From b41e00959c799bba09404f9b771346ee15b640d8 Mon Sep 17 00:00:00 2001 From: Kallesh B S Date: Fri, 27 Jun 2025 15:49:10 +0530 Subject: [PATCH] auth code sanitized for last stable commit - domain added --- src/auth/auth.controller.ts | 24 ++++---- src/auth/auth.service.ts | 103 ++--------------------------------- src/guards/jwt-auth.guard.ts | 18 +----- 3 files changed, 19 insertions(+), 126 deletions(-) diff --git a/src/auth/auth.controller.ts b/src/auth/auth.controller.ts index 1a30934..b5eb36e 100644 --- a/src/auth/auth.controller.ts +++ b/src/auth/auth.controller.ts @@ -18,18 +18,18 @@ export class AuthController { if (k.access_token) { res.cookie('access_token', k.access_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, }); } if (k.refresh_token) { res.cookie('refresh_token', k.refresh_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, }); } @@ -67,9 +67,9 @@ export class AuthController { if (k.access_token) { res.cookie('access_token', k.access_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, path: '/' }); } @@ -77,9 +77,9 @@ export class AuthController { if (k.refresh_token) { res.cookie('refresh_token', k.refresh_token, { httpOnly: true, - secure: true, // set to true if you're on HTTPS - sameSite: 'none', // adjust based on your needs (strict, lax , none) - maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable + secure: true, + sameSite: 'none', + maxAge: 8 * 60 * 60 * 1000, path: '/' }); } diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts index b6ff11e..9e5a48b 100644 --- a/src/auth/auth.service.ts +++ b/src/auth/auth.service.ts @@ -3,7 +3,7 @@ import { OracleDBService } from 'src/db/db.service'; import { AuthLoginDTO } from './auth.dto'; import * as oracledb from 'oracledb'; import { ConfigService } from '@nestjs/config'; -import axios, { AxiosRequestConfig, AxiosResponse } from 'axios'; +import axios, { AxiosRequestConfig } from 'axios'; import { Request } from 'express'; import * as jwkToPem from "jwk-to-pem" import * as jwt from "jsonwebtoken" @@ -167,66 +167,14 @@ export class AuthService { } } - async introspectTokenX(token: string): Promise { - let det: any = await jwt.decode(token); - - const { email } = det; - - console.log("email : ", email); - - let uid = await this.getUserIdByEmail(email); - - console.log("uid : ", uid); - - const USERINFO_URL = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; - - const admintoken = await this.getAdminAccessToken(); - - try { - console.log("url : ", USERINFO_URL); - - const response = await axios.get(USERINFO_URL, { - headers: { - Authorization: `Bearer ${admintoken}` - } - }); - - console.log("active session data : ", response.data); - - console.log("from AuthService decodeToken .......................... end"); - - if (response.data.length > 0) return { active: true }; - else return { active: false } - - } catch (error) { - console.log("Error in introspectToken : ", error.message); - throw new InternalServerErrorException() - } - } - async introspectToken(token: string): Promise { try { - // Securely verify the token const decoded = jwt.decode(token) as DecodedToken; const { email } = decoded; if (!email) throw new UnauthorizedException('Authentication failed'); - // const uid = await this.getUserIdByEmail(email); - - // if (!uid) throw new UnauthorizedException('No user ID found for email.'); - - // const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; - - // const adminToken = await this.getAdminAccessToken(); - - // const response = await axios.get(userInfoUrl, { - // headers: { - // Authorization: `Bearer ${adminToken}`, - // }, - // }); - const sessionData = await this.getUserSession(email); return { active: Array.isArray(sessionData) && sessionData.length > 0 }; @@ -242,13 +190,13 @@ export class AuthService { } } - async getUserSession(email) { + async getUserSession(email:string) { try { const uid = await this.getUserIdByEmail(email); if (!uid) throw new UnauthorizedException('No user ID found for email.'); - const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`; + const userInfoUrl = `${this.USERS_URL}/${uid}/sessions`; const adminToken = await this.getAdminAccessToken(); @@ -303,26 +251,14 @@ export class AuthService { params.append('client_secret', this.CLIENT_SECRET); params.append('username', username); params.append('password', password); - // params.append('scope', 'openid'); try { const userSession = await this.getUserSession(username) if (access_token && refresh_token && userSession.length > 0) { - let tokens = await this.getTokenFromRefreshToken(refresh_token); - const decodedHeader = jwt.decode(access_token, { complete: true }); - - if (!decodedHeader || typeof decodedHeader !== 'object') { - throw new UnauthorizedException("Authentication failed") - } - - const kid: any = decodedHeader.header.kid; - - const publicKey = await this.getPublicKey(kid); - - const decoded = jwt.verify(access_token, publicKey, { algorithms: ['RS256'] }); - - const email = (decoded && typeof decoded === 'object') ? (decoded as any).email : undefined; + let tokens = await this.getTokenFromRefreshToken(req); + const decoded = jwt.decode(access_token, { complete: true }); + const email:any = (decoded && typeof decoded === 'object') ? (decoded as any).payload?.email : undefined; return { ...tokens, email } } @@ -340,33 +276,6 @@ export class AuthService { } } - async getUserIdByEmailX(email: string) { - - let url = `${this.USERS_URL}?email=${email}`; - - let adminAccessToken = await this.getAdminAccessToken(); - - console.log("admin access_token for getting uid : ", adminAccessToken); - console.log("url for uid : ", url); - - const options: AxiosRequestConfig = { - method: 'GET', - url, - headers: { - Authorization: `Bearer ${adminAccessToken}`, - "Content-Type": "application/json" - } - }; - - try { - const { data } = await axios.request(options); - return data[0]?.id; - } catch (error) { - // console.error(error); - console.log("from getUserIdByEmail : ", error.message); - } - } - async getUserIdByEmail(email: string): Promise { try { const adminAccessToken = await this.getAdminAccessToken(); diff --git a/src/guards/jwt-auth.guard.ts b/src/guards/jwt-auth.guard.ts index 9df100a..490be9e 100644 --- a/src/guards/jwt-auth.guard.ts +++ b/src/guards/jwt-auth.guard.ts @@ -23,22 +23,6 @@ export class JwtAuthGuard implements CanActivate { console.log("No token found from Request"); throw new UnauthorizedException('Authentication failed'); } - - // Decode the token without verifying the signature - // const decoded = jwt.decode(token) as { exp?: number }; - - // if (!decoded || !decoded.exp) { - // throw new UnauthorizedException('Authentication failed'); - // } - - // const currentTime = Math.floor(Date.now() / 1000); // in seconds - - // if (decoded.exp < currentTime) { - // console.log('Token expired'); - // throw new UnauthorizedException('Invalid Token'); - // } - - // Token is valid and not expired - continue with your normal logic try { const verifiedUser = await this.authService.decodeToken(token); request.user = verifiedUser; @@ -51,7 +35,7 @@ export class JwtAuthGuard implements CanActivate { if (error instanceof UnauthorizedException || error instanceof UE) { throw error; } - + throw new InternalServerException(); } }