zavadil-ts-common 1.1.47 → 1.1.49

package/src/client/RestClient.ts

@@ -18,7 +18,7 @@ export class RestClient {
 	/**
 	 * Override this to customize http headers.
 	 */
-	getHeaders(): Promise<RestClientHeaders> {
+	getHeaders(url: string): Promise<RestClientHeaders> {
 		return Promise.resolve(
 			{
 				'Content-Type': 'application/json'
@@ -46,8 +46,8 @@ export class RestClient {
 		return url;
 	}
 
-	getRequestOptions(method: string = 'GET', data: object | null = null): Promise<RequestInit> {
-		return this.getHeaders()
+	getRequestOptions(url: string, method: string = 'GET', data: object | null = null): Promise<RequestInit> {
+		return this.getHeaders(url)
 			.then(
 				(headers) => {
 					return {
@@ -116,31 +116,31 @@ export class RestClient {
 		if (params) {
 			url = `${url}${this.paramsToQueryString(params)}`;
 		}
-		return this.getRequestOptions().then(o => this.processRequestJson(url, o));
+		return this.getRequestOptions(url).then(o => this.processRequestJson(url, o));
 	}
 
 	postJson(url: string, data: object | null = null): Promise<any> {
-		return this.getRequestOptions('POST', data).then(o => this.processRequestJson(url, o));
+		return this.getRequestOptions(url, 'POST', data).then(o => this.processRequestJson(url, o));
 	}
 
 	putJson(url: string, data: object | null = null): Promise<any> {
-		return this.getRequestOptions('PUT', data).then(o => this.processRequestJson(url, o));
+		return this.getRequestOptions(url, 'PUT', data).then(o => this.processRequestJson(url, o));
 	}
 
 	get(url: string): Promise<Response> {
-		return this.getRequestOptions().then(o => this.processRequest(url, o));
+		return this.getRequestOptions(url).then(o => this.processRequest(url, o));
 	}
 
 	del(url: string): Promise<Response> {
-		return this.getRequestOptions('DELETE').then(o => this.processRequest(url, o));
+		return this.getRequestOptions(url, 'DELETE').then(o => this.processRequest(url, o));
 	}
 
 	post(url: string, data: object | null = null): Promise<Response> {
-		return this.getRequestOptions('POST', data).then(o => this.processRequest(url, o));
+		return this.getRequestOptions(url, 'POST', data).then(o => this.processRequest(url, o));
 	}
 
 	put(url: string, data: object | null = null): Promise<Response> {
-		return this.getRequestOptions('PUT', data).then(o => this.processRequest(url, o));
+		return this.getRequestOptions(url, 'PUT', data).then(o => this.processRequest(url, o));
 	}
 
 }

package/src/oauth/OAuthRestClient.ts

@@ -1,4 +1,4 @@
-import {RestClient} from "../client/RestClient";
+import {RestClient} from "../client";
 import {StringUtil} from "../util";
 
 export type TokenRequestPayloadBase = {
@@ -7,6 +7,7 @@ export type TokenRequestPayloadBase = {
 
 export type RequestAccessTokenPayload = TokenRequestPayloadBase & {
 	idToken: string;
+	privilege: string;
 }
 
 export type RequestIdTokenFromPrevTokenPayload = {
@@ -29,7 +30,6 @@ export type IdTokenPayload = TokenResponsePayloadBase & {
 
 export type AccessTokenPayload = TokenResponsePayloadBase & {
 	accessToken: string;
-	refreshToken: string;
 }
 
 export type JwKeyPayload = {
@@ -45,7 +45,7 @@ export type JwksPayload = {
 
 /**
  * This implements rest client for OAuth server - https://github.com/lotcz/oauth-server
- * Provide basic url, /api/oauth prefix will be added automatically
+ * Provide basic url, /api/oauth path prefix will be added automatically
  */
 export class OAuthRestClient extends RestClient {
 
@@ -57,6 +57,10 @@ export class OAuthRestClient extends RestClient {
 		return this.getJson('jwks.json');
 	}
 
+	verifyIdToken(idToken: string): Promise<IdTokenPayload> {
+		return this.getJson(`id-tokens/verify/${idToken}`);
+	}
+
 	requestIdTokenFromLogin(request: RequestIdTokenFromLoginPayload): Promise<IdTokenPayload> {
 		return this.postJson('id-tokens/from-login', request);
 	}

package/src/oauth/OAuthTokenManager.ts

@@ -1,21 +1,29 @@
-import {AccessTokenPayload, IdTokenPayload, OAuthRestClient, RequestIdTokenFromLoginPayload} from "./OAuthRestClient";
+import {AccessTokenPayload, IdTokenPayload, OAuthRestClient} from "./OAuthRestClient";
+import {EventManager} from "../component";
 
 /**
  * Manages refresh of id and access tokens.
  */
 export class OAuthTokenManager {
 
+	private eventManager: EventManager = new EventManager();
+
 	oAuthServer: OAuthRestClient;
 
 	audience: string;
 
 	idToken?: IdTokenPayload;
 
-	accessToken?: AccessTokenPayload;
+	accessTokens: Map<string, AccessTokenPayload>;
 
 	constructor(oAuthServerBaseUrl: string, targetAudience: string) {
 		this.audience = targetAudience;
 		this.oAuthServer = new OAuthRestClient(oAuthServerBaseUrl);
+		this.accessTokens = new Map<string, AccessTokenPayload>();
+	}
+
+	addIdTokenChangedHandler(handler: (t: IdTokenPayload) => any) {
+		this.eventManager.addEventListener('id-token-changed', handler);
 	}
 
 	isTokenExpired(expires?: Date | null): boolean {
@@ -44,13 +52,13 @@ export class OAuthTokenManager {
 		return accessToken !== undefined && !this.isTokenExpired(accessToken.expires);
 	}
 
-	hasValidAccessToken(): boolean {
-		return this.isValidAccessToken(this.accessToken);
+	hasValidAccessToken(privilege: string): boolean {
+		return this.isValidAccessToken(this.accessTokens.get(privilege));
 	}
 
 	reset() {
-		this.idToken = undefined;
-		this.accessToken = undefined;
+		this.setIdToken(undefined);
+		this.accessTokens.clear();
 	}
 
 	getIdToken(): Promise<string> {
@@ -62,10 +70,7 @@ export class OAuthTokenManager {
 				.refreshIdToken({idToken: this.idToken.idToken})
 				.then(
 					(t) => {
-						if (!this.isValidIdToken(t)) {
-							return Promise.reject("Received ID token is not valid!");
-						}
-						this.idToken = t;
+						this.setIdToken(t);
 						return t.idToken;
 					}
 				)
@@ -73,11 +78,18 @@ export class OAuthTokenManager {
 		return Promise.resolve(this.idToken.idToken);
 	}
 
-	setIdToken(token: IdTokenPayload) {
+	setIdToken(token?: IdTokenPayload) {
 		if (!this.isValidIdToken(token)) {
 			throw new Error("Received ID token is not valid!");
 		}
 		this.idToken = token;
+		this.eventManager.triggerEvent('id-token-changed', token);
+	}
+
+	verifyIdToken(token: string): Promise<boolean> {
+		return this.oAuthServer.verifyIdToken(token)
+			.then((t) => this.setIdToken(t))
+			.then(() => true)
 	}
 
 	login(login: string, password: string): Promise<boolean> {
@@ -90,23 +102,27 @@ export class OAuthTokenManager {
 				})
 	}
 
-	getAccessToken(): Promise<string> {
-		if (this.hasValidAccessToken()) {
-			return Promise.resolve(String(this.accessToken?.accessToken));
-		} else {
-			return this.getIdToken()
-				.then(
-					(idToken: string) => this.oAuthServer
-						.requestAccessToken({idToken: idToken, targetAudience: this.audience})
-						.then((act: AccessTokenPayload) => {
-							if (!this.isValidAccessToken(act)) {
-								return Promise.reject("Received access token is not valid!");
-							}
-							this.accessToken = act;
-							return act.accessToken;
-						})
-				);
-		}
+	private getAccessTokenInternal(privilege: string): Promise<AccessTokenPayload> {
+		return this.getIdToken()
+			.then(
+				(idToken: string) => this.oAuthServer
+					.requestAccessToken({idToken: idToken, targetAudience: this.audience, privilege: privilege})
+					.then((act: AccessTokenPayload) => {
+						if (!this.isValidAccessToken(act)) {
+							return Promise.reject("Received access token is not valid!");
+						}
+						this.accessTokens.set(privilege, act);
+						return act;
+					})
+			);
+	}
+
+	getAccessToken(privilege: string): Promise<string> {
+		const existing = this.accessTokens.get(privilege);
+		if (existing === undefined || !this.isValidAccessToken(existing)) return this.getAccessTokenInternal(privilege).then((t) => t.accessToken);
+		// preload access token if it is going to expire soon
+		if (this.isTokenReadyForRefresh(existing.issuedAt, existing.expires)) this.getAccessTokenInternal(privilege);
+		return Promise.resolve(existing.accessToken);
 	}
 
 }

package/src/oauth/RestClientWithOAuth.ts

@@ -1,6 +1,7 @@
 import {OAuthTokenManager} from "./OAuthTokenManager";
-import { RestClient, RestClientHeaders } from "../client";
+import {RestClient, RestClientHeaders} from "../client";
 import {IdTokenPayload} from "./OAuthRestClient";
+import {LazyAsync} from "../cache";
 
 export type ServerOAuthInfoPayload = {
 	debugMode?: boolean;
@@ -11,35 +12,87 @@ export type ServerOAuthInfoPayload = {
 
 export class RestClientWithOAuth extends RestClient {
 
-	private tokenManager?: OAuthTokenManager;
+	private insecureClient: RestClient;
 
-	private serverInfo?: ServerOAuthInfoPayload;
+	private tokenManager: LazyAsync<OAuthTokenManager>;
 
-	private insecureClient: RestClient;
+	private serverInfo: LazyAsync<ServerOAuthInfoPayload>;
 
-	constructor(url: string) {
+	private defaultPrivilege: string;
+
+	constructor(url: string, defaultPrivilege: string = '*') {
 		super(url);
+		this.defaultPrivilege = defaultPrivilege;
+
 		// rest client without OAuth headers
 		this.insecureClient = new RestClient(url);
-	}
 
-	getServerInfo(): Promise<ServerOAuthInfoPayload> {
-		if (this.serverInfo !== undefined) {
-			return Promise.resolve(this.serverInfo);
+		this.serverInfo = new LazyAsync<ServerOAuthInfoPayload>(() => this.getServerInfoInternal());
+		this.tokenManager = new LazyAsync<OAuthTokenManager>(() => this.getTokenManagerInternal());
+
+		// initialize
+		const urlToken = this.getIdTokenFromUrl();
+		if (urlToken !== null) {
+			this.setIdTokenRaw(urlToken);
+		} else {
+			const storageToken = this.getIdTokenFromLocalStorage();
+			if (storageToken) this.setIdToken(storageToken);
 		}
-		return this.insecureClient.getJson('status/info')
-			.then((si: ServerOAuthInfoPayload) => {
-				this.serverInfo = si;
-				return this.serverInfo;
-			});
 	}
 
-	getTokenManager(): Promise<OAuthTokenManager> {
-		if (this.tokenManager !== undefined) {
-			return Promise.resolve(this.tokenManager);
+	/**
+	 * Override this if a different privilege is needed for different endpoints
+	 * @param url
+	 */
+	getPrivilege(url: string): string {
+		return this.defaultPrivilege;
+	}
+
+	getIdTokenFromUrl(): string | null {
+		const up = new URLSearchParams(document.location.search);
+		return up.get('token');
+	}
+
+	getIdTokenFromLocalStorage(): IdTokenPayload | null {
+		const raw = localStorage.getItem('id-token');
+		if (!raw) return null;
+		return JSON.parse(raw);
+	}
+
+	saveIdTokenToLocalStorage(token: IdTokenPayload | null) {
+		const raw = token ? JSON.stringify(token) : null;
+		if (raw === null) {
+			localStorage.removeItem('id-token');
+			return;
 		}
+		localStorage.setItem('id-token', raw);
+	}
+
+	addIdTokenChangedHandler(handler: () => any) {
+		this.getTokenManager().then((m) => m.addIdTokenChangedHandler(handler));
+	}
+
+	private getServerInfoInternal(): Promise<ServerOAuthInfoPayload> {
+		return this.insecureClient.getJson('status/info');
+	}
+
+	getServerInfo(): Promise<ServerOAuthInfoPayload> {
+		return this.serverInfo.get();
+	}
+
+	private getTokenManagerInternal(): Promise<OAuthTokenManager> {
 		return this.getServerInfo()
-			.then((info) => new OAuthTokenManager(info.oauthServerUrl, info.targetAudience));
+			.then(
+				(info) => {
+					const tm = new OAuthTokenManager(info.oauthServerUrl, info.targetAudience);
+					tm.addIdTokenChangedHandler((t: IdTokenPayload) => this.saveIdTokenToLocalStorage(t));
+					return tm;
+				}
+			);
+	}
+
+	getTokenManager(): Promise<OAuthTokenManager> {
+		return this.tokenManager.get();
 	}
 
 	login(login: string, password: string): Promise<boolean> {
@@ -52,9 +105,14 @@ export class RestClientWithOAuth extends RestClient {
 			.then(() => true)
 	}
 
-	getHeaders(): Promise<RestClientHeaders> {
+	setIdTokenRaw(token: string): Promise<boolean> {
+		return this.getTokenManager()
+			.then(m => m.verifyIdToken(token))
+	}
+
+	getHeaders(url: string): Promise<RestClientHeaders> {
 		return this.getTokenManager()
-			.then(sm => sm.getAccessToken())
+			.then(tm => tm.getAccessToken(this.getPrivilege(url)))
 			.then(
 				(accessToken) => {
 					return {