Other OIDC providers

import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose";
import { NoResponse, fromOIDC } from "@noresponse/node";

const issuer = process.env.OIDC_ISSUER!;
const clientId = process.env.OIDC_CLIENT_ID!;
const nr = new NoResponse(); // reads NORESPONSE_API_KEY

// Reads the discovery document on first use; a failure is retried on the next call.
let jwks: ReturnType<typeof createRemoteJWKSet> | undefined;
async function signingKeys() {
  if (!jwks) {
    const res = await fetch(`${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(10_000) });
    if (!res.ok) throw new Error(`OIDC discovery answered HTTP ${res.status}`);
    const discovery = (await res.json()) as { jwks_uri: string };
    jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
  }
  return jwks;
}

const bool = (value: unknown) => (typeof value === "boolean" ? value : undefined);

// amr holding "mfa" means a second factor at auth_time, so its age is the time since then.
function mfaFrom(claims: JWTPayload) {
  const amr = Array.isArray(claims.amr) ? claims.amr : [];
  if (!amr.includes("mfa") || typeof claims.auth_time !== "number") return undefined;
  return { present: true, methods: ["mfa"], ageSeconds: Math.max(0, Math.floor(Date.now() / 1000) - claims.auth_time) };
}

export async function assessAccountCreation(idToken: string, accountCreatedAt: string | undefined, ip: string) {
  // 1. Verify the ID token.
  const { payload: claims } = await jwtVerify(idToken, await signingKeys(), { issuer, audience: clientId });

  // 2. The adapter maps the standard claims; the overrides carry the facts.
  const authContext = fromOIDC("okta", claims, {
    emailVerified: bool(claims.email_verified),
    phoneVerified: bool(claims.phone_number_verified),
    mfa: mfaFrom(claims),
    impersonated: claims.act ? true : undefined,
    accountCreatedAt,
  });

  // 3. NoResponse assesses the account creation.
  return nr.assessments.create({
    accountId: claims.sub!,
    identifiers: { email: typeof claims.email === "string" ? claims.email : undefined, ip },
    flow: "account_creation",
    authContext,
  });
}

import os
import time
from typing import Any

import jwt
import requests
from noresponse import Assessment, NoResponse, from_oidc

issuer = os.environ["OIDC_ISSUER"]
client_id = os.environ["OIDC_CLIENT_ID"]
nr = NoResponse()  # reads NORESPONSE_API_KEY
_jwks: jwt.PyJWKClient | None = None


def signing_keys() -> jwt.PyJWKClient:
    """Reads the discovery document on first use; a failure is retried on the next call."""
    global _jwks
    if _jwks is None:
        response = requests.get(f"{issuer.rstrip('/')}/.well-known/openid-configuration", timeout=10)
        response.raise_for_status()
        _jwks = jwt.PyJWKClient(response.json()["jwks_uri"], timeout=10)
    return _jwks


def mfa_from(claims: dict[str, Any]) -> dict[str, Any] | None:
    """amr holding "mfa" means a second factor at auth_time, so its age is the time since then."""
    amr = claims.get("amr")
    auth_time = claims.get("auth_time")
    if not isinstance(amr, list) or "mfa" not in amr or not isinstance(auth_time, int):
        return None
    return {"present": True, "methods": ["mfa"], "age_seconds": max(0, int(time.time()) - auth_time)}


def assess_account_creation(id_token: str, account_created_at: str | None, ip: str) -> Assessment:
    # 1. Verify the ID token.
    key = signing_keys().get_signing_key_from_jwt(id_token).key
    claims = jwt.decode(id_token, key, algorithms=["RS256", "ES256"], issuer=issuer, audience=client_id)

    # 2. The adapter maps the standard claims; the overrides carry the facts.
    email_verified = claims.get("email_verified")
    phone_verified = claims.get("phone_number_verified")
    auth_context = from_oidc("okta", claims, {
        "email_verified": email_verified if isinstance(email_verified, bool) else None,
        "phone_verified": phone_verified if isinstance(phone_verified, bool) else None,
        "mfa": mfa_from(claims),
        "impersonated": True if claims.get("act") else None,
        "account_created_at": account_created_at,
    })

    # 3. NoResponse assesses the account creation.
    email = claims.get("email")
    return nr.assessments.create(
        account_id=claims["sub"],
        identifiers={"email": email, "ip": ip} if isinstance(email, str) else {"ip": ip},
        flow="account_creation",
        auth_context=auth_context,
    )

package accounts

import (
	"context"
	"net/http"
	"os"
	"sync"
	"time"

	"github.com/coreos/go-oidc/v3/oidc"
	noresponse "github.com/noresponsehq/go/v5"
	"github.com/noresponsehq/go/v5/models/components"
)

var (
	nr             = noresponse.NewClient(os.Getenv("NORESPONSE_API_KEY"))
	verifierMu     sync.Mutex
	cachedVerifier *oidc.IDTokenVerifier
)

// idTokenVerifier reads the discovery document on first use; a failure is
// retried on the next call. NewProvider caches the signing keys and fetches
// them again with the HTTP client in its context, so that client's timeout
// bounds every key fetch too.
func idTokenVerifier(ctx context.Context) (*oidc.IDTokenVerifier, error) {
	verifierMu.Lock()
	defer verifierMu.Unlock()
	if cachedVerifier == nil {
		ctx := oidc.ClientContext(ctx, &http.Client{Timeout: 10 * time.Second})
		ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
		defer cancel()
		provider, err := oidc.NewProvider(ctx, os.Getenv("OIDC_ISSUER"))
		if err != nil {
			return nil, err
		}
		cachedVerifier = provider.Verifier(&oidc.Config{ClientID: os.Getenv("OIDC_CLIENT_ID")})
	}
	return cachedVerifier, nil
}

// mfaFrom reads a second factor from amr. "mfa" in amr means a second factor
// at auth_time, so its age is the time since then.
func mfaFrom(claims map[string]any) map[string]any {
	amr, _ := claims["amr"].([]any)
	authTime, ok := claims["auth_time"].(float64)
	if !ok {
		return nil
	}
	for _, method := range amr {
		if method == "mfa" {
			return map[string]any{"present": true, "methods": []string{"mfa"}, "age_seconds": max(0, time.Now().Unix()-int64(authTime))}
		}
	}
	return nil
}

// AssessAccountCreation takes accountCreatedAt from your provider's user API as an
// RFC 3339 string, or "" when you do not have it.
func AssessAccountCreation(ctx context.Context, idToken, accountCreatedAt, ip string) (*components.Assessment, error) {
	// 1. Verify the ID token.
	verifier, err := idTokenVerifier(ctx)
	if err != nil {
		return nil, err
	}
	tok, err := verifier.Verify(ctx, idToken)
	if err != nil {
		return nil, err
	}
	var claims map[string]any
	if err := tok.Claims(&claims); err != nil {
		return nil, err
	}

	// 2. The adapter maps the standard claims; the overrides carry the facts.
	overrides := map[string]any{}
	if v, ok := claims["email_verified"].(bool); ok {
		overrides["email_verified"] = v
	}
	if v, ok := claims["phone_number_verified"].(bool); ok {
		overrides["phone_verified"] = v
	}
	if mfa := mfaFrom(claims); mfa != nil {
		overrides["mfa"] = mfa
	}
	if claims["act"] != nil {
		overrides["impersonated"] = true
	}
	if accountCreatedAt != "" {
		overrides["account_created_at"] = accountCreatedAt
	}
	authContext, err := noresponse.FromOIDCClaims("okta", claims, overrides)
	if err != nil {
		return nil, err
	}

	// 3. NoResponse assesses the account creation. The second argument is the
	// Idempotency-Key, which the SDK reuses across its own retries.
	identifiers := components.AssessmentRequestIdentifiers{IP: noresponse.Pointer(ip)}
	if email, ok := claims["email"].(string); ok {
		identifiers.Email = noresponse.Pointer(email)
	}
	res, err := nr.Assessments.Create(ctx, noresponse.NewIdempotencyKey(), components.AssessmentRequest{
		AccountID:   tok.Subject,
		Identifiers: identifiers,
		Flow:        components.FlowAccountCreation,
		AuthContext: authContext,
	})
	if err != nil {
		return nil, err
	}
	return &res.Result, nil
}