Project Backend OIDC

import { authorizationUrl, createPkce } from "@minicenter/sdk";

export async function startOidcLogin({
  saveLogin, request = fetch, issuer = "https://sandbox.minicenter.otus.tw",
  clientId = process.env.MINICENTER_PROJECT_CLIENT_ID ?? "YOUR_SANDBOX_PROJECT_CLIENT_ID",
  redirectUri = process.env.PROJECT_OIDC_REDIRECT_URI ?? "https://your-project.example/auth/callback",
}) {
  const { verifier, challenge } = await createPkce();
  const state = crypto.randomUUID();
  const nonce = crypto.randomUUID();
  const noRedirect = async (url, options = {}) => {
    const response = await request(url, { ...options, redirect: "error" });
    if (response.redirected) throw new Error("redirected OIDC fetch");
    return response;
  };
  const discovery = await noRedirect(new URL("/.well-known/openid-configuration", issuer)).then((response) => response.json());
  if (discovery.issuer !== issuer) throw new Error("issuer mismatch");
  for (const name of ["authorization_endpoint", "token_endpoint", "userinfo_endpoint", "jwks_uri"]) {
    const endpoint = new URL(discovery[name]);
    if (endpoint.protocol !== "https:" || endpoint.origin !== new URL(issuer).origin) throw new Error(`untrusted ${name}`);
  }
  const url = authorizationUrl({
    issuer, authorizationEndpoint: discovery.authorization_endpoint, clientId, redirectUri,
    state, nonce, challenge, scopes: ["openid", "profile", "email"],
  });
  if (!url.startsWith(discovery.authorization_endpoint) || !url.includes("code_challenge_method=S256")) throw new Error("discovery or PKCE mismatch");
  await saveLogin(state, { verifier, state, nonce, createdAt: Math.floor(Date.now() / 1000) }, { ttlSeconds: 600 });
  return url;
}

import { createPublicKey, verify } from "node:crypto";

const json = (part) => JSON.parse(Buffer.from(part, "base64url"));

export async function completeOidcCallback({
  callbackUrl, consumeLogin, issuer, clientId, redirectUri,
  request = fetch, saveSession, now = Math.floor(Date.now() / 1000),
}) {
  const noRedirect = async (url, options = {}) => {
    const response = await request(url, { ...options, redirect: "error" });
    if (response.redirected) throw new Error("redirected OIDC fetch");
    return response;
  };
  const callback = new URL(callbackUrl);
  const callbackState = callback.searchParams.get("state");
  const login = callbackState ? await consumeLogin(callbackState) : null;
  if (!login || callbackState !== login.state
    || !Number.isInteger(login.createdAt) || now - login.createdAt > 600 || login.createdAt > now + 60) throw new Error("state mismatch or expired");
  const code = callback.searchParams.get("code");
  if (!code) throw new Error("authorization code missing");

  const discovery = await noRedirect(new URL("/.well-known/openid-configuration", issuer)).then((response) => response.json());
  if (discovery.issuer !== issuer) throw new Error("issuer mismatch");
  for (const name of ["authorization_endpoint", "token_endpoint", "userinfo_endpoint", "jwks_uri"]) {
    const endpoint = new URL(discovery[name]);
    if (endpoint.protocol !== "https:" || endpoint.origin !== new URL(issuer).origin) throw new Error(`untrusted ${name}`);
  }
  const tokenResponse = await noRedirect(discovery.token_endpoint, {
    method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "authorization_code", code, client_id: clientId,
      redirect_uri: redirectUri, code_verifier: login.verifier,
    }),
  });
  if (!tokenResponse.ok) throw new Error("token exchange failed");
  const tokens = await tokenResponse.json();
  const [encodedHeader, encodedClaims, encodedSignature] = tokens.id_token.split(".");
  const header = json(encodedHeader);
  const claims = json(encodedClaims);
  const jwks = await noRedirect(discovery.jwks_uri).then((response) => response.json());
  const jwk = jwks.keys.find((candidate) => candidate.kid === header.kid && candidate.alg === "RS256");
  const validSignature = jwk && verify(
    "RSA-SHA256", Buffer.from(`${encodedHeader}.${encodedClaims}`),
    createPublicKey({ key: jwk, format: "jwk" }), Buffer.from(encodedSignature, "base64url"),
  );
  const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
  if (!validSignature || claims.iss !== issuer || !audience.includes(clientId)
    || claims.nonce !== login.nonce || !Number.isFinite(claims.exp) || !Number.isFinite(claims.iat)
    || claims.exp <= now || claims.iat > now + 60
    || typeof claims.sub !== "string" || claims.sub === "") throw new Error("invalid ID token");

  await saveSession({ accountId: claims.sub });
  return { accountId: claims.sub };
}