feat: migration corppass to oidc (#4248)

* chore: rename cache

* chore: rename utils, types and errors files

* chore: separate SpcpOidcBaseClient and SpOidcClient

* chore: rename sp.oidc.client to spcp.oidc.client

* feat: add cp oidc client

* chore: add corppass oidc env vars

* chore: update docs and client types

* chore: add cp idtoken typeguard

* feat: SpcpOidcServiceClass

* chore: update spcp service tests

* chore: rename spcp.oidc.service and update imports

* chore: add separate cp oidc test keys

* chore: add CP tests for spcp.oidc.service

* chore: update getRedirectTargetSpcpOidc

* feat: createJWTPayload in spcp.oidc.service

* chore: handleSpcpOidcLogin to include CP, update tests

* feat: add cp login route

* chore: update email, encrypt, verification controller, update tests

* fix: add correct authType to express handler

* chore: different esrvcID param in auth url for corppass oidc

* chore: remove cp e2e tests

* chore: add spcp oidc controller tests

* chore: add /login route integration tests

* chore: use axios to post to token endpoint in order to include typ header

* chore: update tests

* refactor: use createJWT to create client assertion

* fix: typo CilentCache > ClientCache

* [WIP] ref: OIDCClient classes (#4516)

* refactor: Refactor OIDCClient classes

* ref: first attempt at splitting spcp.oidc.service

* ref: split oidc.service into multiple files

* ref: change instantiation responsibilities

* ref: use the split classes

* ref: set oidcProps type correctly in child classes

* ref: remove unecessary overwritten method getClient()

* chore: add function return type

* chore: clean up some typings

* chore: clean up spcp oidc client abstract class

* chore: getExtraTokenFields non optional

* chore: update spcp.oidc.client tests

* chore: add tests for spcp.oidc.service.sp

* fix: cookieDomain should be non-optional for CpOidcProps

* chore: add tests for spcp.oidc.service.cp

* chore: use conditional types for getOidcService

* chore: update references to oidc service in codebase

* chore: update tests

* chore: put some oidc test constants in separate file

* fix: remove unnecessary getSigningKey in exchangeAuthCode

* ref: restore polymorphic code for oidc controller

* chore: fix typing for createJWTPayload

* chore: improve docs

* fix: continue using abstract class for createJwtPayload in order to preserve attribute check for cp

* chore: update tests

Co-authored-by: tshuli <[email protected]>

* feat: allow saml keys for cp forms

* ref(oidc.service): set client and props as abstract properties

Co-authored-by: Timothee Groleau <[email protected]>

.template-env

@@ -101,7 +101,13 @@ FORMSG_SDK_MODE=
 # SP_OIDC_RP_REDIRECT_URL=
 # SP_OIDC_RP_JWKS_PUBLIC_PATH=
 # SP_OIDC_RP_JWKS_SECRET_PATH=
+# CP_OIDC_NDI_DISCOVERY_ENDPOINT=https://stg-id.corppass.gov.sg/.well-known/openid-configuration
+# CP_OIDC_NDI_JWKS_ENDPOINT=https://stg-id.corppass.gov.sg/.well-known/keys
+# CP_OIDC_RP_CLIENT_ID=
+# CP_OIDC_RP_REDIRECT_URL=
 # CP_OIDC_RP_JWKS_PUBLIC_PATH=
+# CP_OIDC_RP_JWKS_SECRET_PATH=
+
 
 
 # CP_FORMSG_KEY_PATH=./node_modules/@opengovsg/mockpass/static/certs/key.pem

docker-compose.yml

@@ -69,9 +69,14 @@ services:
       - SP_OIDC_NDI_JWKS_ENDPOINT=https://stg-id.singpass.gov.sg/.well-known/keys
       - SP_OIDC_RP_CLIENT_ID=rpClientId
       - SP_OIDC_RP_REDIRECT_URL=https://staging.form.gov.sg/api/v3/singpass/login
-      - SP_OIDC_RP_JWKS_PUBLIC_PATH=./tests/certs/test_rp_public_jwks.json
-      - SP_OIDC_RP_JWKS_SECRET_PATH=./tests/certs/test_rp_secret_jwks.json
-      - CP_OIDC_RP_JWKS_PUBLIC_PATH=./tests/certs/test_rp_public_jwks.json
+      - SP_OIDC_RP_JWKS_PUBLIC_PATH=./tests/certs/test_sp_rp_public_jwks.json
+      - SP_OIDC_RP_JWKS_SECRET_PATH=./tests/certs/test_sp_rp_secret_jwks.json
+      - CP_OIDC_NDI_DISCOVERY_ENDPOINT=https://stg-id.corppass.gov.sg/.well-known/openid-configuration
+      - CP_OIDC_NDI_JWKS_ENDPOINT=https://stg-id.corppass.gov.sg/.well-known/keys
+      - CP_OIDC_RP_CLIENT_ID=rpClientId
+      - CP_OIDC_RP_REDIRECT_URL=https://staging.form.gov.sg/api/v3/corppass/login
+      - CP_OIDC_RP_JWKS_PUBLIC_PATH=./tests/certs/test_cp_rp_public_jwks.json
+      - CP_OIDC_RP_JWKS_SECRET_PATH=./tests/certs/test_cp_rp_secret_jwks.json
       - CP_FORMSG_KEY_PATH=./node_modules/@opengovsg/mockpass/static/certs/key.pem
       - CP_FORMSG_CERT_PATH=./node_modules/@opengovsg/mockpass/static/certs/server.crt
       - CP_IDP_CERT_PATH=./node_modules/@opengovsg/mockpass/static/certs/spcp.crt

docs/DEPLOYMENT_SETUP.md

@@ -303,11 +303,16 @@ Note that MyInfo is currently not supported for storage mode forms and enabling
 | `SINGPASS_IDP_ID`                | Partner ID of National Digital Identity Office for SingPass authentication.                                                                                                                     |
 | `SP_OIDC_NDI_DISCOVERY_ENDPOINT` | NDI's Singpass OIDC Discovery Endpoint                                                                                                                                                          |
 | `SP_OIDC_NDI_JWKS_ENDPOINT`      | NDI's Singpass OIDC JWKS Endpoint                                                                                                                                                               |
-| `SP_OIDC_RP_CLIENT_ID`           | The Relying Party's Client ID as registered with NDI                                                                                                                                            |
-| `SP_OIDC_RP_REDIRECT_URL`        | The Relying Party's Redirect URL                                                                                                                                                                |
+| `SP_OIDC_RP_CLIENT_ID`           | The Relying Party's Singpass Client ID as registered with NDI                                                                                                                                   |
+| `SP_OIDC_RP_REDIRECT_URL`        | The Relying Party's Singpass Redirect URL                                                                                                                                                       |
 | `SP_OIDC_RP_JWKS_PUBLIC_PATH`    | Path to the Relying Party's Public Json Web Key Set used for Singpass-related communication with NDI. This will be hosted at /singpass/.well-known/jwks.json endpoint.                          |
 | `SP_OIDC_RP_JWKS_SECRET_PATH`    | Path to the Relying Party's Secret Json Web Key Set used for Singpass-related communication with NDI                                                                                            |
+| `CP_OIDC_NDI_DISCOVERY_ENDPOINT` | NDI's Corppass OIDC Discovery Endpoint                                                                                                                                                          |
+| `CP_OIDC_NDI_JWKS_ENDPOINT`      | NDI's Corppass OIDC JWKS Endpoint                                                                                                                                                               |
+| `CP_OIDC_RP_CLIENT_ID`           | The Relying Party's Corppass Client ID as registered with NDI                                                                                                                                   |
+| `CP_OIDC_RP_REDIRECT_URL`        | The Relying Party's Corppass Redirect URL                                                                                                                                                       |
 | `CP_OIDC_RP_JWKS_PUBLIC_PATH`    | Path to the Relying Party's Public Json Web Key Set used for Corppass-related communication with NDI. This will be hosted at api/v3/corppass/.well-known/jwks.json endpoint.                    |
+| `CP_OIDC_RP_JWKS_SECRET_PATH`    | Path to the Relying Party's Secret Json Web Key Set used for Corppass-related communication with NDI                                                                                            |
 | `CORPPASS_ESRVC_ID`              | e-service ID registered with National Digital Identity office for CorpPass authentication.                                                                                                      |
 | `CORPPASS_PARTNER_ENTITY_ID`     | Partner ID registered with National Digital Identity Office for CorpPass authentication.                                                                                                        |
 | `CORPPASS_IDP_LOGIN_URL`         | URL of CorpPass Login Page.                                                                                                                                                                     |

src/app/config/features/spcp-myinfo.config.ts

@@ -35,7 +35,12 @@ type ISpcpConfig = {
   spOidcRpRedirectUrl: string
   spOidcRpJwksPublicPath: string
   spOidcRpJwksSecretPath: string
+  cpOidcNdiDiscoveryEndpoint: string
+  cpOidcNdiJwksEndpoint: string
+  cpOidcRpClientId: string
+  cpOidcRpRedirectUrl: string
   cpOidcRpJwksPublicPath: string
+  cpOidcRpJwksSecretPath: string
 }
 
 type IMyInfoConfig = {
@@ -235,13 +240,13 @@ const spcpMyInfoSchema: Schema<ISpcpMyInfo> = {
     env: 'SP_OIDC_NDI_JWKS_ENDPOINT',
   },
   spOidcRpClientId: {
-    doc: "The Relying Party's Client ID as registered with NDI",
+    doc: "The Relying Party's Singpass Client ID as registered with NDI",
     format: String,
     default: null,
     env: 'SP_OIDC_RP_CLIENT_ID',
   },
   spOidcRpRedirectUrl: {
-    doc: "The Relying Party's Redirect URL",
+    doc: "The Relying Party's Singpass Redirect URL",
     format: String,
     default: null,
     env: 'SP_OIDC_RP_REDIRECT_URL',
@@ -258,12 +263,42 @@ const spcpMyInfoSchema: Schema<ISpcpMyInfo> = {
     default: null,
     env: 'SP_OIDC_RP_JWKS_SECRET_PATH',
   },
+  cpOidcNdiDiscoveryEndpoint: {
+    doc: "NDI's Corppass OIDC Discovery Endpoint",
+    format: String,
+    default: null,
+    env: 'CP_OIDC_NDI_DISCOVERY_ENDPOINT',
+  },
+  cpOidcNdiJwksEndpoint: {
+    doc: "NDI's Corppass OIDC JWKS Endpoint",
+    format: String,
+    default: null,
+    env: 'CP_OIDC_NDI_JWKS_ENDPOINT',
+  },
+  cpOidcRpClientId: {
+    doc: "The Relying Party's Corppass Client ID as registered with NDI",
+    format: String,
+    default: null,
+    env: 'CP_OIDC_RP_CLIENT_ID',
+  },
+  cpOidcRpRedirectUrl: {
+    doc: "The Relying Party's Corppass Redirect URL",
+    format: String,
+    default: null,
+    env: 'CP_OIDC_RP_REDIRECT_URL',
+  },
   cpOidcRpJwksPublicPath: {
     doc: "Path to the Relying Party's Public Json Web Key Set used for Corppass-related communication with NDI.  This will be hosted at api/v3/corppass/.well-known/jwks.json endpoint.",
     format: String,
     default: null,
     env: 'CP_OIDC_RP_JWKS_PUBLIC_PATH',
   },
+  cpOidcRpJwksSecretPath: {
+    doc: "Path to the Relying Party's Secret Json Web Key Set used for Cingpass-related communication with NDI",
+    format: String,
+    default: null,
+    env: 'CP_OIDC_RP_JWKS_SECRET_PATH',
+  },
 }
 
 export const spcpMyInfoConfig = convict(spcpMyInfoSchema)

src/app/modules/examples/__tests__/examples.routes.spec.ts

@@ -30,7 +30,7 @@ const app = setupApp('/examples', ExamplesRouter, {
   setupWithAuth: true,
 })
 
-jest.mock('../../spcp/sp.oidc.client')
+jest.mock('../../spcp/spcp.oidc.client')
 
 describe('examples.routes', () => {
   let request: Session

src/app/modules/form/admin-form/__tests__/admin-form.routes.spec.ts

@@ -81,7 +81,7 @@ jest.mock('nodemailer', () => ({
 }))
 
 // Avoid async refresh calls
-jest.mock('src/app/modules/spcp/sp.oidc.client.ts')
+jest.mock('src/app/modules/spcp/spcp.oidc.client.ts')
 
 const UserModel = getUserModel(mongoose)
 const FormModel = getFormModel(mongoose)

src/app/modules/form/public-form/__tests__/public-form.controller.spec.ts

@@ -36,13 +36,14 @@ import { MYINFO_COOKIE_NAME } from '../../../myinfo/myinfo.constants'
 import { MyInfoCookieStateError } from '../../../myinfo/myinfo.errors'
 import { MyInfoService } from '../../../myinfo/myinfo.service'
 import { SGID_COOKIE_NAME } from '../../../sgid/sgid.constants'
-import { SpOidcService } from '../../../spcp/sp.oidc.service'
 import {
   CreateRedirectUrlError,
   FetchLoginPageError,
   LoginPageValidationError,
   MissingJwtError,
 } from '../../../spcp/spcp.errors'
+import { CpOidcServiceClass } from '../../../spcp/spcp.oidc.service/spcp.oidc.service.cp'
+import { SpOidcServiceClass } from '../../../spcp/spcp.oidc.service/spcp.oidc.service.sp'
 import { SpcpService } from '../../../spcp/spcp.service'
 import { JwtName } from '../../../spcp/spcp.types'
 import {
@@ -61,14 +62,15 @@ jest.mock('../public-form.service')
 jest.mock('../../form.service')
 jest.mock('../../../auth/auth.service')
 jest.mock('../../../spcp/spcp.service')
-jest.mock('../../../spcp/sp.oidc.service')
+jest.mock('../../../spcp/spcp.oidc.service/spcp.oidc.service.sp')
+jest.mock('../../../spcp/spcp.oidc.service/spcp.oidc.service.cp')
 jest.mock('../../../myinfo/myinfo.service')
 
 const MockFormService = mocked(FormService)
 const MockPublicFormService = mocked(PublicFormService)
 const MockAuthService = mocked(AuthService)
 const MockSpcpService = mocked(SpcpService, true)
-const MockSpOidcService = mocked(SpOidcService, true)
+
 const MockMyInfoService = mocked(MyInfoService, true)
 
 const FormFeedbackModel = getFormFeedbackModel(mongoose)
@@ -544,9 +546,10 @@ describe('public-form.controller', () => {
         MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
           okAsync(MOCK_SP_AUTH_FORM),
         )
-        MockSpOidcService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          okAsync(MOCK_SPCP_SESSION),
-        )
+
+        jest
+          .spyOn(SpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(okAsync(MOCK_SPCP_SESSION))
 
         // Act
         await PublicFormController.handleGetPublicForm(
@@ -583,9 +586,9 @@ describe('public-form.controller', () => {
         MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
           okAsync(MOCK_CP_AUTH_FORM),
         )
-        MockSpcpService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          okAsync(MOCK_SPCP_SESSION),
-        )
+        jest
+          .spyOn(CpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(okAsync(MOCK_SPCP_SESSION))
         // Act
         await PublicFormController.handleGetPublicForm(
           MOCK_REQ,
@@ -887,9 +890,9 @@ describe('public-form.controller', () => {
         MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
           okAsync(MOCK_SP_FORM),
         )
-        MockSpOidcService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          errAsync(new MissingJwtError()),
-        )
+        jest
+          .spyOn(SpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(errAsync(new MissingJwtError()))
 
         // Act
         // 2. GET the endpoint
@@ -919,9 +922,9 @@ describe('public-form.controller', () => {
         MockFormService.checkFormSubmissionLimitAndDeactivateForm.mockReturnValueOnce(
           okAsync(MOCK_CP_FORM),
         )
-        MockSpcpService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          errAsync(new MissingJwtError()),
-        )
+        jest
+          .spyOn(CpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(errAsync(new MissingJwtError()))
 
         // Act
         // 2. GET the endpoint
@@ -1092,9 +1095,9 @@ describe('public-form.controller', () => {
 
         const mockRes = expressHandler.mockResponse()
 
-        MockSpOidcService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          okAsync(MOCK_SPCP_SESSION),
-        )
+        jest
+          .spyOn(SpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(okAsync(MOCK_SPCP_SESSION))
         MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(true)
         MockAuthService.getFormIfPublic.mockReturnValueOnce(
           okAsync(MOCK_SP_AUTH_FORM),
@@ -1128,9 +1131,9 @@ describe('public-form.controller', () => {
         const mockRes = expressHandler.mockResponse()
 
         MockFormService.checkIsIntranetFormAccess.mockReturnValueOnce(true)
-        MockSpcpService.extractJwtPayloadFromRequest.mockReturnValueOnce(
-          okAsync(MOCK_SPCP_SESSION),
-        )
+        jest
+          .spyOn(CpOidcServiceClass.prototype, 'extractJwtPayloadFromRequest')
+          .mockReturnValueOnce(okAsync(MOCK_SPCP_SESSION))
         MockAuthService.getFormIfPublic.mockReturnValueOnce(
           okAsync(MOCK_CP_AUTH_FORM),
         )
@@ -1224,9 +1227,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpOidcService.createRedirectUrl.mockResolvedValueOnce(
-        ok(MOCK_REDIRECT_URL),
-      )
+      jest
+        .spyOn(SpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockResolvedValueOnce(ok(MOCK_REDIRECT_URL))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(
@@ -1255,9 +1258,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpOidcService.createRedirectUrl.mockResolvedValueOnce(
-        ok(MOCK_REDIRECT_URL),
-      )
+      jest
+        .spyOn(SpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockResolvedValueOnce(ok(MOCK_REDIRECT_URL))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(
@@ -1289,9 +1292,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpOidcService.createRedirectUrl.mockResolvedValueOnce(
-        ok(MOCK_REDIRECT_URL),
-      )
+      jest
+        .spyOn(SpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockResolvedValueOnce(ok(MOCK_REDIRECT_URL))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(
@@ -1316,9 +1319,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpcpService.createRedirectUrl.mockReturnValueOnce(
-        ok(MOCK_REDIRECT_URL),
-      )
+      jest
+        .spyOn(CpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockReturnValueOnce(okAsync(MOCK_REDIRECT_URL))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(
@@ -1498,9 +1501,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpOidcService.createRedirectUrl.mockResolvedValue(
-        err(new CreateRedirectUrlError()),
-      )
+      jest
+        .spyOn(SpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockResolvedValue(err(new CreateRedirectUrlError()))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(
@@ -1527,9 +1530,9 @@ describe('public-form.controller', () => {
       MockFormService.retrieveFullFormById.mockReturnValueOnce(
         okAsync(MOCK_FORM),
       )
-      MockSpcpService.createRedirectUrl.mockReturnValueOnce(
-        err(new CreateRedirectUrlError()),
-      )
+      jest
+        .spyOn(CpOidcServiceClass.prototype, 'createRedirectUrl')
+        .mockReturnValueOnce(errAsync(new CreateRedirectUrlError()))
 
       // Act
       await PublicFormController._handleFormAuthRedirect(

src/app/modules/form/public-form/__tests__/public-form.routes.spec.ts

@@ -1,4 +1,3 @@
-import SPCPAuthClient from '@opengovsg/spcp-auth-client'
 import { ObjectId } from 'bson-ext'
 import { errAsync } from 'neverthrow'
 import supertest, { Session } from 'supertest-session'
@@ -13,7 +12,7 @@ import dbHandler from 'tests/unit/backend/helpers/jest-db'
 
 import { FormAuthType, FormStatus } from '../../../../../../shared/types'
 import * as AuthService from '../../../auth/auth.service'
-import { SpOidcClient } from '../../../spcp/sp.oidc.client'
+import { CpOidcClient, SpOidcClient } from '../../../spcp/spcp.oidc.client'
 import { PublicFormRouter } from '../public-form.routes'
 
 jest.mock('@opengovsg/myinfo-gov-client', () => ({
@@ -29,10 +28,10 @@ jest.mock('@opengovsg/myinfo-gov-client', () => ({
     .MyInfoAttribute,
 }))
 
-jest.mock('../../../spcp/sp.oidc.client')
+jest.mock('../../../spcp/spcp.oidc.client')
 
 jest.mock('@opengovsg/spcp-auth-client')
-const MockSpcpAuthClient = mocked(SPCPAuthClient, true)
+const MockCpOidcClient = mocked(CpOidcClient, true)
 
 const app = setupApp('/', PublicFormRouter, {
   setupWithAuth: false,
@@ -41,7 +40,7 @@ const app = setupApp('/', PublicFormRouter, {
 describe('public-form.routes', () => {
   let request: Session
 
-  const mockCpClient = mocked(MockSpcpAuthClient.mock.instances[1], true)
+  const mockCpClient = mocked(MockCpOidcClient.mock.instances[0], true)
 
   beforeAll(async () => await dbHandler.connect())
   beforeEach(async () => {
@@ -127,15 +126,13 @@ describe('public-form.routes', () => {
     })
     it('should return 200 with public form when form has FormAuthType.CP and valid formId', async () => {
       // Arrange
-      mockCpClient.verifyJWT.mockImplementationOnce((_jwt, cb) =>
-        cb(null, {
-          userName: MOCK_COOKIE_PAYLOAD.userName,
-          userInfo: 'MyCorpPassUEN',
-          iat: 100000000,
-          exp: 1000000000,
-          rememberMe: false,
-        }),
-      )
+      mockCpClient.verifyJwt.mockResolvedValueOnce({
+        userName: MOCK_COOKIE_PAYLOAD.userName,
+        userInfo: 'MyCorpPassUEN',
+        iat: 100000000,
+        exp: 1000000000,
+        rememberMe: false,
+      })
       const { form } = await dbHandler.insertEmailForm({
         formOptions: {
           esrvcId: 'mockEsrvcId',