From 6cecbec5925be0dee25bcfbc40c206fd7d2cb7b5 Mon Sep 17 00:00:00 2001
From: Erki Aas <eaas@k-space.ee>
Date: Tue, 26 Mar 2024 15:27:58 +0200
Subject: [PATCH] Revert "fix(oidc): temporarily disable pkce"

This reverts commit ed9559efe5104c2a8d40e2e943cb9e3cee7277f4.
---
 src/services/auth-oidc/auth-oidc.class.ts                   | 6 ++++++
 src/services/auth-oidc/callback/auth-oidc-callback.class.ts | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/src/services/auth-oidc/auth-oidc.class.ts b/src/services/auth-oidc/auth-oidc.class.ts
index 2f96233..29283be 100644
--- a/src/services/auth-oidc/auth-oidc.class.ts
+++ b/src/services/auth-oidc/auth-oidc.class.ts
@@ -33,12 +33,18 @@ export class AuthOidcService<ServiceParams extends AuthOidcParams = AuthOidcPara
             id_token_signed_response_alg: config.get('oidc.signedResponseAlg'),
             token_endpoint_auth_method: config.get('oidc.authMethod'),
         });
+        const codeVerifier = generators.codeVerifier();
+        const codeChallenge = generators.codeChallenge(codeVerifier);
+
         const url = client.authorizationUrl({
             redirect_uri: config.get('clientUrl') + '/auth-oidc/callback',
             scope: config.get('oidc.scopes'),
             response_type: config.get('oidc.responseTypes'),
+            code_challenge: codeChallenge,
+            code_challenge_method: config.get('oidc.codeChallengeMethod'),
         });
 
+        params.session.codeVerifier = codeVerifier;
         return url;
     }
 }
diff --git a/src/services/auth-oidc/callback/auth-oidc-callback.class.ts b/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
index e388762..c4c9234 100644
--- a/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
+++ b/src/services/auth-oidc/callback/auth-oidc-callback.class.ts
@@ -37,9 +37,11 @@ export class AuthOidcCallbackService<ServiceParams extends AuthOidcCallbackParam
             response_types: ['code'],
         });
 
+        const codeVerifier = params.session.codeVerifier;
         const tokenSet = await client.callback(
             config.get('clientUrl') + '/auth-oidc/callback',
             { code: params.query.code, iss: params.query.iss },
+            { code_verifier: codeVerifier }
         );
         const userinfo = await client.userinfo(tokenSet.access_token as string);