@tsed/oidc-provider-plugin-wildcard-redirect-uri 8.0.0 → 8.0.2

package/package.json

@@ -2,13 +2,14 @@
   "name": "@tsed/oidc-provider-plugin-wildcard-redirect-uri",
   "description": "A plugin to support wildcard in the redirect uri whitelist",
   "type": "module",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "source": "./src/index.ts",
   "main": "./lib/esm/index.js",
   "module": "./lib/esm/index.js",
   "typings": "./lib/types/index.d.ts",
   "exports": {
     ".": {
+      "@tsed/source": "./src/index.ts",
       "types": "./lib/types/index.d.ts",
       "import": "./lib/esm/index.js",
       "default": "./lib/esm/index.js"
@@ -27,11 +28,11 @@
     "wildcard": "2.0.1"
   },
   "devDependencies": {
-    "@tsed/barrels": "8.0.0",
-    "@tsed/core": "8.0.0",
-    "@tsed/di": "8.0.0",
-    "@tsed/oidc-provider": "8.0.0",
-    "@tsed/typescript": "8.0.0",
+    "@tsed/barrels": "8.0.2",
+    "@tsed/core": "8.0.2",
+    "@tsed/di": "8.0.2",
+    "@tsed/oidc-provider": "8.0.2",
+    "@tsed/typescript": "8.0.2",
     "@types/psl": "^1.1.3",
     "@types/uuid": "10.0.0",
     "eslint": "9.12.0",
@@ -39,10 +40,10 @@
     "vitest": "2.1.2"
   },
   "peerDependencies": {
-    "@tsed/core": "8.0.0",
-    "@tsed/di": "8.0.0",
+    "@tsed/core": "8.0.2",
+    "@tsed/di": "8.0.2",
     "@tsed/logger": ">=6.7.5",
-    "@tsed/oidc-provider": "8.0.0",
+    "@tsed/oidc-provider": "8.0.2",
     "oidc-provider": ">=8.0.0"
   },
   "peerDependenciesMeta": {

package/src/OidcWildcardRedirectUriModule.spec.ts

@@ -0,0 +1,133 @@
+import {catchError} from "@tsed/core";
+import {PlatformTest} from "@tsed/platform-http/testing";
+import {errors, KoaContextWithOIDC} from "oidc-provider";
+
+import {OidcWildcardRedirectUriModule} from "./OidcWildcardRedirectUriModule.js";
+import InvalidClientMetadata = errors.InvalidClientMetadata;
+
+describe("WildcardRedirectUriAllowed", () => {
+  beforeEach(() =>
+    PlatformTest.create({
+      oidc: {
+        plugins: {
+          wildcard: {
+            enabled: true
+          }
+        }
+      }
+    })
+  );
+  afterEach(() => PlatformTest.reset());
+
+  describe("$onCreateOIDC()", () => {
+    it("should configure the oidc provider", async () => {
+      const originalRedirectUriAllowed = vi.fn();
+      const originalPostLogoutRedirectUriAllowed = vi.fn();
+      const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+      const provider: any = {
+        Client: {
+          prototype: {
+            redirectUriAllowed: originalRedirectUriAllowed,
+            postLogoutRedirectUriAllowed: originalPostLogoutRedirectUriAllowed
+          }
+        }
+      };
+
+      await service.$onCreateOIDC(provider as any);
+
+      expect(provider.Client.prototype.redirectUriAllowed).not.toEqual(originalRedirectUriAllowed);
+      expect(provider.Client.prototype.postLogoutRedirectUriAllowed).not.toEqual(originalPostLogoutRedirectUriAllowed);
+    });
+  });
+  describe("$alterOidcConfiguration()", () => {
+    it("should alter configuration", async () => {
+      const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+      const config: any = {};
+
+      await service.$alterOidcConfiguration(config);
+
+      expect(config.extraClientMetadata.properties).toEqual(["redirect_uris", "post_logout_redirect_uris"]);
+      expect(config.extraClientMetadata.validator).toBeInstanceOf(Function);
+    });
+  });
+  describe("validator()", () => {
+    describe("for redirect_uris", () => {
+      it("should do nothing if key is not redirect_uris", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+        service.validator({} as KoaContextWithOIDC, "key", "value");
+      });
+      it("should throw an error if one of client redirect_uri contains more than one '*'", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() =>
+          service.validator({} as KoaContextWithOIDC, "redirect_uris", ["https://*.test.com/callback/*"])
+        );
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_redirect_uri");
+        expect(error.error_description).toEqual("redirect_uris with a wildcard may only contain a single one");
+      });
+      it("should throw an error if one of client redirect_uri contains one '*' but not in hostname", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() =>
+          service.validator({} as KoaContextWithOIDC, "redirect_uris", ["https://redirect.test.com/callback/*"])
+        );
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_redirect_uri");
+        expect(error.error_description).toEqual("redirect_uris may only have a wildcard in the hostname");
+      });
+      it("should throw an error if one of client redirect_uri contains one '*' as hostname prefix", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() => service.validator({} as KoaContextWithOIDC, "redirect_uris", ["https://prefix.*/callback"]));
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_redirect_uri");
+        expect(error.error_description).toEqual("redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain");
+      });
+    });
+    describe("for post_logout_redirect_uris", () => {
+      it("should do nothing if key is not redirect_uris", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+        service.validator({} as KoaContextWithOIDC, "key", "value");
+      });
+      it("should throw an error if one of client post_logout_redirect_uris contains more than one '*'", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() =>
+          service.validator({} as KoaContextWithOIDC, "post_logout_redirect_uris", ["https://*.test.com/callback/*"])
+        );
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_client_metadata");
+        expect(error.error_description).toEqual("post_logout_redirect_uris with a wildcard may only contain a single one");
+      });
+      it("should throw an error if one of client post_logout_redirect_uris contains one '*' but not in hostname", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() =>
+          service.validator({} as KoaContextWithOIDC, "post_logout_redirect_uris", ["https://redirect.test.com/callback/*"])
+        );
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_client_metadata");
+        expect(error.error_description).toEqual("post_logout_redirect_uris may only have a wildcard in the hostname");
+      });
+      it("should throw an error if one of client post_logout_redirect_uris contains one '*' as hostname prefix", () => {
+        const service = PlatformTest.get<OidcWildcardRedirectUriModule>(OidcWildcardRedirectUriModule);
+
+        const error = catchError<any>(() =>
+          service.validator({} as KoaContextWithOIDC, "post_logout_redirect_uris", ["https://prefix.*/callback"])
+        );
+
+        expect(error).toBeInstanceOf(InvalidClientMetadata);
+        expect(error.message).toEqual("invalid_client_metadata");
+        expect(error.error_description).toEqual(
+          "post_logout_redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain"
+        );
+      });
+    });
+  });
+});

package/src/OidcWildcardRedirectUriModule.ts

@@ -0,0 +1,92 @@
+import {constant, logger, Module} from "@tsed/di";
+import {OidcSettings} from "@tsed/oidc-provider";
+import Provider, {errors, type KoaContextWithOIDC} from "oidc-provider";
+// @ts-ignore
+import psl from "psl";
+
+import {wildcardRedirectUriAllowed} from "./utils/wildcardRedirectUriAllowed.js";
+
+declare global {
+  namespace TsED {
+    interface OIDCPluginSettings {
+      wildcard: {
+        enabled?: boolean;
+      };
+    }
+  }
+}
+
+@Module()
+export class OidcWildcardRedirectUriModule {
+  readonly enabled = constant<boolean>("oidc.plugins.wildcard.enabled", false);
+
+  $onCreateOIDC(provider: Provider) {
+    if (this.enabled) {
+      const {redirectUriAllowed, postLogoutRedirectUriAllowed} = provider.Client.prototype;
+      provider.Client.prototype.redirectUriAllowed = wildcardRedirectUriAllowed(redirectUriAllowed, "redirectUris");
+      provider.Client.prototype.postLogoutRedirectUriAllowed = wildcardRedirectUriAllowed(
+        postLogoutRedirectUriAllowed,
+        "postLogoutRedirectUris"
+      );
+
+      logger().warn("⚠️⚠️⚠️ OIDC Wildcard Uris plugin is ENABLED ⚠️⚠️⚠️");
+    }
+  }
+
+  $alterOidcConfiguration(config: OidcSettings): Promise<OidcSettings> {
+    if (this.enabled) {
+      const actualProperties = config?.extraClientMetadata?.properties || [];
+
+      config.extraClientMetadata = {
+        properties: [...actualProperties, "redirect_uris", "post_logout_redirect_uris"],
+        validator: this.validator.bind(this)
+      };
+    }
+
+    return Promise.resolve(config);
+  }
+
+  validator(ctx: KoaContextWithOIDC, key: string, value: any) {
+    if (key === "redirect_uris") {
+      for (const redirectUri of value) {
+        if (redirectUri.includes("*")) {
+          const {hostname, href} = new URL(redirectUri);
+
+          if (href.split("*").length !== 2) {
+            throw new errors.InvalidClientMetadata("redirect_uris with a wildcard may only contain a single one");
+          }
+
+          if (!hostname.includes("*")) {
+            throw new errors.InvalidClientMetadata("redirect_uris may only have a wildcard in the hostname");
+          }
+
+          if (!psl.get(hostname.split("*.")[1])) {
+            throw new errors.InvalidClientMetadata(
+              "redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain"
+            );
+          }
+        }
+      }
+    } else if (key === "post_logout_redirect_uris") {
+      for (const postLogoutRedirectUri of value) {
+        if (postLogoutRedirectUri.includes("*")) {
+          const {hostname, href} = new URL(postLogoutRedirectUri);
+
+          if (href.split("*").length !== 2) {
+            throw new errors.InvalidClientMetadata("post_logout_redirect_uris with a wildcard may only contain a single one");
+          }
+
+          if (!hostname.includes("*")) {
+            throw new errors.InvalidClientMetadata("post_logout_redirect_uris may only have a wildcard in the hostname");
+          }
+
+          if (!psl.get(hostname.split("*.")[1])) {
+            throw new errors.InvalidClientMetadata(
+              "post_logout_redirect_uris with a wildcard must not match an eTLD+1 of a known public suffix domain"
+            );
+          }
+        }
+      }
+    }
+  }
+}

package/src/index.ts

@@ -0,0 +1,5 @@
+/**
+ * @file Automatically generated by @tsed/barrels.
+ */
+export * from "./OidcWildcardRedirectUriModule.js";
+export * from "./utils/wildcardRedirectUriAllowed.js";

package/src/utils/wildcardRedirectUriAllowed.spec.ts

@@ -0,0 +1,48 @@
+import {wildcardRedirectUriAllowed} from "./wildcardRedirectUriAllowed.js";
+
+describe("wildcardRedirectUriAllowed()", () => {
+  it("should call the original function if there is no wildcard in client redirect_uris", () => {
+    const originalRedirectUriAllowed = vi.fn();
+    wildcardRedirectUriAllowed(originalRedirectUriAllowed, "redirectUris").call(
+      {
+        redirectUris: ["https://redirect.test.com"]
+      },
+      "https://redirect.test.com"
+    );
+    expect(originalRedirectUriAllowed).toHaveBeenCalledWith("https://redirect.test.com");
+  });
+
+  it("should return original function result if client has wildcard uris but not used", () => {
+    const originalRedirectUriAllowed = vi.fn().mockReturnValue(true);
+    const result = wildcardRedirectUriAllowed(originalRedirectUriAllowed, "redirectUris").call(
+      {
+        redirectUris: ["https://test.com/titi", "https://*.test.com/toto"]
+      },
+      "https://test.com/titi"
+    );
+    expect(originalRedirectUriAllowed).toHaveBeenCalledWith("https://test.com/titi");
+    expect(result).toEqual(true);
+  });
+  it("should return true if the redirect_uri match client redirect_uri with wildcard", () => {
+    const originalRedirectUriAllowed = vi.fn();
+    const result = wildcardRedirectUriAllowed(originalRedirectUriAllowed, "redirectUris").call(
+      {
+        redirectUris: ["https://*.test.com/"]
+      },
+      "https://toto.test.com/"
+    );
+    expect(originalRedirectUriAllowed).not.toHaveBeenCalledWith();
+    expect(result).toEqual(true);
+  });
+  it("should return true if the post_logout_redirect_uri match client redirect_uri with wildcard", () => {
+    const originalRedirectUriAllowed = vi.fn();
+    const result = wildcardRedirectUriAllowed(originalRedirectUriAllowed, "postLogoutRedirectUris").call(
+      {
+        postLogoutRedirectUris: ["https://*.test.com/"]
+      },
+      "https://toto.test.com/"
+    );
+    expect(originalRedirectUriAllowed).not.toHaveBeenCalledWith();
+    expect(result).toEqual(true);
+  });
+});

package/src/utils/wildcardRedirectUriAllowed.ts

@@ -0,0 +1,22 @@
+// @ts-ignore
+import wildcard from "wildcard";
+
+const hasWildcardHost = (redirectUri: string) => {
+  const {hostname} = new URL(redirectUri);
+  return hostname.includes("*");
+};
+
+const wildcardMatches = (redirectUri: string, wildcardUri: string) => !!wildcard(wildcardUri, redirectUri);
+
+export function wildcardRedirectUriAllowed(
+  originalRedirectUriAllowed: any,
+  redirectUriOrPostLogoutRedirectUri: "redirectUris" | "postLogoutRedirectUris"
+) {
+  return function (redirectUri: string) {
+    if (this[redirectUriOrPostLogoutRedirectUri].some(hasWildcardHost)) {
+      const wildcardUris = this[redirectUriOrPostLogoutRedirectUri].filter(hasWildcardHost);
+      return wildcardUris.some(wildcardMatches.bind(undefined, redirectUri)) || originalRedirectUriAllowed.call(this, redirectUri);
+    }
+    return originalRedirectUriAllowed.call(this, redirectUri);
+  };
+}