design

apps/api/src/oidc/oidc-provider.service.ts

@@ -63,13 +63,13 @@ export class OidcProviderService implements OnModuleInit {
   ): Promise<void> {
     const details = await this.interactionDetails(request, response);
     if (details.uid !== uid || details.prompt.name !== 'login') {
-      throw new UnauthorizedException('Ungültige OIDC-Interaktion.');
+      throw new UnauthorizedException('Ungueltige OIDC-Interaktion.');
     }
 
     const valid = await this.ldapAuth.verifyPassword(username, password);
     if (!valid) {
       await this.audit.record({ type: 'oidc.login_failed', username, ipAddress: request.ip, userAgent: request.headers['user-agent'] });
-      throw new UnauthorizedException('Ungültige Zugangsdaten.');
+      throw new UnauthorizedException('Ungueltige Zugangsdaten.');
     }
 
     const account = await this.lldap.getAccount(username);
@@ -93,10 +93,15 @@ export class OidcProviderService implements OnModuleInit {
     );
   }
 
-  async finishConsent(request: Request, response: Response, uid: string): Promise<void> {
+  async finishConsent(
+    request: Request,
+    response: Response,
+    uid: string,
+    options: { autoGranted?: boolean } = {},
+  ): Promise<void> {
     const details = await this.interactionDetails(request, response);
     if (details.uid !== uid || details.prompt.name !== 'consent') {
-      throw new UnauthorizedException('Ungültige OIDC-Interaktion.');
+      throw new UnauthorizedException('Ungueltige OIDC-Interaktion.');
     }
 
     const clientId = String(details.params.client_id ?? '');
@@ -110,13 +115,18 @@ export class OidcProviderService implements OnModuleInit {
       ? await Grant.find(details.grantId)
       : new Grant({ accountId, clientId });
 
-    grant.addOIDCScope(String(details.params.scope ?? 'openid'));
+    const scope = String(details.params.scope ?? 'openid');
+    grant.addOIDCScope(scope);
     if (details.prompt.details?.missingOIDCClaims) {
       grant.addOIDCClaims(details.prompt.details.missingOIDCClaims);
     }
 
     const grantId = await grant.save();
-    await this.audit.record({ type: 'oidc.consent_granted', username: accountId, metadata: { clientId } });
+    await this.audit.record({
+      type: options.autoGranted ? 'oidc.consent_auto_granted' : 'oidc.consent_granted',
+      username: accountId,
+      metadata: { clientId, scope },
+    });
 
     await this.getProvider().interactionFinished(
       request,
@@ -138,6 +148,11 @@ export class OidcProviderService implements OnModuleInit {
     );
   }
 
+  async isFirstPartyClient(clientId: string): Promise<boolean> {
+    const client = await this.clients.findByClientId(clientId);
+    return client?.firstParty === true;
+  }
+
   private buildConfiguration(jwks: { keys: Record<string, unknown>[] }): Configuration {
     return {
       adapter: (name: string): Adapter => new TypeormOidcAdapter(name, this.storage, this.clients),