profoundjs 6.6.1 → 7.0.0

package/setup/completeInstall.js

@@ -47,7 +47,8 @@ const IBMi = iutils.isIBMi();
         "h",
         "c",
         "s",
-        "v"
+        "v",
+        "installSamples"
       ],
       string: []
     };
@@ -62,6 +63,7 @@ const IBMi = iutils.isIBMi();
 -c, --configure   Update config.js, if present.
 -s, --silent      No interactive prompts.
 -v, --validate    Validate silent mode arguments only.
+--installSamples  Install sample code
 
 Creates config.js, if not present, and completes installation.
 --configure can be specified to update an existing config.js before proceeding.
@@ -73,6 +75,9 @@ If --silent is specified, configuration values are read from arguments instead.
 If arguments are not valid, the script will exit with code 2 and error messages
 will be output to stderr in JSON format.
 
+--installSamples installs sample modules, workspaces, plugins, and other sample
+   code.
+
 Valid arguments for --silent mode:
 
 ` + await buildArgHelp();
@@ -146,10 +151,12 @@ Valid arguments for --silent mode:
     const gitSupported = ["win32", "darwin", "linux"].includes(os.platform());
 
     const configPath = iutils.getConfigPath();
+    // Note: because an eval() may set the "config" variable subsequently, "config" cannot be a const.
+    // eslint-disable-next-line prefer-const
     let config = fileExists(configPath) ? require(configPath) : {};
     const strtcpsvr_config = {};
 
-    let svrname, autostart, ccsid, nodePath;
+    let svrname, autostart, ccsid, nodePath, installSamples;
 
     // If config.js doesn't exist, or if --configure is passed, prompt and create/update config.js.
     if (!fileExists(configPath) || args["configure"] === true) {
@@ -256,6 +263,7 @@ Valid arguments for --silent mode:
             delete config.profounduiLibrary;
           }
         }
+
         fs.writeFileSync(configPath, stringifyConfig(config));
         console.log("");
         console.log("config.js updated.");
@@ -263,7 +271,7 @@ Valid arguments for --silent mode:
       }
       else {
         let content = fs.readFileSync(path.join(iutils.getSetupDir(), "config.js"), "utf8");
-        eval("config = " + content.substr(content.indexOf("{")));
+        eval("config = " + content.substring(content.indexOf("{")));
         config.port = answers.port;
         if (answers.connectorLibrary) {
           config.connectorLibrary = answers.connectorLibrary;
@@ -304,6 +312,8 @@ Valid arguments for --silent mode:
         console.log("config.js created.");
         console.log("");
       }
+
+      installSamples = answers.installSamples == true;
     }
 
     // Complete installation.
@@ -316,7 +326,7 @@ Valid arguments for --silent mode:
       if (config.connectorLibrary !== undefined) {
         setupArgs.push("--ibmi-connector-library");
       }
-      if (svrname) {		
+      if (svrname) {
         setupArgs.push("--ibmi-instance=" + svrname);
         if (autostart) {
           setupArgs.push("--ibmi-instance-autostart");
@@ -335,6 +345,11 @@ Valid arguments for --silent mode:
     if (gitSupported && config.gitSupport !== false && nodeMajorVersion < 18) {
       setupArgs.push("--nodegit");
     }
+
+    if (installSamples || args.installSamples) {
+      setupArgs.push("--installSamples");
+    }
+
     if (setupArgs.length === 0) {
       setupArgs = "";
     }
@@ -372,7 +387,7 @@ async function ask(questionParm, configs, recursive) {
   if (typeof defaultAnswer !== "string") defaultAnswer = String(defaultAnswer);
 
   if (defaultAnswer !== "") {
-    let lastChar = question.substr(question.length - 1, 1);
+    const lastChar = question.substr(question.length - 1, 1);
     if (lastChar === ":" || lastChar === "?") {
       question = question.substr(0, question.length - 1) + " (" + defaultAnswer + ")" + lastChar;
     }
@@ -408,9 +423,9 @@ async function ask(questionParm, configs, recursive) {
 }
 
 function fileExists(file) {
-  var exists = false;
+  let exists = false;
   try {
-    var stat = fs.statSync(file);
+    const stat = fs.statSync(file);
     if (stat && stat.isFile()) exists = true;
   }
   catch (err) {
@@ -430,7 +445,7 @@ function validateName(name) {
 function validateLibrary(name) {
   const err = validateName(name);
   if (err === true) {
-	if (iutils.libraryExists(name)) return "Library " + name.toUpperCase() + " already exists. Please use a different name.";
+    if (iutils.libraryExists(name)) return "Library " + name.toUpperCase() + " already exists. Please use a different name.";
   }
   else return err;
   return true;
@@ -439,8 +454,8 @@ function validateLibrary(name) {
 function validateServer(name) {
   const err = validateName(name);
   if (err === true) {
-	  const exists = iutils.getIBMiInstances().some(el => el.name === name.toUpperCase());
-	  if (exists) return "Server Instance " + name.toUpperCase() + " already exists. Please use a different name.";
+    const exists = iutils.getIBMiInstances().some(el => el.name === name.toUpperCase());
+    if (exists) return "Server Instance " + name.toUpperCase() + " already exists. Please use a different name.";
   }
   else return err;
   return true;
@@ -487,12 +502,12 @@ function stringifyConfig(config) {
   // JavaScript functions (like connectorIPFilter) will be lost when doing JSON.stringify,
   // so we need to do some magic to preserve them.
 
-  let funkz = [];
+  const funkz = [];
   let configString = "\nmodule.exports = ";
 
   configString += JSON.stringify(config, (key, val) => {
     if (typeof val === "function") {
-      let n = funkz.length;
+      const n = funkz.length;
       funkz.push(val.toString());
       return `___function${n}___`;
     }
@@ -501,7 +516,7 @@ function stringifyConfig(config) {
 
   configString += "\n";
 
-  for (var i = 0; i < funkz.length; i++) {
+  for (let i = 0; i < funkz.length; i++) {
     configString = configString.replace(`"___function${i}___"`, funkz[i]);
   }
 
@@ -605,7 +620,7 @@ function getPUIInstanceData(name) {
   }
 
   // Replace PUI Developer name in doc root, if set.
-  let developer = getPUIDefine("DEVELOPER");
+  const developer = getPUIDefine("DEVELOPER");
   if (developer) {
     docRoot = docRoot.replace(/\$\{DEVELOPER\}/g, developer);
   }
@@ -824,13 +839,13 @@ function validate(question, answer) {
     validator = validatePUIInstance;
   }
   else if (question.id === "connectorLibrary") {
-	validator = validateLibrary;
+    validator = validateLibrary;
   }
   else if (question.id === "connectorIASP") {
     validator = validateIASP;
   }
   else if (question.id === "strtcpsvr_svrname") {
-	validator = validateServer;
+    validator = validateServer;
   }
   else if (question.type === "boolean") {
     validator = validateYesNo;

package/setup/gen_key.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const profoundjs = require("profoundjs");
+profoundjs.genKey(__filename);

package/setup/get_pjscall_key.js

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const profoundjs = require("profoundjs");
+profoundjs.getPJSCALLKey(__filename);

package/setup/install_info.json

@@ -124,6 +124,13 @@
           "textType": "ibmi_name"
         }
       ]
+    },
+    {
+      "id": "installSamples",
+      "type": "boolean",
+      "label": "Install sample code",
+      "prompt": "Install sample code?",
+      "default": true
     }
   ],
   "commands": {

package/setup/modules/oauth2sample/.noderun/ide_settings.json

@@ -0,0 +1,9 @@
+{
+  "open files": [
+    {
+      "name": "README.md"
+    }
+  ],
+  "active tab": 0,
+  "active widgets panel tab": 2
+}

package/setup/modules/oauth2sample/.noderun/settings.json

@@ -0,0 +1,14 @@
+{
+  "description": "Sample Sign on via OAuth2 and Call an API",
+  "routes": {
+    "useful-app.json": {
+      "method": "get",
+      "route": "useful-app",
+      "rdf": true
+    },
+    "authpage.js": {
+      "method": "get",
+      "route": "authpage"
+    }
+  }
+}

package/setup/modules/oauth2sample/README.md

@@ -0,0 +1,251 @@
+# OAuth2 Sample
+This sample workspace provides a sample sign on screen, a screen for calling an API, a sample API, and back-end code to glue these parts together.
+
+The sample application, "useful-app.json", requires users to authenticate via an OAuth2 provider. Once authenticated, a user can click a button causing the Profound.js (PJS) server to call the provided sample API route, defined in "mywebservices.api.json". The HTTP request to the API route includes an HTTP header containing the user's OAuth2 token, which verifies the user's identity. The API will return a message if the PJS security store permits the user to access the sample API.
+
+Disclaimer: this sample is provided to demonstrate OAuth2 for Profound API. This example and its code are not meant as a demonstration of good sign-on coding and are provided AS-IS with no warranty. The sign-on code should not be used in production servers.
+## Setup
+
+### 1. Install Sample Workspace: oauth2sample
+If you are reading this README from within your own Profound.js instance inside the /modules/oauth2sample/ directory, then you can skip this step.
+
+Otherwise, the oauth2sample workspace can be installed by running this command from the directory of your Profound.js installation:
+`node complete_install --installSamples`
+
+If you do not already have a config.js file, then you will be prompted for some settings. When asked about sample code, answer y for yes.
+
+For example, your terminal screen may look like below:
+```
+$ cd /your-profoundjs-instance/
+$ node complete_install --installSamples
+
+Specify port number for Profound.js server (8081):
+Install with Git integration (y)? n
+Install sample code (y)? y
+
+config.js updated.
+[...]
+Copying pjssamples.
+Copying sample workspace into /your-profoundjs-instance/modules/oauth2sample
+[...]
+Profound.js installation complete.
+```
+
+### 2. Setup an app with an OAuth2 Provider
+Before the oauth2sample app can authenticate users via OAuth2, an app must be defined with an OAuth2 authorization server (identity provider).
+
+An authorization server authorizes a user or an API consumer to access some resource. Common providers of authorization servers are Google, Facebook, and Microsoft.
+
+Basic steps with the provider should include:
+* creating an account if you do not already have one.
+* specifying one or more Redirect URIs.
+* obtaining a Client ID
+* obtaining a Client Secret
+
+You may use Google, Amazon, Microsoft, Facebook, GitHub, Twitter, or any other authorization server. This guide covers implementing with Microsoft, Google, and GitHub. The sample app requires at least one OAuth2 provider to be configured.
+
+#### Microsoft Entra (Azure Active Directory)
+1. Log into your Microsoft Entra / Azure account and go to: https://entra.microsoft.com/#blade/Microsoft_AAD_IAM/TenantOverview.ReactView
+(or https://entra.microsoft.com/#home).
+2. In the left panel, click Applications > App registrations.
+    1. Click the "+ New registration" near the top of the screen.
+    2. Enter a name, e.g. "OAuth2 Sample"
+    3. For Supported account types, specify the intended users; e.g. "Accounts in this organizational directory only ... Single tenant".
+    4. For Redirect URI specify:
+        * Platform: "Platform: Single-page application (SPA)"
+        * URI: specify a URI used to reach the sample express route running on your PJS server and a special parameter for redirecting; e.g., https://localhost:8081/run/oauth2sample/authpage?redir=1
+    5. Click "Register"
+3. After clicking Register you should be shown an "App registration" screen for the new app.
+    1. Copy the "Application (client) ID" value, and paste it into a temporary text file. That value will become the "client_id" in the settings.json for the workspace.
+    2. You should see an "Endpoints" button near the top of the screen. Click it to see some required URLs.
+        * Copy the "OAuth 2.0 authorization endpoint (v2)" URL into a temporary text file. (This will become the "authorizationUrl" in the openapi.json)
+        * Copy the "OAuth 2.0 token endpoint (v2)" URL into a temporary text file. (This will become the "tokenUrl" in the openapi.json)
+4. Click the "Authentication" link on the left panel under Manage.
+    1. Make sure you see a platform, "Single-page application" with "Redirect URIs" and an entry with the redirect URI that you set previously. If you do not, then set one or more URIs now.
+    2. Do NOT check anything under "Implicit grant and hybrid flows"
+    3. Under "Supported account types" you should see "Accounts in this organizational directory only" or what you picked previously.
+    4. Leave "Allow public client flows" > "Enable the following mobile and desktop flows": as "No".
+5. Click the "Certificates & secrets" link on the left panel under Manage.
+    1. Click the "Client secrets" section.
+    2. Click on the "+ New client secret" link.
+    3. Set a name, e.g., "OAuth2 smaple secret"
+    4. Set an expiration to something, e.g. "90 days (3 months)"
+    5. Click "Add"
+    6. While it is visible, copy the "Value" and paste it into a temporary text file. The value will become the "client_secret" later in your settings.js file in the workspace.
+6. Click the "API permissions" link on the left panel under Manage.
+    1. Under "Configured permissions" click "+ Add a permission".
+        * Specify "Microsft Graph"
+        * Choose "Delegated permissions
+        * Add and enable permissions for "User.read" (Sign in and read user profile), "email" (View user's email address), and "openid" (Sign users in).
+7. Paste the client_id and client_secret into the /modules/oauth2sample/settings.js file under the providerSettings.Microsoft entries, replacing the text "__enter-your-client-id-here__" and "__enter-your-client-secret-here__".
+
+
+#### Google
+1. Log in to a Google account and go to https://console.cloud.google.com/apis/credentials
+2. Click "Create Project " if there is none. Input the following data and click "Create".
+    1. Project Name: PAPI OAuth2 Project (e.g.)
+    2. Location: (pick the default)
+3. On the Left Panel, click "OAuth consent screen".
+    1. For User Type, choose "External " and click "Create".
+    2. For App Information, input the following data and click "Save and Continue".
+        * App name: PAPI OAuth2 App (e.g.)
+        * User support email: (pick the default)
+        * Developer contact information email addresses: (same as support)
+    3. For Scopes and Test Users, click "Save and Continue" to skip.
+    4. For Summary, click "Back to Dashboard".
+4. On the Left Panel, click "Credentials". Go to "+ Create Credentials -> OAuth client ID". Input the following data and click "Create".
+    * Application type: Web application
+    * Name: PAPI OAuth2 Client 1 (e.g.)
+    * Authorized redirect URIs: The URL of your Profound.js instance including the special path to the custom Express program, authpage: /run/oauth2sample/authpage?redir=1 ; Examples:
+        * https://myapp.example.com/run/oauth2sample/authpage?redir=1 
+        * http://localhost:8081/run/oauth2sample/authpage?redir=1
+5. Copy the Client ID and the Client Secret and store it in the /modules/oauth2sample/settings.js file under Google.
+
+#### GitHub
+1. Log in at https://github.com/
+2. Go to "Settings -> Developer Settings -> OAuth Apps -> New OAuth App".
+3. Input the following and click "Register Application".
+    * Application Name: PAPI OAuth2 Application (e.g.)
+    * Homepage URL: Specify the URL you use to reach your Profound.js instance in your browser; e.g., http://localhost:8081/
+    * Authorization callback URL: The URL of your Profound.js instance including the special path, /run/oauth2sample/authpage?redir=1 ; e.g. http://localhost:8081/run/oauth2sample/authpage?redir=1
+4. Click "Generate a new client secret" and authenticate on the security prompt.
+5. Copy the Client ID and the Client Secret and store it in the /modules/oauth2sample/settings.js file under GitHub.
+
+### 3. Configure Profound.js for OpenAPI
+Your Profound.js instance will provide resources for users or API consumers and will handle the authentication. Your Profound.js server should already be setup and running. (The Profound.js server is considered the Resource Server in OAuth2 terminology. https://www.oauth.com/oauth2-servers/the-resource-server/)
+
+Configuration for the OAuth2 component of PAPI is in the openapi.json file, which will exist in the base directory of your Profound.js installation when an OpenAPI security store is configured. (To setup the security store, please see https://docs.profoundlogic.com/Profound+API/Authentication+-+Authorization/Security+Store+Configuration)
+
+If the openapi.json file does not exist yet, then the file can be created by navigating to the IDE (e.g. http://localhost:8081/ide), then clicking the "API Options" toolbar button, "OpenAPI Configuration". You will then be shown a basic editor with sample JSON for the openapi.json and can save the file to create it. 
+
+If the openapi.json file already exists but does not have entries for OAuth2 under components.securitySchemes, then those entries need to be added.
+
+To make sure you test your security settings correctly, ensure the value of "x-allowAnonymous" is false. The security property should be an array of objects, including which authorization schemes are permitted. e.g. just to allow OAuth2:
+```
+"security": [
+  {
+    "OAuth2": []
+  }
+]
+```
+Or to allow either "ApiKeyAuth" or an OAuth2 security scheme defined as "OAuth2_Example":
+```
+"security": [
+  {
+    "OAuth2_Example": []
+  },
+  {
+    "ApiKeyAuth": []
+  }
+]
+```
+
+Instructions for adding entries for OAuth2 into openapi.json can be found here: https://docs.profoundlogic.com//Profound+API/Authentication+-+Authorization/OpenAPI+Configuration
+
+#### 3.1 Sample openapi.json
+```
+{
+  "openapi": "3.0.3",
+  "info": {
+    "title": "APIs",
+    "version": "1.0.0"
+  },
+  "components": {
+    "securitySchemes": {
+      "ApiKeyAuth": {
+        "type": "apiKey",
+        "in": "header",
+        "name": "X-API-Key"
+      },
+      "OAuth2_MS_Entra_Identity": {
+        "type": "oauth2",
+        "description": "Microsoft Azure Active Directory (Entra)",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "https://login.microsoftonline.com/__your-tenant-id__/oauth2/v2.0/authorize",
+            "tokenUrl": "https://login.microsoftonline.com/__your-tenant-id__/oauth2/v2.0/token",
+            "refreshUrl": "https://example.com",
+            "scopes": {
+              "openid": "required for consent page",
+              "User.Read": "read user info, userPrincipalName"
+            },
+            "x-userinfoUrl": "https://graph.microsoft.com/v1.0/me",
+            "x-userinfoField": "userPrincipalName"
+          }
+        }
+      },
+      "OAuth2_GitHub": {
+        "type": "oauth2",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "https://github.com/login/oauth/authorize",
+            "tokenUrl": "https://github.com/login/oauth/access_token",
+            "refreshUrl": "not implemented for GitHub",
+            "scopes": {
+              "user": "GitHub user profile"
+            },
+            "x-userinfoUrl": "https://api.github.com/user",
+            "x-userinfoField": "login",
+            "x-cacheTokenTTL": 10
+          }
+        }
+      },
+      "OAuth2_Google": {
+        "type": "oauth2",
+        "flows": {
+          "authorizationCode": {
+            "authorizationUrl": "https://accounts.google.com/o/oauth2/auth",
+            "tokenUrl": "https://oauth2.googleapis.com/token",
+            "refreshUrl": "https://oauth2.googleapis.com/token",
+            "scopes": {
+              "email": "Google email address"
+            },
+            "x-userinfoUrl": "https://www.googleapis.com/oauth2/v3/userinfo",
+            "x-userinfoField": "email",
+            "x-cacheTokenTTL": 5
+          }
+        }
+      }
+    }
+  },
+  "x-allowAnonymous": false,
+  "security": [
+    {
+      "OAuth2_MS_Entra_Identity": []
+    },
+    {
+      "OAuth2_GitHub": []
+    },
+    {
+      "OAuth2_Google": []
+    },
+    {
+      "ApiKeyAuth": []
+    }
+  ]
+}
+```
+
+### 4. Specify Provider Details in Settings
+Modify the oauth2sample/settings.js file.
+
+Inside this workspace is a file, settings.js, which contains some values that should be edited. Read the comments in the file to understand what each setting does.
+
+At a minimum, this sample app requires a provider to be set, and one entry must be setup in "providerSettings", where the entry's property name matches the value of the "provider" property. e.g., if your "provider" is "Microsoft", then you should have an object under the property name, "Microsoft", inside the "propertySettings" object.
+
+The values inside of your "propertySettings" entry will include at least a client_id and client_secret. Depending on your OAuth2 provider, more settings may be required. If your provider is not listed, then read the options under the `[example]` to determine what your provider needs.
+
+Set the serverDomainName to the domain name that you will use to access your PJS server, or leave it as "localhost" if you are running the example locally.
+
+### 5. Setup API Users
+
+1. From your Profound.js instance's IDE:
+2. Go to "Home Ribbon -> API Options -> User Authentication -> API Users -> Add New User "
+3. Input the user or login name of an end-user authorized to use PAPI OAuth2 and choose "New -> oauth2 -> OK"
+    * Note: the username added under this dialog must match the user's account via the OAuth2 provider, e.g. email address or username.
+
+## Run the App
+Run the sample app from the starting point; e.g. http://localhost:8081/run/oauth2sample/authpage
+
+## More information
+For documentation on OAuth2 in Profound.js, see: https://docs.profoundlogic.com/PAPI+OAuth2

package/setup/modules/oauth2sample/authpage.js

@@ -0,0 +1,178 @@
+/**
+ * Handle the initial authentication page and the redirect from the OAuth2 provider
+ * to the Rich Display File application, "useful-app".
+ */
+const crypto = require("crypto");
+
+const HTML_HEAD = `<!doctype html>
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+<meta http-equiv="X-UA-Compatible" content="IE=edge">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, target-densitydpi=device-dpi">
+<link href="/profoundui/proddata/css/profoundui.css" rel="stylesheet" type="text/css">`;
+
+const HTML_TAIL = "</body></html>";
+
+/**
+ * Route a request to this URL to either show the initial auth page, or draw the redirect page.
+ * @param {HTTPRequest} request
+ * @param {HTTPResponse} response
+ */
+function authpage(request, response) {
+  response.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+  response.setHeader("Pragma", "no-cache");
+  response.setHeader("Expires", "0");
+
+  if (request.query.redir === "1") {
+    redirect(request, response);
+  }
+  else {
+    start(request, response);
+  }
+}
+
+/**
+ * Draw the initial auth page.
+ */
+function start(request, response) {
+  // "state" is a cryptographically strong random sequence of characters, used later to
+  // protect against cross-site forgery attacks.
+  const formdata = {
+    response_type: "code",
+    redirect_uri: "",
+    client_id: "",
+    scope: "",
+    state: crypto.randomUUID(),
+    method: "GET",
+    url: "",
+    provider: ""
+  };
+
+  let message = request.query.error;
+
+  // Get 64 random characters needed for PKCE code verification. The characters must be URL-safe
+  // so that they can be passed without alteration to verify the code later.
+  let code_verifier_str = "";
+  while (code_verifier_str.length < 64) {
+    const rand = crypto.randomInt(45, 127);
+    // permitted: - . _ ~ 0-9 A-Z a-z
+    if (rand === 0x2d || rand === 0x2e || rand === 0x5f || rand === 0x7e ||
+    (rand >= 0x30 && rand <= 0x39) ||
+    (rand >= 0x41 && rand <= 0x5a) || (rand >= 0x61 && rand <= 0x7a)) {
+      code_verifier_str += String.fromCharCode(rand);
+    }
+  }
+
+  const hash = crypto.createHash("sha256");
+  hash.update(code_verifier_str, "utf8"); // read the random bytes into the hash object.
+
+  let oautils;
+
+  if (typeof message !== "string") message = "";
+  try {
+    oautils = require("./oautils.js");
+
+    formdata.redirect_uri = oautils.redirectURI;
+    formdata.client_id = oautils.client_id;
+    formdata.scope = oautils.scope;
+
+    formdata.code_challenge = hash.digest("base64url"); // the hash is expected to be base64url encoding.
+    formdata.code_challenge_method = "S256";
+
+    if (typeof oautils.authMethod === "string" && oautils.authMethod.length > 0 && oautils.authMethod !== "GET") {
+      formdata.method = oautils.authMethod;
+    }
+
+    formdata.provider = oautils.provider;
+    formdata.url = oautils.authorizationUrl;
+  }
+  catch (err) {
+    message = String(err);
+  }
+
+  response.send(`${HTML_HEAD}
+<script type="text/javascript">
+function init(){
+  /* Store value that are only available to pages in the same origin as this page. */
+  /* These values will persist even when the page redirects to the OAuth2 provider's site and back. */
+  localStorage.setItem("pjs_oadata", "${formdata.state}");
+  localStorage.setItem("pjs_codver", "${code_verifier_str}");
+}
+</script>
+<style type="text/css">
+pre {
+  color: #999999;
+}
+div#pui {
+  width: calc(100% - 20px);
+  left: 10px;
+  top: 10px;
+}
+#submit {
+  width: 100px;
+  height: 25px;
+}
+</style>
+</head>
+<body onload="init();">
+<div id="pui">
+  <p>Click Sign On to use your ${formdata.provider} account to access this app.</p>
+  <form action="${formdata.url}" method="${formdata.method}">
+    <input type="hidden" name="response_type" value="${formdata.response_type}" />
+    <input type="hidden" name="redirect_uri" value="${formdata.redirect_uri}" />
+    <input type="hidden" name="client_id" value="${formdata.client_id}" />
+    <input type="hidden" name="scope" value="${formdata.scope}" />
+    <input type="hidden" name="state" value="${formdata.state}" />
+    <input type="hidden" name="code_challenge" value="${formdata.code_challenge}" />
+    <input type="hidden" name="code_challenge_method" value="${formdata.code_challenge_method}" />
+
+    <input type="submit" value="Sign On" class="pui-solid-button-yes blueprint-defaults" id="submit" />
+  </form>
+  <pre>${message}</pre>
+</div>
+${HTML_TAIL}`);
+}
+
+/**
+ * Respond to a redirect from the OAuth2 authentication server.
+ */
+async function redirect(request, response) {
+  let strResp;
+  try {
+    const rquery = request.query;
+    if (rquery.error) {
+      // Pass on any errors to the user.
+      throw new Error(`${rquery.error}\nDescription: ${rquery.error_description}\n${rquery.error_uri}\nState: ${rquery.state}`);
+    }
+
+    if (typeof rquery.code !== "string" || rquery.code.length < 1 ||
+        typeof rquery.state !== "string" || rquery.state.length < 1) {
+      throw new Error("Authentication server did not provide code or state.");
+    }
+
+    strResp = `${HTML_HEAD}
+  <script type="text/javascript">
+  function sendTokens(){
+    const state = localStorage.getItem("pjs_oadata");
+    if (typeof state === "string" && state.length > 0 && state === "${rquery.state}"){
+      localStorage.setItem("pjs_oadata", "${rquery.code}");
+      window.location = "/run/oauth2sample/useful-app";
+    }
+    else {
+      document.body.innerHTML = '<b>Error:</b> Unable to authenticate. Invalid state.';
+    }
+  }
+  </script>
+</head>
+<body onload="sendTokens();">Redirecting to session...</body>
+</html>`;
+  }
+  catch (err) {
+    strResp = `${HTML_HEAD}</head><body><pre>${err.message}\n${err.stack}</pre>${HTML_TAIL}`;
+  }
+
+  response.send(strResp);
+}
+
+exports.run = authpage;