server/lib/oauth-model.ts

   1 import * as express from 'express'
   2 import { AccessDeniedError } from 'oauth2-server'
   3 import { logger } from '../helpers/logger'
   4 import { UserModel } from '../models/account/user'
   5 import { OAuthClientModel } from '../models/oauth/oauth-client'
   6 import { OAuthTokenModel } from '../models/oauth/oauth-token'
   7 import { LRU_CACHE } from '../initializers/constants'
   8 import { Transaction } from 'sequelize'
   9 import { CONFIG } from '../initializers/config'
  10 import * as LRUCache from 'lru-cache'
  11 import { MOAuthTokenUser } from '@server/typings/models/oauth/oauth-token'
  12 import { MUser } from '@server/typings/models/user/user'
  13 import { UserAdminFlag } from '@shared/models/users/user-flag.model'
  14 import { createUserAccountAndChannelAndPlaylist } from './user'
  15 import { UserRole } from '@shared/models/users/user-role'
  16 import { PluginManager } from '@server/lib/plugins/plugin-manager'
  17
  18 type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date }
  19
  20 const accessTokenCache = new LRUCache<string, MOAuthTokenUser>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE })
  21 const userHavingToken = new LRUCache<number, string>({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE })
  22
  23 // ---------------------------------------------------------------------------
  24
  25 function deleteUserToken (userId: number, t?: Transaction) {
  26   clearCacheByUserId(userId)
  27
  28   return OAuthTokenModel.deleteUserToken(userId, t)
  29 }
  30
  31 function clearCacheByUserId (userId: number) {
  32   const token = userHavingToken.get(userId)
  33
  34   if (token !== undefined) {
  35     accessTokenCache.del(token)
  36     userHavingToken.del(userId)
  37   }
  38 }
  39
  40 function clearCacheByToken (token: string) {
  41   const tokenModel = accessTokenCache.get(token)
  42
  43   if (tokenModel !== undefined) {
  44     userHavingToken.del(tokenModel.userId)
  45     accessTokenCache.del(token)
  46   }
  47 }
  48
  49 async function getAccessToken (bearerToken: string) {
  50   logger.debug('Getting access token (bearerToken: ' + bearerToken + ').')
  51
  52   if (!bearerToken) return undefined
  53
  54   let tokenModel: MOAuthTokenUser
  55
  56   if (accessTokenCache.has(bearerToken)) {
  57     tokenModel = accessTokenCache.get(bearerToken)
  58   } else {
  59     tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken)
  60
  61     if (tokenModel) {
  62       accessTokenCache.set(bearerToken, tokenModel)
  63       userHavingToken.set(tokenModel.userId, tokenModel.accessToken)
  64     }
  65   }
  66
  67   if (!tokenModel) return undefined
  68
  69   if (tokenModel.User.pluginAuth) {
  70     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access')
  71
  72     if (valid !== true) return undefined
  73   }
  74
  75   return tokenModel
  76 }
  77
  78 function getClient (clientId: string, clientSecret: string) {
  79   logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').')
  80
  81   return OAuthClientModel.getByIdAndSecret(clientId, clientSecret)
  82 }
  83
  84 async function getRefreshToken (refreshToken: string) {
  85   logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').')
  86
  87   const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken)
  88   if (!tokenInfo) return undefined
  89
  90   const tokenModel = tokenInfo.token
  91
  92   if (tokenModel.User.pluginAuth) {
  93     const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh')
  94
  95     if (valid !== true) return undefined
  96   }
  97
  98   return tokenInfo
  99 }
 100
 101 async function getUser (usernameOrEmail?: string, password?: string) {
 102   const res: express.Response = this.request.res
 103
 104   // Special treatment coming from a plugin
 105   if (res.locals.bypassLogin && res.locals.bypassLogin.bypass === true) {
 106     const obj = res.locals.bypassLogin
 107     logger.info('Bypassing oauth login by plugin %s.', obj.pluginName)
 108
 109     let user = await UserModel.loadByEmail(obj.user.email)
 110     if (!user) user = await createUserFromExternal(obj.pluginName, obj.user)
 111
 112     // If the user does not belongs to a plugin, it was created before its installation
 113     // Then we just go through a regular login process
 114     if (user.pluginAuth !== null) {
 115       // This user does not belong to this plugin, skip it
 116       if (user.pluginAuth !== obj.pluginName) return null
 117
 118       return user
 119     }
 120   }
 121
 122   logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).')
 123
 124   const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail)
 125   // If we don't find the user, or if the user belongs to a plugin
 126   if (!user || user.pluginAuth !== null) return null
 127
 128   const passwordMatch = await user.isPasswordMatch(password)
 129   if (passwordMatch !== true) return null
 130
 131   if (user.blocked) throw new AccessDeniedError('User is blocked.')
 132
 133   if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) {
 134     throw new AccessDeniedError('User email is not verified.')
 135   }
 136
 137   return user
 138 }
 139
 140 async function revokeToken (tokenInfo: { refreshToken: string }) {
 141   const res: express.Response = this.request.res
 142   const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken)
 143
 144   if (token) {
 145     if (res.locals.explicitLogout === true && token.User.pluginAuth && token.authName) {
 146       PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User)
 147     }
 148
 149     clearCacheByToken(token.accessToken)
 150
 151     token.destroy()
 152          .catch(err => logger.error('Cannot destroy token when revoking token.', { err }))
 153
 154     return true
 155   }
 156
 157   return false
 158 }
 159
 160 async function saveToken (token: TokenInfo, client: OAuthClientModel, user: UserModel) {
 161   const res: express.Response = this.request.res
 162
 163   let authName: string = null
 164   if (res.locals.bypassLogin?.bypass === true) {
 165     authName = res.locals.bypassLogin.authName
 166   } else if (res.locals.refreshTokenAuthName) {
 167     authName = res.locals.refreshTokenAuthName
 168   }
 169
 170   logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.')
 171
 172   const tokenToCreate = {
 173     accessToken: token.accessToken,
 174     accessTokenExpiresAt: token.accessTokenExpiresAt,
 175     refreshToken: token.refreshToken,
 176     refreshTokenExpiresAt: token.refreshTokenExpiresAt,
 177     authName,
 178     oAuthClientId: client.id,
 179     userId: user.id
 180   }
 181
 182   const tokenCreated = await OAuthTokenModel.create(tokenToCreate)
 183   return Object.assign(tokenCreated, { client, user })
 184 }
 185
 186 // ---------------------------------------------------------------------------
 187
 188 // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications
 189 export {
 190   deleteUserToken,
 191   clearCacheByUserId,
 192   clearCacheByToken,
 193   getAccessToken,
 194   getClient,
 195   getRefreshToken,
 196   getUser,
 197   revokeToken,
 198   saveToken
 199 }
 200
 201 async function createUserFromExternal (pluginAuth: string, options: {
 202   username: string
 203   email: string
 204   role: UserRole
 205   displayName: string
 206 }) {
 207   const userToCreate = new UserModel({
 208     username: options.username,
 209     password: null,
 210     email: options.email,
 211     nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY,
 212     autoPlayVideo: true,
 213     role: options.role,
 214     videoQuota: CONFIG.USER.VIDEO_QUOTA,
 215     videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY,
 216     adminFlags: UserAdminFlag.NONE,
 217     pluginAuth
 218   }) as MUser
 219
 220   const { user } = await createUserAccountAndChannelAndPlaylist({
 221     userToCreate,
 222     userDisplayName: options.displayName
 223   })
 224
 225   return user
 226 }