initial

2026-07-15 14:09:28 +02:00
commit 3e5348b7ec
104 changed files with 30367 additions and 0 deletions
--- a/apps/api/src/oidc/oidc-interaction.controller.ts
+++ b/apps/api/src/oidc/oidc-interaction.controller.ts
@@ -0,0 +1,109 @@
+import { Body, Controller, Get, Param, Post, Req, Res } from '@nestjs/common';
+import { Request, Response } from 'express';
+import { OidcProviderService } from './oidc-provider.service';
+
+@Controller('interaction')
+export class OidcInteractionController {
+  constructor(private readonly oidc: OidcProviderService) {}
+
+  @Get(':uid')
+  async view(@Param('uid') uid: string, @Req() request: Request, @Res() response: Response) {
+    const details = await this.oidc.interactionDetails(request, response);
+    if (details.uid !== uid) {
+      response.status(400).send(this.page('Ungueltige Anfrage', '<p>Die OIDC-Interaktion ist ungueltig.</p>'));
+      return;
+    }
+
+    if (details.prompt.name === 'login') {
+      response.send(
+        this.page(
+          'Anmelden',
+          `
+            <form method="post" action="/interaction/${encodeURIComponent(uid)}/login">
+              <label>Benutzername <input name="username" autocomplete="username" required></label>
+              <label>Passwort <input name="password" type="password" autocomplete="current-password" required></label>
+              <button type="submit">Anmelden</button>
+            </form>
+            <form method="post" action="/interaction/${encodeURIComponent(uid)}/abort">
+              <button class="secondary" type="submit">Abbrechen</button>
+            </form>
+          `,
+        ),
+      );
+      return;
+    }
+
+    if (details.prompt.name === 'consent') {
+      response.send(
+        this.page(
+          'Zugriff erlauben',
+          `
+            <p>Client <strong>${this.escape(String(details.params.client_id ?? ''))}</strong> moechte Zugriff auf folgende Scopes:</p>
+            <p class="scopes">${this.escape(String(details.params.scope ?? 'openid'))}</p>
+            <form method="post" action="/interaction/${encodeURIComponent(uid)}/confirm">
+              <button type="submit">Erlauben</button>
+            </form>
+            <form method="post" action="/interaction/${encodeURIComponent(uid)}/abort">
+              <button class="secondary" type="submit">Ablehnen</button>
+            </form>
+          `,
+        ),
+      );
+      return;
+    }
+
+    response.status(400).send(this.page('OIDC', '<p>Diese Interaktion wird noch nicht unterstuetzt.</p>'));
+  }
+
+  @Post(':uid/login')
+  async login(
+    @Param('uid') uid: string,
+    @Body() body: { username?: string; password?: string },
+    @Req() request: Request,
+    @Res() response: Response,
+  ) {
+    await this.oidc.finishLogin(request, response, uid, body.username ?? '', body.password ?? '');
+  }
+
+  @Post(':uid/confirm')
+  async confirm(@Param('uid') uid: string, @Req() request: Request, @Res() response: Response) {
+    await this.oidc.finishConsent(request, response, uid);
+  }
+
+  @Post(':uid/abort')
+  async abort(@Req() request: Request, @Res() response: Response) {
+    await this.oidc.abortInteraction(request, response);
+  }
+
+  private page(title: string, body: string): string {
+    return `<!doctype html>
+      <html lang="de">
+        <head>
+          <meta charset="utf-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1">
+          <title>${this.escape(title)} - LDAP Portal</title>
+          <style>
+            body { background: #f5f7f9; color: #18202a; font-family: Inter, system-ui, sans-serif; margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 20px; }
+            main { background: white; border: 1px solid #d8e0e7; border-radius: 8px; box-shadow: 0 16px 40px rgb(24 32 42 / 8%); max-width: 420px; padding: 28px; width: 100%; }
+            h1 { font-size: 1.45rem; margin: 0 0 22px; }
+            form { display: grid; gap: 16px; margin-top: 16px; }
+            label { display: grid; gap: 7px; font-weight: 700; }
+            input { border: 1px solid #bcc8d3; border-radius: 6px; font: inherit; min-height: 44px; padding: 10px 12px; }
+            button { background: #0f6b6e; border: 1px solid #0f6b6e; border-radius: 6px; color: white; cursor: pointer; font: inherit; font-weight: 700; min-height: 44px; padding: 10px 14px; }
+            button.secondary { background: white; color: #0f6b6e; }
+            .scopes { background: #edf2f5; border-radius: 6px; padding: 10px; word-break: break-word; }
+          </style>
+        </head>
+        <body><main><h1>${this.escape(title)}</h1>${body}</main></body>
+      </html>`;
+  }
+
+  private escape(value: string): string {
+    return value
+      .replaceAll('&', '&amp;')
+      .replaceAll('<', '&lt;')
+      .replaceAll('>', '&gt;')
+      .replaceAll('"', '&quot;')
+      .replaceAll("'", '&#039;');
+  }
+}