oidc-spa 8.5.5 → 8.6.0

package/src/core/tokenPlaceholderSubstitution.ts

@@ -2,7 +2,7 @@ import { assert } from "../tools/tsafe/assert";
 
 let isTokenSubstitutionEnabled = false;
 
-export function markTokenSubstitutionAdEnabled() {
+export function markTokenSubstitutionAsEnabled() {
     isTokenSubstitutionEnabled = true;
 }
 
@@ -18,10 +18,61 @@ type Tokens = {
 
 const entries: {
     configId: string;
-    tokens: Tokens;
     id: number;
+    tokens: Tokens;
+    tokens_placeholder: Tokens;
 }[] = [];
 
+function generatePlaceholderForToken(params: {
+    tokenType: "id_token" | "access_token" | "refresh_token";
+    token_real: string;
+    id: number;
+}): string {
+    const { tokenType, token_real, id } = params;
+
+    const match = token_real.match(/^([A-Za-z0-9\-_]+)\.([A-Za-z0-9\-_]+)\.([A-Za-z0-9\-_]+)$/);
+
+    if (match === null) {
+        assert(tokenType !== "id_token", "39232932927");
+        return `${tokenType}_placeholder_${id}`;
+    }
+
+    const [, header_b64, payload_b64, signature_b64] = match;
+
+    const signatureByteLength = (() => {
+        const b64 = signature_b64
+            .replace(/-/g, "+")
+            .replace(/_/g, "/")
+            .padEnd(Math.ceil(signature_b64.length / 4) * 4, "=");
+
+        const padding = b64.endsWith("==") ? 2 : b64.endsWith("=") ? 1 : 0;
+        return (b64.length * 3) / 4 - padding;
+    })();
+
+    const targetSigB64Length = Math.ceil((signatureByteLength * 4) / 3);
+
+    const sig_placeholder = (function makeZeroPaddedBase64UrlString(
+        targetLength: number,
+        seed: string
+    ): string {
+        const PAD = "A";
+
+        let out = seed.slice(0, targetLength);
+
+        if (out.length < targetLength) {
+            out = out + PAD.repeat(targetLength - out.length);
+        }
+
+        if (out.length % 4 === 1) {
+            out = out.slice(0, -1) + PAD;
+        }
+
+        return out;
+    })(targetSigB64Length, `sig_placeholder_${id}_`);
+
+    return `${header_b64}.${payload_b64}.${sig_placeholder}`;
+}
+
 let counter = Math.floor(Math.random() * 1_000_000) + 1_000_000;
 
 export function getTokensPlaceholders(params: { configId: string; tokens: Tokens }): Tokens {
@@ -48,66 +99,68 @@ export function getTokensPlaceholders(params: { configId: string; tokens: Tokens
     const id = counter++;
 
     const entry_new: (typeof entries)[number] = {
-        id,
         configId,
+        id,
         tokens: {
-            accessToken: tokens.accessToken,
             idToken: tokens.idToken,
+            accessToken: tokens.accessToken,
             refreshToken: tokens.refreshToken
+        },
+        tokens_placeholder: {
+            idToken: generatePlaceholderForToken({
+                tokenType: "id_token",
+                id,
+                token_real: tokens.idToken
+            }),
+            accessToken: generatePlaceholderForToken({
+                tokenType: "access_token",
+                id,
+                token_real: tokens.accessToken
+            }),
+            refreshToken:
+                tokens.refreshToken === undefined
+                    ? undefined
+                    : generatePlaceholderForToken({
+                          tokenType: "refresh_token",
+                          id,
+                          token_real: tokens.refreshToken
+                      })
         }
     };
 
     entries.push(entry_new);
 
-    return {
-        accessToken: `access_token_placeholder_${id}`,
-        idToken: `id_token_placeholder_${id}`,
-        refreshToken: tokens.refreshToken === undefined ? undefined : `refresh_token_placeholder_${id}`
-    };
+    return entry_new.tokens_placeholder;
 }
 
-export function substitutePlaceholderByRealToken(params: {
-    text: string;
-    doEncodeUriComponent: boolean;
-}): string {
-    const { text, doEncodeUriComponent } = params;
+export function substitutePlaceholderByRealToken(text: string): string {
+    if (!text.includes("_placeholder_")) {
+        return text;
+    }
 
     let text_modified = text;
 
-    for (const [tokenType, regExp] of [
-        ["access_token", /access_token_placeholder_(\d+)/g],
-        ["id_token", /id_token_placeholder_(\d+)/g],
-        ["refresh_token", /refresh_token_placeholder_(\d+)/g]
-    ] as const) {
-        text_modified = text_modified.replace(regExp, (...[, p1]) => {
-            const id = parseInt(p1);
-
-            const entry = entries.find(e => e.id === id);
-
-            if (!entry) {
-                throw new Error(
-                    [
-                        "oidc-spa: Outdated token used to make a request.",
-                        "Token should not be stored at the application level, when a token",
-                        "is needed, it should be requested and used immediately."
-                    ].join(" ")
-                );
-            }
+    for (const entry of entries) {
+        if (!text.includes(`${entry.id}`)) {
+            continue;
+        }
+
+        for (const tokenType of ["idToken", "accessToken", "refreshToken"] as const) {
+            const placeholder = entry.tokens_placeholder[tokenType];
 
-            const token = (() => {
-                switch (tokenType) {
-                    case "access_token":
-                        return entry.tokens.accessToken;
-                    case "id_token":
-                        return entry.tokens.idToken;
-                    case "refresh_token":
-                        assert(entry.tokens.refreshToken !== undefined, "204392284");
-                        return entry.tokens.refreshToken;
+            if (tokenType === "refreshToken") {
+                if (placeholder === undefined) {
+                    continue;
                 }
-            })();
+            }
+            assert(placeholder !== undefined, "023948092393");
+
+            const realToken = entry.tokens[tokenType];
 
-            return doEncodeUriComponent ? encodeURIComponent(token) : token;
-        });
+            assert(realToken !== undefined, "02394809239328");
+
+            text_modified = text_modified.split(placeholder).join(realToken);
+        }
     }
 
     return text_modified;