server/lib/auth/oauth-model.ts

   1 import express from 'express'
   2 import { AccessDeniedError } from '@node-oauth/oauth2-server'
   3 import { PluginManager } from '@server/lib/plugins/plugin-manager'
   4 import { AccountModel } from '@server/models/account/account'
   5 import { AuthenticatedResultUpdaterFieldName, RegisterServerAuthenticatedResult } from '@server/types'
   6 import { MOAuthClient } from '@server/types/models'
   7 import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token'
   8 import { MUser, MUserDefault } from '@server/types/models/user/user'
   9 import { pick } from '@shared/core-utils'
  10 import { AttributesOnly } from '@shared/typescript-utils'
  11 import { logger } from '../../helpers/logger'
  12 import { CONFIG } from '../../initializers/config'
  13 import { OAuthClientModel } from '../../models/oauth/oauth-client'
  14 import { OAuthTokenModel } from '../../models/oauth/oauth-token'
  15 import { UserModel } from '../../models/user/user'
  16 import { findAvailableLocalActorName } from '../local-actor'
  17 import { buildUser, createUserAccountAndChannelAndPlaylist } from '../user'
  18 import { ExternalUser } from './external-auth'
  19 import { TokensCache } from './tokens-cache'
  20
  21 type TokenInfo = {
  22   accessToken: string
  23   refreshToken: string
  24   accessTokenExpiresAt: Date
  25   refreshTokenExpiresAt: Date
  26 }
  27
  28 export type BypassLogin = {
  29   bypass: boolean
  30   pluginName: string
  31   authName?: string
  32   user: ExternalUser
  33   userUpdater: RegisterServerAuthenticatedResult['userUpdater']
  34 }
  35
  36 async function getAccessToken (bearerToken: string) {
  37   logger.debug('Getting access token.')
  38
  39   if (!bearerToken) return undefined
  40
  41   let tokenModel: MOAuthTokenUser
  42
  43   if (TokensCache.Instance.hasToken(bearerToken)) {
  44     tokenModel = TokensCache.Instance.getByToken(bearerToken)
  45   } else {
  46     tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken)
  47
  48     if (tokenModel) TokensCache.Instance.setToken(tokenModel)
  49   }
  50
  51   if (!tokenModel) return undefined
  52
  53   if (tokenModel.User.pluginAuth) {
  54     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access')
  55
  56     if (valid !== true) return undefined
  57   }
  58
  59   return tokenModel
  60 }
  61
  62 function getClient (clientId: string, clientSecret: string) {
  63   logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').')
  64
  65   return OAuthClientModel.getByIdAndSecret(clientId, clientSecret)
  66 }
  67
  68 async function getRefreshToken (refreshToken: string) {
  69   logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').')
  70
  71   const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken)
  72   if (!tokenInfo) return undefined
  73
  74   const tokenModel = tokenInfo.token
  75
  76   if (tokenModel.User.pluginAuth) {
  77     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh')
  78
  79     if (valid !== true) return undefined
  80   }
  81
  82   return tokenInfo
  83 }
  84
  85 async function getUser (usernameOrEmail?: string, password?: string, bypassLogin?: BypassLogin) {
  86   // Special treatment coming from a plugin
  87   if (bypassLogin && bypassLogin.bypass === true) {
  88     logger.info('Bypassing oauth login by plugin %s.', bypassLogin.pluginName)
  89
  90     let user = await UserModel.loadByEmail(bypassLogin.user.email)
  91
  92     if (!user) user = await createUserFromExternal(bypassLogin.pluginName, bypassLogin.user)
  93     else user = await updateUserFromExternal(user, bypassLogin.user, bypassLogin.userUpdater)
  94
  95     // Cannot create a user
  96     if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.')
  97
  98     // If the user does not belongs to a plugin, it was created before its installation
  99     // Then we just go through a regular login process
 100     if (user.pluginAuth !== null) {
 101       // This user does not belong to this plugin, skip it
 102       if (user.pluginAuth !== bypassLogin.pluginName) {
 103         logger.info(
 104           'Cannot bypass oauth login by plugin %s because %s has another plugin auth method (%s).',
 105           bypassLogin.pluginName, bypassLogin.user.email, user.pluginAuth
 106         )
 107
 108         return null
 109       }
 110
 111       checkUserValidityOrThrow(user)
 112
 113       return user
 114     }
 115   }
 116
 117   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
 118
 119   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
 120
 121   // If we don't find the user, or if the user belongs to a plugin
 122   if (!user || user.pluginAuth !== null || !password) return null
 123
 124   const passwordMatch = await user.isPasswordMatch(password)
 125   if (passwordMatch !== true) return null
 126
 127   checkUserValidityOrThrow(user)
 128
 129   if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) {
 130     throw new AccessDeniedError('User email is not verified.')
 131   }
 132
 133   return user
 134 }
 135
 136 async function revokeToken (
 137   tokenInfo: { refreshToken: string },
 138   options: {
 139     req?: express.Request
 140     explicitLogout?: boolean
 141   } = {}
 142 ): Promise<{ success: boolean, redirectUrl?: string }> {
 143   const { req, explicitLogout } = options
 144
 145   const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken)
 146
 147   if (token) {
 148     let redirectUrl: string
 149
 150     if (explicitLogout === true && token.User.pluginAuth && token.authName) {
 151       redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, req)
 152     }
 153
 154     TokensCache.Instance.clearCacheByToken(token.accessToken)
 155
 156     token.destroy()
 157          .catch(err => logger.error('Cannot destroy token when revoking token.', { err }))
 158
 159     return { success: true, redirectUrl }
 160   }
 161
 162   return { success: false }
 163 }
 164
 165 async function saveToken (
 166   token: TokenInfo,
 167   client: MOAuthClient,
 168   user: MUser,
 169   options: {
 170     refreshTokenAuthName?: string
 171     bypassLogin?: BypassLogin
 172   } = {}
 173 ) {
 174   const { refreshTokenAuthName, bypassLogin } = options
 175   let authName: string = null
 176
 177   if (bypassLogin?.bypass === true) {
 178     authName = bypassLogin.authName
 179   } else if (refreshTokenAuthName) {
 180     authName = refreshTokenAuthName
 181   }
 182
 183   logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.')
 184
 185   const tokenToCreate = {
 186     accessToken: token.accessToken,
 187     accessTokenExpiresAt: token.accessTokenExpiresAt,
 188     refreshToken: token.refreshToken,
 189     refreshTokenExpiresAt: token.refreshTokenExpiresAt,
 190     authName,
 191     oAuthClientId: client.id,
 192     userId: user.id
 193   }
 194
 195   const tokenCreated = await OAuthTokenModel.create(tokenToCreate)
 196
 197   user.lastLoginDate = new Date()
 198   await user.save()
 199
 200   return {
 201     accessToken: tokenCreated.accessToken,
 202     accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt,
 203     refreshToken: tokenCreated.refreshToken,
 204     refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt,
 205     client,
 206     user,
 207     accessTokenExpiresIn: buildExpiresIn(tokenCreated.accessTokenExpiresAt),
 208     refreshTokenExpiresIn: buildExpiresIn(tokenCreated.refreshTokenExpiresAt)
 209   }
 210 }
 211
 212 export {
 213   getAccessToken,
 214   getClient,
 215   getRefreshToken,
 216   getUser,
 217   revokeToken,
 218   saveToken
 219 }
 220
 221 // ---------------------------------------------------------------------------
 222
 223 async function createUserFromExternal (pluginAuth: string, userOptions: ExternalUser) {
 224   const username = await findAvailableLocalActorName(userOptions.username)
 225
 226   const userToCreate = buildUser({
 227     ...pick(userOptions, [ 'email', 'role', 'adminFlags', 'videoQuota', 'videoQuotaDaily' ]),
 228
 229     username,
 230     emailVerified: null,
 231     password: null,
 232     pluginAuth
 233   })
 234
 235   const { user } = await createUserAccountAndChannelAndPlaylist({
 236     userToCreate,
 237     userDisplayName: userOptions.displayName
 238   })
 239
 240   return user
 241 }
 242
 243 async function updateUserFromExternal (
 244   user: MUserDefault,
 245   userOptions: ExternalUser,
 246   userUpdater: RegisterServerAuthenticatedResult['userUpdater']
 247 ) {
 248   if (!userUpdater) return user
 249
 250   {
 251     type UserAttributeKeys = keyof AttributesOnly<UserModel>
 252     const mappingKeys: { [ id in UserAttributeKeys ]?: AuthenticatedResultUpdaterFieldName } = {
 253       role: 'role',
 254       adminFlags: 'adminFlags',
 255       videoQuota: 'videoQuota',
 256       videoQuotaDaily: 'videoQuotaDaily'
 257     }
 258
 259     for (const modelKey of Object.keys(mappingKeys)) {
 260       const pluginOptionKey = mappingKeys[modelKey]
 261
 262       const newValue = userUpdater({ fieldName: pluginOptionKey, currentValue: user[modelKey], newValue: userOptions[pluginOptionKey] })
 263       user.set(modelKey, newValue)
 264     }
 265   }
 266
 267   {
 268     type AccountAttributeKeys = keyof Partial<AttributesOnly<AccountModel>>
 269     const mappingKeys: { [ id in AccountAttributeKeys ]?: AuthenticatedResultUpdaterFieldName } = {
 270       name: 'displayName'
 271     }
 272
 273     for (const modelKey of Object.keys(mappingKeys)) {
 274       const optionKey = mappingKeys[modelKey]
 275
 276       const newValue = userUpdater({ fieldName: optionKey, currentValue: user.Account[modelKey], newValue: userOptions[optionKey] })
 277       user.Account.set(modelKey, newValue)
 278     }
 279   }
 280
 281   logger.debug('Updated user %s with plugin userUpdated function.', user.email, { user, userOptions })
 282
 283   user.Account = await user.Account.save()
 284
 285   return user.save()
 286 }
 287
 288 function checkUserValidityOrThrow (user: MUser) {
 289   if (user.blocked) throw new AccessDeniedError('User is blocked.')
 290 }
 291
 292 function buildExpiresIn (expiresAt: Date) {
 293   return Math.floor((expiresAt.getTime() - new Date().getTime()) / 1000)
 294 }