feat: moved oidc to ee directory

backend/src/server/routes/index.ts

@@ -30,6 +30,8 @@ import { ldapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-conf
 import { ldapGroupMapDALFactory } from "@app/ee/services/ldap-config/ldap-group-map-dal";
 import { licenseDALFactory } from "@app/ee/services/license/license-dal";
 import { licenseServiceFactory } from "@app/ee/services/license/license-service";
+import { oidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
+import { oidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { permissionDALFactory } from "@app/ee/services/permission/permission-dal";
 import { permissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { projectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -101,8 +103,6 @@ import { integrationAuthServiceFactory } from "@app/services/integration-auth/in
 import { kmsDALFactory } from "@app/services/kms/kms-dal";
 import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 import { kmsServiceFactory } from "@app/services/kms/kms-service";
-import { oidcConfigDALFactory } from "@app/services/oidc/oidc-config-dal";
-import { oidcConfigServiceFactory } from "@app/services/oidc/oidc-config-service";
 import { incidentContactDALFactory } from "@app/services/org/incident-contacts-dal";
 import { orgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { orgDALFactory } from "@app/services/org/org-dal";

backend/src/server/routes/v1/index.ts

@@ -11,7 +11,6 @@ import { registerIdentityUaRouter } from "./identity-ua";
 import { registerIntegrationAuthRouter } from "./integration-auth-router";
 import { registerIntegrationRouter } from "./integration-router";
 import { registerInviteOrgRouter } from "./invite-org-router";
-import { registerOidcRouter } from "./oidc-router";
 import { registerOrgRouter } from "./organization-router";
 import { registerPasswordRouter } from "./password-router";
 import { registerProjectEnvRouter } from "./project-env-router";
@@ -30,7 +29,6 @@ import { registerWebhookRouter } from "./webhook-router";
 
 export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(registerSsoRouter, { prefix: "/sso" });
-  await server.register(registerOidcRouter, { prefix: "/oidc" });
   await server.register(
     async (authRouter) => {
       await authRouter.register(registerAuthRoutes);

backend/src/server/routes/v1/oidc-router.ts

@@ -1,220 +0,0 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-unsafe-call */
-/* eslint-disable @typescript-eslint/no-unsafe-argument */
-// All the any rules are disabled because passport typesense with fastify is really poor
-
-import { Authenticator, Strategy } from "@fastify/passport";
-import fastifySession from "@fastify/session";
-import { z } from "zod";
-
-import { OidcConfigsSchema } from "@app/db/schemas/oidc-configs";
-import { getConfig } from "@app/lib/config/env";
-import { writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerOidcRouter = async (server: FastifyZodProvider) => {
-  const appCfg = getConfig();
-  const passport = new Authenticator({ key: "oidc", userProperty: "passportUser" });
-  await server.register(fastifySession, {
-    secret: appCfg.COOKIE_SECRET_SIGN_KEY,
-    cookie: {
-      secure: false // has to be set to false if testing locally
-    }
-  });
-  await server.register(passport.initialize());
-  await server.register(passport.secureSession());
-
-  // redirect to IDP for login
-  server.route({
-    url: "/login",
-    method: "GET",
-    schema: {
-      params: z.object({
-        orgSlug: z.string().trim()
-      })
-    },
-    handler: async (req, res) => {
-      // get params, save to session
-      const { orgSlug } = req.params;
-      req.session.set<any>("oidcOrgSlug", orgSlug);
-      const oidcStrategy = await server.services.oidc.getOrgAuthStrategy(orgSlug);
-      (
-        passport.authenticate(oidcStrategy as Strategy, {
-          scope: "profile email openid"
-        }) as any
-      )(req, res);
-    }
-  });
-
-  // callback route after login from IDP
-  server.route({
-    url: "/callback",
-    method: "GET",
-    handler: async (req, res) => {
-      const oidcOrgSlug = req.session.get<any>("oidcOrgSlug");
-      const oidcStrategy = await server.services.oidc.getOrgAuthStrategy(oidcOrgSlug);
-      await (
-        passport.authenticate(oidcStrategy as Strategy, {
-          failureRedirect: "/api/v1/oidc/login/error",
-          session: false,
-          failureMessage: true
-        }) as any
-      )(req, res);
-
-      if (req.passportUser.isUserCompleted) {
-        return res.redirect(
-          `http://localhost:8080/login/sso?token=${encodeURIComponent(req.passportUser.providerAuthToken)}`
-        );
-      }
-
-      // signup
-      return res.redirect(
-        `http://localhost:8080/signup/sso?token=${encodeURIComponent(req.passportUser.providerAuthToken)}`
-      );
-    }
-  });
-
-  server.route({
-    url: "/login/error",
-    method: "GET",
-    handler: (req, res) => {
-      return res.status(500).send({
-        error: "Authentication error",
-        details: req.query
-      });
-    }
-  });
-
-  server.route({
-    url: "/config",
-    method: "GET",
-    schema: {
-      querystring: z.object({
-        orgSlug: z.string().trim()
-      }),
-      response: {
-        200: OidcConfigsSchema.pick({
-          id: true,
-          issuer: true,
-          authorizationEndpoint: true,
-          jwksUri: true,
-          tokenEndpoint: true,
-          userinfoEndpoint: true,
-          isActive: true,
-          orgId: true
-        }).extend({
-          clientId: z.string(),
-          clientSecret: z.string()
-        })
-      }
-    },
-    handler: async (req) => {
-      const { orgSlug } = req.query;
-      const oidc = await server.services.oidc.getOidc({
-        orgSlug,
-        type: "external",
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod
-      });
-
-      return oidc;
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      body: z
-        .object({
-          issuer: z.string(),
-          authorizationEndpoint: z.string(),
-          jwksUri: z.string(),
-          tokenEndpoint: z.string(),
-          userinfoEndpoint: z.string(),
-          clientId: z.string(),
-          clientSecret: z.string(),
-          isActive: z.boolean()
-        })
-        .partial()
-        .merge(z.object({ orgSlug: z.string() })),
-      response: {
-        200: OidcConfigsSchema.pick({
-          id: true,
-          issuer: true,
-          authorizationEndpoint: true,
-          jwksUri: true,
-          tokenEndpoint: true,
-          userinfoEndpoint: true,
-          orgId: true,
-          isActive: true
-        })
-      }
-    },
-    handler: async (req) => {
-      const oidc = await server.services.oidc.updateOidcCfg({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-      return oidc;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    schema: {
-      body: z.object({
-        issuer: z.string(),
-        authorizationEndpoint: z.string(),
-        jwksUri: z.string(),
-        tokenEndpoint: z.string(),
-        userinfoEndpoint: z.string(),
-        clientId: z.string(),
-        clientSecret: z.string(),
-        isActive: z.boolean(),
-        orgSlug: z.string()
-      }),
-      response: {
-        200: OidcConfigsSchema.pick({
-          id: true,
-          issuer: true,
-          authorizationEndpoint: true,
-          jwksUri: true,
-          tokenEndpoint: true,
-          userinfoEndpoint: true,
-          orgId: true,
-          isActive: true
-        })
-      }
-    },
-
-    handler: async (req) => {
-      const oidc = await server.services.oidc.createOidcCfg({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-      return oidc;
-    }
-  });
-};