@unwanted/matrix-sdk-mini 34.12.0-1

package/lib/oidc/register.js

@@ -0,0 +1,96 @@
+import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { OidcError } from "./error.js";
+import { Method } from "../http-api/index.js";
+import { logger } from "../logger.js";
+
+/**
+ * Client metadata passed to registration endpoint
+ */
+
+/**
+ * Request body for dynamic registration as defined by https://github.com/matrix-org/matrix-spec-proposals/pull/2966
+ */
+
+export var DEVICE_CODE_SCOPE = "urn:ietf:params:oauth:grant-type:device_code";
+
+/**
+ * Attempts dynamic registration against the configured registration endpoint
+ * @param delegatedAuthConfig - Auth config from {@link discoverAndValidateOIDCIssuerWellKnown}
+ * @param clientMetadata - The metadata for the client which to register
+ * @returns Promise<string> resolved with registered clientId
+ * @throws when registration is not supported, on failed request or invalid response
+ */
+export var registerOidcClient = /*#__PURE__*/function () {
+  var _ref = _asyncToGenerator(function* (delegatedAuthConfig, clientMetadata) {
+    if (!delegatedAuthConfig.registrationEndpoint) {
+      throw new Error(OidcError.DynamicRegistrationNotSupported);
+    }
+    var grantTypes = ["authorization_code", "refresh_token"];
+    if (grantTypes.some(scope => !delegatedAuthConfig.metadata.grant_types_supported.includes(scope))) {
+      throw new Error(OidcError.DynamicRegistrationNotSupported);
+    }
+
+    // https://openid.net/specs/openid-connect-registration-1_0.html
+    var metadata = {
+      client_name: clientMetadata.clientName,
+      client_uri: clientMetadata.clientUri,
+      response_types: ["code"],
+      grant_types: grantTypes,
+      redirect_uris: clientMetadata.redirectUris,
+      id_token_signed_response_alg: "RS256",
+      token_endpoint_auth_method: "none",
+      application_type: clientMetadata.applicationType,
+      logo_uri: clientMetadata.logoUri,
+      contacts: clientMetadata.contacts,
+      policy_uri: clientMetadata.policyUri,
+      tos_uri: clientMetadata.tosUri
+    };
+    var headers = {
+      "Accept": "application/json",
+      "Content-Type": "application/json"
+    };
+    try {
+      var response = yield fetch(delegatedAuthConfig.registrationEndpoint, {
+        method: Method.Post,
+        headers,
+        body: JSON.stringify(metadata)
+      });
+      if (response.status >= 400) {
+        throw new Error(OidcError.DynamicRegistrationFailed);
+      }
+      var body = yield response.json();
+      var clientId = body["client_id"];
+      if (!clientId || typeof clientId !== "string") {
+        throw new Error(OidcError.DynamicRegistrationInvalid);
+      }
+      return clientId;
+    } catch (error) {
+      if (Object.values(OidcError).includes(error.message)) {
+        throw error;
+      } else {
+        logger.error("Dynamic registration request failed", error);
+        throw new Error(OidcError.DynamicRegistrationFailed);
+      }
+    }
+  });
+  return function registerOidcClient(_x, _x2) {
+    return _ref.apply(this, arguments);
+  };
+}();
+//# sourceMappingURL=register.js.map

package/lib/oidc/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","names":["OidcError","Method","logger","DEVICE_CODE_SCOPE","registerOidcClient","_ref","_asyncToGenerator","delegatedAuthConfig","clientMetadata","registrationEndpoint","Error","DynamicRegistrationNotSupported","grantTypes","some","scope","metadata","grant_types_supported","includes","client_name","clientName","client_uri","clientUri","response_types","grant_types","redirect_uris","redirectUris","id_token_signed_response_alg","token_endpoint_auth_method","application_type","applicationType","logo_uri","logoUri","contacts","policy_uri","policyUri","tos_uri","tosUri","headers","response","fetch","method","Post","body","JSON","stringify","status","DynamicRegistrationFailed","json","clientId","DynamicRegistrationInvalid","error","Object","values","message","_x","_x2","apply","arguments"],"sources":["../../src/oidc/register.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { OidcClientConfig } from \"./index.ts\";\nimport { OidcError } from \"./error.ts\";\nimport { Method } from \"../http-api/index.ts\";\nimport { logger } from \"../logger.ts\";\nimport { NonEmptyArray } from \"../@types/common.ts\";\n\n/**\n * Client metadata passed to registration endpoint\n */\nexport type OidcRegistrationClientMetadata = {\n    clientName: OidcRegistrationRequestBody[\"client_name\"];\n    clientUri: OidcRegistrationRequestBody[\"client_uri\"];\n    logoUri?: OidcRegistrationRequestBody[\"logo_uri\"];\n    applicationType: OidcRegistrationRequestBody[\"application_type\"];\n    redirectUris: OidcRegistrationRequestBody[\"redirect_uris\"];\n    contacts: OidcRegistrationRequestBody[\"contacts\"];\n    tosUri: OidcRegistrationRequestBody[\"tos_uri\"];\n    policyUri: OidcRegistrationRequestBody[\"policy_uri\"];\n};\n\n/**\n * Request body for dynamic registration as defined by https://github.com/matrix-org/matrix-spec-proposals/pull/2966\n */\ninterface OidcRegistrationRequestBody {\n    client_name?: string;\n    client_uri: string;\n    logo_uri?: string;\n    contacts?: string[];\n    tos_uri?: string;\n    policy_uri?: string;\n    redirect_uris?: NonEmptyArray<string>;\n    response_types?: NonEmptyArray<string>;\n    grant_types?: NonEmptyArray<string>;\n    id_token_signed_response_alg?: string;\n    token_endpoint_auth_method: string;\n    application_type: \"web\" | \"native\";\n}\n\nexport const DEVICE_CODE_SCOPE = \"urn:ietf:params:oauth:grant-type:device_code\";\n\n/**\n * Attempts dynamic registration against the configured registration endpoint\n * @param delegatedAuthConfig - Auth config from {@link discoverAndValidateOIDCIssuerWellKnown}\n * @param clientMetadata - The metadata for the client which to register\n * @returns Promise<string> resolved with registered clientId\n * @throws when registration is not supported, on failed request or invalid response\n */\nexport const registerOidcClient = async (\n    delegatedAuthConfig: OidcClientConfig,\n    clientMetadata: OidcRegistrationClientMetadata,\n): Promise<string> => {\n    if (!delegatedAuthConfig.registrationEndpoint) {\n        throw new Error(OidcError.DynamicRegistrationNotSupported);\n    }\n\n    const grantTypes: NonEmptyArray<string> = [\"authorization_code\", \"refresh_token\"];\n    if (grantTypes.some((scope) => !delegatedAuthConfig.metadata.grant_types_supported.includes(scope))) {\n        throw new Error(OidcError.DynamicRegistrationNotSupported);\n    }\n\n    // https://openid.net/specs/openid-connect-registration-1_0.html\n    const metadata: OidcRegistrationRequestBody = {\n        client_name: clientMetadata.clientName,\n        client_uri: clientMetadata.clientUri,\n        response_types: [\"code\"],\n        grant_types: grantTypes,\n        redirect_uris: clientMetadata.redirectUris,\n        id_token_signed_response_alg: \"RS256\",\n        token_endpoint_auth_method: \"none\",\n        application_type: clientMetadata.applicationType,\n        logo_uri: clientMetadata.logoUri,\n        contacts: clientMetadata.contacts,\n        policy_uri: clientMetadata.policyUri,\n        tos_uri: clientMetadata.tosUri,\n    };\n    const headers = {\n        \"Accept\": \"application/json\",\n        \"Content-Type\": \"application/json\",\n    };\n\n    try {\n        const response = await fetch(delegatedAuthConfig.registrationEndpoint, {\n            method: Method.Post,\n            headers,\n            body: JSON.stringify(metadata),\n        });\n\n        if (response.status >= 400) {\n            throw new Error(OidcError.DynamicRegistrationFailed);\n        }\n\n        const body = await response.json();\n        const clientId = body[\"client_id\"];\n        if (!clientId || typeof clientId !== \"string\") {\n            throw new Error(OidcError.DynamicRegistrationInvalid);\n        }\n\n        return clientId;\n    } catch (error) {\n        if (Object.values(OidcError).includes((error as Error).message as OidcError)) {\n            throw error;\n        } else {\n            logger.error(\"Dynamic registration request failed\", error);\n            throw new Error(OidcError.DynamicRegistrationFailed);\n        }\n    }\n};\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,SAAS,QAAQ,YAAY;AACtC,SAASC,MAAM,QAAQ,sBAAsB;AAC7C,SAASC,MAAM,QAAQ,cAAc;;AAGrC;AACA;AACA;;AAYA;AACA;AACA;;AAgBA,OAAO,IAAMC,iBAAiB,GAAG,8CAA8C;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMC,kBAAkB;EAAA,IAAAC,IAAA,GAAAC,iBAAA,CAAG,WAC9BC,mBAAqC,EACrCC,cAA8C,EAC5B;IAClB,IAAI,CAACD,mBAAmB,CAACE,oBAAoB,EAAE;MAC3C,MAAM,IAAIC,KAAK,CAACV,SAAS,CAACW,+BAA+B,CAAC;IAC9D;IAEA,IAAMC,UAAiC,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC;IACjF,IAAIA,UAAU,CAACC,IAAI,CAAEC,KAAK,IAAK,CAACP,mBAAmB,CAACQ,QAAQ,CAACC,qBAAqB,CAACC,QAAQ,CAACH,KAAK,CAAC,CAAC,EAAE;MACjG,MAAM,IAAIJ,KAAK,CAACV,SAAS,CAACW,+BAA+B,CAAC;IAC9D;;IAEA;IACA,IAAMI,QAAqC,GAAG;MAC1CG,WAAW,EAAEV,cAAc,CAACW,UAAU;MACtCC,UAAU,EAAEZ,cAAc,CAACa,SAAS;MACpCC,cAAc,EAAE,CAAC,MAAM,CAAC;MACxBC,WAAW,EAAEX,UAAU;MACvBY,aAAa,EAAEhB,cAAc,CAACiB,YAAY;MAC1CC,4BAA4B,EAAE,OAAO;MACrCC,0BAA0B,EAAE,MAAM;MAClCC,gBAAgB,EAAEpB,cAAc,CAACqB,eAAe;MAChDC,QAAQ,EAAEtB,cAAc,CAACuB,OAAO;MAChCC,QAAQ,EAAExB,cAAc,CAACwB,QAAQ;MACjCC,UAAU,EAAEzB,cAAc,CAAC0B,SAAS;MACpCC,OAAO,EAAE3B,cAAc,CAAC4B;IAC5B,CAAC;IACD,IAAMC,OAAO,GAAG;MACZ,QAAQ,EAAE,kBAAkB;MAC5B,cAAc,EAAE;IACpB,CAAC;IAED,IAAI;MACA,IAAMC,QAAQ,SAASC,KAAK,CAAChC,mBAAmB,CAACE,oBAAoB,EAAE;QACnE+B,MAAM,EAAEvC,MAAM,CAACwC,IAAI;QACnBJ,OAAO;QACPK,IAAI,EAAEC,IAAI,CAACC,SAAS,CAAC7B,QAAQ;MACjC,CAAC,CAAC;MAEF,IAAIuB,QAAQ,CAACO,MAAM,IAAI,GAAG,EAAE;QACxB,MAAM,IAAInC,KAAK,CAACV,SAAS,CAAC8C,yBAAyB,CAAC;MACxD;MAEA,IAAMJ,IAAI,SAASJ,QAAQ,CAACS,IAAI,CAAC,CAAC;MAClC,IAAMC,QAAQ,GAAGN,IAAI,CAAC,WAAW,CAAC;MAClC,IAAI,CAACM,QAAQ,IAAI,OAAOA,QAAQ,KAAK,QAAQ,EAAE;QAC3C,MAAM,IAAItC,KAAK,CAACV,SAAS,CAACiD,0BAA0B,CAAC;MACzD;MAEA,OAAOD,QAAQ;IACnB,CAAC,CAAC,OAAOE,KAAK,EAAE;MACZ,IAAIC,MAAM,CAACC,MAAM,CAACpD,SAAS,CAAC,CAACiB,QAAQ,CAAEiC,KAAK,CAAWG,OAAoB,CAAC,EAAE;QAC1E,MAAMH,KAAK;MACf,CAAC,MAAM;QACHhD,MAAM,CAACgD,KAAK,CAAC,qCAAqC,EAAEA,KAAK,CAAC;QAC1D,MAAM,IAAIxC,KAAK,CAACV,SAAS,CAAC8C,yBAAyB,CAAC;MACxD;IACJ;EACJ,CAAC;EAAA,gBA3DY1C,kBAAkBA,CAAAkD,EAAA,EAAAC,GAAA;IAAA,OAAAlD,IAAA,CAAAmD,KAAA,OAAAC,SAAA;EAAA;AAAA,GA2D9B","ignoreList":[]}

package/lib/oidc/tokenRefresher.d.ts

@@ -0,0 +1,69 @@
+import { IdTokenClaims } from "oidc-client-ts";
+import { AccessTokens } from "../http-api/index.ts";
+/**
+ * @experimental
+ * Class responsible for refreshing OIDC access tokens
+ *
+ * Client implementations will likely want to override {@link persistTokens} to persist tokens after successful refresh
+ *
+ */
+export declare class OidcTokenRefresher {
+    /**
+     * idTokenClaims as returned from authorization grant
+     * used to validate tokens
+     */
+    private readonly idTokenClaims;
+    /**
+     * Promise which will complete once the OidcClient has been initialised
+     * and is ready to start refreshing tokens.
+     *
+     * Will reject if the client initialisation fails.
+     */
+    readonly oidcClientReady: Promise<void>;
+    private oidcClient;
+    private inflightRefreshRequest?;
+    constructor(
+    /**
+     * The OIDC issuer as returned by the /auth_issuer API
+     */
+    issuer: string, 
+    /**
+     * id of this client as registered with the OP
+     */
+    clientId: string, 
+    /**
+     * redirectUri as registered with OP
+     */
+    redirectUri: string, 
+    /**
+     * Device ID of current session
+     */
+    deviceId: string, 
+    /**
+     * idTokenClaims as returned from authorization grant
+     * used to validate tokens
+     */
+    idTokenClaims: IdTokenClaims);
+    private initialiseOidcClient;
+    /**
+     * Attempt token refresh using given refresh token
+     * @param refreshToken - refresh token to use in request with token issuer
+     * @returns tokens - Promise that resolves with new access and refresh tokens
+     * @throws when token refresh fails
+     */
+    doRefreshAccessToken(refreshToken: string): Promise<AccessTokens>;
+    /**
+     * Persist the new tokens, called after tokens are successfully refreshed.
+     *
+     * This function is intended to be overriden by the consumer when persistence is necessary.
+     *
+     * @param tokens.accessToken - new access token
+     * @param tokens.refreshToken - OPTIONAL new refresh token
+     */
+    persistTokens(tokens: {
+        accessToken: string;
+        refreshToken?: string;
+    }): Promise<void>;
+    private getNewTokens;
+}
+//# sourceMappingURL=tokenRefresher.d.ts.map

package/lib/oidc/tokenRefresher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenRefresher.d.ts","sourceRoot":"","sources":["../../src/oidc/tokenRefresher.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAoC,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKpD;;;;;;GAMG;AACH,qBAAa,kBAAkB;IA4BvB;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa;IA/BlC;;;;;OAKG;IACH,SAAgB,eAAe,EAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,sBAAsB,CAAC,CAAwB;;IAGnD;;OAEG;IACH,MAAM,EAAE,MAAM;IACd;;OAEG;IACH,QAAQ,EAAE,MAAM;IAChB;;OAEG;IACH,WAAW,EAAE,MAAM;IACnB;;OAEG;IACH,QAAQ,EAAE,MAAM;IAChB;;;OAGG;IACc,aAAa,EAAE,aAAa;YAKnC,oBAAoB;IAyBlC;;;;;OAKG;IACU,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAY9E;;;;;;;OAOG;IACU,aAAa,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAInF,YAAY;CA0B7B"}

package/lib/oidc/tokenRefresher.js

@@ -0,0 +1,148 @@
+import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { OidcClient, WebStorageStateStore } from "oidc-client-ts";
+import { generateScope } from "./authorize.js";
+import { discoverAndValidateOIDCIssuerWellKnown } from "./discovery.js";
+import { logger } from "../logger.js";
+
+/**
+ * @experimental
+ * Class responsible for refreshing OIDC access tokens
+ *
+ * Client implementations will likely want to override {@link persistTokens} to persist tokens after successful refresh
+ *
+ */
+export class OidcTokenRefresher {
+  constructor(
+  /**
+   * The OIDC issuer as returned by the /auth_issuer API
+   */
+  issuer,
+  /**
+   * id of this client as registered with the OP
+   */
+  clientId,
+  /**
+   * redirectUri as registered with OP
+   */
+  redirectUri,
+  /**
+   * Device ID of current session
+   */
+  deviceId,
+  /**
+   * idTokenClaims as returned from authorization grant
+   * used to validate tokens
+   */
+  idTokenClaims) {
+    this.idTokenClaims = idTokenClaims;
+    /**
+     * Promise which will complete once the OidcClient has been initialised
+     * and is ready to start refreshing tokens.
+     *
+     * Will reject if the client initialisation fails.
+     */
+    _defineProperty(this, "oidcClientReady", void 0);
+    _defineProperty(this, "oidcClient", void 0);
+    _defineProperty(this, "inflightRefreshRequest", void 0);
+    this.oidcClientReady = this.initialiseOidcClient(issuer, clientId, deviceId, redirectUri);
+  }
+  initialiseOidcClient(issuer, clientId, deviceId, redirectUri) {
+    var _this = this;
+    return _asyncToGenerator(function* () {
+      try {
+        var config = yield discoverAndValidateOIDCIssuerWellKnown(issuer);
+        var scope = generateScope(deviceId);
+        _this.oidcClient = new OidcClient(_objectSpread(_objectSpread({}, config.metadata), {}, {
+          client_id: clientId,
+          scope,
+          redirect_uri: redirectUri,
+          authority: config.metadata.issuer,
+          stateStore: new WebStorageStateStore({
+            prefix: "mx_oidc_",
+            store: window.sessionStorage
+          })
+        }));
+      } catch (error) {
+        logger.error("Failed to initialise OIDC client.", error);
+        throw new Error("Failed to initialise OIDC client.");
+      }
+    })();
+  }
+
+  /**
+   * Attempt token refresh using given refresh token
+   * @param refreshToken - refresh token to use in request with token issuer
+   * @returns tokens - Promise that resolves with new access and refresh tokens
+   * @throws when token refresh fails
+   */
+  doRefreshAccessToken(refreshToken) {
+    var _this2 = this;
+    return _asyncToGenerator(function* () {
+      if (!_this2.inflightRefreshRequest) {
+        _this2.inflightRefreshRequest = _this2.getNewTokens(refreshToken);
+      }
+      try {
+        var tokens = yield _this2.inflightRefreshRequest;
+        return tokens;
+      } finally {
+        _this2.inflightRefreshRequest = undefined;
+      }
+    })();
+  }
+
+  /**
+   * Persist the new tokens, called after tokens are successfully refreshed.
+   *
+   * This function is intended to be overriden by the consumer when persistence is necessary.
+   *
+   * @param tokens.accessToken - new access token
+   * @param tokens.refreshToken - OPTIONAL new refresh token
+   */
+  persistTokens(tokens) {
+    return _asyncToGenerator(function* () {})();
+  } // NOOP
+  getNewTokens(refreshToken) {
+    var _this3 = this;
+    return _asyncToGenerator(function* () {
+      if (!_this3.oidcClient) {
+        throw new Error("Cannot get new token before OIDC client is initialised.");
+      }
+      var refreshTokenState = {
+        refresh_token: refreshToken,
+        session_state: "test",
+        data: undefined,
+        profile: _this3.idTokenClaims
+      };
+      var response = yield _this3.oidcClient.useRefreshToken({
+        state: refreshTokenState,
+        timeoutInSeconds: 300
+      });
+      var tokens = {
+        accessToken: response.access_token,
+        refreshToken: response.refresh_token
+      };
+      yield _this3.persistTokens(tokens);
+      return tokens;
+    })();
+  }
+}
+//# sourceMappingURL=tokenRefresher.js.map

package/lib/oidc/tokenRefresher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenRefresher.js","names":["OidcClient","WebStorageStateStore","generateScope","discoverAndValidateOIDCIssuerWellKnown","logger","OidcTokenRefresher","constructor","issuer","clientId","redirectUri","deviceId","idTokenClaims","_defineProperty","oidcClientReady","initialiseOidcClient","_this","_asyncToGenerator","config","scope","oidcClient","_objectSpread","metadata","client_id","redirect_uri","authority","stateStore","prefix","store","window","sessionStorage","error","Error","doRefreshAccessToken","refreshToken","_this2","inflightRefreshRequest","getNewTokens","tokens","undefined","persistTokens","_this3","refreshTokenState","refresh_token","session_state","data","profile","response","useRefreshToken","state","timeoutInSeconds","accessToken","access_token"],"sources":["../../src/oidc/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport { IdTokenClaims, OidcClient, WebStorageStateStore } from \"oidc-client-ts\";\n\nimport { AccessTokens } from \"../http-api/index.ts\";\nimport { generateScope } from \"./authorize.ts\";\nimport { discoverAndValidateOIDCIssuerWellKnown } from \"./discovery.ts\";\nimport { logger } from \"../logger.ts\";\n\n/**\n * @experimental\n * Class responsible for refreshing OIDC access tokens\n *\n * Client implementations will likely want to override {@link persistTokens} to persist tokens after successful refresh\n *\n */\nexport class OidcTokenRefresher {\n    /**\n     * Promise which will complete once the OidcClient has been initialised\n     * and is ready to start refreshing tokens.\n     *\n     * Will reject if the client initialisation fails.\n     */\n    public readonly oidcClientReady!: Promise<void>;\n    private oidcClient!: OidcClient;\n    private inflightRefreshRequest?: Promise<AccessTokens>;\n\n    public constructor(\n        /**\n         * The OIDC issuer as returned by the /auth_issuer API\n         */\n        issuer: string,\n        /**\n         * id of this client as registered with the OP\n         */\n        clientId: string,\n        /**\n         * redirectUri as registered with OP\n         */\n        redirectUri: string,\n        /**\n         * Device ID of current session\n         */\n        deviceId: string,\n        /**\n         * idTokenClaims as returned from authorization grant\n         * used to validate tokens\n         */\n        private readonly idTokenClaims: IdTokenClaims,\n    ) {\n        this.oidcClientReady = this.initialiseOidcClient(issuer, clientId, deviceId, redirectUri);\n    }\n\n    private async initialiseOidcClient(\n        issuer: string,\n        clientId: string,\n        deviceId: string,\n        redirectUri: string,\n    ): Promise<void> {\n        try {\n            const config = await discoverAndValidateOIDCIssuerWellKnown(issuer);\n\n            const scope = generateScope(deviceId);\n\n            this.oidcClient = new OidcClient({\n                ...config.metadata,\n                client_id: clientId,\n                scope,\n                redirect_uri: redirectUri,\n                authority: config.metadata.issuer,\n                stateStore: new WebStorageStateStore({ prefix: \"mx_oidc_\", store: window.sessionStorage }),\n            });\n        } catch (error) {\n            logger.error(\"Failed to initialise OIDC client.\", error);\n            throw new Error(\"Failed to initialise OIDC client.\");\n        }\n    }\n\n    /**\n     * Attempt token refresh using given refresh token\n     * @param refreshToken - refresh token to use in request with token issuer\n     * @returns tokens - Promise that resolves with new access and refresh tokens\n     * @throws when token refresh fails\n     */\n    public async doRefreshAccessToken(refreshToken: string): Promise<AccessTokens> {\n        if (!this.inflightRefreshRequest) {\n            this.inflightRefreshRequest = this.getNewTokens(refreshToken);\n        }\n        try {\n            const tokens = await this.inflightRefreshRequest;\n            return tokens;\n        } finally {\n            this.inflightRefreshRequest = undefined;\n        }\n    }\n\n    /**\n     * Persist the new tokens, called after tokens are successfully refreshed.\n     *\n     * This function is intended to be overriden by the consumer when persistence is necessary.\n     *\n     * @param tokens.accessToken - new access token\n     * @param tokens.refreshToken - OPTIONAL new refresh token\n     */\n    public async persistTokens(tokens: { accessToken: string; refreshToken?: string }): Promise<void> {\n        // NOOP\n    }\n\n    private async getNewTokens(refreshToken: string): Promise<AccessTokens> {\n        if (!this.oidcClient) {\n            throw new Error(\"Cannot get new token before OIDC client is initialised.\");\n        }\n\n        const refreshTokenState = {\n            refresh_token: refreshToken,\n            session_state: \"test\",\n            data: undefined,\n            profile: this.idTokenClaims,\n        };\n\n        const response = await this.oidcClient.useRefreshToken({\n            state: refreshTokenState,\n            timeoutInSeconds: 300,\n        });\n\n        const tokens = {\n            accessToken: response.access_token,\n            refreshToken: response.refresh_token,\n        };\n\n        await this.persistTokens(tokens);\n\n        return tokens;\n    }\n}\n"],"mappings":";;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAwBA,UAAU,EAAEC,oBAAoB,QAAQ,gBAAgB;AAGhF,SAASC,aAAa,QAAQ,gBAAgB;AAC9C,SAASC,sCAAsC,QAAQ,gBAAgB;AACvE,SAASC,MAAM,QAAQ,cAAc;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,CAAC;EAWrBC,WAAWA;EACd;AACR;AACA;EACQC,MAAc;EACd;AACR;AACA;EACQC,QAAgB;EAChB;AACR;AACA;EACQC,WAAmB;EACnB;AACR;AACA;EACQC,QAAgB;EAChB;AACR;AACA;AACA;EACyBC,aAA4B,EAC/C;IAAA,KADmBA,aAA4B,GAA5BA,aAA4B;IA/BjD;AACJ;AACA;AACA;AACA;AACA;IALIC,eAAA;IAAAA,eAAA;IAAAA,eAAA;IAiCI,IAAI,CAACC,eAAe,GAAG,IAAI,CAACC,oBAAoB,CAACP,MAAM,EAAEC,QAAQ,EAAEE,QAAQ,EAAED,WAAW,CAAC;EAC7F;EAEcK,oBAAoBA,CAC9BP,MAAc,EACdC,QAAgB,EAChBE,QAAgB,EAChBD,WAAmB,EACN;IAAA,IAAAM,KAAA;IAAA,OAAAC,iBAAA;MACb,IAAI;QACA,IAAMC,MAAM,SAASd,sCAAsC,CAACI,MAAM,CAAC;QAEnE,IAAMW,KAAK,GAAGhB,aAAa,CAACQ,QAAQ,CAAC;QAErCK,KAAI,CAACI,UAAU,GAAG,IAAInB,UAAU,CAAAoB,aAAA,CAAAA,aAAA,KACzBH,MAAM,CAACI,QAAQ;UAClBC,SAAS,EAAEd,QAAQ;UACnBU,KAAK;UACLK,YAAY,EAAEd,WAAW;UACzBe,SAAS,EAAEP,MAAM,CAACI,QAAQ,CAACd,MAAM;UACjCkB,UAAU,EAAE,IAAIxB,oBAAoB,CAAC;YAAEyB,MAAM,EAAE,UAAU;YAAEC,KAAK,EAAEC,MAAM,CAACC;UAAe,CAAC;QAAC,EAC7F,CAAC;MACN,CAAC,CAAC,OAAOC,KAAK,EAAE;QACZ1B,MAAM,CAAC0B,KAAK,CAAC,mCAAmC,EAAEA,KAAK,CAAC;QACxD,MAAM,IAAIC,KAAK,CAAC,mCAAmC,CAAC;MACxD;IAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;EACiBC,oBAAoBA,CAACC,YAAoB,EAAyB;IAAA,IAAAC,MAAA;IAAA,OAAAlB,iBAAA;MAC3E,IAAI,CAACkB,MAAI,CAACC,sBAAsB,EAAE;QAC9BD,MAAI,CAACC,sBAAsB,GAAGD,MAAI,CAACE,YAAY,CAACH,YAAY,CAAC;MACjE;MACA,IAAI;QACA,IAAMI,MAAM,SAASH,MAAI,CAACC,sBAAsB;QAChD,OAAOE,MAAM;MACjB,CAAC,SAAS;QACNH,MAAI,CAACC,sBAAsB,GAAGG,SAAS;MAC3C;IAAC;EACL;;EAEA;AACJ;AACA;AACA;AACA;AACA;AACA;AACA;EACiBC,aAAaA,CAACF,MAAsD,EAAiB;IAAA,OAAArB,iBAAA;EAElG,CAAC,CADG;EAGUoB,YAAYA,CAACH,YAAoB,EAAyB;IAAA,IAAAO,MAAA;IAAA,OAAAxB,iBAAA;MACpE,IAAI,CAACwB,MAAI,CAACrB,UAAU,EAAE;QAClB,MAAM,IAAIY,KAAK,CAAC,yDAAyD,CAAC;MAC9E;MAEA,IAAMU,iBAAiB,GAAG;QACtBC,aAAa,EAAET,YAAY;QAC3BU,aAAa,EAAE,MAAM;QACrBC,IAAI,EAAEN,SAAS;QACfO,OAAO,EAAEL,MAAI,CAAC7B;MAClB,CAAC;MAED,IAAMmC,QAAQ,SAASN,MAAI,CAACrB,UAAU,CAAC4B,eAAe,CAAC;QACnDC,KAAK,EAAEP,iBAAiB;QACxBQ,gBAAgB,EAAE;MACtB,CAAC,CAAC;MAEF,IAAMZ,MAAM,GAAG;QACXa,WAAW,EAAEJ,QAAQ,CAACK,YAAY;QAClClB,YAAY,EAAEa,QAAQ,CAACJ;MAC3B,CAAC;MAED,MAAMF,MAAI,CAACD,aAAa,CAACF,MAAM,CAAC;MAEhC,OAAOA,MAAM;IAAC;EAClB;AACJ","ignoreList":[]}

package/lib/oidc/validate.d.ts

@@ -0,0 +1,90 @@
+import { IdTokenClaims, OidcMetadata, SigninResponse } from "oidc-client-ts";
+export type ValidatedIssuerConfig = {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    registrationEndpoint?: string;
+    accountManagementEndpoint?: string;
+    accountManagementActionsSupported?: string[];
+};
+/**
+ * Validates issuer `.well-known/openid-configuration`
+ * As defined in RFC5785 https://openid.net/specs/openid-connect-discovery-1_0.html
+ * validates that OP is compatible with Element's OIDC flow
+ * @param wellKnown - json object
+ * @returns valid issuer config
+ * @throws Error - when issuer config is not found or is invalid
+ */
+export declare const validateOIDCIssuerWellKnown: (wellKnown: unknown) => ValidatedIssuerConfig;
+/**
+ * Metadata from OIDC authority discovery
+ * With validated properties required in type
+ */
+export type ValidatedIssuerMetadata = Partial<OidcMetadata> & Pick<OidcMetadata, "issuer" | "authorization_endpoint" | "token_endpoint" | "registration_endpoint" | "revocation_endpoint" | "response_types_supported" | "grant_types_supported" | "code_challenge_methods_supported" | "device_authorization_endpoint"> & {
+    account_management_uri?: string;
+    account_management_actions_supported?: string[];
+};
+/**
+ * Wraps validateOIDCIssuerWellKnown in a type assertion
+ * that asserts expected properties are present
+ * (Typescript assertions cannot be arrow functions)
+ * @param metadata - issuer openid-configuration response
+ * @throws when metadata validation fails
+ */
+export declare function isValidatedIssuerMetadata(metadata: Partial<OidcMetadata>): asserts metadata is ValidatedIssuerMetadata;
+export declare const decodeIdToken: (token: string) => IdTokenClaims;
+/**
+ * Validate idToken
+ * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+ * @param idToken - id token from token endpoint
+ * @param issuer - issuer for the OP as found during discovery
+ * @param clientId - this client's id as registered with the OP
+ * @param nonce - nonce used in the authentication request
+ * @throws when id token is invalid
+ */
+export declare const validateIdToken: (idToken: string | undefined, issuer: string, clientId: string, nonce: string | undefined) => void;
+/**
+ * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)
+ * so that we can access it on return from the OP and complete login
+ */
+export type UserState = {
+    /**
+     * Remember which server we were trying to login to
+     */
+    homeserverUrl: string;
+    identityServerUrl?: string;
+    /**
+     * Used to validate id token
+     */
+    nonce: string;
+};
+/**
+ * Validate stored user state exists and is valid
+ * @param userState - userState returned by oidcClient.processSigninResponse
+ * @throws when userState is invalid
+ */
+export declare function validateStoredUserState(userState: unknown): asserts userState is UserState;
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
+ * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
+ */
+export type BearerTokenResponse = {
+    token_type: "Bearer";
+    access_token: string;
+    scope: string;
+    refresh_token?: string;
+    expires_in?: number;
+    expires_at?: number;
+    id_token: string;
+};
+/**
+ * Make required properties required in type
+ */
+type ValidSignInResponse = SigninResponse & BearerTokenResponse & {
+    token_type: "Bearer" | "bearer";
+};
+export declare function validateBearerTokenResponse(response: unknown): asserts response is ValidSignInResponse;
+export {};
+//# sourceMappingURL=validate.d.ts.map

package/lib/oidc/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/oidc/validate.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAK7E,MAAM,MAAM,qBAAqB,GAAG;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC;CAChD,CAAC;AAqCF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,cAAe,OAAO,KAAG,qBA+BhE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,GACvD,IAAI,CACA,YAAY,EACV,QAAQ,GACR,wBAAwB,GACxB,gBAAgB,GAChB,uBAAuB,GACvB,qBAAqB,GACrB,0BAA0B,GAC1B,uBAAuB,GACvB,kCAAkC,GAClC,+BAA+B,CACpC,GAAG;IAEA,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,oCAAoC,CAAC,EAAE,MAAM,EAAE,CAAC;CACnD,CAAC;AAEN;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACrC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAChC,OAAO,CAAC,QAAQ,IAAI,uBAAuB,CAE7C;AAED,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,aAO7C,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,YACf,MAAM,GAAG,SAAS,UACnB,MAAM,YACJ,MAAM,SACT,MAAM,GAAG,SAAS,KAC1B,IAwCF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG;IACpB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AACF;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,CAc1F;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,QAAQ,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,KAAK,mBAAmB,GAAG,cAAc,GACrC,mBAAmB,GAAG;IAClB,UAAU,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACnC,CAAC;AAWN,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAItG"}

package/lib/oidc/validate.js

@@ -0,0 +1,194 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { jwtDecode } from "jwt-decode";
+import { logger } from "../logger.js";
+import { OidcError } from "./error.js";
+var isRecord = value => !!value && typeof value === "object" && !Array.isArray(value);
+var requiredStringProperty = (wellKnown, key) => {
+  if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {
+    logger.error("Missing or invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var optionalStringProperty = (wellKnown, key) => {
+  if (!!wellKnown[key] && typeof wellKnown[key] !== "string") {
+    logger.error("Invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var optionalStringArrayProperty = (wellKnown, key) => {
+  if (!!wellKnown[key] && (!Array.isArray(wellKnown[key]) || !wellKnown[key].every(v => typeof v === "string"))) {
+    logger.error("Invalid property: ".concat(key));
+    return false;
+  }
+  return true;
+};
+var requiredArrayValue = (wellKnown, key, value) => {
+  var array = wellKnown[key];
+  if (!array || !Array.isArray(array) || !array.includes(value)) {
+    logger.error("Invalid property: ".concat(key, ". ").concat(value, " is required."));
+    return false;
+  }
+  return true;
+};
+
+/**
+ * Validates issuer `.well-known/openid-configuration`
+ * As defined in RFC5785 https://openid.net/specs/openid-connect-discovery-1_0.html
+ * validates that OP is compatible with Element's OIDC flow
+ * @param wellKnown - json object
+ * @returns valid issuer config
+ * @throws Error - when issuer config is not found or is invalid
+ */
+export var validateOIDCIssuerWellKnown = wellKnown => {
+  if (!isRecord(wellKnown)) {
+    logger.error("Issuer configuration not found or malformed");
+    throw new Error(OidcError.OpSupport);
+  }
+  var isInvalid = [requiredStringProperty(wellKnown, "authorization_endpoint"), requiredStringProperty(wellKnown, "token_endpoint"), requiredStringProperty(wellKnown, "revocation_endpoint"), optionalStringProperty(wellKnown, "registration_endpoint"), optionalStringProperty(wellKnown, "account_management_uri"), optionalStringProperty(wellKnown, "device_authorization_endpoint"), optionalStringArrayProperty(wellKnown, "account_management_actions_supported"), requiredArrayValue(wellKnown, "response_types_supported", "code"), requiredArrayValue(wellKnown, "grant_types_supported", "authorization_code"), requiredArrayValue(wellKnown, "code_challenge_methods_supported", "S256")].some(isValid => !isValid);
+  if (!isInvalid) {
+    return {
+      authorizationEndpoint: wellKnown["authorization_endpoint"],
+      tokenEndpoint: wellKnown["token_endpoint"],
+      registrationEndpoint: wellKnown["registration_endpoint"],
+      accountManagementEndpoint: wellKnown["account_management_uri"],
+      accountManagementActionsSupported: wellKnown["account_management_actions_supported"]
+    };
+  }
+  logger.error("Issuer configuration not valid");
+  throw new Error(OidcError.OpSupport);
+};
+
+/**
+ * Metadata from OIDC authority discovery
+ * With validated properties required in type
+ */
+
+/**
+ * Wraps validateOIDCIssuerWellKnown in a type assertion
+ * that asserts expected properties are present
+ * (Typescript assertions cannot be arrow functions)
+ * @param metadata - issuer openid-configuration response
+ * @throws when metadata validation fails
+ */
+export function isValidatedIssuerMetadata(metadata) {
+  validateOIDCIssuerWellKnown(metadata);
+}
+export var decodeIdToken = token => {
+  try {
+    return jwtDecode(token);
+  } catch (error) {
+    logger.error("Could not decode id_token", error);
+    throw error;
+  }
+};
+
+/**
+ * Validate idToken
+ * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+ * @param idToken - id token from token endpoint
+ * @param issuer - issuer for the OP as found during discovery
+ * @param clientId - this client's id as registered with the OP
+ * @param nonce - nonce used in the authentication request
+ * @throws when id token is invalid
+ */
+export var validateIdToken = (idToken, issuer, clientId, nonce) => {
+  try {
+    if (!idToken) {
+      throw new Error("No ID token");
+    }
+    var claims = decodeIdToken(idToken);
+
+    // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.
+    if (claims.iss !== issuer) {
+      throw new Error("Invalid issuer");
+    }
+    /**
+     * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.
+     * The aud (audience) Claim MAY contain an array with more than one element.
+     * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+     * EW: Don't accept tokens with other untrusted audiences
+     * */
+    if (claims.aud !== clientId) {
+      throw new Error("Invalid audience");
+    }
+
+    /**
+     * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked
+     * to verify that it is the same value as the one that was sent in the Authentication Request.
+     */
+    if (nonce !== undefined && claims.nonce !== nonce) {
+      throw new Error("Invalid nonce");
+    }
+
+    /**
+     * The current time MUST be before the time represented by the exp Claim.
+     *  exp is an epoch timestamp in seconds
+     * */
+    if (!claims.exp || Date.now() > claims.exp * 1000) {
+      throw new Error("Invalid expiry");
+    }
+  } catch (error) {
+    logger.error("Invalid ID token", error);
+    throw new Error(OidcError.InvalidIdToken);
+  }
+};
+
+/**
+ * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)
+ * so that we can access it on return from the OP and complete login
+ */
+
+/**
+ * Validate stored user state exists and is valid
+ * @param userState - userState returned by oidcClient.processSigninResponse
+ * @throws when userState is invalid
+ */
+export function validateStoredUserState(userState) {
+  if (!isRecord(userState)) {
+    logger.error("Stored user state not found");
+    throw new Error(OidcError.MissingOrInvalidStoredState);
+  }
+  var isInvalid = [requiredStringProperty(userState, "homeserverUrl"), requiredStringProperty(userState, "nonce"), optionalStringProperty(userState, "identityServerUrl")].some(isValid => !isValid);
+  if (isInvalid) {
+    throw new Error(OidcError.MissingOrInvalidStoredState);
+  }
+}
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
+ * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
+ */
+
+/**
+ * Make required properties required in type
+ */
+
+var isValidBearerTokenResponse = response => isRecord(response) && requiredStringProperty(response, "token_type") &&
+// token_type is case insensitive, some OPs return `token_type: "bearer"`
+response["token_type"].toLowerCase() === "bearer" && requiredStringProperty(response, "access_token") && requiredStringProperty(response, "refresh_token") && (!("expires_in" in response) || typeof response["expires_in"] === "number");
+export function validateBearerTokenResponse(response) {
+  if (!isValidBearerTokenResponse(response)) {
+    throw new Error(OidcError.InvalidBearerTokenResponse);
+  }
+}
+//# sourceMappingURL=validate.js.map