src/auth.js

   1 'use strict';
   2
   3 var passport = require('passport'),
   4     path = require('path'),
   5     safe = require('safetydance'),
   6     fs = require('fs'),
   7     bcrypt = require('bcryptjs'),
   8     uuid = require('uuid/v4'),
   9     BearerStrategy = require('passport-http-bearer').Strategy,
  10     LdapStrategy = require('passport-ldapjs').Strategy,
  11     HttpError = require('connect-lastmile').HttpError,
  12     HttpSuccess = require('connect-lastmile').HttpSuccess,
  13     webdavErrors = require('webdav-server').v2.Errors;
  14
  15 const LOCAL_AUTH_FILE = path.resolve(process.env.LOCAL_AUTH_FILE || './.users.json');
  16 const TOKENSTORE_FILE = path.resolve(process.env.TOKENSTORE_FILE || './.tokens.json');
  17
  18 var tokenStore = {
  19     data: {},
  20     save: function () {
  21         try {
  22             fs.writeFileSync(TOKENSTORE_FILE, JSON.stringify(tokenStore.data), 'utf-8');
  23         } catch (e) {
  24             console.error(`Unable to save tokenstore file at ${TOKENSTORE_FILE}`, e);
  25         }
  26     },
  27     get: function (token, callback) {
  28         callback(tokenStore.data[token] ? null : 'not found', tokenStore.data[token]);
  29     },
  30     set: function (token, data, callback) {
  31         tokenStore.data[token] = data;
  32         tokenStore.save();
  33         callback(null);
  34     },
  35     del: function (token, callback) {
  36         delete tokenStore.data[token];
  37         tokenStore.save();
  38         callback(null);
  39     }
  40 };
  41
  42 // load token store data if any
  43 try {
  44     console.log(`Using tokenstore file: ${TOKENSTORE_FILE}`);
  45     tokenStore.data = JSON.parse(fs.readFileSync(TOKENSTORE_FILE, 'utf-8'));
  46 } catch (e) {
  47     // start with empty token store
  48 }
  49
  50 function issueAccessToken() {
  51     return function (req, res, next) {
  52         var accessToken = uuid();
  53
  54         tokenStore.set(accessToken, req.user, function (error) {
  55             if (error) return next(new HttpError(500, error));
  56             next(new HttpSuccess(201, { accessToken: accessToken, user: req.user }));
  57         });
  58     };
  59 }
  60
  61 passport.serializeUser(function (user, done) {
  62     console.log('serializeUser', user);
  63     done(null, user.uid);
  64 });
  65
  66 passport.deserializeUser(function (id, done) {
  67     console.log('deserializeUser', id);
  68     done(null, { uid: id });
  69 });
  70
  71 var LDAP_URL = process.env.LDAP_URL;
  72 var LDAP_USERS_BASE_DN = process.env.LDAP_USERS_BASE_DN;
  73
  74 if (LDAP_URL && LDAP_USERS_BASE_DN) {
  75     console.log('Using ldap auth');
  76
  77     exports.login = [ passport.authenticate('ldap'), issueAccessToken() ];
  78 } else {
  79     console.log(`Using local user file: ${LOCAL_AUTH_FILE}`);
  80
  81     exports.login = [
  82         function (req, res, next) {
  83             var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE));
  84             if (!users) return res.send(401);
  85             if (!users[req.body.username]) return res.send(401);
  86
  87             bcrypt.compare(req.body.password, users[req.body.username].passwordHash, function (error, valid) {
  88                 if (error || !valid) return res.send(401);
  89
  90                 req.user = {
  91                     username: req.body.username
  92                 };
  93
  94                 next();
  95             });
  96         },
  97         issueAccessToken()
  98     ];
  99 }
 100
 101 var opts = {
 102     server: {
 103         url: LDAP_URL,
 104     },
 105     base: LDAP_USERS_BASE_DN,
 106     search: {
 107         filter: '(|(username={{username}})(mail={{username}}))',
 108         attributes: ['displayname', 'username', 'mail', 'uid'],
 109         scope: 'sub'
 110     },
 111     uidTag: 'cn',
 112     usernameField: 'username',
 113     passwordField: 'password',
 114 };
 115
 116 passport.use(new LdapStrategy(opts, function (profile, done) {
 117     done(null, profile);
 118 }));
 119
 120 exports.verify = passport.authenticate('bearer', { session: false });
 121
 122 passport.use(new BearerStrategy(function (token, done) {
 123     tokenStore.get(token, function (error, result) {
 124         if (error) {
 125             console.error(error);
 126             return done(null, false);
 127         }
 128
 129         done(null, result, { accessToken: token });
 130     });
 131 }));
 132
 133 exports.logout = function (req, res, next) {
 134     tokenStore.del(req.authInfo.accessToken, function (error) {
 135         if (error) console.error(error);
 136
 137         next(new HttpSuccess(200, {}));
 138     });
 139 };
 140
 141 exports.getProfile = function (req, res, next) {
 142     next(new HttpSuccess(200, { username: req.user.username }));
 143 };
 144
 145 // webdav usermanager
 146 exports.WebdavUserManager = WebdavUserManager;
 147
 148 // This implements the required interface only for the Basic Authentication for webdav-server
 149 function WebdavUserManager() {};
 150
 151 WebdavUserManager.prototype.getDefaultUser = function (callback) {
 152     // this is only a dummy user, since we always require authentication
 153     var user = {
 154         username: 'DefaultUser',
 155         password: null,
 156         isAdministrator: false,
 157         isDefaultUser: true,
 158         uid: 'DefaultUser'
 159     };
 160
 161     callback(user);
 162 };
 163
 164 WebdavUserManager.prototype.getUserByNamePassword = function (username, password, callback) {
 165     var users = safe.JSON.parse(safe.fs.readFileSync(LOCAL_AUTH_FILE));
 166     if (!users) return callback(webdavErrors.UserNotFound);
 167     if (!users[username]) return callback(webdavErrors.UserNotFound);
 168
 169     bcrypt.compare(password, users[username].passwordHash, function (error, valid) {
 170         if (error || !valid) return callback(webdavErrors.UserNotFound);
 171
 172         callback(null, {
 173             username: username,
 174             isAdministrator: true,
 175             isDefaultUser: false,
 176             uid: username
 177         });
 178     });
 179 };