@owlmeans/server-oidc-rp 0.1.0

package/src/utils/cache.ts

@@ -0,0 +1,12 @@
+import type { Resource } from '@owlmeans/resource'
+import type { OIDCAuthCache } from './types.js'
+import type {  Config, Context } from '../types.js'
+import { AUTH_CACHE } from '@owlmeans/server-auth'
+import { OIDC_TOKEN_STORE } from '../consts.js'
+
+export const cache = <C extends Config, T extends Context<C>>(context: T): Resource<OIDCAuthCache> =>
+  context.resource<Resource<OIDCAuthCache>>(AUTH_CACHE)
+
+export const verifierId = (challenge: string) => `${OIDC_TOKEN_STORE}:verifier:${challenge}`
+export const exchangeId = (exchange: string) => `${OIDC_TOKEN_STORE}:exchange:${exchange}`
+export const managedId = (token: string) => `${OIDC_TOKEN_STORE}:token:${token}`

package/src/utils/index.ts

@@ -0,0 +1,5 @@
+
+export * from './cache.js'
+export type * from './types.js'
+export * from './auth.js'
+export * from './wrapped.js'

package/src/utils/types.ts

@@ -0,0 +1,10 @@
+import type { AuthSpent } from '@owlmeans/server-auth'
+import type { TokenSetParameters } from '../types.js'
+
+export interface OIDCAuthCache extends AuthSpent {
+  verifier?: string
+  payload?: TokenSetParameters
+  client?: string
+  validated?: Date
+  entityId?: string
+}

package/src/utils/wrapped.ts

@@ -0,0 +1,6 @@
+import type { WrappedOIDCService } from '@owlmeans/oidc'
+import { WRAPPED_OIDC } from '@owlmeans/oidc'
+import type { Context } from '../types.js'
+
+export const wrapper = (context: Context): WrappedOIDCService =>
+  context.service(WRAPPED_OIDC)

package/src/wrapper.ts

@@ -0,0 +1,92 @@
+import { AuthenFailed, AuthorizationError, AuthRole } from '@owlmeans/auth'
+import type { Auth, AuthCredentials } from '@owlmeans/auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { createService } from '@owlmeans/context'
+import type { OIDCTokenUpdate, WrappedOIDCService } from '@owlmeans/oidc'
+import { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from '@owlmeans/oidc'
+import { cache, managedId } from './utils/cache.js'
+import type { Config, Context, TokenSetParameters } from './types.js'
+import { authService, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js'
+import days from 'dayjs'
+import type { ClientModule } from '@owlmeans/client-module'
+import { TRUSTED } from '@owlmeans/config'
+import { AUTH_SRV_KEY } from '@owlmeans/server-auth'
+import { trust } from '@owlmeans/auth-common/utils'
+
+export const makeOidcWrappingService = (): WrappedOIDCService => {
+  const service = createService<WrappedOIDCService>(WRAPPED_OIDC, {
+    update: async (token, thr) => {
+      const ctx = service.assertCtx<Config, Context>()
+      token = typeof token === 'string' ? token : token?.token
+      if (token == null) {
+        throw new AuthorizationError('token')
+      }
+      const [ , authentication ] = token.split(' ')
+      const envelope = makeEnvelopeModel<Auth>(authentication, EnvelopeKind.Token)
+      const user = envelope.message()
+
+      try {
+        const record = await cache(ctx).get(managedId(user.token))
+        if (record == null || record.payload == null) {
+          throw new AuthorizationError('record')
+        }
+
+        if (record.validated != null && days(record.validated)
+          .add(OIDC_WRAP_FRESHNESS, 'milliseconds').isAfter()) {
+          return { token }
+        }
+
+        record.validated = new Date()
+
+        const [ update ] = await ctx.module<ClientModule<OIDCTokenUpdate>>(authService.auth.update)
+          .call({ body: { token, tokenSet: record.payload } })
+
+        const updateEnvelope = makeEnvelopeModel<AuthCredentials>(update.token, EnvelopeKind.Token)
+        const authManager = await trust<Config, Context>(ctx, TRUSTED, AUTH_SRV_KEY)
+        if (!await updateEnvelope.verify(authManager.key)) {
+          throw new AuthenFailed()
+        }
+
+        const updatedAuth = updateEnvelope.message()
+
+        const updatedUser: Auth = {
+          ...user,
+          role: updatedAuth.role ?? AuthRole.Guest,
+          userId: updatedAuth.userId ?? user.userId,
+          profileId: updatedAuth.profileId,
+          entityId: updatedAuth.entityId ?? user.entityId,
+          createdAt: new Date()
+        }
+
+        if (updatedAuth.challenge !== user.token) {
+          await cache(ctx).delete(record)
+          updatedUser.token = updatedAuth.challenge
+          record.id = managedId(updatedUser.token)
+        }
+
+
+        const trusted = await trust<Config, Context>(ctx, TRUSTED, ctx.cfg.alias ?? ctx.cfg.service)
+        const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
+          .send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
+
+        record.payload = update.tokenSet as TokenSetParameters
+
+        await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 })
+
+        return { token: `${OIDC_WRAPPED_TOKEN.toUpperCase()} ${authorization}` }
+      } catch (err) {
+        console.error(err)
+        await cache(ctx).delete(managedId(user.token))
+        if (thr) {
+          if (err instanceof AuthorizationError) {
+            throw err
+          }
+          throw new AuthorizationError('unknown')
+        }
+      }
+      return null
+    }
+  })
+
+  return service
+}

package/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "extends": [
+    "../tsconfig.default.json",
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/", /* Specify the root folder within your source files. */
+    "outDir": "./build/", /* Specify an output folder for all emitted files. */
+    "moduleResolution": "Bundler",
+  },
+  "exclude": [
+    "./dist/**/*",
+    "./build/**/*",
+    "./*.ts"
+  ]
+}

package/tsconfig.tsbuildinfo

@@ -0,0 +1 @@
+{"root":["./src/consts.ts","./src/gate.ts","./src/guard.ts","./src/index.ts","./src/models.ts","./src/modules.ts","./src/service.ts","./src/types.ts","./src/wrapper.ts","./src/actions/index.ts","./src/actions/init.ts","./src/actions/process.ts","./src/auth/consts.ts","./src/auth/index.ts","./src/auth/plugins/index.ts","./src/auth/plugins/oidc-client.ts","./src/auth/plugins/types.ts","./src/model/consts.ts","./src/model/gate.ts","./src/model/types.ts","./src/utils/auth.ts","./src/utils/cache.ts","./src/utils/index.ts","./src/utils/types.ts","./src/utils/wrapped.ts"],"version":"5.6.3"}