swaf/src/auth/AuthGuard.ts

188 lines
6.2 KiB
TypeScript
Raw Normal View History

2020-04-24 12:12:27 +02:00
import AuthProof from "./AuthProof";
import MysqlConnectionManager from "../db/MysqlConnectionManager";
import User from "./models/User";
2020-04-25 09:35:49 +02:00
import {Connection} from "mysql";
import {Request, Response} from "express";
import {PENDING_ACCOUNT_REVIEW_MAIL_TEMPLATE} from "../Mails";
import Mail from "../mail/Mail";
import Controller from "../Controller";
import config from "config";
import Application from "../Application";
import NunjucksComponent from "../components/NunjucksComponent";
import AuthMethod from "./AuthMethod";
import {Session, SessionData} from "express-session";
export default class AuthGuard {
private readonly authMethods: AuthMethod<AuthProof<User>>[];
2020-04-24 12:12:27 +02:00
public constructor(
private readonly app: Application,
...authMethods: AuthMethod<AuthProof<User>>[]
) {
this.authMethods = authMethods;
}
public async interruptAuth(req: Request, res: Response): Promise<boolean> {
for (const method of this.authMethods) {
if (method.interruptAuth && await method.interruptAuth(req, res)) return true;
}
2020-04-24 12:12:27 +02:00
return false;
}
public getAuthMethodByName(authMethodName: string): AuthMethod<AuthProof<User>> | null {
return this.authMethods.find(m => m.getName() === authMethodName) || null;
}
public getAuthMethodNames(): string[] {
return this.authMethods.map(m => m.getName());
}
public getRegistrationMethod(): AuthMethod<AuthProof<User>> {
return this.authMethods[0];
}
public async getAuthMethodsByIdentifier(
identifier: string,
): Promise<{ user: User, method: AuthMethod<AuthProof<User>> }[]> {
const methods = [];
for (const method of this.authMethods) {
const user = await method.findUserByIdentifier(identifier);
if (user) methods.push({user, method});
}
return methods;
}
public async getProofs(req: Request): Promise<AuthProof<User>[]> {
const proofs = [];
if (req.getSessionOptional()) {
proofs.push(...await this.getProofsForSession(req.session));
}
proofs.push(...await this.getProofsForRequest(req));
return proofs;
}
public async getProofsForSession(session: Session & Partial<SessionData>): Promise<AuthProof<User>[]> {
if (!session.is_authenticated) return [];
const proofs = [];
for (const method of this.authMethods) {
if (method.getProofsForSession) {
const methodProofs = await method.getProofsForSession(session);
for (const proof of methodProofs) {
if (!await proof.isValid() || !await proof.isAuthorized()) {
await proof.revoke();
} else {
proofs.push(proof);
}
}
}
}
if (proofs.length === 0) {
session.is_authenticated = false;
session.persistent = false;
}
return proofs;
}
public async getProofsForRequest(req: Request): Promise<AuthProof<User>[]> {
const proofs = [];
for (const method of this.authMethods) {
if (method.getProofsForRequest) {
const methodProofs = await method.getProofsForRequest(req);
for (const proof of methodProofs) {
if (!await proof.isValid() || !await proof.isAuthorized()) {
await proof.revoke();
} else {
proofs.push(proof);
}
}
}
}
return proofs;
}
2020-07-25 10:28:50 +02:00
public async authenticateOrRegister(
session: Session & Partial<SessionData>,
proof: AuthProof<User>,
persistSession: boolean,
2020-07-25 10:28:50 +02:00
onLogin?: (user: User) => Promise<void>,
beforeRegister?: (connection: Connection, user: User) => Promise<RegisterCallback[]>,
afterRegister?: (connection: Connection, user: User) => Promise<RegisterCallback[]>,
): Promise<User> {
2020-07-25 10:28:50 +02:00
if (!await proof.isValid()) throw new InvalidAuthProofError();
if (!await proof.isAuthorized()) throw new UnauthorizedAuthProofError();
2020-04-24 12:12:27 +02:00
2020-07-25 10:28:50 +02:00
let user = await proof.getResource();
2020-04-24 12:12:27 +02:00
2020-07-25 10:28:50 +02:00
// Register if user doesn't exist
if (!user) {
const callbacks: RegisterCallback[] = [];
2020-04-24 12:12:27 +02:00
user = await MysqlConnectionManager.wrapTransaction(async connection => {
const user = User.create({});
if (beforeRegister) {
(await beforeRegister(connection, user)).forEach(c => callbacks.push(c));
}
await user.save(connection, c => callbacks.push(c));
if (afterRegister) {
(await afterRegister(connection, user)).forEach(c => callbacks.push(c));
}
return user;
2020-04-24 12:12:27 +02:00
});
for (const callback of callbacks) {
await callback();
}
if (!user.isApproved()) {
await new Mail(this.app.as(NunjucksComponent).getEnvironment(), PENDING_ACCOUNT_REVIEW_MAIL_TEMPLATE, {
username: (await user.mainEmail.get())?.getOrFail('email'),
2021-01-21 17:12:59 +01:00
link: config.get<string>('public_url') + Controller.route('accounts-approval'),
}).send(config.get<string>('app.contact_email'));
2020-04-24 12:12:27 +02:00
}
}
2020-07-25 10:28:50 +02:00
// Don't login if user isn't approved
if (!user.isApproved()) {
throw new PendingApprovalAuthError();
}
2020-06-16 11:12:58 +02:00
2020-07-25 10:28:50 +02:00
// Login
session.is_authenticated = true;
session.persistent = persistSession;
2020-07-25 10:28:50 +02:00
if (onLogin) await onLogin(user);
return user;
2020-04-24 12:12:27 +02:00
}
}
export class AuthError extends Error {
2020-04-25 16:08:20 +02:00
}
2020-07-25 10:28:50 +02:00
export class AuthProofError extends AuthError {
}
export class InvalidAuthProofError extends AuthProofError {
public constructor() {
2020-07-25 10:28:50 +02:00
super('Invalid auth proof.');
}
}
2020-04-25 16:08:20 +02:00
2020-07-25 10:28:50 +02:00
export class UnauthorizedAuthProofError extends AuthProofError {
public constructor() {
2020-07-25 10:28:50 +02:00
super('Unauthorized auth proof.');
2020-04-25 16:08:20 +02:00
}
2020-06-16 11:12:58 +02:00
}
export class PendingApprovalAuthError extends AuthError {
public constructor() {
2020-06-16 11:12:58 +02:00
super(`User is not approved.`);
}
}
2020-07-25 10:28:50 +02:00
export type RegisterCallback = () => Promise<void>;