]>
Commit | Line | Data |
---|---|---|
7fed6375 | 1 | import * as express from 'express' |
141b177d | 2 | import { AccessDeniedError } from 'oauth2-server' |
da854ddd | 3 | import { logger } from '../helpers/logger' |
3fd3ab2d C |
4 | import { UserModel } from '../models/account/user' |
5 | import { OAuthClientModel } from '../models/oauth/oauth-client' | |
6 | import { OAuthTokenModel } from '../models/oauth/oauth-token' | |
557b13ae | 7 | import { LRU_CACHE } from '../initializers/constants' |
f201a749 | 8 | import { Transaction } from 'sequelize' |
6dd9de95 | 9 | import { CONFIG } from '../initializers/config' |
557b13ae | 10 | import * as LRUCache from 'lru-cache' |
453e83ea | 11 | import { MOAuthTokenUser } from '@server/typings/models/oauth/oauth-token' |
7fed6375 C |
12 | import { MUser } from '@server/typings/models/user/user' |
13 | import { UserAdminFlag } from '@shared/models/users/user-flag.model' | |
14 | import { createUserAccountAndChannelAndPlaylist } from './user' | |
15 | import { UserRole } from '@shared/models/users/user-role' | |
e1c55031 | 16 | import { PluginManager } from '@server/lib/plugins/plugin-manager' |
69b0a27c | 17 | |
69818c93 | 18 | type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date } |
557b13ae | 19 | |
453e83ea | 20 | const accessTokenCache = new LRUCache<string, MOAuthTokenUser>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) |
557b13ae | 21 | const userHavingToken = new LRUCache<number, string>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) |
69818c93 | 22 | |
69b0a27c C |
23 | // --------------------------------------------------------------------------- |
24 | ||
f201a749 C |
25 | function deleteUserToken (userId: number, t?: Transaction) { |
26 | clearCacheByUserId(userId) | |
27 | ||
28 | return OAuthTokenModel.deleteUserToken(userId, t) | |
29 | } | |
30 | ||
31 | function clearCacheByUserId (userId: number) { | |
557b13ae C |
32 | const token = userHavingToken.get(userId) |
33 | ||
f201a749 | 34 | if (token !== undefined) { |
557b13ae C |
35 | accessTokenCache.del(token) |
36 | userHavingToken.del(userId) | |
f201a749 C |
37 | } |
38 | } | |
39 | ||
40 | function clearCacheByToken (token: string) { | |
557b13ae C |
41 | const tokenModel = accessTokenCache.get(token) |
42 | ||
f201a749 | 43 | if (tokenModel !== undefined) { |
557b13ae C |
44 | userHavingToken.del(tokenModel.userId) |
45 | accessTokenCache.del(token) | |
f201a749 C |
46 | } |
47 | } | |
48 | ||
e307e4fc | 49 | async function getAccessToken (bearerToken: string) { |
69b0a27c C |
50 | logger.debug('Getting access token (bearerToken: ' + bearerToken + ').') |
51 | ||
e307e4fc | 52 | if (!bearerToken) return undefined |
3acc5084 | 53 | |
e307e4fc | 54 | let tokenModel: MOAuthTokenUser |
f201a749 | 55 | |
e307e4fc C |
56 | if (accessTokenCache.has(bearerToken)) { |
57 | tokenModel = accessTokenCache.get(bearerToken) | |
58 | } else { | |
59 | tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken) | |
7fed6375 | 60 | |
e307e4fc C |
61 | if (tokenModel) { |
62 | accessTokenCache.set(bearerToken, tokenModel) | |
63 | userHavingToken.set(tokenModel.userId, tokenModel.accessToken) | |
64 | } | |
65 | } | |
66 | ||
67 | if (!tokenModel) return undefined | |
68 | ||
69 | if (tokenModel.User.pluginAuth) { | |
70 | const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access') | |
71 | ||
72 | if (valid !== true) return undefined | |
73 | } | |
74 | ||
75 | return tokenModel | |
69b0a27c C |
76 | } |
77 | ||
69818c93 | 78 | function getClient (clientId: string, clientSecret: string) { |
69b0a27c C |
79 | logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').') |
80 | ||
3fd3ab2d | 81 | return OAuthClientModel.getByIdAndSecret(clientId, clientSecret) |
69b0a27c C |
82 | } |
83 | ||
e307e4fc | 84 | async function getRefreshToken (refreshToken: string) { |
69b0a27c C |
85 | logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').') |
86 | ||
e307e4fc C |
87 | const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken) |
88 | if (!tokenInfo) return undefined | |
89 | ||
90 | const tokenModel = tokenInfo.token | |
91 | ||
92 | if (tokenModel.User.pluginAuth) { | |
93 | const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh') | |
94 | ||
95 | if (valid !== true) return undefined | |
96 | } | |
97 | ||
98 | return tokenInfo | |
69b0a27c C |
99 | } |
100 | ||
4a8d113b | 101 | async function getUser (usernameOrEmail?: string, password?: string) { |
7fed6375 | 102 | const res: express.Response = this.request.res |
e307e4fc C |
103 | |
104 | // Special treatment coming from a plugin | |
7fed6375 C |
105 | if (res.locals.bypassLogin && res.locals.bypassLogin.bypass === true) { |
106 | const obj = res.locals.bypassLogin | |
107 | logger.info('Bypassing oauth login by plugin %s.', obj.pluginName) | |
108 | ||
e1c55031 | 109 | let user = await UserModel.loadByEmail(obj.user.email) |
7fed6375 C |
110 | if (!user) user = await createUserFromExternal(obj.pluginName, obj.user) |
111 | ||
e9b0fa5c C |
112 | // If the user does not belongs to a plugin, it was created before its installation |
113 | // Then we just go through a regular login process | |
114 | if (user.pluginAuth !== null) { | |
115 | // This user does not belong to this plugin, skip it | |
116 | if (user.pluginAuth !== obj.pluginName) return null | |
7fed6375 | 117 | |
e9b0fa5c C |
118 | return user |
119 | } | |
7fed6375 C |
120 | } |
121 | ||
ba12e8b3 | 122 | logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).') |
69b0a27c | 123 | |
ba12e8b3 | 124 | const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail) |
e1c55031 C |
125 | // If we don't find the user, or if the user belongs to a plugin |
126 | if (!user || user.pluginAuth !== null) return null | |
26d7d31b | 127 | |
f5028693 | 128 | const passwordMatch = await user.isPasswordMatch(password) |
e9b0fa5c | 129 | if (passwordMatch !== true) return null |
26d7d31b | 130 | |
e6921918 C |
131 | if (user.blocked) throw new AccessDeniedError('User is blocked.') |
132 | ||
d9eaee39 JM |
133 | if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) { |
134 | throw new AccessDeniedError('User email is not verified.') | |
135 | } | |
136 | ||
f5028693 | 137 | return user |
2f372a86 C |
138 | } |
139 | ||
e307e4fc | 140 | async function revokeToken (tokenInfo: { refreshToken: string }) { |
e1c55031 | 141 | const res: express.Response = this.request.res |
3fd3ab2d | 142 | const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken) |
e1c55031 | 143 | |
bfcef50d | 144 | if (token) { |
e1c55031 | 145 | if (res.locals.explicitLogout === true && token.User.pluginAuth && token.authName) { |
9107d791 | 146 | PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User) |
e1c55031 C |
147 | } |
148 | ||
f201a749 C |
149 | clearCacheByToken(token.accessToken) |
150 | ||
bfcef50d C |
151 | token.destroy() |
152 | .catch(err => logger.error('Cannot destroy token when revoking token.', { err })) | |
7fed6375 C |
153 | |
154 | return true | |
bfcef50d | 155 | } |
f5028693 | 156 | |
7fed6375 | 157 | return false |
69b0a27c C |
158 | } |
159 | ||
3fd3ab2d | 160 | async function saveToken (token: TokenInfo, client: OAuthClientModel, user: UserModel) { |
e1c55031 C |
161 | const res: express.Response = this.request.res |
162 | ||
e307e4fc C |
163 | let authName: string = null |
164 | if (res.locals.bypassLogin?.bypass === true) { | |
165 | authName = res.locals.bypassLogin.authName | |
166 | } else if (res.locals.refreshTokenAuthName) { | |
167 | authName = res.locals.refreshTokenAuthName | |
168 | } | |
e1c55031 | 169 | |
32bb4156 | 170 | logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.') |
69b0a27c | 171 | |
feb4bdfd | 172 | const tokenToCreate = { |
69b0a27c | 173 | accessToken: token.accessToken, |
2f372a86 | 174 | accessTokenExpiresAt: token.accessTokenExpiresAt, |
69b0a27c | 175 | refreshToken: token.refreshToken, |
2f372a86 | 176 | refreshTokenExpiresAt: token.refreshTokenExpiresAt, |
e1c55031 | 177 | authName, |
feb4bdfd C |
178 | oAuthClientId: client.id, |
179 | userId: user.id | |
180 | } | |
69b0a27c | 181 | |
3fd3ab2d | 182 | const tokenCreated = await OAuthTokenModel.create(tokenToCreate) |
3cc665f4 C |
183 | |
184 | user.lastLoginDate = new Date() | |
185 | await user.save() | |
186 | ||
e6921918 | 187 | return Object.assign(tokenCreated, { client, user }) |
69b0a27c C |
188 | } |
189 | ||
190 | // --------------------------------------------------------------------------- | |
191 | ||
65fcc311 C |
192 | // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications |
193 | export { | |
f201a749 C |
194 | deleteUserToken, |
195 | clearCacheByUserId, | |
196 | clearCacheByToken, | |
65fcc311 C |
197 | getAccessToken, |
198 | getClient, | |
199 | getRefreshToken, | |
200 | getUser, | |
201 | revokeToken, | |
202 | saveToken | |
203 | } | |
7fed6375 C |
204 | |
205 | async function createUserFromExternal (pluginAuth: string, options: { | |
206 | username: string | |
207 | email: string | |
208 | role: UserRole | |
209 | displayName: string | |
210 | }) { | |
211 | const userToCreate = new UserModel({ | |
212 | username: options.username, | |
213 | password: null, | |
214 | email: options.email, | |
215 | nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY, | |
216 | autoPlayVideo: true, | |
217 | role: options.role, | |
218 | videoQuota: CONFIG.USER.VIDEO_QUOTA, | |
219 | videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY, | |
220 | adminFlags: UserAdminFlag.NONE, | |
221 | pluginAuth | |
222 | }) as MUser | |
223 | ||
224 | const { user } = await createUserAccountAndChannelAndPlaylist({ | |
225 | userToCreate, | |
226 | userDisplayName: options.displayName | |
227 | }) | |
228 | ||
229 | return user | |
230 | } |