oidc-spa 7.1.7 → 7.1.9

package/core/AuthResponse.d.ts

@@ -2,5 +2,4 @@ export type AuthResponse = {
     state: string;
     [key: string]: string | undefined;
 };
-export declare function getIsAuthResponse(data: any): data is AuthResponse;
 export declare function authResponseToUrl(authResponse: AuthResponse): string;

package/core/AuthResponse.js

@@ -27,15 +27,8 @@ var __read = (this && this.__read) || function (o, n) {
     return ar;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getIsAuthResponse = getIsAuthResponse;
 exports.authResponseToUrl = authResponseToUrl;
 var urlSearchParams_1 = require("../tools/urlSearchParams");
-function getIsAuthResponse(data) {
-    return (data instanceof Object &&
-        "state" in data &&
-        typeof data.state === "string" &&
-        Object.values(data).every(function (value) { return value === undefined || typeof value === "string"; }));
-}
 function authResponseToUrl(authResponse) {
     var e_1, _a;
     var authResponseUrl = "https://dummy.com";

package/core/AuthResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthResponse.js","sourceRoot":"","sources":["../src/core/AuthResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,8CAOC;AAED,8CAgBC;AAhCD,4DAAkE;AAOlE,SAAgB,iBAAiB,CAAC,IAAS;IACvC,OAAO,CACH,IAAI,YAAY,MAAM;QACtB,OAAO,IAAI,IAAI;QACf,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAA,KAAK,IAAI,OAAA,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAhD,CAAgD,CAAC,CACvF,CAAC;AACN,CAAC;AAED,SAAgB,iBAAiB,CAAC,YAA0B;;IACxD,IAAI,eAAe,GAAG,mBAAmB,CAAC;;QAE1C,KAA4B,IAAA,KAAA,SAAA,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA,gBAAA,4BAAE,CAAC;YAAhD,IAAA,KAAA,mBAAa,EAAZ,MAAI,QAAA,EAAE,KAAK,QAAA;YACnB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS;YACb,CAAC;YACD,eAAe,GAAG,IAAA,wCAAsB,EAAC;gBACrC,GAAG,EAAE,eAAe;gBACpB,IAAI,QAAA;gBACJ,KAAK,OAAA;gBACL,YAAY,EAAE,UAAU;aAC3B,CAAC,CAAC;QACP,CAAC;;;;;;;;;IAED,OAAO,eAAe,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"AuthResponse.js","sourceRoot":"","sources":["../src/core/AuthResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,8CAgBC;AAvBD,4DAAkE;AAOlE,SAAgB,iBAAiB,CAAC,YAA0B;;IACxD,IAAI,eAAe,GAAG,mBAAmB,CAAC;;QAE1C,KAA4B,IAAA,KAAA,SAAA,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA,gBAAA,4BAAE,CAAC;YAAhD,IAAA,KAAA,mBAAa,EAAZ,MAAI,QAAA,EAAE,KAAK,QAAA;YACnB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,SAAS;YACb,CAAC;YACD,eAAe,GAAG,IAAA,wCAAsB,EAAC;gBACrC,GAAG,EAAE,eAAe;gBACpB,IAAI,QAAA;gBACJ,KAAK,OAAA;gBACL,YAAY,EAAE,UAAU;aAC3B,CAAC,CAAC;QACP,CAAC;;;;;;;;;IAED,OAAO,eAAe,CAAC;AAC3B,CAAC"}

package/core/createOidc.js

@@ -125,7 +125,7 @@ var trustedFetch_1 = require("./trustedFetch");
 var getIsOnline_1 = require("../tools/getIsOnline");
 (0, handleOidcCallback_1.handleOidcCallback)();
 // NOTE: Replaced at build time
-var VERSION = "7.1.7";
+var VERSION = "7.1.9";
 var globalContext = {
     prOidcByConfigId: new Map(),
     hasLogoutBeenCalled: (0, tsafe_1.id)(false),

package/core/handleOidcCallback.d.ts

@@ -3,6 +3,8 @@ import type { AuthResponse } from "./AuthResponse";
 export declare function handleOidcCallback(): {
     isHandled: boolean;
 };
+declare const moveRedirectAuthResponseFromSessionStorageToMemory: () => void;
+export { moveRedirectAuthResponseFromSessionStorageToMemory };
 export declare function retrieveRedirectAuthResponseAndStateData(params: {
     configId: string;
 }): {

package/core/handleOidcCallback.js

@@ -47,12 +47,14 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     return to.concat(ar || Array.prototype.slice.call(from));
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.moveRedirectAuthResponseFromSessionStorageToMemory = void 0;
 exports.handleOidcCallback = handleOidcCallback;
 exports.retrieveRedirectAuthResponseAndStateData = retrieveRedirectAuthResponseAndStateData;
 var StateData_1 = require("./StateData");
 var tsafe_1 = require("../vendor/frontend/tsafe");
 var initialLocationHref_1 = require("./initialLocationHref");
 var trustedFetch_1 = require("./trustedFetch");
+var iframeMessageProtection_1 = require("./iframeMessageProtection");
 (0, trustedFetch_1.captureFetch)();
 var globalContext = {
     previousCall: (0, tsafe_1.id)(undefined)
@@ -126,7 +128,8 @@ function handleOidcCallback_nonMemoized() {
             // NOTE: This is a "better than nothing" approach.
             // Under some circumstances it's possible to get stuck on this url
             // if there is no "next" page in the history for example, navigating
-            // forward is a NoOp. So in that case it's better to navigate to the home.
+            // forward is a NoOp. So in that case it's better to reload the same route
+            // with just the authResponse removed from the url to avoid re-entering here.
             setTimeout(function () {
                 var _a = window.location, protocol = _a.protocol, host = _a.host, pathname = _a.pathname, hash = _a.hash;
                 window.location.href = "".concat(protocol, "//").concat(host).concat(pathname).concat(hash);
@@ -151,9 +154,12 @@ function handleOidcCallback_nonMemoized() {
     (0, tsafe_1.assert)(authResponse.state !== "", "063965");
     switch (stateData.context) {
         case "iframe":
-            setTimeout(function () {
-                parent.postMessage(authResponse, location.origin);
-            }, 0);
+            (0, iframeMessageProtection_1.encryptAuthResponse)({
+                authResponse: authResponse
+            }).then(function (_a) {
+                var encryptedMessage = _a.encryptedMessage;
+                return parent.postMessage(encryptedMessage, location.origin);
+            });
             break;
         case "redirect":
             (0, StateData_1.markStateDataAsProcessedByCallback)({ stateQueryParamValue: stateQueryParamValue });
@@ -177,8 +183,17 @@ function handleOidcCallback_nonMemoized() {
 }
 var _a = (function () {
     var AUTH_RESPONSES_KEY = "oidc-spa:authResponses";
+    var authResponses_movedToMemoryFromSessionStorage = undefined;
+    // NOTE: Here we note that we can re-write on session storage some auth response
+    // after earlyInit in retrieveRedirectAuthResponseAndStateData
+    // In situation where there are more than one client in the same app and we can't use iframe,
+    // we can have one client that has to redirect before the response has been dealt with.
+    // In most case it won't happen if the init sequence is deterministic but the client
+    // can be instantiated at any time really.
+    // So the move to memory of the response is fully effective only when theres one client.
     function writeRedirectAuthResponses(params) {
         var authResponses = params.authResponses;
+        authResponses_movedToMemoryFromSessionStorage = undefined;
         if (authResponses.length === 0) {
             sessionStorage.removeItem(AUTH_RESPONSES_KEY);
             return;
@@ -186,14 +201,27 @@ var _a = (function () {
         sessionStorage.setItem(AUTH_RESPONSES_KEY, JSON.stringify(authResponses));
     }
     function readRedirectAuthResponses() {
+        if (authResponses_movedToMemoryFromSessionStorage !== undefined) {
+            return authResponses_movedToMemoryFromSessionStorage;
+        }
         var raw = sessionStorage.getItem(AUTH_RESPONSES_KEY);
         if (raw === null) {
             return [];
         }
         return JSON.parse(raw);
     }
-    return { writeRedirectAuthResponses: writeRedirectAuthResponses, readRedirectAuthResponses: readRedirectAuthResponses };
-})(), readRedirectAuthResponses = _a.readRedirectAuthResponses, writeRedirectAuthResponses = _a.writeRedirectAuthResponses;
+    function moveRedirectAuthResponseFromSessionStorageToMemory() {
+        var authResponses = readRedirectAuthResponses();
+        writeRedirectAuthResponses({ authResponses: [] });
+        authResponses_movedToMemoryFromSessionStorage = authResponses;
+    }
+    return {
+        writeRedirectAuthResponses: writeRedirectAuthResponses,
+        readRedirectAuthResponses: readRedirectAuthResponses,
+        moveRedirectAuthResponseFromSessionStorageToMemory: moveRedirectAuthResponseFromSessionStorageToMemory
+    };
+})(), readRedirectAuthResponses = _a.readRedirectAuthResponses, writeRedirectAuthResponses = _a.writeRedirectAuthResponses, moveRedirectAuthResponseFromSessionStorageToMemory = _a.moveRedirectAuthResponseFromSessionStorageToMemory;
+exports.moveRedirectAuthResponseFromSessionStorageToMemory = moveRedirectAuthResponseFromSessionStorageToMemory;
 function retrieveRedirectAuthResponseAndStateData(params) {
     var e_2, _a;
     var configId = params.configId;
@@ -223,9 +251,7 @@ function retrieveRedirectAuthResponseAndStateData(params) {
         }
         finally { if (e_2) throw e_2.error; }
     }
-    if (authResponseAndStateData !== undefined) {
-        writeRedirectAuthResponses({ authResponses: authResponses });
-    }
+    writeRedirectAuthResponses({ authResponses: authResponses });
     return authResponseAndStateData;
 }
 function reloadOnBfCacheNavigation() {

package/core/handleOidcCallback.js.map

@@ -1 +1 @@
-{"version":3,"file":"handleOidcCallback.js","sourceRoot":"","sources":["../src/core/handleOidcCallback.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,gDAMC;AAmKD,4FAoCC;AA9ND,yCAKqB;AACrB,kDAAsD;AAEtD,6DAA4D;AAC5D,+CAA8C;AAE9C,IAAA,2BAAY,GAAE,CAAC;AAEf,IAAM,aAAa,GAAG;IAClB,YAAY,EAAE,IAAA,UAAE,EAAqC,SAAS,CAAC;CAClE,CAAC;AAEF,SAAgB,kBAAkB;IAC9B,IAAI,aAAa,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,aAAa,CAAC,YAAY,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,aAAa,CAAC,YAAY,GAAG,8BAA8B,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,8BAA8B;;IACnC,IAAM,eAAe,GAAG,IAAI,GAAG,CAAC,yCAAmB,CAAC,CAAC;IAErD,IAAM,oBAAoB,GAAG,CAAC;QAC1B,IAAM,oBAAoB,GAAG,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEvE,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,IAAA,oCAAwB,EAAC,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;YACjF,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IACI,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;YACtD,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI;YAC1D,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAC3D,CAAC;YACC,mFAAmF;YACnF,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO,oBAAoB,CAAC;IAChC,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACrC,IAAM,kBAAkB,GAAG,sBAAsB,EAAE,CAAC;QAEpD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnC,uBAAuB,CAAC;gBACpB,kBAAkB,wBACX,kBAAkB,KACrB,iBAAiB,EAAE,IAAI,GAC1B;aACJ,CAAC,CAAC;QACP,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,IAAM,SAAS,GAAG,IAAI,CAAC;IAEvB,OAAO,CAAC,GAAG,GAAG,cAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,GAAG,cAAO,CAAC,CAAC;IACxB,OAAO,CAAC,KAAK,GAAG,cAAO,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,GAAG,cAAO,CAAC,CAAC;IAEzB,IAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,EAAE,oBAAoB,sBAAA,EAAE,CAAC,CAAC;IAEzD,IACI,SAAS,KAAK,SAAS;QACvB,CAAC,SAAS,CAAC,OAAO,KAAK,UAAU,IAAI,SAAS,CAAC,0BAA0B,CAAC,EAC5E,CAAC;QACC,IAAM,eAAa,GAAuB,CAAC;YACvC,IAAM,kBAAkB,GAAG,sBAAsB,EAAE,CAAC;YAEpD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC;YAClB,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBACxC,OAAO,kBAAkB,CAAC,qBAAqB,CAAC;YACpD,CAAC;YAED,QAAQ,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,KAAK,MAAM;oBACP,OAAO,SAAS,CAAC;gBACrB,KAAK,SAAS;oBACV,OAAO,MAAM,CAAC;YACtB,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;QAEL,uBAAuB,CAAC;YACpB,kBAAkB,EAAE;gBAChB,qBAAqB,EAAE,eAAa;gBACpC,iBAAiB,EAAE,KAAK;aAC3B;SACJ,CAAC,CAAC;QAEH,UAAU,CAAC;YACP,yBAAyB,EAAE,CAAC;YAE5B,MAAM,CAAC,OAAO,CAAC,eAAa,CAAC,EAAE,CAAC;YAEhC,kDAAkD;YAClD,kEAAkE;YAClE,oEAAoE;YACpE,0EAA0E;YAC1E,UAAU,CAAC;gBACD,IAAA,KAAqC,MAAM,CAAC,QAAQ,EAAlD,QAAQ,cAAA,EAAE,IAAI,UAAA,EAAE,QAAQ,cAAA,EAAE,IAAI,UAAoB,CAAC;gBAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAG,QAAQ,eAAK,IAAI,SAAG,QAAQ,SAAG,IAAI,CAAE,CAAC;YACpE,CAAC,EAAE,GAAG,CAAC,CAAC;QACZ,CAAC,EAAE,CAAC,CAAC,CAAC;QAEN,OAAO,EAAE,SAAS,WAAA,EAAE,CAAC;IACzB,CAAC;IAED,IAAM,YAAY,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;;QAEjD,KAA2B,IAAA,KAAA,SAAA,eAAe,CAAC,YAAY,CAAA,gBAAA,4BAAE,CAAC;YAA/C,IAAA,KAAA,mBAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YAClB,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;;;;;;;;;IAED,IAAA,cAAM,EAAC,YAAY,CAAC,KAAK,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE5C,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,QAAQ;YACT,UAAU,CAAC;gBACP,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,MAAM;QACV,KAAK,UAAU;YACX,IAAA,8CAAkC,EAAC,EAAE,oBAAoB,sBAAA,EAAE,CAAC,CAAC;YAC7D,uBAAuB,EAAE,CAAC;YAC1B,0BAA0B,CAAC;gBACvB,aAAa,yCAAM,yBAAyB,EAAE,YAAE,YAAY,SAAC;aAChE,CAAC,CAAC;YACH,yBAAyB,EAAE,CAAC;YAC5B,UAAU,CAAC;gBACP,IAAM,IAAI,GAAG,CAAC;oBACV,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;wBAC5E,OAAO,SAAS,CAAC,+BAA+B,CAAC;oBACrD,CAAC;oBAED,OAAO,SAAS,CAAC,WAAW,CAAC;gBACjC,CAAC,CAAC,EAAE,CAAC;gBAEL,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACzB,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,MAAM;IACd,CAAC;IAED,OAAO,EAAE,SAAS,WAAA,EAAE,CAAC;AACzB,CAAC;AAEK,IAAA,KAA4D,CAAC;IAC/D,IAAM,kBAAkB,GAAG,wBAAwB,CAAC;IAEpD,SAAS,0BAA0B,CAAC,MAAyC;QACjE,IAAA,aAAa,GAAK,MAAM,cAAX,CAAY;QACjC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAC9C,OAAO;QACX,CAAC;QACD,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,SAAS,yBAAyB;QAC9B,IAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAEvD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,EAAE,0BAA0B,4BAAA,EAAE,yBAAyB,2BAAA,EAAE,CAAC;AACrE,CAAC,CAAC,EAAE,EAvBI,yBAAyB,+BAAA,EAAE,0BAA0B,gCAuBzD,CAAC;AAEL,SAAgB,wCAAwC,CAAC,MAExD;;IACW,IAAA,QAAQ,GAAK,MAAM,SAAX,CAAY;IAE5B,IAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;IAElD,IAAI,wBAAwB,GAEV,SAAS,CAAC;;QAE5B,KAA2B,IAAA,KAAA,kCAAI,aAAa,UAAC,gBAAA,4BAAE,CAAC;YAA3C,IAAM,YAAY,WAAA;YACnB,IAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YAE7E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,6DAA6D;gBAC7D,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7D,SAAS;YACb,CAAC;YAED,IAAA,cAAM,EAAC,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEnD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,SAAS;YACb,CAAC;YAED,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7D,wBAAwB,GAAG,EAAE,YAAY,cAAA,EAAE,SAAS,WAAA,EAAE,CAAC;QAC3D,CAAC;;;;;;;;;IAED,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACzC,0BAA0B,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,wBAAwB,CAAC;AACpC,CAAC;AAED,SAAS,yBAAyB;IAC9B,IAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE;QAChC,IAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC;AAEK,IAAA,KAA+E,CAAC;IAClF,IAAM,2BAA2B,GAAG,wCAAwC,CAAC;IAO7E,SAAS,uBAAuB,CAAC,MAAkD;QACvE,IAAA,kBAAkB,GAAK,MAAM,mBAAX,CAAY;QAEtC,cAAc,CAAC,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,SAAS,sBAAsB;QAC3B,IAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAEhE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,uBAAuB;QAC5B,cAAc,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,uBAAuB,yBAAA,EAAE,sBAAsB,wBAAA,EAAE,uBAAuB,yBAAA,EAAE,CAAC;AACxF,CAAC,CAAC,EAAE,EA7BI,uBAAuB,6BAAA,EAAE,sBAAsB,4BAAA,EAAE,uBAAuB,6BA6B5E,CAAC"}
+{"version":3,"file":"handleOidcCallback.js","sourceRoot":"","sources":["../src/core/handleOidcCallback.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkBA,gDAMC;AAsMD,4FAkCC;AAhQD,yCAKqB;AACrB,kDAAsD;AAEtD,6DAA4D;AAC5D,+CAA8C;AAC9C,qEAAgE;AAEhE,IAAA,2BAAY,GAAE,CAAC;AAEf,IAAM,aAAa,GAAG;IAClB,YAAY,EAAE,IAAA,UAAE,EAAqC,SAAS,CAAC;CAClE,CAAC;AAEF,SAAgB,kBAAkB;IAC9B,IAAI,aAAa,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,aAAa,CAAC,YAAY,CAAC;IACtC,CAAC;IAED,OAAO,CAAC,aAAa,CAAC,YAAY,GAAG,8BAA8B,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,8BAA8B;;IACnC,IAAM,eAAe,GAAG,IAAI,GAAG,CAAC,yCAAmB,CAAC,CAAC;IAErD,IAAM,oBAAoB,GAAG,CAAC;QAC1B,IAAM,oBAAoB,GAAG,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEvE,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,IAAA,oCAAwB,EAAC,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;YACjF,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,IACI,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI;YACtD,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI;YAC1D,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,EAC3D,CAAC;YACC,mFAAmF;YACnF,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO,oBAAoB,CAAC;IAChC,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACrC,IAAM,kBAAkB,GAAG,sBAAsB,EAAE,CAAC;QAEpD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACnC,uBAAuB,CAAC;gBACpB,kBAAkB,wBACX,kBAAkB,KACrB,iBAAiB,EAAE,IAAI,GAC1B;aACJ,CAAC,CAAC;QACP,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,IAAM,SAAS,GAAG,IAAI,CAAC;IAEvB,OAAO,CAAC,GAAG,GAAG,cAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,GAAG,cAAO,CAAC,CAAC;IACxB,OAAO,CAAC,KAAK,GAAG,cAAO,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,GAAG,cAAO,CAAC,CAAC;IAEzB,IAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,EAAE,oBAAoB,sBAAA,EAAE,CAAC,CAAC;IAEzD,IACI,SAAS,KAAK,SAAS;QACvB,CAAC,SAAS,CAAC,OAAO,KAAK,UAAU,IAAI,SAAS,CAAC,0BAA0B,CAAC,EAC5E,CAAC;QACC,IAAM,eAAa,GAAuB,CAAC;YACvC,IAAM,kBAAkB,GAAG,sBAAsB,EAAE,CAAC;YAEpD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC;YAClB,CAAC;YAED,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC;gBACxC,OAAO,kBAAkB,CAAC,qBAAqB,CAAC;YACpD,CAAC;YAED,QAAQ,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,KAAK,MAAM;oBACP,OAAO,SAAS,CAAC;gBACrB,KAAK,SAAS;oBACV,OAAO,MAAM,CAAC;YACtB,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;QAEL,uBAAuB,CAAC;YACpB,kBAAkB,EAAE;gBAChB,qBAAqB,EAAE,eAAa;gBACpC,iBAAiB,EAAE,KAAK;aAC3B;SACJ,CAAC,CAAC;QAEH,UAAU,CAAC;YACP,yBAAyB,EAAE,CAAC;YAE5B,MAAM,CAAC,OAAO,CAAC,eAAa,CAAC,EAAE,CAAC;YAEhC,kDAAkD;YAClD,kEAAkE;YAClE,oEAAoE;YACpE,0EAA0E;YAC1E,6EAA6E;YAC7E,UAAU,CAAC;gBACD,IAAA,KAAqC,MAAM,CAAC,QAAQ,EAAlD,QAAQ,cAAA,EAAE,IAAI,UAAA,EAAE,QAAQ,cAAA,EAAE,IAAI,UAAoB,CAAC;gBAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAG,QAAQ,eAAK,IAAI,SAAG,QAAQ,SAAG,IAAI,CAAE,CAAC;YACpE,CAAC,EAAE,GAAG,CAAC,CAAC;QACZ,CAAC,EAAE,CAAC,CAAC,CAAC;QAEN,OAAO,EAAE,SAAS,WAAA,EAAE,CAAC;IACzB,CAAC;IAED,IAAM,YAAY,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;;QAEjD,KAA2B,IAAA,KAAA,SAAA,eAAe,CAAC,YAAY,CAAA,gBAAA,4BAAE,CAAC;YAA/C,IAAA,KAAA,mBAAY,EAAX,GAAG,QAAA,EAAE,KAAK,QAAA;YAClB,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;;;;;;;;;IAED,IAAA,cAAM,EAAC,YAAY,CAAC,KAAK,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE5C,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,QAAQ;YACT,IAAA,6CAAmB,EAAC;gBAChB,YAAY,cAAA;aACf,CAAC,CAAC,IAAI,CAAC,UAAC,EAAoB;oBAAlB,gBAAgB,sBAAA;gBAAO,OAAA,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC;YAArD,CAAqD,CAAC,CAAC;YACzF,MAAM;QACV,KAAK,UAAU;YACX,IAAA,8CAAkC,EAAC,EAAE,oBAAoB,sBAAA,EAAE,CAAC,CAAC;YAC7D,uBAAuB,EAAE,CAAC;YAC1B,0BAA0B,CAAC;gBACvB,aAAa,yCAAM,yBAAyB,EAAE,YAAE,YAAY,SAAC;aAChE,CAAC,CAAC;YACH,yBAAyB,EAAE,CAAC;YAC5B,UAAU,CAAC;gBACP,IAAM,IAAI,GAAG,CAAC;oBACV,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;wBAC5E,OAAO,SAAS,CAAC,+BAA+B,CAAC;oBACrD,CAAC;oBAED,OAAO,SAAS,CAAC,WAAW,CAAC;gBACjC,CAAC,CAAC,EAAE,CAAC;gBAEL,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACzB,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,MAAM;IACd,CAAC;IAED,OAAO,EAAE,SAAS,WAAA,EAAE,CAAC;AACzB,CAAC;AAEK,IAAA,KAIF,CAAC;IACD,IAAM,kBAAkB,GAAG,wBAAwB,CAAC;IAEpD,IAAI,6CAA6C,GAA+B,SAAS,CAAC;IAE1F,gFAAgF;IAChF,8DAA8D;IAC9D,6FAA6F;IAC7F,uFAAuF;IACvF,oFAAoF;IACpF,0CAA0C;IAC1C,wFAAwF;IACxF,SAAS,0BAA0B,CAAC,MAAyC;QACjE,IAAA,aAAa,GAAK,MAAM,cAAX,CAAY;QAEjC,6CAA6C,GAAG,SAAS,CAAC;QAE1D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,cAAc,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAC9C,OAAO;QACX,CAAC;QACD,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,SAAS,yBAAyB;QAC9B,IAAI,6CAA6C,KAAK,SAAS,EAAE,CAAC;YAC9D,OAAO,6CAA6C,CAAC;QACzD,CAAC;QAED,IAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAEvD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,kDAAkD;QACvD,IAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;QAElD,0BAA0B,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAElD,6CAA6C,GAAG,aAAa,CAAC;IAClE,CAAC;IAED,OAAO;QACH,0BAA0B,4BAAA;QAC1B,yBAAyB,2BAAA;QACzB,kDAAkD,oDAAA;KACrD,CAAC;AACN,CAAC,CAAC,EAAE,EAtDA,yBAAyB,+BAAA,EACzB,0BAA0B,gCAAA,EAC1B,kDAAkD,wDAoDlD,CAAC;AAEI,gHAAkD;AAE3D,SAAgB,wCAAwC,CAAC,MAExD;;IACW,IAAA,QAAQ,GAAK,MAAM,SAAX,CAAY;IAE5B,IAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;IAElD,IAAI,wBAAwB,GAEV,SAAS,CAAC;;QAE5B,KAA2B,IAAA,KAAA,kCAAI,aAAa,UAAC,gBAAA,4BAAE,CAAC;YAA3C,IAAM,YAAY,WAAA;YACnB,IAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;YAE7E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC1B,6DAA6D;gBAC7D,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7D,SAAS;YACb,CAAC;YAED,IAAA,cAAM,EAAC,SAAS,CAAC,OAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,CAAC;YAEnD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,SAAS;YACb,CAAC;YAED,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7D,wBAAwB,GAAG,EAAE,YAAY,cAAA,EAAE,SAAS,WAAA,EAAE,CAAC;QAC3D,CAAC;;;;;;;;;IAED,0BAA0B,CAAC,EAAE,aAAa,eAAA,EAAE,CAAC,CAAC;IAE9C,OAAO,wBAAwB,CAAC;AACpC,CAAC;AAED,SAAS,yBAAyB;IAC9B,IAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE;QAChC,IAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC;AAEK,IAAA,KAA+E,CAAC;IAClF,IAAM,2BAA2B,GAAG,wCAAwC,CAAC;IAO7E,SAAS,uBAAuB,CAAC,MAAkD;QACvE,IAAA,kBAAkB,GAAK,MAAM,mBAAX,CAAY;QAEtC,cAAc,CAAC,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,SAAS,sBAAsB;QAC3B,IAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAEhE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,uBAAuB;QAC5B,cAAc,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,EAAE,uBAAuB,yBAAA,EAAE,sBAAsB,wBAAA,EAAE,uBAAuB,yBAAA,EAAE,CAAC;AACxF,CAAC,CAAC,EAAE,EA7BI,uBAAuB,6BAAA,EAAE,sBAAsB,4BAAA,EAAE,uBAAuB,6BA6B5E,CAAC"}

package/core/iframeMessageProtection.d.ts

@@ -0,0 +1,20 @@
+import { type AuthResponse } from "./AuthResponse";
+export declare function preventSessionStorageSetItemOfPublicKeyByThirdParty(): void;
+export declare function initIframeMessageProtection(params: {
+    stateQueryParamValue: string;
+}): Promise<{
+    getIsEncryptedAuthResponse: (params: {
+        message: unknown;
+    }) => boolean;
+    decodeEncryptedAuth: (params: {
+        encryptedAuthResponse: string;
+    }) => Promise<{
+        authResponse: AuthResponse;
+    }>;
+    clearSessionStoragePublicKey: () => void;
+}>;
+export declare function encryptAuthResponse(params: {
+    authResponse: AuthResponse;
+}): Promise<{
+    encryptedMessage: string;
+}>;

package/core/iframeMessageProtection.js

@@ -0,0 +1,135 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preventSessionStorageSetItemOfPublicKeyByThirdParty = preventSessionStorageSetItemOfPublicKeyByThirdParty;
+exports.initIframeMessageProtection = initIframeMessageProtection;
+exports.encryptAuthResponse = encryptAuthResponse;
+var assert_1 = require("tsafe/assert");
+var asymmetricEncryption_1 = require("../tools/asymmetricEncryption");
+var setItem_real = Storage.prototype.setItem;
+var SESSION_STORAGE_PREFIX = "oidc-spa_iframe_authResponse_publicKey_";
+function preventSessionStorageSetItemOfPublicKeyByThirdParty() {
+    var setItem_protected = function setItem(key, value) {
+        if (this !== sessionStorage) {
+            return setItem_real.call(this, key, value);
+        }
+        if (key.startsWith(SESSION_STORAGE_PREFIX)) {
+            throw new Error("Attack prevented by oidc-spa. You have malicious code running in your system");
+        }
+        return setItem_real.call(sessionStorage, key, value);
+    };
+    {
+        var pd = Object.getOwnPropertyDescriptor(Storage.prototype, "setItem");
+        (0, assert_1.assert)(pd !== undefined);
+        Object.defineProperty(Storage.prototype, "setItem", {
+            enumerable: pd.enumerable,
+            writable: pd.writable,
+            value: setItem_protected
+        });
+    }
+}
+var ENCRYPTED_AUTH_RESPONSES_PREFIX = "oidc-spa_encrypted_authResponse_";
+function getSessionStorageKey(params) {
+    var stateQueryParamValue = params.stateQueryParamValue;
+    return "".concat(SESSION_STORAGE_PREFIX).concat(stateQueryParamValue);
+}
+function initIframeMessageProtection(params) {
+    return __awaiter(this, void 0, void 0, function () {
+        function getIsEncryptedAuthResponse(params) {
+            var message = params.message;
+            return typeof message === "string" && message.startsWith(ENCRYPTED_AUTH_RESPONSES_PREFIX);
+        }
+        function decodeEncryptedAuth(params) {
+            return __awaiter(this, void 0, void 0, function () {
+                var encryptedAuthResponse, authResponse_str, authResponse;
+                return __generator(this, function (_a) {
+                    switch (_a.label) {
+                        case 0:
+                            encryptedAuthResponse = params.encryptedAuthResponse;
+                            return [4 /*yield*/, (0, asymmetricEncryption_1.asymmetricDecrypt)({
+                                    encryptedMessage: encryptedAuthResponse.slice(ENCRYPTED_AUTH_RESPONSES_PREFIX.length),
+                                    privateKey: privateKey
+                                })];
+                        case 1:
+                            authResponse_str = (_a.sent()).message;
+                            authResponse = JSON.parse(authResponse_str);
+                            return [2 /*return*/, { authResponse: authResponse }];
+                    }
+                });
+            });
+        }
+        function clearSessionStoragePublicKey() {
+            sessionStorage.removeItem(sessionStorageKey);
+        }
+        var stateQueryParamValue, _a, publicKey, privateKey, sessionStorageKey;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    stateQueryParamValue = params.stateQueryParamValue;
+                    return [4 /*yield*/, (0, asymmetricEncryption_1.generateKeys)()];
+                case 1:
+                    _a = _b.sent(), publicKey = _a.publicKey, privateKey = _a.privateKey;
+                    sessionStorageKey = getSessionStorageKey({ stateQueryParamValue: stateQueryParamValue });
+                    setItem_real.call(sessionStorage, sessionStorageKey, publicKey);
+                    return [2 /*return*/, { getIsEncryptedAuthResponse: getIsEncryptedAuthResponse, decodeEncryptedAuth: decodeEncryptedAuth, clearSessionStoragePublicKey: clearSessionStoragePublicKey }];
+            }
+        });
+    });
+}
+function encryptAuthResponse(params) {
+    return __awaiter(this, void 0, void 0, function () {
+        var authResponse, publicKey, encryptedMessage_withoutPrefix, encryptedMessage;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    authResponse = params.authResponse;
+                    publicKey = sessionStorage.getItem(getSessionStorageKey({ stateQueryParamValue: authResponse.state }));
+                    (0, assert_1.assert)(publicKey !== null, "2293302");
+                    return [4 /*yield*/, (0, asymmetricEncryption_1.asymmetricEncrypt)({
+                            publicKey: publicKey,
+                            message: JSON.stringify(authResponse)
+                        })];
+                case 1:
+                    encryptedMessage_withoutPrefix = (_a.sent()).encryptedMessage;
+                    encryptedMessage = "".concat(ENCRYPTED_AUTH_RESPONSES_PREFIX).concat(encryptedMessage_withoutPrefix);
+                    return [2 /*return*/, { encryptedMessage: encryptedMessage }];
+            }
+        });
+    });
+}
+//# sourceMappingURL=iframeMessageProtection.js.map

package/core/iframeMessageProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframeMessageProtection.js","sourceRoot":"","sources":["../src/core/iframeMessageProtection.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,kHA0BC;AAUD,kEAmCC;AAED,kDAiBC;AAlGD,uCAAsC;AACtC,sEAAmG;AAGnG,IAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;AAE/C,IAAM,sBAAsB,GAAG,yCAAyC,CAAC;AAEzE,SAAgB,mDAAmD;IAC/D,IAAM,iBAAiB,GAAG,SAAS,OAAO,CAAY,GAAW,EAAE,KAAa;QAC5E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACX,8EAA8E,CACjF,CAAC;QACN,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,CAAC;QACG,IAAM,EAAE,GAAG,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEzE,IAAA,eAAM,EAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAEzB,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;YAChD,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,KAAK,EAAE,iBAAiB;SAC3B,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AAED,IAAM,+BAA+B,GAAG,kCAAkC,CAAC;AAE3E,SAAS,oBAAoB,CAAC,MAAwC;IAC1D,IAAA,oBAAoB,GAAK,MAAM,qBAAX,CAAY;IAExC,OAAO,UAAG,sBAAsB,SAAG,oBAAoB,CAAE,CAAC;AAC9D,CAAC;AAED,SAAsB,2BAA2B,CAAC,MAAwC;;QAStF,SAAS,0BAA0B,CAAC,MAA4B;YACpD,IAAA,OAAO,GAAK,MAAM,QAAX,CAAY;YAE3B,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC;QAC9F,CAAC;QAED,SAAe,mBAAmB,CAAC,MAElC;;;;;;4BACW,qBAAqB,GAAK,MAAM,sBAAX,CAAY;4BAEH,qBAAM,IAAA,wCAAiB,EAAC;oCAC1D,gBAAgB,EAAE,qBAAqB,CAAC,KAAK,CAAC,+BAA+B,CAAC,MAAM,CAAC;oCACrF,UAAU,YAAA;iCACb,CAAC,EAAA;;4BAHe,gBAAgB,GAAK,CAAA,SAGpC,CAAA,QAH+B;4BAK3B,YAAY,GAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;4BAEhE,sBAAO,EAAE,YAAY,cAAA,EAAE,EAAC;;;;SAC3B;QAED,SAAS,4BAA4B;YACjC,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;;;;;oBA/BO,oBAAoB,GAAK,MAAM,qBAAX,CAAY;oBAEN,qBAAM,IAAA,mCAAY,GAAE,EAAA;;oBAAhD,KAA4B,SAAoB,EAA9C,SAAS,eAAA,EAAE,UAAU,gBAAA;oBAEvB,iBAAiB,GAAG,oBAAoB,CAAC,EAAE,oBAAoB,sBAAA,EAAE,CAAC,CAAC;oBAEzE,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC;oBA2BhE,sBAAO,EAAE,0BAA0B,4BAAA,EAAE,mBAAmB,qBAAA,EAAE,4BAA4B,8BAAA,EAAE,EAAC;;;;CAC5F;AAED,SAAsB,mBAAmB,CAAC,MAAsC;;;;;;oBACpE,YAAY,GAAK,MAAM,aAAX,CAAY;oBAE1B,SAAS,GAAG,cAAc,CAAC,OAAO,CACpC,oBAAoB,CAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CACrE,CAAC;oBAEF,IAAA,eAAM,EAAC,SAAS,KAAK,IAAI,EAAE,SAAS,CAAC,CAAC;oBAEuB,qBAAM,IAAA,wCAAiB,EAAC;4BACjF,SAAS,WAAA;4BACT,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;yBACxC,CAAC,EAAA;;oBAHwB,8BAA8B,GAAK,CAAA,SAG3D,CAAA,iBAHsD;oBAKlD,gBAAgB,GAAG,UAAG,+BAA+B,SAAG,8BAA8B,CAAE,CAAC;oBAE/F,sBAAO,EAAE,gBAAgB,kBAAA,EAAE,EAAC;;;;CAC/B"}

package/core/loginSilent.js

@@ -69,132 +69,155 @@ var tsafe_1 = require("../vendor/frontend/tsafe");
 var StateData_1 = require("./StateData");
 var getDownlinkAndRtt_1 = require("../tools/getDownlinkAndRtt");
 var isDev_1 = require("../tools/isDev");
-var AuthResponse_1 = require("./AuthResponse");
 var urlSearchParams_1 = require("../tools/urlSearchParams");
+var iframeMessageProtection_1 = require("./iframeMessageProtection");
 function loginSilent(params) {
     return __awaiter(this, void 0, void 0, function () {
-        var oidcClientTsUserManager, stateQueryParamValue_instance, configId, transformUrlBeforeRedirect, getExtraQueryParams, getExtraTokenParams, autoLogin, dResult, timeoutDelayMs, timeout, listener, transformUrl_oidcClientTs;
+        var oidcClientTsUserManager, stateQueryParamValue_instance, configId, transformUrlBeforeRedirect, getExtraQueryParams, getExtraTokenParams, autoLogin, dResult, timeoutDelayMs, _a, decodeEncryptedAuth, getIsEncryptedAuthResponse, clearSessionStoragePublicKey, timeout, listener, transformUrl_oidcClientTs;
         var _this = this;
-        return __generator(this, function (_a) {
-            oidcClientTsUserManager = params.oidcClientTsUserManager, stateQueryParamValue_instance = params.stateQueryParamValue_instance, configId = params.configId, transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, getExtraQueryParams = params.getExtraQueryParams, getExtraTokenParams = params.getExtraTokenParams, autoLogin = params.autoLogin;
-            dResult = new Deferred_1.Deferred();
-            timeoutDelayMs = (function () {
-                if (autoLogin) {
-                    return 25000;
-                }
-                var downlinkAndRtt = (0, getDownlinkAndRtt_1.getDownlinkAndRtt)();
-                var isDev = (0, isDev_1.getIsDev)();
-                // Base delay is the minimum delay we should wait in any case
-                var BASE_DELAY_MS = isDev ? 9000 : 7000;
-                if (downlinkAndRtt === undefined) {
-                    return BASE_DELAY_MS;
-                }
-                var downlink = downlinkAndRtt.downlink, rtt = downlinkAndRtt.rtt;
-                // Calculate dynamic delay based on RTT and downlink
-                // Add 1 to downlink to avoid division by zero
-                var dynamicDelay = rtt * 2.5 + BASE_DELAY_MS / (downlink + 1);
-                return Math.max(BASE_DELAY_MS, dynamicDelay);
-            })();
-            timeout = setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    dResult.resolve({
-                        outcome: "failure",
-                        cause: "timeout"
-                    });
-                    return [2 /*return*/];
-                });
-            }); }, timeoutDelayMs);
-            listener = function (event) {
-                if (!(0, AuthResponse_1.getIsAuthResponse)(event.data)) {
-                    return;
-                }
-                var authResponse = event.data;
-                var stateData = (0, StateData_1.getStateData)({ stateQueryParamValue: authResponse.state });
-                (0, tsafe_1.assert)(stateData !== undefined, "765645");
-                (0, tsafe_1.assert)(stateData.context === "iframe", "250711");
-                if (stateData.configId !== configId) {
-                    return;
-                }
-                clearTimeout(timeout);
-                window.removeEventListener("message", listener);
-                dResult.resolve({
-                    outcome: "got auth response from iframe",
-                    authResponse: authResponse
-                });
-            };
-            window.addEventListener("message", listener, false);
-            transformUrl_oidcClientTs = function (url) {
-                var e_1, _a;
-                add_extra_query_params: {
-                    if (getExtraQueryParams === undefined) {
-                        break add_extra_query_params;
-                    }
-                    var extraQueryParams = getExtraQueryParams({ isSilent: true, url: url });
-                    try {
-                        for (var _b = __values(Object.entries(extraQueryParams)), _c = _b.next(); !_c.done; _c = _b.next()) {
-                            var _d = __read(_c.value, 2), name_1 = _d[0], value = _d[1];
-                            if (value === undefined) {
-                                continue;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    oidcClientTsUserManager = params.oidcClientTsUserManager, stateQueryParamValue_instance = params.stateQueryParamValue_instance, configId = params.configId, transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, getExtraQueryParams = params.getExtraQueryParams, getExtraTokenParams = params.getExtraTokenParams, autoLogin = params.autoLogin;
+                    dResult = new Deferred_1.Deferred();
+                    timeoutDelayMs = (function () {
+                        if (autoLogin) {
+                            return 25000;
+                        }
+                        var downlinkAndRtt = (0, getDownlinkAndRtt_1.getDownlinkAndRtt)();
+                        var isDev = (0, isDev_1.getIsDev)();
+                        // Base delay is the minimum delay we should wait in any case
+                        var BASE_DELAY_MS = isDev ? 9000 : 7000;
+                        if (downlinkAndRtt === undefined) {
+                            return BASE_DELAY_MS;
+                        }
+                        var downlink = downlinkAndRtt.downlink, rtt = downlinkAndRtt.rtt;
+                        // Calculate dynamic delay based on RTT and downlink
+                        // Add 1 to downlink to avoid division by zero
+                        var dynamicDelay = rtt * 2.5 + BASE_DELAY_MS / (downlink + 1);
+                        return Math.max(BASE_DELAY_MS, dynamicDelay);
+                    })();
+                    return [4 /*yield*/, (0, iframeMessageProtection_1.initIframeMessageProtection)({
+                            stateQueryParamValue: stateQueryParamValue_instance
+                        })];
+                case 1:
+                    _a = _b.sent(), decodeEncryptedAuth = _a.decodeEncryptedAuth, getIsEncryptedAuthResponse = _a.getIsEncryptedAuthResponse, clearSessionStoragePublicKey = _a.clearSessionStoragePublicKey;
+                    timeout = setTimeout(function () { return __awaiter(_this, void 0, void 0, function () {
+                        return __generator(this, function (_a) {
+                            dResult.resolve({
+                                outcome: "failure",
+                                cause: "timeout"
+                            });
+                            return [2 /*return*/];
+                        });
+                    }); }, timeoutDelayMs);
+                    listener = function (event) { return __awaiter(_this, void 0, void 0, function () {
+                        var authResponse, stateData;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    if (event.origin !== window.location.origin) {
+                                        return [2 /*return*/];
+                                    }
+                                    if (!getIsEncryptedAuthResponse({
+                                        message: event.data
+                                    })) {
+                                        return [2 /*return*/];
+                                    }
+                                    return [4 /*yield*/, decodeEncryptedAuth({ encryptedAuthResponse: event.data })];
+                                case 1:
+                                    authResponse = (_a.sent()).authResponse;
+                                    stateData = (0, StateData_1.getStateData)({ stateQueryParamValue: authResponse.state });
+                                    (0, tsafe_1.assert)(stateData !== undefined, "765645");
+                                    (0, tsafe_1.assert)(stateData.context === "iframe", "250711");
+                                    if (stateData.configId !== configId) {
+                                        return [2 /*return*/];
+                                    }
+                                    clearTimeout(timeout);
+                                    window.removeEventListener("message", listener);
+                                    dResult.resolve({
+                                        outcome: "got auth response from iframe",
+                                        authResponse: authResponse
+                                    });
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    window.addEventListener("message", listener, false);
+                    transformUrl_oidcClientTs = function (url) {
+                        var e_1, _a;
+                        add_extra_query_params: {
+                            if (getExtraQueryParams === undefined) {
+                                break add_extra_query_params;
+                            }
+                            var extraQueryParams = getExtraQueryParams({ isSilent: true, url: url });
+                            try {
+                                for (var _b = __values(Object.entries(extraQueryParams)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                                    var _d = __read(_c.value, 2), name_1 = _d[0], value = _d[1];
+                                    if (value === undefined) {
+                                        continue;
+                                    }
+                                    url = (0, urlSearchParams_1.addOrUpdateSearchParam)({ url: url, name: name_1, value: value, encodeMethod: "www-form" });
+                                }
+                            }
+                            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                            finally {
+                                try {
+                                    if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+                                }
+                                finally { if (e_1) throw e_1.error; }
                             }
-                            url = (0, urlSearchParams_1.addOrUpdateSearchParam)({ url: url, name: name_1, value: value, encodeMethod: "www-form" });
                         }
-                    }
-                    catch (e_1_1) { e_1 = { error: e_1_1 }; }
-                    finally {
-                        try {
-                            if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
+                        apply_transform_url: {
+                            if (transformUrlBeforeRedirect === undefined) {
+                                break apply_transform_url;
+                            }
+                            url = transformUrlBeforeRedirect({ authorizationUrl: url, isSilent: true });
+                        }
+                        return url;
+                    };
+                    oidcClientTsUserManager
+                        .signinSilent({
+                        state: (0, tsafe_1.id)({
+                            context: "iframe",
+                            configId: configId
+                        }),
+                        silentRequestTimeoutInSeconds: timeoutDelayMs / 1000,
+                        extraTokenParams: getExtraTokenParams === undefined ? undefined : (0, tsafe_1.noUndefined)(getExtraTokenParams()),
+                        transformUrl: transformUrl_oidcClientTs
+                    })
+                        .then(function (oidcClientTsUser) {
+                        (0, tsafe_1.assert)(oidcClientTsUser !== null, "oidcClientTsUser is not supposed to be null here");
+                        clearTimeout(timeout);
+                        dResult.resolve({
+                            outcome: "token refreshed using refresh token",
+                            oidcClientTsUser: oidcClientTsUser
+                        });
+                    }, function (error) {
+                        if (error.message === "Failed to fetch") {
+                            // NOTE: If we got an error here it means that the fetch to the
+                            // well-known oidc endpoint failed.
+                            // This usually means that the server is down or that the issuerUri
+                            // is not pointing to a valid oidc server.
+                            // It could be a CORS error on the well-known endpoint but it's unlikely.
+                            clearTimeout(timeout);
+                            dResult.resolve({
+                                outcome: "failure",
+                                cause: "can't reach well-known oidc endpoint"
+                            });
+                            return;
                         }
-                        finally { if (e_1) throw e_1.error; }
-                    }
-                }
-                apply_transform_url: {
-                    if (transformUrlBeforeRedirect === undefined) {
-                        break apply_transform_url;
-                    }
-                    url = transformUrlBeforeRedirect({ authorizationUrl: url, isSilent: true });
-                }
-                return url;
-            };
-            oidcClientTsUserManager
-                .signinSilent({
-                state: (0, tsafe_1.id)({
-                    context: "iframe",
-                    configId: configId
-                }),
-                silentRequestTimeoutInSeconds: timeoutDelayMs / 1000,
-                extraTokenParams: getExtraTokenParams === undefined ? undefined : (0, tsafe_1.noUndefined)(getExtraTokenParams()),
-                transformUrl: transformUrl_oidcClientTs
-            })
-                .then(function (oidcClientTsUser) {
-                (0, tsafe_1.assert)(oidcClientTsUser !== null, "oidcClientTsUser is not supposed to be null here");
-                clearTimeout(timeout);
-                dResult.resolve({
-                    outcome: "token refreshed using refresh token",
-                    oidcClientTsUser: oidcClientTsUser
-                });
-            }, function (error) {
-                if (error.message === "Failed to fetch") {
-                    // NOTE: If we got an error here it means that the fetch to the
-                    // well-known oidc endpoint failed.
-                    // This usually means that the server is down or that the issuerUri
-                    // is not pointing to a valid oidc server.
-                    // It could be a CORS error on the well-known endpoint but it's unlikely.
-                    clearTimeout(timeout);
-                    dResult.resolve({
-                        outcome: "failure",
-                        cause: "can't reach well-known oidc endpoint"
+                        // NOTE: Here, except error on our understanding there can't be any other
+                        // error than timeout so we fail silently and let the timeout expire.
                     });
-                    return;
-                }
-                // NOTE: Here, except error on our understanding there can't be any other
-                // error than timeout so we fail silently and let the timeout expire.
-            });
-            dResult.pr.then(function (result) {
-                if (result.outcome === "failure") {
-                    (0, StateData_1.clearStateStore)({ stateQueryParamValue: stateQueryParamValue_instance });
-                }
-            });
-            return [2 /*return*/, dResult.pr];
+                    dResult.pr.then(function (result) {
+                        clearSessionStoragePublicKey();
+                        if (result.outcome === "failure") {
+                            (0, StateData_1.clearStateStore)({ stateQueryParamValue: stateQueryParamValue_instance });
+                        }
+                    });
+                    return [2 /*return*/, dResult.pr];
+            }
         });
     });
 }