openid-client 5.6.5 → 5.7.1

package/README.md

@@ -52,13 +52,11 @@ Updates to draft specifications are released as MINOR library versions,
 if you utilize these specification implementations consider using the tilde `~` operator in your
 package.json since breaking changes may be introduced as part of these version updates. 
 
-## Certification
-[<img width="184" height="96" align="right" src="https://cdn.jsdelivr.net/gh/panva/node-openid-client@38cf016b0837e6d4116de3780b28d222d5780bc9/OpenID_Certified.png" alt="OpenID Certification">][openid-certified-link]  
-Filip Skokan has [certified][openid-certified-link] that [openid-client][npm-url]
-conforms to the following profiles of the OpenID Connect™ protocol
+## [Certification](https://openid.net/certification/faq/)
 
-- Basic, Implicit, Hybrid, Config, Dynamic, and Form Post RP
-- FAPI 1.0 Advanced RP
+[<img width="96" height="50" align="right" src="https://user-images.githubusercontent.com/241506/166977513-7cd710a9-7f60-4944-aebe-a658e9f36375.png" alt="OpenID Certification">](#certification)
+
+[Filip Skokan](https://github.com/panva) has [certified](https://openid.net/certification) that [this software](https://github.com/panva/node-openid-client) conforms to the Basic, Implicit, Hybrid, Config, Dynamic, FAPI 1.0, and FAPI 2.0 Relying Party Conformance Profiles of the OpenID Connect™ protocol.
 
 ## Sponsor
 
@@ -304,7 +302,6 @@ See [Customizing (docs)][documentation-customizing].
 [feature-par]: https://www.rfc-editor.org/rfc/rfc9126.html
 [feature-jar]: https://www.rfc-editor.org/rfc/rfc9101.html
 [feature-iss]: https://www.rfc-editor.org/rfc/rfc9207.html
-[openid-certified-link]: https://openid.net/certification/
 [passport-url]: http://passportjs.org
 [npm-url]: https://www.npmjs.com/package/openid-client
 [sponsor-auth0]: https://a0.to/try-auth0

package/lib/client.js

@@ -191,7 +191,7 @@ class BaseClient {
       authorization_signed_response_alg: 'RS256',
       response_types: ['code'],
       token_endpoint_auth_method: 'client_secret_basic',
-      ...(this.fapi()
+      ...(this.fapi1()
         ? {
             grant_types: ['authorization_code', 'implicit'],
             id_token_signed_response_alg: 'PS256',
@@ -201,6 +201,13 @@ class BaseClient {
             token_endpoint_auth_method: undefined,
           }
         : undefined),
+      ...(this.fapi2()
+        ? {
+            id_token_signed_response_alg: 'PS256',
+            authorization_signed_response_alg: 'PS256',
+            token_endpoint_auth_method: undefined,
+          }
+        : undefined),
       ...metadata,
     };
 
@@ -221,6 +228,26 @@ class BaseClient {
       }
     }
 
+    if (this.fapi2()) {
+      if (
+        properties.tls_client_certificate_bound_access_tokens &&
+        properties.dpop_bound_access_tokens
+      ) {
+        throw new TypeError(
+          'either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true',
+        );
+      }
+
+      if (
+        !properties.tls_client_certificate_bound_access_tokens &&
+        !properties.dpop_bound_access_tokens
+      ) {
+        throw new TypeError(
+          'either tls_client_certificate_bound_access_tokens or dpop_bound_access_tokens must be set to true',
+        );
+      }
+    }
+
     handleCommonMistakes(this, metadata, properties);
 
     assertSigningAlgValuesSupport('token', this.issuer, properties);
@@ -824,7 +851,7 @@ class BaseClient {
         });
       }
 
-      if (this.fapi()) {
+      if (this.fapi1()) {
         if (!payload.s_hash && (tokenSet.state || state)) {
           throw new RPError({
             message: 'missing required property s_hash',
@@ -1631,9 +1658,17 @@ class BaseClient {
   }
 
   fapi() {
+    return this.fapi1() || this.fapi2();
+  }
+
+  fapi1() {
     return this.constructor.name === 'FAPI1Client';
   }
 
+  fapi2() {
+    return this.constructor.name === 'FAPI2Client';
+  }
+
   async validateJARM(response) {
     const expectedAlg = this.authorization_signed_response_alg;
     const { payload } = await this.validateJWT(response, expectedAlg, ['iss', 'exp', 'aud']);

package/lib/helpers/client.js

@@ -92,9 +92,6 @@ async function authFor(endpoint, { clientAssertionPayload } = {}) {
     case 'private_key_jwt':
     case 'client_secret_jwt': {
       const timestamp = now();
-      const audience = [
-        ...new Set([this.issuer.issuer, this.issuer.token_endpoint].filter(Boolean)),
-      ];
 
       const assertion = await clientAssertion.call(this, endpoint, {
         iat: timestamp,
@@ -102,7 +99,7 @@ async function authFor(endpoint, { clientAssertionPayload } = {}) {
         jti: random(),
         iss: this.client_id,
         sub: this.client_id,
-        aud: audience,
+        aud: this.issuer.issuer,
         ...clientAssertionPayload,
       });
 

package/lib/helpers/request.js

@@ -79,7 +79,7 @@ module.exports = async function request(options, { accessToken, mTLS = false, DP
     opts.headers.DPoP = await this.dpopProof(
       {
         htu: `${url.origin}${url.pathname}`,
-        htm: options.method,
+        htm: options.method || 'GET',
         nonce: nonces.get(nonceKey),
       },
       DPoP,

package/lib/issuer.js

@@ -73,6 +73,7 @@ class Issuer {
     Object.defineProperties(this, {
       Client: { value: Client, enumerable: true },
       FAPI1Client: { value: class FAPI1Client extends Client {}, enumerable: true },
+      FAPI2Client: { value: class FAPI2Client extends Client {}, enumerable: true },
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client",
-  "version": "5.6.5",
+  "version": "5.7.1",
   "description": "OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs",
   "keywords": [
     "auth",
@@ -22,8 +22,8 @@
     "relying party",
     "strategy"
   ],
-  "homepage": "https://github.com/panva/node-openid-client",
-  "repository": "panva/node-openid-client",
+  "homepage": "https://github.com/panva/openid-client",
+  "repository": "panva/openid-client",
   "funding": {
     "url": "https://github.com/sponsors/panva"
   },
@@ -45,18 +45,18 @@
     "test": "mocha test/**/*.test.js"
   },
   "dependencies": {
-    "jose": "^4.15.5",
+    "jose": "^4.15.9",
     "lru-cache": "^6.0.0",
     "object-hash": "^2.2.0",
     "oidc-token-hash": "^5.0.3"
   },
   "devDependencies": {
-    "@types/node": "^16.18.87",
+    "@types/node": "^16.18.106",
     "@types/passport": "^1.0.16",
     "base64url": "^3.0.1",
-    "chai": "^4.4.1",
-    "mocha": "^10.3.0",
-    "nock": "^13.5.4",
+    "chai": "^4.5.0",
+    "mocha": "^10.7.3",
+    "nock": "^13.5.5",
     "prettier": "^2.8.8",
     "readable-mock-req": "^0.2.2",
     "sinon": "^9.2.4",

package/types/index.d.ts

@@ -443,6 +443,7 @@ export class Issuer<TClient extends BaseClient = BaseClient> {
   Client: TypeOfGenericClient<TClient>;
 
   FAPI1Client: TypeOfGenericClient<TClient>;
+  FAPI2Client: TypeOfGenericClient<TClient>;
 
   metadata: IssuerMetadata;
   [custom.http_options]: CustomHttpOptionsProvider;