@wbce-d9/api 12.0.0 → 12.0.1

package/dist/auth/drivers/openid.js

@@ -76,6 +76,14 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
             const client = await this.client;
             const codeChallenge = generators.codeChallenge(codeVerifier);
             const paramsConfig = typeof this.config['params'] === 'object' ? this.config['params'] : {};
+            const redirectAfterLogin = additionalParams?.['redirect'];
+            delete additionalParams?.['redirect'];
+            let finalRedirectUri = this.redirectUrl;
+            if (redirectAfterLogin) {
+                const redirectUriWithParams = new URL(this.redirectUrl);
+                redirectUriWithParams.searchParams.set('redirect', redirectAfterLogin);
+                finalRedirectUri = redirectUriWithParams.toString();
+            }
             return client.authorizationUrl({
                 scope: this.config['scope'] ?? 'openid profile email',
                 access_type: 'offline',
@@ -86,6 +94,7 @@ export class OpenIDAuthDriver extends BaseOAuthDriver {
                 // Some providers require state even with PKCE
                 state: codeChallenge,
                 nonce: codeChallenge,
+                redirect_uri: finalRedirectUri,
                 ...additionalParams,
             });
         }
@@ -147,28 +156,40 @@ export function createOpenIDAuthRouter(providerName) {
             expiresIn: '5m',
             issuer: 'directus',
         });
-        res.cookie(`openid.${providerName}`, token, {
+        const additionalParams = { ...req.query };
+        delete additionalParams['prompt'];
+        const authUrl = await provider.generateAuthUrl(codeVerifier, prompt, additionalParams);
+        const urlParams = new URL(authUrl);
+        const state = urlParams.searchParams.get('state');
+        const cookieName = `openid.${providerName}.${state || ''}`;
+        res.cookie(cookieName, token, {
             httpOnly: true,
             sameSite: 'lax',
         });
-        const additionalParams = { ...req.query };
-        delete additionalParams['prompt'];
-        delete additionalParams['redirect'];
-        return res.redirect(await provider.generateAuthUrl(codeVerifier, prompt, additionalParams));
+        return res.redirect(authUrl);
     }), respond);
     router.post('/callback', express.urlencoded({ extended: false }), (req, res) => {
         res.redirect(303, `./callback?${new URLSearchParams(req.body)}`);
     }, respond);
     router.get('/callback', asyncHandler(async (req, res, next) => {
+        const redirectUrl = req.query['redirect'];
+        const validRedirectUrl = isRedirectAllowedOnLogin(redirectUrl, providerName) ? redirectUrl : null;
+        const state = req.query['state'];
+        const cookieName = `openid.${providerName}.${state || ''}`;
+        const cookieValue = req.cookies[cookieName];
         let tokenData;
         try {
-            tokenData = jwt.verify(req.cookies[`openid.${providerName}`], env['SECRET'], {
+            tokenData = jwt.verify(cookieValue, env['SECRET'], {
                 issuer: 'directus',
             });
         }
         catch (e) {
-            logger.warn(e, `[OpenID] Couldn't verify OpenID cookie`);
-            throw new InvalidCredentialsException();
+            logger.warn(e, `[OpenID] Couldn't verify OpenID cookie ${state ? `for state ${state}` : ''}`);
+            const baseUrl = env['PUBLIC_URL'];
+            const loginPath = '/admin/login';
+            const url = new URL(loginPath, baseUrl);
+            const redirectTo = validRedirectUrl || url.toString();
+            return res.redirect(`${redirectTo}?reason=INVALID_CREDENTIALS`);
         }
         const { verifier, redirect, prompt } = tokenData;
         const accountability = {
@@ -187,7 +208,7 @@ export function createOpenIDAuthRouter(providerName) {
         });
         let authResponse;
         try {
-            res.clearCookie(`openid.${providerName}`);
+            res.clearCookie(cookieName);
             authResponse = await authenticationService.login(providerName, {
                 code: req.query['code'],
                 codeVerifier: verifier,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "12.0.0",
+  "version": "12.0.1",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,19 +143,19 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
+    "@wbce-d9/app": "9.33.8",
+    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/exceptions": "10.0.0",
     "@wbce-d9/extensions-sdk": "10.0.0",
-    "@wbce-d9/constants": "10.0.0",
     "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/schema": "10.0.0",
-    "@wbce-d9/storage-driver-azure": "10.0.0",
     "@wbce-d9/storage": "10.0.0",
+    "@wbce-d9/storage-driver-azure": "10.0.0",
     "@wbce-d9/storage-driver-cloudinary": "10.0.0",
-    "@wbce-d9/app": "9.33.7",
     "@wbce-d9/storage-driver-gcs": "10.0.0",
     "@wbce-d9/storage-driver-local": "10.0.0",
-    "@wbce-d9/storage-driver-s3": "10.0.0",
     "@wbce-d9/update-check": "10.0.0",
+    "@wbce-d9/storage-driver-s3": "10.0.0",
     "@wbce-d9/utils": "10.0.0"
   },
   "devDependencies": {