@quanticjs/auth-web-bff 5.0.0 → 5.2.0

package/dist/bff.controller.d.ts

@@ -1,8 +1,10 @@
 import { Request, Response } from 'express';
 import { BffService } from './bff.service';
+import { type BffModuleOptions } from './interfaces';
 export declare class BffController {
     private readonly bffService;
-    constructor(bffService: BffService);
+    private readonly callbackPath;
+    constructor(bffService: BffService, options: BffModuleOptions);
     login(returnTo: string, res: Response): void;
     callback(code: string, state: string, req: Request, res: Response): Promise<void>;
     refresh(req: Request, res: Response): Promise<void>;

package/dist/bff.controller.js

@@ -17,18 +17,21 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const core_1 = require("@quanticjs/core");
 const bff_service_1 = require("./bff.service");
+const interfaces_1 = require("./interfaces");
 const VERIFIER_COOKIE = 'pkce_verifier';
 let BffController = class BffController {
     bffService;
-    constructor(bffService) {
+    callbackPath;
+    constructor(bffService, options) {
         this.bffService = bffService;
+        this.callbackPath = options.callbackPath ?? '/api/auth/callback';
     }
     login(returnTo, res) {
         const { url, codeVerifier } = this.bffService.getAuthorizationUrl(returnTo);
         res.cookie(VERIFIER_COOKIE, codeVerifier, {
             httpOnly: true,
             sameSite: 'lax',
-            path: '/auth/callback',
+            path: this.callbackPath,
             maxAge: 5 * 60 * 1000,
         });
         res.redirect(url);
@@ -36,20 +39,27 @@ let BffController = class BffController {
     async callback(code, state, req, res) {
         const codeVerifier = req.cookies?.[VERIFIER_COOKIE];
         if (!codeVerifier || !code) {
-            res.redirect('/auth/login');
+            res.redirect('/api/auth/login');
             return;
         }
-        res.clearCookie(VERIFIER_COOKIE, { path: '/auth/callback' });
+        res.clearCookie(VERIFIER_COOKIE, { path: this.callbackPath });
         try {
             const { sessionId, returnTo } = await this.bffService.handleCallback(code, state, codeVerifier);
             res.cookie(this.bffService.getCookieName(), sessionId, this.bffService.getCookieOptions());
+            res.cookie(this.bffService.getCsrfCookieName(), this.bffService.generateCsrfToken(), this.bffService.getCsrfCookieOptions());
             res.redirect(returnTo);
         }
         catch {
-            res.redirect('/auth/login?error=callback_failed');
+            res.redirect('/api/auth/login?error=callback_failed');
         }
     }
     async refresh(req, res) {
+        const csrfHeader = req.headers['x-csrf-token'];
+        const csrfCookie = req.cookies?.[this.bffService.getCsrfCookieName()];
+        if (!this.bffService.validateCsrf(csrfHeader, csrfCookie)) {
+            res.status(403).json({ message: 'Invalid CSRF token' });
+            return;
+        }
         const sessionId = req.cookies?.[this.bffService.getCookieName()];
         if (!sessionId) {
             res.status(401).json({ message: 'No session' });
@@ -63,12 +73,21 @@ let BffController = class BffController {
         res.json({ success: true });
     }
     async logout(req, res) {
+        const csrfHeader = req.headers['x-csrf-token'];
+        const csrfCookie = req.cookies?.[this.bffService.getCsrfCookieName()];
+        if (!this.bffService.validateCsrf(csrfHeader, csrfCookie)) {
+            res.status(403).json({ message: 'Invalid CSRF token' });
+            return;
+        }
         const cookieName = this.bffService.getCookieName();
         const sessionId = req.cookies?.[cookieName];
         if (sessionId) {
             await this.bffService.destroySession(sessionId);
         }
-        res.clearCookie(cookieName, this.bffService.getCookieOptions()).json({ success: true });
+        res
+            .clearCookie(cookieName, this.bffService.getCookieOptions())
+            .clearCookie(this.bffService.getCsrfCookieName(), this.bffService.getCsrfCookieOptions())
+            .json({ success: true });
     }
     async me(req, res) {
         const cookieName = this.bffService.getCookieName();
@@ -143,5 +162,6 @@ __decorate([
 exports.BffController = BffController = __decorate([
     (0, swagger_1.ApiTags)('auth'),
     (0, common_1.Controller)('auth'),
-    __metadata("design:paramtypes", [bff_service_1.BffService])
+    __param(1, (0, common_1.Inject)(interfaces_1.BFF_OPTIONS)),
+    __metadata("design:paramtypes", [bff_service_1.BffService, Object])
 ], BffController);

package/dist/bff.service.d.ts

@@ -10,6 +10,7 @@ export declare class BffService implements OnModuleInit {
     private readonly sessionTtl;
     private readonly sessionPrefix;
     private readonly cookieName;
+    private readonly csrfCookieName;
     constructor(options: BffModuleOptions, redis: Redis | undefined);
     onModuleInit(): Promise<void>;
     getAuthorizationUrl(returnTo?: string): {
@@ -27,6 +28,10 @@ export declare class BffService implements OnModuleInit {
     getUserInfo(sessionId: string): Promise<Record<string, unknown> | null>;
     getCookieOptions(): Record<string, unknown>;
     getCookieName(): string;
+    getCsrfCookieName(): string;
+    getCsrfCookieOptions(): Record<string, unknown>;
+    generateCsrfToken(): string;
+    validateCsrf(headerValue: string | undefined, cookieValue: string | undefined): boolean;
     private saveSession;
     private toPublicKeycloakUrl;
     private getCallbackUrl;

package/dist/bff.service.js

@@ -16,6 +16,7 @@ exports.BffService = void 0;
 const common_1 = require("@nestjs/common");
 const openid_client_1 = require("openid-client");
 const uuid_1 = require("uuid");
+const crypto_1 = require("crypto");
 const core_1 = require("@quanticjs/core");
 const interfaces_1 = require("./interfaces");
 function extractRealmRoles(accessToken) {
@@ -38,12 +39,14 @@ let BffService = class BffService {
     sessionTtl;
     sessionPrefix;
     cookieName;
+    csrfCookieName;
     constructor(options, redis) {
         this.options = options;
         this.redis = redis;
         this.sessionTtl = options.session?.ttlSeconds ?? 7 * 24 * 3600;
         this.sessionPrefix = options.session?.prefix ?? 'session:';
-        this.cookieName = options.session?.cookieName ?? 'sid';
+        this.cookieName = options.session?.cookieName ?? '__Host-sid';
+        this.csrfCookieName = options.csrf?.cookieName ?? '__Host-csrf';
     }
     async onModuleInit() {
         const { keycloak } = this.options;
@@ -166,7 +169,7 @@ let BffService = class BffService {
         return {
             httpOnly: true,
             secure: process.env.NODE_ENV === 'production',
-            sameSite: 'lax',
+            sameSite: 'strict',
             path: '/',
             maxAge: this.sessionTtl * 1000,
         };
@@ -174,6 +177,24 @@ let BffService = class BffService {
     getCookieName() {
         return this.cookieName;
     }
+    getCsrfCookieName() {
+        return this.csrfCookieName;
+    }
+    getCsrfCookieOptions() {
+        return {
+            httpOnly: false,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'strict',
+            path: '/',
+            maxAge: this.sessionTtl * 1000,
+        };
+    }
+    generateCsrfToken() {
+        return (0, crypto_1.randomBytes)(32).toString('base64url');
+    }
+    validateCsrf(headerValue, cookieValue) {
+        return !!headerValue && !!cookieValue && headerValue === cookieValue;
+    }
     async saveSession(sessionId, data) {
         if (!this.redis)
             throw new Error('Redis not available');
@@ -185,7 +206,7 @@ let BffService = class BffService {
         return url.replace(this.internalKeycloakBase, this.publicKeycloakBase);
     }
     getCallbackUrl() {
-        const callbackPath = this.options.callbackPath ?? '/auth/callback';
+        const callbackPath = this.options.callbackPath ?? '/api/auth/callback';
         return `${this.options.publicUrl}${callbackPath}`;
     }
 };

package/dist/interfaces.d.ts

@@ -11,6 +11,9 @@ export interface BffModuleOptions {
         cookieName?: string;
         prefix?: string;
     };
+    csrf?: {
+        cookieName?: string;
+    };
     publicUrl: string;
     callbackPath?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quanticjs/auth-web-bff",
-  "version": "5.0.0",
+  "version": "5.2.0",
   "description": "BFF authentication module — Keycloak OIDC, Redis sessions, httpOnly cookies",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,7 +9,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@quanticjs/core": "^5.0.0"
+    "@quanticjs/core": "^5.2.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",