@webda/google-auth 4.0.0-beta.3 → 4.0.0-beta.5

package/README.md

@@ -15,91 +15,94 @@ This module is part of Webda Application Framework that allows you to quickly de
 
 # @webda/google-auth
 
-> Google OAuth 2.0 authentication provider for Webda — adds `GET /auth/google` and callback handling to your application so users can sign in with their Google account.
+> "Sign in with Google" (OpenID Connect) provider for [`@webda/auth`](../auth): adds `GET /auth/google`, its callback
+> and the `Auth.Google.Token` operation; logins go through the `Authentication` service (linking, registration,
+> sessions, tokens).
 
 ## When to use it
 
-- You want to add "Sign in with Google" to a Webda application without hand-rolling OAuth flows.
-- You need an offline access token (e.g. for server-side Google API calls on behalf of the user).
-- You are building a multi-provider auth system alongside other `@webda/oauth` providers.
+- You want users to sign in with their Google account, in the browser or from a mobile/desktop client holding a
+  Google ID token.
+- You want to restrict logins to a Google Workspace domain (`hostedDomain`).
+- You need an offline Google refresh token (`access_type: "offline"`; stored in the ident tokens).
 
 ## Install
 
 ```bash
-pnpm add @webda/google-auth
+pnpm add @webda/auth @webda/google-auth
 ```
 
 ## Configuration
 
-```json
+`GoogleAuthentication` is a provider service next to `Authentication` (see the
+[Authentication guide](https://docs.webda.io/Security/Authentication)):
+
+```jsonc
 {
   "services": {
-    "Authentication": {
-      "type": "Authentication",
-      "providers": {
-        "google": {
-          "type": "GoogleAuthentication",
-          "client_id": "${GOOGLE_CLIENT_ID}",
-          "client_secret": "${GOOGLE_CLIENT_SECRET}",
-          "access_type": "online",
-          "redirect_uri": "https://myapp.example.com/auth/google/callback"
-        }
-      }
+    "Authentication": { "type": "Webda/Authentication" },
+    "google": {
+      "type": "Webda/GoogleAuthentication",
+      "client_id": "${GOOGLE_CLIENT_ID}",
+      "client_secret": "${GOOGLE_CLIENT_SECRET}",
+      // Register exactly this url in the Google Cloud console; set it explicitly behind a proxy
+      "redirect_uri": "https://api.example.com/auth/google/callback",
+      "redirects": {
+        "success": "https://app.example.com/", // default "/"
+        "failure": "https://app.example.com/login" // required, receives ?reason=CODE
+      },
+      // Allowed targets of GET /auth/google?redirect=... (same origin, this path or below)
+      "authorized_uris": ["https://app.example.com/"],
+      "audiences": ["1234-ios.apps.googleusercontent.com"], // other client ids accepted by Auth.Google.Token
+      "hostedDomain": "example.com" // optional: Google Workspace accounts of this domain only
     }
   }
 }
 ```
 
-| Parameter | Type | Default | Required | Description |
-|---|---|---|---|---|
-| `client_id` | string | — | Yes | Google OAuth 2.0 Client ID from Google Cloud Console |
-| `client_secret` | string | — | Yes | Google OAuth 2.0 Client Secret |
-| `access_type` | `"online"` \| `"offline"` | `"online"` | No | `"offline"` returns a refresh token for server-side API access |
-| `project_id` | string | — | No | Google Cloud Project ID (informational) |
-| `auth_options` | object | — | No | Additional parameters forwarded to the Google authorization URL |
-| `redirects.use_referer` | boolean | — | No | Redirect to the HTTP Referer after successful login |
-| `redirects.whitelist` | string[] | — | No | Allowed redirect URLs (regexp strings) |
+| Parameter                                       | Default                          | Description                                                                                     |
+| ----------------------------------------------- | -------------------------------- | ----------------------------------------------------------------------------------------------- |
+| `client_id`, `client_secret`                    | required                         | OAuth client of type "Web application"                                                          |
+| `url`                                           | `/auth/google`                   | Prefix of the login and callback routes                                                         |
+| `redirect_uri`                                  | request url + `/callback`        | Callback url sent to Google                                                                     |
+| `redirects.success` / `redirects.failure`       | `/` / required                   | Where the callback redirects                                                                    |
+| `authorized_uris`                               | `[]`                             | Allowed `redirect` parameters (absolute urls)                                                   |
+| `scope`                                         | `["openid", "email", "profile"]` | Requested scopes (`openid` is needed for the ID token)                                          |
+| `access_type`                                   | `"online"`                       | `"offline"` also returns a refresh token                                                        |
+| `audiences`                                     | `[]`                             | Extra client ids accepted by `Auth.Google.Token`                                                |
+| `hostedDomain`                                  | -                                | Required `hd` claim; refused with `EMAIL_DOMAIN_NOT_ALLOWED`                                    |
+| `auth_options`                                  | -                                | Extra authorization url parameters (`prompt`, `login_hint`...); cannot override the flow fields |
+| `allowedEmailDomains`, `trustEmailVerification` | -                                | Per-provider email policy of `@webda/auth`                                                      |
 
 ## Usage
 
+- Browser: link to `GET /auth/google?redirect=https://app.example.com/after`. The flow uses PKCE and an OpenID nonce,
+  kept in a short-lived encrypted `webda_oauth_google` cookie (so it also works with a `SameSite=Strict` session
+  cookie). After the Google consent the callback logs the user in and redirects to `redirect` (or
+  `redirects.success`), adding `?mfa=required` when the user still has to pass MFA. Failures redirect to
+  `redirects.failure?reason=CODE` (`STATE_MISMATCH`, `PROVIDER_ERROR`, `TOKEN_INVALID`, `ACCOUNT_EXISTS`,
+  `EMAIL_DOMAIN_NOT_ALLOWED`, ...).
+- Other clients: `POST /auth/google/token` (`Auth.Google.Token`) with a JSON body `{ "token": "<Google ID token>" }`
+  or the v3 body `{ "tokens": { "id_token": "...", "access_token": "...", ... } }` returns the `@webda/auth` result
+  (`{ status: "ok", accessToken, refreshToken, ... }`). Only ID tokens are verified; access tokens alone are refused.
+  This operation never links the identity to an already logged-in user.
+
+The Google identity is the ID token `sub`; the email is only treated as verified when `email_verified` is `true`.
+Google credentials are stored encrypted on the ident (`await ident.tokens.get()`) and published after each login:
+
 ```typescript
-// 1. Register your OAuth credentials in Google Cloud Console:
-//    APIs & Services > Credentials > Create OAuth 2.0 Client ID
-//    Authorized redirect URI: https://myapp.example.com/auth/google/callback
-
-// 2. Configure (see above). The framework auto-registers these routes:
-//    GET  /auth/google           → redirects to Google consent screen
-//    GET  /auth/google/callback  → handles the OAuth callback, creates a session
-
-// 3. Listen to the auth event to customize post-login behaviour:
-import { GoogleAuthentication } from "@webda/google-auth";
-import { Bean, Inject } from "@webda/core";
-
-@Bean
-export class ProfileSync extends Service {
-  @Inject("Authentication")
-  auth: any;
-
-  async resolve(): Promise<this> {
-    await super.resolve();
-    // Fired after a successful Google login
-    this.auth.on("GoogleAuth.Tokens", async ({ tokens, context }) => {
-      // tokens.access_token, tokens.refresh_token (if access_type=offline)
-      const user = context.getCurrentUser();
-      // ... sync Google profile data to your User model
-    });
-    return this;
-  }
-}
+useService("google").on("GoogleAuth.Tokens", async ({ tokens, context }) => {
+  // tokens.access_token, tokens.refresh_token (access_type "offline")
+});
 ```
 
 ## Reference
 
-- API reference: see the auto-generated typedoc at `docs/pages/Modules/google-auth/`.
 - Source: [`packages/google-auth`](https://github.com/loopingz/webda.io/tree/main/packages/google-auth)
-- Related: [`@webda/core`](../core) Authentication service; [`@webda/gcp`](../gcp) for Cloud-side GCP integrations.
+- Related: [`@webda/auth`](../auth) (`OAuthProvider` base class, `Authentication` service).
 
 <!-- README_FOOTER -->
+
 ## Sponsors
 
 <!--

package/lib/google-auth.service.d.ts

@@ -1,136 +1,125 @@
-import { EventWithContext, OAuthEvents, OAuthService, OAuthServiceParameters, RequestFilter, WebContext } from "@webda/core";
-import { Credentials, OAuth2Client } from "google-auth-library";
-export interface EventGoogleOAuthToken extends EventWithContext<WebContext> {
+import { type AuthResult, type EventWithContext, type ResolvedIdentity } from "@webda/core";
+import { type OAuthAuthorizationRequest, type OAuthCallbackRequest, OAuthProvider, OAuthProviderParameters, type OAuthTokenRequest } from "@webda/auth";
+import { type Credentials, OAuth2Client, type TokenPayload } from "google-auth-library";
+/** Emitted with the Google credentials of a successful login */
+export interface EventGoogleOAuthToken extends EventWithContext {
     /**
-     * Tokens retrieved from Google
+     * Credentials: from the code exchange (browser flow), or as sent to `Auth.Google.Token` (`tokens`, or
+     * `{ id_token }` for a bare token). Only the ID token is verified: treat the other values as client-provided on
+     * the token operation
      */
     tokens: Credentials;
 }
+/** Events of GoogleAuthentication */
+export type GoogleAuthEvents = {
+    "GoogleAuth.Tokens": EventGoogleOAuthToken;
+};
 /**
- * Credentials to manage Google Auth
- * https://developers.google.com/identity/protocols/oauth2
+ * Google login parameters
+ * https://developers.google.com/identity/protocols/oauth2/openid-connect
  */
-export declare class GoogleParameters extends OAuthServiceParameters {
+export declare class GoogleParameters extends OAuthProviderParameters {
     /**
-     * Google Auth Client id
+     * Google OAuth client id (web application)
      */
     client_id: string;
     /**
-     * Google Auth Client secret
+     * Google OAuth client secret
      */
     client_secret: string;
     /**
-     * Google Project ID
+     * Scopes requested from Google
+     * @default ["openid", "email", "profile"]
      */
-    project_id?: string;
+    scope?: string[];
     /**
-     * Type of access for Google token
-     *
-     * online by default
+     * Type of access: "offline" also returns a refresh token (stored encrypted in the ident tokens)
+     * @default "online"
      */
     access_type?: "online" | "offline";
-    auth_options?: any;
-    redirects?: {
-        use_referer: boolean;
-        whitelist: string[];
-        defaults: {
-            [key: string]: string;
-        };
-    };
-    /**
-     * Load parameters with Google defaults
-     * @param params - the service parameters
-     * @returns this
-     */
-    load(params?: any): this;
-}
-type GoogleAuthEvents = OAuthEvents & {
-    "GoogleAuth.Tokens": EventGoogleOAuthToken;
-};
-/**
- * Manage Google Authentication
- *
- * @WebdaModda
- */
-export default class GoogleAuthentication<T extends GoogleParameters = GoogleParameters> extends OAuthService<T, GoogleAuthEvents> implements RequestFilter<WebContext> {
-    protected _client: OAuth2Client;
     /**
-     * Return provider name
-     * @returns the provider name
+     * Other client ids whose ID tokens `Auth.Google.Token` accepts (for example Android/iOS client ids)
+     * @default []
      */
-    getName(): string;
+    audiences?: string[];
     /**
-     * Allow every accounts.google.
-     * @returns the referer patterns allowed to call back
+     * Only accept Google Workspace accounts of this domain (the `hd` claim of the ID token); also sent as a hint to
+     * the account chooser
      */
-    getCallbackReferer(): RegExp[];
+    hostedDomain?: string;
     /**
-     * Get OAuth callback query parameters
-     * @returns the callback query parameters
+     * Additional authorization url parameters (for example `prompt`, `login_hint`); cannot override `state`,
+     * `redirect_uri`, `scope`, `access_type`, `response_type`, `code_challenge*`, `nonce` nor `hd`
+     * See https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters
      */
-    getCallbackQueryParams(): {
-        name: string;
-        required: boolean;
-    }[];
+    auth_options?: Record<string, any>;
     /**
-     * Expose on /google by default
-     * @returns the default url
+     * @param params - raw parameters
+     * @returns this
      */
-    getDefaultUrl(): string;
+    load(params?: any): this;
+}
+/**
+ * Sign in with Google (OpenID Connect)
+ *
+ * The browser flow (`GET /auth/google`, `GET /auth/google/callback`) uses PKCE and a nonce, exchanges the code and
+ * verifies the returned ID token for `client_id`. `Auth.Google.Token` accepts a Google ID token, as `token` or as
+ * the `id_token` of `tokens` (v3 body), whose audience is `client_id` or one of `audiences` (never an access
+ * token). Credentials are stored encrypted on the ident and emitted with `GoogleAuth.Tokens` after the login.
+ * @WebdaModda GoogleAuthentication
+ */
+export declare class GoogleAuthentication<T extends GoogleParameters = GoogleParameters> extends OAuthProvider<T, GoogleAuthEvents> {
+    static Parameters: typeof GoogleParameters;
+    readonly providerName = "google";
+    /** Client verifying ID tokens: one per service so the Google certificates cache is reused */
+    protected verifier: OAuth2Client;
+    /** @override */
+    init(): Promise<this>;
     /**
-     * We manage Google Auth Token
-     * @returns true
+     * @param redirectUri - callback url
+     * @returns a Google OAuth client for the authorization url and the code exchange
      */
-    hasToken(): boolean;
+    protected getClient(redirectUri?: string): OAuth2Client;
     /**
-     * Generate the Google authorization url
-     * @param redirect_uri - the url Google will redirect to
-     * @param state - the random state to verify on callback
-     * @param _ctx - the request context
-     * @returns the authorization url
+     * @param request - authorization request
+     * @returns the Google authorization url
      */
-    generateAuthUrl(redirect_uri: string, state: string, _ctx: WebContext): string;
+    getAuthorizationUrl(request: OAuthAuthorizationRequest): string;
     /**
-     * Return a google oauth client
-     * @param redirect_uri - the redirect url to use
-     * @returns a new OAuth2 client
+     * Exchange the code with the PKCE verifier, verify the returned ID token for `client_id` and its nonce
+     * @param request - code exchange
+     * @returns the identity, with the credentials of the exchange
      */
-    getOAuthClient(redirect_uri?: string): OAuth2Client;
+    handleCallback(request: OAuthCallbackRequest): Promise<ResolvedIdentity>;
     /**
-     * @inheritdoc
-     * @param ctx - the request context
-     * @returns the identity and profile
+     * Verify a Google ID token sent by a client, as `token` or `tokens.id_token`
+     * @param request - token request
+     * @returns the identity, with the credentials sent in `tokens`
      */
-    handleCallback(ctx: WebContext): Promise<{
-        identId: any;
-        profile: any;
-    }>;
+    handleToken(request: OAuthTokenRequest): Promise<ResolvedIdentity>;
     /**
-     * Retrieve the user profile based on the token
-     * @param token - the Google id token
-     * @returns the token payload
+     * Emit `GoogleAuth.Tokens` once the login succeeded
+     * @param identity - the identity
+     * @param _result - the result
+     * @param source - browser callback or token operation
+     * @param request - the token operation request
      */
-    getUserInfo(token: string): Promise<import("google-auth-library").TokenPayload>;
+    protected onAuthenticated(identity: ResolvedIdentity, _result: AuthResult, source: "callback" | "token", request?: OAuthTokenRequest): Promise<void>;
     /**
-     * Verify a Google Auth Token
-     * @param context - the request context
-     * @returns the identity and profile
+     * Verify an ID token: signature, expiry, issuer (google-auth-library), audience and hosted domain
+     * @param idToken - ID token
+     * @param audiences - accepted audiences
+     * @returns the payload
+     * @throws TokenInvalid when the token does not verify
+     * @throws EmailDomainNotAllowed when `hostedDomain` is set and the token is not from that domain
      */
-    handleToken(context: WebContext): Promise<{
-        identId: string;
-        profile: import("google-auth-library").TokenPayload;
-    }>;
+    protected verifyIdToken(idToken: string, audiences: string[]): Promise<TokenPayload>;
     /**
-     * Retrieve Google Client
-     *
-     * Redirecting to the webbrowser for the OAuth validation
-     * Store the token in user store afterwards
-     * @param token - existing credentials to reuse, if any
-     * @param open - callback to open the authorization url in a browser
-     * @param storeToken - callback to persist the retrieved credentials
-     * @returns the authenticated OAuth2 client
+     * @param payload - verified ID token payload
+     * @param tokens - credentials to store
+     * @returns the identity
      */
-    getLocalClient(token: Credentials, open: (url: string) => void, storeToken: (token: Credentials) => Promise<void>): Promise<OAuth2Client>;
+    protected toIdentity(payload: TokenPayload, tokens?: Credentials): ResolvedIdentity;
 }
-export { GoogleAuthentication };
+export default GoogleAuthentication;
 //# sourceMappingURL=google-auth.service.d.ts.map

package/lib/google-auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth.service.d.ts","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,sBAAsB,EAEtB,aAAa,EACb,UAAU,EAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhE,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB,CAAC,UAAU,CAAC;IACzE;;OAEG;IACH,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,sBAAsB;IAC1D;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAEnC,YAAY,CAAC,EAAE,GAAG,CAAC;IACnB,SAAS,CAAC,EAAE;QAEV,WAAW,EAAE,OAAO,CAAC;QAErB,SAAS,EAAE,MAAM,EAAE,CAAC;QAEpB,QAAQ,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;SAAE,CAAC;KACrC,CAAC;IAEF;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED,KAAK,gBAAgB,GAAG,WAAW,GAAG;IACpC,mBAAmB,EAAE,qBAAqB,CAAC;CAC5C,CAAC;AACF;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,CACrF,SAAQ,YAAY,CAAC,CAAC,EAAE,gBAAgB,CACxC,YAAW,aAAa,CAAC,UAAU,CAAC;IAEpC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;IAEhC;;;OAGG;IACH,OAAO,WAEN;IAED;;;OAGG;IACH,kBAAkB,IAAI,MAAM,EAAE,CAE7B;IAED;;;OAGG;IACH,sBAAsB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,EAAE,CA2B9D;IAED;;;OAGG;IACH,aAAa,WAEZ;IAED;;;OAGG;IACH,QAAQ,YAEP;IAED;;;;;;OAMG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,UAUpE;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,YAAY,CAElD;IAED;;;;OAIG;IACG,cAAc,CAAC,GAAG,EAAE,UAAU;;;OAwBnC;IAED;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,uDAO9B;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,UAAU;;;OAUpC;IAED;;;;;;;;;OASG;IACG,cAAc,CAClB,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC3B,UAAU,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,YAAY,CAAC,CAyDvB;CACF;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"google-auth.service.d.ts","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAA0B,MAAM,aAAa,CAAC;AACpH,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,aAAa,EACb,uBAAuB,EACvB,KAAK,iBAAiB,EAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,KAAK,WAAW,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE7G,gEAAgE;AAChE,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D;;;;OAIG;IACH,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,qCAAqC;AACrC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,mBAAmB,EAAE,qBAAqB,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,uBAAuB;IAC3D;;OAEG;IACK,SAAS,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACK,aAAa,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACK,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEnC;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAM3B;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,CAAE,SAAQ,aAAa,CACpG,CAAC,EACD,gBAAgB,CACjB;IACC,MAAM,CAAC,UAAU,0BAAoB;IAErC,QAAQ,CAAC,YAAY,YAAY;IAEjC,6FAA6F;IAC7F,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC;IAEjC,gBAAgB;IACV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAI1B;IAED;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAMtD;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAc9D;IAED;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoB7E;IAED;;;;OAIG;IACG,WAAW,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAcvE;IAED;;;;;;OAMG;IACH,UAAgB,eAAe,CAC7B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,UAAU,GAAG,OAAO,EAC5B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAGf;IAED;;;;;;;OAOG;IACH,UAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BzF;IAED;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAUlF;CACF;eAcc,oBAAoB"}

package/lib/google-auth.service.js

@@ -1,241 +1,197 @@
-import { OAuthService, OAuthServiceParameters, WebdaError } from "@webda/core";
-import { OAuth2Client } from "google-auth-library";
-import * as http from "node:http";
+import { timingSafeEqual } from "node:crypto";
+import { useContext, WebdaError } from "@webda/core";
+import { EmailDomainNotAllowed, OAuthProvider, OAuthProviderParameters, safeErrorReason, TokenInvalid } from "@webda/auth";
+import { CodeChallengeMethod, OAuth2Client } from "google-auth-library";
 /**
- * Credentials to manage Google Auth
- * https://developers.google.com/identity/protocols/oauth2
+ * Google login parameters
+ * https://developers.google.com/identity/protocols/oauth2/openid-connect
  */
-export class GoogleParameters extends OAuthServiceParameters {
+export class GoogleParameters extends OAuthProviderParameters {
     /**
-     * Load parameters with Google defaults
-     * @param params - the service parameters
+     * @param params - raw parameters
      * @returns this
      */
     load(params = {}) {
         super.load(params);
         this.access_type ?? (this.access_type = "online");
+        this.scope ?? (this.scope = ["openid", "email", "profile"]);
+        this.audiences ?? (this.audiences = []);
         return this;
     }
 }
 /**
- * Manage Google Authentication
+ * Sign in with Google (OpenID Connect)
  *
- * @WebdaModda
+ * The browser flow (`GET /auth/google`, `GET /auth/google/callback`) uses PKCE and a nonce, exchanges the code and
+ * verifies the returned ID token for `client_id`. `Auth.Google.Token` accepts a Google ID token, as `token` or as
+ * the `id_token` of `tokens` (v3 body), whose audience is `client_id` or one of `audiences` (never an access
+ * token). Credentials are stored encrypted on the ident and emitted with `GoogleAuth.Tokens` after the login.
+ * @WebdaModda GoogleAuthentication
  */
-export default class GoogleAuthentication extends OAuthService {
-    /**
-     * Return provider name
-     * @returns the provider name
-     */
-    getName() {
-        return "google";
+export class GoogleAuthentication extends OAuthProvider {
+    constructor() {
+        super(...arguments);
+        this.providerName = "google";
     }
-    /**
-     * Allow every accounts.google.
-     * @returns the referer patterns allowed to call back
-     */
-    getCallbackReferer() {
-        return [/accounts\.google\.[a-z]+$/];
+    /** @override */
+    async init() {
+        await super.init();
+        this.verifier = new OAuth2Client({ clientId: this.parameters.client_id });
+        return this;
     }
     /**
-     * Get OAuth callback query parameters
-     * @returns the callback query parameters
+     * @param redirectUri - callback url
+     * @returns a Google OAuth client for the authorization url and the code exchange
      */
-    getCallbackQueryParams() {
-        return [
-            {
-                name: "code",
-                required: true
-            },
-            {
-                name: "scope",
-                required: true
-            },
-            {
-                name: "state",
-                required: true
-            },
-            {
-                name: "authuser",
-                required: false
-            },
-            {
-                name: "hd",
-                required: false
-            },
-            {
-                name: "prompt",
-                required: false
-            }
-        ];
+    getClient(redirectUri) {
+        return new OAuth2Client({
+            clientId: this.parameters.client_id,
+            clientSecret: this.parameters.client_secret,
+            redirectUri
+        });
     }
     /**
-     * Expose on /google by default
-     * @returns the default url
+     * @param request - authorization request
+     * @returns the Google authorization url
      */
-    getDefaultUrl() {
-        return "/google";
+    getAuthorizationUrl(request) {
+        const { auth_options, access_type, hostedDomain } = this.parameters;
+        return this.getClient(request.redirectUri).generateAuthUrl({
+            ...(auth_options ?? {}),
+            access_type,
+            scope: request.scope,
+            state: request.state,
+            redirect_uri: request.redirectUri,
+            response_type: "code",
+            code_challenge_method: CodeChallengeMethod.S256,
+            code_challenge: request.codeChallenge,
+            nonce: request.nonce,
+            ...(hostedDomain ? { hd: hostedDomain } : {})
+        });
     }
     /**
-     * We manage Google Auth Token
-     * @returns true
+     * Exchange the code with the PKCE verifier, verify the returned ID token for `client_id` and its nonce
+     * @param request - code exchange
+     * @returns the identity, with the credentials of the exchange
      */
-    hasToken() {
-        return true;
+    async handleCallback(request) {
+        let tokens;
+        try {
+            ({ tokens } = await this.getClient(request.redirectUri).getToken({
+                code: request.code,
+                codeVerifier: request.codeVerifier,
+                redirect_uri: request.redirectUri
+            }));
+        }
+        catch (err) {
+            this.log("WARN", "Google code exchange failed:", safeErrorReason(err));
+            throw new TokenInvalid("Code exchange failed");
+        }
+        if (!tokens?.id_token) {
+            throw new TokenInvalid("Google returned no ID token: the 'openid' scope is required");
+        }
+        const payload = await this.verifyIdToken(tokens.id_token, [this.parameters.client_id]);
+        if (typeof payload.nonce !== "string" || !sameSecret(payload.nonce, request.nonce)) {
+            throw new TokenInvalid("ID token nonce mismatch");
+        }
+        return this.toIdentity(payload, tokens);
     }
     /**
-     * Generate the Google authorization url
-     * @param redirect_uri - the url Google will redirect to
-     * @param state - the random state to verify on callback
-     * @param _ctx - the request context
-     * @returns the authorization url
+     * Verify a Google ID token sent by a client, as `token` or `tokens.id_token`
+     * @param request - token request
+     * @returns the identity, with the credentials sent in `tokens`
      */
-    generateAuthUrl(redirect_uri, state, _ctx) {
-        const oauthClient = this.getOAuthClient(redirect_uri);
-        return oauthClient.generateAuthUrl({
-            access_type: this.parameters.access_type,
-            scope: this.parameters.scope,
-            redirect_uri,
-            response_type: "code",
-            state,
-            ...this.parameters.auth_options
-        });
+    async handleToken(request) {
+        const fromTokens = request.tokens?.id_token;
+        if (request.token && fromTokens !== undefined && fromTokens !== request.token) {
+            throw new WebdaError.BadRequest("token and tokens.id_token differ");
+        }
+        const idToken = request.token ?? fromTokens;
+        if (typeof idToken !== "string" || !idToken) {
+            throw new TokenInvalid("A Google ID token is required");
+        }
+        const payload = await this.verifyIdToken(idToken, [
+            this.parameters.client_id,
+            ...(this.parameters.audiences ?? [])
+        ]);
+        return this.toIdentity(payload, request.tokens);
     }
     /**
-     * Return a google oauth client
-     * @param redirect_uri - the redirect url to use
-     * @returns a new OAuth2 client
+     * Emit `GoogleAuth.Tokens` once the login succeeded
+     * @param identity - the identity
+     * @param _result - the result
+     * @param source - browser callback or token operation
+     * @param request - the token operation request
      */
-    getOAuthClient(redirect_uri) {
-        return new OAuth2Client(this.parameters.client_id, this.parameters.client_secret, redirect_uri);
+    async onAuthenticated(identity, _result, source, request) {
+        const tokens = source === "token" ? (request?.tokens ?? { id_token: request?.token }) : identity.tokens;
+        await this.emit("GoogleAuth.Tokens", { tokens, context: useContext() });
     }
     /**
-     * @inheritdoc
-     * @param ctx - the request context
-     * @returns the identity and profile
+     * Verify an ID token: signature, expiry, issuer (google-auth-library), audience and hosted domain
+     * @param idToken - ID token
+     * @param audiences - accepted audiences
+     * @returns the payload
+     * @throws TokenInvalid when the token does not verify
+     * @throws EmailDomainNotAllowed when `hostedDomain` is set and the token is not from that domain
      */
-    async handleCallback(ctx) {
-        // Verify state are equal
-        if (ctx.getParameters().state !== ctx.getSession().oauth?.state) {
-            this.log("WARN", `Bad State ${ctx.getParameters().state} !== ${ctx.getSession().oauth?.state}`);
-            throw new WebdaError.Forbidden("Bad State");
+    async verifyIdToken(idToken, audiences) {
+        const audience = audiences.filter(a => typeof a === "string" && a);
+        // Without audience the library would skip the check: never verify without one
+        if (!audience.length) {
+            throw new TokenInvalid("No audience configured");
         }
-        const code = ctx.getParameters().code;
-        const redirect_uri = ctx.getHttpContext().getAbsoluteUrl(`${this.parameters.url}/callback`);
-        const oauthClient = this.getOAuthClient(redirect_uri);
-        let profile, identId;
-        // Now that we have the code, use that to acquire tokens.
+        this.verifier ?? (this.verifier = new OAuth2Client({ clientId: this.parameters.client_id }));
+        let payload;
         try {
-            const r = await oauthClient.getToken(code);
-            await this.emit("GoogleAuth.Tokens", { tokens: r.tokens, context: ctx });
-            profile = await this.getUserInfo(r.tokens.id_token);
-            identId = profile.sub;
+            const ticket = await this.verifier.verifyIdToken({
+                idToken,
+                audience: audience.length === 1 ? audience[0] : audience
+            });
+            payload = ticket.getPayload();
         }
         catch (err) {
-            this.log("ERROR", err);
-            throw new WebdaError.Forbidden("OAuth Error");
+            // The library messages contain the token or its payload: only the error class is logged
+            this.log("WARN", "Google ID token verification failed:", safeErrorReason(err));
+            throw new TokenInvalid();
         }
-        return {
-            identId,
-            profile
-        };
-    }
-    /**
-     * Retrieve the user profile based on the token
-     * @param token - the Google id token
-     * @returns the token payload
-     */
-    async getUserInfo(token) {
-        const oauthClient = this.getOAuthClient();
-        const ticket = await oauthClient.verifyIdToken({
-            idToken: token,
-            audience: this.parameters.client_id
-        });
-        return ticket.getPayload();
+        if (!payload?.sub) {
+            throw new TokenInvalid("ID token has no subject");
+        }
+        const hostedDomain = this.parameters.hostedDomain?.trim().toLowerCase();
+        if (hostedDomain && payload.hd?.toLowerCase() !== hostedDomain) {
+            throw new EmailDomainNotAllowed("Google account is not from the hosted domain");
+        }
+        return payload;
     }
     /**
-     * Verify a Google Auth Token
-     * @param context - the request context
-     * @returns the identity and profile
+     * @param payload - verified ID token payload
+     * @param tokens - credentials to store
+     * @returns the identity
      */
-    async handleToken(context) {
-        const tokens = (await context.getRequestBody()).tokens;
-        if (!tokens) {
-            throw new WebdaError.BadRequest("No tokens provided");
-        }
-        const profile = await this.getUserInfo(tokens.id_token);
+    toIdentity(payload, tokens) {
         return {
-            identId: profile.sub,
-            profile
+            provider: this.providerName,
+            providerUid: payload.sub,
+            email: payload.email,
+            emailVerified: payload.email_verified === true,
+            profile: { name: payload.name, picture: payload.picture, locale: payload.locale, hd: payload.hd },
+            tokens,
+            amr: ["oauth"]
         };
     }
-    /**
-     * Retrieve Google Client
-     *
-     * Redirecting to the webbrowser for the OAuth validation
-     * Store the token in user store afterwards
-     * @param token - existing credentials to reuse, if any
-     * @param open - callback to open the authorization url in a browser
-     * @param storeToken - callback to persist the retrieved credentials
-     * @returns the authenticated OAuth2 client
-     */
-    async getLocalClient(token, open, storeToken) {
-        if (this._client) {
-            return this._client;
-        }
-        const oAuth2Client = this.getOAuthClient();
-        if (token) {
-            oAuth2Client.setCredentials(token);
-            this._client = oAuth2Client;
-            return oAuth2Client;
-        }
-        // Generate the url that will be used for the consent dialog.
-        const authorizeUrl = oAuth2Client.generateAuthUrl({
-            access_type: "offline",
-            scope: this.parameters.scope,
-            redirect_uri: "http://localhost:3000/oauth2callback"
-        });
-        // Open an http server to accept the oauth callback. In this simple example, the
-        // only request to our webserver is to /oauth2callback?code=<code>
-        return new Promise((resolve, reject) => {
-            const server = http
-                .createServer(async (req, res) => {
-                if (req.url.indexOf("/oauth2callback") > -1) {
-                    try {
-                        // acquire the code from the querystring, and close the web server.
-                        const code = new URL(req.url, `http://localhost:3000`).searchParams.get("code");
-                        if (code) {
-                            res.end("Authentication successful! Please return to the console.");
-                        }
-                        else {
-                            res.end("Authentication unsuccessful! Please return to the console.");
-                            return reject("Failed");
-                        }
-                        // Now that we have the code, use that to acquire tokens.
-                        const r = await oAuth2Client.getToken(code);
-                        // Make sure to set the credentials on the OAuth2 client.
-                        storeToken(r.tokens);
-                        oAuth2Client.setCredentials(r.tokens);
-                        this._client = oAuth2Client;
-                        this.log("INFO", "Google Authentication finished.");
-                        return resolve(this._client);
-                    }
-                    catch (err) {
-                        this.log("ERROR", err);
-                        reject(err);
-                    }
-                    finally {
-                        server.close();
-                    }
-                }
-            })
-                .listen(3000, () => {
-                // open the browser to the authorize url to start the workflow
-                this.log("INFO", "Launching your browser for Google API Permission");
-                open(authorizeUrl);
-            });
-        });
-    }
 }
-export { GoogleAuthentication };
+GoogleAuthentication.Parameters = GoogleParameters;
+/**
+ * Constant-time comparison
+ * @param a - received value
+ * @param b - expected value
+ * @returns true when equal
+ */
+function sameSecret(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+export default GoogleAuthentication;
 //# sourceMappingURL=google-auth.service.js.map

package/lib/google-auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth.service.js","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EACZ,sBAAsB,EAItB,UAAU,EACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAe,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,sBAAsB;IA+B1D;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,KAAhB,IAAI,CAAC,WAAW,GAAK,QAAQ,EAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAKD;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,oBACnB,SAAQ,YAAiC;IAKzC;;;OAGG;IACH,OAAO;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,OAAO;YACL;gBACE,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,IAAI;aACf;YACD;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,KAAK;aAChB;YACD;gBACE,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,KAAK;aAChB;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,KAAK;aAChB;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,YAAoB,EAAE,KAAa,EAAE,IAAgB;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,eAAe,CAAC;YACjC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;YACxC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,YAAY;YACZ,aAAa,EAAE,MAAM;YACrB,KAAK;YACL,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,YAAqB;QAClC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAClG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAe;QAClC,yBAAyB;QACzB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,UAAU,EAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,CAAC,aAAa,EAAE,CAAC,KAAK,QAAQ,GAAG,CAAC,UAAU,EAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAW,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC;QAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,CAAC;QAC5F,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,OAAO,CAAC;QACrB,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACzE,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvB,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC;QACD,OAAO;YACL,OAAO;YACP,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC;YAC7C,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAmB;QACnC,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAClB,KAAkB,EAClB,IAA2B,EAC3B,UAAiD;QAEjD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAE3C,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;YAC5B,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,6DAA6D;QAC7D,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC;YAChD,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;YAC5B,YAAY,EAAE,sCAAsC;SACrD,CAAC,CAAC;QAEH,gFAAgF;QAChF,kEAAkE;QAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI;iBAChB,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC/B,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,mEAAmE;wBACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAChF,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;wBACtE,CAAC;6BAAM,CAAC;4BACN,GAAG,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;4BACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;wBAC1B,CAAC;wBAED,yDAAyD;wBACzD,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;wBAC5C,yDAAyD;wBACzD,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACrB,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACtC,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC;wBAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;wBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC/B,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;wBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,CAAC;4BAAS,CAAC;wBACT,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;iBACD,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBACjB,8DAA8D;gBAC9D,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,kDAAkD,CAAC,CAAC;gBACrE,IAAI,CAAC,YAAY,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"google-auth.service.js","sourceRoot":"","sources":["../src/google-auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAiE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpH,OAAO,EACL,qBAAqB,EAGrB,aAAa,EACb,uBAAuB,EAEvB,eAAe,EACf,YAAY,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAoB,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AAiB7G;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,uBAAuB;IAoC3D;;;OAGG;IACH,IAAI,CAAC,MAAM,GAAQ,EAAE;QACnB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,IAAI,CAAC,WAAW,KAAhB,IAAI,CAAC,WAAW,GAAK,QAAQ,EAAC;QAC9B,IAAI,CAAC,KAAK,KAAV,IAAI,CAAC,KAAK,GAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAC;QAC9C,IAAI,CAAC,SAAS,KAAd,IAAI,CAAC,SAAS,GAAK,EAAE,EAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,oBAAoE,SAAQ,aAGxF;IAHD;;QAMW,iBAAY,GAAG,QAAQ,CAAC;IAkKnC,CAAC;IA7JC,gBAAgB;IAChB,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACO,SAAS,CAAC,WAAoB;QACtC,OAAO,IAAI,YAAY,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;YACnC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa;YAC3C,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,OAAkC;QACpD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;QACpE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC;YACzD,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YACvB,WAAW;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,aAAa,EAAE,MAAM;YACrB,qBAAqB,EAAE,mBAAmB,CAAC,IAAI;YAC/C,cAAc,EAAE,OAAO,CAAC,aAAa;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAA6B;QAChD,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;gBAC/D,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,YAAY,EAAE,OAAO,CAAC,WAAW;aAClC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,8BAA8B,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,YAAY,CAAC,sBAAsB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,YAAY,CAAC,6DAA6D,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAA0B;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;QAC5C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,YAAY,CAAC,+BAA+B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;YAChD,IAAI,CAAC,UAAU,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,MAAqB,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,eAAe,CAC7B,QAA0B,EAC1B,OAAmB,EACnB,MAA4B,EAC5B,OAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAA2B,CAAC,CAAC;IACnG,CAAC;IAED;;;;;;;OAOG;IACO,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,SAAmB;QAChE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC;QACnE,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,KAAb,IAAI,CAAC,QAAQ,GAAK,IAAI,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,EAAC;QAC5E,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAC/C,OAAO;gBACP,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;aACzD,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wFAAwF;YACxF,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,sCAAsC,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/E,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,qBAAqB,CAAC,8CAA8C,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACO,UAAU,CAAC,OAAqB,EAAE,MAAoB;QAC9D,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,YAAY;YAC3B,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;YAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;YACjG,MAAM;YACN,GAAG,EAAE,CAAC,OAAO,CAAC;SACf,CAAC;IACJ,CAAC;CACF;AApKQ,+BAAU,GAAG,gBAAgB,AAAnB,CAAoB;AAsKvC;;;;;GAKG;AACH,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,eAAe,oBAAoB,CAAC"}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@webda/google-auth",
-  "version": "4.0.0-beta.3",
+  "version": "4.0.0-beta.5",
   "description": "Webda Google Authentication",
   "main": "lib/index.js",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/loopingz/webda.io.git"
+    "url": "git+https://github.com/loopingz/webda.io.git",
+    "directory": "packages/google-auth"
   },
   "keywords": [
     "webda",
@@ -24,7 +25,8 @@
   "homepage": "https://github.com/loopingz/webda.io#readme",
   "dependencies": {
     "google-auth-library": "^10.6.2",
-    "@webda/core": "4.0.0-beta.3"
+    "@webda/auth": "4.0.0-beta.5",
+    "@webda/core": "4.0.0-beta.5"
   },
   "publishConfig": {
     "access": "public"
@@ -38,8 +40,10 @@
     "typescript": "7.1.0-dev.20260929.1",
     "vite": "^6.0.0",
     "vitest": "^4.1.2",
-    "@webda/compiler": "^4.0.0-beta.3",
-    "@webda/test": "4.0.0-beta.3"
+    "@webda/compiler": "^4.0.0-beta.5",
+    "@webda/content-mapper": "^4.0.0-beta.5",
+    "@webda/workout": "4.0.0-beta.5",
+    "@webda/test": "4.0.0-beta.5"
   },
   "type": "module",
   "engines": {
@@ -47,7 +51,8 @@
   },
   "nx": {
     "implicitDependencies": [
-      "@webda/core"
+      "@webda/core",
+      "@webda/auth"
     ]
   },
   "scripts": {

package/webda.module.json

@@ -4,112 +4,125 @@
   "deployers": {},
   "moddas": {
     "Webda/GoogleAuthentication": {
-      "Import": "lib/google-auth.service:default",
+      "Import": "lib/google-auth.service:GoogleAuthentication",
       "Schema": {
         "$schema": "http://json-schema.org/draft-07/schema#",
         "additionalProperties": false,
         "definitions": {
-          "redirects": {
+          "OAuthRedirects": {
             "additionalProperties": false,
+            "description": "Browser redirects of the OAuth callback",
             "properties": {
-              "defaults": {
-                "$ref": "#/definitions/redirects%24defaults"
-              },
-              "use_referer": {
-                "default": false,
-                "type": "boolean"
+              "failure": {
+                "description": "Where a failed login or callback lands, with `?reason=<CODE>` (required)",
+                "type": "string"
               },
-              "whitelist": {
-                "items": {
-                  "type": "string"
-                },
-                "type": "array"
+              "success": {
+                "default": "/",
+                "description": "Where a successful login lands when the login did not carry an allowed `redirect` parameter",
+                "type": "string"
               }
             },
-            "required": [
-              "defaults",
-              "whitelist"
-            ],
             "type": "object"
           },
-          "redirects$defaults": {
-            "additionalProperties": {
-              "type": "string"
-            },
+          "Record<string, any>": {
+            "additionalProperties": {},
+            "description": "Construct a type with a set of properties K of type T",
             "type": "object"
           }
         },
-        "description": "Credentials to manage Google Auth\nhttps://developers.google.com/identity/protocols/oauth2",
+        "description": "Google login parameters\nhttps://developers.google.com/identity/protocols/oauth2/openid-connect",
         "properties": {
           "access_type": {
-            "description": "Type of access for Google token\n\nonline by default",
+            "default": "online",
+            "description": "Type of access: \"offline\" also returns a refresh token (stored encrypted in the ident tokens)",
             "enum": [
               "online",
               "offline"
             ],
             "type": "string"
           },
-          "auth_options": {},
-          "authenticationService": {
-            "default": "Authentication",
-            "description": "Name of the authentication service to use if exist",
-            "type": "string"
+          "allowedEmailDomains": {
+            "description": "Only these email domains may use this provider (see ProviderEmailPolicy)",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "audiences": {
+            "default": [],
+            "description": "Other client ids whose ID tokens `Auth.Google.Token` accepts (for example Android/iOS client ids)",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "auth_options": {
+            "$ref": "#/definitions/Record%3Cstring%2C%20any%3E",
+            "description": "Additional authorization url parameters (for example `prompt`, `login_hint`); cannot override `state`,\n`redirect_uri`, `scope`, `access_type`, `response_type`, `code_challenge*`, `nonce` nor `hd`\nSee https://developers.google.com/identity/protocols/oauth2/openid-connect#authenticationuriparameters"
           },
           "authorized_uris": {
             "default": [],
-            "description": "List of URIs authorized for redirect post authorization",
+            "description": "Allowed post-login targets for the `redirect` query parameter of the login route: absolute http(s) urls, a\ntarget matches when it has the same origin and its path is the listed path or below it",
             "items": {
               "type": "string"
             },
             "type": "array"
           },
           "client_id": {
-            "description": "Google Auth Client id",
+            "description": "Google OAuth client id (web application)",
             "type": "string"
           },
           "client_secret": {
-            "description": "Google Auth Client secret",
+            "description": "Google OAuth client secret",
             "type": "string"
           },
-          "exposeScope": {
-            "default": false,
-            "description": "If set to true it will add a ${url}/scope\nSo client can anticipate the requested scope\n\nThis is useful when using the client api to generate\ntoken. This way the service can request the wanted scope",
-            "type": "boolean"
-          },
-          "no_referer": {
-            "default": false,
-            "description": "Allow direct connection without a referer",
-            "type": "boolean"
-          },
-          "project_id": {
-            "description": "Google Project ID",
+          "hostedDomain": {
+            "description": "Only accept Google Workspace accounts of this domain (the `hd` claim of the ID token); also sent as a hint to\nthe account chooser",
             "type": "string"
           },
           "redirect_uri": {
-            "default": "${url}/callback",
-            "description": "Default redirect_uri",
+            "default": "\"<absolute url of the request>/callback\"; set it explicitly behind a proxy",
+            "description": "Callback url registered at the provider",
             "type": "string"
           },
           "redirects": {
-            "$ref": "#/definitions/redirects"
+            "$ref": "#/definitions/OAuthRedirects",
+            "description": "Browser redirects of the callback"
           },
           "scope": {
-            "defaut": [
-              "email"
+            "default": [
+              "openid",
+              "email",
+              "profile"
             ],
-            "description": "Scope to request on OAuth flow",
+            "description": "Scopes requested from Google",
             "items": {
               "type": "string"
             },
             "type": "array"
           },
+          "trustEmailVerification": {
+            "anyOf": [
+              {
+                "items": {
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "boolean"
+              }
+            ],
+            "description": "Whether the verification of the email is believed (see ProviderEmailPolicy)"
+          },
           "type": {
             "description": "Type of the service",
             "type": "string"
           },
           "url": {
-            "SchemaOptional": true,
-            "description": "URL to use for expose\n\nThe default value varying based on implementation\nIt should by default be the provider name in lowercase",
+            "default": "/auth/<providerName>",
+            "description": "Route prefix of the login (`<url>`) and callback (`<url>/callback`) routes",
             "type": "string"
           },
           "openapi": {
@@ -120,16 +133,12 @@
         "required": [
           "client_id",
           "client_secret",
-          "scope",
           "type"
         ],
         "type": "object",
         "title": "GoogleAuthentication"
       },
-      "Configuration": "lib/google-auth.service:GoogleParameters",
-      "capabilities": [
-        "request-filter"
-      ]
+      "Configuration": "lib/google-auth.service:GoogleParameters"
     }
   },
   "models": {},
@@ -140,10 +149,6 @@
       "additionalProperties": false,
       "description": "Represent a file to store",
       "properties": {
-        "challenge": {
-          "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
-          "type": "string"
-        },
         "hash": {
           "description": "Will be computed by the service\n\nhash of the content",
           "type": "string"
@@ -175,6 +180,31 @@
       ],
       "type": "object",
       "title": "BinaryFile"
+    },
+    "Webda/OAuthTokenRequest": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "WebdaSchema": true,
+      "additionalProperties": false,
+      "definitions": {
+        "OAuthTokens": {
+          "additionalProperties": {},
+          "description": "Credentials as returned by an OAuth token endpoint (google-auth-library `Credentials` shape): `id_token`,\n`access_token`, `refresh_token`, `expiry_date`, `token_type`, `scope`... Values are not typed by the schema\n(providers send nulls); providers check what they use.",
+          "type": "object"
+        }
+      },
+      "description": "Input of the `Auth.<Provider>.Token` operations: `token`, or the provider credentials `tokens`",
+      "properties": {
+        "token": {
+          "description": "Token issued by the provider to the client (an ID token for OpenID Connect providers)",
+          "type": "string"
+        },
+        "tokens": {
+          "$ref": "#/definitions/OAuthTokens",
+          "description": "Credentials obtained by the client from the provider (v3 body; its `id_token` is verified)"
+        }
+      },
+      "type": "object",
+      "title": "OAuthTokenRequest"
     }
   },
   "behaviors": {}