zavadil-ts-common 1.1.39 → 1.1.41

package/src/{component → oauth}/OAuthRestClient.ts

@@ -1,4 +1,4 @@
-import {RestClient} from "./RestClient";
+import {RestClient} from "../client/RestClient";
 import {StringUtil} from "../util";
 
 export type TokenRequestPayloadBase = {
@@ -9,8 +9,8 @@ export type RequestAccessTokenPayload = TokenRequestPayloadBase & {
 	idToken: string;
 }
 
-export type RequestIdTokenFromSessionPayload = TokenRequestPayloadBase & {
-	sessionId: string;
+export type RequestIdTokenFromPrevTokenPayload = {
+	idToken: string;
 }
 
 export type RequestIdTokenFromLoginPayload = TokenRequestPayloadBase & {
@@ -18,12 +18,8 @@ export type RequestIdTokenFromLoginPayload = TokenRequestPayloadBase & {
 	password: string;
 }
 
-export type RefreshAccessTokenPayload = TokenRequestPayloadBase & {
-	accessToken: string;
-	refreshToken: string;
-}
-
 export type TokenResponsePayloadBase = {
+	issuedAt: Date;
 	expires?: Date | null;
 }
 
@@ -47,16 +43,6 @@ export type JwksPayload = {
 	keys: Array<JwKeyPayload>;
 }
 
-export type SessionPayload = {
-	session_id: string;
-	plugin_id: number;
-	user_id: number;
-	account_id: number;
-	server: string;
-	user_name: string;
-	timezone: string;
-}
-
 /**
  * This implements rest client for OAuth server - https://github.com/lotcz/oauth-server
  */
@@ -74,19 +60,12 @@ export class OAuthRestClient extends RestClient {
 		return this.postJson('id-tokens/from-login', request);
 	}
 
-	requestIdTokenFromSession(request: RequestIdTokenFromSessionPayload): Promise<IdTokenPayload> {
-		return this.postJson('id-tokens/from-session', request);
+	refreshIdToken(request: RequestIdTokenFromPrevTokenPayload): Promise<IdTokenPayload> {
+		return this.postJson('id-tokens/refresh', request);
 	}
 
 	requestAccessToken(request: RequestAccessTokenPayload): Promise<AccessTokenPayload> {
 		return this.postJson('access-tokens/from-id-token', request);
 	}
 
-	refreshAccessToken(request: RefreshAccessTokenPayload): Promise<AccessTokenPayload> {
-		return this.postJson('access-tokens/refresh', request);
-	}
-
-	loadSessionById(sessionId: string): Promise<SessionPayload> {
-		return this.getJson(`sessions/${sessionId}`);
-	}
 }

package/src/oauth/OAuthTokenManager.ts

@@ -0,0 +1,110 @@
+import {AccessTokenPayload, IdTokenPayload, OAuthRestClient} from "./OAuthRestClient";
+
+/**
+ * Manages refresh of id and access tokens.
+ */
+export class OAuthTokenManager {
+
+	oAuthServer: OAuthRestClient;
+
+	audience: string;
+
+	idToken?: IdTokenPayload;
+
+	accessToken?: AccessTokenPayload;
+
+	constructor(oAuthServerBaseUrl: string, targetAudience: string) {
+		this.audience = targetAudience;
+		this.oAuthServer = new OAuthRestClient(oAuthServerBaseUrl);
+	}
+
+	isTokenExpired(expires?: Date | null): boolean {
+		if (expires === undefined || expires === null) return false;
+		const now = Date.now();
+		const exp = new Date(expires).getTime();
+		return (exp < now);
+	}
+
+	isTokenReadyForRefresh(issuedAt: Date, expires?: Date | null): boolean {
+		if (expires === undefined || expires === null) return false;
+		const middle = new Date((expires.getTime() + issuedAt.getTime()) / 2);
+		const now = new Date();
+		return (middle < now);
+	}
+
+	isValidIdToken(idToken?: IdTokenPayload): boolean {
+		return idToken !== undefined && !this.isTokenExpired(idToken.expires);
+	}
+
+	hasValidIdToken(): boolean {
+		return this.isValidIdToken(this.idToken);
+	}
+
+	isValidAccessToken(accessToken?: AccessTokenPayload): boolean {
+		return accessToken !== undefined && !this.isTokenExpired(accessToken.expires);
+	}
+
+	hasValidAccessToken(): boolean {
+		return this.isValidAccessToken(this.accessToken);
+	}
+
+	reset() {
+		this.idToken = undefined;
+		this.accessToken = undefined;
+	}
+
+	getIdToken(): Promise<string> {
+		if (this.idToken === undefined || !this.hasValidIdToken()) {
+			return Promise.reject("No valid ID token!");
+		}
+		if (this.isTokenReadyForRefresh(this.idToken.issuedAt, this.idToken.expires)) {
+			return this.oAuthServer
+				.refreshIdToken({idToken: this.idToken.idToken})
+				.then(
+					(t) => {
+						if (!this.isValidIdToken(t)) {
+							return Promise.reject("Received ID token is not valid!");
+						}
+						this.idToken = t;
+						return t.idToken;
+					}
+				)
+		}
+		return Promise.resolve(this.idToken.idToken);
+	}
+
+	login(login: string, password: string): Promise<boolean> {
+		this.reset();
+		return this.oAuthServer.requestIdTokenFromLogin({login: login, password: password, targetAudience: this.audience})
+			.then(
+				(t) => {
+					if (!this.isValidIdToken(t)) {
+						return Promise.reject("Received ID token is not valid!");
+					}
+					this.idToken = t;
+					return true;
+				})
+			.catch((e) => false);
+	}
+
+	getAccessToken(): Promise<string> {
+		if (this.hasValidAccessToken()) {
+			return Promise.resolve(String(this.accessToken?.accessToken));
+		} else {
+			return this.getIdToken()
+				.then(
+					(idToken: string) => this.oAuthServer
+						.requestAccessToken({idToken: idToken, targetAudience: this.audience})
+						.then((act: AccessTokenPayload) => {
+							if (!this.isValidAccessToken(act)) {
+								return Promise.reject("Received access token is not valid!");
+							}
+							this.accessToken = act;
+							return act.accessToken;
+						})
+				);
+		}
+	}
+
+}
+

package/src/oauth/RestClientWithOAuth.ts

@@ -0,0 +1,61 @@
+import {OAuthTokenManager} from "./OAuthTokenManager";
+import { RestClient, RestClientHeaders } from "../client/RestClient";
+
+export type ServerOAuthInfoPayload = {
+	debugMode?: boolean;
+	targetAudience: string;
+	oauthServerUrl: string;
+	version: string;
+}
+
+export class RestClientWithOAuth extends RestClient {
+
+	private tokenManager?: OAuthTokenManager;
+
+	private serverInfo?: ServerOAuthInfoPayload;
+
+	private insecureClient: RestClient;
+
+	constructor(url: string) {
+		super(url);
+		// rest client without OAuth headers
+		this.insecureClient = new RestClient(url);
+	}
+
+	getServerInfo(): Promise<ServerOAuthInfoPayload> {
+		if (this.serverInfo !== undefined) {
+			return Promise.resolve(this.serverInfo);
+		}
+		return this.insecureClient.getJson('status/info')
+			.then((si: ServerOAuthInfoPayload) => {
+				this.serverInfo = si;
+				return this.serverInfo;
+			});
+	}
+
+	getTokenManager(): Promise<OAuthTokenManager> {
+		if (this.tokenManager !== undefined) {
+			return Promise.resolve(this.tokenManager);
+		}
+		return this.getServerInfo()
+			.then((info) => new OAuthTokenManager(info.oauthServerUrl, info.targetAudience));
+	}
+
+	login(login: string, password: string): Promise<boolean> {
+		return this.getTokenManager().then((m) => m.login(login, password));
+	}
+
+	getHeaders(): Promise<RestClientHeaders> {
+		return this.getTokenManager()
+			.then(sm => sm.getAccessToken())
+			.then(
+				(accessToken) => {
+					return {
+						'Content-Type': 'application/json',
+						'Authorization': `Bearer ${accessToken}`
+					}
+				}
+			);
+	}
+
+}

package/src/oauth/index.ts

@@ -0,0 +1,6 @@
+export * from './OAuthRestClient';
+export * from './OAuthTokenManager';
+export * from './OAuthSubject';
+export * from './OAuthTokenManager';
+export * from './RestClientWithOAuth';
+

package/src/component/OAuthSessionManager.ts

@@ -1,143 +0,0 @@
-import {AccessTokenPayload, IdTokenPayload, OAuthRestClient, SessionPayload} from "./OAuthRestClient";
-
-export class OAuthSessionManager {
-
-	oAuthServer: OAuthRestClient;
-
-	audience: string;
-
-	idToken?: IdTokenPayload;
-
-	accessToken?: AccessTokenPayload;
-
-	sessionId?: string;
-
-	session?: SessionPayload;
-
-	constructor(oAuthServerBaseUrl: string, targetAudience: string) {
-		this.audience = targetAudience;
-		this.oAuthServer = new OAuthRestClient(oAuthServerBaseUrl);
-		setInterval(() => this.checkAccessTokenRefresh(), 5000);
-	}
-
-	isTokenExpired(expires?: Date | null): boolean {
-		if (expires === undefined || expires === null) return false;
-		const now = Date.now();
-		const exp = new Date(expires).getTime();
-		return (exp < now);
-	}
-
-	isTokenReadyForRefresh(expires?: Date | null): boolean {
-		if (expires === undefined || expires === null) return false;
-		const now = Date.now();
-		const exp = new Date(expires).getTime() - (1000 * 10);
-		return (exp < now);
-	}
-
-	isValidIdToken(idToken?: IdTokenPayload): boolean {
-		return idToken !== undefined && !this.isTokenExpired(idToken.expires);
-	}
-
-	hasValidIdToken(): boolean {
-		return this.isValidIdToken(this.idToken);
-	}
-
-	isValidAccessToken(accessToken?: AccessTokenPayload): boolean {
-		return accessToken !== undefined && !this.isTokenExpired(accessToken.expires);
-	}
-
-	hasValidAccessToken(): boolean {
-		return this.isValidAccessToken(this.accessToken);
-	}
-
-	reset() {
-		this.sessionId = undefined;
-		this.session = undefined;
-		this.idToken = undefined;
-		this.accessToken = undefined;
-	}
-
-	initializeSessionId(sessionId: string) {
-		this.reset();
-		this.sessionId = sessionId;
-	}
-
-	getSession(): Promise<SessionPayload> {
-		if (this.session !== undefined) {
-			return Promise.resolve(this.session);
-		} else {
-			if (this.sessionId === undefined) {
-				return Promise.reject("No session ID!");
-			}
-			return this.oAuthServer
-				.loadSessionById(this.sessionId)
-				.then((session: SessionPayload) => {
-					this.session = session;
-					return this.session;
-				});
-		}
-	}
-
-	getIdToken(): Promise<string> {
-		if (this.hasValidIdToken()) {
-			return Promise.resolve(String(this.idToken?.idToken));
-		} else {
-			if (this.sessionId === undefined) {
-				return Promise.reject("No session ID!");
-			}
-			return this.oAuthServer
-				.requestIdTokenFromSession({sessionId: this.sessionId, targetAudience: this.audience})
-				.then((idToken: IdTokenPayload) => {
-					if (!this.isValidIdToken(idToken)) {
-						return Promise.reject("Received ID token is not valid!");
-					}
-					this.idToken = idToken;
-				})
-				.then(() => this.getIdToken());
-		}
-	}
-
-	getAccessToken(): Promise<string> {
-		if (this.hasValidAccessToken()) {
-			return Promise.resolve(String(this.accessToken?.accessToken));
-		} else {
-			return this.getIdToken()
-				.then(
-					(idToken: string) => this.oAuthServer
-						.requestAccessToken({idToken: idToken, targetAudience: this.audience})
-						.then((act: AccessTokenPayload) => {
-							if (!this.isValidAccessToken(act)) {
-								return Promise.reject("Received access token is not valid!");
-							}
-							this.accessToken = act;
-						})
-				)
-				.then(() => this.getAccessToken());
-		}
-	}
-
-	refreshAccessToken() {
-		if (this.accessToken === undefined) throw new Error("No access token to be refreshed!");
-		this.oAuthServer.refreshAccessToken(
-			{
-				targetAudience: this.audience,
-				accessToken: this.accessToken?.accessToken,
-				refreshToken: this.accessToken?.refreshToken
-			}
-		).then(
-			(act: AccessTokenPayload) => {
-				if (!this.isValidAccessToken(act)) {
-					throw new Error("Refreshed access token is not valid!");
-				}
-				this.accessToken = act;
-			}
-		)
-	}
-
-	checkAccessTokenRefresh() {
-		if (this.hasValidAccessToken() && this.isTokenReadyForRefresh(this.accessToken?.expires)) {
-			this.refreshAccessToken();
-		}
-	}
-}
-