Stream-based Authorization Framework for Anvil Connect

This is a library implementing authorization/anthentication flows for Anvil Connect based on Rx.js.

Instantiating an Issuer

Issuer instances form the basis of the authorization flows. They need to be passed an object with the following interface to be able to operate:

OidcConfiguration {
  client_id: string;
  issuer: string;
  redirect_uri: string;
}

Optionally a client_secret key may be included as well, but this will typically not be necessary for applications running 'client-side'.

Authorization

Authorization flows can be instantiated in two different forms, either using full page navigation or using a pop-up. These methods take at least an array of 'scopes', and optionally an object adhering to the following interface:

export interface AuthorizationOptions {
  // Whether to close any popups used in the authorization process (defaults to
  // true). When disabled, requires additional logic in the authorization flow
  // callback handling to close the popup
  close_popup?: boolean;

  // Can be used to force a path on the cookie used to store the secret
  // encrypting the tokens stored in localStorage. This can be useful when
  // running the authorization flow from a sub-path of a domain while
  // authorizing for the entire domain
  force_path?: string;

  // The time in seconds for which the session may stay active
  max_age?: number;

  // By specifying a provider, the authorization process will only use that
  // specific provider instead of showing a selector providing access to all
  // identity providers available to the issuer
  provider?: string;

  // Whether to replace the active 'persisted' (i.e. across page reloads)
  // session
  replace_active_session?: boolean;

  // Setting to true implies replacing the active session
  retrieve_user_info?: boolean;
}

Authorization flow using full-page navigation

Call authorizeFullPage on an Issuer instance

Authorization flow in popup

Call authorizeWithPopup on the Issuer. The page located at redirect_uri must capture its full URI and 'post' it back to the window that initiated the authorization flow using code such as

window.addEventListener('load', function() {
  var opener = window.opener;
  if(opener) {
    opener.postMessage(window.location.href, opener.location.origin);
    window.close();
  }
});