@unbrained/pm-web 2026.7.11 → 2026.7.13

package/dist/routes/oidc.js

@@ -0,0 +1,147 @@
+import crypto from "node:crypto";
+import { Router } from "express";
+import { authorizationCodeGrant, buildAuthorizationUrl, ClientSecretBasic, Configuration, discovery, } from "openid-client";
+import { pool } from "../db.js";
+import { setSessionCookie } from "../auth.js";
+import { createOidcState, decodeOidcStateCookie, encodeOidcStateCookie, OIDC_STATE_COOKIE, OIDC_STATE_MAX_AGE_MS, oidcGrantChecks, OidcFlowError, oidcPublicConfig, resolveExternalIdentity, resolveOidcSettings, validateOidcClaims, } from "../oidc.js";
+const router = Router();
+const stateCookieOptions = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/api/auth/oidc",
+};
+let cachedDiscovery = null;
+function enabledSettings() {
+    const settings = resolveOidcSettings();
+    if (!settings.enabled) {
+        throw new OidcFlowError("oidc_disabled", "OpenID Connect login is not enabled.", 404);
+    }
+    return settings;
+}
+function discoveryConfiguration(settings) {
+    const fingerprint = crypto
+        .createHash("sha256")
+        .update(`${settings.issuer}\0${settings.clientId}\0${settings.clientSecret}`)
+        .digest("base64url");
+    if (!cachedDiscovery || cachedDiscovery.fingerprint !== fingerprint) {
+        const promise = discoverProvider(settings).catch((error) => {
+            if (cachedDiscovery?.fingerprint === fingerprint)
+                cachedDiscovery = null;
+            throw error;
+        });
+        cachedDiscovery = { fingerprint, promise };
+    }
+    return cachedDiscovery.promise;
+}
+async function discoverProvider(settings) {
+    const issuer = new URL(settings.issuer);
+    const initial = await discovery(issuer, settings.clientId, settings.clientSecret);
+    const methods = initial.serverMetadata().token_endpoint_auth_methods_supported;
+    if (Array.isArray(methods) &&
+        !methods.includes("client_secret_post") &&
+        methods.includes("client_secret_basic")) {
+        return new Configuration(initial.serverMetadata(), settings.clientId, { client_secret: settings.clientSecret }, ClientSecretBasic(settings.clientSecret));
+    }
+    return initial;
+}
+export function providerAuthorizationError(value) {
+    if (typeof value !== "string" || !value)
+        return null;
+    if (value === "access_denied") {
+        return new OidcFlowError("provider_access_denied", "OpenID Connect login was canceled or denied.", 403);
+    }
+    return new OidcFlowError("provider_error", "The OpenID Connect provider could not complete login.");
+}
+function callbackUrl(req, configuredRedirectUri) {
+    const url = new URL(configuredRedirectUri);
+    const incoming = new URL(req.originalUrl, "http://localhost");
+    url.search = incoming.search;
+    return url;
+}
+function clearStateCookie(res) {
+    res.clearCookie(OIDC_STATE_COOKIE, stateCookieOptions);
+}
+router.get("/oidc/config", (_req, res) => {
+    res.json(oidcPublicConfig());
+});
+router.get("/oidc/start", async (_req, res) => {
+    try {
+        const settings = enabledSettings();
+        const configuration = await discoveryConfiguration(settings);
+        const flow = createOidcState();
+        const authorizationUrl = buildAuthorizationUrl(configuration, {
+            redirect_uri: settings.redirectUri,
+            scope: settings.scopes,
+            response_type: "code",
+            state: flow.state,
+            nonce: flow.nonce,
+            code_challenge: flow.codeChallenge,
+            code_challenge_method: "S256",
+        });
+        res.cookie(OIDC_STATE_COOKIE, encodeOidcStateCookie(flow, settings.cookieSecret), { ...stateCookieOptions, maxAge: OIDC_STATE_MAX_AGE_MS });
+        res.redirect(302, authorizationUrl.href);
+    }
+    catch (error) {
+        if (error instanceof OidcFlowError) {
+            res.status(error.status).json({ error: error.message, code: error.code });
+            return;
+        }
+        res.status(502).json({ error: "OpenID Connect provider discovery failed." });
+    }
+});
+router.get("/oidc/callback", async (req, res) => {
+    let client;
+    try {
+        const settings = enabledSettings();
+        const stateCookie = req.cookies?.[OIDC_STATE_COOKIE];
+        const flow = decodeOidcStateCookie(stateCookie, settings.cookieSecret);
+        if (req.query.state !== flow.state) {
+            throw new OidcFlowError("state_mismatch", "OIDC state does not match the login request.");
+        }
+        const providerError = providerAuthorizationError(req.query.error);
+        if (providerError)
+            throw providerError;
+        if (typeof req.query.code !== "string" || !req.query.code) {
+            throw new OidcFlowError("missing_code", "OIDC authorization code is missing.");
+        }
+        const configuration = await discoveryConfiguration(settings);
+        const tokens = await authorizationCodeGrant(configuration, callbackUrl(req, settings.redirectUri), oidcGrantChecks(flow));
+        const claims = tokens.claims();
+        if (!claims) {
+            throw new OidcFlowError("missing_id_token", "OIDC provider did not return an ID token.");
+        }
+        const identity = validateOidcClaims(claims, settings, flow.nonce);
+        client = await pool.connect();
+        const user = await resolveExternalIdentity(client, identity);
+        setSessionCookie(res, { userId: user.id, email: user.email });
+        clearStateCookie(res);
+        res.redirect(303, "/");
+    }
+    catch (error) {
+        clearStateCookie(res);
+        if (error instanceof OidcFlowError) {
+            res.status(error.status).json({ error: error.message, code: error.code });
+            return;
+        }
+        // Never log the full exception: OAuth failures may contain authorization
+        // codes or token data. A class + PostgreSQL-style code is sufficient to
+        // distinguish infrastructure/schema faults without exposing the payload.
+        const diagnostic = error instanceof Error
+            ? {
+                name: error.name,
+                ...(error.code &&
+                    /^[A-Z0-9_]{1,32}$/i.test(String(error.code))
+                    ? { code: String(error.code) }
+                    : {}),
+            }
+            : { name: typeof error };
+        console.error("OIDC callback failed", diagnostic);
+        res.status(400).json({ error: "OpenID Connect login failed." });
+    }
+    finally {
+        client?.release();
+    }
+});
+export { router as oidcRouter };
+//# sourceMappingURL=oidc.js.map

package/dist/routes/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/routes/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,MAAM,kBAAkB,GAAG;IACzB,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;IAC7C,QAAQ,EAAE,KAAc;IACxB,IAAI,EAAE,gBAAgB;CACvB,CAAC;AAEF,IAAI,eAAe,GAAoE,IAAI,CAAC;AAE5F,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAsB;IACpD,MAAM,WAAW,GAAG,MAAM;SACvB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;SAC5E,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClE,IAAI,eAAe,EAAE,WAAW,KAAK,WAAW;gBAAE,eAAe,GAAG,IAAI,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,eAAe,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAsB;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,qCAAqC,CAAC;IAC/E,IACE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtB,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EACvC,CAAC;QACD,OAAO,IAAI,aAAa,CACtB,OAAO,CAAC,cAAc,EAAE,EACxB,QAAQ,CAAC,QAAQ,EACjB,EAAE,aAAa,EAAE,QAAQ,CAAC,YAAY,EAAE,EACxC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;QAC9B,OAAO,IAAI,aAAa,CACtB,wBAAwB,EACxB,8CAA8C,EAC9C,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,aAAa,CACtB,gBAAgB,EAChB,uDAAuD,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,qBAA6B;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC9D,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAa;IACrC,GAAG,CAAC,WAAW,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACvC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,aAAa,EAAE;YAC5D,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CACR,iBAAiB,EACjB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAClD,EAAE,GAAG,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,EAAE,CACzD,CAAC;QACF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC9C,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,WAAW,GAAI,GAAsD,CAAC,OAAO,EAAE,CACnF,iBAAiB,CAClB,CAAC;QACF,MAAM,IAAI,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvE,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,8CAA8C,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,aAAa;YAAE,MAAM,aAAa,CAAC;QACvC,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,aAAa,EACb,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,EACtC,eAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElE,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,gBAAgB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,UAAU,GAAG,KAAK,YAAY,KAAK;YACvC,CAAC,CAAC;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAE,KAAoC,CAAC,IAAI;oBAC9C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAE,KAAoC,CAAC,IAAI,CAAC,CAAC;oBAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAE,KAAoC,CAAC,IAAI,CAAC,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC;aACR;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,CAAC"}