@alfresco/js-api 7.3.0-1529 → 7.3.0

package/src/authentication/oauth2Auth.js

@@ -1,575 +0,0 @@
-"use strict";
-/*!
- * @license
- * Copyright © 2005-2023 Hyland Software, Inc. and its affiliates. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Oauth2Auth = void 0;
-const tslib_1 = require("tslib");
-const event_emitter_1 = tslib_1.__importDefault(require("event-emitter"));
-const alfrescoApiClient_1 = require("../alfrescoApiClient");
-const auth_rest_api_1 = require("../api/auth-rest-api");
-const storage_1 = require("../storage");
-const path_matcher_1 = require("../utils/path-matcher");
-class Oauth2Auth extends alfrescoApiClient_1.AlfrescoApiClient {
-    constructor(config, alfrescoApi, httpClient) {
-        super(undefined, httpClient);
-        this.checkAccessToken = true;
-        this.discovery = {
-            loginUrl: undefined,
-            logoutUrl: undefined,
-            tokenEndpoint: undefined,
-            userinfoEndpoint: undefined,
-        };
-        this.authentications = {
-            'oauth2': { accessToken: '' }, type: 'oauth2', 'basicAuth': {}
-        };
-        this.storage = storage_1.Storage.getInstance();
-        this.className = 'Oauth2Auth';
-        if (config) {
-            this.setConfig(config, alfrescoApi);
-        }
-    }
-    setConfig(config, alfrescoApi) {
-        this.config = config;
-        this.storage.setDomainPrefix(config.domainPrefix);
-        if (this.config.oauth2) {
-            if (this.config.oauth2.host === undefined || this.config.oauth2.host === null) {
-                throw 'Missing the required oauth2 host parameter';
-            }
-            if (this.config.oauth2.clientId === undefined || this.config.oauth2.clientId === null) {
-                throw 'Missing the required oauth2 clientId parameter';
-            }
-            if (this.config.oauth2.scope === undefined || this.config.oauth2.scope === null) {
-                throw 'Missing the required oauth2 scope parameter';
-            }
-            if (this.config.oauth2.secret === undefined || this.config.oauth2.secret === null) {
-                this.config.oauth2.secret = '';
-            }
-            if ((this.config.oauth2.redirectUri === undefined || this.config.oauth2.redirectUri === null) && this.config.oauth2.implicitFlow) {
-                throw 'Missing redirectUri required parameter';
-            }
-            if (!this.config.oauth2.refreshTokenTimeout) {
-                this.config.oauth2.refreshTokenTimeout = 300000;
-            }
-            if (!this.config.oauth2.redirectSilentIframeUri) {
-                let context = '';
-                if (typeof window !== 'undefined') {
-                    context = window.location.origin;
-                }
-                this.config.oauth2.redirectSilentIframeUri = context + '/assets/silent-refresh.html';
-            }
-            this.basePath = this.config.oauth2.host;
-            this.host = this.config.oauth2.host;
-            this.discoveryUrls();
-            if (this.hasContentProvider()) {
-                this.exchangeTicketListener(alfrescoApi);
-            }
-            this.initOauth();
-        }
-    }
-    initOauth() {
-        if (!this.config.oauth2.implicitFlow && this.isValidAccessToken()) {
-            const accessToken = this.storage.getItem('access_token');
-            this.setToken(accessToken, null);
-        }
-        if (this.config.oauth2.implicitFlow) {
-            this.checkFragment('nonce');
-        }
-    }
-    discoveryUrls() {
-        this.discovery.loginUrl = this.config.oauth2.authorizationUrl || this.host + Oauth2Auth.DEFAULT_AUTHORIZATION_URL;
-        this.discovery.logoutUrl = this.config.oauth2.logoutUrl || this.host + Oauth2Auth.DEFAULT_LOGOUT_URL;
-        this.discovery.tokenEndpoint = this.config.oauth2.tokenUrl || this.host + Oauth2Auth.DEFAULT_TOKEN_URL;
-        this.discovery.userinfoEndpoint = this.config.oauth2.userinfoEndpoint || this.host + Oauth2Auth.DEFAULT_USER_INFO_ENDPOINT;
-    }
-    getProfile() {
-        const postBody = {}, pathParams = {}, queryParams = {};
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded'
-        };
-        const formParams = {};
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        return this.callCustomApi(this.discovery.userinfoEndpoint, 'GET', pathParams, queryParams, headerParams, formParams, postBody, contentTypes, accepts);
-    }
-    hasContentProvider() {
-        return this.config.provider === 'ECM' || this.config.provider === 'ALL';
-    }
-    checkFragment(nonceKey, externalHash) {
-        this.hashFragmentParams = this.getHashFragmentParams(externalHash);
-        if (this.hashFragmentParams && this.hashFragmentParams.error === undefined) {
-            this.useFragmentTimeLogin(nonceKey);
-        }
-        else {
-            this.refreshBrowserLogin();
-        }
-    }
-    refreshBrowserLogin() {
-        if (this.config.oauth2.silentLogin && !this.isPublicUrl()) {
-            this.implicitLogin();
-        }
-        if (this.isValidToken() && this.isValidAccessToken()) {
-            const accessToken = this.storage.getItem('access_token');
-            this.setToken(accessToken, null);
-            this.silentRefresh();
-        }
-    }
-    useFragmentTimeLogin(nonceKey) {
-        const accessToken = this.hashFragmentParams.access_token;
-        const idToken = this.hashFragmentParams.id_token;
-        const sessionState = this.hashFragmentParams.session_state;
-        const expiresIn = this.hashFragmentParams.expires_in;
-        if (!sessionState) {
-            throw ('session state not present');
-        }
-        try {
-            const jwt = this.processJWTToken(idToken, nonceKey);
-            if (jwt) {
-                this.storeIdToken(idToken, jwt.payload.exp);
-                this.storeAccessToken(accessToken, expiresIn);
-                this.authentications.basicAuth.username = jwt.payload.preferred_username;
-                this.saveUsername(jwt.payload.preferred_username);
-                this.silentRefresh();
-                return accessToken;
-            }
-        }
-        catch (error) {
-            throw ('Validation JWT error' + error);
-        }
-    }
-    isPublicUrl() {
-        const publicUrls = this.config.oauth2.publicUrls || [];
-        if (Array.isArray(publicUrls)) {
-            return publicUrls.length > 0 &&
-                publicUrls.some((urlPattern) => path_matcher_1.PathMatcher.match(window.location.href, urlPattern));
-        }
-        return false;
-    }
-    padBase64(base64data) {
-        while (base64data.length % 4 !== 0) {
-            base64data += '=';
-        }
-        return base64data;
-    }
-    processJWTToken(jwt, nonceKey) {
-        if (jwt) {
-            const jwtArray = jwt.split('.');
-            const headerBase64 = this.padBase64(jwtArray[0]);
-            const headerJson = this.b64DecodeUnicode(headerBase64);
-            const header = JSON.parse(headerJson);
-            const payloadBase64 = this.padBase64(jwtArray[1]);
-            const payloadJson = this.b64DecodeUnicode(payloadBase64);
-            const payload = JSON.parse(payloadJson);
-            const savedNonce = this.storage.getItem(nonceKey);
-            if (!payload.sub) {
-                throw ('Missing sub in JWT');
-            }
-            if (payload.nonce !== savedNonce) {
-                console.log('Failing nonce JWT is not corresponding' + payload.nonce);
-                return;
-            }
-            return {
-                idToken: jwt,
-                payload: payload,
-                header: header
-            };
-        }
-    }
-    b64DecodeUnicode(b64string) {
-        const base64 = b64string.replace(/-/g, '+').replace(/_/g, '/');
-        return decodeURIComponent(atob(base64)
-            .split('')
-            .map((c) => {
-            return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
-        })
-            .join(''));
-    }
-    storeIdToken(idToken, exp) {
-        this.storage.setItem('id_token', idToken);
-        this.storage.setItem('id_token_expires_at', Number(exp * 1000).toString());
-        this.storage.setItem('id_token_stored_at', Date.now().toString());
-    }
-    storeAccessToken(accessToken, expiresIn, refreshToken) {
-        this.storage.setItem('access_token', accessToken);
-        const expiresInMilliSeconds = expiresIn * 1000;
-        const now = new Date();
-        const expiresAt = now.getTime() + expiresInMilliSeconds;
-        this.storage.setItem('access_token_expires_in', expiresAt);
-        this.storage.setItem('access_token_stored_at', Date.now().toString());
-        this.setToken(accessToken, refreshToken);
-    }
-    saveUsername(username) {
-        if (this.storage.supportsStorage()) {
-            this.storage.setItem('USERNAME', username);
-        }
-    }
-    implicitLogin() {
-        if (!this.isValidToken() || !this.isValidAccessToken()) {
-            this.redirectLogin();
-        }
-    }
-    isValidToken() {
-        let validToken = false;
-        if (this.getIdToken()) {
-            const expiresAt = this.storage.getItem('id_token_expires_at');
-            const now = new Date();
-            if (expiresAt && parseInt(expiresAt, 10) >= now.getTime()) {
-                validToken = true;
-            }
-        }
-        return validToken;
-    }
-    isValidAccessToken() {
-        let validAccessToken = false;
-        if (this.getAccessToken()) {
-            const expiresAt = this.storage.getItem('access_token_expires_in');
-            const now = new Date();
-            if (expiresAt && parseInt(expiresAt, 10) >= now.getTime()) {
-                validAccessToken = true;
-            }
-        }
-        return validAccessToken;
-    }
-    getIdToken() {
-        return this.storage.getItem('id_token');
-    }
-    getAccessToken() {
-        return this.storage.getItem('access_token');
-    }
-    redirectLogin() {
-        if (this.config.oauth2.implicitFlow && typeof window !== 'undefined') {
-            const href = this.composeImplicitLoginUrl();
-            window.location.href = href;
-            this.emit('implicit_redirect', href);
-        }
-    }
-    isRedirectionUrl() {
-        return window.location.hash && window.location.hash.split('&')[0].indexOf('session_state') === -1;
-    }
-    genNonce() {
-        let text = '';
-        const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-        for (let i = 0; i < 40; i++) {
-            text += possible.charAt(Math.floor(Math.random() * possible.length));
-        }
-        return text;
-    }
-    composeImplicitLoginUrl() {
-        const nonce = this.genNonce();
-        this.storage.setItem('nonce', nonce);
-        const afterLoginUriSegment = this.isRedirectionUrl() ? window.location.hash : '';
-        if (afterLoginUriSegment && afterLoginUriSegment !== '/') {
-            this.storage.setItem('loginFragment', afterLoginUriSegment.replace('#', '').trim());
-        }
-        const separation = this.discovery.loginUrl.indexOf('?') > -1 ? '&' : '?';
-        return this.discovery.loginUrl +
-            separation +
-            'client_id=' +
-            encodeURIComponent(this.config.oauth2.clientId) +
-            '&redirect_uri=' +
-            encodeURIComponent(this.config.oauth2.redirectUri) +
-            '&scope=' +
-            encodeURIComponent(this.config.oauth2.scope) +
-            '&response_type=' +
-            encodeURIComponent('id_token token') +
-            '&nonce=' +
-            encodeURIComponent(nonce);
-    }
-    composeIframeLoginUrl() {
-        const nonce = this.genNonce();
-        this.storage.setItem('refresh_nonce', nonce);
-        const separation = this.discovery.loginUrl.indexOf('?') > -1 ? '&' : '?';
-        return this.discovery.loginUrl +
-            separation +
-            'client_id=' +
-            encodeURIComponent(this.config.oauth2.clientId) +
-            '&redirect_uri=' +
-            encodeURIComponent(this.config.oauth2.redirectSilentIframeUri) +
-            '&scope=' +
-            encodeURIComponent(this.config.oauth2.scope) +
-            '&response_type=' +
-            encodeURIComponent('id_token token') +
-            '&nonce=' +
-            encodeURIComponent(nonce) +
-            '&prompt=none';
-    }
-    hasHashCharacter(hash) {
-        return hash.indexOf('#') === 0;
-    }
-    startWithHashRoute(hash) {
-        return hash.startsWith('#/');
-    }
-    getHashFragmentParams(externalHash) {
-        let hashFragmentParams = null;
-        if (typeof window !== 'undefined') {
-            let hash;
-            if (!externalHash) {
-                hash = decodeURIComponent(window.location.hash);
-                if (!this.startWithHashRoute(hash)) {
-                    window.location.hash = '';
-                }
-            }
-            else {
-                hash = decodeURIComponent(externalHash);
-                this.removeHashFromSilentIframe();
-                this.destroyIframe();
-            }
-            if (this.hasHashCharacter(hash) && !this.startWithHashRoute(hash)) {
-                const questionMarkPosition = hash.indexOf('?');
-                if (questionMarkPosition > -1) {
-                    hash = hash.substring(questionMarkPosition + 1);
-                }
-                else {
-                    hash = hash.substring(1);
-                }
-                hashFragmentParams = this.parseQueryString(hash);
-            }
-        }
-        return hashFragmentParams;
-    }
-    parseQueryString(queryString) {
-        const data = {};
-        let pairs;
-        let pair;
-        let separatorIndex;
-        let escapedKey;
-        let escapedValue;
-        let key;
-        let value;
-        if (queryString !== null) {
-            pairs = queryString.split('&');
-            for (let i = 0; i < pairs.length; i++) {
-                pair = pairs[i];
-                separatorIndex = pair.indexOf('=');
-                if (separatorIndex === -1) {
-                    escapedKey = pair;
-                    escapedValue = null;
-                }
-                else {
-                    escapedKey = pair.substring(0, separatorIndex);
-                    escapedValue = pair.substring(separatorIndex + 1);
-                }
-                key = decodeURIComponent(escapedKey);
-                value = decodeURIComponent(escapedValue);
-                if (key.substring(0, 1) === '/') {
-                    key = key.substring(1);
-                }
-                data[key] = value;
-            }
-        }
-        return data;
-    }
-    silentRefresh() {
-        if (typeof document === 'undefined') {
-            this.pollingRefreshToken();
-            return;
-        }
-        if (this.checkAccessToken) {
-            this.destroyIframe();
-            this.createIframe();
-            this.checkAccessToken = false;
-            return;
-        }
-        this.refreshTokenTimeoutIframe = setTimeout(() => {
-            this.destroyIframe();
-            this.createIframe();
-        }, this.config.oauth2.refreshTokenTimeout);
-    }
-    removeHashFromSilentIframe() {
-        const iframe = document.getElementById('silent_refresh_token_iframe');
-        if (iframe && iframe.contentWindow.location.hash) {
-            iframe.contentWindow.location.hash = '';
-        }
-    }
-    createIframe() {
-        const iframe = document.createElement('iframe');
-        iframe.id = 'silent_refresh_token_iframe';
-        const loginUrl = this.composeIframeLoginUrl();
-        iframe.setAttribute('src', loginUrl);
-        iframe.style.display = 'none';
-        document.body.appendChild(iframe);
-        this.iFrameHashListener = () => {
-            const silentRefreshTokenIframe = document.getElementById('silent_refresh_token_iframe');
-            const hash = silentRefreshTokenIframe.contentWindow.location.hash;
-            try {
-                this.checkFragment('refresh_nonce', hash);
-            }
-            catch (_a) {
-                this.logOut();
-            }
-        };
-        iframe.addEventListener('load', this.iFrameHashListener);
-    }
-    destroyIframe() {
-        const iframe = document.getElementById('silent_refresh_token_iframe');
-        if (iframe) {
-            iframe.removeEventListener('load', this.iFrameHashListener);
-            document.body.removeChild(iframe);
-        }
-    }
-    login(username, password) {
-        return new Promise((resolve, reject) => {
-            this.grantPasswordLogin(username, password, resolve, reject);
-        });
-    }
-    grantPasswordLogin(username, password, resolve, reject) {
-        this.invalidateSession();
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded'
-        };
-        const formParams = {
-            username: username,
-            password: password,
-            grant_type: 'password',
-            client_id: this.config.oauth2.clientId,
-            client_secret: this.config.oauth2.secret
-        };
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        const promise = this.callCustomApi(this.discovery.tokenEndpoint, 'POST', {}, {}, headerParams, formParams, {}, contentTypes, accepts).then((data) => {
-            this.saveUsername(username);
-            this.silentRefresh();
-            this.storeAccessToken(data.access_token, data.expires_in, data.refresh_token);
-            resolve(data);
-        }, (error) => {
-            if (error.error && error.error.status === 401 || error.status === 401) {
-                this.emit('unauthorized');
-            }
-            this.emit('error');
-            reject(error.error);
-        });
-        (0, event_emitter_1.default)(promise);
-    }
-    pollingRefreshToken() {
-        this.refreshTokenIntervalPolling = setInterval(() => tslib_1.__awaiter(this, void 0, void 0, function* () {
-            try {
-                yield this.refreshToken();
-            }
-            catch (_a) {
-            }
-        }), this.config.oauth2.refreshTokenTimeout);
-        this.refreshTokenIntervalPolling.unref();
-    }
-    refreshToken() {
-        const auth = 'Basic ' + this.universalBtoa(this.config.oauth2.clientId + ':' + this.config.oauth2.secret);
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            'Cache-Control': 'no-cache',
-            'Authorization': auth
-        };
-        const formParams = {
-            grant_type: 'refresh_token',
-            refresh_token: this.authentications.oauth2.refreshToken
-        };
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        const promise = new Promise((resolve, reject) => {
-            this.callCustomApi(this.discovery.tokenEndpoint, 'POST', {}, {}, headerParams, formParams, {}, contentTypes, accepts).then((data) => {
-                this.setToken(data.access_token, data.refresh_token);
-                resolve(data);
-            }, (error) => {
-                if (error.error && error.error.status === 401) {
-                    this.emit('unauthorized');
-                }
-                this.emit('error');
-                reject(error.error);
-            });
-        });
-        (0, event_emitter_1.default)(promise);
-        return promise;
-    }
-    universalBtoa(stringToConvert) {
-        try {
-            return btoa(stringToConvert);
-        }
-        catch (err) {
-            return Buffer.from(stringToConvert).toString('base64');
-        }
-    }
-    setToken(token, refreshToken) {
-        this.authentications.oauth2.accessToken = token;
-        this.authentications.oauth2.refreshToken = refreshToken;
-        this.authentications.basicAuth.password = null;
-        this.token = token;
-        if (token) {
-            this.emit('token_issued');
-            this.emit('logged-in');
-        }
-    }
-    getToken() {
-        return this.token;
-    }
-    getAuthentication() {
-        return this.authentications;
-    }
-    changeHost(host) {
-        this.config.hostOauth2 = host;
-    }
-    isLoggedIn() {
-        return !!this.authentications.oauth2.accessToken;
-    }
-    logOut() {
-        return tslib_1.__awaiter(this, void 0, void 0, function* () {
-            this.checkAccessToken = true;
-            const id_token = this.getIdToken();
-            this.invalidateSession();
-            this.setToken(null, null);
-            const separation = this.discovery.logoutUrl.indexOf('?') > -1 ? '&' : '?';
-            const redirectLogout = this.config.oauth2.redirectUriLogout || this.config.oauth2.redirectUri;
-            const logoutUrl = this.discovery.logoutUrl +
-                separation +
-                'post_logout_redirect_uri=' +
-                encodeURIComponent(redirectLogout) +
-                '&id_token_hint=' +
-                encodeURIComponent(id_token);
-            if (id_token != null && this.config.oauth2.implicitFlow && typeof window !== 'undefined') {
-                window.location.href = logoutUrl;
-            }
-        });
-    }
-    invalidateSession() {
-        clearTimeout(this.refreshTokenTimeoutIframe);
-        clearInterval(this.refreshTokenIntervalPolling);
-        this.storage.removeItem('access_token');
-        this.storage.removeItem('access_token_expires_in');
-        this.storage.removeItem('access_token_stored_at');
-        this.storage.removeItem('id_token');
-        this.storage.removeItem('id_token');
-        this.storage.removeItem('id_token_claims_obj');
-        this.storage.removeItem('id_token_expires_at');
-        this.storage.removeItem('id_token_stored_at');
-        this.storage.removeItem('nonce');
-    }
-    exchangeTicketListener(alfrescoApi) {
-        this.on('token_issued', () => tslib_1.__awaiter(this, void 0, void 0, function* () {
-            const authContentApi = new auth_rest_api_1.AuthenticationApi(alfrescoApi);
-            authContentApi.apiClient.authentications = this.authentications;
-            try {
-                const ticketEntry = yield authContentApi.getTicket();
-                this.config.ticketEcm = ticketEntry.entry.id;
-                this.emit('ticket_exchanged');
-            }
-            catch (e) {
-            }
-        }));
-    }
-}
-exports.Oauth2Auth = Oauth2Auth;
-Oauth2Auth.DEFAULT_AUTHORIZATION_URL = '/protocol/openid-connect/auth';
-Oauth2Auth.DEFAULT_TOKEN_URL = '/protocol/openid-connect/token';
-Oauth2Auth.DEFAULT_USER_INFO_ENDPOINT = '/protocol/openid-connect/userinfo';
-Oauth2Auth.DEFAULT_LOGOUT_URL = '/protocol/openid-connect/logout';
-//# sourceMappingURL=../../../src/authentication/oauth2Auth.js.map