@xemahq/oidc-session-nest 1.1.0 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -0
- package/dist/config/oidc-session-env.d.ts.map +1 -1
- package/dist/config/oidc-session-env.js +3 -0
- package/dist/config/oidc-session-env.js.map +1 -1
- package/dist/config/oidc-session-options.d.ts +1 -0
- package/dist/config/oidc-session-options.d.ts.map +1 -1
- package/dist/config/oidc-session-options.js +14 -0
- package/dist/config/oidc-session-options.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -1
- package/dist/index.js.map +1 -1
- package/dist/nest/navigation-refusal.d.ts +4 -0
- package/dist/nest/navigation-refusal.d.ts.map +1 -0
- package/dist/nest/navigation-refusal.js +10 -0
- package/dist/nest/navigation-refusal.js.map +1 -0
- package/dist/nest/oidc-session-auth.controller.d.ts +4 -0
- package/dist/nest/oidc-session-auth.controller.d.ts.map +1 -1
- package/dist/nest/oidc-session-auth.controller.js +45 -12
- package/dist/nest/oidc-session-auth.controller.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -136,6 +136,33 @@ The two forms are exclusive, and the loader refuses both together or neither.
|
|
|
136
136
|
authorization request carried.
|
|
137
137
|
- Keep `SESSION_COOKIE_DOMAIN` unset, so each address keeps its own session.
|
|
138
138
|
|
|
139
|
+
### Sign-in errors on the application's own page
|
|
140
|
+
|
|
141
|
+
`GET /auth/login` and `GET /auth/callback` are browser navigations, not
|
|
142
|
+
fetches. By default a refusal there is a JSON `400`, which the browser shows as
|
|
143
|
+
raw JSON on a backend address.
|
|
144
|
+
|
|
145
|
+
Set `OIDC_NAVIGATION_ERROR_PATH` (or `navigationErrorPath`) to a path on the
|
|
146
|
+
application's own origin, and every refusal on those two routes becomes a
|
|
147
|
+
redirect to it with the error code:
|
|
148
|
+
|
|
149
|
+
```
|
|
150
|
+
302 Location: /sign-in?error=OIDC_LOGIN_ORIGIN_MISMATCH
|
|
151
|
+
```
|
|
152
|
+
|
|
153
|
+
- The `Location` is always relative, so it cannot redirect anywhere else and
|
|
154
|
+
needs no allowlist. The value must start with a single `/` and carry no query
|
|
155
|
+
or fragment. Anything else fails at boot.
|
|
156
|
+
- The parameter is always `error`, and it carries only the code. The detail
|
|
157
|
+
text stays in the server log, where each refusal is logged with its code.
|
|
158
|
+
- The codes a sign-in page can receive are `OIDC_REDIRECT_ORIGIN_NOT_ALLOWED`,
|
|
159
|
+
`OIDC_LOGIN_ORIGIN_MISMATCH`, `OIDC_LOGIN_STATE_UNKNOWN`,
|
|
160
|
+
`OIDC_CALLBACK_REJECTED` and `OIDC_TOKEN_ENDPOINT_FAILED`.
|
|
161
|
+
- With the variable unset, the two routes keep answering JSON. There is no
|
|
162
|
+
default path, because a page that does not read `?error=` would hide the
|
|
163
|
+
refusal.
|
|
164
|
+
- `POST /auth/logout` is a fetch and always answers JSON.
|
|
165
|
+
|
|
139
166
|
## Peer requirements
|
|
140
167
|
|
|
141
168
|
- `@nestjs/common` and `@nestjs/core` `^10 || ^11` — the framework this mounts into.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-env.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAI3D,CAAC;AAiBF,eAAO,MAAM,8BAA8B;;;CAQjC,CAAC;AAOX,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,
|
|
1
|
+
{"version":3,"file":"oidc-session-env.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,kBAAkB,EAExB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAI3D,CAAC;AAiBF,eAAO,MAAM,8BAA8B;;;CAQjC,CAAC;AAOX,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAc3D,CAAC;AAoBF,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,SAAS,GACd,kBAAkB,CAmDpB"}
|
|
@@ -30,6 +30,7 @@ exports.OIDC_SESSION_OPTIONAL_ENV_VARS = [
|
|
|
30
30
|
'SESSION_REFRESH_LEAD_SECONDS',
|
|
31
31
|
'SESSION_REFRESH_WAIT_MS',
|
|
32
32
|
'SESSION_KEY_PREFIX',
|
|
33
|
+
'OIDC_NAVIGATION_ERROR_PATH',
|
|
33
34
|
];
|
|
34
35
|
const DEFAULT_IDLE_TTL_SECONDS = 8 * 60 * 60;
|
|
35
36
|
const DEFAULT_ABSOLUTE_TTL_SECONDS = 24 * 60 * 60;
|
|
@@ -43,6 +44,7 @@ function loadOidcSessionOptionsFromEnv(read) {
|
|
|
43
44
|
const clientSecret = optional(read, 'OIDC_CLIENT_SECRET');
|
|
44
45
|
const cookieDomain = optional(read, 'SESSION_COOKIE_DOMAIN');
|
|
45
46
|
const keycloakIdpHint = optional(read, 'OIDC_KEYCLOAK_IDP_HINT');
|
|
47
|
+
const navigationErrorPath = optional(read, 'OIDC_NAVIGATION_ERROR_PATH');
|
|
46
48
|
const options = {
|
|
47
49
|
oidc: {
|
|
48
50
|
issuerUrl: required(read, 'OIDC_ISSUER_URL'),
|
|
@@ -66,6 +68,7 @@ function loadOidcSessionOptionsFromEnv(read) {
|
|
|
66
68
|
refreshWaitMs: readPositiveNumber(read, 'SESSION_REFRESH_WAIT_MS', DEFAULT_REFRESH_WAIT_MS),
|
|
67
69
|
},
|
|
68
70
|
keyPrefix: optional(read, 'SESSION_KEY_PREFIX') ?? DEFAULT_KEY_PREFIX,
|
|
71
|
+
...(navigationErrorPath === undefined ? {} : { navigationErrorPath }),
|
|
69
72
|
};
|
|
70
73
|
return (0, oidc_session_options_1.assertOidcSessionOptions)(options);
|
|
71
74
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-env.js","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"oidc-session-env.js","sourceRoot":"","sources":["../../src/config/oidc-session-env.ts"],"names":[],"mappings":";;;AAsGA,sEAqDC;AA9ID,iEAMgC;AAanB,QAAA,8BAA8B,GAAsB;IAC/D,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAiBW,QAAA,8BAA8B,GAAG;IAC5C,KAAK,EAAE,CAAC,mBAAmB,EAAE,+BAA+B,CAAC;IAC7D,SAAS,EAAE;QACT,+BAA+B;QAC/B,oBAAoB;QACpB,gCAAgC;QAChC,sBAAsB;KACvB;CACO,CAAC;AAOE,QAAA,8BAA8B,GAAsB;IAC/D,oBAAoB;IACpB,YAAY;IACZ,wBAAwB;IACxB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,8BAA8B;IAC9B,yBAAyB;IACzB,oBAAoB;IACpB,4BAA4B;CAC7B,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC7C,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAClD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAC1C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAU5D,SAAgB,6BAA6B,CAC3C,IAAe;IAEf,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAGjE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAEzE,MAAM,OAAO,GAAuB;QAClC,IAAI,EAAE;YACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAC5C,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAC1C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;YACvD,GAAG,YAAY,CAAC,IAAI,CAAC;YACrB,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,0CAAmB,CAAC;YAC7E,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;SAC9D;QACD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC;YACxD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC/D,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,mBAAmB;YAClE,QAAQ,EAAE,YAAY,CAAC,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,CAAC;SAC5E;QACD,GAAG,EAAE;YACH,cAAc,EAAE,kBAAkB,CAChC,IAAI,EACJ,0BAA0B,EAC1B,wBAAwB,CACzB;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,kBAAkB,EAAE,kBAAkB,CACpC,IAAI,EACJ,8BAA8B,EAC9B,4BAA4B,CAC7B;YACD,aAAa,EAAE,kBAAkB,CAC/B,IAAI,EACJ,yBAAyB,EACzB,uBAAuB,CACxB;SACF;QACD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,kBAAkB;QACrE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACtE,CAAC;IAEF,OAAO,IAAA,+CAAwB,EAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAQD,SAAS,YAAY,CAAC,IAAe;IAKnC,MAAM,QAAQ,GAAG,CAAC,KAAwB,EAAY,EAAE,CACtD,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,sCAA8B,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC,CAAC;IAErE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACtE,gEAAgE;YAChE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACxD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,6CAAsB,CAC9B,mEAAmE;gBACjE,oEAAoE;gBACpE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAC9E,OAAO;YACL,WAAW;YACX,GAAG,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACvE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,6CAAsB,CAC9B,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;YACrE,uEAAuE;YACvE,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC9D,OAAO;QACL,yBAAyB,EAAE;YACzB,cAAc;YACd,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;YAClD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;YAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAMD,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,6BAA6B,GAAG,yCAAyC,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAe,EAAE,IAAY;IAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,8DAA8D;YACnE,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,0CAAmB,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,0CAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AASD,SAAS,WAAW,CAAC,IAAe,EAAE,IAAY,EAAE,QAAiB;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAe,EACf,IAAY,EACZ,QAAgB;IAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,oCAAoC,GAAG,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,IAAe,EACf,IAAY,EACZ,QAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,6CAAsB,CAC9B,GAAG,IAAI,mBAAmB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -33,6 +33,7 @@ export interface OidcSessionOptions {
|
|
|
33
33
|
readonly cookie: SessionCookieOptions;
|
|
34
34
|
readonly ttl: SessionTtlOptions;
|
|
35
35
|
readonly keyPrefix: string;
|
|
36
|
+
readonly navigationErrorPath?: string;
|
|
36
37
|
}
|
|
37
38
|
export { OidcSessionConfigError };
|
|
38
39
|
export declare const REQUIRED_OIDC_SCOPE = "openid";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-options.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;
|
|
1
|
+
{"version":3,"file":"oidc-session-options.d.ts","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AASrE,MAAM,WAAW,mBAAmB;IAQlC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAQ/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAK9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAOxC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,4BAA4B,CAAC;IAKlE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAavB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAgBD,MAAM,WAAW,4BAA4B;IAE3C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAE3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAM9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IASjC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAGD,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAMtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAOtB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC9C;AAGD,MAAM,WAAW,iBAAiB;IAMhC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAKhC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAMpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAOpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAMhC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAkB3B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAGlC,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAU5C,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CAwEpB"}
|
|
@@ -5,6 +5,7 @@ exports.assertOidcSessionOptions = assertOidcSessionOptions;
|
|
|
5
5
|
const oidc_session_config_error_1 = require("./oidc-session-config-error");
|
|
6
6
|
Object.defineProperty(exports, "OidcSessionConfigError", { enumerable: true, get: function () { return oidc_session_config_error_1.OidcSessionConfigError; } });
|
|
7
7
|
const redirect_origin_1 = require("./redirect-origin");
|
|
8
|
+
const cookie_1 = require("../http/cookie");
|
|
8
9
|
const request_authority_1 = require("../http/request-authority");
|
|
9
10
|
exports.REQUIRED_OIDC_SCOPE = 'openid';
|
|
10
11
|
function assertOidcSessionOptions(options) {
|
|
@@ -29,6 +30,9 @@ function assertOidcSessionOptions(options) {
|
|
|
29
30
|
throw new oidc_session_config_error_1.OidcSessionConfigError('keycloakIdpHint must be a non-empty string when set; omit it to let the ' +
|
|
30
31
|
'realm show its own login page.');
|
|
31
32
|
}
|
|
33
|
+
if (options.navigationErrorPath !== undefined) {
|
|
34
|
+
assertNavigationErrorPath(options.navigationErrorPath);
|
|
35
|
+
}
|
|
32
36
|
for (const [name, value] of [
|
|
33
37
|
['ttl.idleTtlSeconds', ttl.idleTtlSeconds],
|
|
34
38
|
['ttl.absoluteTtlSeconds', ttl.absoluteTtlSeconds],
|
|
@@ -86,6 +90,16 @@ function assertRedirectStatement(oidc) {
|
|
|
86
90
|
}
|
|
87
91
|
(0, request_authority_1.parseTrustedProxies)(perOrigin.trustedProxies ?? []);
|
|
88
92
|
}
|
|
93
|
+
function assertNavigationErrorPath(value) {
|
|
94
|
+
if (typeof value !== 'string' || value.trim() === '') {
|
|
95
|
+
throw new oidc_session_config_error_1.OidcSessionConfigError('navigationErrorPath must be a non-empty path when set; omit it to keep ' +
|
|
96
|
+
'JSON refusals on the navigation routes.');
|
|
97
|
+
}
|
|
98
|
+
(0, redirect_origin_1.assertOriginRelativePath)('navigationErrorPath', value);
|
|
99
|
+
if ((0, cookie_1.containsControlCharacter)(value)) {
|
|
100
|
+
throw new oidc_session_config_error_1.OidcSessionConfigError('navigationErrorPath contains a control character.');
|
|
101
|
+
}
|
|
102
|
+
}
|
|
89
103
|
function assertAbsoluteHttpUrl(name, value) {
|
|
90
104
|
let parsed;
|
|
91
105
|
try {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-options.js","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"oidc-session-options.js","sourceRoot":"","sources":["../../src/config/oidc-session-options.ts"],"names":[],"mappings":";;;AA4MA,4DA0EC;AA/QD,2EAAqE;AAwL5D,uGAxLA,kDAAsB,OAwLA;AAvL/B,uDAG2B;AAC3B,2CAA0D;AAC1D,iEAAgE;AAqLnD,QAAA,mBAAmB,GAAG,QAAQ,CAAC;AAU5C,SAAgB,wBAAwB,CACtC,OAA2B;IAE3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC3B,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,kDAAsB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAAmB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kDAAsB,CAC9B,uBAAuB,2BAAmB,WAAW,IAAI,CAAC,KAAK,IAAI,CACpE,CAAC;IACJ,CAAC;IAQD,IACE,IAAI,CAAC,eAAe,KAAK,SAAS;QAClC,CAAC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAChF,CAAC;QACD,MAAM,IAAI,kDAAsB,CAC9B,0EAA0E;YACxE,gCAAgC,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,yBAAyB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,oBAAoB,EAAE,GAAG,CAAC,cAAc,CAAC;QAC1C,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,wBAAwB,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAClD,CAAC,mBAAmB,EAAE,GAAG,CAAC,aAAa,CAAC;KAChC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,kDAAsB,CAC9B,GAAG,IAAI,0CAA0C,MAAM,CAAC,KAAK,CAAC,GAAG,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,kDAAsB,CAC9B,uBAAuB,GAAG,CAAC,cAAc,mCAAmC;YAC1E,IAAI,GAAG,CAAC,kBAAkB,gDAAgD;YAC1E,+CAA+C,CAClD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACjD,MAAM,IAAI,kDAAsB,CAC9B,4EAA4E;YAC1E,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAS,uBAAuB,CAAC,IAAyB;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,kDAAsB,CAC9B,uEAAuE;YACrE,sEAAsE;YACtE,UAAU,CACb,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACnD,MAAM,IAAI,kDAAsB,CAC9B,0EAA0E;YACxE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,kDAAsB,CAAC,yCAAyC,CAAC,CAAC;QAC9E,CAAC;QACD,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,kDAAsB,CAC9B,yEAAyE;YACvE,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,IAAA,8CAA4B,EAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACvD,IAAA,0CAAwB,EACtB,wCAAwC,EACxC,SAAS,CAAC,YAAY,CACvB,CAAC;IACF,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAA,0CAAwB,EACtB,0CAA0C,EAC1C,SAAS,CAAC,cAAc,CACzB,CAAC;IACJ,CAAC;IACD,IAAA,uCAAmB,EAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAOD,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,kDAAsB,CAC9B,yEAAyE;YACvE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IACD,IAAA,0CAAwB,EAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,IAAA,iCAAwB,EAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kDAAsB,CAC9B,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kDAAsB,CAAC,GAAG,IAAI,kCAAkC,KAAK,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,kDAAsB,CAC9B,GAAG,IAAI,gCAAgC,MAAM,CAAC,QAAQ,IAAI,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -21,6 +21,7 @@ export { OidcSessionGuard } from './nest/oidc-session.guard';
|
|
|
21
21
|
export { SessionActor } from './nest/session-actor.decorator';
|
|
22
22
|
export { sessionClientTransport, type SessionClientTransport, } from './nest/session-client-transport';
|
|
23
23
|
export { OidcSessionAuthController, type LogoutResponse, type SessionRequestShape, type SessionResponseLike, } from './nest/oidc-session-auth.controller';
|
|
24
|
+
export { navigationErrorLocation, OIDC_NAVIGATION_ERROR_PARAM, } from './nest/navigation-refusal';
|
|
24
25
|
export { LogoutResponseDto } from './nest/dto/logout-response.dto';
|
|
25
26
|
export { SessionActorDto } from './nest/dto/session-actor.dto';
|
|
26
27
|
export { OIDC_SESSION_OPTIONS, OIDC_SESSION_STORE } from './nest/tokens';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,KAAK,YAAY,IAAI,iBAAiB,GACvC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,kBAAkB,EAIvB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,SAAS,GACf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EACL,UAAU,EACV,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,cAAc,EACd,KAAK,YAAY,IAAI,iBAAiB,GACvC,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,kBAAkB,EAIvB,KAAK,mBAAmB,GACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EACL,sBAAsB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,yBAAyB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACL,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,GACnC,MAAM,4BAA4B,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.OidcSessionGuard = exports.OidcSessionMiddleware = exports.OIDC_SESSION_SCOPE = exports.setCurrentProjectId = exports.runWithSessionScope = exports.currentSessionScope = exports.currentSession = exports.safeLoginHint = exports.MAX_LOGIN_HINT_LENGTH = exports.serializeCookie = exports.safeRelativePath = exports.readCookie = exports.resolveRedirectTargets = exports.resolveRequestAuthority = exports.parseTrustedProxies = exports.isTrustedPeer = exports.parseRedirectOriginPattern = exports.parseRedirectOriginAllowlist = exports.matchRedirectOrigin = exports.PROJECT_HEADER_NAME = exports.storeKeyFor = exports.SessionService = exports.toSessionActor = exports.resolveSessionOrgRoles = exports.resolveInitialActiveOrgId = exports.RedisSessionStore = exports.ioredisScriptClient = exports.InMemorySessionStore = exports.OidcInvalidGrantError = exports.OidcClient = exports.randomUrlSafeToken = exports.createPkcePair = exports.OidcDiscovery = exports.OIDC_SESSION_REQUIRED_ENV_VARS = exports.OIDC_SESSION_REDIRECT_ENV_VARS = exports.OIDC_SESSION_OPTIONAL_ENV_VARS = exports.loadOidcSessionOptionsFromEnv = exports.REQUIRED_OIDC_SCOPE = exports.OidcSessionConfigError = exports.assertOidcSessionOptions = exports.SessionRequiredError = exports.SessionRefreshContendedError = exports.SessionExpiredError = exports.OidcTokenEndpointFailedError = exports.OidcRedirectOriginNotAllowedError = exports.OidcLoginStateUnknownError = exports.OidcLoginOriginMismatchError = exports.OidcCallbackRejectedError = exports.OidcSessionErrorCode = exports.OidcSessionError = void 0;
|
|
4
|
-
exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = exports.SessionActorDto = exports.LogoutResponseDto = exports.OidcSessionAuthController = exports.sessionClientTransport = exports.SessionActor = void 0;
|
|
4
|
+
exports.OidcSessionModule = exports.OIDC_SESSION_STORE = exports.OIDC_SESSION_OPTIONS = exports.SessionActorDto = exports.LogoutResponseDto = exports.OIDC_NAVIGATION_ERROR_PARAM = exports.navigationErrorLocation = exports.OidcSessionAuthController = exports.sessionClientTransport = exports.SessionActor = void 0;
|
|
5
5
|
var errors_1 = require("./errors");
|
|
6
6
|
Object.defineProperty(exports, "OidcSessionError", { enumerable: true, get: function () { return errors_1.OidcSessionError; } });
|
|
7
7
|
Object.defineProperty(exports, "OidcSessionErrorCode", { enumerable: true, get: function () { return errors_1.OidcSessionErrorCode; } });
|
|
@@ -77,6 +77,9 @@ var session_client_transport_1 = require("./nest/session-client-transport");
|
|
|
77
77
|
Object.defineProperty(exports, "sessionClientTransport", { enumerable: true, get: function () { return session_client_transport_1.sessionClientTransport; } });
|
|
78
78
|
var oidc_session_auth_controller_1 = require("./nest/oidc-session-auth.controller");
|
|
79
79
|
Object.defineProperty(exports, "OidcSessionAuthController", { enumerable: true, get: function () { return oidc_session_auth_controller_1.OidcSessionAuthController; } });
|
|
80
|
+
var navigation_refusal_1 = require("./nest/navigation-refusal");
|
|
81
|
+
Object.defineProperty(exports, "navigationErrorLocation", { enumerable: true, get: function () { return navigation_refusal_1.navigationErrorLocation; } });
|
|
82
|
+
Object.defineProperty(exports, "OIDC_NAVIGATION_ERROR_PARAM", { enumerable: true, get: function () { return navigation_refusal_1.OIDC_NAVIGATION_ERROR_PARAM; } });
|
|
80
83
|
var logout_response_dto_1 = require("./nest/dto/logout-response.dto");
|
|
81
84
|
Object.defineProperty(exports, "LogoutResponseDto", { enumerable: true, get: function () { return logout_response_dto_1.LogoutResponseDto; } });
|
|
82
85
|
var session_actor_dto_1 = require("./nest/dto/session-actor.dto");
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAWA,mCAYkB;AAXhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,sHAAA,4BAA4B,OAAA;AAC5B,oHAAA,0BAA0B,OAAA;AAC1B,2HAAA,iCAAiC,OAAA;AACjC,sHAAA,4BAA4B,OAAA;AAC5B,6GAAA,mBAAmB,OAAA;AACnB,sHAAA,4BAA4B,OAAA;AAC5B,8GAAA,oBAAoB,OAAA;AAItB,sEASuC;AARrC,gIAAA,wBAAwB,OAAA;AACxB,8HAAA,sBAAsB,OAAA;AACtB,2HAAA,mBAAmB,OAAA;AAQrB,8DAMmC;AALjC,iIAAA,6BAA6B,OAAA;AAC7B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAIhC,8CAI0B;AAHxB,0GAAA,aAAa,OAAA;AAKf,oCAAgF;AAAvE,sGAAA,cAAc,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAE3C,kDAM4B;AAL1B,yGAAA,UAAU,OAAA;AACV,oHAAA,qBAAqB,OAAA;AAavB,6EAG2C;AAFzC,+HAAA,oBAAoB,OAAA;AAItB,qEAMuC;AALrC,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AAMnB,yCAKyB;AAJvB,kHAAA,yBAAyB,OAAA;AACzB,+GAAA,sBAAsB,OAAA;AACtB,uGAAA,cAAc,OAAA;AAIhB,6DAOmC;AANjC,iHAAA,cAAc,OAAA;AACd,8GAAA,WAAW,OAAA;AAOb,0CAAqD;AAA5C,8GAAA,mBAAmB,OAAA;AAE5B,4DAKkC;AAJhC,sHAAA,mBAAmB,OAAA;AACnB,+HAAA,4BAA4B,OAAA;AAC5B,6HAAA,0BAA0B,OAAA;AAI5B,8DAOkC;AANhC,kHAAA,aAAa,OAAA;AACb,wHAAA,mBAAmB,OAAA;AACnB,4HAAA,uBAAuB,OAAA;AAMzB,4DAGiC;AAF/B,0HAAA,sBAAsB,OAAA;AAIxB,wCAKuB;AAJrB,oGAAA,UAAU,OAAA;AACV,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AAIjB,gDAAyE;AAAhE,mHAAA,qBAAqB,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE7C,oEAMqC;AALnC,sHAAA,cAAc,OAAA;AACd,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,0EAQwC;AAPtC,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AAQvB,gEAA6D;AAApD,sHAAA,gBAAgB,OAAA;AAEzB,0EAA8D;AAArD,uHAAA,YAAY,OAAA;AAErB,4EAGyC;AAFvC,kIAAA,sBAAsB,OAAA;AAIxB,oFAK6C;AAJ3C,yIAAA,yBAAyB,OAAA;AAM3B,sEAAmE;AAA1D,wHAAA,iBAAiB,OAAA;AAC1B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAExB,wCAAyE;AAAhE,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAEjD,kEAIoC;AAHlC,wHAAA,iBAAiB,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAWA,mCAYkB;AAXhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,sHAAA,4BAA4B,OAAA;AAC5B,oHAAA,0BAA0B,OAAA;AAC1B,2HAAA,iCAAiC,OAAA;AACjC,sHAAA,4BAA4B,OAAA;AAC5B,6GAAA,mBAAmB,OAAA;AACnB,sHAAA,4BAA4B,OAAA;AAC5B,8GAAA,oBAAoB,OAAA;AAItB,sEASuC;AARrC,gIAAA,wBAAwB,OAAA;AACxB,8HAAA,sBAAsB,OAAA;AACtB,2HAAA,mBAAmB,OAAA;AAQrB,8DAMmC;AALjC,iIAAA,6BAA6B,OAAA;AAC7B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAC9B,kIAAA,8BAA8B,OAAA;AAIhC,8CAI0B;AAHxB,0GAAA,aAAa,OAAA;AAKf,oCAAgF;AAAvE,sGAAA,cAAc,OAAA;AAAE,0GAAA,kBAAkB,OAAA;AAE3C,kDAM4B;AAL1B,yGAAA,UAAU,OAAA;AACV,oHAAA,qBAAqB,OAAA;AAavB,6EAG2C;AAFzC,+HAAA,oBAAoB,OAAA;AAItB,qEAMuC;AALrC,0HAAA,mBAAmB,OAAA;AACnB,wHAAA,iBAAiB,OAAA;AAMnB,yCAKyB;AAJvB,kHAAA,yBAAyB,OAAA;AACzB,+GAAA,sBAAsB,OAAA;AACtB,uGAAA,cAAc,OAAA;AAIhB,6DAOmC;AANjC,iHAAA,cAAc,OAAA;AACd,8GAAA,WAAW,OAAA;AAOb,0CAAqD;AAA5C,8GAAA,mBAAmB,OAAA;AAE5B,4DAKkC;AAJhC,sHAAA,mBAAmB,OAAA;AACnB,+HAAA,4BAA4B,OAAA;AAC5B,6HAAA,0BAA0B,OAAA;AAI5B,8DAOkC;AANhC,kHAAA,aAAa,OAAA;AACb,wHAAA,mBAAmB,OAAA;AACnB,4HAAA,uBAAuB,OAAA;AAMzB,4DAGiC;AAF/B,0HAAA,sBAAsB,OAAA;AAIxB,wCAKuB;AAJrB,oGAAA,UAAU,OAAA;AACV,0GAAA,gBAAgB,OAAA;AAChB,yGAAA,eAAe,OAAA;AAIjB,gDAAyE;AAAhE,mHAAA,qBAAqB,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE7C,oEAMqC;AALnC,sHAAA,cAAc,OAAA;AACd,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AACnB,2HAAA,mBAAmB,OAAA;AAIrB,0EAQwC;AAPtC,6HAAA,kBAAkB,OAAA;AAClB,gIAAA,qBAAqB,OAAA;AAQvB,gEAA6D;AAApD,sHAAA,gBAAgB,OAAA;AAEzB,0EAA8D;AAArD,uHAAA,YAAY,OAAA;AAErB,4EAGyC;AAFvC,kIAAA,sBAAsB,OAAA;AAIxB,oFAK6C;AAJ3C,yIAAA,yBAAyB,OAAA;AAM3B,gEAGmC;AAFjC,6HAAA,uBAAuB,OAAA;AACvB,iIAAA,2BAA2B,OAAA;AAG7B,sEAAmE;AAA1D,wHAAA,iBAAiB,OAAA;AAC1B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAExB,wCAAyE;AAAhE,8GAAA,oBAAoB,OAAA;AAAE,4GAAA,kBAAkB,OAAA;AAEjD,kEAIoC;AAHlC,wHAAA,iBAAiB,OAAA"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"navigation-refusal.d.ts","sourceRoot":"","sources":["../../src/nest/navigation-refusal.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAOtD,eAAO,MAAM,2BAA2B,UAAU,CAAC;AAOnD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,oBAAoB,GACzB,MAAM,CAGR"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.OIDC_NAVIGATION_ERROR_PARAM = void 0;
|
|
4
|
+
exports.navigationErrorLocation = navigationErrorLocation;
|
|
5
|
+
exports.OIDC_NAVIGATION_ERROR_PARAM = 'error';
|
|
6
|
+
function navigationErrorLocation(path, code) {
|
|
7
|
+
const query = new URLSearchParams({ [exports.OIDC_NAVIGATION_ERROR_PARAM]: code });
|
|
8
|
+
return `${path}?${query.toString()}`;
|
|
9
|
+
}
|
|
10
|
+
//# sourceMappingURL=navigation-refusal.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"navigation-refusal.js","sourceRoot":"","sources":["../../src/nest/navigation-refusal.ts"],"names":[],"mappings":";;;AA6BA,0DAMC;AAbY,QAAA,2BAA2B,GAAG,OAAO,CAAC;AAOnD,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAA0B;IAE1B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,mCAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvC,CAAC"}
|
|
@@ -19,11 +19,15 @@ export declare class OidcSessionAuthController {
|
|
|
19
19
|
private readonly sessions;
|
|
20
20
|
private readonly client;
|
|
21
21
|
private readonly options;
|
|
22
|
+
private readonly logger;
|
|
22
23
|
constructor(sessions: SessionService, client: OidcClient, options: OidcSessionOptions);
|
|
23
24
|
login(returnTo: string | undefined, loginHint: string | undefined, res: SessionResponseLike): Promise<void>;
|
|
24
25
|
callback(code: string | undefined, state: string | undefined, error: string | undefined, errorDescription: string | undefined, res: SessionResponseLike): Promise<void>;
|
|
26
|
+
private completeCallback;
|
|
25
27
|
logout(res: SessionResponseLike): Promise<void>;
|
|
26
28
|
me(_req: SessionRequestShape, res: SessionResponseLike): void;
|
|
29
|
+
private exchangeCode;
|
|
30
|
+
private asNavigation;
|
|
27
31
|
private sessionCookie;
|
|
28
32
|
private clearedCookie;
|
|
29
33
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-auth.controller.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc-session-auth.controller.d.ts","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,UAAU,EAAyB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAIzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAGD,MAAM,WAAW,cAAc;IAQ7B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAgBD,qBAEa,yBAAyB;IAIlC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAIvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C;gBAGlD,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,UAAU,EAIlB,OAAO,EAAE,kBAAkB;IA2CxC,KAAK,CACU,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC1C,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAwCV,QAAQ,CACG,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EACb,gBAAgB,EAAE,MAAM,GAAG,SAAS,EACzD,GAAG,EAAE,mBAAmB,GAC9B,OAAO,CAAC,IAAI,CAAC;YAMF,gBAAgB;IAqFxB,MAAM,CAAQ,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgD5D,EAAE,CAAQ,IAAI,EAAE,mBAAmB,EAAS,GAAG,EAAE,mBAAmB,GAAG,IAAI;YA4B7D,YAAY;YAuBZ,YAAY;IAuB1B,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,aAAa;CAWtB"}
|
|
@@ -11,12 +11,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
|
|
|
11
11
|
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
12
|
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
13
|
};
|
|
14
|
+
var OidcSessionAuthController_1;
|
|
14
15
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
15
16
|
exports.OidcSessionAuthController = void 0;
|
|
16
17
|
const common_1 = require("@nestjs/common");
|
|
17
18
|
const swagger_1 = require("@nestjs/swagger");
|
|
18
19
|
const xema_decorators_1 = require("@xemahq/xema-decorators");
|
|
19
20
|
const errors_1 = require("../errors");
|
|
21
|
+
const navigation_refusal_1 = require("./navigation-refusal");
|
|
20
22
|
const oidc_session_context_1 = require("./oidc-session-context");
|
|
21
23
|
const oidc_session_guard_1 = require("./oidc-session.guard");
|
|
22
24
|
const redirect_targets_1 = require("./redirect-targets");
|
|
@@ -31,28 +33,34 @@ const session_actor_dto_1 = require("./dto/session-actor.dto");
|
|
|
31
33
|
const HTTP_FOUND = 302;
|
|
32
34
|
const HTTP_OK = 200;
|
|
33
35
|
const HTTP_UNAUTHORIZED = 401;
|
|
34
|
-
let OidcSessionAuthController = class OidcSessionAuthController {
|
|
36
|
+
let OidcSessionAuthController = OidcSessionAuthController_1 = class OidcSessionAuthController {
|
|
35
37
|
sessions;
|
|
36
38
|
client;
|
|
37
39
|
options;
|
|
40
|
+
logger = new common_1.Logger(OidcSessionAuthController_1.name);
|
|
38
41
|
constructor(sessions, client, options) {
|
|
39
42
|
this.sessions = sessions;
|
|
40
43
|
this.client = client;
|
|
41
44
|
this.options = options;
|
|
42
45
|
}
|
|
43
46
|
async login(returnTo, loginHint, res) {
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
47
|
+
await this.asNavigation('login', res, async () => {
|
|
48
|
+
const { redirectUri } = (0, redirect_targets_1.resolveRedirectTargets)(this.options.oidc, (0, oidc_session_context_1.currentSessionScope)());
|
|
49
|
+
const pkce = (0, pkce_1.createPkcePair)();
|
|
50
|
+
const { authorizationUrl } = await this.sessions.beginAuthorization({
|
|
51
|
+
pkceVerifier: pkce.verifier,
|
|
52
|
+
codeChallenge: pkce.challenge,
|
|
53
|
+
returnTo: (0, cookie_1.safeRelativePath)(returnTo),
|
|
54
|
+
loginHint: (0, login_hint_1.safeLoginHint)(loginHint),
|
|
55
|
+
redirectUri,
|
|
56
|
+
});
|
|
57
|
+
res.status(HTTP_FOUND).redirect(authorizationUrl);
|
|
52
58
|
});
|
|
53
|
-
res.status(HTTP_FOUND).redirect(authorizationUrl);
|
|
54
59
|
}
|
|
55
60
|
async callback(code, state, error, errorDescription, res) {
|
|
61
|
+
await this.asNavigation('callback', res, () => this.completeCallback(code, state, error, errorDescription, res));
|
|
62
|
+
}
|
|
63
|
+
async completeCallback(code, state, error, errorDescription, res) {
|
|
56
64
|
if (error !== undefined && error !== '') {
|
|
57
65
|
throw new errors_1.OidcCallbackRejectedError(`The identity provider refused the sign-in (${error}` +
|
|
58
66
|
`${errorDescription === undefined ? '' : `: ${errorDescription}`}).`);
|
|
@@ -71,7 +79,7 @@ let OidcSessionAuthController = class OidcSessionAuthController {
|
|
|
71
79
|
if (pending.redirectUri !== redirectUri) {
|
|
72
80
|
throw new errors_1.OidcLoginOriginMismatchError();
|
|
73
81
|
}
|
|
74
|
-
const tokenSet = await this.
|
|
82
|
+
const tokenSet = await this.exchangeCode({
|
|
75
83
|
code,
|
|
76
84
|
codeVerifier: pending.codeVerifier,
|
|
77
85
|
nonce: pending.nonce,
|
|
@@ -107,6 +115,31 @@ let OidcSessionAuthController = class OidcSessionAuthController {
|
|
|
107
115
|
res.status(HTTP_OK).type('application/json');
|
|
108
116
|
res.send('null');
|
|
109
117
|
}
|
|
118
|
+
async exchangeCode(input) {
|
|
119
|
+
try {
|
|
120
|
+
return await this.client.exchangeCode(input);
|
|
121
|
+
}
|
|
122
|
+
catch (caught) {
|
|
123
|
+
if (caught instanceof oidc_client_1.OidcInvalidGrantError) {
|
|
124
|
+
throw new errors_1.OidcCallbackRejectedError(caught.message);
|
|
125
|
+
}
|
|
126
|
+
throw caught;
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
async asNavigation(route, res, work) {
|
|
130
|
+
try {
|
|
131
|
+
await work();
|
|
132
|
+
}
|
|
133
|
+
catch (caught) {
|
|
134
|
+
const path = this.options.navigationErrorPath;
|
|
135
|
+
if (path === undefined || !(caught instanceof errors_1.OidcSessionError)) {
|
|
136
|
+
throw caught;
|
|
137
|
+
}
|
|
138
|
+
this.logger.warn(`GET ${route} refused (${caught.code}, HTTP ${String(caught.getStatus())}): ` +
|
|
139
|
+
`${caught.message} — redirecting to the navigation-error path.`);
|
|
140
|
+
res.status(HTTP_FOUND).redirect((0, navigation_refusal_1.navigationErrorLocation)(path, caught.code));
|
|
141
|
+
}
|
|
142
|
+
}
|
|
110
143
|
sessionCookie(value) {
|
|
111
144
|
const { cookie, ttl } = this.options;
|
|
112
145
|
return (0, cookie_1.serializeCookie)(cookie.name, value, {
|
|
@@ -225,7 +258,7 @@ __decorate([
|
|
|
225
258
|
__metadata("design:paramtypes", [Object, Object]),
|
|
226
259
|
__metadata("design:returntype", void 0)
|
|
227
260
|
], OidcSessionAuthController.prototype, "me", null);
|
|
228
|
-
exports.OidcSessionAuthController = OidcSessionAuthController = __decorate([
|
|
261
|
+
exports.OidcSessionAuthController = OidcSessionAuthController = OidcSessionAuthController_1 = __decorate([
|
|
229
262
|
(0, swagger_1.ApiExtraModels)(session_actor_dto_1.SessionActorDto),
|
|
230
263
|
(0, common_1.Controller)('auth'),
|
|
231
264
|
__param(2, (0, common_1.Inject)(tokens_1.OIDC_SESSION_OPTIONS)),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oidc-session-auth.controller.js","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"oidc-session-auth.controller.js","sourceRoot":"","sources":["../../src/nest/oidc-session-auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiBA,2CAUwB;AACxB,6CAMyB;AACzB,6DAA6E;AAE7E,sCAMmB;AACnB,6DAA+D;AAC/D,iEAA6D;AAC7D,6DAAwD;AACxD,yDAA4D;AAC5D,qCAAgD;AAChD,2CAAmE;AACnE,mDAAmD;AAInD,qDAAwE;AACxE,uCAA8C;AAC9C,gEAA4D;AAC5D,mEAA8D;AAC9D,+DAA0D;AAiC1D,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAcvB,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAIjB;IACA;IAIA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAErE,YACmB,QAAwB,EACxB,MAAkB,EAIlB,OAA2B;QAL3B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAY;QAIlB,YAAO,GAAP,OAAO,CAAoB;IAC3C,CAAC;IA0CE,AAAN,KAAK,CAAC,KAAK,CACU,QAA4B,EAC3B,SAA6B,EAC1C,GAAwB;QAE/B,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE;YAG/C,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,yCAAsB,EAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAA,0CAAmB,GAAE,CACtB,CAAC;YACF,MAAM,IAAI,GAAG,IAAA,qBAAc,GAAE,CAAC;YAC9B,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAClE,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,QAAQ,EAAE,IAAA,yBAAgB,EAAC,QAAQ,CAAC;gBACpC,SAAS,EAAE,IAAA,0BAAa,EAAC,SAAS,CAAC;gBACnC,WAAW;aACZ,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;IAsBK,AAAN,KAAK,CAAC,QAAQ,CACG,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EACb,gBAAoC,EACzD,GAAwB;QAE/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CACjE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,IAAwB,EACxB,KAAyB,EACzB,KAAyB,EACzB,gBAAoC,EACpC,GAAwB;QAExB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CACjC,8CAA8C,KAAK,EAAE;gBACnD,GAAG,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,IAAI,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,kCAAyB,CAAC,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,kCAAyB,CACjC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QAID,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,yCAAsB,EAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,IAAA,0CAAmB,GAAE,CACtB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,mCAA0B,EAAE,CAAC;QACzC,CAAC;QAID,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,IAAI,qCAA4B,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC;YACvC,IAAI;YACJ,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YAEpB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAKH,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CACtD,QAAQ,EACR,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC/D,CAAC;IAuBK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAwB;QAC1C,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QAGpC,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAA,yCAAsB,EACtD,IAAI,CAAC,OAAO,CAAC,IAAI,EACjB,KAAK,CACN,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAClD,KAAK,EAAE,OAAO,IAAI,IAAI,EACtB,qBAAqB,CACtB,CAAC;QACF,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAiCD,EAAE,CAAQ,IAAyB,EAAS,GAAwB;QAClE,MAAM,KAAK,GAAG,IAAA,0CAAmB,GAAE,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,KAAK,GAAiB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAIlD,MAAM,IAAI,4BAAmB,EAAE,CAAC;QAClC,CAAC;QAID,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IASO,KAAK,CAAC,YAAY,CACxB,KAAgD;QAEhD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,IAAI,MAAM,YAAY,mCAAqB,EAAE,CAAC;gBAC5C,MAAM,IAAI,kCAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAYO,KAAK,CAAC,YAAY,CACxB,KAA2B,EAC3B,GAAwB,EACxB,IAAyB;QAEzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,YAAY,yBAAgB,CAAC,EAAE,CAAC;gBAChE,MAAM,MAAM,CAAC;YACf,CAAC;YAID,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,OAAO,KAAK,aAAa,MAAM,CAAC,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK;gBAC3E,GAAG,MAAM,CAAC,OAAO,8CAA8C,CAClE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAA,4CAAuB,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,GAAG,CAAC,kBAAkB;SACtC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa;QACnB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE;YACtC,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjE,aAAa,EAAE,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlVY,8DAAyB;AAoD9B;IA1BL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,0EAA0E;YAC1E,qDAAqD;KACxD,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,+EAA+E;KAClF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;KAChF,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EAAE,0EAA0E;KACxF,CAAC;IACD,IAAA,YAAG,EAAC,OAAO,CAAC;IAEV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,WAAW,CAAC,CAAA;IAClB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDAmBP;AAsBK;IAbL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,aAAa;QACvC,KAAK,EACH,wEAAwE;YACxE,2EAA2E;KAC9E,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,UAAU;QAClB,WAAW,EACT,oEAAoE;YACpE,sCAAsC;KACzC,CAAC;IACD,IAAA,YAAG,EAAC,UAAU,CAAC;IAEb,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,mBAAmB,CAAC,CAAA;IAC1B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;yDAKP;AAuFK;IAdL,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,6DAA6D;YAC7D,wEAAwE;YACxE,2EAA2E;YAC3E,oBAAoB;KACvB,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,IAAI,EAAE,uCAAiB;QACvB,WAAW,EAAE,sDAAsD;KACpE,CAAC;IACD,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAelB;AAiCD;IAtBC,IAAA,iCAAe,EAAC;QACf,MAAM,EAAE,mCAAiB,CAAC,wBAAwB;QAClD,KAAK,EACH,0EAA0E;YAC1E,0EAA0E;KAC7E,CAAC;IAID,IAAA,uBAAa,EAAC;QACb,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,uBAAa,EAAC,mCAAe,CAAC,EAAE,CAAC,EAAE;QAC7E,WAAW,EACT,0EAA0E;YAC1E,iEAAiE;KACpE,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,iBAAiB;QACzB,WAAW,EACT,4EAA4E;YAC5E,yCAAyC;KAC5C,CAAC;IACD,IAAA,YAAG,EAAC,IAAI,CAAC;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAmB1C;oCApQU,yBAAyB;IAFrC,IAAA,wBAAc,EAAC,mCAAe,CAAC;IAC/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IASd,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;qCAJF,gCAAc;QAChB,wBAAU;GAL1B,yBAAyB,CAkVrC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/oidc-session-nest",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"description": "Server-side OIDC session for a NestJS backend-for-frontend: the browser holds one httpOnly cookie and never a Xema token. Performs the authorization-code exchange, keeps the token set in a session store the application owns, refreshes it under a lease so concurrent requests exchange once, and hands the generated Xema clients a bearer plus the org and Project headers through an ambient request scope.",
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"registry": "https://registry.npmjs.org/",
|