Press n or j to go to the next uncovered block, b, p or k for the previous block.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 | import { NextApiRequest, NextApiResponse } from 'next'
import { getOpenIdClientService } from './openid-client-service'
import { generators } from 'openid-client'
import axios from 'axios'
import https from 'https'
import fs from 'fs'
import { getLogger } from '../../logging/log-util'
import {
addCookie,
getCookieValue,
deleteCookieWithName,
} from '../../lib/cookie-utils'
import { decodeJwt } from 'jose'
import * as jose from 'jose'
export default async function handler(
req: NextApiRequest,
res: NextApiResponse,
) {
const codeVerifier = getCookieValue(
process.env.AUTH_COOKIE_PREFIX + 'codeVerifier',
req.cookies,
) as string
const state = getCookieValue(
process.env.AUTH_COOKIE_PREFIX + 'state',
req.cookies,
) as string
const nonce = getCookieValue(
process.env.AUTH_COOKIE_PREFIX + 'nonce',
req.cookies,
) as string
const now = Math.floor(Date.now() / 1000) // current time, rounded down to the nearest second
const expiry = now + 60 // valid for 1 minute
const jwtId = generators.random(32)
const openIdService = await getOpenIdClientService()
const tokenSet = await openIdService.callback(
req.query,
state,
nonce,
codeVerifier,
jwtId,
expiry,
now,
now,
)
const userinfoResponse = await axios
.get(process.env.AUTH_ECAS_USERINFO as string, {
headers: {
Authorization: `Bearer ${tokenSet.access_token as string}`,
},
})
.then((response) => response)
.catch((error) => console.log(error))
const userinfoBody = userinfoResponse?.data
const userinfoToken = userinfoBody.userinfo_token
const decodedIdToken: jose.JWTPayload = decodeJwt(tokenSet.id_token as string)
const sessionId = decodedIdToken.sid
Iif (sessionId !== undefined && sessionId !== null && sessionId !== '') {
addCookie(
res,
process.env.AUTH_COOKIE_PREFIX + 'sessionId',
sessionId as string,
Number(process.env.SESSION_MAX_AGE),
)
}
const decryptedUserInfoToken = await decryptJwe(userinfoToken)
addCookie(
res,
'sinuid',
decryptedUserInfoToken.sin + ' ' + decryptedUserInfoToken.uid,
Number(process.env.SESSION_MAX_AGE),
)
updateMscaNg(
decryptedUserInfoToken.sin as string,
decryptedUserInfoToken.uid as string,
)
const locale = getCookieValue('localeForOauthCallback', req.cookies)
deleteCookieWithName(req, res, 'localeForOauthCallback')
const dashboardRedirect =
locale === 'en' ? '/en/my-dashboard' : '/fr/mon-tableau-de-bord'
res.status(307).redirect(dashboardRedirect)
}
export function updateMscaNg(sin: string, uid: string) {
const logger = getLogger('update-msca-ng')
//Create httpsAgent to read in cert to make BRZ call
const httpsAgent =
process.env.AUTH_DISABLED === 'true'
? new https.Agent()
: new https.Agent({
ca: fs.readFileSync(
'/usr/local/share/ca-certificates/env.crt' as fs.PathOrFileDescriptor,
),
})
//Make call to msca-ng API to create user if it doesn't exist
axios
.post(
`https://${process.env.HOSTALIAS_HOSTNAME}${process.env.MSCA_NG_USER_ENDPOINT}`,
{
pid: sin,
spid: uid,
},
{
headers: {
'authorization': `Basic ${process.env.MSCA_NG_CREDS}`,
'Content-Type': 'application/json',
},
httpsAgent: httpsAgent,
},
)
.then((response) => {
logger.debug(response)
updateLastLoginDate(uid)
})
.catch((error) => logger.error(error))
function updateLastLoginDate(uid: string) {
axios({
method: 'post',
url: `https://${process.env.HOSTALIAS_HOSTNAME}${process.env.MSCA_NG_USER_ENDPOINT}/${uid}/logins`,
headers: {
'Authorization': `Basic ${process.env.MSCA_NG_CREDS}`,
'Content-Type': 'application/json',
},
httpsAgent: httpsAgent,
})
.then((response) => logger.debug(response))
.catch((error) => logger.error(error))
}
}
async function decryptJwe(jwe: string) {
const jwk = JSON.parse(process.env.AUTH_PRIVATE ?? '{}')
jwk.alg = 'RS256'
const key = await jose.importJWK({ ...jwk })
const decryptResult = await jose.compactDecrypt(jwe, key, {
keyManagementAlgorithms: ['RSA-OAEP-256'],
})
return jose.decodeJwt(decryptResult.plaintext.toString())
}
|