@kwirthmagnify/kwirth-common-back 0.5.15 → 0.5.17

package/dist/IIdpConnector.d.ts

@@ -0,0 +1,44 @@
+export declare enum EIdpConnectorKind {
+    OIDC = "oidc",
+    OAUTH2 = "oauth2"
+}
+export type IdpFieldType = 'text' | 'number' | 'boolean' | 'password';
+export interface IIdpConfigFieldDef {
+    name: string;
+    label: string;
+    type?: IdpFieldType;
+    required?: boolean;
+    options?: string[];
+}
+export interface IIdpIdentity {
+    email: string;
+    emailVerified: boolean;
+    name?: string;
+    sub?: string;
+}
+export interface IIdpAuthContext {
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+}
+export interface IIdpCallbackContext {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+export interface IIdpConnector {
+    connectorId: string;
+    label: string;
+    kind: EIdpConnectorKind;
+    getConfigSchema(): IIdpConfigFieldDef[];
+    buildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext): Promise<string> | string;
+    handleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext): Promise<IIdpIdentity>;
+}
+export interface IIdpInstanceConfig {
+    id: string;
+    connectorId: string;
+    label: string;
+    enabled: boolean;
+    config: Record<string, unknown>;
+}
+export type TIdpConnectorConstructor = new () => IIdpConnector;

package/dist/IIdpConnector.js

@@ -0,0 +1,18 @@
+"use strict";
+/*
+    Interfaz de conector de Identity Provider (IdP) para Kwirth.
+
+    Un conector es LOGICA PURA (sin rutas propias): construye la URL de autorizacion del IdP
+    y procesa el callback devolviendo la identidad verificada. El flujo HTTP pre-login y la
+    emision de AccessKey viven en el core de Kwirth, nunca en el conector.
+
+    Vive en common-back para que los conectores empaquetados por separado (idps/<id>/) puedan
+    implementarlo importando '@kwirthmagnify/kwirth-common-back', igual que ISender/IProvider.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EIdpConnectorKind = void 0;
+var EIdpConnectorKind;
+(function (EIdpConnectorKind) {
+    EIdpConnectorKind["OIDC"] = "oidc";
+    EIdpConnectorKind["OAUTH2"] = "oauth2";
+})(EIdpConnectorKind || (exports.EIdpConnectorKind = EIdpConnectorKind = {}));

package/dist/IProvider.d.ts

@@ -17,6 +17,7 @@ export interface IProvider {
     addSubscriber(c: IProviderSubscriber, data: any): Promise<void>;
     removeSubscriber(c: IProviderSubscriber): Promise<void>;
     updateSubscription?(c: IProviderSubscriber, data: any): Promise<void>;
+    configure?(config: Record<string, unknown>): void;
     startProvider(): Promise<void>;
     stopProvider(): Promise<void>;
     router: any;

package/dist/index.d.ts

@@ -2,5 +2,7 @@ export * from './IChannel';
 export * from './IDaemon';
 export * from './IProvider';
 export * from './ISender';
+export * from './IIdpConnector';
+export * from './oidc';
 export * from './KubernetesTools';
 export * from '@kwirthmagnify/kwirth-common';

package/dist/index.js

@@ -18,5 +18,7 @@ __exportStar(require("./IChannel"), exports);
 __exportStar(require("./IDaemon"), exports);
 __exportStar(require("./IProvider"), exports);
 __exportStar(require("./ISender"), exports);
+__exportStar(require("./IIdpConnector"), exports);
+__exportStar(require("./oidc"), exports);
 __exportStar(require("./KubernetesTools"), exports);
 __exportStar(require("@kwirthmagnify/kwirth-common"), exports);

package/dist/oidc.d.ts

@@ -0,0 +1,4 @@
+import { IIdpAuthContext, IIdpCallbackContext, IIdpConfigFieldDef, IIdpIdentity } from './IIdpConnector';
+export declare function oidcConfigSchema(): IIdpConfigFieldDef[];
+export declare function oidcBuildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext, defaultIssuer?: string): Promise<string>;
+export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string): Promise<IIdpIdentity>;

package/dist/oidc.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcConfigSchema = oidcConfigSchema;
+exports.oidcBuildAuthorizationUrl = oidcBuildAuthorizationUrl;
+exports.oidcHandleCallback = oidcHandleCallback;
+const openid_client_1 = require("openid-client");
+/*
+    Lógica OIDC compartida por todos los conectores OIDC (Google, Keycloak, GitLab, Microsoft, ...).
+    Vive en common-back y el back la expone como global (__kwirth_back__.kwirthCommonBack), de modo
+    que los conectores la usan por composición SIN bundlear openid-client ni duplicar el flujo.
+
+    Flujo Authorization Code + PKCE con intercambio back-channel (el id_token llega por TLS del
+    token endpoint, así que openid-client valida issuer/aud y basta con eso).
+*/
+// esquema de config estándar de un IdP OIDC (clientSecret es 'password' → se enmascara en la UI)
+function oidcConfigSchema() {
+    return [
+        { name: 'clientId', label: 'Client ID', type: 'text', required: true },
+        { name: 'clientSecret', label: 'Client Secret', type: 'password', required: true },
+        { name: 'scopes', label: 'Scopes', type: 'text' },
+        { name: 'issuer', label: 'Issuer URL', type: 'text' }
+    ];
+}
+async function makeClient(config, redirectUri, defaultIssuer) {
+    const issuerUrl = config.issuer || defaultIssuer;
+    if (!issuerUrl)
+        throw new Error('OIDC issuer not configured');
+    const issuer = await openid_client_1.Issuer.discover(issuerUrl);
+    return new issuer.Client({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uris: [redirectUri],
+        response_types: ['code']
+    });
+}
+async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
+    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    const scope = config.scopes || 'openid email profile';
+    return client.authorizationUrl({
+        scope,
+        state: ctx.state,
+        redirect_uri: ctx.redirectUri,
+        code_challenge: ctx.codeChallenge,
+        code_challenge_method: 'S256'
+    });
+}
+async function oidcHandleCallback(config, ctx, defaultIssuer) {
+    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    const tokenSet = await client.callback(ctx.redirectUri, { code: ctx.code }, { code_verifier: ctx.codeVerifier });
+    const claims = tokenSet.claims();
+    return {
+        email: String(claims.email ?? ''),
+        emailVerified: claims.email_verified === true,
+        name: claims.name ? String(claims.name) : undefined,
+        sub: claims.sub
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwirthmagnify/kwirth-common-back",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Backend interfaces for building Kwirth provider and channel plugins",
   "scripts": {
     "build": "tsc"
@@ -27,7 +27,8 @@
     "@kubernetes/client-node": "^1.4.0",
     "@kwirthmagnify/kwirth-common": "^0.5.14",
     "express": "^4.18.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.1.0",
+    "openid-client": "^5.7.0"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",