@@ -6,7 +6,9 @@ import { IUser } from '../identity/domain/repositories/user.interface';
|
||||
import { PrismaService } from '../../shared/prisma.service';
|
||||
import { RedisPkceStore } from './pkce/redis-pkce.store';
|
||||
import { InMemoryRefreshStore } from './refresh/inmemory-refresh.store';
|
||||
import { Issuer, generators, Client, TokenSet } from 'openid-client';
|
||||
// dynamic require to avoid TypeScript typing issues with installed openid-client
|
||||
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
||||
const OpenIDClient = require('openid-client');
|
||||
import crypto from 'crypto';
|
||||
|
||||
const logger = new Logger('AuthService');
|
||||
@@ -23,14 +25,14 @@ export class AuthService {
|
||||
private readonly refreshStore: InMemoryRefreshStore,
|
||||
) {}
|
||||
|
||||
private issuer: Issuer<Client> | null = null;
|
||||
private client: Client | null = null;
|
||||
private issuer: any | null = null;
|
||||
private client: any | null = null;
|
||||
|
||||
private async getIssuer() {
|
||||
if (this.issuer) return this.issuer;
|
||||
const issuerUrl = this.config.get<string>('AUTHENTIK_ISSUER');
|
||||
if (!issuerUrl) throw new Error('AUTHENTIK_ISSUER not configured');
|
||||
this.issuer = await Issuer.discover(issuerUrl);
|
||||
this.issuer = await OpenIDClient.Issuer.discover(issuerUrl);
|
||||
return this.issuer;
|
||||
}
|
||||
|
||||
@@ -53,9 +55,9 @@ export class AuthService {
|
||||
}
|
||||
|
||||
const state = crypto.randomUUID();
|
||||
const code_verifier = generators.codeVerifier();
|
||||
const code_challenge = await generators.codeChallenge(code_verifier);
|
||||
const nonce = generators.nonce();
|
||||
const code_verifier = OpenIDClient.generators.codeVerifier();
|
||||
const code_challenge = await OpenIDClient.generators.codeChallenge(code_verifier);
|
||||
const nonce = OpenIDClient.generators.nonce();
|
||||
|
||||
// save PKCE session keyed by state
|
||||
await this.pkceStore.save(state, { code_verifier, nonce, returnTo }, 300);
|
||||
@@ -84,7 +86,7 @@ export class AuthService {
|
||||
if (!redirectUri) throw new Error('AUTHENTIK_REDIRECT_URI is not configured');
|
||||
|
||||
// Exchange code for tokens. Provide explicit checks: state, nonce and code_verifier.
|
||||
let tokenSet: TokenSet;
|
||||
let tokenSet: any;
|
||||
try {
|
||||
tokenSet = await client.callback(
|
||||
redirectUri,
|
||||
|
||||
Reference in New Issue
Block a user