@owlmeans/mui-oidc-rp 0.1.3

package/src/service.ts

@@ -0,0 +1,159 @@
+import type { Config, Context, OidcAuthService, OidcInteraction } from './types.js'
+import type { FlowService } from '@owlmeans/client-flow'
+
+import { assertContext, createService, HOME } from '@owlmeans/context'
+import { DEFAULT_ALIAS } from './consts.js'
+import { UserManager } from 'oidc-client-ts'
+import { DEFAULT_ALIAS as FLOW_SERVICE } from '@owlmeans/client-flow'
+import { FlowStepMissconfigured, OidcAuthStep, STD_OIDC_FLOW, UnknownFlow } from '@owlmeans/flow'
+import type { Module } from '@owlmeans/web-client'
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, OIDC_CODE_QUERY } from '@owlmeans/oidc'
+import type { Auth, AuthToken } from '@owlmeans/auth'
+import { AUTH_RESOURCE, USER_ID } from '@owlmeans/client-auth'
+import type { ClientAuthResource } from '@owlmeans/client-auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+
+export const makeOidcAuthService = (alias: string = DEFAULT_ALIAS): OidcAuthService => {
+  const store = (context: Context) => context.auth().store<OidcInteraction>()
+  const storeKey = '_oidc-client-interaction'
+
+  const service: OidcAuthService = createService<OidcAuthService>(alias, {
+    /**
+     * This method performs when the IdP returns authentication params.
+     */
+    dispatch: async params => {
+      /**
+       * 1. Check if there are parameters in the URL for the server side OIDC authentication (e.g. code)
+       * 2. Send paramters to finalize authentication (proxy request to the auth server?)
+       * 3. If the authentication successful set user state using authentication service
+       */
+      if (params[OIDC_CODE_QUERY] == null) {
+        return false
+      }
+
+      const ctx = service.assertCtx<Config, Context>()
+
+      params.authUrl = (await store(ctx).get(storeKey)).authUrl
+
+      const [authToken] = await ctx.module<Module<AuthToken>>(DISPATCHER_OIDC)
+        .call({ body: params })
+
+      if (authToken.token != null && authToken.token !== '') {
+        const authResource = ctx.resource<ClientAuthResource>(AUTH_RESOURCE)
+        await authResource.save({ id: USER_ID, token: authToken.token })
+
+        const [, authorization] = authToken.token.split(' ')
+        const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+
+        ctx.auth().auth = envelope.message()
+        ctx.auth().token = authToken.token
+
+        return true
+      }
+
+      return false
+    },
+
+    authenticate: async (flow, params) => {
+      /**
+       * 1. Kick of OIDC authentication if we receive some hints about who or for what organization we'd like to authenticate
+       * 2. Request OIDC authentication params from the server using these entity and profile id
+       * 3. The server should return an URL to redirect user to
+       * 4. Return this user to the component for the further processing (redirection)
+       */
+      const state = flow.state()
+      if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Ephemeral) {
+        return null
+      }
+      if (params.entity == null && state.entityId == null) {
+        return null
+      }
+      params.entity ??= state.entityId!
+
+      const ctx = service.assertCtx<Config, Context>()
+
+      let [redirectTo] = await ctx.module<Module<string>>(DISPATCHER_OIDC_INIT)
+        .call({ body: params })
+
+      if (flow.payload().simplified === 'true') {
+        redirectTo += '&simplified=true'
+      }
+      
+      const context = service.assertCtx<Config, Context>()
+      await store(context).save({ id: storeKey, authUrl: redirectTo })
+
+      return redirectTo
+    },
+
+    proceedToRedirectUrl: async extras => {
+      const context = assertContext<Config, Context>(service.ctx as Context)
+
+      const flow = context.service<FlowService>(FLOW_SERVICE)
+      const flowModel = await flow.state()
+      if (flowModel == null) {
+        throw new UnknownFlow('oidc.dispatch')
+      }
+
+      const authorityTransition = flowModel.next()
+      flowModel.transit(authorityTransition.transition, true, { 
+        purpose: extras.purpose,
+        simplified: extras.simplified,
+      })
+
+      // @TODO I'm not sure that this dirty hack is a correct approach
+      if (extras.alias === HOME) {
+        const redirectTransition = flowModel.next()
+        flowModel.transit(redirectTransition.transition, true, { 
+          purpose: extras.purpose,
+          simplified: extras.simplified
+        })
+      }
+
+      const redirectUrl = await flow.proceed({ params: { uid: extras.uid } }, true)
+
+      return redirectUrl
+    },
+
+    /**
+     * This is client-side only OIDC implementation. It's under constructuion.
+     * We stoped on the try to redirect to OIDC provider, but it requires browser integrated
+     * cryptography under ssl/tls.
+     * @TODO Finish client-side only implementation one day
+     */
+    dispatchClientOnly: async () => {
+      const context = assertContext<Config, Context>(service.ctx as Context)
+
+      const flow = context.service<FlowService>(FLOW_SERVICE)
+
+      const flowModel = await flow.state()
+      if (flowModel == null) {
+        throw new UnknownFlow('oidc.dispatch')
+      }
+
+      const authorityTransition = flowModel.next()
+      flowModel.transit(authorityTransition.transition, true)
+      const authorityStep = flowModel.step()
+      if (authorityStep.module == null) {
+        throw new FlowStepMissconfigured(authorityStep.step)
+      }
+      const [authorityUrl] = await context.module<Module>(authorityStep.module).call<string>()
+
+      const redirectTransition = flowModel.next()
+      flowModel.transit(redirectTransition.transition, true)
+
+      const redirectUrl = await flow.proceed(undefined, true)
+
+      // @TODO To proceed we need to provide client_id some way
+      const manager = new UserManager({
+        // client_id: context.cfg.oidc.consumer?.clientId ?? '',
+        client_id: '',
+        redirect_uri: redirectUrl,
+        authority: authorityUrl,
+      })
+
+      await manager.signinRedirect({ state: flowModel.serialize() })
+    }
+  })
+
+  return service
+}

package/src/types.ts

@@ -0,0 +1,39 @@
+import type { InitializedService } from '@owlmeans/context'
+import type { AppConfig, AppContext } from '@owlmeans/web-client'
+import type { OIDCAuthInitParams, WithSharedConfig } from '@owlmeans/oidc'
+import type { OidcAuthPurposes } from './consts.js'
+import type { FlowModel, FlowPayload } from '@owlmeans/flow'
+import type { ResourceRecord } from '@owlmeans/resource'
+import type { AuthToken } from '@owlmeans/auth'
+
+export interface OidcAuthService extends InitializedService {
+  dispatch: (params: Record<string, string>) => Promise<boolean>
+
+  authenticate: (flow: FlowModel, params: OIDCAuthInitParams) => Promise<string | null>
+
+  // This is dedicated authentication service implementation
+  proceedToRedirectUrl: (extras: OidcAuthRedirectExtras) => Promise<string>
+
+  // @TODO Unfinished implementation
+  dispatchClientOnly: () => Promise<void>
+}
+
+export interface OidcAuthRedirectExtras extends FlowPayload {
+  purpose: OidcAuthPurposes
+  simplified?: string
+  uid?: string
+  alias?: string
+}
+
+export interface OidcPostAuthPayload extends FlowPayload , AuthToken {
+  purpose: OidcAuthPurposes
+  simplified?: string
+}
+
+export interface Config extends AppConfig, WithSharedConfig { }
+
+export interface Context<C extends Config = Config> extends AppContext<C> { }
+
+export interface OidcInteraction extends ResourceRecord {
+  authUrl: string 
+}

package/tests/context.ts

@@ -0,0 +1,16 @@
+import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+
+export const makeTestContext = () => {
+  const cfg: BasicConfig = {
+    ready: false,
+    service: 'web-oidc-rp-tests',
+    layer: Layer.Application,
+    type: AppType.Frontend,
+    services: {},
+  }
+
+  const context = makeBasicContext(cfg) as BasicContext<BasicConfig>
+
+  return context
+}

package/tests/google-client.spec.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from 'bun:test'
+import { extractGoogleUrl, buildCallbackCredentials } from '../src/auth/plugins/helpers.js'
+import { AUTH_SCOPE, AuthRole } from '@owlmeans/auth'
+import { makeFixtureKeyPair, signMockEnvelope } from '@owlmeans/test-auth'
+import { EnvelopeKind } from '@owlmeans/basic-envelope'
+
+describe('@owlmeans/mui-oidc-rp — extractGoogleUrl', () => {
+  test('strips source prefix from envelope message', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&state=xyz'
+    const source = 'https://example.com/auth'
+    const challengeMsg = `${source}:${googleUrl}`
+    // Create a signed envelope wrapping the prefixed URL
+    const envelope = await signMockEnvelope(challengeMsg, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, source)
+
+    expect(result).toBe(googleUrl)
+  })
+
+  test('handles raw URL without source prefix', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test-2')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&state=xyz'
+    const envelope = await signMockEnvelope(googleUrl, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, 'https://different.example.com')
+
+    expect(result).toBe(googleUrl)
+  })
+
+  test('handles empty source prefix', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test-3')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc'
+    const envelope = await signMockEnvelope(googleUrl, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, '')
+
+    expect(result).toBe(googleUrl)
+  })
+})
+
+describe('@owlmeans/mui-oidc-rp — buildCallbackCredentials', () => {
+  test('builds AuthCredentials from query params', () => {
+    const queryString = 'code=4/0abc123&state=test-state-xyz&scope=openid+email'
+    const type = 'google-oauth'
+    const challenge = 'stored-challenge-value'
+
+    const creds = buildCallbackCredentials(queryString, type, challenge)
+
+    expect(creds.type).toBe('google-oauth')
+    expect(creds.challenge).toBe('stored-challenge-value')
+    expect(creds.credential).toBe(queryString)
+    expect(creds.role).toBe(AuthRole.User)
+    expect(creds.userId).toBe('code')
+    expect(creds.scopes).toEqual([AUTH_SCOPE])
+  })
+
+  test('works with empty challenge', () => {
+    const creds = buildCallbackCredentials('code=x&state=y', 'google-oauth', '')
+
+    expect(creds.challenge).toBe('')
+    expect(creds.credential).toBe('code=x&state=y')
+  })
+})

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.react.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.react.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/",
+    "outDir": "./build/"
+  },
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}