@cloudron/tegel 1.1.4 → 1.1.6

package/index.js

@@ -3,8 +3,7 @@ import fs from 'node:fs';
 import crypto from 'node:crypto';
 import session from 'express-session';
 import FileStoreFactory from 'session-file-store';
-import lastMile from '@cloudron/connect-lastmile';
-import { HttpError } from '@cloudron/connect-lastmile';
+import { lastMile, HttpError } from '@cloudron/connect-lastmile';
 import * as oidc from './src/oidc.js';
 
 export async function createExpressApp({ oidcConfig, jsonBodySizeLimit = '25mb' }) {
@@ -133,10 +132,35 @@ export function logout(redirectTo) {
   };
 }
 
-export function requireAuth(redirectTo = '') {
+export function requireAuth(redirectTo = '', { requiredScopes = [] } = {}) {
   if (typeof redirectTo !== 'string') throw new Error('requireAuth needs a redirectTo path as non-empty string');
 
-  return (req, res, next) => {
+  return async (req, res, next) => {
+    const accessToken = extractAccessToken(req);
+
+    if (accessToken) {
+      try {
+        const introspection = await oidc.introspectToken(accessToken);
+
+        if (!introspection.active) return next(new HttpError(401, 'Token is not active'));
+
+        if (requiredScopes.length > 0) {
+          const grantedScopes = (introspection.scope || '').split(' ');
+          const missingScopes = requiredScopes.filter(s => !grantedScopes.includes(s));
+          if (missingScopes.length > 0) return next(new HttpError(403, `Missing required scopes: ${missingScopes.join(', ')}`));
+        }
+
+        req.user = {
+          ...introspection,
+          username: introspection.sub || introspection.username,
+        };
+        return next();
+      } catch (error) {
+        console.error('Token introspection error:', error);
+        return next(new HttpError(401, 'Token introspection failed'));
+      }
+    }
+
     if (req.session && req.session.user) {
       req.user = req.session.user;
       return next();
@@ -147,3 +171,10 @@ export function requireAuth(redirectTo = '') {
     res.redirect(redirectTo);
   };
 }
+
+function extractAccessToken(req) {
+  const authHeader = req.get('Authorization');
+  if (authHeader && authHeader.startsWith('Bearer ')) return authHeader.slice(7);
+  if (req.query && req.query.accessToken) return req.query.accessToken;
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudron/tegel",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "",
   "license": "GPL-2.0",
   "author": "Cloudron Developers",
@@ -12,7 +12,7 @@
     "lint:fix": "eslint . --fix"
   },
   "dependencies": {
-    "@cloudron/connect-lastmile": "^2.3.0",
+    "@cloudron/connect-lastmile": "^3.0.0",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
     "openid-client": "^6.8.2",

package/src/oidc.js

@@ -2,6 +2,7 @@ import * as client from 'openid-client';
 
 let clientConfig = null;
 let redirectUri = null;
+let clientScope = 'openid profile email';
 
 /**
  * Initialize the OIDC client by discovering the issuer
@@ -10,11 +11,14 @@ export async function initOIDC({
   issuer = process.env.CLOUDRON_OIDC_ISSUER,
   clientId = process.env.CLOUDRON_OIDC_CLIENT_ID,
   clientSecret = process.env.CLOUDRON_OIDC_CLIENT_SECRET,
-  callbackUrl = (process.env.CLOUDRON_APP_ORIGIN || 'http://localhost:3000') + '/auth/callback'
+  callbackUrl = (process.env.CLOUDRON_APP_ORIGIN || 'http://localhost:3000') + '/auth/callback',
+  extraScope = '',
 }) {
   const issuerUrl = new URL(issuer);
   redirectUri = new URL(callbackUrl);
 
+  clientScope = `${clientScope} ${extraScope}`;
+
   clientConfig = await client.discovery(
     issuerUrl,
     clientId,
@@ -40,7 +44,7 @@ export async function getAuthorizationUrl(req) {
 
   const parameters = {
     redirect_uri: redirectUri,
-    scope: 'openid profile email',
+    scope: clientScope,
     code_challenge: codeChallenge,
     code_challenge_method: 'S256',
     state
@@ -84,18 +88,28 @@ export async function handleCallback(req) {
     );
   }
 
+  console.log(tokens)
+
   // Clean up session OIDC state
   delete req.session.oidc;
 
+  // give common props a nicer name but otherwise return full userInfo as it may have other scopes
+  userInfo.username = userInfo.sub;
+  userInfo.username = userInfo.sub;
+  userInfo.familyName = userInfo.family_name;
+  userInfo.givenName = userInfo.given_name;
+  userInfo.displayName = userInfo.name;
+
   return {
     tokens,
-    user: {
-      username: userInfo.sub,
-      email: userInfo.email,
-      familyName: userInfo.family_name,
-      givenName: userInfo.given_name,
-      displayName: userInfo.name,
-      picture: userInfo.picture
-    }
+    user: userInfo,
   };
 }
+
+/**
+ * Introspect an access token via the OIDC provider's token introspection endpoint (RFC 7662)
+ */
+export async function introspectToken(token) {
+  if (!clientConfig) throw new Error('call initOIDC() first');
+  return client.tokenIntrospection(clientConfig, token);
+}