@blazedpath/commons 0.3.1 → 0.4.0

package/blz-security/middleware/HapiServerSimToken.js

@@ -0,0 +1,286 @@
+/**
+ * @author Blazedpath Team
+ * @implements Protecting all resources through hapi middleware
+ * @description Hapi.js (derived from Http-API) is an open-source Node.js
+ * framework used to build powerful and scalable web applications.
+ * @see https://hapi.dev/api/
+ */
+const {
+    Exception,
+    getFullUrl,
+    getHost,
+    getPathname,
+    getTokenTolerance,
+    trace
+} = require('../helpers/utils')
+
+// Uses Issue to cache manage and logout (generators/customs not sure why yet)
+const {
+    Issuer
+} = require('openid-client') // OpenID Certified Relying Party.
+
+// Self sign library
+const jwToken = require('jsonwebtoken');
+
+let securityService = null
+
+class HapiServerSimToken {
+    constructor(openIdConnect, cookiesName, cache) {
+        this.openIdConnect = openIdConnect
+        this.COOKIE_NAMES = cookiesName
+        this.authServerConfig = null;
+        // This cache stores locally the jwt token set for refresh and logout.
+        this.cache = cache;
+        // To terminate sessions
+        this.clientOidc = null;
+    }
+
+    async connect(_securityService, hapiServer, config) {
+        this.authServerConfig = config;
+        securityService = _securityService
+        const stateOption = {
+            clearInvalid: true,
+            encoding: 'base64',
+            isSecure: true,
+            isHttpOnly: true,
+            isSameSite: 'Lax',
+            path: '/',
+            strictHeader: true
+        }
+        hapiServer.config = config
+        hapiServer.state(this.COOKIE_NAMES.ACCESS_TOKEN, stateOption)
+        this.authServerSimulation(hapiServer)
+    }
+
+    authServerSimulation(hapiServer) {
+        if (!hapiServer.config || !hapiServer.config.accessTokenSimulation) {
+            throw new Exception('Error parsing metadata for simulation', 'ConfigurationError', 404)
+        }
+        let {
+            simaAlgorithm,
+            payload,
+            secret
+        } = hapiServer.config.accessTokenSimulation
+        const me = this
+        hapiServer.ext('onPreAuth', async function(request, h) {
+            if (request.state && request.state[me.COOKIE_NAMES.ACCESS_TOKEN]) {
+                return h.continue
+            } else {
+                switch (simaAlgorithm) {
+                    case 'HMAC-SHA384': {
+                        simaAlgorithm = 'HS384'
+                        break
+                    }
+                    case 'HMAC-SHA512': {
+                        simaAlgorithm = 'HS512'
+                        break
+                    }
+                    default: {
+                        simaAlgorithm = 'HS256'
+                    }
+                }
+                const token = jwToken.sign(payload, secret, { expiresIn: '1h', algorithm: simaAlgorithm });
+                return h
+                    .response()
+                    .state(me.COOKIE_NAMES.ACCESS_TOKEN, token)
+                    .redirect(getFullUrl(request))
+                    .takeover()
+            }
+        })
+        // /get-authorization
+        hapiServer.route({
+            path: '/get-authorization',
+            method: 'GET',
+            handler: async function(_request, h) {
+                return h
+                    .response('[]')
+                    .code(200)
+            }
+        })
+        // /get-security-rules
+        hapiServer.route({
+            path: '/get-security-rules',
+            method: 'GET',
+            handler: async function(_request, h) {
+                let securityRules = []
+                if (securityService && hapiServer.config.accessTokenSimulation.playload) {
+                    const groups = securityService.getGroups(hapiServer.config.accessTokenSimulation.playload)
+                    securityRules = securityService.getFrontendSecurityRules([groups])
+                }
+                return h
+                    .response(JSON.stringify(securityRules))
+                    .code(200)
+            }
+        })
+        // /get-permissions
+        hapiServer.route({
+            path: '/get-permissions',
+            method: 'GET',
+            handler: async function(_request, h) {
+                const permissions = (securityService) ? securityService.getPermissions() : []
+                return h
+                    .response(JSON.stringify(permissions))
+                    .code(200)
+            }
+        })
+
+        hapiServer.route({
+            method: 'GET',
+            path: '/check-authorize',
+            handler: async (request, h) => {
+              try {
+                const resourcePath = request.query.path;
+                const action = request.query.action;
+                const roles = request.query.roles;
+                const domains = request.query.domains;
+                let parsedRoles;
+                if (Array.isArray(roles)) {
+                  parsedRoles = roles;
+                } else if (typeof roles === 'string') {
+                  parsedRoles = roles.split(',').map(r => r.trim());
+                } else {
+                  parsedRoles = [];
+                }
+                let parsedDomains;
+                if (Array.isArray(domains)) {
+                  parsedDomains = domains;
+                } else if (typeof domains === 'string') {
+                  parsedDomains = domains.split(',').map(d => d.trim());
+                } else {
+                  parsedDomains = [];
+                }
+                const result = await securityService.checkAuthorize(
+                  resourcePath,
+                  action,
+                  parsedRoles,
+                  parsedDomains
+                );
+                return h.response(JSON.stringify(result)).takeover()
+              } catch (err) {
+                return errorResponse(h, err, 401)
+              }
+            }
+          })
+
+        // /get-user-info
+        hapiServer.route({
+            path: '/get-user-info',
+            method: 'GET',
+            handler: async function(_request, h) {
+                return h
+                    .response(JSON.stringify(payload))
+                    .code(200)
+            }
+        })
+        // /logout
+        hapiServer.route({
+            path: '/logout',
+            method: 'GET',
+            handler: async function(_request, h) {
+                return h
+                    .response()
+                    .unstate(me.COOKIE_NAMES.ACCESS_TOKEN)
+                    .takeover()
+            }
+        })
+    }
+    async authenticate(h, scope) {
+        const {
+            request
+        } = h
+        const pkceCode = await this.openIdConnect.pkceCode()
+        const requestUrl = getFullUrl(request)
+        let oidcMetadata = await this.openIdConnect.oidcMetadata()
+        if (!oidcMetadata || !oidcMetadata.openid_configuration) {
+            oidcMetadata = await this.configuration(this.authServerConfig.authServer)
+        }
+        if (requestUrl.match(new RegExp(/^(https?:\/{2}.*):?(\d*)/.source + getHost(request) + /\/?$/.source))) {
+            const authorizationUrl = await this.openIdConnect.authorizationUrl({
+                scope,
+                redirectUri: getFullUrl(request),
+                pkceCode
+            })
+            trace('INFO', `Authenticate redirecting to ${authorizationUrl}`)
+            return h
+                .response()
+                .state(this.COOKIE_NAMES.SID, pkceCode)
+                .redirect(authorizationUrl)
+                .takeover()
+        } else if (getPathname(request) === '/logout') {
+            return h.continue
+        } else {
+            const tokenSet = await this.openIdConnect.tokenSet()
+            const {
+                state
+            } = request
+            if (tokenSet && state && state[this.COOKIE_NAMES.SESSION_STATE]) {
+                const tokens = await tokenSet.tokens(state[this.COOKIE_NAMES.SESSION_STATE])
+                if (!tokens || tokens.refresh_expires_in <= getTokenTolerance(0)) {
+                    throw new Exception('Error when getting token', 'ExpirationError', 403)
+                }
+                return h.continue
+            } else {
+                return h
+                    .response()
+                    .code(401)
+                    .takeover()
+            }
+        }
+    }
+    oidcMetadataKey() {
+        return this.authServerConfig.authServer.sessionCookiesDomain || 'oidcMetadata'
+    }
+    async configuration(authServer) {
+        if (!authServer) {
+            throw new Exception('Error when getting configuration attributes ')
+        }
+        const {
+            clientId,
+            clientSecret
+        } = authServer
+        await this.openIdConnect.client({
+            clientId,
+            clientSecret
+        })
+        if (authServer.openIdConfigurationEndpoint) {
+            return await this.openIdConnect.configuration(authServer.openIdConfigurationEndpoint)
+        } else {
+            // If configuration uri does not exist but the auth server form has been filled in.
+            return await this.openIdConnect.configuration({
+                issuer: authServer.issuer,
+                authorization_endpoint: authServer.authorizationEndpoint,
+                token_endpoint: authServer.tokenEndpoint,
+                userinfo_endpoint: authServer.userinfoEndpoint,
+                end_session_endpoint: authServer.endSessionEndpoint,
+                jwks_uri: authServer.jwksUri
+            })
+        }
+    }
+    async configuration(context) {
+        let metadata = await this.cache.get(this.oidcMetadataKey())
+        if (typeof context === 'string' && !context.match(/(https?:\/\/.*):?(\d*)\/?(.*)/gi)) {
+            throw new Exception('Wrong OpenId Provider configuration URI entered', 'AttributeError', 403)
+        }
+        if (!metadata || !metadata.issuer) {
+            if (context.issuer) {
+                metadata = {
+                    ...(metadata || {}),
+                    ...context
+                }
+            } else {
+                metadata = metadata || {}
+                metadata.openid_configuration = context
+                metadata = {
+                    ...metadata,
+                    ...(await Issuer.discover(context.issuer))
+                } // Discover an issuer configuration, must be an url
+            }
+            await this.cache.set(this.oidcMetadataKey(), metadata, 864e5) // 1 day of cache
+        }
+        return new Iss(metadata)
+    }
+}
+
+module.exports = {
+    HapiServerSimToken
+}