@mindful-web/marko-web-auth0-identity-x 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Parameter1 LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,2 @@
+IdentityX + Auth0
+===

package/after-callback.js

@@ -0,0 +1,42 @@
+const { decode } = require('jsonwebtoken');
+
+const { log } = console;
+
+/**
+ * Syncs Auth0 and IdentityX user states
+ *
+ * @param {RequestContext} req
+ * @param {ResponseContext} res
+ * @param {Object} session
+ * @returns Object the Auth0 user session object
+ */
+module.exports = async (req, _, session) => {
+  // Only handle if Auth0 & IdentityX are loaded
+  if (!req.identityX) throw new Error('IdentityX must be enabled and configured!');
+
+  const { identityX: service } = req;
+  const { token } = service;
+  const user = await decode(session.id_token);
+
+  // If there's no Auth0 context, or an IdX context already exists, there's nothing to do here.
+  if (!user || token) return session;
+
+  // Destroy A0 context if no email is present
+  const { email, email_verified: ev } = user;
+  if (!email || !ev) throw new Error('Auth0 user must provide a verified email address.');
+
+  // Upsert the IdentityX AppUser
+  const appUser = await service.createAppUser({ email });
+
+  // federate trusted verification state to IdX and log in via impersonation api
+  try {
+    await service.impersonateAppUser({ userId: appUser.id });
+    log('A0+IdX.cb', 'impersonated', appUser.id);
+  } catch (e) {
+    log('A0+IdX.cb', 'autherr', e);
+    throw e;
+  }
+
+  // Return the user session
+  return session;
+};

package/index.js

@@ -0,0 +1,42 @@
+const Joi = require('@parameter1/joi');
+const { validate } = require('@parameter1/joi/utils');
+const auth0 = require('@mindful-web/marko-web-auth0');
+const identityX = require('@mindful-web/marko-web-identity-x');
+const IdXConfig = require('@mindful-web/marko-web-identity-x/config');
+const middleware = require('./middleware');
+const afterCallback = require('./after-callback');
+
+module.exports = (app, params = {}) => {
+  const {
+    // Auth0 Configs
+    baseURL,
+    clientID,
+    issuerBaseURL,
+    clientSecret,
+    // IdentityX Config
+    idxConfig,
+    idxRouteTemplates,
+  } = validate(Joi.object({
+    baseURL: Joi.string().required().description('The application\'s currently available URL.'),
+    clientID: Joi.string().required().description('The application\'s Auth0 ClientID'),
+    clientSecret: Joi.string().required().description('The application\'s Auth0 Client Secert'),
+    issuerBaseURL: Joi.string().required().description('The Auth0 tenant URL'),
+    idxConfig: Joi.object().required().instance(IdXConfig),
+    idxRouteTemplates: Joi.object().required(),
+  }), params);
+
+  // install identity x
+  identityX(app, idxConfig, { templates: idxRouteTemplates });
+
+  // install auth0 middleware
+  auth0(app, {
+    baseURL,
+    clientID,
+    issuerBaseURL,
+    secret: clientSecret,
+    afterCallback,
+  });
+
+  // Load A0+IdX middleware
+  app.use(middleware);
+};

package/middleware.js

@@ -0,0 +1,71 @@
+const { asyncRoute } = require('@mindful-web/utils');
+
+const isEmpty = (v) => v == null || v === '';
+
+/**
+ * Determines if user input is required.
+ *
+ * @param {*} service The IdentityX service instance
+ * @returns Boolean
+ */
+const isInputRequired = async (service) => {
+  const { user: activeUser, application } = await service.loadActiveContext({ forceQuery: true });
+  const user = activeUser || {};
+
+  // Check that all requires fields (from IdentityX config) are set
+  const requiredFields = service.config.getRequiredServerFields();
+  const requiresUserInput = requiredFields.some((key) => isEmpty(user[key]));
+  if (requiresUserInput) return true;
+
+  // Check that the user does not need to reverify their profile
+  const mustReverify = Boolean(user.mustReVerifyProfile);
+  if (mustReverify) return true;
+
+  // Check that all regional consent policies are agreed to
+  const { regionalConsentPolicies } = application.organization;
+  const matchingPolicies = regionalConsentPolicies.filter((policy) => {
+    const countryCodes = policy.countries.map((country) => country.id);
+    return countryCodes.includes(user.countryCode);
+  });
+  const policiesAnswered = user.regionalConsentAnswers
+    .reduce((o, answer) => ({ ...o, [answer.id]: true }), {});
+  const hasRequiredAnswers = matchingPolicies.length
+    ? matchingPolicies.every((policy) => policiesAnswered[policy.id])
+    : true;
+
+  return !hasRequiredAnswers;
+};
+
+module.exports = asyncRoute(async (req, res, next) => {
+  // Only handle if Auth0 & IdentityX are loaded
+  if (!req.oidc || !req.identityX) throw new Error('Auth0 and IdentityX must be enabled!');
+
+  const { identityX: idxSvc, originalUrl } = req;
+  const { user } = req.oidc;
+
+  // the Auth0 user has been logged out, log out the IdentityX user.
+  if (!user && idxSvc.token) {
+    await idxSvc.logoutAppUser();
+  }
+
+  if (idxSvc.token && req.query.isAuth0Login) {
+    const profile = idxSvc.config.getEndpointFor('profile');
+    const url = new URL(`${req.protocol}://${req.get('host')}${originalUrl}`);
+    url.searchParams.delete('isAuth0Login');
+    const returnTo = `${url}`;
+
+    if (await isInputRequired(idxSvc)) {
+      // If the user attempted to access the profile page, don't redirect after submission.
+      if (url.pathname === profile) {
+        res.redirect(302, profile);
+      } else {
+        res.redirect(302, `${profile}?returnTo=${encodeURIComponent(returnTo)}`);
+      }
+    } else {
+      // Strip the query parameter
+      res.redirect(302, returnTo);
+    }
+  } else {
+    next();
+  }
+});

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@mindful-web/marko-web-auth0-identity-x",
+  "version": "1.0.0",
+  "author": "Josh Worden <josh@parameter1.com>",
+  "repository": "https://github.com/parameter1/mindful-web/tree/main/packages/marko-web-auth0-identity-x",
+  "license": "MIT",
+  "scripts": {
+    "lint:fix": "yarn lint --fix",
+    "lint": "eslint --ext .js --ext .vue --max-warnings 5 --ignore-path ../../.eslintignore ./",
+    "test": "yarn lint"
+  },
+  "dependencies": {
+    "@mindful-web/marko-web-auth0": "^1.0.0",
+    "@mindful-web/marko-web-identity-x": "^1.0.0",
+    "@mindful-web/utils": "^1.0.0",
+    "@parameter1/joi": "^1.2.10",
+    "jsonwebtoken": "^8.5.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "gitHead": "0b77cab713eb5841202bb86c7119949866bc68b5"
+}