Browse Source
- Update login API to support direct authentication via email and password, removing the OAuth2 redirect flow. - Modify LoginForm component to include password field and validation. - Refactor useAuth composable to handle login with both email and password. - Remove unnecessary OAuth2 callback handler and PKCE utilities. - Update relevant documentation and error handling for the new login method.main
Bastian Masanek
2 months ago
8 changed files with 178 additions and 268 deletions
@ -1,128 +0,0 @@ |
|||||
// server/api/auth/callback.get.ts
|
|
||||
|
|
||||
/** |
|
||||
* GET /api/auth/callback |
|
||||
* |
|
||||
* OAuth2 callback handler - receives authorization code from Cidaas |
|
||||
* |
|
||||
* Query params: |
|
||||
* - code: Authorization code |
|
||||
* - state: CSRF protection token |
|
||||
* |
|
||||
* Flow: |
|
||||
* 1. Validate state parameter |
|
||||
* 2. Exchange code for tokens |
|
||||
* 3. Validate ID token |
|
||||
* 4. Fetch user info |
|
||||
* 5. Create/update user in PostgreSQL |
|
||||
* 6. Create session |
|
||||
* 7. Redirect to homepage |
|
||||
*/ |
|
||||
|
|
||||
import { eq } from 'drizzle-orm' |
|
||||
import { users } from '../../database/schema' |
|
||||
|
|
||||
export default defineEventHandler(async (event) => { |
|
||||
// 1. Extract query parameters
|
|
||||
const query = getQuery(event) |
|
||||
const { code, state } = query |
|
||||
|
|
||||
if (!code || !state) { |
|
||||
throw createError({ |
|
||||
statusCode: 400, |
|
||||
statusMessage: 'Missing code or state parameter', |
|
||||
}) |
|
||||
} |
|
||||
|
|
||||
// 2. Validate state (CSRF protection)
|
|
||||
const storedState = getCookie(event, 'oauth_state') |
|
||||
|
|
||||
if (!storedState || state !== storedState) { |
|
||||
throw createError({ |
|
||||
statusCode: 400, |
|
||||
statusMessage: 'Invalid state parameter - possible CSRF attack', |
|
||||
}) |
|
||||
} |
|
||||
|
|
||||
// 3. Retrieve PKCE verifier
|
|
||||
const verifier = getCookie(event, 'pkce_verifier') |
|
||||
|
|
||||
if (!verifier) { |
|
||||
throw createError({ |
|
||||
statusCode: 400, |
|
||||
statusMessage: 'PKCE verifier not found - session expired', |
|
||||
}) |
|
||||
} |
|
||||
|
|
||||
try { |
|
||||
// 4. Exchange authorization code for tokens
|
|
||||
const tokens = await exchangeCodeForToken(code as string, verifier) |
|
||||
|
|
||||
// 5. Validate ID token (JWT)
|
|
||||
const idTokenPayload = await verifyIdToken(tokens.id_token) |
|
||||
|
|
||||
// 6. Fetch detailed user info from Cidaas
|
|
||||
const cidaasUser = await fetchUserInfo(tokens.access_token) |
|
||||
|
|
||||
// 7. Get database instance
|
|
||||
const db = useDatabase() |
|
||||
|
|
||||
// 8. Check if user already exists in our database
|
|
||||
let user = await db.query.users.findFirst({ |
|
||||
where: eq(users.experimentaId, cidaasUser.sub), |
|
||||
}) |
|
||||
|
|
||||
if (!user) { |
|
||||
// First time login - create new user
|
|
||||
const [newUser] = await db |
|
||||
.insert(users) |
|
||||
.values({ |
|
||||
experimentaId: cidaasUser.sub, // Cidaas user ID
|
|
||||
email: cidaasUser.email, |
|
||||
firstName: cidaasUser.given_name || null, |
|
||||
lastName: cidaasUser.family_name || null, |
|
||||
}) |
|
||||
.returning() |
|
||||
|
|
||||
user = newUser |
|
||||
|
|
||||
console.log('New user created:', user.id) |
|
||||
} else { |
|
||||
// Existing user - update last login timestamp
|
|
||||
await db.update(users).set({ updatedAt: new Date() }).where(eq(users.id, user.id)) |
|
||||
|
|
||||
console.log('User logged in:', user.id) |
|
||||
} |
|
||||
|
|
||||
// 9. Create encrypted session (nuxt-auth-utils)
|
|
||||
await setUserSession(event, { |
|
||||
user: { |
|
||||
id: user.id, |
|
||||
experimentaId: user.experimentaId, |
|
||||
email: user.email, |
|
||||
firstName: user.firstName, |
|
||||
lastName: user.lastName, |
|
||||
}, |
|
||||
loggedInAt: new Date().toISOString(), |
|
||||
}) |
|
||||
|
|
||||
// 10. Clean up temporary cookies
|
|
||||
deleteCookie(event, 'oauth_state') |
|
||||
deleteCookie(event, 'pkce_verifier') |
|
||||
|
|
||||
// 11. Redirect to homepage (or original requested page)
|
|
||||
const redirectTo = getCookie(event, 'redirect_after_login') || '/' |
|
||||
deleteCookie(event, 'redirect_after_login') |
|
||||
|
|
||||
return sendRedirect(event, redirectTo) |
|
||||
} catch (error) { |
|
||||
console.error('OAuth callback error:', error) |
|
||||
|
|
||||
// Clean up cookies on error
|
|
||||
deleteCookie(event, 'oauth_state') |
|
||||
deleteCookie(event, 'pkce_verifier') |
|
||||
|
|
||||
// Redirect to login page with error
|
|
||||
return sendRedirect(event, '/auth?error=login_failed') |
|
||||
} |
|
||||
}) |
|
||||
@ -1,90 +0,0 @@ |
|||||
// server/utils/pkce.ts
|
|
||||
|
|
||||
/** |
|
||||
* PKCE (Proof Key for Code Exchange) utilities for OAuth2 security. |
|
||||
* |
|
||||
* PKCE prevents authorization code interception attacks by requiring |
|
||||
* the client to prove possession of the original code verifier. |
|
||||
* |
|
||||
* Flow: |
|
||||
* 1. Generate random code_verifier (43-128 chars) |
|
||||
* 2. Hash verifier with SHA-256 → code_challenge |
|
||||
* 3. Send challenge to authorization server |
|
||||
* 4. Server returns authorization code |
|
||||
* 5. Exchange code + verifier for tokens |
|
||||
* 6. Server validates: SHA256(verifier) === stored_challenge |
|
||||
*/ |
|
||||
|
|
||||
/** |
|
||||
* Generate a random code verifier (43-128 URL-safe characters) |
|
||||
* |
|
||||
* @param length - Length of verifier (default: 64) |
|
||||
* @returns Base64URL-encoded random string |
|
||||
*/ |
|
||||
export function generateCodeVerifier(length: number = 64): string { |
|
||||
// Generate random bytes
|
|
||||
const randomBytes = crypto.getRandomValues(new Uint8Array(length)) |
|
||||
|
|
||||
// Convert to base64url (URL-safe base64 without padding)
|
|
||||
return base64UrlEncode(randomBytes) |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* Generate SHA-256 hash of code verifier → code challenge |
|
||||
* |
|
||||
* @param verifier - The code verifier |
|
||||
* @returns Base64URL-encoded SHA-256 hash |
|
||||
*/ |
|
||||
export async function generateCodeChallenge(verifier: string): Promise<string> { |
|
||||
// Convert verifier string to Uint8Array
|
|
||||
const encoder = new TextEncoder() |
|
||||
const data = encoder.encode(verifier) |
|
||||
|
|
||||
// Hash with SHA-256
|
|
||||
const hashBuffer = await crypto.subtle.digest('SHA-256', data) |
|
||||
|
|
||||
// Convert to base64url
|
|
||||
return base64UrlEncode(new Uint8Array(hashBuffer)) |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* Generate PKCE verifier + challenge pair |
|
||||
* |
|
||||
* @returns Object with verifier and challenge |
|
||||
*/ |
|
||||
export async function generatePKCE(): Promise<{ |
|
||||
verifier: string |
|
||||
challenge: string |
|
||||
}> { |
|
||||
const verifier = generateCodeVerifier() |
|
||||
const challenge = await generateCodeChallenge(verifier) |
|
||||
|
|
||||
return { verifier, challenge } |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* Convert Uint8Array to Base64URL string |
|
||||
* |
|
||||
* Base64URL is URL-safe variant of Base64: |
|
||||
* - Replace '+' with '-' |
|
||||
* - Replace '/' with '_' |
|
||||
* - Remove padding '=' |
|
||||
*/ |
|
||||
function base64UrlEncode(buffer: Uint8Array): string { |
|
||||
// Convert to base64
|
|
||||
const base64 = btoa(String.fromCharCode(...buffer)) |
|
||||
|
|
||||
// Convert to base64url
|
|
||||
return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '') |
|
||||
} |
|
||||
|
|
||||
/** |
|
||||
* Generate random state parameter for CSRF protection |
|
||||
* |
|
||||
* @param length - Length of state string (default: 32) |
|
||||
* @returns Random URL-safe string |
|
||||
*/ |
|
||||
export function generateState(length: number = 32): string { |
|
||||
const randomBytes = crypto.getRandomValues(new Uint8Array(length)) |
|
||||
return base64UrlEncode(randomBytes) |
|
||||
} |
|
||||
Loading…
Reference in new issue