]>
Commit | Line | Data |
---|---|---|
1 | 'use strict'; | |
2 | ||
3 | var passport = require('passport'), | |
4 | path = require('path'), | |
5 | safe = require('safetydance'), | |
6 | fs = require('fs'), | |
7 | bcrypt = require('bcryptjs'), | |
8 | uuid = require('uuid/v4'), | |
9 | BearerStrategy = require('passport-http-bearer').Strategy, | |
10 | LdapStrategy = require('passport-ldapjs').Strategy, | |
11 | HttpError = require('connect-lastmile').HttpError, | |
12 | HttpSuccess = require('connect-lastmile').HttpSuccess, | |
13 | webdavErrors = require('webdav-server').v2.Errors; | |
14 | ||
15 | const LOCAL_AUTH_FILE = path.resolve(process.env.LOCAL_AUTH_FILE || './.users.json'); | |
16 | const TOKENSTORE_FILE = path.resolve(process.env.TOKENSTORE_FILE || './.tokens.json'); | |
17 | ||
18 | var tokenStore = { | |
19 | data: {}, | |
20 | save: function () { | |
21 | try { | |
22 | fs.writeFileSync(TOKENSTORE_FILE, JSON.stringify(tokenStore.data), 'utf-8'); | |
23 | } catch (e) { | |
24 | console.error(`Unable to save tokenstore file at ${TOKENSTORE_FILE}`, e); | |
25 | } | |
26 | }, | |
27 | get: function (token, callback) { | |
28 | callback(tokenStore.data[token] ? null : 'not found', tokenStore.data[token]); | |
29 | }, | |
30 | set: function (token, data, callback) { | |
31 | tokenStore.data[token] = data; | |
32 | tokenStore.save(); | |
33 | callback(null); | |
34 | }, | |
35 | del: function (token, callback) { | |
36 | delete tokenStore.data[token]; | |
37 | tokenStore.save(); | |
38 | callback(null); | |
39 | } | |
40 | }; | |
41 | ||
42 | // load token store data if any | |
43 | try { | |
44 | console.log(`Using tokenstore file: ${TOKENSTORE_FILE}`); | |
45 | tokenStore.data = JSON.parse(fs.readFileSync(TOKENSTORE_FILE, 'utf-8')); | |
46 | } catch (e) { | |
47 | // start with empty token store | |
48 | } | |
49 | ||
50 | function issueAccessToken() { | |
51 | return function (req, res, next) { | |
52 | var accessToken = uuid(); | |
53 | ||
54 | tokenStore.set(accessToken, req.user, function (error) { | |
55 | if (error) return next(new HttpError(500, error)); | |
56 | next(new HttpSuccess(201, { accessToken: accessToken, user: req.user })); | |
57 | }); | |
58 | }; | |
59 | } | |
60 | ||
61 | passport.serializeUser(function (user, done) { | |
62 | console.log('serializeUser', user); | |
63 | done(null, user.uid); | |
64 | }); | |
65 | ||
66 | passport.deserializeUser(function (id, done) { | |
67 | console.log('deserializeUser', id); | |
68 | done(null, { uid: id }); | |
69 | }); | |
70 | ||
71 | var LDAP_URL = process.env.LDAP_URL; | |
72 | var LDAP_USERS_BASE_DN = process.env.LDAP_USERS_BASE_DN; | |
73 | ||
74 | if (LDAP_URL && LDAP_USERS_BASE_DN) { | |
75 | console.log('Using ldap auth'); | |
76 | ||
77 | exports.login = [ passport.authenticate('ldap'), issueAccessToken() ]; | |
78 | } else { | |
79 | console.log(`Using local user file: ${LOCAL_AUTH_FILE}`); | |
80 | ||
81 | exports.login = [ | |
82 | function (req, res, next) { | |
83 | var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE)); | |
84 | if (!users) return res.send(401); | |
85 | if (!users[req.body.username]) return res.send(401); | |
86 | ||
87 | bcrypt.compare(req.body.password, users[req.body.username].passwordHash, function (error, valid) { | |
88 | if (error || !valid) return res.send(401); | |
89 | ||
90 | req.user = { | |
91 | username: req.body.username | |
92 | }; | |
93 | ||
94 | next(); | |
95 | }); | |
96 | }, | |
97 | issueAccessToken() | |
98 | ]; | |
99 | } | |
100 | ||
101 | var opts = { | |
102 | server: { | |
103 | url: LDAP_URL, | |
104 | }, | |
105 | base: LDAP_USERS_BASE_DN, | |
106 | search: { | |
107 | filter: '(|(username={{username}})(mail={{username}}))', | |
108 | attributes: ['displayname', 'username', 'mail', 'uid'], | |
109 | scope: 'sub' | |
110 | }, | |
111 | uidTag: 'cn', | |
112 | usernameField: 'username', | |
113 | passwordField: 'password', | |
114 | }; | |
115 | ||
116 | passport.use(new LdapStrategy(opts, function (profile, done) { | |
117 | done(null, profile); | |
118 | })); | |
119 | ||
120 | exports.verify = passport.authenticate('bearer', { session: false }); | |
121 | ||
122 | passport.use(new BearerStrategy(function (token, done) { | |
123 | tokenStore.get(token, function (error, result) { | |
124 | if (error) { | |
125 | console.error(error); | |
126 | return done(null, false); | |
127 | } | |
128 | ||
129 | done(null, result, { accessToken: token }); | |
130 | }); | |
131 | })); | |
132 | ||
133 | exports.logout = function (req, res, next) { | |
134 | tokenStore.del(req.authInfo.accessToken, function (error) { | |
135 | if (error) console.error(error); | |
136 | ||
137 | next(new HttpSuccess(200, {})); | |
138 | }); | |
139 | }; | |
140 | ||
141 | exports.getProfile = function (req, res, next) { | |
142 | next(new HttpSuccess(200, { username: req.user.username })); | |
143 | }; | |
144 | ||
145 | // webdav usermanager | |
146 | exports.WebdavUserManager = WebdavUserManager; | |
147 | ||
148 | // This implements the required interface only for the Basic Authentication for webdav-server | |
149 | function WebdavUserManager() {}; | |
150 | ||
151 | WebdavUserManager.prototype.getDefaultUser = function (callback) { | |
152 | // this is only a dummy user, since we always require authentication | |
153 | var user = { | |
154 | username: 'DefaultUser', | |
155 | password: null, | |
156 | isAdministrator: false, | |
157 | isDefaultUser: true, | |
158 | uid: 'DefaultUser' | |
159 | }; | |
160 | ||
161 | callback(user); | |
162 | }; | |
163 | ||
164 | WebdavUserManager.prototype.getUserByNamePassword = function (username, password, callback) { | |
165 | var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE)); | |
166 | if (!users) return callback(webdavErrors.UserNotFound); | |
167 | if (!users[username]) return callback(webdavErrors.UserNotFound); | |
168 | ||
169 | bcrypt.compare(password, users[username].passwordHash, function (error, valid) { | |
170 | if (error || !valid) return callback(webdavErrors.UserNotFound); | |
171 | ||
172 | callback(null, { | |
173 | username: username, | |
174 | isAdministrator: true, | |
175 | isDefaultUser: false, | |
176 | uid: username | |
177 | }); | |
178 | }); | |
179 | }; |