feat: session management client helper is now inline with other helpers

The logic of allowed/not allowed is now moved to the client instance
method to allow for overloading and relaxing the policies.

Author: panva

lib/actions/check_session.js

@@ -160,7 +160,7 @@ module.exports = function checkSessionAction(provider) {
         if (!client) {
           throw new InvalidClient();
         }
-        if (!client.redirectUriOrigins.has(origin)) {
+        if (!client.originAllowed(origin)) {
           throw new InvalidRequest('origin not allowed', 403);
         }
         ctx.status = 204;

lib/models/client.js

@@ -313,18 +313,17 @@ module.exports = function getClient(provider) {
       return this.redirectUris.includes(checkedUri);
     }
 
-    get redirectUriOrigins() {
-      if ('redirectUriOrigins' in instance(this)) {
-        return instance(this).redirectUriOrigins;
+    originAllowed(origin) {
+      if (!('redirectUriOrigins' in instance(this))) {
+        instance(this).redirectUriOrigins = this.redirectUris.reduce((acc, uri) => {
+          const { origin: redirectUriOrigin } = new URL(uri);
+          acc.add(redirectUriOrigin);
+          return acc;
+        }, new Set());
       }
 
-      instance(this).redirectUriOrigins = this.redirectUris.reduce((acc, uri) => {
-        const { origin } = new URL(uri);
-        acc.add(origin);
-        return acc;
-      }, new Set());
-
-      return instance(this).redirectUriOrigins;
+      const origins = instance(this).redirectUriOrigins;
+      return origins.has(origin);
     }
 
     webMessageUriAllowed(webMessageUri) {