wikijs-fork/server/core/auth.js

415 lines
12 KiB
JavaScript
Raw Normal View History

const passport = require('passport')
const passportJWT = require('passport-jwt')
2018-05-28 18:46:55 +00:00
const _ = require('lodash')
2019-01-07 03:03:34 +00:00
const jwt = require('jsonwebtoken')
const ms = require('ms')
2019-01-07 03:03:34 +00:00
const moment = require('moment')
const Promise = require('bluebird')
const crypto = Promise.promisifyAll(require('crypto'))
const pem2jwk = require('pem-jwk').pem2jwk
2018-08-04 21:27:55 +00:00
const securityHelper = require('../helpers/security')
2018-05-28 18:46:55 +00:00
/* global WIKI */
2017-04-02 23:56:47 +00:00
2017-08-03 03:47:11 +00:00
module.exports = {
strategies: {},
2019-01-07 03:03:34 +00:00
guest: {
cacheExpiration: moment.utc().subtract(1, 'd')
},
2019-01-12 23:33:30 +00:00
groups: {},
validApiKeys: [],
2019-01-07 03:03:34 +00:00
/**
* Initialize the authentication module
*/
init() {
this.passport = passport
2019-01-12 23:33:30 +00:00
passport.serializeUser((user, done) => {
2018-01-10 01:41:53 +00:00
done(null, user.id)
2017-08-03 03:47:11 +00:00
})
2017-04-02 23:56:47 +00:00
2019-01-12 23:33:30 +00:00
passport.deserializeUser(async (id, done) => {
try {
2020-01-25 00:20:53 +00:00
const user = await WIKI.models.users.query().findById(id).withGraphFetched('groups').modifyGraph('groups', builder => {
2019-01-12 23:33:30 +00:00
builder.select('groups.id', 'permissions')
})
if (user) {
done(null, user)
} else {
done(new Error(WIKI.lang.t('auth:errors:usernotfound')), null)
}
2019-01-12 23:33:30 +00:00
} catch (err) {
done(err, null)
2019-01-12 23:33:30 +00:00
}
2017-04-02 23:56:47 +00:00
})
2019-01-12 23:33:30 +00:00
this.reloadGroups()
this.reloadApiKeys()
2019-01-12 23:33:30 +00:00
return this
2018-05-28 18:46:55 +00:00
},
2019-01-07 03:03:34 +00:00
/**
* Load authentication strategies
*/
2018-05-28 18:46:55 +00:00
async activateStrategies() {
try {
// Unload any active strategies
WIKI.auth.strategies = {}
2018-05-28 18:46:55 +00:00
const currentStrategies = _.keys(passport._strategies)
_.pull(currentStrategies, 'session')
_.forEach(currentStrategies, stg => { passport.unuse(stg) })
// Load JWT
passport.use('jwt', new passportJWT.Strategy({
jwtFromRequest: securityHelper.extractJWT,
2018-12-03 02:42:43 +00:00
secretOrKey: WIKI.config.certs.public,
2019-01-07 03:03:34 +00:00
audience: WIKI.config.auth.audience,
issuer: 'urn:wiki.js',
algorithms: ['RS256']
}, (jwtPayload, cb) => {
cb(null, jwtPayload)
}))
// Load enabled strategies
const enabledStrategies = await WIKI.models.authentication.getStrategies()
2018-05-28 18:46:55 +00:00
for (let idx in enabledStrategies) {
const stg = enabledStrategies[idx]
if (!stg.isEnabled) { continue }
try {
const strategy = require(`../modules/authentication/${stg.key}/authentication.js`)
stg.config.callbackURL = `${WIKI.config.host}/login/${stg.key}/callback`
strategy.init(passport, stg.config)
strategy.config = stg.config
WIKI.auth.strategies[stg.key] = {
...strategy,
...stg
}
WIKI.logger.info(`Authentication Strategy ${stg.key}: [ OK ]`)
} catch (err) {
WIKI.logger.error(`Authentication Strategy ${stg.key}: [ FAILED ]`)
WIKI.logger.error(err)
2019-03-19 18:46:10 +00:00
}
2018-05-28 18:46:55 +00:00
}
} catch (err) {
WIKI.logger.error(`Failed to initialize Authentication Strategies: [ ERROR ]`)
2018-05-28 18:46:55 +00:00
WIKI.logger.error(err)
}
2019-01-07 03:03:34 +00:00
},
/**
* Authenticate current request
*
* @param {Express Request} req
* @param {Express Response} res
* @param {Express Next Callback} next
*/
authenticate(req, res, next) {
WIKI.auth.passport.authenticate('jwt', {session: false}, async (err, user, info) => {
if (err) { return next() }
// Expired but still valid within N days, just renew
if (info instanceof Error && info.name === 'TokenExpiredError' &&
moment().subtract(ms(WIKI.config.auth.tokenRenewal), 'ms').isBefore(info.expiredAt)) {
2019-01-07 03:03:34 +00:00
const jwtPayload = jwt.decode(securityHelper.extractJWT(req))
try {
const newToken = await WIKI.models.users.refreshToken(jwtPayload.id)
user = newToken.user
user.permissions = user.getGlobalPermissions()
user.groups = user.getGroups()
req.user = user
2019-01-07 03:03:34 +00:00
// Try headers, otherwise cookies for response
if (req.get('content-type') === 'application/json') {
res.set('new-jwt', newToken.token)
} else {
res.cookie('jwt', newToken.token, { expires: moment().add(365, 'days').toDate() })
}
2019-09-08 16:39:05 +00:00
} catch (errc) {
WIKI.logger.warn(errc)
2019-01-07 03:03:34 +00:00
return next()
}
}
// JWT is NOT valid, set as guest
if (!user) {
if (WIKI.auth.guest.cacheExpiration.isSameOrBefore(moment.utc())) {
2019-01-07 03:03:34 +00:00
WIKI.auth.guest = await WIKI.models.users.getGuestUser()
WIKI.auth.guest.cacheExpiration = moment.utc().add(1, 'm')
}
req.user = WIKI.auth.guest
return next()
}
// Process API tokens
if (_.has(user, 'api')) {
if (!WIKI.config.api.isEnabled) {
return next(new Error('API is disabled. You must enable it from the Administration Area first.'))
} else if (_.includes(WIKI.auth.validApiKeys, user.api)) {
req.user = {
id: 1,
email: 'api@localhost',
name: 'API',
pictureUrl: null,
timezone: 'America/New_York',
localeCode: 'en',
permissions: _.get(WIKI.auth.groups, `${user.grp}.permissions`, []),
groups: [user.grp],
getGlobalPermissions () {
return req.user.permissions
},
getGroups () {
return req.user.groups
}
}
return next()
} else {
return next(new Error('API Key is invalid or was revoked.'))
}
}
2019-01-07 03:03:34 +00:00
// JWT is valid
2019-09-08 16:39:05 +00:00
req.logIn(user, { session: false }, (errc) => {
if (errc) { return next(errc) }
2019-01-07 03:03:34 +00:00
next()
})
})(req, res, next)
},
/**
* Check if user has access to resource
*
* @param {User} user
* @param {Array<String>} permissions
* @param {String|Boolean} path
*/
2019-01-12 23:33:30 +00:00
checkAccess(user, permissions = [], page = false) {
const userPermissions = user.permissions ? user.permissions : user.getGlobalPermissions()
2019-01-07 03:03:34 +00:00
// System Admin
if (_.includes(userPermissions, 'manage:system')) {
2019-01-07 03:03:34 +00:00
return true
}
// Check Global Permissions
2019-01-12 23:33:30 +00:00
if (_.intersection(userPermissions, permissions).length < 1) {
2019-01-07 03:03:34 +00:00
return false
}
// Check Page Rules
2019-10-13 23:59:50 +00:00
if (page && user.groups) {
2019-01-12 23:33:30 +00:00
let checkState = {
deny: false,
match: false,
specificity: ''
}
user.groups.forEach(grp => {
const grpId = _.isObject(grp) ? _.get(grp, 'id', 0) : grp
_.get(WIKI.auth.groups, `${grpId}.pageRules`, []).forEach(rule => {
2020-02-08 03:02:33 +00:00
if (_.intersection(rule.roles, permissions).length > 0) {
switch (rule.match) {
case 'START':
if (_.startsWith(`/${page.path}`, `/${rule.path}`)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['END', 'REGEX', 'EXACT', 'TAG'] })
}
break
case 'END':
if (_.endsWith(page.path, rule.path)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['REGEX', 'EXACT', 'TAG'] })
}
break
case 'REGEX':
const reg = new RegExp(rule.path)
if (reg.test(page.path)) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: ['EXACT', 'TAG'] })
}
break
case 'TAG':
_.get(page, 'tags', []).forEach(tag => {
if (tag.tag === rule.path) {
checkState = this._applyPageRuleSpecificity({
rule,
checkState,
higherPriority: ['EXACT']
})
}
})
break
case 'EXACT':
if (`/${page.path}` === `/${rule.path}`) {
checkState = this._applyPageRuleSpecificity({ rule, checkState, higherPriority: [] })
}
break
}
2019-01-12 23:33:30 +00:00
}
})
})
return (checkState.match && !checkState.deny)
}
2019-01-07 03:03:34 +00:00
return false
2019-01-12 23:33:30 +00:00
},
/**
* Check and apply Page Rule specificity
*
* @access private
*/
_applyPageRuleSpecificity ({ rule, checkState, higherPriority = [] }) {
if (rule.path.length === checkState.specificity.length) {
// Do not override higher priority rules
if (_.includes(higherPriority, checkState.match)) {
return checkState
}
// Do not override a previous DENY rule with same match
if (rule.match === checkState.match && checkState.deny && !rule.deny) {
return checkState
}
} else if (rule.path.length < checkState.specificity.length) {
// Do not override higher specificity rules
return checkState
}
return {
deny: rule.deny,
match: rule.match,
specificity: rule.path
}
},
/**
* Reload Groups from DB
*/
async reloadGroups () {
2019-01-12 23:33:30 +00:00
const groupsArray = await WIKI.models.groups.query()
this.groups = _.keyBy(groupsArray, 'id')
2020-04-20 02:44:51 +00:00
WIKI.auth.guest.cacheExpiration = moment.utc().subtract(1, 'd')
},
/**
* Reload valid API Keys from DB
*/
async reloadApiKeys () {
const keys = await WIKI.models.apiKeys.query().select('id').where('isRevoked', false).andWhere('expiration', '>', moment.utc().toISOString())
this.validApiKeys = _.map(keys, 'id')
},
/**
* Generate New Authentication Public / Private Key Certificates
*/
async regenerateCertificates () {
WIKI.logger.info('Regenerating certificates...')
_.set(WIKI.config, 'sessionSecret', (await crypto.randomBytesAsync(32)).toString('hex'))
const certs = crypto.generateKeyPairSync('rsa', {
modulusLength: 2048,
publicKeyEncoding: {
type: 'pkcs1',
format: 'pem'
},
privateKeyEncoding: {
type: 'pkcs1',
format: 'pem',
cipher: 'aes-256-cbc',
passphrase: WIKI.config.sessionSecret
}
})
_.set(WIKI.config, 'certs', {
jwk: pem2jwk(certs.publicKey),
public: certs.publicKey,
private: certs.privateKey
})
await WIKI.configSvc.saveToDb([
'certs',
'sessionSecret'
])
await WIKI.auth.activateStrategies()
2020-04-20 00:26:26 +00:00
WIKI.events.outbound.emit('reloadAuthStrategies')
WIKI.logger.info('Regenerated certificates: [ COMPLETED ]')
},
/**
* Reset Guest User
*/
async resetGuestUser() {
WIKI.logger.info('Resetting guest account...')
const guestGroup = await WIKI.models.groups.query().where('id', 2).first()
await WIKI.models.users.query().delete().where({
providerKey: 'local',
email: 'guest@example.com'
}).orWhere('id', 2)
const guestUser = await WIKI.models.users.query().insert({
id: 2,
provider: 'local',
email: 'guest@example.com',
name: 'Guest',
password: '',
locale: 'en',
defaultEditor: 'markdown',
tfaIsActive: false,
isSystem: true,
isActive: true,
isVerified: true
})
await guestUser.$relatedQuery('groups').relate(guestGroup.id)
WIKI.logger.info('Guest user has been reset: [ COMPLETED ]')
2020-04-20 00:26:26 +00:00
},
/**
* Subscribe to HA propagation events
*/
subscribeToEvents() {
WIKI.events.inbound.on('reloadGroups', () => {
WIKI.auth.reloadGroups()
})
WIKI.events.inbound.on('reloadApiKeys', () => {
WIKI.auth.reloadApiKeys()
})
WIKI.events.inbound.on('reloadAuthStrategies', () => {
WIKI.auth.activateStrategies()
})
},
/**
* Get all user permissions for a specific page
*/
getEffectivePermissions (req, page) {
return {
comments: {
read: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['read:comments'], page) : false,
write: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['write:comments'], page) : false,
manage: WIKI.config.features.featurePageComments ? WIKI.auth.checkAccess(req.user, ['manage:comments'], page) : false
},
history: {
read: WIKI.auth.checkAccess(req.user, ['read:history'], page)
},
source: {
read: WIKI.auth.checkAccess(req.user, ['read:source'], page)
},
pages: {
read: WIKI.auth.checkAccess(req.user, ['read:pages'], page),
write: WIKI.auth.checkAccess(req.user, ['write:pages'], page),
manage: WIKI.auth.checkAccess(req.user, ['manage:pages'], page),
delete: WIKI.auth.checkAccess(req.user, ['delete:pages'], page),
script: WIKI.auth.checkAccess(req.user, ['write:scripts'], page),
style: WIKI.auth.checkAccess(req.user, ['write:styles'], page)
},
system: {
manage: WIKI.auth.checkAccess(req.user, ['manage:system'], page)
}
}
2017-08-03 03:47:11 +00:00
}
2017-04-02 23:56:47 +00:00
}