{
  "presets": ["@babel/preset-env"],
  "plugins": ["@babel/plugin-transform-runtime"]
}

import * as dotenv from "dotenv";
dotenv.config();

const { Provider } = require("oidc-provider");
import express from "express";
import bodyParser from "body-parser";
import { initAccount, findAccount, checkAccount } from "./supports/account";

import { clients } from "./configs/clients";
import { privatekeys } from "./configs/privatekeys";
const adapter = require("./adapters/" + process.env.ADAPTER || "redis");

// 가장 중요한부분. provider의 설정값들을 세팅하는 부분이다.
// git에도 이 부분에대한 설명이 부실하고 직접 해보지않으면 뭐하는 설정인지 모르는 것들이 많다.
const configuration = {
  // ... see the available options in Configuration options section
  clients: [
    {
      client_id: "foo",
      client_secret: "bar",
      redirect_uris: ["http://lvh.me:8080/cb"],
      // + other client properties
    },
  ],
  // ...
};

const app = express();

app.set("view engine", "ejs");
app.set("views", path.resolve(__dirname, "views"));

const oidc = new Provider("http://localhost:3000", configuration);

app.use(oidc.callback);

// or just expose a server standalone, see /examples/standalone.js
app.listen(3000, () => {
  console.log("oidc-provider listening on port 3000, check http://localhost:3000/.well-known/openid-configuration");
});

// npm i ioredis@^4.0.0
const Redis = require("ioredis"); // eslint-disable-line import/no-unresolved
const isEmpty = require("lodash/isEmpty");

const client = new Redis(process.env.REDIS_URL, { keyPrefix: "oidc:" });

// 저장되는 데이터 종류 set
const consumable = new Set(["AuthorizationCode", "RefreshToken", "DeviceCode"]);

function grantKeyFor(id) {
  return `grant:${id}`;
}

function userCodeKeyFor(userCode) {
  return `userCode:${userCode}`;
}

function uidKeyFor(uid) {
  return `uid:${uid}`;
}

// Adapter 클래스. 기본적으로 키 생성, 삭제, 수정 기능이 전부이다.
class RedisAdapter {
  constructor(name) {
    this.name = name;
  }

  async upsert(id, payload, expiresIn) {
    const key = this.key(id);
    const store = consumable.has(this.name) ? { payload: JSON.stringify(payload) } : JSON.stringify(payload);

    const multi = client.multi();
    multi[consumable.has(this.name) ? "hmset" : "set"](key, store);

    if (expiresIn) {
      multi.expire(key, expiresIn);
    }

    if (payload.grantId) {
      const grantKey = grantKeyFor(payload.grantId);
      multi.rpush(grantKey, key);
      // if you're seeing grant key lists growing out of acceptable proportions consider using LTRIM
      // here to trim the list to an appropriate length
      const ttl = await client.ttl(grantKey);
      if (expiresIn > ttl) {
        multi.expire(grantKey, expiresIn);
      }
    }

    if (payload.userCode) {
      const userCodeKey = userCodeKeyFor(payload.userCode);
      multi.set(userCodeKey, id);
      multi.expire(userCodeKey, expiresIn);
    }

    if (payload.uid) {
      const uidKey = uidKeyFor(payload.uid);
      multi.set(uidKey, id);
      multi.expire(uidKey, expiresIn);
    }

    await multi.exec();
  }

  async find(id) {
    const data = consumable.has(this.name) ? await client.hgetall(this.key(id)) : await client.get(this.key(id));

    if (isEmpty(data)) {
      return undefined;
    }

    if (typeof data === "string") {
      return JSON.parse(data);
    }
    const { payload, ...rest } = data;
    return {
      ...rest,
      ...JSON.parse(payload),
    };
  }

  async findByUid(uid) {
    const id = await client.get(uidKeyFor(uid));
    return this.find(id);
  }

  async findByUserCode(userCode) {
    const id = await client.get(userCodeKeyFor(userCode));
    return this.find(id);
  }

  async destroy(id) {
    const key = this.key(id);
    await client.del(key);
  }

  async revokeByGrantId(grantId) {
    // eslint-disable-line class-methods-use-this
    const multi = client.multi();
    const tokens = await client.lrange(grantKeyFor(grantId), 0, -1);
    tokens.forEach(token => multi.del(token));
    multi.del(grantKeyFor(grantId));
    await multi.exec();
  }

  async consume(id) {
    await client.hset(this.key(id), "consumed", Math.floor(Date.now() / 1000));
  }

  key(id) {
    return `${this.name}:${id}`;
  }
}

module.exports = RedisAdapter;

export const clients = [
  // authCodeCredential Test
  {
    client_id: "auth_test",
    client_secret: "123",
    application_type: "web",
    id_token_signed_response_alg: "ES256",
    redirect_uris: ["http://localhost:3001/auth"],
    response_types: ["code"],
    grant_types: ["refresh_token", "authorization_code"],
    pkceMethods: ["S256"],
    post_logout_redirect_uris: ["http://localhost:3001/"],
    scope: "openid",
    token_endpoint_auth_method: "client_secret_basic",
  },
  // clientCredential Test
  {
    client_id: "test",
    client_secret: "test",
    application_type: "web",
    id_token_signed_response_alg: "ES256",
    redirect_uris: [],
    response_types: [],
    grant_types: ["client_credentials"],
    pkceMethods: [],
    post_logout_redirect_uris: [],
  },
];

const low = require("lowdb");
const Memory = require("lowdb/adapters/Memory");

class MemoryDB {
  constructor() {
    this.name = "memorydb";

    this.db = low(new Memory());
    this.db
      .defaults({
        users: [
          {
            id: "23121d3c-84df-44ac-b458-3d63a9a05497",
            loginId: "user01",
            loginPassword: "",
          },
        ],
      })
      .write();
  }

  getUser(loginId) {
    return new Promise((resolve, reject) => {
      const item = this.db.get("users").find({ loginId: loginId }).value();

      resolve(item);
    });
  }

  getUserById(id) {
    return new Promise((resolve, reject) => {
      const item = this.db.get("users").find({ id: id }).value();

      resolve(item);
    });
  }
}

module.exports = MemoryDB;

import crypto from "crypto";
import DynamoDB from "../databases/dynamodb";
import MemoryDB from "../databases/memorydb";
import MongoDB from "../databases/mongodb";

var database = null;

// 설정에따라 사용할 DB 선택
const initAccount = target => {
  if (target === "dynamodb") {
    database = new DynamoDB();
  } else if (target === "mongodb") {
    database = new MongoDB();
  } else {
    database = new MemoryDB();
  }
};

const findAccount = async (ctx, id) => {
  console.log("findAccount: ", id);
  const item = await database.getUserById(id);
  if (!item) {
    return undefined;
  }

  // Token정보에 포함될 user 정보 return
  return {
    // accountId: id,
    // << Update Accesstoken's "sub" claim >>
    async claims(use, scope) {
      console.log("claims: ", use, scope);
      return {
        sub: id,
        loginId: item.loginId,
      };
    },
  };
};

const checkAccount = async (loginId, password) => {
  try {
    console.log("authenticate: ", loginId, password);
    const item = await database.getUser(loginId);
    // Password 검증 부분. 각자 구현해야 할 부분.
    // DB에서 가져온 password와 전달받은 값의 hash값을 비교하는 logic
    if (item) {
      const key = crypto.pbkdf2Sync(password, item.loginPasswordSalt, 1026, 64, "sha512").toString("hex");
      if (key === item.loginPassword) {
        return item.id;
      }
    }

    return undefined;
  } catch (err) {
    console.log(err);
    return undefined;
  }
};

export { initAccount, findAccount, checkAccount };

<div class="login-client-image">
  <% if (client.logoUri) { %><img src="<%= client.logoUri %>"><% } %>
</div>

<ul>
<% if ([details.missingOIDCScope, details.missingOIDCClaims, details.missingResourceScopes].filter(Boolean).length === 0) { %>
  <li>the client is asking you to confirm previously given authorization</li>
<% } %>

<% missingOIDCScope = new Set(details.missingOIDCScope); missingOIDCScope.delete('openid'); missingOIDCScope.delete('offline_access') %>
<% if (missingOIDCScope.size) { %>
  <li>scopes:</li>
  <ul>
    <% missingOIDCScope.forEach((scope) => { %>
      <li><%= scope %></li>
    <% }) %>
  </ul>
<% } %>

<% missingOIDCClaims = new Set(details.missingOIDCClaims); ['sub', 'sid', 'auth_time', 'acr', 'amr', 'iss'].forEach(Set.prototype.delete.bind(missingOIDCClaims)) %>
<% if (missingOIDCClaims.size) { %>
  <li>claims:</li>
  <ul>
    <% missingOIDCClaims.forEach((claim) => { %>
      <li><%= claim %></li>
    <% }) %>
  </ul>
<% } %>

<% missingResourceScopes = details.missingResourceScopes %>
<% if (missingResourceScopes) { %>
  <% for (const [indicator, scopes] of Object.entries(details.missingResourceScopes)) { %>
    <li><%= indicator %>:</li>
    <ul>
      <% scopes.forEach((scope) => { %>
        <li><%= scope %></li>
      <% }) %>
    </ul>
  <% } %>
<% } %>

<% if (params.scope && params.scope.includes('offline_access')) { %>
  <li>
  the client is asking to have offline access to this authorization
    <% if ((!details.missingOIDCScope) || !details.missingOIDCScope.includes('offline_access')) { %>
      (which you've previously granted)
    <% } %>
  </li>
<% } %>
</ul>
<form autocomplete="off" action="/interaction/<%= uid %>/confirm" method="post">
  <button autofocus type="submit" class="login login-submit">Continue</button>
</form>

<% if (locals.google) { %>
<form autocomplete="off" action="/interaction/<%= uid %>/federated" method="post">
  <input type="hidden" name="upstream" value="google">
  <button type="submit" class="google-button">
    <span class="google-button__icon">
      <svg viewBox="0 0 366 372" xmlns="http://www.w3.org/2000/svg"><path d="M125.9 10.2c40.2-13.9 85.3-13.6 125.3 1.1 22.2 8.2 42.5 21 59.9 37.1-5.8 6.3-12.1 12.2-18.1 18.3l-34.2 34.2c-11.3-10.8-25.1-19-40.1-23.6-17.6-5.3-36.6-6.1-54.6-2.2-21 4.5-40.5 15.5-55.6 30.9-12.2 12.3-21.4 27.5-27 43.9-20.3-15.8-40.6-31.5-61-47.3 21.5-43 60.1-76.9 105.4-92.4z" id="Shape" fill="#EA4335"/><path d="M20.6 102.4c20.3 15.8 40.6 31.5 61 47.3-8 23.3-8 49.2 0 72.4-20.3 15.8-40.6 31.6-60.9 47.3C1.9 232.7-3.8 189.6 4.4 149.2c3.3-16.2 8.7-32 16.2-46.8z" id="Shape" fill="#FBBC05"/><path d="M361.7 151.1c5.8 32.7 4.5 66.8-4.7 98.8-8.5 29.3-24.6 56.5-47.1 77.2l-59.1-45.9c19.5-13.1 33.3-34.3 37.2-57.5H186.6c.1-24.2.1-48.4.1-72.6h175z" id="Shape" fill="#4285F4"/><path d="M81.4 222.2c7.8 22.9 22.8 43.2 42.6 57.1 12.4 8.7 26.6 14.9 41.4 17.9 14.6 3 29.7 2.6 44.4.1 14.6-2.6 28.7-7.9 41-16.2l59.1 45.9c-21.3 19.7-48 33.1-76.2 39.6-31.2 7.1-64.2 7.3-95.2-1-24.6-6.5-47.7-18.2-67.6-34.1-20.9-16.6-38.3-38-50.4-62 20.3-15.7 40.6-31.5 60.9-47.3z" fill="#34A853"/></svg>
    </span>
    <span class="google-button__text">Sign in with Google</span>
  </button>
</form>
<div class="login-help">
  - or -
</div>
<% } %>
<form autocomplete="off" action="/interaction/<%= uid %>/login" method="post">
  <input required type="text" name="login" placeholder="Enter any login" <% if (!params.login_hint) { %>autofocus="on"<% } else { %> value="<%= params.login_hint %>" <% } %>>
  <input required type="password" name="password" placeholder="and password" <% if (params.login_hint) { %>autofocus="on"<% } %>>

  <button type="submit" class="login login-submit">Sign-in</button>
</form>

const configs = {
  clients, // clients.js에서 등록한, 인증서버를 사용하게 될 client들의 정보.
  jwks: privatekeys, // key 발급에 사용될 비대칭 암호키
  adapter: adapter, // 사용할 adapter 클래스. 만약 connection이 필요한 DB ( mongo, dynamo ) 등을 사용한다면 conn 초기화 작업이 먼저 이루어져 있어야한다.
  findAccount: findAccount, // 사용자 정보를 조회할 API 구현부
  // Token의 format을 지정하는 설정.
  formats: {
    // 인증방식에따라 각각 포맷을 지정할 수 있다.
    AccessToken: "jwt",
    ClientCredentials: "jwt",
    // Token의 기본 field 이외에 추가로 넣고싶은 값을 지정.
    customizers: {
      async jwt(ctx, token, jwt) {
        // Token에 "issuerId"라는 필드를 추가
        jwt.payload.issuerId = "custom-field";
      },
    },
  },
  // client.js에서 설정될 client들의 기본 설정들을 지정. 만약 해당 값을 client.js에서 다시 지정한다면 덮어써진다.
  clientDefaults: {
    id_token_signed_response_alg: "ES256",
    token_endpoint_auth_method: "client_secret_basic",
  },
  // 발급받은 Token을 통해 요청할 수 있는 정보와 API의 제한 범위를 지정.
  // 설명하기 가장 어려운 부분이다... 자세한 개념은 검색을 하는게 좋을 것 같다. 키워드는 claims, scope.
  claims: {
    openid: ["sub"],
    profile: ["email", "loginId"],
  },
  // Client의 cookie 이름 등을 custom 할 수 있는 설정.
  cookies: {
    names: {
      session: "_custom_auth_session",
      interaction: "_interaction",
      resume: "_interaction_resume",
    },
    long: {
      httpOnly: true,
      overwrite: true,
      sameSite: "none",
    },
    short: {
      httpOnly: true,
      overwrite: true,
      sameSite: "lax",
    },
    keys: [],
  },
  // 인증과정 진행 시 routing 될 경로 지정.
  interactions: {
    url(ctx, interaction) {
      return `/interaction/${interaction.uid}`;
    },
  },
  // authCode 인증방식에서 code 교환시 pkce 검증과정을 추가할지 여부. false로 할 시 검증과정을 생략한다.
  // pkce가 무엇인지는 RFC7636 https://datatracker.ietf.org/doc/html/rfc7636 참조.
  pkce: {
    methods: ["S256"],
    required: true,
  },
  // TimeToLive. 토큰의 유효 기간을 지정하는 설정. 아래는 기본값으로 필요하다면 늘려서 사용 가능하다.
  ttl: {
    AccessToken: function AccessTokenTTL(ctx, token, client) {
      if (token.resourceServer) {
        return token.resourceServer.accessTokenTTL || 60 * 60;
      }
      return 60 * 60;
    },
    AuthorizationCode: 600,
    ClientCredentials: function ClientCredentialsTTL(ctx, token, client) {
      if (token.resourceServer) {
        return token.resourceServer.accessTokenTTL || 10 * 60;
      }
      return 10 * 60;
    },
    Grant: 1209600,
    IdToken: 3600,
    Interaction: 3600,
    Session: 3600,
  },
  // 추가적인 기능들. 각 설정들은 프로토콜상 지원하는 기능들 이다.
  features: {
    devInteractions: { enabled: false },
    encryption: { enabled: true },
    // 토큰 검증기능 on/off
    introspection: {
      enabled: true,
    },
    // 동적 Client 생성 기능 ( client.js에 등록된 client이외에 추가로 동적으로 등록이 가능하도록 )
    registration: {
      enabled: true,
      // 허가되지 않은 사용자의 client 등록을 차단하기위한 secret key.
      initialAccessToken: "initial_secret",
    },
    // client 등록에 사용되는 인증 절차에 관한 설정
    registrationManagement: {
      enabled: true,
      rotateRegistrationAccessToken: false,
    },
    // 발급한 토큰을 폐지하는 기능 on/off
    revocation: { enabled: true },
    // clientCredential 인증방식 허용 여부. 다른 인증방식에 비해 보안이 취약하기 때문에 별도 설정으로 활성화 시켜야한다.
    clientCredentials: { enabled: true },
  },
  // refreshToken을 발급 하는 case 지정.
  issueRefreshToken: async function issueRefreshToken(ctx, client, code) {
    // client 설정의 auth_type 에 refresh_token 값이 있으면~
    if (!client.grantTypeAllowed("refresh_token")) {
      return false;
    } else {
      return true;
    }
  },
  // accessToken에 필요한 값을 추가하는 기능
  extraAccessTokenClaims: async function extraAccessTokenClaims(ctx, token) {
    // 토큰이 clientCredentials 인증방식이고, 요청의 body에 "custom_token"이라는 필드가 있다면 access_token에 해당값 추가한 뒤 return.
    if (token.kind === "ClientCredentials" && ctx.req.body.custom_token) {
      return {
        custom_access_token: "custom_access_token_test",
      };
    }
  },
};

app.get("/interaction/:uid", setNoCache, async (req, res, next) => {
  try {
    const { uid, prompt, params, session } = await provider.interactionDetails(req, res);

    const client = await provider.Client.find(params.client_id);

    switch (prompt.name) {
      case "login": {
        return res.render("login", {
          client,
          uid,
          details: prompt.details,
          params,
          title: "Sign-in",
          session: session ? debug(session) : undefined,
          dbg: {
            params: debug(params),
            prompt: debug(prompt),
          },
        });
      }
      case "consent": {
        return res.render("interaction", {
          client,
          uid,
          details: prompt.details,
          params,
          title: "Authorize",
          session: session ? debug(session) : undefined,
          dbg: {
            params: debug(params),
            prompt: debug(prompt),
          },
        });
      }
      default:
        return undefined;
    }
  } catch (err) {
    return next(err);
  }
});

app.post("/interaction/:uid/login", setNoCache, body, async (req, res, next) => {
  try {
    const {
      prompt: { name },
    } = await provider.interactionDetails(req, res);
    assert.equal(name, "login");
    const account = await Account.findByLogin(req.body.login);

    const result = {
      login: {
        accountId: account.accountId,
      },
    };

    await provider.interactionFinished(req, res, result, { mergeWithLastSubmission: false });
  } catch (err) {
    next(err);
  }
});

app.post("/interaction/:uid/confirm", setNoCache, body, async (req, res, next) => {
  try {
    const interactionDetails = await provider.interactionDetails(req, res);
    const {
      prompt: { name, details },
      params,
      session: { accountId },
    } = interactionDetails;
    assert.equal(name, "consent");

    let { grantId } = interactionDetails;
    let grant;

    if (grantId) {
      // we'll be modifying existing grant in existing session
      grant = await provider.Grant.find(grantId);
    } else {
      // we're establishing a new grant
      grant = new provider.Grant({
        accountId,
        clientId: params.client_id,
      });
    }

    if (details.missingOIDCScope) {
      grant.addOIDCScope(details.missingOIDCScope.join(" "));
    }
    if (details.missingOIDCClaims) {
      grant.addOIDCClaims(details.missingOIDCClaims);
    }
    if (details.missingResourceScopes) {
      // eslint-disable-next-line no-restricted-syntax
      for (const [indicator, scopes] of Object.entries(details.missingResourceScopes)) {
        grant.addResourceScope(indicator, scopes.join(" "));
      }
    }

    grantId = await grant.save();

    const consent = {};
    if (!interactionDetails.grantId) {
      // we don't have to pass grantId to consent, we're just modifying existing one
      consent.grantId = grantId;
    }

    const result = { consent };
    await provider.interactionFinished(req, res, result, { mergeWithLastSubmission: true });
  } catch (err) {
    next(err);
  }
});

app.get("/interaction/:uid/abort", setNoCache, async (req, res, next) => {
  try {
    const result = {
      error: "access_denied",
      error_description: "End-User aborted interaction",
    };
    await provider.interactionFinished(req, res, result, { mergeWithLastSubmission: false });
  } catch (err) {
    next(err);
  }
});