TokenX

navikt · Jan 8, 2025 · 8e2aa4d · 8e2aa4d
1 parent b169372
commit 8e2aa4d
Show file tree

Hide file tree

Showing 2 changed files with 49 additions and 24 deletions.
diff --git a/server/package.json b/server/package.json
@@ -12,6 +12,7 @@
   "license": "ISC",
   "dependencies": {
     "@navikt/nav-dekoratoren-moduler": "^2.1.4",
+    "@navikt/oasis": "^3.6.0",
     "express": "^4.18.2",
     "express-http-proxy": "^1.6.3"
   }

diff --git a/server/server.js b/server/server.js
@@ -1,15 +1,17 @@
-const express = require('express');
-const app = express();
-const path = require('path');
-const proxy = require('express-http-proxy');
+import express from 'express';
+import path from 'path';
+import proxy from 'express-http-proxy';
+import { getToken, requestOboToken, validateToken } from '@navikt/oasis';
+import { injectDecoratorServerSide } from '@navikt/nav-dekoratoren-moduler/ssr';
 
-const { injectDecoratorServerSide } = require('@navikt/nav-dekoratoren-moduler/ssr');
+const app = express();
 
 const BASE_PATH = '/fritak-agp';
 const HOME_FOLDER = '../dist';
 const PORT = process.env.PORT || 8080;
 const API_URL = process.env.API_URL || 'http://localhost:3000';
 const API_BASEPATH = process.env.API_BASEPATH || '';
+const AUDIENCE = process.env.AUDIENCE || '';
 
 const startServer = () => {
   app.get('/health/is-alive', (req, res) => {
@@ -20,26 +22,48 @@ const startServer = () => {
     res.sendStatus(200);
   });
 
-  app.use(
-    BASE_PATH + '/api/*',
-    proxy(API_URL, {
-      parseReqBody: false,
-      limit: '50mb',
-      proxyReqPathResolver: (req) => req.originalUrl.replace(BASE_PATH, API_BASEPATH),
-      proxyReqOptDecorator: (proxyReqOpts) => {
-        proxyReqOpts.headers['cookie'] = '';
-        return proxyReqOpts;
-      },
-      proxyErrorHandler: (err, res, next) => {
-        console.log(`Error in proxy for ${host} ${err.message}, ${err.code}`);
-        if (err && err.code === 'ECONNREFUSED') {
-          console.log('proxyErrorHandler: Got ECONNREFUSED');
-          return res.status(503).send({ message: `Could not contact ${host}` });
-        }
-        next(err);
+  app.use(BASE_PATH + '/api/*', (req, res) => {
+    const token = getToken(req);
+    if (!token) {
+      /* håndter manglende token */
+      console.error('Mangler token i header');
+      return res.status(401);
+    }
+
+    validateToken(token).then((validation) => {
+      if (!validation.ok) {
+        console.log('Validering feilet: ', validation.error);
+        return res.status(401);
       }
-    })
-  );
+
+      requestOboToken(token, AUDIENCE).then((obo) => {
+        if (!obo.ok) {
+          /* håndter obo-feil */
+          console.error('OBO-feil: ', obo.error);
+          return res.status(401);
+        }
+
+        return proxy(API_URL, {
+          parseReqBody: false,
+          limit: '50mb',
+          proxyReqPathResolver: (req) => req.originalUrl.replace(BASE_PATH, API_BASEPATH),
+          proxyReqOptDecorator: (proxyReqOpts) => {
+            proxyReqOpts.headers['cookie'] = '';
+            proxyReqOpts.headers['Authorization'] = `Bearer ${obo.token}`;
+            return proxyReqOpts;
+          },
+          proxyErrorHandler: (err, res, next) => {
+            console.log(`Error in proxy for ${req.host} ${err.message}, ${err.code}`);
+            if (err && err.code === 'ECONNREFUSED') {
+              console.log('proxyErrorHandler: Got ECONNREFUSED');
+              return res.status(503).send({ message: `Could not contact ${req.host}` });
+            }
+            next(err);
+          }
+        });
+      });
+    });
+  });
 
   app.use(BASE_PATH, express.static(HOME_FOLDER));