SEEC-Portal-Front/server/controller/auth.js

const Response = require('../util/response')
const jwt = require('jsonwebtoken')

class AuthController {
  static checkClient (ctx) {
    const allowed_client_ids = ['seec-portal', 'seec-seec', 'seec-mooc', 'seec-helper']
    const allowed_redirect_domains = ['localhost:3000', 'localhost:8000', 'p.seecoder.cn', 'seec.seecoder.cn', 'mooc.seecoder.cn', 'helper.seecoder.cn',
      'mooc-test.seecoder.cn', 'seec-test.seecoder.cn', 'p-test.seecoder.cn', 'helper-test.seecoder.cn', 'seecoder.cn']

    const query = ctx.query
    // console.log('query', query);

    const { client_id, redirect_uri, scope } = query
    if (!client_id || !redirect_uri || !scope) {
      ctx.body = Response.failed('非法请求,拒绝访问')
    } else if (allowed_client_ids.indexOf(client_id) < 0 || scope !== 'openid' || (redirect_uri.indexOf('https://') !== 0 && redirect_uri.indexOf('http://') !== 0)) {
      ctx.body = Response.failed('非法请求,拒绝访问')
    } else {
      const durl = /http:\/\/([^\/]+)\//i
      const domain = redirect_uri.match(durl)[1]
      // console.log('domain',domain);
      if (allowed_redirect_domains.filter(item => domain.indexOf(item) >= 0).length == 0) {
        ctx.body = Response.failed('非法请求,拒绝访问')
      } else {
        ctx.cookies.set('redirect_uri', redirect_uri, {
          maxAge: 60 * 1000 * 3
        })
        ctx.cookies.set('client_id', client_id, {
          maxAge: 60 * 1000 * 3
        })
        ctx.redirect('/login')
      }
    }
  }

  static processIDToken (ctx) {
    const query = ctx.query
    const { id_token } = query
    if (!id_token) {
      ctx.body = Response.failed('非法请求！')
    } else {
      jwt.verify(id_token, 'SEEC-1919810-OIDC-114514', (err, authData) => {
        if (err) {
          console.log('err:', err)
          ctx.redirect('/error')
        } else {
          const { iss, sub, aud, auth_time, iat, exp, user_info } = authData
          if (!iss || !sub || !aud || !auth_time || !iat || !exp || !user_info) {
            ctx.redirect('/error')
          } else if (iss !== 'p.seecoder.cn' || aud !== 'seec-portal') {
            ctx.redirect('/error')
          } else {
            const user = user_info
            const my_token = jwt.sign(
              user, 'SEEC-1919810-OIDC-114514', { expiresIn: '1day' }
            )

            // console.log("user", user_info);

            ctx.session.maxAge = 1000

            ctx.session.token = my_token
            ctx.session.user = user

            // console.log('state.origin_path', ctx.state.origin_path);

            ctx.redirect('/setToken')
            // console.log('$cookies', ctx.app.$cookies);

            // ctx.res.setHeader("Access-Control-Allow-Origin", "http://localhost:3000");
            // ctx.res.setHeader("Access-Control-Allow-Credentials", true);

            // ctx.cookies.user = user;
            // ctx.cookies.token = my_token;
            //
            // console.log("origin_path", origin_path)
            //
            // ctx.redirect(origin_path);

            // let url = '/setToken?token=' + my_token + '&id=' + user.id + '&name=' + user.name + '&phone=' + user.phone;
            // ctx.redirect(url);
          }
        }
      })
    }
  }

  static authenticate (ctx) {
    const query = ctx.query

    const return_uri = encodeURIComponent(ctx.origin + '/api/receiveIDToken')
    const url = ctx.origin + '/api/interaction?' +
      'client_id=' + 'seec-portal' +
      '&scope=openid' +
      '&redirect_uri=' + return_uri

    // console.log("redirect to " + url);

    return ctx.redirect(url)
  }
}

module.exports = AuthController