oidc-spa 7.2.0-rc.1 → 7.2.0-rc.2

package/src/core/loginSilent.ts

@@ -1,209 +0,0 @@
-import type {
-    UserManager as OidcClientTsUserManager,
-    User as OidcClientTsUser
-} from "../vendor/frontend/oidc-client-ts";
-import { Deferred } from "../tools/Deferred";
-import { id, assert, noUndefined } from "../vendor/frontend/tsafe";
-import { getStateData, clearStateStore, type StateData } from "./StateData";
-import { getDownlinkAndRtt } from "../tools/getDownlinkAndRtt";
-import { getIsDev } from "../tools/isDev";
-import { type AuthResponse } from "./AuthResponse";
-import { addOrUpdateSearchParam } from "../tools/urlSearchParams";
-import { initIframeMessageProtection } from "./iframeMessageProtection";
-
-type ResultOfLoginSilent =
-    | {
-          outcome: "got auth response from iframe";
-          authResponse: AuthResponse;
-      }
-    | {
-          outcome: "failure";
-          cause: "timeout" | "can't reach well-known oidc endpoint";
-      }
-    | {
-          outcome: "token refreshed using refresh token";
-          oidcClientTsUser: OidcClientTsUser;
-      };
-
-export async function loginSilent(params: {
-    oidcClientTsUserManager: OidcClientTsUserManager;
-    stateUrlParamValue_instance: string;
-    configId: string;
-
-    transformUrlBeforeRedirect:
-        | ((params: { authorizationUrl: string; isSilent: true }) => string)
-        | undefined;
-
-    getExtraQueryParams:
-        | ((params: { isSilent: true; url: string }) => Record<string, string | undefined>)
-        | undefined;
-
-    getExtraTokenParams: (() => Record<string, string | undefined>) | undefined;
-    autoLogin: boolean;
-}): Promise<ResultOfLoginSilent> {
-    const {
-        oidcClientTsUserManager,
-        stateUrlParamValue_instance,
-        configId,
-        transformUrlBeforeRedirect,
-        getExtraQueryParams,
-        getExtraTokenParams,
-        autoLogin
-    } = params;
-
-    const dResult = new Deferred<ResultOfLoginSilent>();
-
-    const timeoutDelayMs: number = (() => {
-        if (autoLogin) {
-            return 25_000;
-        }
-
-        const downlinkAndRtt = getDownlinkAndRtt();
-        const isDev = getIsDev();
-
-        // Base delay is the minimum delay we should wait in any case
-        const BASE_DELAY_MS = isDev ? 9_000 : 7_000;
-
-        if (downlinkAndRtt === undefined) {
-            return BASE_DELAY_MS;
-        }
-
-        const { downlink, rtt } = downlinkAndRtt;
-
-        // Calculate dynamic delay based on RTT and downlink
-        // Add 1 to downlink to avoid division by zero
-        const dynamicDelay = rtt * 2.5 + BASE_DELAY_MS / (downlink + 1);
-
-        return Math.max(BASE_DELAY_MS, dynamicDelay);
-    })();
-
-    const { decodeEncryptedAuth, getIsEncryptedAuthResponse, clearSessionStoragePublicKey } =
-        await initIframeMessageProtection({
-            stateUrlParamValue: stateUrlParamValue_instance
-        });
-
-    const timer = setTimeout(async () => {
-        dResult.resolve({
-            outcome: "failure",
-            cause: "timeout"
-        });
-    }, timeoutDelayMs);
-
-    const listener = async (event: MessageEvent) => {
-        if (event.origin !== window.location.origin) {
-            return;
-        }
-
-        if (
-            !getIsEncryptedAuthResponse({
-                message: event.data
-            })
-        ) {
-            return;
-        }
-
-        const { authResponse } = await decodeEncryptedAuth({ encryptedAuthResponse: event.data });
-
-        const stateData = getStateData({ stateUrlParamValue: authResponse.state });
-
-        assert(stateData !== undefined, "765645");
-        assert(stateData.context === "iframe", "250711");
-
-        if (stateData.configId !== configId) {
-            return;
-        }
-
-        clearTimeout(timer);
-
-        window.removeEventListener("message", listener);
-
-        dResult.resolve({
-            outcome: "got auth response from iframe",
-            authResponse
-        });
-    };
-
-    window.addEventListener("message", listener, false);
-
-    const transformUrl_oidcClientTs = (url: string) => {
-        add_extra_query_params: {
-            if (getExtraQueryParams === undefined) {
-                break add_extra_query_params;
-            }
-
-            const extraQueryParams = getExtraQueryParams({ isSilent: true, url });
-
-            for (const [name, value] of Object.entries(extraQueryParams)) {
-                if (value === undefined) {
-                    continue;
-                }
-                url = addOrUpdateSearchParam({ url, name, value, encodeMethod: "www-form" });
-            }
-        }
-
-        apply_transform_url: {
-            if (transformUrlBeforeRedirect === undefined) {
-                break apply_transform_url;
-            }
-            url = transformUrlBeforeRedirect({ authorizationUrl: url, isSilent: true });
-        }
-
-        return url;
-    };
-
-    oidcClientTsUserManager
-        .signinSilent({
-            state: id<StateData.IFrame>({
-                context: "iframe",
-                configId
-            }),
-            silentRequestTimeoutInSeconds: timeoutDelayMs / 1000,
-            extraTokenParams:
-                getExtraTokenParams === undefined ? undefined : noUndefined(getExtraTokenParams()),
-            transformUrl: transformUrl_oidcClientTs
-        })
-        .then(
-            oidcClientTsUser => {
-                assert(oidcClientTsUser !== null, "oidcClientTsUser is not supposed to be null here");
-
-                clearTimeout(timer);
-                window.removeEventListener("message", listener);
-
-                dResult.resolve({
-                    outcome: "token refreshed using refresh token",
-                    oidcClientTsUser
-                });
-            },
-            (error: Error) => {
-                if (error.message === "Failed to fetch") {
-                    // NOTE: If we got an error here it means that the fetch to the
-                    // well-known oidc endpoint failed.
-                    // This usually means that the server is down or that the issuerUri
-                    // is not pointing to a valid oidc server.
-                    // It could be a CORS error on the well-known endpoint but it's unlikely.
-
-                    clearTimeout(timer);
-
-                    dResult.resolve({
-                        outcome: "failure",
-                        cause: "can't reach well-known oidc endpoint"
-                    });
-
-                    return;
-                }
-
-                // NOTE: Here, except error on our understanding there can't be any other
-                // error than timeout so we fail silently and let the timeout expire.
-            }
-        );
-
-    dResult.pr.then(result => {
-        clearSessionStoragePublicKey();
-
-        if (result.outcome === "failure") {
-            clearStateStore({ stateUrlParamValue: stateUrlParamValue_instance });
-        }
-    });
-
-    return dResult.pr;
-}

package/src/core/oidcClientTsUserToTokens.ts

@@ -1,229 +0,0 @@
-import type { User as OidcClientTsUser } from "../vendor/frontend/oidc-client-ts";
-import { assert, id } from "../vendor/frontend/tsafe";
-import { readExpirationTimeInJwt } from "../tools/readExpirationTimeInJwt";
-import { decodeJwt } from "../tools/decodeJwt";
-import type { Oidc } from "./Oidc";
-
-export function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, unknown>>(params: {
-    oidcClientTsUser: OidcClientTsUser;
-    decodedIdTokenSchema?: {
-        parse: (decodedIdToken_original: Oidc.Tokens.DecodedIdToken_base) => DecodedIdToken;
-    };
-    __unsafe_useIdTokenAsAccessToken: boolean;
-    decodedIdToken_previous: DecodedIdToken | undefined;
-    log: typeof console.log | undefined;
-}): Oidc.Tokens<DecodedIdToken> {
-    const {
-        oidcClientTsUser,
-        decodedIdTokenSchema,
-        __unsafe_useIdTokenAsAccessToken,
-        decodedIdToken_previous,
-        log
-    } = params;
-
-    const isFirstInit = decodedIdToken_previous === undefined;
-
-    const accessToken = oidcClientTsUser.access_token;
-
-    const refreshToken = oidcClientTsUser.refresh_token;
-
-    const idToken = oidcClientTsUser.id_token;
-
-    assert(idToken !== undefined, "No id token provided by the oidc server");
-
-    const decodedIdToken_original = decodeJwt<Oidc.Tokens.DecodedIdToken_base>(idToken);
-
-    if (isFirstInit) {
-        log?.(
-            [
-                `Decoded ID token`,
-                decodedIdTokenSchema === undefined ? "" : " before `decodedIdTokenSchema.parse()`\n",
-                JSON.stringify(decodedIdToken_original, null, 2)
-            ].join("")
-        );
-    }
-
-    const decodedIdToken = (() => {
-        let decodedIdToken: DecodedIdToken;
-
-        if (decodedIdTokenSchema !== undefined) {
-            decodedIdToken = decodedIdTokenSchema.parse(decodedIdToken_original);
-
-            if (isFirstInit) {
-                log?.(
-                    [
-                        "Decoded ID token after `decodedIdTokenSchema.parse()`\n",
-                        JSON.stringify(decodedIdToken, null, 2)
-                    ].join("")
-                );
-            }
-        } else {
-            // @ts-expect-error
-            decodedIdToken = decodedIdToken_original;
-        }
-
-        if (
-            decodedIdToken_previous !== undefined &&
-            JSON.stringify(decodedIdToken) === JSON.stringify(decodedIdToken_previous)
-        ) {
-            // NOTE: For stable ref, prevent re-render for component that would memoize
-            return decodedIdToken_previous;
-        }
-
-        return decodedIdToken;
-    })();
-
-    const issuedAtTime = (() => {
-        // NOTE: The id_token is always a JWT as per the protocol.
-        // We don't use Date.now() due to network latency.
-        const id_token_iat = (() => {
-            let iat: number | undefined;
-
-            try {
-                const iat_claimValue = decodedIdToken_original.iat;
-                assert(iat_claimValue === undefined || typeof iat_claimValue === "number");
-                iat = iat_claimValue;
-            } catch {
-                iat = undefined;
-            }
-
-            if (iat === undefined) {
-                return undefined;
-            }
-
-            return iat;
-        })();
-
-        if (id_token_iat === undefined) {
-            return Date.now();
-        }
-
-        return id_token_iat * 1000;
-    })();
-
-    const tokens_common: Oidc.Tokens.Common<DecodedIdToken> = {
-        ...(__unsafe_useIdTokenAsAccessToken
-            ? {
-                  accessToken: idToken,
-                  accessTokenExpirationTime: (() => {
-                      const expirationTime = readExpirationTimeInJwt(idToken);
-
-                      assert(
-                          expirationTime !== undefined,
-                          "Failed to get id token expiration time while trying to substitute the access token by the id token"
-                      );
-
-                      return expirationTime;
-                  })()
-              }
-            : {
-                  accessToken,
-                  accessTokenExpirationTime: (() => {
-                      read_from_jwt: {
-                          const expirationTime = readExpirationTimeInJwt(accessToken);
-
-                          if (expirationTime === undefined) {
-                              break read_from_jwt;
-                          }
-
-                          return expirationTime;
-                      }
-
-                      read_from_token_response_expires_at: {
-                          const { expires_at } = oidcClientTsUser.__oidc_spa_tokenResponse;
-
-                          if (expires_at === undefined) {
-                              break read_from_token_response_expires_at;
-                          }
-
-                          assert(typeof expires_at === "number", "2033392");
-
-                          return expires_at * 1000;
-                      }
-
-                      read_from_token_response_expires_in: {
-                          const { expires_in } = oidcClientTsUser.__oidc_spa_tokenResponse;
-
-                          if (expires_in === undefined) {
-                              break read_from_token_response_expires_in;
-                          }
-
-                          assert(typeof expires_in === "number", "203333425");
-
-                          return issuedAtTime + expires_in * 1_000;
-                      }
-
-                      assert(false, "Failed to get access token expiration time");
-                  })()
-              }),
-        idToken,
-        decodedIdToken,
-        decodedIdToken_original,
-        issuedAtTime
-    };
-
-    const tokens: Oidc.Tokens<DecodedIdToken> =
-        refreshToken === undefined
-            ? id<Oidc.Tokens.WithoutRefreshToken<DecodedIdToken>>({
-                  ...tokens_common,
-                  hasRefreshToken: false
-              })
-            : id<Oidc.Tokens.WithRefreshToken<DecodedIdToken>>({
-                  ...tokens_common,
-                  hasRefreshToken: true,
-                  refreshToken,
-                  refreshTokenExpirationTime: (() => {
-                      read_from_token_response_expires_at: {
-                          const { refresh_expires_at } = oidcClientTsUser.__oidc_spa_tokenResponse;
-
-                          if (refresh_expires_at === undefined) {
-                              break read_from_token_response_expires_at;
-                          }
-
-                          assert(typeof refresh_expires_at === "number", "2033392");
-
-                          return refresh_expires_at * 1000;
-                      }
-
-                      read_from_token_response_expires_in: {
-                          const { refresh_expires_in } = oidcClientTsUser.__oidc_spa_tokenResponse;
-
-                          if (refresh_expires_in === undefined) {
-                              break read_from_token_response_expires_in;
-                          }
-
-                          assert(typeof refresh_expires_in === "number", "2033425330");
-
-                          return issuedAtTime + refresh_expires_in * 1000;
-                      }
-
-                      read_from_jwt: {
-                          const expirationTime = readExpirationTimeInJwt(refreshToken);
-
-                          if (expirationTime === undefined) {
-                              break read_from_jwt;
-                          }
-
-                          return expirationTime;
-                      }
-
-                      return undefined;
-                  })()
-              });
-
-    if (
-        isFirstInit &&
-        tokens.hasRefreshToken &&
-        tokens.refreshTokenExpirationTime !== undefined &&
-        tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime
-    ) {
-        console.warn(
-            [
-                "The OIDC refresh token expirationTime is shorter than the one of the access token.",
-                "This is very unusual and probably a misconfiguration."
-            ].join(" ")
-        );
-    }
-
-    return tokens;
-}

package/src/core/persistedAuthState.ts

@@ -1,122 +0,0 @@
-import { typeGuard, id } from "../vendor/frontend/tsafe";
-
-function getKey(params: { configId: string }) {
-    const { configId } = params;
-
-    return `oidc-spa:auth-state:${configId}`;
-}
-
-type PersistedAuthState = PersistedAuthState.LoggedIn | PersistedAuthState.ExplicitlyLoggedOut;
-namespace PersistedAuthState {
-    type Common = {
-        __brand: "PersistedAuthState-v1";
-    };
-
-    export type LoggedIn = Common & {
-        stateDescription: "logged in";
-        untilTime: number | undefined;
-    };
-
-    export type ExplicitlyLoggedOut = Common & {
-        stateDescription: "explicitly logged out";
-    };
-}
-
-export function persistAuthState(params: {
-    configId: string;
-    state:
-        | {
-              stateDescription: "logged in";
-              idleSessionLifetimeInSeconds: number | undefined;
-              refreshTokenExpirationTime: number | undefined;
-          }
-        | {
-              stateDescription: "explicitly logged out";
-          }
-        | undefined;
-}) {
-    const { configId, state } = params;
-
-    const key = getKey({ configId });
-
-    if (state === undefined) {
-        localStorage.removeItem(key);
-        return;
-    }
-
-    localStorage.setItem(
-        key,
-        JSON.stringify(
-            id<PersistedAuthState>(
-                (() => {
-                    switch (state.stateDescription) {
-                        case "logged in":
-                            return id<PersistedAuthState.LoggedIn>({
-                                __brand: "PersistedAuthState-v1",
-                                stateDescription: "logged in",
-                                untilTime: (() => {
-                                    const { idleSessionLifetimeInSeconds, refreshTokenExpirationTime } =
-                                        state;
-
-                                    if (idleSessionLifetimeInSeconds !== undefined) {
-                                        return Date.now() + idleSessionLifetimeInSeconds * 1000;
-                                    }
-
-                                    return refreshTokenExpirationTime;
-                                })()
-                            });
-                        case "explicitly logged out":
-                            return id<PersistedAuthState.ExplicitlyLoggedOut>({
-                                __brand: "PersistedAuthState-v1",
-                                stateDescription: "explicitly logged out"
-                            });
-                    }
-                })()
-            )
-        )
-    );
-}
-
-export function getPersistedAuthState(params: {
-    configId: string;
-}): PersistedAuthState["stateDescription"] | undefined {
-    const { configId } = params;
-
-    const key = getKey({ configId });
-
-    const value = localStorage.getItem(key);
-
-    if (value === null) {
-        return undefined;
-    }
-
-    let state: unknown;
-
-    try {
-        state = JSON.parse(value);
-    } catch {
-        localStorage.removeItem(key);
-        return undefined;
-    }
-
-    if (
-        !typeGuard<PersistedAuthState>(
-            state,
-            state instanceof Object &&
-                "__brand" in state &&
-                state.__brand === id<PersistedAuthState["__brand"]>("PersistedAuthState-v1")
-        )
-    ) {
-        localStorage.removeItem(key);
-        return undefined;
-    }
-
-    if (state.stateDescription === "logged in") {
-        if (state.untilTime !== undefined && state.untilTime <= Date.now()) {
-            localStorage.removeItem(key);
-            return undefined;
-        }
-    }
-
-    return state.stateDescription;
-}

package/src/keycloak/index.ts

@@ -1,8 +0,0 @@
-export { isKeycloak } from "./isKeycloak";
-export type { KeycloakIssuerUriParsed } from "./keycloakIssuerUriParsed";
-export {
-    type KeycloakUtils,
-    KeycloakProfile,
-    KeycloakUserInfo,
-    createKeycloakUtils
-} from "./keycloakUtils";

package/src/keycloak/keycloakUtils.ts

@@ -1,90 +0,0 @@
-import { toFullyQualifiedUrl } from "../tools/toFullyQualifiedUrl";
-
-import { type KeycloakIssuerUriParsed, parseKeycloakIssuerUri } from "./keycloakIssuerUriParsed";
-
-export type KeycloakUtils = {
-    issuerUriParsed: KeycloakIssuerUriParsed;
-    adminConsoleUrl: string;
-    adminConsoleUrl_master: string;
-    getAccountUrl: (params: {
-        clientId: string;
-        backToAppFromAccountUrl: string;
-        locale?: string;
-    }) => string;
-    fetchUserProfile: (params: { accessToken: string }) => Promise<KeycloakProfile>;
-    fetchUserInfo: (params: { accessToken: string }) => Promise<KeycloakUserInfo>;
-    transformUrlBeforeRedirectForRegister: (authorizationUrl: string) => string;
-};
-
-export type KeycloakProfile = {
-    id?: string;
-    username?: string;
-    email?: string;
-    firstName?: string;
-    lastName?: string;
-    enabled?: boolean;
-    emailVerified?: boolean;
-    totp?: boolean;
-    createdTimestamp?: number;
-    attributes?: Record<string, unknown>;
-};
-
-export type KeycloakUserInfo = {
-    sub: string;
-    [key: string]: any;
-};
-
-export function createKeycloakUtils(params: { issuerUri: string }): KeycloakUtils {
-    const { issuerUri } = params;
-
-    const issuerUriParsed = parseKeycloakIssuerUri({ issuerUri });
-
-    const keycloakServerUrl = `${issuerUriParsed.origin}${issuerUriParsed.kcHttpRelativePath ?? ""}`;
-
-    const getAdminConsoleUrl = (realm: string) =>
-        `${keycloakServerUrl}/admin/${encodeURIComponent(realm)}/console`;
-
-    const realmUrl = `${keycloakServerUrl}/realms/${encodeURIComponent(issuerUriParsed.realm)}`;
-
-    return {
-        issuerUriParsed,
-        adminConsoleUrl: getAdminConsoleUrl(issuerUriParsed.realm),
-        adminConsoleUrl_master: getAdminConsoleUrl("master"),
-        getAccountUrl: ({ clientId, backToAppFromAccountUrl, locale }) => {
-            const accountUrlObj = new URL(
-                `${keycloakServerUrl}/realms/${issuerUriParsed.realm}/account`
-            );
-            accountUrlObj.searchParams.set("referrer", clientId);
-            accountUrlObj.searchParams.set(
-                "referrer_uri",
-                toFullyQualifiedUrl({
-                    urlish: backToAppFromAccountUrl,
-                    doAssertNoQueryParams: false
-                })
-            );
-            if (locale !== undefined) {
-                accountUrlObj.searchParams.set("kc_locale", locale);
-            }
-            return accountUrlObj.href;
-        },
-        fetchUserProfile: ({ accessToken }) =>
-            fetch(`${realmUrl}/account`, {
-                headers: {
-                    Accept: "application/json",
-                    Authorization: `Bearer ${accessToken}`
-                }
-            }).then(r => r.json()),
-        fetchUserInfo: ({ accessToken }) =>
-            fetch(`${realmUrl}/protocol/openid-connect/userinfo`, {
-                headers: {
-                    Accept: "application/json",
-                    Authorization: `Bearer ${accessToken}`
-                }
-            }).then(r => r.json()),
-        transformUrlBeforeRedirectForRegister: authorizationUrl => {
-            const urlObj = new URL(authorizationUrl);
-            urlObj.pathname = urlObj.pathname.replace(/\/auth$/, "/registrations");
-            return urlObj.href;
-        }
-    };
-}

package/src/mock/react.tsx

@@ -1,11 +0,0 @@
-import { createOidcReactApi_dependencyInjection } from "../react/react";
-import { createMockOidc, type ParamsOfCreateMockOidc } from "./oidc";
-import type { ValueOrAsyncGetter } from "../tools/ValueOrAsyncGetter";
-
-/** @see: https://docs.oidc-spa.dev/v/v7/mock */
-export function createMockReactOidc<
-    DecodedIdToken extends Record<string, unknown> = Record<string, unknown>,
-    AutoLogin extends boolean = false
->(params: ValueOrAsyncGetter<ParamsOfCreateMockOidc<DecodedIdToken, AutoLogin>>) {
-    return createOidcReactApi_dependencyInjection(params, createMockOidc);
-}