@owlmeans/server-oidc-rp 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/actions/init.d.ts.map +1 -1
- package/build/actions/init.js +31 -21
- package/build/actions/init.js.map +1 -1
- package/build/auth/plugins/oidc-client.d.ts.map +1 -1
- package/build/gate.d.ts.map +1 -1
- package/build/guard.d.ts.map +1 -1
- package/build/model/gate.d.ts.map +1 -1
- package/build/modules.d.ts.map +1 -1
- package/build/service.d.ts.map +1 -1
- package/build/utils/auth.d.ts.map +1 -1
- package/build/utils/cache.d.ts.map +1 -1
- package/build/utils/wrapped.d.ts.map +1 -1
- package/build/wrapper.d.ts.map +1 -1
- package/build/wrapper.js +55 -26
- package/build/wrapper.js.map +1 -1
- package/package.json +20 -21
- package/src/actions/init.ts +40 -29
- package/src/wrapper.ts +63 -31
- package/tsconfig.tsbuildinfo +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAiBjE,eAAO,MAAM,IAAI,EAAE,
|
|
1
|
+
{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAiBjE,eAAO,MAAM,IAAI,EAAE,kBAmFjB,CAAA"}
|
package/build/actions/init.js
CHANGED
|
@@ -6,7 +6,7 @@ import { authService, DEFAULT_ALIAS } from '../consts.js';
|
|
|
6
6
|
// import type { Client } from 'openid-client'
|
|
7
7
|
import { base64urlnopad as base64 } from '@scure/base';
|
|
8
8
|
import { randomBytes } from '@noble/hashes/utils';
|
|
9
|
-
import { sha256 } from '@noble/hashes/
|
|
9
|
+
import { sha256 } from '@noble/hashes/sha2';
|
|
10
10
|
import { cache, verifierId } from '../utils/cache.js';
|
|
11
11
|
import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth';
|
|
12
12
|
export const init = handleBody(async (body, ctx) => {
|
|
@@ -16,28 +16,38 @@ export const init = handleBody(async (body, ctx) => {
|
|
|
16
16
|
const entityId = body.entity;
|
|
17
17
|
const context = assertContext(ctx);
|
|
18
18
|
const oidc = context.service(DEFAULT_ALIAS);
|
|
19
|
-
let client;
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
* And make oidc service itself use such a resource to get required client.
|
|
24
|
-
*/
|
|
25
|
-
const [providers] = await context.module(authService.provider.list).call({
|
|
26
|
-
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
27
|
-
query: { entityId }
|
|
28
|
-
});
|
|
29
|
-
if (providers.length < 1) {
|
|
30
|
-
throw new AuthUnknown();
|
|
19
|
+
let client = null;
|
|
20
|
+
const defaultClientId = oidc.getDefault();
|
|
21
|
+
if (defaultClientId != null) {
|
|
22
|
+
client = await oidc.getClient(defaultClientId);
|
|
31
23
|
}
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
24
|
+
if (client == null) {
|
|
25
|
+
// if (!oidc.hasProvider({ entityId })) {
|
|
26
|
+
/**
|
|
27
|
+
* @TODO We need to move it to some remote resource.
|
|
28
|
+
* And make oidc service itself use such a resource to get required client.
|
|
29
|
+
*/
|
|
30
|
+
const [providers] = await context.module(authService.provider.list).call({
|
|
31
|
+
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
32
|
+
query: { entityId }
|
|
33
|
+
});
|
|
34
|
+
if (providers.length < 1) {
|
|
35
|
+
throw new AuthUnknown();
|
|
36
|
+
}
|
|
37
|
+
console.log("\n\n ************* \n Providers we get from remote:", providers);
|
|
38
|
+
const provider = providers.find(p => p.def === true) ?? providers.shift();
|
|
39
|
+
// Loaded providers can't be default otherwise we will get stuck with one of them
|
|
40
|
+
if (provider != null && "def" in provider) {
|
|
41
|
+
delete provider.def;
|
|
42
|
+
}
|
|
43
|
+
console.log("\n\nProvider we choose:", provider);
|
|
44
|
+
console.log("************* \n\n");
|
|
45
|
+
if (provider == null) {
|
|
46
|
+
throw new AuthUnknown();
|
|
47
|
+
}
|
|
48
|
+
oidc.registerTemporaryProvider(provider);
|
|
49
|
+
client = await oidc.getClient({ clientId: provider.clientId, entityId });
|
|
38
50
|
}
|
|
39
|
-
oidc.registerTemporaryProvider(provider);
|
|
40
|
-
client = await oidc.getClient({ clientId: provider.clientId, entityId });
|
|
41
51
|
// Cache provider for a while - we dont actually need to clean it up
|
|
42
52
|
// setTimeout(() => provider && oidc.unregisterTemporaryProvider(provider), PROVIDER_CACHE_TTL)
|
|
43
53
|
// } else {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAAuB,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IACzF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAE3C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CACtC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,QAAQ;KACT,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAuB,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAErF,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;QACvD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,gBAAgB,CAAA;AAgBxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/oidc-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,gBAAgB,CAAA;AAgBxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,UAqLrF,CAAA"}
|
package/build/gate.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAMnD,eAAO,MAAM,YAAY,
|
|
1
|
+
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAMnD,eAAO,MAAM,YAAY,GAAI,QAAO,MAAkB,KAAG,WAqBxD,CAAA"}
|
package/build/guard.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AASpD,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AASpD,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EACpE,SAAS,CAAC,EAAE,OAAO,gBAAgB,MAKpC,CAAA;AAED,eAAO,MAAM,cAAc,GAAI,SAAS,YAAY,EAAE,EAAE,WAAW,MAAM,GAAG,MAAM,EAAE,SAKnF,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAA;AAErE,OAAO,KAAK,EAAE,SAAS,EAAyC,MAAM,YAAY,CAAA;AAKlF,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/model/gate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAA;AAErE,OAAO,KAAK,EAAE,SAAS,EAAyC,MAAM,YAAY,CAAA;AAKlF,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAG,SAuHhF,CAAA"}
|
package/build/modules.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQpD,eAAO,MAAM,uBAAuB,
|
|
1
|
+
{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQpD,eAAO,MAAM,uBAAuB,GAClC,SAAS,YAAY,EAAE,EACvB,cAAc,MAAM,EACpB,SAAQ,MAAmB,SAkB5B,CAAA"}
|
package/build/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA0C,iBAAiB,EAAyC,MAAM,YAAY,CAAA;AAQlI,eAAO,MAAM,qBAAqB,
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA0C,iBAAiB,EAAyC,MAAM,YAAY,CAAA;AAQlI,eAAO,MAAM,qBAAqB,GAAI,QAAO,MAAsB,KAAG,iBAuOrE,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AASxD,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/utils/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAqB,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AASxD,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,MAChF,YAAY,eAAe,KAAG,OAAO,CAAC,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAqDlF,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/utils/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAG,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAInD,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/utils/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAG,MAAM,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAInD,eAAO,MAAM,KAAK,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,KAAG,QAAQ,CAAC,aAAa,CAC1C,CAAA;AAEvD,eAAO,MAAM,UAAU,GAAI,WAAW,MAAM,WAAgD,CAAA;AAC5F,eAAO,MAAM,UAAU,GAAI,UAAU,MAAM,WAA+C,CAAA;AAC1F,eAAO,MAAM,SAAS,GAAI,OAAO,MAAM,WAAyC,CAAA"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wrapped.d.ts","sourceRoot":"","sources":["../../src/utils/wrapped.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAE1C,eAAO,MAAM,OAAO,
|
|
1
|
+
{"version":3,"file":"wrapped.d.ts","sourceRoot":"","sources":["../../src/utils/wrapped.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAE1C,eAAO,MAAM,OAAO,GAAI,SAAS,OAAO,KAAG,kBACZ,CAAA"}
|
package/build/wrapper.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"wrapper.d.ts","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAyC,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAW/F,eAAO,MAAM,uBAAuB,QAAO,kBA4G1C,CAAA"}
|
package/build/wrapper.js
CHANGED
|
@@ -3,7 +3,7 @@ import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
|
|
|
3
3
|
import { createService } from '@owlmeans/context';
|
|
4
4
|
import { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from '@owlmeans/oidc';
|
|
5
5
|
import { cache, managedId } from './utils/cache.js';
|
|
6
|
-
import { authService, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js';
|
|
6
|
+
import { authService, DEFAULT_ALIAS, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js';
|
|
7
7
|
import days from 'dayjs';
|
|
8
8
|
import { TRUSTED } from '@owlmeans/config';
|
|
9
9
|
import { AUTH_SRV_KEY } from '@owlmeans/server-auth';
|
|
@@ -29,33 +29,62 @@ export const makeOidcWrappingService = () => {
|
|
|
29
29
|
return { token };
|
|
30
30
|
}
|
|
31
31
|
record.validated = new Date();
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
32
|
+
if (ctx.hasModule(authService.auth.update)) {
|
|
33
|
+
const [update] = await ctx.module(authService.auth.update)
|
|
34
|
+
.call({ body: { token, tokenSet: record.payload } });
|
|
35
|
+
const updateEnvelope = makeEnvelopeModel(update.token, EnvelopeKind.Token);
|
|
36
|
+
const authManager = await trust(ctx, TRUSTED, AUTH_SRV_KEY);
|
|
37
|
+
if (!await updateEnvelope.verify(authManager.key)) {
|
|
38
|
+
throw new AuthenFailed();
|
|
39
|
+
}
|
|
40
|
+
const updatedAuth = updateEnvelope.message();
|
|
41
|
+
const updatedUser = {
|
|
42
|
+
...user,
|
|
43
|
+
role: updatedAuth.role ?? AuthRole.Guest,
|
|
44
|
+
userId: updatedAuth.userId ?? user.userId,
|
|
45
|
+
profileId: updatedAuth.profileId,
|
|
46
|
+
entityId: updatedAuth.entityId ?? user.entityId,
|
|
47
|
+
createdAt: new Date()
|
|
48
|
+
};
|
|
49
|
+
if (updatedAuth.challenge !== user.token) {
|
|
50
|
+
await cache(ctx).delete(record);
|
|
51
|
+
updatedUser.token = updatedAuth.challenge;
|
|
52
|
+
record.id = managedId(updatedUser.token);
|
|
53
|
+
}
|
|
54
|
+
const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
|
|
55
|
+
const authorization = await makeEnvelopeModel(OIDC_WRAPPED_TOKEN)
|
|
56
|
+
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token);
|
|
57
|
+
record.payload = update.tokenSet;
|
|
58
|
+
await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 });
|
|
59
|
+
return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` };
|
|
38
60
|
}
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
61
|
+
else if (record.payload != null) {
|
|
62
|
+
const oidc = ctx.service(DEFAULT_ALIAS);
|
|
63
|
+
const defaultClientId = oidc.getDefault();
|
|
64
|
+
if (defaultClientId != null) {
|
|
65
|
+
let tokenSet = record.payload;
|
|
66
|
+
const client = await oidc.getClient(defaultClientId);
|
|
67
|
+
if (days.unix(tokenSet.expires_at ?? 0).isBefore()) {
|
|
68
|
+
tokenSet = await client.refresh(tokenSet);
|
|
69
|
+
}
|
|
70
|
+
else {
|
|
71
|
+
const result = await client.introspect(tokenSet, 'access_token');
|
|
72
|
+
if (!result.active) {
|
|
73
|
+
throw new AuthorizationError('access-token');
|
|
74
|
+
}
|
|
75
|
+
}
|
|
76
|
+
const updatedUser = {
|
|
77
|
+
...user,
|
|
78
|
+
createdAt: new Date()
|
|
79
|
+
};
|
|
80
|
+
const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
|
|
81
|
+
const authorization = await makeEnvelopeModel(OIDC_WRAPPED_TOKEN)
|
|
82
|
+
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token);
|
|
83
|
+
record.payload = tokenSet;
|
|
84
|
+
await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 });
|
|
85
|
+
return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` };
|
|
86
|
+
}
|
|
52
87
|
}
|
|
53
|
-
const trusted = await trust(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service);
|
|
54
|
-
const authorization = await makeEnvelopeModel(OIDC_WRAPPED_TOKEN)
|
|
55
|
-
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token);
|
|
56
|
-
record.payload = update.tokenSet;
|
|
57
|
-
await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 });
|
|
58
|
-
return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` };
|
|
59
88
|
}
|
|
60
89
|
catch (err) {
|
|
61
90
|
console.error(err);
|
package/build/wrapper.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;
|
|
1
|
+
{"version":3,"file":"wrapper.js","sourceRoot":"","sources":["../src/wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAClG,OAAO,IAAI,MAAM,OAAO,CAAA;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAEnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAuB,EAAE;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAqB,YAAY,EAAE;QAC9D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAChD,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAA;YACxD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACvC,CAAC;YACD,MAAM,CAAC,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,QAAQ,GAAG,iBAAiB,CAAO,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YAE/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1D,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAC7C,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;gBACxC,CAAC;gBAED,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnD,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,CAAA;gBAClB,CAAC;gBAED,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;gBAE7B,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAgC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;yBACtF,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;oBAEtD,MAAM,cAAc,GAAG,iBAAiB,CAAkB,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAC3F,MAAM,WAAW,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;oBAC5E,IAAI,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,YAAY,EAAE,CAAA;oBAC1B,CAAC;oBAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,EAAE,CAAA;oBAE5C,MAAM,WAAW,GAAS;wBACxB,GAAG,IAAI;wBACP,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK;wBACxC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;wBACzC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,QAAQ,EAAE,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB,CAAA;oBAED,IAAI,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;wBACzC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;wBAC/B,WAAW,CAAC,KAAK,GAAG,WAAW,CAAC,SAAS,CAAA;wBACzC,MAAM,CAAC,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;oBAGD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;oBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;yBACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBAEhE,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,QAA8B,CAAA;oBAEtD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;oBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;gBAC1E,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;oBAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;oBAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;oBACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;wBAC5B,IAAI,QAAQ,GAAyB,MAAM,CAAC,OAA+B,CAAA;wBAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;wBACpD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;4BACnD,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAA8B,CAAyB,CAAA;wBACzF,CAAC;6BAAM,CAAC;4BACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAA8B,EAAE,cAAc,CAAC,CAAA;4BACtF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gCACnB,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAA;4BAC9C,CAAC;wBACH,CAAC;wBAED,MAAM,WAAW,GAAS;4BACxB,GAAG,IAAI;4BACP,SAAS,EAAE,IAAI,IAAI,EAAE;yBACtB,CAAA;wBAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;wBAC5F,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;6BACpE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;wBAEhE,MAAM,CAAC,OAAO,GAAG,QAA8B,CAAA;wBAE/C,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CAAC,CAAA;wBAElE,OAAO,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;oBAC1E,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBAClB,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;wBACtC,MAAM,GAAG,CAAA;oBACX,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@owlmeans/server-oidc-rp",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.1",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"scripts": {
|
|
6
6
|
"build": "tsc -b",
|
|
@@ -34,28 +34,28 @@
|
|
|
34
34
|
}
|
|
35
35
|
},
|
|
36
36
|
"devDependencies": {
|
|
37
|
-
"@types/node": "^
|
|
38
|
-
"nodemon": "^3.1.
|
|
37
|
+
"@types/node": "^24.10.1",
|
|
38
|
+
"nodemon": "^3.1.11",
|
|
39
39
|
"npm-check": "^6.0.1",
|
|
40
|
-
"typescript": "^5.
|
|
40
|
+
"typescript": "^5.8.3"
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
43
|
"@noble/hashes": "^1.5.0",
|
|
44
|
-
"@owlmeans/auth": "^0.1.
|
|
45
|
-
"@owlmeans/auth-common": "^0.1.
|
|
46
|
-
"@owlmeans/basic-envelope": "^0.1.
|
|
47
|
-
"@owlmeans/client-module": "^0.1.
|
|
48
|
-
"@owlmeans/config": "^0.1.
|
|
49
|
-
"@owlmeans/context": "^0.1.
|
|
50
|
-
"@owlmeans/did": "^0.1.
|
|
51
|
-
"@owlmeans/module": "^0.1.
|
|
52
|
-
"@owlmeans/oidc": "^0.1.
|
|
53
|
-
"@owlmeans/resource": "^0.1.
|
|
54
|
-
"@owlmeans/route": "^0.1.
|
|
55
|
-
"@owlmeans/server-api": "^0.1.
|
|
56
|
-
"@owlmeans/server-auth": "^0.1.
|
|
57
|
-
"@owlmeans/server-context": "^0.1.
|
|
58
|
-
"@owlmeans/server-module": "^0.1.
|
|
44
|
+
"@owlmeans/auth": "^0.1.1",
|
|
45
|
+
"@owlmeans/auth-common": "^0.1.1",
|
|
46
|
+
"@owlmeans/basic-envelope": "^0.1.1",
|
|
47
|
+
"@owlmeans/client-module": "^0.1.1",
|
|
48
|
+
"@owlmeans/config": "^0.1.1",
|
|
49
|
+
"@owlmeans/context": "^0.1.1",
|
|
50
|
+
"@owlmeans/did": "^0.1.1",
|
|
51
|
+
"@owlmeans/module": "^0.1.1",
|
|
52
|
+
"@owlmeans/oidc": "^0.1.1",
|
|
53
|
+
"@owlmeans/resource": "^0.1.1",
|
|
54
|
+
"@owlmeans/route": "^0.1.1",
|
|
55
|
+
"@owlmeans/server-api": "^0.1.1",
|
|
56
|
+
"@owlmeans/server-auth": "^0.1.1",
|
|
57
|
+
"@owlmeans/server-context": "^0.1.1",
|
|
58
|
+
"@owlmeans/server-module": "^0.1.1",
|
|
59
59
|
"@scure/base": "^1.1.9",
|
|
60
60
|
"dayjs": "^1.11.13",
|
|
61
61
|
"jose": "^5.9.6",
|
|
@@ -64,8 +64,7 @@
|
|
|
64
64
|
"peerDependencies": {
|
|
65
65
|
"ajv": "*"
|
|
66
66
|
},
|
|
67
|
-
"private": false,
|
|
68
67
|
"publishConfig": {
|
|
69
68
|
"access": "public"
|
|
70
69
|
}
|
|
71
|
-
}
|
|
70
|
+
}
|
package/src/actions/init.ts
CHANGED
|
@@ -11,7 +11,7 @@ import { authService, DEFAULT_ALIAS } from '../consts.js'
|
|
|
11
11
|
|
|
12
12
|
import { base64urlnopad as base64 } from '@scure/base'
|
|
13
13
|
import { randomBytes } from '@noble/hashes/utils'
|
|
14
|
-
import { sha256 } from '@noble/hashes/
|
|
14
|
+
import { sha256 } from '@noble/hashes/sha2'
|
|
15
15
|
import { cache, verifierId } from '../utils/cache.js'
|
|
16
16
|
import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
|
|
17
17
|
|
|
@@ -25,35 +25,46 @@ export const init: RefedModuleHandler = handleBody(async (body: OIDCAuthInitPara
|
|
|
25
25
|
const context = assertContext<Config, Context>(ctx)
|
|
26
26
|
const oidc = context.service<OidcClientService>(DEFAULT_ALIAS)
|
|
27
27
|
|
|
28
|
-
let client: OidcClientAdapter
|
|
29
|
-
// if (!oidc.hasProvider({ entityId })) {
|
|
30
|
-
/**
|
|
31
|
-
* @TODO We need to move it to some remote resource.
|
|
32
|
-
* And make oidc service itself use such a resource to get required client.
|
|
33
|
-
*/
|
|
34
|
-
const [providers] = await context.module<ClientModule<OidcProviderDescriptor[]>>(
|
|
35
|
-
authService.provider.list
|
|
36
|
-
).call({
|
|
37
|
-
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
38
|
-
query: { entityId }
|
|
39
|
-
})
|
|
28
|
+
let client: OidcClientAdapter | null = null
|
|
40
29
|
|
|
41
|
-
|
|
42
|
-
|
|
30
|
+
const defaultClientId = oidc.getDefault()
|
|
31
|
+
if (defaultClientId != null) {
|
|
32
|
+
client = await oidc.getClient(defaultClientId)
|
|
43
33
|
}
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
34
|
+
if (client == null) {
|
|
35
|
+
// if (!oidc.hasProvider({ entityId })) {
|
|
36
|
+
/**
|
|
37
|
+
* @TODO We need to move it to some remote resource.
|
|
38
|
+
* And make oidc service itself use such a resource to get required client.
|
|
39
|
+
*/
|
|
40
|
+
const [providers] = await context.module<ClientModule<OidcProviderDescriptor[]>>(
|
|
41
|
+
authService.provider.list
|
|
42
|
+
).call({
|
|
43
|
+
params: { service: context.cfg.alias ?? context.cfg.service },
|
|
44
|
+
query: { entityId }
|
|
45
|
+
})
|
|
46
|
+
|
|
47
|
+
if (providers.length < 1) {
|
|
48
|
+
throw new AuthUnknown()
|
|
49
|
+
}
|
|
50
|
+
|
|
51
|
+
console.log("\n\n ************* \n Providers we get from remote:", providers)
|
|
52
|
+
|
|
53
|
+
const provider = providers.find(p => p.def === true) ?? providers.shift()
|
|
54
|
+
// Loaded providers can't be default otherwise we will get stuck with one of them
|
|
55
|
+
if (provider != null && "def" in provider) {
|
|
56
|
+
delete provider.def
|
|
57
|
+
}
|
|
58
|
+
|
|
59
|
+
console.log("\n\nProvider we choose:", provider)
|
|
60
|
+
console.log("************* \n\n")
|
|
61
|
+
|
|
62
|
+
if (provider == null) {
|
|
63
|
+
throw new AuthUnknown()
|
|
64
|
+
}
|
|
65
|
+
oidc.registerTemporaryProvider(provider)
|
|
66
|
+
client = await oidc.getClient({ clientId: provider.clientId, entityId })
|
|
54
67
|
}
|
|
55
|
-
oidc.registerTemporaryProvider(provider)
|
|
56
|
-
client = await oidc.getClient({ clientId: provider.clientId, entityId })
|
|
57
68
|
// Cache provider for a while - we dont actually need to clean it up
|
|
58
69
|
// setTimeout(() => provider && oidc.unregisterTemporaryProvider(provider), PROVIDER_CACHE_TTL)
|
|
59
70
|
// } else {
|
|
@@ -68,8 +79,8 @@ export const init: RefedModuleHandler = handleBody(async (body: OIDCAuthInitPara
|
|
|
68
79
|
console.log("\n\n We create verifierID: ", verifierId(challenge), verifier, " with client: ", client.getClientId(), "\n\n")
|
|
69
80
|
|
|
70
81
|
await cache(context).create({
|
|
71
|
-
id: verifierId(challenge),
|
|
72
|
-
verifier,
|
|
82
|
+
id: verifierId(challenge),
|
|
83
|
+
verifier,
|
|
73
84
|
client: client.getClientId(),
|
|
74
85
|
entityId,
|
|
75
86
|
}, { ttl: AUTHEN_TIMEFRAME / 1000 })
|
package/src/wrapper.ts
CHANGED
|
@@ -2,11 +2,11 @@ import { AuthenFailed, AuthorizationError, AuthRole } from '@owlmeans/auth'
|
|
|
2
2
|
import type { Auth, AuthCredentials } from '@owlmeans/auth'
|
|
3
3
|
import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
|
|
4
4
|
import { createService } from '@owlmeans/context'
|
|
5
|
-
import type { OIDCTokenUpdate, WrappedOIDCService } from '@owlmeans/oidc'
|
|
5
|
+
import type { CommonTokenSetParams, OIDCTokenUpdate, WrappedOIDCService } from '@owlmeans/oidc'
|
|
6
6
|
import { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from '@owlmeans/oidc'
|
|
7
7
|
import { cache, managedId } from './utils/cache.js'
|
|
8
|
-
import type { Config, Context, TokenSetParameters } from './types.js'
|
|
9
|
-
import { authService, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js'
|
|
8
|
+
import type { Config, Context, OidcClientService, TokenSetParameters } from './types.js'
|
|
9
|
+
import { authService, DEFAULT_ALIAS, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js'
|
|
10
10
|
import days from 'dayjs'
|
|
11
11
|
import type { ClientModule } from '@owlmeans/client-module'
|
|
12
12
|
import { TRUSTED } from '@owlmeans/config'
|
|
@@ -21,7 +21,7 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
|
|
|
21
21
|
if (token == null) {
|
|
22
22
|
throw new AuthorizationError('token')
|
|
23
23
|
}
|
|
24
|
-
const [
|
|
24
|
+
const [, authentication] = token.split(' ')
|
|
25
25
|
const envelope = makeEnvelopeModel<Auth>(authentication, EnvelopeKind.Token)
|
|
26
26
|
const user = envelope.message()
|
|
27
27
|
|
|
@@ -38,42 +38,74 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
|
|
|
38
38
|
|
|
39
39
|
record.validated = new Date()
|
|
40
40
|
|
|
41
|
-
|
|
42
|
-
|
|
41
|
+
if (ctx.hasModule(authService.auth.update)) {
|
|
42
|
+
const [update] = await ctx.module<ClientModule<OIDCTokenUpdate>>(authService.auth.update)
|
|
43
|
+
.call({ body: { token, tokenSet: record.payload } })
|
|
43
44
|
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
45
|
+
const updateEnvelope = makeEnvelopeModel<AuthCredentials>(update.token, EnvelopeKind.Token)
|
|
46
|
+
const authManager = await trust<Config, Context>(ctx, TRUSTED, AUTH_SRV_KEY)
|
|
47
|
+
if (!await updateEnvelope.verify(authManager.key)) {
|
|
48
|
+
throw new AuthenFailed()
|
|
49
|
+
}
|
|
49
50
|
|
|
50
|
-
|
|
51
|
+
const updatedAuth = updateEnvelope.message()
|
|
51
52
|
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
53
|
+
const updatedUser: Auth = {
|
|
54
|
+
...user,
|
|
55
|
+
role: updatedAuth.role ?? AuthRole.Guest,
|
|
56
|
+
userId: updatedAuth.userId ?? user.userId,
|
|
57
|
+
profileId: updatedAuth.profileId,
|
|
58
|
+
entityId: updatedAuth.entityId ?? user.entityId,
|
|
59
|
+
createdAt: new Date()
|
|
60
|
+
}
|
|
61
|
+
|
|
62
|
+
if (updatedAuth.challenge !== user.token) {
|
|
63
|
+
await cache(ctx).delete(record)
|
|
64
|
+
updatedUser.token = updatedAuth.challenge
|
|
65
|
+
record.id = managedId(updatedUser.token)
|
|
66
|
+
}
|
|
60
67
|
|
|
61
|
-
if (updatedAuth.challenge !== user.token) {
|
|
62
|
-
await cache(ctx).delete(record)
|
|
63
|
-
updatedUser.token = updatedAuth.challenge
|
|
64
|
-
record.id = managedId(updatedUser.token)
|
|
65
|
-
}
|
|
66
68
|
|
|
69
|
+
const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
|
|
70
|
+
const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
|
|
71
|
+
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
|
|
67
72
|
|
|
68
|
-
|
|
69
|
-
const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
|
|
70
|
-
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
|
|
73
|
+
record.payload = update.tokenSet as TokenSetParameters
|
|
71
74
|
|
|
72
|
-
|
|
75
|
+
await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 })
|
|
73
76
|
|
|
74
|
-
|
|
77
|
+
return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` }
|
|
78
|
+
} else if (record.payload != null) {
|
|
79
|
+
const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
|
|
80
|
+
const defaultClientId = oidc.getDefault()
|
|
81
|
+
if (defaultClientId != null) {
|
|
82
|
+
let tokenSet: CommonTokenSetParams = record.payload as CommonTokenSetParams
|
|
83
|
+
const client = await oidc.getClient(defaultClientId)
|
|
84
|
+
if (days.unix(tokenSet.expires_at ?? 0).isBefore()) {
|
|
85
|
+
tokenSet = await client.refresh(tokenSet as TokenSetParameters) as CommonTokenSetParams
|
|
86
|
+
} else {
|
|
87
|
+
const result = await client.introspect(tokenSet as TokenSetParameters, 'access_token')
|
|
88
|
+
if (!result.active) {
|
|
89
|
+
throw new AuthorizationError('access-token')
|
|
90
|
+
}
|
|
91
|
+
}
|
|
75
92
|
|
|
76
|
-
|
|
93
|
+
const updatedUser: Auth = {
|
|
94
|
+
...user,
|
|
95
|
+
createdAt: new Date()
|
|
96
|
+
}
|
|
97
|
+
|
|
98
|
+
const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
|
|
99
|
+
const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
|
|
100
|
+
.send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
|
|
101
|
+
|
|
102
|
+
record.payload = tokenSet as TokenSetParameters
|
|
103
|
+
|
|
104
|
+
await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 })
|
|
105
|
+
|
|
106
|
+
return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` }
|
|
107
|
+
}
|
|
108
|
+
}
|
|
77
109
|
} catch (err) {
|
|
78
110
|
console.error(err)
|
|
79
111
|
await cache(ctx).delete(managedId(user.token))
|
package/tsconfig.tsbuildinfo
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"root":["./src/consts.ts","./src/gate.ts","./src/guard.ts","./src/index.ts","./src/models.ts","./src/modules.ts","./src/service.ts","./src/types.ts","./src/wrapper.ts","./src/actions/index.ts","./src/actions/init.ts","./src/actions/process.ts","./src/auth/consts.ts","./src/auth/index.ts","./src/auth/plugins/index.ts","./src/auth/plugins/oidc-client.ts","./src/auth/plugins/types.ts","./src/model/consts.ts","./src/model/gate.ts","./src/model/types.ts","./src/utils/auth.ts","./src/utils/cache.ts","./src/utils/index.ts","./src/utils/types.ts","./src/utils/wrapped.ts"],"version":"5.6.3"}
|