@carisls/sso-standard 1.0.0

package/.gitlab-ci.yml

@@ -0,0 +1,16 @@
+stages:
+  - publish
+
+publish:
+  stage: publish
+  image: node:22-alpine
+  before_script: 
+    - echo -e "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> .npmrc
+  script:
+    - npm i
+    - npm run build --if-present
+    - npm publish --access public
+  only: 
+    - main
+  tags:
+    - build-image

package/cjs/authorize.cjs

@@ -0,0 +1,67 @@
+const debugModule = require('debug');
+const debug = debugModule('keycloak-client:token:authorize');
+
+function checkException (url, exceptions) {
+  if (!exceptions || !exceptions.length)
+    return false;
+
+  for (let i = 0; i < exceptions.length; i++) {
+    if (url.length === exceptions[i].length)
+      return true;
+    else if (url.length > exceptions[i].length && url.substr(0, exceptions[i].length) === exceptions[i])
+      return true;
+  }
+  return false;
+}
+/**
+ * @description A helper middleware to perform authorization filtering
+ * @param {*} role Role (string) or an array of roles to filter by (optional)
+ * @param {*} exceptions Array of urls to skip
+ * @param {*} redirectToLogin If user needs to be redirected to login in case of unsuccessful validation
+ * @returns
+ */
+
+function authorize (role, exceptions, redirectToLogin = false) {
+  return (req, res, next) => {
+  // Check if this is login or sso url
+    if (req.url.match(/^\/login/i) || req.url.match(/^\/sso/i)) {
+      debug(`Url ${req.url} is exception from default authorization rules`);
+      next();
+    }
+
+    // Apply exceptions
+    if (checkException(req.url, exceptions)) {
+      debug(`Url ${req.url} is exception from authorization rules`);
+      next();
+    }
+
+    // If there is no known user, return 401
+    else if (!req.user) {
+      debug('User is unknown where required');
+      if (!redirectToLogin)
+        next({ status: 401, message: 'Unauthorized' });
+      else
+        res.redirect('/login?ReturnUrl=' + encodeURIComponent(req.originalUrl));
+    }
+
+    // If user exists but does not belong to a specified role, return 403
+    else if (role && typeof role === 'string' && !req.user.roles?.includes(role)) {
+      debug(`User is known, but it does not have an appropriate role '${role}'`);
+      next({ status: 403, message: 'Forbidden' });
+    }
+
+    // If user exists but does not belong to any of specified roles, return 403
+    else if (role && Array.isArray(role) && !role.some(i => req.user.roles?.includes(i))) {
+      debug(`User is known, but it does not have any required role from the list of roles '${role}'`);
+      next({ status: 403, message: 'Forbidden' });
+    }
+
+    // If user is authorized
+    else {
+      debug('User is known' + (role ? ` and has a needed role '${role}'` : ''));
+      next();
+    }
+  };
+};
+
+module.exports = authorize;

package/cjs/index.cjs

@@ -0,0 +1,79 @@
+const { Router } = require('express');
+const { issuerSelectorModule, encryptorModule, HttpError } = require('@carisls/sso-core');
+const standardRouterModule = require('./standard/index.cjs');
+const authorize = require('./authorize.cjs');
+
+/**
+ *
+ * @param {Object} options Options for this router
+ * @param {string} options.ssoUrl Base url for provider (usually equal to iss)
+ * @param {string} options.clientId SSO Client ID
+ * @param {number} options.publicKeyCache Public key caching expiration (in seconds)
+ * @param {number} options.expOffset Force nenewal of tokens a bit earlier (in case of problems)
+ * @param {Object[]} options.providers An array of different providers
+ * @param {Object[]} options.providers[].ssoUrl Base url for provider (usually equal to iss)
+ * @param {Object[]} options.providers[].iss If different than ssoUrl
+ * @param {Object[]} options.providers[].publicKey If different than ssoUrl
+ * @param {string} options.encPassword Password to be used for cookies encryption
+ * @param {string} options.encPasswordSalt Password salt to be used for cookies encription (optional)
+ * @param {string} options.encIterationCount Iteration Count to be used for cookies encription (optional)
+ * @param {function} options.userMapper A custom userMapper (maps token to user object attached to a request)
+ * @param {Object} options.paths Customizing of default paths used
+ * @param {string} options.paths.login Change default login endpoint from /login
+ * @param {string} options.paths.sso Change default sso return endpoint from /sso
+ * @param {string} options.paths.afterLogin Change default final endpoint after successful login from /
+ * @param {string} options.paths.logout Change default logout init endpoint from /logout
+ * @param {string} options.paths.afterLogout Change default logout final endpoint after a successful logout from /
+ * @returns
+ */
+const router = (options) => {
+  // Check options
+  if (!options)
+    throw Error('You need to set options parameter');
+
+  if (!options.ssoUrl && !options.providers)
+    throw Error('ssoUrl is always required');
+
+  if (!options.clientId && !options.providers)
+    throw Error('clientId is required');
+
+  if (!options.publicKeyCache)
+    options.publicKeyCache = 300;
+
+  if (!options.expOffset)
+    options.expOffset = 0;
+
+  const router = Router();
+
+  (async () => {
+    const providers = options.providers || [];
+    if (!providers.length && options.ssoUrl)
+      providers.push({ iss: options.iss || options.ssoUrl, ssoUrl: options.ssoUrl, publicKey: options.publicKey });
+    const issuerSelector = await issuerSelectorModule(providers, options.publicKeyCache);
+    const encryptor = encryptorModule(options.encPassword, options.encPasswordSalt, options.encIterationCount);
+
+    standardRouterModule(
+      router,
+      options.clientId,
+      options.clientSecret,
+      issuerSelector,
+      encryptor,
+      options.userMapper,
+      options.paths,
+      options.expOffset);
+
+      })()
+    .catch((err) => {
+      router.all('*', (req, res, next) => {
+        next(new HttpError(500, 'SSO settings have failed to load'));
+      });
+      console.error(err);
+    });
+
+  return router;
+};
+
+module.exports = { 
+  router,
+  authorize
+};

package/cjs/shared/cookies/accessToken.cjs

@@ -0,0 +1,20 @@
+function accessTokenModule (tokenValidator, encryptor, expOffset = 0) {
+  return async function (res, accessToken, cookiesSecure, nonce) {
+  // Process access token if returned
+    const { token } = await tokenValidator(accessToken, nonce || undefined);
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(accessToken);
+    res.cookie('x-session', encToken, {
+      httpOnly: true,
+      expires: new Date((token.exp + expOffset) * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+
+    // Return token
+    return { token: accessToken };
+  };
+}
+
+module.exports = accessTokenModule;

package/cjs/shared/cookies/cookieParser.cjs

@@ -0,0 +1,11 @@
+const cookieParserModule = require('cookie-parser');
+function cookieParser (router) {
+  router.all('*', (req, res, next) => {
+    if (req.cookie)
+      next(); // Cookie parser is already attached
+    else
+      cookieParserModule()(req, res, next); // Cookie parser is needed
+  });
+};
+
+module.exports = cookieParser;

package/cjs/shared/cookies/idToken.cjs

@@ -0,0 +1,23 @@
+const { tokenDecoderModule: decodeToken } = require('@carisls/sso-core');
+
+function idTokenModule (encryptor) {
+  return async function (res, idToken, cookiesSecure) {
+  // Process access token if returned
+    const token = idToken.includes('.') ? decodeToken.data(idToken) : idToken;
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(idToken);
+    res.cookie('x-session-id', encToken, {
+      httpOnly: true,
+      // If not provided, refresh_token expires in 8 hours
+      expires: token.exp ? new Date(token.exp * 1000) : new Date(new Date().getTime() + 8 * 60 * 60 * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+
+    // Return token
+    return { idToken };
+  };
+}
+
+module.exports = idTokenModule;

package/cjs/shared/cookies/refreshToken.cjs

@@ -0,0 +1,20 @@
+const { tokenDecoderModule: decodeToken } = require('@carisls/sso-core');
+
+function refreshTokenModule (tokenValidator, encryptor) {
+  return async function (res, refreshToken, cookiesSecure) {
+  // Process access token if returned
+    const token = refreshToken.includes('.') ? decodeToken.data(refreshToken) : refreshToken;
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(refreshToken);
+    res.cookie('x-session-sso', encToken, {
+      httpOnly: true,
+      // If not provided, refresh_token expires in 8 hours
+      expires: token.exp ? new Date(token.exp * 1000) : new Date(new Date().getTime() + 8 * 60 * 60 * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+  };
+}
+
+module.exports = refreshTokenModule;

package/cjs/shared/logout.cjs

@@ -0,0 +1,25 @@
+function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
+  router.get(logoutPath, async (req, res) => {
+    let idToken = '';
+    if (req.cookies['x-session'])
+      res.cookie('x-session', 'Removing...', { maxAge: 0 });
+    if (req.cookies['x-session-sso'])
+      res.cookie('x-session-sso', 'Removing...', { maxAge: 0 });
+    if (req.cookies['x-session-id']) {
+      idToken = await encryptor.decrypt(req.cookies['x-session-id']);
+      res.cookie('x-session-id', 'Removing...', { maxAge: 0 });
+    }
+    res.redirect(client.endSessionUrl({
+
+      // redirect_uri for keycloak
+      redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`,
+
+      // id_token_hint and post_logout_redirect_uri for okta
+      id_token_hint: idToken,
+      post_logout_redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`
+
+    }));
+  });
+};
+
+module.exports = logout;

package/cjs/shared/user.cjs

@@ -0,0 +1,31 @@
+const { tokenDecoderModule: decodeToken, userMapper: userMapperDefault } = require('@carisls/sso-core');
+
+function user (router, encryptor, userMapper) {
+  router.all('*', (req, res, next) => {
+    // Check if cookie is there
+    if (!req.cookies['x-session'] && !req.token) {
+      next();
+      return;
+    }
+
+    const accessTokenDecoder = req.token ? Promise.resolve(req.token) : encryptor.decrypt(req.cookies['x-session']);
+    const idTokenDecoder = req.idToken ? Promise.resolve(req.idToken) : encryptor.decrypt(req.cookies['x-session-id']) ?? Promise.resolve();
+
+    Promise.all([accessTokenDecoder, idTokenDecoder])
+      .then(([tokenEnc, idTokenEnc]) => {
+        req.token = tokenEnc;
+        req.idToken = idTokenEnc;
+        const token = tokenEnc ? decodeToken.data(tokenEnc) : null;
+        const idToken = idTokenEnc ? decodeToken.data(idTokenEnc) : null;
+        req.user = userMapper ? userMapper(token, idToken) : userMapperDefault(token, idToken);
+      })
+      .catch(() => {
+        res.cookie('x-session', 'Removing...', { maxAge: 0, httpOnly: true, secure: req.protocol === 'https', sameSite: 'lax' });
+      })
+      .finally(() => {
+        next();
+      });
+  });
+};
+
+module.exports = user;

package/cjs/standard/codeRequest.cjs

@@ -0,0 +1,17 @@
+const { postForm } = require('@carisls/sso-core');
+
+function codeRequest (client) {
+  const clientId = client.metadata.client_id;
+  const clientSecret = client.metadata.client_secret || undefined;
+  const url = client.issuer.token_endpoint;
+
+  return (code, redirectUri) => postForm(url, {
+    client_id: clientId,
+    client_secret: clientSecret,
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri
+  });
+};
+
+module.exports = codeRequest;

package/cjs/standard/index.cjs

@@ -0,0 +1,74 @@
+const cookieParserModule = require('../shared/cookies/cookieParser.cjs');
+
+const loginModule = require('./login.cjs');
+const ssoModule = require('./sso.cjs');
+const logoutModule = require('../shared/logout.cjs');
+const refreshRequestModule = require('./refreshRequest.cjs');
+const refreshTokenModule2 = require('../shared/cookies/refreshToken.cjs');
+
+const accessTokenModule2 = require('../shared/cookies/accessToken.cjs');
+
+const idTokenModule2 = require('../shared/cookies/idToken.cjs');
+const codeRequestModule2 = require('./codeRequest.cjs');
+
+const userModule = require('../shared/user.cjs');
+
+function index (router, clientId, clientSecret, issuerSelector, encryptor, userMapper, paths, expOffset = 0) {
+  // Add cookieParser
+  cookieParserModule(router);
+
+  // Issuer Selector
+  const keycloakIssuer = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer;
+  const tokenValidator = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].validator;
+
+  // Instantiate client
+  const client = new keycloakIssuer.Client({
+    client_id: clientId,
+    client_secret: clientSecret,
+    response_types: ['code']
+  });
+
+  // Instantiate token modules
+  const accessTokenModule = accessTokenModule2(tokenValidator, encryptor, expOffset);
+  const refreshTokenModule = refreshTokenModule2(tokenValidator, encryptor);
+  const idTokenModule = idTokenModule2(encryptor); // id_token must be saved for Okta logout
+
+  const codeRequestModule = codeRequestModule2(client);
+
+  // Send to SSO login
+  loginModule(router,
+    client,
+    paths?.login || '/login',
+    paths?.sso || '/sso',
+    paths?.afterLogin || '/'
+  );
+
+  // Handle return from standard SSO
+  ssoModule(router, client,
+    paths?.sso || '/sso',
+    codeRequestModule,
+    accessTokenModule,
+    refreshTokenModule,
+    idTokenModule);
+
+  // Remove session
+  logoutModule(router,
+    client,
+    encryptor,
+    paths?.logout || '/logout',
+    paths?.afterLogout || '/'
+  );
+
+  // Check if session needs/can be refreshed
+  refreshRequestModule(router,
+    client,
+    encryptor,
+    accessTokenModule,
+    refreshTokenModule,
+    idTokenModule);
+
+  // Inject user from session cookie if present
+  userModule(router, encryptor, userMapper);
+};
+
+module.exports = index;

package/cjs/standard/login.cjs

@@ -0,0 +1,15 @@
+function login (router, client, loginPath, ssoPath, afterLoginPath) {
+  router.get(loginPath, (req, res) => {
+    // Set redirectTo
+    const redirectTo = req.query.ReturnUrl || afterLoginPath;
+
+    // Standard flow initiates directly
+    res.redirect(client.authorizationUrl({
+      redirect_uri: `${req.protocol}://${req.headers.host}${ssoPath}`,
+      state: redirectTo ? Buffer.from(redirectTo).toString('hex') : undefined,
+      scope: 'openid profile email offline_access groups'
+    }));
+  });
+};
+
+module.exports = login;

package/cjs/standard/refreshRequest.cjs

@@ -0,0 +1,47 @@
+const { postForm } = require('@carisls/sso-core');
+
+function refreshRequest (router, client, encryptor, accessTokenModule, refreshTokenModule, idTokenModule) {
+  const clientId = client.metadata.client_id;
+  const clientSecret = client.metadata.client_secret || undefined;
+  const url = client.issuer.token_endpoint;
+
+  router.all('*', (req, res, next) => {
+    // Check if SSO cookie is there
+    if (req.cookies['x-session']?.length > 36 || req.token || !req.cookies['x-session-sso']) {
+      next();
+      return;
+    }
+
+    encryptor
+      .decrypt(req.cookies['x-session-sso'])
+      .then(token => postForm(url, {
+        client_id: clientId,
+        client_secret: clientSecret,
+        grant_type: 'refresh_token',
+        refresh_token: token
+      }))
+      .then(tokens => Promise.all([
+        accessTokenModule(res, tokens.access_token, req.protocol === 'https'),
+        idTokenModule(res, tokens.id_token, req.protocol === 'https'),
+        refreshTokenModule(res, tokens.refresh_token, req.protocol === 'https')
+      ]))
+      .then(([{ token }, { idToken }]) => {
+        req.token = token;
+        req.idToken = idToken;
+      })
+      .catch((err) => {
+        console.error(err);
+        res.cookie('x-session-sso', 'Removing...', {
+          maxAge: 0,
+          httpOnly: true,
+          secure: req.protocol === 'https',
+          sameSite: 'lax'
+        });
+      })
+      .finally(() => {
+        next();
+      });
+  });
+};
+
+module.exports = refreshRequest;

package/cjs/standard/sso.cjs

@@ -0,0 +1,25 @@
+const { HttpError } = require('@carisls/sso-core');
+
+function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
+  router.get(ssoPath, (req, res, next) => {
+    if (!req.query.code) {
+      next(new HttpError(500, req.query.error));
+      return;
+    }
+
+    codeRequestModule(req.query.code, `${req.protocol}://${req.headers.host}${ssoPath}`)
+      .then((tokens) => Promise.all([
+        accessTokenModule(res, tokens.access_token, req.protocol === 'https'),
+        refreshTokenModule(res, tokens.refresh_token, req.protocol === 'https'),
+        idTokenModule(res, tokens.id_token, req.protocol === 'https')
+      ]))
+      .then(() => {
+        res.redirect(req.query.state ? Buffer.from(req.query.state, 'hex').toString('utf8') : '/');
+      })
+      .catch((err) => {
+        next(err);
+      });
+  });
+};
+
+module.exports = sso;

package/esm/authorize.js

@@ -0,0 +1,67 @@
+import debugModule from 'debug';
+const debug = debugModule('keycloak-client:token:authorize');
+
+function checkException (url, exceptions) {
+  if (!exceptions || !exceptions.length)
+    return false;
+
+  for (let i = 0; i < exceptions.length; i++) {
+    if (url.length === exceptions[i].length)
+      return true;
+    else if (url.length > exceptions[i].length && url.substr(0, exceptions[i].length) === exceptions[i])
+      return true;
+  }
+  return false;
+}
+/**
+ * @description A helper middleware to perform authorization filtering
+ * @param {*} role Role (string) or an array of roles to filter by (optional)
+ * @param {*} exceptions Array of urls to skip
+ * @param {*} redirectToLogin If user needs to be redirected to login in case of unsuccessful validation
+ * @returns
+ */
+
+function authorize (role, exceptions, redirectToLogin = false) {
+  return (req, res, next) => {
+  // Check if this is login or sso url
+    if (req.url.match(/^\/login/i) || req.url.match(/^\/sso/i)) {
+      debug(`Url ${req.url} is exception from default authorization rules`);
+      next();
+    }
+
+    // Apply exceptions
+    if (checkException(req.url, exceptions)) {
+      debug(`Url ${req.url} is exception from authorization rules`);
+      next();
+    }
+
+    // If there is no known user, return 401
+    else if (!req.user) {
+      debug('User is unknown where required');
+      if (!redirectToLogin)
+        next({ status: 401, message: 'Unauthorized' });
+      else
+        res.redirect('/login?ReturnUrl=' + encodeURIComponent(req.originalUrl));
+    }
+
+    // If user exists but does not belong to a specified role, return 403
+    else if (role && typeof role === 'string' && !req.user.roles?.includes(role)) {
+      debug(`User is known, but it does not have an appropriate role '${role}'`);
+      next({ status: 403, message: 'Forbidden' });
+    }
+
+    // If user exists but does not belong to any of specified roles, return 403
+    else if (role && Array.isArray(role) && !role.some(i => req.user.roles?.includes(i))) {
+      debug(`User is known, but it does not have any required role from the list of roles '${role}'`);
+      next({ status: 403, message: 'Forbidden' });
+    }
+
+    // If user is authorized
+    else {
+      debug('User is known' + (role ? ` and has a needed role '${role}'` : ''));
+      next();
+    }
+  };
+};
+
+export default authorize;

package/esm/index.js

@@ -0,0 +1,82 @@
+import { Router } from 'express';
+import { issuerSelectorModule, encryptorModule, HttpError } from '@carisls/sso-core';
+import standardRouterModule from './standard/index.js';
+import authorize from '../cjs/authorize.cjs';
+
+/**
+ *
+ * @param {Object} options Options for this router
+ * @param {string} options.ssoUrl Base url for provider (usually equal to iss)
+ * @param {string} options.clientId SSO Client ID
+ * @param {number} options.publicKeyCache Public key caching expiration (in seconds)
+ * @param {number} options.expOffset Force nenewal of tokens a bit earlier (in case of problems)
+ * @param {Object[]} options.providers An array of different providers
+ * @param {Object[]} options.providers[].ssoUrl Base url for provider (usually equal to iss)
+ * @param {Object[]} options.providers[].iss If different than ssoUrl
+ * @param {Object[]} options.providers[].publicKey If different than ssoUrl
+ * @param {string} options.encPassword Password to be used for cookies encryption
+ * @param {string} options.encPasswordSalt Password salt to be used for cookies encription (optional)
+ * @param {string} options.encIterationCount Iteration Count to be used for cookies encription (optional)
+ * @param {function} options.userMapper A custom userMapper (maps token to user object attached to a request)
+ * @param {Object} options.paths Customizing of default paths used
+ * @param {string} options.paths.login Change default login endpoint from /login
+ * @param {string} options.paths.sso Change default sso return endpoint from /sso
+ * @param {string} options.paths.afterLogin Change default final endpoint after successful login from /
+ * @param {string} options.paths.logout Change default logout init endpoint from /logout
+ * @param {string} options.paths.afterLogout Change default logout final endpoint after a successful logout from /
+ * @param {boolean} options.useCachedSession Whether or not to store access token to cache instead of a cookie (if larger than 4096)
+ * @returns
+ */
+const router = (options) => {
+  // Check options
+  if (!options)
+    throw Error('You need to set options parameter');
+
+  if (!options.ssoUrl && !options.providers)
+    throw Error('ssoUrl is always required');
+
+  if (!options.clientId && !options.providers)
+    throw Error('clientId is required');
+
+  if (!options.publicKeyCache)
+    options.publicKeyCache = 300;
+
+  if (!options.expOffset)
+    options.expOffset = 0;
+
+  const router = Router();
+
+  (async () => {
+    const providers = options.providers || [];
+    if (!providers.length && options.ssoUrl)
+      providers.push({ iss: options.iss || options.ssoUrl, ssoUrl: options.ssoUrl, publicKey: options.publicKey });
+    const issuerSelector = await issuerSelectorModule(providers, options.publicKeyCache);
+    const encryptor = encryptorModule(options.encPassword, options.encPasswordSalt, options.encIterationCount);
+
+    standardRouterModule(
+      router,
+      options.clientId,
+      options.clientSecret,
+      issuerSelector,
+      encryptor,
+      options.userMapper,
+      options.paths,
+      options.expOffset);
+
+  })()
+    .catch((err) => {
+      router.all('*', (req, res, next) => {
+        next(new HttpError(500, 'SSO settings have failed to load'));
+      });
+      console.error(err);
+    });
+
+  return router;
+};
+
+export { router, authorize };
+
+export default { 
+  router,
+  authorize
+}

package/esm/shared/cookies/accessToken.js

@@ -0,0 +1,20 @@
+function accessTokenModule (tokenValidator, encryptor, expOffset = 0) {
+  return async function (res, accessToken, cookiesSecure, nonce) {
+  // Process access token if returned
+    const { token } = await tokenValidator(accessToken, nonce || undefined);
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(accessToken);
+    res.cookie('x-session', encToken, {
+      httpOnly: true,
+      expires: new Date((token.exp + expOffset) * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+
+    // Return token
+    return { token: accessToken };
+  };
+}
+
+export default accessTokenModule;

package/esm/shared/cookies/cookieParser.js

@@ -0,0 +1,11 @@
+import cookieParserModule from 'cookie-parser';
+function cookieParser (router) {
+  router.all('*', (req, res, next) => {
+    if (req.cookie)
+      next(); // Cookie parser is already attached
+    else
+      cookieParserModule()(req, res, next); // Cookie parser is needed
+  });
+};
+
+export default cookieParser;

package/esm/shared/cookies/idToken.js

@@ -0,0 +1,23 @@
+import { tokenDecoderModule as decodeToken } from '@carisls/sso-core';
+
+function idTokenModule (encryptor) {
+  return async function (res, idToken, cookiesSecure) {
+  // Process access token if returned
+    const token = idToken.includes('.') ? decodeToken.data(idToken) : idToken;
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(idToken);
+    res.cookie('x-session-id', encToken, {
+      httpOnly: true,
+      // If not provided, refresh_token expires in 8 hours
+      expires: token.exp ? new Date(token.exp * 1000) : new Date(new Date().getTime() + 8 * 60 * 60 * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+
+    // Return token
+    return { idToken };
+  };
+}
+
+export default idTokenModule;

package/esm/shared/cookies/refreshToken.js

@@ -0,0 +1,20 @@
+import { tokenDecoderModule as decodeToken } from '@carisls/sso-core';
+
+function refreshTokenModule (tokenValidator, encryptor) {
+  return async function (res, refreshToken, cookiesSecure) {
+  // Process access token if returned
+    const token = refreshToken.includes('.') ? decodeToken.data(refreshToken) : refreshToken;
+
+    // Add access_token to cookies
+    const encToken = await encryptor.encrypt(refreshToken);
+    res.cookie('x-session-sso', encToken, {
+      httpOnly: true,
+      // If not provided, refresh_token expires in 8 hours
+      expires: token.exp ? new Date(token.exp * 1000) : new Date(new Date().getTime() + 8 * 60 * 60 * 1000),
+      secure: cookiesSecure,
+      sameSite: 'lax'
+    });
+  };
+}
+
+export default refreshTokenModule;

package/esm/shared/logout.js

@@ -0,0 +1,25 @@
+function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
+  router.get(logoutPath, async (req, res) => {
+    let idToken = '';
+    if (req.cookies['x-session'])
+      res.cookie('x-session', 'Removing...', { maxAge: 0 });
+    if (req.cookies['x-session-sso'])
+      res.cookie('x-session-sso', 'Removing...', { maxAge: 0 });
+    if (req.cookies['x-session-id']) {
+      idToken = await encryptor.decrypt(req.cookies['x-session-id']);
+      res.cookie('x-session-id', 'Removing...', { maxAge: 0 });
+    }
+    res.redirect(client.endSessionUrl({
+
+      // redirect_uri for keycloak
+      redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`,
+
+      // id_token_hint and post_logout_redirect_uri for okta
+      id_token_hint: idToken,
+      post_logout_redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`
+
+    }));
+  });
+};
+
+export default logout;

package/esm/shared/user.js

@@ -0,0 +1,31 @@
+import { tokenDecoderModule as decodeToken, userMapper as userMapperDefault } from '@carisls/sso-core';
+
+function user (router, encryptor, userMapper) {
+  router.all('*', (req, res, next) => {
+    // Check if cookie is there
+    if (!req.cookies['x-session'] && !req.token) {
+      next();
+      return;
+    }
+
+    const accessTokenDecoder = req.token ? Promise.resolve(req.token) : encryptor.decrypt(req.cookies['x-session']);
+    const idTokenDecoder = req.idToken ? Promise.resolve(req.idToken) : encryptor.decrypt(req.cookies['x-session-id']) ?? Promise.resolve();
+
+    Promise.all([accessTokenDecoder, idTokenDecoder])
+      .then(([tokenEnc, idTokenEnc]) => {
+        req.token = tokenEnc;
+        req.idToken = idTokenEnc;
+        const token = tokenEnc ? decodeToken.data(tokenEnc) : null;
+        const idToken = idTokenEnc ? decodeToken.data(idTokenEnc) : null;
+        req.user = userMapper ? userMapper(token, idToken) : userMapperDefault(token, idToken);
+      })
+      .catch(() => {
+        res.cookie('x-session', 'Removing...', { maxAge: 0, httpOnly: true, secure: req.protocol === 'https', sameSite: 'lax' });
+      })
+      .finally(() => {
+        next();
+      });
+  });
+};
+
+export default user;

package/esm/standard/codeRequest.js

@@ -0,0 +1,17 @@
+import { postForm } from '@carisls/sso-core';
+
+function codeRequest (client) {
+  const clientId = client.metadata.client_id;
+  const clientSecret = client.metadata.client_secret || undefined;
+  const url = client.issuer.token_endpoint;
+
+  return (code, redirectUri) => postForm(url, {
+    client_id: clientId,
+    client_secret: clientSecret,
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri
+  });
+};
+
+export default codeRequest;

package/esm/standard/index.js

@@ -0,0 +1,74 @@
+import cookieParserModule from '../shared/cookies/cookieParser.js';
+
+import loginModule from './login.js';
+import ssoModule from './sso.js';
+import logoutModule from '../shared/logout.js';
+import refreshRequestModule from './refreshRequest.js';
+import refreshTokenModule2 from '../shared/cookies/refreshToken.js';
+
+import accessTokenModule2 from '../shared/cookies/accessToken.js';
+
+import idTokenModule2 from '../shared/cookies/idToken.js';
+import codeRequestModule2 from './codeRequest.js';
+
+import userModule from '../shared/user.js';
+
+function index (router, clientId, clientSecret, issuerSelector, encryptor, userMapper, paths, expOffset = 0) {
+  // Add cookieParser
+  cookieParserModule(router);
+
+  // Issuer Selector
+  const keycloakIssuer = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer;
+  const tokenValidator = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].validator;
+
+  // Instantiate client
+  const client = new keycloakIssuer.Client({
+    client_id: clientId,
+    client_secret: clientSecret,
+    response_types: ['code']
+  });
+
+  // Instantiate token modules
+  const accessTokenModule = accessTokenModule2(tokenValidator, encryptor, expOffset);
+  const refreshTokenModule = refreshTokenModule2(tokenValidator, encryptor);
+  const idTokenModule = idTokenModule2(encryptor); // id_token must be saved for Okta logout
+
+  const codeRequestModule = codeRequestModule2(client);
+
+  // Send to SSO login
+  loginModule(router,
+    client,
+    paths?.login || '/login',
+    paths?.sso || '/sso',
+    paths?.afterLogin || '/'
+  );
+
+  // Handle return from standard SSO
+  ssoModule(router, client,
+    paths?.sso || '/sso',
+    codeRequestModule,
+    accessTokenModule,
+    refreshTokenModule,
+    idTokenModule);
+
+  // Remove session
+  logoutModule(router,
+    client,
+    encryptor,
+    paths?.logout || '/logout',
+    paths?.afterLogout || '/'
+  );
+
+  // Check if session needs/can be refreshed
+  refreshRequestModule(router,
+    client,
+    encryptor,
+    accessTokenModule,
+    refreshTokenModule,
+    idTokenModule);
+
+  // Inject user from session cookie if present
+  userModule(router, encryptor, userMapper);
+};
+
+export default index;

package/esm/standard/login.js

@@ -0,0 +1,15 @@
+function login (router, client, loginPath, ssoPath, afterLoginPath) {
+  router.get(loginPath, (req, res) => {
+    // Set redirectTo
+    const redirectTo = req.query.ReturnUrl || afterLoginPath;
+
+    // Standard flow initiates directly
+    res.redirect(client.authorizationUrl({
+      redirect_uri: `${req.protocol}://${req.headers.host}${ssoPath}`,
+      state: redirectTo ? Buffer.from(redirectTo).toString('hex') : undefined,
+      scope: 'openid profile email offline_access groups'
+    }));
+  });
+};
+
+export default login;

package/esm/standard/refreshRequest.js

@@ -0,0 +1,47 @@
+import { postForm } from '@carisls/sso-core';
+
+function refreshRequest (router, client, encryptor, accessTokenModule, refreshTokenModule, idTokenModule) {
+  const clientId = client.metadata.client_id;
+  const clientSecret = client.metadata.client_secret || undefined;
+  const url = client.issuer.token_endpoint;
+
+  router.all('*', (req, res, next) => {
+    // Check if SSO cookie is there
+    if (req.cookies['x-session']?.length > 36 || req.token || !req.cookies['x-session-sso']) {
+      next();
+      return;
+    }
+
+    encryptor
+      .decrypt(req.cookies['x-session-sso'])
+      .then(token => postForm(url, {
+        client_id: clientId,
+        client_secret: clientSecret,
+        grant_type: 'refresh_token',
+        refresh_token: token
+      }))
+      .then(tokens => Promise.all([
+        accessTokenModule(res, tokens.access_token, req.protocol === 'https'),
+        idTokenModule(res, tokens.id_token, req.protocol === 'https'),
+        refreshTokenModule(res, tokens.refresh_token, req.protocol === 'https')
+      ]))
+      .then(([{ token }, { idToken }]) => {
+        req.token = token;
+        req.idToken = idToken;
+      })
+      .catch((err) => {
+        console.error(err);
+        res.cookie('x-session-sso', 'Removing...', {
+          maxAge: 0,
+          httpOnly: true,
+          secure: req.protocol === 'https',
+          sameSite: 'lax'
+        });
+      })
+      .finally(() => {
+        next();
+      });
+  });
+};
+
+export default refreshRequest;

package/esm/standard/sso.js

@@ -0,0 +1,25 @@
+import { HttpError } from '@carisls/sso-core';
+
+function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
+  router.get(ssoPath, (req, res, next) => {
+    if (!req.query.code) {
+      next(new HttpError(500, req.query.error));
+      return;
+    }
+
+    codeRequestModule(req.query.code, `${req.protocol}://${req.headers.host}${ssoPath}`)
+      .then((tokens) => Promise.all([
+        accessTokenModule(res, tokens.access_token, req.protocol === 'https'),
+        refreshTokenModule(res, tokens.refresh_token, req.protocol === 'https'),
+        idTokenModule(res, tokens.id_token, req.protocol === 'https')
+      ]))
+      .then(() => {
+        res.redirect(req.query.state ? Buffer.from(req.query.state, 'hex').toString('utf8') : '/');
+      })
+      .catch((err) => {
+        next(err);
+      });
+  });
+};
+
+export default sso;

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@carisls/sso-standard",
+  "version": "1.0.0",
+  "description": "A middleware implementing standard flow SSO",
+  "main": "cjs/index.cjs",
+  "module": "esm/index.js",
+  "type": "module",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "sso",
+    "openid",
+    "okta",
+    "keycloak"
+  ],
+  "author": "Mihovil Strujic <mstrujic@carisls.com>",
+  "license": "MIT",
+  "dependencies": {
+    "@carisls/sso-core": "^1.0.0",
+    "cookie-parser": "^1.4.6",
+    "express": "^4.19.2"
+  }
+}