server/lib/oauth-model.ts

   1 import { AccessDeniedError } from 'oauth2-server'
   2 import { logger } from '../helpers/logger'
   3 import { UserModel } from '../models/account/user'
   4 import { OAuthClientModel } from '../models/oauth/oauth-client'
   5 import { OAuthTokenModel } from '../models/oauth/oauth-token'
   6 import { CONFIG } from '../initializers/constants'
   7
   8 type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date }
   9
  10 // ---------------------------------------------------------------------------
  11
  12 function getAccessToken (bearerToken: string) {
  13   logger.debug('Getting access token (bearerToken: ' + bearerToken + ').')
  14
  15   return OAuthTokenModel.getByTokenAndPopulateUser(bearerToken)
  16 }
  17
  18 function getClient (clientId: string, clientSecret: string) {
  19   logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').')
  20
  21   return OAuthClientModel.getByIdAndSecret(clientId, clientSecret)
  22 }
  23
  24 function getRefreshToken (refreshToken: string) {
  25   logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').')
  26
  27   return OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken)
  28 }
  29
  30 async function getUser (usernameOrEmail: string, password: string) {
  31   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
  32
  33   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
  34   if (!user) return null
  35
  36   const passwordMatch = await user.isPasswordMatch(password)
  37   if (passwordMatch === false) return null
  38
  39   if (user.blocked) throw new AccessDeniedError('User is blocked.')
  40
  41   if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) {
  42     throw new AccessDeniedError('User email is not verified.')
  43   }
  44
  45   return user
  46 }
  47
  48 async function revokeToken (tokenInfo: TokenInfo) {
  49   const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken)
  50   if (token) {
  51     token.destroy()
  52          .catch(err => logger.error('Cannot destroy token when revoking token.', { err }))
  53   }
  54
  55   /*
  56     * Thanks to https://github.com/manjeshpv/node-oauth2-server-implementation/blob/master/components/oauth/mongo-models.js
  57     * "As per the discussion we need set older date
  58     * revokeToken will expected return a boolean in future version
  59     * https://github.com/oauthjs/node-oauth2-server/pull/274
  60     * https://github.com/oauthjs/node-oauth2-server/issues/290"
  61   */
  62   const expiredToken = token
  63   expiredToken.refreshTokenExpiresAt = new Date('2015-05-28T06:59:53.000Z')
  64
  65   return expiredToken
  66 }
  67
  68 async function saveToken (token: TokenInfo, client: OAuthClientModel, user: UserModel) {
  69   logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.')
  70
  71   const tokenToCreate = {
  72     accessToken: token.accessToken,
  73     accessTokenExpiresAt: token.accessTokenExpiresAt,
  74     refreshToken: token.refreshToken,
  75     refreshTokenExpiresAt: token.refreshTokenExpiresAt,
  76     oAuthClientId: client.id,
  77     userId: user.id
  78   }
  79
  80   const tokenCreated = await OAuthTokenModel.create(tokenToCreate)
  81   return Object.assign(tokenCreated, { client, user })
  82 }
  83
  84 // ---------------------------------------------------------------------------
  85
  86 // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications
  87 export {
  88   getAccessToken,
  89   getClient,
  90   getRefreshToken,
  91   getUser,
  92   revokeToken,
  93   saveToken
  94 }