Make Own OpenID Provider

$ npm i -g @nestjs/cli
$ yarn global add @nestjs/cli  # or yarn
$ nest new my-own-openid-provider --strict -p yarn  # enable strict, use yarn

$ nest generate module user
$ nest generate service user

// src/user/entities/user.entity.ts

export class UserEntity {
  id: number;
  username: string;
  password: string;
  email: string;
  firstName: string;
  lastName: string;

  static randomWithId(id: number) {
    const user = new UserEntity();
    user.id = id;
    // ...
    return user;
  }
}

// src/user/user.repository.ts

// ...
const users = [...Array(20)].map((_, id) => UserEntity.randomWithId(id));

@Injectable()
export class UserRepository {
  getUserByUsername(username: string) {
    return users.find((user) => user.username === username);
  }
}

// src/user/user.service.ts

// ...
getUserByUsernameAndPassword(username: string, password: string) {
  const user = this.userRepository.getUserByUsername(username);
  if (user && user.password === password) {
    return user;
  }
  return null;
}
// ...

$ nest generate module auth
$ nest generate controller auth
$ nest generate service auth
$ yarn add express-session
$ yarn add @types/express-session -D
$ yarn add hbs

// src/main.ts

// ...
app.setBaseViewsDir(join(__dirname, '..', 'views'));
app.setViewEngine('hbs');
app.use(
  session({
    secret: 'secret',
    resave: false,
    saveUninitialized: false,
  }),
);
// ...

// src/auth/auth.controller.ts
@Get('login')
loginPage(@Session() session: Record<string, any>, @Res() res: Response) {
  if (session.user) {
    return res.status(302).redirect('/auth/info');
  }
  return res.render('auth/login', {});
}

@Post('login')
login(
  @Session() session: Record<string, any>,
  @Body() loginDto: LoginDto,
  @Res() res: Response,
) {
  const user = this.userService.getUserByUsernameAndPassword(
    loginDto.username,
    loginDto.password,
  );
  if (!user) throw new NotFoundException();
  session.user = user;
  return res.status(302).redirect('/auth/info');
}

<!-- views/auth/login.hbs -->

<!-- ... -->
<form action="" method="post">
  <div>
    <label>
      username:
      <input type="text" name="username" autocomplete="username" />
    </label>
  </div>
  <div>
    <label>
      password:
      <input type="password" name="password" autocomplete="current-password" />
    </label>
  </div>
  <div>
    <input type="submit" value="Login" />
  </div>
</form>
<!-- ... -->

// src/auth/auth.controller.ts

// ...
@Get('info')
info(@Session() session: Record<string, any>, @Res() res: Response) {
  const user = session.user;
  if (!user) {
    return res.status(302).redirect('/auth/login');
  }
  return res.render('auth/info', { user });
}

<!-- ... -->
<div>username: {{ user.username }}</div>
<div>email: {{ user.email }}</div>
<!-- ... -->

$ nest generate module client
$ nest generate service client

// src/client/entities/client.entity.ts

// ...
export class ClientEntity {
  id: string;
  secret: string;
  redirectUris: string[];

  static random() {
    const client = new ClientEntity();
    // ...
    return client;
  }
}

// src/client/client.repository.ts

// ...
const clients = [...Array(20).map(() => ClientEntity.random())];

@Injectable()
export class ClientRepository {
  getClientById(id: string) {
    return clients.find((client) => client.id === id);
  }
}

$ nest generate module oauth
$ nest generate controller oauth
$ nest generate service oauth
$ yarn add class-validator class-transformer

// src/oauth/dto/authorize.dto.ts

// ...
export class AuthorizeDto {
  @IsString({ message: 'invalid_request' })
  client_id: string;

  @IsString()
  @IsUrl(
    {
      require_valid_protocol: false,
      require_tld: false,
      require_host: false,
    },
    { message: 'invalid_request' },
  )
  redirect_uri: string;

  @IsString({ message: 'invalid_request' })
  @IsOptional()
  nonce?: string;

  @IsArray()
  @IsEnum(allowedScopes, { each: true, message: 'invalid_scope' })
  @Transform(({ value }) => value.split(' '))
  scope: Readonly<Scope[]>;

  @IsArray()
  @IsEnum(['code'], {
    each: true,
    message: 'unsupported_response_type',
  })
  @Transform(({ value }) => value.split(' '))
  response_type: 'code'[];

  @IsString()
  @IsOptional()
  state?: string;
}

// src/oauth/oauth.service.ts

// ...
interface CacheData {
  user: UserEntity;
  client: ClientEntity;
  redirectUri: string;
  nonce?: string;
  scopes?: readonly string[];
}
// ...
generateCode(data: CacheData) {
  const code = this.generateOpaqueToken();
  // cache-manager@v5에서는 ttl이 seconds에서 milliseconds 단위로 바뀌었다.
  this.cacheManager.set(code, data, 3600e3);
  return code;
}
// ...

// src/oauth/oauth.controller.ts

// ...
@Get('authorize')
authorize(
  @Query() authorizeDto: AuthorizeDto,
  @Session() session: Record<string, any>,
  @Req() req: Request,
  @Res() res: Response,
) {
  const client = this.clientService.getClientById(authorizeDto.client_id);
  if (!client) {
    throw new BadRequestException('invalid_client');
  }
  const user = session.user;
  if (!user) {
    return res
      .status(302)
      .redirect(`/auth/login?redirect=${encodeURIComponent(req.url)}`);
  }
  if (!client.redirectUris.includes(authorizeDto.redirect_uri)) {
    throw new BadRequestException('unauthorized_client');
  }
  const params = new URLSearchParams();
  params.set(
    'code',
    this.oauthService.generateCode({
      user,
      client,
      redirectUri: authorizeDto.redirect_uri,
      nonce: authorizeDto.nonce,
      scopes: authorizeDto.scope,
    }),
  );
  if (authorizeDto.state) {
    params.set('state', authorizeDto.state);
  }
  return res
    .status(302)
    .redirect(`${authorizeDto.redirect_uri}?${params.toString()}`);
}
// ...

// src/auth/auth.controller.ts

// ...
@Post('login')
login(
  @Session() session: Record<string, any>,
  @Body() loginDto: LoginDto,
  @Res() res: Response,
  @Query('redirect') redirect?: string,
) {
  const user = this.userService.getUserByUsernameAndPassword(
    loginDto.username,
    loginDto.password,
  );
  if (!user) throw new NotFoundException();
  session.user = user;
  return res.status(302).redirect(redirect ?? '/auth/info');
}
// ...

// src/oauth/oauth.service.ts

// ...
async generateToken(tokenDto: TokenDto) {
  const client = this.clientService.getClientByIdAndSecret(
    tokenDto.client_id,
    tokenDto.client_secret,
  );
  if (!client) {
    throw new BadRequestException('unauthorized_client');
  }

  if (tokenDto.grant_type !== 'authorization_code') {
    throw new BadRequestException('unsupported_grant_type');
  }
  if (!tokenDto.code) {
    throw new BadRequestException('invalid_request');
  }

  const data = await this.cacheManager.get<CacheData>(tokenDto.code);
  if (!data) {
    throw new BadRequestException('invalid_grant');
  }
  this.cacheManager.del(tokenDto.code);

  if (data.redirectUri !== tokenDto.redirect_uri) {
    throw new BadRequestException('invalid_grant');
  }
  if (data.client.id !== client.id) {
    throw new BadRequestException('invalid_client');
  }

  return this.createToken(data);
}
// ...

// src/oauth/oauth.service.ts
private async createToken(data: CacheData) {
  const accessToken = this.generateOpaqueToken();
  await this.cacheManager.set(accessToken, data, 3600e3);
  const refreshToken = this.generateOpaqueToken();
  await this.cacheManager.set(refreshToken, data, 3600e3 * 24 * 30 * 6);
  const expiresIn = 3600;
  return {
    access_token: accessToken,
    refresh_token: refreshToken,
    expires_in: expiresIn,
    token_type: 'Bearer',
    scope: data.scopes?.join(' ') || '',
  };
}

const key = crypto.generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem',
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
  },
});
this.jwtPrivateKey = crypto.createPrivateKey(key.privateKey);
this.jwtPublicKey = crypto.createPublicKey(key.publicKey);
const hash = crypto.createHash('sha256');
hash.update(this.jwtPublicKey.export({ type: 'spki', format: 'der' }));
this.jwtKeyID = hash.digest('hex');

const idToken = jwt.sign(
  {
    nonce: data.nonce,
    name: `${data.user.firstName} ${data.user.lastName}`,
    given_name: data.user.firstName,
    family_name: data.user.lastName,
    email: data.user.email,
  },
  this.jwtPrivateKey,
  {
    algorithm: 'RS256',
    expiresIn,
    audience: data.client.id,
    issuer: 'http://localhost:3000',
    subject: data.user.id.toString(),
    keyid: this.jwtKeyID,
  },
);

// src/oauth/oauth.service.ts

// ...
async userInfo(accessToken: string) {
  const data = await this.cacheManager.get<CacheData>(accessToken);
  if (!data) {
    throw new BadRequestException('invalid_token');
  }
  return {
    username: data.user.username,
    email: data.user.email,
    given_name: data.user.firstName,
    family_name: data.user.lastName,
  };
}
// ...

discovery() {
  const baseUrl = 'http://localhost:3000';
  return {
    issuer: 'http://localhost:3000',
    authorization_endpoint: `${baseUrl}/oauth/authorize`,
    token_endpoint: `${baseUrl}/oauth/token`,
    userinfo_endpoint: `${baseUrl}/oauth/userinfo`,
    jwks_uri: `${baseUrl}/oauth/certs`,
    response_types_supported: [
      'code',
      'token',
      'id_token',
      'code token',
      'code id_token',
      'token id_token',
      'code token id_token',
    ],
    subject_types_supported: ['public'],
    id_token_signing_alg_values_supported: ['RS256'],
    scopes_supported: ['openid'],
    token_endpoint_auth_methods_supported: [
      'client_secret_basic',
      'client_secret_post',
    ],
    claims_supported: ['name', 'email', 'aud', 'exp', 'iat', 'iss', 'sub'],
    grant_types_supported: [
      'authorization_code',
      'refresh_token',
      'implicit',
    ],
  };
}