feat: /tokens endpoint

pages/api/auth/[...nextauth].js

@@ -1,9 +1,8 @@
 import NextAuth from 'next-auth'
 import Providers from 'next-auth/providers'
-
-// import Adapters from 'next-auth/adapters'
-// import { PrismaClient } from '@prisma/client'
-// const prisma = new PrismaClient()
+import Adapters from 'next-auth/adapters'
+import { PrismaClient } from '@prisma/client'
+const prisma = new PrismaClient()
 
 export default NextAuth({
   providers: [
@@ -49,7 +48,6 @@ export default NextAuth({
   },
   debug: false,
   theme: 'auto'
-
   // Default Database Adapter (TypeORM)
   // database: process.env.DATABASE_URL
 

src/client/index.js

@@ -283,7 +283,6 @@ export async function signIn (provider, options = {}, authorizationParams = {})
   }
 
   const error = new URL(data.url).searchParams.get('error')
-
   if (res.ok) {
     await __NEXTAUTH._getSession({ event: 'storage' })
   }

src/server/cookies.d.ts

@@ -0,0 +1,25 @@
+export interface CookieOption {
+  name?: string
+  options?: {
+    httpOnly?: boolean
+    sameSite?: "lax" | "none" | "strict"
+    path?: string
+    secure?: boolean
+  }
+}
+
+
+export type CookieType = "sessionToken" | "callbackUrl" | "csrfToken" | "accessToken" | "idToken"
+
+export interface AccessToken {
+  accessToken: string
+  refreshToken?: string
+  /** Saved as ISO string */
+  accessTokenExpires?: Date
+}
+
+export type IdToken = string
+
+export interface CookieOptions extends Record<CookieType, CookieOption> {
+
+}

src/server/index.js

@@ -141,6 +141,8 @@ async function NextAuthHandler (req, res, userOptions) {
           return routes.providers(req, res)
         case 'session':
           return routes.session(req, res)
+        case 'tokens':
+          return routes.tokens(req, res)
         case 'csrf':
           return res.json({ csrfToken })
         case 'signin':

src/server/lib/oauth/index.d.ts

@@ -0,0 +1,6 @@
+export interface Account {
+  accessToken?: string
+  accessTokenExpires?: Date | null
+  refreshToken?: string
+  idToken?: string
+}

src/server/routes/callback.js

@@ -281,3 +281,56 @@ export default async function callback (req, res) {
   }
   return res.status(500).end(`Error: Callback for provider type ${provider.type} not supported`)
 }
+
+/**
+ * A common usecase is to put the access_token into the session token.
+ * While nothing wrong with it, the access_token quickly fills up the 4096 bytes
+ * allowed by most browsers. We therefore put id_token, and access_token/refresh_token
+ * in their own cookies.
+ * @param {{
+ *  cookies: import('../cookies').CookieOptions
+ *  res: import('next').NextApiResponse
+ *  maxAge: number
+ *  account: import('../lib/oauth/index').Account
+ *  secret: string
+ * }} SaveOAuthTokensInCookieParams
+ */
+function saveOAuthTokensInCookie ({ res, cookies, account, maxAge, secret }) {
+  const expires = new Date()
+  expires.setTime(expires.getTime() + (maxAge * 1000))
+
+  if (account.accessToken) {
+    let accessTokenExpires = account.accessTokenExpires
+    if (accessTokenExpires) {
+      accessTokenExpires = new Date(accessTokenExpires)
+    } else {
+      accessTokenExpires = expires
+    }
+    // Save the access_token and refresh_token together
+    const accessToken = {
+      accessToken: account.accessToken,
+      refreshToken: account.refreshToken
+    }
+
+    // TODO: Encrypt with secret
+    const encryptedAccessToken = JSON.stringify(accessToken)
+
+    cookie.set(
+      res,
+      cookies.accessToken.name,
+      encryptedAccessToken,
+      { expires: accessTokenExpires.toISOString(), ...cookies.accessToken.options }
+    )
+  }
+
+  if (account.idToken) {
+    // TODO: Encrypt with secret
+    const encryptedIdToken = account.idToken
+    cookie.set(
+      res,
+      cookies.idToken.name,
+      encryptedIdToken,
+      { expires: expires, ...cookies.idToken.options }
+    )
+  }
+}

src/server/routes/tokens.js

@@ -0,0 +1,163 @@
+
+// NOTE: fetch() is built in to Next.js 9.4
+/* global fetch:false */
+import cookie from '../lib/cookie'
+import logger from '../../lib/logger'
+
+/**
+ *
+ * @param {import('next').NextApiRequest} req
+ * @param {import('next').NextApiResponse} res
+ * @param {import('..').NextAuthOptions} options
+ * @param {(value: any) => void} done
+ */
+export default async function tokens (req, res, options, done) {
+  const { query } = req
+  const {
+    nextauth,
+    tokenType = nextauth[2],
+    action = nextauth[3]
+  } = query
+  const providerName = options?.provider
+
+  const { cookies } = options
+  const useJwtSession = options.session.jwt
+  const hasAccessToken = cookies.sessionToken.name in req.cookies
+  const sessionToken = req.cookies[cookies.sessionToken.name]
+
+  let response = {}
+  res.setHeader('Content-Type', 'application/json')
+
+  if (!hasAccessToken && !sessionToken) {
+    res.json(response)
+    return done()
+  }
+
+  if (req.method === 'GET') {
+    if (useJwtSession) {
+      const provider = options.providers[providerName]
+      if (provider?.type !== 'oauth') {
+        res.json(response)
+        logger.error('INVALID_TOKEN_PROVIDER', 'Invalid ')
+        return done()
+      }
+      // TODO: decrypt with options.secret
+      /** @type {import('../cookies').AccessToken} */
+      let accessToken = req[cookies.accessToken.name]
+
+      if (new Date().toISOString() < accessToken.accessTokenExpires) {
+        // The access token is still fresh, return it
+        response = {
+          token: accessToken.accessToken,
+          expires: accessToken.accessTokenExpires
+        }
+      } else {
+        // If the provider is OIDC compliant, we can try to refresh the token
+        if (provider.oidc) {
+          try {
+            accessToken = await refreshAccessToken({ accessToken, provider })
+            response = accessToken
+          } catch (error) {
+            logger.error('REFRESH_TOKEN_ERROR', error)
+          }
+        } else {
+          // REVIEW: redirect to signin(?)
+        }
+      }
+    } else {
+      const { adapter } = options
+      try {
+        const { getSession, updateSession, getAccounts, getAccount } = await adapter.getAdapter(options)
+        const session = await getSession(sessionToken)
+        if (session) {
+          // Trigger update to session object to update session expiry
+          await updateSession(session)
+
+          if (!providerName) {
+            response = await getAccounts(session.userId)
+          } else {
+            let expired
+            // TODO: Determine if tokens have expired
+
+            if (action === 'renew' || expired) {
+              // TODO: Exchange refresh token for access token
+            }
+
+            const account = await getAccount(session.userId, providerName)
+            if (account) {
+              switch (tokenType) {
+                case undefined:
+                case 'access':
+                  response = {
+                    type: 'access',
+                    token: account.accessToken
+                  }
+                  break
+                case 'refresh':
+                  response = {
+                    type: 'refresh',
+                    token: account.refreshToken
+                  }
+                  break
+                default:
+                  res.status(404).end()
+                  return done()
+              }
+            } else {
+              res.status(404).end()
+              return done()
+            }
+          }
+        } else if (sessionToken) {
+          // If sessionToken was found set but it's not valid for a session then
+          // remove the sessionToken cookie from browser.
+          cookie.set(res, cookies.sessionToken.name, '', { ...cookies.sessionToken.options, maxAge: 0 })
+        }
+      } catch (error) {
+        logger.error('TOKEN_ERROR', error)
+      }
+    }
+  }
+
+  res.json(response)
+  return done()
+}
+
+/**
+ * @param {{
+ * token: import('../cookies').AccessToken,
+ *   provider: {
+ *   accessTokenUrl: string
+ *   clientId: string
+ *   clientSecret: string
+ * }
+ * }} params
+ */
+async function refreshAccessToken ({ token, provider }) {
+  const response = await fetch(provider.accessTokenUrl, {
+    body: new URLSearchParams({
+      client_id: provider.clientId,
+      client_secret: provider.clientSecret,
+      grant_type: 'refresh_token',
+      refresh_token: token.refreshToken
+    }),
+    headers: {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    },
+    method: 'POST'
+  })
+
+  const newTokens = await response.json()
+
+  if (!response.ok) {
+    throw new Error({ newTokens })
+  }
+
+  return {
+    ...token,
+    accessToken: newTokens.access_token,
+    accessTokenExpires: new Date(newTokens.expires_in).toISOString(),
+    // Fallback to the previous refresh_token, if it is not rotating/sliding
+    refreshToken: newTokens.refresh_token || token.refreshToken
+  }
+}