Abstract Class: BaseOAuthAuthorizeRoute<C, A, G>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:61

Handles the OAuth 2.0 / OIDC /authorize endpoint (RFC 6749 §4.1.1) and the consent decision that may follow it. Every response is JSON — never a raw HTTP redirect — since this library never owns real HTTP routing/rendering; a subclass mounted by the downstream project decides how to actually navigate the browser based on the redirectTo/loginRequired/consentRequired shape returned.

Deliberately does not authenticate the resource owner via a fixed @Auth([...]) decorator (a decorator's strategy list is fixed at class-declaration time — see the caveat documented on BaseAuthOIDCRoute). Instead, resolveUserUid() first checks req.session.userUid (the field TokenUtils.createAuthResult() already populates for every existing login strategy, including the OIDC relying-party flow against an upstream IdP), falling back to authMiddleware.authenticate(resourceOwnerStrategies, ...) only when no session is present. This is what lets a mobile app federate through an upstream IdP (e.g. Entra ID) with zero changes to this library's relying-party code — the user simply logs in via the existing OIDC route first, and /authorize observes the resulting session.

Consent has no server-side ephemeral storage: when consent is required, a short-lived, HMAC-signed "consent ticket" (via JWTUtils, sharing this deployment's existing auth:secret) encodes the pending request, and decideConsent() verifies and decodes it — avoiding a second storage dependency (Redis/ memory) for state that's inherently short-lived and only ever round-tripped through the caller.

Honors the OIDC Core §3.1.2.1 prompt request parameter: none demands zero user interaction, failing fast with a login_required/consent_required error redirect instead of the usual {loginRequired:true}/{consentRequired:true} (which invite the downstream app to interact with the user) whenever either would otherwise be needed; login/select_account force fresh interactive login even when a session already resolves a user (this library has no concept of an account picker, so both collapse to the same "log in again" signal); consent forces the consent screen even when a sufficient ConsentGrant already exists. none MUST NOT be combined with any other value (RFC-mandated), and is rejected with invalid_request if it is.

Extended by

• BaseOAuthAuthorizeRouteMongo
• BaseOAuthAuthorizeRouteSQL

Type Parameters

C

C extends Client

A

A extends AuthorizationCode

G

G extends ConsentGrant

Constructors

Constructor

new BaseOAuthAuthorizeRoute<C, A, G>(): BaseOAuthAuthorizeRoute<C, A, G>

Returns

BaseOAuthAuthorizeRoute<C, A, G>

Properties

authMiddleware?

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:70

---

authorizationCodeClass

abstract protected authorizationCodeClass: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:62

---

authorizationCodeRepo?

protected optional authorizationCodeRepo?: RepoUtils<A>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:72

---

clientClass

abstract protected clientClass: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:63

---

clientRepo?

protected optional clientRepo?: RepoUtils<C>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:74

---

codeTTL

protected codeTTL: string = "60s"

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:77

---

consentGrantClass

abstract protected consentGrantClass: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:64

---

consentGrantRepo?

protected optional consentGrantRepo?: RepoUtils<G>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:88

---

consentTicketTTL

protected consentTicketTTL: string = "10m"

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:80

---

corsConfig

protected corsConfig: any = {}

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:86

---

csrfConfig

protected csrfConfig: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:83

---

jwtConfig?

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:91

---

resourceOwnerStrategies

abstract protected resourceOwnerStrategies: string[]

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:98

The list of strategy names (registered on AuthMiddleware) to attempt when no req.session.userUid is present — e.g. ["jwt"], or ["jwt", "oidc_entra"] for a deployment federating through an upstream IdP. A subclass must supply this.

Methods

authorize()

authorize(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:282

Validates an incoming authorization request and either issues a code, or reports that a login or a consent decision is needed first. client_id/redirect_uri validation failures are reported directly (RFC 6749 §4.1.2.1 forbids redirecting anywhere before redirect_uri is trusted); every other error is delivered to redirect_uri instead.

Parameters

req

HttpRequest

res

HttpResponse

Returns

Promise<any>

---

decideConsent()

decideConsent(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:403

Completes a pending consent decision produced by authorize(). On approval, records/updates the ConsentGrant and issues an authorization code; on denial, returns an access_denied error redirect. Requires the caller to be authenticated as the same user the ticket was issued to.

Parameters

req

HttpRequest

res

HttpResponse

Returns

Promise<any>

---

resolveUserUid()

protected resolveUserUid(req, res): Promise<string | undefined>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:135

Resolves the uid of the currently authenticated resource owner, or undefined if there isn't one. See the class doc comment for why this doesn't use a fixed @Auth([...]) decorator.

Parameters

req

HttpRequest

res

HttpResponse

Returns

Promise<string | undefined>