hyb-oa/server/src/services/oidc/index.js

const { Issuer, generators } = require("openid-client");

function validateOidcConfig(config) {
  if (!config?.oidcEnabled) {
    throw new Error("OIDC is disabled");
  }

  if (!config.oidcIssuerUrl) {
    throw new Error("Missing OIDC_ISSUER_URL");
  }

  if (!config.oidcClientId) {
    throw new Error("Missing OIDC_CLIENT_ID");
  }

  if (!config.oidcRedirectUri) {
    throw new Error("Missing OIDC_REDIRECT_URI");
  }

  return {
    issuerUrl: config.oidcIssuerUrl,
    clientId: config.oidcClientId,
    clientSecret: config.oidcClientSecret || undefined,
    redirectUri: config.oidcRedirectUri,
    scopes: config.oidcScopes || "openid profile email",
  };
}

let cachedClientPromise = null;
let cachedClientKey = null;

async function getOidcClient(config) {
  const oidc = validateOidcConfig(config);
  const key = JSON.stringify({
    issuerUrl: oidc.issuerUrl,
    clientId: oidc.clientId,
    redirectUri: oidc.redirectUri,
  });

  if (cachedClientPromise && cachedClientKey === key) {
    return cachedClientPromise;
  }

  cachedClientKey = key;
  cachedClientPromise = Issuer.discover(oidc.issuerUrl).then((issuer) => {
    const client = new issuer.Client({
      client_id: oidc.clientId,
      client_secret: oidc.clientSecret,
      redirect_uris: [oidc.redirectUri],
      response_types: ["code"],
    });

    return { issuer, client, config: oidc };
  });

  return cachedClientPromise;
}

module.exports = {
  generators,
  getOidcClient,
  validateOidcConfig,
};