auth0 2.36.1 → 2.38.1

package/src/auth/OAUthWithIDTokenValidation.js

@@ -1,128 +1,124 @@
-var jwt = require('jsonwebtoken');
-var jwksClient = require('jwks-rsa');
+const jwt = require('jsonwebtoken');
+const jwksClient = require('jwks-rsa');
+const { ArgumentError } = require('rest-facade');
+const validateIdToken = require('./idToken').validate;
 
-var ArgumentError = require('rest-facade').ArgumentError;
-var validateIdToken = require('./idToken').validate;
-
-var HS256_IGNORE_VALIDATION_MESSAGE =
+const HS256_IGNORE_VALIDATION_MESSAGE =
   'Validation of `id_token` requires a `clientSecret` when using the HS256 algorithm. To ensure tokens are validated, please switch the signing algorithm to RS256 or provide a `clientSecret` in the constructor.';
 
 /**
- * @class
  * Abstracts the `oauth.create` method with additional id_token validation
- * @constructor
- * @memberOf module:auth
- *
- * @param  {Object}              oauth                               An instance of @type {OAuthAuthenticator}
- * @param  {Object}              options                             Authenticator options.
- * @param  {String}              options.domain                      AuthenticationClient server domain
- * @param  {String}              [options.clientId]                  Default client ID.
- * @param  {String}              [options.clientSecret]              Default client Secret.
- * @param  {String}              [options.supportedAlgorithms]       Algorithms that your application expects to receive
- * @param  {Boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
  */
-var OAUthWithIDTokenValidation = function(oauth, options) {
-  if (!oauth) {
-    throw new ArgumentError('Missing OAuthAuthenticator param');
-  }
+class OAUthWithIDTokenValidation {
+  /**
+   * @param  {object}              oauth                               An instance of @type {OAuthAuthenticator}
+   * @param  {object}              options                             Authenticator options.
+   * @param  {string}              options.domain                      AuthenticationClient server domain
+   * @param  {string}              [options.clientId]                  Default client ID.
+   * @param  {string}              [options.clientSecret]              Default client Secret.
+   * @param  {string}              [options.supportedAlgorithms]       Algorithms that your application expects to receive
+   * @param  {boolean}             [options.__bypassIdTokenValidation] Whether the id_token should be validated or not
+   */
+  constructor(oauth, options) {
+    if (!oauth) {
+      throw new ArgumentError('Missing OAuthAuthenticator param');
+    }
 
-  if (!options) {
-    throw new ArgumentError('Missing authenticator options');
-  }
+    if (!options) {
+      throw new ArgumentError('Missing authenticator options');
+    }
 
-  if (typeof options !== 'object') {
-    throw new ArgumentError('The authenticator options must be an object');
-  }
+    if (typeof options !== 'object') {
+      throw new ArgumentError('The authenticator options must be an object');
+    }
 
-  this.oauth = oauth;
-  this.__bypassIdTokenValidation = options.__bypassIdTokenValidation;
-  this.clientId = options.clientId;
-  this.clientSecret = options.clientSecret;
-  this.domain = options.domain;
-  this.supportedAlgorithms = options.supportedAlgorithms || ['HS256', 'RS256'];
-  this._jwksClient = jwksClient({
-    jwksUri: 'https://' + options.domain + '/.well-known/jwks.json'
-  });
-};
+    this.oauth = oauth;
+    this.__bypassIdTokenValidation = options.__bypassIdTokenValidation;
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
+    this.domain = options.domain;
+    this.supportedAlgorithms = options.supportedAlgorithms || ['HS256', 'RS256'];
+    this._jwksClient = jwksClient({
+      jwksUri: `https://${options.domain}/.well-known/jwks.json`,
+    });
+  }
 
-/**
- * Creates an oauth request and validates the id_token (if any)
- *
- * @method    create
- * @memberOf  module:auth.OAuthWithIDTokenValidation.prototype
- *
- * @param   {Object}    params            OAuth parameters that are passed through
- * @param   {Object}    data              Custom parameters sent to the OAuth endpoint
- * @param   {Function}  [callback]        Callback function
- *
- * @return  {Promise|undefined}
- */
-OAUthWithIDTokenValidation.prototype.create = function(params, data, cb) {
-  const _this = this;
-  const createAndValidate = this.oauth.create(params, data).then(r => {
-    if (_this.__bypassIdTokenValidation) {
-      return r;
-    }
-    if (r.id_token) {
-      function getKey(header, callback) {
-        if (header.alg === 'HS256') {
-          if (!_this.clientSecret) {
-            return callback({ message: HS256_IGNORE_VALIDATION_MESSAGE });
-          }
-          return callback(null, Buffer.from(_this.clientSecret, 'base64'));
+  /**
+   * Creates an oauth request and validates the id_token (if any)
+   *
+   * @param   {object}    params            OAuth parameters that are passed through
+   * @param   {object}    data              Custom parameters sent to the OAuth endpoint
+   * @param   {Function}  [cb]              Callback function
+   * @returns  {Promise|undefined}
+   */
+  create(params, data, cb) {
+    const _this = this;
+    function getKey(header, callback) {
+      if (header.alg === 'HS256') {
+        if (!_this.clientSecret) {
+          return callback({ message: HS256_IGNORE_VALIDATION_MESSAGE });
         }
-        _this._jwksClient.getSigningKey(header.kid, function(err, key) {
-          if (err) {
-            return callback(err);
-          }
-          var signingKey = key.publicKey || key.rsaPublicKey;
-          return callback(null, signingKey);
-        });
+        return callback(null, Buffer.from(_this.clientSecret, 'base64'));
       }
-      return new Promise((res, rej) => {
-        var options = {
-          algorithms: this.supportedAlgorithms,
-          audience: this.clientId,
-          issuer: 'https://' + this.domain + '/'
-        };
-
-        if (data.organization) {
-          options.organization = data.organization;
+      _this._jwksClient.getSigningKey(header.kid, (err, key) => {
+        if (err) {
+          return callback(err);
         }
+        const signingKey = key.publicKey || key.rsaPublicKey;
+        return callback(null, signingKey);
+      });
+    }
+    const createAndValidate = this.oauth.create(params, data).then((r) => {
+      if (_this.__bypassIdTokenValidation) {
+        return r;
+      }
 
-        if (data.nonce) {
-          options.nonce = data.nonce;
-        }
+      if (r.id_token) {
+        return new Promise((resolve, reject) => {
+          const options = {
+            algorithms: this.supportedAlgorithms,
+            audience: this.clientId,
+            issuer: `https://${this.domain}/`,
+          };
 
-        if (data.maxAge) {
-          options.maxAge = data.maxAge;
-        }
+          if (data.organization) {
+            options.organization = data.organization;
+          }
 
-        jwt.verify(r.id_token, getKey, options, function(err) {
-          if (err) {
-            if (err.message && err.message.includes(HS256_IGNORE_VALIDATION_MESSAGE)) {
-              console.warn(HS256_IGNORE_VALIDATION_MESSAGE);
-            } else {
-              return rej(err);
-            }
+          if (data.nonce) {
+            options.nonce = data.nonce;
           }
 
-          try {
-            validateIdToken(r.id_token, options);
-          } catch (idTokenError) {
-            return rej(idTokenError);
+          if (data.maxAge) {
+            options.maxAge = data.maxAge;
           }
 
-          return res(r);
+          jwt.verify(r.id_token, getKey, options, (err) => {
+            if (err) {
+              if (err.message && err.message.includes(HS256_IGNORE_VALIDATION_MESSAGE)) {
+                console.warn(HS256_IGNORE_VALIDATION_MESSAGE);
+              } else {
+                return reject(err);
+              }
+            }
+
+            try {
+              validateIdToken(r.id_token, options);
+            } catch (idTokenError) {
+              return reject(idTokenError);
+            }
+
+            return resolve(r);
+          });
         });
-      });
+      }
+      return r;
+    });
+    if (!cb) {
+      return createAndValidate;
     }
-    return r;
-  });
-  if (!cb) {
-    return createAndValidate;
+    createAndValidate.then((r) => cb(null, r)).catch((e) => cb(e));
   }
-  createAndValidate.then(r => cb(null, r)).catch(e => cb(e));
-};
+}
 
 module.exports = OAUthWithIDTokenValidation;