@textrp/briij-js-sdk 41.0.0

package/lib/oidc/validate.js

@@ -0,0 +1,181 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { jwtDecode } from "jwt-decode";
+import { logger } from "../logger.js";
+import { OidcError } from "./error.js";
+import { OAuthGrantType } from "./index.js";
+
+/**
+ * Metadata from OAuth 2.0 client authentication API as per
+ * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata
+ * With validated properties required in type
+ */
+
+var isRecord = value => !!value && typeof value === "object" && !Array.isArray(value);
+var requiredStringProperty = (wellKnown, key) => {
+  if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {
+    logger.error("Missing or invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var optionalStringProperty = (wellKnown, key) => {
+  if (!!wellKnown[key] && typeof wellKnown[key] !== "string") {
+    logger.error("Invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var optionalStringArrayProperty = (wellKnown, key) => {
+  if (!!wellKnown[key] && (!Array.isArray(wellKnown[key]) || !wellKnown[key].every(v => typeof v === "string"))) {
+    logger.error("Invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var requiredArrayValue = (wellKnown, key, value) => {
+  var array = wellKnown[key];
+  if (!array || !Array.isArray(array) || !array.includes(value)) {
+    logger.error("Invalid property: ".concat(key, ". ").concat(value, " is required."));
+    return false;
+  }
+  return true;
+};
+
+/**
+ * Validates OAuth 2.0 auth metadata as defined by
+ * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata
+ * is compatible with Element's OAuth/OIDC flow
+ * @param authMetadata - json object
+ * @returns valid issuer config
+ * @throws Error - when issuer config is not found or is invalid
+ */
+export var validateAuthMetadata = authMetadata => {
+  if (!isRecord(authMetadata)) {
+    logger.error("Issuer configuration not found or malformed");
+    throw new Error(OidcError.OpSupport);
+  }
+  var isInvalid = [requiredStringProperty(authMetadata, "issuer"), requiredStringProperty(authMetadata, "authorization_endpoint"), requiredStringProperty(authMetadata, "token_endpoint"), requiredStringProperty(authMetadata, "revocation_endpoint"), optionalStringProperty(authMetadata, "registration_endpoint"), optionalStringProperty(authMetadata, "account_management_uri"), optionalStringProperty(authMetadata, "device_authorization_endpoint"), optionalStringArrayProperty(authMetadata, "account_management_actions_supported"), requiredArrayValue(authMetadata, "response_types_supported", "code"), requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.AuthorizationCode), requiredArrayValue(authMetadata, "code_challenge_methods_supported", "S256"), optionalStringArrayProperty(authMetadata, "prompt_values_supported")].some(isValid => !isValid);
+  if (!isInvalid) {
+    return authMetadata;
+  }
+  logger.error("Issuer configuration not valid");
+  throw new Error(OidcError.OpSupport);
+};
+export var decodeIdToken = token => {
+  try {
+    return jwtDecode(token);
+  } catch (error) {
+    logger.error("Could not decode id_token", error);
+    throw error;
+  }
+};
+
+/**
+ * Validate idToken
+ * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+ * @param idToken - id token from token endpoint
+ * @param issuer - issuer for the OP as found during discovery
+ * @param clientId - this client's id as registered with the OP
+ * @param nonce - nonce used in the authentication request
+ * @throws when id token is invalid
+ */
+export var validateIdToken = (idToken, issuer, clientId, nonce) => {
+  try {
+    if (!idToken) {
+      throw new Error("No ID token");
+    }
+    var claims = decodeIdToken(idToken);
+
+    // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.
+    if (claims.iss !== issuer) {
+      throw new Error("Invalid issuer");
+    }
+    /**
+     * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.
+     * The aud (audience) Claim MAY contain an array with more than one element.
+     * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+     * EW: Don't accept tokens with other untrusted audiences
+     * */
+    var sanitisedAuds = typeof claims.aud === "string" ? [claims.aud] : claims.aud;
+    if (!sanitisedAuds.includes(clientId)) {
+      throw new Error("Invalid audience");
+    }
+
+    /**
+     * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked
+     * to verify that it is the same value as the one that was sent in the Authentication Request.
+     */
+    if (nonce !== undefined && claims.nonce !== nonce) {
+      throw new Error("Invalid nonce");
+    }
+
+    /**
+     * The current time MUST be before the time represented by the exp Claim.
+     *  exp is an epoch timestamp in seconds
+     * */
+    if (!claims.exp || Date.now() > claims.exp * 1000) {
+      throw new Error("Invalid expiry");
+    }
+  } catch (error) {
+    logger.error("Invalid ID token", error);
+    throw new Error(OidcError.InvalidIdToken);
+  }
+};
+
+/**
+ * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)
+ * so that we can access it on return from the OP and complete login
+ */
+
+/**
+ * Validate stored user state exists and is valid
+ * @param userState - userState returned by oidcClient.processSigninResponse
+ * @throws when userState is invalid
+ */
+export function validateStoredUserState(userState) {
+  if (!isRecord(userState)) {
+    logger.error("Stored user state not found");
+    throw new Error(OidcError.MissingOrInvalidStoredState);
+  }
+  var isInvalid = [requiredStringProperty(userState, "homeserverUrl"), requiredStringProperty(userState, "nonce"), optionalStringProperty(userState, "identityServerUrl")].some(isValid => !isValid);
+  if (isInvalid) {
+    throw new Error(OidcError.MissingOrInvalidStoredState);
+  }
+}
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
+ * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
+ */
+
+/**
+ * Make required properties required in type
+ */
+
+var isValidBearerTokenResponse = response => isRecord(response) && requiredStringProperty(response, "token_type") &&
+// token_type is case insensitive, some OPs return `token_type: "bearer"`
+response["token_type"].toLowerCase() === "bearer" && requiredStringProperty(response, "access_token") && requiredStringProperty(response, "refresh_token") && (!("expires_in" in response) || typeof response["expires_in"] === "number");
+export function validateBearerTokenResponse(response) {
+  if (!isValidBearerTokenResponse(response)) {
+    throw new Error(OidcError.InvalidBearerTokenResponse);
+  }
+}
+//# sourceMappingURL=validate.js.map

package/lib/oidc/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","names":["jwtDecode","logger","OidcError","OAuthGrantType","isRecord","value","Array","isArray","requiredStringProperty","wellKnown","key","optionalStringProperty","error","concat","optionalStringArrayProperty","every","v","requiredArrayValue","array","includes","validateAuthMetadata","authMetadata","Error","OpSupport","isInvalid","AuthorizationCode","some","isValid","decodeIdToken","token","validateIdToken","idToken","issuer","clientId","nonce","claims","iss","sanitisedAuds","aud","undefined","exp","Date","now","InvalidIdToken","validateStoredUserState","userState","MissingOrInvalidStoredState","isValidBearerTokenResponse","response","toLowerCase","validateBearerTokenResponse","InvalidBearerTokenResponse"],"sources":["../../src/oidc/validate.ts"],"sourcesContent":["/*\r\nCopyright 2023 The Matrix.org Foundation C.I.C.\r\n\r\nLicensed under the Apache License, Version 2.0 (the \"License\");\r\nyou may not use this file except in compliance with the License.\r\nYou may obtain a copy of the License at\r\n\r\n    http://www.apache.org/licenses/LICENSE-2.0\r\n\r\nUnless required by applicable law or agreed to in writing, software\r\ndistributed under the License is distributed on an \"AS IS\" BASIS,\r\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r\nSee the License for the specific language governing permissions and\r\nlimitations under the License.\r\n*/\r\n\r\nimport { jwtDecode } from \"jwt-decode\";\r\nimport { type IdTokenClaims, type OidcMetadata, type SigninResponse } from \"oidc-client-ts\";\r\n\r\nimport { logger } from \"../logger.ts\";\r\nimport { OidcError } from \"./error.ts\";\r\nimport { OAuthGrantType } from \"./index.ts\";\r\n\r\n/**\r\n * Metadata from OAuth 2.0 client authentication API as per\r\n * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata\r\n * With validated properties required in type\r\n */\r\nexport type ValidatedAuthMetadata = Partial<OidcMetadata> &\r\n    Pick<\r\n        // These values are from [RFC8414](https://datatracker.ietf.org/doc/html/rfc8414#section-2)\r\n        // so we can reuse the OidcMetadata definitions from oidc-client-ts\r\n        OidcMetadata,\r\n        | \"issuer\"\r\n        | \"authorization_endpoint\"\r\n        | \"token_endpoint\"\r\n        | \"revocation_endpoint\"\r\n        | \"response_types_supported\"\r\n        | \"grant_types_supported\"\r\n        | \"code_challenge_methods_supported\"\r\n    > & {\r\n        // These values aren't part of RFC8414 so we add them here\r\n        // Account management fields from stable MSC4191:\r\n        account_management_uri?: string;\r\n        account_management_actions_supported?: string[];\r\n        // Value from [Initiating User Registration via OpenID Connect](https://openid.net/specs/openid-connect-prompt-create-1_0.html):\r\n        prompt_values_supported?: string[];\r\n        // Experimental MSC4341 value from [RFC8628](https://datatracker.ietf.org/doc/html/rfc8628#section-4):\r\n        device_authorization_endpoint?: string;\r\n    };\r\n\r\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\r\n    !!value && typeof value === \"object\" && !Array.isArray(value);\r\nconst requiredStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\r\n    if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {\r\n        logger.error(`Missing or invalid property: ${key}`);\r\n        return false;\r\n    }\r\n    return true;\r\n};\r\nconst optionalStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\r\n    if (!!wellKnown[key] && typeof wellKnown[key] !== \"string\") {\r\n        logger.error(`Invalid property: ${key}`);\r\n        return false;\r\n    }\r\n    return true;\r\n};\r\nconst optionalStringArrayProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {\r\n    if (\r\n        !!wellKnown[key] &&\r\n        (!Array.isArray(wellKnown[key]) || !(<unknown[]>wellKnown[key]).every((v) => typeof v === \"string\"))\r\n    ) {\r\n        logger.error(`Invalid property: ${key}`);\r\n        return false;\r\n    }\r\n    return true;\r\n};\r\nconst requiredArrayValue = (wellKnown: Record<string, unknown>, key: string, value: any): boolean => {\r\n    const array = wellKnown[key];\r\n    if (!array || !Array.isArray(array) || !array.includes(value)) {\r\n        logger.error(`Invalid property: ${key}. ${value} is required.`);\r\n        return false;\r\n    }\r\n    return true;\r\n};\r\n\r\n/**\r\n * Validates OAuth 2.0 auth metadata as defined by\r\n * https://spec.matrix.org/v1.17/client-server-api/#get_matrixclientv1auth_metadata\r\n * is compatible with Element's OAuth/OIDC flow\r\n * @param authMetadata - json object\r\n * @returns valid issuer config\r\n * @throws Error - when issuer config is not found or is invalid\r\n */\r\nexport const validateAuthMetadata = (authMetadata: unknown): ValidatedAuthMetadata => {\r\n    if (!isRecord(authMetadata)) {\r\n        logger.error(\"Issuer configuration not found or malformed\");\r\n        throw new Error(OidcError.OpSupport);\r\n    }\r\n\r\n    const isInvalid = [\r\n        requiredStringProperty(authMetadata, \"issuer\"),\r\n        requiredStringProperty(authMetadata, \"authorization_endpoint\"),\r\n        requiredStringProperty(authMetadata, \"token_endpoint\"),\r\n        requiredStringProperty(authMetadata, \"revocation_endpoint\"),\r\n        optionalStringProperty(authMetadata, \"registration_endpoint\"),\r\n        optionalStringProperty(authMetadata, \"account_management_uri\"),\r\n        optionalStringProperty(authMetadata, \"device_authorization_endpoint\"),\r\n        optionalStringArrayProperty(authMetadata, \"account_management_actions_supported\"),\r\n        requiredArrayValue(authMetadata, \"response_types_supported\", \"code\"),\r\n        requiredArrayValue(authMetadata, \"grant_types_supported\", OAuthGrantType.AuthorizationCode),\r\n        requiredArrayValue(authMetadata, \"code_challenge_methods_supported\", \"S256\"),\r\n        optionalStringArrayProperty(authMetadata, \"prompt_values_supported\"),\r\n    ].some((isValid) => !isValid);\r\n\r\n    if (!isInvalid) {\r\n        return authMetadata as ValidatedAuthMetadata;\r\n    }\r\n\r\n    logger.error(\"Issuer configuration not valid\");\r\n    throw new Error(OidcError.OpSupport);\r\n};\r\n\r\nexport const decodeIdToken = (token: string): IdTokenClaims => {\r\n    try {\r\n        return jwtDecode<IdTokenClaims>(token);\r\n    } catch (error) {\r\n        logger.error(\"Could not decode id_token\", error);\r\n        throw error;\r\n    }\r\n};\r\n\r\n/**\r\n * Validate idToken\r\n * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation\r\n * @param idToken - id token from token endpoint\r\n * @param issuer - issuer for the OP as found during discovery\r\n * @param clientId - this client's id as registered with the OP\r\n * @param nonce - nonce used in the authentication request\r\n * @throws when id token is invalid\r\n */\r\nexport const validateIdToken = (\r\n    idToken: string | undefined,\r\n    issuer: string,\r\n    clientId: string,\r\n    nonce: string | undefined,\r\n): void => {\r\n    try {\r\n        if (!idToken) {\r\n            throw new Error(\"No ID token\");\r\n        }\r\n        const claims = decodeIdToken(idToken);\r\n\r\n        // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.\r\n        if (claims.iss !== issuer) {\r\n            throw new Error(\"Invalid issuer\");\r\n        }\r\n        /**\r\n         * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.\r\n         * The aud (audience) Claim MAY contain an array with more than one element.\r\n         * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.\r\n         * EW: Don't accept tokens with other untrusted audiences\r\n         * */\r\n        const sanitisedAuds = typeof claims.aud === \"string\" ? [claims.aud] : claims.aud;\r\n        if (!sanitisedAuds.includes(clientId)) {\r\n            throw new Error(\"Invalid audience\");\r\n        }\r\n\r\n        /**\r\n         * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked\r\n         * to verify that it is the same value as the one that was sent in the Authentication Request.\r\n         */\r\n        if (nonce !== undefined && claims.nonce !== nonce) {\r\n            throw new Error(\"Invalid nonce\");\r\n        }\r\n\r\n        /**\r\n         * The current time MUST be before the time represented by the exp Claim.\r\n         *  exp is an epoch timestamp in seconds\r\n         * */\r\n        if (!claims.exp || Date.now() > claims.exp * 1000) {\r\n            throw new Error(\"Invalid expiry\");\r\n        }\r\n    } catch (error) {\r\n        logger.error(\"Invalid ID token\", error);\r\n        throw new Error(OidcError.InvalidIdToken);\r\n    }\r\n};\r\n\r\n/**\r\n * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)\r\n * so that we can access it on return from the OP and complete login\r\n */\r\nexport type UserState = {\r\n    /**\r\n     * Remember which server we were trying to login to\r\n     */\r\n    homeserverUrl: string;\r\n    identityServerUrl?: string;\r\n    /**\r\n     * Used to validate id token\r\n     */\r\n    nonce: string;\r\n};\r\n/**\r\n * Validate stored user state exists and is valid\r\n * @param userState - userState returned by oidcClient.processSigninResponse\r\n * @throws when userState is invalid\r\n */\r\nexport function validateStoredUserState(userState: unknown): asserts userState is UserState {\r\n    if (!isRecord(userState)) {\r\n        logger.error(\"Stored user state not found\");\r\n        throw new Error(OidcError.MissingOrInvalidStoredState);\r\n    }\r\n    const isInvalid = [\r\n        requiredStringProperty(userState, \"homeserverUrl\"),\r\n        requiredStringProperty(userState, \"nonce\"),\r\n        optionalStringProperty(userState, \"identityServerUrl\"),\r\n    ].some((isValid) => !isValid);\r\n\r\n    if (isInvalid) {\r\n        throw new Error(OidcError.MissingOrInvalidStoredState);\r\n    }\r\n}\r\n\r\n/**\r\n * The expected response type from the token endpoint during authorization code flow\r\n * Normalized to always use capitalized 'Bearer' for token_type\r\n *\r\n * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,\r\n * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.\r\n */\r\nexport type BearerTokenResponse = {\r\n    token_type: \"Bearer\";\r\n    access_token: string;\r\n    scope: string;\r\n    refresh_token?: string;\r\n    expires_in?: number;\r\n    // from oidc-client-ts\r\n    expires_at?: number;\r\n    id_token: string;\r\n};\r\n\r\n/**\r\n * Make required properties required in type\r\n */\r\ntype ValidSignInResponse = SigninResponse &\r\n    BearerTokenResponse & {\r\n        token_type: \"Bearer\" | \"bearer\";\r\n    };\r\n\r\nconst isValidBearerTokenResponse = (response: unknown): response is ValidSignInResponse =>\r\n    isRecord(response) &&\r\n    requiredStringProperty(response, \"token_type\") &&\r\n    // token_type is case insensitive, some OPs return `token_type: \"bearer\"`\r\n    (response[\"token_type\"] as string).toLowerCase() === \"bearer\" &&\r\n    requiredStringProperty(response, \"access_token\") &&\r\n    requiredStringProperty(response, \"refresh_token\") &&\r\n    (!(\"expires_in\" in response) || typeof response[\"expires_in\"] === \"number\");\r\n\r\nexport function validateBearerTokenResponse(response: unknown): asserts response is ValidSignInResponse {\r\n    if (!isValidBearerTokenResponse(response)) {\r\n        throw new Error(OidcError.InvalidBearerTokenResponse);\r\n    }\r\n}\r\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,SAAS,QAAQ,YAAY;AAGtC,SAASC,MAAM,QAAQ,cAAc;AACrC,SAASC,SAAS,QAAQ,YAAY;AACtC,SAASC,cAAc,QAAQ,YAAY;;AAE3C;AACA;AACA;AACA;AACA;;AAwBA,IAAMC,QAAQ,GAAIC,KAAc,IAC5B,CAAC,CAACA,KAAK,IAAI,OAAOA,KAAK,KAAK,QAAQ,IAAI,CAACC,KAAK,CAACC,OAAO,CAACF,KAAK,CAAC;AACjE,IAAMG,sBAAsB,GAAGA,CAACC,SAAkC,EAAEC,GAAW,KAAc;EACzF,IAAI,CAACD,SAAS,CAACC,GAAG,CAAC,IAAI,CAACC,sBAAsB,CAACF,SAAS,EAAEC,GAAG,CAAC,EAAE;IAC5DT,MAAM,CAACW,KAAK,iCAAAC,MAAA,CAAiCH,GAAG,CAAE,CAAC;IACnD,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,IAAMC,sBAAsB,GAAGA,CAACF,SAAkC,EAAEC,GAAW,KAAc;EACzF,IAAI,CAAC,CAACD,SAAS,CAACC,GAAG,CAAC,IAAI,OAAOD,SAAS,CAACC,GAAG,CAAC,KAAK,QAAQ,EAAE;IACxDT,MAAM,CAACW,KAAK,sBAAAC,MAAA,CAAsBH,GAAG,CAAE,CAAC;IACxC,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,IAAMI,2BAA2B,GAAGA,CAACL,SAAkC,EAAEC,GAAW,KAAc;EAC9F,IACI,CAAC,CAACD,SAAS,CAACC,GAAG,CAAC,KACf,CAACJ,KAAK,CAACC,OAAO,CAACE,SAAS,CAACC,GAAG,CAAC,CAAC,IAAI,CAAaD,SAAS,CAACC,GAAG,CAAC,CAAEK,KAAK,CAAEC,CAAC,IAAK,OAAOA,CAAC,KAAK,QAAQ,CAAC,CAAC,EACtG;IACEf,MAAM,CAACW,KAAK,sBAAAC,MAAA,CAAsBH,GAAG,CAAE,CAAC;IACxC,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;AACD,IAAMO,kBAAkB,GAAGA,CAACR,SAAkC,EAAEC,GAAW,EAAEL,KAAU,KAAc;EACjG,IAAMa,KAAK,GAAGT,SAAS,CAACC,GAAG,CAAC;EAC5B,IAAI,CAACQ,KAAK,IAAI,CAACZ,KAAK,CAACC,OAAO,CAACW,KAAK,CAAC,IAAI,CAACA,KAAK,CAACC,QAAQ,CAACd,KAAK,CAAC,EAAE;IAC3DJ,MAAM,CAACW,KAAK,sBAAAC,MAAA,CAAsBH,GAAG,QAAAG,MAAA,CAAKR,KAAK,kBAAe,CAAC;IAC/D,OAAO,KAAK;EAChB;EACA,OAAO,IAAI;AACf,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMe,oBAAoB,GAAIC,YAAqB,IAA4B;EAClF,IAAI,CAACjB,QAAQ,CAACiB,YAAY,CAAC,EAAE;IACzBpB,MAAM,CAACW,KAAK,CAAC,6CAA6C,CAAC;IAC3D,MAAM,IAAIU,KAAK,CAACpB,SAAS,CAACqB,SAAS,CAAC;EACxC;EAEA,IAAMC,SAAS,GAAG,CACdhB,sBAAsB,CAACa,YAAY,EAAE,QAAQ,CAAC,EAC9Cb,sBAAsB,CAACa,YAAY,EAAE,wBAAwB,CAAC,EAC9Db,sBAAsB,CAACa,YAAY,EAAE,gBAAgB,CAAC,EACtDb,sBAAsB,CAACa,YAAY,EAAE,qBAAqB,CAAC,EAC3DV,sBAAsB,CAACU,YAAY,EAAE,uBAAuB,CAAC,EAC7DV,sBAAsB,CAACU,YAAY,EAAE,wBAAwB,CAAC,EAC9DV,sBAAsB,CAACU,YAAY,EAAE,+BAA+B,CAAC,EACrEP,2BAA2B,CAACO,YAAY,EAAE,sCAAsC,CAAC,EACjFJ,kBAAkB,CAACI,YAAY,EAAE,0BAA0B,EAAE,MAAM,CAAC,EACpEJ,kBAAkB,CAACI,YAAY,EAAE,uBAAuB,EAAElB,cAAc,CAACsB,iBAAiB,CAAC,EAC3FR,kBAAkB,CAACI,YAAY,EAAE,kCAAkC,EAAE,MAAM,CAAC,EAC5EP,2BAA2B,CAACO,YAAY,EAAE,yBAAyB,CAAC,CACvE,CAACK,IAAI,CAAEC,OAAO,IAAK,CAACA,OAAO,CAAC;EAE7B,IAAI,CAACH,SAAS,EAAE;IACZ,OAAOH,YAAY;EACvB;EAEApB,MAAM,CAACW,KAAK,CAAC,gCAAgC,CAAC;EAC9C,MAAM,IAAIU,KAAK,CAACpB,SAAS,CAACqB,SAAS,CAAC;AACxC,CAAC;AAED,OAAO,IAAMK,aAAa,GAAIC,KAAa,IAAoB;EAC3D,IAAI;IACA,OAAO7B,SAAS,CAAgB6B,KAAK,CAAC;EAC1C,CAAC,CAAC,OAAOjB,KAAK,EAAE;IACZX,MAAM,CAACW,KAAK,CAAC,2BAA2B,EAAEA,KAAK,CAAC;IAChD,MAAMA,KAAK;EACf;AACJ,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMkB,eAAe,GAAGA,CAC3BC,OAA2B,EAC3BC,MAAc,EACdC,QAAgB,EAChBC,KAAyB,KAClB;EACP,IAAI;IACA,IAAI,CAACH,OAAO,EAAE;MACV,MAAM,IAAIT,KAAK,CAAC,aAAa,CAAC;IAClC;IACA,IAAMa,MAAM,GAAGP,aAAa,CAACG,OAAO,CAAC;;IAErC;IACA,IAAII,MAAM,CAACC,GAAG,KAAKJ,MAAM,EAAE;MACvB,MAAM,IAAIV,KAAK,CAAC,gBAAgB,CAAC;IACrC;IACA;AACR;AACA;AACA;AACA;AACA;IACQ,IAAMe,aAAa,GAAG,OAAOF,MAAM,CAACG,GAAG,KAAK,QAAQ,GAAG,CAACH,MAAM,CAACG,GAAG,CAAC,GAAGH,MAAM,CAACG,GAAG;IAChF,IAAI,CAACD,aAAa,CAAClB,QAAQ,CAACc,QAAQ,CAAC,EAAE;MACnC,MAAM,IAAIX,KAAK,CAAC,kBAAkB,CAAC;IACvC;;IAEA;AACR;AACA;AACA;IACQ,IAAIY,KAAK,KAAKK,SAAS,IAAIJ,MAAM,CAACD,KAAK,KAAKA,KAAK,EAAE;MAC/C,MAAM,IAAIZ,KAAK,CAAC,eAAe,CAAC;IACpC;;IAEA;AACR;AACA;AACA;IACQ,IAAI,CAACa,MAAM,CAACK,GAAG,IAAIC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGP,MAAM,CAACK,GAAG,GAAG,IAAI,EAAE;MAC/C,MAAM,IAAIlB,KAAK,CAAC,gBAAgB,CAAC;IACrC;EACJ,CAAC,CAAC,OAAOV,KAAK,EAAE;IACZX,MAAM,CAACW,KAAK,CAAC,kBAAkB,EAAEA,KAAK,CAAC;IACvC,MAAM,IAAIU,KAAK,CAACpB,SAAS,CAACyC,cAAc,CAAC;EAC7C;AACJ,CAAC;;AAED;AACA;AACA;AACA;;AAYA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAACC,SAAkB,EAAkC;EACxF,IAAI,CAACzC,QAAQ,CAACyC,SAAS,CAAC,EAAE;IACtB5C,MAAM,CAACW,KAAK,CAAC,6BAA6B,CAAC;IAC3C,MAAM,IAAIU,KAAK,CAACpB,SAAS,CAAC4C,2BAA2B,CAAC;EAC1D;EACA,IAAMtB,SAAS,GAAG,CACdhB,sBAAsB,CAACqC,SAAS,EAAE,eAAe,CAAC,EAClDrC,sBAAsB,CAACqC,SAAS,EAAE,OAAO,CAAC,EAC1ClC,sBAAsB,CAACkC,SAAS,EAAE,mBAAmB,CAAC,CACzD,CAACnB,IAAI,CAAEC,OAAO,IAAK,CAACA,OAAO,CAAC;EAE7B,IAAIH,SAAS,EAAE;IACX,MAAM,IAAIF,KAAK,CAACpB,SAAS,CAAC4C,2BAA2B,CAAC;EAC1D;AACJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA;AACA;AACA;;AAMA,IAAMC,0BAA0B,GAAIC,QAAiB,IACjD5C,QAAQ,CAAC4C,QAAQ,CAAC,IAClBxC,sBAAsB,CAACwC,QAAQ,EAAE,YAAY,CAAC;AAC9C;AACCA,QAAQ,CAAC,YAAY,CAAC,CAAYC,WAAW,CAAC,CAAC,KAAK,QAAQ,IAC7DzC,sBAAsB,CAACwC,QAAQ,EAAE,cAAc,CAAC,IAChDxC,sBAAsB,CAACwC,QAAQ,EAAE,eAAe,CAAC,KAChD,EAAE,YAAY,IAAIA,QAAQ,CAAC,IAAI,OAAOA,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;AAE/E,OAAO,SAASE,2BAA2BA,CAACF,QAAiB,EAA2C;EACpG,IAAI,CAACD,0BAA0B,CAACC,QAAQ,CAAC,EAAE;IACvC,MAAM,IAAI1B,KAAK,CAACpB,SAAS,CAACiD,0BAA0B,CAAC;EACzD;AACJ","ignoreList":[]}

package/lib/pushprocessor.d.ts

@@ -0,0 +1,140 @@
+import { type Logger } from "./logger.ts";
+import { type BriijClient } from "./client.ts";
+import { type BriijEvent } from "./models/event.ts";
+import { type IAnnotatedPushRule, type IPushRule, type IPushRules, type PushRuleAction, PushRuleKind, TweakName } from "./@types/PushRules.ts";
+export interface IActionsObject {
+    /** Whether this event should notify the user or not. */
+    notify: boolean;
+    /** How this event should be notified. */
+    tweaks: Partial<Record<TweakName, any>>;
+}
+export declare class PushProcessor {
+    private readonly client;
+    /**
+     * Construct a Push Processor.
+     * @param client - The Matrix client object to use
+     */
+    constructor(client: BriijClient);
+    /**
+     * Maps the original key from the push rules to a list of property names
+     * after unescaping.
+     */
+    private readonly parsedKeys;
+    /**
+     * Convert a list of actions into a object with the actions as keys and their values
+     * @example
+     * eg. `[ 'notify', { set_tweak: 'sound', value: 'default' } ]`
+     *     becomes `{ notify: true, tweaks: { sound: 'default' } }`
+     * @param actionList - The actions list
+     *
+     * @returns A object with key 'notify' (true or false) and an object of actions
+     */
+    static actionListToActionsObject(actionList: PushRuleAction[]): IActionsObject;
+    /**
+     * Rewrites conditions on a client's push rules to match the defaults
+     * where applicable. Useful for upgrading push rules to more strict
+     * conditions when the server is falling behind on defaults.
+     *
+     * @param logger - A `Logger` to write log messages to.
+     * @param incomingRules - The client's existing push rules
+     * @param userId - The Matrix ID of the client.
+     * @returns The rewritten rules
+     */
+    static rewriteDefaultRules(logger: Logger, incomingRules: IPushRules, userId?: string | undefined): IPushRules;
+    /**
+     * Create a RegExp object for the given glob pattern with a single capture group around the pattern itself, caching the result.
+     * No cache invalidation is present currently,
+     * as this will be inherently bounded to the size of the user's own push rules.
+     * @param pattern - the glob pattern to convert to a RegExp
+     * @param alignToWordBoundary - whether to align the pattern to word boundaries,
+     *     as specified for `content.body` matches, will use lookaround assertions to ensure the match only includes the pattern
+     * @param flags - the flags to pass to the RegExp constructor, defaults to case-insensitive
+     */
+    static getPushRuleGlobRegex(pattern: string, alignToWordBoundary?: boolean, flags?: string): RegExp;
+    /**
+     * Pre-caches the parsed keys for push rules and cleans out any obsolete cache
+     * entries. Should be called after push rules are updated.
+     * @param newRules - The new push rules.
+     */
+    updateCachedPushRuleKeys(newRules: IPushRules): void;
+    private static cachedGlobToRegex;
+    private matchingRuleFromKindSet;
+    private templateRuleToRaw;
+    private eventFulfillsCondition;
+    private eventFulfillsSenderNotifPermCondition;
+    private eventFulfillsRoomMemberCountCondition;
+    private eventFulfillsDisplayNameCondition;
+    /**
+     * Check whether the given event matches the push rule condition by fetching
+     * the property from the event and comparing against the condition's glob-based
+     * pattern.
+     * @param cond - The push rule condition to check for a match.
+     * @param ev - The event to check for a match.
+     */
+    private eventFulfillsEventMatchCondition;
+    /**
+     * Check whether the given event matches the push rule condition by fetching
+     * the property from the event and comparing exactly against the condition's
+     * value.
+     * @param cond - The push rule condition to check for a match.
+     * @param ev - The event to check for a match.
+     */
+    private eventFulfillsEventPropertyIsCondition;
+    /**
+     * Check whether the given event matches the push rule condition by fetching
+     * the property from the event and comparing exactly against the condition's
+     * value.
+     * @param cond - The push rule condition to check for a match.
+     * @param ev - The event to check for a match.
+     */
+    private eventFulfillsEventPropertyContains;
+    private eventFulfillsCallStartedCondition;
+    /**
+     * Parse the key into the separate fields to search by splitting on
+     * unescaped ".", and then removing any escape characters.
+     *
+     * @param str - The key of the push rule condition: a dotted field.
+     * @returns The unescaped parts to fetch.
+     * @internal
+     */
+    static partsForDottedKey(str: string): string[];
+    /**
+     * For a dotted field and event, fetch the value at that position, if one
+     * exists.
+     *
+     * @param key - The key of the push rule condition: a dotted field to fetch.
+     * @param ev - The matrix event to fetch the field from.
+     * @returns The value at the dotted path given by key.
+     */
+    private valueForDottedKey;
+    private matchingRuleForEventWithRulesets;
+    private pushActionsForEventAndRulesets;
+    ruleMatchesEvent(rule: Partial<IPushRule> & Pick<IPushRule, "conditions">, ev: BriijEvent): boolean;
+    /**
+     * Get the user's push actions for the given event
+     */
+    actionsForEvent(ev: BriijEvent): IActionsObject;
+    actionsAndRuleForEvent(ev: BriijEvent): {
+        actions?: IActionsObject;
+        rule?: IAnnotatedPushRule;
+    };
+    /**
+     * Get one of the users push rules by its ID
+     *
+     * @param ruleId - The ID of the rule to search for
+     * @returns The push rule, or null if no such rule was found
+     */
+    getPushRuleById(ruleId: string): IPushRule | null;
+    /**
+     * Get one of the users push rules by its ID
+     *
+     * @param ruleId - The ID of the rule to search for
+     * @returns rule The push rule, or null if no such rule was found
+     * @returns kind - The PushRuleKind of the rule to search for
+     */
+    getPushRuleAndKindById(ruleId: string): {
+        rule: IPushRule;
+        kind: PushRuleKind;
+    } | null;
+}
+//# sourceMappingURL=pushprocessor.d.ts.map

package/lib/pushprocessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pushprocessor.d.ts","sourceRoot":"","sources":["../src/pushprocessor.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAEH,KAAK,kBAAkB,EAOvB,KAAK,SAAS,EACd,KAAK,UAAU,EAGf,KAAK,cAAc,EAGnB,YAAY,EAGZ,SAAS,EACZ,MAAM,uBAAuB,CAAC;AAgM/B,MAAM,WAAW,cAAc;IAC3B,wDAAwD;IACxD,MAAM,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;CAC3C;AAED,qBAAa,aAAa;IAKH,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ1C;;;OAGG;gBACiC,MAAM,EAAE,WAAW;IAEvD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D;;;;;;;;OAQG;WACW,yBAAyB,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,cAAc;IAerF;;;;;;;;;OASG;WACW,mBAAmB,CAC7B,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,UAAU,EACzB,MAAM,GAAE,MAAM,GAAG,SAAqB,GACvC,UAAU;IA8Bb;;;;;;;;OAQG;WACW,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,UAAQ,EAAE,KAAK,SAAM,GAAG,MAAM;IAarG;;;;OAIG;IACI,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI;IA0C3D,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA8B;IAE9D,OAAO,CAAC,uBAAuB;IA4B/B,OAAO,CAAC,iBAAiB;IAgDzB,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,qCAAqC;IAoB7C,OAAO,CAAC,qCAAqC;IAsC7C,OAAO,CAAC,iCAAiC;IAuBzC;;;;;;OAMG;IACH,OAAO,CAAC,gCAAgC;IA2BxC;;;;;;OAMG;IACH,OAAO,CAAC,qCAAqC;IAO7C;;;;;;OAMG;IACH,OAAO,CAAC,kCAAkC;IAW1C,OAAO,CAAC,iCAAiC;IAczC;;;;;;;OAOG;WACW,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;IAkDtD;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAsCzB,OAAO,CAAC,gCAAgC;IAYxC,OAAO,CAAC,8BAA8B;IAwB/B,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO;IAe1G;;OAEG;IACI,eAAe,CAAC,EAAE,EAAE,UAAU,GAAG,cAAc;IAK/C,sBAAsB,CAAC,EAAE,EAAE,UAAU,GAAG;QAC3C,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,IAAI,CAAC,EAAE,kBAAkB,CAAC;KAC7B;IAID;;;;;OAKG;IACI,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAKxD;;;;;;OAMG;IACI,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI;CAchG"}