@theshelf/authentication-driver-openid 0.4.0

package/README.md

@@ -0,0 +1,37 @@
+
+# Authentication OpenID driver | The Shelf
+
+This package contains the driver implementation for OpenID. This driver can be used by the [core package](../../core/README.md) for performing the actual operations.
+
+## Installation
+
+```bash
+npm install @theshelf/authentication @theshelf/authentication-driver-openid
+```
+
+## How to use
+
+The basic set up looks like this.
+
+```ts
+import IdentityProvider  from '@theshelf/authentication';
+import { OpenIDDriver } from '@theshelf/authentication-driver-openid';
+
+const driver = new OpenIDDriver({/* Configuration options */});
+const identityProvider = new IdentityProvider(driver);
+
+// Perform operations with the identityProvider instance
+```
+
+## Configuration options
+
+```ts
+type OpenIDConfiguration = {
+    issuer: string; // URL to the provider
+    clientId: string; // provided by the provider
+    clientSecret: string; // provided by the provider
+    redirectPath: string; // e.g. "https://application.com/login"
+    secretKey: string; // a high entropy string for hmac
+    allowInsecureRequests: boolean; // only set to false in development
+};
+```

package/dist/OpenID.d.ts

@@ -0,0 +1,22 @@
+import type { Driver, Session } from '@theshelf/authentication';
+type OpenIDConfiguration = {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    redirectPath: string;
+    secretKey: string;
+    allowInsecureRequests: boolean;
+};
+export default class OpenID implements Driver {
+    #private;
+    constructor(configuration: OpenIDConfiguration);
+    get name(): string;
+    get connected(): boolean;
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    getLoginUrl(origin: string): Promise<string>;
+    login(origin: string, data: Record<string, unknown>): Promise<Session>;
+    refresh(session: Session): Promise<Session>;
+    logout(session: Session): Promise<void>;
+}
+export {};

package/dist/OpenID.js

@@ -0,0 +1,170 @@
+import { allowInsecureRequests, authorizationCodeGrant, buildAuthorizationUrlWithPAR, calculatePKCECodeChallenge, discovery, fetchUserInfo, randomNonce, randomPKCECodeVerifier, refreshTokenGrant, tokenRevocation } from 'openid-client';
+import crypto from 'node:crypto';
+import { LoginFailed, RefreshFailed, NotConnected, generateId } from '@theshelf/authentication';
+import SecretManager from './SecretManager.js';
+const TTL = 30_000;
+const HMAC_ALGORITHM = 'sha512';
+const URL_ENCODING = 'base64url';
+export default class OpenID {
+    #providerConfiguration;
+    #key;
+    #clientConfiguration;
+    #secretManager = new SecretManager();
+    constructor(configuration) {
+        this.#providerConfiguration = configuration;
+        this.#key = configuration.secretKey;
+    }
+    get name() { return OpenID.name; }
+    get connected() {
+        return this.#clientConfiguration !== undefined;
+    }
+    async connect() {
+        const issuer = new URL(this.#providerConfiguration.issuer);
+        const clientId = this.#providerConfiguration.clientId;
+        const clientSecret = this.#providerConfiguration.clientSecret;
+        const requestOptions = this.#getRequestOptions();
+        this.#clientConfiguration = await discovery(issuer, clientId, clientSecret, undefined, requestOptions);
+        this.#secretManager.start();
+    }
+    async disconnect() {
+        this.#secretManager.stop();
+        this.#clientConfiguration = undefined;
+    }
+    async getLoginUrl(origin) {
+        const redirect_uri = new URL(this.#providerConfiguration.redirectPath, origin).href;
+        const scope = 'openid profile email';
+        const nonce = randomNonce();
+        const codeVerifier = randomPKCECodeVerifier();
+        const code_challenge = await calculatePKCECodeChallenge(codeVerifier);
+        const code_challenge_method = 'S256';
+        const payload = this.#createPayload();
+        const state = this.#calculateState(payload);
+        const parameters = {
+            redirect_uri,
+            scope,
+            code_challenge,
+            code_challenge_method,
+            state,
+            nonce
+        };
+        const clientConfiguration = this.#getClientConfiguration();
+        const redirectTo = await buildAuthorizationUrlWithPAR(clientConfiguration, parameters);
+        const secret = { codeVerifier, nonce };
+        this.#secretManager.set(state, secret);
+        return redirectTo.href;
+    }
+    async login(origin, data) {
+        const clientConfiguration = this.#getClientConfiguration();
+        const url = new URL(this.#providerConfiguration.redirectPath, origin);
+        for (const [key, value] of Object.entries(data)) {
+            url.searchParams.set(key, String(value));
+        }
+        const state = this.#getState(data);
+        const secret = this.#secretManager.get(state);
+        if (secret === undefined) {
+            throw new LoginFailed('Missing secret');
+        }
+        const tokens = await authorizationCodeGrant(clientConfiguration, url, {
+            pkceCodeVerifier: secret.codeVerifier,
+            expectedNonce: secret.nonce,
+            expectedState: state,
+            idTokenExpected: true
+        });
+        const access_token = tokens.access_token;
+        const claims = this.#getClaims(tokens);
+        const sub = claims.sub;
+        const expires = claims.exp * 1000;
+        const userInfo = await fetchUserInfo(clientConfiguration, access_token, sub);
+        const identity = {
+            name: userInfo.name,
+            nickname: userInfo.nickname,
+            picture: userInfo.picture,
+            email: userInfo.email,
+            email_verified: userInfo.email_verified
+        };
+        return {
+            id: generateId(),
+            identity: identity,
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token,
+            expires: new Date(expires)
+        };
+    }
+    async refresh(session) {
+        if (session.refreshToken === undefined) {
+            throw new RefreshFailed('Missing refresh token');
+        }
+        const config = this.#getClientConfiguration();
+        const tokens = await refreshTokenGrant(config, session.refreshToken);
+        const claims = this.#getClaims(tokens);
+        const expires = claims.exp * 1000;
+        return {
+            id: session.id,
+            requester: session.requester,
+            identity: session.identity,
+            accessToken: tokens.access_token,
+            refreshToken: tokens.refresh_token,
+            expires: new Date(expires)
+        };
+    }
+    logout(session) {
+        const config = this.#getClientConfiguration();
+        return tokenRevocation(config, session.refreshToken ?? session.accessToken);
+    }
+    #getClientConfiguration() {
+        if (this.#clientConfiguration === undefined) {
+            throw new NotConnected('OpenID client not connected');
+        }
+        return this.#clientConfiguration;
+    }
+    #getRequestOptions() {
+        const options = {};
+        if (this.#providerConfiguration.allowInsecureRequests) {
+            options.execute = [allowInsecureRequests];
+        }
+        return options;
+    }
+    #getClaims(tokens) {
+        const claims = tokens.claims();
+        if (claims === undefined) {
+            throw new LoginFailed('No claims in ID token');
+        }
+        return claims;
+    }
+    #createPayload() {
+        return {
+            jti: crypto.randomBytes(32).toString('base64'),
+            iat: Date.now(),
+            exp: Date.now() + TTL
+        };
+    }
+    #calculateState(payload) {
+        const data = JSON.stringify(payload);
+        const value = Buffer.from(data).toString(URL_ENCODING);
+        const signature = crypto.createHmac(HMAC_ALGORITHM, this.#key).update(data).digest(URL_ENCODING);
+        return `${value}.${signature}`;
+    }
+    #getState(data) {
+        const state = data.state;
+        if (typeof state !== 'string') {
+            throw new LoginFailed('Invalid state');
+        }
+        const parts = state.split('.');
+        if (parts.length !== 2) {
+            throw new LoginFailed('Invalid state');
+        }
+        const [value, signature] = parts;
+        const decodedValue = Buffer.from(value, URL_ENCODING).toString('utf8');
+        const decodedSignature = Buffer.from(signature, URL_ENCODING);
+        const check = Buffer.from(crypto.createHmac(HMAC_ALGORITHM, this.#key).update(decodedValue).digest());
+        if (check.length !== decodedSignature.length || crypto.timingSafeEqual(check, decodedSignature) === false) {
+            throw new LoginFailed('Invalid state');
+        }
+        const payload = JSON.parse(decodedValue);
+        const now = Date.now();
+        if (payload.iat > now || payload.exp < now) {
+            throw new LoginFailed('Invalid state');
+        }
+        return state;
+    }
+}

package/dist/SecretManager.d.ts

@@ -0,0 +1,12 @@
+type Secret = {
+    codeVerifier: string;
+    nonce: string;
+};
+export default class SecretManager {
+    #private;
+    set(key: string, secret: Secret): void;
+    get(key: string): Secret | undefined;
+    start(): void;
+    stop(): void;
+}
+export {};

package/dist/SecretManager.js

@@ -0,0 +1,44 @@
+const TTL = 40_000;
+const CLEANUP_INTERVAL = 10_000;
+export default class SecretManager {
+    #cache = new Map();
+    #cleanupInterval;
+    set(key, secret) {
+        const entry = {
+            secret,
+            expiresAt: Date.now() + TTL
+        };
+        this.#cache.set(key, entry);
+    }
+    get(key) {
+        const entry = this.#cache.get(key);
+        if (entry === undefined)
+            return;
+        this.#cache.delete(key);
+        if (entry.expiresAt < Date.now()) {
+            return;
+        }
+        return entry.secret;
+    }
+    start() {
+        if (this.#cleanupInterval !== undefined)
+            return;
+        this.#cleanupInterval = setInterval(() => this.#cleanup(), CLEANUP_INTERVAL);
+        this.#cleanupInterval.unref();
+    }
+    stop() {
+        if (this.#cleanupInterval === undefined)
+            return;
+        clearInterval(this.#cleanupInterval);
+        this.#cache.clear();
+        this.#cleanupInterval = undefined;
+    }
+    #cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.#cache.entries()) {
+            if (entry.expiresAt < now) {
+                this.#cache.delete(key);
+            }
+        }
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { default as OpenIDDriver } from './OpenID.js';

package/dist/index.js

@@ -0,0 +1 @@
+export { default as OpenIDDriver } from './OpenID.js';

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@theshelf/authentication-driver-openid",
+  "private": false,
+  "version": "0.4.0",
+  "type": "module",
+  "repository": {
+    "url": "git+https://github.com/MaskingTechnology/theshelf.git"
+  },
+  "license": "MIT",
+  "scripts": {
+    "build": "tsc",
+    "clean": "rimraf dist",
+    "lint": "eslint",
+    "review": "npm run build && npm run lint",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "files": [
+    "README.md",
+    "dist"
+  ],
+  "types": "./dist/index.d.ts",
+  "exports": "./dist/index.js",
+  "dependencies": {
+    "openid-client": "6.8.1"
+  },
+  "peerDependencies": {
+    "@theshelf/authentication": "^0.4.0"
+  }
+}