@cloudron/tegel 1.1.5 → 1.1.6

package/index.js

@@ -3,8 +3,7 @@ import fs from 'node:fs';
 import crypto from 'node:crypto';
 import session from 'express-session';
 import FileStoreFactory from 'session-file-store';
-import lastMile from '@cloudron/connect-lastmile';
-import { HttpError } from '@cloudron/connect-lastmile';
+import { lastMile, HttpError } from '@cloudron/connect-lastmile';
 import * as oidc from './src/oidc.js';
 
 export async function createExpressApp({ oidcConfig, jsonBodySizeLimit = '25mb' }) {
@@ -133,10 +132,35 @@ export function logout(redirectTo) {
   };
 }
 
-export function requireAuth(redirectTo = '') {
+export function requireAuth(redirectTo = '', { requiredScopes = [] } = {}) {
   if (typeof redirectTo !== 'string') throw new Error('requireAuth needs a redirectTo path as non-empty string');
 
-  return (req, res, next) => {
+  return async (req, res, next) => {
+    const accessToken = extractAccessToken(req);
+
+    if (accessToken) {
+      try {
+        const introspection = await oidc.introspectToken(accessToken);
+
+        if (!introspection.active) return next(new HttpError(401, 'Token is not active'));
+
+        if (requiredScopes.length > 0) {
+          const grantedScopes = (introspection.scope || '').split(' ');
+          const missingScopes = requiredScopes.filter(s => !grantedScopes.includes(s));
+          if (missingScopes.length > 0) return next(new HttpError(403, `Missing required scopes: ${missingScopes.join(', ')}`));
+        }
+
+        req.user = {
+          ...introspection,
+          username: introspection.sub || introspection.username,
+        };
+        return next();
+      } catch (error) {
+        console.error('Token introspection error:', error);
+        return next(new HttpError(401, 'Token introspection failed'));
+      }
+    }
+
     if (req.session && req.session.user) {
       req.user = req.session.user;
       return next();
@@ -147,3 +171,10 @@ export function requireAuth(redirectTo = '') {
     res.redirect(redirectTo);
   };
 }
+
+function extractAccessToken(req) {
+  const authHeader = req.get('Authorization');
+  if (authHeader && authHeader.startsWith('Bearer ')) return authHeader.slice(7);
+  if (req.query && req.query.accessToken) return req.query.accessToken;
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudron/tegel",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "",
   "license": "GPL-2.0",
   "author": "Cloudron Developers",
@@ -12,7 +12,7 @@
     "lint:fix": "eslint . --fix"
   },
   "dependencies": {
-    "@cloudron/connect-lastmile": "^2.3.0",
+    "@cloudron/connect-lastmile": "^3.0.0",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
     "openid-client": "^6.8.2",

package/src/oidc.js

@@ -88,6 +88,8 @@ export async function handleCallback(req) {
     );
   }
 
+  console.log(tokens)
+
   // Clean up session OIDC state
   delete req.session.oidc;
 
@@ -103,3 +105,11 @@ export async function handleCallback(req) {
     user: userInfo,
   };
 }
+
+/**
+ * Introspect an access token via the OIDC provider's token introspection endpoint (RFC 7662)
+ */
+export async function introspectToken(token) {
+  if (!clientConfig) throw new Error('call initOIDC() first');
+  return client.tokenIntrospection(clientConfig, token);
+}