ran-boilerplate
Version:
React . Apollo (GraphQL) . Next.js Toolkit
544 lines • 23 kB
JavaScript
"use strict";
/**
* Copyright 2012 Google Inc. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
var __extends = (this && this.__extends) || (function () {
var extendStatics = Object.setPrototypeOf ||
({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
function (d, b) { for (var p in b) if (b.hasOwnProperty(p)) d[p] = b[p]; };
return function (d, b) {
extendStatics(d, b);
function __() { this.constructor = d; }
d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
};
})();
Object.defineProperty(exports, "__esModule", { value: true });
var querystring = require("querystring");
var pemverifier_1 = require("./../pemverifier");
var transporters_1 = require("./../transporters");
var authclient_1 = require("./authclient");
var loginticket_1 = require("./loginticket");
var merge = require('lodash.merge');
var noop = Function.prototype;
var OAuth2Client = /** @class */ (function (_super) {
__extends(OAuth2Client, _super);
/**
* Handles OAuth2 flow for Google APIs.
*
* @param {string=} clientId The authentication client ID.
* @param {string=} clientSecret The authentication client secret.
* @param {string=} redirectUri The URI to redirect to after completing the auth request.
* @param {Object=} opt_opts optional options for overriding the given parameters.
* @constructor
*/
function OAuth2Client(clientId, clientSecret, redirectUri, opt_opts) {
var _this = _super.call(this) || this;
_this._certificateCache = null;
_this._certificateExpiry = null;
_this._clientId = clientId;
_this._clientSecret = clientSecret;
_this._redirectUri = redirectUri;
_this._opts = opt_opts || {};
_this.credentials = {};
return _this;
}
/**
* Generates URL for consent page landing.
* @param {object=} opt_opts Options.
* @return {string} URL to consent page.
*/
OAuth2Client.prototype.generateAuthUrl = function (opt_opts) {
var opts = opt_opts || {};
opts.response_type = opts.response_type || 'code';
opts.client_id = opts.client_id || this._clientId;
opts.redirect_uri = opts.redirect_uri || this._redirectUri;
// Allow scopes to be passed either as array or a string
if (opts.scope instanceof Array) {
opts.scope = opts.scope.join(' ');
}
var rootUrl = this._opts.authBaseUrl || OAuth2Client.GOOGLE_OAUTH2_AUTH_BASE_URL_;
return rootUrl + '?' + querystring.stringify(opts);
};
/**
* Gets the access token for the given code.
* @param {string} code The authorization code.
* @param {function=} callback Optional callback fn.
*/
OAuth2Client.prototype.getToken = function (code, callback) {
var uri = this._opts.tokenUrl || OAuth2Client.GOOGLE_OAUTH2_TOKEN_URL_;
var values = {
code: code,
client_id: this._clientId,
client_secret: this._clientSecret,
redirect_uri: this._redirectUri,
grant_type: 'authorization_code'
};
this.transporter.request({ method: 'POST', uri: uri, form: values, json: true }, function (err, tokens, response) {
if (!err && tokens && tokens.expires_in) {
tokens.expiry_date =
((new Date()).getTime() + (tokens.expires_in * 1000));
delete tokens.expires_in;
}
var done = callback || noop;
done(err, tokens, response);
});
};
/**
* Refreshes the access token.
* @param {string} refresh_token Existing refresh token.
* @param {function=} callback Optional callback.
* @private
*/
OAuth2Client.prototype.refreshToken = function (refresh_token, callback) {
var uri = this._opts.tokenUrl || OAuth2Client.GOOGLE_OAUTH2_TOKEN_URL_;
var values = {
refresh_token: refresh_token,
client_id: this._clientId,
client_secret: this._clientSecret,
grant_type: 'refresh_token'
};
// request for new token
return this.transporter.request({ method: 'POST', uri: uri, form: values, json: true }, function (err, tokens, response) {
if (!err && tokens && tokens.expires_in) {
tokens.expiry_date =
((new Date()).getTime() + (tokens.expires_in * 1000));
delete tokens.expires_in;
}
var done = callback || noop;
done(err, tokens, response);
});
};
/**
* Retrieves the access token using refresh token
*
* @deprecated use getRequestMetadata instead.
* @param {function} callback callback
*/
OAuth2Client.prototype.refreshAccessToken = function (callback) {
var _this = this;
if (!this.credentials.refresh_token) {
callback(new Error('No refresh token is set.'), null);
return;
}
this.refreshToken(this.credentials.refresh_token, function (err, result, response) {
if (err) {
callback(err, null, response);
}
else {
var tokens = result;
tokens.refresh_token = _this.credentials.refresh_token;
_this.credentials = tokens;
callback(null, _this.credentials, response);
}
});
};
/**
* Get a non-expired access token, after refreshing if necessary
*
* @param {function} callback Callback to call with the access token
*/
OAuth2Client.prototype.getAccessToken = function (callback) {
var expiryDate = this.credentials.expiry_date;
// if no expiry time, assume it's not expired
var isTokenExpired = expiryDate ? expiryDate <= (new Date()).getTime() : false;
if (!this.credentials.access_token && !this.credentials.refresh_token) {
return callback(new Error('No access or refresh token is set.'), null);
}
var shouldRefresh = !this.credentials.access_token || isTokenExpired;
if (shouldRefresh && this.credentials.refresh_token) {
if (!this.credentials.refresh_token) {
return callback(new Error('No refresh token is set.'), null);
}
this.refreshAccessToken(function (err, tokens, response) {
if (err) {
return callback(err, null, response);
}
if (!tokens || (tokens && !tokens.access_token)) {
return callback(new Error('Could not refresh access token.'), null, response);
}
return callback(null, tokens.access_token, response);
});
}
else {
return callback(null, this.credentials.access_token, null);
}
};
/**
* getRequestMetadata obtains auth metadata to be used by requests.
*
* getRequestMetadata is the main authentication interface. It takes an
* optional uri which when present is the endpoint being accessed, and a
* callback func(err, metadata_obj, response) where metadata_obj contains
* authorization metadata fields and response is an optional response object.
*
* In OAuth2Client, metadata_obj has the form.
*
* {Authorization: 'Bearer <access_token_value>'}
*
* @param {string} opt_uri the Uri being authorized
* @param {function} metadataCb the func described above
*/
OAuth2Client.prototype.getRequestMetadata = function (opt_uri, metadataCb) {
var _this = this;
var thisCreds = this.credentials;
if (!thisCreds.access_token && !thisCreds.refresh_token && !this.apiKey) {
return metadataCb(new Error('No access, refresh token or API key is set.'), null);
}
// if no expiry time, assume it's not expired
var expiryDate = thisCreds.expiry_date;
var isTokenExpired = expiryDate ? expiryDate <= (new Date()).getTime() : false;
if (thisCreds.access_token && !isTokenExpired) {
thisCreds.token_type = thisCreds.token_type || 'Bearer';
var headers = {
Authorization: thisCreds.token_type + ' ' + thisCreds.access_token
};
return metadataCb(null, headers, null);
}
if (this.apiKey) {
return metadataCb(null, {}, null);
}
return this.refreshToken(thisCreds.refresh_token, function (err, tokens, response) {
// If the error code is 403 or 404, go to the else so the error
// message is replaced. Otherwise, return the error.
if (err && err.code != 403 &&
err.code != 404) {
return metadataCb(err, null, response);
}
else {
if (!tokens || (tokens && !tokens.access_token)) {
return metadataCb(new Error('Could not refresh access token.'), null, response);
}
var credentials = _this.credentials;
credentials.token_type = credentials.token_type || 'Bearer';
tokens.refresh_token = credentials.refresh_token;
_this.credentials = tokens;
var headers = {
Authorization: credentials.token_type + ' ' + tokens.access_token
};
return metadataCb(err, headers, response);
}
});
};
/**
* Revokes the access given to token.
* @param {string} token The existing token to be revoked.
* @param {function=} callback Optional callback fn.
*/
OAuth2Client.prototype.revokeToken = function (token, callback) {
this.transporter.request({
uri: OAuth2Client.GOOGLE_OAUTH2_REVOKE_URL_ + '?' +
querystring.stringify({ token: token }),
json: true
}, callback);
};
/**
* Revokes access token and clears the credentials object
* @param {Function=} callback callback
*/
OAuth2Client.prototype.revokeCredentials = function (callback) {
var token = this.credentials.access_token;
this.credentials = {};
if (token) {
this.revokeToken(token, callback);
}
else {
callback(new transporters_1.RequestError('No access token to revoke.'), null, null);
}
};
/**
* Provides a request implementation with OAuth 2.0 flow.
* If credentials have a refresh_token, in cases of HTTP
* 401 and 403 responses, it automatically asks for a new
* access token and replays the unsuccessful request.
* @param {object} opts Request options.
* @param {function} callback callback.
* @return {Request} Request object
*/
OAuth2Client.prototype.request = function (opts, callback) {
/* jshint latedef:false */
var _this = this;
// Callbacks will close over this to ensure that we only retry once
var retry = true;
var unusedUri = null;
// Declare authCb upfront to avoid the linter complaining about use before
// declaration.
var authCb;
// Hook the callback routine to call the _postRequest method.
var postRequestCb = function (err, body, resp) {
var statusCode = resp && resp.statusCode;
// Automatically retry 401 and 403 responses
// if err is set and is unrelated to response
// then getting credentials failed, and retrying won't help
if (retry && (statusCode === 401 || statusCode === 403) &&
(!err || err.code === statusCode)) {
/* It only makes sense to retry once, because the retry is intended
* to handle expiration-related failures. If refreshing the token
* does not fix the failure, then refreshing again probably won't
* help */
retry = false;
// Force token refresh
_this.refreshAccessToken(function () {
_this.getRequestMetadata(unusedUri, authCb);
});
}
else {
_this.postRequest(err, body, resp, callback);
}
};
authCb = function (err, headers, response) {
if (err) {
postRequestCb(err, null, response);
}
else {
if (headers) {
opts.headers = opts.headers || {};
opts.headers.Authorization = headers.Authorization;
}
if (_this.apiKey) {
if (opts.qs) {
opts.qs = merge({}, opts.qs, { key: _this.apiKey });
}
else {
opts.qs = { key: _this.apiKey };
}
}
return _this._makeRequest(opts, postRequestCb);
}
};
return this.getRequestMetadata(unusedUri, authCb);
};
/**
* Makes a request without paying attention to refreshing or anything
* Assumes that all credentials are set correctly.
* @param {object} opts Options for request
* @param {Function} callback callback function
* @return {Request} The request object created
*/
OAuth2Client.prototype._makeRequest = function (opts, callback) {
return this.transporter.request(opts, callback);
};
/**
* Allows inheriting classes to inspect and alter the request result.
* @param {object} err Error result.
* @param {object} result The result.
* @param {object} result The HTTP response.
* @param {Function} callback The callback.
* @private
*/
OAuth2Client.prototype.postRequest = function (err, result, response, callback) {
callback(err, result, response);
};
/**
* Verify id token is token by checking the certs and audience
* @param {string} idToken ID Token.
* @param {(string|Array.<string>)} audience The audience to verify against the ID Token
* @param {function=} callback Callback supplying GoogleLogin if successful
*/
OAuth2Client.prototype.verifyIdToken = function (idToken, audience, callback) {
var _this = this;
if (!idToken || !callback) {
throw new Error('The verifyIdToken method requires both ' +
'an ID Token and a callback method');
}
this.getFederatedSignonCerts((function (err, certs) {
if (err) {
callback(err, null);
}
var login;
try {
login = _this.verifySignedJwtWithCerts(idToken, certs, audience, OAuth2Client.ISSUERS_);
}
catch (err) {
callback(err);
return;
}
callback(null, login);
}).bind(this));
};
/**
* Gets federated sign-on certificates to use for verifying identity tokens.
* Returns certs as array structure, where keys are key ids, and values
* are PEM encoded certificates.
* @param {function=} callback Callback supplying the certificates
*/
OAuth2Client.prototype.getFederatedSignonCerts = function (callback) {
var _this = this;
var nowTime = (new Date()).getTime();
if (this._certificateExpiry &&
(nowTime < this._certificateExpiry.getTime())) {
callback(null, this._certificateCache);
return;
}
this.transporter.request({
method: 'GET',
uri: OAuth2Client.GOOGLE_OAUTH2_FEDERATED_SIGNON_CERTS_URL_,
json: true
}, function (err, body, response) {
if (err) {
callback(new transporters_1.RequestError('Failed to retrieve verification certificates: ' + err), null, response);
return;
}
var cacheControl = response.headers['cache-control'];
var cacheAge = -1;
if (cacheControl) {
var pattern = new RegExp('max-age=([0-9]*)');
var regexResult = pattern.exec(cacheControl);
if (regexResult.length === 2) {
// Cache results with max-age (in seconds)
cacheAge = Number(regexResult[1]) * 1000; // milliseconds
}
}
var now = new Date();
_this._certificateExpiry =
cacheAge === -1 ? null : new Date(now.getTime() + cacheAge);
_this._certificateCache = body;
callback(null, body, response);
});
};
/**
* Verify the id token is signed with the correct certificate
* and is from the correct audience.
* @param {string} jwt The jwt to verify (The ID Token in this case).
* @param {array} certs The array of certs to test the jwt against.
* @param {(string|Array.<string>)} requiredAudience The audience to test the jwt against.
* @param {array} issuers The allowed issuers of the jwt (Optional).
* @param {string} maxExpiry The max expiry the certificate can be (Optional).
* @return {LoginTicket} Returns a LoginTicket on verification.
*/
OAuth2Client.prototype.verifySignedJwtWithCerts = function (jwt, certs, requiredAudience, issuers, maxExpiry) {
if (!maxExpiry) {
maxExpiry = OAuth2Client.MAX_TOKEN_LIFETIME_SECS_;
}
var segments = jwt.split('.');
if (segments.length !== 3) {
throw new Error('Wrong number of segments in token: ' + jwt);
}
var signed = segments[0] + '.' + segments[1];
var signature = segments[2];
var envelope;
var payload;
try {
envelope = JSON.parse(this.decodeBase64(segments[0]));
}
catch (err) {
throw new Error('Can\'t parse token envelope: ' + segments[0]);
}
if (!envelope) {
throw new Error('Can\'t parse token envelope: ' + segments[0]);
}
try {
payload = JSON.parse(this.decodeBase64(segments[1]));
}
catch (err) {
throw new Error('Can\'t parse token payload: ' + segments[0]);
}
if (!payload) {
throw new Error('Can\'t parse token payload: ' + segments[1]);
}
if (!certs.hasOwnProperty(envelope.kid)) {
// If this is not present, then there's no reason to attempt verification
throw new Error('No pem found for envelope: ' + JSON.stringify(envelope));
}
var pem = certs[envelope.kid];
var pemVerifier = new pemverifier_1.PemVerifier();
var verified = pemVerifier.verify(pem, signed, signature, 'base64');
if (!verified) {
throw new Error('Invalid token signature: ' + jwt);
}
if (!payload.iat) {
throw new Error('No issue time in token: ' + JSON.stringify(payload));
}
if (!payload.exp) {
throw new Error('No expiration time in token: ' + JSON.stringify(payload));
}
var iat = parseInt(payload.iat, 10);
var exp = parseInt(payload.exp, 10);
var now = new Date().getTime() / 1000;
if (exp >= now + maxExpiry) {
throw new Error('Expiration time too far in future: ' + JSON.stringify(payload));
}
var earliest = iat - OAuth2Client.CLOCK_SKEW_SECS_;
var latest = exp + OAuth2Client.CLOCK_SKEW_SECS_;
if (now < earliest) {
throw new Error('Token used too early, ' + now + ' < ' + earliest + ': ' +
JSON.stringify(payload));
}
if (now > latest) {
throw new Error('Token used too late, ' + now + ' > ' + latest + ': ' +
JSON.stringify(payload));
}
if (issuers && issuers.indexOf(payload.iss) < 0) {
throw new Error('Invalid issuer, expected one of [' + issuers + '], but got ' +
payload.iss);
}
// Check the audience matches if we have one
if (typeof requiredAudience !== 'undefined' && requiredAudience !== null) {
var aud = payload.aud;
var audVerified = false;
// If the requiredAudience is an array, check if it contains token
// audience
if (requiredAudience.constructor === Array) {
audVerified = (requiredAudience.indexOf(aud) > -1);
}
else {
audVerified = (aud === requiredAudience);
}
if (!audVerified) {
throw new Error('Wrong recipient, payload audience != requiredAudience');
}
}
return new loginticket_1.LoginTicket(envelope, payload);
};
/**
* This is a utils method to decode a base64 string
* @param {string} b64String The string to base64 decode
* @return {string} The decoded string
*/
OAuth2Client.prototype.decodeBase64 = function (b64String) {
var buffer = new Buffer(b64String, 'base64');
return buffer.toString('utf8');
};
/**
* The base URL for auth endpoints.
*/
OAuth2Client.GOOGLE_OAUTH2_AUTH_BASE_URL_ = 'https://accounts.google.com/o/oauth2/auth';
/**
* The base endpoint for token retrieval.
*/
OAuth2Client.GOOGLE_OAUTH2_TOKEN_URL_ = 'https://accounts.google.com/o/oauth2/token';
/**
* The base endpoint to revoke tokens.
*/
OAuth2Client.GOOGLE_OAUTH2_REVOKE_URL_ = 'https://accounts.google.com/o/oauth2/revoke';
/**
* Google Sign on certificates.
*/
OAuth2Client.GOOGLE_OAUTH2_FEDERATED_SIGNON_CERTS_URL_ = 'https://www.googleapis.com/oauth2/v1/certs';
/**
* Clock skew - five minutes in seconds
*/
OAuth2Client.CLOCK_SKEW_SECS_ = 300;
/**
* Max Token Lifetime is one day in seconds
*/
OAuth2Client.MAX_TOKEN_LIFETIME_SECS_ = 86400;
/**
* The allowed oauth token issuers.
*/
OAuth2Client.ISSUERS_ = ['accounts.google.com', 'https://accounts.google.com'];
return OAuth2Client;
}(authclient_1.AuthClient));
exports.OAuth2Client = OAuth2Client;
//# sourceMappingURL=oauth2client.js.map