@oslokommune/auth-bff 1.5.1 → 1.6.0-beta1

package/dist/middleware/oidc-routes.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc-routes.mjs"],"names":[],"mappings":"AAEA,qDASC"}
+{"version":3,"file":"oidc-routes.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc-routes.mjs"],"names":[],"mappings":"AAEA,qDAUC"}

package/dist/middleware/oidc-routes.mjs

@@ -5,5 +5,6 @@ export function oidcRoutes(oidcMiddleware) {
     router.get('/auth/callback', oidcMiddleware.callback);
     router.get('/auth/logout', oidcMiddleware.logout);
     router.get('/auth/user', oidcMiddleware.user);
+    router.get('/auth/front-channel-logout', oidcMiddleware.frontChannelLogout);
     return router;
 }

package/dist/middleware/oidc.d.mts

@@ -11,6 +11,7 @@ export class OidcMiddleware {
     get callback(): (req: any, res: any, next: any) => Promise<void>;
     get user(): (req: any, res: any, next: any) => Promise<any>;
     get logout(): (req: any, res: any) => void;
+    get frontChannelLogout(): (req: any, res: any) => Promise<void>;
     #private;
 }
 //# sourceMappingURL=oidc.d.mts.map

package/dist/middleware/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc.mjs"],"names":[],"mappings":"AAGA;IAeE,oDAIC;IAdD;;;;OAIG;IACH,sBAGC;IAqDD,yBACU,QAAG,EAAE,QAAG,EAAE,SAAI,UAUvB;IAED,cACU,QAAG,EAAE,QAAG,UAsBjB;IAED,iBACgB,QAAG,EAAE,QAAG,EAAE,SAAI,mBAmC7B;IAED,aACgB,QAAG,EAAE,QAAG,EAAE,SAAI,kBAmB7B;IAED,eACU,QAAG,EAAE,QAAG,UAYjB;;CACF"}
+{"version":3,"file":"oidc.d.mts","sourceRoot":"","sources":["../../src/middleware/oidc.mjs"],"names":[],"mappings":"AAIA;IAeE,oDAIC;IAdD;;;;OAIG;IACH,sBAGC;IAsDD,yBACU,QAAG,EAAE,QAAG,EAAE,SAAI,UAWvB;IAED,cACU,QAAG,EAAE,QAAG,UAsBjB;IAED,iBACgB,QAAG,EAAE,QAAG,EAAE,SAAI,mBAqC7B;IAED,aACgB,QAAG,EAAE,QAAG,EAAE,SAAI,kBAmB7B;IAED,eACU,QAAG,EAAE,QAAG,UAQjB;IAED,2BACgB,QAAG,EAAE,QAAG,mBAcvB;;CACF"}

package/dist/middleware/oidc.mjs

@@ -21,6 +21,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
 var _OidcMiddleware_instances, _OidcMiddleware_clientManager, _OidcMiddleware_config, _OidcMiddleware_refreshPromises, _OidcMiddleware_refreshTokenSet, _OidcMiddleware_getFreshTokenSet;
 import { generators, TokenSet } from "openid-client";
 import { OidcClientManager } from "../client.mjs";
+import { redact } from "../utils.js";
 export class OidcMiddleware {
     /**
      * @private
@@ -56,6 +57,7 @@ export class OidcMiddleware {
                     next();
                 }
                 else {
+                    console.warn(`401: No valid tokenSet in session sid=${redact(req.session.id)}`);
                     res.sendStatus(401);
                 }
             }).catch(next);
@@ -92,7 +94,9 @@ export class OidcMiddleware {
                     code_verifier: codeVerifier,
                     state: stateKey
                 });
-                req.session.tokenSet = new TokenSet(tokenSet);
+                req.session.tokenSet = tokenSet;
+                const parsedTokenSet = new TokenSet(tokenSet);
+                req.session["idp-sid"] = parsedTokenSet.claims().sid;
                 delete req.session.codeVerifier;
                 delete req.session.stateKey;
                 delete req.session.stateValue;
@@ -132,7 +136,7 @@ export class OidcMiddleware {
                 return res.send(claims);
             }
             catch (e) {
-                console.error(`Error in /user sid=${(_a = req.session) === null || _a === void 0 ? void 0 : _a.id}`, e, req.session);
+                console.error(`Error in /user sid=${redact((_a = req.session) === null || _a === void 0 ? void 0 : _a.id)}`, e);
                 next(e);
             }
         });
@@ -140,7 +144,6 @@ export class OidcMiddleware {
     get logout() {
         return (req, res) => {
             const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet);
-            //TODO: støtt frontchannel SLO
             req.session.destroy(() => {
                 res.redirect(__classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.endSessionUrl({
                     id_token_hint: tokenSet === null || tokenSet === void 0 ? void 0 : tokenSet.id_token,
@@ -148,6 +151,22 @@ export class OidcMiddleware {
             });
         };
     }
+    get frontChannelLogout() {
+        return (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const { iss, sid } = req.query;
+            console.log(`Front channel logout: params iss=${iss}, sid=${redact(sid)}`);
+            if (sid) {
+                try {
+                    yield ((_a = req.destroySessionByIdTokenSid) === null || _a === void 0 ? void 0 : _a.call(req, sid));
+                }
+                catch (e) {
+                    console.error("Failed to destroy session", e);
+                }
+            }
+            res.sendStatus(200);
+        });
+    }
 }
 _OidcMiddleware_clientManager = new WeakMap(), _OidcMiddleware_config = new WeakMap(), _OidcMiddleware_refreshPromises = new WeakMap(), _OidcMiddleware_instances = new WeakSet(), _OidcMiddleware_refreshTokenSet = function _OidcMiddleware_refreshTokenSet(req, tokenSet) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -156,19 +175,19 @@ _OidcMiddleware_clientManager = new WeakMap(), _OidcMiddleware_config = new Weak
         const sessionId = req.session.id;
         const refreshToken = tokenSet.refresh_token;
         const doRefresh = () => __awaiter(this, void 0, void 0, function* () {
-            console.log(`Token refresh starting. sid=${sessionId}`);
+            console.log(`Token refresh starting. sid=${redact(sessionId)}`);
             try {
                 const refreshedTokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_clientManager, "f").client.refresh(refreshToken);
-                console.log(`Token refresh OK. sid=${sessionId}`);
+                console.log(`Token refresh OK. sid=${redact(sessionId)}`);
                 return refreshedTokenSet;
             }
             catch (err) {
-                console.log(`Token refresh failed. sid=${sessionId}`, err);
+                console.log(`Token refresh failed. sid=${redact(sessionId)}`, err);
                 return null;
             }
         });
         const refreshPromise = (_a = (_b = __classPrivateFieldGet(this, _OidcMiddleware_refreshPromises, "f"))[refreshToken]) !== null && _a !== void 0 ? _a : (_b[refreshToken] = doRefresh().finally(() => {
-            console.log(`Token refresh finished. Cleaning up. sid=${sessionId}`);
+            console.log(`Token refresh finished. Cleaning up. sid=${redact(sessionId)}`);
             setTimeout(() => {
                 delete __classPrivateFieldGet(this, _OidcMiddleware_refreshPromises, "f")[refreshToken];
             }, 10000);
@@ -186,10 +205,11 @@ _OidcMiddleware_clientManager = new WeakMap(), _OidcMiddleware_config = new Weak
     return __awaiter(this, void 0, void 0, function* () {
         const tokenSet = req.session.tokenSet && new TokenSet(req.session.tokenSet);
         if (!tokenSet) {
-            console.log("No tokenSet found in session");
+            console.log(`No tokenSet found in session sid=${redact(req.session.id)}`);
             return;
         }
         if (tokenSet.expired()) {
+            console.log(`TokenSet expired sid=${redact(req.session.id)}`);
             const newTokenSet = yield __classPrivateFieldGet(this, _OidcMiddleware_instances, "m", _OidcMiddleware_refreshTokenSet).call(this, req, tokenSet);
             return newTokenSet && new TokenSet(newTokenSet);
         }

package/dist/middleware/sessions.d.mts

@@ -1,2 +1,2 @@
-export function sessions(config: any): any;
+export function sessions(config: any): any[];
 //# sourceMappingURL=sessions.d.mts.map

package/dist/middleware/sessions.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.mts","sourceRoot":"","sources":["../../src/middleware/sessions.mjs"],"names":[],"mappings":"AAQA,2CAyBC"}
+{"version":3,"file":"sessions.d.mts","sourceRoot":"","sources":["../../src/middleware/sessions.mjs"],"names":[],"mappings":"AAiDA,6CAgCC"}

package/dist/middleware/sessions.mjs

@@ -1,17 +1,63 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 import session from "express-session";
 import dynamoDbStore from "connect-dynamodb";
+import { DeleteItemCommand, DynamoDBClient, QueryCommand } from "@aws-sdk/client-dynamodb";
+import { redact } from "../utils.js";
 function dynamoDbSessionStore(config = {}) {
+    const client = new DynamoDBClient({});
     const DynamoDbStore = dynamoDbStore({ session });
-    return new DynamoDbStore(config);
+    const sessionStoreConfig = Object.assign(Object.assign({}, config), { client, specialKeys: [
+            { name: "idp-sid", type: "S" }
+        ], skipThrowMissingSpecialKeys: true });
+    const sessionStore = new DynamoDbStore(sessionStoreConfig);
+    sessionStore.destroyByIdTokenSid = (idTokenSid) => __awaiter(this, void 0, void 0, function* () {
+        console.log(`Front channel logout: deleting session(s) with idp-sid=${redact(idTokenSid)}`);
+        const query = new QueryCommand({
+            TableName: config.table,
+            IndexName: "idp-sid-index",
+            ExpressionAttributeValues: { ":sid": { S: idTokenSid } },
+            ExpressionAttributeNames: { "#k": "idp-sid" },
+            KeyConditionExpression: "#k = :sid",
+            ProjectionExpression: "id"
+        });
+        const res = yield client.send(query);
+        yield Promise.all(res.Items.map((item) => {
+            var _a;
+            console.log(`Front channel logout: deleting session ${redact((_a = item.id) === null || _a === void 0 ? void 0 : _a.S, 10)}`);
+            return client.send(new DeleteItemCommand({
+                TableName: config.table,
+                Key: { id: item.id }
+            }));
+        }));
+        console.log(`Front channel logout: completed. ${res.Count} session(s) deleted`);
+    });
+    return sessionStore;
+}
+function memorySessionStore(config = {}) {
+    const sessionStore = new session.MemoryStore(config);
+    sessionStore.destroyByIdTokenSid = (idTokenSid) => {
+        // dummy.
+        console.log(`Pretending to destroyByIdTokenSid. idp-sid=${redact(idTokenSid)}`);
+    };
+    return sessionStore;
 }
 export function sessions(config) {
-    var _a;
+    var _a, _b;
     let sessionStore;
     if (config.sessionStoreType === 'memory') {
-        sessionStore = undefined;
+        const sessionStoreOptions = (_a = config.sessionStoreOptions) !== null && _a !== void 0 ? _a : {};
+        sessionStore = memorySessionStore(sessionStoreOptions);
     }
     else if (config.sessionStoreType === 'dynamodb') {
-        const sessionStoreOptions = (_a = config.sessionStoreOptions) !== null && _a !== void 0 ? _a : {};
+        const sessionStoreOptions = (_b = config.sessionStoreOptions) !== null && _b !== void 0 ? _b : {};
         sessionStore = dynamoDbSessionStore(sessionStoreOptions);
     }
     else if (config.sessionStoreType) {
@@ -20,16 +66,22 @@ export function sessions(config) {
     else {
         throw Error('missing sessionStoreType');
     }
-    return session({
-        secret: config.sessionSecret,
-        store: sessionStore,
-        resave: false,
-        saveUninitialized: false,
-        cookie: config.cookie || {
-            httpOnly: true,
-            path: config.cookiePath,
-            secure: config.cookieSecure,
-            sameSite: config.cookieSameSite
-        },
-    });
+    return [
+        session({
+            secret: config.sessionSecret,
+            store: sessionStore,
+            resave: false,
+            saveUninitialized: false,
+            cookie: config.cookie || {
+                httpOnly: true,
+                path: config.cookiePath,
+                secure: config.cookieSecure,
+                sameSite: config.cookieSameSite
+            },
+        }),
+        (req) => {
+            // make this function available to request handlers
+            req.destroySessionByIdTokenSid = sessionStore === null || sessionStore === void 0 ? void 0 : sessionStore.destroyByIdTokenSid;
+        }
+    ];
 }

package/dist/utils.d.ts

@@ -0,0 +1,2 @@
+export function redact(string: any, length?: number): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.js"],"names":[],"mappings":"AAAA,6DAEC"}

package/dist/utils.js

@@ -0,0 +1,3 @@
+export function redact(string, length = 5) {
+    return (string === null || string === void 0 ? void 0 : string.substring(0, length)) + '***';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oslokommune/auth-bff",
-  "version": "1.5.1",
+  "version": "1.6.0-beta1",
   "repository": "https://github.com/oslokommune/auth-bff.git",
   "publishConfig": {
     "access": "public"
@@ -8,7 +8,8 @@
   "scripts": {
     "build": "tsc",
     "run": "node ./dist/server.mjs",
-    "build-and-publish": "tsc && npm publish"
+    "build-and-publish": "tsc && npm publish",
+    "build-and-publish-prerelease": "tsc && npm publish --tag prerelease"
   },
   "exports": {
     "./vite-plugin": "./dist/vite-plugin.mjs",