@ministryofjustice/hmpps-prisoner-auth 0.0.2 → 0.0.4

package/README.md

@@ -7,29 +7,39 @@
 The following steps will give an opinionated out of the box setup for applications where a launchpad user will be the main user in the system.
 
 1. Add the package `@ministryofjustice/hmpps-prisoner-auth` to your `package.json`
+```sh
+npm add --save @ministryofjustice/hmpps-prisoner-auth
+npm i
 ```
-$ npm add --save @ministryofjustice/hmpps-prisoner-auth
-$ npm i
-```
+
 2. Copy the contents of [src/misc/install.diff](src/misc/install.diff) to your local folder
+```sh
+curl https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/misc/install.diff > install.diff
 ```
-$ curl https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/misc/install.diff > install.diff
-```
+
 3. Apply the diff to carry out all the required changes
+```sh
+git apply install.diff
 ```
-$ git apply install.diff
-```
+
 4. Make sure to look through the applied changes and remove the diff file before committing.
 
+5. Fill in the configuration options in `server/middleware/setUpPrisonerAuth.ts`:
+
+See [PrisonerAuthOptions](https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/main/prisonerAuth.ts) for full documentation on the avaialble options
+
 ### Manual installation
 
+NOTE: see [install.diff](https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/misc/install.diff) for an authorititive list of changes to be made.
+
 1. Add the package `@ministryofjustice/hmpps-prisoner-auth` to your `package.json`
+```sh
+npm add --save @ministryofjustice/hmpps-prisoner-auth
+npm i
 ```
-$ npm add --save @ministryofjustice/hmpps-prisoner-auth
-$ npm i
-```
+
 2. Modify `interfaces/hmppsUser.ts` to make the following additions:
-```
+```ts
 # add prisoner-auth to the AuthSource type
 export type AuthSource = 'nomis' | 'delius' | 'external' | 'azuread' | 'prisoner-auth'
 
@@ -38,87 +48,16 @@ export type HmppsUser = PrisonUser | ProbationUser | ExternalUser | AzureADUser
 ```
 These changes will help smooth over alot of assumptions made in the typescript template about the type of fields the user will have.
 
-3. Modify `server/middleware/setupAuthentication.ts` to add prisoner auth as the passport strategy (see below for the full list of config options):
-```
-passport.use(
-  'prisoner-auth',
-  prisonerAuthStrategy(
-    {
-      launchpadAuthUrl: 'https://launchpad.instance.etc' ...
-    }
-  )
-)
-```
-Note: it is recommended to give the strategy a name ('prisoner-auth' here) for later referral with passport.authenticate middleware.
+3. Add `server/middleware/setUpPrisonerAuth.ts` middlware:
 
-4. Modify `server/middleware/setupAuthentication.ts` to remove any hmpps auth specific code and add in prisoner auth setup. The following code snippet is intended as a guide:
-```
-export default function setupAuthentication() {
-  const router = Router()
-
-  router.use(passport.initialize())
-  router.use(passport.session())
-  router.use(flash())
-
-  router.get('/autherror', (req, res) => {
-    res.status(401)
-    return res.render('autherror')
-  })
-
-  router.get('/sign-in', passport.authenticate('prisoner-auth'))
-
-  router.get('/sign-in/callback', (req, res, next) =>
-    passport.authenticate('prisoner-auth', {
-      successReturnToOrRedirect: req.session.returnTo || '/',
-      failureRedirect: '/autherror',
-    })(req, res, next),
-  )
-
-  router.use('/sign-out', (req, res, next) => {
-    if (req.user) {
-      req.logout(err => {
-        if (err) return next(err)
-        return req.session.destroy(() => res.redirect('/'))
-      })
-    } else res.redirect('/')
-  })
-
-  router.use(async (req, res, next) => {
-    if (!req.isAuthenticated()) {
-      req.session.returnTo = req.originalUrl
-      return res.redirect('/sign-in')
-    }
-
-    return prisonerAuth
-      .validateAndRefreshUser(req.user as LaunchpadUser)
-      .then(user => {
-        req.user = user
-        next()
-      })
-      .catch(() => res.redirect('/autherror'))
-  })
-  
-  router.use((req, res, next) => {
-    res.locals.user = req.user as HmppsUser
-    next()
-  })
-
-  return router
-}
+```sh
+curl https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/misc/setUpPrisonerAuth.ts.example > server/middleware/setUpPrisonerAuth.ts
 ```
-5. You may wish to remove the following middleware from `server/app.ts` as they were not designed for use with `LaunchpadUser`:
-  - `authorisationMiddleware()` - this checks the users `ROLE_` which a launchpad user will not have.
-  - `setUpCurrentUser()` - this sets up the `res.locals.user` fields which a launchpad will have already (`name`, `displayName` etc).
-
-### Configuration Options
-
-| Option | Description |
-| - | - |
-| launchpadAuthUrl | The full URL of the launchpad auth instance you wish to authenticate against |
-| clientID | The client ID |
-| clientSecret | The client secret |
-| callbackURL | *Optional, The URL or path you wish launchpad to call back to in the auth flow. Defaults to `/signin/callback` |
-| scope | *Optional, One or more OpenIdConnect Scopes you require for the application. Defaults to `['user.basic.read', 'user.establishment.read', 'user.booking.read']` |
-| tokenMinimumLifespan | The least amount of time a token must have left before it is considered expired. Expressed as a TimeSpan. eg. `minutes(5)` or `nothing()`. |
-
-See `PrisonerAuthOptions` for full list and documentation for these options.
+Make sure to fill in the appropriate values.
+
+See [PrisonerAuthOptions](https://raw.githubusercontent.com/ministryofjustice/hmpps-prisoner-facing-typescript-lib/refs/heads/main/packages/prisoner-auth/src/main/prisonerAuth.ts) for full documentation on the avaialble options
+
+4. Modify `server/app.ts`:
+  - ADD `setUpPrisonerAuth()` to enable the middlware.
+  - REMOVE reference to `authorisationMiddleware()` - this checks the users `ROLE_` which a launchpad user will not have.
+  - REMOVE reference to `setUpCurrentUser()` - this sets up the `res.locals.user` fields which a launchpad will have already (`name`, `displayName` etc).

package/dist/index.cjs.js

@@ -99,11 +99,13 @@ class TimeSpan {
     }
 }
 
+const nullOnLoginSuccessCallback = _ => Promise.resolve();
 class PrisonerAuth {
     launchpadAuthUrl;
     authorizationUrl;
     tokenUrl;
     callbackUrl;
+    onLoginSuccessCallback;
     clientId;
     clientSecret;
     scope;
@@ -115,6 +117,7 @@ class PrisonerAuth {
         this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`;
         this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`;
         this.callbackUrl = options.callbackUrl ?? '/sign-in/callback';
+        this.onLoginSuccessCallback = options.onLoginSuccessCallback ?? nullOnLoginSuccessCallback;
         this.clientId = options.clientId;
         this.clientSecret = options.clientSecret;
         this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read'];
@@ -139,7 +142,11 @@ class PrisonerAuth {
             skipUserProfile: true,
             nonce: this.nonce ? 'true' : undefined,
             customHeaders: { authorization: this.authorizationToken() },
-        }, ((_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => done(null, userFromTokens({ idToken, accessToken, refreshToken }))));
+        }, (async (_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => {
+            const user = userFromTokens({ idToken, accessToken, refreshToken });
+            await this.onLoginSuccessCallback(user);
+            done(null, user);
+        }));
     }
     /**
      * Checks the expiry of a given LaunchpadUser idToken and refreshToken.

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/main/tokens.ts","../src/main/launchpadUser.ts","../src/main/timeSpans.ts","../src/main/prisonerAuth.ts"],"sourcesContent":[null,null,null,null],"names":[],"mappings":";;;;;AA0CO,MAAM,YAAY,GAAG,CAAI,KAAa,KAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/G,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,YAAoB,KAAY;AACjF,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC3E,OAAO,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE;AACzB,CAAC;AAIM,MAAM,YAAY,GAAiB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,KAAI;IAC5F,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,KAAI;QAChD;aACG,IAAI,CAAC,QAAQ;AACb,aAAA,GAAG,CAAC,cAAc,EAAE,mCAAmC;AACvD,aAAA,GAAG,CAAC,eAAe,EAAE,mBAAmB;aACxC,KAAK,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE;AACtE,aAAA,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAI;AAChB,YAAA,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC;AACpB,YAAA,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI;YAC9F,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxD,QAAA,CAAC,CAAC;AACN,IAAA,CAAC,CAAC;AACJ,CAAC;;AC5CM,MAAM,cAAc,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAa,KAAmB;IACjG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,YAAY,CAAU,OAAO,CAAC;IACnH,MAAM,UAAU,GAAG,eAAe;IAElC,OAAO;QACL,UAAU;QACV,OAAO;QACP,YAAY;QACZ,WAAW;QACX,aAAa;QACb,IAAI;QACJ,SAAS;QACT,UAAU;;AAGV,QAAA,KAAK,EAAE,OAAO;AACd,QAAA,QAAQ,EAAE,IAAI;AACd,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,WAAW,EAAE,IAAI;AACjB,QAAA,SAAS,EAAE,EAAE;KACd;AACH,CAAC;;ACzCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEO,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,YAAY,GAAG,CAAC,eAAuB,KAAe,QAAQ,CAAC,YAAY,CAAC,eAAe;AAEjG,MAAM,OAAO,GAAG,MAAgB,QAAQ,CAAC,OAAO;AAKvD;AACO,MAAM,WAAW,GAAG,CAAC,OAAiB,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;AAEjG;MACa,QAAQ,CAAA;AACV,IAAA,OAAO;AAEP,IAAA,OAAO;AAEP,IAAA,YAAY;AAErB,IAAA,WAAA,CAAoB,UAAkB,EAAE,UAAkB,EAAE,eAAuB,EAAA;AACjF,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,YAAY,GAAG,eAAe;IACrC;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;QAC/B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC;IAClG;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;AAC/B,QAAA,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACrE;IAEA,OAAO,YAAY,CAAC,eAAuB,EAAA;QACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;IAChH;AAEA,IAAA,OAAO,OAAO,GAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9B;AAEA,IAAA,aAAa,CAAC,CAAW,EAAA;AACvB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,sBAAsB,CAAC,CAAW,EAAA;AAChC,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,UAAU,CAAC,CAAW,EAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,mBAAmB,CAAC,CAAW,EAAA;AAC7B,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,SAAS,CAAC,CAAW,EAAA;AACnB,QAAA,OAAO,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;IAC7C;AACD;;ACCa,MAAO,YAAY,CAAA;AACtB,IAAA,gBAAgB;AAEhB,IAAA,gBAAgB;AAEhB,IAAA,QAAQ;AAER,IAAA,WAAW;AAEX,IAAA,QAAQ;AAER,IAAA,YAAY;AAEZ,IAAA,KAAK;AAEL,IAAA,KAAK;AAEL,IAAA,oBAAoB;AAEpB,IAAA,YAAY;AAErB,IAAA,WAAA,CAAY,OAA4B,EAAA;AACtC,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB;AAChD,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,oBAAA,CAAsB;AACrG,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,gBAAA,CAAkB;QACjF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB;AAC7D,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;AAChC,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY;AACxC,QAAA,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;QACjG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI;AAClC,QAAA,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,YAAY;IAC1D;AAEA;;;AAGG;IACH,gBAAgB,GAAA;QACd,OAAO,IAAI,qBAAqB,CAC9B;YACE,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;AACjB,YAAA,WAAW,EAAE,EAAE;AACf,YAAA,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS;YACtC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE;AAC5D,SAAA,GACA,CACC,OAAe,EACf,QAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,IAAoB,KACjB,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,EACxE;IACH;AAEA;;;;;;;;;;AAUG;IACH,MAAM,sBAAsB,CAAC,IAAmB,EAAA;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAU,IAAI,CAAC,OAAO,CAAC;QACnD,MAAM,YAAY,GAAG,YAAY,CAAe,IAAI,CAAC,YAAY,CAAC;QAClE,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC;;AAG9D,QAAA,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE;AAChE,YAAA,OAAO,IAAI;QACb;;AAGA,QAAA,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;QAC1C;;QAGA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;AACtG,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC;IAClC;IAEQ,kBAAkB,GAAA;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;IAC3D;AACD;;;;;;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/main/tokens.ts","../src/main/launchpadUser.ts","../src/main/timeSpans.ts","../src/main/prisonerAuth.ts"],"sourcesContent":[null,null,null,null],"names":[],"mappings":";;;;;AA0CO,MAAM,YAAY,GAAG,CAAI,KAAa,KAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/G,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,YAAoB,KAAY;AACjF,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC3E,OAAO,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE;AACzB,CAAC;AAIM,MAAM,YAAY,GAAiB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,KAAI;IAC5F,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,KAAI;QAChD;aACG,IAAI,CAAC,QAAQ;AACb,aAAA,GAAG,CAAC,cAAc,EAAE,mCAAmC;AACvD,aAAA,GAAG,CAAC,eAAe,EAAE,mBAAmB;aACxC,KAAK,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE;AACtE,aAAA,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAI;AAChB,YAAA,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC;AACpB,YAAA,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI;YAC9F,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxD,QAAA,CAAC,CAAC;AACN,IAAA,CAAC,CAAC;AACJ,CAAC;;AC5CM,MAAM,cAAc,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAa,KAAmB;IACjG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,YAAY,CAAU,OAAO,CAAC;IACnH,MAAM,UAAU,GAAG,eAAe;IAElC,OAAO;QACL,UAAU;QACV,OAAO;QACP,YAAY;QACZ,WAAW;QACX,aAAa;QACb,IAAI;QACJ,SAAS;QACT,UAAU;;AAGV,QAAA,KAAK,EAAE,OAAO;AACd,QAAA,QAAQ,EAAE,IAAI;AACd,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,WAAW,EAAE,IAAI;AACjB,QAAA,SAAS,EAAE,EAAE;KACd;AACH,CAAC;;ACzCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEO,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,YAAY,GAAG,CAAC,eAAuB,KAAe,QAAQ,CAAC,YAAY,CAAC,eAAe;AAEjG,MAAM,OAAO,GAAG,MAAgB,QAAQ,CAAC,OAAO;AAKvD;AACO,MAAM,WAAW,GAAG,CAAC,OAAiB,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;AAEjG;MACa,QAAQ,CAAA;AACV,IAAA,OAAO;AAEP,IAAA,OAAO;AAEP,IAAA,YAAY;AAErB,IAAA,WAAA,CAAoB,UAAkB,EAAE,UAAkB,EAAE,eAAuB,EAAA;AACjF,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,YAAY,GAAG,eAAe;IACrC;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;QAC/B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC;IAClG;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;AAC/B,QAAA,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACrE;IAEA,OAAO,YAAY,CAAC,eAAuB,EAAA;QACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;IAChH;AAEA,IAAA,OAAO,OAAO,GAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9B;AAEA,IAAA,aAAa,CAAC,CAAW,EAAA;AACvB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,sBAAsB,CAAC,CAAW,EAAA;AAChC,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,UAAU,CAAC,CAAW,EAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,mBAAmB,CAAC,CAAW,EAAA;AAC7B,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,SAAS,CAAC,CAAW,EAAA;AACnB,QAAA,OAAO,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;IAC7C;AACD;;ACOD,MAAM,0BAA0B,GAA2B,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;AAEnE,MAAO,YAAY,CAAA;AACtB,IAAA,gBAAgB;AAEhB,IAAA,gBAAgB;AAEhB,IAAA,QAAQ;AAER,IAAA,WAAW;AAEX,IAAA,sBAAsB;AAEtB,IAAA,QAAQ;AAER,IAAA,YAAY;AAEZ,IAAA,KAAK;AAEL,IAAA,KAAK;AAEL,IAAA,oBAAoB;AAEpB,IAAA,YAAY;AAErB,IAAA,WAAA,CAAY,OAA4B,EAAA;AACtC,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB;AAChD,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,oBAAA,CAAsB;AACrG,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,gBAAA,CAAkB;QACjF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB;QAC7D,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,0BAA0B;AAC1F,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;AAChC,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY;AACxC,QAAA,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;QACjG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI;AAClC,QAAA,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,YAAY;IAC1D;AAEA;;;AAGG;IACH,gBAAgB,GAAA;QACd,OAAO,IAAI,qBAAqB,CAC9B;YACE,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;AACjB,YAAA,WAAW,EAAE,EAAE;AACf,YAAA,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS;YACtC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE;AAC5D,SAAA,GACA,OACC,OAAe,EACf,QAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,IAAoB,KAClB;AACF,YAAA,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACnE,YAAA,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AACvC,YAAA,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAClB,CAAC,EACF;IACH;AAEA;;;;;;;;;;AAUG;IACH,MAAM,sBAAsB,CAAC,IAAmB,EAAA;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAU,IAAI,CAAC,OAAO,CAAC;QACnD,MAAM,YAAY,GAAG,YAAY,CAAe,IAAI,CAAC,YAAY,CAAC;QAClE,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC;;AAG9D,QAAA,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE;AAChE,YAAA,OAAO,IAAI;QACb;;AAGA,QAAA,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;QAC1C;;QAGA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;AACtG,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC;IAClC;IAEQ,kBAAkB,GAAA;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;IAC3D;AACD;;;;;;;;;"}

package/dist/index.d.ts

@@ -85,6 +85,10 @@ type PrisonerAuthOptions = {
      * If omitted, callbackUrl will default to /sign-in/callback
      */
     callbackUrl?: string;
+    /**
+     * Optional: A callback that will be invoked on sucessful login, provides the logged in user as a parameter
+     */
+    onLoginSuccessCallback?: OnLoginSuccessCallback;
     /** The Client ID of this application to send to Launchpad Auth */
     clientId: string;
     /** The Client Secret of this application to send to Launchpad Auth */
@@ -126,11 +130,13 @@ type PrisonerAuthOptions = {
      */
     tokenFetcher?: TokenFetcher;
 };
+type OnLoginSuccessCallback = (user: LaunchpadUser) => Promise<void>;
 declare class PrisonerAuth {
     readonly launchpadAuthUrl: string;
     readonly authorizationUrl: string;
     readonly tokenUrl: string;
     readonly callbackUrl: string;
+    readonly onLoginSuccessCallback: OnLoginSuccessCallback;
     readonly clientId: string;
     readonly clientSecret: string;
     readonly scope: Scope | Scope[];

package/dist/index.esm.js

@@ -97,11 +97,13 @@ class TimeSpan {
     }
 }
 
+const nullOnLoginSuccessCallback = _ => Promise.resolve();
 class PrisonerAuth {
     launchpadAuthUrl;
     authorizationUrl;
     tokenUrl;
     callbackUrl;
+    onLoginSuccessCallback;
     clientId;
     clientSecret;
     scope;
@@ -113,6 +115,7 @@ class PrisonerAuth {
         this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`;
         this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`;
         this.callbackUrl = options.callbackUrl ?? '/sign-in/callback';
+        this.onLoginSuccessCallback = options.onLoginSuccessCallback ?? nullOnLoginSuccessCallback;
         this.clientId = options.clientId;
         this.clientSecret = options.clientSecret;
         this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read'];
@@ -137,7 +140,11 @@ class PrisonerAuth {
             skipUserProfile: true,
             nonce: this.nonce ? 'true' : undefined,
             customHeaders: { authorization: this.authorizationToken() },
-        }, ((_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => done(null, userFromTokens({ idToken, accessToken, refreshToken }))));
+        }, (async (_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => {
+            const user = userFromTokens({ idToken, accessToken, refreshToken });
+            await this.onLoginSuccessCallback(user);
+            done(null, user);
+        }));
     }
     /**
      * Checks the expiry of a given LaunchpadUser idToken and refreshToken.

package/dist/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../src/main/tokens.ts","../src/main/launchpadUser.ts","../src/main/timeSpans.ts","../src/main/prisonerAuth.ts"],"sourcesContent":[null,null,null,null],"names":[],"mappings":";;;AA0CO,MAAM,YAAY,GAAG,CAAI,KAAa,KAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/G,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,YAAoB,KAAY;AACjF,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC3E,OAAO,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE;AACzB,CAAC;AAIM,MAAM,YAAY,GAAiB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,KAAI;IAC5F,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,KAAI;QAChD;aACG,IAAI,CAAC,QAAQ;AACb,aAAA,GAAG,CAAC,cAAc,EAAE,mCAAmC;AACvD,aAAA,GAAG,CAAC,eAAe,EAAE,mBAAmB;aACxC,KAAK,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE;AACtE,aAAA,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAI;AAChB,YAAA,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC;AACpB,YAAA,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI;YAC9F,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxD,QAAA,CAAC,CAAC;AACN,IAAA,CAAC,CAAC;AACJ,CAAC;;AC5CM,MAAM,cAAc,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAa,KAAmB;IACjG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,YAAY,CAAU,OAAO,CAAC;IACnH,MAAM,UAAU,GAAG,eAAe;IAElC,OAAO;QACL,UAAU;QACV,OAAO;QACP,YAAY;QACZ,WAAW;QACX,aAAa;QACb,IAAI;QACJ,SAAS;QACT,UAAU;;AAGV,QAAA,KAAK,EAAE,OAAO;AACd,QAAA,QAAQ,EAAE,IAAI;AACd,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,WAAW,EAAE,IAAI;AACjB,QAAA,SAAS,EAAE,EAAE;KACd;AACH,CAAC;;ACzCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEO,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,YAAY,GAAG,CAAC,eAAuB,KAAe,QAAQ,CAAC,YAAY,CAAC,eAAe;AAEjG,MAAM,OAAO,GAAG,MAAgB,QAAQ,CAAC,OAAO;AAKvD;AACO,MAAM,WAAW,GAAG,CAAC,OAAiB,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;AAEjG;MACa,QAAQ,CAAA;AACV,IAAA,OAAO;AAEP,IAAA,OAAO;AAEP,IAAA,YAAY;AAErB,IAAA,WAAA,CAAoB,UAAkB,EAAE,UAAkB,EAAE,eAAuB,EAAA;AACjF,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,YAAY,GAAG,eAAe;IACrC;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;QAC/B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC;IAClG;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;AAC/B,QAAA,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACrE;IAEA,OAAO,YAAY,CAAC,eAAuB,EAAA;QACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;IAChH;AAEA,IAAA,OAAO,OAAO,GAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9B;AAEA,IAAA,aAAa,CAAC,CAAW,EAAA;AACvB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,sBAAsB,CAAC,CAAW,EAAA;AAChC,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,UAAU,CAAC,CAAW,EAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,mBAAmB,CAAC,CAAW,EAAA;AAC7B,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,SAAS,CAAC,CAAW,EAAA;AACnB,QAAA,OAAO,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;IAC7C;AACD;;ACCa,MAAO,YAAY,CAAA;AACtB,IAAA,gBAAgB;AAEhB,IAAA,gBAAgB;AAEhB,IAAA,QAAQ;AAER,IAAA,WAAW;AAEX,IAAA,QAAQ;AAER,IAAA,YAAY;AAEZ,IAAA,KAAK;AAEL,IAAA,KAAK;AAEL,IAAA,oBAAoB;AAEpB,IAAA,YAAY;AAErB,IAAA,WAAA,CAAY,OAA4B,EAAA;AACtC,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB;AAChD,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,oBAAA,CAAsB;AACrG,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,gBAAA,CAAkB;QACjF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB;AAC7D,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;AAChC,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY;AACxC,QAAA,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;QACjG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI;AAClC,QAAA,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,YAAY;IAC1D;AAEA;;;AAGG;IACH,gBAAgB,GAAA;QACd,OAAO,IAAI,qBAAqB,CAC9B;YACE,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;AACjB,YAAA,WAAW,EAAE,EAAE;AACf,YAAA,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS;YACtC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE;AAC5D,SAAA,GACA,CACC,OAAe,EACf,QAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,IAAoB,KACjB,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,EACxE;IACH;AAEA;;;;;;;;;;AAUG;IACH,MAAM,sBAAsB,CAAC,IAAmB,EAAA;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAU,IAAI,CAAC,OAAO,CAAC;QACnD,MAAM,YAAY,GAAG,YAAY,CAAe,IAAI,CAAC,YAAY,CAAC;QAClE,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC;;AAG9D,QAAA,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE;AAChE,YAAA,OAAO,IAAI;QACb;;AAGA,QAAA,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;QAC1C;;QAGA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;AACtG,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC;IAClC;IAEQ,kBAAkB,GAAA;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;IAC3D;AACD;;;;"}
+{"version":3,"file":"index.esm.js","sources":["../src/main/tokens.ts","../src/main/launchpadUser.ts","../src/main/timeSpans.ts","../src/main/prisonerAuth.ts"],"sourcesContent":[null,null,null,null],"names":[],"mappings":";;;AA0CO,MAAM,YAAY,GAAG,CAAI,KAAa,KAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;AAE/G,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,YAAoB,KAAY;AACjF,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC3E,OAAO,CAAA,MAAA,EAAS,KAAK,CAAA,CAAE;AACzB,CAAC;AAIM,MAAM,YAAY,GAAiB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,KAAI;IAC5F,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,KAAI;QAChD;aACG,IAAI,CAAC,QAAQ;AACb,aAAA,GAAG,CAAC,cAAc,EAAE,mCAAmC;AACvD,aAAA,GAAG,CAAC,eAAe,EAAE,mBAAmB;aACxC,KAAK,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE;AACtE,aAAA,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAI;AAChB,YAAA,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC;AACpB,YAAA,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,IAAI;YAC9F,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACxD,QAAA,CAAC,CAAC;AACN,IAAA,CAAC,CAAC;AACJ,CAAC;;AC5CM,MAAM,cAAc,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAa,KAAmB;IACjG,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,YAAY,CAAU,OAAO,CAAC;IACnH,MAAM,UAAU,GAAG,eAAe;IAElC,OAAO;QACL,UAAU;QACV,OAAO;QACP,YAAY;QACZ,WAAW;QACX,aAAa;QACb,IAAI;QACJ,SAAS;QACT,UAAU;;AAGV,QAAA,KAAK,EAAE,OAAO;AACd,QAAA,QAAQ,EAAE,IAAI;AACd,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,WAAW,EAAE,IAAI;AACjB,QAAA,SAAS,EAAE,EAAE;KACd;AACH,CAAC;;ACzCD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAEO,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,OAAO,GAAG,CAAC,UAAkB,KAAe,QAAQ,CAAC,OAAO,CAAC,UAAU;AAE7E,MAAM,YAAY,GAAG,CAAC,eAAuB,KAAe,QAAQ,CAAC,YAAY,CAAC,eAAe;AAEjG,MAAM,OAAO,GAAG,MAAgB,QAAQ,CAAC,OAAO;AAKvD;AACO,MAAM,WAAW,GAAG,CAAC,OAAiB,KAAK,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;AAEjG;MACa,QAAQ,CAAA;AACV,IAAA,OAAO;AAEP,IAAA,OAAO;AAEP,IAAA,YAAY;AAErB,IAAA,WAAA,CAAoB,UAAkB,EAAE,UAAkB,EAAE,eAAuB,EAAA;AACjF,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,OAAO,GAAG,UAAU;AACzB,QAAA,IAAI,CAAC,YAAY,GAAG,eAAe;IACrC;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;QAC/B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC;IAClG;IAEA,OAAO,OAAO,CAAC,UAAkB,EAAA;AAC/B,QAAA,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACrE;IAEA,OAAO,YAAY,CAAC,eAAuB,EAAA;QACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,EAAE,eAAe,CAAC;IAChH;AAEA,IAAA,OAAO,OAAO,GAAA;QACZ,OAAO,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9B;AAEA,IAAA,aAAa,CAAC,CAAW,EAAA;AACvB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,sBAAsB,CAAC,CAAW,EAAA;AAChC,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,UAAU,CAAC,CAAW,EAAA;AACpB,QAAA,OAAO,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY;IAC3C;AAEA,IAAA,mBAAmB,CAAC,CAAW,EAAA;AAC7B,QAAA,OAAO,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;IAC5C;AAEA,IAAA,SAAS,CAAC,CAAW,EAAA;AACnB,QAAA,OAAO,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;IAC7C;AACD;;ACOD,MAAM,0BAA0B,GAA2B,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;AAEnE,MAAO,YAAY,CAAA;AACtB,IAAA,gBAAgB;AAEhB,IAAA,gBAAgB;AAEhB,IAAA,QAAQ;AAER,IAAA,WAAW;AAEX,IAAA,sBAAsB;AAEtB,IAAA,QAAQ;AAER,IAAA,YAAY;AAEZ,IAAA,KAAK;AAEL,IAAA,KAAK;AAEL,IAAA,oBAAoB;AAEpB,IAAA,YAAY;AAErB,IAAA,WAAA,CAAY,OAA4B,EAAA;AACtC,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB;AAChD,QAAA,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,oBAAA,CAAsB;AACrG,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAA,EAAG,OAAO,CAAC,gBAAgB,CAAA,gBAAA,CAAkB;QACjF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,mBAAmB;QAC7D,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,0BAA0B;AAC1F,QAAA,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;AAChC,QAAA,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY;AACxC,QAAA,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,mBAAmB,CAAC;QACjG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI;AAClC,QAAA,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,YAAY;IAC1D;AAEA;;;AAGG;IACH,gBAAgB,GAAA;QACd,OAAO,IAAI,qBAAqB,CAC9B;YACE,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;AACjB,YAAA,WAAW,EAAE,EAAE;AACf,YAAA,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS;YACtC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE;AAC5D,SAAA,GACA,OACC,OAAe,EACf,QAAiB,EACjB,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,YAAoB,EACpB,IAAoB,KAClB;AACF,YAAA,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AACnE,YAAA,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;AACvC,YAAA,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAClB,CAAC,EACF;IACH;AAEA;;;;;;;;;;AAUG;IACH,MAAM,sBAAsB,CAAC,IAAmB,EAAA;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAU,IAAI,CAAC,OAAO,CAAC;QACnD,MAAM,YAAY,GAAG,YAAY,CAAe,IAAI,CAAC,YAAY,CAAC;QAClE,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,oBAAoB,CAAC;;AAG9D,QAAA,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE;AAChE,YAAA,OAAO,IAAI;QACb;;AAGA,QAAA,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;AACzD,YAAA,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC;QAC1C;;QAGA,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;AACtG,QAAA,OAAO,cAAc,CAAC,SAAS,CAAC;IAClC;IAEQ,kBAAkB,GAAA;QACxB,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;IAC3D;AACD;;;;"}

package/dist/main/prisonerAuth.d.ts

@@ -23,6 +23,10 @@ export type PrisonerAuthOptions = {
      * If omitted, callbackUrl will default to /sign-in/callback
      */
     callbackUrl?: string;
+    /**
+     * Optional: A callback that will be invoked on sucessful login, provides the logged in user as a parameter
+     */
+    onLoginSuccessCallback?: OnLoginSuccessCallback;
     /** The Client ID of this application to send to Launchpad Auth */
     clientId: string;
     /** The Client Secret of this application to send to Launchpad Auth */
@@ -64,11 +68,13 @@ export type PrisonerAuthOptions = {
      */
     tokenFetcher?: TokenFetcher;
 };
+export type OnLoginSuccessCallback = (user: LaunchpadUser) => Promise<void>;
 export default class PrisonerAuth {
     readonly launchpadAuthUrl: string;
     readonly authorizationUrl: string;
     readonly tokenUrl: string;
     readonly callbackUrl: string;
+    readonly onLoginSuccessCallback: OnLoginSuccessCallback;
     readonly clientId: string;
     readonly clientSecret: string;
     readonly scope: Scope | Scope[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ministryofjustice/hmpps-prisoner-auth",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Middleware for providing authentication against Launchpad Auth",
   "author": "hmpps-launchpad-devs",
   "license": "MIT",
@@ -18,8 +18,7 @@
   "types": "./dist/index.d.ts",
   "files": [
     "*.md",
-    "dist/**/*",
-    "src/**/*"
+    "dist/**/*"
   ],
   "engines": {
     "node": "24"
@@ -42,5 +41,7 @@
     "passport-openidconnect": "^0.1.2",
     "superagent": "^10.3.0"
   },
-  "peerDependencies": {}
+  "peerDependencies": {
+    "express": "^5.2.1"
+  }
 }

package/src/main/index.ts

@@ -1,3 +0,0 @@
-export { default as PrisonerAuth, type PrisonerAuthOptions } from './prisonerAuth'
-export { minutes, seconds, milliseconds, nothing, TimeSpan } from './timeSpans'
-export type { LaunchpadUser } from './launchpadUser'

package/src/main/launchpadUser.test.ts

@@ -1,41 +0,0 @@
-import jwt from 'jsonwebtoken'
-import { userFromTokens } from './launchpadUser'
-
-describe('userFromTokens', () => {
-  const aJwtOf = (obj: object): string => jwt.sign(obj, 'secret')
-
-  const idToken = aJwtOf({
-    name: 'Test User',
-    given_name: 'Test',
-    family_name: 'User',
-    establishment: { agency_id: 'CKI' },
-    sub: '12345',
-  })
-  const accessToken = aJwtOf({ hello: 'world' })
-  const refreshToken = aJwtOf({ hello: 'world' })
-
-  it('sets the given tokens on the user for later use (refreshing tokens)', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-
-    expect(result.idToken).toEqual(idToken)
-    expect(result.accessToken).toEqual(accessToken)
-    expect(result.refreshToken).toEqual(refreshToken)
-  })
-
-  it('sets the establishment from the idToken', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.establishment).toEqual({ agency_id: 'CKI' })
-  })
-
-  it('sets the name fields from the idToken', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.name).toEqual('Test User')
-    expect(result.givenName).toEqual('Test')
-    expect(result.familyName).toEqual('User')
-  })
-
-  it('sets authSource to give compatibility with the HmppsUser interface', () => {
-    const result = userFromTokens({ idToken, accessToken, refreshToken })
-    expect(result.authSource).toEqual('prisoner-auth')
-  })
-})

package/src/main/launchpadUser.ts

@@ -1,42 +0,0 @@
-import { IdToken, RawTokens, tokenFromJwt } from './tokens'
-
-export type LaunchpadUser = {
-  authSource: 'prisoner-auth'
-  idToken: string
-  refreshToken: string
-  accessToken: string
-  establishment: IdToken['establishment']
-  name: string
-  givenName: string
-  familyName: string
-
-  // The following fields are for compatibility with HmppsUser only
-  token: string
-  username: string
-  userId: string
-  displayName: string
-  userRoles: string[]
-}
-
-export const userFromTokens = ({ idToken, accessToken, refreshToken }: RawTokens): LaunchpadUser => {
-  const { establishment, name, given_name: givenName, family_name: familyName, sub } = tokenFromJwt<IdToken>(idToken)
-  const authSource = 'prisoner-auth'
-
-  return {
-    authSource,
-    idToken,
-    refreshToken,
-    accessToken,
-    establishment,
-    name,
-    givenName,
-    familyName,
-
-    // The following fields are for compatibility with HmppsUser only
-    token: idToken,
-    username: name,
-    userId: sub,
-    displayName: name,
-    userRoles: [],
-  }
-}

package/src/main/prisonerAuth.test.ts

@@ -1,117 +0,0 @@
-import { minutes, timeAgo, timeFromNow } from './timeSpans'
-import PrisonerAuth, { PrisonerAuthOptions } from './prisonerAuth'
-import { LaunchpadUser } from './launchpadUser'
-import { AccessToken, IdToken, RefreshToken, tokenFromJwt } from './tokens'
-import { aJwtOf, aUserWith } from './testUtils'
-
-describe('PrisonerAuth', () => {
-  const options: PrisonerAuthOptions = {
-    launchpadAuthUrl: 'https://launchpad.example.com',
-    clientId: 'cf837899-2a3c-4838-aa83-5fb76bd58df1',
-    clientSecret: '445f30b2-1010-4bcb-8cba-447b70463bd0',
-    tokenMinimumLifespan: minutes(5),
-  }
-
-  describe('setting options', () => {
-    it('sets sane defaults for the URL options', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.authorizationUrl).toEqual('https://launchpad.example.com/v1/oauth2/authorize')
-      expect(prisonerAuth.tokenUrl).toEqual('https://launchpad.example.com/v1/oauth2/token')
-    })
-
-    it('allows custom override of the URL options', () => {
-      const prisonerAuth = new PrisonerAuth({
-        ...options,
-        authorizationUrl: 'https://auth.com',
-        tokenUrl: 'https://token.com',
-      })
-      expect(prisonerAuth.authorizationUrl).toEqual('https://auth.com')
-      expect(prisonerAuth.tokenUrl).toEqual('https://token.com')
-    })
-
-    it('sets the client credentials', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.clientId).toEqual('cf837899-2a3c-4838-aa83-5fb76bd58df1')
-      expect(prisonerAuth.clientSecret).toEqual('445f30b2-1010-4bcb-8cba-447b70463bd0')
-    })
-
-    it('allows overriding of the callbackUrl', () => {
-      const prisonerAuth = new PrisonerAuth({ ...options, callbackUrl: '/my/call/back' })
-      expect(prisonerAuth.callbackUrl).toEqual('/my/call/back')
-    })
-
-    it('sets a default callbackUrl when none provided', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.callbackUrl).toEqual('/sign-in/callback')
-    })
-
-    it('allows overriding of the scopes', () => {
-      const prisonerAuth = new PrisonerAuth({ ...options, scope: 'user.basic.read' })
-      expect(prisonerAuth.scope).toEqual('user.basic.read')
-    })
-
-    it('sets a default scope of all read only scopes when no scopes given', () => {
-      const prisonerAuth = new PrisonerAuth(options)
-      expect(prisonerAuth.scope).toEqual(['user.basic.read', 'user.establishment.read', 'user.booking.read'])
-    })
-  })
-
-  describe('validateAndRefreshUser', () => {
-    describe('when the users idToken has not yet expired', () => {
-      it('returns the user as it is', async () => {
-        const prisonerAuth = new PrisonerAuth(options)
-        const user = aUserWith({
-          idTokenExp: timeFromNow(minutes(6)).seconds,
-          refreshTokenExp: timeFromNow(minutes(6)).seconds,
-        })
-
-        const result = await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-        const idToken = tokenFromJwt<IdToken>(result.idToken)
-
-        expect(idToken.iat).toEqual(123_456_789)
-      })
-    })
-
-    describe('when the users idToken has expired', () => {
-      describe('when the users refreshToken has not yet expired', () => {
-        it('returns a new set of user tokens for the given user', async () => {
-          const prisonerAuth = new PrisonerAuth({
-            ...options,
-            tokenFetcher: jest.fn().mockResolvedValue({
-              idToken: aJwtOf({ iat: 987_654_321 }),
-              refreshToken: aJwtOf({ iat: 987_654_322 }),
-              accessToken: aJwtOf({ iat: 987_654_323 }),
-            }),
-          })
-          const user = aUserWith({
-            idTokenExp: timeAgo(minutes(3)).seconds,
-            refreshTokenExp: timeFromNow(minutes(6)).seconds,
-          })
-
-          const result = await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-          const idToken = tokenFromJwt<IdToken>(result.idToken)
-          const refreshToken = tokenFromJwt<RefreshToken>(result.refreshToken)
-          const accessToken = tokenFromJwt<AccessToken>(result.accessToken)
-
-          expect(idToken.iat).toEqual(987_654_321)
-          expect(refreshToken.iat).toEqual(987_654_322)
-          expect(accessToken.iat).toEqual(987_654_323)
-        })
-      })
-
-      describe('when the users refreshToken has expired', () => {
-        it('throws an error as we cant continue', async () => {
-          const prisonerAuth = new PrisonerAuth(options)
-          const user = aUserWith({
-            idTokenExp: timeAgo(minutes(3)).seconds,
-            refreshTokenExp: timeFromNow(minutes(3)).seconds,
-          })
-
-          await expect(async () => {
-            await prisonerAuth.validateAndRefreshUser(user as LaunchpadUser)
-          }).rejects.toThrow('Refresh token expired')
-        })
-      })
-    })
-  })
-})

package/src/main/prisonerAuth.ts

@@ -1,174 +0,0 @@
-import OpenIDConnectStrategy, { Profile, VerifyCallback, VerifyFunction } from 'passport-openidconnect'
-import { IdToken, oauthClientToken, RefreshToken, Scope, tokenFromJwt, tokenFetcher, TokenFetcher } from './tokens'
-import { LaunchpadUser, userFromTokens } from './launchpadUser'
-import { seconds, timeFromNow, TimeSpan } from './timeSpans'
-
-export type PrisonerAuthOptions = {
-  /** The full URL of the Launchpad Auth instance */
-  launchpadAuthUrl: string
-
-  /**
-   * Optional: The full URL of the authorisation path on the Launchpad Auth instance.
-   *
-   * If omitted, authorizationUrl will default to $launchpadAuthUrl/v1/oauth2/authorize
-   */
-  authorizationUrl?: string
-
-  /**
-   * Optional: The full URL of the token path on the Launchpad Auth instance.
-   *
-   * If omitted, tokenUrl will default to $launchpadAuthUrl/v1/oauth2/token
-   */
-  tokenUrl?: string
-
-  /**
-   * Optional: The URL or path that Launchpad Auth will be told to call back to with the tokens.
-   *
-   * If omitted, callbackUrl will default to /sign-in/callback
-   */
-  callbackUrl?: string
-
-  /** The Client ID of this application to send to Launchpad Auth */
-  clientId: string
-  /** The Client Secret of this application to send to Launchpad Auth */
-  clientSecret: string
-  /**
-   * Optional: The scope or scopes to request on behalf of the user.
-   *
-   * If omitted, scope will default to user.basic.read, user.establishment.read and user.booking.read
-   */
-  scope?: Scope | Scope[]
-  /**
-   * Optional: Whether or not to use nonce, not recommended to be disabled except for integration tests
-   *
-   * If ommitted. defaults to true
-   */
-  nonce?: boolean
-
-  /**
-   * A time span specifying the least amount of time a token must have left before it is considered expired.
-   *
-   * @example
-   *
-   * Token will be considered expired when its exp value is in the past.
-   * ```ts
-   * nothing()
-   * ```
-   *
-   * Token will be considered expired unless its exp value is **AT LEAST 5** minutes in the future from time of checking.
-   * ```ts
-   * minutes(5)
-   * ```
-   *
-   * @see TimeSpan
-   */
-  tokenMinimumLifespan: TimeSpan
-
-  /**
-   * Optional: Token fetcher implementation. Intended for unit testing PrisonerAuth
-   *
-   * @see TokenFetcher
-   */
-  tokenFetcher?: TokenFetcher
-}
-
-export default class PrisonerAuth {
-  readonly launchpadAuthUrl: string
-
-  readonly authorizationUrl: string
-
-  readonly tokenUrl: string
-
-  readonly callbackUrl: string
-
-  readonly clientId: string
-
-  readonly clientSecret: string
-
-  readonly scope: Scope | Scope[]
-
-  readonly nonce: boolean
-
-  readonly tokenMinimumLifespan: TimeSpan
-
-  readonly tokenFetcher: TokenFetcher
-
-  constructor(options: PrisonerAuthOptions) {
-    this.launchpadAuthUrl = options.launchpadAuthUrl
-    this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`
-    this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`
-    this.callbackUrl = options.callbackUrl ?? '/sign-in/callback'
-    this.clientId = options.clientId
-    this.clientSecret = options.clientSecret
-    this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read']
-    this.nonce = options.nonce ?? true
-    this.tokenMinimumLifespan = options.tokenMinimumLifespan
-    this.tokenFetcher = options.tokenFetcher ?? tokenFetcher
-  }
-
-  /**
-   *
-   * @returns OpenIDConnectStrategy ready for use with passport
-   */
-  passportStrategy(): OpenIDConnectStrategy {
-    return new OpenIDConnectStrategy(
-      {
-        issuer: this.launchpadAuthUrl,
-        authorizationURL: this.authorizationUrl,
-        tokenURL: this.tokenUrl,
-        callbackURL: this.callbackUrl,
-        clientID: this.clientId,
-        clientSecret: this.clientSecret,
-        scope: this.scope,
-        userInfoURL: '',
-        skipUserProfile: true,
-        nonce: this.nonce ? 'true' : undefined,
-        customHeaders: { authorization: this.authorizationToken() },
-      },
-      ((
-        _issuer: string,
-        _profile: Profile,
-        _context: object,
-        idToken: string,
-        accessToken: string,
-        refreshToken: string,
-        done: VerifyCallback,
-      ) => done(null, userFromTokens({ idToken, accessToken, refreshToken }))) as VerifyFunction,
-    )
-  }
-
-  /**
-   * Checks the expiry of a given LaunchpadUser idToken and refreshToken.
-   * - If the idToken has expired it will attempt to refresh it using the refreshToken.
-   * - If the refreshToken has expired it will throw an Error.
-   *
-   * This method will always return a LaunchpadUser so it is suggested to updated your local copy and it will keep the tokens up to date.
-   *
-   * @param user - The LaunchpadUser instance to check token expiry on.
-   * @returns A LaunchpadUser is always returned, either the given user or a user with refreshed tokens.
-   * @throws Error is thrown if the refreshToken has expired, the user must sign in again from scratch.
-   */
-  async validateAndRefreshUser(user: LaunchpadUser): Promise<LaunchpadUser> {
-    const idToken = tokenFromJwt<IdToken>(user.idToken)
-    const refreshToken = tokenFromJwt<RefreshToken>(user.refreshToken)
-    const tokenExpiryTime = timeFromNow(this.tokenMinimumLifespan)
-
-    // Id Token still valid, return the current user
-    if (seconds(idToken.exp).isGreaterThanOrEqualTo(tokenExpiryTime)) {
-      return user
-    }
-
-    // Refresh token expired, cannot continue
-    if (seconds(refreshToken.exp).isLessThan(tokenExpiryTime)) {
-      throw new Error('Refresh token expired')
-    }
-
-    // Refresh the user tokens
-    const newTokens = await this.tokenFetcher(user.refreshToken, this.tokenUrl, this.authorizationToken())
-    return userFromTokens(newTokens)
-  }
-
-  private authorizationToken(): string {
-    return oauthClientToken(this.clientId, this.clientSecret)
-  }
-}

package/src/main/testUtils.ts

@@ -1,10 +0,0 @@
-// eslint-disable-next-line import/no-extraneous-dependencies
-import jwt from 'jsonwebtoken'
-
-export const aJwtOf = (obj: object): string => jwt.sign(obj, 'secret')
-
-export const aUserWith = ({ idTokenExp, refreshTokenExp }: { idTokenExp: number; refreshTokenExp: number }) => ({
-  idToken: aJwtOf({ exp: idTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-  refreshToken: aJwtOf({ exp: refreshTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-  accessToken: aJwtOf({ exp: refreshTokenExp, iat: 123_456_789, sub: 'USER_A' }),
-})

package/src/main/timeSpans.test.ts

@@ -1,129 +0,0 @@
-import { milliseconds, minutes, seconds, timeAgo, timeFromNow, TimeSpan } from './timeSpans'
-
-describe('time spans', () => {
-  describe('minutes', () => {
-    const cases = [
-      [1, 1, 60, 60000],
-      [5, 5, 300, 300000],
-      [0.5, 0.5, 30, 30000],
-      [0, 0, 0, 0],
-    ]
-
-    test.each(cases)(
-      'Given %p minute(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = minutes(example)
-        expect(subject.minutes).toEqual(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('seconds', () => {
-    const cases = [
-      [1, 0.01666667, 1, 1000],
-      [60, 1, 60, 60000],
-      [120, 2, 120, 120000],
-    ]
-
-    test.each(cases)(
-      'Given %p seconds(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = seconds(example)
-        expect(subject.minutes).toBeCloseTo(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('milliseconds', () => {
-    const cases = [
-      [1, 0.00001667, 0.001, 1],
-      [1000, 0.01666667, 1, 1000],
-    ]
-
-    test.each(cases)(
-      'Given %p milliseconds(s), minutes is %p, seconds is %p and milliseconds is %p',
-      (example, expectedMinutes, expectedSeconds, expectedMilliseconds) => {
-        const subject = milliseconds(example)
-        expect(subject.minutes).toBeCloseTo(expectedMinutes)
-        expect(subject.seconds).toEqual(expectedSeconds)
-        expect(subject.milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('isEqualTo', () => {
-    const cases: [string, TimeSpan, TimeSpan, boolean][] = [
-      ['60 seconds is equal to 1 minute', seconds(60), minutes(1), true],
-      ['120 seconds is equal to 1 and a half minutes', seconds(90), minutes(1.5), true],
-      ['2 and a half seconds is equal to 2500 milliseconds', seconds(2.5), milliseconds(2500), true],
-      ['120 minutes is equal to 7200 seconds', minutes(120), seconds(7200), true],
-      ['120 minutes is not equal to 7000 seconds', minutes(120), seconds(7000), false],
-      ['1 seconds is not equal to 1 minutes', seconds(1), minutes(1), false],
-    ]
-
-    test.each(cases)('%s', (testCaseDescription, example1, example2, expectedResult) => {
-      expect(example1.isEqualTo(example2)).toBe(expectedResult)
-    })
-  })
-
-  describe('isGreaterThan', () => {
-    const cases: [string, TimeSpan, TimeSpan, boolean][] = [
-      ['61 seconds is greater than 1 minute', seconds(61), minutes(1), true],
-      ['125 seconds is greater than 1 and a half minutes', seconds(121), minutes(1.5), true],
-      ['60 seconds is not greater than 1 minute', seconds(60), minutes(1), false],
-      ['1 minute is not greater than 61 seconds', minutes(1), seconds(61), false],
-    ]
-
-    test.each(cases)('%s', (testCaseDescription, example1, example2, expectedResult) => {
-      expect(example1.isGreaterThan(example2)).toBe(expectedResult)
-    })
-  })
-
-  describe('timeAgo', () => {
-    const dateNowInMs: number = 1770000000000
-
-    beforeEach(() => {
-      Date.now = jest.fn(() => dateNowInMs)
-    })
-
-    const cases: [string, number, TimeSpan][] = [
-      ['1 millisecond', dateNowInMs - 1, milliseconds(1)],
-      ['1 second', dateNowInMs - 1000, seconds(1)],
-      ['30 seconds', dateNowInMs - 30000, seconds(30)],
-      ['2 minutes', dateNowInMs - 120000, minutes(2)],
-    ]
-
-    test.each(cases)(
-      'Given a current time in milliseconds 1770000000000 and a timespan of %p, the expected past timespan in milliseconds is %p',
-      (description, expectedMilliseconds, example) => {
-        expect(timeAgo(example).milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-
-  describe('timeFromNow', () => {
-    const dateNowInMs: number = 1770000000000
-
-    beforeEach(() => {
-      Date.now = jest.fn(() => dateNowInMs)
-    })
-
-    const cases: [string, number, TimeSpan][] = [
-      ['1 millisecond', dateNowInMs + 1, milliseconds(1)],
-      ['1 second', dateNowInMs + 1000, seconds(1)],
-      ['30 seconds', dateNowInMs + 30000, seconds(30)],
-      ['2 minutes', dateNowInMs + 120000, minutes(2)],
-    ]
-
-    test.each(cases)(
-      'Given a current time in milliseconds 1770000000000 and a timespan of %p, the expected future timespan in milliseconds is %p',
-      (description, expectedMilliseconds, example) => {
-        expect(timeFromNow(example).milliseconds).toEqual(expectedMilliseconds)
-      },
-    )
-  })
-})

package/src/main/timeSpans.ts

@@ -1,74 +0,0 @@
-// A TimeSpan allows you to give meaning to a number and then read that number back and compare them in different formats
-// ie.
-// seconds(60).minutes === 1
-// seconds(30).seconds === 30
-// minutes(1).seconds === 60
-// milliseconds(1000).seconds === 1
-// milliseconds(2000).isEqualTo(seconds(2)) #=> true
-// minutes(5).
-// This allows a caller to just accept a TimeSpan and then work in the units it cares about
-
-export const minutes = (numMinutes: number): TimeSpan => TimeSpan.minutes(numMinutes)
-
-export const seconds = (numSeconds: number): TimeSpan => TimeSpan.seconds(numSeconds)
-
-export const milliseconds = (numMilliseconds: number): TimeSpan => TimeSpan.milliseconds(numMilliseconds)
-
-export const nothing = (): TimeSpan => TimeSpan.nothing()
-
-// Get a time span in the past
-export const timeAgo = (ago: TimeSpan) => milliseconds(Date.now() - ago.milliseconds)
-
-// Get a time span in the future
-export const timeFromNow = (fromNow: TimeSpan) => milliseconds(Date.now() + fromNow.milliseconds)
-
-// Implementation
-export class TimeSpan {
-  readonly minutes: number
-
-  readonly seconds: number
-
-  readonly milliseconds: number
-
-  private constructor(numMinutes: number, numSeconds: number, numMilliseconds: number) {
-    this.minutes = numMinutes
-    this.seconds = numSeconds
-    this.milliseconds = numMilliseconds
-  }
-
-  static minutes(numMinutes: number): TimeSpan {
-    return new TimeSpan(numMinutes, numMinutes * 60, TimeSpan.seconds(numMinutes * 60).milliseconds)
-  }
-
-  static seconds(numSeconds: number): TimeSpan {
-    return new TimeSpan(numSeconds / 60, numSeconds, numSeconds * 1000)
-  }
-
-  static milliseconds(numMilliseconds: number): TimeSpan {
-    return new TimeSpan(TimeSpan.seconds(numMilliseconds / 1000).minutes, numMilliseconds / 1000, numMilliseconds)
-  }
-
-  static nothing(): TimeSpan {
-    return new TimeSpan(0, 0, 0)
-  }
-
-  isGreaterThan(t: TimeSpan): boolean {
-    return this.milliseconds > t.milliseconds
-  }
-
-  isGreaterThanOrEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds >= t.milliseconds
-  }
-
-  isLessThan(t: TimeSpan): boolean {
-    return this.milliseconds < t.milliseconds
-  }
-
-  isLessThanOrEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds <= t.milliseconds
-  }
-
-  isEqualTo(t: TimeSpan): boolean {
-    return this.milliseconds === t.milliseconds
-  }
-}

package/src/main/tokens.ts

@@ -1,65 +0,0 @@
-import superagent from 'superagent'
-
-export type IdToken = {
-  name: string
-  given_name: string
-  family_name: string
-  nonce?: string
-  iat: number
-  aud: string
-  sub: string
-  exp: number // exp is in seconds
-  booking: { id: string }
-  establishment: {
-    agency_id: string
-    name: string
-    display_name: string
-    youth: boolean
-  }
-  iss: string
-}
-
-export type RefreshToken = {
-  jti: string
-  ati: string
-  iat: number
-  aud: string
-  sub: string
-  exp: number // exp is in seconds
-  scopes: Scope[]
-}
-
-export type AccessToken = RefreshToken
-
-export type RawTokens = { idToken: string; refreshToken: string; accessToken: string }
-
-export type Scope =
-  | 'user.basic.read'
-  | 'user.establishment.read'
-  | 'user.booking.read'
-  | 'user.clients.read'
-  | 'user.clients.delete'
-
-export const tokenFromJwt = <T>(token: string): T => JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString())
-
-export const oauthClientToken = (clientId: string, clientSecret: string): string => {
-  const token = Buffer.from(`${clientId}:${clientSecret}`).toString('base64')
-  return `Basic ${token}`
-}
-
-export type TokenFetcher = (refreshToken: string, tokenUrl: string, authorizationHeader: string) => Promise<RawTokens>
-
-export const tokenFetcher: TokenFetcher = (userRefreshToken, tokenUrl, authorizationHeader) => {
-  return new Promise<RawTokens>((resolve, reject) => {
-    superagent
-      .post(tokenUrl)
-      .set('Content-Type', 'application/x-www-form-urlencoded')
-      .set('Authorization', authorizationHeader)
-      .query({ refresh_token: userRefreshToken, grant_type: 'refresh_token' })
-      .end((err, res) => {
-        if (err) reject(err)
-        const { id_token: idToken, access_token: accessToken, refresh_token: refreshToken } = res.body
-        return resolve({ idToken, accessToken, refreshToken })
-      })
-  })
-}

package/src/misc/install.diff

@@ -1,154 +0,0 @@
-diff --git a/server/app.ts b/server/app.ts
-index eddaa67..26fb35e 100644
---- a/server/app.ts
-+++ b/server/app.ts
-@@ -5,11 +5,9 @@ import createError from 'http-errors'
- import nunjucksSetup from './utils/nunjucksSetup'
- import errorHandler from './errorHandler'
- import { appInsightsMiddleware } from './utils/azureAppInsights'
--import authorisationMiddleware from './middleware/authorisationMiddleware'
-
- import setUpAuthentication from './middleware/setUpAuthentication'
- import setUpCsrf from './middleware/setUpCsrf'
--import setUpCurrentUser from './middleware/setUpCurrentUser'
- import setUpHealthChecks from './middleware/setUpHealthChecks'
- import setUpStaticResources from './middleware/setUpStaticResources'
- import setUpWebRequestParsing from './middleware/setupRequestParsing'
-@@ -34,9 +32,7 @@ export default function createApp(services: Services): express.Application {
-   app.use(setUpStaticResources())
-   nunjucksSetup(app)
-   app.use(setUpAuthentication())
--  app.use(authorisationMiddleware())
-   app.use(setUpCsrf())
--  app.use(setUpCurrentUser())
-
-   app.use(routes(services))
-
-diff --git a/server/interfaces/hmppsUser.ts b/server/interfaces/hmppsUser.ts
-index f0a6dd2..8c01550 100644
---- a/server/interfaces/hmppsUser.ts
-+++ b/server/interfaces/hmppsUser.ts
-@@ -1,4 +1,6 @@
--export type AuthSource = 'nomis' | 'delius' | 'external' | 'azuread'
-+import { LaunchpadUser } from '@ministryofjustice/hmpps-prisoner-auth'
-+
-+export type AuthSource = 'nomis' | 'delius' | 'external' | 'azuread' | 'prisoner-auth'
-
- /**
-  * These are the details that all user types share.
-@@ -57,4 +59,4 @@ export interface AzureADUser extends BaseUser {
-   authSource: 'azuread'
- }
-
--export type HmppsUser = PrisonUser | ProbationUser | ExternalUser | AzureADUser
-+export type HmppsUser = PrisonUser | ProbationUser | ExternalUser | AzureADUser | LaunchpadUser
-diff --git a/server/middleware/setUpAuthentication.ts b/server/middleware/setUpAuthentication.ts
-index 1979d6e..a954198 100644
---- a/server/middleware/setUpAuthentication.ts
-+++ b/server/middleware/setUpAuthentication.ts
-@@ -1,12 +1,8 @@
- import passport from 'passport'
- import flash from 'connect-flash'
- import { Router } from 'express'
--import { Strategy } from 'passport-oauth2'
--import { VerificationClient, AuthenticatedRequest } from '@ministryofjustice/hmpps-auth-clients'
--import config from '../config'
-+import { LaunchpadUser, PrisonerAuth, minutes } from '@ministryofjustice/hmpps-prisoner-auth'
- import { HmppsUser } from '../interfaces/hmppsUser'
--import generateOauthClientToken from '../utils/clientCredentials'
--import logger from '../../logger'
-
- passport.serializeUser((user, done) => {
-   // Not used but required for Passport
-@@ -18,26 +14,17 @@ passport.deserializeUser((user, done) => {
-   done(null, user as Express.User)
- })
-
--passport.use(
--  new Strategy(
--    {
--      authorizationURL: `${config.apis.hmppsAuth.externalUrl}/oauth/authorize`,
--      tokenURL: `${config.apis.hmppsAuth.url}/oauth/token`,
--      clientID: config.apis.hmppsAuth.authClientId,
--      clientSecret: config.apis.hmppsAuth.authClientSecret,
--      callbackURL: `${config.ingressUrl}/sign-in/callback`,
--      state: true,
--      customHeaders: { Authorization: generateOauthClientToken() },
--    },
--    (token, refreshToken, params, profile, done) => {
--      return done(null, { token, username: params.user_name, authSource: params.auth_source })
--    },
--  ),
--)
-+const prisonerAuth = new PrisonerAuth({
-+  launchpadAuthUrl: 'VALUE_HERE',
-+  clientId: 'VALUE_HERE',
-+  clientSecret: 'VALUE_HERE',
-+  tokenMinimumLifespan: minutes(5),
-+})
-+
-+passport.use('prisoner-auth', prisonerAuth.passportStrategy())
-
- export default function setupAuthentication() {
-   const router = Router()
--  const tokenVerificationClient = new VerificationClient(config.apis.tokenVerification, logger)
-
-   router.use(passport.initialize())
-   router.use(passport.session())
-@@ -48,40 +35,39 @@ export default function setupAuthentication() {
-     return res.render('autherror')
-   })
-
--  router.get('/sign-in', passport.authenticate('oauth2'))
-+  router.get('/sign-in', passport.authenticate('prisoner-auth'))
-
-   router.get('/sign-in/callback', (req, res, next) =>
--    passport.authenticate('oauth2', {
-+    passport.authenticate('prisoner-auth', {
-       successReturnToOrRedirect: req.session.returnTo || '/',
-       failureRedirect: '/autherror',
-     })(req, res, next),
-   )
-
--  const authUrl = config.apis.hmppsAuth.externalUrl
--  const authParameters = `client_id=${config.apis.hmppsAuth.authClientId}&redirect_uri=${config.ingressUrl}`
--
-   router.use('/sign-out', (req, res, next) => {
--    const authSignOutUrl = `${authUrl}/sign-out?${authParameters}`
-     if (req.user) {
-       req.logout(err => {
-         if (err) return next(err)
--        return req.session.destroy(() => res.redirect(authSignOutUrl))
-+        return req.session.destroy(() => res.redirect('/'))
-       })
--    } else res.redirect(authSignOutUrl)
--  })
--
--  router.use('/account-details', (req, res) => {
--    res.redirect(`${authUrl}/account-details?${authParameters}`)
-+    } else res.redirect('/')
-   })
-
-   router.use(async (req, res, next) => {
--    if (req.isAuthenticated() && (await tokenVerificationClient.verifyToken(req as unknown as AuthenticatedRequest))) {
--      return next()
-+    if (!req.isAuthenticated()) {
-+      req.session.returnTo = req.originalUrl
-+      return res.redirect('/sign-in')
-     }
--    req.session.returnTo = req.originalUrl
--    return res.redirect('/sign-in')
--  })
-
-+    return prisonerAuth
-+      .validateAndRefreshUser(req.user as LaunchpadUser)
-+      .then(user => {
-+        req.user = user
-+        next()
-+      })
-+      .catch(() => res.redirect('/autherror'))
-+  })
-+
-   router.use((req, res, next) => {
-     res.locals.user = req.user as HmppsUser
-     next()