@owlmeans/web-oidc-rp 0.1.1 → 0.1.3

package/src/auth/plugins/google-client.tsx

@@ -0,0 +1,94 @@
+
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { AuthenticationStage, CAUTHEN_AUTHEN_TYPED } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
+import type { AuthService } from '@owlmeans/auth-common'
+import { GOOGLE_CLIENT_AUTH } from '@owlmeans/oidc'
+import { useContext, useValue } from '@owlmeans/client'
+import { HOME } from '@owlmeans/web-client'
+import type { Module } from '@owlmeans/web-client'
+import { Progress } from '@/components/ui/progress'
+import { extractGoogleUrl, buildCallbackCredentials } from './helpers.js'
+
+export const googleClientPlugin: AuthenticationPlugin = {
+  type: GOOGLE_CLIENT_AUTH,
+
+  Implementation: Renderer => ({ type, stage, control }) => {
+    const context = useContext()
+    Renderer = Renderer ?? googleClientPlugin.Renderer
+
+    useValue(async cancel => {
+      switch (control.stage) {
+        case AuthenticationStage.Init: {
+          const hasState = await control.hasPersistentState()
+          if (cancel?.current) return
+
+          // Returning from Google redirect — restore state and authenticate
+          if (hasState) {
+            await control.restore()
+            await control.cleanUpState()
+
+            const url = new URL(window.location.href)
+            const code = url.searchParams.get('code')
+
+            if (code != null) {
+              const auth: AuthCredentials = buildCallbackCredentials(
+                url.searchParams.toString(),
+                type,
+                control.allowance?.challenge ?? '',
+              )
+
+              const token = await control.authenticate(auth)
+
+              if (token.token !== '') {
+                const authService = context.service<AuthService>(AUTH_SERVICE)
+                await authService.authenticate(token)
+              }
+
+              // Navigate to app root after successful authentication
+              const [homeUrl] = await context.module<Module<string>>(HOME).call({ full: true }) ?? []
+              window.location.href = homeUrl ?? window.location.origin
+
+              return
+            }
+          }
+
+          // Initial request — ask server for Google auth URL
+          const [source] = await context.module<Module<string>>(CAUTHEN_AUTHEN_TYPED).call({
+            full: true, params: { type }
+          }) ?? []
+          await control.requestAllowence({ type, source: source ?? '' })
+          break
+        }
+
+        case AuthenticationStage.Authenticate: {
+          if (cancel?.current) return
+
+          if (control.allowance?.challenge != null) {
+            // The server wraps challenge as "source:googleUrl" — extract the URL part
+            const [source] = await context.module<Module<string>>(CAUTHEN_AUTHEN_TYPED).call({
+              full: true, params: { type }
+            }) ?? []
+            const url = extractGoogleUrl(control.allowance.challenge, source ?? '')
+
+            // Persist control state before redirect
+            await control.persist()
+
+            // Redirect to Google
+            document.location.href = url
+          }
+          break
+        }
+      }
+    }, [type, stage])
+
+    if (Renderer == null) {
+      throw new SyntaxError('Renderer is not defined for Google plugin')
+    }
+
+    return <Renderer type={type} stage={stage} control={control} params={{}} />
+  },
+
+  Renderer: () => <Progress />
+}

package/src/auth/plugins/helpers.ts

@@ -0,0 +1,39 @@
+/**
+ * Pure helpers extracted from the Google client plugin for unit-testability.
+ * These perform the URL/challenge processing logic that doesn't depend on React.
+ */
+
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { AUTH_SCOPE, AuthRole } from '@owlmeans/auth'
+import type { AuthCredentials } from '@owlmeans/auth'
+
+/**
+ * Extract the Google auth URL from a signed challenge envelope message.
+ * The server wraps the challenge as "source:googleUrl" — this strips the source prefix.
+ * Also handles raw Google URLs (rolling deployment compatibility).
+ */
+export const extractGoogleUrl = (envelopeChallenge: string, sourcePrefix: string): string => {
+  const envelope = makeEnvelopeModel(envelopeChallenge, EnvelopeKind.Wrap)
+  const msg = envelope.message<string>(true)
+
+  if (msg.startsWith(sourcePrefix + ':')) {
+    return msg.slice(sourcePrefix.length + 1)
+  }
+  return msg
+}
+
+/**
+ * Build AuthCredentials from the Google callback URL query params.
+ */
+export const buildCallbackCredentials = (
+  queryString: string,
+  type: string,
+  challenge: string,
+): AuthCredentials => ({
+  type,
+  challenge,
+  credential: queryString,
+  role: AuthRole.User,
+  userId: 'code',
+  scopes: [AUTH_SCOPE],
+})

package/src/auth/plugins/index.ts

@@ -1,8 +1,10 @@
 
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
-import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
+import { OIDC_CLIENT_AUTH, GOOGLE_CLIENT_AUTH } from '@owlmeans/oidc'
 import { oidcClientPlugin } from './oidc-client.js'
+import { googleClientPlugin } from './google-client.js'
 
 authPlugins[OIDC_CLIENT_AUTH] = oidcClientPlugin
+authPlugins[GOOGLE_CLIENT_AUTH] = googleClientPlugin
 
 export const plugins = authPlugins

package/src/auth/plugins/oidc-client.tsx

@@ -4,7 +4,7 @@ import { AUTH_SCOPE, AuthenticationStage, AuthManagerError, AuthRole } from '@ow
 import type { AuthCredentials } from '@owlmeans/auth'
 import { OIDC_CLIENT_AUTH } from '@owlmeans/oidc'
 import { useEffect } from 'react'
-import LinearProgress from '@mui/material/LinearProgress'
+import { Progress } from '@/components/ui/progress'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import type { Config, Context, OidcAuthService } from '../../types.js'
 import { useContext } from '@owlmeans/web-client'
@@ -67,8 +67,11 @@ export const oidcClientPlugin: AuthenticationPlugin = {
             const oidc = context.service<OidcAuthService>(DEFAULT_ALIAS)
 
             // @TODO we need to provide an identity provider client as entityId here for flexibel usage
+            const flow = await control.flow()
+            const state = await flow?.state()
             const _source = await oidc.proceedToRedirectUrl({
               purpose: control.source as OidcAuthPurposes ?? OidcAuthPurposes.Unknown,
+              simplified: state?.payload().simplified as string,
               uid: 'uid' in module.params ? `${module.params.uid}` : undefined,
               alias: module.alias
             })
@@ -90,6 +93,7 @@ export const oidcClientPlugin: AuthenticationPlugin = {
               const envelope = makeEnvelopeModel(control.allowance?.challenge, EnvelopeKind.Wrap)
               const challenge = envelope.message<string>(true)
               const parts = challenge.split(':http')
+              // This thing includes url with flow state so the OIDC redirect it back a correct way
               const url = 'http' + parts[1]
 
               // 2. Include additional parameters (control state with allowance to flow state)
@@ -110,5 +114,5 @@ export const oidcClientPlugin: AuthenticationPlugin = {
     return <Renderer type={type} stage={stage} control={control} params={module.params} />
   },
 
-  Renderer: () => <LinearProgress />
+  Renderer: () => <Progress />
 }

package/src/guard.ts

@@ -1,16 +1,17 @@
+import { DISPATCHER } from '@owlmeans/auth'
+import { handler } from '@owlmeans/client'
+import type { CommonEntrypoint } from '@owlmeans/entrypoint'
 import type { OidcGuardOptions } from '@owlmeans/oidc'
-import type { Config, Context } from './types.js'
-import type { CommonModule } from '@owlmeans/module'
 import {
   appendOidcGuard as appendBasicOidcGuard,
-  setupOidcGuard as setupBasicOidcGuard,
-  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT
+  DISPATCHER_OIDC, DISPATCHER_OIDC_INIT,
+  setupOidcGuard as setupBasicOidcGuard
 } from '@owlmeans/oidc'
-import { elevate } from '@owlmeans/web-client'
-import { DISPATCHER } from '@owlmeans/auth'
-import { handler } from '@owlmeans/client'
+import type { ParametrisedProps } from '@owlmeans/web-client'
+import { elevate, parametriseDispatcher } from '@owlmeans/web-client'
 import { Dispatcher } from './components/dispatcher.js'
 import { makeOidcAuthService } from './service.js'
+import type { Config, Context } from './types.js'
 
 export const appendOidcGuard = <C extends Config, T extends Context<C>>(
   context: T, opts?: OidcGuardOptions
@@ -18,14 +19,16 @@ export const appendOidcGuard = <C extends Config, T extends Context<C>>(
   context.registerService(makeOidcAuthService())
 
   const ctx = appendBasicOidcGuard<C, T>(context, opts)
-  
+
   return ctx
 }
 
-export const setupOidcGuard = (modules: CommonModule[], coguards?: string | string[]) => {
+export const setupOidcGuard = (modules: CommonEntrypoint[], coguards?: string | string[], extras?: Partial<ParametrisedProps>) => {
+  const DispatcherCom = extras ? parametriseDispatcher(extras, Dispatcher) : Dispatcher
+
   setupBasicOidcGuard(modules, coguards)
 
   elevate(modules, DISPATCHER_OIDC_INIT)
   elevate(modules, DISPATCHER_OIDC)
-  elevate(modules, DISPATCHER, handler(Dispatcher), { force: true })
+  elevate(modules, DISPATCHER, handler(DispatcherCom), { force: true })
 }

package/src/service.ts

@@ -72,8 +72,12 @@ export const makeOidcAuthService = (alias: string = DEFAULT_ALIAS): OidcAuthServ
 
       const ctx = service.assertCtx<Config, Context>()
 
-      const [redirectTo] = await ctx.module<Module<string>>(DISPATCHER_OIDC_INIT)
+      let [redirectTo] = await ctx.module<Module<string>>(DISPATCHER_OIDC_INIT)
         .call({ body: params })
+
+      if (flow.payload().simplified === 'true') {
+        redirectTo += '&simplified=true'
+      }
       
       const context = service.assertCtx<Config, Context>()
       await store(context).save({ id: storeKey, authUrl: redirectTo })
@@ -91,12 +95,18 @@ export const makeOidcAuthService = (alias: string = DEFAULT_ALIAS): OidcAuthServ
       }
 
       const authorityTransition = flowModel.next()
-      flowModel.transit(authorityTransition.transition, true, { purpose: extras.purpose })
+      flowModel.transit(authorityTransition.transition, true, { 
+        purpose: extras.purpose,
+        simplified: extras.simplified,
+      })
 
       // @TODO I'm not sure that this dirty hack is a correct approach
       if (extras.alias === HOME) {
         const redirectTransition = flowModel.next()
-        flowModel.transit(redirectTransition.transition, true, { purpose: extras.purpose })
+        flowModel.transit(redirectTransition.transition, true, { 
+          purpose: extras.purpose,
+          simplified: extras.simplified
+        })
       }
 
       const redirectUrl = await flow.proceed({ params: { uid: extras.uid } }, true)

package/src/types.ts

@@ -4,6 +4,7 @@ import type { OIDCAuthInitParams, WithSharedConfig } from '@owlmeans/oidc'
 import type { OidcAuthPurposes } from './consts.js'
 import type { FlowModel, FlowPayload } from '@owlmeans/flow'
 import type { ResourceRecord } from '@owlmeans/resource'
+import type { AuthToken } from '@owlmeans/auth'
 
 export interface OidcAuthService extends InitializedService {
   dispatch: (params: Record<string, string>) => Promise<boolean>
@@ -19,10 +20,16 @@ export interface OidcAuthService extends InitializedService {
 
 export interface OidcAuthRedirectExtras extends FlowPayload {
   purpose: OidcAuthPurposes
+  simplified?: string
   uid?: string
   alias?: string
 }
 
+export interface OidcPostAuthPayload extends FlowPayload , AuthToken {
+  purpose: OidcAuthPurposes
+  simplified?: string
+}
+
 export interface Config extends AppConfig, WithSharedConfig { }
 
 export interface Context<C extends Config = Config> extends AppContext<C> { }

package/tests/context.ts

@@ -0,0 +1,16 @@
+import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+
+export const makeTestContext = () => {
+  const cfg: BasicConfig = {
+    ready: false,
+    service: 'web-oidc-rp-tests',
+    layer: Layer.Application,
+    type: AppType.Frontend,
+    services: {},
+  }
+
+  const context = makeBasicContext(cfg) as BasicContext<BasicConfig>
+
+  return context
+}

package/tests/google-client.spec.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from 'bun:test'
+import { extractGoogleUrl, buildCallbackCredentials } from '../src/auth/plugins/helpers.js'
+import { AUTH_SCOPE, AuthRole } from '@owlmeans/auth'
+import { makeFixtureKeyPair, signMockEnvelope } from '@owlmeans/test-auth'
+import { EnvelopeKind } from '@owlmeans/basic-envelope'
+
+describe('@owlmeans/web-oidc-rp — extractGoogleUrl', () => {
+  test('strips source prefix from envelope message', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&state=xyz'
+    const source = 'https://example.com/auth'
+    const challengeMsg = `${source}:${googleUrl}`
+    // Create a signed envelope wrapping the prefixed URL
+    const envelope = await signMockEnvelope(challengeMsg, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, source)
+
+    expect(result).toBe(googleUrl)
+  })
+
+  test('handles raw URL without source prefix', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test-2')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc&state=xyz'
+    const envelope = await signMockEnvelope(googleUrl, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, 'https://different.example.com')
+
+    expect(result).toBe(googleUrl)
+  })
+
+  test('handles empty source prefix', async () => {
+    const kp = makeFixtureKeyPair('web-oidc-test-3')
+    const googleUrl = 'https://accounts.google.com/o/oauth2/v2/auth?client_id=abc'
+    const envelope = await signMockEnvelope(googleUrl, 'string', EnvelopeKind.Wrap, kp)
+
+    const result = extractGoogleUrl(envelope, '')
+
+    expect(result).toBe(googleUrl)
+  })
+})
+
+describe('@owlmeans/web-oidc-rp — buildCallbackCredentials', () => {
+  test('builds AuthCredentials from query params', () => {
+    const queryString = 'code=4/0abc123&state=test-state-xyz&scope=openid+email'
+    const type = 'google-oauth'
+    const challenge = 'stored-challenge-value'
+
+    const creds = buildCallbackCredentials(queryString, type, challenge)
+
+    expect(creds.type).toBe('google-oauth')
+    expect(creds.challenge).toBe('stored-challenge-value')
+    expect(creds.credential).toBe(queryString)
+    expect(creds.role).toBe(AuthRole.User)
+    expect(creds.userId).toBe('code')
+    expect(creds.scopes).toEqual([AUTH_SCOPE])
+  })
+
+  test('works with empty challenge', () => {
+    const creds = buildCallbackCredentials('code=x&state=y', 'google-oauth', '')
+
+    expect(creds.challenge).toBe('')
+    expect(creds.credential).toBe('code=x&state=y')
+  })
+})

package/tests/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.react.json"
+  ],
+  "compilerOptions": {
+    "types": ["bun"],
+    "rootDir": "../",
+    "noEmit": true
+  },
+  "include": ["./**/*", "../src/**/*"]
+}

package/tsconfig.json

@@ -1,16 +1,14 @@
 {
   "extends": [
-    "../tsconfig.default.json",
-    "../tsconfig.react.json",
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.react.json"
   ],
   "compilerOptions": {
-    "rootDir": "./src/", /* Specify the root folder within your source files. */
-    "outDir": "./build/", /* Specify an output folder for all emitted files. */
-    "moduleResolution": "Bundler",
+    "paths": {
+      "@/*": ["./src/@/*"]
+    },
+    "rootDir": "./src/",
+    "outDir": "./build/"
   },
-  "exclude": [
-    "./dist/**/*",
-    "./build/**/*",
-    "./*.ts"
-  ]
-}
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}