feat: add dex auth

.github/workflows/analysis.yml

@@ -167,5 +167,9 @@ jobs:
           KC_ADMIN_CLIENT_SECRET: so_secret_000
           ETL_MIRROR_URL: https://geo-datasets-mirror.s3.fr-par.scw.cloud
           ETL_ARCHIVES_URL: https://geo-datasets-archives.s3.fr-par.scw.cloud
+          PRO_CONNECT_CLIENT_ID: ${{ secrets.PRO_CONNECT_CLIENT_ID }}
+          PRO_CONNECT_CLIENT_SECRET: ${{ secrets.PRO_CONNECT_CLIENT_SECRET }}
+          APP_AUTH_CLIENT_ID: secret
+          APP_AUTH_CLIENT_SECRET: secret
         run: just ci_test_integration
         working-directory: api

api/justfile

@@ -160,6 +160,25 @@ api *command:
   --unstable-fs \
   src/main.ts {{ command }}
 
+debug:
+  deno repl \
+  -A \
+  --unstable-fs \
+  --eval 'import { getKernel } from "./src/debug.ts"; const kernel = await getKernel();'
+
+watch:
+  deno run \
+  --allow-net \
+  --allow-env \
+  --allow-read \
+  --allow-write \
+  --allow-ffi \
+  --allow-sys \
+  --allow-run \
+  --watch \
+  --unstable-fs \
+  src/main.ts http \$PORT
+
 # Start the HTTP API server on port 8080
 @serve:
   just api http \$PORT

api/src/db/migrations/20250210000000-alter-users.sql

@@ -0,0 +1,6 @@
+ALTER TABLE auth.users
+  ALTER COLUMN firstname DROP NOT NULL,
+  ALTER COLUMN lastname DROP NOT NULL;
+
+ALTER TABLE territory.territories
+  ADD COLUMN siret VARCHAR;

api/src/ilos/common/Decorators.ts

@@ -130,3 +130,7 @@ export function extension(config: ExtensionConfigurationType) {
 }
 
 export { inject, injectable } from "@/deps.ts";
+
+export const proxy = Symbol.for("PROXY");
+export const router = Symbol.for("ROUTER");
+export const children = Symbol.for("CHILDREN");

api/src/ilos/connection-redis/RedisConnection.ts

@@ -11,13 +11,11 @@ import {
  * @fixme
  */
 type WindowProcess = Window & typeof globalThis & { process: NodeJS.Process };
-(window as WindowProcess).process = process;
+if (typeof window !== "undefined") {
+  (window as WindowProcess).process = process;
+}
 
-export class RedisConnection
-  implements
-    ConnectionInterface<Redis>,
-    DestroyHookInterface,
-    InitHookInterface {
+export class RedisConnection implements ConnectionInterface<Redis>, DestroyHookInterface, InitHookInterface {
   protected client: Redis | null = null;
 
   get connected(): boolean {

api/src/ilos/core/foundation/ServiceContainer.ts

@@ -8,6 +8,7 @@ import {
   RegisterHookInterface,
   ServiceContainerInterface,
   ServiceContainerInterfaceResolver,
+  children as childrenSymbol,
 } from "@/ilos/common/index.ts";
 import { ExtensionRegistry } from "../container/ExtensionRegistry.ts";
 import { Container, HookRegistry } from "../container/index.ts";
@@ -107,7 +108,7 @@ export abstract class ServiceContainer
       for (const child of children) {
         const childInstance = new child(this.getContainer());
         this.getContainer().bind(child).toConstantValue(childInstance);
-        this.getContainer().bind("children").toConstantValue(child);
+        this.getContainer().bind(childrenSymbol).toConstantValue(childInstance);
         this.registerHooks(childInstance);
       }
     }

api/src/pdc/proxy/HttpTransport.ts

@@ -12,16 +12,21 @@ import {
   Response,
 } from "@/deps.ts";
 import {
+  children,
   ConfigInterface,
   ConfigInterfaceResolver,
   ContextType,
   InvalidRequestException,
   KernelInterface,
+  proxy,
+  RegisterHookInterface,
+  router,
   RPCResponseType,
   RPCSingleCallType,
   TransportInterface,
   UnauthorizedException,
 } from "@/ilos/common/index.ts";
+import { ServiceProvider } from "@/ilos/core/index.ts";
 import { env_or_fail, env_or_false } from "@/lib/env/index.ts";
 import { logger } from "@/lib/logger/index.ts";
 import { get } from "@/lib/object/index.ts";
@@ -105,6 +110,7 @@ export class HttpTransport implements TransportInterface {
     this.registerMetrics();
     this.registerGlobalMiddlewares();
     this.registerCache();
+    this.registerNestedRoutes();
     this.registerAuthRoutes();
     this.registerApplicationRoutes();
     this.registerCertificateRoutes();
@@ -126,6 +132,18 @@ export class HttpTransport implements TransportInterface {
     return this.app;
   }
 
+  private registerNestedRoutes() {
+    this.kernel.getContainer().bind(proxy).toConstantValue(this.app);
+    const serviceProviders = this.kernel.getContainer().getAll<ServiceProvider>(children);
+    for (const serviceProvider of serviceProviders) {
+      const container = serviceProvider.getContainer();
+      if (container.isBound(router)) {
+        const routerInstance = container.resolve<RegisterHookInterface>(container.get(router));
+        routerInstance.register();
+      }
+    }
+  }
+
   private async getProviders(): Promise<void> {
     this.config = this.kernel.getContainer().get(ConfigInterfaceResolver);
     this.tokenProvider = this.kernel.getContainer().get(

api/src/pdc/proxy/Kernel.ts

@@ -4,6 +4,7 @@ import { Kernel as BaseKernel } from "@/ilos/framework/index.ts";
 import { SentryProvider } from "@/pdc/providers/sentry/index.ts";
 import { TokenProvider } from "@/pdc/providers/token/index.ts";
 import { ListCommand } from "@/pdc/proxy/commands/ListCommand.ts";
+import { AuthServiceProvider } from "@/pdc/services/auth/AuthServiceProvider.ts";
 import { MonitoringServiceProvider } from "@/pdc/services/monitoring/MonitoringServiceProvider.ts";
 import { PostgresConnection } from "../../ilos/connection-postgres/index.ts";
 import { AcquisitionServiceProvider } from "../services/acquisition/AcquisitionServiceProvider.ts";
@@ -26,6 +27,7 @@ import { config } from "./config/index.ts";
 @kernel({
   config,
   children: [
+    AuthServiceProvider,
     AcquisitionServiceProvider,
     APDFServiceProvider,
     ApplicationServiceProvider,

api/src/pdc/services/auth/AuthRouter.ts

@@ -0,0 +1,33 @@
+import { express } from "@/deps.ts";
+import { ConfigInterfaceResolver, inject, injectable, proxy } from "@/ilos/common/index.ts";
+import { asyncHandler } from "@/pdc/proxy/helpers/asyncHandler.ts";
+import { OidcCallbackAction } from "@/pdc/services/auth/actions/OidcCallbackAction.ts";
+import { OidcProvider } from "@/pdc/services/auth/providers/OidcProvider.ts";
+
+@injectable()
+export class AuthRouter {
+  constructor(
+    @inject(proxy) private app: express.Express,
+    private oidcProvider: OidcProvider,
+    private oidcCallbackAction: OidcCallbackAction,
+    private config: ConfigInterfaceResolver,
+  ) {}
+
+  register() {
+    this.app.get("/auth/login", (req, res, next) => {
+      return res.redirect(this.oidcProvider.getLoginUrl());
+    });
+
+    this.app.get(
+      "/auth/callback",
+      asyncHandler(async (req: express.Request, res: express.Response) => {
+        const { code } = req.query;
+        if (typeof code === "string") {
+          const user = await this.oidcCallbackAction.handle({ code });
+          req.session.user = user;
+        }
+        return res.redirect(this.config.get("oidc.app_url"));
+      }),
+    );
+  }
+}

api/src/pdc/services/auth/AuthServiceProvider.ts

@@ -0,0 +1,23 @@
+import { router, serviceProvider } from "@/ilos/common/index.ts";
+import { ServiceProvider as AbstractServiceProvider } from "@/ilos/core/index.ts";
+import { ValidatorMiddleware } from "@/pdc/providers/superstruct/ValidatorMiddleware.ts";
+
+import { OidcProvider } from "@/pdc/services/auth/providers/OidcProvider.ts";
+import { OidcCallbackAction } from "./actions/OidcCallbackAction.ts";
+import { AuthRouter } from "./AuthRouter.ts";
+import { config } from "./config/index.ts";
+import { UserRepository } from "./providers/UserRepository.ts";
+
+@serviceProvider({
+  config,
+  providers: [
+    UserRepository,
+    OidcProvider,
+    [router, AuthRouter],
+  ],
+  middlewares: [
+    ["validate", ValidatorMiddleware],
+  ],
+  handlers: [OidcCallbackAction],
+})
+export class AuthServiceProvider extends AbstractServiceProvider {}

api/src/pdc/services/auth/actions/OidcCallbackAction.ts

@@ -0,0 +1,47 @@
+import { ConfigInterfaceResolver, handler, UnauthorizedException } from "@/ilos/common/index.ts";
+import { Action as AbstractAction } from "@/ilos/core/index.ts";
+import { OidcCallback } from "../dto/OidcCallback.ts";
+import { OidcProvider } from "../providers/OidcProvider.ts";
+import { UserRepository } from "../providers/UserRepository.ts";
+
+export type ResultInterface = {
+  email: string;
+  role: string;
+  permissions: Array<string>;
+  operator_id?: number;
+  territory_id?: number;
+};
+
+@handler({
+  service: "auth",
+  method: "oidcCallback",
+  middlewares: [
+    ["validate", OidcCallback],
+  ],
+})
+export class OidcCallbackAction extends AbstractAction {
+  constructor(
+    private oidcProvider: OidcProvider,
+    private userRepository: UserRepository,
+    protected config: ConfigInterfaceResolver,
+  ) {
+    super();
+  }
+
+  public async handle(params: OidcCallback): Promise<ResultInterface> {
+    const token = await this.oidcProvider.getTokenFromCode(params.code);
+    const info = await this.oidcProvider.getUserInfoFromToken(token);
+    const user = await this.userRepository.findUserByEmail(info.email);
+    if (!user || user.siret !== info.siret) {
+      throw new UnauthorizedException("User not found");
+    }
+    return {
+      ...user,
+      permissions: this.getPermissionsFromRole(user.role),
+    };
+  }
+
+  private getPermissionsFromRole(role: string): string[] {
+    return this.config.get(`permissions.${role}.permissions`, []);
+  }
+}

api/src/pdc/services/auth/config/index.ts

@@ -0,0 +1,7 @@
+import * as oidc from "./oidc.ts";
+import * as permissions from "./permissions.ts";
+
+export const config = {
+  permissions,
+  oidc,
+};

api/src/pdc/services/auth/config/oidc.ts

@@ -0,0 +1,6 @@
+import { env_or_fail } from "@/lib/env/index.ts";
+export const client_id = env_or_fail("OIDC_CLIENT_ID");
+export const client_secret = env_or_fail("OIDC_CLIENT_SECRET");
+export const base_url = env_or_fail("OIDC_BASE_URL");
+export const redirect_url = env_or_fail("OIDC_REDIRECT_URL");
+export const app_url = env_or_fail("APP_APP_URL");