@mongodb-js/oidc-plugin - npm Package Compare versions

Comparing version 0.3.0 to 0.3.1

dist/log-hook.js

@@ -110,4 +110,7 @@ "use strict";
     });
+    emitter.on('mongodb-oidc-plugin:missing-id-token', () => {
+        log.warn('OIDC-PLUGIN', mongoLogId(1002000022), `${contextPrefix}-oidc`, 'Missing ID token in IdP response');
+    });
 }
 exports.hookLoggerToMongoLogWriter = hookLoggerToMongoLogWriter;
 //# sourceMappingURL=log-hook.js.map

dist/plugin.js

@@ -325,19 +325,35 @@ "use strict";
         // receive mismatching tokens for different users or different audiences.
-        const idTokenClaims = tokenSet.claims();
-        if (state.lastIdTokenClaims) {
-            for (const claim of ['aud', 'sub']) {
-                const normalize = (value) => {
-                    return JSON.stringify(Array.isArray(value) ? [...value].sort() : value);
-                };
-                const knownClaim = normalize(state.lastIdTokenClaims[claim]);
-                const newClaim = normalize(idTokenClaims[claim]);
-                if (knownClaim !== newClaim) {
-                    throw new types_1.MongoDBOIDCError(`Unexpected '${claim}' field in id token: Expected ${knownClaim}, saw ${newClaim}`);
+        if (!tokenSet.id_token &&
+            state.lastIdTokenClaims &&
+            !state.lastIdTokenClaims.noIdToken) {
+            throw new types_1.MongoDBOIDCError(`ID token expected, but not found. Expected claims: ${JSON.stringify(state.lastIdTokenClaims)}`);
+        }
+        if (tokenSet.id_token &&
+            state.lastIdTokenClaims &&
+            state.lastIdTokenClaims.noIdToken) {
+            throw new types_1.MongoDBOIDCError(`Unexpected ID token received.`);
+        }
+        if (tokenSet.id_token) {
+            const idTokenClaims = tokenSet.claims();
+            if (state.lastIdTokenClaims && !state.lastIdTokenClaims.noIdToken) {
+                for (const claim of ['aud', 'sub']) {
+                    const normalize = (value) => {
+                        return JSON.stringify(Array.isArray(value) ? [...value].sort() : value);
+                    };
+                    const knownClaim = normalize(state.lastIdTokenClaims[claim]);
+                    const newClaim = normalize(idTokenClaims[claim]);
+                    if (knownClaim !== newClaim) {
+                        throw new types_1.MongoDBOIDCError(`Unexpected '${claim}' field in id token: Expected ${knownClaim}, saw ${newClaim}`);
+                    }
                 }
             }
+            state.lastIdTokenClaims = {
+                aud: idTokenClaims.aud,
+                sub: idTokenClaims.sub,
+            };
         }
-        state.lastIdTokenClaims = {
-            aud: idTokenClaims.aud,
-            sub: idTokenClaims.sub,
-        };
+        else {
+            state.lastIdTokenClaims = { noIdToken: true };
+            this.logger.emit('mongodb-oidc-plugin:missing-id-token');
+        }
         const timerDuration = automaticRefreshTimeoutMS(tokenSet);
@@ -344,0 +360,0 @@ // Use `.call()` because in browsers, `setTimeout()` requires that it is called

dist/types.d.ts

@@ -65,2 +65,3 @@ /** @public */
     'mongodb-oidc-plugin:destroyed': () => void;
+    'mongodb-oidc-plugin:missing-id-token': () => void;
 }
@@ -67,0 +68,0 @@ /** @public */

index.d.ts

@@ -143,2 +143,3 @@ /// <reference types="node" />
     'mongodb-oidc-plugin:destroyed': () => void;
+    'mongodb-oidc-plugin:missing-id-token': () => void;
 }
@@ -145,0 +146,0 @@

package.json

@@ -16,3 +16,3 @@ {
   "homepage": "https://github.com/mongodb-js/oidc-plugin",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "repository": {
@@ -61,3 +61,3 @@ "type": "git",
     "@mongodb-js/monorepo-tools": "^1.1.4",
-    "@mongodb-js/oidc-mock-provider": "^0.6.2",
+    "@mongodb-js/oidc-mock-provider": "^0.7.1",
     "@mongodb-js/prettier-config-devtools": "^1.0.1",
@@ -67,3 +67,3 @@ "@mongodb-js/tsconfig-devtools": "^1.0.0",
     "@types/express": "^4.17.17",
-    "@types/mocha": "^9.0.0",
+    "@types/mocha": "^10.0.2",
     "@types/node": "^18.13.0",
@@ -74,3 +74,3 @@ "@types/oidc-provider": "^8.1.1",
     "depcheck": "^1.4.1",
-    "electron": "^23.1.2",
+    "electron": "^26.2.0",
     "electron-mocha": "^12.0.0",
@@ -77,0 +77,0 @@ "eslint": "^7.25.0",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

164973

increased by1.12%

Lines of code

2264

increased by0.94%

No dependency changes