]>
Commit | Line | Data |
---|---|---|
41fb13c3 | 1 | import express from 'express' |
141b177d | 2 | import { AccessDeniedError } from 'oauth2-server' |
a77c7327 | 3 | import { PluginManager } from '@server/lib/plugins/plugin-manager' |
7d9ba5c0 | 4 | import { ActorModel } from '@server/models/actor/actor' |
f43db2f4 | 5 | import { MOAuthClient } from '@server/types/models' |
26d6bf65 C |
6 | import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token' |
7 | import { MUser } from '@server/types/models/user/user' | |
d3d3deaa | 8 | import { pick } from '@shared/core-utils' |
7fed6375 | 9 | import { UserRole } from '@shared/models/users/user-role' |
f43db2f4 C |
10 | import { logger } from '../../helpers/logger' |
11 | import { CONFIG } from '../../initializers/config' | |
f43db2f4 C |
12 | import { OAuthClientModel } from '../../models/oauth/oauth-client' |
13 | import { OAuthTokenModel } from '../../models/oauth/oauth-token' | |
9d8ef212 | 14 | import { UserModel } from '../../models/user/user' |
d3d3deaa | 15 | import { buildUser, createUserAccountAndChannelAndPlaylist } from '../user' |
f43db2f4 C |
16 | import { TokensCache } from './tokens-cache' |
17 | ||
18 | type TokenInfo = { | |
19 | accessToken: string | |
20 | refreshToken: string | |
21 | accessTokenExpiresAt: Date | |
22 | refreshTokenExpiresAt: Date | |
f201a749 C |
23 | } |
24 | ||
f43db2f4 C |
25 | export type BypassLogin = { |
26 | bypass: boolean | |
27 | pluginName: string | |
28 | authName?: string | |
29 | user: { | |
30 | username: string | |
31 | email: string | |
32 | displayName: string | |
33 | role: UserRole | |
f201a749 C |
34 | } |
35 | } | |
36 | ||
e307e4fc | 37 | async function getAccessToken (bearerToken: string) { |
69b0a27c C |
38 | logger.debug('Getting access token (bearerToken: ' + bearerToken + ').') |
39 | ||
e307e4fc | 40 | if (!bearerToken) return undefined |
3acc5084 | 41 | |
e307e4fc | 42 | let tokenModel: MOAuthTokenUser |
f201a749 | 43 | |
f43db2f4 C |
44 | if (TokensCache.Instance.hasToken(bearerToken)) { |
45 | tokenModel = TokensCache.Instance.getByToken(bearerToken) | |
e307e4fc C |
46 | } else { |
47 | tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken) | |
7fed6375 | 48 | |
f43db2f4 | 49 | if (tokenModel) TokensCache.Instance.setToken(tokenModel) |
e307e4fc C |
50 | } |
51 | ||
52 | if (!tokenModel) return undefined | |
53 | ||
54 | if (tokenModel.User.pluginAuth) { | |
55 | const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access') | |
56 | ||
57 | if (valid !== true) return undefined | |
58 | } | |
59 | ||
60 | return tokenModel | |
69b0a27c C |
61 | } |
62 | ||
69818c93 | 63 | function getClient (clientId: string, clientSecret: string) { |
69b0a27c C |
64 | logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').') |
65 | ||
3fd3ab2d | 66 | return OAuthClientModel.getByIdAndSecret(clientId, clientSecret) |
69b0a27c C |
67 | } |
68 | ||
e307e4fc | 69 | async function getRefreshToken (refreshToken: string) { |
69b0a27c C |
70 | logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').') |
71 | ||
e307e4fc C |
72 | const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken) |
73 | if (!tokenInfo) return undefined | |
74 | ||
75 | const tokenModel = tokenInfo.token | |
76 | ||
77 | if (tokenModel.User.pluginAuth) { | |
78 | const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh') | |
79 | ||
80 | if (valid !== true) return undefined | |
81 | } | |
82 | ||
83 | return tokenInfo | |
69b0a27c C |
84 | } |
85 | ||
f43db2f4 | 86 | async function getUser (usernameOrEmail?: string, password?: string, bypassLogin?: BypassLogin) { |
e307e4fc | 87 | // Special treatment coming from a plugin |
f43db2f4 C |
88 | if (bypassLogin && bypassLogin.bypass === true) { |
89 | logger.info('Bypassing oauth login by plugin %s.', bypassLogin.pluginName) | |
7fed6375 | 90 | |
f43db2f4 C |
91 | let user = await UserModel.loadByEmail(bypassLogin.user.email) |
92 | if (!user) user = await createUserFromExternal(bypassLogin.pluginName, bypassLogin.user) | |
7fed6375 | 93 | |
9a7fd960 C |
94 | // Cannot create a user |
95 | if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.') | |
96 | ||
e9b0fa5c C |
97 | // If the user does not belongs to a plugin, it was created before its installation |
98 | // Then we just go through a regular login process | |
99 | if (user.pluginAuth !== null) { | |
100 | // This user does not belong to this plugin, skip it | |
400ed2ab C |
101 | if (user.pluginAuth !== bypassLogin.pluginName) { |
102 | logger.info( | |
103 | 'Cannot bypass oauth login by plugin %s because %s has another plugin auth method (%s).', | |
104 | bypassLogin.pluginName, bypassLogin.user.email, user.pluginAuth | |
105 | ) | |
106 | ||
107 | return null | |
108 | } | |
7fed6375 | 109 | |
33c7131b C |
110 | checkUserValidityOrThrow(user) |
111 | ||
e9b0fa5c C |
112 | return user |
113 | } | |
7fed6375 C |
114 | } |
115 | ||
ba12e8b3 | 116 | logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).') |
69b0a27c | 117 | |
ba12e8b3 | 118 | const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail) |
9d8ef212 | 119 | |
e1c55031 | 120 | // If we don't find the user, or if the user belongs to a plugin |
d253bfaa | 121 | if (!user || user.pluginAuth !== null || !password) return null |
26d7d31b | 122 | |
f5028693 | 123 | const passwordMatch = await user.isPasswordMatch(password) |
e9b0fa5c | 124 | if (passwordMatch !== true) return null |
26d7d31b | 125 | |
33c7131b | 126 | checkUserValidityOrThrow(user) |
e6921918 | 127 | |
d9eaee39 JM |
128 | if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) { |
129 | throw new AccessDeniedError('User email is not verified.') | |
130 | } | |
131 | ||
f5028693 | 132 | return user |
2f372a86 C |
133 | } |
134 | ||
f43db2f4 C |
135 | async function revokeToken ( |
136 | tokenInfo: { refreshToken: string }, | |
97aeb3cc C |
137 | options: { |
138 | req?: express.Request | |
139 | explicitLogout?: boolean | |
140 | } = {} | |
f43db2f4 | 141 | ): Promise<{ success: boolean, redirectUrl?: string }> { |
97aeb3cc C |
142 | const { req, explicitLogout } = options |
143 | ||
3fd3ab2d | 144 | const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken) |
e1c55031 | 145 | |
bfcef50d | 146 | if (token) { |
74fd2643 C |
147 | let redirectUrl: string |
148 | ||
f43db2f4 | 149 | if (explicitLogout === true && token.User.pluginAuth && token.authName) { |
97aeb3cc | 150 | redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, req) |
e1c55031 C |
151 | } |
152 | ||
f43db2f4 | 153 | TokensCache.Instance.clearCacheByToken(token.accessToken) |
f201a749 | 154 | |
bfcef50d C |
155 | token.destroy() |
156 | .catch(err => logger.error('Cannot destroy token when revoking token.', { err })) | |
7fed6375 | 157 | |
74fd2643 | 158 | return { success: true, redirectUrl } |
bfcef50d | 159 | } |
f5028693 | 160 | |
74fd2643 | 161 | return { success: false } |
69b0a27c C |
162 | } |
163 | ||
f43db2f4 C |
164 | async function saveToken ( |
165 | token: TokenInfo, | |
166 | client: MOAuthClient, | |
167 | user: MUser, | |
168 | options: { | |
169 | refreshTokenAuthName?: string | |
170 | bypassLogin?: BypassLogin | |
171 | } = {} | |
172 | ) { | |
173 | const { refreshTokenAuthName, bypassLogin } = options | |
e307e4fc | 174 | let authName: string = null |
f43db2f4 C |
175 | |
176 | if (bypassLogin?.bypass === true) { | |
177 | authName = bypassLogin.authName | |
178 | } else if (refreshTokenAuthName) { | |
179 | authName = refreshTokenAuthName | |
e307e4fc | 180 | } |
e1c55031 | 181 | |
32bb4156 | 182 | logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.') |
69b0a27c | 183 | |
feb4bdfd | 184 | const tokenToCreate = { |
69b0a27c | 185 | accessToken: token.accessToken, |
2f372a86 | 186 | accessTokenExpiresAt: token.accessTokenExpiresAt, |
69b0a27c | 187 | refreshToken: token.refreshToken, |
2f372a86 | 188 | refreshTokenExpiresAt: token.refreshTokenExpiresAt, |
e1c55031 | 189 | authName, |
feb4bdfd C |
190 | oAuthClientId: client.id, |
191 | userId: user.id | |
192 | } | |
69b0a27c | 193 | |
3fd3ab2d | 194 | const tokenCreated = await OAuthTokenModel.create(tokenToCreate) |
3cc665f4 C |
195 | |
196 | user.lastLoginDate = new Date() | |
197 | await user.save() | |
198 | ||
e7812bf0 C |
199 | return { |
200 | accessToken: tokenCreated.accessToken, | |
201 | accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt, | |
202 | refreshToken: tokenCreated.refreshToken, | |
203 | refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt, | |
204 | client, | |
205 | user, | |
f43db2f4 C |
206 | accessTokenExpiresIn: buildExpiresIn(tokenCreated.accessTokenExpiresAt), |
207 | refreshTokenExpiresIn: buildExpiresIn(tokenCreated.refreshTokenExpiresAt) | |
e7812bf0 | 208 | } |
69b0a27c C |
209 | } |
210 | ||
65fcc311 C |
211 | export { |
212 | getAccessToken, | |
213 | getClient, | |
214 | getRefreshToken, | |
215 | getUser, | |
216 | revokeToken, | |
217 | saveToken | |
218 | } | |
7fed6375 | 219 | |
f43db2f4 C |
220 | // --------------------------------------------------------------------------- |
221 | ||
7fed6375 C |
222 | async function createUserFromExternal (pluginAuth: string, options: { |
223 | username: string | |
224 | email: string | |
225 | role: UserRole | |
226 | displayName: string | |
227 | }) { | |
9a7fd960 C |
228 | // Check an actor does not already exists with that name (removed user) |
229 | const actor = await ActorModel.loadLocalByName(options.username) | |
230 | if (actor) return null | |
231 | ||
d3d3deaa C |
232 | const userToCreate = buildUser({ |
233 | ...pick(options, [ 'username', 'email', 'role' ]), | |
234 | ||
235 | emailVerified: null, | |
7fed6375 | 236 | password: null, |
7fed6375 | 237 | pluginAuth |
d3d3deaa | 238 | }) |
7fed6375 C |
239 | |
240 | const { user } = await createUserAccountAndChannelAndPlaylist({ | |
241 | userToCreate, | |
242 | userDisplayName: options.displayName | |
243 | }) | |
244 | ||
245 | return user | |
246 | } | |
33c7131b C |
247 | |
248 | function checkUserValidityOrThrow (user: MUser) { | |
249 | if (user.blocked) throw new AccessDeniedError('User is blocked.') | |
250 | } | |
f43db2f4 C |
251 | |
252 | function buildExpiresIn (expiresAt: Date) { | |
253 | return Math.floor((expiresAt.getTime() - new Date().getTime()) / 1000) | |
254 | } |