berget 2.2.7 → 2.2.9

package/dist/src/services/browser-auth.js

@@ -22,64 +22,55 @@ var __importStar = (this && this.__importStar) || function (mod) {
     __setModuleDefault(result, mod);
     return result;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BrowserAuth = void 0;
-const http = __importStar(require("http"));
-const crypto = __importStar(require("crypto"));
+const crypto = __importStar(require("node:crypto"));
+const http = __importStar(require("node:http"));
 class BrowserAuth {
+    options;
     constructor(options) {
         this.options = options;
     }
-    start() {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { keycloakUrl, realm, clientId, callbackPort, debug } = this.options;
-            // Generate PKCE code verifier and challenge
-            const codeVerifier = this.generateCodeVerifier();
-            const codeChallenge = this.generateCodeChallenge(codeVerifier);
-            const state = crypto.randomBytes(16).toString("hex");
-            const redirectUri = `http://localhost:${callbackPort}/callback`;
-            // Build authorization URL
-            const authUrl = new URL(`${keycloakUrl}/realms/${realm}/protocol/openid-connect/auth`);
-            authUrl.searchParams.set("client_id", clientId);
-            authUrl.searchParams.set("response_type", "code");
-            authUrl.searchParams.set("redirect_uri", redirectUri);
-            authUrl.searchParams.set("scope", "openid email profile");
-            authUrl.searchParams.set("state", state);
-            authUrl.searchParams.set("code_challenge", codeChallenge);
-            authUrl.searchParams.set("code_challenge_method", "S256");
-            // Create a promise that resolves when we receive the callback
-            const authResult = yield new Promise(resolve => {
-                let resolved = false;
-                const sockets = new Set();
-                const safeResolve = (result) => {
-                    if (resolved)
-                        return;
-                    resolved = true;
-                    clearTimeout(timeoutHandle);
-                    server.close();
-                    // Force-close all active sockets so the server stops immediately
-                    for (const socket of sockets) {
-                        socket.destroy();
-                    }
-                    sockets.clear();
-                    resolve(result);
-                };
-                const server = http.createServer((req, res) => {
-                    const requestUrl = new URL(req.url || "", `http://localhost:${callbackPort}`);
-                    if (requestUrl.pathname === "/callback") {
-                        const receivedState = requestUrl.searchParams.get("state") || "";
-                        const code = requestUrl.searchParams.get("code") || "";
-                        const error = requestUrl.searchParams.get("error") || "";
-                        const errorPage = (title, message) => `
+    async start() {
+        const { callbackPort, clientId, debug, keycloakUrl, realm } = this.options;
+        // Generate PKCE code verifier and challenge
+        const codeVerifier = this.generateCodeVerifier();
+        const codeChallenge = this.generateCodeChallenge(codeVerifier);
+        const state = crypto.randomBytes(16).toString('hex');
+        const redirectUri = `http://localhost:${callbackPort}/callback`;
+        // Build authorization URL
+        const authUrl = new URL(`${keycloakUrl}/realms/${realm}/protocol/openid-connect/auth`);
+        authUrl.searchParams.set('client_id', clientId);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('redirect_uri', redirectUri);
+        authUrl.searchParams.set('scope', 'openid email profile');
+        authUrl.searchParams.set('state', state);
+        authUrl.searchParams.set('code_challenge', codeChallenge);
+        authUrl.searchParams.set('code_challenge_method', 'S256');
+        // Create a promise that resolves when we receive the callback
+        const authResult = await new Promise((resolve) => {
+            let resolved = false;
+            const sockets = new Set();
+            const safeResolve = (result) => {
+                if (resolved)
+                    return;
+                resolved = true;
+                clearTimeout(timeoutHandle);
+                server.close();
+                // Force-close all active sockets so the server stops immediately
+                for (const socket of sockets) {
+                    socket.destroy();
+                }
+                sockets.clear();
+                resolve(result);
+            };
+            const server = http.createServer((request, res) => {
+                const requestUrl = new URL(request.url || '', `http://localhost:${callbackPort}`);
+                if (requestUrl.pathname === '/callback') {
+                    const receivedState = requestUrl.searchParams.get('state') || '';
+                    const code = requestUrl.searchParams.get('code') || '';
+                    const error = requestUrl.searchParams.get('error') || '';
+                    const errorPage = (title, message) => `
             <!DOCTYPE html>
             <html lang="en">
               <head>
@@ -134,22 +125,22 @@ class BrowserAuth {
               </body>
             </html>
           `;
-                        // Set Connection: close so the browser doesn't keep the socket alive
-                        // after we respond, and force-end the connection
-                        if (error) {
-                            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" });
-                            res.end(errorPage("Authentication Failed", requestUrl.searchParams.get("error_description") || error));
-                            safeResolve({ success: false, error });
-                            return;
-                        }
-                        if (receivedState !== state) {
-                            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" });
-                            res.end(errorPage("Authentication Failed", "Invalid state parameter. Please try again."));
-                            safeResolve({ success: false, error: "Invalid state parameter" });
-                            return;
-                        }
-                        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" });
-                        res.end(`
+                    // Set Connection: close so the browser doesn't keep the socket alive
+                    // after we respond, and force-end the connection
+                    if (error) {
+                        res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(errorPage('Authentication Failed', requestUrl.searchParams.get('error_description') || error));
+                        safeResolve({ error, success: false });
+                        return;
+                    }
+                    if (receivedState !== state) {
+                        res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
+                        res.end(errorPage('Authentication Failed', 'Invalid state parameter. Please try again.'));
+                        safeResolve({ error: 'Invalid state parameter', success: false });
+                        return;
+                    }
+                    res.writeHead(200, { Connection: 'close', 'Content-Type': 'text/html; charset=utf-8' });
+                    res.end(`
             <!DOCTYPE html>
             <html lang="en">
               <head>
@@ -203,76 +194,75 @@ class BrowserAuth {
               </body>
             </html>
           `);
-                        safeResolve({ success: true, code });
-                    }
-                });
-                // Track sockets so we can destroy them on shutdown
-                server.on("connection", (socket) => {
-                    sockets.add(socket);
-                    socket.on("close", () => sockets.delete(socket));
-                });
-                server.listen(callbackPort, () => {
-                    if (debug) {
-                        console.log(`Callback server listening on port ${callbackPort}`);
-                    }
-                });
-                // Set timeout for the server
-                const timeoutHandle = setTimeout(() => {
-                    safeResolve({ success: false, error: "Authentication timed out" });
-                }, 5 * 60 * 1000); // 5 minute timeout
-                // Open browser
-                (() => __awaiter(this, void 0, void 0, function* () {
-                    try {
-                        const open = yield Promise.resolve().then(() => __importStar(require("open"))).then(m => m.default);
-                        yield open(authUrl.toString());
-                    }
-                    catch (_a) {
-                        // Browser failed to open - user must open URL manually
-                    }
-                }))();
+                    safeResolve({ code, success: true });
+                }
+            });
+            // Track sockets so we can destroy them on shutdown
+            server.on('connection', (socket) => {
+                sockets.add(socket);
+                socket.on('close', () => sockets.delete(socket));
             });
-            if (!authResult.success || !authResult.code) {
-                return {
-                    success: false,
-                    error: authResult.error || "Unknown error",
-                };
-            }
-            // Exchange authorization code for tokens
-            const tokenUrl = `${keycloakUrl}/realms/${realm}/protocol/openid-connect/token`;
-            const tokenResponse = yield fetch(tokenUrl, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                },
-                body: new URLSearchParams({
-                    grant_type: "authorization_code",
-                    client_id: clientId,
-                    code: authResult.code,
-                    redirect_uri: redirectUri,
-                    code_verifier: codeVerifier,
-                }).toString(),
+            server.listen(callbackPort, () => {
+                if (debug) {
+                    console.log(`Callback server listening on port ${callbackPort}`);
+                }
             });
-            if (!tokenResponse.ok) {
-                const errorText = yield tokenResponse.text();
-                return {
-                    success: false,
-                    error: `Failed to exchange code for tokens: ${errorText}`,
-                };
-            }
-            const tokenData = (yield tokenResponse.json());
+            // Set timeout for the server
+            const timeoutHandle = setTimeout(() => {
+                safeResolve({ error: 'Authentication timed out', success: false });
+            }, 5 * 60 * 1000); // 5 minute timeout
+            // Open browser
+            (async () => {
+                try {
+                    const open = await Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
+                    await open(authUrl.toString());
+                }
+                catch {
+                    // Browser failed to open - user must open URL manually
+                }
+            })();
+        });
+        if (!authResult.success || !authResult.code) {
             return {
-                success: true,
-                accessToken: tokenData.access_token,
-                refreshToken: tokenData.refresh_token,
-                expiresIn: tokenData.expires_in,
+                error: authResult.error || 'Unknown error',
+                success: false,
             };
+        }
+        // Exchange authorization code for tokens
+        const tokenUrl = `${keycloakUrl}/realms/${realm}/protocol/openid-connect/token`;
+        const tokenResponse = await fetch(tokenUrl, {
+            body: new URLSearchParams({
+                client_id: clientId,
+                code: authResult.code,
+                code_verifier: codeVerifier,
+                grant_type: 'authorization_code',
+                redirect_uri: redirectUri,
+            }).toString(),
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            method: 'POST',
         });
-    }
-    generateCodeVerifier() {
-        return crypto.randomBytes(32).toString("base64url");
+        if (!tokenResponse.ok) {
+            const errorText = await tokenResponse.text();
+            return {
+                error: `Failed to exchange code for tokens: ${errorText}`,
+                success: false,
+            };
+        }
+        const tokenData = (await tokenResponse.json());
+        return {
+            accessToken: tokenData.access_token,
+            expiresIn: tokenData.expires_in,
+            refreshToken: tokenData.refresh_token,
+            success: true,
+        };
     }
     generateCodeChallenge(verifier) {
-        return crypto.createHash("sha256").update(verifier).digest("base64url");
+        return crypto.createHash('sha256').update(verifier).digest('base64url');
+    }
+    generateCodeVerifier() {
+        return crypto.randomBytes(32).toString('base64url');
     }
 }
 exports.BrowserAuth = BrowserAuth;