Method validateAndCreateSession

lib/models/oidc.ts:108–209

(request: Request)

  }

  static async validateAndCreateSession(request: Request) {
    const urlSearchParams = new URL(request.url).searchParams;
    const state = urlSearchParams.get('state');

    if (!state) {
      throw new Error('Missing OIDC "state" parameter');
    }

    const oidcStateCache = new SimpleCache(`oidc:state:${state}`);

    let expectedState: string;
    let expectedCodeVerifier: string;

    try {
      const cacheValue = await oidcStateCache.get();

      const { state, codeVerifier } = JSON.parse(cacheValue) as {
        state: OidcExtraState;
        codeVerifier: string;
      };

      expectedState = btoa(JSON.stringify(state));
      expectedCodeVerifier = codeVerifier;
    } catch (error) {
      console.log(`Failed to verify/parse OIDC code: ${error}`);
      console.error(error);

      throw new Error('Invalid OIDC code');
    }

    const config = await AppConfig.getConfig();

    const baseUrl = config.auth.baseUrl;
    const oidcBaseUrl = config.auth.singleSignOnUrl;
    const emailAttribute = config.auth.singleSignOnEmailAttribute;
    const oidcOptions = oidcBaseUrl.startsWith('http://')
      ? { execute: [openIdClient.allowInsecureRequests] }
      : undefined;

    const oidcConfig = await openIdClient.discovery(
      new URL(oidcBaseUrl),
      OIDC_CLIENT_ID,
      OIDC_CLIENT_SECRET,
      undefined,
      oidcOptions,
    );

    const tokens = await openIdClient.authorizationCodeGrant(
      oidcConfig,
      new URL(`${baseUrl}${redirectUrlPath}?${urlSearchParams.toString()}`),
      {
        pkceCodeVerifier: expectedCodeVerifier,
        expectedState,
      },
    );

    const oidcParams = this.decodeJwt(tokens.id_token!);