auth code sanitized for last stable commit - domain added

src/auth/auth.controller.ts

@@ -18,18 +18,18 @@ export class AuthController {
     if (k.access_token) {
       res.cookie('access_token', k.access_token, {
         httpOnly: true,
-        secure: true,        // set to true if you're on HTTPS
+        secure: true,
-        sameSite: 'none',  // adjust based on your needs (strict, lax , none)
+        sameSite: 'none',
-        maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable
+        maxAge: 8 * 60 * 60 * 1000,
       });
     }
 
     if (k.refresh_token) {
       res.cookie('refresh_token', k.refresh_token, {
         httpOnly: true,
-        secure: true,        // set to true if you're on HTTPS
+        secure: true,
-        sameSite: 'none',  // adjust based on your needs (strict, lax , none)
+        sameSite: 'none',
-        maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable
+        maxAge: 8 * 60 * 60 * 1000,
       });
     }
 
@@ -67,9 +67,9 @@ export class AuthController {
     if (k.access_token) {
       res.cookie('access_token', k.access_token, {
         httpOnly: true,
-        secure: true,        // set to true if you're on HTTPS
+        secure: true,
-        sameSite: 'none',  // adjust based on your needs (strict, lax , none)
+        sameSite: 'none',
-        maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable
+        maxAge: 8 * 60 * 60 * 1000,
         path: '/'
       });
     }
@@ -77,9 +77,9 @@ export class AuthController {
     if (k.refresh_token) {
       res.cookie('refresh_token', k.refresh_token, {
         httpOnly: true,
-        secure: true,        // set to true if you're on HTTPS
+        secure: true,
-        sameSite: 'none',  // adjust based on your needs (strict, lax , none)
+        sameSite: 'none',
-        maxAge: 8 * 60 * 60 * 1000, // convert seconds to ms if applicable
+        maxAge: 8 * 60 * 60 * 1000,
         path: '/'
       });
     }

src/auth/auth.service.ts

@@ -3,7 +3,7 @@ import { OracleDBService } from 'src/db/db.service';
 import { AuthLoginDTO } from './auth.dto';
 import * as oracledb from 'oracledb';
 import { ConfigService } from '@nestjs/config';
-import axios, { AxiosRequestConfig, AxiosResponse } from 'axios';
+import axios, { AxiosRequestConfig } from 'axios';
 import { Request } from 'express';
 import * as jwkToPem from "jwk-to-pem"
 import * as jwt from "jsonwebtoken"
@@ -167,66 +167,14 @@ export class AuthService {
     }
   }
 
-  async introspectTokenX(token: string): Promise<any> {
-    let det: any = await jwt.decode(token);
-
-    const { email } = det;
-
-    console.log("email : ", email);
-
-    let uid = await this.getUserIdByEmail(email);
-
-    console.log("uid : ", uid);
-
-    const USERINFO_URL = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`;
-
-    const admintoken = await this.getAdminAccessToken();
-
-    try {
-      console.log("url : ", USERINFO_URL);
-
-      const response = await axios.get(USERINFO_URL, {
-        headers: {
-          Authorization: `Bearer ${admintoken}`
-        }
-      });
-
-      console.log("active session data : ", response.data);
-
-      console.log("from AuthService decodeToken .......................... end");
-
-      if (response.data.length > 0) return { active: true };
-      else return { active: false }
-
-    } catch (error) {
-      console.log("Error in introspectToken : ", error.message);
-      throw new InternalServerErrorException()
-    }
-  }
-
   async introspectToken(token: string): Promise<IntrospectResult> {
     try {
-      // Securely verify the token
       const decoded = jwt.decode(token) as DecodedToken;
 
       const { email } = decoded;
 
       if (!email) throw new UnauthorizedException('Authentication failed');
 
-      // const uid = await this.getUserIdByEmail(email);
-
-      // if (!uid) throw new UnauthorizedException('No user ID found for email.');
-
-      // const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`;
-
-      // const adminToken = await this.getAdminAccessToken();
-
-      // const response = await axios.get(userInfoUrl, {
-      //   headers: {
-      //     Authorization: `Bearer ${adminToken}`,
-      //   },
-      // });
-
       const sessionData = await this.getUserSession(email);
 
       return { active: Array.isArray(sessionData) && sessionData.length > 0 };
@@ -242,13 +190,13 @@ export class AuthService {
     }
   }
 
-  async getUserSession(email) {
+  async getUserSession(email:string) {
     try {
       const uid = await this.getUserIdByEmail(email);
 
       if (!uid) throw new UnauthorizedException('No user ID found for email.');
 
-      const userInfoUrl = `${this.KEYCLOAK_URL}/admin/realms/${this.KEYCLOAK_REALM}/users/${uid}/sessions`;
+      const userInfoUrl = `${this.USERS_URL}/${uid}/sessions`;
 
       const adminToken = await this.getAdminAccessToken();
 
@@ -303,26 +251,14 @@ export class AuthService {
     params.append('client_secret', this.CLIENT_SECRET);
     params.append('username', username);
     params.append('password', password);
-    // params.append('scope', 'openid');
 
     try {
       const userSession = await this.getUserSession(username)
 
       if (access_token && refresh_token && userSession.length > 0) {
-        let tokens = await this.getTokenFromRefreshToken(refresh_token);
+        let tokens = await this.getTokenFromRefreshToken(req);
-        const decodedHeader = jwt.decode(access_token, { complete: true });
+        const decoded = jwt.decode(access_token, { complete: true });
-
+        const email:any = (decoded && typeof decoded === 'object') ? (decoded as any).payload?.email : undefined;
-        if (!decodedHeader || typeof decodedHeader !== 'object') {
-          throw new UnauthorizedException("Authentication failed")
-        }
-
-        const kid: any = decodedHeader.header.kid;
-
-        const publicKey = await this.getPublicKey(kid);
-
-        const decoded = jwt.verify(access_token, publicKey, { algorithms: ['RS256'] });
-
-        const email = (decoded && typeof decoded === 'object') ? (decoded as any).email : undefined;
         return { ...tokens, email }
       }
 
@@ -340,33 +276,6 @@ export class AuthService {
     }
   }
 
-  async getUserIdByEmailX(email: string) {
-
-    let url = `${this.USERS_URL}?email=${email}`;
-
-    let adminAccessToken = await this.getAdminAccessToken();
-
-    console.log("admin access_token for getting uid : ", adminAccessToken);
-    console.log("url for uid : ", url);
-
-    const options: AxiosRequestConfig = {
-      method: 'GET',
-      url,
-      headers: {
-        Authorization: `Bearer ${adminAccessToken}`,
-        "Content-Type": "application/json"
-      }
-    };
-
-    try {
-      const { data } = await axios.request(options);
-      return data[0]?.id;
-    } catch (error) {
-      // console.error(error);
-      console.log("from getUserIdByEmail : ", error.message);
-    }
-  }
-
   async getUserIdByEmail(email: string): Promise<string> {
     try {
       const adminAccessToken = await this.getAdminAccessToken();

src/guards/jwt-auth.guard.ts

@@ -23,22 +23,6 @@ export class JwtAuthGuard implements CanActivate {
       console.log("No token found from Request");
       throw new UnauthorizedException('Authentication failed');
     }
-
-    // Decode the token without verifying the signature
-    // const decoded = jwt.decode(token) as { exp?: number };
-
-    // if (!decoded || !decoded.exp) {
-    //   throw new UnauthorizedException('Authentication failed');
-    // }
-
-    // const currentTime = Math.floor(Date.now() / 1000); // in seconds
-
-    // if (decoded.exp < currentTime) {
-    //   console.log('Token expired');
-    //   throw new UnauthorizedException('Invalid Token');
-    // }
-
-    // Token is valid and not expired - continue with your normal logic
     try {
       const verifiedUser = await this.authService.decodeToken(token);
       request.user = verifiedUser;