matrix-js-sdk 41.8.0 → 41.9.0

package/lib/oidc/authorize.js

@@ -1,7 +1,4 @@
-import _defineProperty from "@babel/runtime/helpers/defineProperty";
-import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
-function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+import _objectSpread from "@babel/runtime/helpers/objectSpread2";
 /*
 Copyright 2023 The Matrix.org Foundation C.I.C.
 
@@ -42,26 +39,21 @@ import { Method } from "../http-api/index.js";
  * Generate the scope used in authorization request with OIDC OP
  * @returns scope
  */
-export var generateScope = deviceId => {
-  var safeDeviceId = deviceId !== null && deviceId !== void 0 ? deviceId : secureRandomString(10);
-  return "openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:".concat(safeDeviceId);
+export const generateScope = deviceId => {
+  const safeDeviceId = deviceId ?? secureRandomString(10);
+  return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${safeDeviceId}`;
 };
 
 // https://www.rfc-editor.org/rfc/rfc7636
-var generateCodeChallenge = /*#__PURE__*/function () {
-  var _ref = _asyncToGenerator(function* (codeVerifier) {
-    if (!globalThis.crypto.subtle) {
-      // @TODO(kerrya) should this be allowed? configurable?
-      logger.warn("A secure context is required to generate code challenge. Using plain text code challenge");
-      return codeVerifier;
-    }
-    var hashBuffer = yield sha256(codeVerifier);
-    return encodeUnpaddedBase64Url(hashBuffer);
-  });
-  return function generateCodeChallenge(_x) {
-    return _ref.apply(this, arguments);
-  };
-}();
+const generateCodeChallenge = async codeVerifier => {
+  if (!globalThis.crypto.subtle) {
+    // @TODO(kerrya) should this be allowed? configurable?
+    logger.warn("A secure context is required to generate code challenge. Using plain text code challenge");
+    return codeVerifier;
+  }
+  const hashBuffer = await sha256(codeVerifier);
+  return encodeUnpaddedBase64Url(hashBuffer);
+};
 
 /**
  * Generate authorization params to pass to {@link generateAuthorizationUrl}.
@@ -71,16 +63,15 @@ var generateCodeChallenge = /*#__PURE__*/function () {
  * @param redirectUri - absolute url for OP to redirect to after authorization
  * @returns AuthorizationParams
  */
-export var generateAuthorizationParams = _ref2 => {
-  var redirectUri = _ref2.redirectUri;
-  return {
-    scope: generateScope(),
-    redirectUri,
-    state: secureRandomString(8),
-    nonce: secureRandomString(8),
-    codeVerifier: secureRandomString(64) // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
-  };
-};
+export const generateAuthorizationParams = ({
+  redirectUri
+}) => ({
+  scope: generateScope(),
+  redirectUri,
+  state: secureRandomString(8),
+  nonce: secureRandomString(8),
+  codeVerifier: secureRandomString(64) // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
+});
 
 /**
  * @deprecated use generateOidcAuthorizationUrl
@@ -91,29 +82,25 @@ export var generateAuthorizationParams = _ref2 => {
  * @param authorizationParams - params to be used in the url
  * @returns a Promise with the url as a string
  */
-export var generateAuthorizationUrl = /*#__PURE__*/function () {
-  var _ref4 = _asyncToGenerator(function* (authorizationUrl, clientId, _ref3) {
-    var scope = _ref3.scope,
-      redirectUri = _ref3.redirectUri,
-      state = _ref3.state,
-      nonce = _ref3.nonce,
-      codeVerifier = _ref3.codeVerifier;
-    var url = new URL(authorizationUrl);
-    url.searchParams.append("response_mode", "query");
-    url.searchParams.append("response_type", "code");
-    url.searchParams.append("redirect_uri", redirectUri);
-    url.searchParams.append("client_id", clientId);
-    url.searchParams.append("state", state);
-    url.searchParams.append("scope", scope);
-    url.searchParams.append("nonce", nonce);
-    url.searchParams.append("code_challenge_method", "S256");
-    url.searchParams.append("code_challenge", yield generateCodeChallenge(codeVerifier));
-    return url.toString();
-  });
-  return function generateAuthorizationUrl(_x2, _x3, _x4) {
-    return _ref4.apply(this, arguments);
-  };
-}();
+export const generateAuthorizationUrl = async (authorizationUrl, clientId, {
+  scope,
+  redirectUri,
+  state,
+  nonce,
+  codeVerifier
+}) => {
+  const url = new URL(authorizationUrl);
+  url.searchParams.append("response_mode", "query");
+  url.searchParams.append("response_type", "code");
+  url.searchParams.append("redirect_uri", redirectUri);
+  url.searchParams.append("client_id", clientId);
+  url.searchParams.append("state", state);
+  url.searchParams.append("scope", scope);
+  url.searchParams.append("nonce", nonce);
+  url.searchParams.append("code_challenge_method", "S256");
+  url.searchParams.append("code_challenge", await generateCodeChallenge(codeVerifier));
+  return url.toString();
+};
 
 /**
  * @experimental
@@ -133,50 +120,45 @@ export var generateAuthorizationUrl = /*#__PURE__*/function () {
  *          See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
  * @returns a Promise with the url as a string
  */
-export var generateOidcAuthorizationUrl = /*#__PURE__*/function () {
-  var _ref6 = _asyncToGenerator(function* (_ref5) {
-    var metadata = _ref5.metadata,
-      redirectUri = _ref5.redirectUri,
-      clientId = _ref5.clientId,
-      homeserverUrl = _ref5.homeserverUrl,
-      identityServerUrl = _ref5.identityServerUrl,
-      nonce = _ref5.nonce,
-      prompt = _ref5.prompt,
-      urlState = _ref5.urlState,
-      loginHint = _ref5.loginHint,
-      _ref5$responseMode = _ref5.responseMode,
-      responseMode = _ref5$responseMode === void 0 ? "query" : _ref5$responseMode;
-    var scope = generateScope();
-    var oidcClient = new OidcClient(_objectSpread(_objectSpread({}, metadata), {}, {
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      authority: metadata.issuer,
-      response_mode: responseMode,
-      response_type: "code",
-      scope,
-      stateStore: new WebStorageStateStore({
-        prefix: "mx_oidc_",
-        store: window.sessionStorage
-      })
-    }));
-    var userState = {
-      homeserverUrl,
-      nonce,
-      identityServerUrl
-    };
-    var request = yield oidcClient.createSigninRequest({
-      state: userState,
-      nonce,
-      prompt,
-      url_state: urlState,
-      login_hint: loginHint
-    });
-    return request.url;
-  });
-  return function generateOidcAuthorizationUrl(_x5) {
-    return _ref6.apply(this, arguments);
+export const generateOidcAuthorizationUrl = async ({
+  metadata,
+  redirectUri,
+  clientId,
+  homeserverUrl,
+  identityServerUrl,
+  nonce,
+  prompt,
+  urlState,
+  loginHint,
+  responseMode = "query"
+}) => {
+  const scope = generateScope();
+  const oidcClient = new OidcClient(_objectSpread(_objectSpread({}, metadata), {}, {
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    authority: metadata.issuer,
+    response_mode: responseMode,
+    response_type: "code",
+    scope,
+    stateStore: new WebStorageStateStore({
+      prefix: "mx_oidc_",
+      store: window.sessionStorage
+    })
+  }));
+  const userState = {
+    homeserverUrl,
+    nonce,
+    identityServerUrl
   };
-}();
+  const request = await oidcClient.createSigninRequest({
+    state: userState,
+    nonce,
+    prompt,
+    url_state: urlState,
+    login_hint: loginHint
+  });
+  return request.url;
+};
 
 /**
  * Normalize token_type to use capital case to make consuming the token response easier
@@ -187,7 +169,7 @@ export var generateOidcAuthorizationUrl = /*#__PURE__*/function () {
  * @param response - validated token response
  * @returns response with token_type set to 'Bearer'
  */
-var normalizeBearerTokenResponseTokenType = response => ({
+const normalizeBearerTokenResponseTokenType = response => ({
   id_token: response.id_token,
   scope: response.scope,
   expires_at: response.expires_at,
@@ -210,88 +192,82 @@ var normalizeBearerTokenResponseTokenType = response => ({
  * @throws An `Error` with `message` set to an entry in {@link OidcError},
  *      when the request fails, or the returned token response is invalid.
  */
-export var completeAuthorizationCodeGrant = /*#__PURE__*/function () {
-  var _ref7 = _asyncToGenerator(function* (code, state) {
-    var responseMode = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : "query";
-    /**
-     * Element Web strips and changes the url on starting the app
-     * Use the code and state from query params to rebuild a url
-     * so that oidc-client can parse it
-     */
-    var reconstructedUrl = new URL(window.location.origin);
-    var params = new URLSearchParams({
-      code,
-      state
-    });
-    if (responseMode === "query") {
-      reconstructedUrl.search = params.toString();
-    } else {
-      reconstructedUrl.hash = "#".concat(params.toString());
-    }
+export const completeAuthorizationCodeGrant = async (code, state, responseMode = "query") => {
+  /**
+   * Element Web strips and changes the url on starting the app
+   * Use the code and state from query params to rebuild a url
+   * so that oidc-client can parse it
+   */
+  const reconstructedUrl = new URL(window.location.origin);
+  const params = new URLSearchParams({
+    code,
+    state
+  });
+  if (responseMode === "query") {
+    reconstructedUrl.search = params.toString();
+  } else {
+    reconstructedUrl.hash = `#${params.toString()}`;
+  }
 
-    // set oidc-client to use our logger
-    Log.setLogger(logger);
-    try {
-      var response = new SigninResponse(params);
-      var stateStore = new WebStorageStateStore({
-        prefix: "mx_oidc_",
-        store: window.sessionStorage
-      });
+  // set oidc-client to use our logger
+  Log.setLogger(logger);
+  try {
+    const response = new SigninResponse(params);
+    const stateStore = new WebStorageStateStore({
+      prefix: "mx_oidc_",
+      store: window.sessionStorage
+    });
 
-      // retrieve the state we put in storage at the start of oidc auth flow
-      var stateString = yield stateStore.get(response.state);
-      if (!stateString) {
-        throw new Error(OidcError.MissingOrInvalidStoredState);
-      }
+    // retrieve the state we put in storage at the start of oidc auth flow
+    const stateString = await stateStore.get(response.state);
+    if (!stateString) {
+      throw new Error(OidcError.MissingOrInvalidStoredState);
+    }
 
-      // hydrate the sign in state and create a client
-      // the stored sign in state includes oidc configuration we set at the start of the oidc login flow
-      var signInState = yield SigninState.fromStorageString(stateString);
-      var client = new OidcClient(_objectSpread(_objectSpread({}, signInState), {}, {
-        stateStore
-      }));
+    // hydrate the sign in state and create a client
+    // the stored sign in state includes oidc configuration we set at the start of the oidc login flow
+    const signInState = await SigninState.fromStorageString(stateString);
+    const client = new OidcClient(_objectSpread(_objectSpread({}, signInState), {}, {
+      stateStore
+    }));
 
-      // validate the code and state, and attempt to swap the code for tokens
-      var signinResponse = yield client.processSigninResponse(reconstructedUrl.href);
+    // validate the code and state, and attempt to swap the code for tokens
+    const signinResponse = await client.processSigninResponse(reconstructedUrl.href);
 
-      // extra values we stored at the start of the login flow
-      // used to complete login in the client
-      var userState = signinResponse.userState;
-      validateStoredUserState(userState);
+    // extra values we stored at the start of the login flow
+    // used to complete login in the client
+    const userState = signinResponse.userState;
+    validateStoredUserState(userState);
 
-      // throws when response is invalid
-      validateBearerTokenResponse(signinResponse);
-      if (signinResponse.id_token) {
-        // The token is not yet in the Matrix spec so consider it optional
-        // throws when token is invalid
-        validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);
-      }
-      var normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);
-      return {
-        oidcClientSettings: {
-          clientId: client.settings.client_id,
-          issuer: client.settings.authority
-        },
-        tokenResponse: normalizedTokenResponse,
-        homeserverUrl: userState.homeserverUrl,
-        identityServerUrl: userState.identityServerUrl,
-        idTokenClaims: signinResponse.profile
-      };
-    } catch (error) {
-      logger.error("Oidc login failed", error);
-      var errorType = error.message;
+    // throws when response is invalid
+    validateBearerTokenResponse(signinResponse);
+    if (signinResponse.id_token) {
+      // The token is not yet in the Matrix spec so consider it optional
+      // throws when token is invalid
+      validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);
+    }
+    const normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);
+    return {
+      oidcClientSettings: {
+        clientId: client.settings.client_id,
+        issuer: client.settings.authority
+      },
+      tokenResponse: normalizedTokenResponse,
+      homeserverUrl: userState.homeserverUrl,
+      identityServerUrl: userState.identityServerUrl,
+      idTokenClaims: signinResponse.profile
+    };
+  } catch (error) {
+    logger.error("Oidc login failed", error);
+    const errorType = error.message;
 
-      // rethrow errors that we recognise
-      if (Object.values(OidcError).includes(errorType)) {
-        throw error;
-      }
-      throw new Error(OidcError.CodeExchangeFailed);
+    // rethrow errors that we recognise
+    if (Object.values(OidcError).includes(errorType)) {
+      throw error;
     }
-  });
-  return function completeAuthorizationCodeGrant(_x6, _x7) {
-    return _ref7.apply(this, arguments);
-  };
-}();
+    throw new Error(OidcError.CodeExchangeFailed);
+  }
+};
 
 /**
  * Response from the OIDC token endpoint when exchanging a token for grant_type device_code.
@@ -314,32 +290,28 @@ export var completeAuthorizationCodeGrant = /*#__PURE__*/function () {
  * @returns a promise that resolves to a device access token response,
  *   or an error response if the user denies authorization or the device code expires.
  */
-export var startDeviceAuthorization = /*#__PURE__*/function () {
-  var _ref9 = _asyncToGenerator(function* (_ref8) {
-    var clientId = _ref8.clientId,
-      scope = _ref8.scope,
-      metadata = _ref8.metadata;
-    var body = new URLSearchParams({
-      client_id: clientId,
-      scope: scope
-    }).toString();
-    var url = metadata.device_authorization_endpoint;
-    if (!url) {
-      throw new Error("No device_authorization_endpoint given");
-    }
-    var response = yield fetch(url, {
-      method: Method.Post,
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body
-    });
-    return yield response.json();
+export const startDeviceAuthorization = async ({
+  clientId,
+  scope,
+  metadata
+}) => {
+  const body = new URLSearchParams({
+    client_id: clientId,
+    scope: scope
+  }).toString();
+  const url = metadata.device_authorization_endpoint;
+  if (!url) {
+    throw new Error("No device_authorization_endpoint given");
+  }
+  const response = await fetch(url, {
+    method: Method.Post,
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
   });
-  return function startDeviceAuthorization(_x8) {
-    return _ref9.apply(this, arguments);
-  };
-}();
+  return await response.json();
+};
 
 /**
  * Polls the OIDC token endpoint until we get a device access token response, or encounter an unrecoverable error.
@@ -350,49 +322,44 @@ export var startDeviceAuthorization = /*#__PURE__*/function () {
  * @returns a promise that resolves to a device access token response,
  *   or an error response if the user denies authorization or the device code expires.
  */
-export var waitForDeviceAuthorization = /*#__PURE__*/function () {
-  var _ref1 = _asyncToGenerator(function* (_ref0) {
-    var _session$interval;
-    var session = _ref0.session,
-      metadata = _ref0.metadata,
-      clientId = _ref0.clientId;
-    var interval = ((_session$interval = session.interval) !== null && _session$interval !== void 0 ? _session$interval : 5) * 1000; // poll interval
-    var expiration = Date.now() + session.expires_in * 1000;
-    do {
-      var body = new URLSearchParams({
-        device_code: session.device_code,
-        grant_type: OAuthGrantType.DeviceAuthorization,
-        client_id: clientId
-      }).toString();
-      var response = yield fetch(metadata.token_endpoint, {
-        method: Method.Post,
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body
-      });
-      if (response.ok) {
-        return yield response.json();
-      }
-      var errorResponse = yield response.json();
-      switch (errorResponse.error) {
-        case "authorization_pending":
-          break;
-        case "slow_down":
-          interval += 5000;
-          break;
-        case "access_denied":
-        case "expired_token":
-          return errorResponse;
-      }
-      yield sleep(interval);
-    } while (Date.now() < expiration);
-    return {
-      error: "expired"
-    };
-  });
-  return function waitForDeviceAuthorization(_x9) {
-    return _ref1.apply(this, arguments);
+export const waitForDeviceAuthorization = async ({
+  session,
+  metadata,
+  clientId
+}) => {
+  let interval = (session.interval ?? 5) * 1000; // poll interval
+  const expiration = Date.now() + session.expires_in * 1000;
+  do {
+    const body = new URLSearchParams({
+      device_code: session.device_code,
+      grant_type: OAuthGrantType.DeviceAuthorization,
+      client_id: clientId
+    }).toString();
+    const response = await fetch(metadata.token_endpoint, {
+      method: Method.Post,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body
+    });
+    if (response.ok) {
+      return await response.json();
+    }
+    const errorResponse = await response.json();
+    switch (errorResponse.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5000;
+        break;
+      case "access_denied":
+      case "expired_token":
+        return errorResponse;
+    }
+    await sleep(interval);
+  } while (Date.now() < expiration);
+  return {
+    error: "expired"
   };
-}();
+};
 //# sourceMappingURL=authorize.js.map