From bf4bc8b0bd2c87811290e434ecf61dbce4e8e6cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wojciech=20Nied=C5=BAwied=C5=BA?=
 <wojciech.niedzwiedz@napa.fi>
Date: Fri, 9 Sep 2022 16:29:14 +0200
Subject: [PATCH] Handle authenticate endpoint, access_token and audience

---
 README.md | 4 +++-
 index.js  | 7 ++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 0c6ecdc..646b9fd 100644
--- a/README.md
+++ b/README.md
@@ -42,9 +42,10 @@ Here is what an auth configuration file looks like:
   "AUTH0_CLIENT_ID": "xlkihjaskjhaskjjh",
   "AUTH0_CLIENT_SECRET": "sdlkjsdlkjsdlkjsdl/kjsd;lklksdjhlksjdh",
   "AUTH0_ALGORITHM": "RS256",
+  "AUTH0_AUDIENCE": "YOURAUDIENCE",
   "AUTH0_DOMAIN": "YOURDOMAIN.auth0.com",
   "AUTH0_HOST": "https://YOURDOMAIN.auth0.com",
-  "AUTH0_LOGIN_URL": "https://YOURDOMAIN.auth0.com/login",
+  "AUTH0_LOGIN_URL": "https://YOURDOMAIN.auth0.com/authenticate",
   "CALLBACK_PATH": "/logincb"
 }
 ```
@@ -55,6 +56,7 @@ Here is a description of each field:
 * `AUTH0_CLIENT_ID` - the client id of the Auth0 Applicaton you are using to protect your site.  Get from your Auth0 dashboard
 * `AUTH0_CLIENT_SECRET` - the client secret of the Auth0 Application.
 * `AUTH0_CLIENT_ALGORITHM` - either `"RS256"` or `"HS256"` depending on how your Auth0 application is configured
+* `AUTH0_AUDIENCE` - id of the api audience
 * `AUTH0_DOMAIN` - your Auth0 domain, aka `your-auth0-tenant.auth0.com`
 * `AUTH0_HOST` - the url to your auth0 tenant aka `https://your-auth0-tenant.auth0.com`
 * `AUTH0_LOGIN_URL` - the url to your app's login page
diff --git a/index.js b/index.js
index 45eeef9..6f3a929 100644
--- a/index.js
+++ b/index.js
@@ -25,7 +25,7 @@ function validateToken(config, token) {
   try {
     const decoded = jsonwebtoken.verify(token, config.certificate, {
       algorithms: [config.AUTH0_ALGORITHM],
-      audience: config.AUTH0_CLIENT_ID,
+      audience: config.AUTH0_AUDIENCE,
     });
 
     return true;
@@ -65,6 +65,7 @@ function loginCallback(config, request, callback) {
     client_id: config.AUTH0_CLIENT_ID,
     redirect_uri: `https://${headers.host[0].value}${config.CALLBACK_PATH}`,
     client_secret: config.AUTH0_CLIENT_SECRET,
+    audience: config.AUTH0_AUDIENCE,
     code: params.code,
     grant_type: "authorization_code"
   });
@@ -88,7 +89,7 @@ function loginCallback(config, request, callback) {
     res.on('end', () => {
       try {
         const json = JSON.parse(body);
-        const token = json.id_token;
+        const token = json.access_token;
 
         if (!token) {
           return callback(null, respond(401, "Unauthorized", "Unauthorized", body));
@@ -129,7 +130,7 @@ function redirectIfNotAuthenticated(config, request, callback) {
   const encodedRedirectUrl = encodeURIComponent(request.querystring ? `${request.uri}?${request.querystring}` : request.uri);
   const callbackUrl = `https://${headers.host[0].value}${config.CALLBACK_PATH}?dest=${encodedRedirectUrl}`;
   const encodedCallback = encodeURIComponent(callbackUrl);
-  const redirectUrl = `${config.AUTH0_LOGIN_URL}?client=${config.AUTH0_CLIENT_ID}&redirect_uri=${encodedCallback}`;
+  const redirectUrl = `${config.AUTH0_LOGIN_URL}?client_id=${config.AUTH0_CLIENT_ID}&redirect_uri=${encodedCallback}&audience=${config.AUTH0_AUDIENCE}&&response_type=code&state=${Date.now()}`;
 
   callback(null, redirect(redirectUrl, [{name: "session-token", value: ""}]));