OIDC: navigate to authorization endpoint

[kerryarchibald]

For element-hq/element-web#25574
Used matrix-org/matrix-react-sdk#11096

3.1.1. Authorization Code Flow Steps

1. Client prepares an Authentication Request containing the desired request parameters.
2. Client sends the request to the Authorization Server.
3. Authorization Server Authenticates the End-User.
4. Authorization Server obtains End-User Consent/Authorization.
5. Authorization Server sends the End-User back to the Client with an Authorization Code.
6. Client requests a response using the Authorization Code at the Token Endpoint.
7. Client receives a response that contains an ID Token and Access Token in the response body.
8. Client validates the ID token and retrieves the End-User's Subject Identifier.

This task addresses steps 1-5.

Splitting this flow into two parts to keep change set a reasonable size.

• generates authorization params and navigates to authorization endpoint

Checklist

• Tests written for new code (and old code if feasible)
• Linter and other CI checks pass
• Sign-off given on the changes (see CONTRIBUTING.md)

---

Here's what your changelog entry will look like:

✨ Features

• OIDC: navigate to authorization endpoint (#3499). Contributed by @kerryarchibald.

[kerryarchibald]

https://spec.matrix.org/v1.7/client-server-api/#get_matrixclientv3accountwhoami

[richvdh]

Looks generally great, a few nits and suggestions.

Sorry to keep banging on about comments and documentation but I really feel like paying a bit of extra effort in getting this stuff right pays big dividends in making maintenance easier down the line!

[richvdh]

I don't think this whole thing is a bearer token, in OpenID terminology. As I understand it, the "bearer token" per se is just access_token, and obviously this contains a whole bunch of other stuff.

Maybe we can call this BearerTokenResponse, or something?

Suggested change

	export type BearerToken = {
	token_type: "Bearer";
	access_token: string;
	scope: string;
	refresh_token?: string;
	expires_in?: number;
	id_token?: string;
	};
	/**
	* The expected response type from the authorization URL for a bearer token.
	*
	* See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
	* https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
	*/
	export type BearerTokenResponse = {
	token_type: "Bearer";
	access_token: string;
	scope: string;
	refresh_token?: string;
	expires_in?: number;
	id_token?: string;
	};

[richvdh]

isValidBearerToken needs a similar rename

[richvdh]

https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK says "Note that the token_type value is case insensitive."

... which might also be a problem for the type definition?

[kerryarchibald]

Good catch, added some handling for this

[richvdh]

LGTM.

At some point, not necessarily as part of this PR: it would be good to find out why these things aren't appearing in the documentation for the js-sdk (cf https://pr3499--js-sdk-docs-previews.netlify.app/stable/). It probably means they aren't exported correctly via src/matrix.ts.