Refresh token impl

waspc/data/Generator/templates/sdk/wasp/package.json

@@ -109,6 +109,7 @@
       "./client/test": "./dist/client/test/index.js",
       "./client": "./dist/client/index.js",
       "./dev": "./dist/dev/index.js",
+      "./server/oauth": "./dist/server/oauth/index.js",
 
       {=! todo(filip): Fixes below are for type errors in 0.13.1, remove ASAP =}
       {=! Used by our code (SDK for full-stack type safety), uncodumented (but accessible) for users. =}

waspc/data/Generator/templates/sdk/wasp/server/auth/hooks.ts

@@ -1,7 +1,9 @@
+{{={= =}=}}
 import type { Request as ExpressRequest } from 'express'
 import { type ProviderId, createUser, findAuthWithUserBy } from '../../auth/utils.js'
 import { prisma } from '../index.js'
 import { Expand } from '../../universal/types.js'
+import { ProviderName } from '../_types/index.js';
 
 // PUBLIC API
 export type OnBeforeSignupHook = (
@@ -35,7 +37,7 @@ export type OnAfterLoginHook = (
 export type InternalAuthHookParams = {
   /**
    * Prisma instance that can be used to interact with the database.
-   */
+  */
   prisma: typeof prisma
 }
 
@@ -48,86 +50,98 @@ export type InternalAuthHookParams = {
 type OnBeforeSignupHookParams = {
   /**
    * Provider ID object that contains the provider name and the provide user ID.
-   */
+  */
   providerId: ProviderId
   /**
    * Request object that can be used to access the incoming request.
-   */
+  */
   req: ExpressRequest
 } & InternalAuthHookParams
 
 type OnAfterSignupHookParams = {
   /**
    * Provider ID object that contains the provider name and the provide user ID.
-   */
+  */
   providerId: ProviderId
   /**
    * User object that was created during the signup process.
-   */
+  */
   user: Awaited<ReturnType<typeof createUser>>
-  oauth?: {
-    /**
-     * Access token that was received during the OAuth flow.
-     */
-    accessToken: string
-    /**
-     * Unique request ID that was generated during the OAuth flow.
-     */
-    uniqueRequestId: string
-  },
+  /**
+   * OAuth flow data that was generated during the OAuth flow. This is only
+   * available if the user signed up using OAuth.
+  */
+  oauth?: OAuthParams
   /**
    * Request object that can be used to access the incoming request.
-   */
+  */
   req: ExpressRequest
 } & InternalAuthHookParams
 
 type OnBeforeOAuthRedirectHookParams = {
   /**
    * URL that the OAuth flow should redirect to.
-   */
+  */
   url: URL
   /**
    * Unique request ID that was generated during the OAuth flow.
-   */
-  uniqueRequestId: string
+  */
+  uniqueRequestId: OAuthParams['uniqueRequestId']
   /**
    * Request object that can be used to access the incoming request.
-   */
+  */
   req: ExpressRequest
 } & InternalAuthHookParams
 
 type OnBeforeLoginHookParams = {
   /**
    * Provider ID object that contains the provider name and the provide user ID.
-   */
+  */
   providerId: ProviderId
   /**
    * Request object that can be used to access the incoming request.
-   */
+  */
   req: ExpressRequest
 } & InternalAuthHookParams
 
 type OnAfterLoginHookParams = {
   /**
    * Provider ID object that contains the provider name and the provide user ID.
-   */
+  */
   providerId: ProviderId
-  oauth?: {
-    /**
-     * Access token that was received during the OAuth flow.
-     */
-    accessToken: string
-    /**
-     * Unique request ID that was generated during the OAuth flow.
-     */
-    uniqueRequestId: string
-  },
   /**
    * User that is logged in.
-   */
+  */
   user: Awaited<ReturnType<typeof findAuthWithUserBy>>['user']
+  /**
+   * OAuth flow data that was generated during the OAuth flow. This is only
+   * available if the user logged in using OAuth.
+  */
+  oauth?: OAuthParams
   /**
    * Request object that can be used to access the incoming request.
-   */
+  */
   req: ExpressRequest
 } & InternalAuthHookParams
+
+// PRIVATE API
+export type OAuthParams = {
+  /**
+   * Unique request ID that was generated during the OAuth flow.
+  */
+  uniqueRequestId: string
+} & (
+  {=# enabledProviders.isGoogleAuthEnabled =}
+  | { providerName: 'google'; tokens: import('arctic').GoogleTokens } 
+  {=/ enabledProviders.isGoogleAuthEnabled =}
+  {=# enabledProviders.isDiscordAuthEnabled =}
+  | { providerName: 'discord'; tokens: import('arctic').DiscordTokens }
+  {=/ enabledProviders.isDiscordAuthEnabled =}
+  {=# enabledProviders.isGitHubAuthEnabled =}
+  | { providerName: 'github'; tokens: import('arctic').GitHubTokens }
+  {=/ enabledProviders.isGitHubAuthEnabled =}
+  {=# enabledProviders.isKeycloakAuthEnabled =}
+  | { providerName: 'keycloak'; tokens: import('arctic').KeycloakTokens }
+  {=/ enabledProviders.isKeycloakAuthEnabled =}
+  | never
+)

waspc/data/Generator/templates/sdk/wasp/server/auth/index.ts

@@ -30,6 +30,7 @@ export type {
   OnBeforeLoginHook,
   OnAfterLoginHook,
   InternalAuthHookParams,
+  OAuthParams,
 } from './hooks.js'
 
 {=# isEmailAuthEnabled =}

waspc/data/Generator/templates/server/src/auth/providers/oauth/env.ts → waspc/data/Generator/templates/sdk/wasp/server/oauth/env.ts

@@ -1,14 +1,13 @@
-import { type ProviderConfig } from "wasp/auth/providers/types";
-
+// PRIVATE API (SDK)
 export function ensureEnvVarsForProvider<EnvVarName extends string>(
   envVarNames: EnvVarName[],
-  provider: ProviderConfig,
+  providerName: string,
 ): Record<EnvVarName, string> {
   const result: Record<string, string> = {};
   for (const envVarName of envVarNames) {
     const value = process.env[envVarName];
     if (!value) {
-      throw new Error(`${envVarName} env variable is required when using the ${provider.displayName} auth provider.`);
+      throw new Error(`${envVarName} env variable is required when using the ${providerName} auth provider.`);
     }
     result[envVarName] = value;
   }

waspc/data/Generator/templates/sdk/wasp/server/oauth/index.ts

@@ -0,0 +1,31 @@
+{{={= =}=}}
+{=# enabledProviders.isGoogleAuthEnabled =}
+// PUBLIC API
+export * as google from './providers/google.js';
+{=/ enabledProviders.isGoogleAuthEnabled =}
+{=# enabledProviders.isDiscordAuthEnabled =}
+// PUBLIC API
+export * as discord from './providers/discord.js';
+{=/ enabledProviders.isDiscordAuthEnabled =}
+{=# enabledProviders.isGitHubAuthEnabled =}
+// PUBLIC API
+export * as github from './providers/github.js';
+{=/ enabledProviders.isGitHubAuthEnabled =}
+{=# enabledProviders.isKeycloakAuthEnabled =}
+// PUBLIC API
+export * as keycloak from './providers/keycloak.js';
+{=/ enabledProviders.isKeycloakAuthEnabled =}
+
+// PRIVATE API
+export {
+  loginPath,
+  callbackPath,
+  exchangeCodeForTokenPath,
+  handleOAuthErrorAndGetRedirectUri,
+  getRedirectUriForOneTimeCode,
+} from './redirect.js'
+
+// PRIVATE API
+export {
+  tokenStore,
+} from './oneTimeCode.js'

waspc/data/Generator/templates/sdk/wasp/server/oauth/oneTimeCode.ts

@@ -0,0 +1,50 @@
+import { createJWT, validateJWT, TimeSpan } from '../../auth/jwt.js'
+
+export const tokenStore = createTokenStore();
+
+function createTokenStore() {
+  const usedTokens = new Map<string, number>();
+
+  const validFor = new TimeSpan(1, 'm') // 1 minute
+  const cleanupAfter = 1000 * 60 * 60; // 1 hour
+
+  function createToken(userId: string): Promise<string> {
+    return createJWT(
+      {
+        id: userId,
+      },
+      {
+        expiresIn: validFor,
+      }
+    );
+  }
+
+  function verifyToken(token: string): Promise<{ id: string }> {
+    return validateJWT(token);
+  }
+
+  function isUsed(token: string): boolean {
+    return usedTokens.has(token);
+  }
+
+  function markUsed(token: string): void {
+    usedTokens.set(token, Date.now());
+    cleanUp();
+  }
+
+  function cleanUp(): void {
+    const now = Date.now();
+    for (const [token, timestamp] of usedTokens.entries()) {
+      if (now - timestamp > cleanupAfter) {
+        usedTokens.delete(token);
+      }
+    }
+  }
+
+  return {
+    createToken,
+    verifyToken,
+    isUsed,
+    markUsed,
+  };
+}

waspc/data/Generator/templates/sdk/wasp/server/oauth/providers/discord.ts

@@ -0,0 +1,19 @@
+{{={= =}=}}
+import { Discord  } from "arctic";
+
+import { ensureEnvVarsForProvider } from "../env.js";
+import { getRedirectUriForCallback } from "../redirect.js";
+
+export const id = "{= providerId =}";
+export const displayName = "{= displayName =}";
+
+const env = ensureEnvVarsForProvider(
+  ["DISCORD_CLIENT_ID", "DISCORD_CLIENT_SECRET"],
+  displayName
+);
+
+export const oAuthClient = new Discord(
+  env.DISCORD_CLIENT_ID,
+  env.DISCORD_CLIENT_SECRET,
+  getRedirectUriForCallback(id).toString(),
+);

waspc/data/Generator/templates/sdk/wasp/server/oauth/providers/github.ts

@@ -0,0 +1,17 @@
+{{={= =}=}}
+import { GitHub  } from "arctic";
+
+import { ensureEnvVarsForProvider } from "../env.js";
+
+export const id = "{= providerId =}";
+export const displayName = "{= displayName =}";
+
+const env = ensureEnvVarsForProvider(
+  ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET"],
+  displayName
+);
+
+export const oAuthClient = new GitHub(
+  env.GITHUB_CLIENT_ID,
+  env.GITHUB_CLIENT_SECRET,
+);

waspc/data/Generator/templates/sdk/wasp/server/oauth/providers/google.ts

@@ -0,0 +1,19 @@
+{{={= =}=}}
+import { Google  } from "arctic";
+
+import { ensureEnvVarsForProvider } from "../env.js";
+import { getRedirectUriForCallback } from "../redirect.js";
+
+export const id = "{= providerId =}";
+export const displayName = "{= displayName =}";
+
+const env = ensureEnvVarsForProvider(
+  ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
+  displayName,
+);
+
+export const oAuthClient = new Google(
+  env.GOOGLE_CLIENT_ID,
+  env.GOOGLE_CLIENT_SECRET,
+  getRedirectUriForCallback(id).toString(),
+);

waspc/data/Generator/templates/sdk/wasp/server/oauth/providers/keycloak.ts

@@ -0,0 +1,20 @@
+{{={= =}=}}
+import { Keycloak  } from "arctic";
+
+import { ensureEnvVarsForProvider } from "../env.js";
+import { getRedirectUriForCallback } from "../redirect.js";
+
+export const id = "{= providerId =}";
+export const displayName = "{= displayName =}";
+
+const env = ensureEnvVarsForProvider(
+  ["KEYCLOAK_REALM_URL", "KEYCLOAK_CLIENT_ID", "KEYCLOAK_CLIENT_SECRET"],
+  displayName,
+);
+
+export const oAuthClient = new Keycloak(
+  env.KEYCLOAK_REALM_URL,
+  env.KEYCLOAK_CLIENT_ID,
+  env.KEYCLOAK_CLIENT_SECRET,
+  getRedirectUriForCallback(id).toString(),
+);

waspc/data/Generator/templates/server/src/auth/providers/oauth/redirect.ts → waspc/data/Generator/templates/sdk/wasp/server/oauth/redirect.ts

@@ -1,20 +1,23 @@
 {{={= =}=}}
-import { config } from 'wasp/server'
-import { HttpError } from 'wasp/server'
+import { config, HttpError } from '../../server/index.js'
 
+// PRIVATE API (server)
 export const loginPath = '{= serverOAuthLoginHandlerPath =}'
-export const callbackPath = '{= serverOAuthCallbackHandlerPath =}'
+
+// PRIVATE API (server)
 export const exchangeCodeForTokenPath = '{= serverExchangeCodeForTokenHandlerPath =}'
-const clientOAuthCallbackPath = '{= clientOAuthCallbackPath =}'
 
-export function getRedirectUriForCallback(providerName: string): URL {
-  return new URL(`${config.serverUrl}/auth/${providerName}/${callbackPath}`);
-}
+// PRIVATE API (server)
+export const callbackPath = '{= serverOAuthCallbackHandlerPath =}'
 
+const clientOAuthCallbackPath = '{= clientOAuthCallbackPath =}'
+
+// PRIVATE API (server)
 export function getRedirectUriForOneTimeCode(oneTimeCode: string): URL {
   return new URL(`${config.frontendUrl}${clientOAuthCallbackPath}#${oneTimeCode}`);
 }
 
+// PRIVATE API (server)
 export function handleOAuthErrorAndGetRedirectUri(error: unknown): URL {
   if (error instanceof HttpError) {
     const errorMessage = isHttpErrorWithExtraMessage(error)
@@ -26,6 +29,11 @@ export function handleOAuthErrorAndGetRedirectUri(error: unknown): URL {
   return getRedirectUriForError("An unknown error occurred while trying to log in with the OAuth provider.");
 }
 
+// PRIVATE API (SDK)
+export function getRedirectUriForCallback(providerName: string): URL {
+  return new URL(`${config.serverUrl}/auth/${providerName}/${callbackPath}`);
+}
+
 function getRedirectUriForError(error: string): URL {
   return new URL(`${config.frontendUrl}${clientOAuthCallbackPath}?error=${error}`);
 }