server/lib/oauth-model.ts

   1 import * as express from 'express'
   2 import { AccessDeniedError } from 'oauth2-server'
   3 import { logger } from '../helpers/logger'
   4 import { UserModel } from '../models/account/user'
   5 import { OAuthClientModel } from '../models/oauth/oauth-client'
   6 import { OAuthTokenModel } from '../models/oauth/oauth-token'
   7 import { LRU_CACHE } from '../initializers/constants'
   8 import { Transaction } from 'sequelize'
   9 import { CONFIG } from '../initializers/config'
  10 import * as LRUCache from 'lru-cache'
  11 import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token'
  12 import { MUser } from '@server/types/models/user/user'
  13 import { UserAdminFlag } from '@shared/models/users/user-flag.model'
  14 import { createUserAccountAndChannelAndPlaylist } from './user'
  15 import { UserRole } from '@shared/models/users/user-role'
  16 import { PluginManager } from '@server/lib/plugins/plugin-manager'
  17 import { ActorModel } from '@server/models/activitypub/actor'
  18
  19 type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date }
  20
  21 const accessTokenCache = new LRUCache<string, MOAuthTokenUser>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE })
  22 const userHavingToken = new LRUCache<number, string>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE })
  23
  24 // ---------------------------------------------------------------------------
  25
  26 function deleteUserToken (userId: number, t?: Transaction) {
  27   clearCacheByUserId(userId)
  28
  29   return OAuthTokenModel.deleteUserToken(userId, t)
  30 }
  31
  32 function clearCacheByUserId (userId: number) {
  33   const token = userHavingToken.get(userId)
  34
  35   if (token !== undefined) {
  36     accessTokenCache.del(token)
  37     userHavingToken.del(userId)
  38   }
  39 }
  40
  41 function clearCacheByToken (token: string) {
  42   const tokenModel = accessTokenCache.get(token)
  43
  44   if (tokenModel !== undefined) {
  45     userHavingToken.del(tokenModel.userId)
  46     accessTokenCache.del(token)
  47   }
  48 }
  49
  50 async function getAccessToken (bearerToken: string) {
  51   logger.debug('Getting access token (bearerToken: ' + bearerToken + ').')
  52
  53   if (!bearerToken) return undefined
  54
  55   let tokenModel: MOAuthTokenUser
  56
  57   if (accessTokenCache.has(bearerToken)) {
  58     tokenModel = accessTokenCache.get(bearerToken)
  59   } else {
  60     tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken)
  61
  62     if (tokenModel) {
  63       accessTokenCache.set(bearerToken, tokenModel)
  64       userHavingToken.set(tokenModel.userId, tokenModel.accessToken)
  65     }
  66   }
  67
  68   if (!tokenModel) return undefined
  69
  70   if (tokenModel.User.pluginAuth) {
  71     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access')
  72
  73     if (valid !== true) return undefined
  74   }
  75
  76   return tokenModel
  77 }
  78
  79 function getClient (clientId: string, clientSecret: string) {
  80   logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').')
  81
  82   return OAuthClientModel.getByIdAndSecret(clientId, clientSecret)
  83 }
  84
  85 async function getRefreshToken (refreshToken: string) {
  86   logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').')
  87
  88   const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken)
  89   if (!tokenInfo) return undefined
  90
  91   const tokenModel = tokenInfo.token
  92
  93   if (tokenModel.User.pluginAuth) {
  94     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh')
  95
  96     if (valid !== true) return undefined
  97   }
  98
  99   return tokenInfo
 100 }
 101
 102 async function getUser (usernameOrEmail?: string, password?: string) {
 103   const res: express.Response = this.request.res
 104
 105   // Special treatment coming from a plugin
 106   if (res.locals.bypassLogin && res.locals.bypassLogin.bypass === true) {
 107     const obj = res.locals.bypassLogin
 108     logger.info('Bypassing oauth login by plugin %s.', obj.pluginName)
 109
 110     let user = await UserModel.loadByEmail(obj.user.email)
 111     if (!user) user = await createUserFromExternal(obj.pluginName, obj.user)
 112
 113     // Cannot create a user
 114     if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.')
 115
 116     // If the user does not belongs to a plugin, it was created before its installation
 117     // Then we just go through a regular login process
 118     if (user.pluginAuth !== null) {
 119       // This user does not belong to this plugin, skip it
 120       if (user.pluginAuth !== obj.pluginName) return null
 121
 122       return user
 123     }
 124   }
 125
 126   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
 127
 128   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
 129   // If we don't find the user, or if the user belongs to a plugin
 130   if (!user || user.pluginAuth !== null || !password) return null
 131
 132   const passwordMatch = await user.isPasswordMatch(password)
 133   if (passwordMatch !== true) return null
 134
 135   if (user.blocked) throw new AccessDeniedError('User is blocked.')
 136
 137   if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) {
 138     throw new AccessDeniedError('User email is not verified.')
 139   }
 140
 141   return user
 142 }
 143
 144 async function revokeToken (tokenInfo: { refreshToken: string }) {
 145   const res: express.Response = this.request.res
 146   const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken)
 147
 148   if (token) {
 149     if (res.locals.explicitLogout === true && token.User.pluginAuth && token.authName) {
 150       PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User)
 151     }
 152
 153     clearCacheByToken(token.accessToken)
 154
 155     token.destroy()
 156          .catch(err => logger.error('Cannot destroy token when revoking token.', { err }))
 157
 158     return true
 159   }
 160
 161   return false
 162 }
 163
 164 async function saveToken (token: TokenInfo, client: OAuthClientModel, user: UserModel) {
 165   const res: express.Response = this.request.res
 166
 167   let authName: string = null
 168   if (res.locals.bypassLogin?.bypass === true) {
 169     authName = res.locals.bypassLogin.authName
 170   } else if (res.locals.refreshTokenAuthName) {
 171     authName = res.locals.refreshTokenAuthName
 172   }
 173
 174   logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.')
 175
 176   const tokenToCreate = {
 177     accessToken: token.accessToken,
 178     accessTokenExpiresAt: token.accessTokenExpiresAt,
 179     refreshToken: token.refreshToken,
 180     refreshTokenExpiresAt: token.refreshTokenExpiresAt,
 181     authName,
 182     oAuthClientId: client.id,
 183     userId: user.id
 184   }
 185
 186   const tokenCreated = await OAuthTokenModel.create(tokenToCreate)
 187
 188   user.lastLoginDate = new Date()
 189   await user.save()
 190
 191   return Object.assign(tokenCreated, { client, user })
 192 }
 193
 194 // ---------------------------------------------------------------------------
 195
 196 // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications
 197 export {
 198   deleteUserToken,
 199   clearCacheByUserId,
 200   clearCacheByToken,
 201   getAccessToken,
 202   getClient,
 203   getRefreshToken,
 204   getUser,
 205   revokeToken,
 206   saveToken
 207 }
 208
 209 async function createUserFromExternal (pluginAuth: string, options: {
 210   username: string
 211   email: string
 212   role: UserRole
 213   displayName: string
 214 }) {
 215   // Check an actor does not already exists with that name (removed user)
 216   const actor = await ActorModel.loadLocalByName(options.username)
 217   if (actor) return null
 218
 219   const userToCreate = new UserModel({
 220     username: options.username,
 221     password: null,
 222     email: options.email,
 223     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 224     autoPlayVideo: true,
 225     role: options.role,
 226     videoQuota: CONFIG.USER.VIDEO_QUOTA,
 227     videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY,
 228     adminFlags: UserAdminFlag.NONE,
 229     pluginAuth
 230   }) as MUser
 231
 232   const { user } = await createUserAccountAndChannelAndPlaylist({
 233     userToCreate,
 234     userDisplayName: options.displayName
 235   })
 236
 237   return user
 238 }