@mpudt/age-verification 1.0.0

package/README.md

@@ -0,0 +1,60 @@
+# age-verification
+
+mGrađani age verification client for web shops. Uses OAuth 2.1 + OIDC with PKCE.
+
+## Install
+
+```bash
+npm install @mpudt/age-verification
+```
+
+## Usage
+
+### 1. Create the client
+
+```js
+import { AgeVerificationClient } from 'age-verification';
+
+const client = new AgeVerificationClient({
+  issuer: 'https://mgradjani-test.gov.hr/idp',
+  clientId: 'your-client-id',
+  redirectUri: 'https://your-shop.com/callback',
+});
+```
+
+### 2. Redirect user to authorization
+
+On your verify button click, generate the URL and redirect:
+
+```js
+const url = await client.createAuthorizationUrl();
+window.location.href = url;
+```
+
+The user will be redirected to mGrađani, scan a QR code with their mobile app, and then redirected back to your `redirectUri` with a `code` in the query string.
+
+### 3. Handle the callback and verify age
+
+On your callback page, read the `code` from the URL and call `isAgeVerified`:
+
+```js
+const code = new URLSearchParams(window.location.search).get('code');
+const verified = await client.isAgeVerified(code);
+
+if (verified) {
+  // user is of legal drinking age
+} else {
+  // user is not verified
+}
+```
+
+`isAgeVerified` exchanges the code for a token and returns `true` or `false`.
+
+## Config
+
+| Option        | Required | Default       | Description                        |
+|---------------|----------|---------------|------------------------------------|
+| `issuer`      | yes      | —             | mGrađani IdP base URL              |
+| `clientId`    | yes      | —             | Your web shop client ID            |
+| `redirectUri` | yes      | —             | Callback URL after authorization   |
+| `scope`       | no       | `age.alcohol` | OIDC scope to request              |

package/index.d.ts

@@ -0,0 +1,14 @@
+export interface AgeVerificationConfig {
+  issuer: string;
+  clientId: string;
+  redirectUri: string;
+  scope?: string;
+}
+
+export class AgeVerificationClient {
+  constructor(config: AgeVerificationConfig);
+  initialize(): Promise<unknown>;
+  getDiscoveryDocument(): Promise<unknown>;
+  createAuthorizationUrl(): Promise<string>;
+  isAgeVerified(code: string): Promise<boolean>;
+}

package/index.js

@@ -0,0 +1,128 @@
+const { jwtDecode } = require("jwt-decode");
+
+class AgeVerificationClient {
+  constructor({ issuer, clientId, redirectUri, scope = "age.alcohol" }) {
+    if (!issuer) throw new Error("issuer is required");
+    if (!clientId) throw new Error("clientId is required");
+    if (!redirectUri) throw new Error("redirectUri is required");
+
+    this.issuer = issuer.replace(/\/$/, "");
+    this.clientId = clientId;
+    this.redirectUri = redirectUri;
+    this.scope = scope;
+
+    this.discovery = null;
+  }
+
+  async initialize() {
+    const response = await fetch(
+      `${this.issuer}/.well-known/openid-configuration`,
+    );
+
+    if (!response.ok) {
+      throw new Error("Unable to load OpenID configuration");
+    }
+
+    this.discovery = await response.json();
+
+    return this.discovery;
+  }
+
+  async getDiscoveryDocument() {
+    if (!this.discovery) {
+      await this.initialize();
+    }
+
+    return this.discovery;
+  }
+
+  async createAuthorizationUrl() {
+    const discovery = await this.getDiscoveryDocument();
+
+    const state = randomString();
+    const nonce = randomString();
+    const verifier = randomString(64);
+    const challenge = await sha256(verifier);
+
+    sessionStorage.setItem("pkce_verifier", verifier);
+    sessionStorage.setItem("oidc_state", state);
+    sessionStorage.setItem("oidc_nonce", nonce);
+
+    const params = new URLSearchParams({
+      response_type: "code",
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      scope: this.scope,
+      state,
+      nonce,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+
+    return `${discovery.authorization_endpoint}?${params.toString()}`;
+  }
+
+  async isAgeVerified(code) {
+    if (!code) {
+      throw new Error("authorization code is required");
+    }
+
+    const discovery = await this.getDiscoveryDocument();
+
+    const verifier = sessionStorage.getItem("pkce_verifier");
+
+    if (!verifier) {
+      throw new Error("Missing PKCE verifier");
+    }
+
+    const body = new URLSearchParams({
+      grant_type: "authorization_code",
+      code,
+      client_id: this.clientId,
+      redirect_uri: this.redirectUri,
+      code_verifier: verifier,
+    });
+
+    const response = await fetch(discovery.token_endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body,
+    });
+
+    if (!response.ok) {
+      throw new Error("Token exchange failed");
+    }
+
+    const tokens = await response.json();
+
+    const isVerified =
+      tokens.id_token && jwtDecode(tokens.id_token)["age.alcohol"];
+
+    return isVerified;
+  }
+}
+
+function randomString(length = 32) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return btoa(String.fromCharCode(...bytes))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+async function sha256(value) {
+  const encoded = new TextEncoder().encode(value);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", encoded);
+  const hashArray = new Uint8Array(hashBuffer);
+  return btoa(String.fromCharCode(...hashArray))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/, "");
+}
+
+module.exports = {
+  AgeVerificationClient,
+};

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@mpudt/age-verification",
+  "version": "1.0.0",
+  "main": "index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "build": "node --check index.js"
+  },
+  "dependencies": {
+    "jwt-decode": "^4.0.0"
+  }
+}