@owlmeans/server-oidc-rp 0.1.2 → 0.1.3

package/src/utils/auth.ts

@@ -1,8 +1,7 @@
 import type { AuthCredentials } from '@owlmeans/auth'
 import { AuthenFailed, AuthenPayloadError } from '@owlmeans/auth'
-import type { Config, Context, OidcClientService, TokenSet } from '../types.js'
+import type { Config, Context, OidcClientService, OidcTokenSet } from '../types.js'
 import type { OidcProviderConfig } from '@owlmeans/oidc'
-import type { } from 'openid-client'
 import Url from 'url'
 import { cache, exchangeId, verifierId } from './cache.js'
 import { DEFAULT_ALIAS } from '../consts.js'
@@ -11,7 +10,7 @@ import { randomBytes } from '@noble/hashes/utils'
 import { AUTHEN_TIMEFRAME } from '@owlmeans/server-auth'
 
 export const makeOidcAuthentication = <C extends Config, T extends Context<C>>(context: T) =>
-  async (credential: AuthCredentials): Promise<[OidcProviderConfig, TokenSet, string]> => {
+  async (credential: AuthCredentials): Promise<[OidcProviderConfig, OidcTokenSet, string]> => {
     console.log('Challenge we got: ', credential.challenge)
     const challengeParts = credential.challenge.split(':http')
     // This is ex. source - url we were going to return user to after all it happens

package/src/utils/types.ts

@@ -1,10 +1,11 @@
 import type { AuthSpent } from '@owlmeans/server-auth'
-import type { TokenSetParameters } from '../types.js'
+import type { OidcTokenSetParameters } from '../types.js'
 
 export interface OIDCAuthCache extends AuthSpent {
   verifier?: string
-  payload?: TokenSetParameters
+  payload?: OidcTokenSetParameters
   client?: string
   validated?: Date
   entityId?: string
+  redirectUri?: string
 }

package/src/wrapper.ts

@@ -5,10 +5,10 @@ import { createService } from '@owlmeans/context'
 import type { CommonTokenSetParams, OIDCTokenUpdate, WrappedOIDCService } from '@owlmeans/oidc'
 import { OIDC_WRAPPED_TOKEN, WRAPPED_OIDC } from '@owlmeans/oidc'
 import { cache, managedId } from './utils/cache.js'
-import type { Config, Context, OidcClientService, TokenSetParameters } from './types.js'
+import type { Config, Context, OidcClientService, OidcTokenSetParameters } from './types.js'
 import { authService, DEFAULT_ALIAS, OIDC_AUTH_LIFTETIME, OIDC_WRAP_FRESHNESS } from './consts.js'
 import days from 'dayjs'
-import type { ClientModule } from '@owlmeans/client-module'
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 import { TRUSTED } from '@owlmeans/config'
 import { AUTH_SRV_KEY } from '@owlmeans/server-auth'
 import { trust } from '@owlmeans/auth-common/utils'
@@ -38,8 +38,8 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
 
         record.validated = new Date()
 
-        if (ctx.hasModule(authService.auth.update)) {
-          const [update] = await ctx.module<ClientModule<OIDCTokenUpdate>>(authService.auth.update)
+        if (ctx.hasEntrypoint(authService.auth.update)) {
+          const [update] = await ctx.entrypoint<ClientEntrypoint<OIDCTokenUpdate>>(authService.auth.update)
             .call({ body: { token, tokenSet: record.payload } })
 
           const updateEnvelope = makeEnvelopeModel<AuthCredentials>(update.token, EnvelopeKind.Token)
@@ -70,7 +70,7 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
           const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
             .send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
 
-          record.payload = update.tokenSet as TokenSetParameters
+          record.payload = update.tokenSet as OidcTokenSetParameters
 
           await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 })
 
@@ -82,9 +82,9 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
             let tokenSet: CommonTokenSetParams = record.payload as CommonTokenSetParams
             const client = await oidc.getClient(defaultClientId)
             if (days.unix(tokenSet.expires_at ?? 0).isBefore()) {
-              tokenSet = await client.refresh(tokenSet as TokenSetParameters) as CommonTokenSetParams
+              tokenSet = await client.refresh(tokenSet as OidcTokenSetParameters) as CommonTokenSetParams
             } else {
-              const result = await client.introspect(tokenSet as TokenSetParameters, 'access_token')
+              const result = await client.introspect(tokenSet as OidcTokenSetParameters, 'access_token')
               if (!result.active) {
                 throw new AuthorizationError('access-token')
               }
@@ -99,7 +99,7 @@ export const makeOidcWrappingService = (): WrappedOIDCService => {
             const authorization = await makeEnvelopeModel<Auth>(OIDC_WRAPPED_TOKEN)
               .send(updatedUser, null).sign(trusted.key, EnvelopeKind.Token)
 
-            record.payload = tokenSet as TokenSetParameters
+            record.payload = tokenSet as OidcTokenSetParameters
 
             await cache(ctx).save(record, { ttl: OIDC_AUTH_LIFTETIME / 1000 })
 

package/tests/context.ts

@@ -0,0 +1,44 @@
+import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { createStaticResource } from '@owlmeans/static-resource'
+import { AUTH_CACHE } from '@owlmeans/server-auth'
+import { makeOidcClientService } from '../src/service.js'
+import { GOOGLE_SERVICE } from '@owlmeans/oidc'
+import type { Config } from '../src/types.js'
+
+const RESOURCE_KEY = 'server-oidc-rp-test-cache'
+
+export const makeTestContext = () => {
+  const cfg: Config = {
+    ready: false,
+    service: 'server-oidc-rp-tests',
+    layer: Layer.Service,
+    type: AppType.Backend,
+    services: {},
+    oidc: {
+      providers: [
+        {
+          clientId: 'google-client-id-123',
+          secret: 'google-secret-456',
+          service: GOOGLE_SERVICE,
+          basePath: 'unused-in-unit-tests',
+        },
+        {
+          clientId: 'keycloak-admin',
+          secret: 'kc-secret',
+          service: 'iam-product-api',
+          basePath: 'realms/master',
+          def: true,
+          internal: true,
+        },
+      ],
+    },
+  } as Config
+
+  const context = makeBasicContext(cfg) as BasicContext<Config>
+
+  context.registerResource(createStaticResource(AUTH_CACHE, RESOURCE_KEY))
+  context.registerService(makeOidcClientService())
+
+  return context
+}

package/tests/google-client.spec.ts

@@ -0,0 +1,123 @@
+import { describe, test, expect } from 'bun:test'
+import { makeTestContext } from './context.js'
+import { googleClientPlugin } from '../src/auth/plugins/google-client.js'
+import { GOOGLE_SERVICE } from '@owlmeans/oidc'
+import { AuthenPayloadError, AuthRole } from '@owlmeans/auth'
+import { UnknownRecordError } from '@owlmeans/resource'
+import { verifierId } from '../src/utils/cache.js'
+import { AUTH_CACHE } from '@owlmeans/server-auth'
+import type { Resource } from '@owlmeans/resource'
+import type { OIDCAuthCache } from '../src/utils/types.js'
+import type { Config, Context } from '../src/types.js'
+import type { BasicContext } from '@owlmeans/context'
+
+const initContext = async () => {
+  const ctx = makeTestContext()
+  ctx.configure()
+  await ctx.init()
+  return ctx
+}
+
+describe('@owlmeans/server-oidc-rp — googleClientPlugin.init', () => {
+  test('rejects when request.source is missing', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    await expect(
+      plugin.init({ type: 'google-oauth', source: undefined as any })
+    ).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('returns a Google auth URL with correct params', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    const result = await plugin.init({
+      type: 'google-oauth',
+      source: 'https://example.com/authentication/login/google-oauth',
+    })
+
+    expect(result.challenge).toContain('https://accounts.google.com/o/oauth2/v2/auth')
+
+    const url = new URL(result.challenge)
+    expect(url.searchParams.get('client_id')).toBe('google-client-id-123')
+    expect(url.searchParams.get('redirect_uri')).toBe('https://example.com/authentication/login/google-oauth')
+    expect(url.searchParams.get('response_type')).toBe('code')
+    expect(url.searchParams.get('code_challenge_method')).toBe('S256')
+    expect(url.searchParams.get('state')).not.toBeNull()
+    expect(url.searchParams.get('state')!.length).toBeGreaterThan(0)
+    expect(url.searchParams.get('code_challenge')).not.toBeNull()
+  })
+
+  test('caches PKCE verifier under verifierId(state) with redirectUri', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    const result = await plugin.init({
+      type: 'google-oauth',
+      source: 'https://example.com/auth/login/google-oauth',
+    })
+
+    const url = new URL(result.challenge)
+    const state = url.searchParams.get('state')!
+
+    const cache = (ctx as unknown as BasicContext<Config>).resource<Resource<OIDCAuthCache>>(AUTH_CACHE)
+    const record = await cache.load(verifierId(state))
+
+    expect(record).not.toBeNull()
+    expect(record!.verifier).toBeDefined()
+    expect(record!.verifier!.length).toBeGreaterThan(0)
+    expect(record!.client).toBe('google-client-id-123')
+    expect(record!.redirectUri).toBe('https://example.com/auth/login/google-oauth')
+  })
+})
+
+describe('@owlmeans/server-oidc-rp — googleClientPlugin.authenticate', () => {
+  test('rejects when code is missing', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    await expect(
+      plugin.authenticate({
+        type: 'google-oauth',
+        challenge: '',
+        credential: 'state=abc123',
+        role: AuthRole.User,
+        userId: 'code',
+        scopes: ['*'],
+      })
+    ).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('rejects when state is missing', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    await expect(
+      plugin.authenticate({
+        type: 'google-oauth',
+        challenge: '',
+        credential: 'code=abc123',
+        role: AuthRole.User,
+        userId: 'code',
+        scopes: ['*'],
+      })
+    ).rejects.toBeInstanceOf(AuthenPayloadError)
+  })
+
+  test('rejects when verifier not found for state', async () => {
+    const ctx = await initContext()
+    const plugin = googleClientPlugin(ctx as unknown as Context, GOOGLE_SERVICE)
+
+    await expect(
+      plugin.authenticate({
+        type: 'google-oauth',
+        challenge: '',
+        credential: 'code=abc123&state=nonexistent-state',
+        role: AuthRole.User,
+        userId: 'code',
+        scopes: ['*'],
+      })
+    ).rejects.toBeInstanceOf(UnknownRecordError)
+  })
+})

package/tests/service.spec.ts

@@ -0,0 +1,75 @@
+import { describe, test, expect } from 'bun:test'
+import { makeTestContext } from './context.js'
+import { GOOGLE_SERVICE } from '@owlmeans/oidc'
+import { AuthManagerError } from '@owlmeans/auth'
+import type { OidcClientService } from '../src/types.js'
+import { DEFAULT_ALIAS } from '../src/consts.js'
+
+describe('@owlmeans/server-oidc-rp — getConfig', () => {
+  test('finds provider by service name only', async () => {
+    const ctx = makeTestContext()
+    ctx.configure()
+    await ctx.init()
+
+    const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+    const cfg = await oidc.getConfig({ service: GOOGLE_SERVICE })
+
+    expect(cfg).not.toBeNull()
+    expect(cfg!.clientId).toBe('google-client-id-123')
+    expect(cfg!.secret).toBe('google-secret-456')
+  })
+
+  test('finds provider by clientId string', async () => {
+    const ctx = makeTestContext()
+    ctx.configure()
+    await ctx.init()
+
+    const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+    const cfg = await oidc.getConfig('keycloak-admin')
+
+    expect(cfg).not.toBeNull()
+    expect(cfg!.service).toBe('iam-product-api')
+  })
+
+  test('throws when lookup has neither clientId nor service', async () => {
+    const ctx = makeTestContext()
+    ctx.configure()
+    await ctx.init()
+
+    const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+
+    await expect(oidc.getConfig({})).rejects.toBeInstanceOf(AuthManagerError)
+  })
+
+  test('returns undefined for unknown service', async () => {
+    const ctx = makeTestContext()
+    ctx.configure()
+    await ctx.init()
+
+    const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+    const cfg = await oidc.getConfig({ service: 'nonexistent-service' })
+
+    expect(cfg).toBeUndefined()
+  })
+})
+
+describe('@owlmeans/server-oidc-rp — getConfiguration guard', () => {
+  test('throws oidc.client.client-id when service-only provider has no clientId on provider or param', async () => {
+    const ctx = makeTestContext()
+    // Add a provider with no clientId
+    ;(ctx.cfg as any).oidc.providers.push({
+      service: 'no-client-id-svc',
+      secret: 'some-secret',
+      basePath: 'realms/test',
+    })
+    ctx.configure()
+    await ctx.init()
+
+    const oidc = ctx.service<OidcClientService>(DEFAULT_ALIAS)
+
+    // getConfiguration should throw because neither param.clientId nor cfg.clientId exist
+    await expect(
+      oidc.getConfiguration({ service: 'no-client-id-svc' })
+    ).rejects.toThrow('oidc.client.client-id')
+  })
+})

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}

package/tsconfig.json

@@ -1,15 +1,16 @@
 {
   "extends": [
-    "../tsconfig.default.json",
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.node.json"
   ],
   "compilerOptions": {
-    "rootDir": "./src/", /* Specify the root folder within your source files. */
-    "outDir": "./build/", /* Specify an output folder for all emitted files. */
-    "moduleResolution": "Bundler",
+    "rootDir": "./src/",
+    "outDir": "./build/"
   },
   "exclude": [
     "./dist/**/*",
     "./build/**/*",
+    "./tests/**/*",
     "./*.ts"
   ]
-}
+}