198 lines
8.3 KiB
TypeScript
198 lines
8.3 KiB
TypeScript
import { Body, Controller, Get, Param, Post, Req, Res, UnauthorizedException } from '@nestjs/common';
|
|
import { ConfigService } from '@nestjs/config';
|
|
import { Request, Response } from 'express';
|
|
import type { Interaction } from 'oidc-provider';
|
|
import { OidcProviderService } from './oidc-provider.service';
|
|
|
|
@Controller('interaction')
|
|
export class OidcInteractionController {
|
|
constructor(
|
|
private readonly oidc: OidcProviderService,
|
|
private readonly config: ConfigService,
|
|
) {}
|
|
|
|
@Get(':uid')
|
|
async view(@Param('uid') uid: string, @Req() request: Request, @Res() response: Response) {
|
|
const details = await this.oidc.interactionDetails(request, response);
|
|
if (details.uid !== uid) {
|
|
response.status(400).send(this.page('Ungueltige Anfrage', '<p>Die OIDC-Interaktion ist ungueltig.</p>'));
|
|
return;
|
|
}
|
|
|
|
if (details.prompt.name === 'login') {
|
|
response.send(this.page('Anmelden', this.loginForm(uid)));
|
|
return;
|
|
}
|
|
|
|
if (details.prompt.name === 'consent') {
|
|
const clientId = String(details.params.client_id ?? '');
|
|
if (clientId && (await this.oidc.isFirstPartyClient(clientId))) {
|
|
await this.oidc.finishConsent(request, response, uid, { autoGranted: true });
|
|
return;
|
|
}
|
|
|
|
response.send(this.page('Zugriff erlauben', this.consentView(uid, details)));
|
|
return;
|
|
}
|
|
|
|
response.status(400).send(this.page('OIDC', '<p>Diese Interaktion wird noch nicht unterstuetzt.</p>'));
|
|
}
|
|
|
|
@Post(':uid/login')
|
|
async login(
|
|
@Param('uid') uid: string,
|
|
@Body() body: { username?: string; password?: string },
|
|
@Req() request: Request,
|
|
@Res() response: Response,
|
|
) {
|
|
const username = body.username ?? '';
|
|
try {
|
|
await this.oidc.finishLogin(request, response, uid, username, body.password ?? '');
|
|
} catch (error) {
|
|
if (this.isInvalidCredentialsError(error)) {
|
|
response
|
|
.status(401)
|
|
.send(this.page('Anmelden', this.loginForm(uid, username, 'Ungueltige Zugangsdaten.')));
|
|
return;
|
|
}
|
|
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
@Post(':uid/confirm')
|
|
async confirm(@Param('uid') uid: string, @Req() request: Request, @Res() response: Response) {
|
|
await this.oidc.finishConsent(request, response, uid);
|
|
}
|
|
|
|
@Post(':uid/abort')
|
|
async abort(@Req() request: Request, @Res() response: Response) {
|
|
await this.oidc.abortInteraction(request, response);
|
|
}
|
|
|
|
private loginForm(uid: string, username = '', errorMessage = ''): string {
|
|
const encodedUid = encodeURIComponent(uid);
|
|
const error = errorMessage
|
|
? `<p class="message error" role="alert">${this.escape(errorMessage)}</p>`
|
|
: '';
|
|
|
|
return `
|
|
${error}
|
|
<form method="post" action="/interaction/${encodedUid}/login">
|
|
<label>Benutzername <input name="username" autocomplete="username" value="${this.escape(username)}" required></label>
|
|
<label>Passwort <input name="password" type="password" autocomplete="current-password" required autofocus></label>
|
|
<button type="submit">Anmelden</button>
|
|
</form>
|
|
<form method="post" action="/interaction/${encodedUid}/abort">
|
|
<button class="secondary" type="submit">Abbrechen</button>
|
|
</form>
|
|
<p class="form-link"><a href="${this.escape(this.registrationUrl)}">Neues Konto registrieren</a></p>
|
|
`;
|
|
}
|
|
|
|
private consentView(uid: string, details: Interaction): string {
|
|
const encodedUid = encodeURIComponent(uid);
|
|
const clientId = String(details.params.client_id ?? '');
|
|
const clientName = String(details.params.name ?? (clientId || 'Unbekannte Anwendung'));
|
|
const redirectUri = String(details.params.redirect_uri ?? '');
|
|
const scope = String(details.params.scope ?? 'openid');
|
|
|
|
return `
|
|
<p class="intro">Die Anwendung <strong>${this.escape(clientName)}</strong> moechte auf dein Konto zugreifen.</p>
|
|
${redirectUri ? `<dl class="consent-details"><div><dt>Weiterleitung</dt><dd>${this.escape(redirectUri)}</dd></div></dl>` : ''}
|
|
<div class="scope-list" aria-label="Angeforderte Berechtigungen">
|
|
${this.scopeItems(scope)}
|
|
</div>
|
|
<form method="post" action="/interaction/${encodedUid}/confirm">
|
|
<button type="submit">Zugriff erlauben</button>
|
|
</form>
|
|
<form method="post" action="/interaction/${encodedUid}/abort">
|
|
<button class="secondary" type="submit">Ablehnen</button>
|
|
</form>
|
|
`;
|
|
}
|
|
|
|
private scopeItems(scope: string): string {
|
|
const scopes = scope
|
|
.split(/\s+/)
|
|
.map((item) => item.trim())
|
|
.filter(Boolean);
|
|
|
|
return scopes
|
|
.map(
|
|
(item) => `
|
|
<section class="scope-item">
|
|
<strong>${this.escape(item)}</strong>
|
|
<span>${this.escape(this.scopeDescription(item))}</span>
|
|
</section>
|
|
`,
|
|
)
|
|
.join('');
|
|
}
|
|
|
|
private scopeDescription(scope: string): string {
|
|
const descriptions: Record<string, string> = {
|
|
openid: 'Anmeldung per OpenID Connect bestaetigen.',
|
|
profile: 'Profilinformationen wie Name und Anzeigename lesen.',
|
|
email: 'E-Mail-Adresse lesen.',
|
|
groups: 'Gruppenmitgliedschaften lesen.',
|
|
offline_access: 'Laengerfristigen Zugriff ueber Refresh Tokens erlauben.',
|
|
};
|
|
|
|
return descriptions[scope] ?? 'Diese Berechtigung wurde von der Anwendung angefordert.';
|
|
}
|
|
|
|
private page(title: string, body: string): string {
|
|
return `<!doctype html>
|
|
<html lang="de">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>${this.escape(title)} - LDAP Portal</title>
|
|
<style>
|
|
body { background: #f5f7f9; color: #18202a; font-family: Inter, system-ui, sans-serif; margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 20px; }
|
|
main { background: white; border: 1px solid #d8e0e7; border-radius: 8px; box-shadow: 0 16px 40px rgb(24 32 42 / 8%); max-width: 460px; padding: 28px; width: 100%; }
|
|
h1 { font-size: 1.45rem; margin: 0 0 22px; }
|
|
form { display: grid; gap: 16px; margin-top: 16px; }
|
|
label { display: grid; gap: 7px; font-weight: 700; }
|
|
input { border: 1px solid #bcc8d3; border-radius: 6px; font: inherit; min-height: 44px; padding: 10px 12px; }
|
|
button { background: #0f6b6e; border: 1px solid #0f6b6e; border-radius: 6px; color: white; cursor: pointer; font: inherit; font-weight: 700; min-height: 44px; padding: 10px 14px; }
|
|
button.secondary { background: white; color: #0f6b6e; }
|
|
a { color: #0f6b6e; font-weight: 700; text-decoration: none; }
|
|
a:hover { text-decoration: underline; }
|
|
.form-link { margin: 16px 0 0; text-align: center; }
|
|
.intro { color: #3a4551; line-height: 1.45; margin: 0 0 16px; }
|
|
.message { background: #edf7f4; border: 1px solid #b8ddd3; border-radius: 6px; color: #24564f; margin: 0 0 16px; padding: 12px; }
|
|
.message.error { background: #fff1f0; border-color: #efb5ae; color: #8d2b20; }
|
|
.consent-details { display: grid; gap: 10px; margin: 0 0 16px; }
|
|
.consent-details div { display: grid; gap: 5px; }
|
|
dt { color: #637083; font-size: 0.82rem; font-weight: 700; }
|
|
dd { margin: 0; overflow-wrap: anywhere; }
|
|
.scope-list { display: grid; gap: 8px; margin: 16px 0; }
|
|
.scope-item { border: 1px solid #d8e0e7; border-radius: 6px; display: grid; gap: 4px; padding: 10px 12px; }
|
|
.scope-item span { color: #637083; font-size: 0.9rem; line-height: 1.35; }
|
|
</style>
|
|
</head>
|
|
<body><main><h1>${this.escape(title)}</h1>${body}</main></body>
|
|
</html>`;
|
|
}
|
|
|
|
private escape(value: string): string {
|
|
return value
|
|
.replaceAll('&', '&')
|
|
.replaceAll('<', '<')
|
|
.replaceAll('>', '>')
|
|
.replaceAll('"', '"')
|
|
.replaceAll("'", ''');
|
|
}
|
|
|
|
private get registrationUrl(): string {
|
|
const publicWebUrl = this.config.get<string>('PUBLIC_WEB_URL') ?? 'http://localhost:4200';
|
|
return `${publicWebUrl.replace(/\/+$/, '')}/register`;
|
|
}
|
|
|
|
private isInvalidCredentialsError(error: unknown): boolean {
|
|
return error instanceof UnauthorizedException && error.message === 'Ungueltige Zugangsdaten.';
|
|
}
|
|
}
|