server/lib/auth/oauth-model.ts

   1 import express from 'express'
   2 import { AccessDeniedError } from '@node-oauth/oauth2-server'
   3 import { PluginManager } from '@server/lib/plugins/plugin-manager'
   4 import { MOAuthClient } from '@server/types/models'
   5 import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token'
   6 import { MUser } from '@server/types/models/user/user'
   7 import { pick } from '@shared/core-utils'
   8 import { logger } from '../../helpers/logger'
   9 import { CONFIG } from '../../initializers/config'
  10 import { OAuthClientModel } from '../../models/oauth/oauth-client'
  11 import { OAuthTokenModel } from '../../models/oauth/oauth-token'
  12 import { UserModel } from '../../models/user/user'
  13 import { findAvailableLocalActorName } from '../local-actor'
  14 import { buildUser, createUserAccountAndChannelAndPlaylist } from '../user'
  15 import { ExternalUser } from './external-auth'
  16 import { TokensCache } from './tokens-cache'
  17
  18 type TokenInfo = {
  19   accessToken: string
  20   refreshToken: string
  21   accessTokenExpiresAt: Date
  22   refreshTokenExpiresAt: Date
  23 }
  24
  25 export type BypassLogin = {
  26   bypass: boolean
  27   pluginName: string
  28   authName?: string
  29   user: ExternalUser
  30 }
  31
  32 async function getAccessToken (bearerToken: string) {
  33   logger.debug('Getting access token (bearerToken: ' + bearerToken + ').')
  34
  35   if (!bearerToken) return undefined
  36
  37   let tokenModel: MOAuthTokenUser
  38
  39   if (TokensCache.Instance.hasToken(bearerToken)) {
  40     tokenModel = TokensCache.Instance.getByToken(bearerToken)
  41   } else {
  42     tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken)
  43
  44     if (tokenModel) TokensCache.Instance.setToken(tokenModel)
  45   }
  46
  47   if (!tokenModel) return undefined
  48
  49   if (tokenModel.User.pluginAuth) {
  50     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access')
  51
  52     if (valid !== true) return undefined
  53   }
  54
  55   return tokenModel
  56 }
  57
  58 function getClient (clientId: string, clientSecret: string) {
  59   logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').')
  60
  61   return OAuthClientModel.getByIdAndSecret(clientId, clientSecret)
  62 }
  63
  64 async function getRefreshToken (refreshToken: string) {
  65   logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').')
  66
  67   const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken)
  68   if (!tokenInfo) return undefined
  69
  70   const tokenModel = tokenInfo.token
  71
  72   if (tokenModel.User.pluginAuth) {
  73     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh')
  74
  75     if (valid !== true) return undefined
  76   }
  77
  78   return tokenInfo
  79 }
  80
  81 async function getUser (usernameOrEmail?: string, password?: string, bypassLogin?: BypassLogin) {
  82   // Special treatment coming from a plugin
  83   if (bypassLogin && bypassLogin.bypass === true) {
  84     logger.info('Bypassing oauth login by plugin %s.', bypassLogin.pluginName)
  85
  86     let user = await UserModel.loadByEmail(bypassLogin.user.email)
  87     if (!user) user = await createUserFromExternal(bypassLogin.pluginName, bypassLogin.user)
  88
  89     // Cannot create a user
  90     if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.')
  91
  92     // If the user does not belongs to a plugin, it was created before its installation
  93     // Then we just go through a regular login process
  94     if (user.pluginAuth !== null) {
  95       // This user does not belong to this plugin, skip it
  96       if (user.pluginAuth !== bypassLogin.pluginName) {
  97         logger.info(
  98           'Cannot bypass oauth login by plugin %s because %s has another plugin auth method (%s).',
  99           bypassLogin.pluginName, bypassLogin.user.email, user.pluginAuth
 100         )
 101
 102         return null
 103       }
 104
 105       checkUserValidityOrThrow(user)
 106
 107       return user
 108     }
 109   }
 110
 111   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
 112
 113   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
 114
 115   // If we don't find the user, or if the user belongs to a plugin
 116   if (!user || user.pluginAuth !== null || !password) return null
 117
 118   const passwordMatch = await user.isPasswordMatch(password)
 119   if (passwordMatch !== true) return null
 120
 121   checkUserValidityOrThrow(user)
 122
 123   if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) {
 124     throw new AccessDeniedError('User email is not verified.')
 125   }
 126
 127   return user
 128 }
 129
 130 async function revokeToken (
 131   tokenInfo: { refreshToken: string },
 132   options: {
 133     req?: express.Request
 134     explicitLogout?: boolean
 135   } = {}
 136 ): Promise<{ success: boolean, redirectUrl?: string }> {
 137   const { req, explicitLogout } = options
 138
 139   const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken)
 140
 141   if (token) {
 142     let redirectUrl: string
 143
 144     if (explicitLogout === true && token.User.pluginAuth && token.authName) {
 145       redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, req)
 146     }
 147
 148     TokensCache.Instance.clearCacheByToken(token.accessToken)
 149
 150     token.destroy()
 151          .catch(err => logger.error('Cannot destroy token when revoking token.', { err }))
 152
 153     return { success: true, redirectUrl }
 154   }
 155
 156   return { success: false }
 157 }
 158
 159 async function saveToken (
 160   token: TokenInfo,
 161   client: MOAuthClient,
 162   user: MUser,
 163   options: {
 164     refreshTokenAuthName?: string
 165     bypassLogin?: BypassLogin
 166   } = {}
 167 ) {
 168   const { refreshTokenAuthName, bypassLogin } = options
 169   let authName: string = null
 170
 171   if (bypassLogin?.bypass === true) {
 172     authName = bypassLogin.authName
 173   } else if (refreshTokenAuthName) {
 174     authName = refreshTokenAuthName
 175   }
 176
 177   logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.')
 178
 179   const tokenToCreate = {
 180     accessToken: token.accessToken,
 181     accessTokenExpiresAt: token.accessTokenExpiresAt,
 182     refreshToken: token.refreshToken,
 183     refreshTokenExpiresAt: token.refreshTokenExpiresAt,
 184     authName,
 185     oAuthClientId: client.id,
 186     userId: user.id
 187   }
 188
 189   const tokenCreated = await OAuthTokenModel.create(tokenToCreate)
 190
 191   user.lastLoginDate = new Date()
 192   await user.save()
 193
 194   return {
 195     accessToken: tokenCreated.accessToken,
 196     accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt,
 197     refreshToken: tokenCreated.refreshToken,
 198     refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt,
 199     client,
 200     user,
 201     accessTokenExpiresIn: buildExpiresIn(tokenCreated.accessTokenExpiresAt),
 202     refreshTokenExpiresIn: buildExpiresIn(tokenCreated.refreshTokenExpiresAt)
 203   }
 204 }
 205
 206 export {
 207   getAccessToken,
 208   getClient,
 209   getRefreshToken,
 210   getUser,
 211   revokeToken,
 212   saveToken
 213 }
 214
 215 // ---------------------------------------------------------------------------
 216
 217 async function createUserFromExternal (pluginAuth: string, userOptions: ExternalUser) {
 218   const username = await findAvailableLocalActorName(userOptions.username)
 219
 220   const userToCreate = buildUser({
 221     ...pick(userOptions, [ 'email', 'role', 'adminFlags', 'videoQuota', 'videoQuotaDaily' ]),
 222
 223     username,
 224     emailVerified: null,
 225     password: null,
 226     pluginAuth
 227   })
 228
 229   const { user } = await createUserAccountAndChannelAndPlaylist({
 230     userToCreate,
 231     userDisplayName: userOptions.displayName
 232   })
 233
 234   return user
 235 }
 236
 237 function checkUserValidityOrThrow (user: MUser) {
 238   if (user.blocked) throw new AccessDeniedError('User is blocked.')
 239 }
 240
 241 function buildExpiresIn (expiresAt: Date) {
 242   return Math.floor((expiresAt.getTime() - new Date().getTime()) / 1000)
 243 }