<commit_before>const { readFileSync } = require('fs');
const path = require('path');
const { randomBytes } = require('crypto');
const https = require('https');

const jose = require('jose');
const helmet = require('koa-helmet');
const pem = require('https-pem');

const { Provider } = require('../../lib'); // require('oidc-provider');

const OFFICIAL_CERTIFICATION = 'https://www.certification.openid.net';
const { PORT = 3000, ISSUER = `http://localhost:${PORT}`, SUITE_BASE_URL = OFFICIAL_CERTIFICATION } = process.env;

const ALGS = ['PS256', 'ES256', 'EdDSA'];
const tokenEndpointAuthMethods = ['private_key_jwt', 'self_signed_tls_client_auth'];

const normalize = (cert) => cert.toString().replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');

const JWK_PKJWTONE = jose.JWK.asKey(readFileSync(path.join(__dirname, 'pkjwtone.key')), { alg: 'PS256', use: 'sig' }).toJWK();
const JWK_PKJWTTWO = jose.JWK.asKey(readFileSync(path.join(__dirname, 'pkjwttwo.key')), { alg: 'PS256', use: 'sig' }).toJWK();
const JWK_MTLSONE = jose.JWK.asKey(readFileSync(path.join(__dirname, 'mtlsone.key')), { x5c: [normalize(readFileSync(path.join(__dirname, 'mtlsone.crt')))], alg: 'PS256', use: 'sig' }).toJWK();
const JWK_MTLSTWO = jose.JWK.asKey(readFileSync(path.join(__dirname, 'mtlstwo.key')), { x5c: [normalize(readFileSync(path.join(__dirname, 'mtlstwo.crt')))], alg: 'PS256', use: 'sig' }).toJWK();

const fapi = new Provider(ISSUER, {
  acrValues: ['urn:mace:incommon:iap:silver'],
  routes: {
    userinfo: '/accounts',
  },
  jwks: {
    keys: [
      {
        alg: 'PS256',
        d: '<KEY>',
        dp: '<KEY>',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: '<KEY>',
        p: '<KEY>',
        q: 'xgyjgfZdlfpne27vdlxi5VGmNnBnLRAe_a7Wgo6JdmKPMPa1qugxVM5tUhoYjUuUpHxi8gDSxb0-N_kIqTu7zp2Ly9iB8wQIyyYmdxN7J_B5bSn5rfTcu_Uz-EuYVEGfj0hk5_aNQc0y02Di1L4QrnMNRGBo3jWCCRZrjqyHfqc',
        qi: 'nmJaonUO_d62824V6YmWuEX7imXdgHKRi-tY4IUDJbrm7lKEfcn_xazqilECh1xm7O8b4bj0th3JrRcs1Al0sWP1FwVHjzzmg5oqq26PvHjmtVIHn3cXGT6AmY8-eUPkYgPBc61Ej58Usazm1iuRIe-wNIBeL244kFTQK7zJfnE',
        use: 'sig',
      },
      {
        alg: 'ES256',
        crv: 'P-256',
        d: 'otMhQm75BL5LLmfkCtDDbAxHSLsj2zqBNJvf0C1zY2E',
        kty: 'EC',
        use: 'sig',
        x: 'p9xTCnXKLoJnBOpm1kzSgPt87AIZJZLtdlAXnUk3rxY',
        y: 'ZpaFStCyyWXA_UFQe-rwsSIgOGw92uuzO4BLbvUKkpY',
      },
      {
        alg: 'EdDSA',
        crv: 'Ed25519',
        d: '0OlblX_LYlFnDRD8yEE5gkc4vZw6T94uDCsxRfIEpKo',
        kty: 'OKP',
        use: 'sig',
        x: 'oZrknP771NulaB41XAkHQlvZBLlFnVtlE4AcmGpsGYU',
      },
    ],
  },
  scopes: ['openid', 'offline_access'],
  clients: [
    {
      client_id: 'pkjwt-one',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'private_key_jwt',
      jwks: {
        keys: [JWK_PKJWTONE],
      },
    },
    {
      client_id: 'pkjwt-two',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'private_key_jwt',
      jwks: {
        keys: [JWK_PKJWTTWO],
      },
    },
    {
      client_id: 'mtls-one',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'self_signed_tls_client_auth',
      jwks: {
        keys: [JWK_MTLSONE],
      },
    },
    {
      client_id: 'mtls-two',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'self_signed_tls_client_auth',
      jwks: {
        keys: [JWK_MTLSTWO],
      },
    },
  ],
  clientDefaults: {
    authorization_signed_response_alg: 'PS256',
    grant_types: ['authorization_code', 'implicit'],
    id_token_signed_response_alg: 'PS256',
    introspection_signed_response_alg: 'PS256',
    request_object_signing_alg: 'PS256',
    response_types: ['code id_token'],
    scope: 'openid offline_access',
    tls_client_certificate_bound_access_tokens: true,
    token_endpoint_auth_method: 'private_key_jwt',
  },
  clockTolerance: 5,
  features: {
    fapiRW: { enabled: true },
    mTLS: {
      enabled: true,
      certificateBoundAccessTokens: true,
      selfSignedTlsClientAuth: true,<commit_msg>example: whitelist some extra fapi uris<commit_after>const { readFileSync } = require('fs');
const path = require('path');
const { randomBytes } = require('crypto');
const https = require('https');

const jose = require('jose');
const helmet = require('koa-helmet');
const pem = require('https-pem');

const { Provider } = require('../../lib'); // require('oidc-provider');

const OFFICIAL_CERTIFICATION = 'https://www.certification.openid.net';
const { PORT = 3000, ISSUER = `http://localhost:${PORT}`, SUITE_BASE_URL = OFFICIAL_CERTIFICATION } = process.env;

const ALGS = ['PS256', 'ES256', 'EdDSA'];
const tokenEndpointAuthMethods = ['private_key_jwt', 'self_signed_tls_client_auth'];

const normalize = (cert) => cert.toString().replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');

const JWK_PKJWTONE = jose.JWK.asKey(readFileSync(path.join(__dirname, 'pkjwtone.key')), { alg: 'PS256', use: 'sig' }).toJWK();
const JWK_PKJWTTWO = jose.JWK.asKey(readFileSync(path.join(__dirname, 'pkjwttwo.key')), { alg: 'PS256', use: 'sig' }).toJWK();
const JWK_MTLSONE = jose.JWK.asKey(readFileSync(path.join(__dirname, 'mtlsone.key')), { x5c: [normalize(readFileSync(path.join(__dirname, 'mtlsone.crt')))], alg: 'PS256', use: 'sig' }).toJWK();
const JWK_MTLSTWO = jose.JWK.asKey(readFileSync(path.join(__dirname, 'mtlstwo.key')), { x5c: [normalize(readFileSync(path.join(__dirname, 'mtlstwo.crt')))], alg: 'PS256', use: 'sig' }).toJWK();

const fapi = new Provider(ISSUER, {
  acrValues: ['urn:mace:incommon:iap:silver'],
  routes: {
    userinfo: '/accounts',
  },
  jwks: {
    keys: [
      {
        alg: 'PS256',
        d: '<KEY>',
        dp: 'tc9sHeUoX1V1cedHpn0VUNiFwCSRTIn6IMzaSRS4f3IUMbLUHv6Ybt9MRco3hBRV1PrJv8K2YPWzZnNIoFF6gILIIsmz1EJX36lcHtIme0GLAt3BFNm_ofmxA6pLPawtDvo_uFpTBm-Z2frq-BSGeDGh5_Tr1cdlS1RT70RJzbk',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: '<KEY>',
        p: '5SLM2g4Uv3Q1-PGqwKPQ8h8Onp674FTxxYAHCh8mivgCGx7uIjVaOxCKvCimi8NCgtON0a1QdGY-BT3NsewJUvaniWyb5BZo-kpdkSzXCvQpWuWT_iSorgEgl4anJ59JZH_QW7wtjRnF8jWnw-_nkNv4HIIVd7fdKKCkpGi1Drk',
        q: '<KEY>',
        qi: '<KEY>',
        use: 'sig',
      },
      {
        alg: 'ES256',
        crv: 'P-256',
        d: 'otMhQm75BL5LLmfkCtDDbAxHSLsj2zqBNJvf0C1zY2E',
        kty: 'EC',
        use: 'sig',
        x: 'p9xTCnXKLoJnBOpm1kzSgPt87AIZJZLtdlAXnUk3rxY',
        y: 'ZpaFStCyyWXA_UFQe-rwsSIgOGw92uuzO4BLbvUKkpY',
      },
      {
        alg: 'EdDSA',
        crv: 'Ed25519',
        d: '0OlblX_LYlFnDRD8yEE5gkc4vZw6T94uDCsxRfIEpKo',
        kty: 'OKP',
        use: 'sig',
        x: 'oZrknP771NulaB41XAkHQlvZBLlFnVtlE4AcmGpsGYU',
      },
    ],
  },
  scopes: ['openid', 'offline_access'],
  clients: [
    {
      client_id: 'pkjwt-one',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        'https://review-app-dev-branch-8.certification.openid.net/test/a/mtls/callback', // removeme eventually
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'private_key_jwt',
      jwks: {
        keys: [JWK_PKJWTONE],
      },
    },
    {
      client_id: 'pkjwt-two',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        'https://review-app-dev-branch-8.certification.openid.net/test/a/mtls/callback', // removeme eventually
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-private_key_jwt-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'private_key_jwt',
      jwks: {
        keys: [JWK_PKJWTTWO],
      },
    },
    {
      client_id: 'mtls-one',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        'https://review-app-dev-branch-8.certification.openid.net/test/a/mtls/callback', // removeme eventually
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'self_signed_tls_client_auth',
      jwks: {
        keys: [JWK_MTLSONE],
      },
    },
    {
      client_id: 'mtls-two',
      response_types: ['code', 'code id_token'],
      grant_types: ['implicit', 'authorization_code', 'refresh_token'],
      redirect_uris: [
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback`,
        'https://review-app-dev-branch-8.certification.openid.net/test/a/mtls/callback', // removeme eventually
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-jarm/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider-mtls-plain_fapi-plain_response/callback?dummy1=lorem&dummy2=ipsum`,
        `${SUITE_BASE_URL}/test/a/oidc-provider/callback?dummy1=lorem&dummy2=ipsum`,
      ],
      token_endpoint_auth_method: 'self_signed_tls_client_auth',
      jwks: {
        keys: [JWK_MTLSTWO],
      },
    },
  ],
  clientDefaults: {
    authorization_signed_response_alg: 'PS256',
    grant_types: ['authorization_code', 'implicit'],
    id_token_signed_response_alg: 'PS256',
    introspection_signed_response_alg: 'PS256',
    request_object_signing_alg: 'PS256',
    response_types: ['code id_token'],
    scope: 'openid offline_access',
    tls_client_certificate_bound_access_tokens: true,
    token_endpoint_auth_method: 'private_key_jwt',
  },
  clockTolerance: 5,
  features: {
    fapiRW: { enabled: true },
    mTLS: {
      enabled: true,
      certificateBoundAccessTokens: true,
      selfSignedTlsClientAuth: true,
{'fraction_non_alphanumeric': 0.15836781281209872, 'fraction_numerical': 0.022685119132543872, 'mean_word_length': 3.8863715580341585, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 15, 'https://': 6, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1433171', 'n_tokens_mistral': 5804, 'n_tokens_neox': 5646, 'n_words': 572}