@platform-mesh/portal-server-lib 0.9.94 → 0.9.96

package/dist/portal-options/logout-callback.service.js

@@ -30,26 +30,34 @@ let PMLogoutService = PMLogoutService_1 = class PMLogoutService {
         try {
             const refreshToken = this.cookiesService.getAuthCookie(request);
             const body = new URLSearchParams({
-                client_id: authConfig.clientId,
-                client_secret: authConfig.clientSecret,
                 refresh_token: refreshToken,
             });
             await firstValueFrom(this.httpService.post(authConfig.endSessionUrl, body, {
                 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                auth: {
+                    username: authConfig.clientId,
+                    password: authConfig.clientSecret,
+                },
             }));
         }
         catch (error) {
             this.logger.error('Error during keycloak logout', error?.response?.data || error.message);
             this.logger.warn('Trying to log out with the id token');
-            return this.logoutWithIdToken(request, authConfig.endSessionUrl);
+            return this.logoutWithIdToken(request, authConfig.endSessionUrl, authConfig.clientId);
         }
     }
-    logoutWithIdToken(request, endSessionUrl) {
+    logoutWithIdToken(request, endSessionUrl, clientId) {
         const { id_token_hint, post_logout_redirect_uri } = request.query;
-        const params = new URLSearchParams({
-            id_token_hint: String(id_token_hint || ''),
-            post_logout_redirect_uri: String(post_logout_redirect_uri || ''),
-        });
+        const params = new URLSearchParams();
+        if (id_token_hint) {
+            params.set('id_token_hint', String(id_token_hint));
+        }
+        else {
+            params.set('client_id', clientId);
+        }
+        if (post_logout_redirect_uri) {
+            params.set('post_logout_redirect_uri', String(post_logout_redirect_uri));
+        }
         return `${endSessionUrl}?${params}`;
     }
 };

package/dist/portal-options/logout-callback.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-callback.service.js","sourceRoot":"","sources":["../../src/portal-options/logout-callback.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAE3B,cAAc,GAEf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAG/B,IAAM,eAAe,uBAArB,MAAM,eAAe;IAKhB;IACA;IACA;IANF,MAAM,GAAW,IAAI,MAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE1D,YAEU,iBAAoC,EACpC,WAAwB,EACxB,cAA8B;QAF9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;QACxB,mBAAc,GAAd,cAAc,CAAgB;IACrC,CAAC;IAEG,KAAK,CAAC,YAAY,CACvB,OAAgB,EAChB,QAAkB;QAElB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAEhE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,SAAS,EAAE,UAAU,CAAC,QAAQ;gBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;gBACtC,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YAEH,MAAM,cAAc,CAClB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,EAAE;gBACpD,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;aACjE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,EAC9B,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,OAAO,CACvC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,OAAgB,EAAE,aAAqB;QAC/D,MAAM,EAAE,aAAa,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;YAC1C,wBAAwB,EAAE,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,OAAO,GAAG,aAAa,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;CACF,CAAA;AA/CY,eAAe;IAD3B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,2BAA2B,CAAC,CAAA;6CAEf,WAAW;QACR,cAAc;GAP7B,eAAe,CA+C3B"}
+{"version":3,"file":"logout-callback.service.js","sourceRoot":"","sources":["../../src/portal-options/logout-callback.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EACL,2BAA2B,EAE3B,cAAc,GAEf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAG/B,IAAM,eAAe,uBAArB,MAAM,eAAe;IAKhB;IACA;IACA;IANF,MAAM,GAAW,IAAI,MAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE1D,YAEU,iBAAoC,EACpC,WAAwB,EACxB,cAA8B;QAF9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;QACxB,mBAAc,GAAd,cAAc,CAAgB;IACrC,CAAC;IAEG,KAAK,CAAC,YAAY,CACvB,OAAgB,EAChB,QAAkB;QAElB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAEhE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;gBAC/B,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC;YAMH,MAAM,cAAc,CAClB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,EAAE;gBACpD,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE;oBACJ,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,YAAY;iBAClC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,EAC9B,KAAK,EAAE,QAAQ,EAAE,IAAI,IAAI,KAAK,CAAC,OAAO,CACvC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,iBAAiB,CAC3B,OAAO,EACP,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,QAAQ,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,OAAgB,EAChB,aAAqB,EACrB,QAAgB;QAEhB,MAAM,EAAE,aAAa,EAAE,wBAAwB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAMrC,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,wBAAwB,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,GAAG,aAAa,IAAI,MAAM,EAAE,CAAC;IACtC,CAAC;CACF,CAAA;AAzEY,eAAe;IAD3B,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,2BAA2B,CAAC,CAAA;6CAEf,WAAW;QACR,cAAc;GAP7B,eAAe,CAyE3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platform-mesh/portal-server-lib",
-  "version": "0.9.94",
+  "version": "0.9.96",
   "author": "Platform Mesh",
   "license": "Apache-2.0",
   "publishConfig": {

package/src/portal-options/logout-callback.service.spec.ts

@@ -63,10 +63,36 @@ describe('PMLogoutService', () => {
     expect(httpService.post).toHaveBeenCalledWith(
       'https://keycloak/logout',
       expect.any(URLSearchParams),
-      { headers: { 'Content-Type': 'application/x-www-form-urlencoded' } },
+      {
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        auth: { username: 'client-id', password: 'secret' },
+      },
     );
   });
 
+  it('should not send the client secret as a form parameter', async () => {
+    const mockRequest = {} as Request;
+    const mockResponse = {} as Response;
+
+    (authConfigService.getAuthConfig as jest.Mock).mockResolvedValue({
+      clientId: 'client-id',
+      clientSecret: 'secret',
+      endSessionUrl: 'https://keycloak/logout',
+    });
+    (cookiesService.getAuthCookie as jest.Mock).mockReturnValue(
+      'refresh-token',
+    );
+    (httpService.post as jest.Mock).mockReturnValue(of({ data: {} }));
+
+    await service.handleLogout(mockRequest, mockResponse);
+
+    const body = (httpService.post as jest.Mock).mock
+      .calls[0][1] as URLSearchParams;
+    expect(body.get('refresh_token')).toBe('refresh-token');
+    expect(body.get('client_secret')).toBeNull();
+    expect(body.get('client_id')).toBeNull();
+  });
+
   it('should return logoutWithIdToken URL when logout fails', async () => {
     const mockRequest = {
       query: {
@@ -105,9 +131,39 @@ describe('PMLogoutService', () => {
     const result = (service as any).logoutWithIdToken(
       request,
       'https://kc/logout',
+      'client-id',
     );
     expect(result).toBe(
       'https://kc/logout?id_token_hint=token123&post_logout_redirect_uri=https%3A%2F%2Fexample.com',
     );
   });
+
+  it('logoutWithIdToken should fall back to client_id when no id token is present', () => {
+    const request = {
+      query: { post_logout_redirect_uri: 'https://example.com' },
+    } as unknown as Request;
+
+    const result = (service as any).logoutWithIdToken(
+      request,
+      'https://kc/logout',
+      'client-id',
+    );
+
+    expect(result).toBe(
+      'https://kc/logout?client_id=client-id&post_logout_redirect_uri=https%3A%2F%2Fexample.com',
+    );
+    expect(result).not.toContain('id_token_hint');
+  });
+
+  it('logoutWithIdToken should omit an absent post logout redirect uri', () => {
+    const request = { query: {} } as unknown as Request;
+
+    const result = (service as any).logoutWithIdToken(
+      request,
+      'https://kc/logout',
+      'client-id',
+    );
+
+    expect(result).toBe('https://kc/logout?client_id=client-id');
+  });
 });

package/src/portal-options/logout-callback.service.ts

@@ -29,14 +29,20 @@ export class PMLogoutService implements LogoutCallback {
       const refreshToken = this.cookiesService.getAuthCookie(request);
 
       const body = new URLSearchParams({
-        client_id: authConfig.clientId,
-        client_secret: authConfig.clientSecret,
         refresh_token: refreshToken,
       });
 
+      // Client credentials go in the Authorization header, not the form body:
+      // the client is registered with token_endpoint_auth_method
+      // client_secret_basic, and an IdP that enforces it rejects credentials
+      // sent as form parameters with unauthorized_client.
       await firstValueFrom(
         this.httpService.post(authConfig.endSessionUrl, body, {
           headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          auth: {
+            username: authConfig.clientId,
+            password: authConfig.clientSecret,
+          },
         }),
       );
     } catch (error: any) {
@@ -45,16 +51,36 @@ export class PMLogoutService implements LogoutCallback {
         error?.response?.data || error.message,
       );
       this.logger.warn('Trying to log out with the id token');
-      return this.logoutWithIdToken(request, authConfig.endSessionUrl);
+      return this.logoutWithIdToken(
+        request,
+        authConfig.endSessionUrl,
+        authConfig.clientId,
+      );
     }
   }
 
-  private logoutWithIdToken(request: Request, endSessionUrl: string) {
+  private logoutWithIdToken(
+    request: Request,
+    endSessionUrl: string,
+    clientId: string,
+  ) {
     const { id_token_hint, post_logout_redirect_uri } = request.query;
-    const params = new URLSearchParams({
-      id_token_hint: String(id_token_hint || ''),
-      post_logout_redirect_uri: String(post_logout_redirect_uri || ''),
-    });
+    const params = new URLSearchParams();
+
+    // RP-initiated logout honours post_logout_redirect_uri only together with
+    // id_token_hint or client_id. An empty id_token_hint is not a no-op: the
+    // IdP rejects the request ("Missing parameters: id_token_hint") and the
+    // user is stranded on an error page instead of being signed out.
+    if (id_token_hint) {
+      params.set('id_token_hint', String(id_token_hint));
+    } else {
+      params.set('client_id', clientId);
+    }
+
+    if (post_logout_redirect_uri) {
+      params.set('post_logout_redirect_uri', String(post_logout_redirect_uri));
+    }
+
     return `${endSessionUrl}?${params}`;
   }
 }