fix: support number and strings for id params but pass original params to model

Author: jankapunkt

lib/grant-types/authorization-code-grant-type.js

@@ -84,13 +84,15 @@ class AuthorizationCodeGrantType extends AbstractGrantType {
       throw new InvalidRequestError('Invalid parameter: `code`');
     }
 
+    // normalize string|number to string
     const requestCode = toString(request.body.code);
 
     if (!isFormat.vschar(requestCode)) {
       throw new InvalidRequestError('Invalid parameter: `code`');
     }
 
-    const code = await this.model.getAuthorizationCode(requestCode);
+    // XXX: still passing the original value from request to model
+    const code = await this.model.getAuthorizationCode(request.body.code);
 
     if (!code) {
       throw new InvalidGrantError('Invalid grant: authorization code is invalid');

lib/grant-types/refresh-token-grant-type.js

@@ -81,7 +81,7 @@ class RefreshTokenGrantType extends AbstractGrantType {
       throw new InvalidRequestError('Invalid parameter: `refresh_token`');
     }
 
-    const token = await this.model.getRefreshToken(refreshToken);
+    const token = await this.model.getRefreshToken(request.body.refresh_token);
 
     if (!token) {
       throw new InvalidGrantError('Invalid grant: refresh token is invalid');

lib/handlers/authorize-handler.js

@@ -173,6 +173,7 @@ class AuthorizeHandler {
 
     const redirectUri = request.body.redirect_uri || request.query.redirect_uri;
 
+    // XXX: why is there no 'Missing parameter: `redirect_uri`' error?
     if (isDefined(redirectUri) && (!isString(redirectUri) || !isFormat.uri(redirectUri))) {
       throw new InvalidRequestError('Invalid request: `redirect_uri` is not a valid URI');
     }

lib/handlers/token-handler.js

@@ -18,6 +18,8 @@ const UnsupportedGrantTypeError = require('../errors/unsupported-grant-type-erro
 const auth = require('basic-auth');
 const pkce = require('../pkce/pkce');
 const isFormat = require('@node-oauth/formats');
+const { isInTypes, toString } = require('../utils/param-util');
+const isStringOrNumber = isInTypes('string', 'number');
 
 /**
  * Grant types.
@@ -123,7 +125,7 @@ class TokenHandler {
       throw new InvalidRequestError('Missing parameter: `client_secret`');
     }
 
-    if (!isFormat.vschar(credentials.clientId)) {
+    if (!isStringOrNumber(credentials.clientId) || !isFormat.vschar(toString(credentials.clientId))) {
       throw new InvalidRequestError('Invalid parameter: `client_id`');
     }
 

lib/utils/scope-util.js

@@ -1,6 +1,8 @@
 const isFormat = require('@node-oauth/formats');
 const InvalidScopeError = require('../errors/invalid-scope-error');
+const { isInTypes } = require('../utils/param-util');
 const whiteSpace = /\s+/g;
+const isString = isInTypes('string');
 
 /**
  * @module ScopeUtil
@@ -22,7 +24,7 @@ function parseScope (requestedScope) {
     return undefined;
   }
 
-  if (typeof requestedScope !== 'string') {
+  if (!isString(requestedScope)) {
     throw new InvalidScopeError('Invalid parameter: `scope`');
   }