swaf/src/auth/AuthGuard.ts

133 lines
4.0 KiB
TypeScript
Raw Normal View History

2020-04-24 12:12:27 +02:00
import AuthProof from "./AuthProof";
import MysqlConnectionManager from "../db/MysqlConnectionManager";
import User from "./models/User";
2020-04-25 09:35:49 +02:00
import {Connection} from "mysql";
import {Request} from "express";
import {PENDING_ACCOUNT_REVIEW_MAIL_TEMPLATE} from "../Mails";
import Mail from "../Mail";
import Controller from "../Controller";
import config from "config";
import Application from "../Application";
import NunjucksComponent from "../components/NunjucksComponent";
2020-04-24 12:12:27 +02:00
2020-07-25 10:28:50 +02:00
export default abstract class AuthGuard<P extends AuthProof<User>> {
public constructor(
private readonly app: Application,
) {
}
protected abstract async getProofForSession(session: Express.Session): Promise<P | null>;
2020-04-24 12:12:27 +02:00
protected async getProofForRequest(_req: Request): Promise<P | null> {
return null;
}
public async getProof(req: Request): Promise<P | null> {
let proof = await this.isAuthenticatedViaRequest(req);
if (!proof && req.session) {
proof = await this.isAuthenticated(req.session);
}
return proof;
}
public async isAuthenticated(session: Express.Session): Promise<P | null> {
if (!session.is_authenticated) return null;
const proof = await this.getProofForSession(session);
if (!proof || !await proof.isValid() || !await proof.isAuthorized()) {
await proof?.revoke();
session.is_authenticated = false;
return null;
}
return proof;
}
public async isAuthenticatedViaRequest(req: Request): Promise<P | null> {
const proof = await this.getProofForRequest(req);
if (!proof || !await proof.isValid() || !await proof.isAuthorized()) {
await proof?.revoke();
return null;
}
return proof;
}
2020-07-25 10:28:50 +02:00
public async authenticateOrRegister(
session: Express.Session,
proof: P,
onLogin?: (user: User) => Promise<void>,
onRegister?: (connection: Connection, user: User) => Promise<RegisterCallback[]>,
): Promise<User> {
2020-07-25 10:28:50 +02:00
if (!await proof.isValid()) throw new InvalidAuthProofError();
if (!await proof.isAuthorized()) throw new UnauthorizedAuthProofError();
2020-04-24 12:12:27 +02:00
2020-07-25 10:28:50 +02:00
let user = await proof.getResource();
2020-04-24 12:12:27 +02:00
2020-07-25 10:28:50 +02:00
// Register if user doesn't exist
if (!user) {
const callbacks: RegisterCallback[] = [];
2020-04-24 12:12:27 +02:00
user = await MysqlConnectionManager.wrapTransaction(async connection => {
const user = User.create({});
await user.save(connection, c => callbacks.push(c));
2020-07-25 10:28:50 +02:00
if (onRegister) {
(await onRegister(connection, user)).forEach(c => callbacks.push(c));
}
return user;
2020-04-24 12:12:27 +02:00
});
for (const callback of callbacks) {
await callback();
}
if (!user.isApproved()) {
await new Mail(this.app.as(NunjucksComponent).getEnvironment(), PENDING_ACCOUNT_REVIEW_MAIL_TEMPLATE, {
username: (await user.mainEmail.get())?.getOrFail('email'),
link: config.get<string>('base_url') + Controller.route('accounts-approval'),
}).send(config.get<string>('app.contact_email'));
2020-04-24 12:12:27 +02:00
}
}
2020-07-25 10:28:50 +02:00
// Don't login if user isn't approved
if (!user.isApproved()) {
throw new PendingApprovalAuthError();
}
2020-06-16 11:12:58 +02:00
2020-07-25 10:28:50 +02:00
// Login
session.is_authenticated = true;
2020-07-25 10:28:50 +02:00
if (onLogin) await onLogin(user);
return user;
2020-04-24 12:12:27 +02:00
}
}
export class AuthError extends Error {
2020-04-25 16:08:20 +02:00
}
2020-07-25 10:28:50 +02:00
export class AuthProofError extends AuthError {
}
export class InvalidAuthProofError extends AuthProofError {
public constructor() {
2020-07-25 10:28:50 +02:00
super('Invalid auth proof.');
}
}
2020-04-25 16:08:20 +02:00
2020-07-25 10:28:50 +02:00
export class UnauthorizedAuthProofError extends AuthProofError {
public constructor() {
2020-07-25 10:28:50 +02:00
super('Unauthorized auth proof.');
2020-04-25 16:08:20 +02:00
}
2020-06-16 11:12:58 +02:00
}
export class PendingApprovalAuthError extends AuthError {
public constructor() {
2020-06-16 11:12:58 +02:00
super(`User is not approved.`);
}
}
2020-07-25 10:28:50 +02:00
export type RegisterCallback = () => Promise<void>;