lib/plankton/plankton.d.ts

@@ -4320,7 +4320,7 @@ declare namespace lib_plankton.auth.oidc {
      */
     export type type_subject = {
         parameters: type_parameters;
-        cases: Record<string, {}>;
+        state: {};
     };
     /**
      */
@@ -4328,13 +4328,7 @@ declare namespace lib_plankton.auth.oidc {
     /**
      * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
      */
-    export function authorization_url(subject: type_subject, state: string): string;
+    export function authorization_url(subject: type_subject): string;
-    /**
-     */
-    export function prepare_login(subject: type_subject): {
-        state: string;
-        authorization_url: string;
-    };
     /**
      */
     export function handle_authorization_callback(subject: type_subject, cookie: (null | string), stuff: Record<string, string>): Promise<{

lib/plankton/plankton.js

@@ -15246,12 +15246,12 @@ var lib_plankton;
         (function (oidc) {
             /**
              */
-            let enum_condition;
+            let enum_state_label;
-            (function (enum_condition) {
+            (function (enum_state_label) {
-                enum_condition["idle"] = "idle";
+                enum_state_label["idle"] = "idle";
-                enum_condition["wait"] = "wait";
+                enum_state_label["wait"] = "wait";
-                enum_condition["ready"] = "ready";
+                enum_state_label["ready"] = "ready";
-            })(enum_condition || (enum_condition = {}));
+            })(enum_state_label || (enum_state_label = {}));
             ;
             /**
              */
@@ -15271,38 +15271,26 @@ var lib_plankton;
                             ??
                                 "OIDC"),
                     },
-                    "cases": {}
+                    "state": {}
                 };
             }
             oidc.make = make;
             /**
              * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
              */
-            function authorization_url(subject, state) {
+            function authorization_url(subject) {
-                const url = lib_plankton.url.encode(Object.assign(lib_plankton.url.decode(subject.parameters.url_authorization), {
+                return lib_plankton.url.encode(Object.assign(lib_plankton.url.decode(subject.parameters.url_authorization), {
                     "query": lib_plankton.www_form.encode({
                         "response_type": "code",
                         "client_id": subject.parameters.client_id,
                         // "client_secret": subject.parameters.client_secret,
                         "scope": subject.parameters.scopes.join(" "),
-                        "state": state,
+                        "state": lib_plankton.random.generate_guid(),
                         "redirect_uri": subject.parameters.url_redirect,
                     })
                 }));
-                return url;
             }
             oidc.authorization_url = authorization_url;
-            /**
-             */
-            function prepare_login(subject) {
-                const state = lib_plankton.random.generate_guid();
-                subject.cases[state] = {};
-                return {
-                    "state": state,
-                    "authorization_url": authorization_url(subject, state),
-                };
-            }
-            oidc.prepare_login = prepare_login;
             /**
              * https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
              */
@@ -15377,11 +15365,6 @@ var lib_plankton;
             /**
              */
             async function handle_authorization_callback(subject, cookie, stuff) {
-                const state = stuff["state"];
-                if (!(state in subject.cases)) {
-                    return Promise.reject(new Error("no case for this state"));
-                }
-                else {
                 if (("error" in stuff)
                     ||
                         (!("code" in stuff))
@@ -15398,7 +15381,6 @@ var lib_plankton;
                     });
                 }
             }
-            }
             oidc.handle_authorization_callback = handle_authorization_callback;
         })(oidc = auth.oidc || (auth.oidc = {}));
     })(auth = lib_plankton.auth || (lib_plankton.auth = {}));

source/api/actions/session_oidc.ts

@@ -56,8 +56,8 @@ namespace _zeitbild.api
 							name : (null | string);
 							email : (null | string);
 						};
-						redirect_uri_template : string;
+					} = await lib_plankton.auth.oidc.handle_authorization_callback(
-					} = await _zeitbild.auth.oidc_handle_authorization_callback(
+						_zeitbild.auth.oidc_subject(),
 						(stuff.headers["Cookie"] ?? stuff.headers["cookie"] ?? null),
 						stuff.query_parameters
 					);
@@ -94,6 +94,7 @@ namespace _zeitbild.api
 								}
 							}
 						);
+						const redirect_uri_template : string = _zeitbild.auth.oidc_get_redirect_uri_template("foo");
 						return Promise.resolve(
 							{
 								"status_code": 200,
@@ -101,7 +102,7 @@ namespace _zeitbild.api
 									"<html><head><meta http-equiv=\"refresh\" content=\"0; url={{url}}\" /></head><body></body></html>",
 									{
 										"url": lib_plankton.string.coin(
-											data.redirect_uri_template,
+											redirect_uri_template,
 											{
 												"session_key": session_key,
 											}

source/auth.ts

@@ -11,13 +11,6 @@ namespace _zeitbild.auth
 	) = null;
 	
 	
-	
-	/**
-	 */
-	let _subject_oidc : (null | lib_plankton.auth.oidc.type_subject) = null;
-
-	
-	
 	/**
 	 */
 	let _oidc_redict_uri_template_map : (
@@ -27,6 +20,30 @@ namespace _zeitbild.auth
 	) = null;
 	
 	
+	/**
+	 */
+	export function oidc_subject(
+	)
+	{
+		return lib_plankton.auth.oidc.make(
+			{
+				"url_authorization": _zeitbild.conf.get().authentication.data.url_authorization,
+				"url_token": _zeitbild.conf.get().authentication.data.url_token,
+				"url_userinfo": _zeitbild.conf.get().authentication.data.url_userinfo,
+				"client_id": _zeitbild.conf.get().authentication.data.client_id,
+				"client_secret": _zeitbild.conf.get().authentication.data.client_secret,
+				"url_redirect": (_zeitbild.conf.get().authentication.data.backend_url_base + "/session/oidc"),
+				"scopes": [
+					"openid",
+					"profile",
+					"email",
+				],
+				"label": _zeitbild.conf.get().authentication.data.label,
+			}
+		);
+	}
+	
+	
 	/**
 	 */
 	export function oidc_get_redirect_uri_template(
@@ -37,6 +54,12 @@ namespace _zeitbild.auth
 			throw (new Error("apparently not initialized yet"));
 		}
 		else {
+lib_plankton.log.info(
+	"oidc_redirect_uri_templates",
+	{
+		"val": lib_plankton.map.dump(_oidc_redict_uri_template_map),
+	}
+);
 			return _oidc_redict_uri_template_map.get(key);
 		}
 	}
@@ -65,22 +88,6 @@ namespace _zeitbild.auth
 				break;
 			}
 			case "oidc": {
-				_subject_oidc = lib_plankton.auth.oidc.make(
-					{
-						"url_authorization": _zeitbild.conf.get().authentication.data.url_authorization,
-						"url_token": _zeitbild.conf.get().authentication.data.url_token,
-						"url_userinfo": _zeitbild.conf.get().authentication.data.url_userinfo,
-						"client_id": _zeitbild.conf.get().authentication.data.client_id,
-						"client_secret": _zeitbild.conf.get().authentication.data.client_secret,
-						"url_redirect": (_zeitbild.conf.get().authentication.data.backend_url_base + "/session/oidc"),
-						"scopes": [
-							"openid",
-							"profile",
-							"email",
-						],
-						"label": _zeitbild.conf.get().authentication.data.label,
-					}
-				);
 				_oidc_redict_uri_template_map = lib_plankton.map.simplemap.implementation_map(
 					lib_plankton.map.simplemap.make(
 					)
@@ -106,21 +113,21 @@ namespace _zeitbild.auth
 	{
 		switch (_zeitbild.conf.get().authentication.kind) {
 			case "oidc": {
-				if ((_subject_oidc === null) || (_oidc_redict_uri_template_map === null)) {
+				const subject : lib_plankton.auth.oidc.type_subject = oidc_subject();
-					throw (new Error("not initialized yet"));
+				if (_oidc_redict_uri_template_map === null) {
+					throw (new Error("apparently not initialized yet"));
 				}
 				else {
-					const stuff : {state : string; authorization_url : string;} = lib_plankton.auth.oidc.prepare_login(_subject_oidc);
 					_oidc_redict_uri_template_map.set(
-						stuff.state,
+						"foo", // TODO proper key
 						input["oidc_redirect_uri_template"]
 					);
 					return Promise.resolve(
 						{
 							"kind": "oidc",
 							"data": {
-								"url": stuff.authorization_url,
+								"url": lib_plankton.auth.oidc.authorization_url(subject),
-								"label": _zeitbild.conf.get().authentication.data.label,
+								"label": subject.parameters.label,
 							}
 						}
 					);
@@ -150,52 +157,30 @@ namespace _zeitbild.auth
 	
 	/**
 	 */
-	export async function oidc_handle_authorization_callback(
+	export function execute(
-		cookie : (null | string),
+		input : any
-		data : Record<string, string>
+	) : Promise<string>
-	) : Promise<
 	{
-			token : string;
+		if (_subject === null) {
-			userinfo : {
+			return Promise.reject(new Error("not initialized yet"));
-				name : (null | string);
-				email : (null | string);
-			};
-			redirect_uri_template : string;
-		}
-	>
-	{
-		if ((_subject_oidc === null) || (_oidc_redict_uri_template_map === null)) {
-			throw (new Error("not initialized yet"));
 		}
 		else {
-			const state : string = data["state"];
+			return _subject.login_execute(input);
-			const result : {
-				token : string;
-				userinfo : {
-					name : (null | string);
-					email : (null | string);
-				};
-			} = await lib_plankton.auth.oidc.handle_authorization_callback(
-				_subject_oidc,
-				cookie,
-				data
-			);
-			return Promise.resolve<
-				{
-					token : string;
-					userinfo : {
-						name : (null | string);
-						email : (null | string);
-					};
-					redirect_uri_template : string;
 		}
-			>(
-				{
-					"token": result.token,
-					"userinfo": result.userinfo,
-					"redirect_uri_template": _oidc_redict_uri_template_map.get(state),
 	}
-			);
+	
+	
+	/**
+	 */
+	export function control(
+		input : any
+	) : Promise<void>
+	{
+		if (_subject === null) {
+			return Promise.reject(new Error("not initialized yet"));
+		}
+		else {
+			return _subject.login_control(input);
 		}
 	}
 	

todo.md

@@ -9,4 +9,5 @@
       - Termin-Eigenschaft "öffentlich"
       - optional: Kalender-Eigenschaft: "neue Termine standard-mäßig öffentlich"
 - CalDAV-Export
+- Caching
 - OIDC session mapping ordentlich machen

tools/deploy

@@ -28,7 +28,7 @@ def main():
 		"--build-directory",
 		type = str,
 		dest = "build_directory",
-		default = "/tmp/zeitbild",
+		default = "build",
 		metavar = "<build-directory>",
 		help = "directory to where the build was put",
 	)