@ministryofjustice/hmpps-prisoner-auth 0.0.2 → 0.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ministryofjustice/hmpps-prisoner-auth",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Middleware for providing authentication against Launchpad Auth",
   "author": "hmpps-launchpad-devs",
   "license": "MIT",
@@ -18,8 +18,7 @@
   "types": "./dist/index.d.ts",
   "files": [
     "*.md",
-    "dist/**/*",
-    "src/**/*"
+    "dist/**/*"
   ],
   "engines": {
     "node": "24"

package/src/main/index.ts

@@ -1,3 +0,0 @@
-export { default as PrisonerAuth, type PrisonerAuthOptions } from './prisonerAuth'
-export { minutes, seconds, milliseconds, nothing, TimeSpan } from './timeSpans'
-export type { LaunchpadUser } from './launchpadUser'

package/src/main/launchpadUser.test.ts

@@ -1,41 +0,0 @@
-import jwt from 'jsonwebtoken'
-import { userFromTokens } from './launchpadUser'
-
-describe('userFromTokens', () => {
-  const aJwtOf = (obj: object): string => jwt.sign(obj, 'secret')
-
-  const idToken = aJwtOf({
-    name: 'Test User',
-    given_name: 'Test',
-    family_name: 'User',
-    establishment: { agency_id: 'CKI' },
-    sub: '12345',
-  })
-  const accessToken = aJwtOf({ hello: 'world' })
-  const refreshToken = aJwtOf({ hello: 'world' })
-
-  it('sets the given tokens on the user for later use (refreshing tokens)', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-
-    expect(result.idToken).toEqual(idToken)
-    expect(result.accessToken).toEqual(accessToken)
-    expect(result.refreshToken).toEqual(refreshToken)
-  })
-
-  it('sets the establishment from the idToken', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.establishment).toEqual({ agency_id: 'CKI' })
-  })
-
-  it('sets the name fields from the idToken', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.name).toEqual('Test User')
-    expect(result.givenName).toEqual('Test')
-    expect(result.familyName).toEqual('User')
-  })
-
-  it('sets authSource to give compatibility with the HmppsUser interface', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.authSource).toEqual('prisoner-auth')
-  })
-})

package/src/main/launchpadUser.ts

@@ -1,42 +0,0 @@
-import { IdToken, RawTokens, tokenFromJwt } from './tokens'
-
-export type LaunchpadUser = {
-  authSource: 'prisoner-auth'
-  idToken: string
-  refreshToken: string
-  accessToken: string
-  establishment: IdToken['establishment']
-  name: string
-  givenName: string
-  familyName: string
-
-  // The following fields are for compatibility with HmppsUser only
-  token: string
-  username: string
-  userId: string
-  displayName: string
-  userRoles: string[]
-}
-
-export const userFromTokens = ({ idToken, accessToken, refreshToken }: RawTokens): LaunchpadUser => {
-  const { establishment, name, given_name: givenName, family_name: familyName, sub } = tokenFromJwt<IdToken>(idToken)
-  const authSource = 'prisoner-auth'
-
-  return {
-    authSource,
-    idToken,
-    refreshToken,
-    accessToken,
-    establishment,
-    name,
-    givenName,
-    familyName,
-
-    // The following fields are for compatibility with HmppsUser only
-    token: idToken,
-    username: name,
-    userId: sub,
-    displayName: name,
-    userRoles: [],
-  }
-}

package/src/main/prisonerAuth.test.ts

@@ -1,117 +0,0 @@
-import { minutes, timeAgo, timeFromNow } from './timeSpans'
-import PrisonerAuth, { PrisonerAuthOptions } from './prisonerAuth'
-import { LaunchpadUser } from './launchpadUser'
-import { AccessToken, IdToken, RefreshToken, tokenFromJwt } from './tokens'
-import { aJwtOf, aUserWith } from './testUtils'
-
-describe('PrisonerAuth', () => {
-  const options: PrisonerAuthOptions = {
-    launchpadAuthUrl: 'https://launchpad.example.com',
-    clientId: 'cf837899-2a3c-4838-aa83-5fb76bd58df1',
-    clientSecret: '445f30b2-1010-4bcb-8cba-447b70463bd0',
-    tokenMinimumLifespan: minutes(5),
-  }
-
-  describe('setting options', () => {
-    it('sets sane defaults for the URL options', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.authorizationUrl).toEqual('https://launchpad.example.com/v1/oauth2/authorize')
-      expect(prisonerAuth.tokenUrl).toEqual('https://launchpad.example.com/v1/oauth2/token')
-    })
-
-    it('allows custom override of the URL options', () => {
-      const prisonerAuth = new PrisonerAuth({
-        ...options,
-        authorizationUrl: 'https://auth.com',
-        tokenUrl: 'https://token.com',
-      })
-      expect(prisonerAuth.authorizationUrl).toEqual('https://auth.com')
-      expect(prisonerAuth.tokenUrl).toEqual('https://token.com')
-    })
-
-    it('sets the client credentials', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.clientId).toEqual('cf837899-2a3c-4838-aa83-5fb76bd58df1')
-      expect(prisonerAuth.clientSecret).toEqual('445f30b2-1010-4bcb-8cba-447b70463bd0')
-    })
-
-    it('allows overriding of the callbackUrl', () => {
-      const prisonerAuth = new PrisonerAuth({ ...options, callbackUrl: '/my/call/back' })
-      expect(prisonerAuth.callbackUrl).toEqual('/my/call/back')
-    })
-
-    it('sets a default callbackUrl when none provided', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.callbackUrl).toEqual('/sign-in/callback')
-    })
-
-    it('allows overriding of the scopes', () => {
-      const prisonerAuth = new PrisonerAuth({ ...options, scope: 'user.basic.read' })
-      expect(prisonerAuth.scope).toEqual('user.basic.read')
-    })
-
-    it('sets a default scope of all read only scopes when no scopes given', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.scope).toEqual(['user.basic.read', 'user.establishment.read', 'user.booking.read'])
-    })
-  })
-
-  describe('validateAndRefreshUser', () => {
-    describe('when the users idToken has not yet expired', () => {
-      it('returns the user as it is', async () => {
-        const prisonerAuth = new PrisonerAuth(options)
-        const user = aUserWith({
-          idTokenExp: timeFromNow(minutes(6)).seconds,
-          refreshTokenExp: timeFromNow(minutes(6)).seconds,
-        })
-
-        const result = await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-        const idToken = tokenFromJwt<IdToken>(result.idToken)
-
-        expect(idToken.iat).toEqual(123_456_789)
-      })
-    })
-
-    describe('when the users idToken has expired', () => {
-      describe('when the users refreshToken has not yet expired', () => {
-        it('returns a new set of user tokens for the given user', async () => {
-          const prisonerAuth = new PrisonerAuth({
-            ...options,
-            tokenFetcher: jest.fn().mockResolvedValue({
-              idToken: aJwtOf({ iat: 987_654_321 }),
-              refreshToken: aJwtOf({ iat: 987_654_322 }),
-              accessToken: aJwtOf({ iat: 987_654_323 }),
-            }),
-          })
-          const user = aUserWith({
-            idTokenExp: timeAgo(minutes(3)).seconds,
-            refreshTokenExp: timeFromNow(minutes(6)).seconds,
-          })
-
-          const result = await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-          const idToken = tokenFromJwt<IdToken>(result.idToken)
-          const refreshToken = tokenFromJwt<RefreshToken>(result.refreshToken)
-          const accessToken = tokenFromJwt<AccessToken>(result.accessToken)
-
-          expect(idToken.iat).toEqual(987_654_321)
-          expect(refreshToken.iat).toEqual(987_654_322)
-          expect(accessToken.iat).toEqual(987_654_323)
-        })
-      })
-
-      describe('when the users refreshToken has expired', () => {
-        it('throws an error as we cant continue', async () => {
-          const prisonerAuth = new PrisonerAuth(options)
-          const user = aUserWith({
-            idTokenExp: timeAgo(minutes(3)).seconds,
-            refreshTokenExp: timeFromNow(minutes(3)).seconds,
-          })
-
-          await expect(async () => {
-            await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-          }).rejects.toThrow('Refresh token expired')
-        })
-      })
-    })
-  })
-})

package/src/main/prisonerAuth.ts

@@ -1,174 +0,0 @@
-import OpenIDConnectStrategy, { Profile, VerifyCallback, VerifyFunction } from 'passport-openidconnect'
-import { IdToken, oauthClientToken, RefreshToken, Scope, tokenFromJwt, tokenFetcher, TokenFetcher } from './tokens'
-import { LaunchpadUser, userFromTokens } from './launchpadUser'
-import { seconds, timeFromNow, TimeSpan } from './timeSpans'
-
-export type PrisonerAuthOptions = {
-  /** The full URL of the Launchpad Auth instance */
-  launchpadAuthUrl: string
-
-  /**
-   * Optional: The full URL of the authorisation path on the Launchpad Auth instance.
-   *
-   * If omitted, authorizationUrl will default to $launchpadAuthUrl/v1/oauth2/authorize
-   */
-  authorizationUrl?: string
-
-  /**
-   * Optional: The full URL of the token path on the Launchpad Auth instance.
-   *
-   * If omitted, tokenUrl will default to $launchpadAuthUrl/v1/oauth2/token
-   */
-  tokenUrl?: string
-
-  /**
-   * Optional: The URL or path that Launchpad Auth will be told to call back to with the tokens.
-   *
-   * If omitted, callbackUrl will default to /sign-in/callback
-   */
-  callbackUrl?: string
-
-  /** The Client ID of this application to send to Launchpad Auth */
-  clientId: string
-  /** The Client Secret of this application to send to Launchpad Auth */
-  clientSecret: string
-  /**
-   * Optional: The scope or scopes to request on behalf of the user.
-   *
-   * If omitted, scope will default to user.basic.read, user.establishment.read and user.booking.read
-   */
-  scope?: Scope | Scope[]
-  /**
-   * Optional: Whether or not to use nonce, not recommended to be disabled except for integration tests
-   *
-   * If ommitted. defaults to true
-   */
-  nonce?: boolean
-
-  /**
-   * A time span specifying the least amount of time a token must have left before it is considered expired.
-   *
-   * @example
-   *
-   * Token will be considered expired when its exp value is in the past.
-   * ```ts
-   * nothing()
-   * ```
-   *
-   * Token will be considered expired unless its exp value is **AT LEAST 5** minutes in the future from time of checking.
-   * ```ts
-   * minutes(5)
-   * ```
-   *
-   * @see TimeSpan
-   */
-  tokenMinimumLifespan: TimeSpan
-
-  /**
-   * Optional: Token fetcher implementation. Intended for unit testing PrisonerAuth
-   *
-   * @see TokenFetcher
-   */
-  tokenFetcher?: TokenFetcher
-}
-
-export default class PrisonerAuth {
-  readonly launchpadAuthUrl: string
-
-  readonly authorizationUrl: string
-
-  readonly tokenUrl: string
-
-  readonly callbackUrl: string
-
-  readonly clientId: string
-
-  readonly clientSecret: string
-
-  readonly scope: Scope | Scope[]
-
-  readonly nonce: boolean
-
-  readonly tokenMinimumLifespan: TimeSpan
-
-  readonly tokenFetcher: TokenFetcher
-
-  constructor(options: PrisonerAuthOptions) {
-    this.launchpadAuthUrl = options.launchpadAuthUrl
-    this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`
-    this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`
-    this.callbackUrl = options.callbackUrl ?? '/sign-in/callback'
-    this.clientId = options.clientId
-    this.clientSecret = options.clientSecret
-    this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read']
-    this.nonce = options.nonce ?? true
-    this.tokenMinimumLifespan = options.tokenMinimumLifespan
-    this.tokenFetcher = options.tokenFetcher ?? tokenFetcher
-  }
-
-  /**
-   *
-   * @returns OpenIDConnectStrategy ready for use with passport
-   */
-  passportStrategy(): OpenIDConnectStrategy {
-    return new OpenIDConnectStrategy(
-      {
-        issuer: this.launchpadAuthUrl,
-        authorizationURL: this.authorizationUrl,
-        tokenURL: this.tokenUrl,
-        callbackURL: this.callbackUrl,
-        clientID: this.clientId,
-        clientSecret: this.clientSecret,
-        scope: this.scope,
-        userInfoURL: '',
-        skipUserProfile: true,
-        nonce: this.nonce ? 'true' : undefined,
-        customHeaders: { authorization: this.authorizationToken() },
-      },
-      ((
-        _issuer: string,
-        _profile: Profile,
-        _context: object,
-        idToken: string,
-        accessToken: string,
-        refreshToken: string,
-        done: VerifyCallback,
-      ) => done(null, userFromTokens({ idToken, accessToken, refreshToken }))) as VerifyFunction,
-    )
-  }
-
-  /**
-   * Checks the expiry of a given LaunchpadUser idToken and refreshToken.
-   * - If the idToken has expired it will attempt to refresh it using the refreshToken.
-   * - If the refreshToken has expired it will throw an Error.
-   *
-   * This method will always return a LaunchpadUser so it is suggested to updated your local copy and it will keep the tokens up to date.
-   *
-   * @param user - The LaunchpadUser instance to check token expiry on.
-   * @returns A LaunchpadUser is always returned, either the given user or a user with refreshed tokens.
-   * @throws Error is thrown if the refreshToken has expired, the user must sign in again from scratch.
-   */
-  async validateAndRefreshUser(user: LaunchpadUser): Promise<LaunchpadUser> {
-    const idToken = tokenFromJwt<IdToken>(user.idToken)
-    const refreshToken = tokenFromJwt<RefreshToken>(user.refreshToken)
-    const tokenExpiryTime = timeFromNow(this.tokenMinimumLifespan)
-
-    // Id Token still valid, return the current user
-    if (seconds(idToken.exp).isGreaterThanOrEqualTo(tokenExpiryTime)) {
-      return user
-    }
-
-    // Refresh token expired, cannot continue
-    if (seconds(refreshToken.exp).isLessThan(tokenExpiryTime)) {
-      throw new Error('Refresh token expired')
-    }
-
-    // Refresh the user tokens
-    const newTokens = await this.tokenFetcher(user.refreshToken, this.tokenUrl, this.authorizationToken())
-    return userFromTokens(newTokens)
-  }
-
-  private authorizationToken(): string {
-    return oauthClientToken(this.clientId, this.clientSecret)
-  }
-}

package/src/main/testUtils.ts

@@ -1,10 +0,0 @@
-// eslint-disable-next-line import/no-extraneous-dependencies
-import jwt from 'jsonwebtoken'
-
-export const aJwtOf = (obj: object): string => jwt.sign(obj, 'secret')
-
-export const aUserWith = ({ idTokenExp, refreshTokenExp }: { idTokenExp: number; refreshTokenExp: number }) => ({
-  idToken: aJwtOf({ exp: idTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-  refreshToken: aJwtOf({ exp: refreshTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-  accessToken: aJwtOf({ exp: refreshTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-})

package/src/main/timeSpans.test.ts

@@ -1,129 +0,0 @@
-import { milliseconds, minutes, seconds, timeAgo, timeFromNow, TimeSpan } from './timeSpans'
-
-describe('time spans', () => {
-  describe('minutes', () => {
-    const cases = [
-      [1, 1, 60, 60000],
-      [5, 5, 300, 300000],
-      [0.5, 0.5, 30, 30000],
-      [0, 0, 0, 0],
-    ]
-
-    test.each(cases)(
-      'Given %p minute(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = minutes(example)
-        expect(subject.minutes).toEqual(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('seconds', () => {
-    const cases = [
-      [1, 0.01666667, 1, 1000],
-      [60, 1, 60, 60000],
-      [120, 2, 120, 120000],
-    ]
-
-    test.each(cases)(
-      'Given %p seconds(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = seconds(example)
-        expect(subject.minutes).toBeCloseTo(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('milliseconds', () => {
-    const cases = [
-      [1, 0.00001667, 0.001, 1],
-      [1000, 0.01666667, 1, 1000],
-    ]
-
-    test.each(cases)(
-      'Given %p milliseconds(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = milliseconds(example)
-        expect(subject.minutes).toBeCloseTo(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('isEqualTo', () => {
-    const cases: [string, TimeSpan, TimeSpan, boolean][] = [
-      ['60 seconds is equal to 1 minute', seconds(60), minutes(1), true],
-      ['120 seconds is equal to 1 and a half minutes', seconds(90), minutes(1.5), true],
-      ['2 and a half seconds is equal to 2500 milliseconds', seconds(2.5), milliseconds(2500), true],
-      ['120 minutes is equal to 7200 seconds', minutes(120), seconds(7200), true],
-      ['120 minutes is not equal to 7000 seconds', minutes(120), seconds(7000), false],
-      ['1 seconds is not equal to 1 minutes', seconds(1), minutes(1), false],
-    ]
-
-    test.each(cases)('%s', (testCaseDescription, example1, example2, expectedResult) => {
-      expect(example1.isEqualTo(example2)).toBe(expectedResult)
-    })
-  })
-
-  describe('isGreaterThan', () => {
-    const cases: [string, TimeSpan, TimeSpan, boolean][] = [
-      ['61 seconds is greater than 1 minute', seconds(61), minutes(1), true],
-      ['125 seconds is greater than 1 and a half minutes', seconds(121), minutes(1.5), true],
-      ['60 seconds is not greater than 1 minute', seconds(60), minutes(1), false],
-      ['1 minute is not greater than 61 seconds', minutes(1), seconds(61), false],
-    ]
-
-    test.each(cases)('%s', (testCaseDescription, example1, example2, expectedResult) => {
-      expect(example1.isGreaterThan(example2)).toBe(expectedResult)
-    })
-  })
-
-  describe('timeAgo', () => {
-    const dateNowInMs: number = 1770000000000
-
-    beforeEach(() => {
-      Date.now = jest.fn(() => dateNowInMs)
-    })
-
-    const cases: [string, number, TimeSpan][] = [
-      ['1 millisecond', dateNowInMs - 1, milliseconds(1)],
-      ['1 second', dateNowInMs - 1000, seconds(1)],
-      ['30 seconds', dateNowInMs - 30000, seconds(30)],
-      ['2 minutes', dateNowInMs - 120000, minutes(2)],
-    ]
-
-    test.each(cases)(
-      'Given a current time in milliseconds 1770000000000 and a timespan of %p, the expected past timespan in milliseconds is %p',
-      (description, expectedMilliseconds, example) => {
-        expect(timeAgo(example).milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('timeFromNow', () => {
-    const dateNowInMs: number = 1770000000000
-
-    beforeEach(() => {
-      Date.now = jest.fn(() => dateNowInMs)
-    })
-
-    const cases: [string, number, TimeSpan][] = [
-      ['1 millisecond', dateNowInMs + 1, milliseconds(1)],
-      ['1 second', dateNowInMs + 1000, seconds(1)],
-      ['30 seconds', dateNowInMs + 30000, seconds(30)],
-      ['2 minutes', dateNowInMs + 120000, minutes(2)],
-    ]
-
-    test.each(cases)(
-      'Given a current time in milliseconds 1770000000000 and a timespan of %p, the expected future timespan in milliseconds is %p',
-      (description, expectedMilliseconds, example) => {
-        expect(timeFromNow(example).milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-})

package/src/main/timeSpans.ts

@@ -1,74 +0,0 @@
-// A TimeSpan allows you to give meaning to a number and then read that number back and compare them in different formats
-// ie.
-// seconds(60).minutes === 1
-// seconds(30).seconds === 30
-// minutes(1).seconds === 60
-// milliseconds(1000).seconds === 1
-// milliseconds(2000).isEqualTo(seconds(2)) #=> true
-// minutes(5).
-// This allows a caller to just accept a TimeSpan and then work in the units it cares about
-
-export const minutes = (numMinutes: number): TimeSpan => TimeSpan.minutes(numMinutes)
-
-export const seconds = (numSeconds: number): TimeSpan => TimeSpan.seconds(numSeconds)
-
-export const milliseconds = (numMilliseconds: number): TimeSpan => TimeSpan.milliseconds(numMilliseconds)
-
-export const nothing = (): TimeSpan => TimeSpan.nothing()
-
-// Get a time span in the past
-export const timeAgo = (ago: TimeSpan) => milliseconds(Date.now() - ago.milliseconds)
-
-// Get a time span in the future
-export const timeFromNow = (fromNow: TimeSpan) => milliseconds(Date.now() + fromNow.milliseconds)
-
-// Implementation
-export class TimeSpan {
-  readonly minutes: number
-
-  readonly seconds: number
-
-  readonly milliseconds: number
-
-  private constructor(numMinutes: number, numSeconds: number, numMilliseconds: number) {
-    this.minutes = numMinutes
-    this.seconds = numSeconds
-    this.milliseconds = numMilliseconds
-  }
-
-  static minutes(numMinutes: number): TimeSpan {
-    return new TimeSpan(numMinutes, numMinutes * 60, TimeSpan.seconds(numMinutes * 60).milliseconds)
-  }
-
-  static seconds(numSeconds: number): TimeSpan {
-    return new TimeSpan(numSeconds / 60, numSeconds, numSeconds * 1000)
-  }
-
-  static milliseconds(numMilliseconds: number): TimeSpan {
-    return new TimeSpan(TimeSpan.seconds(numMilliseconds / 1000).minutes, numMilliseconds / 1000, numMilliseconds)
-  }
-
-  static nothing(): TimeSpan {
-    return new TimeSpan(0, 0, 0)
-  }
-
-  isGreaterThan(t: TimeSpan): boolean {
-    return this.milliseconds > t.milliseconds
-  }
-
-  isGreaterThanOrEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds >= t.milliseconds
-  }
-
-  isLessThan(t: TimeSpan): boolean {
-    return this.milliseconds < t.milliseconds
-  }
-
-  isLessThanOrEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds <= t.milliseconds
-  }
-
-  isEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds === t.milliseconds
-  }
-}

package/src/main/tokens.ts

@@ -1,65 +0,0 @@
-import superagent from 'superagent'
-
-export type IdToken = {
-  name: string
-  given_name: string
-  family_name: string
-  nonce?: string
-  iat: number
-  aud: string
-  sub: string
-  exp: number // exp is in seconds
-  booking: { id: string }
-  establishment: {
-    agency_id: string
-    name: string
-    display_name: string
-    youth: boolean
-  }
-  iss: string
-}
-
-export type RefreshToken = {
-  jti: string
-  ati: string
-  iat: number
-  aud: string
-  sub: string
-  exp: number // exp is in seconds
-  scopes: Scope[]
-}
-
-export type AccessToken = RefreshToken
-
-export type RawTokens = { idToken: string; refreshToken: string; accessToken: string }
-
-export type Scope =
-  | 'user.basic.read'
-  | 'user.establishment.read'
-  | 'user.booking.read'
-  | 'user.clients.read'
-  | 'user.clients.delete'
-
-export const tokenFromJwt = <T>(token: string): T => JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString())
-
-export const oauthClientToken = (clientId: string, clientSecret: string): string => {
-  const token = Buffer.from(`${clientId}:${clientSecret}`).toString('base64')
-  return `Basic ${token}`
-}
-
-export type TokenFetcher = (refreshToken: string, tokenUrl: string, authorizationHeader: string) => Promise<RawTokens>
-
-export const tokenFetcher: TokenFetcher = (userRefreshToken, tokenUrl, authorizationHeader) => {
-  return new Promise<RawTokens>((resolve, reject) => {
-    superagent
-      .post(tokenUrl)
-      .set('Content-Type', 'application/x-www-form-urlencoded')
-      .set('Authorization', authorizationHeader)
-      .query({ refresh_token: userRefreshToken, grant_type: 'refresh_token' })
-      .end((err, res) => {
-        if (err) reject(err)
-        const { id_token: idToken, access_token: accessToken, refresh_token: refreshToken } = res.body
-        return resolve({ idToken, accessToken, refreshToken })
-      })
-  })
-}

package/src/misc/install.diff

@@ -1,154 +0,0 @@
-diff --git a/server/app.ts b/server/app.ts
-index eddaa67..26fb35e 100644
---- a/server/app.ts
-+++ b/server/app.ts
-@@ -5,11 +5,9 @@ import createError from 'http-errors'
- import nunjucksSetup from './utils/nunjucksSetup'
- import errorHandler from './errorHandler'
- import { appInsightsMiddleware } from './utils/azureAppInsights'
--import authorisationMiddleware from './middleware/authorisationMiddleware'
-
- import setUpAuthentication from './middleware/setUpAuthentication'
- import setUpCsrf from './middleware/setUpCsrf'
--import setUpCurrentUser from './middleware/setUpCurrentUser'
- import setUpHealthChecks from './middleware/setUpHealthChecks'
- import setUpStaticResources from './middleware/setUpStaticResources'
- import setUpWebRequestParsing from './middleware/setupRequestParsing'
-@@ -34,9 +32,7 @@ export default function createApp(services: Services): express.Application {
-   app.use(setUpStaticResources())
-   nunjucksSetup(app)
-   app.use(setUpAuthentication())
--  app.use(authorisationMiddleware())
-   app.use(setUpCsrf())
--  app.use(setUpCurrentUser())
-
-   app.use(routes(services))
-
-diff --git a/server/interfaces/hmppsUser.ts b/server/interfaces/hmppsUser.ts
-index f0a6dd2..8c01550 100644
---- a/server/interfaces/hmppsUser.ts
-+++ b/server/interfaces/hmppsUser.ts
-@@ -1,4 +1,6 @@
--export type AuthSource = 'nomis' | 'delius' | 'external' | 'azuread'
-+import { LaunchpadUser } from '@ministryofjustice/hmpps-prisoner-auth'
-+
-+export type AuthSource = 'nomis' | 'delius' | 'external' | 'azuread' | 'prisoner-auth'
-
- /**
-  * These are the details that all user types share.
-@@ -57,4 +59,4 @@ export interface AzureADUser extends BaseUser {
-   authSource: 'azuread'
- }
-
--export type HmppsUser = PrisonUser | ProbationUser | ExternalUser | AzureADUser
-+export type HmppsUser = PrisonUser | ProbationUser | ExternalUser | AzureADUser | LaunchpadUser
-diff --git a/server/middleware/setUpAuthentication.ts b/server/middleware/setUpAuthentication.ts
-index 1979d6e..a954198 100644
---- a/server/middleware/setUpAuthentication.ts
-+++ b/server/middleware/setUpAuthentication.ts
-@@ -1,12 +1,8 @@
- import passport from 'passport'
- import flash from 'connect-flash'
- import { Router } from 'express'
--import { Strategy } from 'passport-oauth2'
--import { VerificationClient, AuthenticatedRequest } from '@ministryofjustice/hmpps-auth-clients'
--import config from '../config'
-+import { LaunchpadUser, PrisonerAuth, minutes } from '@ministryofjustice/hmpps-prisoner-auth'
- import { HmppsUser } from '../interfaces/hmppsUser'
--import generateOauthClientToken from '../utils/clientCredentials'
--import logger from '../../logger'
-
- passport.serializeUser((user, done) => {
-   // Not used but required for Passport
-@@ -18,26 +14,17 @@ passport.deserializeUser((user, done) => {
-   done(null, user as Express.User)
- })
-
--passport.use(
--  new Strategy(
--    {
--      authorizationURL: `${config.apis.hmppsAuth.externalUrl}/oauth/authorize`,
--      tokenURL: `${config.apis.hmppsAuth.url}/oauth/token`,
--      clientID: config.apis.hmppsAuth.authClientId,
--      clientSecret: config.apis.hmppsAuth.authClientSecret,
--      callbackURL: `${config.ingressUrl}/sign-in/callback`,
--      state: true,
--      customHeaders: { Authorization: generateOauthClientToken() },
--    },
--    (token, refreshToken, params, profile, done) => {
--      return done(null, { token, username: params.user_name, authSource: params.auth_source })
--    },
--  ),
--)
-+const prisonerAuth = new PrisonerAuth({
-+  launchpadAuthUrl: 'VALUE_HERE',
-+  clientId: 'VALUE_HERE',
-+  clientSecret: 'VALUE_HERE',
-+  tokenMinimumLifespan: minutes(5),
-+})
-+
-+passport.use('prisoner-auth', prisonerAuth.passportStrategy())
-
- export default function setupAuthentication() {
-   const router = Router()
--  const tokenVerificationClient = new VerificationClient(config.apis.tokenVerification, logger)
-
-   router.use(passport.initialize())
-   router.use(passport.session())
-@@ -48,40 +35,39 @@ export default function setupAuthentication() {
-     return res.render('autherror')
-   })
-
--  router.get('/sign-in', passport.authenticate('oauth2'))
-+  router.get('/sign-in', passport.authenticate('prisoner-auth'))
-
-   router.get('/sign-in/callback', (req, res, next) =>
--    passport.authenticate('oauth2', {
-+    passport.authenticate('prisoner-auth', {
-       successReturnToOrRedirect: req.session.returnTo || '/',
-       failureRedirect: '/autherror',
-     })(req, res, next),
-   )
-
--  const authUrl = config.apis.hmppsAuth.externalUrl
--  const authParameters = `client_id=${config.apis.hmppsAuth.authClientId}&redirect_uri=${config.ingressUrl}`
--
-   router.use('/sign-out', (req, res, next) => {
--    const authSignOutUrl = `${authUrl}/sign-out?${authParameters}`
-     if (req.user) {
-       req.logout(err => {
-         if (err) return next(err)
--        return req.session.destroy(() => res.redirect(authSignOutUrl))
-+        return req.session.destroy(() => res.redirect('/'))
-       })
--    } else res.redirect(authSignOutUrl)
--  })
--
--  router.use('/account-details', (req, res) => {
--    res.redirect(`${authUrl}/account-details?${authParameters}`)
-+    } else res.redirect('/')
-   })
-
-   router.use(async (req, res, next) => {
--    if (req.isAuthenticated() && (await tokenVerificationClient.verifyToken(req as unknown as AuthenticatedRequest))) {
--      return next()
-+    if (!req.isAuthenticated()) {
-+      req.session.returnTo = req.originalUrl
-+      return res.redirect('/sign-in')
-     }
--    req.session.returnTo = req.originalUrl
--    return res.redirect('/sign-in')
--  })
-
-+    return prisonerAuth
-+      .validateAndRefreshUser(req.user as LaunchpadUser)
-+      .then(user => {
-+        req.user = user
-+        next()
-+      })
-+      .catch(() => res.redirect('/autherror'))
-+  })
-+
-   router.use((req, res, next) => {
-     res.locals.user = req.user as HmppsUser
-     next()