@oslokommune/auth-bff 1.6.1 → 2.0.0-beta2

package/README.md

@@ -0,0 +1,240 @@
+# auth-bff
+
+A NodeJS Backend for frontend.
+
+Features:
+
+* Two "modes" of operation
+    * A vite plugin for use during development
+    * A standalone mode for use in production (e.g. inside a docker container)
+* Supports generic OIDC auth code flow clients
+* Has special support for `okdata`-generated Idporten clients
+* Handles login/logout and sessions (using DynamoDb as a store)
+* Proxies API calls
+* Serves a static web app
+* Includes simple React components for handling login-state
+
+See https://github.com/oslokommune/auth-bff-example for an example React app using this package.
+
+## Getting started
+
+### Dev mode
+
+1. Install package
+
+```shell
+npm install @oslokommune/auth-bff
+```
+
+2. Add plugin to your vite config
+
+```ts
+import {defineConfig} from 'vite'
+import bff from '@oslokommune/auth-bff/vite-plugin'
+
+export default defineConfig({
+  plugins: [
+    bff()
+  ],
+  ...
+})
+```
+
+3. Create a [config file](#configuration)
+
+4. Run!
+
+### Standalone mode
+
+1. Install package globally
+
+```shell
+npm install -g @oslokommune/auth-bff
+```
+
+2. Create a [config file](#configuration)
+
+3. Run with
+
+```shell
+auth-bff
+```
+
+## Configuration
+
+Configuration is set in json-files that look like this:
+
+```json
+{
+  "issuer": "https://example-issuer.com/",
+  "clientId": "example-client",
+  "clientSecret": "{ssm:/secret/from/parameter/store}",
+  "redirectUri": "http://localhost:3000/auth/callback",
+  "cookieSecure": false,
+  "cookieSameSite": false,
+  "postLogoutRedirectUri": "http://localhost:3000/",
+  "sessionSecret": "{env:SECRET_FROM_ENV}",
+  "sessionStoreType": "memory",
+  "proxyTargets": {
+    "/api": "http://localhost:8080/api"
+  }
+}
+```
+
+By default it looks for a file named `bff.config.json`. But this can be overridden:
+
+Vite:
+
+```ts
+plugins: [
+  bff({configFile: ['bff.config.local.json', 'bff.config.json']}) //First existing file is used
+]
+```
+
+Standalone:
+
+```shell
+auth-bff --configFile /path/to/bff.config.json
+```
+
+The config file supports two special forms for loading values from other sources. Primarily meant for loading secrets:
+
+Environment values:
+
+```json
+{
+  "sessionSecret": "{env:MY_SECRET}"
+}
+```
+
+AWS Parameter store:
+
+```json
+{
+  "sessionSecret": "{ssm:/name/of/parameter}"
+}
+```
+
+This loads from the configured AWS environment. For this to work on your local machine the `AWS_PROFILE` environment
+variable must be set, and you must be signed in to that profile
+
+See [config.ts](src/config.ts) description of all config parameters
+
+### Using with ID-porten (via `okdata`):
+
+`auth-bff` Has special support for keys generated by [`okdata`](https://github.com/oslokommune/okdata-cli).
+
+1. Start by creating a new client and key using okdata:
+
+```shell
+~> okdata pubs create-client
+* Environment test
+* Team <team>
+* Client type ID-porten
+* Integration name  (identifying in which system or case this client will be used) <your name here>
+* Redirect URIs (comma-separated) http://localhost:3000/auth/callback
+* Post logout Redirect URIs (comma-separated) http://localhost:3000
+* Frontchannel logout URI http://localhost:3000/auth/logout
+* Client URI (back URI) http://localhost:3000
+...
+~> okdata pubs create-key
+* Environment test
+* Client <same client as above>
+* Where should the key be stored? Send the key to your AWS Parameter Store
+* AWS account number <accno>
+* AWS region eu-west-1 (Ireland)
+* Automatic key rotation will replace the key in SSM nightly on weekdays.
+  Enable automatic key rotation for this client? Yes
+...
+A new key has been created and the following parameters have been written to SSM:
+- /okdata/maskinporten/11111111-2222-3333-4444-555555555555/key.json
+...
+```
+
+2. Set the following options in the config file:
+
+```json
+{
+  "issuer": "https://test.idporten.no/",
+  "clientId": "11111111-2222-3333-4444-555555555555",
+  "okDataIdPortenKeyName": "/okdata/maskinporten/11111111-2222-3333-4444-555555555555/key.json",
+  ...
+}
+```
+
+3. Done!
+
+## Configuring session storage
+
+Currently only dynamoDb is supported for storing sessions in production. It requires some setup.
+To work properly, the table must have ttl enabled, and an extra index for the `idp-sid`-property (used to delete
+sessions during front-channel logout)
+
+> [!WARNING]  
+> If the table does not exist, it will be automatically created with settings not appropriate for production.
+
+
+Here is an example configuration in terraform
+
+```terraform
+resource "aws_dynamodb_table" "session_dynamodb_table" {
+  name         = "${local.environment}-${local.main_container_name}-sessions"
+  billing_mode = "PAY_PER_REQUEST"
+  hash_key     = "id"
+
+  on_demand_throughput {
+    max_read_request_units  = 20
+    max_write_request_units = 20
+  }
+
+  attribute {
+    name = "id"
+    type = "S"
+  }
+
+  attribute {
+    name = "idp-sid"
+    type = "S"
+  }
+
+  ttl {
+    enabled        = true
+    attribute_name = "expires"
+  }
+
+  global_secondary_index {
+    hash_key        = "idp-sid"
+    name            = "idp-sid-index"
+    projection_type = "KEYS_ONLY"
+    on_demand_throughput {
+      max_read_request_units  = 20
+      max_write_request_units = 20
+    }
+  }
+}
+```
+
+The read/write limits above are just an example, and can be changed/removed
+
+## Required AWS permissions
+
+When using SSM parameters or `okDataIdPortenKeyName` in the config, the service will need the `ssm:GetParameter`
+permission for each parameter
+
+If using dynamodb, the service will need the following permissions for the table
+
+```
+dynamodb:CreateTable
+dynamodb:DescribeTable
+dynamodb:PutItem
+dynamodb:DeleteItem
+dynamodb:GetItem
+dynamodb:Scan
+dynamodb:UpdateItem
+```
+
+## React AuthContext
+
+This package also includes a React component for handling authentication state
+
+

package/dist/package.json

@@ -0,0 +1,58 @@
+{
+    "name": "@oslokommune/auth-bff",
+    "version": "2.0.0-beta2",
+    "repository": "https://github.com/oslokommune/auth-bff.git",
+    "publishConfig": {
+        "access": "public"
+    },
+    "scripts": {
+        "build": "tsc",
+        "run": "node ./dist/src/server.js",
+        "build-and-publish": "tsc && npm publish",
+        "build-and-publish-prerelease": "tsc && npm publish --tag prerelease",
+        "test": "vitest"
+    },
+    "exports": {
+        "./vite-plugin": "./dist/src/vite-plugin.js",
+        "./react": "./dist/src/react/index.js"
+    },
+    "bin": {
+        "auth-bff": "dist/src/server.js"
+    },
+    "files": [
+        "/dist"
+    ],
+    "type": "module",
+    "author": "",
+    "license": "",
+    "description": "",
+    "devDependencies": {
+        "@types/command-line-args": "^5.2.3",
+        "@types/compression": "^1.8.1",
+        "@types/express": "^4.17.22",
+        "@types/express-session": "^1.18.2",
+        "@types/node-forge": "1.3.13",
+        "@types/react": "17.0.87",
+        "@types/supertest": "^6.0.3",
+        "react": "17.0.2",
+        "supertest": "^7.2.2",
+        "typescript": "^5.9.3",
+        "vitest": "^4.0.18"
+    },
+    "dependencies": {
+        "@aws-sdk/client-dynamodb": "^3.990.0",
+        "@aws-sdk/client-ssm": "^3.990.0",
+        "command-line-args": "^6.0.1",
+        "compression": "^1.8.1",
+        "connect-dynamodb": "^3.0.5",
+        "express": "4.22.1",
+        "express-session": "1.19.0",
+        "find-up": "^7.0.0",
+        "helmet": "^8.1.0",
+        "http-proxy-middleware": "^3.0.5",
+        "jose": "^6.1.3",
+        "node-forge": "1.3.3",
+        "openid-client": "^6.8.2",
+        "string-replace-middleware": "^1.1.0"
+    }
+}

package/dist/src/OpenIdConfigManager.d.ts

@@ -0,0 +1,10 @@
+import * as client from 'openid-client';
+import { BffConfig } from "./config.js";
+export declare class OpenIdConfigManager {
+    #private;
+    constructor(config: BffConfig, serverMetadata?: client.ServerMetadata);
+    init(): Promise<void>;
+    updateOpenIdConfig(): Promise<void>;
+    get openIdConfig(): client.Configuration;
+}
+//# sourceMappingURL=OpenIdConfigManager.d.ts.map

package/dist/src/OpenIdConfigManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenIdConfigManager.d.ts","sourceRoot":"","sources":["../../src/OpenIdConfigManager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAC,SAAS,EAAkB,MAAM,aAAa,CAAC;AASvD,qBAAa,mBAAmB;;gBAMlB,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,cAAc;IAK/D,IAAI;IA4BJ,kBAAkB;IAuCxB,IAAI,YAAY,yBAEf;CAEF"}

package/dist/src/OpenIdConfigManager.js

@@ -0,0 +1,77 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _OpenIdConfigManager_instances, _OpenIdConfigManager_bffConfig, _OpenIdConfigManager_openIdConfig, _OpenIdConfigManager_serverMetadata, _OpenIdConfigManager_p12ToJwk, _OpenIdConfigManager_createKeyFromOkData;
+// @ts-ignore
+import forge from 'node-forge';
+import * as jose from 'jose';
+import * as client from 'openid-client';
+import { getSsmParameter } from "./config.js";
+export class OpenIdConfigManager {
+    constructor(config, serverMetadata) {
+        _OpenIdConfigManager_instances.add(this);
+        _OpenIdConfigManager_bffConfig.set(this, void 0);
+        _OpenIdConfigManager_openIdConfig.set(this, void 0);
+        _OpenIdConfigManager_serverMetadata.set(this, void 0);
+        __classPrivateFieldSet(this, _OpenIdConfigManager_bffConfig, config, "f");
+        __classPrivateFieldSet(this, _OpenIdConfigManager_serverMetadata, serverMetadata, "f");
+    }
+    async init() {
+        await this.updateOpenIdConfig();
+        if (__classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").okDataIdPortenKeyName) {
+            setInterval(async () => {
+                await this.updateOpenIdConfig();
+            }, 5 * 60 * 1000);
+        }
+    }
+    async updateOpenIdConfig() {
+        console.log('Updating OpenId config...');
+        let key;
+        if (__classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").okDataIdPortenKeyName) {
+            console.log('Fetching okdata key');
+            key = await __classPrivateFieldGet(this, _OpenIdConfigManager_instances, "m", _OpenIdConfigManager_createKeyFromOkData).call(this, __classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").okDataIdPortenKeyName);
+        }
+        const clientId = __classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").clientId;
+        const clientMetadata = { client_secret: __classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").clientSecret };
+        const clientAuth = key ? client.PrivateKeyJwt(key) : undefined;
+        if (__classPrivateFieldGet(this, _OpenIdConfigManager_openIdConfig, "f")) {
+            console.log('Reusing OpenId Config with new key');
+            __classPrivateFieldSet(this, _OpenIdConfigManager_openIdConfig, new client.Configuration(__classPrivateFieldGet(this, _OpenIdConfigManager_openIdConfig, "f").serverMetadata(), clientId, clientMetadata, clientAuth), "f");
+        }
+        else if (__classPrivateFieldGet(this, _OpenIdConfigManager_serverMetadata, "f")) {
+            console.log('Using OpenId Config with provided server metadata');
+            __classPrivateFieldSet(this, _OpenIdConfigManager_openIdConfig, new client.Configuration(__classPrivateFieldGet(this, _OpenIdConfigManager_serverMetadata, "f"), clientId, clientMetadata, clientAuth), "f");
+        }
+        else {
+            console.log('Fetching OpenId config');
+            __classPrivateFieldSet(this, _OpenIdConfigManager_openIdConfig, await client.discovery(new URL(__classPrivateFieldGet(this, _OpenIdConfigManager_bffConfig, "f").issuer), clientId, clientMetadata, clientAuth), "f");
+        }
+    }
+    get openIdConfig() {
+        return __classPrivateFieldGet(this, _OpenIdConfigManager_openIdConfig, "f");
+    }
+}
+_OpenIdConfigManager_bffConfig = new WeakMap(), _OpenIdConfigManager_openIdConfig = new WeakMap(), _OpenIdConfigManager_serverMetadata = new WeakMap(), _OpenIdConfigManager_instances = new WeakSet(), _OpenIdConfigManager_p12ToJwk = async function _OpenIdConfigManager_p12ToJwk(okdataP12) {
+    //TODO: dette er helt sikkert mulig å gjøre i færre steg...
+    const p12Der = forge.util.decode64(okdataP12.keystore);
+    const p12Asn1 = forge.asn1.fromDer(p12Der);
+    const p12 = forge.pkcs12.pkcs12FromAsn1(p12Asn1, okdataP12.key_password);
+    const privateKey = p12.getBags({ friendlyName: okdataP12.key_alias }).friendlyName[0].key;
+    const privateKeyAsn1 = forge.pki.privateKeyToAsn1(privateKey);
+    const privateKeyInfo = forge.pki.wrapRsaPrivateKey(privateKeyAsn1);
+    const pem = forge.pki.privateKeyInfoToPem(privateKeyInfo);
+    const key = await jose.importPKCS8(pem, 'RS256', { extractable: true });
+    return { key: key, kid: okdataP12.key_id };
+}, _OpenIdConfigManager_createKeyFromOkData = async function _OpenIdConfigManager_createKeyFromOkData(ssmName) {
+    const keyString = await getSsmParameter(ssmName);
+    const okdataKey = JSON.parse(keyString);
+    return await __classPrivateFieldGet(this, _OpenIdConfigManager_instances, "m", _OpenIdConfigManager_p12ToJwk).call(this, okdataKey);
+};

package/dist/src/config.d.ts

@@ -0,0 +1,128 @@
+import { HelmetOptions } from "helmet";
+import session from "express-session";
+export type BffConfig = {
+    /**
+     * The port at which the app will be served. Only used in standalone mode, to change the port used during development,
+     * set it in your vite config instead.
+     */
+    port: number;
+    /**
+     * The base root path. Change if app is served from a non-root path.
+     *
+     * Default: `/`
+     */
+    basePath?: string;
+    /**
+     * The root path of the static resources to be served
+     *
+     * Default: `/dist`
+     */
+    staticRootPath?: string;
+    /**
+     * The issuer
+     *
+     * Example: `https://test.idporten.no/`
+     */
+    issuer: string;
+    /**
+     * The ID of the client
+     */
+    clientId: string;
+    /**
+     * The client secret. Not used if `okDataIdPortenKeyName` is set.
+     */
+    clientSecret?: string;
+    /**
+     * The redirect uri configured for the client
+     */
+    redirectUri: string;
+    /**
+     * The intended audience for the tokens. Value(s) set here can be used to verify audience on the recipient end.
+     * See https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-indicators-05.
+     *
+     * Example: `["https://example.com/api1", "https://example.com/api2"]`
+     */
+    resources?: Array<string>;
+    /**
+     * express-session cookie options, note that if this is set, the below cookie*-options will have no effect
+     */
+    cookie?: session.CookieOptions;
+    /**
+     * Sets the Path attribute of the cookie. Should most likely be the same as basePath. See https://expressjs.com/en/resources/middleware/session.html
+     *
+     * Default: `/`
+     */
+    cookiePath?: string;
+    /**
+     * Sets the Secure attribute of the cookie. See https://expressjs.com/en/resources/middleware/session.html
+     *
+     * Default: `true`
+     */
+    cookieSecure?: boolean;
+    /**
+     * Sets the SameSite attribute of the cookie. See https://expressjs.com/en/resources/middleware/session.html
+     *
+     * Default: `"lax"`
+     */
+    cookieSameSite: boolean | "lax" | "none" | "strict";
+    /**
+     * The post logout redirect uri configured for the client
+     */
+    postLogoutRedirectUri: string;
+    /**
+     * The name of the key that okdata stored in parameter store.
+     *
+     * Example: `/okdata/maskinporten/11111111-2222-3333-4444-555555555555/key.json`
+     */
+    okDataIdPortenKeyName: string;
+    /**
+     * Secret used to sign sessions
+     */
+    sessionSecret: string;
+    /**
+     * The type of session store used. Only `memory` and `dynamodb` currently supported. `memory` is only for dev use
+     */
+    sessionStoreType: 'memory' | 'dynamodb';
+    /**
+     * Options that will be passed to the chosen sessionStore. Options depend on the type of store chosen
+     *
+     * Example: `{"table": "my-custom-dynamodb-table"}`
+     */
+    sessionStoreOptions?: object;
+    /**
+     * Map of paths and remote targets that will be forwarded by the proxy
+     *
+     * Example: `{'/api': 'http://example.com/api'}`
+     */
+    proxyTargets: {
+        [path: string]: string;
+    };
+    /**
+     * List of claims in the access token that are returned by the /user-endpoint. By default all are returned
+     *
+     * Example: `["pid"]`
+     */
+    userClaims?: Array<string>;
+    /**
+     * Content security policy configuration passed to helmet.
+     * See https://github.com/helmetjs/helmet for details. Note that since the config in limited to json,
+     * some features are not supported. To set a nonce value, use the special value `"{nonce}"` instead.
+     *
+     *
+     * Example:
+     * ```json
+     *     {
+     *       "directives": {
+     *         "default-src": ["'self'", "https://*.oslo.kommune.no", "https://*.oslo.systems"],
+     *         "script-src": ["'self'", "{nonce}"],
+     *       ...
+     *       }
+     *     }
+     * ```
+     */
+    contentSecurityPolicy?: Exclude<HelmetOptions['contentSecurityPolicy'], Boolean>;
+};
+export declare function getEnv(env: string, defaultVal?: string, parseFn?: (val: string) => string): string;
+export declare function getSsmParameter(name: string, withDecryption?: boolean): Promise<string>;
+export declare function loadConfig(configFile?: string): Promise<BffConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/src/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,aAAa,EAAC,MAAM,QAAQ,CAAC;AACrC,OAAO,OAAO,MAAM,iBAAiB,CAAC;AAEtC,MAAM,MAAM,SAAS,GAAG;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACzB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAA;IAC9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;;OAIG;IACH,cAAc,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;IACnD;;OAEG;IACH,qBAAqB,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAA;IAC7B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,gBAAgB,EAAE,QAAQ,GAAG,UAAU,CAAA;IACvC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;OAIG;IACH,YAAY,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B;;;;;;;;;;;;;;;;OAgBG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAA;CACjF,CAAA;AAUD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,UAQzF;AAID,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,GAAE,OAAc,mBAMjF;AAKD,wBAAsB,UAAU,CAAC,UAAU,GAAE,MAA0B,sBAyBtE"}

package/dist/src/config.js

@@ -0,0 +1,55 @@
+import { findUp } from 'find-up';
+import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+const defaultConfig = {
+    basePath: "",
+    cookiePath: '/',
+    cookieSecure: true,
+    cookieSameSite: 'lax',
+    staticRootPath: './dist'
+};
+export function getEnv(env, defaultVal, parseFn) {
+    if (process.env[env]) {
+        return parseFn ? parseFn(process.env[env]) : process.env[env];
+    }
+    else if (defaultVal !== undefined) {
+        return defaultVal;
+    }
+    else {
+        throw Error(`Missing env var: ${env}`);
+    }
+}
+let ssmClient;
+export async function getSsmParameter(name, withDecryption = true) {
+    ssmClient ?? (ssmClient = new SSMClient({}));
+    return ssmClient.send(new GetParameterCommand({
+        Name: name,
+        WithDecryption: withDecryption
+    })).then(p => p.Parameter.Value);
+}
+let config;
+export async function loadConfig(configFile = 'bff.config.json') {
+    if (config)
+        return config;
+    const userConfigPath = await findUp(configFile);
+    if (!userConfigPath) {
+        throw Error(`Could not find config file ${configFile}`);
+    }
+    console.log('Loading config at', userConfigPath);
+    const { default: loadedConfig } = await import(userConfigPath, { with: { type: 'json' } });
+    for (const [key, value] of Object.entries(loadedConfig)) {
+        if (typeof value === "string") {
+            const [, varType, varName] = value.match(/\{(\w+):(.*)}/) ?? [];
+            if (varType === 'env') {
+                loadedConfig[key] = getEnv(varName);
+            }
+            else if (varType === 'ssm') {
+                loadedConfig[key] = await getSsmParameter(varName);
+            }
+            else if (varType) {
+                throw Error(`unknown varType: ${varType}`);
+            }
+        }
+    }
+    config = { ...defaultConfig, ...loadedConfig };
+    return config;
+}

package/dist/src/middleware/OidcMiddleware.d.ts

@@ -0,0 +1,20 @@
+import { OpenIdConfigManager } from "../OpenIdConfigManager.js";
+import { BffConfig } from "../config.js";
+import type { Request, Response, NextFunction } from 'express';
+export declare class OidcMiddleware {
+    #private;
+    /**
+     * @private
+     * @param config
+     * @param configManager
+     */
+    constructor(config: BffConfig, configManager: OpenIdConfigManager);
+    static create(config: BffConfig): Promise<OidcMiddleware>;
+    get ensureFreshToken(): (req: Request, res: Response, next: NextFunction) => void;
+    get login(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    get callback(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    get user(): (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>>>;
+    get logout(): (req: Request, res: Response) => void;
+    get frontChannelLogout(): (req: Request, res: Response) => Promise<void>;
+}
+//# sourceMappingURL=OidcMiddleware.d.ts.map

package/dist/src/middleware/OidcMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/OidcMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,mBAAmB,EAAC,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAC,SAAS,EAAC,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAC,MAAM,SAAS,CAAA;AAK5D,qBAAa,cAAc;;IAKzB;;;;OAIG;gBACS,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB;WASpD,MAAM,CAAC,MAAM,EAAE,SAAS;IAgErC,IAAI,gBAAgB,KACV,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAWxD;IAED,IAAI,KAAK,KACO,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBA+B9D;IAqBD,IAAI,QAAQ,KACI,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAuC9D;IAED,IAAI,IAAI,KACQ,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,iDAc9D;IAED,IAAI,MAAM,KACA,KAAK,OAAO,EAAE,KAAK,QAAQ,UASpC;IAED,IAAI,kBAAkB,KACN,KAAK,OAAO,EAAE,KAAK,QAAQ,mBAc1C;CACF"}