nexus-shared 1.1.17 → 1.1.19

package/src/sso-config/sign-out-route.tsx

@@ -0,0 +1,53 @@
+import { NextRequest, NextResponse } from "next/server";
+import { NEXUS_INFO, URLS } from "../nexus.environments";
+import { HttpPost } from "../services/http-services";
+import { AUTH_COOKIES, ClearAllAuthCookies, GetDecryptedRequestCookie } from "./cookie-helpers";
+import { SanitizeReturnPath } from "./redirect-context-helpers";
+import { SSO_CONFIG } from "./sso-config";
+
+function hasAuthSession(req: NextRequest): boolean {
+  return !!(req.cookies.get(AUTH_COOKIES.ssoSession)?.value || req.cookies.get(AUTH_COOKIES.accessToken)?.value || req.cookies.get(AUTH_COOKIES.refreshToken)?.value);
+}
+
+function resolveReturnUrl(req: NextRequest): URL {
+  if (NEXUS_INFO.IS_ADMIN_MODULE && !hasAuthSession(req)) {
+    return new URL(URLS.SIGN_IN);
+  }
+
+  const appBase = req.nextUrl.origin ?? URLS.CURRENT!;
+  const returnPath = req.nextUrl.searchParams.get("returnUrl");
+  if (returnPath) {
+    return new URL(SanitizeReturnPath(returnPath), appBase);
+  }
+
+  return new URL(appBase);
+}
+
+async function revokeServerSession(req: NextRequest) {
+  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
+  if (!ssoSession) return;
+
+  const response = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_OUT, { ssoSession });
+
+  return response.isSuccess;
+}
+
+/** GET — clear cookies and redirect back to the originating app page. */
+export async function SignOutGetRoute(req: NextRequest) {
+  await revokeServerSession(req);
+  const response = NextResponse.redirect(resolveReturnUrl(req));
+  ClearAllAuthCookies(response);
+  return response;
+}
+
+/** POST — clear cookies and return JSON (API clients). */
+export async function SignOutPostRoute(req: NextRequest) {
+  if (NEXUS_INFO.IS_ADMIN_MODULE && !hasAuthSession(req)) {
+    return NextResponse.json({ ok: false, redirect: URLS.SIGN_IN }, { status: 401 });
+  }
+
+  await revokeServerSession(req);
+  const response = NextResponse.json({ ok: true });
+  ClearAllAuthCookies(response);
+  return response;
+}

package/src/sso-config/sign-up-route.tsx

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { HttpPost } from "../services/http-services";
+import { SetSsoSessionCookie } from "./cookie-helpers";
+import { SSO_CONFIG } from "./sso-config";
+import { ISignUpRequest } from "./sso-interfaces";
+import { ParseWrappedResult } from "./sso-response-helpers";
+
+const mapGender = (gender?: string | null) => {
+  const normalized = gender?.trim().toLowerCase();
+  if (normalized === "male") return 0;
+  if (normalized === "female") return 1;
+  return 2;
+};
+
+/** POST — register a new account (identity provider app). */
+export async function SignUpPostRoute(req: NextRequest) {
+  const body = (await req.json()) as ISignUpRequest & { confirmPassword?: string };
+
+  if (!body.fullName?.trim() || !body.username?.trim() || !body.email?.trim() || !body.password || !body.confirmPassword) {
+    return NextResponse.json({ error: "All required fields must be provided." }, { status: 400 });
+  }
+
+  if (body.password !== body.confirmPassword) {
+    return NextResponse.json({ error: "Passwords do not match." }, { status: 400 });
+  }
+
+  const signUpRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SIGN_UP, {
+    fullname: body.fullName.trim(),
+    username: body.username.trim(),
+    password: body.password,
+    confirmPassword: body.confirmPassword,
+    genderType: mapGender(body.gender),
+    emailAddress: body.email.trim(),
+    contactNumber: null,
+    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
+  });
+
+  const signUpResult = ParseWrappedResult<{ ssoSession: string }>(signUpRes);
+  if (!signUpRes.isSuccess || !signUpResult?.ssoSession) {
+    return NextResponse.json(signUpRes, { status: signUpRes.code ?? 400 });
+  }
+
+  const response = NextResponse.json(signUpRes);
+  SetSsoSessionCookie(response, signUpResult.ssoSession, SSO_CONFIG.BACKEND_CONFIG.SSO_SESSION_MAX_AGE);
+  return response;
+}

package/src/sso-config/sso-backend-flow.ts

@@ -0,0 +1,45 @@
+import { HttpPost } from "../services/http-services";
+import { PKCE_METHOD_S256, PkcePair } from "./pkce-helpers";
+import { SSO_CONFIG } from "./sso-config";
+import { SSOAuthResponse } from "./sso-interfaces";
+import { ParseSsoCodeResponse, ParseTokenResponse } from "./sso-response-helpers";
+
+export type SsoExchangeInput = {
+  ssoSession: string;
+  redirectUri: string;
+  state?: string;
+  returnPath?: string;
+  pkce: PkcePair;
+};
+
+export type TokenExchangeInput = {
+  code: string;
+  redirectUri: string;
+  codeVerifier: string;
+};
+
+/** Server-only: request an authorization code using client policy + PKCE. */
+export async function RequestAuthorizationCode(input: SsoExchangeInput): Promise<string | null> {
+  const ssoRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.SSO, {
+    ssoSession: input.ssoSession,
+    redirectUri: input.redirectUri,
+    state: input.state,
+    returnPath: input.returnPath,
+    codeChallenge: input.pkce.challenge,
+    codeChallengeMethod: input.pkce.method ?? PKCE_METHOD_S256,
+  });
+
+  return ParseSsoCodeResponse(ssoRes);
+}
+
+/** Server-only: exchange authorization code for tokens. */
+export async function ExchangeAuthorizationCode(input: TokenExchangeInput): Promise<SSOAuthResponse | null> {
+  const tokenRes = await HttpPost(SSO_CONFIG.BACKEND_ENDPOINTS.TOKEN, {
+    code: input.code,
+    redirectUri: input.redirectUri,
+    clientSystemName: SSO_CONFIG.BACKEND_CONFIG.CLIENT_SYSTEM_NAME,
+    codeVerifier: input.codeVerifier,
+  });
+
+  return ParseTokenResponse(tokenRes);
+}

package/src/sso-config/sso-complete-route.tsx

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { AUTH_COOKIES, GetDecryptedRequestCookie } from "./cookie-helpers";
+import { EncodeOAuthCallbackState } from "./oauth-callback-state";
+import { BuildAuthenticationSignInUrl } from "./sso-config";
+import { ClearRedirectContextCookie, DecodeRedirectContext } from "./redirect-context-helpers";
+import { PKCE_METHOD_S256, PkcePair } from "./pkce-helpers";
+import { RequestAuthorizationCode } from "./sso-backend-flow";
+
+function buildSignInRedirect(redirectContext: ReturnType<typeof DecodeRedirectContext>) {
+  return new URL(BuildAuthenticationSignInUrl(redirectContext?.returnPath));
+}
+
+/** Completes SSO after credentials sign-in: exchange session for code and redirect to the client callback. */
+export async function SsoCompleteRoute(req: NextRequest) {
+  const ssoSession = GetDecryptedRequestCookie(req, AUTH_COOKIES.ssoSession);
+  const redirectContext = DecodeRedirectContext(req.cookies.get(AUTH_COOKIES.redirectContext)?.value);
+
+  if (!ssoSession || !redirectContext?.redirectUri) {
+    return NextResponse.redirect(buildSignInRedirect(redirectContext));
+  }
+
+  const pkce: PkcePair = {
+    verifier: redirectContext.pkceVerifier,
+    challenge: redirectContext.codeChallenge,
+    method: (redirectContext.codeChallengeMethod as PkcePair["method"]) ?? PKCE_METHOD_S256,
+  };
+
+  try {
+    const code = await RequestAuthorizationCode({
+      ssoSession,
+      redirectUri: redirectContext.redirectUri,
+      state: redirectContext.state,
+      returnPath: redirectContext.returnPath,
+      pkce,
+    });
+    if (!code) return NextResponse.redirect(buildSignInRedirect(redirectContext));
+
+    const callbackState = EncodeOAuthCallbackState(redirectContext.state, redirectContext.returnPath, pkce.verifier);
+    const location = `${redirectContext.redirectUri}?code=${encodeURIComponent(code)}&state=${encodeURIComponent(callbackState)}`;
+    const response = NextResponse.redirect(location);
+    ClearRedirectContextCookie(response);
+    return response;
+  } catch {
+    return NextResponse.redirect(buildSignInRedirect(redirectContext));
+  }
+}

package/src/sso-config/sso-config.ts

@@ -0,0 +1,57 @@
+import { APIS, URLS } from "nexus-shared";
+
+const _callbackPath = `${URLS.CURRENT}/api/auth/callback`;
+
+export const SSO_CONFIG = {
+  COOKIE_CONFIG: {
+    COOKIE_SECRET: process.env.SSO_COOKIE_SECRET as string,
+  },
+  BACKEND_ENDPOINTS: {
+    SIGN_IN: `${APIS.AUTHENTICATION}/Authentication/SignIn`,
+    SIGN_UP: `${APIS.AUTHENTICATION}/Authentication/SignUp`,
+    SSO: `${APIS.AUTHENTICATION}/Authentication/SSO`,
+    TOKEN: `${APIS.AUTHENTICATION}/Authentication/Token`,
+    REFRESH: `${APIS.AUTHENTICATION}/Authentication/Refresh`,
+    SIGN_OUT: `${APIS.AUTHENTICATION}/Authentication/SignOut`,
+    PROVIDERS: `${APIS.AUTHENTICATION}/Authentication/Providers`,
+    FORGOT_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ForgotPassword`,
+    RESET_PASSWORD: `${APIS.AUTHENTICATION}/Authentication/ResetPassword`,
+    /** Used by VerifyAccessToken — returns 200 for a valid Bearer token, 401 otherwise. */
+    VERIFY: `${APIS.AUTHENTICATION}/Authentication/Verify`,
+    PROVIDER_CHALLENGE: (provider: string, returnUrl: string, clientSystemName: string) => `${APIS.AUTHENTICATION}/Provider/${provider}/Challenge?returnUrl=${encodeURIComponent(returnUrl)}&clientSystemName=${encodeURIComponent(clientSystemName)}`,
+  },
+  BACKEND_CONFIG: {
+    /** Matches AuthenticationOptions.DefaultClientSystemName (NEXUS_WEB_APPLICATION_API). */
+    CLIENT_SYSTEM_NAME: process.env.AUTH_CLIENT_SYSTEM_NAME as string,
+    /** Matches ClientApplications.SsoSessionLifetime (30 minutes). */
+    SSO_SESSION_MAX_AGE: process.env.SSO_SESSION_MAX_AGE as string,
+    /** How long redirect_uri/state survive in a secure httpOnly cookie on the auth app (seconds). */
+    REDIRECT_CONTEXT_MAX_AGE: process.env.REDIRECT_CONTEXT_MAX_AGE as string,
+  },
+  FRONTEND_ENDPOINTS: {
+    CALLBACK: _callbackPath,
+    SIGN_IN: `${URLS.CURRENT}/api/auth/sign-in`,
+    SIGN_UP: `${URLS.CURRENT}/api/auth/sign-up`,
+    SIGN_OUT: `${URLS.CURRENT}/api/auth/sign-out`,
+    REFRESH: `${URLS.CURRENT}/api/auth/refresh`,
+    SSO_COMPLETE: `${URLS.CURRENT}/api/auth/sso-complete`,
+    PROVIDER_COMPLETE: `${URLS.CURRENT}/api/auth/provider-complete`,
+    FORGOT_PASSWORD: `${URLS.CURRENT}/api/auth/forgot-password`,
+    RESET_PASSWORD: `${URLS.CURRENT}/api/auth/reset-password`,
+  },
+} as const;
+
+/** Client-app entry URL for centralized sign-in (includes redirect_uri + optional return path). */
+export function BuildAuthenticationSignInUrl(returnPath?: string) {
+  const entryUrl = new URL(`${URLS.AUTHENTICATION}/api/auth/redirect-context`);
+  entryUrl.searchParams.set("redirect_uri", SSO_CONFIG.FRONTEND_ENDPOINTS.CALLBACK);
+  if (returnPath) entryUrl.searchParams.set("state", returnPath);
+  return entryUrl.toString();
+}
+
+/** Sign-out URL that returns the user to a page on this app after cookies are cleared. */
+export function BuildSignOutUrl(returnPath?: string) {
+  const signOutUrl = new URL(SSO_CONFIG.FRONTEND_ENDPOINTS.SIGN_OUT);
+  if (returnPath) signOutUrl.searchParams.set("returnUrl", returnPath);
+  return signOutUrl.toString();
+}

package/src/sso-config/sso-interfaces.tsx

@@ -0,0 +1,68 @@
+import { UN } from "../interfaces/type-interfaces";
+export interface SSOAuthResponse {
+  accessToken: string;
+  refreshToken: string;
+  expiresTokenIn: number;
+  expiresRefreshTokenIn: number;
+  returnPath?: string;
+}
+
+export interface CookieInfo {
+  ssoSession: string;
+  accessToken: string | UN;
+  refreshToken: string | UN;
+}
+
+export interface IRedirectContext {
+  redirectUri: string;
+  /** OAuth CSRF nonce sent to the client callback. */
+  state: string;
+  /** Relative path to return to after sign-in completes. */
+  returnPath: string;
+  /** PKCE code challenge (stored server-side until SSO). */
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  /** PKCE verifier (server-side only; also embedded in signed callback state). */
+  pkceVerifier: string;
+}
+
+export interface ISignInParams {
+  redirect_uri: string | UN;
+  state: string | UN;
+}
+
+export interface ISsoSessionResponse {
+  code: string;
+}
+
+export interface ILoginRequest {
+  username: string;
+  password: string;
+  rememberMe: boolean;
+  clientSystemName: string;
+}
+
+export interface ILoginResponse {
+  ssoSession: string;
+  displayName: string;
+  role: string;
+  userId: number;
+  redirectUrl?: string;
+}
+
+export interface ISignUpRequest {
+  fullName: string;
+  gender?: string | UN;
+  username: string;
+  email: string;
+  password: string;
+}
+
+export interface IDemoUserInfo {
+  id: number;
+  username: string;
+  email: string;
+  displayName: string;
+  role: string;
+  passwordHint: string;
+}

package/src/sso-config/sso-response-helpers.tsx

@@ -0,0 +1,20 @@
+import { IErrorRespose, ISuccessResponse } from "../interfaces/http-interfaces";
+import { ISsoSessionResponse, SSOAuthResponse } from "./sso-interfaces";
+
+type ApiResponse = ISuccessResponse | IErrorRespose;
+
+export function ParseWrappedResult<T>(response: ApiResponse): T | null {
+  if (!response.isSuccess) return null;
+  return (response.result ?? null) as T | null;
+}
+
+export function ParseSsoCodeResponse(response: ApiResponse): string | null {
+  const result = ParseWrappedResult<ISsoSessionResponse | { code?: string }>(response);
+  if (!result) return null;
+  if ("code" in result && result.code) return result.code;
+  return null;
+}
+
+export function ParseTokenResponse(response: ApiResponse): SSOAuthResponse | null {
+  return ParseWrappedResult<SSOAuthResponse>(response);
+}

package/src/sso-server.tsx

@@ -1 +1,21 @@
-export {};
+export * from "./sso-config/oauth-callback-state";
+export * from "./sso-config/pkce-helpers";
+export * from "./sso-config/sso-backend-flow";
+export * from "./sso-config/auth-token-validation";
+export * from "./sso-config/callback-route";
+export * from "./sso-config/cookie-helpers";
+export * from "./sso-config/redirect-context-actions";
+export * from "./sso-config/redirect-context-helpers";
+export * from "./sso-config/redirect-context-route";
+export * from "./sso-config/redirect-context-persist";
+export * from "./sso-config/refresh-route";
+export * from "./sso-config/sign-in-route";
+export * from "./sso-config/sign-out-route";
+export * from "./sso-config/sign-up-route";
+export * from "./sso-config/sso-response-helpers";
+export * from "./sso-config/forgot-password-route";
+export * from "./sso-config/provider-complete-route";
+export * from "./sso-config/sso-complete-route";
+export * from "./sso-config/sso-config";
+export * from "./sso-config/sso-interfaces";
+export * from "./sso-config/sso-response-helpers";

package/src/styles/nexus.dialog.css

@@ -8,6 +8,9 @@
   z-index: 100 !important;
   cursor: default;
 }
+.nexus-message {
+  z-index: 100000 !important;
+}
 
 .dialog.left::before,
 .dialog.right::before,