Merge pull request #12 from RADAR-base/feat/consent-module

Add initial hydra consent module

package.json

@@ -20,7 +20,7 @@
  "module": "dist/index.mjs",
  "typings": "dist/index.d.ts",
  "dependencies": {
- "@ory/client": "^0.0.0-next.f88d10559361",
+ "@ory/client": "1.6.2",
  "@ory/integrations": "0.2.8",
  "@ory/themes": "~0.0.101",
  "classnames": "^2.3.1",

pages/api/consent.ts

@@ -0,0 +1,80 @@
+import { Configuration, OAuth2Api } from "@ory/client"
+import { NextApiRequest, NextApiResponse } from "next"
+
+const hydra = new OAuth2Api(
+ new Configuration({
+ basePath: process.env.HYDRA_ADMIN_URL,
+ baseOptions: {
+ "X-Forwarded-Proto": "https",
+ withCredentials: true,
+ },
+ }),
+)
+
+// Helper function to extract session data
+const extractSession = (identity: any, grantScope: string[]) => {
+ const session: any = {
+ access_token: {
+ roles: identity.metadata_public.roles,
+ scope: identity.metadata_public.scope,
+ authorities: identity.metadata_public.authorities,
+ sources: identity.metadata_public.sources,
+ user_name: identity.metadata_public.mp_login,
+ },
+ id_token: {},
+ }
+ return session
+}
+
+export default async (req: NextApiRequest, res: NextApiResponse) => {
+ const { consentChallenge, consentAction, grantScope, remember, identity } =
+ req.body
+
+ try {
+ if (req.method === "GET") {
+ const { consent_challenge } = req.query
+ const response = await hydra.getOAuth2ConsentRequest({
+ consentChallenge: String(consent_challenge),
+ })
+ return res.status(200).json(response.data)
+ } else {
+ if (!consentChallenge || !consentAction) {
+ return res.status(400).json({ error: "Missing required parameters" })
+ }
+ if (consentAction === "accept") {
+ const { data: body } = await hydra.getOAuth2ConsentRequest({
+ consentChallenge,
+ })
+ const session = extractSession(identity, grantScope)
+ const acceptResponse = await hydra.acceptOAuth2ConsentRequest({
+ consentChallenge,
+ acceptOAuth2ConsentRequest: {
+ grant_scope: grantScope,
+ grant_access_token_audience: body.requested_access_token_audience,
+ session,
+ remember: Boolean(remember),
+ remember_for: 3600,
+ },
+ })
+ return res
+ .status(200)
+ .json({ redirect_to: acceptResponse.data.redirect_to })
+ } else {
+ const rejectResponse = await hydra.rejectOAuth2ConsentRequest({
+ consentChallenge,
+ rejectOAuth2Request: {
+ error: "access_denied",
+ error_description: "The resource owner denied the request",
+ },
+ })
+
+ return res
+ .status(200)
+ .json({ redirect_to: rejectResponse.data.redirect_to })
+ }
+ }
+ } catch (error) {
+ console.error(error)
+ return res.status(500).json({ error: "Internal server error" })
+ }
+}