74 lines
3.2 KiB
TypeScript
74 lines
3.2 KiB
TypeScript
 
|
import { env } from "@/lib/env";
|
||
|
|
import { mcpIssuer } from "@/lib/auth/jwt";
|
||
|
|
|
||
|
|
/**
|
||
|
|
* The protected-resource metadata document, RFC 9728 §2.
|
||
|
|
*
|
||
|
|
* Shared by both metadata routes — the root `/.well-known/oauth-protected-
|
||
|
|
* resource` and the path-suffixed `/.well-known/oauth-protected-resource/
|
||
|
|
* <resource path>` form of §3.1 — because the two documents differ ONLY in
|
||
|
|
* the `resource` identifier they describe. Anything else drifting between
|
||
|
|
* them is a bug: a client that discovers us through the suffixed URL would
|
||
|
|
* be told to request a different scope set than one that follows the
|
||
|
|
* `WWW-Authenticate: resource_metadata=...` header, and whichever of the two
|
||
|
|
* lost the audience scope would hand back tokens with no `aud` claim.
|
||
|
|
*/
|
||
|
|
export interface ResourceMetadata {
|
||
|
|
resource: string;
|
||
|
|
authorization_servers: string[];
|
||
|
|
scopes_supported: string[];
|
||
|
|
bearer_methods_supported: string[];
|
||
|
|
resource_documentation: string;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* The public origin, with any trailing slash stripped.
|
||
|
|
*
|
||
|
|
* `resource` values are compared as exact strings by clients (RFC 9728 §3.3),
|
||
|
|
* so `https://host/` and `https://host` are not interchangeable — PUBLIC_URL
|
||
|
|
* is written both ways in the wild and only the stripped form is emitted.
|
||
|
|
*/
|
||
|
|
export function publicOrigin(): string {
|
||
|
|
return env().PUBLIC_URL.replace(/\/$/, "");
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Build the metadata document for `resource`.
|
||
|
|
*
|
||
|
|
* The caller supplies the resource identifier because it depends on which
|
||
|
|
* URL the document was fetched from; everything else is deployment config.
|
||
|
|
*/
|
||
|
|
export function buildResourceMetadata(resource: string): ResourceMetadata {
|
||
|
|
// The audience scope MUST be advertised. Authentik only evaluates a scope
|
||
|
|
// mapping when the client requests that scope by name, and the client only
|
||
|
|
// learns scope names from this document. Omit it and every access token
|
||
|
|
// arrives without `aud`, which jwt.ts rejects as "claim invalid: aud".
|
||
|
|
const audienceScope =
|
||
|
|
env().OIDC_AUDIENCE_SCOPE ?? `aud-${env().OIDC_AUDIENCE}`;
|
||
|
|
|
||
|
|
// Same mechanism as the audience scope, different consequence: a client
|
||
|
|
// only requests `offline_access` if it sees the name here, and without
|
||
|
|
// that request the IdP returns no refresh token — so the client cannot
|
||
|
|
// renew and the user gets kicked back to an interactive login whenever
|
||
|
|
// the access token expires.
|
||
|
|
//
|
||
|
|
// Opt-in, because the IdP needs a matching scope mapping; advertising one
|
||
|
|
// it doesn't offer can fail the whole authorization request.
|
||
|
|
const scopes = ["openid", "profile", "email", audienceScope];
|
||
|
|
if (env().OIDC_OFFLINE_ACCESS) scopes.push("offline_access");
|
||
|
|
|
||
|
|
return {
|
||
|
|
resource,
|
||
|
|
// The MCP application's issuer, which is not necessarily the Web UI's —
|
||
|
|
// see mcpIssuer(). Advertising the wrong one sends clients to a discovery
|
||
|
|
// document whose tokens this endpoint will then reject on `iss`.
|
||
|
|
authorization_servers: [mcpIssuer()], // as configured, slash and all
|
||
|
|
scopes_supported: scopes,
|
||
|
|
bearer_methods_supported: ["header"],
|
||
|
|
// Documentation lives at the site root regardless of which resource this
|
||
|
|
// document describes, so it is always derived from the public origin and
|
||
|
|
// not from `resource`.
|
||
|
|
resource_documentation: `${publicOrigin()}/`,
|
||
|
|
};
|
||
|
|
}
|