@svadmin/sso 0.9.0 → 0.11.0

package/src/auth-provider.ts

@@ -1,485 +0,0 @@
-/**
- * @svadmin/sso — OIDC/OAuth2 SSO AuthProvider for svadmin.
- *
- * Supports any OIDC-compliant Identity Provider:
- * - Okta
- * - Azure AD / Entra ID
- * - Amazon Cognito
- * - Keycloak
- * - Google Workspace
- * - Auth0
- * - Any custom OIDC server
- *
- * Uses the Authorization Code Flow with PKCE (no client secret needed in browser).
- *
- * @example
- * ```ts
- * import { createSSOAuthProvider } from '@svadmin/sso';
- * import { setAuthProvider } from '@svadmin/core';
-
-
- *
- * const authProvider = createSSOAuthProvider({
- *   issuer: 'https://your-tenant.okta.com',
- *   clientId: 'your-client-id',
- *   redirectUri: window.location.origin + '/callback',
- * });
- *
- * setAuthProvider(authProvider);
- * ```
- */
-
-import type { AuthProvider, Identity } from '@svadmin/core';
-
-// Safe base64url decode for JWT payloads
-function decodeJwtPayload(token: string): Record<string, unknown> | null {
-  if (!token) return null;
-  const parts = token.split('.');
-  if (parts.length < 2) return null;
-  const payloadStr = parts[1];
-  const padded = payloadStr + '='.repeat((4 - (payloadStr.length % 4)) % 4);
-  const binString = atob(padded.replace(/-/g, '+').replace(/_/g, '/'));
-  const bytes = Uint8Array.from(binString, (m) => m.codePointAt(0) ?? 0);
-  return JSON.parse(new TextDecoder().decode(bytes));
-}
-
-
-// ─── Types ────────────────────────────────────────────────────
-
-export interface SSOConfig {
-  /** OIDC Issuer URL (e.g., 'https://your-tenant.okta.com') */
-  issuer: string;
-  /** OAuth2 Client ID */
-  clientId: string;
-  /** Redirect URI after login (e.g., '/callback') */
-  redirectUri: string;
-  /** OAuth2 scopes. Default: ['openid', 'profile', 'email'] */
-  scopes?: string[];
-  /** Where to redirect after logout */
-  postLogoutRedirectUri?: string;
-  /** Token storage backend. Default: 'local' (localStorage) */
-  storage?: 'local' | 'session' | TokenStorage;
-  /** Custom identity mapper — transform OIDC userinfo to svadmin Identity */
-  mapIdentity?: (userinfo: Record<string, unknown>) => Identity;
-  /** Auto-refresh tokens before expiry. Default: true */
-  autoRefresh?: boolean;
-  /** Seconds before expiry to trigger refresh. Default: 60 */
-  refreshBuffer?: number;
-  /** Additional authorization request parameters, e.g. audience or prompt. */
-  authorizationParams?: Record<string, string>;
-  /**
-   * Manual OAuth2 endpoints for providers that don't support OIDC discovery
-   * (e.g., GitHub). When provided, OIDC auto-discovery is skipped.
-   */
-  manualEndpoints?: {
-    authorization_endpoint: string;
-    token_endpoint: string;
-    userinfo_endpoint: string;
-    end_session_endpoint?: string;
-  };
-}
-
-export interface TokenStorage {
-  getItem: (key: string) => string | null;
-  setItem: (key: string, value: string) => void;
-  removeItem: (key: string) => void;
-}
-
-export interface SSOAuthProvider extends AuthProvider {
-  getAccessToken: () => Promise<string | null>;
-}
-
-interface OIDCConfig {
-  authorization_endpoint: string;
-  token_endpoint: string;
-  userinfo_endpoint: string;
-  end_session_endpoint?: string;
-}
-
-interface TokenSet {
-  access_token: string;
-  id_token?: string;
-  refresh_token?: string;
-  expires_at?: number;
-  token_type: string;
-}
-
-// ─── PKCE Utilities ───────────────────────────────────────────
-
-function generateRandomString(length: number): string {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
-  const values = crypto.getRandomValues(new Uint8Array(length));
-  return Array.from(values, (v) => chars[v % chars.length]).join('');
-}
-
-async function sha256(plain: string): Promise<ArrayBuffer> {
-  const encoder = new TextEncoder();
-  return crypto.subtle.digest('SHA-256', encoder.encode(plain));
-}
-
-function base64urlEncode(buffer: ArrayBuffer): string {
-  const bytes = new Uint8Array(buffer);
-  let binary = '';
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-
-async function createPKCEChallenge(): Promise<{ verifier: string; challenge: string }> {
-  const verifier = generateRandomString(64);
-  const hashed = await sha256(verifier);
-  const challenge = base64urlEncode(hashed);
-  return { verifier, challenge };
-}
-
-// ─── Storage Helper ───────────────────────────────────────────
-
-const STORAGE_PREFIX = 'svadmin_sso_';
-
-function getStorage(config: SSOConfig): TokenStorage {
-  if (config.storage && typeof config.storage === 'object') return config.storage;
-  return {
-    getItem: (key) => typeof window !== 'undefined' ? (config.storage === 'session' ? sessionStorage : localStorage).getItem(key) : null,
-    setItem: (key, value) => { if (typeof window !== 'undefined') (config.storage === 'session' ? sessionStorage : localStorage).setItem(key, value); },
-    removeItem: (key) => { if (typeof window !== 'undefined') (config.storage === 'session' ? sessionStorage : localStorage).removeItem(key); },
-  };
-}
-
-// ─── Provider ─────────────────────────────────────────────────
-
-/**
- * Create an OIDC/OAuth2 SSO AuthProvider.
- */
-export function createSSOAuthProvider(config: SSOConfig): SSOAuthProvider {
-  const scopes = config.scopes ?? ['openid', 'profile', 'email'];
-  const autoRefresh = config.autoRefresh ?? true;
-  const refreshBuffer = config.refreshBuffer ?? 60;
-  const storage = getStorage(config);
-
-  let oidcConfig: OIDCConfig | null = null;
-  let refreshTimer: ReturnType<typeof setTimeout> | null = null;
-
-  // ── OIDC Discovery ───────────────────────────────────────
-
-  async function discover(): Promise<OIDCConfig> {
-    if (oidcConfig) return oidcConfig;
-
-    // Use manual endpoints if provided (e.g., GitHub)
-    if (config.manualEndpoints) {
-      oidcConfig = config.manualEndpoints;
-      return oidcConfig;
-    }
-
-    const url = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`OIDC discovery failed: ${res.status} ${res.statusText}`);
-    oidcConfig = await res.json() as OIDCConfig;
-    return oidcConfig;
-  }
-
-  // ── Token Management ─────────────────────────────────────
-
-  function getTokens(): TokenSet | null {
-    const raw = storage.getItem(`${STORAGE_PREFIX}tokens`);
-    if (!raw) return null;
-    try { return JSON.parse(raw) as TokenSet; }
-    catch { return null; }
-  }
-
-  function setTokens(tokens: TokenSet): void {
-    storage.setItem(`${STORAGE_PREFIX}tokens`, JSON.stringify(tokens));
-    if (autoRefresh && tokens.refresh_token && tokens.expires_at) {
-      scheduleRefresh(tokens);
-    }
-  }
-
-  function clearTokens(): void {
-    storage.removeItem(`${STORAGE_PREFIX}tokens`);
-    storage.removeItem(`${STORAGE_PREFIX}pkce_verifier`);
-    storage.removeItem(`${STORAGE_PREFIX}state`);
-    if (refreshTimer) clearTimeout(refreshTimer);
-  }
-
-  function scheduleRefresh(tokens: TokenSet): void {
-    if (refreshTimer) clearTimeout(refreshTimer);
-    if (!tokens.expires_at || !tokens.refresh_token) return;
-    const now = Math.floor(Date.now() / 1000);
-    const delay = Math.max(0, (tokens.expires_at - now - refreshBuffer)) * 1000;
-    const refreshToken = tokens.refresh_token;
-    refreshTimer = setTimeout(() => refreshAccessToken(refreshToken), delay);
-  }
-
-  async function refreshAccessToken(refreshToken: string): Promise<void> {
-    try {
-      const cfg = await discover();
-      const body = new URLSearchParams({
-        grant_type: 'refresh_token',
-        client_id: config.clientId,
-        refresh_token: refreshToken,
-      });
-      const res = await fetch(cfg.token_endpoint, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body,
-      });
-      if (!res.ok) { clearTokens(); return; }
-      const data = await res.json();
-      if (!data.access_token) {
-        clearTokens();
-        return;
-      }
-      const newTokens: TokenSet = {
-        access_token: data.access_token,
-        id_token: data.id_token,
-        refresh_token: data.refresh_token ?? refreshToken,
-        expires_at: data.expires_in ? Math.floor(Date.now() / 1000) + data.expires_in : undefined,
-        token_type: data.token_type ?? 'Bearer',
-      };
-      setTokens(newTokens);
-    } catch {
-      clearTokens();
-    }
-  }
-
-  // ── Token Exchange ───────────────────────────────────────
-
-  async function exchangeCode(code: string): Promise<TokenSet> {
-    const cfg = await discover();
-    const verifier = storage.getItem(`${STORAGE_PREFIX}pkce_verifier`);
-    const body = new URLSearchParams({
-      grant_type: 'authorization_code',
-      client_id: config.clientId,
-      code,
-      redirect_uri: config.redirectUri,
-      ...(verifier ? { code_verifier: verifier } : {}),
-    });
-    const res = await fetch(cfg.token_endpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body,
-    });
-    if (!res.ok) throw new Error(`Token exchange failed: ${res.status}`);
-    const data = await res.json();
-    if (!data.access_token) throw new Error('Token exchange failed: missing access_token');
-    const tokens: TokenSet = {
-      access_token: data.access_token,
-      id_token: data.id_token,
-      refresh_token: data.refresh_token,
-      expires_at: data.expires_in ? Math.floor(Date.now() / 1000) + data.expires_in : undefined,
-      token_type: data.token_type ?? 'Bearer',
-    };
-    setTokens(tokens);
-    storage.removeItem(`${STORAGE_PREFIX}pkce_verifier`);
-    storage.removeItem(`${STORAGE_PREFIX}state`);
-    return tokens;
-  }
-
-  // ── Default Identity Mapper ──────────────────────────────
-
-  function defaultMapIdentity(userinfo: Record<string, unknown>): Identity {
-    return {
-      id: (userinfo.sub as string) ?? '',
-      name: (userinfo.name as string) ?? (userinfo.preferred_username as string) ?? '',
-      avatar: (userinfo.picture as string) ?? undefined,
-      email: (userinfo.email as string) ?? undefined,
-    };
-  }
-
-  const mapIdentity = config.mapIdentity ?? defaultMapIdentity;
-
-  // ── AuthProvider Implementation ──────────────────────────
-
-  return {
-    async login() {
-      if (typeof window === 'undefined') {
-        return { success: false, error: { message: 'SSO login requires a browser environment' } };
-      }
-      try {
-        const cfg = await discover();
-        const { verifier, challenge } = await createPKCEChallenge();
-        const state = generateRandomString(32);
-
-        storage.setItem(`${STORAGE_PREFIX}pkce_verifier`, verifier);
-        storage.setItem(`${STORAGE_PREFIX}state`, state);
-
-        const params = new URLSearchParams({
-          response_type: 'code',
-          client_id: config.clientId,
-          redirect_uri: config.redirectUri,
-          scope: scopes.join(' '),
-          state,
-          code_challenge: challenge,
-          code_challenge_method: 'S256',
-          ...config.authorizationParams,
-        });
-
-        // Redirect to authorization endpoint
-        window.location.href = `${cfg.authorization_endpoint}?${params}`;
-
-        // Won't actually reach here due to redirect
-        return { success: true };
-      } catch (err) {
-        return { success: false, error: { message: err instanceof Error ? err.message : 'SSO login failed' } };
-      }
-    },
-
-    async logout() {
-      const cfg = await discover();
-      const tokens = getTokens();
-      clearTokens();
-
-      if (typeof window !== 'undefined' && cfg.end_session_endpoint && tokens?.id_token) {
-        const params = new URLSearchParams({
-          id_token_hint: tokens.id_token,
-          ...(config.postLogoutRedirectUri
-            ? { post_logout_redirect_uri: config.postLogoutRedirectUri }
-            : {}),
-        });
-        window.location.href = `${cfg.end_session_endpoint}?${params}`;
-        return { success: true };
-      }
-
-      return {
-        success: true,
-        redirectTo: config.postLogoutRedirectUri ?? '/',
-      };
-    },
-
-    async check() {
-      // SSR: no tokens, no callback — return unauthenticated
-      if (typeof window === 'undefined') {
-        const tokens = getTokens();
-        if (tokens && (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1000))) {
-          return { authenticated: true };
-        }
-        return { authenticated: false, logout: true };
-      }
-
-      // Handle callback — exchange authorization code for tokens
-      const url = new URL(window.location.href);
-      const callbackError = url.searchParams.get('error');
-      if (callbackError) {
-        clearTokens();
-        return {
-          authenticated: false,
-          error: {
-            message: url.searchParams.get('error_description') ?? callbackError,
-            name: callbackError,
-          },
-          logout: true,
-        };
-      }
-
-      const code = url.searchParams.get('code');
-      const state = url.searchParams.get('state');
-
-      if (code) {
-        const savedState = storage.getItem(`${STORAGE_PREFIX}state`);
-        if (!state || !savedState || state !== savedState) {
-          clearTokens();
-          return { authenticated: false, error: { message: 'State mismatch' } };
-        }
-        try {
-          await exchangeCode(code);
-          // Clean URL
-          url.searchParams.delete('code');
-          url.searchParams.delete('state');
-          window.history.replaceState({}, '', `${url.pathname}${url.search}${url.hash}`);
-          return { authenticated: true };
-        } catch (err) {
-          return { authenticated: false, error: { message: String(err) } };
-        }
-      }
-
-      // Check existing tokens
-      const tokens = getTokens();
-      if (!tokens) {
-        return { authenticated: false, logout: true };
-      }
-
-      // Check expiry
-      if (tokens.expires_at && tokens.expires_at < Math.floor(Date.now() / 1000)) {
-        if (tokens.refresh_token) {
-          await refreshAccessToken(tokens.refresh_token);
-          const refreshed = getTokens();
-          if (refreshed) return { authenticated: true };
-        }
-        clearTokens();
-        return { authenticated: false, logout: true };
-      }
-
-      // Schedule refresh if not already done
-      if (autoRefresh && tokens.refresh_token && tokens.expires_at) {
-        scheduleRefresh(tokens);
-      }
-
-      return { authenticated: true };
-    },
-
-    async getIdentity(): Promise<Identity | null> {
-      const tokens = getTokens();
-      if (!tokens) return null;
-
-      try {
-        const cfg = await discover();
-        const res = await fetch(cfg.userinfo_endpoint, {
-          headers: { Authorization: `${tokens.token_type} ${tokens.access_token}` },
-        });
-        if (!res.ok) return null;
-        const userinfo = await res.json();
-        return mapIdentity(userinfo);
-      } catch {
-        return null;
-      }
-    },
-
-    async getPermissions() {
-      const tokens = getTokens();
-      if (!tokens) return null;
-
-      // Try to extract roles/permissions from the ID token
-      if (tokens.id_token) {
-        try {
-          const payload = decodeJwtPayload(tokens.id_token);
-          if (!payload) return null;
-          return payload.roles ?? payload.groups ?? payload.permissions ?? null;
-        } catch {
-          return null;
-        }
-      }
-
-      return null;
-    },
-
-    async getAccessToken() {
-      const tokens = getTokens();
-      if (!tokens) return null;
-
-      if (tokens.expires_at && tokens.expires_at < Math.floor(Date.now() / 1000)) {
-        if (!tokens.refresh_token) {
-          clearTokens();
-          return null;
-        }
-        await refreshAccessToken(tokens.refresh_token);
-        return getTokens()?.access_token ?? null;
-      }
-
-      return tokens.access_token;
-    },
-
-    async onError(error) {
-      if (typeof error === 'object' && error !== null && 'statusCode' in error) {
-        const statusCode = (error as { statusCode: number }).statusCode;
-        if (statusCode === 401 || statusCode === 403) {
-          return { logout: true, redirectTo: '/login' };
-        }
-      }
-      if (typeof error === 'object' && error !== null && 'status' in error) {
-        const status = (error as { status: number }).status;
-        if (status === 401 || status === 403) {
-          return { logout: true, redirectTo: '/login' };
-        }
-      }
-      return {};
-    },
-  };
-}

package/src/index.ts

@@ -1,22 +0,0 @@
-/**
- * @svadmin/sso — OIDC/OAuth2 SSO AuthProvider plugin
- *
- * Usage:
- * ```ts
- * import { createSSOAuthProvider, createGoogleAuth } from '@svadmin/sso';
- * ```
- */
-
-export { createSSOAuthProvider } from './auth-provider';
-export type { SSOAuthProvider, SSOConfig, TokenStorage } from './auth-provider';
-
-// Social login presets
-export {
-  createGoogleAuth,
-  createMicrosoftAuth,
-  createGitHubAuth,
-  createGitLabAuth,
-  createKeycloakAuth,
-  createAuth0Auth,
-} from './presets';
-export type { PresetOptions } from './presets';

package/src/presets.ts

@@ -1,179 +0,0 @@
-/**
- * Social login presets — pre-configured SSO providers for common identity platforms.
- *
- * Each factory function returns an AuthProvider via `createSSOAuthProvider()`
- * with the correct issuer and default scopes for that platform.
- *
- * @example
- * ```ts
- * import { createGoogleAuth } from '@svadmin/sso';
- * import { setAuthProvider } from '@svadmin/core';
- *
- * setAuthProvider(createGoogleAuth('your-client-id'));
- * ```
- */
-
-import { createSSOAuthProvider, type SSOConfig } from './auth-provider';
-
-// ─── Shared helpers ──────────────────────────────────────────
-
-type PresetOptions = Omit<SSOConfig, 'issuer' | 'clientId'>;
-
-function resolveRedirectUri(opts?: PresetOptions): string {
-  return opts?.redirectUri ?? (typeof window !== 'undefined' ? `${window.location.origin}/callback` : '/callback');
-}
-
-// ─── Google ──────────────────────────────────────────────────
-
-/**
- * Google Sign-In via OIDC (OpenID Connect).
- *
- * Prerequisites:
- * 1. Create OAuth2 credentials at https://console.cloud.google.com/apis/credentials
- * 2. Add authorized redirect URIs (e.g., `http://localhost:5173/callback`)
- *
- * @param clientId - Google OAuth2 Client ID
- */
-export function createGoogleAuth(clientId: string, opts?: PresetOptions) {
-  return createSSOAuthProvider({
-    issuer: 'https://accounts.google.com',
-    clientId,
-    scopes: ['openid', 'profile', 'email'],
-    redirectUri: resolveRedirectUri(opts),
-    ...opts,
-  });
-}
-
-// ─── Microsoft / Azure AD (Entra ID) ────────────────────────
-
-/**
- * Microsoft / Azure AD Sign-In via OIDC.
- *
- * @param clientId - Azure App Registration Client ID
- * @param tenantId - Azure tenant ID. Default: 'common' (multi-tenant)
- */
-export function createMicrosoftAuth(
-  clientId: string,
-  tenantId = 'common',
-  opts?: PresetOptions,
-) {
-  return createSSOAuthProvider({
-    issuer: `https://login.microsoftonline.com/${tenantId}/v2.0`,
-    clientId,
-    scopes: ['openid', 'profile', 'email'],
-    redirectUri: resolveRedirectUri(opts),
-    ...opts,
-  });
-}
-
-// ─── GitHub ──────────────────────────────────────────────────
-
-/**
- * GitHub Sign-In via OAuth2.
- *
- * Note: GitHub does NOT support OIDC discovery, so we manually specify endpoints.
- * The `issuer` field is used for identification only.
- *
- * Prerequisites:
- * 1. Create an OAuth App at https://github.com/settings/developers
- * 2. Set the callback URL to your redirect URI
- *
- * @param clientId - GitHub OAuth App Client ID
- */
-export function createGitHubAuth(clientId: string, opts?: PresetOptions) {
-  // GitHub uses standard OAuth2, not OIDC — requires manual endpoint config.
-  // We leverage the SSO provider but override the discovery with manual endpoints.
-  const redirectUri = resolveRedirectUri(opts);
-
-  return createSSOAuthProvider({
-    issuer: 'https://github.com',
-    clientId,
-    scopes: ['read:user', 'user:email'],
-    redirectUri,
-    // GitHub doesn't support OIDC discovery, provide manual endpoints
-    manualEndpoints: {
-      authorization_endpoint: 'https://github.com/login/oauth/authorize',
-      token_endpoint: 'https://github.com/login/oauth/access_token',
-      userinfo_endpoint: 'https://api.github.com/user',
-    },
-    mapIdentity: (userinfo) => ({
-      id: String(userinfo.id ?? ''),
-      name: (userinfo.name as string) ?? (userinfo.login as string) ?? '',
-      avatar: (userinfo.avatar_url as string) ?? undefined,
-      email: (userinfo.email as string) ?? undefined,
-    }),
-    ...opts,
-  });
-}
-
-// ─── GitLab ──────────────────────────────────────────────────
-
-/**
- * GitLab Sign-In via OIDC.
- *
- * @param clientId - GitLab Application ID
- * @param instanceUrl - GitLab instance URL. Default: 'https://gitlab.com'
- */
-export function createGitLabAuth(
-  clientId: string,
-  instanceUrl = 'https://gitlab.com',
-  opts?: PresetOptions,
-) {
-  return createSSOAuthProvider({
-    issuer: instanceUrl,
-    clientId,
-    scopes: ['openid', 'profile', 'email'],
-    redirectUri: resolveRedirectUri(opts),
-    ...opts,
-  });
-}
-
-// ─── Keycloak ────────────────────────────────────────────────
-
-/**
- * Keycloak Sign-In via OIDC.
- *
- * @param baseUrl - Keycloak base URL (e.g., 'https://keycloak.example.com')
- * @param realm - Keycloak realm name
- * @param clientId - Keycloak Client ID
- */
-export function createKeycloakAuth(
-  baseUrl: string,
-  realm: string,
-  clientId: string,
-  opts?: PresetOptions,
-) {
-  return createSSOAuthProvider({
-    issuer: `${baseUrl.replace(/\/$/, '')}/realms/${realm}`,
-    clientId,
-    scopes: ['openid', 'profile', 'email'],
-    redirectUri: resolveRedirectUri(opts),
-    ...opts,
-  });
-}
-
-// ─── Auth0 ───────────────────────────────────────────────────
-
-/**
- * Auth0 Sign-In via OIDC.
- *
- * @param domain - Auth0 domain (e.g., 'your-tenant.auth0.com')
- * @param clientId - Auth0 Client ID
- */
-export function createAuth0Auth(
-  domain: string,
-  clientId: string,
-  opts?: PresetOptions,
-) {
-  return createSSOAuthProvider({
-    issuer: `https://${domain.replace(/^https?:\/\//, '').replace(/\/$/, '')}`,
-    clientId,
-    scopes: ['openid', 'profile', 'email'],
-    redirectUri: resolveRedirectUri(opts),
-    ...opts,
-  });
-}
-
-// ─── Type exports ────────────────────────────────────────────
-
-export type { PresetOptions };