oidc-spa 6.4.0 → 6.5.0

package/src/oidc/loginOrGoToAuthServer.ts

@@ -0,0 +1,267 @@
+import type { UserManager as OidcClientTsUserManager } from "../vendor/frontend/oidc-client-ts-and-jwt-decode";
+import { toFullyQualifiedUrl } from "../tools/toFullyQualifiedUrl";
+import { id, assert, type Equals } from "../vendor/frontend/tsafe";
+import type { StateData } from "./StateData";
+
+const GLOBAL_CONTEXT_KEY = "__oidc-spa.loginOrGoToAuthSever.globalContext";
+
+declare global {
+    interface Window {
+        [GLOBAL_CONTEXT_KEY]: {
+            hasLoginBeenCalled: boolean;
+            URL_real: typeof URL;
+        };
+    }
+}
+
+window[GLOBAL_CONTEXT_KEY] ??= {
+    hasLoginBeenCalled: false,
+    URL_real: window.URL
+};
+
+const globalContext = window[GLOBAL_CONTEXT_KEY];
+
+type Params = Params.Login | Params.GoToAuthServer;
+
+namespace Params {
+    type Common = {
+        redirectUrl: string;
+        extraQueryParams_local: Record<string, string> | undefined;
+        transformUrlBeforeRedirect_local: ((url: string) => string) | undefined;
+    };
+
+    export type Login = Common & {
+        action: "login";
+        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: boolean;
+        doForceReloadOnBfCache: boolean;
+        doForceInteraction: boolean;
+    };
+
+    export type GoToAuthServer = Common & {
+        action: "go to auth server";
+    };
+}
+
+export function createLoginOrGoToAuthServer(params: {
+    configId: string;
+    oidcClientTsUserManager: OidcClientTsUserManager;
+    getExtraQueryParams: (() => Record<string, string>) | undefined;
+    transformUrlBeforeRedirect: ((url: string) => string) | undefined;
+    homeAndCallbackUrl: string;
+    log: typeof console.log | undefined;
+}) {
+    const {
+        configId,
+        oidcClientTsUserManager,
+        getExtraQueryParams,
+        transformUrlBeforeRedirect,
+        homeAndCallbackUrl,
+        log
+    } = params;
+
+    const LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_RETURNING_OIDC_LOGGED_IN = `oidc-spa.login-redirect-initiated:${configId}`;
+
+    let lastPublicUrl: string | undefined = undefined;
+
+    async function loginOrGoToAuthServer(params: Params): Promise<never> {
+        const {
+            redirectUrl: redirectUrl_params,
+            extraQueryParams_local,
+            transformUrlBeforeRedirect_local,
+            ...rest
+        } = params;
+
+        log?.("Calling loginOrGoToAuthServer", { params });
+
+        login_specific_handling: {
+            if (rest.action !== "login") {
+                break login_specific_handling;
+            }
+
+            if (globalContext.hasLoginBeenCalled) {
+                log?.("login() has already been called, ignoring the call");
+                return new Promise<never>(() => {});
+            }
+
+            globalContext.hasLoginBeenCalled = true;
+
+            bf_cache_handling: {
+                if (rest.doForceReloadOnBfCache) {
+                    document.removeEventListener("visibilitychange", () => {
+                        if (document.visibilityState === "visible") {
+                            location.reload();
+                        }
+                    });
+                    break bf_cache_handling;
+                }
+
+                localStorage.setItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_RETURNING_OIDC_LOGGED_IN, "true");
+
+                const callback = () => {
+                    if (document.visibilityState === "visible") {
+                        document.removeEventListener("visibilitychange", callback);
+
+                        log?.(
+                            "We came back from the login pages and the state of the app has been restored"
+                        );
+
+                        if (rest.doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack) {
+                            if (lastPublicUrl !== undefined) {
+                                log?.(`Loading last public route: ${lastPublicUrl}`);
+                                window.location.href = lastPublicUrl;
+                            } else {
+                                log?.("We don't know the last public route, navigating back in history");
+                                window.history.back();
+                            }
+                        } else {
+                            log?.("The current page doesn't require auth...");
+
+                            if (
+                                localStorage.getItem(
+                                    LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_RETURNING_OIDC_LOGGED_IN
+                                ) === null
+                            ) {
+                                log?.("but the user is now authenticated, reloading the page");
+                                location.reload();
+                            } else {
+                                log?.(
+                                    "and the user doesn't seem to be authenticated, avoiding a reload"
+                                );
+                                globalContext.hasLoginBeenCalled = false;
+                            }
+                        }
+                    }
+                };
+
+                log?.("Start listening to visibility change event");
+
+                document.addEventListener("visibilitychange", callback);
+            }
+        }
+
+        const redirectUrl = toFullyQualifiedUrl({
+            urlish: redirectUrl_params,
+            doAssertNoQueryParams: false
+        });
+
+        log?.(`redirectUrl: ${redirectUrl}`);
+
+        const transformUrl_oidcClientTs = (url: string) => {
+            (
+                [
+                    [getExtraQueryParams?.(), transformUrlBeforeRedirect],
+                    [extraQueryParams_local, transformUrlBeforeRedirect_local]
+                ] as const
+            ).forEach(([extraQueryParams, transformUrlBeforeRedirect]) => {
+                add_extra_query_params: {
+                    if (extraQueryParams === undefined) {
+                        break add_extra_query_params;
+                    }
+
+                    const url_obj = new URL(url);
+
+                    for (const [name, value] of Object.entries(extraQueryParams)) {
+                        url_obj.searchParams.set(name, value);
+                    }
+
+                    url = url_obj.href;
+                }
+
+                apply_transform_before_redirect: {
+                    if (transformUrlBeforeRedirect === undefined) {
+                        break apply_transform_before_redirect;
+                    }
+                    url = transformUrlBeforeRedirect(url);
+                }
+            });
+
+            return url;
+        };
+
+        const redirectMethod = (() => {
+            switch (rest.action) {
+                case "login":
+                    return rest.doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack
+                        ? "replace"
+                        : "assign";
+                case "go to auth server":
+                    return "assign";
+            }
+        })();
+
+        log?.(`redirectMethod: ${redirectMethod}`);
+
+        const { extraQueryParams } = (() => {
+            const extraQueryParams: Record<string, string> = extraQueryParams_local ?? {};
+
+            read_query_params_added_by_transform_before_redirect: {
+                if (transformUrlBeforeRedirect_local === undefined) {
+                    break read_query_params_added_by_transform_before_redirect;
+                }
+
+                let url_afterTransform;
+
+                try {
+                    url_afterTransform = transformUrlBeforeRedirect_local("https://dummy.com");
+                } catch {
+                    break read_query_params_added_by_transform_before_redirect;
+                }
+
+                for (const [name, value] of new URL(url_afterTransform).searchParams) {
+                    extraQueryParams[name] = value;
+                }
+            }
+
+            return { extraQueryParams };
+        })();
+
+        await oidcClientTsUserManager.signinRedirect({
+            state: id<StateData>({
+                context: "redirect",
+                redirectUrl,
+                extraQueryParams,
+                hasBeenProcessedByCallback: false,
+                configId,
+                action: "login",
+                redirectUrl_consentRequiredCase: (() => {
+                    switch (rest.action) {
+                        case "login":
+                            return lastPublicUrl ?? homeAndCallbackUrl;
+                        case "go to auth server":
+                            return redirectUrl;
+                    }
+                })()
+            }),
+            redirectMethod,
+            prompt: (() => {
+                switch (rest.action) {
+                    case "go to auth server":
+                        return undefined;
+                    case "login":
+                        return rest.doForceInteraction ? "consent" : undefined;
+                }
+                assert<Equals<typeof rest, never>>;
+            })(),
+            transformUrl: transformUrl_oidcClientTs
+        });
+        return new Promise<never>(() => {});
+    }
+
+    function toCallBeforeReturningOidcLoggedIn() {
+        localStorage.removeItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_RETURNING_OIDC_LOGGED_IN);
+    }
+
+    function toCallBeforeReturningOidcNotLoggedIn() {
+        const realPushState = history.pushState.bind(history);
+        history.pushState = function pushState(...args) {
+            lastPublicUrl = window.location.href;
+            return realPushState(...args);
+        };
+    }
+
+    return {
+        loginOrGoToAuthServer,
+        toCallBeforeReturningOidcLoggedIn,
+        toCallBeforeReturningOidcNotLoggedIn
+    };
+}

package/src/oidc/loginSilent.ts

@@ -27,7 +27,7 @@ export function authResponseToUrl(authResponse: AuthResponse): string {
 
 type ResultOfLoginSilent =
     | {
-          outcome: "success iframe";
+          outcome: "got auth response from iframe";
           authResponse: AuthResponse;
       }
     | {
@@ -35,7 +35,7 @@ type ResultOfLoginSilent =
           cause: "timeout" | "can't reach well-known oidc endpoint";
       }
     | {
-          outcome: "refresh token used";
+          outcome: "token refreshed using refresh token";
           oidcClientTsUser: OidcClientTsUser;
       };
 
@@ -99,7 +99,7 @@ export async function loginSilent(params: {
         window.removeEventListener("message", listener);
 
         dResult.resolve({
-            outcome: "success iframe",
+            outcome: "got auth response from iframe",
             authResponse
         });
     };
@@ -122,7 +122,7 @@ export async function loginSilent(params: {
                 clearTimeout(timeout);
 
                 dResult.resolve({
-                    outcome: "refresh token used",
+                    outcome: "token refreshed using refresh token",
                     oidcClientTsUser
                 });
             },

package/src/oidc/oidcClientTsUserToTokens.ts

@@ -117,3 +117,27 @@ export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, u
 
     return tokens;
 }
+
+export function getMsBeforeExpiration(tokens: Oidc.Tokens): number {
+    // NOTE: In general the access token is supposed to have a shorter
+    // lifespan than the refresh token but we don't want to make any
+    // assumption here.
+    const tokenExpirationTime = Math.min(
+        tokens.accessTokenExpirationTime,
+        tokens.refreshTokenExpirationTime
+    );
+
+    const msBeforeExpiration = Math.min(
+        tokenExpirationTime - Date.now(),
+        // NOTE: We want to make sure we do not overflow the setTimeout
+        // that must be a 32 bit unsigned integer.
+        // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
+        Math.pow(2, 31) - 1
+    );
+
+    if (msBeforeExpiration < 0) {
+        return 0;
+    }
+
+    return msBeforeExpiration;
+}

package/src/oidc/persistedAuthState.ts

@@ -0,0 +1,36 @@
+import { assert } from "../vendor/frontend/tsafe";
+
+function getKey(params: { configId: string }) {
+    const { configId } = params;
+
+    return `oidc-spa:auth-state:${configId}`;
+}
+
+type PersistedAuthState = "logged in" | "explicitly logged out";
+
+export function persistAuthState(params: { configId: string; state: PersistedAuthState | undefined }) {
+    const { configId, state } = params;
+
+    const key = getKey({ configId });
+
+    if (state === undefined) {
+        localStorage.removeItem(key);
+        return;
+    }
+
+    localStorage.setItem(key, state);
+}
+
+export function getPersistedAuthState(params: { configId: string }): PersistedAuthState | undefined {
+    const { configId } = params;
+
+    const value = localStorage.getItem(getKey({ configId }));
+
+    if (value === null) {
+        return undefined;
+    }
+
+    assert(value === "logged in" || value === "explicitly logged out");
+
+    return value;
+}

package/src/tools/ephemeralSessionStorage.ts

@@ -0,0 +1,191 @@
+import { assert, typeGuard, id } from "../vendor/frontend/tsafe";
+
+type SessionStorageItem_Parsed = {
+    __brand: typeof SessionStorageItem_Parsed.brand;
+    value: string;
+    expiresAtTime: number;
+};
+
+namespace SessionStorageItem_Parsed {
+    export const brand = "SessionStorageItem_Parsed";
+}
+
+function parseSessionStorageItem(
+    sessionStorageItemValue: string
+): SessionStorageItem_Parsed | undefined {
+    let json: unknown;
+
+    try {
+        json = JSON.parse(sessionStorageItemValue);
+    } catch {
+        return undefined;
+    }
+
+    if (
+        !typeGuard<SessionStorageItem_Parsed>(
+            json,
+            json instanceof Object &&
+                "__brand" in json &&
+                json.__brand === SessionStorageItem_Parsed.brand
+        )
+    ) {
+        return undefined;
+    }
+
+    return json;
+}
+
+type InMemoryItem = {
+    key: string;
+    value: string;
+    removeFromSessionStorage: (() => void) | undefined;
+};
+
+const SESSION_STORAGE_PREFIX = "ephemeral:";
+
+function createStoreInSessionStorageAndScheduleRemovalInMemoryItem(params: {
+    key: string;
+    value: string;
+    remainingTtlMs: number;
+}): InMemoryItem {
+    const { key, value, remainingTtlMs } = params;
+
+    const sessionStorageKey = `${SESSION_STORAGE_PREFIX}${key}`;
+
+    const removeFromSessionStorage = () => {
+        inMemoryItem.removeFromSessionStorage = undefined;
+        clearTimeout(timer);
+        sessionStorage.removeItem(sessionStorageKey);
+    };
+
+    const timer = setTimeout(() => removeFromSessionStorage(), remainingTtlMs);
+
+    const inMemoryItem: InMemoryItem = {
+        key,
+        value,
+        removeFromSessionStorage
+    };
+
+    sessionStorage.removeItem(sessionStorageKey);
+
+    sessionStorage.setItem(
+        sessionStorageKey,
+        JSON.stringify(
+            id<SessionStorageItem_Parsed>({
+                __brand: "SessionStorageItem_Parsed",
+                value,
+                expiresAtTime: Date.now() + remainingTtlMs
+            })
+        )
+    );
+
+    return inMemoryItem;
+}
+
+export function createEphemeralSessionStorage(params: { sessionStorageTtlMs: number }): Storage {
+    const { sessionStorageTtlMs } = params;
+
+    const inMemoryItems: InMemoryItem[] = [];
+
+    for (let i = 0; i < sessionStorage.length; i++) {
+        const sessionStorageKey = sessionStorage.key(i);
+        assert(sessionStorageKey !== null);
+
+        if (!sessionStorageKey.startsWith(SESSION_STORAGE_PREFIX)) {
+            continue;
+        }
+
+        const sessionStorageItem = sessionStorage.getItem(sessionStorageKey);
+
+        assert(sessionStorageItem !== null);
+
+        const sessionStorageItem_parsed = parseSessionStorageItem(sessionStorageItem);
+
+        if (sessionStorageItem_parsed === undefined) {
+            continue;
+        }
+
+        const remainingTtlMs = sessionStorageItem_parsed.expiresAtTime - Date.now();
+
+        if (remainingTtlMs <= 0) {
+            sessionStorage.removeItem(sessionStorageKey);
+            continue;
+        }
+
+        inMemoryItems.push(
+            createStoreInSessionStorageAndScheduleRemovalInMemoryItem({
+                key: sessionStorageKey.slice(SESSION_STORAGE_PREFIX.length),
+                value: sessionStorageItem_parsed.value,
+                remainingTtlMs
+            })
+        );
+    }
+
+    const storage = {
+        get length() {
+            return inMemoryItems.length;
+        },
+        key(index: number) {
+            const inMemoryItem = inMemoryItems[index];
+
+            if (inMemoryItem === undefined) {
+                return null;
+            }
+
+            return inMemoryItem.key;
+        },
+        removeItem(key: string) {
+            const inMemoryItem = inMemoryItems.find(item => item.key === key);
+
+            if (inMemoryItem === undefined) {
+                return;
+            }
+
+            inMemoryItem.removeFromSessionStorage?.();
+
+            const index = inMemoryItems.indexOf(inMemoryItem);
+
+            inMemoryItems.splice(index, 1);
+        },
+        clear() {
+            for (let i = 0; i < storage.length; i++) {
+                const key = storage.key(i);
+                assert(key !== null);
+                storage.removeItem(key);
+            }
+        },
+        getItem(key: string) {
+            const inMemoryItem = inMemoryItems.find(item => item.key === key);
+            if (inMemoryItem === undefined) {
+                return null;
+            }
+            return inMemoryItem.value;
+        },
+        setItem(key: string, value: string) {
+            let existingInMemoryItemIndex: number | undefined = undefined;
+
+            {
+                const inMemoryItem = inMemoryItems.find(item => item.key === key);
+
+                if (inMemoryItem !== undefined) {
+                    inMemoryItem.removeFromSessionStorage?.();
+                    existingInMemoryItemIndex = inMemoryItems.indexOf(inMemoryItem);
+                }
+            }
+
+            const inMemoryItem_new = createStoreInSessionStorageAndScheduleRemovalInMemoryItem({
+                key,
+                value,
+                remainingTtlMs: sessionStorageTtlMs
+            });
+
+            if (existingInMemoryItemIndex !== undefined) {
+                inMemoryItems[existingInMemoryItemIndex] = inMemoryItem_new;
+            } else {
+                inMemoryItems.push(inMemoryItem_new);
+            }
+        }
+    };
+
+    return storage;
+}

package/src/tools/haveSharedParentDomain.ts

@@ -0,0 +1,13 @@
+export function getHaveSharedParentDomain(params: { url1: string; url2: string }): boolean {
+    const { url1, url2 } = params;
+
+    const url1Domain = new URL(url1).hostname;
+    const url2Domain = new URL(url2).hostname;
+
+    const getLevel2Domain = (url: string): string => {
+        const parts = url.split(".");
+        return parts.slice(parts.length - 2).join(".");
+    };
+
+    return getLevel2Domain(url1Domain) === getLevel2Domain(url2Domain);
+}

package/tools/ephemeralSessionStorage.d.ts

@@ -0,0 +1,3 @@
+export declare function createEphemeralSessionStorage(params: {
+    sessionStorageTtlMs: number;
+}): Storage;