@hahnpro/hpc-api 3.4.2 → 3.4.3

package/dist/http.service.d.ts

@@ -7,8 +7,8 @@ export declare class HttpClient {
     private readonly clientId;
     private readonly clientSecret;
     private readonly axiosInstance;
+    private readonly authAxiosInstance;
     private readonly requestQueue;
-    private client;
     private tokenSet;
     eventSourcesMap: Map<string, {
         eventSource: EventSource;
@@ -31,4 +31,7 @@ export declare class HttpClient {
     destroyEventSource(id: string): void;
     destroyAllEventSources(): void;
     getAccessToken: () => Promise<string>;
+    private validateIssuer;
+    private discoverIssuer;
+    private requestAccessToken;
 }

package/dist/http.service.js

@@ -4,9 +4,11 @@ exports.HttpClient = void 0;
 const tslib_1 = require("tslib");
 const axios_1 = tslib_1.__importDefault(require("axios"));
 const eventsource_1 = tslib_1.__importDefault(require("eventsource"));
-const openid_client_1 = require("openid-client");
-const Queue_1 = require("./Queue");
 const crypto_1 = require("crypto");
+const jose_1 = require("jose");
+const Queue_1 = require("./Queue");
+const token_set_1 = require("./token-set");
+const querystring_1 = require("querystring");
 const TOKEN_EXPIRATION_BUFFER = 30;
 class HttpClient {
     constructor(baseURL, authBaseURL, realm, clientId, clientSecret) {
@@ -33,21 +35,13 @@ class HttpClient {
             }));
         };
         this.getAccessToken = async () => {
-            var _a;
-            if (!((_a = this.client) === null || _a === void 0 ? void 0 : _a.issuer)) {
-                const authIssuer = await openid_client_1.Issuer.discover(`${this.authBaseURL}/realms/${this.realm}/`);
-                this.client = await new authIssuer.Client({
-                    client_id: this.clientId,
-                    client_secret: this.clientSecret,
-                    token_endpoint_auth_method: 'client_secret_jwt',
-                });
-            }
-            if (!this.tokenSet || this.tokenSet.expired() || this.tokenSet.expires_at < Date.now() / 1000 + TOKEN_EXPIRATION_BUFFER) {
-                this.tokenSet = await this.client.grant({ grant_type: 'client_credentials' });
+            if (!this.tokenSet || this.tokenSet.expired() || this.tokenSet.expiresAt < Date.now() / 1000 + TOKEN_EXPIRATION_BUFFER) {
+                return this.requestAccessToken();
             }
             return this.tokenSet.access_token;
         };
         this.axiosInstance = axios_1.default.create({ baseURL, timeout: 60000 });
+        this.authAxiosInstance = axios_1.default.create({ baseURL: authBaseURL || baseURL, timeout: 10000 });
         this.requestQueue = new Queue_1.Queue({ concurrency: 1, timeout: 70000, throwOnTimeout: true });
     }
     async addEventSource(url, listener, errorListener) {
@@ -80,5 +74,60 @@ class HttpClient {
             this.destroyEventSource(key);
         }
     }
+    validateIssuer(issuer) {
+        var _a, _b;
+        if (!issuer.issuer ||
+            !((_a = issuer.grant_types_supported) === null || _a === void 0 ? void 0 : _a.includes('client_credentials')) ||
+            !((_b = issuer.token_endpoint_auth_methods_supported) === null || _b === void 0 ? void 0 : _b.includes('client_secret_jwt'))) {
+            throw new Error('Issuer does not support client_secret_jwt');
+        }
+        return issuer;
+    }
+    async discoverIssuer(uri) {
+        const wellKnownUri = `${uri}/.well-known/openid-configuration`;
+        const issuerResponse = await this.authAxiosInstance.get(wellKnownUri, {
+            responseType: 'json',
+            headers: { Accept: 'application/json' },
+        });
+        return this.validateIssuer(issuerResponse.data);
+    }
+    async requestAccessToken() {
+        var _a, _b;
+        const issuer = await this.discoverIssuer(`${this.authBaseURL}/realms/${this.realm}`);
+        const timestamp = Date.now() / 1000;
+        const audience = [...new Set([issuer.issuer, issuer.token_endpoint].filter(Boolean))];
+        const assertionPayload = {
+            iat: timestamp,
+            exp: timestamp + 60,
+            jti: (0, crypto_1.randomUUID)(),
+            iss: this.clientId,
+            sub: this.clientId,
+            aud: audience,
+        };
+        const supportedAlgos = issuer.token_endpoint_auth_signing_alg_values_supported;
+        const alg = (_a = issuer.token_endpoint_auth_signing_alg) !== null && _a !== void 0 ? _a : (Array.isArray(supportedAlgos) && supportedAlgos.find((signAlg) => /^HS(?:256|384|512)/.test(signAlg)));
+        if (!alg) {
+            throw new Error('Issuer has to support HS256, HS384 or HS512');
+        }
+        const assertion = await new jose_1.CompactSign(Buffer.from(JSON.stringify(assertionPayload)))
+            .setProtectedHeader({ alg })
+            .sign(new TextEncoder().encode(this.clientSecret));
+        const opts = {
+            client_id: this.clientId,
+            client_assertion: assertion,
+            client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+            grant_type: 'client_credentials',
+        };
+        const authResponse = await this.authAxiosInstance.post(issuer.token_endpoint, (0, querystring_1.stringify)(opts), {
+            headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        });
+        if (((_b = authResponse === null || authResponse === void 0 ? void 0 : authResponse.data) === null || _b === void 0 ? void 0 : _b.access_token) && authResponse.data.expires_in) {
+            this.tokenSet = new token_set_1.TokenSet(authResponse.data.access_token, authResponse.data.expires_in);
+            return authResponse.data.access_token;
+        }
+        else {
+            throw new Error('Invalid access token received');
+        }
+    }
 }
 exports.HttpClient = HttpClient;

package/dist/token-set.d.ts

@@ -0,0 +1,8 @@
+export declare class TokenSet {
+    expiresAt: number;
+    access_token: string;
+    constructor(access_token: string, expires_in: number);
+    set expires_in(value: number);
+    get expires_in(): number;
+    expired(): boolean;
+}

package/dist/token-set.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSet = void 0;
+class TokenSet {
+    constructor(access_token, expires_in) {
+        this.expires_in = expires_in;
+        this.access_token = access_token;
+    }
+    set expires_in(value) {
+        this.expiresAt = Date.now() + Number(value);
+    }
+    get expires_in() {
+        return Math.max(this.expiresAt - Date.now(), 0);
+    }
+    expired() {
+        return this.expires_in === 0;
+    }
+}
+exports.TokenSet = TokenSet;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hahnpro/hpc-api",
-  "version": "3.4.2",
+  "version": "3.4.3",
   "description": "Module for easy access to the HahnPRO API",
   "license": "MIT",
   "author": {
@@ -27,15 +27,14 @@
     "axios": "~0.27.2",
     "eventsource": "^2.0.2",
     "form-data": "^4.0.0",
+    "jose": "^4.8.3",
     "jwt-decode": "^3.1.2",
-    "openid-client": "^5.1.8",
     "p-queue": "^6.6.2",
     "ts-mixer": "^6.0.1"
   },
   "devDependencies": {
     "@types/eventsource": "^1.1.9",
-    "axios-mock-adapter": "^1.21.2",
-    "nock": "^13.2.9"
+    "axios-mock-adapter": "^1.21.2"
   },
   "engines": {
     "node": ">=v14.13"