{"_id":"@anxing131/openid-client","_rev":"2-f3f1ed113252328bb1030ee1f349e8a2","name":"@anxing131/openid-client","dist-tags":{"latest":"4.9.0"},"versions":{"4.9.0":{"name":"@anxing131/openid-client","version":"4.9.0","description":"OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs","keywords":["auth","authentication","basic","certified","client","connect","dynamic","electron","hybrid","identity","implicit","oauth","oauth2","oidc","openid","passport","relying party","strategy"],"homepage":"https://github.com/panva/node-openid-client","repository":{"type":"git","url":"git+https://github.com/panva/node-openid-client.git"},"funding":{"url":"https://github.com/sponsors/panva"},"license":"MIT","author":{"name":"Filip Skokan","email":"panva.ip@gmail.com"},"exports":{"import":"./lib/index.mjs","require":"./lib/index.js"},"main":"lib/index.js","types":"types/index.d.ts","scripts":{"coverage":"nyc mocha test/**/*.test.js","lint":"eslint lib test","lint-fix":"eslint lib test --fix","test":"mocha test/**/*.test.js"},"nyc":{"reporter":["lcov","text-summary"]},"dependencies":{"aggregate-error":"^3.1.0","got":"^11.8.0","jose":"^2.0.5","lru-cache":"^6.0.0","make-error":"^1.3.6","object-hash":"^2.0.1","oidc-token-hash":"^5.0.1"},"devDependencies":{"@types/passport":"^1.0.4","base64url":"^3.0.1","chai":"^4.2.0","eslint":"^7.12.1","eslint-config-airbnb-base":"^14.2.0","eslint-plugin-import":"^2.22.1","mocha":"^8.2.0","nock":"^13.0.2","nyc":"^15.1.0","readable-mock-req":"^0.2.2","sinon":"^9.2.0","timekeeper":"^2.2.0"},"engines":{"node":"^10.19.0 || >=12.0.0 < 13 || >=13.7.0 < 14 || >= 14.2.0"},"standard-version":{"scripts":{"postchangelog":"sed -i '' -e 's/### \\[/## [/g' CHANGELOG.md"},"types":[{"type":"feat","section":"Features"},{"type":"fix","section":"Bug Fixes"},{"type":"chore","hidden":true},{"type":"docs","hidden":true},{"type":"style","hidden":true},{"type":"refactor","section":"Refactor","hidden":true},{"type":"perf","section":"Performance","hidden":false},{"type":"test","hidden":true}]},"gitHead":"faca2f3ebf2e94c78d2bcd1d889a1d1c7b85d1cb","bugs":{"url":"https://github.com/panva/node-openid-client/issues"},"_id":"@anxing131/openid-client@4.9.0","_nodeVersion":"14.16.0","_npmVersion":"6.14.11","dist":{"integrity":"sha512-ZubFdYt5ubMwO1VDR/RoLt26T4hc+mwVPlzeD+raX5evfZja7b3TX0klXdRPpe1oH5b6/0wxnncbM6sSQNZiHQ==","shasum":"82f49d8de2fe1b5097fc9f1278454532b856ecd8","tarball":"https://registry.npmjs.org/@anxing131/openid-client/-/openid-client-4.9.0.tgz","fileCount":30,"unpackedSize":181638,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJhzFdsCRA9TVsSAnZWagAAIpAP/AlHjtJW0S9b7WacQQiD\n6mlZq3EWCVUeTVqFX1+AXApLpHC2QPnSTMa1y4rOTzLAAdWjlzgdV+G7eIoE\n463tCQrLUM9Mzb2SXDAT5Qodf820UhZPCH9z7a3hctT/2Hn9N6AnKjloBi4Q\nuN0BLiSl3vyYRryEo5zNyOsPMtNwK7eYJ0XIVvMFF7c555JODbF1I9CGQ2m/\nbkJOaTAahQCcvOlptEtxfSwG4D4XP6u/hsx6XVsNoeo7Rayi+Mx4qBL6h22h\ncWrxD1ScMYGeQ1zSSdzHEzZ5NS38N7we6EczvD1cihHSvIw8xvx4hQg+NFnp\nQKtfigFgFp4EgmM+REut/W+i/4+PhV4TfwDd5XUd6cVZWIy2vt0eIEpNLuFG\nREP4+4DeYmzdMSllkmVM6xiCCFGM4Yn6Rlp/Cey2yZBzK7jRg+3qmMnUtioZ\nBgG0jsXtQCc1K6xpEz3ecYMITm63Uym6XrmOeRO93+rPfD8KnB61hsk94yd+\n4FP4F8wcYeXfk5o/G+p33hh0gbcoquvgHhevorG9+sx5RhdyB43hwYuQthQE\nDRAewZtWJfh0QUudOIUbBAaw63yHd3LsIHCPGViM8+P8ztY2xKVbzNZFGCIa\nXAK+tU1MuvfLBxyx86iwNKS2bBPo/TjotLTMmRjXxeyVugQ+BPdVX8DX2boh\n9HiR\r\n=9YxT\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIHWCI7P0XK4+SZTrRgXN920nUETjGLYLtX4YkpnHbuTsAiAmVUw2g94ntFQsctwC8HBBNHwVGFqVTUsGBseWCOoCCQ=="}]},"_npmUser":{"name":"anxing131","email":"anxing131@gmail.com"},"directories":{},"maintainers":[{"name":"anxing131","email":"anxing131@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/openid-client_4.9.0_1633402657120_0.2527684219911204"},"_hasShrinkwrap":false}},"time":{"created":"2021-10-05T02:57:37.063Z","4.9.0":"2021-10-05T02:57:37.333Z","modified":"2022-04-04T14:26:14.624Z"},"maintainers":[{"name":"anxing131","email":"anxing131@gmail.com"}],"description":"OpenID Connect Relying Party (RP, Client) implementation for Node.js runtime, supports passportjs","homepage":"https://github.com/panva/node-openid-client","keywords":["auth","authentication","basic","certified","client","connect","dynamic","electron","hybrid","identity","implicit","oauth","oauth2","oidc","openid","passport","relying party","strategy"],"repository":{"type":"git","url":"git+https://github.com/panva/node-openid-client.git"},"author":{"name":"Filip Skokan","email":"panva.ip@gmail.com"},"bugs":{"url":"https://github.com/panva/node-openid-client/issues"},"license":"MIT","readme":"# openid-client\n> ⚠️ 此 repo 是为了兼容 casdoor 的 authorization_code 模式而进行的魔改项目.\n> openid-client 并不支持该改动，特此进行小魔改.\n\nopenid-client is a server side [OpenID][openid-connect] Relying Party (RP, Client) implementation for\nNode.js runtime, supports [passport][passport-url].\n\n## Implemented specs & features\n\nThe following client/RP features from OpenID Connect/OAuth2.0 specifications are implemented by\nopenid-client.\n\n- [OpenID Connect Core 1.0][feature-core]\n  - Authorization Callback\n    - Authorization Code Flow\n    - Implicit Flow\n    - Hybrid Flow\n  - UserInfo Request\n  - Fetching Distributed Claims\n  - Unpacking Aggregated Claims\n  - Offline Access / Refresh Token Grant\n  - Client Credentials Grant\n  - Client Authentication\n    - none\n    - client_secret_basic\n    - client_secret_post\n    - client_secret_jwt\n    - private_key_jwt\n  - Consuming Self-Issued OpenID Provider ID Token response\n- [RFC8414 - OAuth 2.0 Authorization Server Metadata][feature-oauth-discovery] and [OpenID Connect Discovery 1.0][feature-discovery]\n  - Discovery of OpenID Provider (Issuer) Metadata\n  - Discovery of OpenID Provider (Issuer) Metadata via user provided inputs (via [webfinger][documentation-webfinger])\n- [OpenID Connect Dynamic Client Registration 1.0][feature-registration]\n  - Dynamic Client Registration request\n  - Client initialization via registration client uri\n- [RFC7009 - OAuth 2.0 Token revocation][feature-revocation]\n  - Client Authenticated request to token revocation\n- [RFC7662 - OAuth 2.0 Token introspection][feature-introspection]\n  - Client Authenticated request to token introspection\n- [RFC8628 - OAuth 2.0 Device Authorization Grant (Device Flow)][feature-device-flow]\n- [RFC8705 - OAuth 2.0 Mutual TLS Client Authentication and Certificate-Bound Access Tokens][feature-mtls]\n  - Mutual TLS Client Certificate-Bound Access Tokens\n  - Metadata for Mutual TLS Endpoint Aliases\n  - Client Authentication\n    - tls_client_auth\n    - self_signed_tls_client_auth\n- [RFC9101 - OAuth 2.0 JWT-Secured Authorization Request (JAR)][feature-jar]\n- [RFC9126 - OAuth 2.0 Pushed Authorization Requests (PAR)][feature-par]\n- [OpenID Connect Session Management 1.0 - draft 28][feature-rp-logout]\n  - RP-Initiated Logout\n- [Financial-grade API - Part 2: Read and Write API Security Profile (FAPI) - ID2][feature-fapi]\n- [JWT Secured Authorization Response Mode for OAuth 2.0 (JARM) - ID1][feature-jarm]\n- [OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) - draft 03][feature-dpop]\n\nUpdates to draft specifications (DPoP, JARM, and FAPI) are released as MINOR library versions,\nif you utilize these specification implementations consider using the tilde `~` operator in your\npackage.json since breaking changes may be introduced as part of these version updates. \n\n## Certification\n[<img width=\"184\" height=\"96\" align=\"right\" src=\"https://cdn.jsdelivr.net/gh/panva/node-openid-client@38cf016b0837e6d4116de3780b28d222d5780bc9/OpenID_Certified.png\" alt=\"OpenID Certification\">][openid-certified-link]  \nFilip Skokan has [certified][openid-certified-link] that [openid-client][npm-url]\nconforms to the following profiles of the OpenID Connect™ protocol\n\n- RP Basic, Implicit, Hybrid, Config, Dynamic, and Form Post\n- RP FAPI R/W MTLS and Private Key\n\n\n## Sponsor\n\n[<img width=\"65\" height=\"65\" align=\"left\" src=\"https://avatars.githubusercontent.com/u/2824157?s=75&v=4\" alt=\"auth0-logo\">][sponsor-auth0] If you want to quickly add OpenID Connect authentication to Node.js apps, feel free to check out Auth0's Node.js SDK and free plan at [auth0.com/developers][sponsor-auth0].<br><br>\n\n## Support\n\nIf you or your business use openid-client, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree.\n\n\n## Documentation\n\nThe library exposes what are essentially steps necessary to be done by a relying party consuming\nOpenID Connect Authorization Server responses or wrappers around requests to its endpoints. Aside\nfrom a generic OpenID Connect [passport][passport-url] strategy it does not expose neither express\nor koa middlewares. Those can however be built using the exposed API.\n\n- [openid-client API Documentation][documentation]\n  - [Issuer][documentation-issuer]\n  - [Client][documentation-client]\n  - [Customizing][documentation-customizing]\n  - [TokenSet][documentation-tokenset]\n  - [Strategy][documentation-strategy]\n  - [generators][documentation-generators]\n  - [errors][documentation-errors]\n\n## Install\n\nNode.js version **>=12.0.0** is recommended, but **^10.19.0** lts/dubnium is also supported.\n\n```console\nnpm install openid-client\n```\n\n## Quick start\n\nDiscover an Issuer configuration using its published .well-known endpoints\n```js\nconst { Issuer } = require('openid-client');\nIssuer.discover('https://accounts.google.com') // => Promise\n  .then(function (googleIssuer) {\n    console.log('Discovered issuer %s %O', googleIssuer.issuer, googleIssuer.metadata);\n  });\n```\n\n### Authorization Code Flow\n\nAuthorization Code flow is for obtaining Access Tokens (and optionally Refresh Tokens) to use with\nthird party APIs securely as well as Refresh Tokens. In this quick start your application also uses\nPKCE instead of `state` parameter for CSRF protection.\n\nCreate a Client instance for that issuer's authorization server intended for Authorization Code\nflow.\n\n**See the [documentation][documentation] for full API details.**\n\n```js\nconst client = new googleIssuer.Client({\n  client_id: 'zELcpfANLqY7Oqas',\n  client_secret: 'TQV5U29k1gHibH5bx1layBo0OSAvAbRT3UYW3EWrSYBB5swxjVfWUa1BS8lqzxG/0v9wruMcrGadany3',\n  redirect_uris: ['http://localhost:3000/cb'],\n  response_types: ['code'],\n  // id_token_signed_response_alg (default \"RS256\")\n  // token_endpoint_auth_method (default \"client_secret_basic\")\n}); // => Client\n```\n\nWhen you want to have your end-users authorize you need to send them to the issuer's\n`authorization_endpoint`. Consult the web framework of your choice on how to redirect but here's how\nto get the authorization endpoint's URL with parameters already encoded in the query to redirect\nto.\n\n```js\nconst { generators } = require('openid-client');\nconst code_verifier = generators.codeVerifier();\n// store the code_verifier in your framework's session mechanism, if it is a cookie based solution\n// it should be httpOnly (not readable by javascript) and encrypted.\n\nconst code_challenge = generators.codeChallenge(code_verifier);\n\nclient.authorizationUrl({\n  scope: 'openid email profile',\n  resource: 'https://my.api.example.com/resource/32178',\n  code_challenge,\n  code_challenge_method: 'S256',\n});\n```\n\nWhen end-users are redirected back to your `redirect_uri` your application consumes the callback and\npasses in the `code_verifier` to include it in the authorization code grant token exchange.\n```js\nconst params = client.callbackParams(req);\nclient.callback('https://client.example.com/callback', params, { code_verifier }) // => Promise\n  .then(function (tokenSet) {\n    console.log('received and validated tokens %j', tokenSet);\n    console.log('validated ID Token claims %j', tokenSet.claims());\n  });\n```\n\nYou can then call the `userinfo_endpoint`.\n```js\nclient.userinfo(access_token) // => Promise\n  .then(function (userinfo) {\n    console.log('userinfo %j', userinfo);\n  });\n```\n\nAnd later refresh the tokenSet if it had a `refresh_token`.\n```js\nclient.refresh(refresh_token) // => Promise\n  .then(function (tokenSet) {\n    console.log('refreshed and validated tokens %j', tokenSet);\n    console.log('refreshed ID Token claims %j', tokenSet.claims());\n  });\n```\n\n### Implicit ID Token Flow\n\nImplicit `response_type=id_token` flow is perfect for simply authenticating your end-users, assuming\nthe only job you want done is authenticating the user and then relying on your own session mechanism\nwith no need for accessing any third party APIs with an Access Token from the Authorization Server.\n\nCreate a Client instance for that issuer's authorization server intended for ID Token implicit flow.\n\n**See the [documentation][documentation] for full API details.**\n```js\nconst client = new googleIssuer.Client({\n  client_id: 'zELcpfANLqY7Oqas',\n  redirect_uris: ['http://localhost:3000/cb'],\n  response_types: ['id_token'],\n  // id_token_signed_response_alg (default \"RS256\")\n}); // => Client\n```\n\nWhen you want to have your end-users authorize you need to send them to the issuer's\n`authorization_endpoint`. Consult the web framework of your choice on how to redirect but here's how\nto get the authorization endpoint's URL with parameters already encoded in the query to redirect\nto.\n\n```js\nconst { generators } = require('openid-client');\nconst nonce = generators.nonce();\n// store the nonce in your framework's session mechanism, if it is a cookie based solution\n// it should be httpOnly (not readable by javascript) and encrypted.\n\nclient.authorizationUrl({\n  scope: 'openid email profile',\n  response_mode: 'form_post',\n  nonce,\n});\n```\n\nWhen end-users hit back your `redirect_uri` with a POST (authorization request included `form_post`\nresponse mode) your application consumes the callback and passes the `nonce` in to include it in the\nID Token verification steps.\n```js\n// assumes req.body is populated from your web framework's body parser\nconst params = client.callbackParams(req);\nclient.callback('https://client.example.com/callback', params, { nonce }) // => Promise\n  .then(function (tokenSet) {\n    console.log('received and validated tokens %j', tokenSet);\n    console.log('validated ID Token claims %j', tokenSet.claims());\n  });\n```\n\n### Device Authorization Grant (Device Flow)\n\n[RFC8628 - OAuth 2.0 Device Authorization Grant (Device Flow)](https://tools.ietf.org/html/rfc8628)\nis started by starting a Device Authorization Request.\n\n```js\nconst handle = await client.deviceAuthorization();\nconsole.log('User Code: ', handle.user_code);\nconsole.log('Verification URI: ', handle.verification_uri);\nconsole.log('Verification URI (complete): ', handle.verification_uri_complete);\n```\n\nThe handle represents a Device Authorization Response with the `verification_uri`, `user_code` and\nother defined response properties.\n\nYou will display the instructions to the end-user and have him directed at `verification_uri` or\n`verification_uri_complete`, afterwards you can start polling for the Device Access Token Response.\n```js\nconst tokenSet = await handle.poll();\nconsole.log('received tokens %j', tokenSet);\n```\n\nThis will poll in the defined interval and only resolve with a TokenSet once one is received. This\nwill handle the defined `authorization_pending` and `slow_down` \"soft\" errors and continue polling\nbut upon any other error it will reject. With tokenSet received you can throw away the handle.\n\n## Electron Support\n\nElectron >=v6.0.0 runtime is supported to the extent of the crypto engine BoringSSL feature parity\nwith standard Node.js OpenSSL.\n\n## FAQ\n\n#### Semver?\n\n**Yes.** Everything that's either exported in the TypeScript definitions file or\n[documented][documentation] is subject to\n[Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html). The rest is to be considered\nprivate API and is subject to change between any versions.\n\n#### How do I use it outside of Node.js\n\nIt is **only built for ^10.19.0 || >=12.0.0 Node.js** environment - including openid-client in\nbrowser-environment targeted projects is not supported and may result in unexpected results.\n\n#### How to make the client send client_id and client_secret in the body?\n\nSee [Client Authentication Methods (docs)][documentation-methods].\n\n#### Can I adjust the HTTP timeout?\n\nSee [Customizing (docs)](https://github.com/panva/node-openid-client/blob/master/docs/README.md#customizing).\n\n#### How can I debug the requests and responses?\n\nSee [Customizing (docs)](https://github.com/panva/node-openid-client/blob/master/docs/README.md#customizing).\n\n\n[openid-connect]: https://openid.net/connect/\n[feature-core]: https://openid.net/specs/openid-connect-core-1_0.html\n[feature-discovery]: https://openid.net/specs/openid-connect-discovery-1_0.html\n[feature-oauth-discovery]: https://tools.ietf.org/html/rfc8414\n[feature-registration]: https://openid.net/specs/openid-connect-registration-1_0.html\n[feature-revocation]: https://tools.ietf.org/html/rfc7009\n[feature-introspection]: https://tools.ietf.org/html/rfc7662\n[feature-mtls]: https://tools.ietf.org/html/rfc8705\n[feature-device-flow]: https://tools.ietf.org/html/rfc8628\n[feature-rp-logout]: https://openid.net/specs/openid-connect-session-1_0.html#RPLogout\n[feature-jarm]: https://openid.net/specs/openid-financial-api-jarm-ID1.html\n[feature-fapi]: https://openid.net/specs/openid-financial-api-part-2-ID2.html\n[feature-dpop]: https://tools.ietf.org/html/draft-ietf-oauth-dpop-03\n[feature-par]: https://www.rfc-editor.org/rfc/rfc9126.html\n[feature-jar]: https://www.rfc-editor.org/rfc/rfc9101.html\n[openid-certified-link]: https://openid.net/certification/\n[passport-url]: http://passportjs.org\n[npm-url]: https://www.npmjs.com/package/openid-client\n[sponsor-auth0]: https://auth0.com/developers?utm_source=GHsponsor&utm_medium=GHsponsor&utm_campaign=openid-client&utm_content=auth\n[support-sponsor]: https://github.com/sponsors/panva\n[documentation]: https://github.com/panva/node-openid-client/blob/master/docs/README.md\n[documentation-issuer]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#issuer\n[documentation-client]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#client\n[documentation-customizing]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#customizing\n[documentation-tokenset]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#tokenset\n[documentation-strategy]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#strategy\n[documentation-errors]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#errors\n[documentation-generators]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#generators\n[documentation-methods]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#client-authentication-methods\n[documentation-webfinger]: https://github.com/panva/node-openid-client/blob/master/docs/README.md#issuerwebfingerinput\n","readmeFilename":"README.md"}