update for openid-client 3.x

.gitignore

@@ -29,6 +29,7 @@ build/Release
 # Dependency directoryand lockfiles
 node_modules
 yarn.lock
+package-lock.json
 npm-shrinkwrap.json
 
 # Optional npm cache directory

.nvmrc

@@ -1 +1 @@
-lts/carbon
+stable

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openid-client-conformance-tests",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "node's openid-client library conformance tests",
   "scripts": {
     "test": "mocha",
@@ -12,31 +12,29 @@
     "id_token+token-implicit": "mocha --fgrep @id_token+token-implicit",
     "code+id_token-hybrid": "mocha --fgrep @code+id_token-hybrid",
     "code+token-hybrid": "mocha --fgrep @code+token-hybrid",
-    "code+id_token+token-hybrid": "mocha --fgrep @code+id_token+token-hybrid",
-    "coverage": "istanbul cover --root node_modules/openid-client _mocha"
+    "code+id_token+token-hybrid": "mocha --fgrep @code+id_token+token-hybrid"
   },
   "repository": "panva/openid-client-conformance-tests",
   "engines": {
-    "node": ">=7.6.0"
+    "node": ">=12.0.0"
   },
   "homepage": "https://github.com/panva/openid-client-conformance-tests",
   "author": "Filip Skokan",
   "license": "MIT",
   "dependencies": {
-    "base64url": "^2.0.0",
-    "fs-extra": "^1.0.0",
+    "base64url": "^3.0.1",
+    "fs-extra": "^7.0.1",
     "got": "^9.6.0",
     "lodash": "^4.17.11",
-    "mocha": "^3.1.2",
-    "nock": "^9.6.1",
-    "openid-client": "^2.0.0",
-    "tar": "^2.2.1",
-    "timekeeper": "^1.0.0"
+    "mocha": "^6.1.4",
+    "nock": "^11.0.0-beta.14",
+    "openid-client": "^3.0.0",
+    "tar": "^4.4.8",
+    "timekeeper": "^2.2.0"
   },
   "devDependencies": {
-    "eslint": "^3.9.1",
-    "eslint-config-airbnb-base": "^10.0.0",
-    "eslint-plugin-import": "^2.16.0",
-    "istanbul": "next"
+    "eslint": "^5.16.0",
+    "eslint-config-airbnb-base": "^13.1.0",
+    "eslint-plugin-import": "^2.17.2"
   }
 }

test/claim-types.js

@@ -1,24 +1,22 @@
-'use strict';
+const { strict: assert } = require('assert');
 
 const {
   noFollow,
   redirect_uri,
   register,
   describe,
   authorize,
-  authorizationCallback,
+  callback,
   it,
 } = require('./helper');
 
-const assert = require('assert');
-
 describe('Claim Types', function () {
   it('rp-claims-aggregated', async function () {
     const response_type = 'code';
     const { client } = await register('rp-claims-aggregated', { });
     const authorization = await authorize(client.authorizationUrl({ redirect_uri, response_type }), noFollow);
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     const userinfo = await client.userinfo(tokens);
     const aggregated = await client.unpackAggregatedClaims(userinfo);
     assert(aggregated.shoe_size);
@@ -30,7 +28,7 @@ describe('Claim Types', function () {
     const { client } = await register('rp-claims-distributed', { });
     const authorization = await authorize(client.authorizationUrl({ redirect_uri, response_type }), noFollow);
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     const userinfo = await client.userinfo(tokens);
     const distributed = await client.fetchDistributedClaims(userinfo);
     assert(distributed.age);

test/claims-request-parameter.js

@@ -1,4 +1,4 @@
-'use strict';
+const { strict: assert } = require('assert');
 
 const base64url = require('base64url');
 const {
@@ -7,19 +7,17 @@ const {
   register,
   describe,
   authorize,
-  authorizationCallback,
+  callback,
   it,
 } = require('./helper');
 
-const assert = require('assert');
-
 describe('claims Request Parameter', function () {
   it('rp-claims_request-id_token', async function () {
     const response_type = 'code';
     const { client } = await register('rp-claims_request-id_token', { });
     const authorization = await authorize(client.authorizationUrl({ claims: { id_token: { name: null } }, redirect_uri, response_type }), noFollow);
     const params = client.callbackParams(authorization.headers.location);
-    const { id_token: idToken } = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const { id_token: idToken } = await callback(client, redirect_uri, params, { response_type });
     assert(JSON.parse(base64url.decode(idToken.split('.')[1])).name);
   });
 
@@ -28,7 +26,7 @@ describe('claims Request Parameter', function () {
     const { client } = await register('rp-claims_request-userinfo', { });
     const authorization = await authorize(client.authorizationUrl({ claims: { userinfo: { name: null } }, redirect_uri, response_type }), noFollow);
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     const userinfo = await client.userinfo(tokens);
     assert(userinfo.name);
   });

test/client-authentication.js

@@ -1,19 +1,18 @@
-'use strict';
+const { strict: assert } = require('assert');
 
 const { forEach } = require('lodash');
-const jose = require('node-jose'); // eslint-disable-line import/no-extraneous-dependencies
+const jose = require('@panva/jose'); // eslint-disable-line import/no-extraneous-dependencies
 const {
   noFollow,
   redirect_uri,
   register,
   describe,
   authorize,
-  authorizationCallback,
+  callback,
   it,
+  random,
 } = require('./helper');
 
-const assert = require('assert');
-
 describe('Client Authentication', function () {
   describe('rp-token_endpoint-client_secret_basic', function () {
     forEach({
@@ -25,11 +24,11 @@ describe('Client Authentication', function () {
       it(profile, async function () {
         const { client } = await register('rp-token_endpoint-client_secret_basic', { token_endpoint_auth_method: 'client_secret_basic' });
         assert.equal(client.token_endpoint_auth_method, 'client_secret_basic');
-        const nonce = String(Math.random());
+        const nonce = random();
         const authorization = await authorize(client.authorizationUrl({ redirect_uri, nonce, response_type }), noFollow);
 
         const params = client.callbackParams(authorization.headers.location.replace('#', '?'));
-        const tokens = await authorizationCallback(client, redirect_uri, params, { nonce, response_type });
+        const tokens = await callback(client, redirect_uri, params, { nonce, response_type });
         assert(tokens);
       });
     });
@@ -42,7 +41,7 @@ describe('Client Authentication', function () {
     const authorization = await authorize(client.authorizationUrl({ redirect_uri, response_type }), noFollow);
 
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     assert(tokens);
   });
 
@@ -53,20 +52,20 @@ describe('Client Authentication', function () {
     const authorization = await authorize(client.authorizationUrl({ redirect_uri, response_type }), noFollow);
 
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     assert(tokens);
   });
 
   it('rp-token_endpoint-private_key_jwt', async function () {
-    const keystore = jose.JWK.createKeyStore();
-    await keystore.generate('EC', 'P-256');
+    const keystore = new jose.JWKS.KeyStore();
+    await keystore.generate('EC');
     const response_type = 'code';
     const { client } = await register('rp-token_endpoint-private_key_jwt', { token_endpoint_auth_method: 'private_key_jwt' }, keystore);
     assert.equal(client.token_endpoint_auth_method, 'private_key_jwt');
     const authorization = await authorize(client.authorizationUrl({ redirect_uri, response_type }), noFollow);
 
     const params = client.callbackParams(authorization.headers.location);
-    const tokens = await authorizationCallback(client, redirect_uri, params, { response_type });
+    const tokens = await callback(client, redirect_uri, params, { response_type });
     assert(tokens);
   });
 });

test/discovery.js

@@ -1,9 +1,11 @@
-'use strict';
-
 /* eslint-disable no-restricted-syntax */
 
 const url = require('url');
 const { Issuer } = require('openid-client');
+
+const { strict: assert } = require('assert');
+const got = require('got');
+const nock = require('nock');
 const {
   discover,
   noFollow,
@@ -14,10 +16,6 @@ const {
   it,
 } = require('./helper');
 
-const assert = require('assert');
-const got = require('got');
-const nock = require('nock');
-
 afterEach(nock.cleanAll);
 afterEach(() => nock.enableNetConnect());
 
@@ -26,15 +24,15 @@ describe('Discovery', function () {
     const testId = 'rp-discovery-webfinger-url';
     const input = `${root}/${rpId}/${testId}/joe`;
     const issuer = await Issuer.webfinger(input);
-    log('webfinger using', input, 'discovered', issuer.issuer);
+    log('webfinger using', input, 'discovered', issuer.issuer, JSON.stringify(issuer, null, 4));
     assert.equal(issuer.issuer, `${root}/${rpId}/${testId}`);
   });
 
   it('rp-discovery-webfinger-acct @code-dynamic', async function () {
     const testId = 'rp-discovery-webfinger-acct';
     const input = `acct:${rpId}.${testId}@${url.parse(root).host}`;
     const issuer = await Issuer.webfinger(input);
-    log('webfinger using', input, 'discovered', issuer.issuer);
+    log('webfinger using', input, 'discovered', issuer.issuer, JSON.stringify(issuer, null, 4));
     assert.equal(issuer.issuer, `${root}/${rpId}/${testId}`);
   });
 
@@ -46,7 +44,7 @@ describe('Discovery', function () {
       reject();
     } catch (err) {
       log('caught', err);
-      assert.equal(err.message, 'discovered issuer mismatch');
+      assert.equal(err.message, `discovered issuer mismatch, expected ${root}/${rpId}/rp-discovery-issuer-not-matching-config, got: https://example.com`);
     }
   });
 
@@ -73,7 +71,7 @@ describe('Discovery', function () {
     const jwks = await issuer.keystore();
 
     assert.equal(jwks.all().length, 4);
-    log('fetched jwks_uri', JSON.stringify(jwks.toJSON(), null, 4));
+    log('fetched jwks_uri', JSON.stringify(jwks.toJWKS(), null, 4));
   });
 
   it('rp-discovery-webfinger-unknown-member', async function () {
@@ -91,7 +89,7 @@ describe('Discovery', function () {
       reject();
     } catch (err) {
       log('caught', err);
-      assert.equal(err.message, 'invalid issuer location');
+      assert.equal(err.message, `invalid issuer location ${root.replace('https:', 'http:')}/${rpId}/rp-discovery-webfinger-http-href`);
     }
   });
 });

test/dynamic-client-registration.js

@@ -1,13 +1,11 @@
-'use strict';
+const { strict: assert } = require('assert');
 
 const {
   register,
   describe,
   it,
 } = require('./helper');
 
-const assert = require('assert');
-
 describe('Dynamic Client Registration', function () {
   it('rp-registration-dynamic @code-dynamic', async function () {
     const { client, issuer } = await register('rp-registration-dynamic', { });