@kwirthmagnify/kwirth-common-back 0.5.16 → 0.5.18

package/dist/IIdpConnector.d.ts

@@ -25,6 +25,7 @@ export interface IIdpCallbackContext {
     code: string;
     codeVerifier: string;
     redirectUri: string;
+    params?: Record<string, string>;
 }
 export interface IIdpConnector {
     connectorId: string;

package/dist/index.d.ts

@@ -3,5 +3,6 @@ export * from './IDaemon';
 export * from './IProvider';
 export * from './ISender';
 export * from './IIdpConnector';
+export * from './oidc';
 export * from './KubernetesTools';
 export * from '@kwirthmagnify/kwirth-common';

package/dist/index.js

@@ -19,5 +19,6 @@ __exportStar(require("./IDaemon"), exports);
 __exportStar(require("./IProvider"), exports);
 __exportStar(require("./ISender"), exports);
 __exportStar(require("./IIdpConnector"), exports);
+__exportStar(require("./oidc"), exports);
 __exportStar(require("./KubernetesTools"), exports);
 __exportStar(require("@kwirthmagnify/kwirth-common"), exports);

package/dist/oidc.d.ts

@@ -0,0 +1,4 @@
+import { IIdpAuthContext, IIdpCallbackContext, IIdpConfigFieldDef, IIdpIdentity } from './IIdpConnector';
+export declare function oidcConfigSchema(): IIdpConfigFieldDef[];
+export declare function oidcBuildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext, defaultIssuer?: string): Promise<string>;
+export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string): Promise<IIdpIdentity>;

package/dist/oidc.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcConfigSchema = oidcConfigSchema;
+exports.oidcBuildAuthorizationUrl = oidcBuildAuthorizationUrl;
+exports.oidcHandleCallback = oidcHandleCallback;
+const openid_client_1 = require("openid-client");
+/*
+    Lógica OIDC compartida por todos los conectores OIDC (Google, Keycloak, GitLab, Microsoft, ...).
+    Vive en common-back y el back la expone como global (__kwirth_back__.kwirthCommonBack), de modo
+    que los conectores la usan por composición SIN bundlear openid-client ni duplicar el flujo.
+
+    Flujo Authorization Code + PKCE con intercambio back-channel (el id_token llega por TLS del
+    token endpoint, así que openid-client valida issuer/aud y basta con eso).
+*/
+// esquema de config estándar de un IdP OIDC (clientSecret es 'password' → se enmascara en la UI)
+function oidcConfigSchema() {
+    return [
+        { name: 'clientId', label: 'Client ID', type: 'text', required: true },
+        { name: 'clientSecret', label: 'Client Secret', type: 'password', required: true },
+        { name: 'scopes', label: 'Scopes', type: 'text' },
+        { name: 'issuer', label: 'Issuer URL', type: 'text' }
+    ];
+}
+async function makeClient(config, redirectUri, defaultIssuer) {
+    const issuerUrl = config.issuer || defaultIssuer;
+    if (!issuerUrl)
+        throw new Error('OIDC issuer not configured');
+    const issuer = await openid_client_1.Issuer.discover(issuerUrl);
+    return new issuer.Client({
+        client_id: config.clientId,
+        client_secret: config.clientSecret,
+        redirect_uris: [redirectUri],
+        response_types: ['code']
+    });
+}
+async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
+    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    const scope = config.scopes || 'openid email profile';
+    return client.authorizationUrl({
+        scope,
+        state: ctx.state,
+        redirect_uri: ctx.redirectUri,
+        code_challenge: ctx.codeChallenge,
+        code_challenge_method: 'S256'
+    });
+}
+async function oidcHandleCallback(config, ctx, defaultIssuer) {
+    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    // pasamos los params crudos del callback (incluyen iss para RFC 9207 y state); el state ya lo
+    // valida el core, pero openid-client exige checks.state si el param state viene presente.
+    const params = ctx.params ?? { code: ctx.code };
+    const checks = { code_verifier: ctx.codeVerifier };
+    if (params.state !== undefined)
+        checks.state = params.state;
+    const tokenSet = await client.callback(ctx.redirectUri, params, checks);
+    const claims = tokenSet.claims();
+    return {
+        email: String(claims.email ?? ''),
+        emailVerified: claims.email_verified === true,
+        name: claims.name ? String(claims.name) : undefined,
+        sub: claims.sub
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwirthmagnify/kwirth-common-back",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "Backend interfaces for building Kwirth provider and channel plugins",
   "scripts": {
     "build": "tsc"
@@ -27,7 +27,8 @@
     "@kubernetes/client-node": "^1.4.0",
     "@kwirthmagnify/kwirth-common": "^0.5.14",
     "express": "^4.18.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.1.0",
+    "openid-client": "^5.7.0"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",