fastify-txstate 3.6.2 → 3.6.4

package/lib/unified-auth.d.ts

@@ -7,6 +7,7 @@ export interface IssuerConfigRaw extends Omit<IssuerConfig, 'validateUrl' | 'log
 export declare function unifiedAuthenticate(req: FastifyRequest, options?: {
     authenticateAll?: boolean;
     exceptRoutes?: Set<string>;
+    optionalRoutes?: Set<string>;
     usingUaCookieRoutes?: boolean;
 }): Promise<FastifyTxStateAuthInfo | undefined>;
 /**

package/lib/unified-auth.js

@@ -13,6 +13,7 @@ const issuerConfig = new Map();
 const trustedClients = new Set();
 const uaCookieName = process.env.UA_COOKIE_NAME ?? (0, crypto_1.randomBytes)(16).toString('hex');
 const uaCookieNameRegex = new RegExp(`${uaCookieName}=([^;]+)`);
+const uaServiceUrl = (0, txstate_utils_1.isNotBlank)(process.env.PUBLIC_URL) ? process.env.PUBLIC_URL + (process.env.PUBLIC_URL.endsWith('/') ? '' : '/') + '.uaService' : undefined;
 const tokenCache = new txstate_utils_1.Cache(async (token, req) => {
     const claims = (0, jose_1.decodeJwt)(token);
     let verifyKey;
@@ -144,13 +145,17 @@ async function unifiedAuthenticate(req, options) {
         options.exceptRoutes ??= new Set();
         options.exceptRoutes.add('/.uaService');
         options.exceptRoutes.add('/.uaRedirect');
+        options.optionalRoutes ??= new Set();
+        options.optionalRoutes.add('/.uaLogout');
     }
-    const isAuthenticatedRoute = options?.authenticateAll && (options.exceptRoutes == null || !options.exceptRoutes.has(req.routeOptions.url));
-    if (isAuthenticatedRoute) {
-        if ((0, txstate_utils_1.isBlank)(auth?.username))
-            throw new Error('Request requires authentication.');
+    const isNoAuthenticationRoute = options?.exceptRoutes?.has(req.routeOptions.url);
+    const requiresAuthenticationRoute = options?.authenticateAll &&
+        !options?.exceptRoutes?.has(req.routeOptions.url) &&
+        !options?.optionalRoutes?.has(req.routeOptions.url);
+    if (requiresAuthenticationRoute && (0, txstate_utils_1.isBlank)(auth?.username)) {
+        throw new Error('Request requires authentication.');
     }
-    return auth;
+    return isNoAuthenticationRoute ? undefined : auth;
 }
 /**
  * @deprecated Use unifiedAuthenticateWithOptions with { authenticateAll: true } instead.
@@ -167,7 +172,7 @@ async function requireCookieAuth(req, res) {
     if ((0, txstate_utils_1.isBlank)(req.auth?.username)) {
         const loginUrl = new URL(process.env.UA_URL + '/login');
         loginUrl.searchParams.set('clientId', process.env.UA_CLIENTID);
-        loginUrl.searchParams.set('returnUrl', (0, txstate_utils_1.isNotBlank)(process.env.PUBLIC_URL) ? new URL(process.env.PUBLIC_URL + '/.uaService').toString() : new URL('/.uaService', req.url).toString());
+        loginUrl.searchParams.set('returnUrl', uaServiceUrl ?? new URL('/.uaService', req.url).toString());
         loginUrl.searchParams.set('requestedUrl', req.originalUrl);
         void res.redirect(loginUrl.toString());
         return true;
@@ -188,7 +193,7 @@ function registerUaCookieRoutes(app) {
             }
         }
     }, async (req, res) => {
-        const redirectUrl = req.auth?.issuerConfig?.logoutUrl
+        const redirectUrl = req.auth?.issuerConfig?.logoutUrl && (0, txstate_utils_1.isNotBlank)(req.auth.token)
             ? `${req.auth.issuerConfig.logoutUrl.toString()}?unifiedJwt=${encodeURIComponent(req.auth.token)}`
             : (process.env.PUBLIC_URL || new URL('..', req.url).toString());
         return res
@@ -230,9 +235,12 @@ function registerUaCookieRoutes(app) {
             }
         }
     }, async (req, res) => {
-        const loginUrl = new URL(process.env.UA_URL + '/login');
-        loginUrl.searchParams.set('clientId', process.env.UA_CLIENTID);
-        loginUrl.searchParams.set('returnUrl', new URL('.uaService', process.env.PUBLIC_URL || new URL(req.url, req.protocol + '://' + req.hostname)).toString());
+        const loginUrl = (0, txstate_utils_1.isNotBlank)(process.env.UA_URL)
+            ? new URL(process.env.UA_URL + '/login')
+            : new URL('login', issuerConfig.get('unified-auth')?.url);
+        loginUrl.searchParams.set('clientId', process.env.UA_CLIENTID ?? process.env.JWT_TRUSTED_CLIENTIDS.split(',')[0]);
+        const returnUrl = uaServiceUrl ?? new URL('.uaService', req.protocol + '://' + req.hostname).toString();
+        loginUrl.searchParams.set('returnUrl', returnUrl);
         if (req.query.requestedUrl)
             loginUrl.searchParams.set('requestedUrl', req.query.requestedUrl);
         return res.redirect(loginUrl.toString());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify-txstate",
-  "version": "3.6.2",
+  "version": "3.6.4",
   "description": "A small wrapper for fastify providing a set of common conventions & utility functions we use.",
   "exports": {
     ".": {