@owlmeans/web-oidc-rp 0.1.0

package/build/components/dispatcher.js

@@ -0,0 +1,58 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { DispatcherHOC } from '@owlmeans/client-auth';
+import { useSearchParams } from 'react-router-dom';
+import { useEffect } from 'react';
+import { useContext } from '@owlmeans/web-client';
+import { useI18nLib } from '@owlmeans/client-i18n';
+import { AUTH_QUERY } from '@owlmeans/auth';
+import { useFlow } from '@owlmeans/web-flow';
+import { DEFAULT_ALIAS } from '../consts.js';
+export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
+    const [query] = useSearchParams();
+    const context = useContext();
+    const client = useFlow();
+    const t = useI18nLib('auth', 'dispatcher');
+    useEffect(() => {
+        if (client == null) {
+            return;
+        }
+        const token = query.get(AUTH_QUERY);
+        const params = {};
+        query.forEach((value, key) => {
+            if (key !== AUTH_QUERY) {
+                params[key] = value;
+            }
+        });
+        if (token != null) {
+            // This is required for compatibility with a standard OwlMeans Auth flow.
+            provideToken({ token }, params);
+        }
+        else {
+            const oidc = context.service(DEFAULT_ALIAS);
+            oidc.dispatch(params).then(async (dispatched) => {
+                if (dispatched) {
+                    return await navigate();
+                }
+                if (client == null) {
+                    return;
+                }
+                const redirect = await oidc.authenticate(client.flow(), params);
+                if (redirect != null && redirect !== '') {
+                    document.location.href = redirect;
+                    return;
+                }
+                const authzToken = await context.auth().authenticated();
+                if (authzToken == null) {
+                    provideToken({ token: '' }, undefined);
+                }
+                else {
+                    await navigate();
+                }
+            });
+        }
+    }, [client]);
+    return query.has(AUTH_QUERY)
+        ? _jsx("div", { children: t('loading') })
+        : undefined;
+});
+//# sourceMappingURL=dispatcher.js.map

package/build/components/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/components/dispatcher.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;IACrE,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,OAAO,EAAE,CAAA;IAExB,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAE1C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACnC,MAAM,MAAM,GAA2B,EAAE,CAAA;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACrB,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,yEAAyE;YACzE,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAkB,aAAa,CAAC,CAAA;YAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;gBAC5C,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,MAAM,QAAQ,EAAE,CAAA;gBACzB,CAAC;gBACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnB,OAAM;gBACR,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAA;oBACjC,OAAM;gBACR,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;gBACvD,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBACvB,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;gBACxC,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,EAAE,CAAA;gBAClB,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAEZ,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1B,CAAC,CAAC,wBAAM,CAAC,CAAC,SAAS,CAAC,GAAO;QAC3B,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAC,CAAA"}

package/build/components/index.d.ts

@@ -0,0 +1,2 @@
+export * from './dispatcher.js';
+//# sourceMappingURL=index.d.ts.map

package/build/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAA"}

package/build/components/index.js

@@ -0,0 +1,2 @@
+export * from './dispatcher.js';
+//# sourceMappingURL=index.js.map

package/build/components/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AACA,cAAc,iBAAiB,CAAA"}

package/build/consts.d.ts

@@ -0,0 +1,7 @@
+export declare const DEFAULT_ALIAS = "oidc-rp";
+export declare enum OidcAuthPurposes {
+    Unknown = "unknown",
+    Subscribe = "subscribe",
+    Login = "login"
+}
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB"}

package/build/consts.js

@@ -0,0 +1,8 @@
+export const DEFAULT_ALIAS = 'oidc-rp';
+export var OidcAuthPurposes;
+(function (OidcAuthPurposes) {
+    OidcAuthPurposes["Unknown"] = "unknown";
+    OidcAuthPurposes["Subscribe"] = "subscribe";
+    OidcAuthPurposes["Login"] = "login";
+})(OidcAuthPurposes || (OidcAuthPurposes = {}));
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,uCAAmB,CAAA;IACnB,2CAAuB,CAAA;IACvB,mCAAe,CAAA;AACjB,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B"}

package/build/guard.d.ts

@@ -0,0 +1,6 @@
+import type { OidcGuardOptions } from '@owlmeans/oidc';
+import type { Config, Context } from './types.js';
+import type { CommonModule } from '@owlmeans/module';
+export declare const appendOidcGuard: <C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions) => T;
+export declare const setupOidcGuard: (modules: CommonModule[], coguards?: string | string[]) => void;
+//# sourceMappingURL=guard.d.ts.map

package/build/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAYpD,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,WAC3D,CAAC,SAAS,gBAAgB,MAOpC,CAAA;AAED,eAAO,MAAM,cAAc,YAAa,YAAY,EAAE,aAAa,MAAM,GAAG,MAAM,EAAE,SAMnF,CAAA"}

package/build/guard.js

@@ -0,0 +1,18 @@
+import { appendOidcGuard as appendBasicOidcGuard, setupOidcGuard as setupBasicOidcGuard, DISPATCHER_OIDC, DISPATCHER_OIDC_INIT } from '@owlmeans/oidc';
+import { elevate } from '@owlmeans/web-client';
+import { DISPATCHER } from '@owlmeans/auth';
+import { handler } from '@owlmeans/client';
+import { Dispatcher } from './components/dispatcher.js';
+import { makeOidcAuthService } from './service.js';
+export const appendOidcGuard = (context, opts) => {
+    context.registerService(makeOidcAuthService());
+    const ctx = appendBasicOidcGuard(context, opts);
+    return ctx;
+};
+export const setupOidcGuard = (modules, coguards) => {
+    setupBasicOidcGuard(modules, coguards);
+    elevate(modules, DISPATCHER_OIDC_INIT);
+    elevate(modules, DISPATCHER_OIDC);
+    elevate(modules, DISPATCHER, handler(Dispatcher), { force: true });
+};
+//# sourceMappingURL=guard.js.map

package/build/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,IAAI,oBAAoB,EACvC,cAAc,IAAI,mBAAmB,EACrC,eAAe,EAAE,oBAAoB,EACtC,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,OAAU,EAAE,IAAuB,EACnC,EAAE;IACF,OAAO,CAAC,eAAe,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAE9C,MAAM,GAAG,GAAG,oBAAoB,CAAO,OAAO,EAAE,IAAI,CAAC,CAAA;IAErD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAuB,EAAE,QAA4B,EAAE,EAAE;IACtF,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAEtC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IACtC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IACjC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AACpE,CAAC,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,6 @@
+export type * from './types.js';
+export * from './consts.js';
+export * from './service.js';
+export * from './guard.js';
+export * from './components/index.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA"}

package/build/index.js

@@ -0,0 +1,5 @@
+export * from './consts.js';
+export * from './service.js';
+export * from './guard.js';
+export * from './components/index.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,uBAAuB,CAAA"}

package/build/service.d.ts

@@ -0,0 +1,3 @@
+import type { OidcAuthService } from './types.js';
+export declare const makeOidcAuthService: (alias?: string) => OidcAuthService;
+//# sourceMappingURL=service.d.ts.map

package/build/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,eAAe,EAAmB,MAAM,YAAY,CAAA;AAenF,eAAO,MAAM,mBAAmB,WAAW,MAAM,KAAmB,eAmInE,CAAA"}

package/build/service.js

@@ -0,0 +1,112 @@
+import { assertContext, createService, HOME } from '@owlmeans/context';
+import { DEFAULT_ALIAS } from './consts.js';
+import { UserManager } from 'oidc-client-ts';
+import { DEFAULT_ALIAS as FLOW_SERVICE } from '@owlmeans/client-flow';
+import { FlowStepMissconfigured, OidcAuthStep, STD_OIDC_FLOW, UnknownFlow } from '@owlmeans/flow';
+import { DISPATCHER_OIDC, DISPATCHER_OIDC_INIT, OIDC_CODE_QUERY } from '@owlmeans/oidc';
+import { AUTH_RESOURCE, USER_ID } from '@owlmeans/client-auth';
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
+export const makeOidcAuthService = (alias = DEFAULT_ALIAS) => {
+    const store = (context) => context.auth().store();
+    const storeKey = '_oidc-client-interaction';
+    const service = createService(alias, {
+        /**
+         * This method performs when the IdP returns authentication params.
+         */
+        dispatch: async (params) => {
+            /**
+             * 1. Check if there are parameters in the URL for the server side OIDC authentication (e.g. code)
+             * 2. Send paramters to finalize authentication (proxy request to the auth server?)
+             * 3. If the authentication successful set user state using authentication service
+             */
+            if (params[OIDC_CODE_QUERY] == null) {
+                return false;
+            }
+            const ctx = service.assertCtx();
+            params.authUrl = (await store(ctx).get(storeKey)).authUrl;
+            const [authToken] = await ctx.module(DISPATCHER_OIDC)
+                .call({ body: params });
+            if (authToken.token != null && authToken.token !== '') {
+                const authResource = ctx.resource(AUTH_RESOURCE);
+                await authResource.save({ id: USER_ID, token: authToken.token });
+                const [, authorization] = authToken.token.split(' ');
+                const envelope = makeEnvelopeModel(authorization, EnvelopeKind.Token);
+                ctx.auth().auth = envelope.message();
+                ctx.auth().token = authToken.token;
+                return true;
+            }
+            return false;
+        },
+        authenticate: async (flow, params) => {
+            /**
+             * 1. Kick of OIDC authentication if we receive some hints about who or for what organization we'd like to authenticate
+             * 2. Request OIDC authentication params from the server using these entity and profile id
+             * 3. The server should return an URL to redirect user to
+             * 4. Return this user to the component for the further processing (redirection)
+             */
+            if (flow.state().flow !== STD_OIDC_FLOW || flow.state().step !== OidcAuthStep.Ephemeral) {
+                return null;
+            }
+            if (params.entity == null && params.entity == null) {
+                return null;
+            }
+            const ctx = service.assertCtx();
+            const [redirectTo] = await ctx.module(DISPATCHER_OIDC_INIT)
+                .call({ body: params });
+            const context = service.assertCtx();
+            await store(context).save({ id: storeKey, authUrl: redirectTo });
+            return redirectTo;
+        },
+        proceedToRedirectUrl: async (extras) => {
+            const context = assertContext(service.ctx);
+            const flow = context.service(FLOW_SERVICE);
+            const flowModel = await flow.state();
+            if (flowModel == null) {
+                throw new UnknownFlow('oidc.dispatch');
+            }
+            const authorityTransition = flowModel.next();
+            flowModel.transit(authorityTransition.transition, true, { purpose: extras.purpose });
+            // @TODO I'm not sure that this dirty hack is a correct approach
+            if (extras.alias === HOME) {
+                const redirectTransition = flowModel.next();
+                flowModel.transit(redirectTransition.transition, true, { purpose: extras.purpose });
+            }
+            const redirectUrl = await flow.proceed({ params: { uid: extras.uid } }, true);
+            return redirectUrl;
+        },
+        /**
+         * This is client-side only OIDC implementation. It's under constructuion.
+         * We stoped on the try to redirect to OIDC provider, but it requires browser integrated
+         * cryptography under ssl/tls.
+         * @TODO Finish client-side only implementation one day
+         */
+        dispatchClientOnly: async () => {
+            const context = assertContext(service.ctx);
+            const flow = context.service(FLOW_SERVICE);
+            const flowModel = await flow.state();
+            if (flowModel == null) {
+                throw new UnknownFlow('oidc.dispatch');
+            }
+            const authorityTransition = flowModel.next();
+            flowModel.transit(authorityTransition.transition, true);
+            const authorityStep = flowModel.step();
+            if (authorityStep.module == null) {
+                throw new FlowStepMissconfigured(authorityStep.step);
+            }
+            const [authorityUrl] = await context.module(authorityStep.module).call();
+            const redirectTransition = flowModel.next();
+            flowModel.transit(redirectTransition.transition, true);
+            const redirectUrl = await flow.proceed(undefined, true);
+            // @TODO To proceed we need to provide client_id some way
+            const manager = new UserManager({
+                // client_id: context.cfg.oidc.consumer?.clientId ?? '',
+                client_id: '',
+                redirect_uri: redirectUrl,
+                authority: authorityUrl,
+            });
+            await manager.signinRedirect({ state: flowModel.serialize() });
+        }
+    });
+    return service;
+};
+//# sourceMappingURL=service.js.map

package/build/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAEjG,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEvF,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE9D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,aAAa,EAAmB,EAAE;IACpF,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,EAAmB,CAAA;IAC3E,MAAM,QAAQ,GAAG,0BAA0B,CAAA;IAE3C,MAAM,OAAO,GAAoB,aAAa,CAAkB,KAAK,EAAE;QACrE;;WAEG;QACH,QAAQ,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACvB;;;;eAIG;YACH,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,IAAI,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;YAEzD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAoB,eAAe,CAAC;iBACrE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAEzB,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;gBACtD,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAqB,aAAa,CAAC,CAAA;gBACpE,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAA;gBAEhE,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACpD,MAAM,QAAQ,GAAG,iBAAiB,CAAO,aAAa,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAE3E,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACpC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAA;gBAElC,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC;QAED,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC;;;;;eAKG;YACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;gBACxF,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YAEhD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAiB,oBAAoB,CAAC;iBACxE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAmB,CAAA;YACpD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;YAEhE,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACnC,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,CAAC,CAAA;YAEtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YACpC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC5C,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YAEpF,gEAAgE;YAChE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;gBAC3C,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YAE7E,OAAO,WAAW,CAAA;QACpB,CAAC;QAED;;;;;WAKG;QACH,kBAAkB,EAAE,KAAK,IAAI,EAAE;YAC7B,MAAM,OAAO,GAAG,aAAa,CAAkB,OAAO,CAAC,GAAc,CAAC,CAAA;YAEtE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;YAEvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YACpC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,WAAW,CAAC,eAAe,CAAC,CAAA;YACxC,CAAC;YAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC5C,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACvD,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YACtC,IAAI,aAAa,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;YACtD,CAAC;YACD,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAS,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAU,CAAA;YAExF,MAAM,kBAAkB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;YAC3C,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAEtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAEvD,yDAAyD;YACzD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;gBAC9B,wDAAwD;gBACxD,SAAS,EAAE,EAAE;gBACb,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,YAAY;aACxB,CAAC,CAAA;YAEF,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QAChE,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/types.d.ts

@@ -0,0 +1,25 @@
+import type { InitializedService } from '@owlmeans/context';
+import type { AppConfig, AppContext } from '@owlmeans/web-client';
+import type { OIDCAuthInitParams, WithSharedConfig } from '@owlmeans/oidc';
+import type { OidcAuthPurposes } from './consts.js';
+import type { FlowModel, FlowPayload } from '@owlmeans/flow';
+import type { ResourceRecord } from '@owlmeans/resource';
+export interface OidcAuthService extends InitializedService {
+    dispatch: (params: Record<string, string>) => Promise<boolean>;
+    authenticate: (flow: FlowModel, params: OIDCAuthInitParams) => Promise<string | null>;
+    proceedToRedirectUrl: (extras: OidcAuthRedirectExtras) => Promise<string>;
+    dispatchClientOnly: () => Promise<void>;
+}
+export interface OidcAuthRedirectExtras extends FlowPayload {
+    purpose: OidcAuthPurposes;
+    uid?: string;
+    alias?: string;
+}
+export interface Config extends AppConfig, WithSharedConfig {
+}
+export interface Context<C extends Config = Config> extends AppContext<C> {
+}
+export interface OidcInteraction extends ResourceRecord {
+    authUrl: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAE9D,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAGrF,oBAAoB,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAGzE,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,MAAM,WAAW,sBAAuB,SAAQ,WAAW;IACzD,OAAO,EAAE,gBAAgB,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,MAAO,SAAQ,SAAS,EAAE,gBAAgB;CAAI;AAE/D,MAAM,WAAW,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,UAAU,CAAC,CAAC,CAAC;CAAI;AAE7E,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/build/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@owlmeans/web-oidc-rp",
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 378 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./auth/plugins": {
+      "import": "./build/auth/plugins/index.js",
+      "require": "./build/auth/plugins/index.js",
+      "default": "./build/auth/plugins/index.js",
+      "module": "./build/auth/plugins/index.js",
+      "types": "./build/auth/plugins/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.0",
+    "@owlmeans/basic-envelope": "^0.1.0",
+    "@owlmeans/client": "^0.1.0",
+    "@owlmeans/client-auth": "^0.1.0",
+    "@owlmeans/client-flow": "^0.1.0",
+    "@owlmeans/client-i18n": "^0.1.0",
+    "@owlmeans/context": "^0.1.0",
+    "@owlmeans/flow": "^0.1.0",
+    "@owlmeans/module": "^0.1.0",
+    "@owlmeans/oidc": "^0.1.0",
+    "@owlmeans/resource": "^0.1.0",
+    "@owlmeans/web-client": "^0.1.0",
+    "@owlmeans/web-flow": "^0.1.0",
+    "oidc-client-ts": "^3.1.0"
+  },
+  "peerDependencies": {
+    "@mui/material": "*",
+    "react": "*",
+    "react-router-dom": "*"
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.11",
+    "nodemon": "^3.1.7",
+    "npm-check": "^6.0.1",
+    "typescript": "^5.6.3"
+  },
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/auth/plugins/index.ts

@@ -0,0 +1,8 @@
+
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+import { oidcClientPlugin } from './oidc-client.js'
+
+authPlugins[OIDC_CLIENT_AUTH] = oidcClientPlugin
+
+export const plugins = authPlugins

package/src/auth/plugins/oidc-client.tsx

@@ -0,0 +1,114 @@
+
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { AUTH_SCOPE, AuthenticationStage, AuthManagerError, AuthRole } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+import { useEffect } from 'react'
+import LinearProgress from '@mui/material/LinearProgress'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import type { Config, Context, OidcAuthService } from '../../types.js'
+import { useContext } from '@owlmeans/web-client'
+import { DEFAULT_ALIAS, OidcAuthPurposes } from '../../consts.js'
+import { OidcAuthStep, OidpAuthStep, UnknownFlowStep } from '@owlmeans/flow'
+import { useModule } from '@owlmeans/client'
+
+export const oidcClientPlugin: AuthenticationPlugin = {
+  type: OIDC_CLIENT_AUTH,
+
+  Implementation: Renderer => ({ type, stage, control }) => {
+    const context = useContext<Config, Context>()
+    Renderer = Renderer ?? oidcClientPlugin.Renderer
+    const module = useModule()
+
+    useEffect(() => {
+      let canceled = false
+
+      // @TODO extract somewhere else and make it more consequential
+      // This way it looks too messy
+      switch (control.stage) {
+        case AuthenticationStage.Init:
+          control.hasPersistentState().then(async hasState => {
+            if (canceled) {
+              return
+            }
+            // 3. Properly process additional paramters on sequential rendering to restore control state
+            if (hasState) {
+              await control.restore()
+              await control.cleanUpState()
+              const flow = await control.flow()
+              if (flow != null) {
+                const state = await flow.state()
+                if ([OidcAuthStep.PostAuthen, OidpAuthStep.PostAuth].includes(state?.step().step as OidcAuthStep)) {
+                  const url = new URL(window.location.href)
+
+                  const auth: AuthCredentials = {
+                    ...control.allowance,
+                    type,
+                    challenge: control.allowance?.challenge ?? '',
+                    credential: url.searchParams.toString(),
+                    role: AuthRole.User,
+                    userId: 'code',
+                    scopes: [AUTH_SCOPE]
+                  }
+
+                  const tokenized = await control.authenticate(auth)
+                  // @TODO Introduce some standard further flow in case this plugin/component 
+                  // is used without a callback
+                  if (tokenized.token !== '') {
+                    throw new AuthManagerError('callback')
+                  }
+                  return // @TODO Will it work here?
+                }
+              }
+              // return
+            }
+
+            // 1. Initialize OIDC server side authentication
+            const oidc = context.service<OidcAuthService>(DEFAULT_ALIAS)
+
+            // @TODO we need to provide an identity provider client as entityId here for flexibel usage
+            const _source = await oidc.proceedToRedirectUrl({
+              purpose: control.source as OidcAuthPurposes ?? OidcAuthPurposes.Unknown,
+              uid: 'uid' in module.params ? `${module.params.uid}` : undefined,
+              alias: module.alias
+            })
+            const source = new URL(_source)
+            source.search = ''
+            await control.requestAllowence({ type, source: source.toString() })
+          })
+        case AuthenticationStage.Authenticate:
+          control.flow().then(async flow => {
+            if (canceled) {
+              return
+            }
+            const flowState = await flow?.state()
+            if (flowState == null) {
+              throw new UnknownFlowStep(AuthenticationStage.Authenticate)
+            }
+
+            if (control.allowance?.challenge != null) {
+              const envelope = makeEnvelopeModel(control.allowance?.challenge, EnvelopeKind.Wrap)
+              const challenge = envelope.message<string>(true)
+              const parts = challenge.split(':http')
+              const url = 'http' + parts[1]
+
+              // 2. Include additional parameters (control state with allowance to flow state)
+              await control.persist()
+
+              document.location.href = url
+            }
+          })
+      }
+
+      return () => { canceled = true }
+    }, [type, stage])
+
+    if (Renderer == null) {
+      throw new SyntaxError('Renderer is not defined for OIDC plugin')
+    }
+
+    return <Renderer type={type} stage={stage} control={control} params={module.params} />
+  },
+
+  Renderer: () => <LinearProgress />
+}

package/src/components/dispatcher.tsx

@@ -0,0 +1,61 @@
+
+import { DispatcherHOC } from '@owlmeans/client-auth'
+import { useSearchParams } from 'react-router-dom'
+import { useEffect } from 'react'
+import { useContext } from '@owlmeans/web-client'
+import { useI18nLib } from '@owlmeans/client-i18n'
+import { AUTH_QUERY } from '@owlmeans/auth'
+import { useFlow } from '@owlmeans/web-flow'
+import { OidcAuthService } from '../types.js'
+import { DEFAULT_ALIAS } from '../consts.js'
+
+export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
+  const [query] = useSearchParams()
+  const context = useContext()
+  const client = useFlow()
+
+  const t = useI18nLib('auth', 'dispatcher')
+
+  useEffect(() => {
+    if (client == null) {
+      return
+    }
+    const token = query.get(AUTH_QUERY)
+    const params: Record<string, string> = {}
+    query.forEach((value, key) => {
+      if (key !== AUTH_QUERY) {
+        params[key] = value
+      }
+    })
+
+    if (token != null) {
+      // This is required for compatibility with a standard OwlMeans Auth flow.
+      provideToken({ token }, params)
+    } else {
+      const oidc = context.service<OidcAuthService>(DEFAULT_ALIAS)
+      oidc.dispatch(params).then(async dispatched => {
+        if (dispatched) {
+          return await navigate()
+        }
+        if (client == null) {
+          return
+        }
+        const redirect = await oidc.authenticate(client.flow(), params)
+        if (redirect != null && redirect !== '') {
+          document.location.href = redirect
+          return
+        }
+        const authzToken = await context.auth().authenticated()
+        if (authzToken == null) {
+          provideToken({ token: '' }, undefined)
+        } else {
+          await navigate()
+        }
+      })
+    }
+  }, [client])
+
+  return query.has(AUTH_QUERY)
+    ? <div>{t('loading')}</div>
+    : undefined
+})

package/src/components/index.ts

@@ -0,0 +1,2 @@
+
+export * from './dispatcher.js'

package/src/consts.ts

@@ -0,0 +1,8 @@
+
+export const DEFAULT_ALIAS = 'oidc-rp'
+
+export enum OidcAuthPurposes {
+  Unknown = 'unknown',
+  Subscribe = 'subscribe',
+  Login = 'login'
+}

package/src/guard.ts

@@ -0,0 +1,31 @@
+import type { OidcGuardOptions } from '@owlmeans/oidc'
+import type { Config, Context } from './types.js'
+import type { CommonModule } from '@owlmeans/module'
+import {
+  appendOidcGuard as appendBasicOidcGuard,
+  setupOidcGuard as setupBasicOidcGuard,
+  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT
+} from '@owlmeans/oidc'
+import { elevate } from '@owlmeans/web-client'
+import { DISPATCHER } from '@owlmeans/auth'
+import { handler } from '@owlmeans/client'
+import { Dispatcher } from './components/dispatcher.js'
+import { makeOidcAuthService } from './service.js'
+
+export const appendOidcGuard = <C extends Config, T extends Context<C>>(
+  context: T, opts?: OidcGuardOptions
+) => {
+  context.registerService(makeOidcAuthService())
+
+  const ctx = appendBasicOidcGuard<C, T>(context, opts)
+  
+  return ctx
+}
+
+export const setupOidcGuard = (modules: CommonModule[], coguards?: string | string[]) => {
+  setupBasicOidcGuard(modules, coguards)
+
+  elevate(modules, DISPATCHER_OIDC_INIT)
+  elevate(modules, DISPATCHER_OIDC)
+  elevate(modules, DISPATCHER, handler(Dispatcher), { force: true })
+}

package/src/index.ts

@@ -0,0 +1,6 @@
+
+export type * from './types.js'
+export * from './consts.js'
+export * from './service.js'
+export * from './guard.js'
+export * from './components/index.js'