Method getSignInUrl

lib/models/oidc.ts:27–84

(
    {
      requestPermissions,
      extraState = {},
    }: {
      requestPermissions: string[];
      extraState?: OidcExtraState;
    },
  )

export class OidcModel {
  static async getSignInUrl(
    {
      requestPermissions,
      extraState = {},
    }: {
      requestPermissions: string[];
      extraState?: OidcExtraState;
    },
  ): Promise<string> {
    const state = {
      ...extraState,
      random: generateRandomCode(8),
    };

    const config = await AppConfig.getConfig();

    const baseUrl = config.auth.baseUrl;
    const oidcBaseUrl = config.auth.singleSignOnUrl;
    const oidcOptions = oidcBaseUrl.startsWith('http://')
      ? { execute: [openIdClient.allowInsecureRequests] }
      : undefined;

    try {
      const oidcConfig = await openIdClient.discovery(
        new URL(oidcBaseUrl),
        OIDC_CLIENT_ID,
        OIDC_CLIENT_SECRET,
        undefined,
        oidcOptions,
      );

      const redirectUrl = `${baseUrl}${redirectUrlPath}`;

      const codeVerifier = openIdClient.randomPKCECodeVerifier();

      const params = {
        client_id: OIDC_CLIENT_ID,
        redirect_uri: redirectUrl,
        state: btoa(JSON.stringify(state)),
        scope: requestPermissions.join(' '),
        code_challenge: await openIdClient.calculatePKCECodeChallenge(codeVerifier),
        code_challenge_method: 'S256',
      };

      const oidcStateCache = new SimpleCache(`oidc:state:${params.state}`);

      await oidcStateCache.set(JSON.stringify({ state, codeVerifier }));

      const oidcUrl = openIdClient.buildAuthorizationUrl(oidcConfig, params);

      return oidcUrl.href;
    } catch (error) {
      console.log(`Failed to get OIDC sign in URL: ${error}`);
      console.error(error);

      return '';
    }
  }