@carisls/sso-standard 1.0.6 → 1.1.0

package/cjs/shared/cookies/refreshToken.cjs

@@ -1,6 +1,6 @@
 const { tokenDecoderModule: decodeToken } = require('@carisls/sso-core');
 
-function refreshTokenModule (tokenValidator, encryptor) {
+function refreshTokenModule (encryptor) {
   return async function (res, refreshToken, cookiesSecure) {
   // Process access token if returned
     const token = refreshToken.includes('.') ? decodeToken.data(refreshToken) : refreshToken;

package/cjs/shared/logout.cjs

@@ -1,3 +1,5 @@
+const { stringify } = require('node:querystring');
+
 function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
   router.get(logoutPath, async (req, res) => {
     let idToken = '';
@@ -9,16 +11,15 @@ function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
       idToken = await encryptor.decrypt(req.cookies['x-session-id']);
       res.cookie('x-session-id', 'Removing...', { maxAge: 0 });
     }
-    res.redirect(client.endSessionUrl({
 
+    res.redirect(`${client.issuer.end_session_endpoint}?${stringify({
       // redirect_uri for keycloak
       redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`,
 
       // id_token_hint and post_logout_redirect_uri for okta
       id_token_hint: idToken,
       post_logout_redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`
-
-    }));
+    })}`);
   });
 }
 

package/cjs/standard/codeRequest.cjs

@@ -1,13 +1,9 @@
 const { postForm } = require('@carisls/sso-core');
 
 function codeRequest (client) {
-  const clientId = client.metadata.client_id;
-  const clientSecret = client.metadata.client_secret || undefined;
-  const url = client.issuer.token_endpoint;
-
-  return (code, redirectUri) => postForm(url, {
-    client_id: clientId,
-    client_secret: clientSecret,
+  return (code, redirectUri) => postForm(client.issuer.token_endpoint, {
+    client_id: client.metadata.client_id,
+    client_secret: client.metadata.client_secret,
     grant_type: 'authorization_code',
     code,
     redirect_uri: redirectUri

package/cjs/standard/index.cjs

@@ -18,19 +18,20 @@ function index (router, clientId, clientSecret, issuerSelector, encryptor, userM
   cookieParserModule(router);
 
   // Issuer Selector
-  const keycloakIssuer = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer;
   const tokenValidator = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].validator;
 
   // Instantiate client
-  const client = new keycloakIssuer.Client({
-    client_id: clientId,
-    client_secret: clientSecret,
-    response_types: ['code']
-  });
+  const client = {
+    metadata: {
+      client_id: clientId,
+      client_secret: clientSecret
+    },
+    issuer: issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer
+  };
 
   // Instantiate token modules
   const accessTokenModule = accessTokenModule2(tokenValidator, encryptor, expOffset);
-  const refreshTokenModule = refreshTokenModule2(tokenValidator, encryptor);
+  const refreshTokenModule = refreshTokenModule2(encryptor);
   const idTokenModule = idTokenModule2(encryptor); // id_token must be saved for Okta logout
 
   const codeRequestModule = codeRequestModule2(client);
@@ -45,7 +46,7 @@ function index (router, clientId, clientSecret, issuerSelector, encryptor, userM
   );
 
   // Handle return from standard SSO
-  ssoModule(router, client,
+  ssoModule(router,
     paths?.sso || '/sso',
     codeRequestModule,
     accessTokenModule,

package/cjs/standard/login.cjs

@@ -1,3 +1,5 @@
+const { stringify } = require('node:querystring');
+
 function login (router, client, loginPath, ssoPath, afterLoginPath, groups = true) {
   router.get(loginPath, (req, res) => {
     // Set redirectTo
@@ -10,11 +12,13 @@ function login (router, client, loginPath, ssoPath, afterLoginPath, groups = tru
       scopes.push('groups');
 
     // Standard flow initiates directly
-    res.redirect(client.authorizationUrl({
+    res.redirect(`${client.issuer.authorization_url}?${stringify({
+      client_id: client.metadata.client_id,
+      response_type: 'code',
+      scope: scopes.join(' '),
       redirect_uri: `${req.protocol}://${req.headers.host}${ssoPath}`,
-      state: redirectTo ? Buffer.from(redirectTo).toString('hex') : undefined,
-      scope: scopes.join(' ')
-    }));
+      state: redirectTo ? Buffer.from(redirectTo).toString('base64url') : undefined
+    })}`);
   });
 }
 

package/cjs/standard/refreshRequest.cjs

@@ -1,10 +1,6 @@
 const { postForm } = require('@carisls/sso-core');
 
 function refreshRequest (router, client, encryptor, accessTokenModule, refreshTokenModule, idTokenModule) {
-  const clientId = client.metadata.client_id;
-  const clientSecret = client.metadata.client_secret || undefined;
-  const url = client.issuer.token_endpoint;
-
   router.all('*', (req, res, next) => {
     // Check if SSO cookie is there
     if (req.cookies['x-session']?.length > 36 || req.token || !req.cookies['x-session-sso']) {
@@ -14,9 +10,9 @@ function refreshRequest (router, client, encryptor, accessTokenModule, refreshTo
 
     encryptor
       .decrypt(req.cookies['x-session-sso'])
-      .then(token => postForm(url, {
-        client_id: clientId,
-        client_secret: clientSecret,
+      .then(token => postForm(client.issuer.token_endpoint, {
+        client_id: client.metadata.client_id,
+        client_secret: client.metadata.client_secret,
         grant_type: 'refresh_token',
         refresh_token: token
       }))

package/cjs/standard/sso.cjs

@@ -1,6 +1,6 @@
 const { HttpError } = require('@carisls/sso-core');
 
-function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
+function sso (router, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
   router.get(ssoPath, (req, res, next) => {
     if (!req.query.code) {
       next(new HttpError(500, req.query.error));
@@ -14,7 +14,7 @@ function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, ref
         idTokenModule(res, tokens.id_token, req.protocol === 'https')
       ]))
       .then(() => {
-        res.redirect(req.query.state ? Buffer.from(req.query.state, 'hex').toString('utf8') : '/');
+        res.redirect(req.query.state ? Buffer.from(req.query.state, 'base64url').toString('utf8') : '/');
       })
       .catch((err) => {
         next(err);

package/esm/shared/cookies/refreshToken.js

@@ -1,6 +1,6 @@
 import { tokenDecoderModule as decodeToken } from '@carisls/sso-core';
 
-function refreshTokenModule (tokenValidator, encryptor) {
+function refreshTokenModule (encryptor) {
   return async function (res, refreshToken, cookiesSecure) {
   // Process access token if returned
     const token = refreshToken.includes('.') ? decodeToken.data(refreshToken) : refreshToken;

package/esm/shared/logout.js

@@ -1,3 +1,5 @@
+import { stringify } from 'node:querystring';
+
 function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
   router.get(logoutPath, async (req, res) => {
     let idToken = '';
@@ -9,16 +11,15 @@ function logout (router, client, encryptor, logoutPath, afterLogoutPath) {
       idToken = await encryptor.decrypt(req.cookies['x-session-id']);
       res.cookie('x-session-id', 'Removing...', { maxAge: 0 });
     }
-    res.redirect(client.endSessionUrl({
 
+    res.redirect(`${client.issuer.end_session_endpoint}?${stringify({
       // redirect_uri for keycloak
       redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`,
 
       // id_token_hint and post_logout_redirect_uri for okta
       id_token_hint: idToken,
       post_logout_redirect_uri: `${req.protocol}://${req.headers.host}${afterLogoutPath}`
-
-    }));
+    })}`);
   });
 }
 

package/esm/standard/codeRequest.js

@@ -1,13 +1,9 @@
 import { postForm } from '@carisls/sso-core';
 
 function codeRequest (client) {
-  const clientId = client.metadata.client_id;
-  const clientSecret = client.metadata.client_secret || undefined;
-  const url = client.issuer.token_endpoint;
-
-  return (code, redirectUri) => postForm(url, {
-    client_id: clientId,
-    client_secret: clientSecret,
+  return (code, redirectUri) => postForm(client.issuer.token_endpoint, {
+    client_id: client.metadata.client_id,
+    client_secret: client.metadata.client_secret,
     grant_type: 'authorization_code',
     code,
     redirect_uri: redirectUri

package/esm/standard/index.js

@@ -18,19 +18,20 @@ function index (router, clientId, clientSecret, issuerSelector, encryptor, userM
   cookieParserModule(router);
 
   // Issuer Selector
-  const keycloakIssuer = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer;
   const tokenValidator = issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].validator;
 
   // Instantiate client
-  const client = new keycloakIssuer.Client({
-    client_id: clientId,
-    client_secret: clientSecret,
-    response_types: ['code']
-  });
+  const client = {
+    metadata: {
+      client_id: clientId,
+      client_secret: clientSecret
+    },
+    issuer: issuerSelector.providers[Object.keys(issuerSelector.providers)[0]].issuer
+  };
 
   // Instantiate token modules
   const accessTokenModule = accessTokenModule2(tokenValidator, encryptor, expOffset);
-  const refreshTokenModule = refreshTokenModule2(tokenValidator, encryptor);
+  const refreshTokenModule = refreshTokenModule2(encryptor);
   const idTokenModule = idTokenModule2(encryptor); // id_token must be saved for Okta logout
 
   const codeRequestModule = codeRequestModule2(client);
@@ -45,7 +46,7 @@ function index (router, clientId, clientSecret, issuerSelector, encryptor, userM
   );
 
   // Handle return from standard SSO
-  ssoModule(router, client,
+  ssoModule(router,
     paths?.sso || '/sso',
     codeRequestModule,
     accessTokenModule,

package/esm/standard/login.js

@@ -1,3 +1,5 @@
+import { stringify } from 'node:querystring';
+
 function login (router, client, loginPath, ssoPath, afterLoginPath, groups = true) {
   router.get(loginPath, (req, res) => {
     // Set redirectTo
@@ -10,11 +12,13 @@ function login (router, client, loginPath, ssoPath, afterLoginPath, groups = tru
       scopes.push('groups');
 
     // Standard flow initiates directly
-    res.redirect(client.authorizationUrl({
+    res.redirect(`${client.issuer.authorization_endpoint}?${stringify({
+      client_id: client.metadata.client_id,
+      response_type: 'code',
+      scope: scopes.join(' '),
       redirect_uri: `${req.protocol}://${req.headers.host}${ssoPath}`,
-      state: redirectTo ? Buffer.from(redirectTo).toString('hex') : undefined,
-      scope: scopes.join(' ')
-    }));
+      state: redirectTo ? Buffer.from(redirectTo).toString('base64url') : undefined
+    })}`);
   });
 }
 

package/esm/standard/refreshRequest.js

@@ -1,10 +1,6 @@
 import { postForm } from '@carisls/sso-core';
 
 function refreshRequest (router, client, encryptor, accessTokenModule, refreshTokenModule, idTokenModule) {
-  const clientId = client.metadata.client_id;
-  const clientSecret = client.metadata.client_secret || undefined;
-  const url = client.issuer.token_endpoint;
-
   router.all('*', (req, res, next) => {
     // Check if SSO cookie is there
     if (req.cookies['x-session']?.length > 36 || req.token || !req.cookies['x-session-sso']) {
@@ -14,9 +10,9 @@ function refreshRequest (router, client, encryptor, accessTokenModule, refreshTo
 
     encryptor
       .decrypt(req.cookies['x-session-sso'])
-      .then(token => postForm(url, {
-        client_id: clientId,
-        client_secret: clientSecret,
+      .then(token => postForm(client.issuer.token_endpoint, {
+        client_id: client.metadata.client_id,
+        client_secret: client.metadata.client_secret,
         grant_type: 'refresh_token',
         refresh_token: token
       }))

package/esm/standard/sso.js

@@ -1,6 +1,6 @@
 import { HttpError } from '@carisls/sso-core';
 
-function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
+function sso (router, ssoPath, codeRequestModule, accessTokenModule, refreshTokenModule, idTokenModule) {
   router.get(ssoPath, (req, res, next) => {
     if (!req.query.code) {
       next(new HttpError(500, req.query.error));
@@ -14,7 +14,7 @@ function sso (router, client, ssoPath, codeRequestModule, accessTokenModule, ref
         idTokenModule(res, tokens.id_token, req.protocol === 'https')
       ]))
       .then(() => {
-        res.redirect(req.query.state ? Buffer.from(req.query.state, 'hex').toString('utf8') : '/');
+        res.redirect(req.query.state ? Buffer.from(req.query.state, 'base64url').toString('utf8') : '/');
       })
       .catch((err) => {
         next(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carisls/sso-standard",
-  "version": "1.0.6",
+  "version": "1.1.0",
   "description": "A middleware implementing standard flow SSO",
   "main": "cjs/index.cjs",
   "module": "esm/index.js",
@@ -25,7 +25,7 @@
   "author": "Mihovil Strujic <mstrujic@carisls.com>",
   "license": "MIT",
   "dependencies": {
-    "@carisls/sso-core": "1.0.3",
+    "@carisls/sso-core": "1.1.1",
     "cookie-parser": "^1.4.7",
     "debug": "^4.4.0",
     "express": "^4.21.2"