From f43db2f46ee50bacb402a6ef42d768694c2bc9a8 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 12 Mar 2021 15:20:46 +0100 Subject: Refactor auth flow Reimplement some node-oauth2-server methods to remove hacky code needed by our external login workflow --- server/lib/auth/external-auth.ts | 219 ++++++++++++++++++++++++++++++++++ server/lib/auth/oauth-model.ts | 245 +++++++++++++++++++++++++++++++++++++++ server/lib/auth/oauth.ts | 180 ++++++++++++++++++++++++++++ server/lib/auth/tokens-cache.ts | 52 +++++++++ 4 files changed, 696 insertions(+) create mode 100644 server/lib/auth/external-auth.ts create mode 100644 server/lib/auth/oauth-model.ts create mode 100644 server/lib/auth/oauth.ts create mode 100644 server/lib/auth/tokens-cache.ts (limited to 'server/lib/auth') diff --git a/server/lib/auth/external-auth.ts b/server/lib/auth/external-auth.ts new file mode 100644 index 000000000..80f5064b6 --- /dev/null +++ b/server/lib/auth/external-auth.ts @@ -0,0 +1,219 @@ + +import { isUserDisplayNameValid, isUserRoleValid, isUserUsernameValid } from '@server/helpers/custom-validators/users' +import { logger } from '@server/helpers/logger' +import { generateRandomString } from '@server/helpers/utils' +import { PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME } from '@server/initializers/constants' +import { PluginManager } from '@server/lib/plugins/plugin-manager' +import { OAuthTokenModel } from '@server/models/oauth/oauth-token' +import { + RegisterServerAuthenticatedResult, + RegisterServerAuthPassOptions, + RegisterServerExternalAuthenticatedResult +} from '@server/types/plugins/register-server-auth.model' +import { UserRole } from '@shared/models' + +// Token is the key, expiration date is the value +const authBypassTokens = new Map() + +async function onExternalUserAuthenticated (options: { + npmName: string + authName: string + authResult: RegisterServerExternalAuthenticatedResult +}) { + const { npmName, authName, authResult } = options + + if (!authResult.req || !authResult.res) { + logger.error('Cannot authenticate external user for auth %s of plugin %s: no req or res are provided.', authName, npmName) + return + } + + const { res } = authResult + + if (!isAuthResultValid(npmName, authName, authResult)) { + res.redirect('/login?externalAuthError=true') + return + } + + logger.info('Generating auth bypass token for %s in auth %s of plugin %s.', authResult.username, authName, npmName) + + const bypassToken = await generateRandomString(32) + + const expires = new Date() + expires.setTime(expires.getTime() + PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME) + + const user = buildUserResult(authResult) + authBypassTokens.set(bypassToken, { + expires, + user, + npmName, + authName + }) + + // Cleanup expired tokens + const now = new Date() + for (const [ key, value ] of authBypassTokens) { + if (value.expires.getTime() < now.getTime()) { + authBypassTokens.delete(key) + } + } + + res.redirect(`/login?externalAuthToken=${bypassToken}&username=${user.username}`) +} + +async function getAuthNameFromRefreshGrant (refreshToken?: string) { + if (!refreshToken) return undefined + + const tokenModel = await OAuthTokenModel.loadByRefreshToken(refreshToken) + + return tokenModel?.authName +} + +async function getBypassFromPasswordGrant (username: string, password: string) { + const plugins = PluginManager.Instance.getIdAndPassAuths() + const pluginAuths: { npmName?: string, registerAuthOptions: RegisterServerAuthPassOptions }[] = [] + + for (const plugin of plugins) { + const auths = plugin.idAndPassAuths + + for (const auth of auths) { + pluginAuths.push({ + npmName: plugin.npmName, + registerAuthOptions: auth + }) + } + } + + pluginAuths.sort((a, b) => { + const aWeight = a.registerAuthOptions.getWeight() + const bWeight = b.registerAuthOptions.getWeight() + + // DESC weight order + if (aWeight === bWeight) return 0 + if (aWeight < bWeight) return 1 + return -1 + }) + + const loginOptions = { + id: username, + password + } + + for (const pluginAuth of pluginAuths) { + const authOptions = pluginAuth.registerAuthOptions + const authName = authOptions.authName + const npmName = pluginAuth.npmName + + logger.debug( + 'Using auth method %s of plugin %s to login %s with weight %d.', + authName, npmName, loginOptions.id, authOptions.getWeight() + ) + + try { + const loginResult = await authOptions.login(loginOptions) + + if (!loginResult) continue + if (!isAuthResultValid(pluginAuth.npmName, authOptions.authName, loginResult)) continue + + logger.info( + 'Login success with auth method %s of plugin %s for %s.', + authName, npmName, loginOptions.id + ) + + return { + bypass: true, + pluginName: pluginAuth.npmName, + authName: authOptions.authName, + user: buildUserResult(loginResult) + } + } catch (err) { + logger.error('Error in auth method %s of plugin %s', authOptions.authName, pluginAuth.npmName, { err }) + } + } + + return undefined +} + +function getBypassFromExternalAuth (username: string, externalAuthToken: string) { + const obj = authBypassTokens.get(externalAuthToken) + if (!obj) throw new Error('Cannot authenticate user with unknown bypass token') + + const { expires, user, authName, npmName } = obj + + const now = new Date() + if (now.getTime() > expires.getTime()) { + throw new Error('Cannot authenticate user with an expired external auth token') + } + + if (user.username !== username) { + throw new Error(`Cannot authenticate user ${user.username} with invalid username ${username}`) + } + + logger.info( + 'Auth success with external auth method %s of plugin %s for %s.', + authName, npmName, user.email + ) + + return { + bypass: true, + pluginName: npmName, + authName: authName, + user + } +} + +function isAuthResultValid (npmName: string, authName: string, result: RegisterServerAuthenticatedResult) { + if (!isUserUsernameValid(result.username)) { + logger.error('Auth method %s of plugin %s did not provide a valid username.', authName, npmName, { username: result.username }) + return false + } + + if (!result.email) { + logger.error('Auth method %s of plugin %s did not provide a valid email.', authName, npmName, { email: result.email }) + return false + } + + // role is optional + if (result.role && !isUserRoleValid(result.role)) { + logger.error('Auth method %s of plugin %s did not provide a valid role.', authName, npmName, { role: result.role }) + return false + } + + // display name is optional + if (result.displayName && !isUserDisplayNameValid(result.displayName)) { + logger.error( + 'Auth method %s of plugin %s did not provide a valid display name.', + authName, npmName, { displayName: result.displayName } + ) + return false + } + + return true +} + +function buildUserResult (pluginResult: RegisterServerAuthenticatedResult) { + return { + username: pluginResult.username, + email: pluginResult.email, + role: pluginResult.role ?? UserRole.USER, + displayName: pluginResult.displayName || pluginResult.username + } +} + +// --------------------------------------------------------------------------- + +export { + onExternalUserAuthenticated, + getBypassFromExternalAuth, + getAuthNameFromRefreshGrant, + getBypassFromPasswordGrant +} diff --git a/server/lib/auth/oauth-model.ts b/server/lib/auth/oauth-model.ts new file mode 100644 index 000000000..c74869ee2 --- /dev/null +++ b/server/lib/auth/oauth-model.ts @@ -0,0 +1,245 @@ +import { AccessDeniedError } from 'oauth2-server' +import { PluginManager } from '@server/lib/plugins/plugin-manager' +import { ActorModel } from '@server/models/activitypub/actor' +import { MOAuthClient } from '@server/types/models' +import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token' +import { MUser } from '@server/types/models/user/user' +import { UserAdminFlag } from '@shared/models/users/user-flag.model' +import { UserRole } from '@shared/models/users/user-role' +import { logger } from '../../helpers/logger' +import { CONFIG } from '../../initializers/config' +import { UserModel } from '../../models/account/user' +import { OAuthClientModel } from '../../models/oauth/oauth-client' +import { OAuthTokenModel } from '../../models/oauth/oauth-token' +import { createUserAccountAndChannelAndPlaylist } from '../user' +import { TokensCache } from './tokens-cache' + +type TokenInfo = { + accessToken: string + refreshToken: string + accessTokenExpiresAt: Date + refreshTokenExpiresAt: Date +} + +export type BypassLogin = { + bypass: boolean + pluginName: string + authName?: string + user: { + username: string + email: string + displayName: string + role: UserRole + } +} + +async function getAccessToken (bearerToken: string) { + logger.debug('Getting access token (bearerToken: ' + bearerToken + ').') + + if (!bearerToken) return undefined + + let tokenModel: MOAuthTokenUser + + if (TokensCache.Instance.hasToken(bearerToken)) { + tokenModel = TokensCache.Instance.getByToken(bearerToken) + } else { + tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken) + + if (tokenModel) TokensCache.Instance.setToken(tokenModel) + } + + if (!tokenModel) return undefined + + if (tokenModel.User.pluginAuth) { + const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access') + + if (valid !== true) return undefined + } + + return tokenModel +} + +function getClient (clientId: string, clientSecret: string) { + logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').') + + return OAuthClientModel.getByIdAndSecret(clientId, clientSecret) +} + +async function getRefreshToken (refreshToken: string) { + logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').') + + const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken) + if (!tokenInfo) return undefined + + const tokenModel = tokenInfo.token + + if (tokenModel.User.pluginAuth) { + const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh') + + if (valid !== true) return undefined + } + + return tokenInfo +} + +async function getUser (usernameOrEmail?: string, password?: string, bypassLogin?: BypassLogin) { + // Special treatment coming from a plugin + if (bypassLogin && bypassLogin.bypass === true) { + logger.info('Bypassing oauth login by plugin %s.', bypassLogin.pluginName) + + let user = await UserModel.loadByEmail(bypassLogin.user.email) + if (!user) user = await createUserFromExternal(bypassLogin.pluginName, bypassLogin.user) + + // Cannot create a user + if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.') + + // If the user does not belongs to a plugin, it was created before its installation + // Then we just go through a regular login process + if (user.pluginAuth !== null) { + // This user does not belong to this plugin, skip it + if (user.pluginAuth !== bypassLogin.pluginName) return null + + checkUserValidityOrThrow(user) + + return user + } + } + + logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).') + + const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail) + // If we don't find the user, or if the user belongs to a plugin + if (!user || user.pluginAuth !== null || !password) return null + + const passwordMatch = await user.isPasswordMatch(password) + if (passwordMatch !== true) return null + + checkUserValidityOrThrow(user) + + if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) { + throw new AccessDeniedError('User email is not verified.') + } + + return user +} + +async function revokeToken ( + tokenInfo: { refreshToken: string }, + explicitLogout?: boolean +): Promise<{ success: boolean, redirectUrl?: string }> { + const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken) + + if (token) { + let redirectUrl: string + + if (explicitLogout === true && token.User.pluginAuth && token.authName) { + redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, this.request) + } + + TokensCache.Instance.clearCacheByToken(token.accessToken) + + token.destroy() + .catch(err => logger.error('Cannot destroy token when revoking token.', { err })) + + return { success: true, redirectUrl } + } + + return { success: false } +} + +async function saveToken ( + token: TokenInfo, + client: MOAuthClient, + user: MUser, + options: { + refreshTokenAuthName?: string + bypassLogin?: BypassLogin + } = {} +) { + const { refreshTokenAuthName, bypassLogin } = options + let authName: string = null + + if (bypassLogin?.bypass === true) { + authName = bypassLogin.authName + } else if (refreshTokenAuthName) { + authName = refreshTokenAuthName + } + + logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.') + + const tokenToCreate = { + accessToken: token.accessToken, + accessTokenExpiresAt: token.accessTokenExpiresAt, + refreshToken: token.refreshToken, + refreshTokenExpiresAt: token.refreshTokenExpiresAt, + authName, + oAuthClientId: client.id, + userId: user.id + } + + const tokenCreated = await OAuthTokenModel.create(tokenToCreate) + + user.lastLoginDate = new Date() + await user.save() + + return { + accessToken: tokenCreated.accessToken, + accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt, + refreshToken: tokenCreated.refreshToken, + refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt, + client, + user, + accessTokenExpiresIn: buildExpiresIn(tokenCreated.accessTokenExpiresAt), + refreshTokenExpiresIn: buildExpiresIn(tokenCreated.refreshTokenExpiresAt) + } +} + +export { + getAccessToken, + getClient, + getRefreshToken, + getUser, + revokeToken, + saveToken +} + +// --------------------------------------------------------------------------- + +async function createUserFromExternal (pluginAuth: string, options: { + username: string + email: string + role: UserRole + displayName: string +}) { + // Check an actor does not already exists with that name (removed user) + const actor = await ActorModel.loadLocalByName(options.username) + if (actor) return null + + const userToCreate = new UserModel({ + username: options.username, + password: null, + email: options.email, + nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY, + autoPlayVideo: true, + role: options.role, + videoQuota: CONFIG.USER.VIDEO_QUOTA, + videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY, + adminFlags: UserAdminFlag.NONE, + pluginAuth + }) as MUser + + const { user } = await createUserAccountAndChannelAndPlaylist({ + userToCreate, + userDisplayName: options.displayName + }) + + return user +} + +function checkUserValidityOrThrow (user: MUser) { + if (user.blocked) throw new AccessDeniedError('User is blocked.') +} + +function buildExpiresIn (expiresAt: Date) { + return Math.floor((expiresAt.getTime() - new Date().getTime()) / 1000) +} diff --git a/server/lib/auth/oauth.ts b/server/lib/auth/oauth.ts new file mode 100644 index 000000000..5b6130d56 --- /dev/null +++ b/server/lib/auth/oauth.ts @@ -0,0 +1,180 @@ +import * as express from 'express' +import { + InvalidClientError, + InvalidGrantError, + InvalidRequestError, + Request, + Response, + UnauthorizedClientError, + UnsupportedGrantTypeError +} from 'oauth2-server' +import { randomBytesPromise, sha1 } from '@server/helpers/core-utils' +import { MOAuthClient } from '@server/types/models' +import { OAUTH_LIFETIME } from '../../initializers/constants' +import { BypassLogin, getClient, getRefreshToken, getUser, revokeToken, saveToken } from './oauth-model' + +/** + * + * Reimplement some functions of OAuth2Server to inject external auth methods + * + */ + +const oAuthServer = new (require('oauth2-server'))({ + accessTokenLifetime: OAUTH_LIFETIME.ACCESS_TOKEN, + refreshTokenLifetime: OAUTH_LIFETIME.REFRESH_TOKEN, + + // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications + model: require('./oauth-model') +}) + +// --------------------------------------------------------------------------- + +async function handleOAuthToken (req: express.Request, options: { refreshTokenAuthName?: string, bypassLogin?: BypassLogin }) { + const request = new Request(req) + const { refreshTokenAuthName, bypassLogin } = options + + if (request.method !== 'POST') { + throw new InvalidRequestError('Invalid request: method must be POST') + } + + if (!request.is([ 'application/x-www-form-urlencoded' ])) { + throw new InvalidRequestError('Invalid request: content must be application/x-www-form-urlencoded') + } + + const clientId = request.body.client_id + const clientSecret = request.body.client_secret + + if (!clientId || !clientSecret) { + throw new InvalidClientError('Invalid client: cannot retrieve client credentials') + } + + const client = await getClient(clientId, clientSecret) + if (!client) { + throw new InvalidClientError('Invalid client: client is invalid') + } + + const grantType = request.body.grant_type + if (!grantType) { + throw new InvalidRequestError('Missing parameter: `grant_type`') + } + + if (![ 'password', 'refresh_token' ].includes(grantType)) { + throw new UnsupportedGrantTypeError('Unsupported grant type: `grant_type` is invalid') + } + + if (!client.grants.includes(grantType)) { + throw new UnauthorizedClientError('Unauthorized client: `grant_type` is invalid') + } + + if (grantType === 'password') { + return handlePasswordGrant({ + request, + client, + bypassLogin + }) + } + + return handleRefreshGrant({ + request, + client, + refreshTokenAuthName + }) +} + +async function handleOAuthAuthenticate ( + req: express.Request, + res: express.Response, + authenticateInQuery = false +) { + const options = authenticateInQuery + ? { allowBearerTokensInQueryString: true } + : {} + + return oAuthServer.authenticate(new Request(req), new Response(res), options) +} + +export { + handleOAuthToken, + handleOAuthAuthenticate +} + +// --------------------------------------------------------------------------- + +async function handlePasswordGrant (options: { + request: Request + client: MOAuthClient + bypassLogin?: BypassLogin +}) { + const { request, client, bypassLogin } = options + + if (!request.body.username) { + throw new InvalidRequestError('Missing parameter: `username`') + } + + if (!bypassLogin && !request.body.password) { + throw new InvalidRequestError('Missing parameter: `password`') + } + + const user = await getUser(request.body.username, request.body.password, bypassLogin) + if (!user) throw new InvalidGrantError('Invalid grant: user credentials are invalid') + + const token = await buildToken() + + return saveToken(token, client, user, { bypassLogin }) +} + +async function handleRefreshGrant (options: { + request: Request + client: MOAuthClient + refreshTokenAuthName: string +}) { + const { request, client, refreshTokenAuthName } = options + + if (!request.body.refresh_token) { + throw new InvalidRequestError('Missing parameter: `refresh_token`') + } + + const refreshToken = await getRefreshToken(request.body.refresh_token) + + if (!refreshToken) { + throw new InvalidGrantError('Invalid grant: refresh token is invalid') + } + + if (refreshToken.client.id !== client.id) { + throw new InvalidGrantError('Invalid grant: refresh token is invalid') + } + + if (refreshToken.refreshTokenExpiresAt && refreshToken.refreshTokenExpiresAt < new Date()) { + throw new InvalidGrantError('Invalid grant: refresh token has expired') + } + + await revokeToken({ refreshToken: refreshToken.refreshToken }) + + const token = await buildToken() + + return saveToken(token, client, refreshToken.user, { refreshTokenAuthName }) +} + +function generateRandomToken () { + return randomBytesPromise(256) + .then(buffer => sha1(buffer)) +} + +function getTokenExpiresAt (type: 'access' | 'refresh') { + const lifetime = type === 'access' + ? OAUTH_LIFETIME.ACCESS_TOKEN + : OAUTH_LIFETIME.REFRESH_TOKEN + + return new Date(Date.now() + lifetime * 1000) +} + +async function buildToken () { + const [ accessToken, refreshToken ] = await Promise.all([ generateRandomToken(), generateRandomToken() ]) + + return { + accessToken, + refreshToken, + accessTokenExpiresAt: getTokenExpiresAt('access'), + refreshTokenExpiresAt: getTokenExpiresAt('refresh') + } +} diff --git a/server/lib/auth/tokens-cache.ts b/server/lib/auth/tokens-cache.ts new file mode 100644 index 000000000..b027ce69a --- /dev/null +++ b/server/lib/auth/tokens-cache.ts @@ -0,0 +1,52 @@ +import * as LRUCache from 'lru-cache' +import { MOAuthTokenUser } from '@server/types/models' +import { LRU_CACHE } from '../../initializers/constants' + +export class TokensCache { + + private static instance: TokensCache + + private readonly accessTokenCache = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) + private readonly userHavingToken = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) + + private constructor () { } + + static get Instance () { + return this.instance || (this.instance = new this()) + } + + hasToken (token: string) { + return this.accessTokenCache.has(token) + } + + getByToken (token: string) { + return this.accessTokenCache.get(token) + } + + setToken (token: MOAuthTokenUser) { + this.accessTokenCache.set(token.accessToken, token) + this.userHavingToken.set(token.userId, token.accessToken) + } + + deleteUserToken (userId: number) { + this.clearCacheByUserId(userId) + } + + clearCacheByUserId (userId: number) { + const token = this.userHavingToken.get(userId) + + if (token !== undefined) { + this.accessTokenCache.del(token) + this.userHavingToken.del(userId) + } + } + + clearCacheByToken (token: string) { + const tokenModel = this.accessTokenCache.get(token) + + if (tokenModel !== undefined) { + this.userHavingToken.del(tokenModel.userId) + this.accessTokenCache.del(token) + } + } +} -- cgit v1.2.3