Merge pull request #2 from docusign/main

add client credential support

Author: karissarjacobsen

src/models/auth.ts

@@ -11,4 +11,12 @@ export type GenerateAuthTokenBody =
       code?: string;
       grant_type: 'authorization_code';
     }
-  | { refresh_token?: string; grant_type: 'refresh_token' };
+  | {
+      refresh_token?: string; 
+      grant_type: 'refresh_token';
+    }
+  | {
+      client_id?: string;
+      client_secret?: string;
+      grant_type: 'client_credentials';
+  };

src/services/auth.service.ts

@@ -20,6 +20,7 @@ export const generateAuthToken = (req: IReq<GenerateAuthTokenBody>, res: IRes) =
   const accessToken = jwt.sign({ type: 'access_token', sub: crypto.randomUUID(), email: `${crypto.randomUUID()}@test.com` }, env.JWT_SECRET_KEY, {
     expiresIn: 3600,
   });
+  
   const refreshToken = jwt.sign({ type: 'refresh_token' }, env.JWT_SECRET_KEY);
 
   const jwtResponse = {
@@ -29,16 +30,38 @@ export const generateAuthToken = (req: IReq<GenerateAuthTokenBody>, res: IRes) =
     refresh_token: refreshToken,
   };
 
-  const decodedAuthCode = decodeURIComponent(env.AUTHORIZATION_CODE.replace(/\+/g, '%20'));
-
-  if (req.body.grant_type === 'authorization_code' && (req.body.code === decodedAuthCode || req.body.code === env.AUTHORIZATION_CODE)) {
+  if (
+    req.body.grant_type === 'authorization_code' &&
+    typeof req.body.code === 'string' &&
+    decodeURIComponent(req.body.code.replace(/\+/g, '%20')) === env.AUTHORIZATION_CODE
+  ) {
     return res.json(jwtResponse);
   } else if (req.body.grant_type === 'refresh_token' && req.body.refresh_token) {
     const payload = jwt.verify(req.body.refresh_token, env.JWT_SECRET_KEY) as JwtPayload;
     if (payload.type !== 'refresh_token') {
       throw new Error();
     }
     return res.json(jwtResponse);
+  } else if(req.body.grant_type === 'client_credentials') {
+
+    const authHeader = req.headers.authorization;
+
+    if(!authHeader?.startsWith('Basic ')){
+      throw new Error();
+    }
+
+    const base64Credentials = authHeader.split(' ')[1];
+    const decoded = Buffer.from(base64Credentials, 'base64').toString('utf-8');
+    const [clientId, clientSecret] = decoded.split(':');
+
+    const decodedClientId = decodeURIComponent(clientId.replace(/\+/g, '%20'));
+    const decodedClientSecret = decodeURIComponent(clientSecret.replace(/\+/g, '%20'));
+
+    if(decodedClientId === env.OAUTH_CLIENT_ID && decodedClientSecret === env.OAUTH_CLIENT_SECRET){
+      return res.json(jwtResponse);
+    } else {
+      throw new Error();
+    }
   }
 
   throw new Error();

src/validationSchemas/auth.ts

@@ -8,5 +8,5 @@ export const authorizeQuery: Schema = {
 };
 
 export const generateAuthTokenBody: Schema = {
-  grant_type: { isIn: { options: [['authorization_code', 'refresh_token']] } },
+  grant_type: { isIn: { options: [['authorization_code', 'refresh_token', 'client_credentials']] } },
 };