<commit_before>const crypto = require('crypto');

const pkg = require('../package.json');
const whitelistedJWA = JSON.parse(JSON.stringify(require('../lib/consts/jwa')));
const { interactionPolicy: { Prompt, base: policy } } = require('../lib');
const { InvalidClientMetadata } = require('../lib/helpers/errors');

const timeout = parseInt(process.env.TIMEOUT, 10);
const tokenEndpointAuthMethods = [
  'none',
  'client_secret_basic',
  'client_secret_jwt',
  'client_secret_post',
  'private_key_jwt',
  'self_signed_tls_client_auth',
];

const interactions = policy();
const selectAccount = new Prompt({
  name: 'select_account',
  requestable: true,
});
interactions.add(selectAccount, 0);

module.exports = {
  clients: [
    {
      client_id: 'dpop-heroku',
      token_endpoint_auth_method: 'none',
      scope: 'openid offline_access',
      grant_types: ['authorization_code', 'refresh_token'],
      response_types: ['code'],
      redirect_uris: ['https://murmuring-journey-60982.herokuapp.com/cb'],
    },
  ],
  interactions: {
    policy: interactions,
    url(ctx) {
      return `/interaction/${ctx.oidc.uid}`;
    },
  },
  acrValues: ['urn:mace:incommon:iap:bronze'],
  cookies: {
    long: { signed: true, maxAge: (1 * 24 * 60 * 60) * 1000 }, // 1 day in ms
    short: { signed: true },
    keys: ['some secret key', 'and also the old rotated away some time ago', 'and one more'],
  },
  discovery: {
    service_documentation: pkg.homepage,
    version: [
      pkg.version,
      process.env.HEROKU_SLUG_COMMIT ? process.env.HEROKU_SLUG_COMMIT.slice(0, 7) : undefined,
    ].filter(Boolean).join('-'),
  },
  claims: {
    amr: null,
    address: ['address'],
    email: ['email', 'email_verified'],
    phone: ['phone_number', 'phone_number_verified'],
    profile: ['birthdate', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name',
      'nickname', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'],
  },
  features: {
    devInteractions: { enabled: false },
    backchannelLogout: { enabled: true, ack: 4 },
    mTLS: {
      enabled: true,
      certificateBoundAccessTokens: true,
      selfSignedTlsClientAuth: true,
      ack: '15-rc.1',
      getCertificate(ctx) {
        return unescape(ctx.get('x-ssl-client-cert').replace(/\+/g, ' '));
      },
      certificateAuthorized(ctx) {
        return ctx.get('x-ssl-client-verify') === 'SUCCESS';
      },
      certificateSubjectMatches(ctx, property, expected) {
        if (property !== 'tls_client_auth_subject_dn') {
          throw new InvalidClientMetadata(`${property} is not supported by this deployment`);
        }
        return ctx.get('x-ssl-client-s-dn') === expected;
      },
    },
    claimsParameter: { enabled: true },
    deviceFlow: { enabled: true, ack: 15 },
    dPoP: { enabled: true, ack: 'id-02' },
    encryption: { enabled: true },
    frontchannelLogout: { enabled: true, ack: 2 },
    introspection: { enabled: true },
    jwtIntrospection: { enabled: true, ack: 3 },
    jwtResponseModes: { enabled: true, ack: 2 },
    registration: { enabled: true },
    request: { enabled: true },
    revocation: { enabled: true },
    sessionManagement: { enabled: true, ack: 28 },
    webMessageResponseMode: { enabled: true, ack: 'id-00' },
  },
  extraAccessTokenClaims() {
    return { 'urn:oidc-provider:example:foo': 'bar' };
  },
  formats: {
    AccessToken: 'jwt',
  },
  jwks: {
    keys: [
      {
        d: '<KEY>',
        dp: '<KEY>',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: 'xwQ72P9z9OYshiQ-ntDYaPnnfwG6u9JAdLMZ5o0dmjlcyrvwQRdoFIKPnO65Q8mh6F_LDSxjxa2Yzo_wdjhbPZLjfUJXgCzm54cClXzT5twzo7lzoAfaJlkTsoZc2HFWqmcri0BuzmTFLZx2Q7wYBm0pXHmQKF0V-C1O6NWfd4mfBhbM-I1tHYSpAMgarSm22WDMDx-WWI7TEzy2QhaBVaENW9BKaKkJklocAZCxk18WhR0fckIGiWiSM5FcU1PY2jfGsTmX505Ub7P5Dz75Ygqrutd5tFrcqyPAtPTFDk8X1InxkkUwpP3nFU5o50DGhwQolGYKPGtQ-ZtmbOfcWQ',
        p: '<KEY>',
        q: '<KEY>',
        qi: '<KEY>',
        use: 'sig',
      }, {
        d: '<KEY>',
        dp: '<KEY>',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: '<KEY>',
        p: '<KEY>',
        q: 'psaPv_vFHchNJ-225VnGwvfGYYKCoNgFBSFlLO4KvjPHVwcLDLuFlw1DJMS361s1cDhngglNvl-dgATfav0fJlYiVoh3Q0qHjsAW7Zq07nPeN4IW-n0tWcLBccLPj-S4oNiGWmax2IvpEdHMkY-AhpGbgOQEz9FXYLyHa6vStq0',
        qi: 'bqrEvOsv-dzuhh6dbQfxxq6aQn_hnYi89pFcThfkCEQmHEFqOoxR121QlqQmVPoZoqN7kzxvf_qFEyjvW9I-JuUlz4CbknhwHQrniUf3YwFtJ3SouqmAEL01c5pcB52Bh40J_xmd-Z7whjnwNMCDPQXTEtQZh4BXh4TWrq1N4No',
        use: 'enc',
      }, {
        crv: 'P-256',
        d: 'K9xfPv773dZR22TVUB80xouzdF7qCg5cWjPjkHyv7Ws',
        kty: 'EC',
        use: 'sig',
        x: 'FWZ9rSkLt6Dx9E3pxLybhdM6xgR5obGsj5_pqmnz5J4',
        y: '_n8G69C-A2Xl4xUW2lF0i8ZGZnk_KPYrhv4GbTGu5G4',
      }, {
        crv: 'P-256',
        d: '6UGMJFS2Zew2mcW99l6orWmkgE1Oqhib0NgAbmMuSqs',
        kty: 'EC',
        use: 'enc',
        x: 'Eb3RtGgBGOEz33yu46aha_RU6pyBaYNlu6SawlWGGHQ',
        y: 'tUncttzF6Ud4Abfn1N2A1Rz2MBbJSdI0zuKS28BNb-U',
      }, {
        crv: 'Ed25519',
        d: 'vxd-I9I5Tl76C2q7wkKteBqM0fYLa0Ev6C6CqjfFP5Q',
        kty: 'OKP',
        use: 'sig',
        x: 'lDkysGJKRmJeUp8ncTyGraHPHHiIfdxSajxGm7Srla8',
      },
    ],
  },
  responseTypes: ['code id_token token', 'code id_token', 'code token', 'code', 'id_token token', 'id_token', 'none'],
  subjectTypes: ['public', 'pairwise'],<commit_msg>chore: add all supported key types to certification example jwks<commit_after>const crypto = require('crypto');

const pkg = require('../package.json');
const whitelistedJWA = JSON.parse(JSON.stringify(require('../lib/consts/jwa')));
const { interactionPolicy: { Prompt, base: policy } } = require('../lib');
const { InvalidClientMetadata } = require('../lib/helpers/errors');

const timeout = parseInt(process.env.TIMEOUT, 10);
const tokenEndpointAuthMethods = [
  'none',
  'client_secret_basic',
  'client_secret_jwt',
  'client_secret_post',
  'private_key_jwt',
  'self_signed_tls_client_auth',
];

const interactions = policy();
const selectAccount = new Prompt({
  name: 'select_account',
  requestable: true,
});
interactions.add(selectAccount, 0);

module.exports = {
  clients: [
    {
      client_id: 'dpop-heroku',
      token_endpoint_auth_method: 'none',
      scope: 'openid offline_access',
      grant_types: ['authorization_code', 'refresh_token'],
      response_types: ['code'],
      redirect_uris: ['https://murmuring-journey-60982.herokuapp.com/cb'],
    },
  ],
  interactions: {
    policy: interactions,
    url(ctx) {
      return `/interaction/${ctx.oidc.uid}`;
    },
  },
  acrValues: ['urn:mace:incommon:iap:bronze'],
  cookies: {
    long: { signed: true, maxAge: (1 * 24 * 60 * 60) * 1000 }, // 1 day in ms
    short: { signed: true },
    keys: ['some secret key', 'and also the old rotated away some time ago', 'and one more'],
  },
  discovery: {
    service_documentation: pkg.homepage,
    version: [
      pkg.version,
      process.env.HEROKU_SLUG_COMMIT ? process.env.HEROKU_SLUG_COMMIT.slice(0, 7) : undefined,
    ].filter(Boolean).join('-'),
  },
  claims: {
    amr: null,
    address: ['address'],
    email: ['email', 'email_verified'],
    phone: ['phone_number', 'phone_number_verified'],
    profile: ['birthdate', 'family_name', 'gender', 'given_name', 'locale', 'middle_name', 'name',
      'nickname', 'picture', 'preferred_username', 'profile', 'updated_at', 'website', 'zoneinfo'],
  },
  features: {
    devInteractions: { enabled: false },
    backchannelLogout: { enabled: true, ack: 4 },
    mTLS: {
      enabled: true,
      certificateBoundAccessTokens: true,
      selfSignedTlsClientAuth: true,
      ack: '15-rc.1',
      getCertificate(ctx) {
        return unescape(ctx.get('x-ssl-client-cert').replace(/\+/g, ' '));
      },
      certificateAuthorized(ctx) {
        return ctx.get('x-ssl-client-verify') === 'SUCCESS';
      },
      certificateSubjectMatches(ctx, property, expected) {
        if (property !== 'tls_client_auth_subject_dn') {
          throw new InvalidClientMetadata(`${property} is not supported by this deployment`);
        }
        return ctx.get('x-ssl-client-s-dn') === expected;
      },
    },
    claimsParameter: { enabled: true },
    deviceFlow: { enabled: true, ack: 15 },
    dPoP: { enabled: true, ack: 'id-02' },
    encryption: { enabled: true },
    frontchannelLogout: { enabled: true, ack: 2 },
    introspection: { enabled: true },
    jwtIntrospection: { enabled: true, ack: 3 },
    jwtResponseModes: { enabled: true, ack: 2 },
    registration: { enabled: true },
    request: { enabled: true },
    revocation: { enabled: true },
    sessionManagement: { enabled: true, ack: 28 },
    webMessageResponseMode: { enabled: true, ack: 'id-00' },
  },
  extraAccessTokenClaims() {
    return { 'urn:oidc-provider:example:foo': 'bar' };
  },
  formats: {
    AccessToken: 'jwt',
  },
  jwks: {
    keys: [
      {
        d: '<KEY>',
        dp: '<KEY>',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: '<KEY>',
        p: '<KEY>',
        q: '3I1qeEDslZFB8iNfpKAdWtz_Wzm6-jayT_V6aIvhvMj5mnU-Xpj75zLPQSGa9wunMlOoZW9w1wDO1FVuDhwzeOJaTm-Ds0MezeC4U6nVGyyDHb4CUA3ml2tzt4yLrqGYMT7XbADSvuWYADHw79OFjEi4T3s3tJymhaBvy1ulv8M',
        qi: '<KEY>',
        use: 'sig',
      }, {
        d: '<KEY>',
        dp: '<KEY>',
        dq: '<KEY>',
        e: 'AQAB',
        kty: 'RSA',
        n: '<KEY>',
        p: '<KEY>',
        q: '<KEY>',
        qi: '<KEY>',
        use: 'enc',
      }, {
        crv: 'P-256',
        d: 'K9xfPv773dZR22TVUB80xouzdF7qCg5cWjPjkHyv7Ws',
        kty: 'EC',
        use: 'sig',
        x: '<KEY>',
        y: '_n8G69C-A2Xl4xUW2lF0i8ZGZnk_KPYrhv4GbTGu5G4',
      }, {
        crv: 'P-256',
        d: '6UGMJFS2Zew2mcW99l6orWmkgE1Oqhib0NgAbmMuSqs',
        kty: 'EC',
        use: 'enc',
        x: 'Eb3RtGgBGOEz33yu46aha_RU6pyBaYNlu6SawlWGGHQ',
        y: 'tUncttzF6Ud4Abfn1N2A1Rz2MBbJSdI0zuKS28BNb-U',
      }, {
        crv: 'P-384',
        d: 'nHHV7KHGMNp1P7fIiC3iSNUb07pzgcjNgumLhy2nGYCeNticodVEOve1DQEGkVtJ',
        kty: 'EC',
        use: 'sig',
        x: '<KEY>',
        y: '<KEY>',
      }, {
        crv: 'P-384',
        d: 'EG4BxmopR7AlnqcwkpxR1n9_3Y3xxWCo713eDMINQDcgmyleIrTyfbghQ_NNwiuJ',
        kty: 'EC',
        use: 'enc',
        x: '<KEY>',
        y: '<KEY>',
      }, {
        crv: 'P-521',
        d: 'AAoiKdycjZPhljm5_HxfQHfo0dyytkqHB2orRG_f-JqMTEywZ2uupPfVhXWS3ub6svhP67eVUxBY61by2b6R_-n_',
        kty: 'EC',
        use: 'sig',
        x: '<KEY>',
        y: 'AaKN94cn1ApvvfpOWO9VpJm-lLzOUR8XxOrKYfPqcLs0zEqSPiGdWA5CoNL5ck1q-CXD09ysQSmNkzFGaig2Mnop',
      }, {
        crv: 'P-521',
        d: '<KEY>',
        kty: 'EC',
        use: 'enc',
        x: '<KEY>',
        y: '<KEY>',
      }, {
        crv: 'Ed25519',
        d: 'vxd-I9I5Tl76C2q7wkKteBqM0fYLa0Ev6C6CqjfFP5Q',
        kty: 'OKP',
        use: 'sig',
        x: 'lDkysGJKRmJeUp8ncTyGraHPHHiIfdxSajxGm7Srla8',
      }, {
        crv: 'Ed448',
        d: '1dlYYuxIZytq_AyQxiMAL6CaxveKKE-AZJQJhBOAwAZjsjrvQ3K1McqGjri5_AxM6cOCtVyT-GrR',
        kty: 'OKP',
        use: 'sig',
        x: 'BG1zKFg6A_Rzix4pA08oYN5xHqhKIiREXZ59NZoA8p3xhgjh-tm8nc-6udtiL5ZNhWDbnRSq4jQA',
      },
    ],
  },
  responseTypes: ['code id_token token', 'code id_token', 'code token', 'code', 'id_token token', 'id_token', 'none'],
  subjectTypes: ['public', 'pairwise'],
{'fraction_non_alphanumeric': 0.15558475689881734, 'fraction_numerical': 0.03731931668856767, 'mean_word_length': 3.039631988676575, 'pattern_counts': {'":': 0, '<': 36, '<?xml version=': 0, '>': 36, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5806348', 'n_tokens_mistral': 4916, 'n_tokens_neox': 4698, 'n_words': 728}