webid-oidc.mjs

/**
 * OIDC Relying Party API handler module.
 */

import express from 'express'
import { routeResolvedFile } from '../../utils.mjs'
import bodyParserPkg from 'body-parser'
import { fromServerConfig } from '../../models/oidc-manager.mjs'
import { LoginRequest } from '../../requests/login-request.mjs'
import { SharingRequest } from '../../requests/sharing-request.mjs'
import debug from '../../debug.mjs'

import restrictToTopDomain from '../../handlers/restrict-to-top-domain.mjs'

import PasswordResetEmailRequest from '../../requests/password-reset-email-request.mjs'
import PasswordChangeRequest from '../../requests/password-change-request.mjs'

import oidcOpExpress from 'oidc-op-express'

import oidcAuthManager from '@solid/oidc-auth-manager'
const { urlencoded } = bodyParserPkg
const bodyParser = urlencoded({ extended: false })
const { AuthCallbackRequest } = oidcAuthManager.handlers

function oidcCookieNames (req) {
  const provider = req.app?.locals?.oidc?.provider
  if (!provider || typeof provider.configuration !== 'function') {
    return []
  }

  const cookieNames = provider.configuration('cookies')?.names || {}
  const baseNames = Object.values(cookieNames).filter(Boolean)
  const expandedNames = baseNames.flatMap(name => [
    name,
    `${name}.sig`,
    `${name}.legacy`,
    `${name}.legacy.sig`
  ])

  return Array.from(new Set(expandedNames))
}

function cookieNamesFromRequest (req) {
  const cookieHeader = req.headers?.cookie
  if (!cookieHeader) {
    return []
  }

  return cookieHeader
    .split(';')
    .map(fragment => fragment.trim())
    .filter(Boolean)
    .map(fragment => fragment.split('=')[0].trim())
    .filter(Boolean)
}

function clearAuthCookies (res, domain, cookieNames) {
  const cookiePaths = ['/', '/.oidc']
  const allCookieNames = Array.from(new Set([
    'nssidp.sid',
    'nssidp.sid.sig',
    'nssidp.sid.legacy',
    'nssidp.sid.legacy.sig',
    ...(cookieNames || [])
  ]))

  for (const path of cookiePaths) {
    const noDomainOptions = { path }
    for (const name of allCookieNames) {
      res.clearCookie(name, noDomainOptions)
    }

    if (domain) {
      const domainOptions = { domain, path }
      for (const name of allCookieNames) {
        res.clearCookie(name, domainOptions)
      }
    }
  }
}

function renderGoodbyeAndClearSession (req, res, next) {
  const domain = req.session?.cookie?.domain
  const providerCookieNames = oidcCookieNames(req)
  const incomingCookieNames = cookieNamesFromRequest(req)
  const cookiesToClear = Array.from(new Set([...providerCookieNames, ...incomingCookieNames]))

  if (!req.session) {
    clearAuthCookies(res, domain, cookiesToClear)
    return res.render('auth/goodbye')
  }

  req.session.destroy((err) => {
    if (err) {
      return next(err)
    }

    clearAuthCookies(res, domain, cookiesToClear)
    res.render('auth/goodbye')
  })
}

/**
 * Sets up OIDC authentication for the given app.
 *
 * @param app {Object} Express.js app instance
 * @param argv {Object} Config options hashmap
 */
export function initialize (app, argv) {
  const oidc = fromServerConfig(argv)
  app.locals.oidc = oidc

  // Store initialization function to be called after server starts listening
  // (OIDC client registration needs the server to be up to fetch openid-configuration)
  app.locals.initFunction = () => oidc.initialize()

  // Attach the OIDC API
  app.use('/', middleware(oidc))

  // Perform the actual authentication
  app.use('/', async (req, res, next) => {
    oidc.rs.authenticate({ tokenTypesSupported: argv.tokenTypesSupported })(req, res, (err) => {
      // Error handling should be deferred to the ldp in case a user with a bad token is trying
      // to access a public resource
      if (err) {
        req.authError = err
        res.status(200)
      }
      next()
    })
  })

  // Expose session.userId
  app.use('/', (req, res, next) => {
    oidc.webIdFromClaims(req.claims)
      .then(webId => {
        if (webId) {
          req.session.userId = webId
        }

        next()
      })
      .catch(err => {
        const error = new Error('Could not verify Web ID from token claims')
        error.statusCode = 401
        error.statusText = 'Invalid login'
        error.cause = err

        console.error(err)

        next(error)
      })
  })
}

/**
 * Returns a router with OIDC Relying Party and Identity Provider middleware:
 *
 * @method middleware
 *
 * @param oidc {OidcManager}
 *
 * @return {Router} Express router
 */
export function middleware (oidc) {
  const router = express.Router('/')

  // User-facing Authentication API
  router.get(['/login', '/signin'], LoginRequest.get)

  router.post('/login/password', bodyParser, LoginRequest.loginPassword)

  router.post('/login/tls', bodyParser, LoginRequest.loginTls)

  router.get('/sharing', SharingRequest.get)
  router.post('/sharing', bodyParser, SharingRequest.share)

  router.get('/account/password/reset', restrictToTopDomain, PasswordResetEmailRequest.get)
  router.post('/account/password/reset', restrictToTopDomain, bodyParser, PasswordResetEmailRequest.post)

  router.get('/account/password/change', restrictToTopDomain, PasswordChangeRequest.get)
  router.post('/account/password/change', restrictToTopDomain, bodyParser, PasswordChangeRequest.post)

  router.get([
    '/.well-known/solid/logout',
    '/.well-known/solid/logout/',
    '/solid/logout',
    '/solid/logout/'
  ], (req, res) => {
    res.redirect('/goodbye')
  })

  router.get(['/logout', '/logout/'], (req, res) => {
    res.redirect('/goodbye')
  })

  router.get('/goodbye', renderGoodbyeAndClearSession)

  // The relying party callback is called at the end of the OIDC signin process
  router.get('/api/oidc/rp/:issuer_id', AuthCallbackRequest.get)

  // Static assets related to authentication
  const authAssets = [
    ['/.well-known/solid/login/', '../static/popup-redirect.html', false],
    ['/common/', 'solid-auth-client/dist-popup/popup.html']
  ]
  authAssets.map(args => routeResolvedFile(router, ...args))

  // Initialize the OIDC Identity Provider routes/api
  // router.get('/.well-known/openid-configuration', discover.bind(provider))
  // router.get('/jwks', jwks.bind(provider))
  // router.post('/register', register.bind(provider))
  // router.get('/authorize', authorize.bind(provider))
  // router.post('/authorize', authorize.bind(provider))
  // router.post('/token', token.bind(provider))
  // router.get('/userinfo', userinfo.bind(provider))
  // router.get('/logout', logout.bind(provider))
  const oidcProviderApi = oidcOpExpress(oidc.provider)
  router.use('/', oidcProviderApi)

  return router
}

/**
 * Sets the `WWW-Authenticate` response header for 401 error responses.
 * Used by error-pages handler.
 *
 * @param req {IncomingRequest}
 * @param res {ServerResponse}
 * @param err {Error}
 */
export function setAuthenticateHeader (req, res, err) {
  const locals = req.app.locals

  const errorParams = {
    realm: locals.host.serverUri,
    scope: 'openid webid',
    error: err.error,
    error_description: err.error_description,
    error_uri: err.error_uri
  }

  const challengeParams = Object.keys(errorParams)
    .filter(key => !!errorParams[key])
    .map(key => `${key}="${errorParams[key]}"`)
    .join(', ')

  res.set('WWW-Authenticate', 'Bearer ' + challengeParams)
}

/**
 * Provides custom logic for error status code overrides.
 *
 * @param statusCode {number}
 * @param req {IncomingRequest}
 *
 * @returns {number}
 */
export function statusCodeOverride (statusCode, req) {
  if (isEmptyToken(req)) {
    return 400
  } else {
    return statusCode
  }
}

/**
 * Tests whether the `Authorization:` header includes an empty or missing Bearer
 * token.
 *
 * @param req {IncomingRequest}
 *
 * @returns {boolean}
 */
export function isEmptyToken (req) {
  const header = req.get('Authorization')

  if (!header) { return false }

  if (header.startsWith('Bearer')) {
    const fragments = header.split(' ')

    if (fragments.length === 1) {
      return true
    } else if (!fragments[1]) {
      return true
    }
  }

  return false
}

export default {
  initialize,
  isEmptyToken,
  middleware,
  setAuthenticateHeader,
  statusCodeOverride
}