server/middlewares/auth.ts

   1 import express from 'express'
   2 import { Socket } from 'socket.io'
   3 import { getAccessToken } from '@server/lib/auth/oauth-model'
   4 import { RunnerModel } from '@server/models/runner/runner'
   5 import { HttpStatusCode } from '../../shared/models/http/http-error-codes'
   6 import { logger } from '../helpers/logger'
   7 import { handleOAuthAuthenticate } from '../lib/auth/oauth'
   8
   9 function authenticate (req: express.Request, res: express.Response, next: express.NextFunction) {
  10   handleOAuthAuthenticate(req, res)
  11     .then((token: any) => {
  12       res.locals.oauth = { token }
  13       res.locals.authenticated = true
  14
  15       return next()
  16     })
  17     .catch(err => {
  18       logger.info('Cannot authenticate.', { err })
  19
  20       return res.fail({
  21         status: err.status,
  22         message: 'Token is invalid',
  23         type: err.name
  24       })
  25     })
  26 }
  27
  28 function authenticateSocket (socket: Socket, next: (err?: any) => void) {
  29   const accessToken = socket.handshake.query['accessToken']
  30
  31   logger.debug('Checking access token in runner.')
  32
  33   if (!accessToken) return next(new Error('No access token provided'))
  34   if (typeof accessToken !== 'string') return next(new Error('Access token is invalid'))
  35
  36   getAccessToken(accessToken)
  37     .then(tokenDB => {
  38       const now = new Date()
  39
  40       if (!tokenDB || tokenDB.accessTokenExpiresAt < now || tokenDB.refreshTokenExpiresAt < now) {
  41         return next(new Error('Invalid access token.'))
  42       }
  43
  44       socket.handshake.auth.user = tokenDB.User
  45
  46       return next()
  47     })
  48     .catch(err => logger.error('Cannot get access token.', { err }))
  49 }
  50
  51 function authenticatePromise (req: express.Request, res: express.Response) {
  52   return new Promise<void>(resolve => {
  53     // Already authenticated? (or tried to)
  54     if (res.locals.oauth?.token.User) return resolve()
  55
  56     if (res.locals.authenticated === false) {
  57       return res.fail({
  58         status: HttpStatusCode.UNAUTHORIZED_401,
  59         message: 'Not authenticated'
  60       })
  61     }
  62
  63     authenticate(req, res, () => resolve())
  64   })
  65 }
  66
  67 function optionalAuthenticate (req: express.Request, res: express.Response, next: express.NextFunction) {
  68   if (req.header('authorization')) return authenticate(req, res, next)
  69
  70   res.locals.authenticated = false
  71
  72   return next()
  73 }
  74
  75 // ---------------------------------------------------------------------------
  76
  77 function authenticateRunnerSocket (socket: Socket, next: (err?: any) => void) {
  78   const runnerToken = socket.handshake.auth['runnerToken']
  79
  80   logger.debug('Checking runner token in socket.')
  81
  82   if (!runnerToken) return next(new Error('No runner token provided'))
  83   if (typeof runnerToken !== 'string') return next(new Error('Runner token is invalid'))
  84
  85   RunnerModel.loadByToken(runnerToken)
  86     .then(runner => {
  87       if (!runner) return next(new Error('Invalid runner token.'))
  88
  89       socket.handshake.auth.runner = runner
  90
  91       return next()
  92     })
  93     .catch(err => logger.error('Cannot get runner token.', { err }))
  94 }
  95
  96 // ---------------------------------------------------------------------------
  97
  98 export {
  99   authenticate,
 100   authenticateSocket,
 101   authenticatePromise,
 102   optionalAuthenticate,
 103   authenticateRunnerSocket
 104 }