@udibo/oauth2 0.9.2 → 0.11.0

package/esm/testing/tenant.js

@@ -1,9 +1,10 @@
 import { AuthorizationCodeGrant } from "../server/grants/authorization-code.js";
+import { ClientCredentialsGrant, } from "../server/grants/client-credentials.js";
 import { RefreshTokenGrant } from "../server/grants/refresh-token.js";
 import { AuthorizationServer } from "../server/authorization-server.js";
 import { createJwtAccessTokenGenerator, generateSigningKey, StaticSigningKeyProvider, } from "../server/signing-keys.js";
 import { BasicScope } from "../models/scope.js";
-import { InvalidRequestError } from "../errors.js";
+import { AccessDeniedError, InvalidClientError, InvalidRequestError, } from "../errors.js";
 import { safeReturnTo } from "../utils/url.js";
 import { MemoryAuthorizationCodeService, MemoryClientService, MemoryTokenService, MemoryUserService, } from "./services.js";
 const PATHS = {
@@ -30,10 +31,56 @@ const BUILT_IN_ROLES = [
     { slug: "admin", name: "Admin" },
     { slug: "member", name: "Member" },
 ];
+const ORGANIZATIONS_READ = "identity:organizations:read";
+const MACHINE_SCOPES = [
+    ORGANIZATIONS_READ,
+    "identity:organizations:write",
+];
+const OIDC_SCOPES = ["openid", "profile", "email"];
+const RESOURCE_GRANTS_READ = "resource_grants.read";
+const RESOURCE_TYPE_MAX_LENGTH = 64;
+const RESOURCE_ID_MAX_LENGTH = 255;
+// deno-lint-ignore no-control-regex
+const ASCII_CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/;
+const UNSTATED_ALLOWLIST = "A client_credentials application has to state the scopes its tokens may " +
+    "be granted: pass `scopes`, an empty list to deny every scope.";
+const ORGANIZATION_ID_REFUSAL = "organization_id is only accepted on the refresh_token grant";
+const USER_TOKEN_REFUSAL = "Resource grants are placed and read by your application, not by the person " +
+    "using it. Call this with your application's own client credentials after " +
+    "deciding, in your own logic, that the share is allowed.";
+const MACHINE_TOKEN_REFUSAL = "A machine credential has no self to answer for.";
 const OWNER = "owner";
 const MANAGER_ROLES = ["owner", "admin"];
 const DEFAULT_ROLES = ["member"];
 const ORGANIZATION_NOT_FOUND = "Organization not found";
+class ConfidentialClientCredentialsGrant extends ClientCredentialsGrant {
+    isConfidential;
+    constructor(options, isConfidential) {
+        super(options);
+        this.isConfidential = isConfidential;
+    }
+    async getAuthenticatedClient(request, body) {
+        const client = await super.getAuthenticatedClient(request, body);
+        if (!this.isConfidential(client)) {
+            throw new InvalidClientError("client authentication failed");
+        }
+        return client;
+    }
+}
+function machineScopeCeiling(client) {
+    return client.scopes?.filter((scope) => MACHINE_SCOPES.includes(scope)) ??
+        [];
+}
+function isBuiltInRole(slug) {
+    return BUILT_IN_ROLES.some((role) => role.slug === slug);
+}
+function roleSlugOf(permissions) {
+    const slug = permissions
+        .map((permission) => permission.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""))
+        .filter(Boolean)
+        .join("-");
+    return slug || "grant";
+}
 class TenantTokenService extends MemoryTokenService {
     issuanceOf;
     recordCredential;
@@ -44,9 +91,19 @@ class TenantTokenService extends MemoryTokenService {
         this.recordCredential = recordCredential;
         this.mintJwt = mintJwt;
     }
+    acceptedScope(client, user, scope) {
+        if (!scope || user)
+            return Promise.resolve(scope);
+        const requested = [...scope];
+        if (requested.some((name) => OIDC_SCOPES.includes(name))) {
+            return Promise.resolve(false);
+        }
+        const ceiling = machineScopeCeiling(client);
+        return Promise.resolve(requested.every((name) => ceiling.includes(name)) ? scope : false);
+    }
     async generateAccessToken(client, user, scope) {
         const issuance = (user ? this.issuanceOf(user.id) : undefined) ?? {};
-        const accessToken = client.accessTokenFormat === "jwt" && user
+        const accessToken = client.accessTokenFormat === "jwt"
             ? await this.mintJwt(client, user, scope, issuance.organizationId)
             : await super.generateAccessToken(client, user, scope);
         this.recordCredential(accessToken, issuance, client);
@@ -220,6 +277,7 @@ export async function createFakeTenant(options) {
     const invitations = new Map();
     const resourceTypes = new Set();
     const grants = [];
+    const resourceRoleIds = new Map();
     const loginSessions = new Map();
     const linkedAccounts = new Map();
     const credentials = new Map();
@@ -257,6 +315,8 @@ export async function createFakeTenant(options) {
         };
     };
     const userService = new MemoryUserService();
+    const confidentialClients = new Set();
+    const isConfidential = (client) => confidentialClients.has(client.id);
     const clientService = new MemoryClientService(userService);
     const tokenService = new TenantTokenService({ clientService, userService }, (userId) => pendingIssuance.get(userId), (accessToken, issuance, client) => credentials.set(accessToken, {
         ...issuance,
@@ -267,10 +327,12 @@ export async function createFakeTenant(options) {
         signingKeys,
         issuer,
         audience: client.audience ?? client.id,
-        userClaims: () => ({
-            username: user.username,
-            ...authorizationClaims(user.id, organizationId),
-        }),
+        userClaims: user
+            ? () => ({
+                username: user.username,
+                ...authorizationClaims(user.id, organizationId),
+            })
+            : undefined,
     })(client, user, scope));
     const authorizationCodeService = new MemoryAuthorizationCodeService({ clientService, userService });
     const server = new AuthorizationServer({
@@ -296,9 +358,16 @@ export async function createFakeTenant(options) {
             refresh_token: new RefreshTokenGrant({
                 resolve: () => ({ clientService, tokenService }),
             }),
+            client_credentials: new ConfidentialClientCredentialsGrant({ resolve: () => ({ clientService, tokenService }) }, isConfidential),
         },
         signingKeys,
-        scopesSupported: ["openid", "profile", "email", "offline_access"],
+        scopesSupported: [
+            "openid",
+            "profile",
+            "email",
+            "offline_access",
+            ...MACHINE_SCOPES,
+        ],
         userClaims: (user) => ({
             preferred_username: user.username,
             name: user.name,
@@ -306,10 +375,12 @@ export async function createFakeTenant(options) {
             email_verified: user.email ? user.emailVerified ?? true : undefined,
             ...organizationClaims(user.id, signedIn?.userId === user.id ? signedIn.organizationId : undefined),
         }),
+        canIntrospectToken: (client, token) => isConfidential(client) && client.id === token.client.id,
         introspectionClaims: (token) => token.user
             ? authorizationClaims(token.user.id, credentials.get(token.accessToken)?.organizationId)
             : {},
     });
+    const isMachineToken = (token) => !token.user;
     const withIssuance = async (userId, issuance, work) => {
         if (!userId)
             return await work();
@@ -337,7 +408,7 @@ export async function createFakeTenant(options) {
             return server.handleAuthError(error);
         }
         if (!token.user) {
-            return problem(403, "A machine credential has no self to answer for.", machineRefusal);
+            return problem(403, MACHINE_TOKEN_REFUSAL, machineRefusal);
         }
         const user = users.get(token.user.id) ?? token.user;
         const organizationId = credentials.get(token.accessToken)?.organizationId;
@@ -363,8 +434,9 @@ export async function createFakeTenant(options) {
         return held;
     };
     const answer = (asked, held) => Object.fromEntries(asked.map((p) => [p, held.has(p)]));
+    const personOnly = { reason: "machine_token" };
     const check = async (request) => {
-        const caller = await authenticated(request);
+        const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return caller;
         const body = await request.json().catch(() => null);
@@ -404,7 +476,7 @@ export async function createFakeTenant(options) {
         });
     };
     const checkBatch = async (request) => {
-        const caller = await authenticated(request);
+        const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return caller;
         const body = await request.json().catch(() => null);
@@ -445,7 +517,7 @@ export async function createFakeTenant(options) {
         return organization.id;
     };
     const memberships = async (request) => {
-        const caller = await authenticated(request);
+        const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return caller;
         return Response.json({
@@ -540,6 +612,17 @@ export async function createFakeTenant(options) {
     };
     const token = async (request) => {
         const form = await request.clone().formData().catch(() => null);
+        const organizationId = form?.get("organization_id");
+        if (typeof organizationId === "string" && organizationId.length > 0 &&
+            form?.get("grant_type") !== "refresh_token") {
+            return Response.json({
+                error: "invalid_request",
+                error_description: ORGANIZATION_ID_REFUSAL,
+            }, {
+                status: 400,
+                headers: { "cache-control": "no-store", pragma: "no-cache" },
+            });
+        }
         const code = form?.get("code");
         const refreshToken = form?.get("refresh_token");
         const signIn = typeof code === "string"
@@ -1001,11 +1084,23 @@ export async function createFakeTenant(options) {
         });
     });
     const accountApi = (handler) => async (request, params) => {
-        const caller = await authenticated(request, { reason: "machine_token" });
+        const caller = await authenticated(request, personOnly);
         if (caller instanceof Response)
             return noStore(caller);
         return noStore(await handler(caller, request, params));
     };
+    const userinfo = async (request) => {
+        try {
+            const { token } = await server.authenticate(request);
+            if (isMachineToken(token)) {
+                throw new AccessDeniedError("client credentials have no end user");
+            }
+        }
+        catch (error) {
+            return server.handleAuthError(error);
+        }
+        return await server.handleUserInfoRequest(request);
+    };
     const readAccount = accountApi((caller) => Response.json({
         userMetadata: userMetadata.get(caller.user.id) ?? {},
     }));
@@ -1109,6 +1204,70 @@ export async function createFakeTenant(options) {
         linkedAccounts.delete(account.id);
         return new Response(null, { status: 204 });
     });
+    const machineCaller = async (request) => {
+        let token;
+        try {
+            ({ token } = await server.authenticate(request));
+        }
+        catch (error) {
+            return server.handleAuthError(error);
+        }
+        if (!isMachineToken(token)) {
+            return problem(403, USER_TOKEN_REFUSAL, { reason: "user_token" });
+        }
+        return {
+            client: token.client,
+            scopes: token.scope ? [...token.scope] : [],
+        };
+    };
+    const resourceGrantJson = (grant) => {
+        const holder = grant.subject.type === "user"
+            ? users.get(grant.subject.id)
+            : undefined;
+        const organization = grant.subject.type === "organization"
+            ? organizations.get(grant.subject.id)
+            : undefined;
+        return {
+            id: grant.id,
+            subjectType: grant.subject.type,
+            subjectId: grant.subject.id,
+            subjectRole: null,
+            subjectName: holder
+                ? holder.name ?? holder.username
+                : organization?.name ?? null,
+            subjectActive: holder !== undefined || organization !== undefined,
+            roleId: grant.roleId,
+            builtInRole: isBuiltInRole(grant.role) ? grant.role : null,
+            roleSlug: grant.role,
+            roleName: roleName(grant.role),
+        };
+    };
+    const listResourceGrants = async (request) => {
+        const caller = await machineCaller(request);
+        if (caller instanceof Response)
+            return noStore(caller);
+        if (!caller.scopes.includes(ORGANIZATIONS_READ) ||
+            !caller.client.machinePermissions?.includes(RESOURCE_GRANTS_READ)) {
+            return noStore(problem(404, "Not found"));
+        }
+        const params = new URL(request.url).searchParams;
+        const type = params.get("type");
+        const id = params.get("id");
+        if (!type || type.length > RESOURCE_TYPE_MAX_LENGTH || !id ||
+            id.length > RESOURCE_ID_MAX_LENGTH || ASCII_CONTROL_CHARACTERS.test(id)) {
+            return noStore(invalid("resource", "Pass the resource as `type` and `id` query parameters."));
+        }
+        if (!resourceTypes.has(type)) {
+            return noStore(invalid("type", `No resource type "${type}" is registered for this tenant.`));
+        }
+        return noStore(Response.json({
+            resource: { type, id },
+            grants: grants
+                .filter((grant) => grant.resource.type === type && grant.resource.id === id)
+                .map(resourceGrantJson)
+                .sort((a, b) => a.roleName.localeCompare(b.roleName)),
+        }));
+    };
     const routes = {
         "GET /.well-known/oauth-authorization-server": (r) => server.handleMetadataRequest(r),
         "GET /.well-known/openid-configuration": (r) => server.handleOidcMetadataRequest(r),
@@ -1116,12 +1275,13 @@ export async function createFakeTenant(options) {
         [`POST ${PATHS.token}`]: token,
         [`POST ${PATHS.revocation}`]: revocation,
         [`POST ${PATHS.introspection}`]: (r) => server.handleIntrospectionRequest(r),
-        [`GET ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
-        [`POST ${PATHS.userinfo}`]: (r) => server.handleUserInfoRequest(r),
+        [`GET ${PATHS.userinfo}`]: userinfo,
+        [`POST ${PATHS.userinfo}`]: userinfo,
         [`GET ${PATHS.jwks}`]: (r) => server.handleJwksRequest(r),
         "GET /api/memberships": memberships,
         "POST /api/check": check,
         "POST /api/check/batch": checkBatch,
+        "GET /api/resource-grants": listResourceGrants,
     };
     const segment = "([^/]+)";
     const patterns = [
@@ -1218,10 +1378,17 @@ export async function createFakeTenant(options) {
         issuer,
         fetch: (request) => route(request) ?? Promise.resolve(problem(404, "Not found")),
         addClient: async ({ secret, ...client }) => {
-            await clientService.add({
+            const registered = {
                 grants: ["authorization_code", "refresh_token"],
                 ...client,
-            }, secret);
+            };
+            if (registered.grants?.includes("client_credentials") &&
+                registered.scopes === undefined) {
+                throw new Error(UNSTATED_ALLOWLIST);
+            }
+            await clientService.add(registered, secret);
+            if (secret)
+                confidentialClients.add(registered.id);
             for (const uri of client.redirectUris ?? []) {
                 try {
                     redirectOrigins.add(new URL(uri).origin);
@@ -1285,7 +1452,13 @@ export async function createFakeTenant(options) {
             resourceTypes.add(type);
         },
         grant: (grant) => {
-            grants.push(grant);
+            const role = grant.role ?? roleSlugOf(grant.permissions);
+            let roleId = isBuiltInRole(role) ? null : resourceRoleIds.get(role);
+            if (roleId === undefined) {
+                roleId = crypto.randomUUID();
+                resourceRoleIds.set(role, roleId);
+            }
+            grants.push({ ...grant, id: crypto.randomUUID(), role, roleId });
         },
         linkAccount: (userId, account) => {
             if (!users.has(userId)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",