@sviy/authglue 0.0.0-stage → 1.0.0

package/README

@@ -0,0 +1,3 @@
+# @sviy/authglue
+
+> TODO: Write this later.

package/index.js

@@ -0,0 +1,83 @@
+import * as client from 'openid-client';
+import session from 'express-session';
+import FileStore from 'session-file-store';
+
+export async function setupAuth(app, config) {
+  // ── Sessions ──────────────────────────
+  app.use(session({
+    secret: config.sessionSecret,
+    resave: false,
+    saveUninitialized: false,
+    store: new FileStore({ path: config.sessionPath }),
+    cookie: {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: config.secure ?? false,
+    },
+  }));
+
+  // ── Discover the IdP ───────────────────
+  const issuer = await client.discovery(
+    new URL(config.issuerUrl),
+    config.clientId,
+    config.clientSecret,
+  );
+
+  const oidcClient = new issuer.Client({
+    client_id: config.clientId,
+    client_secret: config.clientSecret,
+    redirect_uris: [config.callbackUrl],
+    response_types: ['code'],
+  });
+
+  // ── Login ─────────────────────────────
+  app.get(config.loginPath || '/login', (req, res) => {
+    const verifier = client.randomPKCECodeVerifier();
+    const challenge = await client.calculatePKCECodeChallenge(verifier);
+    const state = client.randomState();
+
+    req.session.pkce = { verifier, state };
+    req.session.save();
+
+    res.redirect(client.buildAuthorizationUrl(oidcClient, {
+      scope: config.scopes || 'openid profile email offline_access',
+      state,
+      code_challenge: challenge,
+      code_challenge_method: 'S256',
+      redirect_uri: config.callbackUrl,
+    }));
+  });
+
+  // ── Callback ───────────────────────────
+  app.get(config.callbackPath || '/callback', async (req, res) => {
+    const { pkce } = req.session;
+    if (!pkce) return res.status(400).send('Session expired. Try again.');
+
+    const tokens = await client.authorizationCodeGrant(
+      oidcClient,
+      new URL(`${req.protocol}://${req.get('host')}${req.originalUrl}`),
+      { pkceCodeVerifier: pkce.verifier, expectedState: pkce.state },
+    );
+
+    req.session.user = tokens.claims();
+    req.session.tokens = tokens;
+    delete req.session.pkce;
+
+    res.redirect(config.successRedirect || '/');
+  });
+
+  // ── Logout ───────────────────────────
+  app.get(config.logoutPath || '/logout', (req, res) => {
+    const logoutUrl = client.buildEndSessionUrl(oidcClient, {
+      id_token_hint: req.session.tokens?.id_token,
+      post_logout_redirect_uri: config.postLogoutUrl || config.successRedirect || '/',
+    });
+    req.session.destroy(() => res.redirect(logoutUrl));
+  });
+
+  // ── Auth guard ───────────────────────
+  return function requireAuth(req, res, next) {
+    if (req.session?.user) return next();
+    res.redirect(config.loginPath || '/login');
+  };
+}

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "@sviy/authglue",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "OIDC auth glue for Express apps",
+  "keywords": [
+    "oidc",
+    "oauth",
+    "auth",
+    "express",
+    "sso"
+  ],
+  "license": "MIT",
+  "author": "sviy",
+  "type": "module",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "dependencies": {
+    "openid-client": "^6.8.8",
+    "express-session": "^1.19.0",
+    "session-file-store": "^1.5.0"
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.