@hellocoop/express 1.3.0 → 1.5.0

package/dist/handlers/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/handlers/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAO/C,MAAM,MAAM,WAAW,GACnB,MAAM,GAAG;IACL,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB,CAAA;AAEL,eAAO,MAAM,UAAU,QAAwB,OAAO,OAAO,QAAQ,kBAEpE,CAAA;AAED,eAAO,MAAM,SAAS,QAAyB,QAAQ,kBAEtD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAyB,OAAO,OAAO,QAAQ,QAAQ,YAAY,kBAYhG,CAAA;AAED,eAAO,MAAM,UAAU,QAAyB,OAAO,OAAO,QAAQ,eAAe,WAAW,KACtF,QAAQ,IAAI,GAAG,IAAI,CAc5B,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/handlers/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAIzD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAO/C,MAAM,MAAM,WAAW,GACnB,MAAM,GAAG;IACL,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACtB,CAAA;AAEL,eAAO,MAAM,UAAU,QAAwB,OAAO,OAAO,QAAQ,kBAKpE,CAAA;AAED,eAAO,MAAM,SAAS,QAAyB,QAAQ,kBAEtD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAyB,OAAO,OAAO,QAAQ,QAAQ,YAAY,kBAYhG,CAAA;AAED,eAAO,MAAM,UAAU,QAAyB,OAAO,OAAO,QAAQ,eAAe,WAAW,KACtF,QAAQ,IAAI,GAAG,IAAI,CAc5B,CAAA"}

package/dist/handlers/auth.js

@@ -4,6 +4,9 @@ exports.updateAuth = exports.setAuthMiddleware = exports.clearAuth = exports.han
 const auth_1 = require("../lib/auth");
 const auth_2 = require("../lib/auth");
 const handleAuth = async function (req, res) {
+    res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
+    res.setHeader('Pragma', 'no-cache');
+    res.setHeader('Expires', '0');
     res.json(await req.getAuth());
 };
 exports.handleAuth = handleAuth;

package/dist/handlers/callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/handlers/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AA8B3C,QAAA,MAAM,cAAc,QAAe,OAAO,OAAO,QAAQ,uDAwHxD,CAAA;AAED,eAAe,cAAc,CAAA"}
+{"version":3,"file":"callback.d.ts","sourceRoot":"","sources":["../../src/handlers/callback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AA8B3C,QAAA,MAAM,cAAc,QAAe,OAAO,OAAO,QAAQ,uDAuHxD,CAAA;AAED,eAAe,cAAc,CAAA"}

package/dist/handlers/callback.js

@@ -29,11 +29,14 @@ const sendErrorPage = (error, target_uri, req, res) => {
 };
 const handleCallback = async (req, res) => {
     var _a;
-    const { code, error, wildcard_domain, app_name, } = req.query;
+    const { code, error, same_site, wildcard_domain, app_name, } = req.query;
+    if (!same_site) // we need to bounce so we get cookies
+        return res.send((0, core_1.sameSiteCallback)());
     const oidcState = await (0, oidc_1.getOidc)(req, res);
     if (!oidcState)
         return res.status(400).end('OpenID Connect cookie lost');
-    const { code_verifier, nonce, redirect_uri, target_uri } = oidcState;
+    const { code_verifier, nonce, redirect_uri, } = oidcState;
+    let { target_uri = '/' } = oidcState;
     if (error)
         return sendErrorPage(req.query, target_uri, req, res);
     if (!code)
@@ -67,8 +70,6 @@ const handleCallback = async (req, res) => {
         if (payload.iat > currentTimeInt + 5) { // 5 seconds of clock skew
             return res.status(400).end('The ID token is not yet valid.');
         }
-        // let auth = NotLoggedIn
-        let callbackProcessed = false;
         let auth = {
             isLoggedIn: true,
             sub: payload.sub,
@@ -97,9 +98,10 @@ const handleCallback = async (req, res) => {
         if ((_a = config_1.default.callbacks) === null || _a === void 0 ? void 0 : _a.loggedIn) {
             try {
                 const cb = await config_1.default.callbacks.loggedIn({ token, payload, req, res });
-                callbackProcessed = cb === null || cb === void 0 ? void 0 : cb.isProcessed;
-                if (cb === null || cb === void 0 ? void 0 : cb.accessDenied)
+                if (cb === null || cb === void 0 ? void 0 : cb.accessDenied) {
                     auth = auth_1.NotLoggedIn;
+                    // TODO? set target_uri to not logged in setting?
+                }
                 else if (cb === null || cb === void 0 ? void 0 : cb.updatedAuth) {
                     auth = {
                         ...cb.updatedAuth,
@@ -108,6 +110,7 @@ const handleCallback = async (req, res) => {
                         iat: payload.iat
                     };
                 }
+                target_uri = (cb === null || cb === void 0 ? void 0 : cb.target_uri) || target_uri;
             }
             catch (e) {
                 console.error(new Error('callback faulted'));
@@ -115,10 +118,7 @@ const handleCallback = async (req, res) => {
             }
         }
         await (0, auth_1.saveAuthCookie)(res, auth);
-        if (!callbackProcessed) {
-            res.redirect(target_uri
-                || '/'); // just in case
-        }
+        res.json({ target_uri });
     }
     catch (error) {
         (0, oidc_1.clearOidcCookie)(res);

package/dist/handlers/config.d.ts

@@ -9,7 +9,7 @@ export type LoggedInParams = {
 };
 export type LoggedInResponse = {
     accessDenied?: boolean;
-    isProcessed?: boolean;
+    target_uri?: string;
     updatedAuth?: {
         [key: string]: any;
     };

package/dist/handlers/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/handlers/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAInD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAEzB,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,QAAQ,CAAA;CAChB,CAAA;AAGD,MAAM,MAAM,gBAAgB,GAAG;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAA;CACrC,CAAA;AAGD,MAAM,MAAM,MAAM,GAAG;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;KACnE,CAAC;IACF,MAAM,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACJ,CAAA;AAED,eAAO,MAAM,IAAI,WAAsB,MAAM,KAAG,MAQ/C,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/handlers/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAInD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;AAEzB,MAAM,MAAM,cAAc,GAAG;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,QAAQ,CAAA;CAChB,CAAA;AAGD,MAAM,MAAM,gBAAgB,GAAG;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAA;CACrC,CAAA;AAGD,MAAM,MAAM,MAAM,GAAG;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;IAChB,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;KACnE,CAAC;IACF,MAAM,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAA;KACjB,CAAA;CACJ,CAAA;AAED,eAAO,MAAM,IAAI,WAAsB,MAAM,KAAG,MAQ/C,CAAA"}

package/dist/lib/auth.d.ts

@@ -1,6 +1,6 @@
 import { Auth } from '@hellocoop/types';
 import { Request, Response } from 'express';
-export declare const saveAuthCookie: (res: Response, auth: Auth, sameSite?: boolean) => Promise<boolean>;
+export declare const saveAuthCookie: (res: Response, auth: Auth) => Promise<boolean>;
 export declare const clearAuthCookie: (res: Response) => Promise<void>;
 export declare const getAuthfromCookies: (req: Request, res: Response) => Promise<Auth>;
 export declare const NotLoggedIn: Auth;

package/dist/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAwB3C,eAAO,MAAM,cAAc,QAAgB,QAAQ,QAAQ,IAAI,aAAY,OAAO,KAAY,QAAQ,OAAO,CAW5G,CAAA;AAED,eAAO,MAAM,eAAe,QAAgB,QAAQ,kBAKnD,CAAA;AAGD,eAAO,MAAM,kBAAkB,QAChB,OAAO,OAAO,QAAQ,KAC3B,QAAQ,IAAI,CA8BrB,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,IAA2B,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAQ3C,eAAO,MAAM,cAAc,QAAgB,QAAQ,QAAQ,IAAI,KAAG,QAAQ,OAAO,CAgBhF,CAAA;AAED,eAAO,MAAM,eAAe,QAAgB,QAAQ,kBAKnD,CAAA;AAGD,eAAO,MAAM,kBAAkB,QAChB,OAAO,OAAO,QAAQ,KAC3B,QAAQ,IAAI,CAoBrB,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,IAA2B,CAAA"}

package/dist/lib/auth.js

@@ -9,24 +9,17 @@ const config_1 = __importDefault(require("./config"));
 const cookie_1 = require("cookie");
 const oidc_1 = require("./oidc");
 const { cookies: { authName, oidcName } } = config_1.default;
-const laxAuthName = 'lax-' + authName;
-const setEncryptedCookie = (res, sameSite, encCookie) => {
-    const cookieName = sameSite ? authName : laxAuthName;
-    const options = {
-        httpOnly: true,
-        secure: config_1.default.production,
-        path: '/' // let any server side route call getAuth
-    };
-    if (sameSite)
-        options.sameSite = 'strict';
-    res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(cookieName, encCookie, options));
-};
-const saveAuthCookie = async (res, auth, sameSite = false) => {
+const saveAuthCookie = async (res, auth) => {
     try {
         const encCookie = await (0, core_1.encryptObj)(auth, config_1.default.secret);
         if (!encCookie)
             return false;
-        setEncryptedCookie(res, sameSite, encCookie);
+        res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(authName, encCookie, {
+            httpOnly: true,
+            secure: config_1.default.production,
+            sameSite: 'strict',
+            path: '/' // let any server side route call getAuth
+        }));
         return true;
     }
     catch (e) {
@@ -44,18 +37,9 @@ const clearAuthCookie = async (res) => {
 exports.clearAuthCookie = clearAuthCookie;
 const getAuthfromCookies = async function (req, res) {
     const cookies = (0, cookie_1.parse)(req.headers.cookie || '');
-    if (cookies[oidcName]) // clear OIDC cookie it still there
+    if (cookies[oidcName]) // clear OIDC cookie if still there
         (0, oidc_1.clearOidcCookie)(res);
-    const laxAuthCookie = cookies[laxAuthName];
-    if (laxAuthCookie) {
-        // rotate to a sameSite:strict cookie
-        setEncryptedCookie(res, true, laxAuthCookie);
-        res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(laxAuthName, '', {
-            expires: new Date(0),
-            path: '/', // Specify the path
-        }));
-    }
-    const authCookie = cookies[authName] || laxAuthCookie;
+    const authCookie = cookies[authName];
     if (!authCookie)
         return exports.NotLoggedIn;
     try {

package/dist/lib/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/lib/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAO3C,MAAM,MAAM,IAAI,GAAG;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,eAAO,MAAM,OAAO,QAAgB,OAAO,OAAO,QAAQ,KAAG,QAAQ,IAAI,GAAG,SAAS,CAepF,CAAA;AAID,eAAO,MAAM,QAAQ,QAAgB,OAAO,OAAO,QAAQ,QAAQ,IAAI,kBActE,CAAA;AAED,eAAO,MAAM,eAAe,QAAU,QAAQ,SAK7C,CAAA"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../src/lib/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAO3C,MAAM,MAAM,IAAI,GAAG;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,eAAO,MAAM,OAAO,QAAgB,OAAO,OAAO,QAAQ,KAAG,QAAQ,IAAI,GAAG,SAAS,CAepF,CAAA;AAID,eAAO,MAAM,QAAQ,QAAgB,OAAO,OAAO,QAAQ,QAAQ,IAAI,kBAetE,CAAA;AAED,eAAO,MAAM,eAAe,QAAU,QAAQ,SAK7C,CAAA"}

package/dist/lib/oidc.js

@@ -35,6 +35,7 @@ const saveOidc = async (req, res, oidc) => {
         res.appendHeader('Set-Cookie', (0, cookie_1.serialize)(oidcName, encCookie, {
             httpOnly: true,
             secure: config_1.default.production,
+            sameSite: 'strict',
             maxAge: 5 * 60,
             path: apiRoute
         }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellocoop/express",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Express SDK for Hellō https://hello.dev",
   "repository": {
     "type": "git",