wikijs-fork/server/core/auth.js

247 lines
7.2 KiB
JavaScript
Raw Normal View History

const passport = require('passport')
const passportJWT = require('passport-jwt')
const fs = require('fs-extra')
2018-05-28 18:46:55 +00:00
const _ = require('lodash')
const path = require('path')
2019-01-07 03:03:34 +00:00
const jwt = require('jsonwebtoken')
const moment = require('moment')
2018-08-04 21:27:55 +00:00
const securityHelper = require('../helpers/security')
2018-05-28 18:46:55 +00:00
/* global WIKI */
2017-04-02 23:56:47 +00:00
2017-08-03 03:47:11 +00:00
module.exports = {
strategies: {},
2019-01-07 03:03:34 +00:00
guest: {
cacheExpiration: moment.utc().subtract(1, 'd')
},
2019-01-12 23:33:30 +00:00
groups: {},
2019-01-07 03:03:34 +00:00
/**
* Initialize the authentication module
*/
init() {
this.passport = passport
2019-01-12 23:33:30 +00:00
passport.serializeUser((user, done) => {
2018-01-10 01:41:53 +00:00
done(null, user.id)
2017-08-03 03:47:11 +00:00
})
2017-04-02 23:56:47 +00:00
2019-01-12 23:33:30 +00:00
passport.deserializeUser(async (id, done) => {
try {
const user = await WIKI.models.users.query().findById(id).modifyEager('groups', builder => {
builder.select('groups.id', 'permissions')
})
if (user) {
done(null, user)
} else {
done(new Error(WIKI.lang.t('auth:errors:usernotfound')), null)
}
2019-01-12 23:33:30 +00:00
} catch (err) {
done(err, null)
2019-01-12 23:33:30 +00:00
}
2017-04-02 23:56:47 +00:00
})
2019-01-12 23:33:30 +00:00
this.reloadGroups()
return this
2018-05-28 18:46:55 +00:00
},
2019-01-07 03:03:34 +00:00
/**
* Load authentication strategies
*/
2018-05-28 18:46:55 +00:00
async activateStrategies() {
try {
// Unload any active strategies
WIKI.auth.strategies = {}
2018-05-28 18:46:55 +00:00
const currentStrategies = _.keys(passport._strategies)
_.pull(currentStrategies, 'session')
_.forEach(currentStrategies, stg => { passport.unuse(stg) })
// Load JWT
passport.use('jwt', new passportJWT.Strategy({
jwtFromRequest: securityHelper.extractJWT,
2018-12-03 02:42:43 +00:00
secretOrKey: WIKI.config.certs.public,
2019-01-07 03:03:34 +00:00
audience: WIKI.config.auth.audience,
issuer: 'urn:wiki.js'
}, (jwtPayload, cb) => {
cb(null, jwtPayload)
}))
// Load enabled strategies
const enabledStrategies = await WIKI.models.authentication.getStrategies()
2018-05-28 18:46:55 +00:00
for (let idx in enabledStrategies) {
const stg = enabledStrategies[idx]
if (!stg.isEnabled) { continue }
const strategy = require(`../modules/authentication/${stg.key}/authentication.js`)
2019-01-07 03:03:34 +00:00
stg.config.callbackURL = `${WIKI.config.host}/login/${stg.key}/callback`
2018-05-28 18:46:55 +00:00
strategy.init(passport, stg.config)
fs.readFile(path.join(WIKI.ROOTPATH, `assets/svg/auth-icon-${strategy.key}.svg`), 'utf8').then(iconData => {
strategy.icon = iconData
}).catch(err => {
if (err.code === 'ENOENT') {
strategy.icon = '[missing icon]'
} else {
WIKI.logger.warn(err)
}
})
WIKI.auth.strategies[stg.key] = strategy
WIKI.logger.info(`Authentication Strategy ${stg.key}: [ OK ]`)
2018-05-28 18:46:55 +00:00
}
} catch (err) {
WIKI.logger.error(`Authentication Strategy: [ FAILED ]`)
WIKI.logger.error(err)
}
2019-01-07 03:03:34 +00:00
},
/**
* Authenticate current request
*
* @param {Express Request} req
* @param {Express Response} res
* @param {Express Next Callback} next
*/
authenticate(req, res, next) {
WIKI.auth.passport.authenticate('jwt', {session: false}, async (err, user, info) => {
if (err) { return next() }
// Expired but still valid within N days, just renew
if (info instanceof Error && info.name === 'TokenExpiredError' && moment().subtract(14, 'days').isBefore(info.expiredAt)) {
const jwtPayload = jwt.decode(securityHelper.extractJWT(req))
try {
const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
user = newToken.user
req.user = user
2019-01-07 03:03:34 +00:00
// Try headers, otherwise cookies for response
if (req.get('content-type') === 'application/json') {
res.set('new-jwt', newToken.token)
} else {
res.cookie('jwt', newToken.token, { expires: moment().add(365, 'days').toDate() })
}
} catch (err) {
2019-01-12 23:33:30 +00:00
WIKI.logger.warn(err)
2019-01-07 03:03:34 +00:00
return next()
}
}
// JWT is NOT valid, set as guest
if (!user) {
2019-01-12 23:33:30 +00:00
if (true || WIKI.auth.guest.cacheExpiration.isSameOrBefore(moment.utc())) {
2019-01-07 03:03:34 +00:00
WIKI.auth.guest = await WIKI.models.users.getGuestUser()
WIKI.auth.guest.cacheExpiration = moment.utc().add(1, 'm')
}
req.user = WIKI.auth.guest
return next()
}
// JWT is valid
req.logIn(user, { session: false }, (err) => {
if (err) { return next(err) }
next()
})
})(req, res, next)
},
/**
* Check if user has access to resource
*
* @param {User} user
* @param {Array<String>} permissions
* @param {String|Boolean} path
*/
2019-01-12 23:33:30 +00:00
checkAccess(user, permissions = [], page = false) {
const userPermissions = user.permissions ? user.permissions : user.getGlobalPermissions()
2019-01-07 03:03:34 +00:00
// System Admin
if (_.includes(userPermissions, 'manage:system')) {
2019-01-07 03:03:34 +00:00
return true
}
// Check Global Permissions
2019-01-12 23:33:30 +00:00
if (_.intersection(userPermissions, permissions).length < 1) {
2019-01-07 03:03:34 +00:00
return false
}
// Check Page Rules
2019-01-12 23:33:30 +00:00
if (path && user.groups) {
let checkState = {
deny: false,
match: false,
specificity: ''
}
user.groups.forEach(grp => {
const grpId = _.isObject(grp) ? _.get(grp, 'id', 0) : grp
_.get(WIKI.auth.groups, `${grpId}.pageRules`, []).forEach(rule => {
console.info(page.path)
console.info(rule)
switch(rule.match) {
case 'START':
if (_.startsWith(`/${page.path}`, `/${rule.path}`)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['END', 'REGEX', 'EXACT'] })
}
break
case 'END':
if (_.endsWith(page.path, rule.path)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['REGEX', 'EXACT'] })
}
break
case 'REGEX':
const reg = new RegExp(rule.path)
if (reg.test(page.path)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['EXACT'] })
}
case 'EXACT':
if (`/${page.path}` === `/${rule.path}`) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: [] })
}
break
}
})
})
return (checkState.match && !checkState.deny)
}
2019-01-07 03:03:34 +00:00
return false
2019-01-12 23:33:30 +00:00
},
/**
* Check and apply Page Rule specificity
*
* @access private
*/
_applyPageRuleSpecificity ({ rule, checkState, higherPriority = [] }) {
if (rule.path.length === checkState.specificity.length) {
// Do not override higher priority rules
if (_.includes(higherPriority, checkState.match)) {
return checkState
}
// Do not override a previous DENY rule with same match
if (rule.match === checkState.match && checkState.deny && !rule.deny) {
return checkState
}
} else if (rule.path.length < checkState.specificity.length) {
// Do not override higher specificity rules
return checkState
}
return {
deny: rule.deny,
match: rule.match,
specificity: rule.path
}
},
/**
* Reload Groups from DB
*/
async reloadGroups() {
const groupsArray = await WIKI.models.groups.query()
this.groups = _.keyBy(groupsArray, 'id')
2017-08-03 03:47:11 +00:00
}
2017-04-02 23:56:47 +00:00
}