@civic/auth 0.0.1--.tsc.alpha.1 → 0.0.1-beta.1

package/src/shared/hooks/useConfig.ts

@@ -1,14 +0,0 @@
-"use client";
-import { useContext } from "react";
-import { ConfigContext } from "@/shared/providers/ConfigProvider.js";
-
-// TokenProvider will use this internal context to access Config
-const useConfig = () => {
-  const context = useContext(ConfigContext);
-  if (!context) {
-    throw new Error("useConfig must be used within an ConfigProvider");
-  }
-  return context;
-};
-
-export { useConfig };

package/src/shared/hooks/useIframe.ts

@@ -1,14 +0,0 @@
-"use client";
-import { useContext } from "react";
-import { IframeContext } from "@/shared/providers/IframeProvider.js";
-
-// TokenProvider will use this internal context to access Iframe
-const useIframe = () => {
-  const context = useContext(IframeContext);
-  if (!context) {
-    throw new Error("useIframe must be used within an IframeProvider");
-  }
-  return context;
-};
-
-export { useIframe };

package/src/shared/hooks/useSession.ts

@@ -1,14 +0,0 @@
-"use client";
-import { useContext } from "react";
-import { SessionContext } from "@/shared/providers/SessionProvider.js";
-
-// TokenProvider will use this internal context to access session
-const useSession = () => {
-  const context = useContext(SessionContext);
-  if (!context) {
-    throw new Error("useSession must be used within an SessionProvider");
-  }
-  return context;
-};
-
-export { useSession };

package/src/shared/hooks/useToken.ts

@@ -1,15 +0,0 @@
-"use client";
-import { useContext } from "react";
-import { TokenContext } from "@/shared/providers/TokenProvider.js";
-
-const useToken = () => {
-  const context = useContext(TokenContext);
-
-  if (!context) {
-    throw new Error("useToken must be used within a TokenProvider");
-  }
-
-  return context;
-};
-
-export { useToken };

package/src/shared/lib/GenericAuthenticationRefresher.ts

@@ -1,75 +0,0 @@
-import type { AuthenticationRefresher } from "@/services/types.js";
-import type { AuthStorage, Endpoints, OIDCTokenResponseBody } from "@/types.js";
-import {
-  getEndpointsWithOverrides,
-  retrieveTokens,
-  storeTokens,
-} from "@/shared/lib/util.js";
-import type { AuthConfig } from "@/server/config.js";
-import { OAuth2Client } from "oslo/oauth2";
-
-export class GenericAuthenticationRefresher implements AuthenticationRefresher {
-  private oauth2client: OAuth2Client | undefined;
-  private endpoints: Endpoints | undefined;
-
-  private constructor(
-    private authConfig: AuthConfig,
-    private storage: AuthStorage,
-    private endpointOverrides?: Partial<Endpoints>,
-  ) {
-    console.log("GenericAuthenticationRefresher constructor", {
-      authConfig,
-      endpointOverrides,
-    });
-  }
-
-  async init(): Promise<this> {
-    // resolve oauth config
-    this.endpoints = await getEndpointsWithOverrides(
-      this.authConfig.oauthServer,
-      this.endpointOverrides,
-    );
-    this.oauth2client = new OAuth2Client(
-      this.authConfig.clientId,
-      this.endpoints.auth,
-      this.endpoints.token,
-      {
-        redirectURI: this.authConfig.redirectUrl,
-      },
-    );
-
-    return this;
-  }
-
-  static async build(
-    authConfig: AuthConfig,
-    storage: AuthStorage,
-    endpointOverrides?: Partial<Endpoints>,
-  ): Promise<GenericAuthenticationRefresher> {
-    const refresher = new GenericAuthenticationRefresher(
-      authConfig,
-      storage,
-      endpointOverrides,
-    );
-    await refresher.init();
-
-    return refresher;
-  }
-
-  async refreshTokens() {
-    if (!this.oauth2client) await this.init();
-
-    const tokens = retrieveTokens(this.storage);
-    if (!tokens?.refresh_token) throw new Error("No refresh token available");
-
-    const oauth2Client = this.oauth2client!;
-    const refreshedTokens =
-      await oauth2Client.refreshAccessToken<OIDCTokenResponseBody>(
-        tokens.refresh_token,
-      );
-
-    storeTokens(this.storage, refreshedTokens);
-
-    return tokens;
-  }
-}

package/src/shared/lib/UserSession.ts

@@ -1,25 +0,0 @@
-import type { AuthStorage, ForwardedTokensJWT, User } from "@/types.js";
-import { UserStorage } from "@/shared/lib/types.js";
-import { convertForwardedTokenFormat } from "@/lib/jwt.js";
-
-export interface UserSession {
-  get(): User | null;
-  set(user: User): void;
-}
-
-export class GenericUserSession implements UserSession {
-  constructor(readonly storage: AuthStorage) {}
-
-  get(): User | null {
-    const user = this.storage.get(UserStorage.USER);
-    return user ? JSON.parse(user) : null;
-  }
-
-  set(user: User | null): void {
-    const forwardedTokens = user?.forwardedTokens
-      ? convertForwardedTokenFormat(user?.forwardedTokens as ForwardedTokensJWT)
-      : null;
-    const value = user ? JSON.stringify({ ...user, forwardedTokens }) : "";
-    this.storage.set(UserStorage.USER, value);
-  }
-}

package/src/shared/lib/session.ts

@@ -1,11 +0,0 @@
-import { retrieveTokens } from "@/shared/lib/util.js";
-import { parseJWT } from "oslo/jwt";
-import type { AuthStorage, User } from "@/types.js";
-
-export async function getUser(storage: AuthStorage): Promise<User | null> {
-  const tokens = retrieveTokens(storage);
-  if (!tokens) return null;
-
-  // Assumes all information is in the ID token
-  return (parseJWT(tokens.id_token)?.payload as User) ?? null;
-}

package/src/shared/lib/storage.ts

@@ -1,40 +0,0 @@
-import type { AuthStorage, SessionData, UnknownObject, User } from "@/types.js";
-
-type SameSiteOption = "strict" | "lax" | "none";
-
-export interface SessionStorage {
-  get(): SessionData;
-  getUser(): User<UnknownObject> | null;
-  set(data: Partial<SessionData>): void;
-  setUser(data: User<UnknownObject> | null): void;
-  clear(): void;
-}
-
-export type CookieStorageSettings = {
-  httpOnly: boolean;
-  secure: boolean;
-  sameSite: SameSiteOption;
-  expires: Date;
-  path: string;
-};
-
-export const DEFAULT_COOKIE_DURATION = 60 * 15; // 15 minutes
-
-export abstract class CookieStorage implements AuthStorage {
-  protected settings: CookieStorageSettings;
-  protected constructor(settings: Partial<CookieStorageSettings> = {}) {
-    this.settings = {
-      httpOnly: settings.httpOnly ?? true,
-      secure: settings.secure ?? true,
-      // the callback request comes the auth server
-      // 'lax' ensures the code_verifier cookie is sent with the request
-      sameSite: settings.sameSite ?? "lax",
-      expires:
-        settings.expires ??
-        new Date(Date.now() + 1000 * DEFAULT_COOKIE_DURATION),
-      path: settings.path ?? "/",
-    };
-  }
-  abstract get(key: string): string | null;
-  abstract set(key: string, value: string): void;
-}

package/src/shared/lib/types.ts

@@ -1,25 +0,0 @@
-export enum OAuthTokens {
-  ID_TOKEN = "id_token",
-  ACCESS_TOKEN = "access_token",
-  REFRESH_TOKEN = "refresh_token",
-}
-
-export enum CodeVerifier {
-  COOKIE_NAME = "code_verifier",
-}
-export enum UserStorage {
-  USER = "user",
-}
-export interface CookieConfig {
-  secure?: boolean;
-  sameSite?: "strict" | "lax" | "none";
-  domain?: string;
-  path?: string;
-  maxAge?: number;
-  httpOnly?: boolean;
-}
-
-export type TokensCookieConfig = Record<
-  OAuthTokens | CodeVerifier,
-  CookieConfig
->;

package/src/shared/lib/util.ts

@@ -1,217 +0,0 @@
-// Utility functions shared by auth server and client integrations
-// Typically these functions should be used inside AuthenticationInitiator and AuthenticationResolver implementations
-
-// Utility functions shared by auth server and client integrations
-// Typically these functions should be used inside AuthenticationInitiator and AuthenticationResolver implementations
-import type {
-  AuthStorage,
-  Endpoints,
-  JWTPayload,
-  OIDCTokenResponseBody,
-  ParsedTokens,
-} from "@/types.js";
-import { CodeVerifier, OAuthTokens } from "./types.js";
-import { OAuth2Client } from "oslo/oauth2";
-import { getIssuerVariations, getOauthEndpoints } from "@/lib/oauth.js";
-import * as jose from "jose";
-import { withoutUndefined } from "@/utils.js";
-import type { PKCEConsumer, PKCEProducer } from "@/services/types.js";
-import { GenericUserSession } from "@/shared/lib/UserSession.js";
-
-/**
- * Given a PKCE code verifier, derive the code challenge using SHA
- */
-export async function deriveCodeChallenge(
-  codeVerifier: string,
-  method: "Plain" | "S256" = "S256",
-): Promise<string> {
-  if (method === "Plain") {
-    console.warn("Using insecure plain code challenge method");
-    return codeVerifier;
-  }
-
-  const encoder = new TextEncoder();
-  const data = encoder.encode(codeVerifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return btoa(String.fromCharCode(...new Uint8Array(digest)))
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/, "");
-}
-
-export async function getEndpointsWithOverrides(
-  oauthServer: string,
-  endpointOverrides: Partial<Endpoints> = {},
-): Promise<Endpoints> {
-  const endpoints = await getOauthEndpoints(oauthServer);
-  return {
-    ...endpoints,
-    ...endpointOverrides,
-  };
-}
-
-export async function generateOauthLoginUrl(config: {
-  clientId: string;
-  scopes: string[];
-  state: string;
-  redirectUrl: string;
-  oauthServer: string;
-  nonce?: string;
-  endpointOverrides?: Partial<Endpoints>;
-  // used to get the PKCE challenge
-  pkceConsumer: PKCEConsumer;
-}): Promise<URL> {
-  const endpoints = await getEndpointsWithOverrides(
-    config.oauthServer,
-    config.endpointOverrides,
-  );
-  const oauth2Client = buildOauth2Client(
-    config.clientId,
-    config.redirectUrl,
-    endpoints,
-  );
-  const challenge = await config.pkceConsumer.getCodeChallenge();
-  const oAuthUrl = await oauth2Client.createAuthorizationURL({
-    state: config.state,
-    scopes: config.scopes,
-  });
-  // The OAuth2 client supports PKCE, but does not allow passing in a code challenge from some other source
-  // It only allows passing in a code verifier which it then hashes itself.
-  oAuthUrl.searchParams.append("code_challenge", challenge);
-  oAuthUrl.searchParams.append("code_challenge_method", "S256");
-  if (config.nonce) {
-    // nonce isn't supported by oslo, so we add it manually
-    oAuthUrl.searchParams.append("nonce", config.nonce);
-  }
-  // Required by the auth server for offline_access scope
-  oAuthUrl.searchParams.append("prompt", "consent");
-
-  console.log("Generated OAuth URL", oAuthUrl.toString());
-  return oAuthUrl;
-}
-
-export async function generateOauthLogoutUrl(config: {
-  clientId: string;
-  scopes: string[];
-  oauthServer: string;
-  endpointOverrides?: Partial<Endpoints>;
-  // used to get the PKCE challenge
-  pkceConsumer: PKCEConsumer;
-}): Promise<URL> {
-  // TODO TECH-676: Implement logout
-  console.log("generateOauthLogoutUrl not implemented", config);
-  return new URL("http://localhost");
-}
-
-export function buildOauth2Client(
-  clientId: string,
-  redirectUri: string,
-  endpoints: Endpoints,
-): OAuth2Client {
-  return new OAuth2Client(clientId, endpoints.auth, endpoints.token, {
-    redirectURI: redirectUri,
-  });
-}
-
-export async function exchangeTokens(
-  code: string,
-  state: string,
-  pkceProducer: PKCEProducer,
-  oauth2Client: OAuth2Client,
-  oauthServer: string,
-  endpoints: Endpoints,
-) {
-  const codeVerifier = await pkceProducer.getCodeVerifier();
-  if (!codeVerifier) throw new Error("Code verifier not found in state");
-
-  const tokens =
-    await oauth2Client.validateAuthorizationCode<OIDCTokenResponseBody>(code, {
-      codeVerifier,
-    });
-
-  // Validate relevant tokens
-  try {
-    await validateOauth2Tokens(tokens, endpoints, oauth2Client, oauthServer);
-  } catch (error) {
-    console.error("tokenExchange error", { error, tokens });
-    throw new Error(
-      `OIDC tokens validation failed: ${(error as Error).message}`,
-    );
-  }
-
-  return tokens;
-}
-
-export function storeTokens(
-  storage: AuthStorage,
-  tokens: OIDCTokenResponseBody,
-) {
-  // store tokens in storage ( TODO we should probably store them against the state to allow multiple logins )
-  storage.set(OAuthTokens.ID_TOKEN, tokens.id_token);
-  storage.set(OAuthTokens.ACCESS_TOKEN, tokens.access_token);
-  if (tokens.refresh_token)
-    storage.set(OAuthTokens.REFRESH_TOKEN, tokens.refresh_token);
-}
-
-export function clearTokens(storage: AuthStorage) {
-  Object.values(OAuthTokens).forEach((cookie) => {
-    storage.set(cookie, "");
-  });
-  Object.values(CodeVerifier.COOKIE_NAME).forEach((cookie) => {
-    storage.set(cookie, "");
-  });
-}
-export function clearUser(storage: AuthStorage) {
-  const userSession = new GenericUserSession(storage);
-  userSession.set(null);
-}
-
-export function retrieveTokens(
-  storage: AuthStorage,
-): OIDCTokenResponseBody | null {
-  const idToken = storage.get(OAuthTokens.ID_TOKEN);
-  const accessToken = storage.get(OAuthTokens.ACCESS_TOKEN);
-  const refreshToken = storage.get(OAuthTokens.REFRESH_TOKEN);
-
-  if (!idToken || !accessToken) return null;
-
-  return {
-    id_token: idToken,
-    access_token: accessToken,
-    refresh_token: refreshToken ?? undefined,
-  };
-}
-
-export async function validateOauth2Tokens(
-  tokens: OIDCTokenResponseBody,
-  endpoints: Endpoints,
-  oauth2Client: OAuth2Client,
-  issuer: string,
-): Promise<ParsedTokens> {
-  const JWKS = jose.createRemoteJWKSet(new URL(endpoints.jwks));
-
-  // validate the ID token
-  const idTokenResponse = await jose.jwtVerify<JWTPayload>(
-    tokens.id_token,
-    JWKS,
-    {
-      issuer: getIssuerVariations(issuer),
-      audience: oauth2Client.clientId,
-    },
-  );
-
-  // validate the access token
-  const accessTokenResponse = await jose.jwtVerify<JWTPayload>(
-    tokens.access_token,
-    JWKS,
-    {
-      issuer: getIssuerVariations(issuer),
-    },
-  );
-
-  return withoutUndefined({
-    id_token: idTokenResponse.payload,
-    access_token: accessTokenResponse.payload,
-    refresh_token: tokens.refresh_token,
-  });
-}

package/src/shared/providers/AuthContext.tsx

@@ -1,11 +0,0 @@
-import { createContext } from "react";
-import type { DisplayMode } from "@/types.js";
-
-export type AuthContextType = {
-  signIn: (displayMode?: DisplayMode) => Promise<void>;
-  isAuthenticated: boolean;
-  isLoading: boolean;
-  error: Error | null;
-  signOut: () => Promise<void>;
-};
-export const AuthContext = createContext<AuthContextType | null>(null);