@owlmeans/oidc 0.1.0

package/build/guard.js

@@ -0,0 +1,102 @@
+import { createService } from '@owlmeans/context';
+import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js';
+import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common';
+import { AUTH_HEADER, AuthorizationError } from '@owlmeans/auth';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+import { trust } from '@owlmeans/auth-common/utils';
+import { TRUSTED } from '@owlmeans/config';
+import { extractAuthToken } from '@owlmeans/auth-common/utils';
+import { modules as oidcModules } from './modules.js';
+export const makeOidcGuard = (opts) => {
+    // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
+    //   ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? OIDC_GUARD_CACHE)
+    //   : null
+    const [cogurad] = Array.isArray(opts?.coguards) ? opts.coguards : [opts?.coguards ?? DEFAULT_GUARD];
+    const guard = createService(OIDC_GUARD, {
+        // Client side
+        // get token() {
+        //   const ctx = guard.assertCtx<Config, Context>()
+        //   if (!ctx.hasService(cogurad)) {
+        //     return undefined
+        //   }
+        //   // @TODO Make some custom implementation if required.
+        //   // Cause it won't work on the back. And it's likely that
+        //   // we will need it soon.
+        //   const auth = ctx.service<GuardService>(cogurad)
+        //   return auth.token
+        // },
+        authenticated: async (req) => {
+            const ctx = guard.assertCtx();
+            // @TODO Make some custom implementation if required.
+            // We try to rely on some centeral auth service that operates all tokens.
+            const auth = ctx.service(opts?.tokenService ?? cogurad);
+            const token = await auth.authenticated(req);
+            if (token != null) {
+                const [type] = token.split(' ');
+                if (type === OIDC_WRAPPED_TOKEN.toUpperCase()) {
+                    return token;
+                }
+            }
+            return null;
+        },
+        // Server side
+        match: async (req) => extractAuthToken(req, OIDC_WRAPPED_TOKEN) != null,
+        handle: async (req, res) => {
+            const authorization = extractAuthToken(req, OIDC_WRAPPED_TOKEN);
+            if (authorization == null) {
+                return false;
+            }
+            const ctx = guard.assertCtx();
+            const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+            const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
+            if (!await envelope.verify(trusted.key)) {
+                return false;
+            }
+            const token = extractAuthToken(req, OIDC_WRAPPED_TOKEN, false);
+            let updated = null;
+            try {
+                updated = await wrapper(ctx).update({ token }, true);
+            }
+            catch (e) {
+                if (e instanceof AuthorizationError) {
+                    res.responseProvider.header(TOKEN_UPDATE, '');
+                    req.headers = { ...req.headers, [AUTH_HEADER]: '' };
+                }
+                throw e;
+            }
+            if (updated == null) {
+                return false;
+            }
+            if (updated.token !== token) {
+                const [, newAuth] = updated.token.split(' ');
+                const envelope = makeEnvelopeModel(newAuth, EnvelopeKind.Token);
+                res.responseProvider.header(TOKEN_UPDATE, updated.token);
+                req.headers = { ...req.headers, [AUTH_HEADER]: updated.token };
+                res.resolve(envelope.message());
+            }
+            else {
+                res.resolve(envelope.message());
+            }
+            return true;
+        },
+    });
+    return guard;
+};
+export const appendOidcGuard = (context, opts) => {
+    context.registerService(makeOidcGuard(opts));
+    return context;
+};
+export const setupOidcGuard = (modules, coguards) => {
+    modules.push(...oidcModules);
+    coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD];
+    modules.forEach(module => {
+        if (module.guards != null && !module.guards.includes(OIDC_GUARD)
+            && module.guards.some(guard => coguards.includes(guard))) {
+            module.guards.unshift(OIDC_GUARD);
+        }
+    });
+};
+const wrapper = (context) => context.hasService(WRAPPED_OIDC)
+    ? context.service(WRAPPED_OIDC)
+    : { update: async (token) => token };
+//# sourceMappingURL=guard.js.map

package/build/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1E,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,WAAW,EAAwB,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAa,EAAE;IAClE,2FAA2F;IAC3F,kFAAkF;IAClF,WAAW;IAEX,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,aAAa,CAAC,CAAA;IAEnG,MAAM,KAAK,GAAc,aAAa,CAAY,UAAU,EAAE;QAC5D,cAAc;QAEd,gBAAgB;QAChB,mDAAmD;QACnD,oCAAoC;QACpC,uBAAuB;QACvB,MAAM;QAEN,0DAA0D;QAC1D,6DAA6D;QAC7D,6BAA6B;QAC7B,oDAAoD;QACpD,sBAAsB;QACtB,KAAK;QAEL,aAAa,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE;YACzB,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,qDAAqD;YACrD,yEAAyE;YACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAe,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,CAAA;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,IAAI,KAAK,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC9C,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;QAED,cAAc;QACd,KAAK,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAI;QAErE,MAAM,EAAE,KAAK,EAAK,GAAoB,EAAE,GAA2B,EAAE,EAAE;YACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC/D,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAE5F,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,CAAE,CAAA;YAE/D,IAAI,OAAO,GAAqB,IAAI,CAAA;YAEpC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAA;YACtD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;oBACpC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;oBAC7C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAA;gBACrD,CAAC;gBAED,MAAM,CAAC,CAAA;YACT,CAAC;YAED,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,KAAU,CAAA;YACnB,CAAC;YAED,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAC5C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAErE,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;gBACxD,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;gBAE9D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;YACjC,CAAC;YAED,OAAO,IAAS,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAE5C,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAE,QAA4B,EAAE,EAAE;IACtF,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;IAC5B,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAA;IAE3E,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvB,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;eAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACnC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAsB,EAAE,CACvD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC9B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,KAAK,EAAwB,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,6 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './guard.js';
+export * from './modules.js';
+export * from './models.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/index.js

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './guard.js';
+export * from './modules.js';
+export * from './models.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA"}

package/build/models.d.ts

@@ -0,0 +1,7 @@
+import type { JSONSchemaType } from 'ajv';
+import type { OIDCAuthInitParams, OIDCClientAuthPayload, OIDCTokenUpdate, ProviderProfileDetails } from './types.js';
+export declare const OIDCAuthInitParamsSchema: JSONSchemaType<OIDCAuthInitParams>;
+export declare const OIDCClientAuthPayloadSchema: JSONSchemaType<OIDCClientAuthPayload>;
+export declare const OIDCTokenUpdateSchema: JSONSchemaType<OIDCTokenUpdate>;
+export declare const ProviderProfileDetailsSchema: JSONSchemaType<ProviderProfileDetails>;
+//# sourceMappingURL=models.d.ts.map

package/build/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAGpH,eAAO,MAAM,wBAAwB,EAAE,cAAc,CAAC,kBAAkB,CAQvE,CAAA;AAED,eAAO,MAAM,2BAA2B,EAAE,cAAc,CAAC,qBAAqB,CAQ7E,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAqBjE,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAe/E,CAAA"}

package/build/models.js

@@ -0,0 +1,58 @@
+import { AuthTokenSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema } from '@owlmeans/auth';
+export const OIDCAuthInitParamsSchema = {
+    type: 'object',
+    properties: {
+        entity: { ...EntityValueSchema, nullable: true },
+        profile: { ...IdValueSchema, nullable: true },
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const OIDCClientAuthPayloadSchema = {
+    type: 'object',
+    properties: {
+        code: { type: 'string', minLength: 16, maxLength: 512 },
+        authUrl: { type: 'string', minLength: 0, maxLength: 1024, format: 'uri' },
+    },
+    additionalProperties: { type: 'string', minLength: 0, maxLength: 512 },
+    required: ['code', 'authUrl'],
+};
+export const OIDCTokenUpdateSchema = {
+    type: 'object',
+    properties: {
+        ...AuthTokenSchema.properties,
+        tokenSet: {
+            type: 'object',
+            properties: {
+                access_token: { type: 'string', nullable: true },
+                token_type: { type: 'string', nullable: true },
+                id_token: { type: 'string', nullable: true },
+                refresh_token: { type: 'string', nullable: true },
+                scope: { type: 'string', nullable: true },
+                expires_at: { type: 'number', nullable: true },
+                session_state: { type: 'string', nullable: true }
+            },
+            required: [],
+            additionalProperties: true,
+        }
+    },
+    required: ['token', 'tokenSet'],
+    additionalProperties: false
+};
+export const ProviderProfileDetailsSchema = {
+    type: 'object',
+    properties: {
+        type: { ...TypeNameSchema },
+        service: { ...ScopeValueSchema },
+        clientId: { ...ScopeValueSchema },
+        userId: { ...IdValueSchema },
+        profileId: { ...IdValueSchema, nullable: true },
+        username: { type: 'string', minLength: 1, maxLength: 255, nullable: true },
+        entityId: { ...EntityValueSchema, nullable: true },
+        did: { ...IdValueSchema, nullable: true },
+        isOwlMeansId: { type: 'boolean', nullable: true }
+    },
+    required: ['type', 'service', 'clientId', 'userId'],
+    additionalProperties: false
+};
+//# sourceMappingURL=models.js.map

package/build/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpH,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC1E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,MAAM,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAChD,OAAO,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9C;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAA0C;IAChF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;QACvD,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;KAC1E;IACD,oBAAoB,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAC;IACpE,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;CAC9B,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,eAAe,CAAC,UAAU;QAC7B,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAChD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC9C,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;aAClD;YACD,QAAQ,EAAE,EAAE;YACZ,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;IAC/B,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,cAAc,EAAE;QAC3B,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE;QAChC,QAAQ,EAAE,EAAE,GAAG,gBAAgB,EAAE;QACjC,MAAM,EAAE,EAAE,GAAG,aAAa,EAAE;QAC5B,SAAS,EAAE,EAAC,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1E,QAAQ,EAAE,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,EAAE,GAAG,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAClD;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC;IACnD,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}

package/build/modules.d.ts

@@ -0,0 +1,2 @@
+export declare const modules: import("@owlmeans/module").CommonModule[];
+//# sourceMappingURL=modules.d.ts.map

package/build/modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,OAAO,2CAUnB,CAAA"}

package/build/modules.js

@@ -0,0 +1,9 @@
+import { body, filter, module } from '@owlmeans/module';
+import { route, RouteMethod, backend } from '@owlmeans/route';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js';
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js';
+export const modules = [
+    module(route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)), filter(body(OIDCAuthInitParamsSchema))),
+    module(route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)), filter(body(OIDCClientAuthPayloadSchema)))
+];
+//# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEnF,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,MAAM,CACJ,KAAK,CAAC,oBAAoB,EAAE,yBAAyB,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACvF,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAEvC;IACD,MAAM,CACJ,KAAK,CAAC,eAAe,EAAE,4BAA4B,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,EACrF,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAC1C;CACF,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,88 @@
+import type { AuthToken } from '@owlmeans/auth';
+import type { AuthorizationService } from '@owlmeans/auth-common';
+import type { BasicConfig, BasicContext } from '@owlmeans/context';
+import type { GuardService } from '@owlmeans/module';
+export interface Config extends BasicConfig {
+}
+export interface Context<C extends Config = Config> extends BasicContext<C> {
+}
+export interface OidcSharedConfig {
+    clientCookie?: {
+        interaction?: {
+            name?: string;
+            ttl?: number;
+        };
+    };
+    providers?: OidcProviderConfig[];
+    /**
+     * false - in case the service user can't use identity provider for authentication (restricted for internal use only)
+     * true - in case only default identity provider can be used
+     * string[] - list of allowed identity providers
+     */
+    restrictedProviders?: boolean | string[];
+}
+export interface OidcProviderConfig extends OidcProviderDescriptor {
+    internal?: boolean;
+    apiClientId?: string;
+}
+export interface OidcProviderDescriptor {
+    entityId?: string;
+    service?: string;
+    discoveryUrl?: string;
+    basePath?: string;
+    clientId: string;
+    secret?: string;
+    extraScopes?: string;
+    idOverride?: string;
+    def?: boolean;
+}
+export interface WithSharedConfig {
+    oidc: OidcSharedConfig;
+}
+export interface OidcGuard extends GuardService {
+}
+export interface OidcGuardOptions {
+    cache?: string;
+    coguards: string | string[];
+    tokenService?: string;
+}
+export interface OIDCAuthInitParams {
+    entity?: string;
+    profile?: string;
+}
+export interface OIDCClientAuthPayload extends Record<string, string> {
+    code: string;
+    authUrl: string;
+}
+export interface WrappedOIDCService extends AuthorizationService {
+}
+export interface OIDCTokenUpdate extends AuthToken {
+    tokenSet: CommonTokenSetParams;
+}
+export interface CommonTokenSetParams extends Record<string, string | number | undefined> {
+    access_token?: string;
+    token_type?: string;
+    id_token?: string;
+    refresh_token?: string;
+    scope?: string;
+    expires_at?: number;
+    session_state?: string;
+}
+export interface ProviderProfileDetails extends Partial<OidcUserDetails> {
+    type: string;
+    service: string;
+    clientId: string;
+    userId: string;
+    profileId?: string;
+}
+export interface OidcUserDetails {
+    userId: string;
+    username: string;
+    entityId?: string;
+    did?: string;
+    isOwlMeansId?: boolean;
+}
+export interface OidcProviderSettings {
+    registrationEnabled: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,MAAO,SAAQ,WAAW;CAAI;AAC/C,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CAAI;AAE/E,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE;QACb,WAAW,CAAC,EAAE;YACZ,IAAI,CAAC,EAAE,MAAM,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,CAAA;SACb,CAAA;KACF,CAAC;IACF,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,kBAAmB,SAAQ,sBAAsB;IAEhE,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,GAAG,CAAC,EAAE,OAAO,CAAA;CACd;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAGD,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;CAC/D;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,QAAQ,EAAE,oBAAoB,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAqB,SAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAGD,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CAAC,eAAe,CAAC;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IASZ,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mBAAmB,EAAE,OAAO,CAAA;CAC7B"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@owlmeans/oidc",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 222 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.0",
+    "@owlmeans/auth-common": "^0.1.0",
+    "@owlmeans/basic-envelope": "^0.1.0",
+    "@owlmeans/config": "^0.1.0",
+    "@owlmeans/context": "^0.1.0",
+    "@owlmeans/module": "^0.1.0",
+    "@owlmeans/resource": "^0.1.0",
+    "@owlmeans/route": "^0.1.0"
+  },
+  "peerDependencies": {
+    "ajv": "*"
+  },
+  "devDependencies": {
+    "nodemon": "^3.1.7",
+    "npm-check": "^6.0.1",
+    "typescript": "^5.6.3"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/consts.ts

@@ -0,0 +1,32 @@
+
+export const DEFAULT_PATH = 'oidc'
+
+export const DEFAULT_FRONT = 'oidc-client'
+
+export const INTERACTION_PATH = '/interaction/:uid'
+
+export const INTERACTION = 'oidc:interaction'
+
+export const OIDC_FLOW = 'oidc'
+
+export const OIDC_AUTHEN_MODULE = 'iam-oidc-authen'
+
+export const PROVIDER_INTERACTION = 'oidc-server:interaction'
+
+export const OIDC_CLIENT_AUTH = 'oidc-client'
+
+export const OIDC_GUARD = 'guard:oidc'
+
+export const OIDC_GUARD_CACHE = 'resource:oidc-guard:cache'
+
+export const DISPATCHER_OIDC_INIT = 'dispatcher:oidc:init'
+
+export const DISPATCHER_OIDC = 'dispatcher:oidc:authenticate'
+
+export const OIDC_CODE_QUERY = 'code'
+
+export const OIDC_WRAPPED_TOKEN = 'oidc-wrapped-token'
+
+export const WRAPPED_OIDC = 'wrapped-oidc-authz'
+
+export const OIDC_GATE = 'oidc-gate'

package/src/guard.ts

@@ -0,0 +1,130 @@
+import { createService } from '@owlmeans/context'
+import type { Config, Context, OidcGuard, OidcGuardOptions, WrappedOIDCService } from './types.js'
+import { OIDC_GUARD, OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from './consts.js'
+import type { AbstractRequest, AbstractResponse, CommonModule, GuardService } from '@owlmeans/module'
+import { DEFAULT_GUARD, TOKEN_UPDATE } from '@owlmeans/auth-common'
+import { AUTH_HEADER, type Auth, AuthToken, AuthorizationError } from '@owlmeans/auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { trust } from '@owlmeans/auth-common/utils'
+import { TRUSTED } from '@owlmeans/config'
+import { extractAuthToken } from '@owlmeans/auth-common/utils'
+import { modules as oidcModules } from './modules.js'
+
+export const makeOidcGuard = (opts?: OidcGuardOptions): OidcGuard => {
+  // const cache = (context: Context) => context.hasResource(opts?.cache ?? OIDC_GUARD_CACHE)
+  //   ? context.resource<Resource<ResourceRecord>>(opts?.cache ?? OIDC_GUARD_CACHE)
+  //   : null
+
+  const [cogurad] = Array.isArray(opts?.coguards) ? opts.coguards : [opts?.coguards ?? DEFAULT_GUARD]
+
+  const guard: OidcGuard = createService<OidcGuard>(OIDC_GUARD, {
+    // Client side
+
+    // get token() {
+    //   const ctx = guard.assertCtx<Config, Context>()
+    //   if (!ctx.hasService(cogurad)) {
+    //     return undefined
+    //   }
+
+    //   // @TODO Make some custom implementation if required.
+    //   // Cause it won't work on the back. And it's likely that
+    //   // we will need it soon.
+    //   const auth = ctx.service<GuardService>(cogurad)
+    //   return auth.token
+    // },
+
+    authenticated: async req => {
+      const ctx = guard.assertCtx()
+      // @TODO Make some custom implementation if required.
+      // We try to rely on some centeral auth service that operates all tokens.
+      const auth = ctx.service<GuardService>(opts?.tokenService ?? cogurad)
+      const token = await auth.authenticated(req)
+      if (token != null) {
+        const [type] = token.split(' ')
+        if (type === OIDC_WRAPPED_TOKEN.toUpperCase()) {
+          return token
+        }
+      }
+
+      return null
+    },
+
+    // Server side
+    match: async req => extractAuthToken(req, OIDC_WRAPPED_TOKEN) != null,
+
+    handle: async <T>(req: AbstractRequest, res: AbstractResponse<Auth>) => {
+      const authorization = extractAuthToken(req, OIDC_WRAPPED_TOKEN)
+      if (authorization == null) {
+        return false as T
+      }
+
+      const ctx = guard.assertCtx()
+      const envelope = makeEnvelopeModel<Auth>(authorization, EnvelopeKind.Token)
+      const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
+
+      if (!await envelope.verify(trusted.key)) {
+        return false as T
+      }
+
+      const token = extractAuthToken(req, OIDC_WRAPPED_TOKEN, false)!
+
+      let updated: AuthToken | null = null
+
+      try {
+        updated = await wrapper(ctx).update({ token }, true)
+      } catch (e) {
+        if (e instanceof AuthorizationError) {
+          res.responseProvider.header(TOKEN_UPDATE, '')
+          req.headers = { ...req.headers, [AUTH_HEADER]: '' }
+        }
+
+        throw e
+      }
+
+      if (updated == null) {
+        return false as T
+      }
+
+      if (updated.token !== token) {
+        const [, newAuth] = updated.token.split(' ')
+        const envelope = makeEnvelopeModel<Auth>(newAuth, EnvelopeKind.Token)
+
+        res.responseProvider.header(TOKEN_UPDATE, updated.token)
+        req.headers = { ...req.headers, [AUTH_HEADER]: updated.token }
+
+        res.resolve(envelope.message())
+      } else {
+        res.resolve(envelope.message())
+      }
+
+      return true as T
+    },
+  })
+
+  return guard
+}
+
+export const appendOidcGuard = <C extends Config, T extends Context<C>>(
+  context: T, opts?: OidcGuardOptions
+) => {
+  context.registerService(makeOidcGuard(opts))
+
+  return context
+}
+
+export const setupOidcGuard = (modules: CommonModule[], coguards?: string | string[]) => {
+  modules.push(...oidcModules)
+  coguards = Array.isArray(coguards) ? coguards : [coguards ?? DEFAULT_GUARD]
+
+  modules.forEach(module => {
+    if (module.guards != null && !module.guards.includes(OIDC_GUARD)
+      && module.guards.some(guard => coguards.includes(guard))) {
+      module.guards.unshift(OIDC_GUARD)
+    }
+  })
+}
+
+const wrapper = (context: Context): WrappedOIDCService =>
+  context.hasService(WRAPPED_OIDC)
+    ? context.service(WRAPPED_OIDC)
+    : { update: async token => token } as WrappedOIDCService

package/src/index.ts

@@ -0,0 +1,5 @@
+export type * from './types.js'
+export * from './consts.js'
+export * from './guard.js'
+export * from './modules.js'
+export * from './models.js'

package/src/models.ts

@@ -0,0 +1,63 @@
+import type { JSONSchemaType } from 'ajv'
+import type { OIDCAuthInitParams, OIDCClientAuthPayload, OIDCTokenUpdate, ProviderProfileDetails } from './types.js'
+import { AuthTokenSchema, EntityValueSchema, IdValueSchema, ScopeValueSchema, TypeNameSchema } from '@owlmeans/auth'
+
+export const OIDCAuthInitParamsSchema: JSONSchemaType<OIDCAuthInitParams> = {
+  type: 'object',
+  properties: {
+    entity: { ...EntityValueSchema, nullable: true },
+    profile: { ...IdValueSchema, nullable: true },
+  },
+  required: [],
+  additionalProperties: false,
+}
+
+export const OIDCClientAuthPayloadSchema: JSONSchemaType<OIDCClientAuthPayload> = {
+  type: 'object',
+  properties: {
+    code: { type: 'string', minLength: 16, maxLength: 512 },
+    authUrl: { type: 'string', minLength: 0, maxLength: 1024, format: 'uri' },
+  },
+  additionalProperties: {type: 'string', minLength: 0, maxLength: 512},
+  required: ['code', 'authUrl'],
+}
+
+export const OIDCTokenUpdateSchema: JSONSchemaType<OIDCTokenUpdate> = {
+  type: 'object',
+  properties: {
+    ...AuthTokenSchema.properties,
+    tokenSet: {
+      type: 'object',
+      properties: {
+        access_token: { type: 'string', nullable: true },
+        token_type: { type: 'string', nullable: true },
+        id_token: { type: 'string', nullable: true },
+        refresh_token: { type: 'string', nullable: true },
+        scope: { type: 'string', nullable: true },
+        expires_at: { type: 'number', nullable: true },
+        session_state: { type: 'string', nullable: true }
+      },
+      required: [],
+      additionalProperties: true,
+    }
+  },
+  required: ['token', 'tokenSet'],
+  additionalProperties: false
+}
+
+export const ProviderProfileDetailsSchema: JSONSchemaType<ProviderProfileDetails> = {
+  type: 'object',
+  properties: {
+    type: { ...TypeNameSchema },
+    service: { ...ScopeValueSchema },
+    clientId: { ...ScopeValueSchema },
+    userId: { ...IdValueSchema },
+    profileId: {...IdValueSchema, nullable: true },
+    username: { type: 'string', minLength: 1, maxLength: 255, nullable: true },
+    entityId: { ...EntityValueSchema, nullable: true },
+    did: { ...IdValueSchema, nullable: true },
+    isOwlMeansId: { type: 'boolean', nullable: true }
+  },
+  required: ['type', 'service', 'clientId', 'userId'],
+  additionalProperties: false
+}

package/src/modules.ts

@@ -0,0 +1,16 @@
+import { body, filter, module } from '@owlmeans/module'
+import { route, RouteMethod, backend } from '@owlmeans/route'
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from './consts.js'
+import { OIDCAuthInitParamsSchema, OIDCClientAuthPayloadSchema } from './models.js'
+
+export const modules = [
+  module(
+    route(DISPATCHER_OIDC_INIT, '/authenticate/oidc/init', backend(null, RouteMethod.POST)),
+    filter(body(OIDCAuthInitParamsSchema))
+    
+  ),
+  module(
+    route(DISPATCHER_OIDC, '/authenticate/oidc/process', backend(null, RouteMethod.POST)),
+    filter(body(OIDCClientAuthPayloadSchema))
+  )
+]