@friggframework/core 2.0.0--canary.662.6f4f4f1.0 → 2.0.0--canary.540.4653c0a.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -69,8 +69,12 @@ class ProcessAuthorizationCallback {
|
|
|
69
69
|
definition: moduleDefinition,
|
|
70
70
|
});
|
|
71
71
|
|
|
72
|
+
const authType = module.apiClass.requesterType;
|
|
73
|
+
console.log(`[Frigg][OAuth] Module created: name=${module.getName()}, authType=${authType}`);
|
|
74
|
+
|
|
72
75
|
let tokenResponse;
|
|
73
|
-
if (
|
|
76
|
+
if (authType === ModuleConstants.authType.oauth2) {
|
|
77
|
+
console.log(`[Frigg][OAuth] Exchanging authorization code for token...`);
|
|
74
78
|
tokenResponse = await moduleDefinition.requiredAuthMethods.getToken(
|
|
75
79
|
module.api,
|
|
76
80
|
params
|
|
@@ -86,23 +90,29 @@ class ProcessAuthorizationCallback {
|
|
|
86
90
|
// OAuth flow appears to succeed.
|
|
87
91
|
await this.onTokenUpdate(module, moduleDefinition, userId);
|
|
88
92
|
} else {
|
|
93
|
+
console.log(`[Frigg][OAuth] Setting auth params (non-OAuth2)...`);
|
|
89
94
|
tokenResponse =
|
|
90
95
|
await moduleDefinition.requiredAuthMethods.setAuthParams(
|
|
91
96
|
module.api,
|
|
92
97
|
params
|
|
93
98
|
);
|
|
94
99
|
await this.onTokenUpdate(module, moduleDefinition, userId);
|
|
100
|
+
console.log(`[Frigg][OAuth] Auth params set and credential persisted`);
|
|
95
101
|
}
|
|
96
102
|
|
|
97
103
|
console.log(
|
|
98
104
|
`[Frigg] processAuthorizationCallback credential persisted credentialId=${module.credential?.id} authIsValid=${module.credential?.authIsValid}`
|
|
99
105
|
);
|
|
100
106
|
|
|
107
|
+
console.log(`[Frigg][OAuth] Testing auth...`);
|
|
101
108
|
const authRes = await module.testAuth();
|
|
102
109
|
if (!authRes) {
|
|
110
|
+
console.error(`[Frigg][OAuth] testAuth() returned false — authorization failed`);
|
|
103
111
|
throw new Error('Authorization failed');
|
|
104
112
|
}
|
|
113
|
+
console.log(`[Frigg][OAuth] Auth test passed`);
|
|
105
114
|
|
|
115
|
+
console.log(`[Frigg][OAuth] Fetching entity details...`);
|
|
106
116
|
const entityDetails =
|
|
107
117
|
await moduleDefinition.requiredAuthMethods.getEntityDetails(
|
|
108
118
|
module.api,
|
|
@@ -110,17 +120,20 @@ class ProcessAuthorizationCallback {
|
|
|
110
120
|
tokenResponse,
|
|
111
121
|
userId
|
|
112
122
|
);
|
|
123
|
+
console.log(`[Frigg][OAuth] Entity details received: identifiers=${JSON.stringify(entityDetails.identifiers)}`);
|
|
113
124
|
|
|
114
125
|
Object.assign(
|
|
115
126
|
entityDetails.details,
|
|
116
127
|
module.apiParamsFromEntity(module.api)
|
|
117
128
|
);
|
|
118
129
|
|
|
130
|
+
console.log(`[Frigg][OAuth] Finding or creating entity...`);
|
|
119
131
|
const persistedEntity = await this.findOrCreateEntity(
|
|
120
132
|
entityDetails,
|
|
121
133
|
entityType,
|
|
122
134
|
module.credential.id
|
|
123
135
|
);
|
|
136
|
+
console.log(`[Frigg][OAuth] Done — entity_id=${persistedEntity.id}, credential_id=${module.credential.id}`);
|
|
124
137
|
|
|
125
138
|
// Best-effort: a hiccup here must not fail a successful re-auth whose
|
|
126
139
|
// credential + entity are already persisted. Operators can recover
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@friggframework/core",
|
|
3
3
|
"prettier": "@friggframework/prettier-config",
|
|
4
|
-
"version": "2.0.0--canary.
|
|
4
|
+
"version": "2.0.0--canary.540.4653c0a.0",
|
|
5
5
|
"dependencies": {
|
|
6
6
|
"@aws-sdk/client-apigatewaymanagementapi": "^3.588.0",
|
|
7
7
|
"@aws-sdk/client-kms": "^3.588.0",
|
|
@@ -47,9 +47,9 @@
|
|
|
47
47
|
}
|
|
48
48
|
},
|
|
49
49
|
"devDependencies": {
|
|
50
|
-
"@friggframework/eslint-config": "2.0.0--canary.
|
|
51
|
-
"@friggframework/prettier-config": "2.0.0--canary.
|
|
52
|
-
"@friggframework/test": "2.0.0--canary.
|
|
50
|
+
"@friggframework/eslint-config": "2.0.0--canary.540.4653c0a.0",
|
|
51
|
+
"@friggframework/prettier-config": "2.0.0--canary.540.4653c0a.0",
|
|
52
|
+
"@friggframework/test": "2.0.0--canary.540.4653c0a.0",
|
|
53
53
|
"@prisma/client": "^6.19.3",
|
|
54
54
|
"@types/lodash": "4.17.15",
|
|
55
55
|
"@typescript-eslint/eslint-plugin": "^8.0.0",
|
|
@@ -89,5 +89,5 @@
|
|
|
89
89
|
"publishConfig": {
|
|
90
90
|
"access": "public"
|
|
91
91
|
},
|
|
92
|
-
"gitHead": "
|
|
92
|
+
"gitHead": "4653c0a949b5a88591424a8114a071a96af35b7d"
|
|
93
93
|
}
|
|
@@ -2,12 +2,12 @@ const Boom = require('@hapi/boom');
|
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
4
|
* Use case for authenticating a user using multiple authentication strategies.
|
|
5
|
-
*
|
|
5
|
+
*
|
|
6
6
|
* Supports three authentication modes in priority order:
|
|
7
7
|
* 1. Shared Secret (backend-to-backend with x-frigg-api-key + x-frigg headers)
|
|
8
8
|
* 2. Adopter JWT (custom JWT authentication)
|
|
9
9
|
* 3. Frigg Native Token (bearer token from /user/login)
|
|
10
|
-
*
|
|
10
|
+
*
|
|
11
11
|
* x-frigg-appUserId and x-frigg-appOrgId headers are automatically supported
|
|
12
12
|
* for user identification with any auth mode. When present with JWT or Frigg
|
|
13
13
|
* tokens, they are validated to match the authenticated user.
|
|
@@ -50,12 +50,18 @@ class AuthenticateUser {
|
|
|
50
50
|
const authModes = this.userConfig.authModes || { friggToken: true };
|
|
51
51
|
const appUserId = req.headers['x-frigg-appuserid'];
|
|
52
52
|
const appOrgId = req.headers['x-frigg-apporgid'];
|
|
53
|
-
|
|
53
|
+
console.log(
|
|
54
|
+
'[Frigg] header list:',
|
|
55
|
+
JSON.stringify(Object.keys(req.headers))
|
|
56
|
+
);
|
|
54
57
|
|
|
55
58
|
// Priority 1: Shared Secret (backend-to-backend with API key)
|
|
56
59
|
if (authModes.sharedSecret !== false) {
|
|
57
60
|
const apiKey = req.headers['x-frigg-api-key'];
|
|
58
61
|
if (apiKey) {
|
|
62
|
+
console.log(
|
|
63
|
+
'[Frigg] Attempting shared secret authentication with API key'
|
|
64
|
+
);
|
|
59
65
|
// Validate the API key (authentication)
|
|
60
66
|
await this.authenticateWithSharedSecret.execute(apiKey);
|
|
61
67
|
// Get user from x-frigg headers (authorization)
|
|
@@ -64,6 +70,9 @@ class AuthenticateUser {
|
|
|
64
70
|
appOrgId
|
|
65
71
|
);
|
|
66
72
|
}
|
|
73
|
+
console.log(
|
|
74
|
+
'[Frigg] No x-frigg-api-key header found, skipping shared secret authentication'
|
|
75
|
+
);
|
|
67
76
|
}
|
|
68
77
|
|
|
69
78
|
// Priority 2: Adopter JWT (if enabled)
|
|
@@ -71,10 +80,11 @@ class AuthenticateUser {
|
|
|
71
80
|
authModes.adopterJwt === true &&
|
|
72
81
|
req.headers.authorization?.startsWith('Bearer ')
|
|
73
82
|
) {
|
|
83
|
+
console.log('[Frigg] Attempting Adopter JWT authentication');
|
|
74
84
|
const token = req.headers.authorization.split(' ')[1];
|
|
75
85
|
// Detect JWT format (3 parts separated by dots)
|
|
76
86
|
if (token && token.split('.').length === 3) {
|
|
77
|
-
user = await this.getUserFromAdopterJwt.execute(token);
|
|
87
|
+
const user = await this.getUserFromAdopterJwt.execute(token);
|
|
78
88
|
// Validate x-frigg headers match JWT claims if present
|
|
79
89
|
if (appUserId || appOrgId) {
|
|
80
90
|
this.validateUserMatch(user, appUserId, appOrgId);
|
|
@@ -85,7 +95,8 @@ class AuthenticateUser {
|
|
|
85
95
|
|
|
86
96
|
// Priority 3: Frigg native token (default)
|
|
87
97
|
if (authModes.friggToken !== false && req.headers.authorization) {
|
|
88
|
-
|
|
98
|
+
console.log('[Frigg] Attempting Frigg native token authentication');
|
|
99
|
+
const user = await this.getUserFromBearerToken.execute(
|
|
89
100
|
req.headers.authorization
|
|
90
101
|
);
|
|
91
102
|
// Validate x-frigg headers match token user if present
|
|
@@ -123,5 +134,3 @@ class AuthenticateUser {
|
|
|
123
134
|
}
|
|
124
135
|
|
|
125
136
|
module.exports = { AuthenticateUser };
|
|
126
|
-
|
|
127
|
-
|