Refactor files structure and do some little fixes

app.js

@@ -4,16 +4,32 @@
  */
 import express from 'express';
 import logger from 'morgan';
+import session from 'express-session';
 
-import userInfosHelper from './helpers/userInfo';
-import idHintHelper from './helpers/idHintToken';
-import logoutHelper from './helpers/logout';
-import authorizationHelper from './helpers/authorization';
+import utilsHelper from './helpers/utils';
 import getAccessTokenHelper from './helpers/accessToken';
 
 const app = express();
 const port = process.env.PORT || '3000';
 
+/**
+ * session config
+ * @type {{secret: string, cookie: {}, saveUninitialized: boolean}}
+ */
+const sess = {
+  secret: 'demo secret', // put your own secret
+  cookie: {},
+  saveUninitialized: true,
+};
+
+/**
+ * session config for production
+ */
+if (app.get('env') === 'production') {
+  app.set('trust proxy', 1); // trust first proxy
+  sess.cookie.secure = true; // serve secure cookies
+}
+
 if (process.env.NODE_ENV !== 'test') {
   app.use(logger('dev'));
 }
@@ -22,7 +38,7 @@ app.set('view engine', 'ejs');
 app.set('port', port);
 
 app.use(express.static('public'));
-
+app.use(session(sess));
 
 /**
  * Routes
@@ -31,34 +47,40 @@ app.get('/', (req, res) => {
   res.render('pages/index');
 });
 
+/**
+ * Init authorization and login process
+ */
 app.get('/login', (req, res) => {
-  res.redirect(authorizationHelper.getAuth());
+  res.redirect(utilsHelper.getAuthorizationUrl());
 });
 
+/**
+ * Getting the access token required to get the user data
+ */
 app.get('/callback', (req, res) => {
   // check if the mandatory Authorization code is there.
   if (!req.query.code) {
     res.sendStatus(400);
   }
-  getAccessTokenHelper.getAccessToken(res, req.query.code);
+  getAccessTokenHelper.getAccessToken(res, req);
 });
 
 app.get('/profile', (req, res) => {
-  /**
-   * Getting the user informations by calling helpers/userInfo.
-   * @type {{}}
-   */
-  const user = userInfosHelper.sendUserInfo();
+  const user = req.session.userInfo;
   res.render('pages/profile', { user });
 });
 
+/**
+ * Init logout process
+ */
 app.get('/logout', (req, res) => {
-  res.redirect(logoutHelper.logout());
+  res.redirect(utilsHelper.getLogoutUrl(req));
 });
 
 app.get('/end', (req, res) => {
   // resetting the id token hint.
-  idHintHelper.resetHintToken();
+  req.session.id_token = null;
+  req.session.userInfo = null;
   res.render('pages/end');
 });
 

helpers/accessToken.js

@@ -5,30 +5,28 @@
 import axios from 'axios';
 import querystring from 'querystring';
 import getUserHelper from './user';
-import idHintToken from './idHintToken';
 import config from '../config/config.json';
 
 const sendTokenToFD = false;
+const tokenUrl = config.TOKEN_URL;
+const redirectUrl = config.REDIRECT_URL;
+const clientId = config.CLIENT_SECRET;
+const secretKey = config.SECRET_KEY;
 
 /**
  * Init FranceConnect authentication login process.
  * Make every http call to the different API endpoints.
  * @see @link{ https://partenaires.franceconnect.gouv.fr/fcp/fournisseur-service# }
  */
-exports.getAccessToken = async (res, queryCode) => {
-  const tokenUrl = config.TOKEN_URL;
-  const redirectUrl = config.REDIRECT_URL;
-  const clientId = config.CLIENT_SECRET;
-  const secretKey = config.SECRET_KEY;
-
+exports.getAccessToken = async (res, req) => {
   // Set request params.
   const url = tokenUrl;
   const body = {
     grant_type: 'authorization_code',
     redirect_uri: redirectUrl,
     client_id: clientId,
     client_secret: secretKey,
-    code: queryCode,
+    code: req.query.code,
   };
   const headerConfig = {
     headers: {
@@ -42,9 +40,11 @@ exports.getAccessToken = async (res, queryCode) => {
   await axios.post(url, querystring.stringify(body), headerConfig)
     .then(response => response.data)
     .then((tokenData) => {
-      idHintToken.setHintToken(tokenData.id_token);
+      req.accessToken = tokenData.access_token;
+      req.session.id_token = tokenData.id_token;
       /**
        * Use to send the access token to an data provider.
+       * @return an object of data from the provider.
        * @see @link{ https://partenaires.franceconnect.gouv.fr/fcp/fournisseur-service# }
        * @see @link{ https://partenaires.franceconnect.gouv.fr/fcp/fournisseur-donnees }
        * @see @link{ https://github.com/france-connect/data-providers-examples }
@@ -64,7 +64,7 @@ exports.getAccessToken = async (res, queryCode) => {
       /**
        * Make a call to the France Connect API endpoint to get user data.
        */
-      getUserHelper.getUser(tokenData.access_token, res);
+      getUserHelper.getUser(req, res);
     })
     .catch(err => res.send(err.message));
 };

helpers/user.js

@@ -4,21 +4,21 @@
  */
 
 import axios from 'axios';
-import userInfosHelper from './userInfo';
 import config from '../config/config.json';
 
-exports.getUser = async (token, res) => {
-  if (!token) res.sendStatus(401);
+exports.getUser = async (req, res) => {
+  if (!req.accessToken) res.status(401).send('Access token is required');
   // Set request header
   const headerConfig = {
     headers: {
-      Authorization: `Bearer ${token}`,
+      Authorization: `Bearer ${req.accessToken}`,
     },
   };
   await axios.get(config.USERINFO_URL, headerConfig)
     .then((response) => {
       // Helper to set userInfo value available to the profile page.
-      userInfosHelper.getUserInfo(response.data);
+      req.session.userInfo = response.data;
+
       res.redirect('profile');
     })
     .catch(err => res.send(err.message));

helpers/utils.js

@@ -0,0 +1,18 @@
+/**
+ * Format the url use in the redirection call
+ * to the France Connect Authorization and logout API endpoint.
+ * @see @link{ https://partenaires.franceconnect.gouv.fr/fcp/fournisseur-service# }
+ */
+import config from '../config/config.json';
+
+exports.getAuthorizationUrl = () => `${config.AUTHORIZATION_URL}?response_type=code`
+    + `&client_id=${config.CLIENT_SECRET}&redirect_uri=${config.REDIRECT_URL}`
+    + `&scope=${config.SCOPE}&state=${config.STATE}&nonce=${config.NONCE}`;
+
+
+/**
+ * Format the url 's that is used in a redirect call to France Connect logout API endpoint
+ * @returns {string}
+ */
+exports.getLogoutUrl = req => `${config.LOGOUT_URL}?id_token_hint=${req.session.id_token}`
+  + `&state=${config.STATE}&post_logout_redirect_uri=${config.LOGOUT_REDIRECT_URL}`;