@galadrim/galadmin 0.2.6 → 0.2.7

package/dist/types/config.d.ts

@@ -359,12 +359,17 @@ export type AuthRole = {
     filters?: string;
     useArgon2?: boolean;
 };
+export type TrustedUser = {
+    role: string;
+    userId?: string | number;
+};
 export type Config = {
     enriched?: boolean;
     name: string;
     sessionSecret: string;
     useMysql2?: boolean;
-    auth: {
+    trustedAuth?: (req: any) => TrustedUser | null | Promise<TrustedUser | null>;
+    auth?: {
         username: string;
         password: string;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "main": "dist/index.js",
   "scripts": {
     "test": "jest",

package/src/index.ts

@@ -65,6 +65,26 @@ export default (config: Config): any => {
         name: 'galadmin.sid'
     }));
 
+    // trustedAuth: the host app (e.g. behind its own SSO) says who the user is, on every request.
+    // galadmin then has no login of its own: /api/login is refused, config.auth and authRoles are unused.
+    if (config.trustedAuth) {
+        app.use(async (req, res, next) => {
+            try {
+                const user = await config.trustedAuth(req);
+                if (user) {
+                    if (JSON.stringify(req.session.user) !== JSON.stringify(user)) {
+                        req.session.user = user;
+                    }
+                } else if (req.session.user) {
+                    delete req.session.user;
+                }
+                next();
+            } catch (err) {
+                next(err);
+            }
+        });
+    }
+
     const passwordMatch = async (password: string, hash: string, useArgon2: boolean) => {
         if (password === hash || bcrypt.compareSync(password, hash)) {
             return true;
@@ -81,7 +101,10 @@ export default (config: Config): any => {
     }
 
     app.post('/api/login', async (req, res) => {
-        if (req.body.username === config.auth.username && req.body.password === config.auth.password) {
+        if (config.trustedAuth) {
+            return res.send({ success: false })
+        }
+        if (config.auth && req.body.username === config.auth.username && req.body.password === config.auth.password) {
             req.session.user = { role: "root" }
             res.send({ success: true })
         } else if (config.authRoles) {
@@ -126,7 +149,7 @@ export default (config: Config): any => {
 
     app.use("/api", async (req, res, next) => {
         if (req.method === "OPTIONS" || req.session.user) {
-            if (req.session?.user?.userId) {
+            if (req.session?.user?.userId && !config.trustedAuth) {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {

package/src/types/config.ts

@@ -428,6 +428,11 @@ export type AuthRole = {
   useArgon2?: boolean;
 };
 
+export type TrustedUser = {
+  role: string;
+  userId?: string | number;
+};
+
 export type Config = {
   /** Ne pas renseigner !!! */
   enriched?: boolean;
@@ -440,8 +445,15 @@ export type Config = {
 
   useMysql2?: boolean;
 
+  /**
+   * Authentification déléguée à l'application hôte (par exemple derrière son SSO) : appelée à chaque
+   * requête, renvoie l'utilisateur (`role`, et `userId` pour la traçabilité) ou null. Quand elle est
+   * définie, galadmin n'a plus de login propre : `auth` et `authRoles` ne servent plus.
+   */
+  trustedAuth?: (req: any) => TrustedUser | null | Promise<TrustedUser | null>;
+
   /** Identifiants permettant d'accéder au back-office */
-  auth: {
+  auth?: {
     /** Nom d'utilisateur */
     username: string;
 

package/tests/index.test.ts

@@ -258,6 +258,55 @@ describe("index middleware (src/index.ts)", () => {
     });
   });
 
+  describe("trustedAuth", () => {
+    const trusted = (user: any) =>
+      mysqlConfig({ trustedAuth: jest.fn(async () => user) });
+
+    it("authenticates from the host app, without a galadmin login", async () => {
+      const { app } = buildAppWithDb(trusted({ role: "root", userId: 7 }), withSchema());
+      const auth = await request(app).get("/api/isAuthenticated").expect(200);
+      expect(auth.body).toEqual({ isAuthenticated: true });
+    });
+
+    it("refuses the api when the host app returns no user", async () => {
+      const { app } = buildAppWithDb(trusted(null), withSchema());
+      await request(app).get("/api/config").expect(401);
+      const auth = await request(app).get("/api/isAuthenticated").expect(200);
+      expect(auth.body).toEqual({ isAuthenticated: false });
+    });
+
+    it("refuses the password login, shared account included", async () => {
+      const { app } = buildAppWithDb(trusted(null), withSchema());
+      const res = await request(app)
+        .post("/api/login")
+        .send({ username: "admin", password: "admin-pass" })
+        .expect(200);
+      expect(res.body).toEqual({ success: false });
+    });
+
+    it("drops the access as soon as the host app stops vouching for the user", async () => {
+      let user: any = { role: "user", userId: 3 };
+      const config = mysqlConfig({ trustedAuth: jest.fn(async () => user) });
+      const { app } = buildAppWithDb(config, withSchema());
+      const agent = request.agent(app);
+      expect((await agent.get("/api/isAuthenticated")).body).toEqual({ isAuthenticated: true });
+      user = null;
+      expect((await agent.get("/api/isAuthenticated")).body).toEqual({ isAuthenticated: false });
+    });
+
+    it("never runs the authRoles re-check against the database", async () => {
+      const config = mysqlConfig({
+        trustedAuth: jest.fn(async () => ({ role: "editor", userId: 3 })),
+        authRoles: [
+          { role: "editor", table: "users", usernameField: "u", passwordField: "p", idField: "id" },
+        ],
+      });
+      const { app, instance } = buildAppWithDb(config, withSchema());
+      await request(app).get("/api/isAuthenticated").expect(200);
+      expect(instance.query.mock.calls.some(([sql]: any[]) => /FROM \?\? WHERE \?\? = \?/.test(sql))).toBe(false);
+    });
+  });
+
   describe("GET /api/isAuthenticated and /api/logout", () => {
     it("reports unauthenticated state before login", async () => {
       const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));