openid-client 5.5.0 → 5.6.0

package/lib/client.js

@@ -4,6 +4,7 @@ const crypto = require('crypto');
 const { strict: assert } = require('assert');
 const querystring = require('querystring');
 const url = require('url');
+const { URL, URLSearchParams } = require('url');
 
 const jose = require('jose');
 const tokenHash = require('oidc-token-hash');
@@ -62,6 +63,12 @@ function authorizationHeaderValue(token, tokenType = 'Bearer') {
   return `${tokenType} ${token}`;
 }
 
+function getSearchParams(input) {
+  const parsed = url.parse(input);
+  if (!parsed.search) return {};
+  return querystring.parse(parsed.search.substring(1));
+}
+
 function verifyPresence(payload, jwt, prop) {
   if (payload[prop] === undefined) {
     throw new RPError({
@@ -251,13 +258,21 @@ class BaseClient {
       throw new TypeError('params must be a plain object');
     }
     assertIssuerConfiguration(this.issuer, 'authorization_endpoint');
-    const target = url.parse(this.issuer.authorization_endpoint, true);
-    target.search = null;
-    target.query = {
-      ...target.query,
-      ...authorizationParams.call(this, params),
-    };
-    return url.format(target);
+    const target = new URL(this.issuer.authorization_endpoint);
+
+    for (const [name, value] of Object.entries(authorizationParams.call(this, params))) {
+      if (Array.isArray(value)) {
+        target.searchParams.delete(name);
+        for (const member of value) {
+          target.searchParams.append(name, member);
+        }
+      } else {
+        target.searchParams.set(name, value);
+      }
+    }
+
+    // TODO: is the replace needed?
+    return target.href.replace('+', '%20');
   }
 
   authorizationPost(params = {}) {
@@ -297,10 +312,9 @@ class BaseClient {
       id_token_hint = id_token_hint.id_token;
     }
 
-    const target = url.parse(this.issuer.end_session_endpoint, true);
-    target.search = null;
-    defaults(
-      target.query,
+    const target = url.parse(this.issuer.end_session_endpoint);
+    const query = defaults(
+      getSearchParams(this.issuer.end_session_endpoint),
       params,
       {
         post_logout_redirect_uri,
@@ -309,12 +323,15 @@ class BaseClient {
       { id_token_hint },
     );
 
-    Object.entries(target.query).forEach(([key, value]) => {
+    Object.entries(query).forEach(([key, value]) => {
       if (value === null || value === undefined) {
-        delete target.query[key];
+        delete query[key];
       }
     });
 
+    target.search = null;
+    target.query = query;
+
     return url.format(target);
   }
 
@@ -331,7 +348,7 @@ class BaseClient {
     if (isIncomingMessage) {
       switch (input.method) {
         case 'GET':
-          return pickCb(url.parse(input.url, true).query);
+          return pickCb(getSearchParams(input.url));
         case 'POST':
           if (input.body === undefined) {
             throw new TypeError(
@@ -356,7 +373,7 @@ class BaseClient {
           throw new TypeError('invalid IncomingMessage method');
       }
     } else {
-      return pickCb(url.parse(input, true).query);
+      return pickCb(getSearchParams(input));
     }
   }
 
@@ -703,11 +720,15 @@ class BaseClient {
     if (expectedAlg.match(/^(?:RSA|ECDH)/)) {
       const keystore = await keystores.get(this);
 
-      for (const { keyObject: key } of keystore.all({
-        ...jose.decodeProtectedHeader(jwe),
+      const protectedHeader = jose.decodeProtectedHeader(jwe);
+
+      for (const key of keystore.all({
+        ...protectedHeader,
         use: 'enc',
       })) {
-        plaintext = await jose.compactDecrypt(jwe, key).then(getPlaintext, () => {});
+        plaintext = await jose
+          .compactDecrypt(jwe, await key.keyObject(protectedHeader.alg))
+          .then(getPlaintext, () => {});
         if (plaintext) break;
       }
     } else {
@@ -1016,7 +1037,13 @@ class BaseClient {
         assert(isPlainObject(payload.sub_jwk));
         const key = await jose.importJWK(payload.sub_jwk, header.alg);
         assert.equal(key.type, 'public');
-        keys = [{ keyObject: key }];
+        keys = [
+          {
+            keyObject() {
+              return key;
+            },
+          },
+        ];
       } catch (err) {
         throw new RPError({
           message: 'failed to use sub_jwk claim as an asymmetric JSON Web Key',
@@ -1041,7 +1068,7 @@ class BaseClient {
 
     for (const key of keys) {
       const verified = await jose
-        .compactVerify(jwt, key instanceof Uint8Array ? key : key.keyObject)
+        .compactVerify(jwt, key instanceof Uint8Array ? key : await key.keyObject(header.alg))
         .catch(() => {});
       if (verified) {
         return {
@@ -1195,12 +1222,12 @@ class BaseClient {
       targetUrl = this.issuer.mtls_endpoint_aliases.userinfo_endpoint;
     }
 
-    targetUrl = new url.URL(targetUrl || this.issuer.userinfo_endpoint);
+    targetUrl = new URL(targetUrl || this.issuer.userinfo_endpoint);
 
     if (via === 'body') {
       options.headers.Authorization = undefined;
       options.headers['Content-Type'] = 'application/x-www-form-urlencoded';
-      options.body = new url.URLSearchParams();
+      options.body = new URLSearchParams();
       options.body.append(
         'access_token',
         accessToken instanceof TokenSet ? accessToken.access_token : accessToken,
@@ -1220,7 +1247,7 @@ class BaseClient {
         });
       } else {
         // POST && via header
-        options.body = new url.URLSearchParams();
+        options.body = new URLSearchParams();
         options.headers['Content-Type'] = 'application/x-www-form-urlencoded';
         Object.entries(params).forEach(([key, value]) => {
           options.body.append(key, value);
@@ -1515,7 +1542,7 @@ class BaseClient {
           ...header,
           kid: symmetric ? undefined : key.jwk.kid,
         })
-        .sign(symmetric ? key : key.keyObject);
+        .sign(symmetric ? key : await key.keyObject(signingAlgorithm));
     }
 
     if (!eKeyManagement) {
@@ -1539,7 +1566,7 @@ class BaseClient {
         ...fields,
         kid: key instanceof Uint8Array ? undefined : key.jwk.kid,
       })
-      .encrypt(key instanceof Uint8Array ? key : key.keyObject);
+      .encrypt(key instanceof Uint8Array ? key : await key.keyObject(fields.alg));
   }
 
   async pushedAuthorizationRequest(params = {}, { clientAssertionPayload } = {}) {
@@ -1625,33 +1652,18 @@ class BaseClient {
     let privateKey;
     if (isKeyObject(privateKeyInput)) {
       privateKey = privateKeyInput;
-    } else {
+    } else if (privateKeyInput[Symbol.toStringTag] === 'CryptoKey') {
+      privateKey = privateKeyInput;
+    } else if (jose.cryptoRuntime === 'node:crypto') {
       privateKey = crypto.createPrivateKey(privateKeyInput);
+    } else {
+      throw new TypeError('unrecognized crypto runtime');
     }
 
     if (privateKey.type !== 'private') {
       throw new TypeError('"DPoP" option must be a private key');
     }
-    let alg;
-    switch (privateKey.asymmetricKeyType) {
-      case 'ed25519':
-      case 'ed448':
-        alg = 'EdDSA';
-        break;
-      case 'ec':
-        alg = determineEcAlgorithm(privateKey, privateKeyInput);
-        break;
-      case 'rsa':
-      case rsaPssParams && 'rsa-pss':
-        alg = determineRsaAlgorithm(
-          privateKey,
-          privateKeyInput,
-          this.issuer.dpop_signing_alg_values_supported,
-        );
-        break;
-      default:
-        throw new TypeError('unsupported DPoP private key asymmetric key type');
-    }
+    let alg = determineDPoPAlgorithm.call(this, privateKey, privateKeyInput);
 
     if (!alg) {
       throw new TypeError('could not determine DPoP JWS Algorithm');
@@ -1674,81 +1686,138 @@ class BaseClient {
   }
 }
 
-const RSPS = /^(?:RS|PS)(?:256|384|512)$/;
-function determineRsaAlgorithm(privateKey, privateKeyInput, valuesSupported) {
-  if (
-    typeof privateKeyInput === 'object' &&
-    typeof privateKeyInput.key === 'object' &&
-    privateKeyInput.key.alg
-  ) {
-    return privateKeyInput.key.alg;
+function determineDPoPAlgorithmFromCryptoKey(cryptoKey) {
+  switch (cryptoKey.algorithm.name) {
+    case 'Ed25519':
+    case 'Ed448':
+      return 'EdDSA';
+    case 'ECDSA': {
+      switch (cryptoKey.algorithm.namedCurve) {
+        case 'P-256':
+          return 'ES256';
+        case 'P-384':
+          return 'ES384';
+        case 'P-521':
+          return 'ES512';
+        default:
+          break;
+      }
+      break;
+    }
+    case 'RSASSA-PKCS1-v1_5':
+      return `RS${cryptoKey.algorithm.hash.name.slice(4)}`;
+    case 'RSA-PSS':
+      return `PS${cryptoKey.algorithm.hash.name.slice(4)}`;
+    default:
+      throw new TypeError('unsupported DPoP private key');
   }
+}
 
-  if (Array.isArray(valuesSupported)) {
-    let candidates = valuesSupported.filter(RegExp.prototype.test.bind(RSPS));
-    if (privateKey.asymmetricKeyType === 'rsa-pss') {
-      candidates = candidates.filter((value) => value.startsWith('PS'));
+let determineDPoPAlgorithm;
+if (jose.cryptoRuntime === 'node:crypto') {
+  determineDPoPAlgorithm = function (privateKey, privateKeyInput) {
+    if (privateKeyInput[Symbol.toStringTag] === 'CryptoKey') {
+      return determineDPoPAlgorithmFromCryptoKey(privateKey);
     }
-    return ['PS256', 'PS384', 'PS512', 'RS256', 'RS384', 'RS384'].find((preferred) =>
-      candidates.includes(preferred),
-    );
-  }
 
-  return 'PS256';
-}
+    switch (privateKey.asymmetricKeyType) {
+      case 'ed25519':
+      case 'ed448':
+        return 'EdDSA';
+      case 'ec':
+        return determineEcAlgorithm(privateKey, privateKeyInput);
+      case 'rsa':
+      case rsaPssParams && 'rsa-pss':
+        return determineRsaAlgorithm(
+          privateKey,
+          privateKeyInput,
+          this.issuer.dpop_signing_alg_values_supported,
+        );
+      default:
+        throw new TypeError('unsupported DPoP private key');
+    }
+  };
 
-const p256 = Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
-const p384 = Buffer.from([43, 129, 4, 0, 34]);
-const p521 = Buffer.from([43, 129, 4, 0, 35]);
-const secp256k1 = Buffer.from([43, 129, 4, 0, 10]);
+  const RSPS = /^(?:RS|PS)(?:256|384|512)$/;
+  function determineRsaAlgorithm(privateKey, privateKeyInput, valuesSupported) {
+    if (
+      typeof privateKeyInput === 'object' &&
+      privateKeyInput.format === 'jwk' &&
+      privateKeyInput.key &&
+      privateKeyInput.key.alg
+    ) {
+      return privateKeyInput.key.alg;
+    }
 
-function determineEcAlgorithm(privateKey, privateKeyInput) {
-  // If input was a JWK
-  switch (
-    typeof privateKeyInput === 'object' &&
-    typeof privateKeyInput.key === 'object' &&
-    privateKeyInput.key.crv
-  ) {
-    case 'P-256':
+    if (Array.isArray(valuesSupported)) {
+      let candidates = valuesSupported.filter(RegExp.prototype.test.bind(RSPS));
+      if (privateKey.asymmetricKeyType === 'rsa-pss') {
+        candidates = candidates.filter((value) => value.startsWith('PS'));
+      }
+      return ['PS256', 'PS384', 'PS512', 'RS256', 'RS384', 'RS384'].find((preferred) =>
+        candidates.includes(preferred),
+      );
+    }
+
+    return 'PS256';
+  }
+
+  const p256 = Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
+  const p384 = Buffer.from([43, 129, 4, 0, 34]);
+  const p521 = Buffer.from([43, 129, 4, 0, 35]);
+  const secp256k1 = Buffer.from([43, 129, 4, 0, 10]);
+
+  function determineEcAlgorithm(privateKey, privateKeyInput) {
+    // If input was a JWK
+    switch (
+      typeof privateKeyInput === 'object' &&
+      typeof privateKeyInput.key === 'object' &&
+      privateKeyInput.key.crv
+    ) {
+      case 'P-256':
+        return 'ES256';
+      case 'secp256k1':
+        return 'ES256K';
+      case 'P-384':
+        return 'ES384';
+      case 'P-512':
+        return 'ES512';
+      default:
+        break;
+    }
+
+    const buf = privateKey.export({ format: 'der', type: 'pkcs8' });
+    const i = buf[1] < 128 ? 17 : 18;
+    const len = buf[i];
+    const curveOid = buf.slice(i + 1, i + 1 + len);
+    if (curveOid.equals(p256)) {
       return 'ES256';
-    case 'secp256k1':
-      return 'ES256K';
-    case 'P-384':
+    }
+
+    if (curveOid.equals(p384)) {
       return 'ES384';
-    case 'P-512':
+    }
+    if (curveOid.equals(p521)) {
       return 'ES512';
-    default:
-      break;
-  }
-
-  const buf = privateKey.export({ format: 'der', type: 'pkcs8' });
-  const i = buf[1] < 128 ? 17 : 18;
-  const len = buf[i];
-  const curveOid = buf.slice(i + 1, i + 1 + len);
-  if (curveOid.equals(p256)) {
-    return 'ES256';
-  }
+    }
 
-  if (curveOid.equals(p384)) {
-    return 'ES384';
-  }
-  if (curveOid.equals(p521)) {
-    return 'ES512';
-  }
+    if (curveOid.equals(secp256k1)) {
+      return 'ES256K';
+    }
 
-  if (curveOid.equals(secp256k1)) {
-    return 'ES256K';
+    throw new TypeError('unsupported DPoP private key curve');
   }
-
-  throw new TypeError('unsupported DPoP private key curve');
+} else {
+  determineDPoPAlgorithm = determineDPoPAlgorithmFromCryptoKey;
 }
 
 const jwkCache = new WeakMap();
-async function getJwk(privateKey, privateKeyInput) {
+async function getJwk(keyObject, privateKeyInput) {
   if (
+    jose.cryptoRuntime === 'node:crypto' &&
     typeof privateKeyInput === 'object' &&
     typeof privateKeyInput.key === 'object' &&
-    privateKeyInput.key.crv
+    privateKeyInput.format === 'jwk'
   ) {
     return pick(privateKeyInput.key, 'kty', 'crv', 'x', 'y', 'e', 'n');
   }
@@ -1757,9 +1826,9 @@ async function getJwk(privateKey, privateKeyInput) {
     return jwkCache.get(privateKeyInput);
   }
 
-  const jwk = pick(await jose.exportJWK(privateKey), 'kty', 'crv', 'x', 'y', 'e', 'n');
+  const jwk = pick(await jose.exportJWK(keyObject), 'kty', 'crv', 'x', 'y', 'e', 'n');
 
-  if (isKeyObject(privateKeyInput)) {
+  if (isKeyObject(privateKeyInput) || jose.cryptoRuntime === 'WebCryptoAPI') {
     jwkCache.set(privateKeyInput, jwk);
   }
 
@@ -1776,4 +1845,5 @@ module.exports = (issuer, aadIssValidation = false) =>
       return issuer;
     }
   };
+
 module.exports.BaseClient = BaseClient;

package/lib/helpers/client.js

@@ -70,7 +70,7 @@ async function clientAssertion(endpoint, payload) {
 
   return new jose.CompactSign(Buffer.from(JSON.stringify(payload)))
     .setProtectedHeader({ alg, kid: key.jwk && key.jwk.kid })
-    .sign(key.keyObject);
+    .sign(await key.keyObject(alg));
 }
 
 async function authFor(endpoint, { clientAssertionPayload } = {}) {

package/lib/helpers/keystore.js

@@ -2,7 +2,6 @@ const jose = require('jose');
 
 const clone = require('./deep_clone');
 const isPlainObject = require('./is_plain_object');
-const isKeyObject = require('./is_key_object');
 
 const internal = Symbol();
 
@@ -51,7 +50,7 @@ function getKtyFromAlg(alg) {
 
 function getAlgorithms(use, alg, kty, crv) {
   // Ed25519, Ed448, and secp256k1 always have "alg"
-  // OKP always has use
+  // OKP always has "use"
   if (alg) {
     return new Set([alg]);
   }
@@ -65,7 +64,20 @@ function getAlgorithms(use, alg, kty, crv) {
       }
 
       if (use === 'sig' || use === undefined) {
-        algs = algs.concat([`ES${crv.slice(-3)}`.replace('21', '12')]);
+        switch (crv) {
+          case 'P-256':
+          case 'P-384':
+            algs = algs.concat([`ES${crv.slice(-3)}`.replace('21', '12')]);
+            break;
+          case 'P-521':
+            algs = algs.concat(['ES512']);
+            break;
+          case 'secp256k1':
+            if (jose.cryptoRuntime === 'node:crypto') {
+              algs = algs.concat(['ES256K']);
+            }
+            break;
+        }
       }
 
       return new Set(algs);
@@ -77,7 +89,10 @@ function getAlgorithms(use, alg, kty, crv) {
       let algs = [];
 
       if (use === 'enc' || use === undefined) {
-        algs = algs.concat(['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512', 'RSA1_5']);
+        algs = algs.concat(['RSA-OAEP', 'RSA-OAEP-256', 'RSA-OAEP-384', 'RSA-OAEP-512']);
+        if (jose.cryptoRuntime === 'node:crypto') {
+          algs = algs.concat(['RSA1_5']);
+        }
       }
 
       if (use === 'sig' || use === undefined) {
@@ -225,36 +240,25 @@ module.exports = class KeyStore {
         }
       }
 
-      const keyObject = await jose.importJWK(jwk, alg || fauxAlg(jwk.kty)).catch(() => {});
-
-      if (!keyObject) continue;
-
-      if (keyObject instanceof Uint8Array || keyObject.type === 'secret') {
-        if (onlyPrivate) {
-          throw new Error('jwks must only contain private keys');
-        }
-        continue;
-      }
-
-      if (!isKeyObject(keyObject)) {
-        throw new Error('what?!');
-      }
-
-      if (onlyPrivate && keyObject.type !== 'private') {
+      if (onlyPrivate && (jwk.kty === 'oct' || !jwk.d)) {
         throw new Error('jwks must only contain private keys');
       }
 
-      if (onlyPublic && keyObject.type !== 'public') {
-        continue;
-      }
-
-      if (kty === 'RSA' && keyObject.asymmetricKeySize < 2048) {
+      if (onlyPublic && (jwk.d || jwk.k)) {
         continue;
       }
 
       keys.push({
         jwk: { ...jwk, alg, use },
-        keyObject,
+        async keyObject(alg) {
+          if (this[alg]) {
+            return this[alg];
+          }
+
+          const keyObject = await jose.importJWK(this.jwk, alg);
+          this[alg] = keyObject;
+          return keyObject;
+        },
         get algorithms() {
           Object.defineProperty(this, 'algorithms', {
             value: getAlgorithms(this.jwk.use, this.jwk.alg, this.jwk.kty, this.jwk.crv),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",
@@ -45,23 +45,22 @@
     "test": "mocha test/**/*.test.js"
   },
   "dependencies": {
-    "jose": "^4.14.4",
+    "jose": "^4.15.1",
     "lru-cache": "^6.0.0",
     "object-hash": "^2.2.0",
     "oidc-token-hash": "^5.0.3"
   },
   "devDependencies": {
-    "@types/node": "^16.18.31",
-    "@types/passport": "^1.0.12",
+    "@types/node": "^16.18.55",
+    "@types/passport": "^1.0.13",
     "base64url": "^3.0.1",
-    "chai": "^4.3.7",
-    "jose2": "npm:jose@^2.0.6",
+    "chai": "^4.3.10",
     "mocha": "^10.2.0",
-    "nock": "^13.3.1",
+    "nock": "^13.3.3",
     "prettier": "^2.8.8",
     "readable-mock-req": "^0.2.2",
     "sinon": "^9.2.4",
-    "timekeeper": "^2.2.0"
+    "timekeeper": "^2.3.1"
   },
   "standard-version": {
     "scripts": {