oidc-spa 8.6.18 → 8.7.0

package/src/core/createOidc.ts

@@ -59,6 +59,7 @@ import {
     getIsStateDataCookieEnabled
 } from "./StateDataCookie";
 import { getIsTokenSubstitutionEnabled } from "./tokenPlaceholderSubstitution";
+import { createInMemoryDPoPStore } from "./dpop";
 import { loadWebcryptoLinerShim } from "../tools/loadWebcryptoLinerShim";
 
 // NOTE: Replaced at build time
@@ -133,10 +134,6 @@ export type ParamsOfCreateOidc<
     idleSessionLifetimeInSeconds?: number;
 
     /**
-     * Usage discouraged, this parameter exists because we don't want to assume
-     * too much about your usecase but I can't think of a scenario where you would
-     * want anything other than the current page.
-     *
      * Default: { redirectTo: "current page" }
      */
     autoLogoutParams?: Parameters<Oidc.LoggedIn<any>["logout"]>[0];
@@ -247,6 +244,9 @@ export type ParamsOfCreateOidc<
      * API and no iframe capabilities.
      */
     postLoginRedirectUrl?: string;
+
+    /** Default: false */
+    dpop?: boolean;
 };
 
 const globalContext = {
@@ -380,7 +380,8 @@ export async function createOidc_nonMemoized<
         __unsafe_clientSecret,
         __unsafe_useIdTokenAsAccessToken = false,
         __metadata,
-        sessionRestorationMethod = params.autoLogin === true ? "full page redirect" : "auto"
+        sessionRestorationMethod = params.autoLogin === true ? "full page redirect" : "auto",
+        dpop
     } = params;
 
     const scopes = Array.from(new Set(["openid", ...(params.scopes ?? ["profile"])]));
@@ -454,6 +455,45 @@ export async function createOidc_nonMemoized<
 
     const oidcMetadata = __metadata ?? (await fetchOidcMetadata({ issuerUri }));
 
+    const isDPoPEnabled = (() => {
+        if (dpop === undefined) {
+            log?.(
+                "DPoP disabled because it wasn't explicitly enabled when calling createOidc/bootstrapOidc"
+            );
+        }
+
+        if (!dpop) {
+            log?.("DPoP explicitly disabled in createOidc/bootstrapOidc params");
+            return false;
+        }
+
+        if (oidcMetadata === undefined) {
+            return false;
+        }
+
+        if (__unsafe_useIdTokenAsAccessToken) {
+            return false;
+        }
+
+        const isSupported = (() => {
+            const { dpop_signing_alg_values_supported } = oidcMetadata;
+
+            if (dpop_signing_alg_values_supported === undefined) {
+                return false;
+            }
+
+            return dpop_signing_alg_values_supported.includes("ES256");
+        })();
+
+        if (!isSupported) {
+            log?.("DPoP disabled because it's not supported by your IdP");
+        } else {
+            log?.("DPoP enabled");
+        }
+
+        return isSupported;
+    })();
+
     const canUseIframe = (() => {
         switch (sessionRestorationMethod) {
             case "auto":
@@ -666,7 +706,13 @@ export async function createOidc_nonMemoized<
                       prefix: STATE_STORE_KEY_PREFIX
                   }),
                   client_secret: __unsafe_clientSecret,
-                  metadata: oidcMetadata
+                  metadata: oidcMetadata,
+                  dpop: !isDPoPEnabled
+                      ? undefined
+                      : {
+                            bind_authorization_code: false,
+                            store: createInMemoryDPoPStore({ configId })
+                        }
               });
 
     const evtInitializationOutcomeUserNotLoggedIn = createEvt<void>();
@@ -1245,6 +1291,7 @@ export async function createOidc_nonMemoized<
         decodedIdTokenSchema,
         __unsafe_useIdTokenAsAccessToken,
         decodedIdToken_previous: undefined,
+        isDPoPEnabled,
         log
     });
 
@@ -1572,6 +1619,7 @@ export async function createOidc_nonMemoized<
                     decodedIdTokenSchema,
                     __unsafe_useIdTokenAsAccessToken,
                     decodedIdToken_previous: currentTokens.decodedIdToken,
+                    isDPoPEnabled,
                     log
                 });
 
@@ -2059,8 +2107,8 @@ export async function createOidc_nonMemoized<
             sessionId
         });
 
-        const { unsubscribe: unsubscribeFromIsUserActive } = evtIsUserActive.subscribe(isUserActive => {
-            if (isUserActive) {
+        const { unsubscribe: unsubscribeFromIsUserActive } = evtIsUserActive.subscribe(eventData => {
+            if (eventData.isUserActive) {
                 if (stopCountdown !== undefined) {
                     stopCountdown();
                     stopCountdown = undefined;
@@ -2073,7 +2121,11 @@ export async function createOidc_nonMemoized<
                 assert(currentRefreshTokenTtlInSeconds !== undefined, "902992326");
 
                 stopCountdown = startCountdown({
-                    countDownFromSeconds: currentRefreshTokenTtlInSeconds
+                    countDownFromSeconds: Math.floor(
+                        (currentRefreshTokenTtlInSeconds * 1_000 -
+                            eventData.hasBeenInactiveForHowLongMs) /
+                            1_000
+                    )
                 }).stopCountdown;
             }
         });