From 89baafba2fb69f8252d49958f1a9c455a5251047 Mon Sep 17 00:00:00 2001
From: Gregoire Parant <g.parant@thecodingmachine.com>
Date: Tue, 9 Nov 2021 00:08:01 +0100
Subject: [PATCH] Rollback openid connect to use code and nonce

Signed-off-by: Gregoire Parant <g.parant@thecodingmachine.com>
---
 front/src/Connexion/LocalUserStore.ts |  4 ++++
 pusher/src/Services/OpenIDClient.ts   | 22 +++++++++++++---------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/front/src/Connexion/LocalUserStore.ts b/front/src/Connexion/LocalUserStore.ts
index 6c20aadb..a113291d 100644
--- a/front/src/Connexion/LocalUserStore.ts
+++ b/front/src/Connexion/LocalUserStore.ts
@@ -165,6 +165,10 @@ class LocalUserStore {
 
     verifyState(value: string): boolean {
         const oldValue = localStorage.getItem(state);
+        if (!oldValue) {
+            localStorage.setItem(state, value);
+            return true;
+        }
         return oldValue === value;
     }
     getState(): string | null {
diff --git a/pusher/src/Services/OpenIDClient.ts b/pusher/src/Services/OpenIDClient.ts
index 1a475224..bc0dd6c9 100644
--- a/pusher/src/Services/OpenIDClient.ts
+++ b/pusher/src/Services/OpenIDClient.ts
@@ -23,26 +23,30 @@ class OpenIDClient {
         return this.issuerPromise;
     }
 
-    public authorizationUrl(playUri?: string, redirect?: string) {
+    public authorizationUrl(state: string, nonce: string, playUri?: string, redirect?: string) {
         return this.initClient().then((client) => {
             return client.authorizationUrl({
                 scope: "openid email",
                 prompt: "login",
+                state: state,
+                nonce: nonce,
                 playUri: playUri,
                 redirect: redirect,
             });
         });
     }
 
-    public getUserInfo(accessToken: string): Promise<{ email: string; sub: string; access_token: string }> {
+    public getUserInfo(code: string, nonce: string): Promise<{ email: string; sub: string; access_token: string }> {
         return this.initClient().then((client) => {
-            return client.userinfo(accessToken).then((res) => {
-                return {
-                    ...res,
-                    email: res.email as string,
-                    sub: res.sub,
-                    access_token: accessToken as string,
-                };
+            return client.callback(OPID_CLIENT_REDIREC_URL, { code }, { nonce }).then((tokenSet) => {
+                return client.userinfo(tokenSet).then((res) => {
+                    return {
+                        ...res,
+                        email: res.email as string,
+                        sub: res.sub,
+                        access_token: tokenSet.access_token as string,
+                    };
+                });
             });
         });
     }