@opensas/oidc-sveltekit-adapter 0.0.0-stage → 0.0.2

package/dist/oidc/provider.js

@@ -0,0 +1,134 @@
+import * as client from 'openid-client';
+import { OidcError } from "./errors.js";
+import { safeReturnTo } from "./request.js";
+// Keycloak rechaza los scopes que no conoce (invalid_scope): allatclaims, el de ADFS, no va por defecto
+export const DEFAULT_SCOPE = 'openid profile email';
+// /login?returnTo=/pagina: a dónde volver después del login
+export const RETURN_TO_PARAM = 'returnTo';
+const JWT_PARTS = 3;
+// Errores de openid-client (oauth4webapi) que dicen que el id_token no es válido: firma (llega
+// como respuesta inválida), iss, aud, exp, nonce, o la clave del JWKS.
+const INVALID_ID_TOKEN_ERROR_CODES = new Set([
+    'OAUTH_INVALID_RESPONSE',
+    'OAUTH_JWT_CLAIM_COMPARISON_FAILED',
+    'OAUTH_JWT_TIMESTAMP_CHECK_FAILED',
+    'OAUTH_KEY_SELECTION_FAILED',
+]);
+// Discovery la primera vez que se usa; si falla, no se cachea el error y el próximo pedido reintenta.
+// Así la app levanta aunque el proveedor esté caído.
+export function createOidcProvider(options) {
+    const scope = options.scope ?? DEFAULT_SCOPE;
+    let configuration;
+    // Una sola promesa compartida: los pedidos que llegan mientras se resuelve esperan la misma
+    function discover() {
+        configuration ??= runDiscovery();
+        return configuration;
+    }
+    async function runDiscovery() {
+        try {
+            return await client.discovery(new URL(options.issuer), options.clientId, options.clientSecret, options.clientSecret ? undefined : client.None(), options.allowInsecureRequests ? { execute: [client.allowInsecureRequests] } : undefined);
+        }
+        catch (err) {
+            configuration = undefined;
+            throw new OidcError('DISCOVERY', `no se pudo leer el discovery de ${options.issuer}`, {
+                cause: err,
+            });
+        }
+    }
+    return {
+        async buildLoginUrl(loginUrl) {
+            const config = await discover();
+            const codeVerifier = client.randomPKCECodeVerifier();
+            const state = client.randomState();
+            const nonce = client.randomNonce();
+            const providerUrl = client.buildAuthorizationUrl(config, {
+                redirect_uri: new URL(options.callbackPath, loginUrl.origin).href,
+                scope,
+                code_challenge: await client.calculatePKCECodeChallenge(codeVerifier),
+                code_challenge_method: 'S256',
+                state,
+                nonce,
+            });
+            const returnTo = safeReturnTo(loginUrl.searchParams.get(RETURN_TO_PARAM));
+            return { providerUrl, pendingLogin: { codeVerifier, state, nonce, returnTo } };
+        },
+        async exchangeCode(callbackUrl, pendingLogin) {
+            // Antes de openid-client: sus errores no distinguen estos casos de un id_token inválido
+            const providerError = callbackUrl.searchParams.get('error');
+            if (providerError)
+                throw new OidcError('PROVIDER_ERROR', 'el proveedor devolvió un error en el callback', {
+                    providerError,
+                    providerErrorDescription: callbackUrl.searchParams.get('error_description') ?? undefined,
+                });
+            if (!pendingLogin)
+                throw new OidcError('NO_LOGIN_IN_PROGRESS', 'no hay un login en curso');
+            if (callbackUrl.searchParams.get('state') !== pendingLogin.state)
+                throw new OidcError('STATE_MISMATCH', 'el state del callback no coincide');
+            const config = await discover();
+            let response;
+            try {
+                response = await client.authorizationCodeGrant(config, callbackUrl, {
+                    pkceCodeVerifier: pendingLogin.codeVerifier,
+                    expectedState: pendingLogin.state,
+                    expectedNonce: pendingLogin.nonce,
+                    idTokenExpected: true,
+                });
+            }
+            catch (err) {
+                throw toOidcError(err);
+            }
+            const idTokenClaims = response.claims();
+            if (!response.id_token || !idTokenClaims)
+                throw new OidcError('INVALID_ID_TOKEN', 'el proveedor no devolvió un id_token');
+            return {
+                idToken: response.id_token,
+                accessToken: response.access_token,
+                refreshToken: response.refresh_token,
+                idTokenClaims: { ...idTokenClaims },
+                accessTokenClaims: decodeJwtPayload(response.access_token),
+            };
+        },
+        async buildLogoutUrl(idToken, postLogoutRedirectUri) {
+            const config = await discover();
+            return config.serverMetadata().end_session_endpoint
+                ? client.buildEndSessionUrl(config, {
+                    ...(idToken && { id_token_hint: idToken }),
+                    post_logout_redirect_uri: postLogoutRedirectUri,
+                })
+                : undefined;
+        },
+    };
+}
+function toOidcError(err) {
+    if (err instanceof client.AuthorizationResponseError)
+        return new OidcError('PROVIDER_ERROR', 'el proveedor devolvió un error en el callback', {
+            providerError: err.error,
+            providerErrorDescription: err.error_description,
+            cause: err,
+        });
+    if (err instanceof client.ResponseBodyError)
+        return new OidcError('TOKEN_EXCHANGE', 'el proveedor rechazó el canje del code', {
+            providerError: err.error,
+            providerErrorDescription: err.error_description,
+            cause: err,
+        });
+    const code = err instanceof Error && 'code' in err ? err.code : undefined;
+    if (typeof code === 'string' && INVALID_ID_TOKEN_ERROR_CODES.has(code))
+        return new OidcError('INVALID_ID_TOKEN', 'el id_token no es válido', { cause: err });
+    return new OidcError('TOKEN_EXCHANGE', 'falló el canje del code', { cause: err });
+}
+// Payload de un JWT sin verificar la firma, o undefined si no es un JWT
+function decodeJwtPayload(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== JWT_PARTS)
+        return undefined;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return typeof payload === 'object' && payload !== null && !Array.isArray(payload)
+            ? payload
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/oidc/request.d.ts

@@ -0,0 +1,4 @@
+export declare const DEFAULT_RETURN_TO = "/";
+export declare function isSameOrigin(request: Request, origin: string): boolean;
+export declare function isNavigation(request: Request): boolean;
+export declare function safeReturnTo(value: string | null | undefined): string;

package/dist/oidc/request.js

@@ -0,0 +1,23 @@
+export const DEFAULT_RETURN_TO = '/';
+const HTML_MEDIA_TYPE = 'text/html';
+// La cabecera Origin del pedido es la de la app. Sin Origin, no: el logout lo hace un form del
+// propio sitio, y los navegadores mandan Origin en todo POST.
+export function isSameOrigin(request, origin) {
+    return request.headers.get('origin') === origin;
+}
+// Una navegación del navegador (GET que acepta text/html), no un fetch de la app. Las navegaciones
+// del lado del cliente de un framework (SvelteKit: event.isDataRequest) llegan como fetch: las
+// tiene que sumar la app.
+export function isNavigation(request) {
+    return (request.method === 'GET' && Boolean(request.headers.get('accept')?.includes(HTML_MEDIA_TYPE)));
+}
+// Solo rutas propias: empieza con una sola '/'. '//otro-sitio' y '/\otro-sitio' los navegadores los
+// toman como una URL de otro origen (open redirect), igual que 'https://otro-sitio'.
+export function safeReturnTo(value) {
+    if (!value?.startsWith('/'))
+        return DEFAULT_RETURN_TO;
+    const second = value.charAt(1);
+    if (second === '/' || second === '\\')
+        return DEFAULT_RETURN_TO;
+    return value;
+}

package/dist/oidc/types.d.ts

@@ -0,0 +1 @@
+export type Claims = Record<string, unknown>;

package/dist/oidc/types.js

@@ -0,0 +1 @@
+export {};

package/dist/oidc/user.d.ts

@@ -0,0 +1,10 @@
+import { type DomainUserOptions } from './domain-user.ts';
+import { type Permissions } from './permissions.ts';
+import type { Tokens } from './provider.ts';
+export type OidcUser = {
+    domainUser: string;
+    name?: string;
+    groups: string[];
+    permissions: Permissions;
+};
+export declare function getUser(tokens: Pick<Tokens, 'idTokenClaims' | 'accessTokenClaims'>, options?: DomainUserOptions): OidcUser | undefined;

package/dist/oidc/user.js

@@ -0,0 +1,27 @@
+import { getDomainUser } from "./domain-user.js";
+import { getPermissions } from "./permissions.js";
+// El usuario a partir de los tokens de exchangeCode, o undefined si no hay usuario de red. El
+// nombre, primero del id_token (validado). Grupos y roles, del access token: Keycloak los manda
+// solo ahí. Los roles son los del client al que se le emitió el token (claim azp). Sin access
+// token JWT, sin grupos ni permisos. Guardarlo (la sesión) es cosa de la app.
+export function getUser(tokens, options) {
+    const { idTokenClaims, accessTokenClaims } = tokens;
+    const domainUser = getDomainUser(idTokenClaims, accessTokenClaims, options);
+    if (!domainUser)
+        return undefined;
+    const clientId = stringClaim(accessTokenClaims, 'azp');
+    return {
+        domainUser,
+        name: stringClaim(idTokenClaims, 'name') ?? stringClaim(accessTokenClaims, 'name'),
+        groups: stringArrayClaim(accessTokenClaims, 'groups'),
+        permissions: clientId ? getPermissions(accessTokenClaims, clientId) : {},
+    };
+}
+function stringClaim(claims, name) {
+    const value = claims?.[name];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+function stringArrayClaim(claims, name) {
+    const value = claims?.[name];
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+}

package/dist/sveltekit-handlers.d.ts

@@ -0,0 +1,18 @@
+import { type RequestEvent, type RequestHandler } from '@sveltejs/kit';
+import { OidcError } from './oidc/errors.ts';
+import { type OidcProvider, type OidcProviderOptions, type Tokens } from './oidc/provider.ts';
+export type OidcSvelteKitOptions = Omit<OidcProviderOptions, 'callbackPath'> & {
+    basePath: string;
+    cookiePrefix: string;
+    sessionMaxAge?: number;
+    postLogoutPath?: string;
+    onLogin: (tokens: Tokens, event: RequestEvent) => void | false | Promise<void | false>;
+    onLogout?: (event: RequestEvent) => void | Promise<void>;
+    onLoginError?: (error: OidcError, event: RequestEvent) => Response | Promise<Response>;
+};
+export type OidcSvelteKitHandlers = {
+    handler: RequestHandler;
+    loginRedirect: (event: RequestEvent) => string | undefined;
+    provider: OidcProvider;
+};
+export declare function createOidcSvelteKitHandlers(options: OidcSvelteKitOptions): OidcSvelteKitHandlers;

package/dist/sveltekit-handlers.js

@@ -0,0 +1,122 @@
+// La capa SvelteKit (etapa 2): hace con el provider lo que en la etapa 1 arma a mano la app (ver la
+// app de prueba, src/routes/api/auth/): las rutas, las cookies, los redirects y la página del login
+// fallido. La app solo arma su sesión (onLogin) y la borra (onLogout).
+import { error, redirect } from '@sveltejs/kit';
+import { OidcError } from "./oidc/errors.js";
+import { createOidcProvider, RETURN_TO_PARAM, } from "./oidc/provider.js";
+import { isNavigation, isSameOrigin } from "./oidc/request.js";
+const LOGIN_PATH = '/login';
+const CALLBACK_PATH = '/callback';
+const LOGOUT_PATH = '/logout';
+const DEFAULT_POST_LOGOUT_PATH = '/';
+const SECONDS_PER_MINUTE = 60;
+const LOGIN_MAX_AGE = 10 * SECONDS_PER_MINUTE;
+const SEE_OTHER = 303;
+const UNAUTHORIZED = 401;
+const FORBIDDEN = 403;
+const NOT_FOUND = 404;
+const METHOD_NOT_ALLOWED = 405;
+export function createOidcSvelteKitHandlers(options) {
+    const { basePath, cookiePrefix, sessionMaxAge, postLogoutPath = DEFAULT_POST_LOGOUT_PATH, onLogin, onLogout, onLoginError = (err) => defaultLoginError(err, basePath), ...providerOptions } = options;
+    const provider = createOidcProvider({
+        ...providerOptions,
+        callbackPath: `${basePath}${CALLBACK_PATH}`,
+    });
+    // Kit solo redirige a otro origen si está en la lista: login y logout van al proveedor
+    const external = [new URL(options.issuer).origin];
+    const loginCookie = cookie(`${cookiePrefix}_login`, `${basePath}${CALLBACK_PATH}`, LOGIN_MAX_AGE);
+    const logoutCookie = cookie(`${cookiePrefix}_logout`, `${basePath}${LOGOUT_PATH}`, sessionMaxAge);
+    const login = async ({ url, cookies }) => {
+        const { providerUrl, pendingLogin } = await provider.buildLoginUrl(url);
+        cookies.set(loginCookie.name, JSON.stringify(pendingLogin), loginCookie.options);
+        redirect(SEE_OTHER, providerUrl.href, { external });
+    };
+    const callback = async (event) => {
+        const { url, cookies } = event;
+        const pendingLogin = parsePendingLogin(cookies.get(loginCookie.name));
+        cookies.delete(loginCookie.name, loginCookie.options);
+        try {
+            const tokens = await provider.exchangeCode(url, pendingLogin);
+            if ((await onLogin(tokens, event)) === false)
+                throw new OidcError('LOGIN_REJECTED', 'la app no aceptó el login');
+            cookies.set(logoutCookie.name, tokens.idToken, logoutCookie.options);
+        }
+        catch (err) {
+            if (!(err instanceof OidcError))
+                throw err;
+            return await onLoginError(err, event);
+        }
+        // pendingLogin está: si no, exchangeCode lanzó NO_LOGIN_IN_PROGRESS
+        redirect(SEE_OTHER, pendingLogin.returnTo);
+    };
+    const logout = async (event) => {
+        const { request, url, cookies } = event;
+        // Propio aunque SvelteKit tenga su chequeo de CSRF: no corre en dev y una app lo puede desactivar
+        if (!isSameOrigin(request, url.origin))
+            error(FORBIDDEN, 'Origin distinto del de la app');
+        const idToken = cookies.get(logoutCookie.name);
+        cookies.delete(logoutCookie.name, logoutCookie.options);
+        await onLogout?.(event);
+        const home = new URL(postLogoutPath, url.origin);
+        const providerLogout = await provider.buildLogoutUrl(idToken, home.href);
+        redirect(SEE_OTHER, (providerLogout ?? home).href, { external });
+    };
+    const routes = {
+        [LOGIN_PATH]: { method: 'GET', handle: login },
+        [CALLBACK_PATH]: { method: 'GET', handle: callback },
+        [LOGOUT_PATH]: { method: 'POST', handle: logout },
+    };
+    const handler = (event) => {
+        const route = routes[event.url.pathname.slice(basePath.length)];
+        if (!route)
+            error(NOT_FOUND);
+        if (event.request.method !== route.method)
+            return new Response(undefined, {
+                status: METHOD_NOT_ALLOWED,
+                headers: { allow: route.method },
+            });
+        return route.handle(event);
+    };
+    const loginRedirect = ({ request, url, isDataRequest }) => {
+        if (!isDataRequest && !isNavigation(request))
+            return undefined;
+        if (url.pathname === basePath || url.pathname.startsWith(`${basePath}/`))
+            return undefined;
+        const params = new URLSearchParams({ [RETURN_TO_PARAM]: `${url.pathname}${url.search}` });
+        return `${basePath}${LOGIN_PATH}?${params}`;
+    };
+    return { handler, loginRedirect, provider };
+}
+// HttpOnly y SameSite=Lax; Secure lo pone SvelteKit (salvo en http://localhost). Las mismas opciones
+// para ponerla y para borrarla.
+function cookie(name, path, maxAge) {
+    return { name, options: { path, httpOnly: true, sameSite: 'lax', maxAge } };
+}
+// Sin cookie, o rota: undefined (exchangeCode da NO_LOGIN_IN_PROGRESS)
+function parsePendingLogin(value) {
+    if (!value)
+        return undefined;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+// Los errores de un +server.ts no pasan por +error.svelte: la página la arma el componente
+function defaultLoginError(err, basePath) {
+    const { code, message, providerError } = err;
+    console.warn(`[oidc] ${code}: ${message}${providerError ? ` (${providerError})` : ''}`);
+    const html = `<!doctype html>
+<html lang="es">
+<meta charset="utf-8">
+<title>No se pudo entrar</title>
+<h1>No se pudo entrar</h1>
+<p>El login falló (${code}); el detalle está en el log de la app.</p>
+<p><a href="${basePath}${LOGIN_PATH}">Reintentar</a></p>
+</html>`;
+    return new Response(html, {
+        status: UNAUTHORIZED,
+        headers: { 'content-type': 'text/html; charset=utf-8' },
+    });
+}

package/package.json

@@ -1,6 +1,121 @@
 {
   "name": "@opensas/oidc-sveltekit-adapter",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.2",
+  "license": "LGPL-3.0-or-later",
+  "description": "Login por OpenID Connect (ADFS, Keycloak) para apps SvelteKit, con una capa genérica para cualquier app Node",
+  "engines": {
+    "node": ">=24.0.0 <25"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "COPYING",
+    "COPYING.LESSER",
+    "!dist/**/*.test.*",
+    "!dist/**/*.spec.*",
+    "!dist/**/fixtures.*"
+  ],
+  "sideEffects": [
+    "**/*.css"
+  ],
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit-handlers.d.ts",
+      "default": "./dist/sveltekit-handlers.js"
+    }
+  },
+  "keywords": [
+    "svelte",
+    "sveltekit",
+    "oidc",
+    "openid-connect",
+    "adfs",
+    "keycloak"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/trabajo-it/comun/oidc-sveltekit-adapter.git"
+  },
+  "imports": {
+    "#lib": "./src/lib/index.js",
+    "#lib/*": "./src/lib/*",
+    "#server/*": "./src/server/*",
+    "#e2e/*": "./e2e/*.ts"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.64.1",
+    "@sveltejs/adapter-node": "^6.0.1",
+    "@sveltejs/kit": "^3.1.0",
+    "@sveltejs/package": "^3.0.0",
+    "@sveltejs/vite-plugin-svelte": "^7.3.1",
+    "@types/node": "^24.19.2",
+    "eslint": "^10.13.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-check-file": "^3.3.2",
+    "eslint-plugin-simple-import-sort": "^14.0.0",
+    "eslint-plugin-svelte": "^3.23.1",
+    "eslint-plugin-unicorn": "^71.1.0",
+    "globals": "^17.13.0",
+    "prettier": "^3.9.10",
+    "prettier-plugin-svelte": "^4.1.0",
+    "publint": "^0.3.25",
+    "shiki": "^4.6.0",
+    "svelte": "^5.57.2",
+    "svelte-check": "^4.7.7",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.72.0",
+    "vite": "^8.3.5",
+    "vitest": "^4.1.12"
+  },
+  "dependencies": {
+    "openid-client": "^6.8.9"
+  },
+  "scripts": {
+    "dev": "NODE_EXTRA_CA_CERTS=docker/keycloak/certs/localhost.crt vite dev",
+    "build": "vite build && pnpm prepack",
+    "preview": "NODE_EXTRA_CA_CERTS=docker/keycloak/certs/localhost.crt vite preview",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "format": "prettier --write --cache --log-level warn .",
+    "lint": "eslint . --cache",
+    "lint:clean": "node -e \"for (const p of ['.eslintcache', 'node_modules/.cache/prettier']) require('node:fs').rmSync(p, { recursive: true, force: true })\"",
+    "verify": "eslint . --fix --cache && pnpm format && pnpm check",
+    "up:safe": "pnpm --config.minimumReleaseAge=1440 up -i",
+    "sv:sync-deps": "node scripts/sv-sync-deps.ts",
+    "keycloak:cert": "sh scripts/keycloak-cert.sh",
+    "keycloak:start": "pnpm keycloak:cert && docker compose -f docker/keycloak/docker-compose.yaml up -d",
+    "keycloak:stop": "docker compose -f docker/keycloak/docker-compose.yaml stop",
+    "keycloak:status": "docker ps -a --filter name=oidc-sveltekit-adapter-keycloak --format 'table {{.Names}}\\t{{.Status}}\\t{{.Ports}}'",
+    "keycloak:logs": "docker compose -f docker/keycloak/docker-compose.yaml logs -f",
+    "keycloak:purge": "docker compose -f docker/keycloak/docker-compose.yaml down -v",
+    "keycloak:init": "node scripts/keycloak-init.ts",
+    "test": "pnpm test:vite && pnpm test:play",
+    "test:unit": "vitest run --project=unit-tests",
+    "test:vite": "vitest run",
+    "test:e2e": "playwright test --project=e2e-tests --pass-with-no-tests",
+    "test:play": "playwright test --pass-with-no-tests",
+    "test:ci": "node scripts/test-ci.ts",
+    "vm:pack": "node scripts/vm-pack.ts",
+    "gitlab-runner:start": "sudo gitlab-runner start",
+    "gitlab-runner:stop": "sudo gitlab-runner stop",
+    "gitlab-runner:status": "sudo gitlab-runner status",
+    "gitlab-runner:logs": "sudo journalctl -u gitlab-runner -f"
+  }
 }