@oslokommune/auth-bff 1.0.0-beta6

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@oslokommune/auth-bff",
+  "version": "1.0.0-beta6",
+  "repository": "https://github.com/oslokommune/auth-bff.git",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "src/server.mjs",
+  "types": "types/index.d.mts",
+  "scripts": {
+    "build-types": "tsc",
+    "run": "node ./src/server.mjs",
+    "compile-and-publish": "tsc && npm publish"
+  },
+  "exports": {
+    "./vite-plugin": {
+      "types": "./types/vite-plugin.d.mts",
+      "default": "./src/vite-plugin.mjs"
+    },
+    "./config": {
+      "types": "./types/config-utils.d.mts",
+      "default": "./src/config-utils.mjs"
+    },
+    "./react": {
+      "default": "./src/react/index.ts"
+    }
+  },
+  "bin": {
+    "okauthbff": "src/server.mjs"
+  },
+  "files": ["/src", "/types"],
+  "type": "module",
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "react": "17.0.2",
+    "typescript": "^5.8.3"
+  },
+  "dependencies": {
+    "@aws-sdk/client-dynamodb": "^3.535.0",
+    "@aws-sdk/client-ssm": "^3.535.0",
+    "compression": "^1.7.4",
+    "connect-dynamodb": "^3.0.5",
+    "dotenv": "^16.4.5",
+    "express": "^4.19.2",
+    "express-session": "^1.18.0",
+    "findup-sync": "^5.0.0",
+    "helmet": "^7.1.0",
+    "http-proxy-middleware": "^3.0.5",
+    "jose": "^6.0.11",
+    "node-forge": "^1.3.1",
+    "openid-client": "^5.6.5",
+    "string-replace-middleware": "^1.1.0"
+  }
+}

package/src/client.mjs

@@ -0,0 +1,69 @@
+import forge from "node-forge";
+import * as jose from 'jose'
+import {Issuer} from "openid-client";
+import {config} from "./config.mjs";
+import {getSsmParameter} from "./config.mjs";
+const issuer = await Issuer.discover(config.oidcDiscoveryUri)
+
+/**
+ * Takes the JSON object `okdata` produces and converts it to a JWKS
+ *
+ * @param {Object} okdataP12 - The keys.json created by okdata
+ * @param {string} okdataP12.keystore - Base64 encoded p12 keystore
+ * @param {string} okdataP12.key_password - P12 password
+ * @param {string} okdataP12.key_alias - alias of key to extract
+ * @param {string} okdataP12.key_id - id of key to extract
+ * @returns {Promise<*>}
+ */
+export async function p12ToJwks(okdataP12) {
+  const p12Der = forge.util.decode64(okdataP12.keystore)
+  const p12Asn1 = forge.asn1.fromDer(p12Der)
+  const p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, okdataP12.key_password);
+  const privateKey = p12.getBagsByFriendlyName(okdataP12.key_alias)[0].key
+  const privateKeyAsn1 = forge.pki.privateKeyToAsn1(privateKey)
+  const privateKeyInfo = forge.pki.wrapRsaPrivateKey(privateKeyAsn1)
+  const pem = forge.pki.privateKeyInfoToPem(privateKeyInfo);
+  const k = await jose.importPKCS8(pem, 'RS256', {extractable: true})
+  const jwk = await jose.exportJWK(k)
+  jwk.kid = okdataP12.key_id
+  jwk.use = 'sig'
+  jwk.alg = 'RS256'
+  return {
+    keys: [jwk]
+  }
+}
+
+async function createKeyStoreFromOkData(ssmName) {
+  const keyString = await getSsmParameter(ssmName)
+  const okdataP12 = JSON.parse(keyString)
+  return await p12ToJwks(okdataP12)
+}
+
+async function createClient() {
+  let keyStore
+  if(config.okDataIdPortenKeyName) {
+    keyStore = await createKeyStoreFromOkData(config.okDataIdPortenKeyName)
+  } else if(config.keyStore) {
+    keyStore = config.keyStore
+  }
+  return new issuer.Client(
+    {
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      redirect_uris: [config.redirectUri],
+      response_types: ["code"],
+      token_endpoint_auth_method: config.clientSecret ? "client_secret_post" : "private_key_jwt",
+      token_endpoint_auth_signing_alg: "RS256",
+      post_logout_redirect_uris: config.postLogoutRedirectUris
+    },
+    keyStore
+  )
+}
+
+export let client = await createClient()
+
+if(config.okDataIdPortenKeyName) {
+  setInterval(async () => {
+    client = await createClient()
+  }, 5 * 60 * 1000)
+}

package/src/config.mjs

@@ -0,0 +1,49 @@
+import findup from 'findup-sync'
+import {GetParameterCommand, SSMClient} from "@aws-sdk/client-ssm";
+
+export function getEnv(env, defaultVal, parseFn) {
+  if (process.env[env]) {
+    return parseFn ? parseFn(process.env[env]) : process.env[env]
+  } else if (defaultVal !== undefined) {
+    return defaultVal
+  } else {
+    throw Error(`Missing env var: ${env}`)
+  }
+}
+
+let ssmClient
+export async function getSsmParameter(name, withDecryption = true) {
+  ssmClient ??= new SSMClient({})
+  return ssmClient.send(new GetParameterCommand({
+    Name: name,
+    WithDecryption: withDecryption
+  })).then(p => p.Parameter.Value)
+}
+
+const defaultConfig = {
+  port: "3000",
+  basePath: "",
+  cookieSecure: true,
+  cookieSameSite: 'lax',
+  staticRootPath: './dist'
+}
+
+const userConfigPath = findup('bff.config*.json')
+console.log('BFF: Using config at', userConfigPath)
+const {default: loadedConfig} = await import(userConfigPath, {with: {type: 'json'}});
+
+for (const [k, v] of Object.entries(loadedConfig)) {
+  if(typeof v === "string") {
+    const [, varType, varName]  = v.match(/\{(\w+):(.*)}/) ?? []
+    if(varType === 'env') {
+      loadedConfig[k] = getEnv(varName)
+    } else if (varType === 'ssm') {
+      loadedConfig[k] = await getSsmParameter(varName)
+    } else if(varType) {
+      throw Error(`unknown varType: ${varType}`)
+    }
+  }
+}
+
+export const config = {...defaultConfig, ...loadedConfig}
+console.log('config!', config)

package/src/middleware/oidc-routes.mjs

@@ -0,0 +1,13 @@
+import express from "express";
+import {callback, login, logout, user} from "./oidc.mjs";
+
+export function oidcRoutes() {
+  const router = new express.Router()
+
+  router.get('/auth/login', login)
+  router.get('/auth/callback', callback)
+  router.get('/auth/logout', logout)
+  router.get('/auth/user', user)
+
+  return router
+}

package/src/middleware/oidc.mjs

@@ -0,0 +1,89 @@
+import {generators, TokenSet} from "openid-client";
+import {config} from "../config.mjs";
+import {client} from '../client.mjs'
+
+async function getFreshTokenSet(req) {
+  const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet)
+  if (!tokenSet) {
+    console.log("No tokenSet found in session")
+    return
+  }
+  if (tokenSet.expired()) {
+    try {
+      const refreshedTokenSet = await client.refresh(tokenSet.refresh_token)
+      Object.assign(req.session.tokenSet, refreshedTokenSet)
+      return new TokenSet(req.session.tokenSet)
+    } catch (err) {
+      console.log("Token refresh failed", err)
+      req.session.tokenSet = null
+    }
+  } else {
+    return tokenSet
+  }
+}
+
+export function ensureFreshToken(req, _, next) {
+  getFreshTokenSet(req).then(tokenSet => {
+    req.tokenSet = tokenSet
+    next()
+  })
+}
+
+export function login(req, res) {
+  const codeVerifier = generators.codeVerifier()
+  const codeChallenge = generators.codeChallenge(codeVerifier)
+
+  const authorizationUrl = client.authorizationUrl({
+    scope: "openid profile",
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    resource: config.resources,
+  })
+
+  req.session.codeVerifier = codeVerifier
+  req.session.save(() => {
+    res.redirect(authorizationUrl)
+  })
+}
+
+export async function callback(req, res) {
+  const params = client.callbackParams(req)
+  const codeVerifier = req.session.codeVerifier
+  const redirectUri = `${req.protocol}://${req.headers.host}${config.basePath}/auth/callback`
+  try {
+    const tokenSet = await client.callback(redirectUri, params, {
+      code_verifier: codeVerifier
+    })
+
+    delete req.session.codeVerifier
+    req.session.tokenSet = new TokenSet(tokenSet)
+    req.session.save(() => {
+      res.redirect(config.basePath || "/") //TODO: skal denne kunne redirecte et annet sted?
+    })
+
+  } catch (err) {
+    console.error(err)
+    res.status(500).send("Error during callback")
+  }
+}
+
+export async function user(req, res) {
+  const tokenSet = await getFreshTokenSet(req)
+  if (!tokenSet) {
+    return res.sendStatus(401)
+  }
+  return res.send(tokenSet.claims())
+}
+
+export function logout(req, res) {
+  const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet)
+
+  //TODO: støtt frontchannel SLO
+
+  req.session.destroy(() => {
+    res.redirect(client.endSessionUrl({
+      id_token_hint: tokenSet?.id_token,
+
+    }))
+  })
+}

package/src/middleware/proxy-routes.mjs

@@ -0,0 +1,27 @@
+import express from "express";
+import {ensureFreshToken} from "./oidc.mjs";
+import {createProxyMiddleware} from "http-proxy-middleware";
+import {config} from "../config.mjs";
+
+export function proxyRoutes() {
+  const router = new express.Router()
+  for (const [path, target] of Object.entries(config.proxyTargets)) {
+    router.use(
+      path,
+      ensureFreshToken,
+      createProxyMiddleware({
+        target: target,
+        changeOrigin: true,
+        onProxyReq: (proxyReq, req, res) => {
+          const tokenSet = req.tokenSet
+          if (!tokenSet) {
+            return res.status(401)
+          }
+          proxyReq.setHeader("Authorization", `Bearer ${tokenSet.access_token}`)
+          proxyReq.removeHeader("Cookie")
+        },
+      })
+    )
+  }
+  return router
+}

package/src/middleware/security-headers.mjs

@@ -0,0 +1,37 @@
+import crypto from "crypto";
+import helmet from "helmet";
+
+export function securityHeaders() {
+  const generateCspNonceMiddleware = (req, res, next) => {
+    res.locals.cspNonce = crypto.randomBytes(16).toString("hex");
+    next();
+  }
+
+  const helmetMiddleware = helmet({
+    strictTransportSecurity: {
+      maxAge: 31536000,
+      includeSubDomains: false,
+      preload: false,
+    },
+    contentSecurityPolicy: {
+      useDefaults: true,
+      directives: {
+        "default-src": [
+          "'self'",
+          "https://*.oslo.kommune.no",
+          "https://*.oslo.systems",
+        ],
+        "script-src": ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+        "style-src": ["'self'"],
+        "frame-ancestors": ["'none'"],
+        "img-src": ["'self'"],
+        "font-src": ["'self'"],
+      },
+    },
+  })
+
+  return [
+    generateCspNonceMiddleware,
+    helmetMiddleware
+  ]
+}

package/src/middleware/sessions.mjs

@@ -0,0 +1,34 @@
+import session from "express-session";
+import {config} from "../config.mjs";
+import dynamoDbStore from "connect-dynamodb";
+
+function dynamoDbSessionStore(config = {}) {
+  const DynamoDbStore = dynamoDbStore({session})
+  return new DynamoDbStore(config)
+}
+
+export function sessions() {
+  let sessionStore
+  if(config.sessionStoreType === 'memory') {
+    sessionStore = undefined
+  } else if(config.sessionStoreType === 'dynamodb') {
+    const sessionStoreConfig = config.sessionStoreConfig ?? {}
+    sessionStore = dynamoDbSessionStore(sessionStoreConfig)
+  } else if(config.sessionStoreType) {
+    throw Error(`unknown sessionStoreType ${config.sessionStoreType}`)
+  } else {
+    throw Error('missing sessionStoreType')
+  }
+
+  return session({
+    secret: config.sessionSecret,
+    store: sessionStore,
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      secure: config.cookieSecure,
+      sameSite: config.cookieSameSite
+    },
+  })
+}

package/src/middleware/static-routes.mjs

@@ -0,0 +1,22 @@
+import express from "express";
+import {stringReplace} from "string-replace-middleware";
+import path from "path";
+import {config} from "../config.mjs";
+
+export function staticRoutes() {
+  const router = new express.Router()
+
+  router.use(stringReplace({
+    '__CSP_NONCE__': (req, res) => res.locals.cspNonce
+  }, {
+    contentTypeFilterRegexp: /^text\/html/
+  }))
+  const staticPath = path.resolve(import.meta.dirname, config.staticRootPath)
+  router.use(express.static(staticPath, {index: false}))
+  router.get('*', function (req, res) {
+    res.set('Cache-Control', 'no-store')
+    res.sendFile(path.resolve(import.meta.dirname, config.staticRootPath, 'index.html'))
+  })
+
+  return router
+}

package/src/react/AuthContext.tsx

@@ -0,0 +1,8 @@
+import {createContext} from "react";
+
+export type AuthContextProps = {
+  state: 'pending' | 'authenticated' | 'unauthenticated',
+  user?: {pid: string}}
+
+export const AuthContext = createContext<AuthContextProps | undefined>(undefined)
+

package/src/react/AuthContextProvider.tsx

@@ -0,0 +1,39 @@
+import {React, ReactNode, useEffect, useRef, useState} from "react";
+import {AuthContext, AuthContextProps} from "./AuthContext";
+
+type AuthContextProviderProps = {
+  children: ReactNode,
+  authRequired?: boolean,
+  loaderComponent: ReactNode
+}
+
+export function AuthContextProvider({children, authRequired = false, loaderComponent = null}: AuthContextProviderProps) {
+  const [user, setUser] = useState<AuthContextProps['user']>(undefined)
+  const [state, setState] = useState<AuthContextProps['state']>('pending')
+  const userPromise = useRef<Promise<unknown | void> | undefined>(undefined)
+
+  useEffect(() => {
+    (userPromise.current ??= fetch('/auth/user').then(res => res.ok && res.json()))
+    .then(json => {
+      if (json) {
+        setUser(json)
+        setState('authenticated')
+      } else {
+        setState('unauthenticated')
+      }
+    })
+  }, [])
+
+  useEffect(() => {
+    if (authRequired && state === 'unauthenticated') {
+      window.location.assign('/auth/login')
+    }
+  }, [authRequired, state])
+
+  return (
+    <AuthContext.Provider value={{user, state}}>
+      {(authRequired && state !== 'authenticated' || !authRequired && state === 'pending') && loaderComponent}
+      {(authRequired && state === 'authenticated' || !authRequired && state !== 'pending') && children}
+    </AuthContext.Provider>
+  )
+}

package/src/react/UseAuthContext.tsx

@@ -0,0 +1,11 @@
+import {useContext} from "react";
+import {AuthContext} from "./AuthContext";
+
+export function useAuthContext(required: boolean = false) {
+  const authContext = useContext(AuthContext)
+  if (required && authContext?.state === 'unauthenticated') {
+    window.location.assign('/auth/login')
+    return
+  }
+  return authContext
+}

package/src/react/index.ts

@@ -0,0 +1,3 @@
+export * from './AuthContext'
+export * from './AuthContextProvider'
+export * from './UseAuthContext'

package/src/server.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import express from "express"
+import compression from "compression"
+import {config} from './config.mjs'
+import {proxyRoutes} from "./middleware/proxy-routes.mjs";
+import {staticRoutes} from "./middleware/static-routes.mjs";
+import {securityHeaders} from "./middleware/security-headers.mjs";
+import {sessions} from "./middleware/sessions.mjs";
+import {oidcRoutes} from "./middleware/oidc-routes.mjs";
+
+const app = express()
+
+app.set('trust proxy', true) // TODO: sjekk om denne kan/bør være strengere: https://expressjs.com/en/api.html#trust.proxy.options.table
+app.disable("x-powered-by")
+
+app.use(compression())
+app.use(sessions())
+
+if (!config.devMode) {
+  app.use(securityHeaders())
+}
+
+app.get("/health", (req, res) => {
+  res.send("OK")
+})
+
+const basePath = config.basePath || "/"
+
+app.use(basePath, oidcRoutes())
+app.use(basePath, proxyRoutes())
+app.use(basePath, staticRoutes())
+
+app.listen(config.port, () => {
+  console.log(`Server started on port ${config.port}`)
+})
+

package/src/vite-plugin.mjs

@@ -0,0 +1,32 @@
+import express from "express"
+
+async function configureServer({middlewares}) {
+  const {oidcRoutes} = await import("./middleware/oidc-routes.mjs")
+  const {proxyRoutes} = await import("./middleware/proxy-routes.mjs")
+  const {sessions} = await import("./middleware/sessions.mjs")
+  const basePath = "" || "/"
+  const app = express()
+  app.use(sessions())
+  app.use(basePath, oidcRoutes())
+  app.use(basePath, proxyRoutes())
+
+  middlewares.use(app)
+}
+
+/**
+ *
+ * @returns {{
+ *  name: string,
+ *  apply: 'serve',
+ *  configureServer: ((function({middlewares: *}): Promise<void>)|*),
+ *  configurePreviewServer: ((function({middlewares: *}): Promise<void>)|*)
+ * }}
+ */
+export default function bff() {
+  return {
+    name: 'bff',
+    apply: 'serve',
+    configureServer: configureServer,
+    configurePreviewServer: configureServer
+  }
+}

package/types/client.d.mts

@@ -0,0 +1,18 @@
+/**
+ * Takes the JSON object `okdata` produces and converts it to a JWKS
+ *
+ * @param {Object} okdataP12 - The keys.json created by okdata
+ * @param {string} okdataP12.keystore - Base64 encoded p12 keystore
+ * @param {string} okdataP12.key_password - P12 password
+ * @param {string} okdataP12.key_alias - alias of key to extract
+ * @param {string} okdataP12.key_id - id of key to extract
+ * @returns {Promise<*>}
+ */
+export function p12ToJwks(okdataP12: {
+    keystore: string;
+    key_password: string;
+    key_alias: string;
+    key_id: string;
+}): Promise<any>;
+export let client: import("openid-client").BaseClient;
+//# sourceMappingURL=client.d.mts.map

package/types/client.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.mts","sourceRoot":"","sources":["../src/client.mjs"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,qCANG;IAA0B,QAAQ,EAA1B,MAAM;IACY,YAAY,EAA9B,MAAM;IACY,SAAS,EAA3B,MAAM;IACY,MAAM,EAAxB,MAAM;CACd,GAAU,OAAO,CAAC,GAAC,CAAC,CAkBtB;AA6BD,sDAAwC"}

package/types/config-utils.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config-utils.d.mts.map

package/types/config-utils.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-utils.d.mts","sourceRoot":"","sources":["../src/config-utils.mjs"],"names":[],"mappings":""}

package/types/config.d.mts

@@ -0,0 +1,4 @@
+export function getEnv(env: any, defaultVal: any, parseFn: any): any;
+export function getSsmParameter(name: any, withDecryption?: boolean): Promise<any>;
+export const config: any;
+//# sourceMappingURL=config.d.mts.map

package/types/config.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.mts","sourceRoot":"","sources":["../src/config.mjs"],"names":[],"mappings":"AAGA,qEAQC;AAGD,mFAMC;AA4BD,yBAAyD"}

package/types/middleware/oidc-routes.d.mts

@@ -0,0 +1,2 @@
+export function oidcRoutes(): any;
+//# sourceMappingURL=oidc-routes.d.mts.map

package/types/middleware/oidc-routes.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc-routes.mjs"],"names":[],"mappings":"AAGA,kCASC"}

package/types/middleware/oidc.d.mts

@@ -0,0 +1,6 @@
+export function ensureFreshToken(req: any, _: any, next: any): void;
+export function login(req: any, res: any): void;
+export function callback(req: any, res: any): Promise<void>;
+export function user(req: any, res: any): Promise<any>;
+export function logout(req: any, res: any): void;
+//# sourceMappingURL=oidc.d.mts.map

package/types/middleware/oidc.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc.mjs"],"names":[],"mappings":"AAwBA,oEAKC;AAED,gDAeC;AAED,4DAmBC;AAED,uDAMC;AAED,iDAWC"}

package/types/middleware/proxy-routes.d.mts

@@ -0,0 +1,2 @@
+export function proxyRoutes(): any;
+//# sourceMappingURL=proxy-routes.d.mts.map

package/types/middleware/proxy-routes.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/proxy-routes.mjs"],"names":[],"mappings":"AAKA,mCAqBC"}

package/types/middleware/sessions.d.mts

@@ -0,0 +1,2 @@
+export function sessions(): any;
+//# sourceMappingURL=sessions.d.mts.map

package/types/middleware/sessions.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.mts","sourceRoot":"","sources":["../../src/middleware/sessions.mjs"],"names":[],"mappings":"AASA,gCAwBC"}

package/types/vite-plugin.d.mts

@@ -0,0 +1,20 @@
+/**
+ *
+ * @returns {{
+ *  name: string,
+ *  apply: 'serve',
+ *  configureServer: ((function({middlewares: *}): Promise<void>)|*),
+ *  configurePreviewServer: ((function({middlewares: *}): Promise<void>)|*)
+ * }}
+ */
+export default function bff(): {
+    name: string;
+    apply: "serve";
+    configureServer: (((arg0: {
+        middlewares: any;
+    }) => Promise<void>) | any);
+    configurePreviewServer: (((arg0: {
+        middlewares: any;
+    }) => Promise<void>) | any);
+};
+//# sourceMappingURL=vite-plugin.d.mts.map

package/types/vite-plugin.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-plugin.d.mts","sourceRoot":"","sources":["../src/vite-plugin.mjs"],"names":[],"mappings":"AAeA;;;;;;;;GAQG;AACH,+BAPa;IACT,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,EAAE,CAAC,CAAC,CAAS,IAAgB,EAAhB;QAAC,WAAW,EAAE,GAAC,CAAA;KAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAC,GAAC,CAAC,CAAC;IACjE,sBAAsB,EAAE,CAAC,CAAC,CAAS,IAAgB,EAAhB;QAAC,WAAW,EAAE,GAAC,CAAA;KAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAC,GAAC,CAAC,CAAA;CACvE,CASH"}