@kwirthmagnify/kwirth-common-back 0.5.42 → 0.5.43

package/dist/oidc.d.ts

@@ -1,4 +1,12 @@
 import { IIdpAuthContext, IIdpCallbackContext, IIdpConfigFieldDef, IIdpIdentity } from './IIdpConnector';
+export interface IOidcCallbackOptions {
+    emailClaims?: string[];
+    assumeVerified?: boolean;
+    multiTenant?: boolean;
+    allowedTenants?: string[];
+}
 export declare function oidcConfigSchema(): IIdpConfigFieldDef[];
+export declare function mapOidcIdentity(claims: Record<string, unknown>, opts?: IOidcCallbackOptions): IIdpIdentity;
+export declare function tenantAllowed(tid: string | undefined, allowed?: string[]): boolean;
 export declare function oidcBuildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext, defaultIssuer?: string): Promise<string>;
-export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string): Promise<IIdpIdentity>;
+export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string, opts?: IOidcCallbackOptions): Promise<IIdpIdentity>;

package/dist/oidc.js

@@ -1,17 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oidcConfigSchema = oidcConfigSchema;
+exports.mapOidcIdentity = mapOidcIdentity;
+exports.tenantAllowed = tenantAllowed;
 exports.oidcBuildAuthorizationUrl = oidcBuildAuthorizationUrl;
 exports.oidcHandleCallback = oidcHandleCallback;
 const openid_client_1 = require("openid-client");
-/*
-    Lógica OIDC compartida por todos los conectores OIDC (Google, Keycloak, GitLab, Microsoft, ...).
-    Vive en common-back y el back la expone como global (__kwirth_back__.kwirthCommonBack), de modo
-    que los conectores la usan por composición SIN bundlear openid-client ni duplicar el flujo.
-
-    Flujo Authorization Code + PKCE con intercambio back-channel (el id_token llega por TLS del
-    token endpoint, así que openid-client valida issuer/aud y basta con eso).
-*/
+const jose = __importStar(require("jose"));
 // esquema de config estándar de un IdP OIDC (clientSecret es 'password' → se enmascara en la UI)
 function oidcConfigSchema() {
     return [
@@ -26,15 +54,43 @@ async function makeClient(config, redirectUri, defaultIssuer) {
     if (!issuerUrl)
         throw new Error('OIDC issuer not configured');
     const issuer = await openid_client_1.Issuer.discover(issuerUrl);
-    return new issuer.Client({
+    const client = new issuer.Client({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uris: [redirectUri],
         response_types: ['code']
     });
+    return { issuer, client };
+}
+// mapea los claims del id_token a la identidad de Kwirth (fallback de email + verified asumido)
+function mapOidcIdentity(claims, opts) {
+    const emailClaims = opts?.emailClaims ?? ['email'];
+    let email = '';
+    for (const claim of emailClaims) {
+        const value = claims[claim];
+        if (typeof value === 'string' && value !== '') {
+            email = value;
+            break;
+        }
+    }
+    return {
+        email,
+        emailVerified: claims.email_verified === true || opts?.assumeVerified === true,
+        name: typeof claims.name === 'string' ? claims.name : undefined,
+        sub: claims.sub !== undefined ? String(claims.sub) : undefined
+    };
+}
+// ¿el tenant (tid) está permitido? (allowlist vacía = cualquier tenant)
+function tenantAllowed(tid, allowed) {
+    if (!allowed || allowed.length === 0)
+        return true;
+    if (!tid)
+        return false;
+    const lower = tid.toLowerCase();
+    return allowed.some(t => t.toLowerCase() === lower);
 }
 async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
-    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    const { client } = await makeClient(config, ctx.redirectUri, defaultIssuer);
     const scope = config.scopes || 'openid email profile';
     return client.authorizationUrl({
         scope,
@@ -44,20 +100,42 @@ async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
         code_challenge_method: 'S256'
     });
 }
-async function oidcHandleCallback(config, ctx, defaultIssuer) {
-    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
-    // pasamos los params crudos del callback (incluyen iss para RFC 9207 y state); el state ya lo
-    // valida el core, pero openid-client exige checks.state si el param state viene presente.
+async function oidcHandleCallback(config, ctx, defaultIssuer, opts) {
+    const { issuer, client } = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    if (opts?.multiTenant) {
+        // openid-client valida el iss de forma LITERAL y en multi-tenant el issuer descubierto lleva el
+        // placeholder {tenantid}; hacemos el intercambio crudo (grant, sin validar id_token) y validamos
+        // el id_token a mano con jose: firma (JWKS del issuer) + iss contra el tid concreto del token.
+        const tokenSet = await client.grant({
+            grant_type: 'authorization_code',
+            code: ctx.code,
+            redirect_uri: ctx.redirectUri,
+            code_verifier: ctx.codeVerifier
+        });
+        if (!tokenSet.id_token)
+            throw new Error('OIDC multi-tenant: token response has no id_token');
+        const tid = tokenSet.claims().tid; // sin verificar; solo para conocer el tenant
+        if (!tid)
+            throw new Error('OIDC multi-tenant: id_token has no tid claim');
+        if (!tenantAllowed(tid, opts.allowedTenants))
+            throw new Error(`OIDC multi-tenant: tenant '${tid}' not allowed`);
+        const jwksUri = issuer.metadata.jwks_uri;
+        if (!jwksUri)
+            throw new Error('OIDC multi-tenant: issuer metadata has no jwks_uri');
+        const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+        const { payload } = await jose.jwtVerify(tokenSet.id_token, jwks, {
+            issuer: `https://login.microsoftonline.com/${tid}/v2.0`,
+            audience: config.clientId,
+            clockTolerance: 5
+        });
+        return mapOidcIdentity(payload, opts);
+    }
+    // single-tenant: pasamos los params crudos del callback (incluyen iss para RFC 9207 y state); el state
+    // ya lo valida el core, pero openid-client exige checks.state si el param state viene presente.
     const params = ctx.params ?? { code: ctx.code };
     const checks = { code_verifier: ctx.codeVerifier };
     if (params.state !== undefined)
         checks.state = params.state;
     const tokenSet = await client.callback(ctx.redirectUri, params, checks);
-    const claims = tokenSet.claims();
-    return {
-        email: String(claims.email ?? ''),
-        emailVerified: claims.email_verified === true,
-        name: claims.name ? String(claims.name) : undefined,
-        sub: claims.sub
-    };
+    return mapOidcIdentity(tokenSet.claims(), opts);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwirthmagnify/kwirth-common-back",
-  "version": "0.5.42",
+  "version": "0.5.43",
   "description": "Backend interfaces for building Kwirth provider and channel plugins",
   "scripts": {
     "build": "tsc",
@@ -28,6 +28,7 @@
     "@kubernetes/client-node": "^1.4.0",
     "@kwirthmagnify/kwirth-common": "^0.5.46",
     "express": "^4.18.0",
+    "jose": "^4.15.9",
     "js-yaml": "^4.1.0",
     "openid-client": "^5.7.0"
   },