Skip to content

Commit d4e7504

Browse files
bourgeoabourgeoa
committed
running tests with/without webid
1 parent ae354ee commit d4e7504

File tree

5 files changed

+49
-27
lines changed

5 files changed

+49
-27
lines changed

‎src/DpopIDToken.js‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ class DpopIDToken extends JWT {
4141
static issue (provider, options) {
4242
let { issuer, keys } = provider
4343

44-
let { aud, azp, sub, at_hash, c_hash, cnf } = options
44+
let { aud, azp, sub, at_hash, c_hash, cnf, scope } = options
4545

4646
let alg = options.alg || DEFAULT_SIG_ALGORITHM
4747
let jti = options.jti || random(8)
@@ -57,8 +57,8 @@ class DpopIDToken extends JWT {
5757
let header = { alg, kid }
5858
let payload = { iss, aud, azp, sub, exp, iat, jti }
5959

60-
// Add webid claim for Solid OIDC compliance
61-
if (sub) {
60+
// Add webid claim for Solid OIDC compliance when webid scope is requested
61+
if (sub && scope && (scope.includes('webid') || scope.split(' ').includes('webid'))) {
6262
payload.webid = sub
6363
}
6464

@@ -81,21 +81,29 @@ class DpopIDToken extends JWT {
8181
let alg = client['id_token_signed_response_alg'] || DEFAULT_SIG_ALGORITHM
8282
let jti = random(8)
8383
let iat = Math.floor(Date.now() / 1000)
84-
let aud, azp, sub, max
84+
let aud, azp, sub, max, scope
8585

8686
// authentication request
8787
if (!code) {
88-
aud = client['client_id']
88+
aud = [client['client_id'], 'solid']
8989
azp = client['client_id']
90-
sub = subject['_id']
90+
// Use WebID URL for sub if available (Solid OIDC compliance), otherwise use database ID
91+
sub = subject?.webId || subject['_id']
9192
max = parseInt(params['max_age']) || client['default_max_age'] || DEFAULT_MAX_AGE
93+
scope = params.scope // Get the requested scope
9294

9395
// token request
9496
} else {
95-
aud = code.aud
96-
azp = code.azp || aud
97+
// Ensure aud is array containing both client_id and 'solid'
98+
if (Array.isArray(code.aud) && code.aud.includes('solid')) {
99+
aud = code.aud
100+
} else {
101+
aud = [code.aud, 'solid']
102+
}
103+
azp = code.azp || (Array.isArray(aud) ? aud[0] : aud)
97104
sub = code.sub
98105
max = parseInt(code['max']) || client['default_max_age'] || DEFAULT_MAX_AGE
106+
scope = code.scope // Get the scope from authorization code
99107
}
100108

101109
let len = alg.match(/(256|384|512)$/)[0]
@@ -110,7 +118,7 @@ class DpopIDToken extends JWT {
110118
.then(hashes => {
111119
let [at_hash, c_hash] = hashes
112120

113-
let options = { alg, aud, azp, sub, iat, jti, at_hash, c_hash }
121+
let options = { alg, aud, azp, sub, iat, jti, at_hash, c_hash, scope }
114122

115123
if (request.cnfKey) {
116124
options.cnf = { jwk: request.cnfKey }

‎src/IDToken.js‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ class IDToken extends JWT {
4141
static issue (provider, options) {
4242
let { issuer, keys } = provider
4343

44-
let { aud, azp, sub, nonce, at_hash, c_hash, cnf } = options
44+
let { aud, azp, sub, nonce, at_hash, c_hash, cnf, scope } = options
4545

4646
let alg = options.alg || DEFAULT_SIG_ALGORITHM
4747
let jti = options.jti || random(8)
@@ -57,8 +57,8 @@ class IDToken extends JWT {
5757
let header = { alg, kid }
5858
let payload = { iss, aud, azp, sub, exp, iat, jti, nonce }
5959

60-
// Add webid claim for Solid OIDC compliance
61-
if (sub) {
60+
// Add webid claim for Solid OIDC compliance only if webid scope is requested
61+
if (sub && scope && (scope.includes('webid') || scope.split(' ').includes('webid'))) {
6262
payload.webid = sub
6363
}
6464

@@ -80,23 +80,26 @@ class IDToken extends JWT {
8080
let alg = client['id_token_signed_response_alg'] || DEFAULT_SIG_ALGORITHM
8181
let jti = random(8)
8282
let iat = Math.floor(Date.now() / 1000)
83-
let aud, azp, sub, max, nonce
83+
let aud, azp, sub, max, nonce, scope
8484

8585
// authentication request
8686
if (!code) {
87-
aud = client['client_id']
87+
aud = [client['client_id'], 'solid']
8888
azp = client['client_id']
89-
sub = subject['_id']
89+
// Use WebID URL for sub if available (Solid OIDC compliance), otherwise use database ID
90+
sub = subject?.webId || subject['_id']
9091
max = parseInt(params['max_age']) || client['default_max_age'] || DEFAULT_MAX_AGE
9192
nonce = params.nonce
93+
scope = params.scope // Get the requested scope
9294

9395
// token request
9496
} else {
95-
aud = code.aud
96-
azp = code.azp || aud
97+
aud = Array.isArray(code.aud) ? [...code.aud, 'solid'] : [code.aud, 'solid']
98+
azp = code.azp || (Array.isArray(code.aud) ? code.aud[0] : code.aud)
9799
sub = code.sub
98100
max = parseInt(code['max']) || client['default_max_age'] || DEFAULT_MAX_AGE
99101
nonce = code.nonce
102+
scope = code.scope // Get the scope from authorization code
100103
}
101104

102105
let len = alg.match(/(256|384|512)$/)[0]
@@ -111,7 +114,7 @@ class IDToken extends JWT {
111114
.then(hashes => {
112115
let [at_hash, c_hash] = hashes
113116

114-
let options = { alg, aud, azp, sub, iat, jti, nonce, at_hash, c_hash }
117+
let options = { alg, aud, azp, sub, iat, jti, nonce, at_hash, c_hash, scope }
115118

116119
if (request.cnfKey) {
117120
options.cnf = { jwk: request.cnfKey }

‎src/Provider.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ const DEFAULT_GRANT_TYPES_SUPPORTED = [
3535
]
3636
const DEFAULT_SCOPES_SUPPORTED = [
3737
'openid',
38-
'offline_access'
38+
'offline_access',
39+
'webid'
3940
]
4041
const DEFAULT_SUBJECT_TYPES_SUPPORTED = ['public']
4142

@@ -93,7 +94,7 @@ class Provider {
9394
data.token_endpoint_auth_signing_alg_values_supported || ['RS256']
9495
this.display_values_supported = data.display_values_supported || []
9596
this.claim_types_supported = data.claim_types_supported || ['normal']
96-
this.claims_supported = data.claims_supported || []
97+
this.claims_supported = data.claims_supported || ['sub', 'iss', 'aud', 'exp', 'iat', 'webid']
9798
this.service_documentation = data.service_documentation
9899
this.claims_locales_supported = data.claims_locales_supported
99100
this.ui_locales_supported = data.ui_locales_supported

‎test/IDTokenSpec.js‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ describe('IDToken', () => {
5050
describe('authentication request', () => {
5151
beforeEach(() => {
5252
client = { 'client_id': 'client123' }
53-
params = { nonce: 'nonce123' }
53+
params = { nonce: 'nonce123', scope: 'openid webid' }
5454
cnfKey = {
5555
'kty': 'RSA',
5656
'alg': 'RS256',
@@ -74,7 +74,7 @@ describe('IDToken', () => {
7474
expect(token.payload.iss).to.equal(providerUri)
7575
expect(token.payload.sub).to.equal('user123')
7676
expect(token.payload.webid).to.equal('user123')
77-
expect(token.payload.aud).to.equal('client123')
77+
expect(token.payload.aud).to.deep.equal(['client123', 'solid'])
7878
expect(token.payload.azp).to.equal('client123')
7979
expect(token.payload.cnf).to.eql({ jwk: cnfKey })
8080
})
@@ -87,7 +87,8 @@ describe('IDToken', () => {
8787
code = {
8888
aud: 'client123',
8989
sub: 'user123',
90-
nonce: 'nonce123'
90+
nonce: 'nonce123',
91+
scope: 'openid webid'
9192
}
9293
cnfKey = {}
9394
request = { params, code, provider, client, subject, cnfKey }
@@ -108,7 +109,7 @@ describe('IDToken', () => {
108109
expect(token.payload.iss).to.equal(providerUri)
109110
expect(token.payload.sub).to.equal('user123')
110111
expect(token.payload.webid).to.equal('user123')
111-
expect(token.payload.aud).to.equal('client123')
112+
expect(token.payload.aud).to.deep.equal(['client123', 'solid'])
112113
expect(token.payload.azp).to.equal('client123')
113114
expect(token.payload.nonce).to.equal('nonce123')
114115
expect(token.payload.at_hash).to.equal('tGwJZ3NDJh8LQ5pHJCIiXg')
@@ -130,7 +131,8 @@ describe('IDToken', () => {
130131
nonce: 'n0nce',
131132
at_hash: 'athash123',
132133
c_hash: 'chash123',
133-
cnf: { jwk: {} }
134+
cnf: { jwk: {} },
135+
scope: 'openid webid'
134136
}
135137
})
136138

‎test/config/provider.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
],
2727
"scopes_supported": [
2828
"openid",
29-
"offline_access"
29+
"offline_access",
30+
"webid"
3031
],
3132
"subject_types_supported": [
3233
"public"
@@ -47,7 +48,14 @@
4748
"claim_types_supported": [
4849
"normal"
4950
],
50-
"claims_supported": "",
51+
"claims_supported": [
52+
"sub",
53+
"iss",
54+
"aud",
55+
"exp",
56+
"iat",
57+
"webid"
58+
],
5159
"claims_parameter_supported": false,
5260
"request_parameter_supported": false,
5361
"request_uri_parameter_supported": true,

0 commit comments

Comments
 (0)