versia-pub/server
2
0
Fork 0
mirror of https://github.com/versia-pub/server.git synced 2026-03-13 13:59:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

refactor(api): ♻️ Rewrite full authentication code to go OpenID-only

Browse source
This commit is contained in:
Jesse Wierzbinski 2025-08-21 00:45:58 +02:00
parent 4eae4cd062
commit 1bfc5fb013
No known key found for this signature in database
39 changed files with 3076 additions and 2009 deletions
Download patch file Download diff file Expand all files Collapse all files

35
packages/api/routes/well-known/jwks.test.ts
View file

@ -1,35 +0,0 @@
import { afterAll, describe, expect, test } from "bun:test";
import { Application } from "@versia-server/kit/db";
import { fakeRequest } from "@versia-server/tests";
import { randomUUIDv7 } from "bun";
const application = await Application.insert({
id: randomUUIDv7(),
clientId: "test-client-id",
redirectUri: "https://example.com/callback",
scopes: "openid profile email",
secret: "test-secret",
name: "Test Application",
});
afterAll(async () => {
await application.delete();
});
describe("/.well-known/jwks", () => {
test("should return JWK set with valid inputs", async () => {
const response = await fakeRequest("/.well-known/jwks", {
method: "GET",
});
expect(response.status).toBe(200);
const body = await response.json();
expect(body.keys).toHaveLength(1);
expect(body.keys[0].kty).toBe("OKP");
expect(body.keys[0].use).toBe("sig");
expect(body.keys[0].alg).toBe("EdDSA");
expect(body.keys[0].kid).toBe("1");
expect(body.keys[0].crv).toBe("Ed25519");
expect(body.keys[0].x).toBeString();
});
});

62
packages/api/routes/well-known/jwks.ts
View file

@ -1,62 +0,0 @@
import { config } from "@versia-server/config";
import { apiRoute, auth } from "@versia-server/kit/api";
import { describeRoute, resolver } from "hono-openapi";
import { exportJWK } from "jose";
import { z } from "zod/v4";
export default apiRoute((app) => {
app.get(
"/.well-known/jwks",
describeRoute({
summary: "JWK Set",
tags: ["OpenID"],
responses: {
200: {
description: "JWK Set",
content: {
"application/json": {
schema: resolver(
z.object({
keys: z.array(
z.object({
kty: z.string().optional(),
use: z.string(),
alg: z.string(),
kid: z.string(),
crv: z.string().optional(),
x: z.string().optional(),
y: z.string().optional(),
}),
),
}),
),
},
},
},
},
}),
auth({
auth: false,
}),
async (context) => {
const jwk = await exportJWK(config.authentication.keys.private);
// Remove the private key 💀
jwk.d = undefined;
return context.json(
{
keys: [
{
...jwk,
use: "sig",
alg: "EdDSA",
kid: "1",
},
],
},
200,
);
},
);
});

65
packages/api/routes/well-known/openid-configuration/index.ts
View file

@ -1,65 +0,0 @@
import { config } from "@versia-server/config";
import { apiRoute } from "@versia-server/kit/api";
import { describeRoute, resolver } from "hono-openapi";
import { z } from "zod/v4";
export default apiRoute((app) =>
app.get(
"/.well-known/openid-configuration",
describeRoute({
summary: "OpenID Configuration",
tags: ["OpenID"],
responses: {
200: {
description: "OpenID Configuration",
content: {
"application/json": {
schema: resolver(
z.object({
issuer: z.string(),
authorization_endpoint: z.string(),
token_endpoint: z.string(),
userinfo_endpoint: z.string(),
jwks_uri: z.string(),
response_types_supported: z.array(
z.string(),
),
subject_types_supported: z.array(
z.string(),
),
id_token_signing_alg_values_supported:
z.array(z.string()),
scopes_supported: z.array(z.string()),
token_endpoint_auth_methods_supported:
z.array(z.string()),
claims_supported: z.array(z.string()),
}),
),
},
},
},
},
}),
(context) => {
const baseUrl = config.http.base_url;
return context.json(
{
issuer: baseUrl.origin.toString(),
authorization_endpoint: `${baseUrl.origin}/oauth/authorize`,
token_endpoint: `${baseUrl.origin}/oauth/token`,
userinfo_endpoint: `${baseUrl.origin}/api/v1/accounts/verify_credentials`,
jwks_uri: `${baseUrl.origin}/.well-known/jwks`,
response_types_supported: ["code"],
subject_types_supported: ["public"],
id_token_signing_alg_values_supported: ["EdDSA"],
scopes_supported: ["openid", "profile", "email"],
token_endpoint_auth_methods_supported: [
"client_secret_basic",
],
claims_supported: ["sub"],
},
200,
);
},
),
);