|
| 1 | +import { redirect } from '@sveltejs/kit'; |
| 2 | +import { journey } from '@forgerock/journey-client'; |
| 3 | +import { oidc } from '@forgerock/oidc-client'; |
| 4 | +import { WELLKNOWN_URL, CLIENT_ID, REDIRECT_URI, SCOPE, noopStorage } from '$lib/config.js'; |
| 5 | +import type { PageServerLoad, Actions } from './$types'; |
| 6 | + |
| 7 | +/** |
| 8 | + * Server-side load function. |
| 9 | + * |
| 10 | + * Initializes the journey client with noop storage (no sessionStorage on server) |
| 11 | + * and calls start() to fetch the first authentication step. The raw step payload |
| 12 | + * is serialized and passed to the client for SSR rendering. |
| 13 | + */ |
| 14 | +export const load: PageServerLoad = async () => { |
| 15 | + try { |
| 16 | + const client = await journey({ |
| 17 | + config: { |
| 18 | + serverConfig: { wellknown: WELLKNOWN_URL }, |
| 19 | + storage: { type: 'custom', name: 'journey-step', custom: noopStorage }, |
| 20 | + }, |
| 21 | + }); |
| 22 | + |
| 23 | + const result = await client.start(); |
| 24 | + |
| 25 | + if ('payload' in result) { |
| 26 | + return { |
| 27 | + stepPayload: result.payload, |
| 28 | + error: null, |
| 29 | + }; |
| 30 | + } |
| 31 | + |
| 32 | + return { |
| 33 | + stepPayload: null, |
| 34 | + error: 'error' in result ? result : { error: 'unexpected', message: 'Unexpected result' }, |
| 35 | + }; |
| 36 | + } catch (e) { |
| 37 | + return { |
| 38 | + stepPayload: null, |
| 39 | + error: { |
| 40 | + error: 'server_init_failed', |
| 41 | + message: e instanceof Error ? e.message : 'Failed to initialize journey client on server', |
| 42 | + }, |
| 43 | + }; |
| 44 | + } |
| 45 | +}; |
| 46 | + |
| 47 | +/** |
| 48 | + * Form actions — the authorize action generates a PKCE authorize URL on the server, |
| 49 | + * stores the verifier in a cookie, and redirects the browser to the authorize endpoint. |
| 50 | + */ |
| 51 | +export const actions: Actions = { |
| 52 | + authorize: async ({ cookies }) => { |
| 53 | + const client = await oidc({ |
| 54 | + config: { |
| 55 | + serverConfig: { wellknown: WELLKNOWN_URL }, |
| 56 | + clientId: CLIENT_ID, |
| 57 | + redirectUri: REDIRECT_URI, |
| 58 | + scope: SCOPE, |
| 59 | + responseType: 'code', |
| 60 | + }, |
| 61 | + storage: { type: 'custom', name: CLIENT_ID, custom: noopStorage }, |
| 62 | + }); |
| 63 | + |
| 64 | + if (!client || 'error' in client) { |
| 65 | + return { error: 'Failed to initialize OIDC client' }; |
| 66 | + } |
| 67 | + |
| 68 | + // Generate authorize URL with PKCE — returns { url, verifier, state } |
| 69 | + const result = await client.authorize.url(); |
| 70 | + |
| 71 | + if ('error' in result) { |
| 72 | + return { error: result.error }; |
| 73 | + } |
| 74 | + |
| 75 | + // Store PKCE verifier + state in an httpOnly cookie for the callback route |
| 76 | + cookies.set('pkce_verifier', result.verifier, { |
| 77 | + path: '/', |
| 78 | + httpOnly: true, |
| 79 | + sameSite: 'lax', |
| 80 | + maxAge: 300, // 5 minutes |
| 81 | + }); |
| 82 | + cookies.set('pkce_state', result.state, { |
| 83 | + path: '/', |
| 84 | + httpOnly: true, |
| 85 | + sameSite: 'lax', |
| 86 | + maxAge: 300, |
| 87 | + }); |
| 88 | + |
| 89 | + // Redirect browser to authorization endpoint |
| 90 | + redirect(303, result.url); |
| 91 | + }, |
| 92 | +}; |
0 commit comments