@ibgib/space-gib 0.0.6 → 0.0.7

package/src/server/serve-gib/handlers/api/keystone/sso-login.handler.mts

@@ -0,0 +1,189 @@
+import { createHmac } from 'node:crypto';
+import { extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { getIbGibAddr } from '@ibgib/ts-gib/dist/helper.mjs';
+import { loadSsoServerConfig } from '@ibgib/web-gib/dist/identity/sso/sso-config-helper.mjs';
+import { SsoCustodianService } from '@ibgib/web-gib/dist/identity/sso/sso-custodian-service.mjs';
+import { SsoProviderId } from '@ibgib/web-gib/dist/identity/sso/sso-types.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
+
+import { GLOBAL_LOG_A_LOT } from '../../../constants.mjs';
+import { ServeGibHandlerWithMetaspaceBase } from '../../handler-base.mjs';
+import { API_PATH_REGEXES } from '../../../../path-constants.mjs';
+import { ParamsWithDomain, RequestContext, ResponseResult, ServeGibHttpMethod } from '../../../types.mjs';
+
+const logalot = GLOBAL_LOG_A_LOT || true;
+
+let custodian: SsoCustodianService | undefined;
+function getCustodian(): SsoCustodianService {
+    if (!custodian) {
+        const config = loadSsoServerConfig();
+        custodian = new SsoCustodianService(config);
+    }
+    return custodian;
+}
+
+function signSessionToken(payload: any, secret: string): string {
+    const header = { alg: 'HS256', typ: 'JWT' };
+    const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    const data = `${headerB64}.${payloadB64}`;
+    const signature = createHmac('sha256', secret).update(data).digest('base64url');
+    return `${data}.${signature}`;
+}
+
+interface LoginParams extends ParamsWithDomain {
+    parentTjpAddr: string;
+}
+
+interface LoginBody {
+    code: string;
+    providerId: SsoProviderId;
+    parentTjpAddr: string;
+    userNonce: string;
+    redirectUri: string;
+}
+
+/**
+ * POST /api/identity/sso/login
+ *
+ * Exposes login endpoint for SSO authentication. Verifies provider identity, asserts
+ * that the deterministic server-delegate keystone is registered in the parent keystone,
+ * and yields a secure HttpOnly session token.
+ */
+export class SsoLoginHandler extends ServeGibHandlerWithMetaspaceBase<LoginParams, any> {
+    protected override lc: string = `[${SsoLoginHandler.name}]`;
+    protected override method: ServeGibHttpMethod = 'POST';
+    protected override regex = API_PATH_REGEXES.IDENTITY_SSO_LOGIN;
+
+    protected override async parseParamsImpl(reqCtx: RequestContext<LoginParams, any>): Promise<LoginParams | undefined> {
+        let parsed: any;
+        try {
+            parsed = JSON.parse(reqCtx.body);
+        } catch {
+            return undefined;
+        }
+        const parentTjpAddr = parsed?.parentTjpAddr;
+        if (!parentTjpAddr) { return undefined; }
+        return {
+            parentTjpAddr,
+            domainInfo: this.getDomainInfo({ domainAddr: parentTjpAddr })
+        };
+    }
+
+    protected override async validateQueryParams({ queryParams }: { queryParams: any }): Promise<string[]> {
+        return [];
+    }
+
+    protected async handleRouteImpl(reqCtx: RequestContext<LoginParams>): Promise<ResponseResult | undefined> {
+        const lc = `${this.lc}[${this.handleRouteImpl.name}]`;
+        try {
+            if (logalot) { console.log(`${lc} starting...`); }
+
+            if (!reqCtx.params) {
+                return this.error(400, 'Invalid parameters: parentTjpAddr missing');
+            }
+            if (!reqCtx.metaspace) {
+                return this.error(500, 'Metaspace not initialized');
+            }
+
+            let parsed: LoginBody;
+            try {
+                parsed = JSON.parse(reqCtx.body);
+            } catch {
+                return this.error(400, 'Request body must be valid JSON');
+            }
+
+            const { code, providerId, parentTjpAddr, userNonce, redirectUri } = parsed;
+            if (!code || !providerId || !parentTjpAddr || !userNonce || !redirectUri) {
+                return this.error(400, 'Body missing required parameters (code, providerId, parentTjpAddr, userNonce, redirectUri)');
+            }
+
+            const space = await reqCtx.metaspace.getLocalUserSpace({ lock: false });
+            if (!space) {
+                return this.error(500, 'No local user space found in domain metaspace');
+            }
+
+            // 1. Authenticate with provider and retrieve user info
+            const service = getCustodian();
+            const userInfo = await service.getOAuthUserInfo(providerId, code, redirectUri);
+
+            // 2. Derive custodian secret using providerKey and userNonce
+            const custodianSecret = await service.deriveServerDelegateSecret(userInfo.providerKey, userNonce);
+
+            // 3. Fetch latest parent keystone from metaspace
+            const latestParentAddr = await reqCtx.metaspace.getLatestAddr({ addr: parentTjpAddr, space });
+            if (!latestParentAddr) {
+                return this.error(404, `Parent identity keystone not found for address: ${parentTjpAddr}`);
+            }
+
+            const resGet = await reqCtx.metaspace.get({ addr: latestParentAddr, space });
+            const parentKeystone = resGet.ibGibs?.[0];
+            if (!parentKeystone) {
+                return this.error(404, `Parent identity keystone not found in space for address: ${latestParentAddr}`);
+            }
+
+            // 4. Resolve the POOL_ID_CUSTODIAN_MANAGE pool from the parent keystone
+            const custodianPool = parentKeystone.data?.challengePools?.find((p: any) => p.id === POOL_ID_CUSTODIAN_MANAGE);
+            if (!custodianPool) {
+                return this.error(401, `Unauthorized: Custodian pool '${POOL_ID_CUSTODIAN_MANAGE}' is not registered in the parent identity keystone.`);
+            }
+
+            // 5. Assert allowed verbs contain KEYSTONE_VERB_MANAGE
+            const allowedVerbs = custodianPool.config.allowedVerbs || [];
+            if (!allowedVerbs.includes(KEYSTONE_VERB_MANAGE)) {
+                return this.error(401, `Unauthorized: Custodian pool does not have the required manage permission.`);
+            }
+
+            // 6. Cryptographically verify the custodian secret against the pool's challenges
+            const strategy = KeystoneStrategyFactory.create({ config: custodianPool.config });
+            const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+
+            for (const [id, challenge] of Object.entries(custodianPool.challenges)) {
+                const solution = await strategy.generateSolution({
+                    poolSecret,
+                    poolId: custodianPool.id,
+                    challengeId: id
+                });
+                const hashValue = await strategy.generateChallenge({ solution });
+                if (hashValue.hash !== (challenge as any).hash) {
+                    return this.error(401, 'Unauthorized: Cryptographic verification of custodian pool challenges failed.');
+                }
+            }
+
+            // 7. Issue secure HttpOnly session cookie
+            const sessionPayload = {
+                parentTjpAddr,
+                providerKey: userInfo.providerKey,
+                exp: Math.floor(Date.now() / 1000) + 24 * 3600 // 24-hour expiration
+            };
+
+            const config = loadSsoServerConfig();
+            const sessionToken = signSessionToken(sessionPayload, config.sessionSecret);
+
+            const headers = {
+                'Set-Cookie': `space_gib_session=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`
+            };
+
+            console.log(`${lc} login successful for parent: ${parentTjpAddr}, custodian providerKey: ${userInfo.providerKey}`);
+
+            return {
+                status: 200,
+                headers,
+                body: {
+                    success: true,
+                    parentTjpAddr,
+                    custodianPoolId: custodianPool.id
+                },
+                isJson: true
+            };
+
+        } catch (error) {
+            const emsg = extractErrorMsg(error);
+            console.error(`${lc} Login failed: ${emsg}`);
+            return this.error(500, `Login failed: ${emsg}`);
+        } finally {
+            if (logalot) { console.log(`${lc} complete.`); }
+        }
+    }
+}

package/src/server/server.mts

@@ -21,6 +21,9 @@ import { StaticFileHandler } from './serve-gib/handlers/static-handler.mjs';
 import { ErrorHandler } from './serve-gib/handlers/error-handler.mjs';
 import { canHandleWsUpgrade, handleWsEchoUpgrade } from './serve-gib/handlers/api/debug/ws-echo.handler.mjs';
 import { SyncUpgradeHandler } from './serve-gib/handlers/ws/sync-upgrade.handler.mjs';
+import { SsoLinkHandler } from './serve-gib/handlers/api/keystone/sso-link.handler.mjs';
+import { SsoLoginHandler } from './serve-gib/handlers/api/keystone/sso-login.handler.mjs';
+import { SsoConfigHandler } from './serve-gib/handlers/api/keystone/sso-config.handler.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -56,6 +59,9 @@ async function main(): Promise<void> {
                 new KeystoneEvolveHandler(),
                 new KeystonePostHandler(),
                 new KeystoneGetHandler(),
+                new SsoLinkHandler(),
+                new SsoLoginHandler(),
+                new SsoConfigHandler(),
                 new StaticFileHandler(CLIENT_DIR),
             ],
             errorHandler: new ErrorHandler()