oidc-client 0.5.1.0 → 0.6.0.0

raw patch · 8 files changed

+29/−13 lines, 8 filesPVP ok

version bump matches the API change (PVP)

API changes (from Hackage documentation)

Files

• CHANGELOG.md +10/−0
• README.md +1/−1
• oidc-client.cabal +1/−1
• src/Web/OIDC/Client/CodeFlow.hs +5/−3
• src/Web/OIDC/Client/Discovery.hs +1/−0
• src/Web/OIDC/Client/IdTokenFlow.hs +3/−2
• src/Web/OIDC/Client/Tokens.hs +4/−2
• src/Web/OIDC/Client/Types.hs +4/−4

@@ -1,5 +1,15 @@ # ChangeLog +## [0.6.0.0]+### Added+- Preserve the raw JWT in the tokens record returned by `validate` ([#43](https://github.com/krdlab/haskell-oidc-client/pull/43))++### Fixed+- s/JwtExceptoin/JwtException/ ([#45](https://github.com/krdlab/haskell-oidc-client/pull/45))+- import data.monoid ([#46](https://github.com/krdlab/haskell-oidc-client/pull/46))+- s/Incosistent/Inconsistent/ ([#49](https://github.com/krdlab/haskell-oidc-client/pull/49))+- Use lenient decoding ([#50](https://github.com/krdlab/haskell-oidc-client/pull/50))+ ## [0.5.1.0] ### Fixed - fix: generate correct discovery url ([#39](https://github.com/krdlab/haskell-oidc-client/pull/39))

@@ -1,6 +1,6 @@ # OpenID Connect 1.0 library for Relying Party -[![Circle CI](https://circleci.com/gh/krdlab/haskell-oidc-client.svg?style=svg)](https://circleci.com/gh/krdlab/haskell-oidc-client)+[![Testing](https://github.com/krdlab/haskell-oidc-client/workflows/Testing/badge.svg)](https://github.com/krdlab/haskell-oidc-client/actions?query=workflow%3ATesting)  This package supports implementing of an OpenID Connect 1.0 Relying Party. It's written in Haskell. 

@@ -1,5 +1,5 @@ name:               oidc-client-version:            0.5.1.0+version:            0.6.0.0 synopsis:           OpenID Connect 1.0 library for RP homepage:           https://github.com/krdlab/haskell-oidc-client stability:          experimental

@@ -26,7 +26,8 @@ import           Data.Maybe                         (isNothing) import           Data.Monoid                        ((<>)) import           Data.Text                          (Text, pack, unpack)-import           Data.Text.Encoding                 (decodeUtf8)+import           Data.Text.Encoding                 (decodeUtf8With)+import           Data.Text.Encoding.Error           (lenientDecode) import           Data.Time.Clock.POSIX              (getPOSIXTime) import qualified Jose.Jwt                           as Jwt import           Network.HTTP.Client                (Manager, Request (..),@@ -82,7 +83,7 @@           result <- liftIO $ requestTokens oidc savedNonce code mgr           sessionStoreDelete store           return result-      else throwM $ ValidationException $ "Incosistent state: " <> decodeUtf8 stateFromIdP+      else throwM $ ValidationException $ "Inconsistent state: " <> decodeUtf8With lenientDecode stateFromIdP  -- | Make URL for Authorization Request. {-# WARNING getAuthenticationRequestUrl "This function doesn't manage state and nonce. Use prepareAuthenticationRequestUrl only unless your IdP doesn't support state and/or nonce." #-}@@ -150,7 +151,7 @@     now <- getCurrentIntDate     validateClaims         (P.issuer . P.configuration . oidcProvider $ oidc)-        (decodeUtf8 . oidcClientId $ oidc)+        (decodeUtf8With lenientDecode . oidcClientId $ oidc)         now         savedNonce         claims'@@ -158,6 +159,7 @@           accessToken  = I.accessToken tres         , tokenType    = I.tokenType tres         , idToken      = claims'+        , idTokenJwt   = jwt'         , expiresIn    = I.expiresIn tres         , refreshToken = I.refreshToken tres         }

@@ -22,6 +22,7 @@ import           Control.Monad.Catch                (catch, throwM) import           Data.Aeson                         (eitherDecode) import           Data.ByteString                    (append, isSuffixOf)+import           Data.Monoid                        ((<>)) import           Data.Text                          (pack) import qualified Jose.Jwk                           as Jwk import           Network.HTTP.Client                (Manager, Request, httpLbs,

@@ -20,7 +20,8 @@ import           Data.Maybe                         (isNothing, fromMaybe) import           Data.Monoid                        ((<>)) import           Data.Text                          (unpack)-import           Data.Text.Encoding                 (decodeUtf8)+import           Data.Text.Encoding                 (decodeUtf8With)+import           Data.Text.Encoding.Error           (lenientDecode) import qualified Jose.Jwt                           as Jwt import           Network.HTTP.Client                (getUri, setQueryString) import           Network.URI                        (URI)@@ -72,7 +73,7 @@                 $ throwIO                 $ ValidationException "Nonce does not match request."           pure idToken-      else liftIO $ throwIO $ ValidationException $ "Incosistent state: " <> decodeUtf8 stateFromIdP+      else liftIO $ throwIO $ ValidationException $ "Inconsistent state: " <> decodeUtf8With lenientDecode stateFromIdP  -- | Make URL for Authorization Request. {-# WARNING getAuthenticationRequestUrl "This function doesn't manage state and nonce. Use prepareAuthenticationRequestUrl only unless your IdP doesn't support state and/or nonce." #-}

@@ -1,6 +1,6 @@ {-# LANGUAGE DeriveGeneric     #-}+{-# LANGUAGE LambdaCase        #-} {-# LANGUAGE OverloadedStrings #-}-{-# LANGUAGE LambdaCase #-}  {-|     Module: Web.OIDC.Client.Tokens@@ -24,6 +24,7 @@ import           Data.ByteString                    (ByteString) import qualified Data.ByteString.Lazy.Char8         as BL import           Data.Either                        (partitionEithers)+import           Data.Monoid                        ((<>)) import           Data.Text                          (Text, pack) import           Data.Text.Encoding                 (encodeUtf8) import           GHC.Generics                       (Generic)@@ -38,6 +39,7 @@     { accessToken  :: Text     , tokenType    :: Text     , idToken      :: IdTokenClaims a+    , idTokenJwt   :: Jwt     , expiresIn    :: Maybe Integer     , refreshToken :: Maybe Text     }@@ -83,7 +85,7 @@         Right (Unsecured payload) -> liftIO . throwIO $ UnsecuredJwt payload         Right (Jws (_header, payload)) -> parsePayload payload         Right (Jwe (_header, payload)) -> parsePayload payload-        Left err -> liftIO . throwIO $ JwtExceptoin err+        Left err -> liftIO . throwIO $ JwtException err   where     tryDecode jwks token = \case         P.JwsAlgJson  alg -> liftIO $ Jwt.decode jwks (Just $ Jwt.JwsEncoding alg) token

@@ -53,7 +53,7 @@     | InternalHttpException HttpException     | JsonException Text     | UnsecuredJwt ByteString-    | JwtExceptoin JwtError+    | JwtException JwtError     | ValidationException Text   deriving (Show, Typeable) @@ -64,8 +64,8 @@ data SessionStore m = SessionStore     { sessionStoreGenerate :: m ByteString     -- ^ Generate state and nonce at random-    , sessionStoreSave :: State -> Nonce -> m ()-    , sessionStoreGet :: m (Maybe State, Maybe Nonce)-    , sessionStoreDelete :: m ()+    , sessionStoreSave     :: State -> Nonce -> m ()+    , sessionStoreGet      :: m (Maybe State, Maybe Nonce)+    , sessionStoreDelete   :: m ()     -- ^ Should delete at least nonce     }