@alfresco/js-api 9.6.0-27445232448 → 10.0.0

package/esm5/src/authentication/oauth2Auth.js

@@ -1,571 +0,0 @@
-/*!
- * @license
- * Copyright © 2005-2025 Hyland Software, Inc. and its affiliates. All rights reserved.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { __awaiter } from "tslib";
-import { EventEmitter } from 'eventemitter3';
-import { AlfrescoApiClient } from '../alfrescoApiClient';
-import { AuthenticationApi } from '../api/auth-rest-api';
-import { Storage } from '../storage';
-import { PathMatcher } from '../utils/path-matcher';
-import { isBrowser } from '../utils';
-export class Oauth2Auth extends AlfrescoApiClient {
-    constructor(config, alfrescoApi, httpClient) {
-        super(undefined, httpClient);
-        this.checkAccessToken = true;
-        this.discovery = {
-            loginUrl: undefined,
-            logoutUrl: undefined,
-            tokenEndpoint: undefined,
-            userinfoEndpoint: undefined
-        };
-        this.authentications = {
-            oauth2: { accessToken: '' },
-            type: 'oauth2',
-            basicAuth: {}
-        };
-        this.pathMatcher = new PathMatcher();
-        this.storage = Storage.getInstance();
-        this.className = 'Oauth2Auth';
-        if (config) {
-            this.setConfig(config, alfrescoApi);
-        }
-    }
-    setConfig(config, alfrescoApi) {
-        this.config = config;
-        this.storage.setDomainPrefix(config.domainPrefix);
-        if (this.config.oauth2) {
-            if (this.config.oauth2.host === undefined || this.config.oauth2.host === null) {
-                throw new Error('Missing the required oauth2 host parameter');
-            }
-            if (this.config.oauth2.clientId === undefined || this.config.oauth2.clientId === null) {
-                throw new Error('Missing the required oauth2 clientId parameter');
-            }
-            if (this.config.oauth2.scope === undefined || this.config.oauth2.scope === null) {
-                throw new Error('Missing the required oauth2 scope parameter');
-            }
-            if ((this.config.oauth2.redirectUri === undefined || this.config.oauth2.redirectUri === null) && this.config.oauth2.implicitFlow) {
-                throw new Error('Missing redirectUri required parameter');
-            }
-            if (!this.config.oauth2.refreshTokenTimeout) {
-                this.config.oauth2.refreshTokenTimeout = 300000;
-            }
-            if (!this.config.oauth2.redirectSilentIframeUri) {
-                let context = '';
-                if (typeof window !== 'undefined') {
-                    context = window.location.origin;
-                }
-                this.config.oauth2.redirectSilentIframeUri = context + '/assets/silent-refresh.html';
-            }
-            this.basePath = this.config.oauth2.host;
-            this.host = this.config.oauth2.host;
-            this.discoveryUrls();
-            if (this.hasContentProvider()) {
-                this.exchangeTicketListener(alfrescoApi);
-            }
-            this.initOauth();
-        }
-    }
-    initOauth() {
-        if (!this.config.oauth2.implicitFlow && this.isValidAccessToken()) {
-            const accessToken = this.storage.getItem('access_token');
-            this.setToken(accessToken, null);
-        }
-        if (this.config.oauth2.implicitFlow) {
-            this.checkFragment('nonce');
-        }
-    }
-    discoveryUrls() {
-        this.discovery.loginUrl = this.config.oauth2.authorizationUrl || this.host + Oauth2Auth.DEFAULT_AUTHORIZATION_URL;
-        this.discovery.logoutUrl = this.config.oauth2.logoutUrl || this.host + Oauth2Auth.DEFAULT_LOGOUT_URL;
-        this.discovery.tokenEndpoint = this.config.oauth2.tokenUrl || this.host + Oauth2Auth.DEFAULT_TOKEN_URL;
-        this.discovery.userinfoEndpoint = this.config.oauth2.userinfoEndpoint || this.host + Oauth2Auth.DEFAULT_USER_INFO_ENDPOINT;
-    }
-    getProfile() {
-        const postBody = {};
-        const pathParams = {};
-        const queryParams = {};
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded'
-        };
-        const formParams = {};
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        return this.callCustomApi(this.discovery.userinfoEndpoint, 'GET', pathParams, queryParams, headerParams, formParams, postBody, contentTypes, accepts);
-    }
-    hasContentProvider() {
-        return this.config.provider === 'ECM' || this.config.provider === 'ALL';
-    }
-    checkFragment(nonceKey, externalHash) {
-        this.hashFragmentParams = this.getHashFragmentParams(externalHash);
-        if (this.hashFragmentParams && this.hashFragmentParams.error === undefined) {
-            this.useFragmentTimeLogin(nonceKey);
-        }
-        else {
-            this.refreshBrowserLogin();
-        }
-    }
-    refreshBrowserLogin() {
-        if (this.config.oauth2.silentLogin && !this.isPublicUrl()) {
-            this.implicitLogin();
-        }
-        if (this.isValidToken() && this.isValidAccessToken()) {
-            const accessToken = this.storage.getItem('access_token');
-            this.setToken(accessToken, null);
-            this.silentRefresh();
-        }
-    }
-    useFragmentTimeLogin(nonceKey) {
-        const accessToken = this.hashFragmentParams.access_token;
-        const idToken = this.hashFragmentParams.id_token;
-        const sessionState = this.hashFragmentParams.session_state;
-        const expiresIn = this.hashFragmentParams.expires_in;
-        if (!sessionState) {
-            throw new Error('session state not present');
-        }
-        try {
-            const jwt = this.processJWTToken(idToken, nonceKey);
-            if (jwt) {
-                this.storeIdToken(idToken, jwt.payload.exp);
-                this.storeAccessToken(accessToken, expiresIn);
-                this.authentications.basicAuth.username = jwt.payload.preferred_username;
-                this.saveUsername(jwt.payload.preferred_username);
-                this.silentRefresh();
-                return accessToken;
-            }
-        }
-        catch (error) {
-            throw new Error('Validation JWT error' + error);
-        }
-    }
-    isPublicUrl() {
-        const publicUrls = this.config.oauth2.publicUrls || [];
-        if (Array.isArray(publicUrls)) {
-            return publicUrls.length > 0 && publicUrls.some((urlPattern) => this.pathMatcher.match(window.location.href, urlPattern));
-        }
-        return false;
-    }
-    padBase64(base64data) {
-        while (base64data.length % 4 !== 0) {
-            base64data += '=';
-        }
-        return base64data;
-    }
-    processJWTToken(jwt, nonceKey) {
-        if (jwt) {
-            const jwtArray = jwt.split('.');
-            const headerBase64 = this.padBase64(jwtArray[0]);
-            const headerJson = this.b64DecodeUnicode(headerBase64);
-            const header = JSON.parse(headerJson);
-            const payloadBase64 = this.padBase64(jwtArray[1]);
-            const payloadJson = this.b64DecodeUnicode(payloadBase64);
-            const payload = JSON.parse(payloadJson);
-            const savedNonce = this.storage.getItem(nonceKey);
-            if (!payload.sub) {
-                throw new Error('Missing sub in JWT');
-            }
-            if (payload.nonce !== savedNonce) {
-                return;
-            }
-            return {
-                idToken: jwt,
-                payload,
-                header
-            };
-        }
-    }
-    b64DecodeUnicode(b64string) {
-        const base64 = b64string.replace(/-/g, '+').replace(/_/g, '/');
-        return decodeURIComponent(atob(base64)
-            .split('')
-            .map((c) => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
-            .join(''));
-    }
-    storeIdToken(idToken, exp) {
-        this.storage.setItem('id_token', idToken);
-        this.storage.setItem('id_token_expires_at', Number(exp * 1000).toString());
-        this.storage.setItem('id_token_stored_at', Date.now().toString());
-    }
-    storeAccessToken(accessToken, expiresIn, refreshToken) {
-        this.storage.setItem('access_token', accessToken);
-        const expiresInMilliSeconds = expiresIn * 1000;
-        const now = new Date();
-        const expiresAt = now.getTime() + expiresInMilliSeconds;
-        this.storage.setItem('access_token_expires_in', expiresAt);
-        this.storage.setItem('access_token_stored_at', Date.now().toString());
-        this.setToken(accessToken, refreshToken);
-    }
-    saveUsername(username) {
-        if (this.storage.supportsStorage()) {
-            this.storage.setItem('USERNAME', username);
-        }
-    }
-    implicitLogin() {
-        if (!this.isValidToken() || !this.isValidAccessToken()) {
-            this.redirectLogin();
-        }
-    }
-    isValidToken() {
-        let validToken = false;
-        if (this.getIdToken()) {
-            const expiresAt = this.storage.getItem('id_token_expires_at');
-            const now = new Date();
-            if (expiresAt && parseInt(expiresAt, 10) >= now.getTime()) {
-                validToken = true;
-            }
-        }
-        return validToken;
-    }
-    isValidAccessToken() {
-        let validAccessToken = false;
-        if (this.getAccessToken()) {
-            const expiresAt = this.storage.getItem('access_token_expires_in');
-            const now = new Date();
-            if (expiresAt && parseInt(expiresAt, 10) >= now.getTime()) {
-                validAccessToken = true;
-            }
-        }
-        return validAccessToken;
-    }
-    getIdToken() {
-        return this.storage.getItem('id_token');
-    }
-    getAccessToken() {
-        return this.storage.getItem('access_token');
-    }
-    redirectLogin() {
-        if (this.config.oauth2.implicitFlow && typeof window !== 'undefined') {
-            const href = this.composeImplicitLoginUrl();
-            window.location.href = href;
-            this.emit('implicit_redirect', href);
-        }
-    }
-    isRedirectionUrl() {
-        var _a;
-        return ((_a = window.location.hash) === null || _a === void 0 ? void 0 : _a.split('&')[0].indexOf('session_state')) === -1;
-    }
-    genNonce() {
-        let text = '';
-        const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-        for (let i = 0; i < 40; i++) {
-            text += possible.charAt(Math.floor(Math.random() * possible.length));
-        }
-        return text;
-    }
-    composeImplicitLoginUrl() {
-        const nonce = this.genNonce();
-        this.storage.setItem('nonce', nonce);
-        const afterLoginUriSegment = this.isRedirectionUrl() ? window.location.hash : '';
-        if (afterLoginUriSegment && afterLoginUriSegment !== '/') {
-            this.storage.setItem('loginFragment', afterLoginUriSegment.replace('#', '').trim());
-        }
-        const separation = this.discovery.loginUrl.indexOf('?') > -1 ? '&' : '?';
-        return (this.discovery.loginUrl +
-            separation +
-            'client_id=' +
-            encodeURIComponent(this.config.oauth2.clientId) +
-            '&redirect_uri=' +
-            encodeURIComponent(this.config.oauth2.redirectUri) +
-            '&scope=' +
-            encodeURIComponent(this.config.oauth2.scope) +
-            '&response_type=' +
-            encodeURIComponent('id_token token') +
-            '&nonce=' +
-            encodeURIComponent(nonce));
-    }
-    composeIframeLoginUrl() {
-        const nonce = this.genNonce();
-        this.storage.setItem('refresh_nonce', nonce);
-        const separation = this.discovery.loginUrl.indexOf('?') > -1 ? '&' : '?';
-        return (this.discovery.loginUrl +
-            separation +
-            'client_id=' +
-            encodeURIComponent(this.config.oauth2.clientId) +
-            '&redirect_uri=' +
-            encodeURIComponent(this.config.oauth2.redirectSilentIframeUri) +
-            '&scope=' +
-            encodeURIComponent(this.config.oauth2.scope) +
-            '&response_type=' +
-            encodeURIComponent('id_token token') +
-            '&nonce=' +
-            encodeURIComponent(nonce) +
-            '&prompt=none');
-    }
-    hasHashCharacter(hash) {
-        return hash.indexOf('#') === 0;
-    }
-    startWithHashRoute(hash) {
-        return hash.startsWith('#/');
-    }
-    getHashFragmentParams(externalHash) {
-        let hashFragmentParams = null;
-        if (typeof window !== 'undefined') {
-            let hash;
-            if (!externalHash) {
-                hash = decodeURIComponent(window.location.hash);
-                if (!this.startWithHashRoute(hash)) {
-                    window.location.hash = '';
-                }
-            }
-            else {
-                hash = decodeURIComponent(externalHash);
-                this.removeHashFromSilentIframe();
-                this.destroyIframe();
-            }
-            if (this.hasHashCharacter(hash) && !this.startWithHashRoute(hash)) {
-                const questionMarkPosition = hash.indexOf('?');
-                if (questionMarkPosition > -1) {
-                    hash = hash.substring(questionMarkPosition + 1);
-                }
-                else {
-                    hash = hash.substring(1);
-                }
-                hashFragmentParams = this.parseQueryString(hash);
-            }
-        }
-        return hashFragmentParams;
-    }
-    parseQueryString(queryString) {
-        const data = {};
-        let pairs;
-        let pair;
-        let separatorIndex;
-        let escapedKey;
-        let escapedValue;
-        let key;
-        let value;
-        if (queryString !== null) {
-            pairs = queryString.split('&');
-            for (const item of pairs) {
-                pair = item;
-                separatorIndex = pair.indexOf('=');
-                if (separatorIndex === -1) {
-                    escapedKey = pair;
-                    escapedValue = null;
-                }
-                else {
-                    escapedKey = pair.substring(0, separatorIndex);
-                    escapedValue = pair.substring(separatorIndex + 1);
-                }
-                key = decodeURIComponent(escapedKey);
-                value = decodeURIComponent(escapedValue);
-                if (key.startsWith('/')) {
-                    key = key.substring(1);
-                }
-                data[key] = value;
-            }
-        }
-        return data;
-    }
-    silentRefresh() {
-        if (!isBrowser()) {
-            this.pollingRefreshToken();
-            return;
-        }
-        if (this.checkAccessToken) {
-            this.destroyIframe();
-            this.createIframe();
-            this.checkAccessToken = false;
-            return;
-        }
-        this.refreshTokenTimeoutIframe = setTimeout(() => {
-            this.destroyIframe();
-            this.createIframe();
-        }, this.config.oauth2.refreshTokenTimeout);
-    }
-    removeHashFromSilentIframe() {
-        const iframe = document.getElementById('silent_refresh_token_iframe');
-        if (iframe === null || iframe === void 0 ? void 0 : iframe.contentWindow.location.hash) {
-            iframe.contentWindow.location.hash = '';
-        }
-    }
-    createIframe() {
-        const iframe = document.createElement('iframe');
-        iframe.id = 'silent_refresh_token_iframe';
-        const loginUrl = this.composeIframeLoginUrl();
-        iframe.setAttribute('src', loginUrl);
-        iframe.style.display = 'none';
-        document.body.appendChild(iframe);
-        this.iFrameHashListener = () => {
-            const silentRefreshTokenIframe = document.getElementById('silent_refresh_token_iframe');
-            const hash = silentRefreshTokenIframe.contentWindow.location.hash;
-            try {
-                this.checkFragment('refresh_nonce', hash);
-            }
-            catch (_a) {
-                this.logOut();
-            }
-        };
-        iframe.addEventListener('load', this.iFrameHashListener);
-    }
-    destroyIframe() {
-        const iframe = document.getElementById('silent_refresh_token_iframe');
-        if (iframe) {
-            iframe.removeEventListener('load', this.iFrameHashListener);
-            document.body.removeChild(iframe);
-        }
-    }
-    login(username, password) {
-        return new Promise((resolve, reject) => {
-            this.grantPasswordLogin(username, password, resolve, reject);
-        });
-    }
-    grantPasswordLogin(username, password, resolve, reject) {
-        this.invalidateSession();
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded'
-        };
-        const formParams = {
-            username,
-            password,
-            grant_type: 'password',
-            client_id: this.config.oauth2.clientId
-        };
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        const promise = this.callCustomApi(this.discovery.tokenEndpoint, 'POST', {}, {}, headerParams, formParams, {}, contentTypes, accepts).then((data) => {
-            this.saveUsername(username);
-            this.silentRefresh();
-            this.storeAccessToken(data.access_token, data.expires_in, data.refresh_token);
-            resolve(data);
-        }, (error) => {
-            var _a;
-            if (((_a = error.error) === null || _a === void 0 ? void 0 : _a.status) === 401 || error.status === 401) {
-                this.emit('unauthorized');
-            }
-            this.emit('error');
-            reject(error.error);
-        });
-        return this.addPromiseListeners(promise, new EventEmitter());
-    }
-    pollingRefreshToken() {
-        this.refreshTokenIntervalPolling = setInterval(() => __awaiter(this, void 0, void 0, function* () {
-            try {
-                yield this.refreshToken();
-            }
-            catch (_a) {
-            }
-        }), this.config.oauth2.refreshTokenTimeout);
-        this.refreshTokenIntervalPolling.unref();
-    }
-    refreshToken() {
-        const auth = 'Basic ' + this.universalBtoa(this.config.oauth2.clientId);
-        const headerParams = {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            'Cache-Control': 'no-cache',
-            Authorization: auth
-        };
-        const formParams = {
-            grant_type: 'refresh_token',
-            refresh_token: this.authentications.oauth2.refreshToken
-        };
-        const contentTypes = ['application/x-www-form-urlencoded'];
-        const accepts = ['application/json'];
-        const promise = new Promise((resolve, reject) => {
-            this.callCustomApi(this.discovery.tokenEndpoint, 'POST', {}, {}, headerParams, formParams, {}, contentTypes, accepts).then((data) => {
-                this.setToken(data.access_token, data.refresh_token);
-                resolve(data);
-            }, (error) => {
-                var _a;
-                if (((_a = error.error) === null || _a === void 0 ? void 0 : _a.status) === 401) {
-                    this.emit('unauthorized');
-                }
-                this.emit('error');
-                reject(error.error);
-            });
-        });
-        return this.addPromiseListeners(promise, new EventEmitter());
-    }
-    universalBtoa(stringToConvert) {
-        try {
-            return btoa(stringToConvert);
-        }
-        catch (_a) {
-            return Buffer.from(stringToConvert).toString('base64');
-        }
-    }
-    setToken(token, refreshToken) {
-        this.authentications.oauth2.accessToken = token;
-        this.authentications.oauth2.refreshToken = refreshToken;
-        this.authentications.basicAuth.password = null;
-        this.token = token;
-        if (token) {
-            this.emit('token_issued');
-            this.emit('logged-in');
-        }
-    }
-    getToken() {
-        return this.token;
-    }
-    getAuthentication() {
-        return this.authentications;
-    }
-    changeHost(host) {
-        this.config.hostOauth2 = host;
-    }
-    isLoggedIn() {
-        return !!this.authentications.oauth2.accessToken;
-    }
-    logOut() {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.checkAccessToken = true;
-            const id_token = this.getIdToken();
-            this.invalidateSession();
-            this.setToken(null, null);
-            const separation = this.discovery.logoutUrl.indexOf('?') > -1 ? '&' : '?';
-            const redirectLogout = this.config.oauth2.redirectUriLogout || this.config.oauth2.redirectUri;
-            const logoutUrl = this.discovery.logoutUrl +
-                separation +
-                'post_logout_redirect_uri=' +
-                encodeURIComponent(redirectLogout) +
-                '&id_token_hint=' +
-                encodeURIComponent(id_token);
-            if (id_token != null && this.config.oauth2.implicitFlow && typeof window !== 'undefined') {
-                window.location.href = logoutUrl;
-            }
-        });
-    }
-    invalidateSession() {
-        clearTimeout(this.refreshTokenTimeoutIframe);
-        clearInterval(this.refreshTokenIntervalPolling);
-        this.storage.removeItem('access_token');
-        this.storage.removeItem('access_token_expires_in');
-        this.storage.removeItem('access_token_stored_at');
-        this.storage.removeItem('id_token');
-        this.storage.removeItem('id_token');
-        this.storage.removeItem('id_token_claims_obj');
-        this.storage.removeItem('id_token_expires_at');
-        this.storage.removeItem('id_token_stored_at');
-        this.storage.removeItem('nonce');
-    }
-    exchangeTicketListener(alfrescoApi) {
-        this.on('token_issued', () => __awaiter(this, void 0, void 0, function* () {
-            const authContentApi = new AuthenticationApi(alfrescoApi);
-            authContentApi.apiClient.authentications = this.authentications;
-            try {
-                const ticketEntry = yield authContentApi.getTicket();
-                this.config.ticketEcm = ticketEntry.entry.id;
-                this.emit('ticket_exchanged');
-            }
-            catch (_a) {
-            }
-        }));
-    }
-}
-Oauth2Auth.DEFAULT_AUTHORIZATION_URL = '/protocol/openid-connect/auth';
-Oauth2Auth.DEFAULT_TOKEN_URL = '/protocol/openid-connect/token';
-Oauth2Auth.DEFAULT_USER_INFO_ENDPOINT = '/protocol/openid-connect/userinfo';
-Oauth2Auth.DEFAULT_LOGOUT_URL = '/protocol/openid-connect/logout';
-//# sourceMappingURL=../../../../../../lib/js-api/src/authentication/oauth2Auth.js.map