Merge pull request #820 from SciCatProject/add-better-check-for-logou…

…t-urls feat: add better check for logout urls
SciCatProject · Oct 18, 2023 · 8f62192 · 8f62192
2 parents c29db83 + 7fa5615
commit 8f62192
Show file tree

Hide file tree

Showing 2 changed files with 53 additions and 20 deletions.
diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
@@ -6,7 +6,7 @@ import { User } from "src/users/schemas/user.schema";
 import { UsersService } from "../users/users.service";
 import { Request } from "express";
 import { OidcConfig } from "src/config/configuration";
-import { parseBoolean } from "src/common/utils";
+import { flattenObject, parseBoolean } from "src/common/utils";
 import { Issuer } from "openid-client";
 
 @Injectable()
@@ -58,46 +58,63 @@ export class AuthService {
       "expressSessionSecret",
     );
 
+    const logoutResult = await this.additionalLogoutTasks(req, logoutURL);
+
     if (expressSessionSecret) {
       req.logout(async (err) => {
         if (err) {
           // we should provide a message
           console.log("Logout error");
           console.log(err);
-          //res.status(HttpStatus.BAD_REQUEST);
         }
-        return await this.additionalLogoutTasks(req, logoutURL);
       });
+
+      return logoutResult;
     } else {
-      return await this.additionalLogoutTasks(req, logoutURL);
-    }
-    if (logoutURL) {
-      return { logout: "successful", logoutURL: logoutURL };
+      return logoutResult;
     }
-
-    return { logout: "successful" };
   }
 
   async additionalLogoutTasks(req: Request, logoutURL: string) {
     const user = req.user as Omit<User, "password">;
-    if (user?.authStrategy == "oidc") {
+    if (user?.authStrategy === "oidc") {
       const oidcConfig = this.configService.get<OidcConfig>("oidc");
-      const autoLogout: boolean = parseBoolean(oidcConfig?.autoLogout || false);
+      const autoLogout: boolean = parseBoolean(oidcConfig?.autoLogout || true);
+
       if (autoLogout) {
-        const trustIssuer = await Issuer.discover(
-          `${oidcConfig?.issuer}/.well-known/openid-configuration`,
-        );
-        const end_session_endpoint = trustIssuer.metadata.end_session_endpoint;
-        if (end_session_endpoint) {
+        if (logoutURL) {
           return {
             logout: "successful",
-            logoutURL:
-              end_session_endpoint +
-              (logoutURL ? "?post_logout_redirect_uri=" + logoutURL : ""),
+            logoutURL: logoutURL,
           };
         }
+
+        // If there is no LOGOUT_URL set try to get one from the issuer
+        const trustIssuer = await Issuer.discover(
+          `${oidcConfig?.issuer}/.well-known/openid-configuration`,
+        );
+        // Flatten the object in case the end_session url is nested.
+        const flattenTrustIssuer = flattenObject(trustIssuer);
+
+        // Note search for "end_session" key into the flatten object
+        const endSessionEndpointKey = Object.keys(flattenTrustIssuer).find(
+          (key) => key.includes("end_session"),
+        );
+
+        if (endSessionEndpointKey) {
+          // Get the end_session endpoint value
+          const endSessionEndpoint = flattenTrustIssuer[endSessionEndpointKey];
+
+          if (endSessionEndpoint) {
+            return {
+              logout: "successful",
+              logoutURL: endSessionEndpoint,
+            };
+          }
+        }
       }
     }
-    return;
+
+    return { logout: "successful" };
   }
 }
diff --git a/src/common/utils.ts b/src/common/utils.ts
@@ -176,6 +176,22 @@ export const extractMetadataKeys = <T>(
   return Array.from(keys);
 };
 
+export const flattenObject = <T>(obj: T) => {
+  const result: Record<string, unknown> = {};
+
+  for (const i in obj) {
+    if (typeof obj[i] === "object" && !Array.isArray(obj[i])) {
+      const temp = flattenObject(obj[i]);
+      for (const j in temp) {
+        result[i + "." + j] = temp[j];
+      }
+    } else {
+      result[i] = obj[i];
+    }
+  }
+  return result;
+};
+
 export const handleAxiosRequestError = (
   err: unknown,
   context?: string,