change auth0 passport to the correct passport-auth0 package and allow passing the audience into the auth for api

Signed-off-by: Joe Patterson <jrwpatterson@gmail.com>

plugins/auth-backend/package.json

@@ -62,6 +62,7 @@
     "node-fetch": "^2.6.7",
     "openid-client": "^5.1.3",
     "passport": "^0.6.0",
+    "passport-auth0": "^1.4.3",
     "passport-bitbucket-oauth2": "^0.1.2",
     "passport-github2": "^0.1.12",
     "passport-gitlab2": "^5.0.0",
@@ -81,6 +82,7 @@
     "@types/cookie-parser": "^1.4.2",
     "@types/express-session": "^1.17.2",
     "@types/jwt-decode": "^3.1.0",
+    "@types/passport-auth0": "^1.0.5",
     "@types/passport-github2": "^1.2.4",
     "@types/passport-google-oauth20": "^2.0.3",
     "@types/passport-microsoft": "^0.0.0",

plugins/auth-backend/src/lib/passport/PassportStrategyHelper.ts

@@ -91,6 +91,7 @@ export const executeRedirectStrategy = async (
 export const executeFrameHandlerStrategy = async <Result, PrivateInfo = never>(
   req: express.Request,
   providerStrategy: passport.Strategy,
+  options?: Record<string, string>,
 ) => {
   return new Promise<{ result: Result; privateInfo: PrivateInfo }>(
     (resolve, reject) => {
@@ -124,7 +125,7 @@ export const executeFrameHandlerStrategy = async <Result, PrivateInfo = never>(
       strategy.redirect = () => {
         reject(new Error('Unexpected redirect'));
       };
-      strategy.authenticate(req, {});
+      strategy.authenticate(req, { ...(options ?? {}) });
     },
   );
 };

plugins/auth-backend/src/providers/auth0/provider.ts

@@ -43,9 +43,11 @@ import {
   AuthResolverContext,
 } from '../types';
 import { createAuthProviderIntegration } from '../createAuthProviderIntegration';
+import { ExtraVerificationParams } from 'passport-auth0';
 
 type PrivateInfo = {
   refreshToken: string;
+  extraParams: ExtraVerificationParams,
 };
 
 export type Auth0AuthProviderOptions = OAuthProviderOptions & {
@@ -53,6 +55,7 @@ export type Auth0AuthProviderOptions = OAuthProviderOptions & {
   signInResolver?: SignInResolver<OAuthResult>;
   authHandler: AuthHandler<OAuthResult>;
   resolverContext: AuthResolverContext;
+  audience?: string;
 };
 
 export class Auth0AuthProvider implements OAuthHandlers {
@@ -60,11 +63,13 @@ export class Auth0AuthProvider implements OAuthHandlers {
   private readonly signInResolver?: SignInResolver<OAuthResult>;
   private readonly authHandler: AuthHandler<OAuthResult>;
   private readonly resolverContext: AuthResolverContext;
+  private readonly audience?: string;
 
   constructor(options: Auth0AuthProviderOptions) {
     this.signInResolver = options.signInResolver;
     this.authHandler = options.authHandler;
     this.resolverContext = options.resolverContext;
+    this.audience = options.audience;
     this._strategy = new Auth0Strategy(
       {
         clientID: options.clientId,
@@ -79,6 +84,7 @@ export class Auth0AuthProvider implements OAuthHandlers {
         accessToken: any,
         refreshToken: any,
         params: any,
+        extraParams: ExtraVerificationParams,
         fullProfile: passport.Profile,
         done: PassportDoneCallback<OAuthResult, PrivateInfo>,
       ) => {
@@ -92,6 +98,7 @@ export class Auth0AuthProvider implements OAuthHandlers {
           },
           {
             refreshToken,
+            extraParams
           },
         );
       },
@@ -104,6 +111,7 @@ export class Auth0AuthProvider implements OAuthHandlers {
       prompt: 'consent',
       scope: req.scope,
       state: encodeState(req.state),
+      audience: this.audience as string
     });
   }
 
@@ -111,7 +119,9 @@ export class Auth0AuthProvider implements OAuthHandlers {
     const { result, privateInfo } = await executeFrameHandlerStrategy<
       OAuthResult,
       PrivateInfo
-    >(req, this._strategy);
+    >(req, this._strategy, {
+      audience: this.audience as string
+    });
 
     return {
       response: await this.handleResult(result),
@@ -198,6 +208,7 @@ export const auth0 = createAuthProviderIntegration({
         const clientSecret = envConfig.getString('clientSecret');
         const domain = envConfig.getString('domain');
         const customCallbackUrl = envConfig.getOptionalString('callbackUrl');
+        const audience = envConfig.getOptionalString('audience');
         const callbackUrl =
           customCallbackUrl ||
           `${globalConfig.baseUrl}/${providerId}/handler/frame`;
@@ -218,6 +229,7 @@ export const auth0 = createAuthProviderIntegration({
           authHandler,
           signInResolver,
           resolverContext,
+          audience,
         });
 
         return OAuthAdapter.fromConfig(globalConfig, provider, {

plugins/auth-backend/src/providers/auth0/strategy.ts

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import OAuth2Strategy from 'passport-oauth2';
+import Auth0InternalStrategy from 'passport-auth0';
 
 export interface Auth0StrategyOptionsWithRequest {
   clientID: string;
@@ -23,10 +23,10 @@ export interface Auth0StrategyOptionsWithRequest {
   passReqToCallback: true;
 }
 
-export default class Auth0Strategy extends OAuth2Strategy {
+export default class Auth0Strategy extends Auth0InternalStrategy {
   constructor(
     options: Auth0StrategyOptionsWithRequest,
-    verify: OAuth2Strategy.VerifyFunctionWithRequest,
+    verify: Auth0InternalStrategy.VerifyFunctionWithRequest,
   ) {
     const optionsWithURLs = {
       ...options,