whodis-react-storage-browser/dist/logic/queryparams/loadAntiCsrfTokenFromQueryParamsIfNeeded.js

React hooks and components for secure, best practices authentication in seconds

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.loadAntiCsrfTokenFromQueryParamsIfNeeded = void 0;
const url_fns_1 = require("url-fns");
const getCurrentUrl_1 = require("../env/getCurrentUrl");
const isServerSideRendering_1 = require("../env/isServerSideRendering");
const setCurrentUrl_1 = require("../env/setCurrentUrl");
const setTokenToStorage_1 = require("../storage/setTokenToStorage");
const EXPECTED_ANTICSRFTOKEN_QUERY_PARAMETER_KEY = 'acsrft'; // https://github.com/whodisio/svc-gateway/blob/bb0221d049d6d979adb4f9c3710e291fbd42f75c/src/contract/handlers/oidc/oidcGoogleRedirect.ts#L58
/**
 * tactic: load anti-csrf-token defined in query params, if needed
 * context:
 * - some auth methods, e.g. oidc redirect, return the anti-csrf-token via query params rather than in the body of a payload
 * - in these situations, we must load the anti-csrf-token into local storage before attempting to use it
 * strategy:
 * - detect whether an anti-csrf-token was returned via query params
 * - load the token from query params into local storage if needed
 * - replace the url history to cleanup the url and prevent endless invocation
 */
const loadAntiCsrfTokenFromQueryParamsIfNeeded = () => {
    var _a;
    // if on server side, this is should not have been called
    if ((0, isServerSideRendering_1.isServerSideRendering)())
        throw new Error('should not have attempted to load anti-csrf-token from queryparams on serverside');
    // otherwise, detect whether the current url has an anti-csrf-token defined
    const urlCurrent = (0, getCurrentUrl_1.getCurrentUrl)();
    const antiCsrfTokenFound = (_a = (0, url_fns_1.parseUrl)(urlCurrent).queryParams[EXPECTED_ANTICSRFTOKEN_QUERY_PARAMETER_KEY]) !== null && _a !== void 0 ? _a : null;
    if (!antiCsrfTokenFound)
        return;
    // if there was one found, set it into storage
    (0, setTokenToStorage_1.setTokenToStorage)({ token: antiCsrfTokenFound }); // TODO: set into storage only if it is newer than the one already in storage
    // and wipe it from the existing url
    (0, setCurrentUrl_1.setCurrentUrl)({
        method: 'replace',
        to: (0, url_fns_1.updateUrl)({
            from: urlCurrent,
            with: {
                queryParams: {
                    [EXPECTED_ANTICSRFTOKEN_QUERY_PARAMETER_KEY]: undefined,
                },
            },
        }),
    });
};
exports.loadAntiCsrfTokenFromQueryParamsIfNeeded = loadAntiCsrfTokenFromQueryParamsIfNeeded;
//# sourceMappingURL=loadAntiCsrfTokenFromQueryParamsIfNeeded.js.map