@galadrim/galadmin 0.2.6 → 0.2.8

package/dist/types/config.d.ts

@@ -359,12 +359,17 @@ export type AuthRole = {
     filters?: string;
     useArgon2?: boolean;
 };
+export type TrustedUser = {
+    role: string;
+    userId?: string | number;
+};
 export type Config = {
     enriched?: boolean;
     name: string;
     sessionSecret: string;
     useMysql2?: boolean;
-    auth: {
+    trustedAuth?: (req: any) => TrustedUser | null | Promise<TrustedUser | null>;
+    auth?: {
         username: string;
         password: string;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@galadrim/galadmin",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "main": "dist/index.js",
   "scripts": {
     "test": "jest",

package/src/api.ts

@@ -209,6 +209,21 @@ declare global {
   }
 }
 
+// Columns of `view` the current role may not see (cf. the config middleware below).
+export const hiddenColumnsOf = (view) => (view && view.__hiddenColumns) || [];
+
+// Removes the hidden columns from a record before it is sent.
+export const stripHiddenColumns = (view, record) => {
+  for (const name of hiddenColumnsOf(view)) delete record[name];
+  return record;
+};
+
+// Whether a write payload touches a hidden column.
+export const touchesHiddenColumn = (view, data) =>
+  hiddenColumnsOf(view).some(
+    (name) => data && Object.prototype.hasOwnProperty.call(data, name),
+  );
+
 export default (db, config) => {
   const app = express();
 
@@ -243,14 +258,19 @@ export default (db, config) => {
         })
         .map((view) => {
           if (view.type === "table") {
+            const allowed = (column) =>
+              !column.roles ||
+              (req.session.user &&
+                column.roles.includes(req.session.user.role));
             return {
               ...view,
-              columns: view.columns.filter(
-                (column) =>
-                  !column.roles ||
-                  (req.session.user &&
-                    column.roles.includes(req.session.user.role)),
-              ),
+              columns: view.columns.filter(allowed),
+              // SECURITY: a column's `roles` must hold server-side too. Rows are read with SELECT *, and
+              // writes take any column sent: the names of the columns this role may not see are kept
+              // here, stripped from every record sent back and refused in every write.
+              __hiddenColumns: view.columns
+                .filter((column) => !allowed(column))
+                .map((column) => column.name),
             };
           } else {
             return view;
@@ -564,6 +584,7 @@ export default (db, config) => {
         }
       }
     }
+    for (const record of records) stripHiddenColumns(view, record);
     res.send({
       records,
       input,
@@ -678,6 +699,9 @@ export default (db, config) => {
             }
           }
         }
+        if (columns.some((name) => hiddenColumnsOf(view).includes(name))) {
+          return res.sendStatus(403);
+        }
 
         let queryString;
         if (db.dbType === "POSTGRESQL") {
@@ -861,7 +885,7 @@ export default (db, config) => {
             await column.formatValue(record);
         }
       }
-      res.send(record);
+      res.send(stripHiddenColumns(view, record));
     } else {
       res.sendStatus(404);
     }
@@ -872,6 +896,9 @@ export default (db, config) => {
     if (!areSafeColumnNames(req.body.data)) {
       return res.status(400).send({ error: "Invalid column name" });
     }
+    if (touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     for (let key in req.body.data) {
       if (
         req.body.data[key] == "NULL" ||
@@ -1150,6 +1177,9 @@ export default (db, config) => {
     const hasPanel =
       req.body.panelIndex !== undefined && req.body.panelIndex !== null;
     const panel = hasPanel ? view.recordViewPanels[req.body.panelIndex] : null;
+    if (!hasPanel && touchesHiddenColumn(view, req.body.data)) {
+      return res.sendStatus(403);
+    }
     try {
       for (let key in req.body.data) {
         if (

package/src/index.ts

@@ -65,6 +65,26 @@ export default (config: Config): any => {
         name: 'galadmin.sid'
     }));
 
+    // trustedAuth: the host app (e.g. behind its own SSO) says who the user is, on every request.
+    // galadmin then has no login of its own: /api/login is refused, config.auth and authRoles are unused.
+    if (config.trustedAuth) {
+        app.use(async (req, res, next) => {
+            try {
+                const user = await config.trustedAuth(req);
+                if (user) {
+                    if (JSON.stringify(req.session.user) !== JSON.stringify(user)) {
+                        req.session.user = user;
+                    }
+                } else if (req.session.user) {
+                    delete req.session.user;
+                }
+                next();
+            } catch (err) {
+                next(err);
+            }
+        });
+    }
+
     const passwordMatch = async (password: string, hash: string, useArgon2: boolean) => {
         if (password === hash || bcrypt.compareSync(password, hash)) {
             return true;
@@ -81,7 +101,10 @@ export default (config: Config): any => {
     }
 
     app.post('/api/login', async (req, res) => {
-        if (req.body.username === config.auth.username && req.body.password === config.auth.password) {
+        if (config.trustedAuth) {
+            return res.send({ success: false })
+        }
+        if (config.auth && req.body.username === config.auth.username && req.body.password === config.auth.password) {
             req.session.user = { role: "root" }
             res.send({ success: true })
         } else if (config.authRoles) {
@@ -126,7 +149,7 @@ export default (config: Config): any => {
 
     app.use("/api", async (req, res, next) => {
         if (req.method === "OPTIONS" || req.session.user) {
-            if (req.session?.user?.userId) {
+            if (req.session?.user?.userId && !config.trustedAuth) {
                 // we check that the user still exists
                 let stillExists = false;
                 for (const authRole of config.authRoles) {

package/src/types/config.ts

@@ -428,6 +428,11 @@ export type AuthRole = {
   useArgon2?: boolean;
 };
 
+export type TrustedUser = {
+  role: string;
+  userId?: string | number;
+};
+
 export type Config = {
   /** Ne pas renseigner !!! */
   enriched?: boolean;
@@ -440,8 +445,15 @@ export type Config = {
 
   useMysql2?: boolean;
 
+  /**
+   * Authentification déléguée à l'application hôte (par exemple derrière son SSO) : appelée à chaque
+   * requête, renvoie l'utilisateur (`role`, et `userId` pour la traçabilité) ou null. Quand elle est
+   * définie, galadmin n'a plus de login propre : `auth` et `authRoles` ne servent plus.
+   */
+  trustedAuth?: (req: any) => TrustedUser | null | Promise<TrustedUser | null>;
+
   /** Identifiants permettant d'accéder au back-office */
-  auth: {
+  auth?: {
     /** Nom d'utilisateur */
     username: string;
 

package/tests/column-roles.test.ts

@@ -0,0 +1,86 @@
+import * as request from "supertest";
+import { buildApiApp } from "./helpers/app";
+import { FakeDb } from "./helpers/fakeDb";
+import { baseConfig, fruitSchema, fruitView, schemaRow } from "./helpers/fixtures";
+
+jest.mock("axios");
+
+/**
+ * A column's `roles` must hold on the server, not only in the interface: rows are read with SELECT *, so a
+ * column hidden from a role must be stripped from what is sent back, and refused in writes.
+ */
+describe("column roles enforced server-side", () => {
+  let db: FakeDb;
+  const row = { id: 1, fruitName: "Pomme", acidity: 3, secret: "s3cr3t" };
+  const config = () =>
+    baseConfig({
+      views: [
+        fruitView({
+          roles: ["root", "user"],
+          columns: [
+            { label: "Nom", name: "fruitName" },
+            { label: "Acidité", name: "acidity" },
+            { label: "Secret", name: "secret", roles: ["root"] },
+          ],
+        }),
+      ],
+    });
+
+  beforeEach(() => {
+    db = new FakeDb();
+    db.schemaRows = fruitSchema([schemaRow("fruits", "secret")]);
+  });
+
+  it("GET /api/record leaves the hidden column out for a role that may not see it", async () => {
+    db.queueRows([{ ...row }]);
+    const res = await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .get("/api/record")
+      .query({ viewIndex: 0, recordId: 1 })
+      .expect(200);
+    expect(res.body.fruitName).toBe("Pomme");
+    expect(res.body).not.toHaveProperty("secret");
+  });
+
+  it("GET /api/record keeps it for a role that may see it", async () => {
+    db.queueRows([{ ...row }]);
+    const res = await request(buildApiApp(db, config(), { role: "root", userId: 1 }))
+      .get("/api/record")
+      .query({ viewIndex: 0, recordId: 1 })
+      .expect(200);
+    expect(res.body.secret).toBe("s3cr3t");
+  });
+
+  it("POST /api/records leaves the hidden column out of every record", async () => {
+    db.defaultResult = { err: null, rows: [{ ...row, total: 1, count: 1 }] };
+    const res = await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/records")
+      .send({ viewIndex: 0, page: 1, filters: [] })
+      .expect(200);
+    expect(res.body.records.length).toBeGreaterThan(0);
+    for (const record of res.body.records) expect(record).not.toHaveProperty("secret");
+  });
+
+  it("POST /api/updateRecord refuses to write the hidden column", async () => {
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/updateRecord")
+      .send({ viewIndex: 0, primaryValue: 1, data: { secret: "x" } })
+      .expect(403);
+    expect(db.dataQueries().length).toBe(0);
+  });
+
+  it("POST /api/updateRecord still writes the visible columns", async () => {
+    db.queueRows({ affectedRows: 1 });
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/updateRecord")
+      .send({ viewIndex: 0, primaryValue: 1, data: { fruitName: "Poire" } })
+      .expect((res) => expect(res.status).not.toBe(403));
+  });
+
+  it("POST /api/createRecord refuses to set the hidden column", async () => {
+    await request(buildApiApp(db, config(), { role: "user", userId: 7 }))
+      .post("/api/createRecord")
+      .send({ viewIndex: 0, data: { fruitName: "Kiwi", secret: "x" } })
+      .expect(403);
+    expect(db.dataQueries().length).toBe(0);
+  });
+});

package/tests/index.test.ts

@@ -258,6 +258,55 @@ describe("index middleware (src/index.ts)", () => {
     });
   });
 
+  describe("trustedAuth", () => {
+    const trusted = (user: any) =>
+      mysqlConfig({ trustedAuth: jest.fn(async () => user) });
+
+    it("authenticates from the host app, without a galadmin login", async () => {
+      const { app } = buildAppWithDb(trusted({ role: "root", userId: 7 }), withSchema());
+      const auth = await request(app).get("/api/isAuthenticated").expect(200);
+      expect(auth.body).toEqual({ isAuthenticated: true });
+    });
+
+    it("refuses the api when the host app returns no user", async () => {
+      const { app } = buildAppWithDb(trusted(null), withSchema());
+      await request(app).get("/api/config").expect(401);
+      const auth = await request(app).get("/api/isAuthenticated").expect(200);
+      expect(auth.body).toEqual({ isAuthenticated: false });
+    });
+
+    it("refuses the password login, shared account included", async () => {
+      const { app } = buildAppWithDb(trusted(null), withSchema());
+      const res = await request(app)
+        .post("/api/login")
+        .send({ username: "admin", password: "admin-pass" })
+        .expect(200);
+      expect(res.body).toEqual({ success: false });
+    });
+
+    it("drops the access as soon as the host app stops vouching for the user", async () => {
+      let user: any = { role: "user", userId: 3 };
+      const config = mysqlConfig({ trustedAuth: jest.fn(async () => user) });
+      const { app } = buildAppWithDb(config, withSchema());
+      const agent = request.agent(app);
+      expect((await agent.get("/api/isAuthenticated")).body).toEqual({ isAuthenticated: true });
+      user = null;
+      expect((await agent.get("/api/isAuthenticated")).body).toEqual({ isAuthenticated: false });
+    });
+
+    it("never runs the authRoles re-check against the database", async () => {
+      const config = mysqlConfig({
+        trustedAuth: jest.fn(async () => ({ role: "editor", userId: 3 })),
+        authRoles: [
+          { role: "editor", table: "users", usernameField: "u", passwordField: "p", idField: "id" },
+        ],
+      });
+      const { app, instance } = buildAppWithDb(config, withSchema());
+      await request(app).get("/api/isAuthenticated").expect(200);
+      expect(instance.query.mock.calls.some(([sql]: any[]) => /FROM \?\? WHERE \?\? = \?/.test(sql))).toBe(false);
+    });
+  });
+
   describe("GET /api/isAuthenticated and /api/logout", () => {
     it("reports unauthenticated state before login", async () => {
       const { app } = buildAppWithDb(mysqlConfig(), withSchema(fruitSchema()));