|
| 1 | +/** |
| 2 | + * Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com). |
| 3 | + * |
| 4 | + * WSO2 LLC. licenses this file to you under the Apache License, |
| 5 | + * Version 2.0 (the "License"); you may not use this file except |
| 6 | + * in compliance with the License. |
| 7 | + * You may obtain a copy of the License at |
| 8 | + * |
| 9 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | + * |
| 11 | + * Unless required by applicable law or agreed to in writing, |
| 12 | + * software distributed under the License is distributed on an |
| 13 | + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | + * KIND, either express or implied. See the License for the |
| 15 | + * specific language governing permissions and limitations |
| 16 | + * under the License. |
| 17 | + */ |
| 18 | + |
| 19 | +import {navigate as browserNavigate} from '@asgardeo/browser'; |
| 20 | +import {FC, useEffect, useRef} from 'react'; |
| 21 | + |
| 22 | +/** |
| 23 | + * Props for Callback component |
| 24 | + */ |
| 25 | +export interface CallbackProps { |
| 26 | + /** |
| 27 | + * Callback function called when an error occurs |
| 28 | + */ |
| 29 | + onError?: (error: Error) => void; |
| 30 | + |
| 31 | + /** |
| 32 | + * Function to navigate to a different path. |
| 33 | + * If not provided, falls back to the browser navigate utility (SPA navigation via History API for same-origin paths). |
| 34 | + * Provide this prop to enable framework-specific navigation (e.g., from React Router). |
| 35 | + */ |
| 36 | + onNavigate?: (path: string) => void; |
| 37 | +} |
| 38 | + |
| 39 | +/** |
| 40 | + * BaseCallback is a headless component that handles OAuth callback parameter forwarding. |
| 41 | + * This component extracts OAuth parameters (code, state, error) from the URL and forwards them |
| 42 | + * to the original component that initiated the OAuth flow. |
| 43 | + * |
| 44 | + * Works standalone using the browser navigate utility (History API) for navigation by default. |
| 45 | + * Pass an onNavigate prop to enable framework-specific navigation (e.g., via React Router). |
| 46 | + * |
| 47 | + * Flow: Extract OAuth parameters from URL -> Parse state parameter -> Redirect to original path with parameters |
| 48 | + * |
| 49 | + * The original component (SignIn/AcceptInvite) is responsible for: |
| 50 | + * - Processing the OAuth code via the SDK |
| 51 | + * - Calling /flow/execute |
| 52 | + * - Handling the assertion and auth/callback POST |
| 53 | + * - Managing the authenticated session |
| 54 | + */ |
| 55 | +export const Callback: FC<CallbackProps> = ({onNavigate, onError}: CallbackProps) => { |
| 56 | + // Prevent double execution in React Strict Mode |
| 57 | + const processingRef: any = useRef(false); |
| 58 | + |
| 59 | + // Resolve navigation: use provided onNavigate (router-aware) or fall back to browser navigate utility |
| 60 | + const navigate = (path: string): void => { |
| 61 | + if (onNavigate) { |
| 62 | + onNavigate(path); |
| 63 | + } else { |
| 64 | + browserNavigate(path); |
| 65 | + } |
| 66 | + }; |
| 67 | + |
| 68 | + useEffect(() => { |
| 69 | + const processOAuthCallback = (): void => { |
| 70 | + // Guard against double execution |
| 71 | + if (processingRef.current) { |
| 72 | + return; |
| 73 | + } |
| 74 | + processingRef.current = true; |
| 75 | + |
| 76 | + // Declare variables outside try block for use in catch |
| 77 | + let returnPath: string = '/'; |
| 78 | + |
| 79 | + try { |
| 80 | + // 1. Extract OAuth parameters from URL |
| 81 | + const urlParams: URLSearchParams = new URLSearchParams(window.location.search); |
| 82 | + const code: string | null = urlParams.get('code'); |
| 83 | + const state: string | null = urlParams.get('state'); |
| 84 | + const nonce: string | null = urlParams.get('nonce'); |
| 85 | + const oauthError: string | null = urlParams.get('error'); |
| 86 | + const errorDescription: string | null = urlParams.get('error_description'); |
| 87 | + |
| 88 | + // 2. Validate and retrieve OAuth state from sessionStorage |
| 89 | + if (!state) { |
| 90 | + throw new Error('Missing OAuth state parameter - possible security issue'); |
| 91 | + } |
| 92 | + |
| 93 | + const storedData: string | null = sessionStorage.getItem(`asgardeo_oauth_${state}`); |
| 94 | + if (!storedData) { |
| 95 | + // If state not found, might be an error callback - try to handle gracefully |
| 96 | + if (oauthError) { |
| 97 | + const errorMsg: string = errorDescription || oauthError || 'OAuth authentication failed'; |
| 98 | + const err: Error = new Error(errorMsg); |
| 99 | + onError?.(err); |
| 100 | + |
| 101 | + const params: URLSearchParams = new URLSearchParams(); |
| 102 | + params.set('error', oauthError); |
| 103 | + if (errorDescription) { |
| 104 | + params.set('error_description', errorDescription); |
| 105 | + } |
| 106 | + |
| 107 | + navigate(`/?${params.toString()}`); |
| 108 | + return; |
| 109 | + } |
| 110 | + throw new Error('Invalid OAuth state - possible CSRF attack'); |
| 111 | + } |
| 112 | + |
| 113 | + const {path, timestamp} = JSON.parse(storedData); |
| 114 | + returnPath = path || '/'; |
| 115 | + |
| 116 | + // 3. Validate state freshness |
| 117 | + const MAX_STATE_AGE: number = 600000; // 10 minutes |
| 118 | + if (Date.now() - timestamp > MAX_STATE_AGE) { |
| 119 | + sessionStorage.removeItem(`asgardeo_oauth_${state}`); |
| 120 | + throw new Error('OAuth state expired - please try again'); |
| 121 | + } |
| 122 | + |
| 123 | + // 4. Clean up state |
| 124 | + sessionStorage.removeItem(`asgardeo_oauth_${state}`); |
| 125 | + |
| 126 | + // 5. Handle OAuth error response |
| 127 | + if (oauthError) { |
| 128 | + const errorMsg: string = errorDescription || oauthError || 'OAuth authentication failed'; |
| 129 | + const err: Error = new Error(errorMsg); |
| 130 | + onError?.(err); |
| 131 | + |
| 132 | + const params: URLSearchParams = new URLSearchParams(); |
| 133 | + params.set('error', oauthError); |
| 134 | + if (errorDescription) { |
| 135 | + params.set('error_description', errorDescription); |
| 136 | + } |
| 137 | + |
| 138 | + navigate(`${returnPath}?${params.toString()}`); |
| 139 | + return; |
| 140 | + } |
| 141 | + |
| 142 | + // 6. Validate required parameters |
| 143 | + if (!code) { |
| 144 | + throw new Error('Missing OAuth authorization code'); |
| 145 | + } |
| 146 | + |
| 147 | + // 7. Forward OAuth code to original component |
| 148 | + // The component (SignIn/AcceptInvite) will retrieve flowId/authId from sessionStorage |
| 149 | + const params: URLSearchParams = new URLSearchParams(); |
| 150 | + params.set('code', code); |
| 151 | + if (nonce) { |
| 152 | + params.set('nonce', nonce); |
| 153 | + } |
| 154 | + |
| 155 | + navigate(`${returnPath}?${params.toString()}`); |
| 156 | + } catch (err) { |
| 157 | + const errorMessage: string = err instanceof Error ? err.message : 'OAuth callback processing failed'; |
| 158 | + // eslint-disable-next-line no-console |
| 159 | + console.error('OAuth callback error:', err); |
| 160 | + |
| 161 | + onError?.(err instanceof Error ? err : new Error(errorMessage)); |
| 162 | + |
| 163 | + // Redirect back with OAuth error format |
| 164 | + const params: URLSearchParams = new URLSearchParams(); |
| 165 | + params.set('error', 'callback_error'); |
| 166 | + params.set('error_description', errorMessage); |
| 167 | + |
| 168 | + navigate(`${returnPath}?${params.toString()}`); |
| 169 | + } |
| 170 | + }; |
| 171 | + |
| 172 | + processOAuthCallback(); |
| 173 | + }, [onNavigate, onError]); |
| 174 | + |
| 175 | + // Headless component - no UI, just processing logic |
| 176 | + return null; |
| 177 | +}; |
| 178 | + |
| 179 | +export default Callback; |
0 commit comments