openid-client 5.1.5 → 5.1.8

package/lib/client.js

@@ -489,18 +489,6 @@ class BaseClient {
         tokenset.session_state = params.session_state;
       }
 
-      if (tokenset.scope && checks.scope && this.fapi()) {
-        const expected = new Set(checks.scope.split(' '));
-        const actual = tokenset.scope.split(' ');
-        if (!actual.every(Set.prototype.has, expected)) {
-          throw new RPError({
-            message: 'unexpected scope returned',
-            checks,
-            scope: tokenset.scope,
-          });
-        }
-      }
-
       return tokenset;
     }
 
@@ -569,13 +557,14 @@ class BaseClient {
       throw new OPError(params);
     }
 
-    if ('id_token' in params) {
+    if (typeof params.id_token === 'string' && params.id_token.length) {
       throw new RPError({
         message:
           'id_token detected in the response, you must use client.callback() instead of client.oauthCallback()',
         params,
       });
     }
+    delete params.id_token;
 
     const RESPONSE_TYPE_REQUIRED_PARAMS = {
       code: ['code'],
@@ -620,25 +609,14 @@ class BaseClient {
         { clientAssertionPayload, DPoP },
       );
 
-      if ('id_token' in tokenset) {
+      if (typeof tokenset.id_token === 'string' && tokenset.id_token.length) {
         throw new RPError({
           message:
             'id_token detected in the response, you must use client.callback() instead of client.oauthCallback()',
           params,
         });
       }
-
-      if (tokenset.scope && checks.scope && this.fapi()) {
-        const expected = new Set(checks.scope.split(' '));
-        const actual = tokenset.scope.split(' ');
-        if (!actual.every(Set.prototype.has, expected)) {
-          throw new RPError({
-            message: 'unexpected scope returned',
-            checks,
-            scope: tokenset.scope,
-          });
-        }
-      }
+      delete tokenset.id_token;
 
       return tokenset;
     }

package/lib/device_flow_handle.js

@@ -2,9 +2,6 @@ const { inspect } = require('util');
 
 const { RPError, OPError } = require('./errors');
 const now = require('./helpers/unix_timestamp');
-const { authenticatedPost } = require('./helpers/client');
-const processResponse = require('./helpers/process_response');
-const TokenSet = require('./token_set');
 
 class DeviceFlowHandle {
   #aborted;
@@ -61,23 +58,16 @@ class DeviceFlowHandle {
 
     await new Promise((resolve) => setTimeout(resolve, this.#interval));
 
-    const response = await authenticatedPost.call(
-      this.#client,
-      'token',
-      {
-        form: {
+    let tokenset;
+    try {
+      tokenset = await this.#client.grant(
+        {
           ...this.#exchangeBody,
           grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
           device_code: this.device_code,
         },
-        responseType: 'json',
-      },
-      { clientAssertionPayload: this.#clientAssertionPayload, DPoP: this.#DPoP },
-    );
-
-    let responseBody;
-    try {
-      responseBody = processResponse(response);
+        { clientAssertionPayload: this.#clientAssertionPayload, DPoP: this.#DPoP },
+      );
     } catch (err) {
       switch (err instanceof OPError && err.error) {
         case 'slow_down':
@@ -89,8 +79,6 @@ class DeviceFlowHandle {
       }
     }
 
-    const tokenset = new TokenSet(responseBody);
-
     if ('id_token' in tokenset) {
       await this.#client.decryptIdToken(tokenset);
       await this.#client.validateIdToken(tokenset, undefined, 'token', this.#maxAge);

package/lib/helpers/request.js

@@ -3,6 +3,7 @@ const querystring = require('querystring');
 const http = require('http');
 const https = require('https');
 const { once } = require('events');
+const { URL } = require('url');
 
 const LRU = require('lru-cache');
 
@@ -116,7 +117,7 @@ module.exports = async function request(options, { accessToken, mTLS = false, DP
   }
 
   let response;
-  const req = (url.protocol === 'https:' ? https.request : http.request)(url, opts);
+  const req = (url.protocol === 'https:' ? https.request : http.request)(url.href, opts);
   return (async () => {
     if (json) {
       send(req, JSON.stringify(json), 'application/json');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "5.1.5",
+  "version": "5.1.8",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",
@@ -30,11 +30,12 @@
   "license": "MIT",
   "author": "Filip Skokan <panva.ip@gmail.com>",
   "exports": {
+    "types": "./types/index.d.ts",
     "import": "./lib/index.mjs",
     "require": "./lib/index.js"
   },
-  "main": "lib/index.js",
-  "types": "types/index.d.ts",
+  "main": "./lib/index.js",
+  "types": "./types/index.d.ts",
   "files": [
     "lib",
     "types/index.d.ts"

package/types/index.d.ts

@@ -161,7 +161,7 @@ export interface OAuthCallbackChecks {
   state?: string;
   code_verifier?: string;
   jarm?: boolean;
-  scope?: string;
+  scope?: string; // TODO: remove in v6.x
 }
 
 export interface OpenIDCallbackChecks extends OAuthCallbackChecks {