rewrote the scope validation

Author: jorenvandeweyer

CHANGELOG.md

@@ -8,6 +8,7 @@
 - this is a breaking change, because **it removes callback support** for
   `OAuthServer` and your model implementation.
 - fixed missing await in calling generateAuthorizationCode in AuthorizeHandler
+- validate scope as an array of strings
 
 ## 4.2.0
 ### Fixed
@@ -52,7 +53,7 @@
 - Upgrades all code from ES5 to ES6, where possible.
 
 ## 4.1.0
-### Changed 
+### Changed
 * Bump dev dependencies to resolve vulnerabilities
 * Replaced jshint with eslint along with should and chai
 * Use sha256 when generating tokens

docs/api/oauth2-server.rst

@@ -73,7 +73,7 @@ Authenticates a request.
 +------------------------------------------------+-----------------+-----------------------------------------------------------------------+
 | [options={}]                                   | Object          | Handler options.                                                      |
 +------------------------------------------------+-----------------+-----------------------------------------------------------------------+
-| [options.scope=undefined]                      | String          | The scope(s) to authenticate.                                         |
+| [options.scope=undefined]                      | String[]        | The scope(s) to authenticate.                                         |
 +------------------------------------------------+-----------------+-----------------------------------------------------------------------+
 | [options.addAcceptedScopesHeader=true]         | Boolean         | Set the ``X-Accepted-OAuth-Scopes`` HTTP header on response objects.  |
 +------------------------------------------------+-----------------+-----------------------------------------------------------------------+

docs/model/spec.rst

@@ -118,13 +118,13 @@ declare namespace OAuth2Server {
          * Generate access token. Calls Model#generateAccessToken() if implemented.
          *
          */
-        generateAccessToken(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateAccessToken(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Generate refresh token. Calls Model#generateRefreshToken() if implemented.
          *
          */
-        generateRefreshToken(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateRefreshToken(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Get access token expiration date.
@@ -142,13 +142,13 @@ declare namespace OAuth2Server {
          * Get scope from the request body.
          *
          */
-        getScope(request: Request): string;
+        getScope(request: Request): string[];
 
         /**
          * Validate requested scope. Calls Model#validateScope() if implemented.
          *
          */
-        validateScope(user: User, client: Client, scope: string | string[]): Promise<string | string[] | Falsey>;
+        validateScope(user: User, client: Client, scope: string[]): Promise<string[] | Falsey>;
 
         /**
          * Retrieve info from the request and client and return token
@@ -168,7 +168,7 @@ declare namespace OAuth2Server {
         /**
          * The scope(s) to authenticate.
          */
-        scope?: string | string[] | undefined;
+        scope?: string[] | undefined;
 
         /**
          * Set the X-Accepted-OAuth-Scopes HTTP header on response objects.
@@ -245,7 +245,7 @@ declare namespace OAuth2Server {
          * Invoked to generate a new access token.
          *
          */
-        generateAccessToken?(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateAccessToken?(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Invoked to retrieve a client using a client id or a client id/client secret combination, depending on the grant type.
@@ -272,21 +272,21 @@ declare namespace OAuth2Server {
          * Optional, if a custom authenticateHandler is used or if there is no scope part of the request.
          *
          */
-        verifyScope(token: Token, scope: string | string[]): Promise<boolean>;
+        verifyScope?(token: Token, scope: string[]): Promise<boolean>;
     }
 
     interface AuthorizationCodeModel extends BaseModel, RequestAuthenticationModel {
         /**
          * Invoked to generate a new refresh token.
          *
          */
-        generateRefreshToken?(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateRefreshToken?(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Invoked to generate a new authorization code.
          *
          */
-        generateAuthorizationCode?(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateAuthorizationCode?(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Invoked to retrieve an existing authorization code previously saved through Model#saveAuthorizationCode().
@@ -314,8 +314,8 @@ declare namespace OAuth2Server {
          * Invoked to check if the requested scope is valid for a particular client/user combination.
          *
          */
-        validateScope?(user: User, client: Client, scope: string | string[]): Promise<string | string[] | Falsey>;
-        
+        validateScope?(user: User, client: Client, scope: string[]): Promise<string[] | Falsey>;
+
         /**
          * Invoked to check if the provided `redirectUri` is valid for a particular `client`.
          *
@@ -328,7 +328,7 @@ declare namespace OAuth2Server {
          * Invoked to generate a new refresh token.
          *
          */
-        generateRefreshToken?(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateRefreshToken?(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Invoked to retrieve a user using a username/password combination.
@@ -340,15 +340,15 @@ declare namespace OAuth2Server {
          * Invoked to check if the requested scope is valid for a particular client/user combination.
          *
          */
-        validateScope?(user: User, client: Client, scope: string | string[]): Promise<string | string[] | Falsey>;
+        validateScope?(user: User, client: Client, scope: string[]): Promise<string[] | Falsey>;
     }
 
     interface RefreshTokenModel extends BaseModel, RequestAuthenticationModel {
         /**
          * Invoked to generate a new refresh token.
          *
          */
-        generateRefreshToken?(client: Client, user: User, scope: string | string[]): Promise<string>;
+        generateRefreshToken?(client: Client, user: User, scope: string[]): Promise<string>;
 
         /**
          * Invoked to retrieve an existing refresh token previously saved through Model#saveToken().
@@ -374,7 +374,7 @@ declare namespace OAuth2Server {
          * Invoked to check if the requested scope is valid for a particular client/user combination.
          *
          */
-        validateScope?(user: User, client: Client, scope: string | string[]): Promise<string | string[] | Falsey>;
+        validateScope?(user: User, client: Client, scope: string[]): Promise<string[] | Falsey>;
     }
 
     interface ExtensionModel extends BaseModel, RequestAuthenticationModel {}
@@ -406,7 +406,7 @@ declare namespace OAuth2Server {
         authorizationCode: string;
         expiresAt: Date;
         redirectUri: string;
-        scope?: string | string[] | undefined;
+        scope?: string[] | undefined;
         client: Client;
         user: User;
         codeChallenge?: string;
@@ -422,7 +422,7 @@ declare namespace OAuth2Server {
         accessTokenExpiresAt?: Date | undefined;
         refreshToken?: string | undefined;
         refreshTokenExpiresAt?: Date | undefined;
-        scope?: string | string[] | undefined;
+        scope?: string[] | undefined;
         client: Client;
         user: User;
         [key: string]: any;
@@ -434,7 +434,7 @@ declare namespace OAuth2Server {
     interface RefreshToken {
         refreshToken: string;
         refreshTokenExpiresAt?: Date | undefined;
-        scope?: string | string[] | undefined;
+        scope?: string[] | undefined;
         client: Client;
         user: User;
         [key: string]: any;

index.d.ts

@@ -6,8 +6,8 @@
 
 const InvalidArgumentError = require('../errors/invalid-argument-error');
 const InvalidScopeError = require('../errors/invalid-scope-error');
-const isFormat = require('@node-oauth/formats');
 const tokenUtil = require('../utils/token-util');
+const { parseScope } = require('../utils/scope-util');
 
 class AbstractGrantType {
   constructor (options) {
@@ -73,11 +73,7 @@ class AbstractGrantType {
    * Get scope from the request body.
    */
   getScope (request) {
-    if (!isFormat.nqschar(request.body.scope)) {
-      throw new InvalidArgumentError('Invalid parameter: `scope`');
-    }
-
-    return request.body.scope;
+    return parseScope(request.body.scope);
   }
 
   /**

lib/grant-types/abstract-grant-type.js

@@ -10,6 +10,7 @@ const InvalidGrantError = require('../errors/invalid-grant-error');
 const InvalidRequestError = require('../errors/invalid-request-error');
 const ServerError = require('../errors/server-error');
 const isFormat = require('@node-oauth/formats');
+const InvalidScopeError = require('../errors/invalid-scope-error');
 
 /**
  * Constructor.
@@ -55,7 +56,9 @@ class RefreshTokenGrantType extends AbstractGrantType {
     token = await this.getRefreshToken(request, client);
     token = await this.revokeToken(token);
 
-    return this.saveToken(token.user, client, token.scope);
+    const scope = this.getScope(request, token);
+
+    return this.saveToken(token.user, client, scope);
   }
 
   /**
@@ -142,6 +145,33 @@ class RefreshTokenGrantType extends AbstractGrantType {
 
     return this.model.saveToken(token, client, user);
   }
+
+  getScope (request, token) {
+    const requestedScope = super.getScope(request);
+    const originalScope = token.scope;
+
+    if (!originalScope && !requestedScope) {
+      return;
+    }
+
+    if (!originalScope && requestedScope) {
+      throw new InvalidScopeError('Invalid scope: Unable to add extra scopes');
+    }
+
+    if (!requestedScope) {
+      return originalScope;
+    }
+
+    const valid = requestedScope.every(scope => {
+      return originalScope.includes(scope);
+    });
+
+    if (!valid) {
+      throw new InvalidScopeError('Invalid scope: Unable to add extra scopes');
+    }
+
+    return requestedScope;
+  }
 }
 
 /**

lib/grant-types/refresh-token-grant-type.js

@@ -235,21 +235,23 @@ class AuthenticateHandler {
     if (!scope) {
       throw new InsufficientScopeError('Insufficient scope: authorized scope is insufficient');
     }
-
-    return scope;
   }
 
   /**
    * Update response.
    */
 
   updateResponse (response, accessToken) {
+    if (accessToken.scope == null) {
+      return;
+    }
+
     if (this.scope && this.addAcceptedScopesHeader) {
-      response.set('X-Accepted-OAuth-Scopes', this.scope);
+      response.set('X-Accepted-OAuth-Scopes', this.scope.join(' '));
     }
 
     if (this.scope && this.addAuthorizedScopesHeader) {
-      response.set('X-OAuth-Scopes', accessToken.scope);
+      response.set('X-OAuth-Scopes', accessToken.scope.join(' '));
     }
   }
 }

lib/handlers/authenticate-handler.js

@@ -20,6 +20,7 @@ const isFormat = require('@node-oauth/formats');
 const tokenUtil = require('../utils/token-util');
 const url = require('url');
 const pkce = require('../pkce/pkce');
+const { parseScope } = require('../utils/scope-util');
 
 /**
  * Response types.
@@ -226,11 +227,7 @@ class  AuthorizeHandler {
   getScope (request) {
     const scope = request.body.scope || request.query.scope;
 
-    if (!isFormat.nqschar(scope)) {
-      throw new InvalidScopeError('Invalid parameter: `scope`');
-    }
-
-    return scope;
+    return parseScope(scope);
   }
 
   /**

lib/handlers/authorize-handler.js

@@ -30,10 +30,6 @@ class OAuth2Server {
  */
 
   authenticate (request, response, options) {
-    if (typeof options === 'string') {
-      options = {scope: options};
-    }
-
     options = Object.assign({
       addAcceptedScopesHeader: true,
       addAuthorizedScopesHeader: true,

lib/server.js

@@ -0,0 +1,16 @@
+const isFormat = require('@node-oauth/formats');
+const InvalidScopeError = require('../errors/invalid-scope-error');
+
+module.exports = {
+  parseScope: function (requestedScope) {
+    if (!isFormat.nqschar(requestedScope)) {
+      throw new InvalidScopeError('Invalid parameter: `scope`');
+    }
+
+    if (requestedScope == null) {
+      return undefined;
+    }
+
+    return requestedScope.split(' ');
+  }
+};