|
| 1 | +/* |
| 2 | +Copyright 2023 The Matrix.org Foundation C.I.C. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +import { IDelegatedAuthConfig } from "../client"; |
| 18 | +import { OidcError } from "./error"; |
| 19 | +import { Method } from "../http-api"; |
| 20 | +import { logger } from "../logger"; |
| 21 | +import { ValidatedIssuerConfig } from "./validate"; |
| 22 | + |
| 23 | +/** |
| 24 | + * Client metadata passed to registration endpoint |
| 25 | + */ |
| 26 | +export type OidcRegistrationClientMetadata = { |
| 27 | + clientName: string; |
| 28 | + clientUri: string; |
| 29 | + redirectUris: string[]; |
| 30 | +}; |
| 31 | + |
| 32 | +/** |
| 33 | + * Make the client registration request |
| 34 | + * @param registrationEndpoint - URL as returned from issuer ./well-known/openid-configuration |
| 35 | + * @param clientMetadata - registration metadata |
| 36 | + * @returns resolves to the registered client id when registration is successful |
| 37 | + * @throws when registration request fails, or response is invalid |
| 38 | + */ |
| 39 | +const doRegistration = async ( |
| 40 | + registrationEndpoint: string, |
| 41 | + clientMetadata: OidcRegistrationClientMetadata, |
| 42 | +): Promise<string> => { |
| 43 | + // https://openid.net/specs/openid-connect-registration-1_0.html |
| 44 | + const metadata = { |
| 45 | + client_name: clientMetadata.clientName, |
| 46 | + client_uri: clientMetadata.clientUri, |
| 47 | + response_types: ["code"], |
| 48 | + grant_types: ["authorization_code", "refresh_token"], |
| 49 | + redirect_uris: clientMetadata.redirectUris, |
| 50 | + id_token_signed_response_alg: "RS256", |
| 51 | + token_endpoint_auth_method: "none", |
| 52 | + application_type: "web", |
| 53 | + }; |
| 54 | + const headers = { |
| 55 | + "Accept": "application/json", |
| 56 | + "Content-Type": "application/json", |
| 57 | + }; |
| 58 | + |
| 59 | + try { |
| 60 | + const response = await fetch(registrationEndpoint, { |
| 61 | + method: Method.Post, |
| 62 | + headers, |
| 63 | + body: JSON.stringify(metadata), |
| 64 | + }); |
| 65 | + |
| 66 | + if (response.status >= 400) { |
| 67 | + throw new Error(OidcError.DynamicRegistrationFailed); |
| 68 | + } |
| 69 | + |
| 70 | + const body = await response.json(); |
| 71 | + const clientId = body["client_id"]; |
| 72 | + if (!clientId || typeof clientId !== "string") { |
| 73 | + throw new Error(OidcError.DynamicRegistrationInvalid); |
| 74 | + } |
| 75 | + |
| 76 | + return clientId; |
| 77 | + } catch (error) { |
| 78 | + if (Object.values(OidcError).includes((error as Error).message as OidcError)) { |
| 79 | + throw error; |
| 80 | + } else { |
| 81 | + logger.error("Dynamic registration request failed", error); |
| 82 | + throw new Error(OidcError.DynamicRegistrationFailed); |
| 83 | + } |
| 84 | + } |
| 85 | +}; |
| 86 | + |
| 87 | +/** |
| 88 | + * Attempts dynamic registration against the configured registration endpoint |
| 89 | + * @param delegatedAuthConfig - Auth config from ValidatedServerConfig |
| 90 | + * @param clientName - Client name to register with the OP, eg 'Element' |
| 91 | + * @param baseUrl - URL of the home page of the Client, eg 'https://app.element.io/' |
| 92 | + * @returns Promise<string> resolved with registered clientId |
| 93 | + * @throws when registration is not supported, on failed request or invalid response |
| 94 | + */ |
| 95 | +export const registerOidcClient = async ( |
| 96 | + delegatedAuthConfig: IDelegatedAuthConfig & ValidatedIssuerConfig, |
| 97 | + clientName: string, |
| 98 | + baseUrl: string, |
| 99 | +): Promise<string> => { |
| 100 | + const clientMetadata = { |
| 101 | + clientName, |
| 102 | + clientUri: baseUrl, |
| 103 | + redirectUris: [baseUrl], |
| 104 | + }; |
| 105 | + if (!delegatedAuthConfig.registrationEndpoint) { |
| 106 | + throw new Error(OidcError.DynamicRegistrationNotSupported); |
| 107 | + } |
| 108 | + const clientId = await doRegistration(delegatedAuthConfig.registrationEndpoint, clientMetadata); |
| 109 | + |
| 110 | + return clientId; |
| 111 | +}; |
0 commit comments