oidc-spa 7.2.1 → 7.2.3

package/src/core/iframeMessageProtection.ts

@@ -0,0 +1,100 @@
+import { assert } from "../vendor/frontend/tsafe";
+import { asymmetricEncrypt, asymmetricDecrypt, generateKeys } from "../tools/asymmetricEncryption";
+import { type AuthResponse } from "./AuthResponse";
+
+const sessionStorage_original = window.sessionStorage;
+const setItem_real = Storage.prototype.setItem;
+
+const SESSION_STORAGE_PREFIX = "oidc-spa_iframe_authResponse_publicKey_";
+
+export function preventSessionStorageSetItemOfPublicKeyByThirdParty() {
+    const setItem_protected = function setItem(this: any, key: string, value: string): void {
+        if (this !== sessionStorage_original) {
+            return setItem_real.call(this, key, value);
+        }
+
+        if (key.startsWith(SESSION_STORAGE_PREFIX)) {
+            throw new Error(
+                "Attack prevented by oidc-spa. You have malicious code running in your system"
+            );
+        }
+
+        return setItem_real.call(sessionStorage_original, key, value);
+    };
+
+    {
+        const pd = Object.getOwnPropertyDescriptor(Storage.prototype, "setItem");
+
+        assert(pd !== undefined);
+
+        Object.defineProperty(Storage.prototype, "setItem", {
+            enumerable: pd.enumerable,
+            writable: pd.writable,
+            value: setItem_protected
+        });
+    }
+}
+
+const ENCRYPTED_AUTH_RESPONSES_PREFIX = "oidc-spa_encrypted_authResponse_";
+
+function getSessionStorageKey(params: { stateUrlParamValue: string }) {
+    const { stateUrlParamValue } = params;
+
+    return `${SESSION_STORAGE_PREFIX}${stateUrlParamValue}`;
+}
+
+export async function initIframeMessageProtection(params: { stateUrlParamValue: string }) {
+    const { stateUrlParamValue } = params;
+
+    const { publicKey, privateKey } = await generateKeys();
+
+    const sessionStorageKey = getSessionStorageKey({ stateUrlParamValue });
+
+    setItem_real.call(sessionStorage, sessionStorageKey, publicKey);
+
+    function getIsEncryptedAuthResponse(params: { message: unknown }): boolean {
+        const { message } = params;
+
+        return typeof message === "string" && message.startsWith(ENCRYPTED_AUTH_RESPONSES_PREFIX);
+    }
+
+    async function decodeEncryptedAuth(params: {
+        encryptedAuthResponse: string;
+    }): Promise<{ authResponse: AuthResponse }> {
+        const { encryptedAuthResponse } = params;
+
+        const { message: authResponse_str } = await asymmetricDecrypt({
+            encryptedMessage: encryptedAuthResponse.slice(ENCRYPTED_AUTH_RESPONSES_PREFIX.length),
+            privateKey
+        });
+
+        const authResponse: AuthResponse = JSON.parse(authResponse_str);
+
+        return { authResponse };
+    }
+
+    function clearSessionStoragePublicKey() {
+        sessionStorage.removeItem(sessionStorageKey);
+    }
+
+    return { getIsEncryptedAuthResponse, decodeEncryptedAuth, clearSessionStoragePublicKey };
+}
+
+export async function encryptAuthResponse(params: { authResponse: AuthResponse }) {
+    const { authResponse } = params;
+
+    const publicKey = sessionStorage.getItem(
+        getSessionStorageKey({ stateUrlParamValue: authResponse.state })
+    );
+
+    assert(publicKey !== null, "2293302");
+
+    const { encryptedMessage: encryptedMessage_withoutPrefix } = await asymmetricEncrypt({
+        publicKey,
+        message: JSON.stringify(authResponse)
+    });
+
+    const encryptedMessage = `${ENCRYPTED_AUTH_RESPONSES_PREFIX}${encryptedMessage_withoutPrefix}`;
+
+    return { encryptedMessage };
+}

package/src/core/index.ts

@@ -0,0 +1,4 @@
+export type { Oidc } from "./Oidc";
+export { createOidc, type ParamsOfCreateOidc } from "./createOidc";
+export { OidcInitializationError } from "./OidcInitializationError";
+export { handleOidcCallback } from "./handleOidcCallback";

package/src/core/initialLocationHref.ts

@@ -0,0 +1,5 @@
+const globalContext = {
+    initialLocationHref: window.location.href
+};
+
+export const { initialLocationHref } = globalContext;

package/src/core/isNewBrowserSession.ts

@@ -0,0 +1,37 @@
+import type { NonPostableEvt } from "../tools/Evt";
+
+export function createGetIsNewBrowserSession(params: {
+    configId: string;
+    evtUserNotLoggedIn: NonPostableEvt<void>;
+}) {
+    const { configId, evtUserNotLoggedIn } = params;
+
+    const SESSION_STORAGE_KEY = `oidc-spa.subject-id:${configId}`;
+
+    {
+        const { unsubscribe } = evtUserNotLoggedIn.subscribe(() => {
+            unsubscribe();
+            sessionStorage.removeItem(SESSION_STORAGE_KEY);
+        });
+    }
+
+    function getIsNewBrowserSession(params: { subjectId: string }): boolean {
+        const { subjectId } = params;
+
+        const subjectId_sessionStorage = sessionStorage.getItem(SESSION_STORAGE_KEY);
+
+        if (subjectId_sessionStorage === null) {
+            sessionStorage.setItem(SESSION_STORAGE_KEY, subjectId);
+            return true;
+        }
+
+        if (subjectId !== subjectId_sessionStorage) {
+            sessionStorage.setItem(SESSION_STORAGE_KEY, subjectId);
+            return true;
+        }
+
+        return false;
+    }
+
+    return { getIsNewBrowserSession };
+}

package/src/core/loginOrGoToAuthServer.ts

@@ -0,0 +1,324 @@
+import type { UserManager as OidcClientTsUserManager } from "../vendor/frontend/oidc-client-ts";
+import { toFullyQualifiedUrl } from "../tools/toFullyQualifiedUrl";
+import { assert, type Equals, noUndefined } from "../vendor/frontend/tsafe";
+import type { StateData } from "./StateData";
+import type { NonPostableEvt } from "../tools/Evt";
+import { createStatefulEvt } from "../tools/StatefulEvt";
+import { Deferred } from "../tools/Deferred";
+import { addOrUpdateSearchParam, getAllSearchParams } from "../tools/urlSearchParams";
+
+const globalContext = {
+    evtHasLoginBeenCalled: createStatefulEvt(() => false)
+};
+
+type Params = Params.Login | Params.GoToAuthServer;
+
+namespace Params {
+    type Common = {
+        redirectUrl: string;
+        extraQueryParams_local: Record<string, string | undefined> | undefined;
+        transformUrlBeforeRedirect_local: ((url: string) => string) | undefined;
+    };
+
+    export type Login = Common & {
+        action: "login";
+        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: boolean;
+        doForceReloadOnBfCache: boolean;
+        interaction:
+            | "ensure no interaction"
+            | "ensure interaction"
+            | "directly redirect if active session show login otherwise";
+    };
+
+    export type GoToAuthServer = Common & {
+        action: "go to auth server";
+    };
+}
+
+export function getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation() {
+    const dOut = new Deferred<void>();
+
+    const { unsubscribe } = globalContext.evtHasLoginBeenCalled.subscribe(hasLoginBeenCalled => {
+        if (!hasLoginBeenCalled) {
+            unsubscribe();
+            dOut.resolve();
+        }
+    });
+
+    return dOut.pr;
+}
+
+export function createLoginOrGoToAuthServer(params: {
+    configId: string;
+    oidcClientTsUserManager: OidcClientTsUserManager;
+    transformUrlBeforeRedirect:
+        | ((params: { authorizationUrl: string; isSilent: boolean }) => string)
+        | undefined;
+
+    getExtraQueryParams:
+        | ((params: { isSilent: boolean; url: string }) => Record<string, string | undefined>)
+        | undefined;
+
+    getExtraTokenParams: (() => Record<string, string | undefined>) | undefined;
+
+    homeUrl: string;
+    evtIsUserLoggedIn: NonPostableEvt<boolean>;
+    log: typeof console.log | undefined;
+}) {
+    const {
+        configId,
+        oidcClientTsUserManager,
+
+        transformUrlBeforeRedirect,
+        getExtraQueryParams,
+
+        getExtraTokenParams,
+
+        homeUrl,
+        evtIsUserLoggedIn,
+        log
+    } = params;
+
+    const LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN = `oidc-spa.login-redirect-initiated:${configId}`;
+
+    let lastPublicUrl: string | undefined = undefined;
+
+    async function loginOrGoToAuthServer(params: Params): Promise<never> {
+        const {
+            redirectUrl: redirectUrl_params,
+            extraQueryParams_local,
+            transformUrlBeforeRedirect_local,
+            ...rest
+        } = params;
+
+        log?.(`Calling loginOrGoToAuthServer ${JSON.stringify(params, null, 2)}`);
+
+        login_specific_handling: {
+            if (rest.action !== "login") {
+                break login_specific_handling;
+            }
+
+            if (globalContext.evtHasLoginBeenCalled.current) {
+                log?.("login() has already been called, ignoring the call");
+                return new Promise<never>(() => {});
+            }
+
+            globalContext.evtHasLoginBeenCalled.current = true;
+
+            if (document.visibilityState !== "visible") {
+                rest.interaction === "ensure no interaction";
+
+                const dVisible = new Deferred<void>();
+
+                const onVisible = () => {
+                    if (document.visibilityState !== "visible") {
+                        return;
+                    }
+                    document.removeEventListener("visibilitychange", onVisible);
+                    dVisible.resolve();
+                };
+                document.addEventListener("visibilitychange", onVisible);
+
+                await dVisible.pr;
+            }
+
+            bf_cache_handling: {
+                if (rest.doForceReloadOnBfCache) {
+                    window.removeEventListener("pageshow", () => {
+                        location.reload();
+                    });
+                    break bf_cache_handling;
+                }
+
+                localStorage.setItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN, "true");
+
+                const callback = () => {
+                    window.removeEventListener("pageshow", callback);
+
+                    log?.(
+                        "We came back from the login pages and the state of the app has been restored"
+                    );
+
+                    if (rest.doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack) {
+                        if (lastPublicUrl !== undefined) {
+                            log?.(`Loading last public route: ${lastPublicUrl}`);
+                            window.location.href = lastPublicUrl;
+                        } else {
+                            log?.("We don't know the last public route, navigating back in history");
+                            window.history.back();
+                        }
+                    } else {
+                        log?.("The current page doesn't require auth...");
+
+                        if (
+                            localStorage.getItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN) === null
+                        ) {
+                            log?.("but the user is now authenticated, reloading the page");
+                            location.reload();
+                        } else {
+                            log?.("and the user doesn't seem to be authenticated, avoiding a reload");
+                            globalContext.evtHasLoginBeenCalled.current = false;
+                        }
+                    }
+                };
+
+                window.addEventListener("pageshow", callback);
+            }
+        }
+
+        const redirectUrl = toFullyQualifiedUrl({
+            urlish: redirectUrl_params,
+            doAssertNoQueryParams: false
+        });
+
+        log?.(`redirectUrl: ${redirectUrl}`);
+
+        const stateData: StateData = {
+            context: "redirect",
+            redirectUrl,
+            extraQueryParams: {},
+            hasBeenProcessedByCallback: false,
+            configId,
+            action: "login",
+            redirectUrl_consentRequiredCase: (() => {
+                switch (rest.action) {
+                    case "login":
+                        return lastPublicUrl ?? homeUrl;
+                    case "go to auth server":
+                        return redirectUrl;
+                }
+            })()
+        };
+
+        const isSilent = rest.action === "login" && rest.interaction === "ensure no interaction";
+
+        const transformUrl_oidcClientTs = (url: string) => {
+            (
+                [
+                    [
+                        getExtraQueryParams,
+                        transformUrlBeforeRedirect === undefined
+                            ? undefined
+                            : (url: string) =>
+                                  transformUrlBeforeRedirect({
+                                      isSilent,
+                                      authorizationUrl: url
+                                  })
+                    ],
+                    [extraQueryParams_local, transformUrlBeforeRedirect_local]
+                ] as const
+            ).forEach(([extraQueryParamsMaybeGetter, transformUrlBeforeRedirect], i, arr) => {
+                const url_before = i !== arr.length - 1 ? undefined : url;
+
+                add_extra_query_params: {
+                    if (extraQueryParamsMaybeGetter === undefined) {
+                        break add_extra_query_params;
+                    }
+
+                    const extraQueryParams =
+                        typeof extraQueryParamsMaybeGetter === "function"
+                            ? extraQueryParamsMaybeGetter({ isSilent, url })
+                            : extraQueryParamsMaybeGetter;
+
+                    for (const [name, value] of Object.entries(extraQueryParams)) {
+                        if (value === undefined) {
+                            continue;
+                        }
+                        url = addOrUpdateSearchParam({
+                            url,
+                            name,
+                            value,
+                            encodeMethod: "www-form"
+                        });
+                    }
+                }
+
+                apply_transform_url: {
+                    if (transformUrlBeforeRedirect === undefined) {
+                        break apply_transform_url;
+                    }
+                    url = transformUrlBeforeRedirect(url);
+                }
+
+                update_state: {
+                    if (url_before === undefined) {
+                        break update_state;
+                    }
+
+                    const paramValueByName_current = getAllSearchParams(url);
+                    const paramValueByName_before = getAllSearchParams(url_before);
+
+                    for (const [name, value_current] of Object.entries(paramValueByName_current)) {
+                        const value_before: string | undefined = paramValueByName_before[name];
+
+                        if (value_before === value_current) {
+                            continue;
+                        }
+
+                        stateData.extraQueryParams[name] = value_current;
+                    }
+                }
+            });
+
+            return url;
+        };
+
+        const redirectMethod = (() => {
+            switch (rest.action) {
+                case "login":
+                    return rest.doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack
+                        ? "replace"
+                        : "assign";
+                case "go to auth server":
+                    return "assign";
+            }
+        })();
+
+        log?.(`redirectMethod: ${redirectMethod}`);
+
+        return oidcClientTsUserManager
+            .signinRedirect({
+                state: stateData,
+                redirectMethod,
+                prompt: (() => {
+                    switch (rest.action) {
+                        case "go to auth server":
+                            return undefined;
+                        case "login":
+                            switch (rest.interaction) {
+                                case "ensure no interaction":
+                                    return "none";
+                                case "ensure interaction":
+                                    return "login";
+                                case "directly redirect if active session show login otherwise":
+                                    return undefined;
+                            }
+                            assert<Equals<typeof rest.interaction, never>>;
+                    }
+                    assert<Equals<typeof rest, never>>;
+                })(),
+                transformUrl: transformUrl_oidcClientTs,
+                extraTokenParams:
+                    getExtraTokenParams === undefined ? undefined : noUndefined(getExtraTokenParams())
+            })
+            .then(() => new Promise<never>(() => {}));
+    }
+
+    const { unsubscribe } = evtIsUserLoggedIn.subscribe(isLoggedIn => {
+        unsubscribe();
+
+        if (isLoggedIn) {
+            localStorage.removeItem(LOCAL_STORAGE_KEY_TO_CLEAR_WHEN_USER_LOGGED_IN);
+        } else {
+            const realPushState = history.pushState.bind(history);
+            history.pushState = function pushState(...args) {
+                lastPublicUrl = window.location.href;
+                return realPushState(...args);
+            };
+        }
+    });
+
+    return {
+        loginOrGoToAuthServer
+    };
+}

package/src/core/loginPropagationToOtherTabs.ts

@@ -0,0 +1,51 @@
+import { assert, is } from "../vendor/frontend/tsafe";
+import { Deferred } from "../tools/Deferred";
+
+const globalContext = {
+    appInstanceId: Math.random().toString(36).slice(2)
+};
+
+type Message = {
+    appInstanceId: string;
+    configId: string;
+};
+
+function getChannelName(params: { configId: string }) {
+    const { configId } = params;
+    return `oidc-spa:login-propagation:${configId}`;
+}
+
+export function notifyOtherTabsOfLogin(params: { configId: string }) {
+    const { configId } = params;
+
+    const message: Message = {
+        configId,
+        appInstanceId: globalContext.appInstanceId
+    };
+
+    new BroadcastChannel(getChannelName({ configId })).postMessage(message);
+}
+
+export function getPrOtherTabLogin(params: { configId: string }) {
+    const { configId } = params;
+
+    const dOtherTabLogin = new Deferred<void>();
+
+    const channel = new BroadcastChannel(getChannelName({ configId }));
+
+    channel.onmessage = ({ data: message }) => {
+        assert(is<Message>(message));
+
+        if (message.appInstanceId === globalContext.appInstanceId) {
+            return;
+        }
+
+        channel.close();
+
+        dOtherTabLogin.resolve();
+    };
+
+    const prOtherTabLogin = dOtherTabLogin.pr;
+
+    return { prOtherTabLogin };
+}