/**

* Local dependencies

*/

const { JWT } = require('@solid/jose')

const { hashClaim, random } = require('./crypto')

const DEFAULT_MAX_AGE = 1209600 // Default ID token expiration, in seconds

const DEFAULT_SIG_ALGORITHM = 'RS256'

/**

* DpopIDToken

*/

class DpopIDToken extends JWT {

/**

* issue

*

* @param provider {Provider} OIDC Identity Provider issuing the token

* @param provider.issuer {string} Provider URI

* @param provider.keys {KeyChain}

*

* @param options {Object}

* @param options.aud {string|Array<string>} Audience for the token

* (such as the Relying Party client_id)

* @param options.azp {string} Authorized party / Presenter (RP client_id)

* @param options.sub {string} Subject id for the token (opaque, unique to

* the issuer)

* @param options.nonce {string} Nonce generated by Relying Party

*

* Optional:

* @param [options.alg] {string} Algorithm for signing the id token

* @param [options.jti] {string} Unique JWT id (to prevent reuse)

* @param [options.iat] {number} Issued at timestamp (in seconds)

* @param [options.max] {number} Max token lifetime in seconds

* @param [options.at_hash] {string} Access Token Hash

* @param [options.c_hash] {string} Code hash

* @param [options.cnf] {Object} Proof of Possession confirmation key, see

* https://tools.ietf.org/html/rfc7800#section-3.1

*

* @returns {DpopIDToken} ID Token (JWT instance)

*/

static issue (provider, options) {

let { issuer, keys } = provider

let { aud, azp, sub, at_hash, c_hash, cnf, scope } = options

// If audience is an array and azp wasn't provided, default azp to the

// first audience entry so DPoP ID tokens include azp when `aud` is an array.

if (Array.isArray(aud) && !azp) {

azp = aud[0]

}

let alg = options.alg || DEFAULT_SIG_ALGORITHM

let jti = options.jti || random(8)

let iat = options.iat || Math.floor(Date.now() / 1000)

let max = options.max || DEFAULT_MAX_AGE

let exp = iat + max // token expiration

let iss = issuer

let key = keys['id_token'].signing[alg].privateKey

let kid = keys['id_token'].signing[alg].publicJwk.kid

let header = { alg, kid }

let payload = { iss, aud, azp, sub, exp, iat, jti }

// Ensure azp is in payload when aud is an array (required by OIDC spec)

if (Array.isArray(aud) && !payload.azp) {

payload.azp = aud[0]

}

// Add webid claim for Solid OIDC compliance when webid scope is requested

if (sub && scope && (scope.includes('webid') || scope.split(' ').includes('webid'))) {

payload.webid = sub

}

if (at_hash) { payload.at_hash = at_hash }

if (c_hash) { payload.c_hash = c_hash }

if (cnf) { payload.cnf = cnf }

let jwt = new DpopIDToken({ header, payload, key })

return jwt

}

/**

* issueForRequest

*/

static issueForRequest (request, response) {

// TODO: Implement id_vc

let {params, code, provider, client, subject} = request

let alg = client['id_token_signed_response_alg'] || DEFAULT_SIG_ALGORITHM

let jti = random(8)

let iat = Math.floor(Date.now() / 1000)

let aud, azp, sub, max, scope

// authentication request

if (!code) {

aud = [client['client_id'], 'solid']

azp = client['client_id']

// Use WebID URL for sub if available (Solid OIDC compliance), otherwise use database ID

sub = subject?.webId || subject['_id']

max = parseInt(params['max_age']) || client['default_max_age'] || DEFAULT_MAX_AGE

scope = params.scope // Get the requested scope

// token request

} else {

// Ensure aud is array containing both client_id and 'solid'

if (Array.isArray(code.aud) && code.aud.includes('solid')) {

aud = code.aud

} else {

aud = [code.aud, 'solid']

}

azp = code.azp || (Array.isArray(aud) ? aud[0] : aud)

sub = code.sub

max = parseInt(code['max']) || client['default_max_age'] || DEFAULT_MAX_AGE

scope = code.scope // Get the scope from authorization code

}

let len = alg.match(/(256|384|512)$/)[0]

// generate hashes

return Promise.all([

hashClaim(response['access_token'], len),

hashClaim(response['code'], len)

])

// build the id_token

.then(hashes => {

let [at_hash, c_hash] = hashes

let options = { alg, aud, azp, sub, iat, jti, at_hash, c_hash, scope }

if (request.cnfKey) {

options.cnf = { jwk: request.cnfKey }

}

return DpopIDToken.issue(provider, options)

})

// sign id token

.then(jwt => jwt.encode())

// add to response

.then(compact => {

response['id_token'] = compact

})

// resolve the response

.then(() => response)

}

}

DpopIDToken.DEFAULT_MAX_AGE = DEFAULT_MAX_AGE

DpopIDToken.DEFAULT_SIG_ALGORITHM = DEFAULT_SIG_ALGORITHM

/**

* Export

*/

module.exports = DpopIDToken