aboutsummaryrefslogtreecommitdiffhomepage
path: root/server/middlewares/auth.ts
diff options
context:
space:
mode:
authorChocobozzz <me@florianbigard.com>2021-03-12 15:20:46 +0100
committerChocobozzz <me@florianbigard.com>2021-03-24 18:18:41 +0100
commitf43db2f46ee50bacb402a6ef42d768694c2bc9a8 (patch)
treebce2574e94d48e8602387615a07ee691e98e23e4 /server/middlewares/auth.ts
parentcae2df6bdc3c3590df32bf7431a617177be30429 (diff)
downloadPeerTube-f43db2f46ee50bacb402a6ef42d768694c2bc9a8.tar.gz
PeerTube-f43db2f46ee50bacb402a6ef42d768694c2bc9a8.tar.zst
PeerTube-f43db2f46ee50bacb402a6ef42d768694c2bc9a8.zip
Refactor auth flow
Reimplement some node-oauth2-server methods to remove hacky code needed by our external login workflow
Diffstat (limited to 'server/middlewares/auth.ts')
-rw-r--r--server/middlewares/auth.ts76
1 files changed, 76 insertions, 0 deletions
diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts
new file mode 100644
index 000000000..f38373624
--- /dev/null
+++ b/server/middlewares/auth.ts
@@ -0,0 +1,76 @@
1import * as express from 'express'
2import { Socket } from 'socket.io'
3import { getAccessToken } from '@server/lib/auth/oauth-model'
4import { HttpStatusCode } from '../../shared/core-utils/miscs/http-error-codes'
5import { logger } from '../helpers/logger'
6import { handleOAuthAuthenticate } from '../lib/auth/oauth'
7
8function authenticate (req: express.Request, res: express.Response, next: express.NextFunction, authenticateInQuery = false) {
9 handleOAuthAuthenticate(req, res, authenticateInQuery)
10 .then((token: any) => {
11 res.locals.oauth = { token }
12 res.locals.authenticated = true
13
14 return next()
15 })
16 .catch(err => {
17 logger.warn('Cannot authenticate.', { err })
18
19 return res.status(err.status)
20 .json({
21 error: 'Token is invalid.',
22 code: err.name
23 })
24 })
25}
26
27function authenticateSocket (socket: Socket, next: (err?: any) => void) {
28 const accessToken = socket.handshake.query['accessToken']
29
30 logger.debug('Checking socket access token %s.', accessToken)
31
32 if (!accessToken) return next(new Error('No access token provided'))
33 if (typeof accessToken !== 'string') return next(new Error('Access token is invalid'))
34
35 getAccessToken(accessToken)
36 .then(tokenDB => {
37 const now = new Date()
38
39 if (!tokenDB || tokenDB.accessTokenExpiresAt < now || tokenDB.refreshTokenExpiresAt < now) {
40 return next(new Error('Invalid access token.'))
41 }
42
43 socket.handshake.auth.user = tokenDB.User
44
45 return next()
46 })
47 .catch(err => logger.error('Cannot get access token.', { err }))
48}
49
50function authenticatePromiseIfNeeded (req: express.Request, res: express.Response, authenticateInQuery = false) {
51 return new Promise<void>(resolve => {
52 // Already authenticated? (or tried to)
53 if (res.locals.oauth?.token.User) return resolve()
54
55 if (res.locals.authenticated === false) return res.sendStatus(HttpStatusCode.UNAUTHORIZED_401)
56
57 authenticate(req, res, () => resolve(), authenticateInQuery)
58 })
59}
60
61function optionalAuthenticate (req: express.Request, res: express.Response, next: express.NextFunction) {
62 if (req.header('authorization')) return authenticate(req, res, next)
63
64 res.locals.authenticated = false
65
66 return next()
67}
68
69// ---------------------------------------------------------------------------
70
71export {
72 authenticate,
73 authenticateSocket,
74 authenticatePromiseIfNeeded,
75 optionalAuthenticate
76}