@functionalcms/svelte-components 2.18.1 → 2.18.2

package/dist/auth/authenticationHandle.js

@@ -1,15 +1,36 @@
 import {} from '@sveltejs/kit';
-import { createSession, getSession } from './sessionstorage.js';
+import { createSession, getSession, deleteSession } from './sessionStorage.js';
 import { keycloak } from './authenticationProvider.js';
-const cookieName = `auth_state`;
-const logout = (cookies) => {
+const authStateCookieName = `auth_state`;
+const authSessionCookieName = `auth_session`;
+const logout = (cookies, afterLogoutPath = '/') => {
     const headers = new Headers();
-    const sid = cookies.get(cookieName);
-    if (sid) {
-        const deleteSessionCookieHeader = `${cookieName}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT;`;
-        const deleteAuthCookieHeader = `auth_session=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT;`;
-        headers.append('Set-Cookie', deleteSessionCookieHeader);
-        headers.append('Set-Cookie', deleteAuthCookieHeader);
+    const state = cookies.get(authSessionCookieName);
+    if (state) {
+        cookies.delete('auth_session', { path: '/' });
+        const sid = cookies.get('auth_session');
+        deleteSession(sid);
+        headers.append('Set-Cookie', 'auth_session=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT;');
+        headers.append('Location', afterLogoutPath);
+    }
+    else {
+        headers.append('Location', '/');
+    }
+    return headers;
+};
+const createUserSession = async (provider, event) => {
+    const token = await provider.getValidation(event);
+    const session = await provider.getUser(token);
+    const headers = new Headers();
+    headers.append('Location', '/');
+    headers.append('Set-Cookie', 'auth_state=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT;');
+    if (session !== undefined) {
+        session.userId = session.sub;
+        event.locals.session = session;
+        event.locals.accessToken = token.access_token;
+        const sessionId = createSession({ session, token }, token.expires_in);
+        headers.append('Set-Cookie', `auth_session=${sessionId}; HttpOnly; Secure; SameSite=strict; Max-Age=${token.expires_in}; Path=/`);
+        headers.append('Location', provider.redirectPath);
     }
     return headers;
 };
@@ -24,45 +45,27 @@ const loadUserFromSession = (cookies, locals) => {
         locals.username = "";
     }
 };
-const getHeadersWithCookie = (sessionId, expiresIn) => {
-    const cookieHeader = `auth_session=${sessionId}; HttpOnly; Secure; SameSite=strict; Max-Age=${expiresIn}; Path=/`;
-    const headers = new Headers();
-    headers.append('Set-Cookie', cookieHeader);
-    return headers;
-};
 export const authenticationHandle = (issuer, clientId, scope = '', redirectPath = '/') => {
     const provider = keycloak(issuer, clientId, scope, redirectPath);
     return async ({ event, resolve }) => {
-        //login user check    
+        //login user check
         if (event.url.pathname.startsWith('/')) {
             loadUserFromSession(event.cookies, event.locals);
         }
-        //logout 
-        if (event.url.pathname === '/auth/logout' && event.cookies.get(cookieName) === undefined) {
-            const headers = logout(event.cookie);
+        //logout
+        if (event.url.pathname === '/auth/logout') {
+            const headers = logout(event.cookies);
             return new Response('Logging Out...', { status: 303, headers });
         }
-        // login 
+        // login
         else if (event.url.pathname === '/auth/login') {
             const authProvider = await provider.getAuthIdentity(event.url.origin);
             return new Response('Redirect', { status: 302, headers: authProvider });
         }
         //validate
         else if (event.url.pathname === "/auth/validate") {
-            const token = await provider.getValidation(event);
-            const session = await provider.getUser(token);
-            if (session !== undefined) {
-                session.userId = session.sub;
-                event.locals.session = session;
-                event.locals.accessToken = token.access_token;
-                const sessionId = createSession({ session, token }, token.expires_in);
-                const headers = getHeadersWithCookie(sessionId, token.expires_in);
-                headers.append('Location', provider.redirectPath);
-                return new Response('Redirect', { status: 303, headers });
-            }
-            else {
-                return new Response(`Error in authorizing user`);
-            }
+            const validationResponse = await createUserSession(provider, event);
+            return new Response('Redirect', { status: 302, headers: validationResponse });
         }
         return await resolve(event);
     };

package/dist/auth/authenticationProvider.js

@@ -1,9 +1,9 @@
 import * as o from "oauth4webapi";
-const cookieName = 'auth_state';
+const aurthStateCookieName = 'auth_state';
 const stateIdGenerator = () => crypto.randomUUID();
 const getKeycloakIdentity = async (issuer, client_id, scope, redirectUrl) => {
     const state = stateIdGenerator();
-    const cookieHeader = `${cookieName}=${state}; HttpOnly; Secure; SameSite=strict; Max-Age=3600; Path=/`;
+    const cookieHeader = `${aurthStateCookieName}=${state}; HttpOnly; Secure; SameSite=strict; Max-Age=3600; Path=/`;
     const code_challenge = await o.calculatePKCECodeChallenge(state);
     const authorizationUrlSearchParams = new URLSearchParams({
         client_id: client_id,
@@ -20,7 +20,7 @@ const getKeycloakIdentity = async (issuer, client_id, scope, redirectUrl) => {
     return headers;
 };
 const getKeycloakValidation = async (issuer, client_id, scope, event, redirectUrl) => {
-    const storedState = event.cookies.get(cookieName);
+    const storedState = event.cookies.get(aurthStateCookieName);
     const state = event.url.searchParams.get("state");
     if (!storedState || !state || storedState !== state) {
         throw new Error('State not valid');
@@ -50,7 +50,7 @@ const getKeycloakValidation = async (issuer, client_id, scope, event, redirectUr
         throw new Error('Token not validated.');
     }
     const token = await response.json();
-    event.cookies.delete(cookieName, { path: '/' });
+    event.cookies.delete(aurthStateCookieName, { path: '/' });
     return token;
 };
 const getUser = async (issuer, token) => {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@functionalcms/svelte-components",
-	"version": "2.18.1",
+	"version": "2.18.2",
 	"watch": {
 		"build": {
 			"patterns": [