PeerTube/server/lib/auth/external-auth.ts

232 lines
7.1 KiB
TypeScript
Raw Normal View History

import {
isUserAdminFlagsValid,
isUserDisplayNameValid,
isUserRoleValid,
isUserUsernameValid,
isUserVideoQuotaDailyValid,
isUserVideoQuotaValid
} from '@server/helpers/custom-validators/users'
2020-04-22 16:07:04 +02:00
import { logger } from '@server/helpers/logger'
2020-04-28 14:49:03 +02:00
import { generateRandomString } from '@server/helpers/utils'
import { PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME } from '@server/initializers/constants'
2020-04-28 14:49:03 +02:00
import { PluginManager } from '@server/lib/plugins/plugin-manager'
import { OAuthTokenModel } from '@server/models/oauth/oauth-token'
import { MUser } from '@server/types/models'
2020-04-28 14:49:03 +02:00
import {
RegisterServerAuthenticatedResult,
RegisterServerAuthPassOptions,
RegisterServerExternalAuthenticatedResult
2020-06-23 14:10:17 +02:00
} from '@server/types/plugins/register-server-auth.model'
import { UserAdminFlag, UserRole } from '@shared/models'
2022-12-30 10:12:20 +01:00
import { BypassLogin } from './oauth-model'
export type ExternalUser =
Pick<MUser, 'username' | 'email' | 'role' | 'adminFlags' | 'videoQuotaDaily' | 'videoQuota'> &
{ displayName: string }
2020-04-22 16:07:04 +02:00
2020-04-28 14:49:03 +02:00
// Token is the key, expiration date is the value
const authBypassTokens = new Map<string, {
expires: Date
user: ExternalUser
2022-12-30 10:12:20 +01:00
userUpdater: RegisterServerAuthenticatedResult['userUpdater']
2020-04-28 14:49:03 +02:00
authName: string
npmName: string
}>()
2020-04-22 16:07:04 +02:00
2020-04-28 14:49:03 +02:00
async function onExternalUserAuthenticated (options: {
npmName: string
authName: string
authResult: RegisterServerExternalAuthenticatedResult
}) {
const { npmName, authName, authResult } = options
2020-04-28 14:49:03 +02:00
if (!authResult.req || !authResult.res) {
logger.error('Cannot authenticate external user for auth %s of plugin %s: no req or res are provided.', authName, npmName)
return
}
const { res } = authResult
2020-04-30 15:03:09 +02:00
if (!isAuthResultValid(npmName, authName, authResult)) {
res.redirect('/login?externalAuthError=true')
return
}
2020-04-28 14:49:03 +02:00
logger.info('Generating auth bypass token for %s in auth %s of plugin %s.', authResult.username, authName, npmName)
const bypassToken = await generateRandomString(32)
const expires = new Date()
2020-04-29 09:04:42 +02:00
expires.setTime(expires.getTime() + PLUGIN_EXTERNAL_AUTH_TOKEN_LIFETIME)
2020-04-28 14:49:03 +02:00
const user = buildUserResult(authResult)
authBypassTokens.set(bypassToken, {
expires,
user,
npmName,
2022-12-30 10:12:20 +01:00
authName,
userUpdater: authResult.userUpdater
2020-04-28 14:49:03 +02:00
})
2020-05-11 08:40:38 +02:00
// Cleanup expired tokens
2020-05-11 08:40:38 +02:00
const now = new Date()
for (const [ key, value ] of authBypassTokens) {
if (value.expires.getTime() < now.getTime()) {
authBypassTokens.delete(key)
}
}
2020-04-28 14:49:03 +02:00
res.redirect(`/login?externalAuthToken=${bypassToken}&username=${user.username}`)
}
async function getAuthNameFromRefreshGrant (refreshToken?: string) {
if (!refreshToken) return undefined
const tokenModel = await OAuthTokenModel.loadByRefreshToken(refreshToken)
return tokenModel?.authName
}
2022-12-30 10:12:20 +01:00
async function getBypassFromPasswordGrant (username: string, password: string): Promise<BypassLogin> {
2020-04-22 16:07:04 +02:00
const plugins = PluginManager.Instance.getIdAndPassAuths()
const pluginAuths: { npmName?: string, registerAuthOptions: RegisterServerAuthPassOptions }[] = []
for (const plugin of plugins) {
const auths = plugin.idAndPassAuths
for (const auth of auths) {
pluginAuths.push({
npmName: plugin.npmName,
registerAuthOptions: auth
})
}
}
pluginAuths.sort((a, b) => {
const aWeight = a.registerAuthOptions.getWeight()
const bWeight = b.registerAuthOptions.getWeight()
// DESC weight order
2020-04-22 16:07:04 +02:00
if (aWeight === bWeight) return 0
if (aWeight < bWeight) return 1
2020-04-22 16:07:04 +02:00
return -1
})
const loginOptions = {
id: username,
password
2020-04-22 16:07:04 +02:00
}
for (const pluginAuth of pluginAuths) {
const authOptions = pluginAuth.registerAuthOptions
2020-04-27 11:42:01 +02:00
const authName = authOptions.authName
const npmName = pluginAuth.npmName
2020-04-22 16:07:04 +02:00
logger.debug(
'Using auth method %s of plugin %s to login %s with weight %d.',
2020-04-27 11:42:01 +02:00
authName, npmName, loginOptions.id, authOptions.getWeight()
2020-04-22 16:07:04 +02:00
)
2020-04-27 10:19:14 +02:00
try {
const loginResult = await authOptions.login(loginOptions)
2020-04-28 14:49:03 +02:00
if (!loginResult) continue
if (!isAuthResultValid(pluginAuth.npmName, authOptions.authName, loginResult)) continue
logger.info(
'Login success with auth method %s of plugin %s for %s.',
authName, npmName, loginOptions.id
)
return {
2020-04-28 14:49:03 +02:00
bypass: true,
pluginName: pluginAuth.npmName,
authName: authOptions.authName,
2022-12-30 10:12:20 +01:00
user: buildUserResult(loginResult),
userUpdater: loginResult.userUpdater
2020-04-27 10:19:14 +02:00
}
} catch (err) {
logger.error('Error in auth method %s of plugin %s', authOptions.authName, pluginAuth.npmName, { err })
2020-04-22 16:07:04 +02:00
}
}
return undefined
2020-04-22 16:07:04 +02:00
}
2020-04-28 14:49:03 +02:00
2022-12-30 10:12:20 +01:00
function getBypassFromExternalAuth (username: string, externalAuthToken: string): BypassLogin {
const obj = authBypassTokens.get(externalAuthToken)
if (!obj) throw new Error('Cannot authenticate user with unknown bypass token')
2020-04-28 14:49:03 +02:00
const { expires, user, authName, npmName } = obj
const now = new Date()
if (now.getTime() > expires.getTime()) {
throw new Error('Cannot authenticate user with an expired external auth token')
2020-04-28 14:49:03 +02:00
}
if (user.username !== username) {
throw new Error(`Cannot authenticate user ${user.username} with invalid username ${username}`)
2020-04-28 14:49:03 +02:00
}
logger.info(
'Auth success with external auth method %s of plugin %s for %s.',
authName, npmName, user.email
)
return {
2020-04-28 14:49:03 +02:00
bypass: true,
pluginName: npmName,
2022-07-13 11:58:01 +02:00
authName,
2022-12-30 10:12:20 +01:00
userUpdater: obj.userUpdater,
2020-04-28 14:49:03 +02:00
user
}
}
function isAuthResultValid (npmName: string, authName: string, result: RegisterServerAuthenticatedResult) {
const returnError = (field: string) => {
logger.error('Auth method %s of plugin %s did not provide a valid %s.', authName, npmName, field, { [field]: result[field] })
2020-04-28 14:49:03 +02:00
return false
}
if (!isUserUsernameValid(result.username)) return returnError('username')
if (!result.email) return returnError('email')
2020-04-28 14:49:03 +02:00
// Following fields are optional
if (result.role && !isUserRoleValid(result.role)) return returnError('role')
if (result.displayName && !isUserDisplayNameValid(result.displayName)) return returnError('displayName')
if (result.adminFlags && !isUserAdminFlagsValid(result.adminFlags)) return returnError('adminFlags')
if (result.videoQuota && !isUserVideoQuotaValid(result.videoQuota + '')) return returnError('videoQuota')
if (result.videoQuotaDaily && !isUserVideoQuotaDailyValid(result.videoQuotaDaily + '')) return returnError('videoQuotaDaily')
2020-04-28 14:49:03 +02:00
2022-12-30 10:12:20 +01:00
if (result.userUpdater && typeof result.userUpdater !== 'function') {
logger.error('Auth method %s of plugin %s did not provide a valid user updater function.', authName, npmName)
return false
}
2020-04-28 14:49:03 +02:00
return true
}
function buildUserResult (pluginResult: RegisterServerAuthenticatedResult) {
return {
username: pluginResult.username,
email: pluginResult.email,
2020-04-29 09:04:42 +02:00
role: pluginResult.role ?? UserRole.USER,
displayName: pluginResult.displayName || pluginResult.username,
adminFlags: pluginResult.adminFlags ?? UserAdminFlag.NONE,
videoQuota: pluginResult.videoQuota,
videoQuotaDaily: pluginResult.videoQuotaDaily
2020-04-28 14:49:03 +02:00
}
}
// ---------------------------------------------------------------------------
export {
onExternalUserAuthenticated,
getBypassFromExternalAuth,
getAuthNameFromRefreshGrant,
getBypassFromPasswordGrant
}