@uveysservetoglu/kobil-auth 1.0.0 → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -7
- package/dist/client.d.ts +21 -6
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +33 -16
- package/dist/client.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -12,13 +12,9 @@ npm install @uveysservetoglu/kobil-auth
|
|
|
12
12
|
```ts
|
|
13
13
|
import { AuthClient } from "@uveysservetoglu/kobil-auth";
|
|
14
14
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
clientId: process.env.OAUTH_CLIENT_ID!,
|
|
19
|
-
clientSecret: process.env.OAUTH_CLIENT_SECRET!,
|
|
20
|
-
scope: "openid profile email",
|
|
21
|
-
});
|
|
15
|
+
// Reads OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET from the environment.
|
|
16
|
+
// Both endpoints are derived from the issuer.
|
|
17
|
+
const auth = new AuthClient({ scope: "openid profile email" });
|
|
22
18
|
|
|
23
19
|
// 1. Redirect the user to log in
|
|
24
20
|
const url = auth.buildAuthorizationUrl("https://app.example.com/callback");
|
|
@@ -29,6 +25,21 @@ const tokens = await auth.exchangeCodeForToken(code, "https://app.example.com/ca
|
|
|
29
25
|
|
|
30
26
|
JavaScript usage is identical (`const { AuthClient } = require("@uveysservetoglu/kobil-auth")`).
|
|
31
27
|
|
|
28
|
+
## Environment
|
|
29
|
+
|
|
30
|
+
| Variable | Meaning |
|
|
31
|
+
|---|---|
|
|
32
|
+
| `OIDC_ISSUER` | Realm issuer URL. `…/protocol/openid-connect/auth` and `…/token` are derived from it. |
|
|
33
|
+
| `OIDC_CLIENT_ID` | Client id. |
|
|
34
|
+
| `OIDC_CLIENT_SECRET` | Client secret. |
|
|
35
|
+
|
|
36
|
+
Pass `issuer`, `clientId` or `clientSecret` to override any of them. For a deployment whose endpoints
|
|
37
|
+
are not at the standard paths, set `OIDC_AUTHORIZATION_ENDPOINT` / `OIDC_TOKEN_ENDPOINT` (or pass
|
|
38
|
+
`authorizationEndpoint` / `tokenEndpoint`) and the issuer is not consulted for that one.
|
|
39
|
+
|
|
40
|
+
These are the same names the other KOBIL modules read and the same ones the SuperApp emulator
|
|
41
|
+
publishes at `/__superapp/control/env`.
|
|
42
|
+
|
|
32
43
|
Failures throw `KobilAuthError` (extends `KobilError` from `@uveysservetoglu/kobil-core`), carrying
|
|
33
44
|
`statusCode` and `responseBody` when available.
|
|
34
45
|
|
package/dist/client.d.ts
CHANGED
|
@@ -1,8 +1,17 @@
|
|
|
1
1
|
export interface AuthClientOptions {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
2
|
+
/**
|
|
3
|
+
* Realm issuer URL. Both endpoints are derived from it, so this is normally the only URL you set.
|
|
4
|
+
* Falls back to `OIDC_ISSUER`.
|
|
5
|
+
*/
|
|
6
|
+
issuer?: string;
|
|
7
|
+
/** Falls back to `OIDC_CLIENT_ID`. */
|
|
8
|
+
clientId?: string;
|
|
9
|
+
/** Falls back to `OIDC_CLIENT_SECRET`. */
|
|
10
|
+
clientSecret?: string;
|
|
11
|
+
/** Only for a deployment whose endpoint is not at the issuer's standard path. */
|
|
12
|
+
authorizationEndpoint?: string;
|
|
13
|
+
/** Only for a deployment whose endpoint is not at the issuer's standard path. */
|
|
14
|
+
tokenEndpoint?: string;
|
|
6
15
|
/** Space-separated scopes. Default: "openid". */
|
|
7
16
|
scope?: string;
|
|
8
17
|
/** OAuth2 response type. Default: "code". */
|
|
@@ -12,10 +21,16 @@ export interface AuthClientOptions {
|
|
|
12
21
|
/** Length of the generated nonce. Default: 32. */
|
|
13
22
|
nonceLength?: number;
|
|
14
23
|
}
|
|
15
|
-
/**
|
|
24
|
+
/**
|
|
25
|
+
* OIDC authentication helper: build the login redirect URL and exchange the code for tokens.
|
|
26
|
+
*
|
|
27
|
+
* Every value can come from the environment — `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` —
|
|
28
|
+
* so `new AuthClient()` is enough when those are set. They are the same names the other modules read
|
|
29
|
+
* and the same ones the SuperApp emulator publishes.
|
|
30
|
+
*/
|
|
16
31
|
export declare class AuthClient {
|
|
17
32
|
private readonly options;
|
|
18
|
-
constructor(options
|
|
33
|
+
constructor(options?: AuthClientOptions);
|
|
19
34
|
/** Builds the authorization redirect URL, embedding a fresh secure nonce. */
|
|
20
35
|
buildAuthorizationUrl(redirectUri: string): string;
|
|
21
36
|
/** Exchanges an authorization code for tokens. Returns the parsed token response. */
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAcD;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAE9B,OAAO,GAAE,iBAAsB;IA+B3C,6EAA6E;IAC7E,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAclD,qFAAqF;IAC/E,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAsCpC"}
|
package/dist/client.js
CHANGED
|
@@ -2,27 +2,44 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthClient = void 0;
|
|
4
4
|
const crypto_1 = require("crypto");
|
|
5
|
+
const kobil_core_1 = require("@uveysservetoglu/kobil-core");
|
|
5
6
|
const error_1 = require("./error");
|
|
6
7
|
const NONCE_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_-";
|
|
7
|
-
/**
|
|
8
|
+
/**
|
|
9
|
+
* OIDC authentication helper: build the login redirect URL and exchange the code for tokens.
|
|
10
|
+
*
|
|
11
|
+
* Every value can come from the environment — `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` —
|
|
12
|
+
* so `new AuthClient()` is enough when those are set. They are the same names the other modules read
|
|
13
|
+
* and the same ones the SuperApp emulator publishes.
|
|
14
|
+
*/
|
|
8
15
|
class AuthClient {
|
|
9
16
|
options;
|
|
10
|
-
constructor(options) {
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
nonceLength: 32,
|
|
24
|
-
...options,
|
|
17
|
+
constructor(options = {}) {
|
|
18
|
+
const issuer = options.issuer ?? process.env.OIDC_ISSUER ?? "";
|
|
19
|
+
const resolved = {
|
|
20
|
+
authorizationEndpoint: options.authorizationEndpoint ||
|
|
21
|
+
process.env.OIDC_AUTHORIZATION_ENDPOINT ||
|
|
22
|
+
(0, kobil_core_1.authorizationEndpointFor)(issuer),
|
|
23
|
+
tokenEndpoint: options.tokenEndpoint || process.env.OIDC_TOKEN_ENDPOINT || (0, kobil_core_1.tokenEndpointFor)(issuer),
|
|
24
|
+
clientId: options.clientId ?? process.env.OIDC_CLIENT_ID ?? "",
|
|
25
|
+
clientSecret: options.clientSecret ?? process.env.OIDC_CLIENT_SECRET ?? "",
|
|
26
|
+
scope: options.scope ?? "openid",
|
|
27
|
+
responseType: options.responseType ?? "code",
|
|
28
|
+
responseMode: options.responseMode ?? "query",
|
|
29
|
+
nonceLength: options.nonceLength ?? 32,
|
|
25
30
|
};
|
|
31
|
+
// Named after the environment variable rather than the option, because the environment is how this
|
|
32
|
+
// is configured in practice — an error saying "issuer is required" sends someone reading their code
|
|
33
|
+
// when the value is missing from their deployment.
|
|
34
|
+
if (!resolved.authorizationEndpoint)
|
|
35
|
+
throw new error_1.KobilAuthError("No authorization endpoint: set OIDC_ISSUER (or pass issuer).");
|
|
36
|
+
if (!resolved.tokenEndpoint)
|
|
37
|
+
throw new error_1.KobilAuthError("No token endpoint: set OIDC_ISSUER (or pass issuer).");
|
|
38
|
+
if (!resolved.clientId)
|
|
39
|
+
throw new error_1.KobilAuthError("No client id: set OIDC_CLIENT_ID (or pass clientId).");
|
|
40
|
+
if (!resolved.clientSecret)
|
|
41
|
+
throw new error_1.KobilAuthError("No client secret: set OIDC_CLIENT_SECRET (or pass clientSecret).");
|
|
42
|
+
this.options = resolved;
|
|
26
43
|
}
|
|
27
44
|
/** Builds the authorization redirect URL, embedding a fresh secure nonce. */
|
|
28
45
|
buildAuthorizationUrl(redirectUri) {
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,mCAAyC;AAEzC,MAAM,WAAW,GAAG,kEAAkE,CAAC;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,4DAAyF;AACzF,mCAAyC;AAEzC,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAsCvF;;;;;;GAMG;AACH,MAAa,UAAU;IACJ,OAAO,CAAkB;IAE1C,YAAY,UAA6B,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAoB;YAChC,qBAAqB,EACnB,OAAO,CAAC,qBAAqB;gBAC7B,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACvC,IAAA,qCAAwB,EAAC,MAAM,CAAC;YAClC,aAAa,EACX,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,6BAAgB,EAAC,MAAM,CAAC;YACtF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC9D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAC1E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO;YAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SACvC,CAAC;QAEF,mGAAmG;QACnG,oGAAoG;QACpG,mDAAmD;QACnD,IAAI,CAAC,QAAQ,CAAC,qBAAqB;YACjC,MAAM,IAAI,sBAAc,CAAC,8DAA8D,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,aAAa;YACzB,MAAM,IAAI,sBAAc,CAAC,sDAAsD,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAc,CAAC,sDAAsD,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxB,MAAM,IAAI,sBAAc,CAAC,kEAAkE,CAAC,CAAC;QAE/F,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAC7E,qBAAqB,CAAC,WAAmB;QACvC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,oBAAoB,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,sBAAc,CAAC,uBAAuB,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACxC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAc,CAAC,2BAA2B,QAAQ,CAAC,MAAM,GAAG,EAAE;gBACtE,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;CACF;AA5FD,gCA4FC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAc,CAAC,yCAAyC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@uveysservetoglu/kobil-auth",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "2.0.0",
|
|
4
4
|
"description": "KOBIL OIDC (OpenID Connect) authentication helper for Node.js: build authorization URLs and exchange authorization codes for tokens.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
"url": "https://github.com/uveysservetoglu/kobil-sdks"
|
|
21
21
|
},
|
|
22
22
|
"dependencies": {
|
|
23
|
-
"@uveysservetoglu/kobil-core": "^
|
|
23
|
+
"@uveysservetoglu/kobil-core": "^2.0.0"
|
|
24
24
|
},
|
|
25
25
|
"scripts": {
|
|
26
26
|
"build": "tsc -b"
|