[ node-cli | oidc-signin-tool | service ] : Drop support for core v3 and v4 (#306)

pankhur94 · MichaelSwigerAtBentley · aruniverse · web-flow · commit ae310a6d34c9 · 2025-06-04T13:59:04.000-06:00
Co-authored-by: Pankhur Dhaila &lt;pankhur94@users.noreply.github.com&gt;
Co-authored-by: Michael Swiger &lt;108895074+MichaelSwigerAtBentley@users.noreply.github.com&gt;
Co-authored-by: Arun George &lt;11051042+aruniverse@users.noreply.github.com&gt;
diff --git a/.pipelines/build-docs.yaml b/.pipelines/build-docs.yaml
@@ -33,9 +33,9 @@ stages:
           clean: true
 
         - task: NodeTool@0
-          displayName: Use Node 18
+          displayName: Use Node 20
           inputs:
-            versionSpec: 18
+            versionSpec: 20
             checkLatest: true
 
         - script: npm install -g pnpm@9
diff --git a/.pipelines/integration-test.yaml b/.pipelines/integration-test.yaml
@@ -32,9 +32,9 @@ jobs:
     persistCredentials: true
 
   - task: NodeTool@0
-    displayName: Use Node 18
+    displayName: Use Node 20
     inputs:
-      versionSpec: 18.16.x
+      versionSpec: 20.19.x
 
   - script: npm install -g pnpm@9
     displayName: Install pnpm
diff --git a/README.md b/README.md
@@ -22,7 +22,7 @@ There is also an [authorization client for command-line developer tools](./packa
 
 ## Prerequisites
 
-- [Node](https://nodejs.org/en/): an installation of the latest security patch of Node 18. The Node installation also includes the **npm** package manager.
+- [Node](https://nodejs.org/en/): an installation of the latest security patch of Node 20. The Node installation also includes the **npm** package manager.
 - [pnpm](https://pnpm.io/): [prefer installation via npm corepack](https://pnpm.io/installation#using-corepack)
 
 ## Build Instructions
diff --git a/change/@itwin-browser-authorization-463a9006-7adc-4ec0-b198-c891f747e7c5.json b/change/@itwin-browser-authorization-463a9006-7adc-4ec0-b198-c891f747e7c5.json
@@ -0,0 +1,7 @@
+{
+  "type": "none",
+  "comment": "",
+  "packageName": "@itwin/browser-authorization",
+  "email": "pankhur94@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}
diff --git a/change/@itwin-electron-authorization-a7286cbf-f25c-4d19-ad8e-230e1f3cca6a.json b/change/@itwin-electron-authorization-a7286cbf-f25c-4d19-ad8e-230e1f3cca6a.json
@@ -0,0 +1,7 @@
+{
+  "type": "none",
+  "comment": "",
+  "packageName": "@itwin/electron-authorization",
+  "email": "pankhur94@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}
diff --git a/change/@itwin-node-cli-authorization-b3b53a04-1eda-4a99-82fb-5219f1f05fb8.json b/change/@itwin-node-cli-authorization-b3b53a04-1eda-4a99-82fb-5219f1f05fb8.json
@@ -0,0 +1,7 @@
+{
+  "type": "major",
+  "comment": "Drop support for core v3 and v4",
+  "packageName": "@itwin/node-cli-authorization",
+  "email": "pankhur94@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}
diff --git a/change/@itwin-oidc-signin-tool-4104b7bf-c600-4233-a839-c82d632caed7.json b/change/@itwin-oidc-signin-tool-4104b7bf-c600-4233-a839-c82d632caed7.json
@@ -0,0 +1,7 @@
+{
+  "type": "major",
+  "comment": "Drop support for core v3 and v4 and bump oidc-client-ts to latest major",
+  "packageName": "@itwin/oidc-signin-tool",
+  "email": "pankhur94@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}
diff --git a/change/@itwin-service-authorization-88581ff2-3fcd-4eab-b546-19427a9a47ba.json b/change/@itwin-service-authorization-88581ff2-3fcd-4eab-b546-19427a9a47ba.json
@@ -0,0 +1,7 @@
+{
+  "type": "major",
+  "comment": "Drop support for v3 and v4 and bump jwks-rsa to latest major",
+  "packageName": "@itwin/service-authorization",
+  "email": "pankhur94@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}
diff --git a/packages/browser/package.json b/packages/browser/package.json
@@ -41,7 +41,7 @@
     "@playwright/test": "~1.48.2",
     "@types/chai": "^4.2.22",
     "@types/mocha": "^8.2.3",
-    "@types/node": "^18.11.5",
+    "@types/node": "^20.14.8",
     "@types/sinon": "^10.0.13",
     "chai": "^4.2.2",
     "dotenv": "~16.0.3",
diff --git a/packages/electron/package.json b/packages/electron/package.json
@@ -56,7 +56,7 @@
     "@types/chai": "^4.2.22",
     "@types/chai-as-promised": "^7.1.1",
     "@types/mocha": "^8.2.3",
-    "@types/node": "~18.18.0",
+    "@types/node": "^20.14.8",
     "@types/sinon": "^10.0.13",
     "chai": "^4.2.2",
     "chai-as-promised": "^7.1.1",
diff --git a/packages/node-cli/package.json b/packages/node-cli/package.json
@@ -28,21 +28,21 @@
     "directory": "packages/node-cli"
   },
   "dependencies": {
-    "@itwin/core-common": "^3.3.0 || ^4.0.0",
     "@openid/appauth": "^1.3.1",
     "node-persist": "^3.1.3",
     "open": "^8.3.0",
     "username": "^7.0.0"
   },
   "devDependencies": {
-    "@itwin/build-tools": "^4.6.0-dev.27",
-    "@itwin/core-bentley": "^3.7.0",
+    "@itwin/build-tools": "rc",
+    "@itwin/core-bentley": "rc",
+    "@itwin/core-common": "rc",
     "@itwin/eslint-plugin": "^4.0.2",
     "@types/chai-as-promised": "^7.1.1",
     "@types/chai": "^4.2.22",
     "@types/mocha": "^8.2.3",
     "@types/node-persist": "^3.1.3",
-    "@types/node": "^18.11.5",
+    "@types/node": "^20.14.8",
     "@types/sinon": "^10.0.16",
     "chai-as-promised": "^7.1.1",
     "chai": "^4.2.2",
@@ -53,10 +53,10 @@
     "rimraf": "^3.0.2",
     "sinon": "^15.2.0",
     "source-map-support": "^0.5.9",
-    "typescript": "~5.3.3"
+    "typescript": "~5.6.2"
   },
   "peerDependencies": {
-    "@itwin/core-bentley": "^3.3.0 || ^4.0.0"
+    "@itwin/core-bentley": "^5.0.0"
   },
   "eslintConfig": {
     "plugins": [
diff --git a/packages/node-cli/src/TokenStore.ts b/packages/node-cli/src/TokenStore.ts
@@ -5,7 +5,7 @@
 
 import type { TokenResponseJson } from "@openid/appauth";
 import { TokenResponse } from "@openid/appauth";
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { createCipheriv, createDecipheriv, createSecretKey, randomBytes, scryptSync } from "node:crypto";
 import * as path from "node:path";
 import * as NodePersist from "node-persist";
 
@@ -61,7 +61,8 @@ export class TokenStore {
    */
   private encryptCache(cacheEntry: CacheEntry): { encryptedCache: string, iv: string } {
     const iv = randomBytes(16);
-    const cipher = createCipheriv("aes-256-cbc", this.generateCipherKey(), iv);
+    const key = createSecretKey(new Uint8Array(this.generateCipherKey()));
+    const cipher = createCipheriv("aes-256-cbc", key, new Uint8Array(iv));
 
     const encryptedCache = cipher.update(JSON.stringify(cacheEntry), "utf8", "hex") + cipher.final("hex");
     return {
@@ -71,7 +72,8 @@ export class TokenStore {
   }
 
   private decryptCache(encryptedCache: string, iv: Buffer): string {
-    const decipher = createDecipheriv("aes-256-cbc", this.generateCipherKey(), iv);
+    const key = createSecretKey(new Uint8Array(this.generateCipherKey()));
+    const decipher = createDecipheriv("aes-256-cbc", key, new Uint8Array(iv));
     const decryptedCache = decipher.update(encryptedCache, "hex", "utf8") + decipher.final("utf8");
     return decryptedCache;
   }
diff --git a/packages/oidc-signin-tool/package.json b/packages/oidc-signin-tool/package.json
@@ -33,23 +33,23 @@
     "url": "http://www.bentley.com"
   },
   "dependencies": {
-    "@itwin/certa": "^3.7.0 || ^4.0.0",
-    "@itwin/core-common": "^3.3.0 || ^4.0.0",
+    "@itwin/certa": "rc",
     "@itwin/service-authorization": "workspace:^",
     "@playwright/test": "~1.48.2",
     "dotenv": "^10.0.0",
     "dotenv-expand": "^5.1.0",
-    "oidc-client-ts": "^2.4.0"
+    "oidc-client-ts": "^3.1.0"
   },
   "devDependencies": {
-    "@itwin/build-tools": "^4.6.0-dev.27",
-    "@itwin/core-bentley": "^3.7.0",
+    "@itwin/build-tools": "rc",
+    "@itwin/core-bentley": "rc",
+    "@itwin/core-common": "rc",
     "@itwin/eslint-plugin": "^4.0.2",
     "@types/chai": "^4.2.22",
     "@types/chai-as-promised": "^7.1.1",
     "@types/jsonwebtoken": "^9.0.1",
     "@types/mocha": "^8.2.3",
-    "@types/node": "^18.11.5",
+    "@types/node": "^20.14.8",
     "@types/sinon": "^10.0.13",
     "chai": "^4.2.2",
     "chai-as-promised": "^7.1.1",
@@ -58,9 +58,9 @@
     "nyc": "^17.0.0",
     "rimraf": "^3.0.2",
     "sinon": "15.0.4",
-    "typescript": "~5.3.3"
+    "typescript": "~5.6.2"
   },
   "peerDependencies": {
-    "@itwin/core-bentley": "^3.3.0 || ^4.0.0"
+    "@itwin/core-bentley": "^5.0.0"
   }
 }
diff --git a/packages/service/package.json b/packages/service/package.json
@@ -27,15 +27,14 @@
     "directory": "packages/service"
   },
   "dependencies": {
-    "@itwin/core-common": "^3.3.0 || ^4.0.0",
-    "@itwin/core-geometry": "^3.3.0 || ^4.0.0",
     "got": "^12.6.1",
     "jsonwebtoken": "^9.0.0",
-    "jwks-rsa": "^2.0.4"
+    "jwks-rsa": "^3.1.0"
   },
   "devDependencies": {
-    "@itwin/build-tools": "^4.6.0-dev.27",
-    "@itwin/core-bentley": "^3.7.0",
+    "@itwin/build-tools": "rc",
+    "@itwin/core-bentley": "rc",
+    "@itwin/core-common": "rc",
     "@itwin/eslint-plugin": "^4.0.2",
     "@types/chai": "^4.2.22",
     "@types/chai-as-promised": "^7.1.1",
@@ -50,9 +49,9 @@
     "rimraf": "^3.0.2",
     "sinon": "^15.0.1",
     "source-map-support": "^0.5.9",
-    "typescript": "~5.3.3"
+    "typescript": "~5.6.2"
   },
   "peerDependencies": {
-    "@itwin/core-bentley": "^3.3.0 || ^4.0.0"
+    "@itwin/core-bentley": "^5.0.0"
   }
 }
diff --git a/packages/service/src/OIDCDiscoveryClient.ts b/packages/service/src/OIDCDiscoveryClient.ts
@@ -41,7 +41,7 @@ function assertOIDCConfig(obj: any): asserts obj is OIDCConfig {
       throw new Error(`Invalid OIDC discovery response: '${prop}' must be a boolean.`);
   }
   for (const prop of arrayProperties) {
-    if (prop in obj && (!Array.isArray(obj[prop]) || (obj[prop] as any[]).some((str) => typeof str !== "string")))
+    if (prop in obj && (!Array.isArray(obj[prop]) || obj[prop].some((str) => typeof str !== "string")))
       throw new Error(`Invalid OIDC discovery response: '${prop}' must be a boolean.`);
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
