Skip to main content

Abstract Class: BaseOAuthAuthorizeRouteSQL

Defined in: auth/src/routes/sql/BaseOAuthAuthorizeRouteSQL.ts:8

Handles the OAuth 2.0 / OIDC /authorize endpoint (RFC 6749 §4.1.1) and the consent decision that may follow it. Every response is JSON — never a raw HTTP redirect — since this library never owns real HTTP routing/rendering; a subclass mounted by the downstream project decides how to actually navigate the browser based on the redirectTo/loginRequired/consentRequired shape returned.

Deliberately does not authenticate the resource owner via a fixed @Auth([...]) decorator (a decorator's strategy list is fixed at class-declaration time — see the caveat documented on BaseAuthOIDCRoute). Instead, resolveUserUid() first checks req.session.userUid (the field TokenUtils.createAuthResult() already populates for every existing login strategy, including the OIDC relying-party flow against an upstream IdP), falling back to authMiddleware.authenticate(resourceOwnerStrategies, ...) only when no session is present. This is what lets a mobile app federate through an upstream IdP (e.g. Entra ID) with zero changes to this library's relying-party code — the user simply logs in via the existing OIDC route first, and /authorize observes the resulting session.

Consent has no server-side ephemeral storage: when consent is required, a short-lived, HMAC-signed "consent ticket" (via JWTUtils, sharing this deployment's existing auth:secret) encodes the pending request, and decideConsent() verifies and decodes it — avoiding a second storage dependency (Redis/ memory) for state that's inherently short-lived and only ever round-tripped through the caller.

Honors the OIDC Core §3.1.2.1 prompt request parameter: none demands zero user interaction, failing fast with a login_required/consent_required error redirect instead of the usual {loginRequired:true}/{consentRequired:true} (which invite the downstream app to interact with the user) whenever either would otherwise be needed; login/select_account force fresh interactive login even when a session already resolves a user (this library has no concept of an account picker, so both collapse to the same "log in again" signal); consent forces the consent screen even when a sufficient ConsentGrant already exists. none MUST NOT be combined with any other value (RFC-mandated), and is rejected with invalid_request if it is.

Extends​

Constructors​

Constructor​

new BaseOAuthAuthorizeRouteSQL(): BaseOAuthAuthorizeRouteSQL

Returns​

BaseOAuthAuthorizeRouteSQL

Inherited from​

BaseOAuthAuthorizeRoute.constructor

Properties​

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:70

Inherited from​

BaseOAuthAuthorizeRoute.authMiddleware

authorizationCodeClass​

protected authorizationCodeClass: any = AuthorizationCodeSQL

Defined in: auth/src/routes/sql/BaseOAuthAuthorizeRouteSQL.ts:9

Overrides​

BaseOAuthAuthorizeRoute.authorizationCodeClass

authorizationCodeRepo?​

protected optional authorizationCodeRepo?: RepoUtils<AuthorizationCodeSQL>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:72

Inherited from​

BaseOAuthAuthorizeRoute.authorizationCodeRepo

clientClass​

protected clientClass: any = ClientSQL

Defined in: auth/src/routes/sql/BaseOAuthAuthorizeRouteSQL.ts:10

Overrides​

BaseOAuthAuthorizeRoute.clientClass

clientRepo?​

protected optional clientRepo?: RepoUtils<ClientSQL>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:74

Inherited from​

BaseOAuthAuthorizeRoute.clientRepo

codeTTL​

protected codeTTL: string = "60s"

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:77

Inherited from​

BaseOAuthAuthorizeRoute.codeTTL

consentGrantClass​

protected consentGrantClass: any = ConsentGrantSQL

Defined in: auth/src/routes/sql/BaseOAuthAuthorizeRouteSQL.ts:11

Overrides​

BaseOAuthAuthorizeRoute.consentGrantClass

consentGrantRepo?​

protected optional consentGrantRepo?: RepoUtils<ConsentGrantSQL>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:88

Inherited from​

BaseOAuthAuthorizeRoute.consentGrantRepo

consentTicketTTL​

protected consentTicketTTL: string = "10m"

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:80

Inherited from​

BaseOAuthAuthorizeRoute.consentTicketTTL

corsConfig​

protected corsConfig: any = {}

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:86

Inherited from​

BaseOAuthAuthorizeRoute.corsConfig

csrfConfig​

protected csrfConfig: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:83

Inherited from​

BaseOAuthAuthorizeRoute.csrfConfig

jwtConfig?​

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:91

Inherited from​

BaseOAuthAuthorizeRoute.jwtConfig

resourceOwnerStrategies​

abstract protected resourceOwnerStrategies: string[]

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:98

The list of strategy names (registered on AuthMiddleware) to attempt when no req.session.userUid is present — e.g. ["jwt"], or ["jwt", "oidc_entra"] for a deployment federating through an upstream IdP. A subclass must supply this.

Inherited from​

BaseOAuthAuthorizeRoute.resourceOwnerStrategies

Methods​

authorize()​

authorize(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:282

Validates an incoming authorization request and either issues a code, or reports that a login or a consent decision is needed first. client_id/redirect_uri validation failures are reported directly (RFC 6749 §4.1.2.1 forbids redirecting anywhere before redirect_uri is trusted); every other error is delivered to redirect_uri instead.

Parameters​

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<any>

Inherited from​

BaseOAuthAuthorizeRoute.authorize

decideConsent()​

decideConsent(req, res): Promise<any>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:403

Completes a pending consent decision produced by authorize(). On approval, records/updates the ConsentGrant and issues an authorization code; on denial, returns an access_denied error redirect. Requires the caller to be authenticated as the same user the ticket was issued to.

Parameters​

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<any>

Inherited from​

BaseOAuthAuthorizeRoute.decideConsent

resolveUserUid()​

protected resolveUserUid(req, res): Promise<string | undefined>

Defined in: auth/src/routes/BaseOAuthAuthorizeRoute.ts:135

Resolves the uid of the currently authenticated resource owner, or undefined if there isn't one. See the class doc comment for why this doesn't use a fixed @Auth([...]) decorator.

Parameters​

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<string | undefined>

Inherited from​

BaseOAuthAuthorizeRoute.resolveUserUid