Debug AgentConnect 🔒

src/auth/auth.controller.ts

@@ -38,13 +38,14 @@ export class AuthController {
   async loginCallback(@Req() req, @Res() res: Response) {
     // Ajout de l'utilisateur avec ses droits dans la session
     req.session.user = await this.userService.findOne(req.user.userinfo.email);
+    req.session.user.id_token = req.user.id_token;
     res.redirect(this.configService.get('WEBSITE_URL'));
   }
 
   @Get('/logout')
   @ApiOperation({ summary: 'OAuth - Logout' })
   async logout(@Req() req, @Res() res: Response, next) {
-    const id_token = req.user ? req.user.id_token : undefined;
+    const id_token = req.session.user ? req.session.user.id_token : undefined;
     res.clearCookie('regleau_session');
     req.logout((err) => {
       if (err) {
@@ -57,12 +58,13 @@ export class AuthController {
           )}/.well-known/openid-configuration`,
         );
         const end_session_endpoint = TrustIssuer.metadata.end_session_endpoint;
-        if (end_session_endpoint) {
+        if (end_session_endpoint && id_token) {
           res.redirect(
             end_session_endpoint +
               '?post_logout_redirect_uri=' +
               this.configService.get('WEBSITE_URL') +
-              (id_token ? '&id_token_hint=' + id_token : ''),
+              '&id_token_hint=' +
+              id_token,
           );
         } else {
           res.redirect(this.configService.get('WEBSITE_URL'));

src/auth/login.guard.ts

@@ -1,20 +1,24 @@
 import { ExecutionContext, Injectable } from '@nestjs/common';
 import { AuthGuard } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
 
 @Injectable()
 export class LoginGuard extends AuthGuard('oidc') {
+  constructor(private readonly configService: ConfigService) {
+    super();
+  }
+
   async canActivate(context: ExecutionContext) {
-    console.log('plep 1', context);
     try {
       const result = (await super.canActivate(context)) as boolean;
+      const request = context.switchToHttp().getRequest();
+      await super.logIn(request);
+      return result;
     } catch (e) {
-      console.log(e);
+      const response = context.switchToHttp().getResponse();
+      response.redirect(
+        this.configService.get('WEBSITE_URL') + '?error=unauthorized',
+      );
     }
-    console.log('plep 2');
-    const request = context.switchToHttp().getRequest();
-    console.log('plep 3');
-    await super.logIn(request);
-    console.log('plep 4');
-    return result;
   }
 }

src/auth/oidc.strategy.ts

@@ -7,7 +7,6 @@ import {
   TokenSet,
   Issuer,
   generators,
-  errors,
 } from 'openid-client';
 import { UserService } from '../user/user.service';
 import random = generators.random;
@@ -21,6 +20,8 @@ export const buildOpenIdClient = async () => {
     client_secret: process.env.OAUTH2_CLIENT_REGISTRATION_LOGIN_CLIENT_SECRET,
     acr_values: TrustIssuer.acr_values_supported,
     response_type: 'code',
+    userinfo_signed_response_alg: 'HS256',
+    id_token_signed_response_alg: 'HS256',
   });
   return client;
 };
@@ -39,28 +40,31 @@ export class OidcStrategy extends PassportStrategy(Strategy, 'oidc') {
         scope: process.env.OAUTH2_CLIENT_REGISTRATION_LOGIN_SCOPE,
         acr_values: client.acr_values,
       },
-      passReqToCallback: true,
       usePKCE: false,
     });
 
     this.client = client;
   }
 
-  authenticate(req, options: any = {}) {
+  async authenticate(req, options: any = {}) {
     options.nonce = random();
     super.authenticate(req, options);
   }
 
   async validate(tokenset: TokenSet): Promise<any> {
-    console.log('VALIDATE', tokenset);
     const userinfo: UserinfoResponse = await this.client.userinfo(tokenset);
     const userInDb = await this.userService.findOne(userinfo?.email);
 
     if (!userInDb) {
-      console.log('NOT USE IN DB');
       throw new UnauthorizedException();
     }
 
+    await this.userService.updateName(
+      userinfo.email,
+      <string>userinfo.given_name,
+      <string>userinfo.usual_name,
+    );
+
     try {
       const id_token = tokenset.id_token;
       const access_token = tokenset.access_token;
@@ -73,7 +77,6 @@ export class OidcStrategy extends PassportStrategy(Strategy, 'oidc') {
       };
       return user;
     } catch (err) {
-      console.log('ERROR', err);
       throw new UnauthorizedException();
     }
   }

src/main.ts

@@ -38,7 +38,7 @@ async function bootstrap() {
 
   // OpenAPI
   const options = new DocumentBuilder()
-    .setTitle('API VigiEau')
+    .setTitle('API ReglEau')
     .setVersion('0.1')
     .build();
   const document = SwaggerModule.createDocument(app, options);

src/shared/services/mail.service.ts

@@ -50,10 +50,6 @@ export class MailService {
           )}`,
           error,
         );
-        throw new HttpException(
-          "Une erreur est survenue dans l'envoi du mail.",
-          HttpStatus.INTERNAL_SERVER_ERROR,
-        );
       });
   }
 

src/user/user.service.ts

@@ -29,6 +29,13 @@ export class UserService {
     return this.userRepository.findOne({ where: { email } });
   }
 
+  updateName(email: string, firstName: string, lastName: string) {
+    return this.userRepository.update(
+      { email },
+      { first_name: firstName, last_name: lastName },
+    );
+  }
+
   findByDepartementsId(depIds: number[]): Promise<User[]> {
     return this.userRepository
       .createQueryBuilder('user')