Admin
97daa13ebd
Updates the compose build context, the Dockerfile header, the package name and the docs. The compose service and container keep the name frontend/musify-frontend, since nginx routes to http://frontend:3000. The source files also carry the first prettier pass, so the rename and the reformat land together for them.
66 lines
1.8 KiB
TypeScript
66 lines
1.8 KiB
TypeScript
import { redirect, error } from '@sveltejs/kit';
|
|
import * as client from 'openid-client';
|
|
import type { RequestHandler } from './$types';
|
|
import {
|
|
getOidcConfig,
|
|
encodeSession,
|
|
sessionCookieOptions,
|
|
toSessionUser,
|
|
type Session,
|
|
SESSION_COOKIE,
|
|
STATE_COOKIE,
|
|
VERIFIER_COOKIE,
|
|
NONCE_COOKIE,
|
|
RETURN_COOKIE
|
|
} from '$lib/server/auth';
|
|
|
|
export const GET: RequestHandler = async ({ url, cookies }) => {
|
|
const codeVerifier = cookies.get(VERIFIER_COOKIE);
|
|
const state = cookies.get(STATE_COOKIE);
|
|
const nonce = cookies.get(NONCE_COOKIE);
|
|
const returnTo = cookies.get(RETURN_COOKIE) ?? '/';
|
|
|
|
if (!codeVerifier || !state) {
|
|
error(400, 'Estado de autenticación inválido. Vuelve a iniciar sesión.');
|
|
}
|
|
|
|
const config = await getOidcConfig();
|
|
|
|
let tokens;
|
|
try {
|
|
tokens = await client.authorizationCodeGrant(config, url, {
|
|
pkceCodeVerifier: codeVerifier,
|
|
expectedState: state,
|
|
expectedNonce: nonce,
|
|
idTokenExpected: true
|
|
});
|
|
} catch (exception) {
|
|
console.error('Token exchange failed', exception);
|
|
error(401, 'La autenticación ha fallado.');
|
|
}
|
|
|
|
const claims = tokens.claims();
|
|
if (!claims || !tokens.id_token) {
|
|
error(401, 'El proveedor no devolvió el token de identidad.');
|
|
}
|
|
if (!tokens.refresh_token) {
|
|
error(401, 'El proveedor no devolvió un refresh token; revisa el scope offline_access.');
|
|
}
|
|
|
|
const session: Session = {
|
|
...toSessionUser(claims),
|
|
accessToken: tokens.access_token,
|
|
refreshToken: tokens.refresh_token,
|
|
idToken: tokens.id_token,
|
|
expiresAt: Math.floor(Date.now() / 1000) + (tokens.expires_in ?? 3600)
|
|
};
|
|
|
|
cookies.set(SESSION_COOKIE, await encodeSession(session), sessionCookieOptions(url));
|
|
|
|
for (const name of [STATE_COOKIE, VERIFIER_COOKIE, NONCE_COOKIE, RETURN_COOKIE]) {
|
|
cookies.delete(name, { path: '/' });
|
|
}
|
|
|
|
redirect(302, returnTo);
|
|
};
|