isIP)(host) && !isAllowedAddress(host)) {
+            throw new ClientMetadataFetchError('the URL resolves to a non-public address');
+        }
+        const transport = url.protocol === 'https:' ? https : http;
+        return new Promise((resolve, reject) => {
+            const fail = (reason) => reject(new ClientMetadataFetchError(reason));
+            const request = transport.request(url, {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+                agent: false,
+                lookup: restrictedLookup(isAllowedAddress),
+                signal: AbortSignal.timeout(timeoutMs),
+            }, (response) => {
+                if (response.statusCode !== 200) {
+                    response.destroy();
+                    return fail(`the URL responded with HTTP ${response.statusCode}`);
+                }
+                const contentType = response.headers['content-type'] ?? '';
+                if (!/json/i.test(contentType)) {
+                    response.destroy();
+                    return fail('the response is not JSON');
+                }
+                const chunks = [];
+                let received = 0;
+                response.on('data', (chunk) => {
+                    received += chunk.length;
+                    if (received > maxBytes) {
+                        response.destroy();
+                        return fail(`the document is larger than ${maxBytes} bytes`);
+                    }
+                    chunks.push(chunk);
+                });
+                response.on('error', () => fail('the response was interrupted'));
+                response.on('end', () => {
+                    try {
+                        const cacheControl = response.headers['cache-control'];
+                        resolve({
+                            body: JSON.parse(Buffer.concat(chunks).toString('utf8')),
+                            cacheControl: cacheControl ?? null,
+                        });
+                    }
+                    catch {
+                        fail('the response is not valid JSON');
+                    }
+                });
+            });
+            request.on('error', (error) => {
+                if (error instanceof ClientMetadataFetchError) {
+                    return reject(error);
+                }
+                fail(error.name === 'TimeoutError' || error.name === 'AbortError'
+                    ? 'the request timed out'
+                    : `the request failed (${error.code ?? error.name})`);
+            });
+            request.end();
+        });
+    }
+};
+exports.ClientMetadataDocumentFetcher = ClientMetadataDocumentFetcher;
+exports.ClientMetadataDocumentFetcher = ClientMetadataDocumentFetcher = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(exports.CLIENT_METADATA_FETCH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], ClientMetadataDocumentFetcher);
+function restrictedLookup(isAllowedAddress) {
+    return (hostname, options, callback) => {
+        (0, dns_1.lookup)(hostname, { ...options, all: true }, (error, addresses) => {
+            if (error) {
+                return callback(error, '', 0);
+            }
+            const allowed = allowedAddressesOf(addresses, isAllowedAddress);
+            if (allowed.length === 0) {
+                return callback(new ClientMetadataFetchError('the URL resolves to a non-public address'), '', 0);
+            }
+            if (options.all) {
+                return callback(null, allowed);
+            }
+            callback(null, allowed[0].address, allowed[0].family);
+        });
+    };
+}
+function allowedAddressesOf(addresses, isAllowedAddress) {
+    return addresses.filter(({ address }) => isAllowedAddress(address));
+}
+//# sourceMappingURL=client-metadata-document.fetcher.js.map

package/dist/authorization-server/client-metadata-document.fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-metadata-document.fetcher.js","sourceRoot":"","sources":["../../src/authorization-server/client-metadata-document.fetcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8MA,gDAKC;AAnND,2CAAoD;AACpD,6BAAyD;AACzD,2CAA6B;AAC7B,6CAA+B;AAC/B,6BAA2C;AAC3C,2DAA4E;AAE/D,QAAA,6BAA6B,GAAG,MAAM,CACjD,+BAA+B,CAChC,CAAC;AAsBW,QAAA,qCAAqC,GAChD;IACE,qBAAqB,EAAE,KAAK;IAC5B,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,CAAC,GAAG,IAAI;IAClB,cAAc,EAAE,EAAE,GAAG,IAAI;IACzB,0BAA0B,EAAE,EAAE,GAAG,IAAI;CACtC,CAAC;AAQJ,MAAa,wBAAyB,SAAQ,KAAK;CAAG;AAAtD,4DAAsD;AAS/C,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAGrB;IAFnB,YAEmB,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;IACnD,CAAC;IAEJ,IAAI,sBAAsB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC5C,CAAC;IAED,IAAI,0BAA0B;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACjD,CAAC;IAGD,WAAW,CAAC,GAAQ;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,GAAQ,EACR,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;QAEhC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1D,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,qBAAqB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QAC/D,CAAC;QAGD,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,EAAE,CAC3C,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACvB,CAAC,CAAC,IAAA,gCAAe,EAAC,OAAO,CAAC;gBACxB,CAAC,qBAAqB,IAAI,IAAA,kCAAiB,EAAC,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC,IAAA,kCAAiB,EAAC,OAAO,CAAC,CAAC;QAGjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,IAAA,UAAI,EAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAChC,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,MAAM,CAAC,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;YAE/C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAC/B,GAAG,EACH;gBACE,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAGvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gBAAgB,CAAC,gBAAgB,CAAC;gBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACvC,EACD,CAAC,QAAQ,EAAE,EAAE;gBACX,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;oBAChC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAEnB,OAAO,IAAI,CAAC,+BAA+B,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC1C,CAAC;gBAED,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACpC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;oBACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;wBACxB,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,IAAI,CAAC,+BAA+B,QAAQ,QAAQ,CAAC,CAAC;oBAC/D,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;gBACjE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;wBACvD,OAAO,CAAC;4BACN,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;4BACxD,YAAY,EAAE,YAAY,IAAI,IAAI;yBACnC,CAAC,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YAEF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;gBACnD,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;oBAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,CACF,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;oBAC1D,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,uBAAuB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CACvD,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnHY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,qCAA6B,CAAC,CAAA;;GAF7B,6BAA6B,CAmHzC;AAUD,SAAS,gBAAgB,CACvB,gBAA8C;IAE9C,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,IAAA,YAAS,EAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;YAClE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,QAAQ,CACb,IAAI,wBAAwB,CAC1B,0CAA0C,CAC3C,EACD,EAAE,EACF,CAAC,CACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,SAA0B,EAC1B,gBAA8C;IAE9C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/authorization-server/client-metadata-document.fetcher.spec.d.ts

@@ -0,0 +1 @@
+export {};