From f43db2f46ee50bacb402a6ef42d768694c2bc9a8 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 12 Mar 2021 15:20:46 +0100 Subject: Refactor auth flow Reimplement some node-oauth2-server methods to remove hacky code needed by our external login workflow --- server/controllers/api/users/index.ts | 8 +- server/controllers/api/users/token.ts | 72 +++++- server/controllers/plugins.ts | 14 +- server/lib/auth.ts | 288 --------------------- server/lib/auth/external-auth.ts | 219 ++++++++++++++++ server/lib/auth/oauth-model.ts | 245 ++++++++++++++++++ server/lib/auth/oauth.ts | 180 +++++++++++++ server/lib/auth/tokens-cache.ts | 52 ++++ server/lib/oauth-model.ts | 254 ------------------ server/lib/plugins/register-helpers.ts | 2 +- server/middlewares/auth.ts | 76 ++++++ server/middlewares/index.ts | 2 +- server/middlewares/oauth.ts | 78 ------ .../validators/videos/video-playlists.ts | 2 +- server/middlewares/validators/videos/videos.ts | 2 +- server/models/account/user-notification-setting.ts | 4 +- server/models/account/user.ts | 4 +- server/models/oauth/oauth-token.ts | 11 +- server/tests/api/check-params/users.ts | 2 +- server/tests/api/users/users.ts | 51 +++- server/tests/plugins/external-auth.ts | 2 +- server/typings/express/index.d.ts | 17 -- 22 files changed, 909 insertions(+), 676 deletions(-) delete mode 100644 server/lib/auth.ts create mode 100644 server/lib/auth/external-auth.ts create mode 100644 server/lib/auth/oauth-model.ts create mode 100644 server/lib/auth/oauth.ts create mode 100644 server/lib/auth/tokens-cache.ts delete mode 100644 server/lib/oauth-model.ts create mode 100644 server/middlewares/auth.ts delete mode 100644 server/middlewares/oauth.ts (limited to 'server') diff --git a/server/controllers/api/users/index.ts b/server/controllers/api/users/index.ts index 3be1d55ae..e2b1ea7cd 100644 --- a/server/controllers/api/users/index.ts +++ b/server/controllers/api/users/index.ts @@ -2,8 +2,10 @@ import * as express from 'express' import * as RateLimit from 'express-rate-limit' import { tokensRouter } from '@server/controllers/api/users/token' import { Hooks } from '@server/lib/plugins/hooks' +import { OAuthTokenModel } from '@server/models/oauth/oauth-token' import { MUser, MUserAccountDefault } from '@server/types/models' import { UserCreate, UserRight, UserRole, UserUpdate } from '../../../../shared' +import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes' import { UserAdminFlag } from '../../../../shared/models/users/user-flag.model' import { UserRegister } from '../../../../shared/models/users/user-register.model' import { auditLoggerFactory, getAuditIdFromRes, UserAuditView } from '../../../helpers/audit-logger' @@ -14,7 +16,6 @@ import { WEBSERVER } from '../../../initializers/constants' import { sequelizeTypescript } from '../../../initializers/database' import { Emailer } from '../../../lib/emailer' import { Notifier } from '../../../lib/notifier' -import { deleteUserToken } from '../../../lib/oauth-model' import { Redis } from '../../../lib/redis' import { createUserAccountAndChannelAndPlaylist, sendVerifyUserEmail } from '../../../lib/user' import { @@ -52,7 +53,6 @@ import { myVideosHistoryRouter } from './my-history' import { myNotificationsRouter } from './my-notifications' import { mySubscriptionsRouter } from './my-subscriptions' import { myVideoPlaylistsRouter } from './my-video-playlists' -import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes' const auditLogger = auditLoggerFactory('users') @@ -335,7 +335,7 @@ async function updateUser (req: express.Request, res: express.Response) { const user = await userToUpdate.save() // Destroy user token to refresh rights - if (roleChanged || body.password !== undefined) await deleteUserToken(userToUpdate.id) + if (roleChanged || body.password !== undefined) await OAuthTokenModel.deleteUserToken(userToUpdate.id) auditLogger.update(getAuditIdFromRes(res), new UserAuditView(user.toFormattedJSON()), oldUserAuditView) @@ -395,7 +395,7 @@ async function changeUserBlock (res: express.Response, user: MUserAccountDefault user.blockedReason = reason || null await sequelizeTypescript.transaction(async t => { - await deleteUserToken(user.id, t) + await OAuthTokenModel.deleteUserToken(user.id, t) await user.save({ transaction: t }) }) diff --git a/server/controllers/api/users/token.ts b/server/controllers/api/users/token.ts index 821429358..3eae28b34 100644 --- a/server/controllers/api/users/token.ts +++ b/server/controllers/api/users/token.ts @@ -1,11 +1,14 @@ -import { handleLogin, handleTokenRevocation } from '@server/lib/auth' +import * as express from 'express' import * as RateLimit from 'express-rate-limit' +import { v4 as uuidv4 } from 'uuid' +import { logger } from '@server/helpers/logger' import { CONFIG } from '@server/initializers/config' -import * as express from 'express' +import { getAuthNameFromRefreshGrant, getBypassFromExternalAuth, getBypassFromPasswordGrant } from '@server/lib/auth/external-auth' +import { handleOAuthToken } from '@server/lib/auth/oauth' +import { BypassLogin, revokeToken } from '@server/lib/auth/oauth-model' import { Hooks } from '@server/lib/plugins/hooks' import { asyncMiddleware, authenticate } from '@server/middlewares' import { ScopedToken } from '@shared/models/users/user-scoped-token' -import { v4 as uuidv4 } from 'uuid' const tokensRouter = express.Router() @@ -16,8 +19,7 @@ const loginRateLimiter = RateLimit({ tokensRouter.post('/token', loginRateLimiter, - handleLogin, - tokenSuccess + asyncMiddleware(handleToken) ) tokensRouter.post('/revoke-token', @@ -42,10 +44,53 @@ export { } // --------------------------------------------------------------------------- -function tokenSuccess (req: express.Request) { - const username = req.body.username +async function handleToken (req: express.Request, res: express.Response, next: express.NextFunction) { + const grantType = req.body.grant_type + + try { + const bypassLogin = await buildByPassLogin(req, grantType) + + const refreshTokenAuthName = grantType === 'refresh_token' + ? await getAuthNameFromRefreshGrant(req.body.refresh_token) + : undefined + + const options = { + refreshTokenAuthName, + bypassLogin + } + + const token = await handleOAuthToken(req, options) + + res.set('Cache-Control', 'no-store') + res.set('Pragma', 'no-cache') + + Hooks.runAction('action:api.user.oauth2-got-token', { username: token.user.username, ip: req.ip }) + + return res.json({ + token_type: 'Bearer', - Hooks.runAction('action:api.user.oauth2-got-token', { username, ip: req.ip }) + access_token: token.accessToken, + refresh_token: token.refreshToken, + + expires_in: token.accessTokenExpiresIn, + refresh_token_expires_in: token.refreshTokenExpiresIn + }) + } catch (err) { + logger.warn('Login error', { err }) + + return res.status(err.code || 400).json({ + code: err.name, + error: err.message + }) + } +} + +async function handleTokenRevocation (req: express.Request, res: express.Response) { + const token = res.locals.oauth.token + + const result = await revokeToken(token, true) + + return res.json(result) } function getScopedTokens (req: express.Request, res: express.Response) { @@ -66,3 +111,14 @@ async function renewScopedTokens (req: express.Request, res: express.Response) { feedToken: user.feedToken } as ScopedToken) } + +async function buildByPassLogin (req: express.Request, grantType: string): Promise { + if (grantType !== 'password') return undefined + + if (req.body.externalAuthToken) { + // Consistency with the getBypassFromPasswordGrant promise + return getBypassFromExternalAuth(req.body.username, req.body.externalAuthToken) + } + + return getBypassFromPasswordGrant(req.body.username, req.body.password) +} diff --git a/server/controllers/plugins.ts b/server/controllers/plugins.ts index 6a1ccc0bf..105f51518 100644 --- a/server/controllers/plugins.ts +++ b/server/controllers/plugins.ts @@ -1,15 +1,15 @@ import * as express from 'express' -import { PLUGIN_GLOBAL_CSS_PATH } from '../initializers/constants' import { join } from 'path' -import { PluginManager, RegisteredPlugin } from '../lib/plugins/plugin-manager' -import { getPluginValidator, pluginStaticDirectoryValidator, getExternalAuthValidator } from '../middlewares/validators/plugins' -import { serveThemeCSSValidator } from '../middlewares/validators/themes' -import { HttpStatusCode } from '../../shared/core-utils/miscs/http-error-codes' +import { logger } from '@server/helpers/logger' +import { optionalAuthenticate } from '@server/middlewares/auth' import { getCompleteLocale, is18nLocale } from '../../shared/core-utils/i18n' +import { HttpStatusCode } from '../../shared/core-utils/miscs/http-error-codes' import { PluginType } from '../../shared/models/plugins/plugin.type' import { isTestInstance } from '../helpers/core-utils' -import { logger } from '@server/helpers/logger' -import { optionalAuthenticate } from '@server/middlewares/oauth' +import { PLUGIN_GLOBAL_CSS_PATH } from '../initializers/constants' +import { PluginManager, RegisteredPlugin } from '../lib/plugins/plugin-manager' +import { getExternalAuthValidator, getPluginValidator, pluginStaticDirectoryValidator } from '../middlewares/validators/plugins' +import { serveThemeCSSValidator } from '../middlewares/validators/themes' const sendFileOptions = { maxAge: '30 days', diff --git a/server/lib/auth.ts b/server/lib/auth.ts deleted file mode 100644 index dbd421a7b..000000000 --- a/server/lib/auth.ts +++ /dev/null @@ -1,288 +0,0 @@ -import { isUserDisplayNameValid, isUserRoleValid, isUserUsernameValid } from '@server/helpers/custom-validators/users' -import { logger } from '@server/helpers/logger' -import { generateRandomString } from '@server/helpers/utils' -import { OAUTH_LIFETIME, PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME } from '@server/initializers/constants' -import { revokeToken } from '@server/lib/oauth-model' -import { PluginManager } from '@server/lib/plugins/plugin-manager' -import { OAuthTokenModel } from '@server/models/oauth/oauth-token' -import { UserRole } from '@shared/models' -import { - RegisterServerAuthenticatedResult, - RegisterServerAuthPassOptions, - RegisterServerExternalAuthenticatedResult -} from '@server/types/plugins/register-server-auth.model' -import * as express from 'express' -import * as OAuthServer from 'express-oauth-server' -import { HttpStatusCode } from '@shared/core-utils/miscs/http-error-codes' - -const oAuthServer = new OAuthServer({ - useErrorHandler: true, - accessTokenLifetime: OAUTH_LIFETIME.ACCESS_TOKEN, - refreshTokenLifetime: OAUTH_LIFETIME.REFRESH_TOKEN, - allowExtendedTokenAttributes: true, - continueMiddleware: true, - model: require('./oauth-model') -}) - -// Token is the key, expiration date is the value -const authBypassTokens = new Map() - -async function handleLogin (req: express.Request, res: express.Response, next: express.NextFunction) { - const grantType = req.body.grant_type - - if (grantType === 'password') { - if (req.body.externalAuthToken) proxifyExternalAuthBypass(req, res) - else await proxifyPasswordGrant(req, res) - } else if (grantType === 'refresh_token') { - await proxifyRefreshGrant(req, res) - } - - return forwardTokenReq(req, res, next) -} - -async function handleTokenRevocation (req: express.Request, res: express.Response) { - const token = res.locals.oauth.token - - res.locals.explicitLogout = true - const result = await revokeToken(token) - - // FIXME: uncomment when https://github.com/oauthjs/node-oauth2-server/pull/289 is released - // oAuthServer.revoke(req, res, err => { - // if (err) { - // logger.warn('Error in revoke token handler.', { err }) - // - // return res.status(err.status) - // .json({ - // error: err.message, - // code: err.name - // }) - // .end() - // } - // }) - - return res.json(result) -} - -async function onExternalUserAuthenticated (options: { - npmName: string - authName: string - authResult: RegisterServerExternalAuthenticatedResult -}) { - const { npmName, authName, authResult } = options - - if (!authResult.req || !authResult.res) { - logger.error('Cannot authenticate external user for auth %s of plugin %s: no req or res are provided.', authName, npmName) - return - } - - const { res } = authResult - - if (!isAuthResultValid(npmName, authName, authResult)) { - res.redirect('/login?externalAuthError=true') - return - } - - logger.info('Generating auth bypass token for %s in auth %s of plugin %s.', authResult.username, authName, npmName) - - const bypassToken = await generateRandomString(32) - - const expires = new Date() - expires.setTime(expires.getTime() + PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME) - - const user = buildUserResult(authResult) - authBypassTokens.set(bypassToken, { - expires, - user, - npmName, - authName - }) - - // Cleanup - const now = new Date() - for (const [ key, value ] of authBypassTokens) { - if (value.expires.getTime() < now.getTime()) { - authBypassTokens.delete(key) - } - } - - res.redirect(`/login?externalAuthToken=${bypassToken}&username=${user.username}`) -} - -// --------------------------------------------------------------------------- - -export { oAuthServer, handleLogin, onExternalUserAuthenticated, handleTokenRevocation } - -// --------------------------------------------------------------------------- - -function forwardTokenReq (req: express.Request, res: express.Response, next?: express.NextFunction) { - return oAuthServer.token()(req, res, err => { - if (err) { - logger.warn('Login error.', { err }) - - return res.status(err.status) - .json({ - error: err.message, - code: err.name - }) - } - - if (next) return next() - }) -} - -async function proxifyRefreshGrant (req: express.Request, res: express.Response) { - const refreshToken = req.body.refresh_token - if (!refreshToken) return - - const tokenModel = await OAuthTokenModel.loadByRefreshToken(refreshToken) - if (tokenModel?.authName) res.locals.refreshTokenAuthName = tokenModel.authName -} - -async function proxifyPasswordGrant (req: express.Request, res: express.Response) { - const plugins = PluginManager.Instance.getIdAndPassAuths() - const pluginAuths: { npmName?: string, registerAuthOptions: RegisterServerAuthPassOptions }[] = [] - - for (const plugin of plugins) { - const auths = plugin.idAndPassAuths - - for (const auth of auths) { - pluginAuths.push({ - npmName: plugin.npmName, - registerAuthOptions: auth - }) - } - } - - pluginAuths.sort((a, b) => { - const aWeight = a.registerAuthOptions.getWeight() - const bWeight = b.registerAuthOptions.getWeight() - - // DESC weight order - if (aWeight === bWeight) return 0 - if (aWeight < bWeight) return 1 - return -1 - }) - - const loginOptions = { - id: req.body.username, - password: req.body.password - } - - for (const pluginAuth of pluginAuths) { - const authOptions = pluginAuth.registerAuthOptions - const authName = authOptions.authName - const npmName = pluginAuth.npmName - - logger.debug( - 'Using auth method %s of plugin %s to login %s with weight %d.', - authName, npmName, loginOptions.id, authOptions.getWeight() - ) - - try { - const loginResult = await authOptions.login(loginOptions) - - if (!loginResult) continue - if (!isAuthResultValid(pluginAuth.npmName, authOptions.authName, loginResult)) continue - - logger.info( - 'Login success with auth method %s of plugin %s for %s.', - authName, npmName, loginOptions.id - ) - - res.locals.bypassLogin = { - bypass: true, - pluginName: pluginAuth.npmName, - authName: authOptions.authName, - user: buildUserResult(loginResult) - } - - return - } catch (err) { - logger.error('Error in auth method %s of plugin %s', authOptions.authName, pluginAuth.npmName, { err }) - } - } -} - -function proxifyExternalAuthBypass (req: express.Request, res: express.Response) { - const obj = authBypassTokens.get(req.body.externalAuthToken) - if (!obj) { - logger.error('Cannot authenticate user with unknown bypass token') - return res.sendStatus(HttpStatusCode.BAD_REQUEST_400) - } - - const { expires, user, authName, npmName } = obj - - const now = new Date() - if (now.getTime() > expires.getTime()) { - logger.error('Cannot authenticate user with an expired external auth token') - return res.sendStatus(HttpStatusCode.BAD_REQUEST_400) - } - - if (user.username !== req.body.username) { - logger.error('Cannot authenticate user %s with invalid username %s.', req.body.username) - return res.sendStatus(HttpStatusCode.BAD_REQUEST_400) - } - - // Bypass oauth library validation - req.body.password = 'fake' - - logger.info( - 'Auth success with external auth method %s of plugin %s for %s.', - authName, npmName, user.email - ) - - res.locals.bypassLogin = { - bypass: true, - pluginName: npmName, - authName: authName, - user - } -} - -function isAuthResultValid (npmName: string, authName: string, result: RegisterServerAuthenticatedResult) { - if (!isUserUsernameValid(result.username)) { - logger.error('Auth method %s of plugin %s did not provide a valid username.', authName, npmName, { username: result.username }) - return false - } - - if (!result.email) { - logger.error('Auth method %s of plugin %s did not provide a valid email.', authName, npmName, { email: result.email }) - return false - } - - // role is optional - if (result.role && !isUserRoleValid(result.role)) { - logger.error('Auth method %s of plugin %s did not provide a valid role.', authName, npmName, { role: result.role }) - return false - } - - // display name is optional - if (result.displayName && !isUserDisplayNameValid(result.displayName)) { - logger.error( - 'Auth method %s of plugin %s did not provide a valid display name.', - authName, npmName, { displayName: result.displayName } - ) - return false - } - - return true -} - -function buildUserResult (pluginResult: RegisterServerAuthenticatedResult) { - return { - username: pluginResult.username, - email: pluginResult.email, - role: pluginResult.role ?? UserRole.USER, - displayName: pluginResult.displayName || pluginResult.username - } -} diff --git a/server/lib/auth/external-auth.ts b/server/lib/auth/external-auth.ts new file mode 100644 index 000000000..80f5064b6 --- /dev/null +++ b/server/lib/auth/external-auth.ts @@ -0,0 +1,219 @@ + +import { isUserDisplayNameValid, isUserRoleValid, isUserUsernameValid } from '@server/helpers/custom-validators/users' +import { logger } from '@server/helpers/logger' +import { generateRandomString } from '@server/helpers/utils' +import { PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME } from '@server/initializers/constants' +import { PluginManager } from '@server/lib/plugins/plugin-manager' +import { OAuthTokenModel } from '@server/models/oauth/oauth-token' +import { + RegisterServerAuthenticatedResult, + RegisterServerAuthPassOptions, + RegisterServerExternalAuthenticatedResult +} from '@server/types/plugins/register-server-auth.model' +import { UserRole } from '@shared/models' + +// Token is the key, expiration date is the value +const authBypassTokens = new Map() + +async function onExternalUserAuthenticated (options: { + npmName: string + authName: string + authResult: RegisterServerExternalAuthenticatedResult +}) { + const { npmName, authName, authResult } = options + + if (!authResult.req || !authResult.res) { + logger.error('Cannot authenticate external user for auth %s of plugin %s: no req or res are provided.', authName, npmName) + return + } + + const { res } = authResult + + if (!isAuthResultValid(npmName, authName, authResult)) { + res.redirect('/login?externalAuthError=true') + return + } + + logger.info('Generating auth bypass token for %s in auth %s of plugin %s.', authResult.username, authName, npmName) + + const bypassToken = await generateRandomString(32) + + const expires = new Date() + expires.setTime(expires.getTime() + PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME) + + const user = buildUserResult(authResult) + authBypassTokens.set(bypassToken, { + expires, + user, + npmName, + authName + }) + + // Cleanup expired tokens + const now = new Date() + for (const [ key, value ] of authBypassTokens) { + if (value.expires.getTime() < now.getTime()) { + authBypassTokens.delete(key) + } + } + + res.redirect(`/login?externalAuthToken=${bypassToken}&username=${user.username}`) +} + +async function getAuthNameFromRefreshGrant (refreshToken?: string) { + if (!refreshToken) return undefined + + const tokenModel = await OAuthTokenModel.loadByRefreshToken(refreshToken) + + return tokenModel?.authName +} + +async function getBypassFromPasswordGrant (username: string, password: string) { + const plugins = PluginManager.Instance.getIdAndPassAuths() + const pluginAuths: { npmName?: string, registerAuthOptions: RegisterServerAuthPassOptions }[] = [] + + for (const plugin of plugins) { + const auths = plugin.idAndPassAuths + + for (const auth of auths) { + pluginAuths.push({ + npmName: plugin.npmName, + registerAuthOptions: auth + }) + } + } + + pluginAuths.sort((a, b) => { + const aWeight = a.registerAuthOptions.getWeight() + const bWeight = b.registerAuthOptions.getWeight() + + // DESC weight order + if (aWeight === bWeight) return 0 + if (aWeight < bWeight) return 1 + return -1 + }) + + const loginOptions = { + id: username, + password + } + + for (const pluginAuth of pluginAuths) { + const authOptions = pluginAuth.registerAuthOptions + const authName = authOptions.authName + const npmName = pluginAuth.npmName + + logger.debug( + 'Using auth method %s of plugin %s to login %s with weight %d.', + authName, npmName, loginOptions.id, authOptions.getWeight() + ) + + try { + const loginResult = await authOptions.login(loginOptions) + + if (!loginResult) continue + if (!isAuthResultValid(pluginAuth.npmName, authOptions.authName, loginResult)) continue + + logger.info( + 'Login success with auth method %s of plugin %s for %s.', + authName, npmName, loginOptions.id + ) + + return { + bypass: true, + pluginName: pluginAuth.npmName, + authName: authOptions.authName, + user: buildUserResult(loginResult) + } + } catch (err) { + logger.error('Error in auth method %s of plugin %s', authOptions.authName, pluginAuth.npmName, { err }) + } + } + + return undefined +} + +function getBypassFromExternalAuth (username: string, externalAuthToken: string) { + const obj = authBypassTokens.get(externalAuthToken) + if (!obj) throw new Error('Cannot authenticate user with unknown bypass token') + + const { expires, user, authName, npmName } = obj + + const now = new Date() + if (now.getTime() > expires.getTime()) { + throw new Error('Cannot authenticate user with an expired external auth token') + } + + if (user.username !== username) { + throw new Error(`Cannot authenticate user ${user.username} with invalid username ${username}`) + } + + logger.info( + 'Auth success with external auth method %s of plugin %s for %s.', + authName, npmName, user.email + ) + + return { + bypass: true, + pluginName: npmName, + authName: authName, + user + } +} + +function isAuthResultValid (npmName: string, authName: string, result: RegisterServerAuthenticatedResult) { + if (!isUserUsernameValid(result.username)) { + logger.error('Auth method %s of plugin %s did not provide a valid username.', authName, npmName, { username: result.username }) + return false + } + + if (!result.email) { + logger.error('Auth method %s of plugin %s did not provide a valid email.', authName, npmName, { email: result.email }) + return false + } + + // role is optional + if (result.role && !isUserRoleValid(result.role)) { + logger.error('Auth method %s of plugin %s did not provide a valid role.', authName, npmName, { role: result.role }) + return false + } + + // display name is optional + if (result.displayName && !isUserDisplayNameValid(result.displayName)) { + logger.error( + 'Auth method %s of plugin %s did not provide a valid display name.', + authName, npmName, { displayName: result.displayName } + ) + return false + } + + return true +} + +function buildUserResult (pluginResult: RegisterServerAuthenticatedResult) { + return { + username: pluginResult.username, + email: pluginResult.email, + role: pluginResult.role ?? UserRole.USER, + displayName: pluginResult.displayName || pluginResult.username + } +} + +// --------------------------------------------------------------------------- + +export { + onExternalUserAuthenticated, + getBypassFromExternalAuth, + getAuthNameFromRefreshGrant, + getBypassFromPasswordGrant +} diff --git a/server/lib/auth/oauth-model.ts b/server/lib/auth/oauth-model.ts new file mode 100644 index 000000000..c74869ee2 --- /dev/null +++ b/server/lib/auth/oauth-model.ts @@ -0,0 +1,245 @@ +import { AccessDeniedError } from 'oauth2-server' +import { PluginManager } from '@server/lib/plugins/plugin-manager' +import { ActorModel } from '@server/models/activitypub/actor' +import { MOAuthClient } from '@server/types/models' +import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token' +import { MUser } from '@server/types/models/user/user' +import { UserAdminFlag } from '@shared/models/users/user-flag.model' +import { UserRole } from '@shared/models/users/user-role' +import { logger } from '../../helpers/logger' +import { CONFIG } from '../../initializers/config' +import { UserModel } from '../../models/account/user' +import { OAuthClientModel } from '../../models/oauth/oauth-client' +import { OAuthTokenModel } from '../../models/oauth/oauth-token' +import { createUserAccountAndChannelAndPlaylist } from '../user' +import { TokensCache } from './tokens-cache' + +type TokenInfo = { + accessToken: string + refreshToken: string + accessTokenExpiresAt: Date + refreshTokenExpiresAt: Date +} + +export type BypassLogin = { + bypass: boolean + pluginName: string + authName?: string + user: { + username: string + email: string + displayName: string + role: UserRole + } +} + +async function getAccessToken (bearerToken: string) { + logger.debug('Getting access token (bearerToken: ' + bearerToken + ').') + + if (!bearerToken) return undefined + + let tokenModel: MOAuthTokenUser + + if (TokensCache.Instance.hasToken(bearerToken)) { + tokenModel = TokensCache.Instance.getByToken(bearerToken) + } else { + tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken) + + if (tokenModel) TokensCache.Instance.setToken(tokenModel) + } + + if (!tokenModel) return undefined + + if (tokenModel.User.pluginAuth) { + const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access') + + if (valid !== true) return undefined + } + + return tokenModel +} + +function getClient (clientId: string, clientSecret: string) { + logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').') + + return OAuthClientModel.getByIdAndSecret(clientId, clientSecret) +} + +async function getRefreshToken (refreshToken: string) { + logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').') + + const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken) + if (!tokenInfo) return undefined + + const tokenModel = tokenInfo.token + + if (tokenModel.User.pluginAuth) { + const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh') + + if (valid !== true) return undefined + } + + return tokenInfo +} + +async function getUser (usernameOrEmail?: string, password?: string, bypassLogin?: BypassLogin) { + // Special treatment coming from a plugin + if (bypassLogin && bypassLogin.bypass === true) { + logger.info('Bypassing oauth login by plugin %s.', bypassLogin.pluginName) + + let user = await UserModel.loadByEmail(bypassLogin.user.email) + if (!user) user = await createUserFromExternal(bypassLogin.pluginName, bypassLogin.user) + + // Cannot create a user + if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.') + + // If the user does not belongs to a plugin, it was created before its installation + // Then we just go through a regular login process + if (user.pluginAuth !== null) { + // This user does not belong to this plugin, skip it + if (user.pluginAuth !== bypassLogin.pluginName) return null + + checkUserValidityOrThrow(user) + + return user + } + } + + logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).') + + const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail) + // If we don't find the user, or if the user belongs to a plugin + if (!user || user.pluginAuth !== null || !password) return null + + const passwordMatch = await user.isPasswordMatch(password) + if (passwordMatch !== true) return null + + checkUserValidityOrThrow(user) + + if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) { + throw new AccessDeniedError('User email is not verified.') + } + + return user +} + +async function revokeToken ( + tokenInfo: { refreshToken: string }, + explicitLogout?: boolean +): Promise<{ success: boolean, redirectUrl?: string }> { + const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken) + + if (token) { + let redirectUrl: string + + if (explicitLogout === true && token.User.pluginAuth && token.authName) { + redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, this.request) + } + + TokensCache.Instance.clearCacheByToken(token.accessToken) + + token.destroy() + .catch(err => logger.error('Cannot destroy token when revoking token.', { err })) + + return { success: true, redirectUrl } + } + + return { success: false } +} + +async function saveToken ( + token: TokenInfo, + client: MOAuthClient, + user: MUser, + options: { + refreshTokenAuthName?: string + bypassLogin?: BypassLogin + } = {} +) { + const { refreshTokenAuthName, bypassLogin } = options + let authName: string = null + + if (bypassLogin?.bypass === true) { + authName = bypassLogin.authName + } else if (refreshTokenAuthName) { + authName = refreshTokenAuthName + } + + logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.') + + const tokenToCreate = { + accessToken: token.accessToken, + accessTokenExpiresAt: token.accessTokenExpiresAt, + refreshToken: token.refreshToken, + refreshTokenExpiresAt: token.refreshTokenExpiresAt, + authName, + oAuthClientId: client.id, + userId: user.id + } + + const tokenCreated = await OAuthTokenModel.create(tokenToCreate) + + user.lastLoginDate = new Date() + await user.save() + + return { + accessToken: tokenCreated.accessToken, + accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt, + refreshToken: tokenCreated.refreshToken, + refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt, + client, + user, + accessTokenExpiresIn: buildExpiresIn(tokenCreated.accessTokenExpiresAt), + refreshTokenExpiresIn: buildExpiresIn(tokenCreated.refreshTokenExpiresAt) + } +} + +export { + getAccessToken, + getClient, + getRefreshToken, + getUser, + revokeToken, + saveToken +} + +// --------------------------------------------------------------------------- + +async function createUserFromExternal (pluginAuth: string, options: { + username: string + email: string + role: UserRole + displayName: string +}) { + // Check an actor does not already exists with that name (removed user) + const actor = await ActorModel.loadLocalByName(options.username) + if (actor) return null + + const userToCreate = new UserModel({ + username: options.username, + password: null, + email: options.email, + nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY, + autoPlayVideo: true, + role: options.role, + videoQuota: CONFIG.USER.VIDEO_QUOTA, + videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY, + adminFlags: UserAdminFlag.NONE, + pluginAuth + }) as MUser + + const { user } = await createUserAccountAndChannelAndPlaylist({ + userToCreate, + userDisplayName: options.displayName + }) + + return user +} + +function checkUserValidityOrThrow (user: MUser) { + if (user.blocked) throw new AccessDeniedError('User is blocked.') +} + +function buildExpiresIn (expiresAt: Date) { + return Math.floor((expiresAt.getTime() - new Date().getTime()) / 1000) +} diff --git a/server/lib/auth/oauth.ts b/server/lib/auth/oauth.ts new file mode 100644 index 000000000..5b6130d56 --- /dev/null +++ b/server/lib/auth/oauth.ts @@ -0,0 +1,180 @@ +import * as express from 'express' +import { + InvalidClientError, + InvalidGrantError, + InvalidRequestError, + Request, + Response, + UnauthorizedClientError, + UnsupportedGrantTypeError +} from 'oauth2-server' +import { randomBytesPromise, sha1 } from '@server/helpers/core-utils' +import { MOAuthClient } from '@server/types/models' +import { OAUTH_LIFETIME } from '../../initializers/constants' +import { BypassLogin, getClient, getRefreshToken, getUser, revokeToken, saveToken } from './oauth-model' + +/** + * + * Reimplement some functions of OAuth2Server to inject external auth methods + * + */ + +const oAuthServer = new (require('oauth2-server'))({ + accessTokenLifetime: OAUTH_LIFETIME.ACCESS_TOKEN, + refreshTokenLifetime: OAUTH_LIFETIME.REFRESH_TOKEN, + + // See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications + model: require('./oauth-model') +}) + +// --------------------------------------------------------------------------- + +async function handleOAuthToken (req: express.Request, options: { refreshTokenAuthName?: string, bypassLogin?: BypassLogin }) { + const request = new Request(req) + const { refreshTokenAuthName, bypassLogin } = options + + if (request.method !== 'POST') { + throw new InvalidRequestError('Invalid request: method must be POST') + } + + if (!request.is([ 'application/x-www-form-urlencoded' ])) { + throw new InvalidRequestError('Invalid request: content must be application/x-www-form-urlencoded') + } + + const clientId = request.body.client_id + const clientSecret = request.body.client_secret + + if (!clientId || !clientSecret) { + throw new InvalidClientError('Invalid client: cannot retrieve client credentials') + } + + const client = await getClient(clientId, clientSecret) + if (!client) { + throw new InvalidClientError('Invalid client: client is invalid') + } + + const grantType = request.body.grant_type + if (!grantType) { + throw new InvalidRequestError('Missing parameter: `grant_type`') + } + + if (![ 'password', 'refresh_token' ].includes(grantType)) { + throw new UnsupportedGrantTypeError('Unsupported grant type: `grant_type` is invalid') + } + + if (!client.grants.includes(grantType)) { + throw new UnauthorizedClientError('Unauthorized client: `grant_type` is invalid') + } + + if (grantType === 'password') { + return handlePasswordGrant({ + request, + client, + bypassLogin + }) + } + + return handleRefreshGrant({ + request, + client, + refreshTokenAuthName + }) +} + +async function handleOAuthAuthenticate ( + req: express.Request, + res: express.Response, + authenticateInQuery = false +) { + const options = authenticateInQuery + ? { allowBearerTokensInQueryString: true } + : {} + + return oAuthServer.authenticate(new Request(req), new Response(res), options) +} + +export { + handleOAuthToken, + handleOAuthAuthenticate +} + +// --------------------------------------------------------------------------- + +async function handlePasswordGrant (options: { + request: Request + client: MOAuthClient + bypassLogin?: BypassLogin +}) { + const { request, client, bypassLogin } = options + + if (!request.body.username) { + throw new InvalidRequestError('Missing parameter: `username`') + } + + if (!bypassLogin && !request.body.password) { + throw new InvalidRequestError('Missing parameter: `password`') + } + + const user = await getUser(request.body.username, request.body.password, bypassLogin) + if (!user) throw new InvalidGrantError('Invalid grant: user credentials are invalid') + + const token = await buildToken() + + return saveToken(token, client, user, { bypassLogin }) +} + +async function handleRefreshGrant (options: { + request: Request + client: MOAuthClient + refreshTokenAuthName: string +}) { + const { request, client, refreshTokenAuthName } = options + + if (!request.body.refresh_token) { + throw new InvalidRequestError('Missing parameter: `refresh_token`') + } + + const refreshToken = await getRefreshToken(request.body.refresh_token) + + if (!refreshToken) { + throw new InvalidGrantError('Invalid grant: refresh token is invalid') + } + + if (refreshToken.client.id !== client.id) { + throw new InvalidGrantError('Invalid grant: refresh token is invalid') + } + + if (refreshToken.refreshTokenExpiresAt && refreshToken.refreshTokenExpiresAt < new Date()) { + throw new InvalidGrantError('Invalid grant: refresh token has expired') + } + + await revokeToken({ refreshToken: refreshToken.refreshToken }) + + const token = await buildToken() + + return saveToken(token, client, refreshToken.user, { refreshTokenAuthName }) +} + +function generateRandomToken () { + return randomBytesPromise(256) + .then(buffer => sha1(buffer)) +} + +function getTokenExpiresAt (type: 'access' | 'refresh') { + const lifetime = type === 'access' + ? OAUTH_LIFETIME.ACCESS_TOKEN + : OAUTH_LIFETIME.REFRESH_TOKEN + + return new Date(Date.now() + lifetime * 1000) +} + +async function buildToken () { + const [ accessToken, refreshToken ] = await Promise.all([ generateRandomToken(), generateRandomToken() ]) + + return { + accessToken, + refreshToken, + accessTokenExpiresAt: getTokenExpiresAt('access'), + refreshTokenExpiresAt: getTokenExpiresAt('refresh') + } +} diff --git a/server/lib/auth/tokens-cache.ts b/server/lib/auth/tokens-cache.ts new file mode 100644 index 000000000..b027ce69a --- /dev/null +++ b/server/lib/auth/tokens-cache.ts @@ -0,0 +1,52 @@ +import * as LRUCache from 'lru-cache' +import { MOAuthTokenUser } from '@server/types/models' +import { LRU_CACHE } from '../../initializers/constants' + +export class TokensCache { + + private static instance: TokensCache + + private readonly accessTokenCache = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) + private readonly userHavingToken = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) + + private constructor () { } + + static get Instance () { + return this.instance || (this.instance = new this()) + } + + hasToken (token: string) { + return this.accessTokenCache.has(token) + } + + getByToken (token: string) { + return this.accessTokenCache.get(token) + } + + setToken (token: MOAuthTokenUser) { + this.accessTokenCache.set(token.accessToken, token) + this.userHavingToken.set(token.userId, token.accessToken) + } + + deleteUserToken (userId: number) { + this.clearCacheByUserId(userId) + } + + clearCacheByUserId (userId: number) { + const token = this.userHavingToken.get(userId) + + if (token !== undefined) { + this.accessTokenCache.del(token) + this.userHavingToken.del(userId) + } + } + + clearCacheByToken (token: string) { + const tokenModel = this.accessTokenCache.get(token) + + if (tokenModel !== undefined) { + this.userHavingToken.del(tokenModel.userId) + this.accessTokenCache.del(token) + } + } +} diff --git a/server/lib/oauth-model.ts b/server/lib/oauth-model.ts deleted file mode 100644 index a2c53a2c9..000000000 --- a/server/lib/oauth-model.ts +++ /dev/null @@ -1,254 +0,0 @@ -import * as express from 'express' -import * as LRUCache from 'lru-cache' -import { AccessDeniedError } from 'oauth2-server' -import { Transaction } from 'sequelize' -import { PluginManager } from '@server/lib/plugins/plugin-manager' -import { ActorModel } from '@server/models/activitypub/actor' -import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token' -import { MUser } from '@server/types/models/user/user' -import { UserAdminFlag } from '@shared/models/users/user-flag.model' -import { UserRole } from '@shared/models/users/user-role' -import { logger } from '../helpers/logger' -import { CONFIG } from '../initializers/config' -import { LRU_CACHE } from '../initializers/constants' -import { UserModel } from '../models/account/user' -import { OAuthClientModel } from '../models/oauth/oauth-client' -import { OAuthTokenModel } from '../models/oauth/oauth-token' -import { createUserAccountAndChannelAndPlaylist } from './user' - -type TokenInfo = { accessToken: string, refreshToken: string, accessTokenExpiresAt: Date, refreshTokenExpiresAt: Date } - -const accessTokenCache = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) -const userHavingToken = new LRUCache({ max: LRU_CACHE.USER_TOKENS.MAX_SIZE }) - -// --------------------------------------------------------------------------- - -function deleteUserToken (userId: number, t?: Transaction) { - clearCacheByUserId(userId) - - return OAuthTokenModel.deleteUserToken(userId, t) -} - -function clearCacheByUserId (userId: number) { - const token = userHavingToken.get(userId) - - if (token !== undefined) { - accessTokenCache.del(token) - userHavingToken.del(userId) - } -} - -function clearCacheByToken (token: string) { - const tokenModel = accessTokenCache.get(token) - - if (tokenModel !== undefined) { - userHavingToken.del(tokenModel.userId) - accessTokenCache.del(token) - } -} - -async function getAccessToken (bearerToken: string) { - logger.debug('Getting access token (bearerToken: ' + bearerToken + ').') - - if (!bearerToken) return undefined - - let tokenModel: MOAuthTokenUser - - if (accessTokenCache.has(bearerToken)) { - tokenModel = accessTokenCache.get(bearerToken) - } else { - tokenModel = await OAuthTokenModel.getByTokenAndPopulateUser(bearerToken) - - if (tokenModel) { - accessTokenCache.set(bearerToken, tokenModel) - userHavingToken.set(tokenModel.userId, tokenModel.accessToken) - } - } - - if (!tokenModel) return undefined - - if (tokenModel.User.pluginAuth) { - const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'access') - - if (valid !== true) return undefined - } - - return tokenModel -} - -function getClient (clientId: string, clientSecret: string) { - logger.debug('Getting Client (clientId: ' + clientId + ', clientSecret: ' + clientSecret + ').') - - return OAuthClientModel.getByIdAndSecret(clientId, clientSecret) -} - -async function getRefreshToken (refreshToken: string) { - logger.debug('Getting RefreshToken (refreshToken: ' + refreshToken + ').') - - const tokenInfo = await OAuthTokenModel.getByRefreshTokenAndPopulateClient(refreshToken) - if (!tokenInfo) return undefined - - const tokenModel = tokenInfo.token - - if (tokenModel.User.pluginAuth) { - const valid = await PluginManager.Instance.isTokenValid(tokenModel, 'refresh') - - if (valid !== true) return undefined - } - - return tokenInfo -} - -async function getUser (usernameOrEmail?: string, password?: string) { - const res: express.Response = this.request.res - - // Special treatment coming from a plugin - if (res.locals.bypassLogin && res.locals.bypassLogin.bypass === true) { - const obj = res.locals.bypassLogin - logger.info('Bypassing oauth login by plugin %s.', obj.pluginName) - - let user = await UserModel.loadByEmail(obj.user.email) - if (!user) user = await createUserFromExternal(obj.pluginName, obj.user) - - // Cannot create a user - if (!user) throw new AccessDeniedError('Cannot create such user: an actor with that name already exists.') - - // If the user does not belongs to a plugin, it was created before its installation - // Then we just go through a regular login process - if (user.pluginAuth !== null) { - // This user does not belong to this plugin, skip it - if (user.pluginAuth !== obj.pluginName) return null - - checkUserValidityOrThrow(user) - - return user - } - } - - logger.debug('Getting User (username/email: ' + usernameOrEmail + ', password: ******).') - - const user = await UserModel.loadByUsernameOrEmail(usernameOrEmail) - // If we don't find the user, or if the user belongs to a plugin - if (!user || user.pluginAuth !== null || !password) return null - - const passwordMatch = await user.isPasswordMatch(password) - if (passwordMatch !== true) return null - - checkUserValidityOrThrow(user) - - if (CONFIG.SIGNUP.REQUIRES_EMAIL_VERIFICATION && user.emailVerified === false) { - throw new AccessDeniedError('User email is not verified.') - } - - return user -} - -async function revokeToken (tokenInfo: { refreshToken: string }): Promise<{ success: boolean, redirectUrl?: string }> { - const res: express.Response = this.request.res - const token = await OAuthTokenModel.getByRefreshTokenAndPopulateUser(tokenInfo.refreshToken) - - if (token) { - let redirectUrl: string - - if (res.locals.explicitLogout === true && token.User.pluginAuth && token.authName) { - redirectUrl = await PluginManager.Instance.onLogout(token.User.pluginAuth, token.authName, token.User, this.request) - } - - clearCacheByToken(token.accessToken) - - token.destroy() - .catch(err => logger.error('Cannot destroy token when revoking token.', { err })) - - return { success: true, redirectUrl } - } - - return { success: false } -} - -async function saveToken (token: TokenInfo, client: OAuthClientModel, user: UserModel) { - const res: express.Response = this.request.res - - let authName: string = null - if (res.locals.bypassLogin?.bypass === true) { - authName = res.locals.bypassLogin.authName - } else if (res.locals.refreshTokenAuthName) { - authName = res.locals.refreshTokenAuthName - } - - logger.debug('Saving token ' + token.accessToken + ' for client ' + client.id + ' and user ' + user.id + '.') - - const tokenToCreate = { - accessToken: token.accessToken, - accessTokenExpiresAt: token.accessTokenExpiresAt, - refreshToken: token.refreshToken, - refreshTokenExpiresAt: token.refreshTokenExpiresAt, - authName, - oAuthClientId: client.id, - userId: user.id - } - - const tokenCreated = await OAuthTokenModel.create(tokenToCreate) - - user.lastLoginDate = new Date() - await user.save() - - return { - accessToken: tokenCreated.accessToken, - accessTokenExpiresAt: tokenCreated.accessTokenExpiresAt, - refreshToken: tokenCreated.refreshToken, - refreshTokenExpiresAt: tokenCreated.refreshTokenExpiresAt, - client, - user, - refresh_token_expires_in: Math.floor((tokenCreated.refreshTokenExpiresAt.getTime() - new Date().getTime()) / 1000) - } -} - -// --------------------------------------------------------------------------- - -// See https://github.com/oauthjs/node-oauth2-server/wiki/Model-specification for the model specifications -export { - deleteUserToken, - clearCacheByUserId, - clearCacheByToken, - getAccessToken, - getClient, - getRefreshToken, - getUser, - revokeToken, - saveToken -} - -async function createUserFromExternal (pluginAuth: string, options: { - username: string - email: string - role: UserRole - displayName: string -}) { - // Check an actor does not already exists with that name (removed user) - const actor = await ActorModel.loadLocalByName(options.username) - if (actor) return null - - const userToCreate = new UserModel({ - username: options.username, - password: null, - email: options.email, - nsfwPolicy: CONFIG.INSTANCE.DEFAULT_NSFW_POLICY, - autoPlayVideo: true, - role: options.role, - videoQuota: CONFIG.USER.VIDEO_QUOTA, - videoQuotaDaily: CONFIG.USER.VIDEO_QUOTA_DAILY, - adminFlags: UserAdminFlag.NONE, - pluginAuth - }) as MUser - - const { user } = await createUserAccountAndChannelAndPlaylist({ - userToCreate, - userDisplayName: options.displayName - }) - - return user -} - -function checkUserValidityOrThrow (user: MUser) { - if (user.blocked) throw new AccessDeniedError('User is blocked.') -} diff --git a/server/lib/plugins/register-helpers.ts b/server/lib/plugins/register-helpers.ts index 1f2a88c27..9b5e1a546 100644 --- a/server/lib/plugins/register-helpers.ts +++ b/server/lib/plugins/register-helpers.ts @@ -7,7 +7,7 @@ import { VIDEO_PLAYLIST_PRIVACIES, VIDEO_PRIVACIES } from '@server/initializers/constants' -import { onExternalUserAuthenticated } from '@server/lib/auth' +import { onExternalUserAuthenticated } from '@server/lib/auth/external-auth' import { PluginModel } from '@server/models/server/plugin' import { RegisterServerAuthExternalOptions, diff --git a/server/middlewares/auth.ts b/server/middlewares/auth.ts new file mode 100644 index 000000000..f38373624 --- /dev/null +++ b/server/middlewares/auth.ts @@ -0,0 +1,76 @@ +import * as express from 'express' +import { Socket } from 'socket.io' +import { getAccessToken } from '@server/lib/auth/oauth-model' +import { HttpStatusCode } from '../../shared/core-utils/miscs/http-error-codes' +import { logger } from '../helpers/logger' +import { handleOAuthAuthenticate } from '../lib/auth/oauth' + +function authenticate (req: express.Request, res: express.Response, next: express.NextFunction, authenticateInQuery = false) { + handleOAuthAuthenticate(req, res, authenticateInQuery) + .then((token: any) => { + res.locals.oauth = { token } + res.locals.authenticated = true + + return next() + }) + .catch(err => { + logger.warn('Cannot authenticate.', { err }) + + return res.status(err.status) + .json({ + error: 'Token is invalid.', + code: err.name + }) + }) +} + +function authenticateSocket (socket: Socket, next: (err?: any) => void) { + const accessToken = socket.handshake.query['accessToken'] + + logger.debug('Checking socket access token %s.', accessToken) + + if (!accessToken) return next(new Error('No access token provided')) + if (typeof accessToken !== 'string') return next(new Error('Access token is invalid')) + + getAccessToken(accessToken) + .then(tokenDB => { + const now = new Date() + + if (!tokenDB || tokenDB.accessTokenExpiresAt < now || tokenDB.refreshTokenExpiresAt < now) { + return next(new Error('Invalid access token.')) + } + + socket.handshake.auth.user = tokenDB.User + + return next() + }) + .catch(err => logger.error('Cannot get access token.', { err })) +} + +function authenticatePromiseIfNeeded (req: express.Request, res: express.Response, authenticateInQuery = false) { + return new Promise(resolve => { + // Already authenticated? (or tried to) + if (res.locals.oauth?.token.User) return resolve() + + if (res.locals.authenticated === false) return res.sendStatus(HttpStatusCode.UNAUTHORIZED_401) + + authenticate(req, res, () => resolve(), authenticateInQuery) + }) +} + +function optionalAuthenticate (req: express.Request, res: express.Response, next: express.NextFunction) { + if (req.header('authorization')) return authenticate(req, res, next) + + res.locals.authenticated = false + + return next() +} + +// --------------------------------------------------------------------------- + +export { + authenticate, + authenticateSocket, + authenticatePromiseIfNeeded, + optionalAuthenticate +} diff --git a/server/middlewares/index.ts b/server/middlewares/index.ts index b758a8586..3e280e16f 100644 --- a/server/middlewares/index.ts +++ b/server/middlewares/index.ts @@ -1,7 +1,7 @@ export * from './validators' export * from './activitypub' export * from './async' -export * from './oauth' +export * from './auth' export * from './pagination' export * from './servers' export * from './sort' diff --git a/server/middlewares/oauth.ts b/server/middlewares/oauth.ts deleted file mode 100644 index 280595acc..000000000 --- a/server/middlewares/oauth.ts +++ /dev/null @@ -1,78 +0,0 @@ -import * as express from 'express' -import { Socket } from 'socket.io' -import { oAuthServer } from '@server/lib/auth' -import { logger } from '../helpers/logger' -import { getAccessToken } from '../lib/oauth-model' -import { HttpStatusCode } from '../../shared/core-utils/miscs/http-error-codes' - -function authenticate (req: express.Request, res: express.Response, next: express.NextFunction, authenticateInQuery = false) { - const options = authenticateInQuery ? { allowBearerTokensInQueryString: true } : {} - - oAuthServer.authenticate(options)(req, res, err => { - if (err) { - logger.warn('Cannot authenticate.', { err }) - - return res.status(err.status) - .json({ - error: 'Token is invalid.', - code: err.name - }) - .end() - } - - res.locals.authenticated = true - - return next() - }) -} - -function authenticateSocket (socket: Socket, next: (err?: any) => void) { - const accessToken = socket.handshake.query['accessToken'] - - logger.debug('Checking socket access token %s.', accessToken) - - if (!accessToken) return next(new Error('No access token provided')) - if (typeof accessToken !== 'string') return next(new Error('Access token is invalid')) - - getAccessToken(accessToken) - .then(tokenDB => { - const now = new Date() - - if (!tokenDB || tokenDB.accessTokenExpiresAt < now || tokenDB.refreshTokenExpiresAt < now) { - return next(new Error('Invalid access token.')) - } - - socket.handshake.auth.user = tokenDB.User - - return next() - }) - .catch(err => logger.error('Cannot get access token.', { err })) -} - -function authenticatePromiseIfNeeded (req: express.Request, res: express.Response, authenticateInQuery = false) { - return new Promise(resolve => { - // Already authenticated? (or tried to) - if (res.locals.oauth?.token.User) return resolve() - - if (res.locals.authenticated === false) return res.sendStatus(HttpStatusCode.UNAUTHORIZED_401) - - authenticate(req, res, () => resolve(), authenticateInQuery) - }) -} - -function optionalAuthenticate (req: express.Request, res: express.Response, next: express.NextFunction) { - if (req.header('authorization')) return authenticate(req, res, next) - - res.locals.authenticated = false - - return next() -} - -// --------------------------------------------------------------------------- - -export { - authenticate, - authenticateSocket, - authenticatePromiseIfNeeded, - optionalAuthenticate -} diff --git a/server/middlewares/validators/videos/video-playlists.ts b/server/middlewares/validators/videos/video-playlists.ts index 0fba4f5fd..c872d045e 100644 --- a/server/middlewares/validators/videos/video-playlists.ts +++ b/server/middlewares/validators/videos/video-playlists.ts @@ -29,7 +29,7 @@ import { doesVideoChannelIdExist, doesVideoExist, doesVideoPlaylistExist, VideoP import { CONSTRAINTS_FIELDS } from '../../../initializers/constants' import { VideoPlaylistElementModel } from '../../../models/video/video-playlist-element' import { MVideoPlaylist } from '../../../types/models/video/video-playlist' -import { authenticatePromiseIfNeeded } from '../../oauth' +import { authenticatePromiseIfNeeded } from '../../auth' import { areValidationErrors } from '../utils' const videoPlaylistsAddValidator = getCommonPlaylistEditAttributes().concat([ diff --git a/server/middlewares/validators/videos/videos.ts b/server/middlewares/validators/videos/videos.ts index 37cc07b94..4d31d3dcb 100644 --- a/server/middlewares/validators/videos/videos.ts +++ b/server/middlewares/validators/videos/videos.ts @@ -54,7 +54,7 @@ import { isLocalVideoAccepted } from '../../../lib/moderation' import { Hooks } from '../../../lib/plugins/hooks' import { AccountModel } from '../../../models/account/account' import { VideoModel } from '../../../models/video/video' -import { authenticatePromiseIfNeeded } from '../../oauth' +import { authenticatePromiseIfNeeded } from '../../auth' import { areValidationErrors } from '../utils' const videosAddValidator = getCommonVideoEditAttributes().concat([ diff --git a/server/models/account/user-notification-setting.ts b/server/models/account/user-notification-setting.ts index de1501299..138051528 100644 --- a/server/models/account/user-notification-setting.ts +++ b/server/models/account/user-notification-setting.ts @@ -12,10 +12,10 @@ import { Table, UpdatedAt } from 'sequelize-typescript' +import { TokensCache } from '@server/lib/auth/tokens-cache' import { MNotificationSettingFormattable } from '@server/types/models' import { UserNotificationSetting, UserNotificationSettingValue } from '../../../shared/models/users/user-notification-setting.model' import { isUserNotificationSettingValid } from '../../helpers/custom-validators/user-notifications' -import { clearCacheByUserId } from '../../lib/oauth-model' import { throwIfNotValid } from '../utils' import { UserModel } from './user' @@ -195,7 +195,7 @@ export class UserNotificationSettingModel extends Model { @AfterUpdate @AfterDestroy static removeTokenCache (instance: UserNotificationSettingModel) { - return clearCacheByUserId(instance.userId) + return TokensCache.Instance.clearCacheByUserId(instance.userId) } toFormattedJSON (this: MNotificationSettingFormattable): UserNotificationSetting { diff --git a/server/models/account/user.ts b/server/models/account/user.ts index c1f22b76a..a7a65c489 100644 --- a/server/models/account/user.ts +++ b/server/models/account/user.ts @@ -21,6 +21,7 @@ import { Table, UpdatedAt } from 'sequelize-typescript' +import { TokensCache } from '@server/lib/auth/tokens-cache' import { MMyUserFormattable, MUser, @@ -58,7 +59,6 @@ import { } from '../../helpers/custom-validators/users' import { comparePassword, cryptPassword } from '../../helpers/peertube-crypto' import { DEFAULT_USER_THEME_NAME, NSFW_POLICY_TYPES } from '../../initializers/constants' -import { clearCacheByUserId } from '../../lib/oauth-model' import { getThemeOrDefault } from '../../lib/plugins/theme-utils' import { ActorModel } from '../activitypub/actor' import { ActorFollowModel } from '../activitypub/actor-follow' @@ -411,7 +411,7 @@ export class UserModel extends Model { @AfterUpdate @AfterDestroy static removeTokenCache (instance: UserModel) { - return clearCacheByUserId(instance.id) + return TokensCache.Instance.clearCacheByUserId(instance.id) } static countTotal () { diff --git a/server/models/oauth/oauth-token.ts b/server/models/oauth/oauth-token.ts index 6bc6cf27c..27e643aa7 100644 --- a/server/models/oauth/oauth-token.ts +++ b/server/models/oauth/oauth-token.ts @@ -12,9 +12,10 @@ import { Table, UpdatedAt } from 'sequelize-typescript' +import { TokensCache } from '@server/lib/auth/tokens-cache' +import { MUserAccountId } from '@server/types/models' import { MOAuthTokenUser } from '@server/types/models/oauth/oauth-token' import { logger } from '../../helpers/logger' -import { clearCacheByToken } from '../../lib/oauth-model' import { AccountModel } from '../account/account' import { UserModel } from '../account/user' import { ActorModel } from '../activitypub/actor' @@ -26,9 +27,7 @@ export type OAuthTokenInfo = { client: { id: number } - user: { - id: number - } + user: MUserAccountId token: MOAuthTokenUser } @@ -133,7 +132,7 @@ export class OAuthTokenModel extends Model { @AfterUpdate @AfterDestroy static removeTokenCache (token: OAuthTokenModel) { - return clearCacheByToken(token.accessToken) + return TokensCache.Instance.clearCacheByToken(token.accessToken) } static loadByRefreshToken (refreshToken: string) { @@ -206,6 +205,8 @@ export class OAuthTokenModel extends Model { } static deleteUserToken (userId: number, t?: Transaction) { + TokensCache.Instance.deleteUserToken(userId) + const query = { where: { userId diff --git a/server/tests/api/check-params/users.ts b/server/tests/api/check-params/users.ts index 0a13f5b67..2b03fde2d 100644 --- a/server/tests/api/check-params/users.ts +++ b/server/tests/api/check-params/users.ts @@ -241,7 +241,7 @@ describe('Test users API validators', function () { }) it('Should succeed with no password on a server with smtp enabled', async function () { - this.timeout(10000) + this.timeout(20000) killallServers([ server ]) diff --git a/server/tests/api/users/users.ts b/server/tests/api/users/users.ts index 62a59033f..cea98aac7 100644 --- a/server/tests/api/users/users.ts +++ b/server/tests/api/users/users.ts @@ -4,10 +4,12 @@ import 'mocha' import * as chai from 'chai' import { AbuseState, AbuseUpdate, MyUser, User, UserRole, Video, VideoPlaylistType } from '@shared/models' import { CustomConfig } from '@shared/models/server' +import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes' import { addVideoCommentThread, blockUser, cleanupTests, + closeAllSequelize, createUser, deleteMe, flushAndRunServer, @@ -24,6 +26,7 @@ import { getVideoChannel, getVideosList, installPlugin, + killallServers, login, makePutBodyRequest, rateVideo, @@ -31,7 +34,9 @@ import { removeUser, removeVideo, reportAbuse, + reRunServer, ServerInfo, + setTokenField, testImage, unblockUser, updateAbuse, @@ -44,10 +49,9 @@ import { waitJobs } from '../../../../shared/extra-utils' import { follow } from '../../../../shared/extra-utils/server/follows' -import { logout, serverLogin, setAccessTokensToServers } from '../../../../shared/extra-utils/users/login' +import { logout, refreshToken, setAccessTokensToServers } from '../../../../shared/extra-utils/users/login' import { getMyVideos } from '../../../../shared/extra-utils/videos/videos' import { UserAdminFlag } from '../../../../shared/models/users/user-flag.model' -import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes' const expect = chai.expect @@ -89,6 +93,7 @@ describe('Test users', function () { const client = { id: 'client', secret: server.client.secret } const res = await login(server.url, client, server.user, HttpStatusCode.BAD_REQUEST_400) + expect(res.body.code).to.equal('invalid_client') expect(res.body.error).to.contain('client is invalid') }) @@ -96,6 +101,7 @@ describe('Test users', function () { const client = { id: server.client.id, secret: 'coucou' } const res = await login(server.url, client, server.user, HttpStatusCode.BAD_REQUEST_400) + expect(res.body.code).to.equal('invalid_client') expect(res.body.error).to.contain('client is invalid') }) }) @@ -106,6 +112,7 @@ describe('Test users', function () { const user = { username: 'captain crochet', password: server.user.password } const res = await login(server.url, server.client, user, HttpStatusCode.BAD_REQUEST_400) + expect(res.body.code).to.equal('invalid_grant') expect(res.body.error).to.contain('credentials are invalid') }) @@ -113,6 +120,7 @@ describe('Test users', function () { const user = { username: server.user.username, password: 'mew_three' } const res = await login(server.url, server.client, user, HttpStatusCode.BAD_REQUEST_400) + expect(res.body.code).to.equal('invalid_grant') expect(res.body.error).to.contain('credentials are invalid') }) @@ -245,12 +253,44 @@ describe('Test users', function () { }) it('Should be able to login again', async function () { - server.accessToken = await serverLogin(server) + const res = await login(server.url, server.client, server.user) + server.accessToken = res.body.access_token + server.refreshToken = res.body.refresh_token + }) + + it('Should be able to get my user information again', async function () { + await getMyUserInformation(server.url, server.accessToken) + }) + + it('Should have an expired access token', async function () { + this.timeout(15000) + + await setTokenField(server.internalServerNumber, server.accessToken, 'accessTokenExpiresAt', new Date().toISOString()) + await setTokenField(server.internalServerNumber, server.accessToken, 'refreshTokenExpiresAt', new Date().toISOString()) + + killallServers([ server ]) + await reRunServer(server) + + await getMyUserInformation(server.url, server.accessToken, 401) + }) + + it('Should not be able to refresh an access token with an expired refresh token', async function () { + await refreshToken(server, server.refreshToken, 400) }) - it('Should have an expired access token') + it('Should refresh the token', async function () { + this.timeout(15000) + + const futureDate = new Date(new Date().getTime() + 1000 * 60).toISOString() + await setTokenField(server.internalServerNumber, server.accessToken, 'refreshTokenExpiresAt', futureDate) - it('Should refresh the token') + killallServers([ server ]) + await reRunServer(server) + + const res = await refreshToken(server, server.refreshToken) + server.accessToken = res.body.access_token + server.refreshToken = res.body.refresh_token + }) it('Should be able to get my user information again', async function () { await getMyUserInformation(server.url, server.accessToken) @@ -976,6 +1016,7 @@ describe('Test users', function () { }) after(async function () { + await closeAllSequelize([ server ]) await cleanupTests([ server ]) }) }) diff --git a/server/tests/plugins/external-auth.ts b/server/tests/plugins/external-auth.ts index a1b5e8f5d..5addb45c7 100644 --- a/server/tests/plugins/external-auth.ts +++ b/server/tests/plugins/external-auth.ts @@ -137,7 +137,7 @@ describe('Test external auth plugins', function () { await loginUsingExternalToken(server, 'cyan', externalAuthToken, HttpStatusCode.BAD_REQUEST_400) - await waitUntilLog(server, 'expired external auth token') + await waitUntilLog(server, 'expired external auth token', 2) }) it('Should auto login Cyan, create the user and use the token', async function () { diff --git a/server/typings/express/index.d.ts b/server/typings/express/index.d.ts index 66acfb3f5..b0004dc7b 100644 --- a/server/typings/express/index.d.ts +++ b/server/typings/express/index.d.ts @@ -17,7 +17,6 @@ import { MPlugin, MServer, MServerBlocklist } from '@server/types/models/server' import { MVideoImportDefault } from '@server/types/models/video/video-import' import { MVideoPlaylistElement, MVideoPlaylistElementVideoUrlPlaylistPrivacy } from '@server/types/models/video/video-playlist-element' import { MAccountVideoRateAccountVideo } from '@server/types/models/video/video-rate' -import { UserRole } from '@shared/models' import { RegisteredPlugin } from '../../lib/plugins/plugin-manager' import { MAccountDefault, @@ -49,22 +48,6 @@ declare module 'express' { } interface PeerTubeLocals { - bypassLogin?: { - bypass: boolean - pluginName: string - authName?: string - user: { - username: string - email: string - displayName: string - role: UserRole - } - } - - refreshTokenAuthName?: string - - explicitLogout?: boolean - videoAll?: MVideoFullLight onlyImmutableVideo?: MVideoImmutable onlyVideo?: MVideoThumbnail -- cgit v1.2.3