@ejfdelgado/ejflab-back 1.23.0 → 1.24.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ejfdelgado/ejflab-back",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ejfdelgado/ejflab-back.git"

package/srv/AuthorizationSrv.mjs

@@ -140,6 +140,58 @@ export class AuthorizationSrv {
         });
     }
 
+    static isUserInGroupInternal(user, groups, and) {
+        if (!user) {
+            return false;
+        }
+        const currentGroups = user.groups;
+        const notMeet = groups.filter((group) => {
+            if (currentGroups.indexOf(group) >= 0) {
+                return false;
+            }
+            return true;
+        });
+        if (and) {
+            //All must have
+            return notMeet.length == 0;
+        } else {
+            // At least one
+            return notMeet.length < groups.length;
+        }
+    }
+
+    static isUserInAllGroup(groups) {
+        return async (req, res, next) => {
+            if (res.locals.user) {
+                // Hay usuario
+                const cumple = this.isUserInGroupInternal(res.locals.user, groups, true);
+                if (cumple) {
+                    next();
+                } else {
+                    res.status(403).send({ message: `User not allowed` });
+                }
+            } else {
+                res.status(403).send({ message: `User not authenticated` });
+            }
+        }
+    }
+
+    static isUserInSomeGroup(groups) {
+        return async (req, res, next) => {
+            if (res.locals.user) {
+                // Hay usuario
+                const cumple = this.isUserInGroupInternal(res.locals.user, groups, false);
+                if (cumple) {
+                    next();
+                } else {
+                    res.status(403).send({ message: `User not allowed` });
+                }
+            } else {
+                res.status(403).send({ message: `User not authenticated` });
+            }
+        }
+    }
+
     static hasPagePermisions(listaOr) {
         return async (req, res, next) => {
             if (listaOr.length == 0) {

package/srv/common/FirebasConfig.mjs

@@ -5,6 +5,48 @@ import { Usuario } from './Usuario.mjs';
 import fs from "fs";
 import { General } from './General.mjs';
 import { MyConstants } from '@ejfdelgado/ejflab-common/src/MyConstants.js';
+import jwt from 'jsonwebtoken';
+import jwksClient from 'jwks-rsa';
+
+const AUTH_PROVIDER = process.env.AUTH_PROVIDER;
+const MICROSOFT_CLIENT_ID = process.env.MICROSOFT_CLIENT_ID;
+const MICROSOFT_TENANT = process.env.MICROSOFT_TENANT;
+
+const microsoftClient = jwksClient({
+    jwksUri: `https://login.microsoftonline.com/${MICROSOFT_TENANT}/discovery/v2.0/keys`,
+});
+
+// Helper to get the signing key
+function getMicrosoftKey(header, callback) {
+    microsoftClient.getSigningKey(header.kid, (err, key) => {
+        if (err) {
+            return callback(err);
+        }
+        const signingKey = key.getPublicKey();
+        callback(null, signingKey);
+    });
+}
+
+function verifyMicrosoftToken(token) {
+    return new Promise((resolve, reject) => {
+        jwt.verify(
+            token,
+            getMicrosoftKey,
+            {
+                algorithms: ['RS256'], // Tokens are typically signed with RS256
+                audience: MICROSOFT_CLIENT_ID, // Replace with your application's client ID
+                issuer: `https://login.microsoftonline.com/${MICROSOFT_TENANT}/v2.0`, // Replace with your tenant's issuer
+                //issuer: `https://sts.windows.net/${MICROSOFT_TENANT}/`
+            },
+            (err, decoded) => {
+                if (err) {
+                    return reject(err);
+                }
+                resolve(decoded);
+            }
+        );
+    });
+}
 
 function getFirebaseConfig() {
     const firebaseJson = fs.readFileSync(MyConstants.FIREBASE_CONFIG_FILE, { encoding: "utf8" });
@@ -54,17 +96,30 @@ async function checkAutenticated(req) {
             reject(new MyError("Missing Authorization header.", 403));
             return;
         }
-        getAuth()
-            .verifyIdToken(sessionToken)
-            .then((decodedToken) => {
-                resolve({
-                    decodedToken,
-                    sessionToken,
+        if (AUTH_PROVIDER == "microsoft") {
+            verifyMicrosoftToken(sessionToken)
+                .then((decodedToken) => {
+                    resolve({
+                        decodedToken,
+                        sessionToken,
+                    });
+                })
+                .catch((error) => {
+                    reject(new MyError(error.message, 403));
                 });
-            })
-            .catch((error) => {
-                reject(new MyError(error.message, 403));
-            });
+        } else if (AUTH_PROVIDER == "google") {
+            getAuth()
+                .verifyIdToken(sessionToken)
+                .then((decodedToken) => {
+                    resolve({
+                        decodedToken,
+                        sessionToken,
+                    });
+                })
+                .catch((error) => {
+                    reject(new MyError(error.message, 403));
+                });
+        }
     });
 }
 
@@ -107,7 +162,7 @@ async function checkAuthenticatedSilent(req, res, next) {
         res.locals.user = new Usuario(res.locals.token);
         await next();
     } catch (err) {
-        //console.log(err);
+        console.log(err);
         res.locals.token = null;
         res.locals.user = null;
         await next();

package/srv/common/Usuario.mjs

@@ -5,6 +5,8 @@ import { MyStore } from "./MyStore.mjs";
 import { General } from "./General.mjs";
 import { MalaPeticionException } from "../MyError.mjs";
 
+const AUTH_PROVIDER = process.env.AUTH_PROVIDER;
+const groupIdMap = JSON.parse("AUTH_GROUP_ID_MAP" in process.env ? process.env.AUTH_GROUP_ID_MAP : "{}");
 const USER_TYPE = "user";
 
 export class Usuario {
@@ -12,20 +14,39 @@ export class Usuario {
     id = null;
     email = null;
     phone = null;
+    groups = [];
     constructor(token) {
         this.metadatos = token;
         if (this.metadatos != null) {
             if (this.metadatos.email) {
                 this.email = this.metadatos.email;
             }
-            const contenedor = this.metadatos["firebase"];
-            const identidades = contenedor["identities"];
-            if ("email" in identidades) {
-                this.id = identidades["email"][0];
-                this.email = this.id;
-            } else if ("phone" in identidades) {
-                this.id = identidades["phone"][0];
-                this.phone = this.id;
+            if (AUTH_PROVIDER == "microsoft") {
+                this.id = token.oid;
+                this.email = token.preferred_username;
+                if (token.groups instanceof Array) {
+                    this.groups = token.groups.map((idGroup) => {
+                        if (idGroup in groupIdMap) {
+                            return groupIdMap[idGroup];
+                        }
+                        return idGroup;
+                    });
+                }
+                //console.log(`id: ${this.id}`);
+                //console.log(`email: ${this.email}`);
+                //console.log(`groups: ${JSON.stringify(this.groups)}`);
+            } else {
+                if ("firebase" in this.metadatos) {
+                    const contenedor = this.metadatos["firebase"];
+                    const identidades = contenedor["identities"];
+                    if ("email" in identidades) {
+                        this.id = identidades["email"][0];
+                        this.email = this.id;
+                    } else if ("phone" in identidades) {
+                        this.id = identidades["phone"][0];
+                        this.phone = this.id;
+                    }
+                }
             }
         }
     }