matrix-js-sdk
Version:
Matrix Client-Server SDK for Javascript
407 lines (382 loc) • 15.8 kB
JavaScript
import _defineProperty from "@babel/runtime/helpers/defineProperty";
import _asyncToGenerator from "@babel/runtime/helpers/asyncToGenerator";
function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
/*
Copyright 2023 The Matrix.org Foundation C.I.C.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
import { Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from "oidc-client-ts";
import { logger } from "../logger.js";
import { secureRandomString } from "../randomstring.js";
import { OidcError } from "./error.js";
import { validateBearerTokenResponse, validateIdToken, validateStoredUserState } from "./validate.js";
import { sha256 } from "../digest.js";
import { encodeUnpaddedBase64Url } from "../base64.js";
import { OAuthGrantType } from "./register.js";
import { sleep } from "../utils.js";
import { Method } from "../http-api/index.js";
// reexport for backwards compatibility
/**
* Authorization parameters which are used in the authentication request of an OIDC auth code flow.
*
* See https://openid.net/specs/openid-connect-basic-1_0.html#RequestParameters.
*/
/**
* @experimental
* Generate the scope used in authorization request with OIDC OP
* @returns scope
*/
export var generateScope = deviceId => {
var safeDeviceId = deviceId !== null && deviceId !== void 0 ? deviceId : secureRandomString(10);
return "openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:".concat(safeDeviceId);
};
// https://www.rfc-editor.org/rfc/rfc7636
var generateCodeChallenge = /*#__PURE__*/function () {
var _ref = _asyncToGenerator(function* (codeVerifier) {
if (!globalThis.crypto.subtle) {
// @TODO(kerrya) should this be allowed? configurable?
logger.warn("A secure context is required to generate code challenge. Using plain text code challenge");
return codeVerifier;
}
var hashBuffer = yield sha256(codeVerifier);
return encodeUnpaddedBase64Url(hashBuffer);
});
return function generateCodeChallenge(_x) {
return _ref.apply(this, arguments);
};
}();
/**
* Generate authorization params to pass to {@link generateAuthorizationUrl}.
*
* Used as part of an authorization code OIDC flow: see https://openid.net/specs/openid-connect-basic-1_0.html#CodeFlow.
*
* @param redirectUri - absolute url for OP to redirect to after authorization
* @returns AuthorizationParams
*/
export var generateAuthorizationParams = _ref2 => {
var {
redirectUri
} = _ref2;
return {
scope: generateScope(),
redirectUri,
state: secureRandomString(8),
nonce: secureRandomString(8),
codeVerifier: secureRandomString(64) // https://tools.ietf.org/html/rfc7636#section-4.1 length needs to be 43-128 characters
};
};
/**
* @deprecated use generateOidcAuthorizationUrl
* Generate a URL to attempt authorization with the OP
* See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
* @param authorizationUrl - endpoint to attempt authorization with the OP
* @param clientId - id of this client as registered with the OP
* @param authorizationParams - params to be used in the url
* @returns a Promise with the url as a string
*/
export var generateAuthorizationUrl = /*#__PURE__*/function () {
var _ref4 = _asyncToGenerator(function* (authorizationUrl, clientId, _ref3) {
var {
scope,
redirectUri,
state,
nonce,
codeVerifier
} = _ref3;
var url = new URL(authorizationUrl);
url.searchParams.append("response_mode", "query");
url.searchParams.append("response_type", "code");
url.searchParams.append("redirect_uri", redirectUri);
url.searchParams.append("client_id", clientId);
url.searchParams.append("state", state);
url.searchParams.append("scope", scope);
url.searchParams.append("nonce", nonce);
url.searchParams.append("code_challenge_method", "S256");
url.searchParams.append("code_challenge", yield generateCodeChallenge(codeVerifier));
return url.toString();
});
return function generateAuthorizationUrl(_x2, _x3, _x4) {
return _ref4.apply(this, arguments);
};
}();
/**
* @experimental
* Generate a URL to attempt authorization with the OP
* See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
* @param metadata - validated metadata from OP discovery
* @param clientId - this client's id as registered with the OP
* @param homeserverUrl - used to establish the session on return from the OP
* @param identityServerUrl - used to establish the session on return from the OP
* @param nonce - state
* @param prompt - indicates to the OP which flow the user should see - eg login or registration
* See https://openid.net/specs/openid-connect-prompt-create-1_0.html#name-prompt-parameter
* @param urlState - value to append to the opaque state identifier to uniquely identify the callback
* @param loginHint - value to send as the `login_hint` to the OP, giving a hint about the login identifier the user might use to log in.
* See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
* @param responseMode - value to send as the `response_mode` to the OP, selecting how auth is passed back during redirect.
* See {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest OIDC core 3.1.2.1}.
* @returns a Promise with the url as a string
*/
export var generateOidcAuthorizationUrl = /*#__PURE__*/function () {
var _ref6 = _asyncToGenerator(function* (_ref5) {
var {
metadata,
redirectUri,
clientId,
homeserverUrl,
identityServerUrl,
nonce,
prompt,
urlState,
loginHint,
responseMode = "query"
} = _ref5;
var scope = generateScope();
var oidcClient = new OidcClient(_objectSpread(_objectSpread({}, metadata), {}, {
client_id: clientId,
redirect_uri: redirectUri,
authority: metadata.issuer,
response_mode: responseMode,
response_type: "code",
scope,
stateStore: new WebStorageStateStore({
prefix: "mx_oidc_",
store: window.sessionStorage
})
}));
var userState = {
homeserverUrl,
nonce,
identityServerUrl
};
var request = yield oidcClient.createSigninRequest({
state: userState,
nonce,
prompt,
url_state: urlState,
login_hint: loginHint
});
return request.url;
});
return function generateOidcAuthorizationUrl(_x5) {
return _ref6.apply(this, arguments);
};
}();
/**
* Normalize token_type to use capital case to make consuming the token response easier
* token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
* Later, when used in auth headers it is case sensitive and must be Bearer
* See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
*
* @param response - validated token response
* @returns response with token_type set to 'Bearer'
*/
var normalizeBearerTokenResponseTokenType = response => ({
id_token: response.id_token,
scope: response.scope,
expires_at: response.expires_at,
refresh_token: response.refresh_token,
access_token: response.access_token,
token_type: "Bearer"
});
/**
* @experimental
* Attempt to exchange authorization code for bearer token.
*
* Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a
* request to the Token Endpoint, to obtain the access token, refresh token, etc.
*
* @param code - authorization code as returned by OP during authorization
* @param state - authorization state param as returned by OP during authorization
* @param responseMode - the response mode used for authentication
* @returns valid bearer token response
* @throws An `Error` with `message` set to an entry in {@link OidcError},
* when the request fails, or the returned token response is invalid.
*/
export var completeAuthorizationCodeGrant = /*#__PURE__*/function () {
var _ref7 = _asyncToGenerator(function* (code, state) {
var responseMode = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : "query";
/**
* Element Web strips and changes the url on starting the app
* Use the code and state from query params to rebuild a url
* so that oidc-client can parse it
*/
var reconstructedUrl = new URL(window.location.origin);
var params = new URLSearchParams({
code,
state
});
if (responseMode === "query") {
reconstructedUrl.search = params.toString();
} else {
reconstructedUrl.hash = "#".concat(params.toString());
}
// set oidc-client to use our logger
Log.setLogger(logger);
try {
var response = new SigninResponse(params);
var stateStore = new WebStorageStateStore({
prefix: "mx_oidc_",
store: window.sessionStorage
});
// retrieve the state we put in storage at the start of oidc auth flow
var stateString = yield stateStore.get(response.state);
if (!stateString) {
throw new Error(OidcError.MissingOrInvalidStoredState);
}
// hydrate the sign in state and create a client
// the stored sign in state includes oidc configuration we set at the start of the oidc login flow
var signInState = yield SigninState.fromStorageString(stateString);
var client = new OidcClient(_objectSpread(_objectSpread({}, signInState), {}, {
stateStore
}));
// validate the code and state, and attempt to swap the code for tokens
var signinResponse = yield client.processSigninResponse(reconstructedUrl.href);
// extra values we stored at the start of the login flow
// used to complete login in the client
var userState = signinResponse.userState;
validateStoredUserState(userState);
// throws when response is invalid
validateBearerTokenResponse(signinResponse);
if (signinResponse.id_token) {
// The token is not yet in the Matrix spec so consider it optional
// throws when token is invalid
validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);
}
var normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);
return {
oidcClientSettings: {
clientId: client.settings.client_id,
issuer: client.settings.authority
},
tokenResponse: normalizedTokenResponse,
homeserverUrl: userState.homeserverUrl,
identityServerUrl: userState.identityServerUrl,
idTokenClaims: signinResponse.profile
};
} catch (error) {
logger.error("Oidc login failed", error);
var errorType = error.message;
// rethrow errors that we recognise
if (Object.values(OidcError).includes(errorType)) {
throw error;
}
throw new Error(OidcError.CodeExchangeFailed);
}
});
return function completeAuthorizationCodeGrant(_x6, _x7) {
return _ref7.apply(this, arguments);
};
}();
/**
* Response from the OIDC token endpoint when exchanging a token for grant_type device_code.
*/
/**
* Error from the OIDC token endpoint when exchanging a token for grant_type device_code.
*/
/**
* Response from the OIDC device authorization endpoint.
*/
/**
* Begin OIDC device authorization flow.
* @param options - The device authorization parameters.
* @param options.clientId - the client ID returned from client registration.
* @param options.scope - the scope to request for authorization.
* @param options.metadata - the validated OIDC metadata for the Identity Provider.
* @returns a promise that resolves to a device access token response,
* or an error response if the user denies authorization or the device code expires.
*/
export var startDeviceAuthorization = /*#__PURE__*/function () {
var _ref9 = _asyncToGenerator(function* (_ref8) {
var {
clientId,
scope,
metadata
} = _ref8;
var body = new URLSearchParams({
client_id: clientId,
scope: scope
}).toString();
var url = metadata.device_authorization_endpoint;
if (!url) {
throw new Error("No device_authorization_endpoint given");
}
var response = yield fetch(url, {
method: Method.Post,
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
body
});
return yield response.json();
});
return function startDeviceAuthorization(_x8) {
return _ref9.apply(this, arguments);
};
}();
/**
* Polls the OIDC token endpoint until we get a device access token response, or encounter an unrecoverable error.
* @param options - The device authorization parameters.
* @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
* @param options.metadata - The validated OIDC metadata for the Identity Provider.
* @param options.clientId - The client ID returned from client registration.
* @returns a promise that resolves to a device access token response,
* or an error response if the user denies authorization or the device code expires.
*/
export var waitForDeviceAuthorization = /*#__PURE__*/function () {
var _ref1 = _asyncToGenerator(function* (_ref0) {
var _session$interval;
var {
session,
metadata,
clientId
} = _ref0;
var interval = ((_session$interval = session.interval) !== null && _session$interval !== void 0 ? _session$interval : 5) * 1000; // poll interval
var expiration = Date.now() + session.expires_in * 1000;
do {
var body = new URLSearchParams({
device_code: session.device_code,
grant_type: OAuthGrantType.DeviceAuthorization,
client_id: clientId
}).toString();
var response = yield fetch(metadata.token_endpoint, {
method: Method.Post,
headers: {
"Content-Type": "application/x-www-form-urlencoded"
},
body
});
if (response.ok) {
return yield response.json();
}
var errorResponse = yield response.json();
switch (errorResponse.error) {
case "authorization_pending":
break;
case "slow_down":
interval += 5000;
break;
case "access_denied":
case "expired_token":
return errorResponse;
}
yield sleep(interval);
} while (Date.now() < expiration);
return {
error: "expired"
};
});
return function waitForDeviceAuthorization(_x9) {
return _ref1.apply(this, arguments);
};
}();
//# sourceMappingURL=authorize.js.map