@kumologica/sdk 3.2.0-beta9 → 4.0.0-alpha2

package/src/app/ui/editor-api/lib/auth/index.js

@@ -1,269 +0,0 @@
- 
-
-/**
- * @mixin @kumologica-core/editor-api_auth
- */
-
-// var passport = require('passport');
-// var oauth2orize = require('oauth2orize');
-// var strategies = require('./strategies');
-var Tokens = require('./tokens');
-var Users = require('./users');
-// var permissions = require('./permissions');
-
-var theme = require('../editor/theme');
-
-var settings = null;
-const { util: runtimeUtil } = require('../../../../lib/runtime-loader');
-
-const log = runtimeUtil.log;
-
-// passport.use(strategies.bearerStrategy.BearerStrategy);
-// passport.use(strategies.clientPasswordStrategy.ClientPasswordStrategy);
-// passport.use(strategies.anonymousStrategy);
-
-// var server = oauth2orize.createServer();
-
-// server.exchange(
-//   oauth2orize.exchange.password(strategies.passwordTokenExchange)
-// );
-
-function init(_settings, storage) {
-  settings = _settings;
-  if (settings.adminAuth) {
-    var mergedAdminAuth = Object.assign(
-      {},
-      settings.adminAuth,
-      settings.adminAuth.module
-    );
-    Users.init(mergedAdminAuth);
-    Tokens.init(mergedAdminAuth, storage);
-  }
-}
-/**
- * Returns an Express middleware function that ensures the user making a request
- * has the necessary permission.
- *
- * @param {String} permission - the permission required for the request, such as `flows.write`
- * @return {Function} - an Express middleware
- * @memberof @kumologica-core/editor-api_auth
- */
-function needsPermission(permission) {
-  return function(req, res, next) {
-    // if (settings && settings.adminAuth) {
-    //   return passport.authenticate(['bearer', 'anon'], { session: false })(
-    //     req,
-    //     res,
-    //     function() {
-    //       if (!req.user) {
-    //         return next();
-    //       }
-    //       if (permissions.hasPermission(req.authInfo.scope, permission)) {
-    //         return next();
-    //       }
-    //       log.audit({ event: 'permission.fail', permissions: permission }, req);
-    //       return res.status(401).end();
-    //     }
-    //   );
-    // } else {
-    //   next();
-    // }
-    next();
-  };
-}
-
-function ensureClientSecret(req, res, next) {
-  if (!req.body.client_secret) {
-    req.body.client_secret = 'not_available';
-  }
-  next();
-}
-function authenticateClient(req, res, next) {
-  next();
-  // return passport.authenticate(['oauth2-client-password'], { session: false })(
-  //   req,
-  //   res,
-  //   next
-  // );
-}
-function getToken(req, res, next) {
-  return server.token()(req, res, next);
-}
-
-function login(req, res) {
-  var response = {};
-  if (settings.adminAuth) {
-    var mergedAdminAuth = Object.assign(
-      {},
-      settings.adminAuth,
-      settings.adminAuth.module
-    );
-    if (mergedAdminAuth.type === 'credentials') {
-      response = {
-        type: 'credentials',
-        prompts: [
-          { id: 'username', type: 'text', label: 'user.username' },
-          { id: 'password', type: 'password', label: 'user.password' }
-        ]
-      };
-    } else if (mergedAdminAuth.type === 'strategy') {
-      var urlPrefix =
-        settings.httpAdminRoot === '/' ? '' : settings.httpAdminRoot;
-      response = {
-        type: 'strategy',
-        prompts: [
-          {
-            type: 'button',
-            label: mergedAdminAuth.strategy.label,
-            url: urlPrefix + 'auth/strategy'
-          }
-        ]
-      };
-      if (mergedAdminAuth.strategy.icon) {
-        response.prompts[0].icon = mergedAdminAuth.strategy.icon;
-      }
-      if (mergedAdminAuth.strategy.image) {
-        response.prompts[0].image = theme.serveFile(
-          '/login/',
-          mergedAdminAuth.strategy.image
-        );
-      }
-    }
-    if (theme.context().login && theme.context().login.image) {
-      response.image = theme.context().login.image;
-    }
-  }
-  res.json(response);
-}
-
-function revoke(req, res) {
-  var token = req.body.token;
-  // TODO: audit log
-  Tokens.revoke(token).then(function() {
-    log.audit({ event: 'auth.login.revoke' }, req);
-    if (
-      settings.editorTheme &&
-      settings.editorTheme.logout &&
-      settings.editorTheme.logout.redirect
-    ) {
-      res.json({ redirect: settings.editorTheme.logout.redirect });
-    } else {
-      res.status(200).end();
-    }
-  });
-}
-
-function completeVerify(profile, done) {
-  Users.authenticate(profile).then(function(user) {
-    if (user) {
-      Tokens.create(user.username, 'kumologica-core-editor', user.permissions).then(
-        function(tokens) {
-          log.audit({
-            event: 'auth.login',
-            username: user.username,
-            scope: user.permissions
-          });
-          user.tokens = tokens;
-          done(null, user);
-        }
-      );
-    } else {
-      log.audit({
-        event: 'auth.login.fail.oauth',
-        username: typeof profile === 'string' ? profile : profile.username
-      });
-      done(null, false);
-    }
-  });
-}
-
-function genericStrategy(adminApp, strategy) {
-  var crypto = require('crypto');
-  var session = require('express-session');
-  var MemoryStore = require('memorystore')(session);
-
-  adminApp.use(
-    session({
-      // As the session is only used across the life-span of an auth
-      // hand-shake, we can use a instance specific random string
-      secret: crypto.randomBytes(20).toString('hex'),
-      resave: false,
-      saveUninitialized: false,
-      store: new MemoryStore({
-        checkPeriod: 86400000 // prune expired entries every 24h
-      })
-    })
-  );
-  //TODO: all passport references ought to be in ./auth
-  // adminApp.use(passport.initialize());
-  // adminApp.use(passport.session());
-
-  var options = strategy.options;
-
-  // passport.use(
-  //   new strategy.strategy(options, function() {
-  //     var originalDone = arguments[arguments.length - 1];
-  //     if (options.verify) {
-  //       var args = Array.from(arguments);
-  //       args[args.length - 1] = function(err, profile) {
-  //         if (err) {
-  //           return originalDone(err);
-  //         } else {
-  //           return completeVerify(profile, originalDone);
-  //         }
-  //       };
-  //       options.verify.apply(null, args);
-  //     } else {
-  //       var profile = arguments[arguments.length - 2];
-  //       return completeVerify(profile, originalDone);
-  //     }
-  //   })
-  // );
-
-  // adminApp.get(
-  //   '/auth/strategy',
-  //   passport.authenticate(strategy.name, {
-  //     session: false,
-  //     failureRedirect: settings.httpAdminRoot
-  //   }),
-  //   completeGenerateStrategyAuth
-  // );
-
-  var callbackMethodFunc = adminApp.get;
-  if (/^post$/i.test(options.callbackMethod)) {
-    callbackMethodFunc = adminApp.post;
-  }
-
-  // callbackMethodFunc.call(
-  //   adminApp,
-  //   '/auth/strategy/callback',
-  //   passport.authenticate(strategy.name, {
-  //     session: false,
-  //     failureRedirect: settings.httpAdminRoot
-  //   }),
-  //   completeGenerateStrategyAuth
-  // );
-}
-function completeGenerateStrategyAuth(req, res) {
-  var tokens = req.user.tokens;
-  delete req.user.tokens;
-  // Successful authentication, redirect home.
-  res.redirect(settings.httpAdminRoot + '?access_token=' + tokens.accessToken);
-}
-
-module.exports = {
-  init: init,
-  needsPermission: needsPermission,
-  ensureClientSecret: ensureClientSecret,
-  authenticateClient: authenticateClient,
-  getToken: getToken,
-  errorHandler: function(err, req, res, next) {
-    //TODO: audit log statment
-    //console.log(err.stack);
-    //log.log({level:"audit",type:"auth",msg:err.toString()});
-    return server.errorHandler()(err, req, res, next);
-  },
-  login: login,
-  revoke: revoke,
-  genericStrategy: genericStrategy
-};

package/src/app/ui/editor-api/lib/auth/permissions.js

@@ -1,51 +0,0 @@
- 
-
-var util = require('util');
-
-var readRE = /^((.+)\.)?read$/
-var writeRE = /^((.+)\.)?write$/
-
-function hasPermission(userScope,permission) {
-    if (permission === "") {
-        return true;
-    }
-    var i;
-
-    if (util.isArray(permission)) {
-        // Multiple permissions requested - check each one
-        for (i=0;i<permission.length;i++) {
-            if (!hasPermission(userScope,permission[i])) {
-                return false;
-            }
-        }
-        // All permissions check out
-        return true;
-    }
-
-    if (util.isArray(userScope)) {
-        if (userScope.length === 0) {
-            return false;
-        }
-        for (i=0;i<userScope.length;i++) {
-            if (hasPermission(userScope[i],permission)) {
-                return true;
-            }
-        }
-        return false;
-    }
-
-    if (userScope === "*" || userScope === permission) {
-        return true;
-    }
-
-    if (userScope === "read" || userScope === "*.read") {
-        return readRE.test(permission);
-    } else if (userScope === "write" || userScope === "*.write") {
-        return writeRE.test(permission);
-    }
-    return false;
-}
-
-module.exports = {
-    hasPermission: hasPermission,
-}

package/src/app/ui/editor-api/lib/auth/strategies.js

@@ -1,144 +0,0 @@
- 
-
-// var BearerStrategy = require('passport-http-bearer').Strategy;
-// var ClientPasswordStrategy = require('passport-oauth2-client-password')
-//   .Strategy;
-
-// var passport = require('passport');
-// var crypto = require('crypto');
-// var util = require('util');
-
-// var Tokens = require('./tokens');
-// var Users = require('./users');
-// var Clients = require('./clients');
-// var permissions = require('./permissions');
-
-// const { util: runtimeUtil } = require('../../../../lib/runtime-loader');
-// const log = runtimeUtil.log;
-
-// var bearerStrategy = function(accessToken, done) {
-//   // is this a valid token?
-//   Tokens.get(accessToken).then(function(token) {
-//     if (token) {
-//       Users.get(token.user).then(function(user) {
-//         if (user) {
-//           done(null, user, { scope: token.scope });
-//         } else {
-//           log.audit({ event: 'auth.invalid-token' });
-//           done(null, false);
-//         }
-//       });
-//     } else {
-//       log.audit({ event: 'auth.invalid-token' });
-//       done(null, false);
-//     }
-//   });
-// };
-// bearerStrategy.BearerStrategy = new BearerStrategy(bearerStrategy);
-
-// var clientPasswordStrategy = function(clientId, clientSecret, done) {
-//   Clients.get(clientId).then(function(client) {
-//     if (client && client.secret == clientSecret) {
-//       done(null, client);
-//     } else {
-//       log.audit({ event: 'auth.invalid-client', client: clientId });
-//       done(null, false);
-//     }
-//   });
-// };
-// clientPasswordStrategy.ClientPasswordStrategy = new ClientPasswordStrategy(
-//   clientPasswordStrategy
-// );
-
-// var loginAttempts = [];
-// var loginSignInWindow = 600000; // 10 minutes
-
-// var passwordTokenExchange = function(client, username, password, scope, done) {
-//   var now = Date.now();
-//   loginAttempts = loginAttempts.filter(function(logEntry) {
-//     return logEntry.time + loginSignInWindow > now;
-//   });
-//   loginAttempts.push({ time: now, user: username });
-//   var attemptCount = 0;
-//   loginAttempts.forEach(function(logEntry) {
-//     /* istanbul ignore else */
-//     if (logEntry.user == username) {
-//       attemptCount++;
-//     }
-//   });
-//   if (attemptCount > 5) {
-//     log.audit({
-//       event: 'auth.login.fail.too-many-attempts',
-//       username: username,
-//       client: client.id
-//     });
-//     done(
-//       new Error('Too many login attempts. Wait 10 minutes and try again'),
-//       false
-//     );
-//     return;
-//   }
-
-//   Users.authenticate(username, password).then(function(user) {
-//     if (user) {
-//       if (scope === '') {
-//         scope = user.permissions;
-//       }
-//       if (permissions.hasPermission(user.permissions, scope)) {
-//         loginAttempts = loginAttempts.filter(function(logEntry) {
-//           return logEntry.user !== username;
-//         });
-//         Tokens.create(username, client.id, scope).then(function(tokens) {
-//           log.audit({
-//             event: 'auth.login',
-//             username: username,
-//             client: client.id,
-//             scope: scope
-//           });
-//           done(null, tokens.accessToken, null, {
-//             expires_in: tokens.expires_in
-//           });
-//         });
-//       } else {
-//         log.audit({
-//           event: 'auth.login.fail.permissions',
-//           username: username,
-//           client: client.id,
-//           scope: scope
-//         });
-//         done(null, false);
-//       }
-//     } else {
-//       log.audit({
-//         event: 'auth.login.fail.credentials',
-//         username: username,
-//         client: client.id,
-//         scope: scope
-//       });
-//       done(null, false);
-//     }
-//   });
-// };
-
-// function AnonymousStrategy() {
-//   passport.Strategy.call(this);
-//   this.name = 'anon';
-// }
-// util.inherits(AnonymousStrategy, passport.Strategy);
-// AnonymousStrategy.prototype.authenticate = function(req) {
-//   var self = this;
-//   Users.default().then(function(anon) {
-//     if (anon) {
-//       self.success(anon, { scope: anon.permissions });
-//     } else {
-//       self.fail(401);
-//     }
-//   });
-// };
-
-// module.exports = {
-//   bearerStrategy: bearerStrategy,
-//   clientPasswordStrategy: clientPasswordStrategy,
-//   passwordTokenExchange: passwordTokenExchange,
-//   anonymousStrategy: new AnonymousStrategy()
-// };

package/src/app/ui/editor-api/lib/auth/tokens.js

@@ -1,138 +0,0 @@
- 
-
-function generateToken(length) {
-    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
-    var token = [];
-    for (var i=0;i<length;i++) {
-        token.push(c[Math.floor(Math.random()*c.length)]);
-    }
-    return token.join("");
-}
-
-
-var storage;
-var sessionExpiryTime
-var sessions = {};
-var loadedSessions = null;
-var apiAccessTokens;
-var sessionExpiryListeners = [];
-var expiryTimeout;
-
-function expireSessions() {
-    if (expiryTimeout) {
-        clearTimeout(expiryTimeout);
-        expiryTimeout = null;
-    }
-    var nextExpiry = Number.MAX_SAFE_INTEGER;
-    var now = Date.now();
-    var modified = false;
-    for (var t in sessions) {
-        if (sessions.hasOwnProperty(t)) {
-            var session = sessions[t];
-            if (!session.hasOwnProperty("expires") || session.expires < now) {
-                sessionExpiryListeners.forEach(listener => { listener(session) })
-                delete sessions[t];
-                modified = true;
-            } else {
-                if (session.expires < nextExpiry) {
-                    nextExpiry = session.expires;
-                }
-            }
-        }
-    }
-    if (nextExpiry < Number.MAX_SAFE_INTEGER) {
-        // Allow 5 seconds grace
-        expiryTimeout = setTimeout(expireSessions,Math.min(2147483647,(nextExpiry - Date.now()) + 5000))
-    }
-    if (modified) {
-        return storage.saveSessions(sessions);
-    } else {
-        return Promise.resolve();
-    }
-}
-function loadSessions() {
-    if (loadedSessions === null) {
-        loadedSessions = storage.getSessions().then(function(_sessions) {
-             sessions = _sessions||{};
-             return expireSessions();
-        });
-    }
-    return loadedSessions;
-}
-
-module.exports = {
-    init: function(adminAuthSettings, _storage) {
-        storage = _storage;
-
-        sessionExpiryListeners = [];
-
-        sessionExpiryTime = adminAuthSettings.sessionExpiryTime || 604800; // 1 week in seconds
-        // At this point, storage will not have been initialised, so defer loading
-        // the sessions until there's a request for them.
-        loadedSessions = null;
-
-        apiAccessTokens = {};
-        if ( Array.isArray(adminAuthSettings.tokens) ) {
-            apiAccessTokens = adminAuthSettings.tokens.reduce(function(prev, current) {
-                prev[current.token] = {
-                    user: current.user,
-                    scope: current.scope
-                };
-                return prev;
-            }, {});
-        }
-        return Promise.resolve();
-    },
-    get: function(token) {
-        return loadSessions().then(function() {
-            var info = apiAccessTokens[token] || null;
-
-            if (info) {
-                return Promise.resolve(info);
-            } else {
-                if (sessions[token]) {
-                    if (sessions[token].expires < Date.now()) {
-                        return expireSessions().then(function() { return null });
-                    }
-                }
-                return Promise.resolve(sessions[token]);
-            }
-        });
-    },
-    create: function(user,client,scope) {
-        return loadSessions().then(function() {
-            var accessToken = generateToken(128);
-
-            var accessTokenExpiresAt = Date.now() + (sessionExpiryTime*1000);
-
-            var session = {
-                user:user,
-                client:client,
-                scope:scope,
-                accessToken: accessToken,
-                expires: accessTokenExpiresAt
-            };
-            sessions[accessToken] = session;
-
-            if (!expiryTimeout) {
-                expiryTimeout = setTimeout(expireSessions,Math.min(2147483647,(accessTokenExpiresAt - Date.now()) + 5000))
-            }
-
-            return storage.saveSessions(sessions).then(function() {
-                return {
-                    accessToken: accessToken,
-                    expires_in: sessionExpiryTime
-                }
-            });
-        });
-    },
-    revoke: function(token) {
-        return loadSessions().then(function() {
-            delete sessions[token];
-            return storage.saveSessions(sessions);
-        });
-    },
-    onSessionExpiry: function(callback) {
-        sessionExpiryListeners.push(callback);
-    }
-}