@ministryofjustice/hmpps-prisoner-auth 0.0.9 → 0.0.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs.js +11 -183
- package/dist/index.cjs.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.esm.js +11 -178
- package/dist/index.esm.js.map +1 -1
- package/dist/main/launchpadUser.d.ts +2 -0
- package/package.json +2 -2
package/dist/index.cjs.js
CHANGED
|
@@ -1,186 +1,14 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
};
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
.post(tokenUrl)
|
|
15
|
-
.set('Content-Type', 'application/x-www-form-urlencoded')
|
|
16
|
-
.set('Authorization', authorizationHeader)
|
|
17
|
-
.query({ refresh_token: userRefreshToken, grant_type: 'refresh_token' })
|
|
18
|
-
.end((err, res) => {
|
|
19
|
-
if (err)
|
|
20
|
-
reject(err);
|
|
21
|
-
const { id_token: idToken, access_token: accessToken, refresh_token: refreshToken } = res.body;
|
|
22
|
-
return resolve({ idToken, accessToken, refreshToken });
|
|
23
|
-
});
|
|
24
|
-
});
|
|
25
|
-
};
|
|
26
|
-
|
|
27
|
-
const userFromTokens = ({ idToken, accessToken, refreshToken }) => {
|
|
28
|
-
const parsedIdToken = tokenFromJwt(idToken);
|
|
29
|
-
const { name, sub, establishment } = parsedIdToken;
|
|
30
|
-
const authSource = 'prisoner-auth';
|
|
31
|
-
return {
|
|
32
|
-
establishment,
|
|
33
|
-
idToken: parsedIdToken,
|
|
34
|
-
refreshToken,
|
|
35
|
-
accessToken,
|
|
36
|
-
authSource,
|
|
37
|
-
name,
|
|
38
|
-
token: idToken,
|
|
39
|
-
username: sub,
|
|
40
|
-
userId: sub,
|
|
41
|
-
displayName: name,
|
|
42
|
-
userRoles: [],
|
|
43
|
-
};
|
|
44
|
-
};
|
|
45
|
-
|
|
46
|
-
// A TimeSpan allows you to give meaning to a number and then read that number back and compare them in different formats
|
|
47
|
-
// ie.
|
|
48
|
-
// seconds(60).minutes === 1
|
|
49
|
-
// seconds(30).seconds === 30
|
|
50
|
-
// minutes(1).seconds === 60
|
|
51
|
-
// milliseconds(1000).seconds === 1
|
|
52
|
-
// milliseconds(2000).isEqualTo(seconds(2)) #=> true
|
|
53
|
-
// minutes(5).
|
|
54
|
-
// This allows a caller to just accept a TimeSpan and then work in the units it cares about
|
|
55
|
-
const minutes = (numMinutes) => TimeSpan.minutes(numMinutes);
|
|
56
|
-
const seconds = (numSeconds) => TimeSpan.seconds(numSeconds);
|
|
57
|
-
const milliseconds = (numMilliseconds) => TimeSpan.milliseconds(numMilliseconds);
|
|
58
|
-
const nothing = () => TimeSpan.nothing();
|
|
59
|
-
// Get a time span in the future
|
|
60
|
-
const timeFromNow = (fromNow) => milliseconds(Date.now() + fromNow.milliseconds);
|
|
61
|
-
// Implementation
|
|
62
|
-
class TimeSpan {
|
|
63
|
-
minutes;
|
|
64
|
-
seconds;
|
|
65
|
-
milliseconds;
|
|
66
|
-
constructor(numMinutes, numSeconds, numMilliseconds) {
|
|
67
|
-
this.minutes = numMinutes;
|
|
68
|
-
this.seconds = numSeconds;
|
|
69
|
-
this.milliseconds = numMilliseconds;
|
|
70
|
-
}
|
|
71
|
-
static minutes(numMinutes) {
|
|
72
|
-
return new TimeSpan(numMinutes, numMinutes * 60, TimeSpan.seconds(numMinutes * 60).milliseconds);
|
|
73
|
-
}
|
|
74
|
-
static seconds(numSeconds) {
|
|
75
|
-
return new TimeSpan(numSeconds / 60, numSeconds, numSeconds * 1000);
|
|
76
|
-
}
|
|
77
|
-
static milliseconds(numMilliseconds) {
|
|
78
|
-
return new TimeSpan(TimeSpan.seconds(numMilliseconds / 1000).minutes, numMilliseconds / 1000, numMilliseconds);
|
|
79
|
-
}
|
|
80
|
-
static nothing() {
|
|
81
|
-
return new TimeSpan(0, 0, 0);
|
|
82
|
-
}
|
|
83
|
-
isGreaterThan(t) {
|
|
84
|
-
return this.milliseconds > t.milliseconds;
|
|
85
|
-
}
|
|
86
|
-
isGreaterThanOrEqualTo(t) {
|
|
87
|
-
return this.milliseconds >= t.milliseconds;
|
|
88
|
-
}
|
|
89
|
-
isLessThan(t) {
|
|
90
|
-
return this.milliseconds < t.milliseconds;
|
|
91
|
-
}
|
|
92
|
-
isLessThanOrEqualTo(t) {
|
|
93
|
-
return this.milliseconds <= t.milliseconds;
|
|
94
|
-
}
|
|
95
|
-
isEqualTo(t) {
|
|
96
|
-
return this.milliseconds === t.milliseconds;
|
|
97
|
-
}
|
|
98
|
-
}
|
|
99
|
-
|
|
100
|
-
const nullOnLoginSuccessCallback = _ => Promise.resolve();
|
|
101
|
-
class PrisonerAuth {
|
|
102
|
-
launchpadAuthUrl;
|
|
103
|
-
authorizationUrl;
|
|
104
|
-
tokenUrl;
|
|
105
|
-
callbackUrl;
|
|
106
|
-
onLoginSuccessCallback;
|
|
107
|
-
clientId;
|
|
108
|
-
clientSecret;
|
|
109
|
-
scope;
|
|
110
|
-
nonce;
|
|
111
|
-
tokenMinimumLifespan;
|
|
112
|
-
tokenFetcher;
|
|
113
|
-
constructor(options) {
|
|
114
|
-
this.launchpadAuthUrl = options.launchpadAuthUrl;
|
|
115
|
-
this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`;
|
|
116
|
-
this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`;
|
|
117
|
-
this.callbackUrl = options.callbackUrl ?? '/sign-in/callback';
|
|
118
|
-
this.onLoginSuccessCallback = options.onLoginSuccessCallback ?? nullOnLoginSuccessCallback;
|
|
119
|
-
this.clientId = options.clientId;
|
|
120
|
-
this.clientSecret = options.clientSecret;
|
|
121
|
-
this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read'];
|
|
122
|
-
this.nonce = options.nonce ?? true;
|
|
123
|
-
this.tokenMinimumLifespan = options.tokenMinimumLifespan;
|
|
124
|
-
this.tokenFetcher = options.tokenFetcher ?? tokenFetcher;
|
|
125
|
-
}
|
|
126
|
-
/**
|
|
127
|
-
*
|
|
128
|
-
* @returns OpenIDConnectStrategy ready for use with passport
|
|
129
|
-
*/
|
|
130
|
-
passportStrategy() {
|
|
131
|
-
return new OpenIDConnectStrategy({
|
|
132
|
-
issuer: this.launchpadAuthUrl,
|
|
133
|
-
authorizationURL: this.authorizationUrl,
|
|
134
|
-
tokenURL: this.tokenUrl,
|
|
135
|
-
callbackURL: this.callbackUrl,
|
|
136
|
-
clientID: this.clientId,
|
|
137
|
-
clientSecret: this.clientSecret,
|
|
138
|
-
scope: this.scope,
|
|
139
|
-
userInfoURL: '',
|
|
140
|
-
skipUserProfile: true,
|
|
141
|
-
nonce: this.nonce ? 'true' : undefined,
|
|
142
|
-
customHeaders: { authorization: this.authorizationToken() },
|
|
143
|
-
}, (async (_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => {
|
|
144
|
-
const user = userFromTokens({ idToken, accessToken, refreshToken });
|
|
145
|
-
await this.onLoginSuccessCallback(user);
|
|
146
|
-
done(null, user);
|
|
147
|
-
}));
|
|
148
|
-
}
|
|
149
|
-
/**
|
|
150
|
-
* Checks the expiry of a given LaunchpadUser idToken and refreshToken.
|
|
151
|
-
* - If the idToken has expired it will attempt to refresh it using the refreshToken.
|
|
152
|
-
* - If the refreshToken has expired it will throw an Error.
|
|
153
|
-
*
|
|
154
|
-
* This method will always return a LaunchpadUser so it is suggested to updated your local copy and it will keep the tokens up to date.
|
|
155
|
-
*
|
|
156
|
-
* @param user - The LaunchpadUser instance to check token expiry on.
|
|
157
|
-
* @returns A LaunchpadUser is always returned, either the given user or a user with refreshed tokens.
|
|
158
|
-
* @throws Error is thrown if the refreshToken has expired, the user must sign in again from scratch.
|
|
159
|
-
*/
|
|
160
|
-
async validateAndRefreshUser(user) {
|
|
161
|
-
const refreshToken = tokenFromJwt(user.refreshToken);
|
|
162
|
-
const tokenExpiryTime = timeFromNow(this.tokenMinimumLifespan);
|
|
163
|
-
// Id Token still valid, return the current user
|
|
164
|
-
if (seconds(user.idToken.exp).isGreaterThanOrEqualTo(tokenExpiryTime)) {
|
|
165
|
-
return user;
|
|
166
|
-
}
|
|
167
|
-
// Refresh token expired, cannot continue
|
|
168
|
-
if (seconds(refreshToken.exp).isLessThan(tokenExpiryTime)) {
|
|
169
|
-
throw new Error('Refresh token expired');
|
|
170
|
-
}
|
|
171
|
-
// Refresh the user tokens
|
|
172
|
-
const newTokens = await this.tokenFetcher(user.refreshToken, this.tokenUrl, this.authorizationToken());
|
|
173
|
-
return userFromTokens(newTokens);
|
|
174
|
-
}
|
|
175
|
-
authorizationToken() {
|
|
176
|
-
return oauthClientToken(this.clientId, this.clientSecret);
|
|
177
|
-
}
|
|
178
|
-
}
|
|
179
|
-
|
|
180
|
-
exports.PrisonerAuth = PrisonerAuth;
|
|
181
|
-
exports.TimeSpan = TimeSpan;
|
|
182
|
-
exports.milliseconds = milliseconds;
|
|
183
|
-
exports.minutes = minutes;
|
|
184
|
-
exports.nothing = nothing;
|
|
185
|
-
exports.seconds = seconds;
|
|
3
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
+
exports.TimeSpan = exports.nothing = exports.milliseconds = exports.seconds = exports.minutes = exports.PrisonerAuth = void 0;
|
|
5
|
+
const tslib_1 = require("tslib");
|
|
6
|
+
var prisonerAuth_1 = require("./prisonerAuth");
|
|
7
|
+
Object.defineProperty(exports, "PrisonerAuth", { enumerable: true, get: function () { return tslib_1.__importDefault(prisonerAuth_1).default; } });
|
|
8
|
+
var timeSpans_1 = require("./timeSpans");
|
|
9
|
+
Object.defineProperty(exports, "minutes", { enumerable: true, get: function () { return timeSpans_1.minutes; } });
|
|
10
|
+
Object.defineProperty(exports, "seconds", { enumerable: true, get: function () { return timeSpans_1.seconds; } });
|
|
11
|
+
Object.defineProperty(exports, "milliseconds", { enumerable: true, get: function () { return timeSpans_1.milliseconds; } });
|
|
12
|
+
Object.defineProperty(exports, "nothing", { enumerable: true, get: function () { return timeSpans_1.nothing; } });
|
|
13
|
+
Object.defineProperty(exports, "TimeSpan", { enumerable: true, get: function () { return timeSpans_1.TimeSpan; } });
|
|
186
14
|
//# sourceMappingURL=index.cjs.js.map
|
package/dist/index.cjs.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.cjs.js","sources":["../src/main/
|
|
1
|
+
{"version":3,"file":"index.cjs.js","sources":["../src/main/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;;;AAAA,IAAA,cAAA,GAAA,OAAA,CAAA,gBAAA,CAAA;AAAS,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,cAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,OAAA,CAAA,eAAA,CAAA,cAAA,CAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAChB,IAAA,WAAA,GAAA,OAAA,CAAA,aAAA,CAAA;AAAS,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,cAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,YAAY,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,UAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,QAAQ,CAAA,CAAA,CAAA,EAAA,CAAA"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import OpenIDConnectStrategy from 'passport-openidconnect';
|
|
2
|
+
import { UUID } from 'crypto';
|
|
2
3
|
|
|
3
4
|
type IdToken = {
|
|
4
5
|
name: string;
|
|
@@ -34,6 +35,7 @@ type HmppsUserCompatibility = {
|
|
|
34
35
|
token: string;
|
|
35
36
|
username: string;
|
|
36
37
|
userId: string;
|
|
38
|
+
userUuid: UUID | undefined;
|
|
37
39
|
displayName: string;
|
|
38
40
|
userRoles: string[];
|
|
39
41
|
};
|
package/dist/index.esm.js
CHANGED
|
@@ -1,179 +1,12 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
};
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
.post(tokenUrl)
|
|
13
|
-
.set('Content-Type', 'application/x-www-form-urlencoded')
|
|
14
|
-
.set('Authorization', authorizationHeader)
|
|
15
|
-
.query({ refresh_token: userRefreshToken, grant_type: 'refresh_token' })
|
|
16
|
-
.end((err, res) => {
|
|
17
|
-
if (err)
|
|
18
|
-
reject(err);
|
|
19
|
-
const { id_token: idToken, access_token: accessToken, refresh_token: refreshToken } = res.body;
|
|
20
|
-
return resolve({ idToken, accessToken, refreshToken });
|
|
21
|
-
});
|
|
22
|
-
});
|
|
23
|
-
};
|
|
24
|
-
|
|
25
|
-
const userFromTokens = ({ idToken, accessToken, refreshToken }) => {
|
|
26
|
-
const parsedIdToken = tokenFromJwt(idToken);
|
|
27
|
-
const { name, sub, establishment } = parsedIdToken;
|
|
28
|
-
const authSource = 'prisoner-auth';
|
|
29
|
-
return {
|
|
30
|
-
establishment,
|
|
31
|
-
idToken: parsedIdToken,
|
|
32
|
-
refreshToken,
|
|
33
|
-
accessToken,
|
|
34
|
-
authSource,
|
|
35
|
-
name,
|
|
36
|
-
token: idToken,
|
|
37
|
-
username: sub,
|
|
38
|
-
userId: sub,
|
|
39
|
-
displayName: name,
|
|
40
|
-
userRoles: [],
|
|
41
|
-
};
|
|
42
|
-
};
|
|
43
|
-
|
|
44
|
-
// A TimeSpan allows you to give meaning to a number and then read that number back and compare them in different formats
|
|
45
|
-
// ie.
|
|
46
|
-
// seconds(60).minutes === 1
|
|
47
|
-
// seconds(30).seconds === 30
|
|
48
|
-
// minutes(1).seconds === 60
|
|
49
|
-
// milliseconds(1000).seconds === 1
|
|
50
|
-
// milliseconds(2000).isEqualTo(seconds(2)) #=> true
|
|
51
|
-
// minutes(5).
|
|
52
|
-
// This allows a caller to just accept a TimeSpan and then work in the units it cares about
|
|
53
|
-
const minutes = (numMinutes) => TimeSpan.minutes(numMinutes);
|
|
54
|
-
const seconds = (numSeconds) => TimeSpan.seconds(numSeconds);
|
|
55
|
-
const milliseconds = (numMilliseconds) => TimeSpan.milliseconds(numMilliseconds);
|
|
56
|
-
const nothing = () => TimeSpan.nothing();
|
|
57
|
-
// Get a time span in the future
|
|
58
|
-
const timeFromNow = (fromNow) => milliseconds(Date.now() + fromNow.milliseconds);
|
|
59
|
-
// Implementation
|
|
60
|
-
class TimeSpan {
|
|
61
|
-
minutes;
|
|
62
|
-
seconds;
|
|
63
|
-
milliseconds;
|
|
64
|
-
constructor(numMinutes, numSeconds, numMilliseconds) {
|
|
65
|
-
this.minutes = numMinutes;
|
|
66
|
-
this.seconds = numSeconds;
|
|
67
|
-
this.milliseconds = numMilliseconds;
|
|
68
|
-
}
|
|
69
|
-
static minutes(numMinutes) {
|
|
70
|
-
return new TimeSpan(numMinutes, numMinutes * 60, TimeSpan.seconds(numMinutes * 60).milliseconds);
|
|
71
|
-
}
|
|
72
|
-
static seconds(numSeconds) {
|
|
73
|
-
return new TimeSpan(numSeconds / 60, numSeconds, numSeconds * 1000);
|
|
74
|
-
}
|
|
75
|
-
static milliseconds(numMilliseconds) {
|
|
76
|
-
return new TimeSpan(TimeSpan.seconds(numMilliseconds / 1000).minutes, numMilliseconds / 1000, numMilliseconds);
|
|
77
|
-
}
|
|
78
|
-
static nothing() {
|
|
79
|
-
return new TimeSpan(0, 0, 0);
|
|
80
|
-
}
|
|
81
|
-
isGreaterThan(t) {
|
|
82
|
-
return this.milliseconds > t.milliseconds;
|
|
83
|
-
}
|
|
84
|
-
isGreaterThanOrEqualTo(t) {
|
|
85
|
-
return this.milliseconds >= t.milliseconds;
|
|
86
|
-
}
|
|
87
|
-
isLessThan(t) {
|
|
88
|
-
return this.milliseconds < t.milliseconds;
|
|
89
|
-
}
|
|
90
|
-
isLessThanOrEqualTo(t) {
|
|
91
|
-
return this.milliseconds <= t.milliseconds;
|
|
92
|
-
}
|
|
93
|
-
isEqualTo(t) {
|
|
94
|
-
return this.milliseconds === t.milliseconds;
|
|
95
|
-
}
|
|
96
|
-
}
|
|
97
|
-
|
|
98
|
-
const nullOnLoginSuccessCallback = _ => Promise.resolve();
|
|
99
|
-
class PrisonerAuth {
|
|
100
|
-
launchpadAuthUrl;
|
|
101
|
-
authorizationUrl;
|
|
102
|
-
tokenUrl;
|
|
103
|
-
callbackUrl;
|
|
104
|
-
onLoginSuccessCallback;
|
|
105
|
-
clientId;
|
|
106
|
-
clientSecret;
|
|
107
|
-
scope;
|
|
108
|
-
nonce;
|
|
109
|
-
tokenMinimumLifespan;
|
|
110
|
-
tokenFetcher;
|
|
111
|
-
constructor(options) {
|
|
112
|
-
this.launchpadAuthUrl = options.launchpadAuthUrl;
|
|
113
|
-
this.authorizationUrl = options.authorizationUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/authorize`;
|
|
114
|
-
this.tokenUrl = options.tokenUrl ?? `${options.launchpadAuthUrl}/v1/oauth2/token`;
|
|
115
|
-
this.callbackUrl = options.callbackUrl ?? '/sign-in/callback';
|
|
116
|
-
this.onLoginSuccessCallback = options.onLoginSuccessCallback ?? nullOnLoginSuccessCallback;
|
|
117
|
-
this.clientId = options.clientId;
|
|
118
|
-
this.clientSecret = options.clientSecret;
|
|
119
|
-
this.scope = options.scope ?? ['user.basic.read', 'user.establishment.read', 'user.booking.read'];
|
|
120
|
-
this.nonce = options.nonce ?? true;
|
|
121
|
-
this.tokenMinimumLifespan = options.tokenMinimumLifespan;
|
|
122
|
-
this.tokenFetcher = options.tokenFetcher ?? tokenFetcher;
|
|
123
|
-
}
|
|
124
|
-
/**
|
|
125
|
-
*
|
|
126
|
-
* @returns OpenIDConnectStrategy ready for use with passport
|
|
127
|
-
*/
|
|
128
|
-
passportStrategy() {
|
|
129
|
-
return new OpenIDConnectStrategy({
|
|
130
|
-
issuer: this.launchpadAuthUrl,
|
|
131
|
-
authorizationURL: this.authorizationUrl,
|
|
132
|
-
tokenURL: this.tokenUrl,
|
|
133
|
-
callbackURL: this.callbackUrl,
|
|
134
|
-
clientID: this.clientId,
|
|
135
|
-
clientSecret: this.clientSecret,
|
|
136
|
-
scope: this.scope,
|
|
137
|
-
userInfoURL: '',
|
|
138
|
-
skipUserProfile: true,
|
|
139
|
-
nonce: this.nonce ? 'true' : undefined,
|
|
140
|
-
customHeaders: { authorization: this.authorizationToken() },
|
|
141
|
-
}, (async (_issuer, _profile, _context, idToken, accessToken, refreshToken, done) => {
|
|
142
|
-
const user = userFromTokens({ idToken, accessToken, refreshToken });
|
|
143
|
-
await this.onLoginSuccessCallback(user);
|
|
144
|
-
done(null, user);
|
|
145
|
-
}));
|
|
146
|
-
}
|
|
147
|
-
/**
|
|
148
|
-
* Checks the expiry of a given LaunchpadUser idToken and refreshToken.
|
|
149
|
-
* - If the idToken has expired it will attempt to refresh it using the refreshToken.
|
|
150
|
-
* - If the refreshToken has expired it will throw an Error.
|
|
151
|
-
*
|
|
152
|
-
* This method will always return a LaunchpadUser so it is suggested to updated your local copy and it will keep the tokens up to date.
|
|
153
|
-
*
|
|
154
|
-
* @param user - The LaunchpadUser instance to check token expiry on.
|
|
155
|
-
* @returns A LaunchpadUser is always returned, either the given user or a user with refreshed tokens.
|
|
156
|
-
* @throws Error is thrown if the refreshToken has expired, the user must sign in again from scratch.
|
|
157
|
-
*/
|
|
158
|
-
async validateAndRefreshUser(user) {
|
|
159
|
-
const refreshToken = tokenFromJwt(user.refreshToken);
|
|
160
|
-
const tokenExpiryTime = timeFromNow(this.tokenMinimumLifespan);
|
|
161
|
-
// Id Token still valid, return the current user
|
|
162
|
-
if (seconds(user.idToken.exp).isGreaterThanOrEqualTo(tokenExpiryTime)) {
|
|
163
|
-
return user;
|
|
164
|
-
}
|
|
165
|
-
// Refresh token expired, cannot continue
|
|
166
|
-
if (seconds(refreshToken.exp).isLessThan(tokenExpiryTime)) {
|
|
167
|
-
throw new Error('Refresh token expired');
|
|
168
|
-
}
|
|
169
|
-
// Refresh the user tokens
|
|
170
|
-
const newTokens = await this.tokenFetcher(user.refreshToken, this.tokenUrl, this.authorizationToken());
|
|
171
|
-
return userFromTokens(newTokens);
|
|
172
|
-
}
|
|
173
|
-
authorizationToken() {
|
|
174
|
-
return oauthClientToken(this.clientId, this.clientSecret);
|
|
175
|
-
}
|
|
176
|
-
}
|
|
177
|
-
|
|
178
|
-
export { PrisonerAuth, TimeSpan, milliseconds, minutes, nothing, seconds };
|
|
1
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
2
|
+
exports.TimeSpan = exports.nothing = exports.milliseconds = exports.seconds = exports.minutes = exports.PrisonerAuth = void 0;
|
|
3
|
+
const tslib_1 = require("tslib");
|
|
4
|
+
var prisonerAuth_1 = require("./prisonerAuth");
|
|
5
|
+
Object.defineProperty(exports, "PrisonerAuth", { enumerable: true, get: function () { return tslib_1.__importDefault(prisonerAuth_1).default; } });
|
|
6
|
+
var timeSpans_1 = require("./timeSpans");
|
|
7
|
+
Object.defineProperty(exports, "minutes", { enumerable: true, get: function () { return timeSpans_1.minutes; } });
|
|
8
|
+
Object.defineProperty(exports, "seconds", { enumerable: true, get: function () { return timeSpans_1.seconds; } });
|
|
9
|
+
Object.defineProperty(exports, "milliseconds", { enumerable: true, get: function () { return timeSpans_1.milliseconds; } });
|
|
10
|
+
Object.defineProperty(exports, "nothing", { enumerable: true, get: function () { return timeSpans_1.nothing; } });
|
|
11
|
+
Object.defineProperty(exports, "TimeSpan", { enumerable: true, get: function () { return timeSpans_1.TimeSpan; } });
|
|
179
12
|
//# sourceMappingURL=index.esm.js.map
|
package/dist/index.esm.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.esm.js","sources":["../src/main/
|
|
1
|
+
{"version":3,"file":"index.esm.js","sources":["../src/main/index.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AAAA,IAAA,cAAA,GAAA,OAAA,CAAA,gBAAA,CAAA;AAAS,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,cAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,OAAA,CAAA,eAAA,CAAA,cAAA,CAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAChB,IAAA,WAAA,GAAA,OAAA,CAAA,aAAA,CAAA;AAAS,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,cAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,YAAY,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,SAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,OAAO,CAAA,CAAA,CAAA,EAAA,CAAA;AAAE,MAAA,CAAA,cAAA,CAAA,OAAA,EAAA,UAAA,EAAA,EAAA,UAAA,EAAA,IAAA,EAAA,GAAA,EAAA,YAAA,EAAA,OAAA,WAAA,CAAA,QAAQ,CAAA,CAAA,CAAA,EAAA,CAAA"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { UUID } from 'crypto';
|
|
1
2
|
import { IdToken, RawTokens } from './tokens';
|
|
2
3
|
type HmppsUserCompatibility = {
|
|
3
4
|
authSource: 'prisoner-auth';
|
|
@@ -5,6 +6,7 @@ type HmppsUserCompatibility = {
|
|
|
5
6
|
token: string;
|
|
6
7
|
username: string;
|
|
7
8
|
userId: string;
|
|
9
|
+
userUuid: UUID | undefined;
|
|
8
10
|
displayName: string;
|
|
9
11
|
userRoles: string[];
|
|
10
12
|
};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ministryofjustice/hmpps-prisoner-auth",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.11",
|
|
4
4
|
"description": "Middleware for providing authentication against Launchpad Auth",
|
|
5
5
|
"author": "hmpps-launchpad-devs",
|
|
6
6
|
"license": "MIT",
|
|
@@ -39,7 +39,7 @@
|
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
41
|
"passport-openidconnect": "^0.1.2",
|
|
42
|
-
"superagent": "^10.
|
|
42
|
+
"superagent": "^10.4.1"
|
|
43
43
|
},
|
|
44
44
|
"peerDependencies": {
|
|
45
45
|
"express": "^5.2.1"
|