* Handle when `aud` OIDC claim is an Array
The `aud` claim of OIDC id_tokens [can be an array](ce6d694639/src/Claims.ts (L92)) but the existing logic
incorrectly assumes `aud` is always a string.
This PR adds the necessary check.
* Clarify `aud` OIDC claim check
* Fix for prettier
---------
Co-authored-by: David Baker <dbkr@users.noreply.github.com>
* Update dependency oidc-client-ts to v3
* Update jwt-decode so that oidc-client-ts doesn't run its own and thus we can mock
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
* Merge
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
* delint
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
* Sort package.json
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
* Ensure oidc-client-ts 3.0.1 to drop crypto-js
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
---------
Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Michael Telatynski <7t3chguy@gmail.com>
* use oidc-client-ts during oidc discovery
* export new type for auth config
* deprecate generateAuthorizationUrl in favour of generateOidcAuthorizationUrl
* testing util for oidc configurations
* test generateOidcAuthorizationUrl
* lint
* test discovery
* dont pass whole client wellknown to oidc validation funcs
* add nonce
* use oidc-client-ts for oidc response
* validate user state and update tests
* use oidc-client-ts for code exchange
* use oidc-client-ts in completing auth grant
* use client userState for homeserver
* more comments
* use oidc-client-ts during oidc discovery
* export new type for auth config
* deprecate generateAuthorizationUrl in favour of generateOidcAuthorizationUrl
* testing util for oidc configurations
* test generateOidcAuthorizationUrl
* lint
* test discovery
* dont pass whole client wellknown to oidc validation funcs
* add nonce
* use client userState for homeserver
* validate m.authentication, fetch issuer wellknown
* move validation functions into separate file
* test validateWellKnownAuthentication
* test validateOIDCIssuerWellKnown
* add authentication cases to autodiscovery tests
* test invalid authentication config on wk
* improve types
* test case for account:false
* use hasOwnProperty in validateWellKnownAuthentication
* comments
* make registration_endpoint optional
