WIP user representation

src/core/Oidc.ts

@@ -1,8 +1,9 @@
 import type { OidcInitializationError } from "./OidcInitializationError";
 
 export declare type Oidc<
-    DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec
-> = Oidc.LoggedIn<DecodedIdToken> | Oidc.NotLoggedIn;
+    DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec,
+    User = never
+> = Oidc.LoggedIn<DecodedIdToken, User> | Oidc.NotLoggedIn;
 
 export declare namespace Oidc {
     export type Common = {
@@ -36,59 +37,67 @@ export declare namespace Oidc {
         initializationError: OidcInitializationError | undefined;
     };
 
-    export type LoggedIn<DecodedIdToken extends Record<string, unknown> = Record<string, unknown>> =
-        Common & {
-            isUserLoggedIn: true;
-            renewTokens(params?: {
-                extraTokenParams?: Record<string, string | undefined>;
-            }): Promise<void>;
-            getTokens: () => Promise<Tokens<DecodedIdToken>>;
-            subscribeToTokensChange: (onTokenChange: (tokens: Tokens<DecodedIdToken>) => void) => {
-                unsubscribeFromTokensChange: () => void;
-            };
-            getDecodedIdToken: () => DecodedIdToken;
-            logout: (
-                params:
-                    | { redirectTo: "home" | "current page" }
-                    | { redirectTo: "specific url"; url: string }
-            ) => Promise<never>;
-            goToAuthServer: (params: {
-                extraQueryParams?: Record<string, string | undefined>;
-                redirectUrl?: string;
-                transformUrlBeforeRedirect?: (url: string) => string;
-            }) => Promise<never>;
-            subscribeToAutoLogoutCountdown: (
-                tickCallback: (params: { secondsLeft: number | undefined }) => void
-            ) => { unsubscribeFromAutoLogoutCountdown: () => void };
-            /**
-             * If you called `goToAuthServer` or `login` with extraQueryParams, this object let you know the outcome of the
-             * of the action that was intended.
-             *
-             * For example, on a Keycloak server, if you called `goToAuthServer({ extraQueryParams: { kc_action: "UPDATE_PASSWORD" } })`
-             * you'll get back: `{ extraQueryParams: { kc_action: "UPDATE_PASSWORD" }, result: { kc_action_status: "success" } }` (or "cancelled")
-             */
-            backFromAuthServer:
-                | {
-                      extraQueryParams: Record<string, string>;
-                      result: Record<string, string>;
-                  }
-                | undefined;
-            /**
-             * This is true when the user has just returned from the login pages.
-             * This is also true when the user navigate to your app and was able to be silently signed in because there was still a valid session.
-             * This false however when the use just reload the page.
-             *
-             * This can be used to perform some action related to session initialization
-             * but avoiding doing it repeatedly every time the user reload the page.
-             *
-             * Note that this is referring to the browser session and not the OIDC session
-             * on the server side.
-             *
-             * If you want to perform an action only when a new OIDC session is created
-             * you can test oidc.isNewBrowserSession && oidc.backFromAuthServer !== undefined
-             */
-            isNewBrowserSession: boolean;
+    export type LoggedIn<
+        DecodedIdToken extends Record<string, unknown> = Record<string, unknown>,
+        User = never
+    > = Common & {
+        isUserLoggedIn: true;
+        renewTokens(params?: { extraTokenParams?: Record<string, string | undefined> }): Promise<void>;
+        getTokens: () => Promise<Tokens<DecodedIdToken>>;
+        subscribeToTokensChange: (onTokenChange: (tokens: Tokens<DecodedIdToken>) => void) => {
+            unsubscribeFromTokensChange: () => void;
         };
+        getDecodedIdToken: () => DecodedIdToken;
+        logout: (
+            params: { redirectTo: "home" | "current page" } | { redirectTo: "specific url"; url: string }
+        ) => Promise<never>;
+        goToAuthServer: (params: {
+            extraQueryParams?: Record<string, string | undefined>;
+            redirectUrl?: string;
+            transformUrlBeforeRedirect?: (url: string) => string;
+        }) => Promise<never>;
+        subscribeToAutoLogoutCountdown: (
+            tickCallback: (params: { secondsLeft: number | undefined }) => void
+        ) => { unsubscribeFromAutoLogoutCountdown: () => void };
+        /**
+         * If you called `goToAuthServer` or `login` with extraQueryParams, this object let you know the outcome of the
+         * of the action that was intended.
+         *
+         * For example, on a Keycloak server, if you called `goToAuthServer({ extraQueryParams: { kc_action: "UPDATE_PASSWORD" } })`
+         * you'll get back: `{ extraQueryParams: { kc_action: "UPDATE_PASSWORD" }, result: { kc_action_status: "success" } }` (or "cancelled")
+         */
+        backFromAuthServer:
+            | {
+                  extraQueryParams: Record<string, string>;
+                  result: Record<string, string>;
+              }
+            | undefined;
+        /**
+         * This is true when the user has just returned from the login pages.
+         * This is also true when the user navigate to your app and was able to be silently signed in because there was still a valid session.
+         * This false however when the use just reload the page.
+         *
+         * This can be used to perform some action related to session initialization
+         * but avoiding doing it repeatedly every time the user reload the page.
+         *
+         * Note that this is referring to the browser session and not the OIDC session
+         * on the server side.
+         *
+         * If you want to perform an action only when a new OIDC session is created
+         * you can test oidc.isNewBrowserSession && oidc.backFromAuthServer !== undefined
+         */
+        isNewBrowserSession: boolean;
+
+        getUser: () => Promise<{
+            user: User;
+            subscribeToUserChange: (
+                onUserChange: (params: { user: User; user_previous: User | undefined }) => void
+            ) => {
+                unsubscribeFromUserChange: () => void;
+            };
+            refreshUser: () => Promise<User>;
+        }>;
+    };
 
     export type Tokens<
         DecodedIdToken extends Record<string, unknown> = Tokens.DecodedIdToken_OidcCoreSpec

src/core/createGetUser.ts

@@ -0,0 +1,188 @@
+import type { Oidc } from "./Oidc";
+import { id } from "../tools/tsafe/id";
+import { assert } from "../tools/tsafe/assert";
+import type { MaybeAsync } from "../tools/MaybeAsync";
+import type { NonPostableEvt } from "../tools/Evt";
+import { decodeJwt } from "../tools/decodeJwt";
+
+export function createGetUser<User>(params: {
+    issuerUri: string;
+    createUser:
+        | ((params: {
+              decodedIdToken: Oidc.Tokens.DecodedIdToken_OidcCoreSpec;
+              accessToken: string;
+              fetchUserInfo: () => Promise<{
+                  [key: string]: unknown;
+                  sub: string;
+              }>;
+              issuerUri: string;
+          }) => MaybeAsync<User>)
+        | undefined;
+    getCurrentTokens: () => Oidc.Tokens<any>;
+    evtTokensChange: NonPostableEvt<void>;
+    renewTokens(): Promise<void>;
+    oidcMetadata: {
+        userinfo_endpoint?: string;
+    };
+}) {
+    const { issuerUri, createUser, getCurrentTokens, evtTokensChange, renewTokens, oidcMetadata } =
+        params;
+
+    type GetUser = Oidc.LoggedIn<any, User>["getUser"];
+
+    type R_GetUser = Awaited<ReturnType<GetUser>>;
+
+    async function fetchUserInfo(params: { accessToken: string }) {
+        const { accessToken } = params;
+
+        const { userinfo_endpoint } = oidcMetadata;
+
+        if (!userinfo_endpoint) {
+            // TODO: Make a class for this error
+            throw new Error("oidc-spa: AS does not expose a userinfo endpoint");
+        }
+
+        const r = await fetch(userinfo_endpoint, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`
+            }
+        });
+
+        return r.json();
+    }
+
+    let state: { prUser: Promise<User>; hash: string } | undefined = undefined;
+
+    const onUserChanges = new Set<(params: { user: User; user_previous: User | undefined }) => void>();
+
+    const subscribeToUserChange: R_GetUser["subscribeToUserChange"] = onUserChange => {
+        onUserChanges.add(onUserChange);
+
+        return {
+            unsubscribeFromUserChange: () => {
+                onUserChanges.delete(onUserChange);
+            }
+        };
+    };
+
+    function __updatePrUserIfHashChanged() {
+        assert(createUser !== undefined, "94302");
+
+        const hash_current = state?.hash;
+
+        const tokens = getCurrentTokens();
+
+        const hash_new = computeHash({
+            accessToken: tokens.accessToken,
+            decodedIdToken: tokens.decodedIdToken_original
+        });
+
+        const prUser_new = (async () => {
+            const prUser_current = state?.prUser;
+
+            if (hash_current === hash_new) {
+                assert(prUser_current !== undefined);
+                return prUser_current;
+            }
+
+            const user_new = await createUser({
+                accessToken: tokens.accessToken,
+                decodedIdToken: tokens.decodedIdToken_original,
+                issuerUri,
+                fetchUserInfo: () => fetchUserInfo({ accessToken: tokens.accessToken })
+            });
+
+            {
+                const user_current = await prUser_current;
+
+                onUserChanges.forEach(onUserChange =>
+                    onUserChange({
+                        user: user_new,
+                        user_previous: user_current
+                    })
+                );
+            }
+
+            return user_new;
+        })();
+
+        state = {
+            hash: hash_new,
+            prUser: prUser_new
+        };
+    }
+
+    const refreshUser: R_GetUser["refreshUser"] = async () => {
+        if (state !== undefined) {
+            state.hash = "";
+        }
+
+        await renewTokens();
+
+        assert(state !== undefined);
+
+        return state.prUser;
+    };
+
+    evtTokensChange.subscribe(() => {
+        __updatePrUserIfHashChanged();
+    });
+
+    const getUser: GetUser = async () => {
+        if (createUser === undefined) {
+            throw new Error("oidc-spa: createUser not provided");
+        }
+
+        if (state === undefined) {
+            __updatePrUserIfHashChanged();
+
+            assert(state !== undefined);
+        }
+
+        const user = await state.prUser;
+
+        return id<R_GetUser>({
+            user,
+            refreshUser,
+            subscribeToUserChange
+        });
+    };
+
+    return { getUser };
+}
+
+function computeHash(params: {
+    decodedIdToken: Oidc.Tokens.DecodedIdToken_OidcCoreSpec;
+    accessToken: string;
+}): string {
+    const { decodedIdToken, accessToken } = params;
+
+    const decodedIdToken_stableish = (() => {
+        const { exp, iat, nonce, auth_time, amr, acr, ...rest } = decodedIdToken;
+
+        return rest;
+    })();
+
+    const decodedAccessToken_stableish = (() => {
+        let decodedAccessToken: Record<string, unknown>;
+
+        try {
+            decodedAccessToken = decodeJwt(accessToken);
+        } catch {
+            return undefined;
+        }
+
+        const { exp, iat, jti, nbf, cnf, ...rest } = decodedAccessToken;
+
+        return rest;
+    })();
+
+    const stringify = (obj: Record<string, unknown>) =>
+        JSON.stringify(Object.entries(obj).sort(([a], [b]) => a.localeCompare(b)));
+
+    return [
+        stringify(decodedIdToken_stableish),
+        "|",
+        decodedAccessToken_stableish === undefined ? "" : stringify(decodedAccessToken_stableish)
+    ].join("");
+}