oidc.controller.ts

oidc.controller.tsapps/api/src/modules/sso/oidc.controller.tsraw ← sso3,793 B← Back to the app
1/**
2 * TASK-0131 — OIDC RP endpoints (mounted OUTSIDE the `api/v1` prefix — the
3 * authorization-code flow is browser-redirect, not a JSON API):
4 *
5 *   GET /sso/oidc/:orgId/authorize — 302 → the IdP's authorize URL (state
6 *                                      + nonce + PKCE challenge).
7 *   GET /sso/oidc/:orgId/callback  — the IdP redirects back with
8 *                                      `?code=&state=`.
9 *
10 * Both are PUBLIC (no user JWT) — the state/nonce/PKCE + the RS256 ID-token
11 * signature are the authentication. The global AuthGuard whitelists the
12 * `/sso/` prefix and `main.ts` excludes it from the api/v1 prefix.
13 *
14 * Result handling (browser context): failure → 302 to
15 * `/login?error=sso_oidc_<reason>`; success → the refresh cookie is set by
16 * `provision()` and the browser is redirected to `/w/default`.
17 */
18import { Controller, Get, Inject, Param, Query, Req, Res } from "@nestjs/common";
19import type { Request, Response } from "express";
20import { PrismaService } from "../../common/prisma.service.js";
21import { loadEnv } from "../../config/env.js";
22import { OidcService } from "./oidc.service.js";
23 
24@Controller("sso")
25export class OidcController {
26  constructor(
27    @Inject(PrismaService) private readonly prisma: PrismaService,
28    @Inject(OidcService) private readonly oidc: OidcService
29  ) {}
30 
31  /**
32   * The origin that SERVES the SSO protocol routes (the API) — the start
33   * dispatcher redirects to `/saml/start/` or `/sso/oidc/` (authorize),
34   * both API routes. SSO_ORIGIN (API origin in two-origin dev) or WEB_ORIGIN
35   * (single-origin nginx).
36   */
37  private origin(): string {
38    const env = loadEnv();
39    return (env.SSO_ORIGIN || env.WEB_ORIGIN).replace(/\/$/, "");
40  }
41 
42  /** GET /sso/oidc/:orgId/authorize — start the OIDC authorization-code flow. */
43  @Get("oidc/:orgId/authorize")
44  async authorize(@Param("orgId") orgId: string, @Res() res: Response): Promise<void> {
45    const { url } = await this.oidc.authorize(orgId);
46    res.status(302).header("location", url).end();
47  }
48 
49  /** GET /sso/oidc/:orgId/callback — the IdP redirects back with code + state. */
50  @Get("oidc/:orgId/callback")
51  async callback(
52    @Param("orgId") orgId: string,
53    @Query() query: { code?: string; state?: string },
54    @Req() req: Request,
55    @Res() res: Response
56  ): Promise<void> {
57    await this.oidc.callback(orgId, { code: query.code, state: query.state }, req, res);
58  }
59 
60  /**
61   * GET /sso/start/:orgSlug — PUBLIC (no auth) slug-addressed SSO START
62   * dispatcher. The login page learns only the org slug from the
63   * minimal-info `GET /auth/sso/options?email=` (it never learns the
64   * protocol), so it points the browser here and the SERVER does the
65   * protocol-specific redirect: SAML → `/saml/start/:slug` (which builds
66   * the AuthnRequest and 302s to the IdP); OIDC → `/sso/oidc/:orgId/authorize`.
67   */
68  @Get("start/:orgSlug")
69  async start(@Param("orgSlug") orgSlug: string, @Res() res: Response): Promise<void> {
70    const org = await this.prisma.organization.findUnique({
71      where: { slug: orgSlug },
72      select: { id: true, slug: true }
73    });
74    if (!org) {
75      res.status(404).json({ error: { code: "NOT_FOUND", message: "Unknown organization." } });
76      return;
77    }
78    const provider = await this.prisma.ssoProvider.findUnique({
79      where: { organizationId: org.id },
80      select: { type: true }
81    });
82    if (!provider) {
83      res.status(404).json({ error: { code: "NOT_FOUND", message: "Organization has no SSO provider." } });
84      return;
85    }
86    const location =
87      provider.type === "SAML"
88        ? `${this.origin()}/saml/start/${org.slug}`
89        : `${this.origin()}/sso/oidc/${org.id}/authorize`;
90    res.status(302).header("location", location).end();
91  }
92}
93