@yrpri/api 9.0.132 → 9.0.134

package/app.js

@@ -486,6 +486,7 @@ export class YourPrioritiesApi {
         this.app.use((req, res, next) => {
             if (req.url.indexOf("/auth") > -1 ||
                 req.url.indexOf("/login") > -1 ||
+                req.url.indexOf("/logout") > -1 ||
                 req.url.indexOf("saml_assertion") > -1) {
                 sso.init(req.ypDomain?.loginHosts, req.ypDomain?.loginProviders, {
                     authorize: this.bearerCallback,

package/controllers/users.cjs

@@ -15,20 +15,35 @@ const randomstring = require('randomstring');
 const { sendPlausibleFavicon } = require("../services/engine/analytics/plausible/manager.cjs");
 var getAllModeratedItemsByUser = require('../services/engine/moderation/get_moderation_items.cjs').getAllModeratedItemsByUser;
 const performSingleModerationAction = require('../services/engine/moderation/process_moderation_items.cjs').performSingleModerationAction;
-const logoutFromSession = (req, res, statusCode = 200) => {
+const logoutFromSession = (req, res, statusCode = 200, callback) => {
     if (req.session) {
         req.session.destroy((err) => {
             if (err) {
                 log.error("Error on destroying session", { err });
-                return res.sendStatus(500);
+                if (!callback) {
+                    return res.sendStatus(500);
+                }
+                else {
+                    return callback(err);
+                }
             }
             res.clearCookie('yrpri.sid', { path: '/' });
             log.info("Session destroyed successfully");
-            res.sendStatus(statusCode);
+            if (callback) {
+                callback();
+            }
+            else {
+                res.sendStatus(statusCode);
+            }
         });
     }
     else {
-        res.sendStatus(statusCode);
+        if (callback) {
+            callback();
+        }
+        else {
+            res.sendStatus(statusCode);
+        }
     }
 };
 var sendUserOrError = function (res, user, context, error, errorStatus) {
@@ -1422,14 +1437,31 @@ router.delete('/anonymize_current_user', function (req, res) {
     }
 });
 router.post('/logout', function (req, res) {
-    log.info("Anon debug logout");
     if (req.isAuthenticated()) {
         log.info('User Logging out', { userId: req.user.id, context: 'logout' });
     }
     else {
         log.warn('User Logging out but not logged in', { context: 'logout' });
     }
-    logoutFromSession(req, res);
+    const oidcProvider = req.ypDomain &&
+        req.ypDomain.loginProviders &&
+        req.ypDomain.loginProviders.find((p) => p.provider === 'oidc');
+    log.info("oidcProvider", { oidcProvider });
+    if (req.sso && oidcProvider && oidcProvider.endSessionURL) {
+        log.info("Logging out from OIDC");
+        logoutFromSession(req, res, 200, () => {
+            log.info("Logging out from OIDC", { oidcProvider });
+            req.sso.logout(oidcProvider.name, { postLogoutRedirectUri: '/' }, req, res, (error) => {
+                if (error) {
+                    log.error('Error logging out from OIDC', { err: error });
+                    res.sendStatus(500);
+                }
+            });
+        });
+    }
+    else {
+        logoutFromSession(req, res);
+    }
 });
 // Reset password
 router.post('/forgot_password', function (req, res) {
@@ -2257,7 +2289,10 @@ router.get('/auth/audkenni/callback', async function (req, res) {
             }
         }
         else {
-            if (process.env.REDIRECT_TO_ROOT_AFTER_OIDC) {
+            if (process.env.REDIRECT_AFTER_AUDKENNI_URL) {
+                res.redirect(process.env.REDIRECT_AFTER_AUDKENNI_URL);
+            }
+            else if (process.env.REDIRECT_TO_ROOT_AFTER_OIDC) {
                 res.redirect('/');
             }
             else {

package/models/domain.cjs

@@ -237,6 +237,7 @@ module.exports = (sequelize, DataTypes) => {
                     authorizationURL: domain.secret_api_keys.oidc.authorizationURL,
                     tokenURL: domain.secret_api_keys.oidc.tokenURL,
                     userInfoURL: domain.secret_api_keys.oidc.userInfoURL,
+                    endSessionURL: domain.secret_api_keys.oidc.endSessionURL,
                     callbackUrl: "https://" +
                         callbackDomainName +
                         "/api/users/auth/audkenni/callback",
@@ -337,6 +338,7 @@ module.exports = (sequelize, DataTypes) => {
                 req.ypDomain = domain;
                 if (req.url.indexOf("/auth") > -1 ||
                     req.url.indexOf("/login") > -1 ||
+                    req.url.indexOf("/logout") > -1 ||
                     req.url.indexOf("saml_assertion") > -1) {
                     sequelize.models.Domain.getLoginProviders(req, domain, (error, providers) => {
                         req.ypDomain.loginProviders = providers;
@@ -363,6 +365,7 @@ module.exports = (sequelize, DataTypes) => {
                     req.ypDomain = domain;
                     if (req.url.indexOf("/auth") > -1 ||
                         req.url.indexOf("/login") > -1 ||
+                        req.url.indexOf("/logout") > -1 ||
                         req.url.indexOf("saml_assertion") > -1) {
                         sequelize.models.Domain.getLoginProviders(req, domain, (error, providers) => {
                             log.info("Login Providers", { providers });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yrpri/api",
-  "version": "9.0.132",
+  "version": "9.0.134",
   "license": "MIT",
   "author": "Robert Bjarnason & Citizens Foundation",
   "repository": {

package/scripts/domains/importDomainsFromXls.js

@@ -2,9 +2,9 @@ import ExcelJS from 'exceljs';
 import models from '../../models/index.cjs';
 (async () => {
     try {
-        const [xlsPath, clientId, clientSecret, issuer, authorizationURL, tokenURL, userInfoURL,] = process.argv.slice(2);
+        const [xlsPath, clientId, clientSecret, issuer, authorizationURL, tokenURL, userInfoURL, endSessionURL,] = process.argv.slice(2);
         if (!xlsPath) {
-            console.log('Usage: node importDomainsFromXls.js <path-to-xls> [clientId clientSecret issuer authorizationURL tokenURL userInfoURL]');
+            console.log('Usage: node importDomainsFromXls.js <path-to-xls> [clientId clientSecret issuer authorizationURL tokenURL userInfoURL endSessionURL]');
             process.exit(1);
         }
         const oidcProvided = clientId &&
@@ -12,7 +12,8 @@ import models from '../../models/index.cjs';
             issuer &&
             authorizationURL &&
             tokenURL &&
-            userInfoURL;
+            userInfoURL &&
+            endSessionURL;
         const workbook = new ExcelJS.Workbook();
         await workbook.xlsx.readFile(xlsPath);
         const worksheet = workbook.getWorksheet(1);
@@ -29,6 +30,7 @@ import models from '../../models/index.cjs';
                     authorizationURL,
                     tokenURL,
                     userInfoURL,
+                    endSessionURL,
                 }
                 : null;
             for (let i = 2; i <= worksheet.rowCount; i++) {

package/scripts/keys/addOidcToDomain.cjs

@@ -8,6 +8,7 @@ const issuer = process.argv[5];
 const authorizationURL = process.argv[6];
 const tokenURL = process.argv[7];
 const userInfoURL = process.argv[8];
+const endSessionURL = process.argv[9];
 console.log(`Updating OIDC keys for domain ${domainId}`);
 async.series([
     function (callback) {
@@ -29,7 +30,8 @@ async.series([
                     issuer: issuer,
                     authorizationURL: authorizationURL,
                     tokenURL: tokenURL,
-                    userInfoURL: userInfoURL
+                    userInfoURL: userInfoURL,
+                    endSessionURL: endSessionURL
                 };
                 console.log("Updated secret_api_keys:", JSON.stringify(domain.secret_api_keys, null, 2));
                 domain.changed('secret_api_keys', true);