@boxyhq/saml-jackson 1.35.0 → 1.36.0

package/dist/controller/oauth.js

@@ -72,7 +72,24 @@ const x509_1 = require("../saml/x509");
 const sso_handler_1 = require("./sso-handler");
 const lib_1 = require("../saml/lib");
 const oidc_client_1 = require("./oauth/oidc-client");
+const encrypter = __importStar(require("../db/encrypter"));
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
+function encrypt(val) {
+    const genKey = crypto_1.default.randomBytes(32);
+    const hexKey = genKey.toString('hex');
+    const encVal = encrypter.encrypt(JSON.stringify(val), genKey);
+    return {
+        hexKey,
+        encVal,
+    };
+}
+function decrypt(res, encryptionKey) {
+    const encKey = Buffer.from(encryptionKey, 'hex');
+    if (res.iv && res.tag) {
+        return JSON.parse(encrypter.decrypt(res.value, res.iv, res.tag, encKey));
+    }
+    return JSON.parse(res.value);
+}
 class OAuthController {
     constructor({ connectionStore, sessionStore, codeStore, tokenStore, ssoTraces, opts, idFedApp }) {
         this.connectionStore = connectionStore;
@@ -100,6 +117,10 @@ class OAuthController {
             let isOIDCFederated;
             let connection;
             let fedApp;
+            let connectionIsSAML;
+            let connectionIsOIDC;
+            let protocol;
+            const login_type = 'sp-initiated';
             try {
                 requestedTenant = tenant;
                 requestedProduct = product;
@@ -169,6 +190,7 @@ class OAuthController {
                         // First we check if it's a federated connection
                         if (client_id.startsWith(`${utils_1.clientIDFederatedPrefix}${utils_1.clientIDOIDCPrefix}`)) {
                             isOIDCFederated = true;
+                            protocol = 'oidc-federation';
                             fedApp = yield this.idFedApp.get({
                                 id: client_id.replace(utils_1.clientIDFederatedPrefix, ''),
                             });
@@ -207,8 +229,11 @@ class OAuthController {
                     throw new error_1.JacksonError('You need to specify client_id or tenant & product', 403);
                 }
                 if (!connection) {
-                    throw new error_1.JacksonError('IdP connection not found.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'IdP connection not found.');
                 }
+                connectionIsSAML = 'idpMetadata' in connection && connection.idpMetadata !== undefined;
+                connectionIsOIDC = 'oidcProvider' in connection && connection.oidcProvider !== undefined;
+                protocol = isOIDCFederated ? 'oidc-federation' : connectionIsSAML ? 'saml' : 'oidc';
                 if (!allowed.redirect(redirect_uri, connection.redirectUrl)) {
                     if (fedApp) {
                         if (!allowed.redirect(redirect_uri, fedApp.redirectUrl)) {
@@ -220,11 +245,15 @@ class OAuthController {
                     }
                 }
                 if (!(0, utils_1.isConnectionActive)(connection)) {
-                    throw new error_1.JacksonError('SSO connection is deactivated. Please contact your administrator.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'SSO connection is deactivated.');
                 }
             }
             catch (err) {
                 const error_description = (0, utils_1.getErrorMessage)(err);
+                metrics.increment('oauthAuthorizeError', {
+                    protocol,
+                    login_type,
+                });
                 // Save the error trace
                 yield this.ssoTraces.saveTrace({
                     error: error_description,
@@ -242,14 +271,14 @@ class OAuthController {
             const isMissingJWTKeysForOIDCFlow = requestedOIDCFlow &&
                 (!((_a = this.opts.openid) === null || _a === void 0 ? void 0 : _a.jwtSigningKeys) || !(0, utils_1.isJWSKeyPairLoaded)(this.opts.openid.jwtSigningKeys));
             const oAuthClientReqError = !state || response_type !== 'code';
-            const connectionIsSAML = 'idpMetadata' in connection && connection.idpMetadata !== undefined;
-            const connectionIsOIDC = 'oidcProvider' in connection && connection.oidcProvider !== undefined;
             if (isMissingJWTKeysForOIDCFlow || oAuthClientReqError || (!connectionIsSAML && !connectionIsOIDC)) {
-                let error, error_description;
+                let error, error_description, internalError;
                 if (isMissingJWTKeysForOIDCFlow) {
                     error = 'server_error';
-                    error_description =
-                        'OAuth server not configured correctly for openid flow, check if JWT signing keys are loaded';
+                    internalError =
+                        'Authorize error: OAuth server not configured correctly for openid flow, check if JWT signing keys are loaded';
+                    error_description = utils_1.GENERIC_ERR_STRING;
+                    this.opts.logger.error(internalError);
                 }
                 if (!state) {
                     error = 'invalid_request';
@@ -261,11 +290,17 @@ class OAuthController {
                 }
                 if (!connectionIsSAML && !connectionIsOIDC) {
                     error = 'server_error';
-                    error_description = 'Connection appears to be misconfigured';
+                    internalError = 'Authorize error: Connection appears to be misconfigured';
+                    error_description = utils_1.GENERIC_ERR_STRING;
+                    this.opts.logger.error(internalError);
                 }
+                metrics.increment('oauthAuthorizeError', {
+                    protocol,
+                    login_type,
+                });
                 // Save the error trace
                 const traceId = yield this.ssoTraces.saveTrace({
-                    error: error_description,
+                    error: internalError !== null && internalError !== void 0 ? internalError : error_description,
                     context: {
                         tenant: requestedTenant,
                         product: requestedProduct,
@@ -282,6 +317,7 @@ class OAuthController {
                         redirect_uri,
                         state,
                     }),
+                    error: `${error} - ${error_description}`,
                 };
             }
             // Connection retrieved: Handover to IdP starts here
@@ -291,7 +327,7 @@ class OAuthController {
             const sessionId = crypto_1.default.randomBytes(16).toString('hex');
             const relayState = utils_1.relayStatePrefix + sessionId;
             // SAML connection: SAML request will be constructed here
-            let samlReq;
+            let samlReq, internalError;
             if (connectionIsSAML) {
                 try {
                     const { sso } = connection.idpMetadata;
@@ -306,10 +342,16 @@ class OAuthController {
                     }
                     else {
                         // This code here is kept for backward compatibility. We now have validation while adding the SSO connection to ensure binding is present.
-                        const error_description = 'SAML binding could not be retrieved';
+                        internalError = 'Authorize error: SAML binding could not be retrieved';
+                        const error_description = utils_1.GENERIC_ERR_STRING;
+                        this.opts.logger.error(internalError);
+                        metrics.increment('oauthAuthorizeError', {
+                            protocol,
+                            login_type,
+                        });
                         // Save the error trace
                         const traceId = yield this.ssoTraces.saveTrace({
-                            error: error_description,
+                            error: internalError !== null && internalError !== void 0 ? internalError : error_description,
                             context: {
                                 tenant: requestedTenant,
                                 product: requestedProduct,
@@ -343,6 +385,11 @@ class OAuthController {
                 }
                 catch (err) {
                     const error_description = (0, utils_1.getErrorMessage)(err);
+                    this.opts.logger.error(`Authorize error: ${error_description} `);
+                    metrics.increment('oauthAuthorizeError', {
+                        protocol,
+                        login_type,
+                    });
                     // Save the error trace
                     const traceId = yield this.ssoTraces.saveTrace({
                         error: error_description,
@@ -373,7 +420,7 @@ class OAuthController {
                 const { ssoTraces } = this;
                 try {
                     if (!this.opts.oidcPath) {
-                        throw new error_1.JacksonError('OpenID response handler path (oidcPath) is not set');
+                        throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 500, 'OpenID response handler path (oidcPath) is not set');
                     }
                     const client = (yield (0, utils_1.dynamicImport)('openid-client'));
                     const oidcConfig = yield (0, oidc_client_1.oidcClientConfig)({
@@ -409,6 +456,11 @@ class OAuthController {
                 }
                 catch (err) {
                     const error_description = (0, utils_1.getErrorMessage)(err);
+                    this.opts.logger.error(`Authorize error: ${error_description}`);
+                    metrics.increment('oauthAuthorizeError', {
+                        protocol,
+                        login_type,
+                    });
                     // Save the error trace
                     const traceId = yield this.ssoTraces.saveTrace({
                         error: error_description,
@@ -435,7 +487,7 @@ class OAuthController {
             }
             // Session persistence happens here
             try {
-                const requested = { client_id, state, redirect_uri };
+                const requested = { client_id, state, redirect_uri, protocol, login_type };
                 if (requestedTenant) {
                     requested.tenant = requestedTenant;
                 }
@@ -513,6 +565,10 @@ class OAuthController {
             }
             catch (err) {
                 const error_description = (0, utils_1.getErrorMessage)(err);
+                metrics.increment('oauthAuthorizeError', {
+                    protocol,
+                    login_type,
+                });
                 // Save the error trace
                 const traceId = yield this.ssoTraces.saveTrace({
                     error: error_description,
@@ -551,24 +607,29 @@ class OAuthController {
             let validateOpts;
             let redirect_uri;
             const { SAMLResponse, idp_hint, RelayState = '' } = body;
+            let protocol, login_type;
             try {
                 isIdPFlow = !RelayState.startsWith(utils_1.relayStatePrefix);
                 rawResponse = Buffer.from(SAMLResponse, 'base64').toString();
                 issuer = saml20_1.default.parseIssuer(rawResponse);
                 if (!this.opts.idpEnabled && isIdPFlow) {
                     // IdP login is disabled so block the request
-                    throw new error_1.JacksonError('IdP (Identity Provider) flow has been disabled. Please head to your Service Provider to login.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'IdP (Identity Provider) flow has been disabled. Please head to your Service Provider to login.');
+                }
+                login_type = isIdPFlow ? 'idp-initiated' : 'sp-initiated';
+                if (isIdPFlow) {
+                    protocol = 'saml';
                 }
                 sessionId = RelayState.replace(utils_1.relayStatePrefix, '');
                 if (!issuer) {
-                    throw new error_1.JacksonError('Issuer not found.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'Issuer not found.');
                 }
                 const connections = (yield this.connectionStore.getByIndex({
                     name: utils_1.IndexNames.EntityID,
                     value: issuer,
                 })).data;
                 if (!connections || connections.length === 0) {
-                    throw new error_1.JacksonError('SAML connection not found.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'SAML connection not found.');
                 }
                 session = sessionId ? yield this.sessionStore.get(sessionId) : null;
                 if (!isIdPFlow && !session) {
@@ -577,6 +638,7 @@ class OAuthController {
                 isSAMLFederated = session && 'samlFederated' in session;
                 isOIDCFederated = session && 'oidcFederated' in session;
                 const isSPFlow = !isIdPFlow && !isSAMLFederated;
+                protocol = isOIDCFederated ? 'oidc-federation' : isSAMLFederated ? 'saml-federation' : 'saml';
                 // IdP initiated SSO flow
                 if (isIdPFlow) {
                     const response = yield this.ssoHandler.resolveConnection({
@@ -597,7 +659,7 @@ class OAuthController {
                     if ('connection' in response) {
                         connection = response.connection;
                         if (!(0, utils_1.isConnectionActive)(connection)) {
-                            throw new error_1.JacksonError('SSO connection is deactivated. Please contact your administrator.', 403);
+                            throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'SSO connection is deactivated. Please contact your administrator.');
                         }
                     }
                 }
@@ -611,7 +673,7 @@ class OAuthController {
                     })[0];
                 }
                 if (!connection) {
-                    throw new error_1.JacksonError('SAML connection not found.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'SAML connection not found.');
                 }
                 if (session &&
                     session.redirect_uri &&
@@ -642,6 +704,7 @@ class OAuthController {
                 redirect_uri = (session && session.redirect_uri) || connection.defaultRedirectUrl;
             }
             catch (err) {
+                metrics.increment('oAuthResponseError', { protocol, login_type });
                 // Save the error trace
                 yield this.ssoTraces.saveTrace({
                     error: (0, utils_1.getErrorMessage)(err),
@@ -684,7 +747,9 @@ class OAuthController {
                 return { redirect_url: redirect.success(redirect_uri, params) };
             }
             catch (err) {
+                metrics.increment('oAuthResponseError', { protocol, login_type });
                 const error_description = (0, utils_1.getErrorMessage)(err);
+                this.opts.logger.error(`SAMLResponse error: ${error_description}`);
                 // Trace the error
                 const traceId = yield this.ssoTraces.saveTrace({
                     error: error_description,
@@ -716,6 +781,7 @@ class OAuthController {
                         redirect_uri,
                         state: (_o = session === null || session === void 0 ? void 0 : session.requested) === null || _o === void 0 ? void 0 : _o.state,
                     }),
+                    error: `access_denied - ${error_description}`,
                 };
             }
         });
@@ -729,6 +795,8 @@ class OAuthController {
             let isOIDCFederated;
             let redirect_uri;
             let profile;
+            let protocol;
+            const login_type = 'sp-initiated';
             const callbackParams = body;
             let RelayState = callbackParams.state || '';
             try {
@@ -742,9 +810,10 @@ class OAuthController {
                 }
                 isSAMLFederated = session && 'samlFederated' in session;
                 isOIDCFederated = session && 'oidcFederated' in session;
+                protocol = isOIDCFederated ? 'oidc-federation' : isSAMLFederated ? 'saml-federation' : 'oidc';
                 oidcConnection = yield this.connectionStore.get(session.id);
                 if (!oidcConnection) {
-                    throw new error_1.JacksonError('OIDC connection not found.', 403);
+                    throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 403, 'OIDC connection not found.');
                 }
                 if (!isSAMLFederated) {
                     redirect_uri = session && session.redirect_uri;
@@ -764,6 +833,7 @@ class OAuthController {
                 }
             }
             catch (err) {
+                metrics.increment('oAuthResponseError', { protocol, login_type });
                 yield this.ssoTraces.saveTrace({
                     error: (0, utils_1.getErrorMessage)(err),
                     context: {
@@ -839,6 +909,8 @@ class OAuthController {
             catch (err) {
                 const { error, error_description, error_uri, session_state, scope, stack } = err;
                 const error_message = error_description || (0, utils_1.getErrorMessage)(err);
+                this.opts.logger.error(`OIDCResponse error: ${error_message}`);
+                metrics.increment('oAuthResponseError', { protocol, login_type });
                 const traceId = yield this.ssoTraces.saveTrace({
                     error: error_message,
                     context: {
@@ -874,6 +946,7 @@ class OAuthController {
                         redirect_uri: redirect_uri,
                         state: session.state,
                     }),
+                    error: `${error} - ${error_message}`,
                 };
             }
         });
@@ -898,8 +971,9 @@ class OAuthController {
             if (session) {
                 codeVal['session'] = session;
             }
-            yield this.codeStore.put(code, codeVal);
-            return code;
+            const { hexKey, encVal } = encrypt(codeVal);
+            yield this.codeStore.put(code, encVal);
+            return hexKey + '.' + code;
         });
     }
     /**
@@ -966,6 +1040,7 @@ class OAuthController {
             var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
             let basic_client_id;
             let basic_client_secret;
+            let protocol, login_type;
             try {
                 if (authHeader) {
                     // Authorization: Basic {Base64(<client_id>:<client_secret>)}
@@ -983,111 +1058,129 @@ class OAuthController {
             const client_secret = 'client_secret' in body ? body.client_secret : basic_client_secret;
             const code_verifier = 'code_verifier' in body ? body.code_verifier : undefined;
             metrics.increment('oauthToken');
-            if (grant_type !== 'authorization_code') {
-                throw new error_1.JacksonError('Unsupported grant_type', 400);
-            }
-            if (!code) {
-                throw new error_1.JacksonError('Please specify code', 400);
-            }
-            const codeVal = yield this.codeStore.get(code);
-            if (!codeVal || !codeVal.profile) {
-                throw new error_1.JacksonError('Invalid code', 403);
-            }
-            if ((_a = codeVal.requested) === null || _a === void 0 ? void 0 : _a.redirect_uri) {
-                if (redirect_uri !== codeVal.requested.redirect_uri) {
-                    throw new error_1.JacksonError(`Invalid request: ${!redirect_uri ? 'redirect_uri missing' : 'redirect_uri mismatch'}`, 400);
+            try {
+                if (grant_type !== 'authorization_code') {
+                    throw new error_1.JacksonError('Unsupported grant_type', 400);
                 }
-            }
-            if (code_verifier) {
-                // PKCE flow
-                let cv = code_verifier;
-                if (((_b = codeVal.session.code_challenge_method) === null || _b === void 0 ? void 0 : _b.toLowerCase()) === 's256') {
-                    cv = codeVerifier.encode(code_verifier);
+                if (!code) {
+                    throw new error_1.JacksonError('Please specify code', 400);
                 }
-                if (codeVal.session.code_challenge !== cv) {
-                    throw new error_1.JacksonError('Invalid code_verifier', 401);
+                const codes = code.split('.');
+                if (codes.length !== 2) {
+                    throw new error_1.JacksonError('Invalid code', 403);
                 }
-                // For Federation flow, we need to verify the client_secret
-                if (client_id === null || client_id === void 0 ? void 0 : client_id.startsWith(`${utils_1.clientIDFederatedPrefix}${utils_1.clientIDOIDCPrefix}`)) {
-                    if (client_id !== ((_d = (_c = codeVal.session) === null || _c === void 0 ? void 0 : _c.oidcFederated) === null || _d === void 0 ? void 0 : _d.clientID) ||
-                        client_secret !== ((_f = (_e = codeVal.session) === null || _e === void 0 ? void 0 : _e.oidcFederated) === null || _f === void 0 ? void 0 : _f.clientSecret)) {
-                        throw new error_1.JacksonError('Invalid client_id or client_secret', 401);
+                const encCodeVal = yield this.codeStore.get(codes[1]);
+                if (!encCodeVal) {
+                    throw new error_1.JacksonError('Invalid code', 403);
+                }
+                const codeVal = decrypt(encCodeVal, codes[0]);
+                if (!codeVal || !codeVal.profile) {
+                    throw new error_1.JacksonError('Invalid code', 403);
+                }
+                protocol = codeVal.requested.protocol || 'saml';
+                login_type = codeVal.isIdPFlow ? 'idp-initiated' : 'sp-initiated';
+                if ((_a = codeVal.requested) === null || _a === void 0 ? void 0 : _a.redirect_uri) {
+                    if (redirect_uri !== codeVal.requested.redirect_uri) {
+                        throw new error_1.JacksonError(`Invalid request: ${!redirect_uri ? 'redirect_uri missing' : 'redirect_uri mismatch'}`, 400);
                     }
                 }
-            }
-            else if (client_id && client_secret) {
-                // check if we have an encoded client_id
-                if (client_id !== 'dummy') {
-                    const sp = (0, utils_1.getEncodedTenantProduct)(client_id);
-                    if (!sp) {
-                        // OAuth flow
-                        if (client_id !== codeVal.clientID || client_secret !== codeVal.clientSecret) {
+                if (code_verifier) {
+                    // PKCE flow
+                    let cv = code_verifier;
+                    if (((_b = codeVal.session.code_challenge_method) === null || _b === void 0 ? void 0 : _b.toLowerCase()) === 's256') {
+                        cv = codeVerifier.encode(code_verifier);
+                    }
+                    if (codeVal.session.code_challenge !== cv) {
+                        throw new error_1.JacksonError('Invalid code_verifier', 401);
+                    }
+                    // For Federation flow, we need to verify the client_secret
+                    if (client_id === null || client_id === void 0 ? void 0 : client_id.startsWith(`${utils_1.clientIDFederatedPrefix}${utils_1.clientIDOIDCPrefix}`)) {
+                        if (client_id !== ((_d = (_c = codeVal.session) === null || _c === void 0 ? void 0 : _c.oidcFederated) === null || _d === void 0 ? void 0 : _d.clientID) ||
+                            client_secret !== ((_f = (_e = codeVal.session) === null || _e === void 0 ? void 0 : _e.oidcFederated) === null || _f === void 0 ? void 0 : _f.clientSecret)) {
                             throw new error_1.JacksonError('Invalid client_id or client_secret', 401);
                         }
                     }
-                    else {
-                        if (!codeVal.isIdPFlow &&
-                            (sp.tenant !== ((_g = codeVal.requested) === null || _g === void 0 ? void 0 : _g.tenant) || sp.product !== ((_h = codeVal.requested) === null || _h === void 0 ? void 0 : _h.product))) {
-                            throw new error_1.JacksonError('Invalid tenant or product', 401);
+                }
+                else if (client_id && client_secret) {
+                    // check if we have an encoded client_id
+                    if (client_id !== 'dummy') {
+                        const sp = (0, utils_1.getEncodedTenantProduct)(client_id);
+                        if (!sp) {
+                            // OAuth flow
+                            if (client_id !== codeVal.clientID || client_secret !== codeVal.clientSecret) {
+                                throw new error_1.JacksonError('Invalid client_id or client_secret', 401);
+                            }
                         }
-                        // encoded client_id, verify client_secret
-                        if (client_secret !== this.opts.clientSecretVerifier) {
+                        else {
+                            if (!codeVal.isIdPFlow &&
+                                (sp.tenant !== ((_g = codeVal.requested) === null || _g === void 0 ? void 0 : _g.tenant) || sp.product !== ((_h = codeVal.requested) === null || _h === void 0 ? void 0 : _h.product))) {
+                                throw new error_1.JacksonError('Invalid tenant or product', 401);
+                            }
+                            // encoded client_id, verify client_secret
+                            if (client_secret !== this.opts.clientSecretVerifier) {
+                                throw new error_1.JacksonError('Invalid client_secret', 401);
+                            }
+                        }
+                    }
+                    else {
+                        if (client_secret !== this.opts.clientSecretVerifier && client_secret !== codeVal.clientSecret) {
                             throw new error_1.JacksonError('Invalid client_secret', 401);
                         }
                     }
                 }
-                else {
-                    if (client_secret !== this.opts.clientSecretVerifier && client_secret !== codeVal.clientSecret) {
-                        throw new error_1.JacksonError('Invalid client_secret', 401);
+                else if (codeVal && codeVal.session) {
+                    throw new error_1.JacksonError('Please specify client_secret or code_verifier', 401);
+                }
+                // store details against a token
+                const token = crypto_1.default.randomBytes(20).toString('hex');
+                const tokenVal = Object.assign(Object.assign({}, codeVal.profile), { requested: codeVal.requested, login_type,
+                    protocol });
+                const requestedOIDCFlow = !!((_j = codeVal.requested) === null || _j === void 0 ? void 0 : _j.oidc);
+                const requestHasNonce = !!((_k = codeVal.requested) === null || _k === void 0 ? void 0 : _k.nonce);
+                if (requestedOIDCFlow) {
+                    const { jwtSigningKeys, jwsAlg } = (_l = this.opts.openid) !== null && _l !== void 0 ? _l : {};
+                    if (!jwtSigningKeys || !(0, utils_1.isJWSKeyPairLoaded)(jwtSigningKeys)) {
+                        throw new error_1.JacksonError(utils_1.GENERIC_ERR_STRING, 500, 'JWT signing keys are not loaded');
                     }
+                    let claims = requestHasNonce ? { nonce: codeVal.requested.nonce } : {};
+                    claims = Object.assign(Object.assign({}, claims), { id: codeVal.profile.claims.id, email: codeVal.profile.claims.email, firstName: codeVal.profile.claims.firstName, lastName: codeVal.profile.claims.lastName, roles: codeVal.profile.claims.roles, groups: codeVal.profile.claims.groups });
+                    const signingKey = yield (0, utils_1.loadJWSPrivateKey)(jwtSigningKeys.private, jwsAlg);
+                    const kid = yield (0, utils_1.computeKid)(jwtSigningKeys.public, jwsAlg);
+                    const id_token = yield new jose.SignJWT(claims)
+                        .setProtectedHeader({ alg: jwsAlg, kid })
+                        .setIssuedAt()
+                        .setIssuer(this.opts.externalUrl)
+                        .setSubject(codeVal.profile.claims.id)
+                        .setAudience(tokenVal.requested.client_id)
+                        .setExpirationTime(`${this.opts.db.ttl}s`) //  identity token only really needs to be valid long enough for it to be verified by the client application.
+                        .sign(signingKey);
+                    tokenVal.id_token = id_token;
+                    tokenVal.claims.sub = codeVal.profile.claims.id;
                 }
-            }
-            else if (codeVal && codeVal.session) {
-                throw new error_1.JacksonError('Please specify client_secret or code_verifier', 401);
-            }
-            // store details against a token
-            const token = crypto_1.default.randomBytes(20).toString('hex');
-            const tokenVal = Object.assign(Object.assign({}, codeVal.profile), { requested: codeVal.requested });
-            const requestedOIDCFlow = !!((_j = codeVal.requested) === null || _j === void 0 ? void 0 : _j.oidc);
-            const requestHasNonce = !!((_k = codeVal.requested) === null || _k === void 0 ? void 0 : _k.nonce);
-            if (requestedOIDCFlow) {
-                const { jwtSigningKeys, jwsAlg } = (_l = this.opts.openid) !== null && _l !== void 0 ? _l : {};
-                if (!jwtSigningKeys || !(0, utils_1.isJWSKeyPairLoaded)(jwtSigningKeys)) {
-                    throw new error_1.JacksonError('JWT signing keys are not loaded', 500);
+                const { hexKey, encVal } = encrypt(tokenVal);
+                yield this.tokenStore.put(token, encVal);
+                // delete the code
+                try {
+                    yield this.codeStore.delete(code);
+                    // eslint-disable-next-line @typescript-eslint/no-unused-vars
                 }
-                let claims = requestHasNonce ? { nonce: codeVal.requested.nonce } : {};
-                claims = Object.assign(Object.assign({}, claims), { id: codeVal.profile.claims.id, email: codeVal.profile.claims.email, firstName: codeVal.profile.claims.firstName, lastName: codeVal.profile.claims.lastName, roles: codeVal.profile.claims.roles, groups: codeVal.profile.claims.groups });
-                const signingKey = yield (0, utils_1.loadJWSPrivateKey)(jwtSigningKeys.private, jwsAlg);
-                const kid = yield (0, utils_1.computeKid)(jwtSigningKeys.public, jwsAlg);
-                const id_token = yield new jose.SignJWT(claims)
-                    .setProtectedHeader({ alg: jwsAlg, kid })
-                    .setIssuedAt()
-                    .setIssuer(this.opts.externalUrl)
-                    .setSubject(codeVal.profile.claims.id)
-                    .setAudience(tokenVal.requested.client_id)
-                    .setExpirationTime(`${this.opts.db.ttl}s`) //  identity token only really needs to be valid long enough for it to be verified by the client application.
-                    .sign(signingKey);
-                tokenVal.id_token = id_token;
-                tokenVal.claims.sub = codeVal.profile.claims.id;
-            }
-            yield this.tokenStore.put(token, tokenVal);
-            // delete the code
-            try {
-                yield this.codeStore.delete(code);
-                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            }
-            catch (_err) {
-                // ignore error
+                catch (_err) {
+                    // ignore error
+                }
+                const tokenResponse = {
+                    access_token: hexKey + '.' + token,
+                    token_type: 'bearer',
+                    expires_in: this.opts.db.ttl,
+                };
+                if (requestedOIDCFlow) {
+                    tokenResponse.id_token = tokenVal.id_token;
+                }
+                return tokenResponse;
             }
-            const tokenResponse = {
-                access_token: token,
-                token_type: 'bearer',
-                expires_in: this.opts.db.ttl,
-            };
-            if (requestedOIDCFlow) {
-                tokenResponse.id_token = tokenVal.id_token;
+            catch (err) {
+                metrics.increment('oauthTokenError', { protocol, login_type });
+                throw err;
             }
-            return tokenResponse;
         });
     }
     /**
@@ -1139,9 +1232,18 @@ class OAuthController {
      */
     userInfo(token) {
         return __awaiter(this, void 0, void 0, function* () {
-            const rsp = yield this.tokenStore.get(token);
+            const tokens = token.split('.');
+            if (tokens.length !== 2) {
+                throw new error_1.JacksonError('Invalid token', 403);
+            }
+            const encRsp = yield this.tokenStore.get(tokens[1]);
+            if (!encRsp) {
+                throw new error_1.JacksonError('Invalid token', 403);
+            }
+            const rsp = decrypt(encRsp, tokens[0]);
             metrics.increment('oauthUserInfo');
             if (!rsp || !rsp.claims) {
+                metrics.increment('oauthUserInfoError', { protocol: rsp.protocol, login_type: rsp.login_type });
                 throw new error_1.JacksonError('Invalid token', 403);
             }
             return Object.assign(Object.assign({}, rsp.claims), { requested: rsp.requested });