@webda/google-auth 4.0.0-beta.2 → 4.0.0-beta.4

package/webda.module.json

@@ -1,46 +1,180 @@
 {
+  "$schema": "https://webda.io/schemas/webda.module.v4.json",
   "beans": {},
   "deployers": {},
   "moddas": {
-    "Webda/GoogleAuthentication": "lib/google-auth:default"
-  },
-  "models": {
-    "graph": {},
-    "tree": {},
-    "plurals": {},
-    "list": {},
-    "reflections": {}
+    "Webda/GoogleAuthentication": {
+      "Import": "lib/google-auth.service:GoogleAuthentication",
+      "Schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "additionalProperties": false,
+        "definitions": {
+          "OAuthRedirects": {
+            "additionalProperties": false,
+            "description": "Browser redirects of the OAuth callback",
+            "properties": {
+              "failure": {
+                "description": "Where a failed login or callback lands, with `?reason=<CODE>` (required)",
+                "type": "string"
+              },
+              "success": {
+                "default": "/",
+                "description": "Where a successful login lands when the login did not carry an allowed `redirect` parameter",
+                "type": "string"
+              }
+            },
+            "type": "object"
+          },
+          "Record<string, any>": {
+            "additionalProperties": {},
+            "description": "Construct a type with a set of properties K of type T",
+            "type": "object"
+          }
+        },
+        "description": "Google login parameters\nhttps://developers.google.com/identity/protocols/oauth2/openid-connect",
+        "properties": {
+          "access_type": {
+            "default": "online",
+            "description": "Type of access: \"offline\" also returns a refresh token (stored encrypted in the ident tokens)",
+            "enum": [
+              "online",
+              "offline"
+            ],
+            "type": "string"
+          },
+          "allowedEmailDomains": {
+            "description": "Only these email domains may use this provider (see ProviderEmailPolicy)",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "audiences": {
+            "default": [],
+            "description": "Other client ids whose ID tokens `Auth.Google.Token` accepts (for example Android/iOS client ids)",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "auth_options": {
+            "$ref": "#/definitions/Record%3Cstring%2C%20any%3E",
+            "description": "Additional authorization url parameters (for example `prompt`, `login_hint`); cannot override `state`,\n`redirect_uri`, `scope`, `access_type`, `response_type`, `code_challenge*`, `nonce` nor `hd`\nSee https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters"
+          },
+          "authorized_uris": {
+            "default": [],
+            "description": "Allowed post-login targets for the `redirect` query parameter of the login route: absolute http(s) urls, a\ntarget matches when it has the same origin and its path is the listed path or below it",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "client_id": {
+            "description": "Google OAuth client id (web application)",
+            "type": "string"
+          },
+          "client_secret": {
+            "description": "Google OAuth client secret",
+            "type": "string"
+          },
+          "hostedDomain": {
+            "description": "Only accept Google Workspace accounts of this domain (the `hd` claim of the ID token); also sent as a hint to\nthe account chooser",
+            "type": "string"
+          },
+          "redirect_uri": {
+            "default": "\"<absolute url of the request>/callback\"; set it explicitly behind a proxy",
+            "description": "Callback url registered at the provider",
+            "type": "string"
+          },
+          "redirects": {
+            "$ref": "#/definitions/OAuthRedirects",
+            "description": "Browser redirects of the callback"
+          },
+          "scope": {
+            "default": [
+              "openid",
+              "email",
+              "profile"
+            ],
+            "description": "Scopes requested from Google",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "trustEmailVerification": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "boolean"
+              }
+            ],
+            "description": "Whether the verification of the email is believed (see ProviderEmailPolicy)"
+          },
+          "type": {
+            "description": "Type of the service",
+            "type": "string"
+          },
+          "url": {
+            "default": "/auth/<providerName>",
+            "description": "Route prefix of the login (`<url>`) and callback (`<url>/callback`) routes",
+            "type": "string"
+          },
+          "openapi": {
+            "type": "object",
+            "additionalProperties": true
+          }
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "type"
+        ],
+        "type": "object",
+        "title": "GoogleAuthentication"
+      },
+      "Configuration": "lib/google-auth.service:GoogleParameters"
+    }
   },
+  "models": {},
   "schemas": {
     "Webda/BinaryFile": {
-      "type": "object",
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "WebdaSchema": true,
+      "additionalProperties": false,
+      "description": "Represent a file to store",
       "properties": {
-        "hash": {
-          "type": "string",
-          "description": "Will be computed by the service\n\nhash of the content"
-        },
         "challenge": {
-          "type": "string",
-          "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'"
+          "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
+          "type": "string"
         },
-        "size": {
-          "type": "number",
-          "description": "Size of the binary"
+        "hash": {
+          "description": "Will be computed by the service\n\nhash of the content",
+          "type": "string"
         },
-        "name": {
-          "type": "string",
-          "description": "Current name"
+        "metadata": {
+          "description": "Metadatas stored along with the binary"
         },
         "mimetype": {
-          "type": "string",
-          "description": "Mimetype of the binary"
+          "description": "Mimetype of the binary",
+          "type": "string"
         },
-        "metadata": {
-          "description": "Metadatas stored along with the binary"
+        "name": {
+          "description": "Current name",
+          "type": "string"
         },
         "originalname": {
-          "type": "string",
-          "description": "Original name"
+          "description": "Original name",
+          "type": "string"
+        },
+        "size": {
+          "description": "Size of the binary",
+          "type": "number"
         }
       },
       "required": [
@@ -48,120 +182,34 @@
         "name",
         "size"
       ],
-      "description": "Represent a file to store",
-      "$schema": "http://json-schema.org/draft-07/schema#",
+      "type": "object",
       "title": "BinaryFile"
     },
-    "Webda/GoogleAuthentication": {
-      "type": "object",
+    "Webda/OAuthTokenRequest": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "WebdaSchema": true,
+      "additionalProperties": false,
+      "definitions": {
+        "OAuthTokens": {
+          "additionalProperties": {},
+          "description": "Credentials as returned by an OAuth token endpoint (google-auth-library `Credentials` shape): `id_token`,\n`access_token`, `refresh_token`, `expiry_date`, `token_type`, `scope`... Values are not typed by the schema\n(providers send nulls); providers check what they use.",
+          "type": "object"
+        }
+      },
+      "description": "Input of the `Auth.<Provider>.Token` operations: `token`, or the provider credentials `tokens`",
       "properties": {
-        "type": {
-          "type": "string",
-          "description": "Type of the service"
-        },
-        "url": {
-          "type": "string",
-          "description": "URL to use for expose\n\nThe default value varying based on implementation It should by default be the provider name in lowercase"
+        "token": {
+          "description": "Token issued by the provider to the client (an ID token for OpenID Connect providers)",
+          "type": "string"
         },
-        "scope": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "Scope to request on OAuth flow"
-        },
-        "exposeScope": {
-          "type": "boolean",
-          "description": "If set to true it will add a ${url}/scope So client can anticipate the requested scope\n\nThis is useful when using the client api to generate token. This way the service can request the wanted scope",
-          "default": false
-        },
-        "authorized_uris": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          },
-          "description": "List of URIs authorized for redirect post authorization",
-          "default": []
-        },
-        "redirect_uri": {
-          "type": "string",
-          "description": "Default redirect_uri",
-          "default": "${url}/callback"
-        },
-        "no_referer": {
-          "type": "boolean",
-          "description": "Allow direct connection without a referer",
-          "default": false
-        },
-        "authenticationService": {
-          "type": "string",
-          "description": "Name of the authentication service to use if exist",
-          "default": "Authentication"
-        },
-        "client_id": {
-          "type": "string",
-          "description": "Google Auth Client id"
-        },
-        "client_secret": {
-          "type": "string",
-          "description": "Google Auth Client secret"
-        },
-        "project_id": {
-          "type": "string",
-          "description": "Google Project ID"
-        },
-        "access_type": {
-          "type": "string",
-          "enum": [
-            "online",
-            "offline"
-          ],
-          "description": "Type of access for Google token\n\nonline by default"
-        },
-        "auth_options": {},
-        "redirects": {
-          "type": "object",
-          "properties": {
-            "use_referer": {
-              "type": "boolean"
-            },
-            "whitelist": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              }
-            },
-            "defaults": {
-              "type": "object",
-              "additionalProperties": {
-                "type": "string"
-              }
-            }
-          },
-          "required": [
-            "use_referer",
-            "whitelist",
-            "defaults"
-          ]
-        },
-        "openapi": {
-          "type": "object",
-          "additionalProperties": true
+        "tokens": {
+          "$ref": "#/definitions/OAuthTokens",
+          "description": "Credentials obtained by the client from the provider (v3 body; its `id_token` is verified)"
         }
       },
-      "required": [
-        "authenticationService",
-        "client_id",
-        "client_secret",
-        "exposeScope",
-        "no_referer",
-        "redirects",
-        "scope",
-        "type"
-      ],
-      "description": "Credentials to manage Google Auth https://developers.google.com/identity/protocols/oauth2",
-      "$schema": "http://json-schema.org/draft-07/schema#",
-      "title": "GoogleAuthentication"
+      "type": "object",
+      "title": "OAuthTokenRequest"
     }
-  }
+  },
+  "behaviors": {}
 }

package/lib/google-auth.d.ts

@@ -1,125 +0,0 @@
-import { OAuthEvents, OAuthService, OAuthServiceParameters, RequestFilter, WebContext } from "@webda/core";
-import { Credentials, OAuth2Client } from "google-auth-library";
-export interface EventGoogleOAuthToken {
-    /**
-     * Tokens retrieved from Google
-     */
-    tokens: Credentials;
-    /**
-     * Request context
-     */
-    context: WebContext;
-}
-/**
- * Credentials to manage Google Auth
- * https://developers.google.com/identity/protocols/oauth2
- */
-export declare class GoogleParameters extends OAuthServiceParameters {
-    /**
-     * Google Auth Client id
-     */
-    client_id: string;
-    /**
-     * Google Auth Client secret
-     */
-    client_secret: string;
-    /**
-     * Google Project ID
-     */
-    project_id?: string;
-    /**
-     * Type of access for Google token
-     *
-     * online by default
-     */
-    access_type?: "online" | "offline";
-    auth_options?: any;
-    redirects: {
-        use_referer: boolean;
-        whitelist: string[];
-        defaults: {
-            [key: string]: string;
-        };
-    };
-    constructor(params: any);
-}
-type GoogleAuthEvents = OAuthEvents & {
-    "GoogleAuth.Tokens": EventGoogleOAuthToken;
-};
-/**
- * Manage Google Authentication
- *
- * @WebdaModda
- */
-export default class GoogleAuthentication<T extends GoogleParameters = GoogleParameters> extends OAuthService<T, GoogleAuthEvents> implements RequestFilter<WebContext> {
-    protected _client: OAuth2Client;
-    /**
-     * Return provider name
-     * @returns
-     */
-    getName(): string;
-    /**
-     * Allow every accounts.google.
-     */
-    getCallbackReferer(): RegExp[];
-    /**
-     * Get OAuth callback query parameters
-     * @returns
-     */
-    getCallbackQueryParams(): {
-        name: string;
-        required: boolean;
-    }[];
-    /**
-     * Expose on /google by default
-     */
-    getDefaultUrl(): string;
-    /**
-     * We manage Google Auth Token
-     */
-    hasToken(): boolean;
-    /**
-     * @inheritdoc
-     */
-    loadParameters(params: any): GoogleParameters;
-    /**
-     *
-     * @param redirect_uri
-     * @param state
-     */
-    generateAuthUrl(redirect_uri: string, state: string, _ctx: WebContext): string;
-    /**
-     * Return a google oauth client
-     * @param redirect_uri
-     */
-    getOAuthClient(redirect_uri?: string): OAuth2Client;
-    /**
-     * @inheritdoc
-     */
-    handleCallback(ctx: WebContext): Promise<{
-        identId: any;
-        profile: any;
-    }>;
-    /**
-     * Retrieve the user profile based on the token
-     * @param token
-     * @returns
-     */
-    getUserInfo(token: string): Promise<import("google-auth-library").TokenPayload>;
-    /**
-     * Verify a Google Auth Token
-     */
-    handleToken(context: WebContext): Promise<{
-        identId: string;
-        profile: import("google-auth-library").TokenPayload;
-    }>;
-    /**
-     * Retrieve Google Client
-     *
-     * Redirecting to the webbrowser for the OAuth validation
-     * Store the token in user store afterwards
-     */
-    getLocalClient(token: Credentials, open: (url: string) => void, storeToken: (token: Credentials) => Promise<void>): Promise<OAuth2Client>;
-}
-export { GoogleAuthentication };
-//# sourceMappingURL=google-auth.d.ts.map

package/lib/google-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"google-auth.d.ts","sourceRoot":"","sources":["../src/google-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,sBAAsB,EAEtB,aAAa,EACb,UAAU,EAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhE,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,sBAAsB;IAC1D;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAEnC,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,SAAS,EAAE;QAET,WAAW,EAAE,OAAO,CAAC;QAErB,SAAS,EAAE,MAAM,EAAE,CAAC;QAEpB,QAAQ,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;KACrC,CAAC;gBAEU,MAAM,KAAA;CAInB;AAED,KAAK,gBAAgB,GAAG,WAAW,GAAG;IACpC,mBAAmB,EAAE,qBAAqB,CAAC;CAC5C,CAAC;AACF;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,CACrF,SAAQ,YAAY,CAAC,CAAC,EAAE,gBAAgB,CACxC,YAAW,aAAa,CAAC,UAAU,CAAC;IAEpC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC;;;OAGG;IACH,OAAO;IAIP;;OAEG;IACH,kBAAkB,IAAI,MAAM,EAAE;IAI9B;;;OAGG;IACH,sBAAsB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAAE;IA6B/D;;OAEG;IACH,aAAa;IAIb;;OAEG;IACH,QAAQ;IAIR;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,GAAG,GAAG,gBAAgB;IAI7C;;;;OAIG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;IAYrE;;;OAGG;IACH,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY;IAInD;;OAEG;IACG,cAAc,CAAC,GAAG,EAAE,UAAU;;;;IA0BpC;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM;IAS/B;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,UAAU;;;;IAYrC;;;;;OAKG;IACG,cAAc,CAClB,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,YAAY,CAAC;CA0DzB;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}