@oslokommune/auth-bff 1.5.0 → 1.6.0-beta1

package/dist/middleware/oidc-routes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc-routes.mjs"],"names":[],"mappings":"AAEA,qDASC"}
+{"version":3,"file":"oidc-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc-routes.mjs"],"names":[],"mappings":"AAEA,qDAUC"}

package/dist/middleware/oidc-routes.mjs

@@ -5,5 +5,6 @@ export function oidcRoutes(oidcMiddleware) {
     router.get('/auth/callback', oidcMiddleware.callback);
     router.get('/auth/logout', oidcMiddleware.logout);
     router.get('/auth/user', oidcMiddleware.user);
+    router.get('/auth/front-channel-logout', oidcMiddleware.frontChannelLogout);
     return router;
 }

package/dist/middleware/oidc.d.mts

@@ -8,9 +8,10 @@ export class OidcMiddleware {
     private constructor();
     get ensureFreshToken(): (req: any, res: any, next: any) => void;
     get login(): (req: any, res: any) => void;
-    get callback(): (req: any, res: any) => Promise<void>;
-    get user(): (req: any, res: any) => Promise<any>;
+    get callback(): (req: any, res: any, next: any) => Promise<void>;
+    get user(): (req: any, res: any, next: any) => Promise<any>;
     get logout(): (req: any, res: any) => void;
+    get frontChannelLogout(): (req: any, res: any) => Promise<void>;
     #private;
 }
 //# sourceMappingURL=oidc.d.mts.map

package/dist/middleware/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc.mjs"],"names":[],"mappings":"AAGA;IAeE,oDAIC;IAdD;;;;OAIG;IACH,sBAGC;IAiDD,yBACU,QAAG,EAAE,QAAG,EAAE,SAAI,UAUvB;IAED,cACU,QAAG,EAAE,QAAG,UAuBjB;IAED,iBACgB,QAAG,EAAE,QAAG,mBAmCvB;IAED,aACgB,QAAG,EAAE,QAAG,kBAevB;IAED,eACU,QAAG,EAAE,QAAG,UAYjB;;CACF"}
+{"version":3,"file":"oidc.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc.mjs"],"names":[],"mappings":"AAIA;IAeE,oDAIC;IAdD;;;;OAIG;IACH,sBAGC;IAsDD,yBACU,QAAG,EAAE,QAAG,EAAE,SAAI,UAWvB;IAED,cACU,QAAG,EAAE,QAAG,UAsBjB;IAED,iBACgB,QAAG,EAAE,QAAG,EAAE,SAAI,mBAqC7B;IAED,aACgB,QAAG,EAAE,QAAG,EAAE,SAAI,kBAmB7B;IAED,eACU,QAAG,EAAE,QAAG,UAQjB;IAED,2BACgB,QAAG,EAAE,QAAG,mBAcvB;;CACF"}

package/dist/middleware/oidc.mjs

@@ -21,6 +21,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _OidcMiddleware_instances, _OidcMiddleware_clientManager, _OidcMiddleware_config, _OidcMiddleware_refreshPromises, _OidcMiddleware_refreshTokenSet, _OidcMiddleware_getFreshTokenSet;
 import { generators, TokenSet } from "openid-client";
 import { OidcClientManager } from "../client.mjs";
+import { redact } from "../utils.js";
 export class OidcMiddleware {
     /**
      * @private
@@ -56,9 +57,10 @@ export class OidcMiddleware {
                     next();
                 }
                 else {
+                    console.warn(`401: No valid tokenSet in session sid=${redact(req.session.id)}`);
                     res.sendStatus(401);
                 }
-            });
+            }).catch(next);
         };
     }
     get login() {
@@ -83,16 +85,18 @@ export class OidcMiddleware {
         };
     }
     get callback() {
-        return (req, res) => __awaiter(this, void 0, void 0, function* () {
-            const params = __classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.callbackParams(req);
-            const { codeVerifier, stateKey, stateValue } = req.session;
-            const redirectUri = `${req.protocol}://${req.headers.host}${__classPrivateFieldGet(this, _OidcMiddleware_config, "f").basePath}/auth/callback`;
+        return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
             try {
+                const params = __classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.callbackParams(req);
+                const { codeVerifier, stateKey, stateValue } = req.session;
+                const redirectUri = `${req.protocol}://${req.headers.host}${__classPrivateFieldGet(this, _OidcMiddleware_config, "f").basePath}/auth/callback`;
                 const tokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.callback(redirectUri, params, {
                     code_verifier: codeVerifier,
                     state: stateKey
                 });
-                req.session.tokenSet = new TokenSet(tokenSet);
+                req.session.tokenSet = tokenSet;
+                const parsedTokenSet = new TokenSet(tokenSet);
+                req.session["idp-sid"] = parsedTokenSet.claims().sid;
                 delete req.session.codeVerifier;
                 delete req.session.stateKey;
                 delete req.session.stateValue;
@@ -106,34 +110,40 @@ export class OidcMiddleware {
                     res.redirect(redirectUrl);
                 });
             }
-            catch (err) {
-                console.error(err);
+            catch (e) {
+                console.error(e);
                 req.session.destroy(() => {
-                    res.status(500).send("Error during callback");
+                    next(e);
                 });
             }
         });
     }
     get user() {
-        return (req, res) => __awaiter(this, void 0, void 0, function* () {
-            const tokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_instances, "m", _OidcMiddleware_getFreshTokenSet).call(this, req);
-            if (!tokenSet) {
-                return res.sendStatus(401);
+        return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const tokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_instances, "m", _OidcMiddleware_getFreshTokenSet).call(this, req);
+                if (!tokenSet) {
+                    return res.sendStatus(401);
+                }
+                let claims = tokenSet.claims();
+                if (__classPrivateFieldGet(this, _OidcMiddleware_config, "f").userClaims) {
+                    claims = __classPrivateFieldGet(this, _OidcMiddleware_config, "f").userClaims.reduce((acc, claim) => {
+                        acc[claim] = claims[claim];
+                        return acc;
+                    }, {});
+                }
+                return res.send(claims);
             }
-            let claims = tokenSet.claims();
-            if (__classPrivateFieldGet(this, _OidcMiddleware_config, "f").userClaims) {
-                claims = __classPrivateFieldGet(this, _OidcMiddleware_config, "f").userClaims.reduce((acc, claim) => {
-                    acc[claim] = claims[claim];
-                    return acc;
-                }, {});
+            catch (e) {
+                console.error(`Error in /user sid=${redact((_a = req.session) === null || _a === void 0 ? void 0 : _a.id)}`, e);
+                next(e);
             }
-            return res.send(claims);
         });
     }
     get logout() {
         return (req, res) => {
             const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet);
-            //TODO: støtt frontchannel SLO
             req.session.destroy(() => {
                 res.redirect(__classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.endSessionUrl({
                     id_token_hint: tokenSet === null || tokenSet === void 0 ? void 0 : tokenSet.id_token,
@@ -141,6 +151,22 @@ export class OidcMiddleware {
             });
         };
     }
+    get frontChannelLogout() {
+        return (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const { iss, sid } = req.query;
+            console.log(`Front channel logout: params iss=${iss}, sid=${redact(sid)}`);
+            if (sid) {
+                try {
+                    yield ((_a = req.destroySessionByIdTokenSid) === null || _a === void 0 ? void 0 : _a.call(req, sid));
+                }
+                catch (e) {
+                    console.error("Failed to destroy session", e);
+                }
+            }
+            res.sendStatus(200);
+        });
+    }
 }
 _OidcMiddleware_clientManager = new WeakMap(), _OidcMiddleware_config = new WeakMap(), _OidcMiddleware_refreshPromises = new WeakMap(), _OidcMiddleware_instances = new WeakSet(), _OidcMiddleware_refreshTokenSet = function _OidcMiddleware_refreshTokenSet(req, tokenSet) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -149,35 +175,41 @@ _OidcMiddleware_clientManager = new WeakMap(), _OidcMiddleware_config = new Weak
         const sessionId = req.session.id;
         const refreshToken = tokenSet.refresh_token;
         const doRefresh = () => __awaiter(this, void 0, void 0, function* () {
-            console.log(`Token refresh starting. sid=${sessionId}`);
+            console.log(`Token refresh starting. sid=${redact(sessionId)}`);
             try {
                 const refreshedTokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.refresh(refreshToken);
-                console.log(`Token refresh OK. sid=${sessionId}`);
+                console.log(`Token refresh OK. sid=${redact(sessionId)}`);
                 return refreshedTokenSet;
             }
             catch (err) {
-                console.log(`Token refresh failed. sid=${sessionId}`, err);
+                console.log(`Token refresh failed. sid=${redact(sessionId)}`, err);
                 return null;
             }
         });
         const refreshPromise = (_a = (_b = __classPrivateFieldGet(this, _OidcMiddleware_refreshPromises, "f"))[refreshToken]) !== null && _a !== void 0 ? _a : (_b[refreshToken] = doRefresh().finally(() => {
-            console.log(`Token refresh finished. Cleaning up. sid=${sessionId}`);
+            console.log(`Token refresh finished. Cleaning up. sid=${redact(sessionId)}`);
             setTimeout(() => {
                 delete __classPrivateFieldGet(this, _OidcMiddleware_refreshPromises, "f")[refreshToken];
             }, 10000);
         }));
         const refreshedTokenSet = yield refreshPromise;
-        req.session.tokenSet = refreshedTokenSet;
-        return refreshedTokenSet;
+        if (refreshedTokenSet) {
+            Object.assign(req.session.tokenSet, refreshedTokenSet);
+        }
+        else {
+            req.session.tokenSet = null;
+        }
+        return req.session.tokenSet;
     });
 }, _OidcMiddleware_getFreshTokenSet = function _OidcMiddleware_getFreshTokenSet(req) {
     return __awaiter(this, void 0, void 0, function* () {
         const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet);
         if (!tokenSet) {
-            console.log("No tokenSet found in session");
+            console.log(`No tokenSet found in session sid=${redact(req.session.id)}`);
             return;
         }
         if (tokenSet.expired()) {
+            console.log(`TokenSet expired sid=${redact(req.session.id)}`);
             const newTokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_instances, "m", _OidcMiddleware_refreshTokenSet).call(this, req, tokenSet);
             return newTokenSet && new TokenSet(newTokenSet);
         }

package/dist/middleware/sessions.d.mts

@@ -1,2 +1,2 @@
-export function sessions(config: any): any;
+export function sessions(config: any): any[];
 //# sourceMappingURL=sessions.d.mts.map

package/dist/middleware/sessions.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.mts","sourceRoot":"","sources":["../../src/middleware/sessions.mjs"],"names":[],"mappings":"AAQA,2CAyBC"}
+{"version":3,"file":"sessions.d.mts","sourceRoot":"","sources":["../../src/middleware/sessions.mjs"],"names":[],"mappings":"AAiDA,6CAgCC"}

package/dist/middleware/sessions.mjs

@@ -1,17 +1,63 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 import session from "express-session";
 import dynamoDbStore from "connect-dynamodb";
+import { DeleteItemCommand, DynamoDBClient, QueryCommand } from "@aws-sdk/client-dynamodb";
+import { redact } from "../utils.js";
 function dynamoDbSessionStore(config = {}) {
+    const client = new DynamoDBClient({});
     const DynamoDbStore = dynamoDbStore({ session });
-    return new DynamoDbStore(config);
+    const sessionStoreConfig = Object.assign(Object.assign({}, config), { client, specialKeys: [
+            { name: "idp-sid", type: "S" }
+        ], skipThrowMissingSpecialKeys: true });
+    const sessionStore = new DynamoDbStore(sessionStoreConfig);
+    sessionStore.destroyByIdTokenSid = (idTokenSid) => __awaiter(this, void 0, void 0, function* () {
+        console.log(`Front channel logout: deleting session(s) with idp-sid=${redact(idTokenSid)}`);
+        const query = new QueryCommand({
+            TableName: config.table,
+            IndexName: "idp-sid-index",
+            ExpressionAttributeValues: { ":sid": { S: idTokenSid } },
+            ExpressionAttributeNames: { "#k": "idp-sid" },
+            KeyConditionExpression: "#k = :sid",
+            ProjectionExpression: "id"
+        });
+        const res = yield client.send(query);
+        yield Promise.all(res.Items.map((item) => {
+            var _a;
+            console.log(`Front channel logout: deleting session ${redact((_a = item.id) === null || _a === void 0 ? void 0 : _a.S, 10)}`);
+            return client.send(new DeleteItemCommand({
+                TableName: config.table,
+                Key: { id: item.id }
+            }));
+        }));
+        console.log(`Front channel logout: completed. ${res.Count} session(s) deleted`);
+    });
+    return sessionStore;
+}
+function memorySessionStore(config = {}) {
+    const sessionStore = new session.MemoryStore(config);
+    sessionStore.destroyByIdTokenSid = (idTokenSid) => {
+        // dummy.
+        console.log(`Pretending to destroyByIdTokenSid. idp-sid=${redact(idTokenSid)}`);
+    };
+    return sessionStore;
 }
 export function sessions(config) {
-    var _a;
+    var _a, _b;
     let sessionStore;
     if (config.sessionStoreType === 'memory') {
-        sessionStore = undefined;
+        const sessionStoreOptions = (_a = config.sessionStoreOptions) !== null && _a !== void 0 ? _a : {};
+        sessionStore = memorySessionStore(sessionStoreOptions);
     }
     else if (config.sessionStoreType === 'dynamodb') {
-        const sessionStoreOptions = (_a = config.sessionStoreOptions) !== null && _a !== void 0 ? _a : {};
+        const sessionStoreOptions = (_b = config.sessionStoreOptions) !== null && _b !== void 0 ? _b : {};
         sessionStore = dynamoDbSessionStore(sessionStoreOptions);
     }
     else if (config.sessionStoreType) {
@@ -20,16 +66,22 @@ export function sessions(config) {
     else {
         throw Error('missing sessionStoreType');
     }
-    return session({
-        secret: config.sessionSecret,
-        store: sessionStore,
-        resave: false,
-        saveUninitialized: false,
-        cookie: config.cookie || {
-            httpOnly: true,
-            path: config.cookiePath,
-            secure: config.cookieSecure,
-            sameSite: config.cookieSameSite
-        },
-    });
+    return [
+        session({
+            secret: config.sessionSecret,
+            store: sessionStore,
+            resave: false,
+            saveUninitialized: false,
+            cookie: config.cookie || {
+                httpOnly: true,
+                path: config.cookiePath,
+                secure: config.cookieSecure,
+                sameSite: config.cookieSameSite
+            },
+        }),
+        (req) => {
+            // make this function available to request handlers
+            req.destroySessionByIdTokenSid = sessionStore === null || sessionStore === void 0 ? void 0 : sessionStore.destroyByIdTokenSid;
+        }
+    ];
 }

package/dist/react/AuthContext.d.ts

@@ -2,7 +2,7 @@ export type User = {
     [k: string]: string | number;
 };
 export type AuthContextProps = {
-    state: 'pending' | 'authenticated' | 'unauthenticated' | 'expired';
+    state: 'pending' | 'authenticated' | 'unauthenticated' | 'expired' | 'error';
     user?: User;
     login: () => void;
     logout: () => void;

package/dist/react/AuthContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/react/AuthContext.tsx"],"names":[],"mappings":"AAGA,MAAM,MAAM,IAAI,GAAG;IACjB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACnE,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,WAAW,2CAAyD,CAAA"}
+{"version":3,"file":"AuthContext.d.ts","sourceRoot":"","sources":["../../src/react/AuthContext.tsx"],"names":[],"mappings":"AAGA,MAAM,MAAM,IAAI,GAAG;IACjB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,MAAM,EAAE,MAAM,IAAI,CAAA;CACnB,CAAA;AAED,eAAO,MAAM,WAAW,2CAAyD,CAAA"}

package/dist/react/AuthContextProvider.jsx

@@ -26,17 +26,14 @@ export function AuthContextProvider({ children, authRequired = false, loaderComp
         return __awaiter(this, void 0, void 0, function* () {
             const res = yield fetch(`${baseUrl}/auth/user`);
             if (res.ok) {
-                try {
-                    return yield res.json();
-                }
-                catch (e) {
-                    console.error('failed to parse user', e);
-                    return null;
-                }
+                return yield res.json();
             }
-            else {
+            else if (res.status === 401) {
                 return null;
             }
+            else {
+                throw Error(`Failed to get user: ${res.status} ${res.statusText}`);
+            }
         });
     }
     function startPoller() {
@@ -78,6 +75,9 @@ export function AuthContextProvider({ children, authRequired = false, loaderComp
             else {
                 setState('unauthenticated');
             }
+        }).catch((err) => {
+            console.error(err);
+            setState('error');
         }));
     }, []);
     useEffect(() => {

package/dist/utils.d.ts

@@ -0,0 +1,2 @@
+export function redact(string: any, length?: number): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.js"],"names":[],"mappings":"AAAA,6DAEC"}

package/dist/utils.js

@@ -0,0 +1,3 @@
+export function redact(string, length = 5) {
+    return (string === null || string === void 0 ? void 0 : string.substring(0, length)) + '***';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oslokommune/auth-bff",
-  "version": "1.5.0",
+  "version": "1.6.0-beta1",
   "repository": "https://github.com/oslokommune/auth-bff.git",
   "publishConfig": {
     "access": "public"
@@ -8,7 +8,8 @@
   "scripts": {
     "build": "tsc",
     "run": "node ./dist/server.mjs",
-    "build-and-publish": "tsc && npm publish"
+    "build-and-publish": "tsc && npm publish",
+    "build-and-publish-prerelease": "tsc && npm publish --tag prerelease"
   },
   "exports": {
     "./vite-plugin": "./dist/vite-plugin.mjs",