@theshelf/authentication-driver-openid 0.4.0 → 0.4.1

package/dist/OpenID.d.ts

@@ -4,7 +4,8 @@ type OpenIDConfiguration = {
     clientId: string;
     clientSecret: string;
     redirectPath: string;
-    secretKey: string;
+    signingSecret: string;
+    ttl?: number;
     allowInsecureRequests: boolean;
 };
 export default class OpenID implements Driver {

package/dist/OpenID.js

@@ -1,27 +1,25 @@
-import { allowInsecureRequests, authorizationCodeGrant, buildAuthorizationUrlWithPAR, calculatePKCECodeChallenge, discovery, fetchUserInfo, randomNonce, randomPKCECodeVerifier, refreshTokenGrant, tokenRevocation } from 'openid-client';
 import crypto from 'node:crypto';
-import { LoginFailed, RefreshFailed, NotConnected, generateId } from '@theshelf/authentication';
+import { allowInsecureRequests, authorizationCodeGrant, buildAuthorizationUrlWithPAR, calculatePKCECodeChallenge, discovery, fetchUserInfo, randomNonce, randomPKCECodeVerifier, refreshTokenGrant, tokenRevocation } from 'openid-client';
+import { LoginFailed, NotConnected, RefreshFailed, generateId } from '@theshelf/authentication';
 import SecretManager from './SecretManager.js';
-const TTL = 30_000;
 const HMAC_ALGORITHM = 'sha512';
 const URL_ENCODING = 'base64url';
 export default class OpenID {
-    #providerConfiguration;
-    #key;
+    #configuration;
+    #secretManager;
     #clientConfiguration;
-    #secretManager = new SecretManager();
     constructor(configuration) {
-        this.#providerConfiguration = configuration;
-        this.#key = configuration.secretKey;
+        this.#configuration = configuration;
+        this.#secretManager = new SecretManager(configuration.ttl);
     }
     get name() { return OpenID.name; }
     get connected() {
         return this.#clientConfiguration !== undefined;
     }
     async connect() {
-        const issuer = new URL(this.#providerConfiguration.issuer);
-        const clientId = this.#providerConfiguration.clientId;
-        const clientSecret = this.#providerConfiguration.clientSecret;
+        const issuer = new URL(this.#configuration.issuer);
+        const clientId = this.#configuration.clientId;
+        const clientSecret = this.#configuration.clientSecret;
         const requestOptions = this.#getRequestOptions();
         this.#clientConfiguration = await discovery(issuer, clientId, clientSecret, undefined, requestOptions);
         this.#secretManager.start();
@@ -31,7 +29,7 @@ export default class OpenID {
         this.#clientConfiguration = undefined;
     }
     async getLoginUrl(origin) {
-        const redirect_uri = new URL(this.#providerConfiguration.redirectPath, origin).href;
+        const redirect_uri = new URL(this.#configuration.redirectPath, origin).href;
         const scope = 'openid profile email';
         const nonce = randomNonce();
         const codeVerifier = randomPKCECodeVerifier();
@@ -55,7 +53,7 @@ export default class OpenID {
     }
     async login(origin, data) {
         const clientConfiguration = this.#getClientConfiguration();
-        const url = new URL(this.#providerConfiguration.redirectPath, origin);
+        const url = new URL(this.#configuration.redirectPath, origin);
         for (const [key, value] of Object.entries(data)) {
             url.searchParams.set(key, String(value));
         }
@@ -107,9 +105,13 @@ export default class OpenID {
             expires: new Date(expires)
         };
     }
-    logout(session) {
+    async logout(session) {
         const config = this.#getClientConfiguration();
-        return tokenRevocation(config, session.refreshToken ?? session.accessToken);
+        const revocations = [tokenRevocation(config, session.accessToken)];
+        if (session.refreshToken !== undefined) {
+            revocations.push(tokenRevocation(config, session.refreshToken));
+        }
+        await Promise.allSettled(revocations);
     }
     #getClientConfiguration() {
         if (this.#clientConfiguration === undefined) {
@@ -119,7 +121,7 @@ export default class OpenID {
     }
     #getRequestOptions() {
         const options = {};
-        if (this.#providerConfiguration.allowInsecureRequests) {
+        if (this.#configuration.allowInsecureRequests) {
             options.execute = [allowInsecureRequests];
         }
         return options;
@@ -132,16 +134,11 @@ export default class OpenID {
         return claims;
     }
     #createPayload() {
-        return {
-            jti: crypto.randomBytes(32).toString('base64'),
-            iat: Date.now(),
-            exp: Date.now() + TTL
-        };
+        return crypto.randomBytes(64).toString('base64');
     }
-    #calculateState(payload) {
-        const data = JSON.stringify(payload);
+    #calculateState(data) {
         const value = Buffer.from(data).toString(URL_ENCODING);
-        const signature = crypto.createHmac(HMAC_ALGORITHM, this.#key).update(data).digest(URL_ENCODING);
+        const signature = crypto.createHmac(HMAC_ALGORITHM, this.#configuration.signingSecret).update(data).digest(URL_ENCODING);
         return `${value}.${signature}`;
     }
     #getState(data) {
@@ -156,15 +153,10 @@ export default class OpenID {
         const [value, signature] = parts;
         const decodedValue = Buffer.from(value, URL_ENCODING).toString('utf8');
         const decodedSignature = Buffer.from(signature, URL_ENCODING);
-        const check = Buffer.from(crypto.createHmac(HMAC_ALGORITHM, this.#key).update(decodedValue).digest());
+        const check = Buffer.from(crypto.createHmac(HMAC_ALGORITHM, this.#configuration.signingSecret).update(decodedValue).digest());
         if (check.length !== decodedSignature.length || crypto.timingSafeEqual(check, decodedSignature) === false) {
             throw new LoginFailed('Invalid state');
         }
-        const payload = JSON.parse(decodedValue);
-        const now = Date.now();
-        if (payload.iat > now || payload.exp < now) {
-            throw new LoginFailed('Invalid state');
-        }
         return state;
     }
 }

package/dist/SecretManager.d.ts

@@ -4,6 +4,7 @@ type Secret = {
 };
 export default class SecretManager {
     #private;
+    constructor(ttl?: number);
     set(key: string, secret: Secret): void;
     get(key: string): Secret | undefined;
     start(): void;

package/dist/SecretManager.js

@@ -1,12 +1,15 @@
-const TTL = 40_000;
-const CLEANUP_INTERVAL = 10_000;
+const CLEANUP_INTERVAL = 60_000;
 export default class SecretManager {
     #cache = new Map();
     #cleanupInterval;
+    #TTL;
+    constructor(ttl = 3600_000) {
+        this.#TTL = ttl;
+    }
     set(key, secret) {
         const entry = {
             secret,
-            expiresAt: Date.now() + TTL
+            expiresAt: Date.now() + this.#TTL
         };
         this.#cache.set(key, entry);
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@theshelf/authentication-driver-openid",
   "private": false,
-  "version": "0.4.0",
+  "version": "0.4.1",
   "type": "module",
   "repository": {
     "url": "git+https://github.com/MaskingTechnology/theshelf.git"