@tsed/oidc-provider-plugin-wildcard-redirect-uri 7.21.0

package/.eslintignore

@@ -0,0 +1,13 @@
+node_modules
+docs
+docs-references
+lib
+dist
+coverage
+.nyc_output
+*-lock.json
+*.lock
+benchmarks.*
+**/generated
+
+**/*.js

package/.eslintrc.js

@@ -0,0 +1 @@
+module.exports = require("@tsed/eslint/node.js");

package/jest.config.js

@@ -0,0 +1,19 @@
+// For a detailed explanation regarding each configuration property, visit:
+// https://jestjs.io/docs/en/configuration.html
+
+module.exports = {
+  ...require("@tsed/jest-config"),
+  coverageProvider: "babel",
+  roots: ["<rootDir>/src"],
+  moduleNameMapper: {},
+  transformIgnorePatterns: ["^.+\\.module\\.(css|sass|scss)$"],
+
+  coverageThreshold: {
+    global: {
+      statements: 100,
+      branches: 87.5,
+      functions: 100,
+      lines: 100
+    }
+  }
+};

package/lib/cjs/OidcWildcardRedirectUriModule.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcWildcardRedirectUriModule = void 0;
+const tslib_1 = require("tslib");
+const di_1 = require("@tsed/di");
+const logger_1 = require("@tsed/logger");
+const oidc_provider_1 = require("@tsed/oidc-provider");
+// @ts-ignore
+const psl_1 = tslib_1.__importDefault(require("psl"));
+const wildcardRedirectUriAllowed_1 = require("./utils/wildcardRedirectUriAllowed");
+let OidcWildcardRedirectUriModule = class OidcWildcardRedirectUriModule {
+    module;
+    enabled;
+    logger;
+    constructor(module) {
+        this.module = module;
+    }
+    async $onCreateOIDC(provider) {
+        if (this.enabled) {
+            const { redirectUriAllowed } = provider.Client.prototype;
+            provider.Client.prototype.redirectUriAllowed = (0, wildcardRedirectUriAllowed_1.wildcardRedirectUriAllowed)(redirectUriAllowed);
+            this.logger.warn("⚠️⚠️⚠️ OIDC Wildcard Uris plugin is ENABLED ⚠️⚠️⚠️");
+        }
+    }
+    async $alterOidcConfiguration(config) {
+        if (this.enabled) {
+            const actualProperties = config?.extraClientMetadata?.properties || [];
+            config.extraClientMetadata = {
+                properties: [...actualProperties, "redirect_uris"],
+                validator: this.validator.bind(this)
+            };
+        }
+        return config;
+    }
+    validator(ctx, key, value) {
+        if (key === "redirect_uris") {
+            for (const redirectUri of value) {
+                if (redirectUri.includes("*")) {
+                    const { hostname, href } = new URL(redirectUri);
+                    if (href.split("*").length !== 2) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris with a wildcard may only contain a single one");
+                    }
+                    if (!hostname.includes("*")) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris may only have a wildcard in the hostname");
+                    }
+                    if (!psl_1.default.get(hostname.split("*.")[1])) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain");
+                    }
+                }
+            }
+        }
+    }
+};
+tslib_1.__decorate([
+    (0, di_1.Constant)("oidc.plugins.wildcard.enabled", false),
+    tslib_1.__metadata("design:type", Boolean)
+], OidcWildcardRedirectUriModule.prototype, "enabled", void 0);
+tslib_1.__decorate([
+    (0, di_1.Inject)(logger_1.Logger),
+    tslib_1.__metadata("design:type", logger_1.Logger)
+], OidcWildcardRedirectUriModule.prototype, "logger", void 0);
+OidcWildcardRedirectUriModule = tslib_1.__decorate([
+    (0, di_1.Module)(),
+    tslib_1.__param(0, (0, di_1.Inject)(oidc_provider_1.OIDC_PROVIDER_NODE_MODULE)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], OidcWildcardRedirectUriModule);
+exports.OidcWildcardRedirectUriModule = OidcWildcardRedirectUriModule;
+//# sourceMappingURL=OidcWildcardRedirectUriModule.js.map

package/lib/cjs/OidcWildcardRedirectUriModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcWildcardRedirectUriModule.js","sourceRoot":"","sources":["../../src/OidcWildcardRedirectUriModule.ts"],"names":[],"mappings":";;;;AAAA,iCAAkD;AAClD,yCAAoC;AACpC,uDAA4E;AAG5E,aAAa;AACb,sDAAsB;AACtB,mFAA8E;AAavE,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAOiB;IALhD,OAAO,CAAU;IAGhB,MAAM,CAAS;IAEzB,YAAyD,MAAiC;QAAjC,WAAM,GAAN,MAAM,CAA2B;IAAG,CAAC;IAE9F,KAAK,CAAC,aAAa,CAAC,QAAkB;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE;YAChB,MAAM,EAAC,kBAAkB,EAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YACvD,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,GAAG,IAAA,uDAA0B,EAAC,kBAAkB,CAAC,CAAC;YAE9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;SACxE;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAoB;QAChD,IAAI,IAAI,CAAC,OAAO,EAAE;YAChB,MAAM,gBAAgB,GAAG,MAAM,EAAE,mBAAmB,EAAE,UAAU,IAAI,EAAE,CAAC;YAEvE,MAAM,CAAC,mBAAmB,GAAG;gBAC3B,UAAU,EAAE,CAAC,GAAG,gBAAgB,EAAE,eAAe,CAAC;gBAClD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;aACrC,CAAC;SACH;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,GAAuB,EAAE,GAAW,EAAE,KAAU;QACxD,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE;gBAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;oBAC7B,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBAE9C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;wBAChC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,6DAA6D,CAAC,CAAC;qBACnH;oBAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC3B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,wDAAwD,CAAC,CAAC;qBAC9G;oBAED,IAAI,CAAC,aAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;wBACrC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAChD,wFAAwF,CACzF,CAAC;qBACH;iBACF;aACF;SACF;IACH,CAAC;CACF,CAAA;AArDC;IAAC,IAAA,aAAQ,EAAC,+BAA+B,EAAE,KAAK,CAAC;;8DACvB;AAE1B;IAAC,IAAA,WAAM,EAAC,eAAM,CAAC;sCACG,eAAM;6DAAC;AALd,6BAA6B;IADzC,IAAA,WAAM,GAAE;IAQM,mBAAA,IAAA,WAAM,EAAC,yCAAyB,CAAC,CAAA;;GAPnC,6BAA6B,CAsDzC;AAtDY,sEAA6B"}

package/lib/cjs/index.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * @file Automatically generated by barrelsby.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./OidcWildcardRedirectUriModule"), exports);
+tslib_1.__exportStar(require("./utils/wildcardRedirectUriAllowed"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,0EAAgD;AAChD,6EAAmD"}

package/lib/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/lib/cjs/utils/wildcardRedirectUriAllowed.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wildcardRedirectUriAllowed = void 0;
+const tslib_1 = require("tslib");
+// @ts-ignore
+const wildcard_1 = tslib_1.__importDefault(require("wildcard"));
+const hasWildcardHost = (redirectUri) => {
+    const { hostname } = new URL(redirectUri);
+    return hostname.includes("*");
+};
+const wildcardMatches = (redirectUri, wildcardUri) => !!(0, wildcard_1.default)(wildcardUri, redirectUri);
+function wildcardRedirectUriAllowed(originalRedirectUriAllowed) {
+    return function (redirectUri) {
+        if (this.redirectUris.some(hasWildcardHost)) {
+            const wildcardUris = this.redirectUris.filter(hasWildcardHost);
+            return wildcardUris.some(wildcardMatches.bind(undefined, redirectUri)) || originalRedirectUriAllowed.call(this, redirectUri);
+        }
+        return originalRedirectUriAllowed.call(this, redirectUri);
+    };
+}
+exports.wildcardRedirectUriAllowed = wildcardRedirectUriAllowed;
+//# sourceMappingURL=wildcardRedirectUriAllowed.js.map

package/lib/cjs/utils/wildcardRedirectUriAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcardRedirectUriAllowed.js","sourceRoot":"","sources":["../../../src/utils/wildcardRedirectUriAllowed.ts"],"names":[],"mappings":";;;;AAAA,aAAa;AACb,gEAAgC;AAEhC,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC9C,MAAM,EAAC,QAAQ,EAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,WAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAA,kBAAQ,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE3G,SAAgB,0BAA0B,CAAC,0BAA+B;IACxE,OAAO,UAAU,WAAmB;QAClC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,OAAO,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;SAC9H;QACD,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC;AARD,gEAQC"}

package/lib/esm/OidcWildcardRedirectUriModule.js

@@ -0,0 +1,65 @@
+import { __decorate, __metadata, __param } from "tslib";
+import { Constant, Inject, Module } from "@tsed/di";
+import { Logger } from "@tsed/logger";
+import { OIDC_PROVIDER_NODE_MODULE } from "@tsed/oidc-provider";
+// @ts-ignore
+import psl from "psl";
+import { wildcardRedirectUriAllowed } from "./utils/wildcardRedirectUriAllowed.js";
+let OidcWildcardRedirectUriModule = class OidcWildcardRedirectUriModule {
+    module;
+    enabled;
+    logger;
+    constructor(module) {
+        this.module = module;
+    }
+    async $onCreateOIDC(provider) {
+        if (this.enabled) {
+            const { redirectUriAllowed } = provider.Client.prototype;
+            provider.Client.prototype.redirectUriAllowed = wildcardRedirectUriAllowed(redirectUriAllowed);
+            this.logger.warn("⚠️⚠️⚠️ OIDC Wildcard Uris plugin is ENABLED ⚠️⚠️⚠️");
+        }
+    }
+    async $alterOidcConfiguration(config) {
+        if (this.enabled) {
+            const actualProperties = config?.extraClientMetadata?.properties || [];
+            config.extraClientMetadata = {
+                properties: [...actualProperties, "redirect_uris"],
+                validator: this.validator.bind(this)
+            };
+        }
+        return config;
+    }
+    validator(ctx, key, value) {
+        if (key === "redirect_uris") {
+            for (const redirectUri of value) {
+                if (redirectUri.includes("*")) {
+                    const { hostname, href } = new URL(redirectUri);
+                    if (href.split("*").length !== 2) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris with a wildcard may only contain a single one");
+                    }
+                    if (!hostname.includes("*")) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris may only have a wildcard in the hostname");
+                    }
+                    if (!psl.get(hostname.split("*.")[1])) {
+                        throw new this.module.errors.InvalidClientMetadata("redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain");
+                    }
+                }
+            }
+        }
+    }
+};
+__decorate([
+    Constant("oidc.plugins.wildcard.enabled", false),
+    __metadata("design:type", Boolean)
+], OidcWildcardRedirectUriModule.prototype, "enabled", void 0);
+__decorate([
+    Inject(Logger),
+    __metadata("design:type", Logger)
+], OidcWildcardRedirectUriModule.prototype, "logger", void 0);
+OidcWildcardRedirectUriModule = __decorate([
+    Module(),
+    __param(0, Inject(OIDC_PROVIDER_NODE_MODULE)),
+    __metadata("design:paramtypes", [Object])
+], OidcWildcardRedirectUriModule);
+export { OidcWildcardRedirectUriModule };
+//# sourceMappingURL=OidcWildcardRedirectUriModule.js.map

package/lib/esm/OidcWildcardRedirectUriModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcWildcardRedirectUriModule.js","sourceRoot":"","sources":["../../src/OidcWildcardRedirectUriModule.ts"],"names":[],"mappings":";AAAA,OAAO,EAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAC,MAAM,UAAU,CAAC;AAClD,OAAO,EAAC,MAAM,EAAC,MAAM,cAAc,CAAC;AACpC,OAAO,EAAC,yBAAyB,EAAe,MAAM,qBAAqB,CAAC;AAG5E,aAAa;AACb,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AAavE,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAOiB;IALhD,OAAO,CAAU;IAGhB,MAAM,CAAS;IAEzB,YAAyD,MAAiC;QAAjC,WAAM,GAAN,MAAM,CAA2B;IAAG,CAAC;IAE9F,KAAK,CAAC,aAAa,CAAC,QAAkB;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE;YAChB,MAAM,EAAC,kBAAkB,EAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YACvD,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YAE9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;SACxE;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,MAAoB;QAChD,IAAI,IAAI,CAAC,OAAO,EAAE;YAChB,MAAM,gBAAgB,GAAG,MAAM,EAAE,mBAAmB,EAAE,UAAU,IAAI,EAAE,CAAC;YAEvE,MAAM,CAAC,mBAAmB,GAAG;gBAC3B,UAAU,EAAE,CAAC,GAAG,gBAAgB,EAAE,eAAe,CAAC;gBAClD,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;aACrC,CAAC;SACH;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,CAAC,GAAuB,EAAE,GAAW,EAAE,KAAU;QACxD,IAAI,GAAG,KAAK,eAAe,EAAE;YAC3B,KAAK,MAAM,WAAW,IAAI,KAAK,EAAE;gBAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;oBAC7B,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;oBAE9C,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;wBAChC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,6DAA6D,CAAC,CAAC;qBACnH;oBAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;wBAC3B,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,wDAAwD,CAAC,CAAC;qBAC9G;oBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;wBACrC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAChD,wFAAwF,CACzF,CAAC;qBACH;iBACF;aACF;SACF;IACH,CAAC;CACF,CAAA;AArDC;IAAC,QAAQ,CAAC,+BAA+B,EAAE,KAAK,CAAC;;8DACvB;AAE1B;IAAC,MAAM,CAAC,MAAM,CAAC;8BACG,MAAM;6DAAC;AALd,6BAA6B;IADzC,MAAM,EAAE;IAQM,WAAA,MAAM,CAAC,yBAAyB,CAAC,CAAA;;GAPnC,6BAA6B,CAsDzC;SAtDY,6BAA6B"}

package/lib/esm/index.js

@@ -0,0 +1,6 @@
+/**
+ * @file Automatically generated by barrelsby.
+ */
+export * from "./OidcWildcardRedirectUriModule.js";
+export * from "./utils/wildcardRedirectUriAllowed.js";
+//# sourceMappingURL=index.js.map

package/lib/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC"}

package/lib/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/lib/esm/utils/wildcardRedirectUriAllowed.js

@@ -0,0 +1,17 @@
+// @ts-ignore
+import wildcard from "wildcard";
+const hasWildcardHost = (redirectUri) => {
+    const { hostname } = new URL(redirectUri);
+    return hostname.includes("*");
+};
+const wildcardMatches = (redirectUri, wildcardUri) => !!wildcard(wildcardUri, redirectUri);
+export function wildcardRedirectUriAllowed(originalRedirectUriAllowed) {
+    return function (redirectUri) {
+        if (this.redirectUris.some(hasWildcardHost)) {
+            const wildcardUris = this.redirectUris.filter(hasWildcardHost);
+            return wildcardUris.some(wildcardMatches.bind(undefined, redirectUri)) || originalRedirectUriAllowed.call(this, redirectUri);
+        }
+        return originalRedirectUriAllowed.call(this, redirectUri);
+    };
+}
+//# sourceMappingURL=wildcardRedirectUriAllowed.js.map

package/lib/esm/utils/wildcardRedirectUriAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcardRedirectUriAllowed.js","sourceRoot":"","sources":["../../../src/utils/wildcardRedirectUriAllowed.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC9C,MAAM,EAAC,QAAQ,EAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,WAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE3G,MAAM,UAAU,0BAA0B,CAAC,0BAA+B;IACxE,OAAO,UAAU,WAAmB;QAClC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,OAAO,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;SAC9H;QACD,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5D,CAAC,CAAC;AACJ,CAAC"}