functions/package.json
...
"dependencies": {
"dotenv": "8.6.0",
"dialogflow": "1.2.0",
"express": "4.18.1",
"firebase-admin": "8.13.0",
"firebase-functions": "3.22.0",
"grant-express": "5.4.8",
"jose": "2.0.5",
"node-fetch": "2.6.7",
"oidc-provider": "6.31.1",
"validator": "13.7.0"
},
"devDependencies": {
"firebase-functions-test": "0.3.3"
},
...
firebase.json
...
"hosting": {
"rewrites": [
{
"source": "**",
"function": "app"
}
]
},
...
functions/lib/oidc.js
const Provider = require('oidc-provider');
const { JWKS } = require('jose');
const Account = require('../models/account');
const FirestoreAdapter = require('../adapters/firestore.js');
const admin = require('../services/admin.js');
const db = admin.firestore();
/**
* @returns {Promise<Provider>}
*/
module.exports = async () => {
const {
interactionPolicy: { base: policy },
} = Provider;
const keystore = new JWKS.KeyStore();
await Promise.all([
keystore.generate('RSA', undefined, { use: 'sig' }),
keystore.generate('EC', undefined, { key_ops: ['sign', 'verify'] }),
]);
const querySnapshot = await db.collection('clients').get();
const configuration = {
get clients () {
let clients = [];
querySnapshot.forEach((doc) => {
if (doc.id) {
const data = doc.data();
// насыщаем редирект текущим урлом сервера
data.redirect_uris.unshift(process.env.SERVER_HOST + '/' + process.env.SERVER_PREFIX + '/oidcallback?client_id=tg'); // todo поменять client_id на любой ваш
clients.push(data);
}
});
return clients;
},
get jwks() {
return keystore.toJWKS(true);
},
// This interface is required by oidc-provider
findAccount: Account.findAccount,
// hack https://github.com/panva/node-oidc-provider/blob/master/docs/README.md#id-token-does-not-include-claims-other-than-sub
conformIdTokenClaims: false,
claims: {
email: ['email', 'email_verified'],
profile: ['locale', 'client_id', 'name', 'updated_at', 'zoneinfo'],
},
features: {
clientCredentials: { enabled: true },
introspection: { enabled: true },
revocation: { enabled: true },
registration: { initialAccessToken: true },
requestObjects: { request: true },
encryption: { enabled: true },
jwtIntrospection: { enabled: true },
jwtResponseModes: { enabled: true },
devInteractions: { enabled: false },
},
interactions: {
get policy() {
// copies the default policy, already has login and consent prompt policies
const interactions = policy();
return interactions;
},
url(context) {
return '/' + process.env.SERVER_PREFIX + `/interaction/${context.oidc.uid}`;
},
},
format: { default: 'opaque' },
ttl: {
AccessToken: 1 * 60 * 60, // 1 hour in seconds
AuthorizationCode: 10 * 60, // 10 minutes in seconds
IdToken: 1 * 60 * 60, // 1 hour in seconds
RefreshToken: 1 * 24 * 60 * 60, // 1 day in seconds
},
};
const provider = new Provider(process.env.SERVER_HOST, {
adapter: FirestoreAdapter,
...configuration,
});
// if (IS_PRODUCTION) {
// provider.proxy = true;
// provider.keys = SECURE_KEY.split(',');
// }
return provider;
};
functions/adapters/firestore.js
/*
* Setup firebase-admin for use in nodejs
* 1- Add the firebase-admin npm package.
* 2- Go to https://console.firebase.google.com/ and create a project if you do not have an existing one.
* 3- Get the secret from https://console.firebase.google.com/u/0/project/{PROJECT_ID}/settings/serviceaccounts/adminsdk.
* 4- Set GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the JSON file.
* 5- import the library using`import * as admin from 'firebase-admin'` in the server file.
* 6- Call `admin.initializeApp()` in the server file to establish the connection.
*
* Reach out to @hadyrashwan <https://github.com/hadyrashwan> for questions on this community example.
*/
const admin = require('../services/admin.js');
const undefinedFirestoreValue = 'custom.type.firestore'; // A work around as firestore does not support undefined.
const namePrefix = 'oidc_library';
const db = admin.firestore();
/**
* Use the library with Google's Firestore database
*
* @class FirestoreAdapter
*/
class FirestoreAdapter {
constructor(name) {
this.name = `${namePrefix}_${name.split(' ').join('_')}`;
}
async upsert(id, payload, expiresIn) {
let expiresAt;
if (expiresIn) {
expiresAt = new Date(Date.now() + expiresIn * 1000);
}
await db
.collection(this.name)
.doc(id)
.set(
{
payload: this.updateNestedObject(payload, undefined, undefinedFirestoreValue),
...(expiresAt ? { expiresAt } : null),
},
{ merge: true },
);
}
async find(id) {
const response = await db.collection(this.name).doc(id).get();
if (!response.exists) {
return undefined;
}
const data = response.data();
return this.updateNestedObject(data.payload, undefinedFirestoreValue, undefined);
}
async findByUserCode(userCode) {
const response = await db
.collection(this.name)
.where('payload.userCode', '==', userCode)
.limit(1)
.get();
if (response.empty) {
return undefined;
}
const data = response[0].data();
return this.updateNestedObject(data.payload, undefinedFirestoreValue, undefined);
}
async findByUid(uid) {
const response = await db.collection(this.name).where('payload.uid', '==', uid).limit(1).get();
if (response.empty) {
return undefined;
}
const data = response.docs[0].data();
return this.updateNestedObject(data.payload, undefinedFirestoreValue, undefined);
}
async destroy(id) {
await db.collection(this.name).doc(id).delete();
}
async revokeByGrantId(grantId) {
const response = await db.collection(this.name).where('payload.grantId', '==', grantId).get();
if (response.empty) {
return;
}
const batch = db.batch();
response.docs.forEach((doc) => batch.delete(db.collection(this.name).doc(doc.id).delete()));
await batch.commit();
}
async consume(id) {
const response = await db.collection(this.name).doc(id).get();
if (!response.exists) {
return;
}
const payload = response.data();
payload.consumed = Math.floor(Date.now() / 1000);
await db.collection(this.name).doc(id).update(payload);
}
/**
* Replace a value in the object with another value
*
* @private
* @param {object} internalObject
* @param {(string | undefined)} value
* @param {(string | undefined)} toReplaceValue
* @returns
* @memberof FirestoreAdapter
*/
updateNestedObject(object, value, toReplaceValue) {
const internalObject = Array.isArray(object) ? object : { ...object }; // avoid mutation
const keys = Object.keys(internalObject);
for (let index = 0; index < keys.length;) {
const key = keys[index];
if (Object.prototype.hasOwnProperty.call(internalObject, key)) {
if (internalObject[key] === value) {
internalObject[key] = toReplaceValue;
}
if (typeof internalObject[key] === 'object') {
// Recursion
internalObject[key] = this.updateNestedObject(internalObject[key], value, toReplaceValue);
}
}
index += 1;
}
return internalObject;
}
}
module.exports = FirestoreAdapter;
functions/index.js
const functions = require('firebase-functions');
const express = require('express');
const app = express();
const router = express.Router();
const provider = require('./lib/oidc')
const OidcController = require('./controllers/oidc')
// oidc
(async function() {
const oidcProvider = await provider();
const { constructor: { errors: { SessionNotFound } } } = oidcProvider;
// OpenID Connect server
const oidc = new OidcController(oidcProvider);
router.get('/oidcallback', oidc.oidcallback.bind(oidc));
router.get('/interaction/:uid', setNoCache, oidc.interactionUID.bind(oidc));
router.post(
'/interaction/:uid/login',
setNoCache,
body,
oidc.interactionLogin.bind(oidc)
);
router.post(
'/interaction/:uid/continue',
setNoCache,
body,
oidc.interactionContinue.bind(oidc)
);
router.post(
'/interaction/:uid/confirm',
setNoCache,
body,
oidc.interactionConfirm.bind(oidc)
);
router.get(
'/interaction/:uid/abort',
setNoCache,
oidc.interactionAbort.bind(oidc)
);
oidcRouter.use((err, req, res, next) => {
if (err instanceof SessionNotFound) {
// handle interaction expired / session not found error
}
next(err);
});
app.use('/oidc/', oidcRouter);
app.use(router);
app.use(oidcProvider.callback);
})();
exports.app = functions.https.onRequest(app);
functions/views/oidc/interaction.login.js
module.exports = ({ uid, clientId }) => {
return `
<h1>${clientId}</h1>
<form autocomplete="off" action="/${process.env.SERVER_PREFIX}/interaction/${uid}/login" method="post">
<input required type="email" name="email" placeholder="Enter email" autofocus="on">
<input required type="password" name="password" placeholder="and password">
<button type="submit">Sign-in</button>
</form>
<div>
<a href="/${process.env.SERVER_PREFIX}/interaction/${uid}/abort">[ Abort ]</a>
</div>
`
}
functions/views/oidc/interaction.consept.js
module.exports = ({ uid, details }) => {
return `
<ul>
${details.scopes.new.map((scope) => {
return `<li>${scope}</li>`;
})}
</ul>
<form autocomplete="off" action="/${process.env.SERVER_PREFIX}/interaction/${uid}/confirm" method="post">
<button autofocus type="submit">Continue</button>
</form>
<div>
<a href="/${process.env.SERVER_PREFIX}/interaction/${uid}/abort">[ Abort ]</a>
</div>
`;
};
functions/models/account.js
const store = new Map();
class Account {
constructor(id) {
this.accountId = id;
store.set(this.accountId, this);
}
// todo использовать scope и use для выборки
// todo переделать под private API
async claims(/* use, scope */) {
// example
return {
sub: this.accountId, // it is essential to always return a sub claim
email: '[email protected]', // email
email_verified: true, // email verified
client_id: '3555d074-b52b-4703-a8c4-96ad9edf43e9', // example client_id GUID
updated_at: '2020-04-16 11:46:25.689329', // time
};
}
/**
* Получение аккаунта и запись в стор
*
* @param {*} context - context
* @param {*} id - id
* @returns {Promise<any>}
*/
static findAccount(context, id) {
// find account
return new Promise((resolve) => {
// token is a reference to the token used for which a given account is being loaded,
// it is undefined in scenarios where account claims are returned from authorization endpoint
if (!store.get(id)) {
new Account(id);
}
const out = store.get(id);
resolve(out);
});
}
}
module.exports = Account;
functions/controllers/oidc.js
const jose = require('jose');
const e = require('express');
const fetch = require('node-fetch');
const Account = require('../models/account')
class OIDC {
constructor(provider) {
this.oidc = provider;
}
/**
* @description callback должен выполняться на ассистенте и записывать JWT в свою БД
* @param {e.Request} request - request
* @param {e.Response} response - response
* @returns {Promise<void>}
*/
async oidcallback(request, response) {
try {
if (request.error) {
throw new Error(request.error);
}
if (request.query.error) {
throw new Error(
request.query.error + '\n' + request.query.error_description,
);
}
const res = await fetch(process.env.SERVER_HOST + '/' + process.env.SERVER_PREFIX + '/token', {
method: 'POST',
body: new URLSearchParams({
'client_id': request.query.client_id,
'client_secret': 'foobar',
'code': request.query.code,
'grant_type': 'authorization_code',
'redirect_uri': process.env.SERVER_HOST + '/' + process.env.SERVER_PREFIX + `/oidcallback?client_id=${request.query.client_id}`,
}),
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
'Cache-Control': 'no-cache',
},
});
const tokenResult = await res.json();
const decoded = jose.JWT.decode(tokenResult.id_token);
request.session.passportId = decoded.client_id;
response.send(
`Aud: ${decoded.aud} ; Email: ${decoded.email}.`,
);
} catch (error) {
response.status(400).json({ error: error.message });
}
}
/**
* @see https://github.com/panva/node-oidc-provider/blob/master/example/routes/express.js
* @param {e.Request} request - request
* @param {e.Response} response - response
* @returns {any}
*/
async interactionUID(request, response) {
try {
const details = await this.oidc.interactionDetails(request, response);
const { uid, prompt, params, session } = details;
// eslint-disable-next-line unicorn/no-fn-reference-in-iterator
const client = await this.oidc.Client.find(params.client_id);
switch (prompt.name) {
case 'select_account': {
if (!session) {
return this.oidc.interactionFinished(
request,
response,
{ select_account: {} },
{ mergeWithLastSubmission: false },
);
}
const account = await Account.findAccount(
undefined,
session.accountId,
);
const { email } = await account.claims(
'prompt',
'email',
{ email: null },
[],
);
return response.render('select_account', {
client,
uid,
email,
details: prompt.details,
params,
title: 'Sign-in',
session: session ? session : undefined,
dbg: {
params: params,
prompt: prompt,
},
});
}
case 'login': {
const interactionLoginView = require('../views/oidc/interaction.login.js');
response.send(interactionLoginView({
uid,
clientId: client.clientId
}));
break;
}
case 'consent': {
const interactionConsentView = require('../views/oidc/interaction.consent.js');
response.send(interactionConsentView({
uid,
details: prompt.details,
}));
break;
}
default: {
return;
}
}
} catch (error) {
response.status(400).json({ error: error.message });
}
}
/**
* @description authenticate
* @param {e.Request} request - request
* @param {e.Response} response -> response
*/
async interactionLogin(request, response) {
try {
const {
prompt: { name },
} = await this.oidc.interactionDetails(request, response);
console.log('name: ' + name);
const result = {
select_account: {}, // make sure its skipped by the interaction policy since we just logged in
login: {
account: '3555d074-b52b-4703-a8c4-96ad9edf43e9',
},
};
await this.oidc.interactionFinished(request, response, result, {
mergeWithLastSubmission: false,
});
} catch (error) {
response.status(400).json({ error: error.message });
}
}
/**
* @param {e.Request} request - request
* @param {e.Response} response - response
*/
async interactionContinue(request, response) {
try {
const interaction = await this.oidc.interactionDetails(request, response);
if (request.body.switch) {
if (interaction.params.prompt) {
const prompts = new Set(interaction.params.prompt.split(' '));
prompts.add('login');
interaction.params.prompt = [...prompts].join(' ');
} else {
interaction.params.prompt = 'logout';
}
await interaction.save();
}
const result = { select_account: {} };
await this.oidc.interactionFinished(request, response, result, {
mergeWithLastSubmission: false,
});
} catch (error) {
response.status(400).json({ error: error.message });
}
}
/**
* @param {e.Request} request - request
* @param {e.Response} response - response
*/
async interactionConfirm(request, response) {
try {
await this.oidc.interactionFinished(
request,
response,
{
consent: {
rejectedScopes: [], // < uncomment and add rejections here
rejectedClaims: [], // < uncomment and add rejections here
},
},
{
mergeWithLastSubmission: true,
},
);
} catch (error) {
response.status(400).json({ error: error.message });
}
}
/**
* @param {e.Request} request - request
* @param {e.Response} response - response
*/
async interactionAbort(request, response) {
try {
const result = {
error: 'access_denied',
error_description: 'End-User aborted interaction',
};
await this.oidc.interactionFinished(request, response, result, {
mergeWithLastSubmission: false,
});
} catch (error) {
response.status(400).json({ error: error.message });
}
}
}
module.exports = OIDC;
functions/middlewares/no-cache.js
const setNoCache = (request, response, next) => {
response.set('Pragma', 'no-cache');
response.set('Cache-Control', 'no-cache, no-store');
next();
}
module.exports = setNoCache;