From 87a40021e190a00a30adee308992c93315a1ebe0 Mon Sep 17 00:00:00 2001 From: Kallesh B S Date: Thu, 26 Jun 2025 11:13:10 +0530 Subject: [PATCH] auth code sanitized for last stable commit - domain added --- src/auth/auth.controller.ts | 24 +++++----- src/auth/auth.service.ts | 86 ++---------------------------------- src/guards/jwt-auth.guard.ts | 18 +------- 3 files changed, 16 insertions(+), 112 deletions(-) diff --git a/src/auth/auth.controller.ts b/src/auth/auth.controller.ts index 1a30934..b5eb36e 100644 --- a/src/auth/auth.controller.ts +++ b/src/auth/auth.controller.ts @@ -18,18 +18,18 @@ export class AuthController { if (k.access_token) { res.cookie('access_token', k.access_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, }); } if (k.refresh_token) { res.cookie('refresh_token', k.refresh_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, }); } @@ -67,9 +67,9 @@ export class AuthController { if (k.access_token) { res.cookie('access_token', k.access_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, path: '/' }); } @@ -77,9 +77,9 @@ export class AuthController { if (k.refresh_token) { res.cookie('refresh_token', k.refresh_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, path: '/' }); } diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts index b6ff11e..6a166b9 100644 --- a/src/auth/auth.service.ts +++ b/src/auth/auth.service.ts @@ -3,7 +3,7 @@ import { OracleDBService } from 'src/db/db.service'; import { AuthLoginDTO } from './auth.dto'; import * as oracledb from 'oracledb'; import { ConfigService } from '@nestjs/config'; -import axios, { AxiosRequestConfig, AxiosResponse } from 'axios'; +import axios, { AxiosRequestConfig } from 'axios'; import { Request } from 'express'; import * as jwkToPem from "jwk-to-pem" import * as jwt from "jsonwebtoken" @@ -167,66 +167,14 @@ export class AuthService { } } - async introspectTokenX(token: string): Promise { - let det: any = await jwt.decode(token); - - const { email } = det; - - console.log("email : ", email); - - let uid = await this.getUserIdByEmail(email); - - console.log("uid : ", uid); - - const USERINFO_URL = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; - - const admintoken = await this.getAdminAccessToken(); - - try { - console.log("url : ", USERINFO_URL); - - const response = await axios.get(USERINFO_URL, { - headers: { - Authorization: `Bearer ${admintoken}` - } - }); - - console.log("active session data : ", response.data); - - console.log("from AuthService decodeToken .......................... end"); - - if (response.data.length > 0) return { active: true }; - else return { active: false } - - } catch (error) { - console.log("Error in introspectToken : ", error.message); - throw new InternalServerErrorException() - } - } - async introspectToken(token: string): Promise { try { - // Securely verify the token const decoded = jwt.decode(token) as DecodedToken; const { email } = decoded; if (!email) throw new UnauthorizedException('Authentication failed'); - // const uid = await this.getUserIdByEmail(email); - - // if (!uid) throw new UnauthorizedException('No user ID found for email.'); - - // const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; - - // const adminToken = await this.getAdminAccessToken(); - - // const response = await axios.get(userInfoUrl, { - // headers: { - // Authorization: `Bearer ${adminToken}`, - // }, - // }); - const sessionData = await this.getUserSession(email); return { active: Array.isArray(sessionData) && sessionData.length > 0 }; @@ -242,13 +190,13 @@ export class AuthService { } } - async getUserSession(email) { + async getUserSession(email:string) { try { const uid = await this.getUserIdByEmail(email); if (!uid) throw new UnauthorizedException('No user ID found for email.'); - const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; + const userInfoUrl = `${this.USERS_URL}/${uid}/sessions`; const adminToken = await this.getAdminAccessToken(); @@ -303,7 +251,6 @@ export class AuthService { params.append('client_secret', this.CLIENT_SECRET); params.append('username', username); params.append('password', password); - // params.append('scope', 'openid'); try { const userSession = await this.getUserSession(username) @@ -340,33 +287,6 @@ export class AuthService { } } - async getUserIdByEmailX(email: string) { - - let url = `${this.USERS_URL}?email=${email}`; - - let adminAccessToken = await this.getAdminAccessToken(); - - console.log("admin access_token for getting uid : ", adminAccessToken); - console.log("url for uid : ", url); - - const options: AxiosRequestConfig = { - method: 'GET', - url, - headers: { - Authorization: `Bearer ${adminAccessToken}`, - "Content-Type": "application/json" - } - }; - - try { - const { data } = await axios.request(options); - return data[0]?.id; - } catch (error) { - // console.error(error); - console.log("from getUserIdByEmail : ", error.message); - } - } - async getUserIdByEmail(email: string): Promise { try { const adminAccessToken = await this.getAdminAccessToken(); diff --git a/src/guards/jwt-auth.guard.ts b/src/guards/jwt-auth.guard.ts index 9df100a..490be9e 100644 --- a/src/guards/jwt-auth.guard.ts +++ b/src/guards/jwt-auth.guard.ts @@ -23,22 +23,6 @@ export class JwtAuthGuard implements CanActivate { console.log("No token found from Request"); throw new UnauthorizedException('Authentication failed'); } - - // Decode the token without verifying the signature - // const decoded = jwt.decode(token) as { exp?: number }; - - // if (!decoded || !decoded.exp) { - // throw new UnauthorizedException('Authentication failed'); - // } - - // const currentTime = Math.floor(Date.now() / 1000); // in seconds - - // if (decoded.exp < currentTime) { - // console.log('Token expired'); - // throw new UnauthorizedException('Invalid Token'); - // } - - // Token is valid and not expired - continue with your normal logic try { const verifiedUser = await this.authService.decodeToken(token); request.user = verifiedUser; @@ -51,7 +35,7 @@ export class JwtAuthGuard implements CanActivate { if (error instanceof UnauthorizedException || error instanceof UE) { throw error; } - + throw new InternalServerException(); } }