@uveysservetoglu/kobil-auth 1.0.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +38 -7
- package/dist/client.d.ts +24 -7
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +33 -16
- package/dist/client.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -12,13 +12,9 @@ npm install @uveysservetoglu/kobil-auth
|
|
|
12
12
|
```ts
|
|
13
13
|
import { AuthClient } from "@uveysservetoglu/kobil-auth";
|
|
14
14
|
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
clientId: process.env.OAUTH_CLIENT_ID!,
|
|
19
|
-
clientSecret: process.env.OAUTH_CLIENT_SECRET!,
|
|
20
|
-
scope: "openid profile email",
|
|
21
|
-
});
|
|
15
|
+
// Reads OIDC_ISSUER, OIDC_CLIENT_ID and OIDC_CLIENT_SECRET from the environment.
|
|
16
|
+
// Both endpoints are derived from the issuer.
|
|
17
|
+
const auth = new AuthClient({ scope: "openid profile email" });
|
|
22
18
|
|
|
23
19
|
// 1. Redirect the user to log in
|
|
24
20
|
const url = auth.buildAuthorizationUrl("https://app.example.com/callback");
|
|
@@ -29,6 +25,41 @@ const tokens = await auth.exchangeCodeForToken(code, "https://app.example.com/ca
|
|
|
29
25
|
|
|
30
26
|
JavaScript usage is identical (`const { AuthClient } = require("@uveysservetoglu/kobil-auth")`).
|
|
31
27
|
|
|
28
|
+
## API mode
|
|
29
|
+
|
|
30
|
+
The login page is the identity provider's in both modes: `{OIDC_ISSUER}/protocol/openid-connect/auth`.
|
|
31
|
+
Where the code is exchanged depends on the mode (see `@uveysservetoglu/kobil-core`):
|
|
32
|
+
|
|
33
|
+
| Mode | Token endpoint |
|
|
34
|
+
|---|---|
|
|
35
|
+
| `"miniapp"` (default) | `{MINIAPP_API_BASE}/v1/auth/tokens/{realm}` — the realm is read from the issuer |
|
|
36
|
+
| `"legacy"` | `{OIDC_ISSUER}/protocol/openid-connect/token` |
|
|
37
|
+
|
|
38
|
+
The user token you get back can act for that user in the other modules — the MiniApp API recommends
|
|
39
|
+
it for calls that target a `userId`:
|
|
40
|
+
|
|
41
|
+
```ts
|
|
42
|
+
import { StaticTokenProvider } from "@uveysservetoglu/kobil-core";
|
|
43
|
+
const chat = new ChatClient({ tokenProvider: new StaticTokenProvider(String(tokens.access_token)) });
|
|
44
|
+
```
|
|
45
|
+
|
|
46
|
+
## Environment
|
|
47
|
+
|
|
48
|
+
| Variable | Meaning |
|
|
49
|
+
|---|---|
|
|
50
|
+
| `OIDC_ISSUER` | Realm issuer URL. The login page — and, per mode, the token endpoint — are derived from it. |
|
|
51
|
+
| `OIDC_CLIENT_ID` | Client id. |
|
|
52
|
+
| `OIDC_CLIENT_SECRET` | Client secret. |
|
|
53
|
+
| `KOBIL_API_MODE` | `miniapp` (default) or `legacy`. |
|
|
54
|
+
| `MINIAPP_API_BASE` | MiniApp API origin (miniapp mode). Default `https://miniapp-api.cloud.kobil.com`. |
|
|
55
|
+
|
|
56
|
+
Pass `issuer`, `clientId`, `clientSecret`, `apiMode`, `apiBaseUrl` or `realm` to override any of them.
|
|
57
|
+
For a deployment whose endpoints are not at the standard paths, set `OIDC_AUTHORIZATION_ENDPOINT` /
|
|
58
|
+
`OIDC_TOKEN_ENDPOINT` (or pass `authorizationEndpoint` / `tokenEndpoint`) and that one is used as-is.
|
|
59
|
+
|
|
60
|
+
These are the same names the other KOBIL modules read and the same ones the SuperApp emulator
|
|
61
|
+
publishes at `/__superapp/control/env`.
|
|
62
|
+
|
|
32
63
|
Failures throw `KobilAuthError` (extends `KobilError` from `@uveysservetoglu/kobil-core`), carrying
|
|
33
64
|
`statusCode` and `responseBody` when available.
|
|
34
65
|
|
package/dist/client.d.ts
CHANGED
|
@@ -1,8 +1,19 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
1
|
+
import { KobilApiOptions } from "@uveysservetoglu/kobil-core";
|
|
2
|
+
export interface AuthClientOptions extends KobilApiOptions {
|
|
3
|
+
/**
|
|
4
|
+
* Realm issuer URL. Both endpoints are derived from it, so this is normally the only URL you set.
|
|
5
|
+
* Falls back to `OIDC_ISSUER`. The login page is always on the issuer; in miniapp mode the code is
|
|
6
|
+
* exchanged at the MiniApp API's `/v1/auth/tokens/{realm}`, with the realm read from the issuer.
|
|
7
|
+
*/
|
|
8
|
+
issuer?: string;
|
|
9
|
+
/** Falls back to `OIDC_CLIENT_ID`. */
|
|
10
|
+
clientId?: string;
|
|
11
|
+
/** Falls back to `OIDC_CLIENT_SECRET`. */
|
|
12
|
+
clientSecret?: string;
|
|
13
|
+
/** Only for a deployment whose endpoint is not at the issuer's standard path. */
|
|
14
|
+
authorizationEndpoint?: string;
|
|
15
|
+
/** Only for a deployment whose endpoint is not at the issuer's standard path. */
|
|
16
|
+
tokenEndpoint?: string;
|
|
6
17
|
/** Space-separated scopes. Default: "openid". */
|
|
7
18
|
scope?: string;
|
|
8
19
|
/** OAuth2 response type. Default: "code". */
|
|
@@ -12,10 +23,16 @@ export interface AuthClientOptions {
|
|
|
12
23
|
/** Length of the generated nonce. Default: 32. */
|
|
13
24
|
nonceLength?: number;
|
|
14
25
|
}
|
|
15
|
-
/**
|
|
26
|
+
/**
|
|
27
|
+
* OIDC authentication helper: build the login redirect URL and exchange the code for tokens.
|
|
28
|
+
*
|
|
29
|
+
* Every value can come from the environment — `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` —
|
|
30
|
+
* so `new AuthClient()` is enough when those are set. They are the same names the other modules read
|
|
31
|
+
* and the same ones the SuperApp emulator publishes.
|
|
32
|
+
*/
|
|
16
33
|
export declare class AuthClient {
|
|
17
34
|
private readonly options;
|
|
18
|
-
constructor(options
|
|
35
|
+
constructor(options?: AuthClientOptions);
|
|
19
36
|
/** Builds the authorization redirect URL, embedding a fresh secure nonce. */
|
|
20
37
|
buildAuthorizationUrl(redirectUri: string): string;
|
|
21
38
|
/** Exchanges an authorization code for tokens. Returns the parsed token response. */
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EAGhB,MAAM,6BAA6B,CAAC;AAKrC,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAcD;;;;;;GAMG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAE9B,OAAO,GAAE,iBAAsB;IA8B3C,6EAA6E;IAC7E,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAclD,qFAAqF;IAC/E,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAsCpC"}
|
package/dist/client.js
CHANGED
|
@@ -2,27 +2,44 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthClient = void 0;
|
|
4
4
|
const crypto_1 = require("crypto");
|
|
5
|
+
const kobil_core_1 = require("@uveysservetoglu/kobil-core");
|
|
5
6
|
const error_1 = require("./error");
|
|
6
7
|
const NONCE_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890_-";
|
|
7
|
-
/**
|
|
8
|
+
/**
|
|
9
|
+
* OIDC authentication helper: build the login redirect URL and exchange the code for tokens.
|
|
10
|
+
*
|
|
11
|
+
* Every value can come from the environment — `OIDC_ISSUER`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET` —
|
|
12
|
+
* so `new AuthClient()` is enough when those are set. They are the same names the other modules read
|
|
13
|
+
* and the same ones the SuperApp emulator publishes.
|
|
14
|
+
*/
|
|
8
15
|
class AuthClient {
|
|
9
16
|
options;
|
|
10
|
-
constructor(options) {
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
nonceLength: 32,
|
|
24
|
-
...options,
|
|
17
|
+
constructor(options = {}) {
|
|
18
|
+
const issuer = options.issuer ?? process.env.OIDC_ISSUER ?? "";
|
|
19
|
+
const resolved = {
|
|
20
|
+
authorizationEndpoint: options.authorizationEndpoint ||
|
|
21
|
+
process.env.OIDC_AUTHORIZATION_ENDPOINT ||
|
|
22
|
+
(0, kobil_core_1.authorizationEndpointFor)(issuer),
|
|
23
|
+
tokenEndpoint: options.tokenEndpoint || (0, kobil_core_1.defaultTokenEndpoint)(options, issuer),
|
|
24
|
+
clientId: options.clientId ?? process.env.OIDC_CLIENT_ID ?? "",
|
|
25
|
+
clientSecret: options.clientSecret ?? process.env.OIDC_CLIENT_SECRET ?? "",
|
|
26
|
+
scope: options.scope ?? "openid",
|
|
27
|
+
responseType: options.responseType ?? "code",
|
|
28
|
+
responseMode: options.responseMode ?? "query",
|
|
29
|
+
nonceLength: options.nonceLength ?? 32,
|
|
25
30
|
};
|
|
31
|
+
// Named after the environment variable rather than the option, because the environment is how this
|
|
32
|
+
// is configured in practice — an error saying "issuer is required" sends someone reading their code
|
|
33
|
+
// when the value is missing from their deployment.
|
|
34
|
+
if (!resolved.authorizationEndpoint)
|
|
35
|
+
throw new error_1.KobilAuthError("No authorization endpoint: set OIDC_ISSUER (or pass issuer).");
|
|
36
|
+
if (!resolved.tokenEndpoint)
|
|
37
|
+
throw new error_1.KobilAuthError("No token endpoint: set OIDC_ISSUER (or pass issuer).");
|
|
38
|
+
if (!resolved.clientId)
|
|
39
|
+
throw new error_1.KobilAuthError("No client id: set OIDC_CLIENT_ID (or pass clientId).");
|
|
40
|
+
if (!resolved.clientSecret)
|
|
41
|
+
throw new error_1.KobilAuthError("No client secret: set OIDC_CLIENT_SECRET (or pass clientSecret).");
|
|
42
|
+
this.options = resolved;
|
|
26
43
|
}
|
|
27
44
|
/** Builds the authorization redirect URL, embedding a fresh secure nonce. */
|
|
28
45
|
buildAuthorizationUrl(redirectUri) {
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,mCAAyC;AAEzC,MAAM,WAAW,GAAG,kEAAkE,CAAC;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,4DAIqC;AACrC,mCAAyC;AAEzC,MAAM,WAAW,GAAG,kEAAkE,CAAC;AAuCvF;;;;;;GAMG;AACH,MAAa,UAAU;IACJ,OAAO,CAAkB;IAE1C,YAAY,UAA6B,EAAE;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAoB;YAChC,qBAAqB,EACnB,OAAO,CAAC,qBAAqB;gBAC7B,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACvC,IAAA,qCAAwB,EAAC,MAAM,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAA,iCAAoB,EAAC,OAAO,EAAE,MAAM,CAAC;YAC7E,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE;YAC9D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE;YAC1E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO;YAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;SACvC,CAAC;QAEF,mGAAmG;QACnG,oGAAoG;QACpG,mDAAmD;QACnD,IAAI,CAAC,QAAQ,CAAC,qBAAqB;YACjC,MAAM,IAAI,sBAAc,CAAC,8DAA8D,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,aAAa;YACzB,MAAM,IAAI,sBAAc,CAAC,sDAAsD,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAc,CAAC,sDAAsD,CAAC,CAAC;QACzG,IAAI,CAAC,QAAQ,CAAC,YAAY;YACxB,MAAM,IAAI,sBAAc,CAAC,kEAAkE,CAAC,CAAC;QAE/F,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAC7E,qBAAqB,CAAC,WAAmB;QACvC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,aAAa,EAAE,CAAC,CAAC,YAAY;YAC7B,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,oBAAoB,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAoB;QAEpB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,sBAAc,CAAC,uBAAuB,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAc,CAAC,8BAA8B,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAChC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACxC,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE;gBACjD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAc,CAAC,2BAA2B,QAAQ,CAAC,MAAM,GAAG,EAAE;gBACtE,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,sBAAc,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;CACF;AA3FD,gCA2FC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAc,CAAC,yCAAyC,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,MAAM,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@uveysservetoglu/kobil-auth",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "3.0.0",
|
|
4
4
|
"description": "KOBIL OIDC (OpenID Connect) authentication helper for Node.js: build authorization URLs and exchange authorization codes for tokens.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
"url": "https://github.com/uveysservetoglu/kobil-sdks"
|
|
21
21
|
},
|
|
22
22
|
"dependencies": {
|
|
23
|
-
"@uveysservetoglu/kobil-core": "^
|
|
23
|
+
"@uveysservetoglu/kobil-core": "^3.0.0"
|
|
24
24
|
},
|
|
25
25
|
"scripts": {
|
|
26
26
|
"build": "tsc -b"
|