fix: record CIMD provenance as an issuer-keyed marker, not on the credential
Copilot review (#2287), three findings: 1. **invalid-client recovery lost the provenance.** SDK v2 `auth()` answers `invalid_client` / `unauthorized_client` with `invalidateCredentials("client")` and an immediate retry; our clear drops the registration *and* its kind, so the retry's URL-based client-ID save landed with nothing recorded and was stored as `dcr`. Provenance now lives in `cimdClientMetadataUrl`, an issuer-keyed marker on the issuer slot that records a property of the AS rather than a credential — `clearClientInformation` deliberately leaves it alone. `ensureCimdClientRegistration` writes it, and withdraws it when the AS stops advertising CIMD, on every connect. 2. **Discovery became a hard network dependency.** Moving the existing-client check after discovery meant a well-known outage could fail a reconnect the SDK would have served from its persisted discovery state. Reuse `provider.discoveryState()` first, and treat a discovery failure as "skip pre-registration" rather than an error — this helper is an optimization over what `auth()` does for itself. 3. **Dropped an unjustified double cast** in the test fetch helper; the async signature is directly assignable to `typeof fetch`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall
parent
4c6a9fb376
commit
4297ef8449
9 changed files with 299 additions and 108 deletions
|
|
@ -24,6 +24,9 @@ describe("ensureCimdClientRegistration", () => {
|
|||
storage = {
|
||||
getClientInformation: vi.fn(async () => undefined),
|
||||
saveClientInformation: vi.fn(async () => {}),
|
||||
getDiscoveryState: vi.fn(async () => undefined),
|
||||
getCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
saveCimdClientMetadataUrl: vi.fn(async () => {}),
|
||||
getScope: vi.fn().mockResolvedValue(undefined),
|
||||
getTokens: vi.fn(async () => undefined),
|
||||
saveTokens: vi.fn(async () => {}),
|
||||
|
|
@ -72,6 +75,12 @@ describe("ensureCimdClientRegistration", () => {
|
|||
},
|
||||
{ registrationKind: "cimd", issuer: "http://127.0.0.1:9999" },
|
||||
);
|
||||
// The provenance marker for this AS, which outlives the credential.
|
||||
expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith(
|
||||
SERVER_URL,
|
||||
"http://127.0.0.1:9999",
|
||||
METADATA_URL,
|
||||
);
|
||||
});
|
||||
|
||||
it("does not register when the AS metadata omits CIMD support", async () => {
|
||||
|
|
@ -102,6 +111,13 @@ describe("ensureCimdClientRegistration", () => {
|
|||
});
|
||||
|
||||
expect(storage.saveClientInformation).not.toHaveBeenCalled();
|
||||
// The marker is actively withdrawn, not merely left unwritten, so an AS that
|
||||
// stops advertising CIMD stops being treated as one.
|
||||
expect(storage.saveCimdClientMetadataUrl).toHaveBeenCalledWith(
|
||||
SERVER_URL,
|
||||
"http://127.0.0.1:9999",
|
||||
undefined,
|
||||
);
|
||||
});
|
||||
|
||||
it("discovers protected-resource metadata at the challenge-advertised URL (#2071)", async () => {
|
||||
|
|
@ -161,6 +177,57 @@ describe("ensureCimdClientRegistration", () => {
|
|||
);
|
||||
});
|
||||
|
||||
// #2242 (Copilot): the existing-client check moved after discovery, so this
|
||||
// helper must not turn a well-known outage into a failed reconnect. It reuses
|
||||
// the discovery state SDK `auth()` persists, and treats a discovery failure as
|
||||
// "skip pre-registration" rather than an error.
|
||||
it("reuses persisted discovery state instead of re-fetching", async () => {
|
||||
storage.getDiscoveryState = vi.fn(async () => ({
|
||||
authorizationServerUrl: "http://127.0.0.1:9999",
|
||||
authorizationServerMetadata: {
|
||||
issuer: "http://127.0.0.1:9999",
|
||||
authorization_endpoint: "http://127.0.0.1:9999/oauth/authorize",
|
||||
token_endpoint: "http://127.0.0.1:9999/oauth/token",
|
||||
response_types_supported: ["code"],
|
||||
client_id_metadata_document_supported: true,
|
||||
},
|
||||
}));
|
||||
const fetchFn = vi.fn(async () => {
|
||||
throw new Error("discovery must not run when state is cached");
|
||||
});
|
||||
|
||||
await ensureCimdClientRegistration({
|
||||
serverUrl: SERVER_URL,
|
||||
provider: createProvider(storage),
|
||||
fetchFn,
|
||||
});
|
||||
|
||||
expect(fetchFn).not.toHaveBeenCalled();
|
||||
expect(storage.saveClientInformation).toHaveBeenCalledWith(
|
||||
SERVER_URL,
|
||||
{ client_id: METADATA_URL },
|
||||
{ registrationKind: "cimd", issuer: "http://127.0.0.1:9999" },
|
||||
);
|
||||
});
|
||||
|
||||
it("skips pre-registration when discovery fails, rather than throwing", async () => {
|
||||
const fetchFn = vi.fn(async () => {
|
||||
throw new Error("well-known endpoint is down");
|
||||
});
|
||||
|
||||
await expect(
|
||||
ensureCimdClientRegistration({
|
||||
serverUrl: SERVER_URL,
|
||||
provider: createProvider(storage),
|
||||
fetchFn,
|
||||
}),
|
||||
).resolves.toBeUndefined();
|
||||
|
||||
expect(storage.saveClientInformation).not.toHaveBeenCalled();
|
||||
// No marker is invented either — nothing was learned about the AS.
|
||||
expect(storage.saveCimdClientMetadataUrl).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("no-ops when client information is already stored for the discovered issuer", async () => {
|
||||
// Dynamic slot only — a preregistered hit would short-circuit
|
||||
// `clientInformation()` before it ever reaches the issuer-keyed read.
|
||||
|
|
|
|||
|
|
@ -61,6 +61,8 @@ function createStorage(
|
|||
getCodeVerifier: vi.fn(),
|
||||
getDiscoveryState: vi.fn().mockResolvedValue(undefined),
|
||||
saveDiscoveryState: vi.fn(),
|
||||
getCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
saveCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
clearDiscoveryState: vi.fn(),
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -221,6 +221,8 @@ describe("OAuthNavigation", () => {
|
|||
getScope: vi.fn().mockResolvedValue(undefined),
|
||||
getClientInformation: vi.fn(async () => undefined),
|
||||
getClientRegistrationKind: vi.fn(async () => undefined),
|
||||
getCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
saveCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
saveClientInformation: vi.fn(async () => undefined),
|
||||
savePreregisteredClientInformation: vi.fn(async () => undefined),
|
||||
saveScope: vi.fn(async () => undefined),
|
||||
|
|
@ -641,20 +643,16 @@ describe("OAuthNavigation", () => {
|
|||
const ISSUER = "https://as.example.com";
|
||||
const METADATA_URL = "https://app.example.com/client-metadata.json";
|
||||
|
||||
/** Storage already holding the CIMD pre-registration for METADATA_URL. */
|
||||
/** Storage holding this AS's CIMD marker for METADATA_URL. */
|
||||
function makeCimdStorage(): OAuthStorage {
|
||||
const storage = makeStorage();
|
||||
vi.mocked(storage.getClientInformation).mockImplementation(
|
||||
async (_url: string, preregistered?: boolean) =>
|
||||
preregistered ? undefined : { client_id: METADATA_URL },
|
||||
);
|
||||
vi.mocked(storage.getClientRegistrationKind).mockResolvedValue(
|
||||
"cimd",
|
||||
vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue(
|
||||
METADATA_URL,
|
||||
);
|
||||
return storage;
|
||||
}
|
||||
|
||||
it("keeps cimd when CIMD is configured and the stored registration matches", async () => {
|
||||
it("keeps cimd when CIMD is configured and this issuer carries the marker", async () => {
|
||||
const storage = makeCimdStorage();
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
clientMetadataUrl: METADATA_URL,
|
||||
|
|
@ -665,11 +663,8 @@ describe("OAuthNavigation", () => {
|
|||
{ issuer: ISSUER },
|
||||
);
|
||||
|
||||
// Reads the dynamic slot for this issuer, which falls back to the
|
||||
// unkeyed slot the pre-registration wrote.
|
||||
expect(storage.getClientInformation).toHaveBeenCalledWith(
|
||||
expect(storage.getCimdClientMetadataUrl).toHaveBeenCalledWith(
|
||||
SERVER,
|
||||
false,
|
||||
ISSUER,
|
||||
);
|
||||
expect(storage.saveClientInformation).toHaveBeenCalledWith(
|
||||
|
|
@ -679,6 +674,31 @@ describe("OAuthNavigation", () => {
|
|||
);
|
||||
});
|
||||
|
||||
// SDK v2 `auth()` answers `invalid_client` / `unauthorized_client` with
|
||||
// `invalidateCredentials("client")` and an immediate retry. That clears
|
||||
// the stored registration *and* its kind, so provenance read off the
|
||||
// credential would be gone by the time the retry's CIMD save lands
|
||||
// (Copilot). The marker is not a credential and survives.
|
||||
it("keeps cimd through invalid-client recovery, which clears the credential", async () => {
|
||||
const storage = makeCimdStorage();
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
clientMetadataUrl: METADATA_URL,
|
||||
});
|
||||
|
||||
await provider.invalidateCredentials("client");
|
||||
await provider.saveClientInformation(
|
||||
{ client_id: METADATA_URL },
|
||||
{ issuer: ISSUER },
|
||||
);
|
||||
|
||||
expect(storage.clearClientInformation).toHaveBeenCalledWith(SERVER);
|
||||
expect(storage.saveClientInformation).toHaveBeenCalledWith(
|
||||
SERVER,
|
||||
{ client_id: METADATA_URL },
|
||||
{ registrationKind: "cimd", issuer: ISSUER },
|
||||
);
|
||||
});
|
||||
|
||||
it("records dcr for a server-minted client_id while CIMD is configured", async () => {
|
||||
const storage = makeCimdStorage();
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
|
|
@ -690,10 +710,8 @@ describe("OAuthNavigation", () => {
|
|||
{ issuer: ISSUER },
|
||||
);
|
||||
|
||||
// The id is not the metadata URL, so nothing is read and nothing is
|
||||
// carried forward.
|
||||
expect(storage.getClientInformation).not.toHaveBeenCalled();
|
||||
expect(storage.getClientRegistrationKind).not.toHaveBeenCalled();
|
||||
// The id is not the metadata URL, so the marker is never consulted.
|
||||
expect(storage.getCimdClientMetadataUrl).not.toHaveBeenCalled();
|
||||
expect(storage.saveClientInformation).toHaveBeenCalledWith(
|
||||
SERVER,
|
||||
{ client_id: "dcr-minted-id" },
|
||||
|
|
@ -701,7 +719,7 @@ describe("OAuthNavigation", () => {
|
|||
);
|
||||
});
|
||||
|
||||
it("records dcr when CIMD is not configured, even if storage says cimd", async () => {
|
||||
it("records dcr when CIMD is not configured, even if the marker is set", async () => {
|
||||
const storage = makeCimdStorage();
|
||||
const provider = makeProvider(storage);
|
||||
|
||||
|
|
@ -717,29 +735,11 @@ describe("OAuthNavigation", () => {
|
|||
);
|
||||
});
|
||||
|
||||
it("records dcr when the metadata URL differs from the configured one", async () => {
|
||||
const storage = makeCimdStorage();
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
clientMetadataUrl: "https://other.example.com/client-metadata.json",
|
||||
});
|
||||
|
||||
await provider.saveClientInformation(
|
||||
{ client_id: METADATA_URL },
|
||||
{ issuer: ISSUER },
|
||||
);
|
||||
|
||||
expect(storage.saveClientInformation).toHaveBeenCalledWith(
|
||||
SERVER,
|
||||
{ client_id: METADATA_URL },
|
||||
{ registrationKind: "dcr", issuer: ISSUER },
|
||||
);
|
||||
});
|
||||
|
||||
it("records dcr when no CIMD registration was ever stored", async () => {
|
||||
// The AS returns the configured metadata URL from a real registration
|
||||
// (RFC 7591 §3.2 leaves the id opaque). With nothing recorded as CIMD
|
||||
// under that id, the save is still DCR.
|
||||
it("records dcr when the marker names a different metadata URL", async () => {
|
||||
const storage = makeStorage();
|
||||
vi.mocked(storage.getCimdClientMetadataUrl).mockResolvedValue(
|
||||
"https://other.example.com/client-metadata.json",
|
||||
);
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
clientMetadataUrl: METADATA_URL,
|
||||
});
|
||||
|
|
@ -756,13 +756,11 @@ describe("OAuthNavigation", () => {
|
|||
);
|
||||
});
|
||||
|
||||
it("records dcr when the stored kind under that id is not cimd", async () => {
|
||||
it("records dcr when this issuer carries no marker", async () => {
|
||||
// The AS returns the configured metadata URL from a real registration
|
||||
// (RFC 7591 §3.2 leaves the id opaque). With no marker for this AS,
|
||||
// the save is still DCR.
|
||||
const storage = makeStorage();
|
||||
vi.mocked(storage.getClientInformation).mockImplementation(
|
||||
async (_url: string, preregistered?: boolean) =>
|
||||
preregistered ? undefined : { client_id: METADATA_URL },
|
||||
);
|
||||
vi.mocked(storage.getClientRegistrationKind).mockResolvedValue("dcr");
|
||||
const provider = makeProvider(storage, vi.fn(), {
|
||||
clientMetadataUrl: METADATA_URL,
|
||||
});
|
||||
|
|
@ -802,8 +800,8 @@ describe("OAuthNavigation", () => {
|
|||
* has to name the AS, so that the RFC 8414 §3.3 issuer echo the SDK
|
||||
* enforces resolves against the AS URL rather than the resource's.
|
||||
*/
|
||||
function discoveryFetch(issuer: string, cimd: boolean) {
|
||||
return (async (input: RequestInfo | URL) => {
|
||||
function discoveryFetch(issuer: string, cimd: boolean): typeof fetch {
|
||||
return async (input: RequestInfo | URL) => {
|
||||
const url = String(input);
|
||||
if (url.includes("/.well-known/oauth-protected-resource")) {
|
||||
return new Response(
|
||||
|
|
@ -827,7 +825,7 @@ describe("OAuthNavigation", () => {
|
|||
);
|
||||
}
|
||||
throw new Error(`unexpected fetch: ${url}`);
|
||||
}) as unknown as typeof fetch;
|
||||
};
|
||||
}
|
||||
|
||||
/** Issuer A pre-registers via CIMD, then the SDK binds it. */
|
||||
|
|
@ -900,6 +898,43 @@ describe("OAuthNavigation", () => {
|
|||
).toBe("cimd");
|
||||
});
|
||||
|
||||
// The provenance marker's whole reason for existing: SDK v2 `auth()`
|
||||
// answers `invalid_client` with `invalidateCredentials("client")` and
|
||||
// an immediate retry, and that clear removes the credential *and* its
|
||||
// registration kind. Asserted against real storage, since the point is
|
||||
// what `clearClientInformation` does and does not touch (Copilot).
|
||||
it("keeps the CIMD marker through invalid-client credential invalidation", async () => {
|
||||
const storage = makeRealStorage();
|
||||
const provider = await bindIssuerA(storage);
|
||||
expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe(
|
||||
METADATA_URL,
|
||||
);
|
||||
|
||||
await provider.invalidateCredentials("client");
|
||||
|
||||
// The credential and its kind are gone...
|
||||
expect(
|
||||
await storage.getClientInformation(SERVER, false, ISSUER),
|
||||
).toBeUndefined();
|
||||
expect(
|
||||
await storage.getClientRegistrationKind(SERVER, ISSUER),
|
||||
).toBeUndefined();
|
||||
// ...but the marker is not a credential, so it survives.
|
||||
expect(await storage.getCimdClientMetadataUrl(SERVER, ISSUER)).toBe(
|
||||
METADATA_URL,
|
||||
);
|
||||
|
||||
// The SDK's retry re-runs its URL-based client-ID branch.
|
||||
await provider.saveClientInformation(
|
||||
{ client_id: METADATA_URL },
|
||||
{ issuer: ISSUER },
|
||||
);
|
||||
|
||||
expect(
|
||||
await storage.getClientRegistrationKind(SERVER, ISSUER),
|
||||
).toBe("cimd");
|
||||
});
|
||||
|
||||
it("records dcr for a second issuer that mints its own client_id", async () => {
|
||||
const storage = makeRealStorage();
|
||||
const provider = await bindIssuerA(storage);
|
||||
|
|
|
|||
|
|
@ -70,6 +70,8 @@ function createMockParams(
|
|||
takeRevocationSnapshot: vi.fn().mockResolvedValue({ byIssuer: {} }),
|
||||
getDiscoveryState: vi.fn().mockResolvedValue(undefined),
|
||||
saveDiscoveryState: vi.fn().mockResolvedValue(undefined),
|
||||
getCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
saveCimdClientMetadataUrl: vi.fn(async () => undefined),
|
||||
clearDiscoveryState: vi.fn().mockResolvedValue(undefined),
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -27,50 +27,69 @@ export async function ensureCimdClientRegistration(params: {
|
|||
const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
|
||||
if (!clientMetadataUrl) return;
|
||||
|
||||
let resourceMetadata;
|
||||
try {
|
||||
resourceMetadata = await discoverOAuthProtectedResourceMetadata(
|
||||
params.serverUrl,
|
||||
{ resourceMetadataUrl: params.resourceMetadataUrl },
|
||||
// The same fetch the AS-metadata leg below uses. On web that is
|
||||
// `createRemoteFetch`, which proxies through the backend to sidestep
|
||||
// CORS — on the global `fetch` this leg would fail in the browser, be
|
||||
// swallowed by the catch, and leave CIMD probing the wrong
|
||||
// authorization server (Copilot).
|
||||
params.fetchFn,
|
||||
// Prefer the discovery state SDK `auth()` itself persists and reuses. Without
|
||||
// this, moving the existing-client check after discovery would turn a
|
||||
// temporary well-known outage into a failed reconnect, even where the SDK
|
||||
// could have proceeded from cache (Copilot).
|
||||
let metadata = (await params.provider.discoveryState())
|
||||
?.authorizationServerMetadata;
|
||||
|
||||
if (!metadata) {
|
||||
let resourceMetadata;
|
||||
try {
|
||||
resourceMetadata = await discoverOAuthProtectedResourceMetadata(
|
||||
params.serverUrl,
|
||||
{ resourceMetadataUrl: params.resourceMetadataUrl },
|
||||
// The same fetch the AS-metadata leg below uses. On web that is
|
||||
// `createRemoteFetch`, which proxies through the backend to sidestep
|
||||
// CORS — on the global `fetch` this leg would fail in the browser, be
|
||||
// swallowed by the catch, and leave CIMD probing the wrong
|
||||
// authorization server (Copilot).
|
||||
params.fetchFn,
|
||||
);
|
||||
} catch {
|
||||
resourceMetadata = undefined;
|
||||
}
|
||||
|
||||
try {
|
||||
// Walks the path-scoped authorization-server URL before the bare origin, so
|
||||
// a server hosted under a path is probed where it actually publishes its
|
||||
// metadata rather than only at the domain root (#2110).
|
||||
metadata = await discoverAuthorizationServerMetadataForServer(
|
||||
params.serverUrl,
|
||||
resourceMetadata,
|
||||
params.fetchFn,
|
||||
);
|
||||
} catch {
|
||||
// Pre-registration is an optimization over what SDK `auth()` does for
|
||||
// itself, so a discovery failure here must never fail the connection: bail
|
||||
// out and let `auth()` run its own discovery and error handling.
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
const issuer = metadata?.issuer;
|
||||
|
||||
// Record — or withdraw — this AS's CIMD marker before anything else, so it
|
||||
// stays current rather than only ever being written once. It is keyed by
|
||||
// issuer and is not a credential, so `invalidateCredentials("client")` leaves
|
||||
// it alone; see `IssuerBoundOAuthState.cimdClientMetadataUrl`.
|
||||
if (issuer) {
|
||||
await params.provider.saveCimdClientMetadataUrl(
|
||||
issuer,
|
||||
metadata?.client_id_metadata_document_supported
|
||||
? clientMetadataUrl
|
||||
: undefined,
|
||||
);
|
||||
} catch {
|
||||
resourceMetadata = undefined;
|
||||
}
|
||||
|
||||
// Walks the path-scoped authorization-server URL before the bare origin, so a
|
||||
// server hosted under a path is probed where it actually publishes its
|
||||
// metadata rather than only at the domain root (#2110).
|
||||
const metadata = await discoverAuthorizationServerMetadataForServer(
|
||||
params.serverUrl,
|
||||
resourceMetadata,
|
||||
params.fetchFn,
|
||||
);
|
||||
if (!metadata?.client_id_metadata_document_supported) return;
|
||||
|
||||
// SEP-2352 keys a registration to the authorization server that issued it, so
|
||||
// the record this writes is bound to the issuer we just discovered rather than
|
||||
// to the server as a whole. That binding is what makes the provenance
|
||||
// trustworthy later: `BaseOAuthClientProvider.saveClientInformation` preserves
|
||||
// `cimd` only for an issuer this function recorded it for, having first
|
||||
// confirmed *that* AS advertises `client_id_metadata_document_supported`
|
||||
// (#2242, Copilot). A second AS behind the same resource therefore gets its own
|
||||
// determination — pre-registered here when it too supports CIMD, and left to
|
||||
// dynamic registration when it does not.
|
||||
//
|
||||
// ⚠️ This is why the "do we already have a client?" check below sits *after*
|
||||
// discovery rather than short-circuiting it, at the cost of a discovery round
|
||||
// trip on each connect attempt rather than only the first. Read ctx-less — as
|
||||
// it was — it resolves through the *active* issuer and so early-returns for
|
||||
// every subsequent issuer, leaving them with no CIMD record at all. It still
|
||||
// ⚠️ Keyed by the issuer just resolved, not read ctx-less. A ctx-less read
|
||||
// resolves through the *active* issuer, so it early-returns for every
|
||||
// subsequent issuer and leaves them with no CIMD record at all. It still
|
||||
// answers the static case first, since `clientInformation` checks the
|
||||
// preregistered slot before any issuer slot.
|
||||
const issuer = metadata.issuer;
|
||||
const existing = await params.provider.clientInformation(
|
||||
issuer ? { issuer } : undefined,
|
||||
);
|
||||
|
|
|
|||
|
|
@ -186,6 +186,34 @@ export class OAuthStorageBase implements OAuthStorage {
|
|||
);
|
||||
}
|
||||
|
||||
async getCimdClientMetadataUrl(
|
||||
serverUrl: string,
|
||||
issuer?: string,
|
||||
): Promise<string | undefined> {
|
||||
await this.ensureLoaded();
|
||||
const state = this.memory.getState().getServerState(serverUrl);
|
||||
return this.issuerSlot(state, issuer)?.cimdClientMetadataUrl;
|
||||
}
|
||||
|
||||
async saveCimdClientMetadataUrl(
|
||||
serverUrl: string,
|
||||
issuer: string,
|
||||
clientMetadataUrl: string | undefined,
|
||||
): Promise<void> {
|
||||
await this.ensureLoaded();
|
||||
// Not a save of credentials, so it must not promote this issuer to
|
||||
// `activeIssuer` — the marker is written during discovery, before anything
|
||||
// has been authorized against this AS.
|
||||
this.updateIssuerSlot(
|
||||
serverUrl,
|
||||
issuer,
|
||||
{ cimdClientMetadataUrl: clientMetadataUrl },
|
||||
{},
|
||||
false,
|
||||
);
|
||||
await this.persist();
|
||||
}
|
||||
|
||||
async saveClientInformation(
|
||||
serverUrl: string,
|
||||
clientInformation: OAuthClientInformation,
|
||||
|
|
|
|||
|
|
@ -321,38 +321,35 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
|
|||
* Connection Info the moment the SDK bound it to an issuer (#2242).
|
||||
*
|
||||
* The claim is deliberately narrow — three conditions must all hold, and the
|
||||
* decisive one is a registration *we ourselves recorded* as CIMD, not an
|
||||
* inference about what the authorization server returned:
|
||||
* decisive one is a fact *we recorded about this authorization server*, not an
|
||||
* inference about what it returned:
|
||||
*
|
||||
* 1. CIMD is configured for this connection right now, and
|
||||
* 2. the incoming `client_id` is exactly that metadata-document URL, and
|
||||
* 3. the registration stored **for this issuer** under that same `client_id`
|
||||
* is recorded as `cimd` — written by `ensureCimdClientRegistration`, which
|
||||
* reaches that line only after confirming *that* AS advertises
|
||||
* `client_id_metadata_document_supported`.
|
||||
* 3. `ensureCimdClientRegistration` recorded that same URL as the CIMD marker
|
||||
* **for this issuer**, having read `client_id_metadata_document_supported`
|
||||
* from *that* AS's own metadata.
|
||||
*
|
||||
* RFC 7591 §3.2 makes a dynamically issued `client_id` opaque, so a client may
|
||||
* not assume its format — which is why (2) is not load-bearing on its own. For
|
||||
* a `registerClient` result to be mislabeled here, the AS would have to mint an
|
||||
* identifier byte-identical to the HTTPS URL we configured *and* be an AS we
|
||||
* had already recorded a CIMD registration for — that is, one that advertises
|
||||
* CIMD and then dynamically registers anyway. Anything else — a fresh DCR, a
|
||||
* different id, CIMD switched off, no prior CIMD registration for this issuer —
|
||||
* falls through to `"dcr"`.
|
||||
* identifier byte-identical to the HTTPS URL we configured *and* be an AS that
|
||||
* currently advertises CIMD and dynamically registered anyway. Anything else —
|
||||
* a fresh DCR, a different id, CIMD switched off, an AS that does not advertise
|
||||
* CIMD — falls through to `"dcr"`.
|
||||
*
|
||||
* ⚠️ (3) is scoped to the issuer on purpose, and the lookup deliberately does
|
||||
* **not** fall back to the server's active issuer. SEP-2352 keys registrations
|
||||
* per AS, so a second AS behind the same resource is a separate determination:
|
||||
* it may well not support CIMD and register dynamically, and RFC 7591 permits
|
||||
* it to mint the very URL the first AS uses as a CIMD `client_id` (Copilot).
|
||||
* `ensureCimdClientRegistration` binds the record to the issuer it discovered,
|
||||
* which is what lets this stay issuer-scoped without losing a genuine
|
||||
* second-issuer CIMD registration.
|
||||
* ⚠️ (3) reads the **marker**, not the stored registration kind, and the two
|
||||
* differ in exactly one place that matters: `invalidateCredentials("client")`
|
||||
* clears the credential and its kind, and SDK v2 `auth()` calls it on an
|
||||
* `invalid_client` / `unauthorized_client` response before retrying. The
|
||||
* retry's URL-based client-ID save would then find no kind and be recorded as
|
||||
* DCR. The marker describes the AS rather than the credential, so it survives
|
||||
* that clear (#2242, Copilot).
|
||||
*
|
||||
* The read is still issuer-*keyed* rather than issuer-*only*: `getClientInformation`
|
||||
* falls back to the unkeyed slot when no `byIssuer` entry exists, which is how a
|
||||
* pre-registration written before an issuer was known is still found on the save
|
||||
* that first binds one.
|
||||
* ⚠️ (3) is issuer-scoped with no fallback to the server's active issuer. A
|
||||
* second AS behind one resource is a separate determination: it may not support
|
||||
* CIMD and may register dynamically, and RFC 7591 permits it to mint the very
|
||||
* URL the first AS uses as its CIMD `client_id`.
|
||||
*/
|
||||
private async resolveSdkRegistrationKind(
|
||||
clientInformation: OAuthClientInformation,
|
||||
|
|
@ -365,19 +362,28 @@ export class BaseOAuthClientProvider implements OAuthClientProvider {
|
|||
) {
|
||||
return "dcr";
|
||||
}
|
||||
const stored = await this.storage.getClientInformation(
|
||||
this.serverUrl,
|
||||
false,
|
||||
issuer,
|
||||
);
|
||||
if (stored?.client_id !== clientMetadataUrl) return "dcr";
|
||||
const storedKind = await this.storage.getClientRegistrationKind(
|
||||
const marker = await this.storage.getCimdClientMetadataUrl(
|
||||
this.serverUrl,
|
||||
issuer,
|
||||
);
|
||||
// `"static"` lives in the preregistered slot, never this one, so `"cimd"`
|
||||
// is the only kind worth carrying forward.
|
||||
return storedKind === "cimd" ? "cimd" : "dcr";
|
||||
return marker === clientMetadataUrl ? "cimd" : "dcr";
|
||||
}
|
||||
|
||||
/** @see OAuthStorage.getCimdClientMetadataUrl */
|
||||
async cimdClientMetadataUrl(issuer?: string): Promise<string | undefined> {
|
||||
return await this.storage.getCimdClientMetadataUrl(this.serverUrl, issuer);
|
||||
}
|
||||
|
||||
/** @see OAuthStorage.saveCimdClientMetadataUrl */
|
||||
async saveCimdClientMetadataUrl(
|
||||
issuer: string,
|
||||
clientMetadataUrl: string | undefined,
|
||||
): Promise<void> {
|
||||
await this.storage.saveCimdClientMetadataUrl(
|
||||
this.serverUrl,
|
||||
issuer,
|
||||
clientMetadataUrl,
|
||||
);
|
||||
}
|
||||
|
||||
async saveScope(scope: string | undefined): Promise<void> {
|
||||
|
|
|
|||
|
|
@ -81,6 +81,23 @@ export interface OAuthStorage {
|
|||
issuer?: string,
|
||||
): Promise<OAuthClientRegistrationKind | undefined>;
|
||||
|
||||
/**
|
||||
* The CIMD client-metadata URL this authorization server was confirmed to
|
||||
* accept as a `client_id`. Survives {@link clearClientInformation}, because it
|
||||
* records a property of the AS rather than a credential (#2242).
|
||||
*/
|
||||
getCimdClientMetadataUrl(
|
||||
serverUrl: string,
|
||||
issuer?: string,
|
||||
): Promise<string | undefined>;
|
||||
|
||||
/** Write (or, with `undefined`, clear) the marker above for one issuer. */
|
||||
saveCimdClientMetadataUrl(
|
||||
serverUrl: string,
|
||||
issuer: string,
|
||||
clientMetadataUrl: string | undefined,
|
||||
): Promise<void>;
|
||||
|
||||
/**
|
||||
* Save client information (dynamically registered)
|
||||
*/
|
||||
|
|
|
|||
|
|
@ -30,6 +30,21 @@ export interface IssuerBoundOAuthState {
|
|||
/** Set when {@link clientInformation} is saved — DCR vs CIMD. */
|
||||
clientRegistrationKind?: OAuthClientRegistrationKind;
|
||||
tokens?: OAuthTokens;
|
||||
/**
|
||||
* The CIMD client-metadata URL this AS was confirmed to accept as a `client_id`
|
||||
* — written by `ensureCimdClientRegistration` after reading
|
||||
* `client_id_metadata_document_supported` from *this* issuer's metadata, and
|
||||
* refreshed (or cleared) on every connect because that check now runs each time.
|
||||
*
|
||||
* Deliberately **not** a credential, and so deliberately **not** cleared by
|
||||
* {@link OAuthStorage.clearClientInformation}. It records a property of the
|
||||
* authorization server and our own configuration, which an `invalid_client`
|
||||
* response says nothing about: SDK v2 `auth()` answers that error by calling
|
||||
* `invalidateCredentials("client")` and retrying, and the retry's URL-based
|
||||
* client-ID save would otherwise land with no provenance and be recorded as
|
||||
* DCR (#2242, Copilot).
|
||||
*/
|
||||
cimdClientMetadataUrl?: string;
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
|
|||
Loading…
Reference in a new issue