@ngageoint/mage.service 6.2.2

package/lib/authentication/openidconnect.js

@@ -0,0 +1,148 @@
+"use strict";
+const OpenIdConnectStrategy = require('passport-openidconnect').Strategy, log = require('winston'), User = require('../models/user'), Role = require('../models/role'), TokenAssertion = require('./verification').TokenAssertion, api = require('../api'), { app, passport, tokenService } = require('./index');
+function configure(strategy) {
+    log.info(`Configuring ${strategy.title} authentication`);
+    passport.use(strategy.name, new OpenIdConnectStrategy({
+        clientID: strategy.settings.clientID,
+        clientSecret: strategy.settings.clientSecret,
+        issuer: strategy.settings.issuer,
+        authorizationURL: strategy.settings.authorizationURL,
+        tokenURL: strategy.settings.tokenURL,
+        userInfoURL: strategy.settings.profileURL,
+        callbackURL: `/auth/${strategy.name}/callback`,
+        scope: strategy.settings.scope
+    }, function (issuer, uiProfile, profile, context, idToken, accessToken, refreshToken, params, done) {
+        const jsonProfile = uiProfile._json;
+        const profileId = jsonProfile[strategy.settings.profile.id];
+        if (!profileId) {
+            log.warn(JSON.stringify(jsonProfile));
+            return done(`OIDC user profile does not contain id property ${strategy.settings.profile.id}`);
+        }
+        User.getUserByAuthenticationStrategy(strategy.type, profileId, function (err, user) {
+            if (err)
+                return done(err);
+            if (!user) {
+                // Create an account for the user
+                Role.getRole('USER_ROLE', function (err, role) {
+                    if (err)
+                        return done(err);
+                    const user = {
+                        username: profileId,
+                        displayName: jsonProfile[strategy.settings.profile.displayName] || profileId,
+                        email: jsonProfile[strategy.settings.profile.email],
+                        active: false,
+                        roleId: role._id,
+                        authentication: {
+                            type: strategy.name,
+                            id: profileId,
+                            authenticationConfiguration: {
+                                name: strategy.name
+                            }
+                        }
+                    };
+                    new api.User().create(user).then(newUser => {
+                        if (!newUser.authentication.authenticationConfiguration.enabled) {
+                            log.warn(newUser.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                            return done(null, false, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+                        }
+                        return done(null, newUser);
+                    }).catch(err => done(err));
+                });
+            }
+            else if (!user.active) {
+                return done(null, user, { message: "User is not approved, please contact your MAGE administrator to approve your account." });
+            }
+            else if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn(user.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                return done(null, user, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+            }
+            else {
+                return done(null, user);
+            }
+        });
+    }));
+    function authenticate(req, res, next) {
+        passport.authenticate(strategy.name, function (err, user, info = {}) {
+            if (err)
+                return next(err);
+            // TODO, this is a workaround for openidconnect library killing the app state
+            req.query.state = info.state;
+            req.user = user;
+            // For inactive or disabled accounts don't generate an authorization token
+            if (!user.active || !user.enabled) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is inactive or disabled.');
+                return next();
+            }
+            if (!user.authentication.authenticationConfigurationId) {
+                log.warn('Failed user login attempt: ' + user.authentication.type + ' is not configured');
+                return next();
+            }
+            if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn('Failed user login attempt: Authentication ' + user.authentication.authenticationConfiguration.title + ' is disabled.');
+                return next();
+            }
+            tokenService.generateToken(user._id.toString(), TokenAssertion.Authorized, 60 * 5)
+                .then(token => {
+                req.token = token;
+                req.user = user;
+                req.info = info;
+                next();
+            }).catch(err => {
+                next(err);
+            });
+        })(req, res, next);
+    }
+    app.get(`/auth/${strategy.name}/callback`, authenticate, function (req, res) {
+        if (req.query.state === 'mobile') {
+            let uri;
+            if (!req.user.active || !req.user.enabled) {
+                uri = `mage://app/invalid_account?active=${req.user.active}&enabled=${req.user.enabled}`;
+            }
+            else {
+                uri = `mage://app/authentication?token=${req.token}`;
+            }
+            res.redirect(uri);
+        }
+        else {
+            res.render('authentication', { host: req.getRoot(), login: { token: req.token, user: req.user } });
+        }
+    });
+}
+function setDefaults(strategy) {
+    //openid must be included in scope
+    if (!strategy.settings.scope) {
+        strategy.settings.scope = ['openid'];
+    }
+    else {
+        if (!strategy.settings.scope.includes('openid')) {
+            strategy.settings.scope.push('openid');
+        }
+    }
+    if (!strategy.settings.profile) {
+        strategy.settings.profile = {};
+    }
+    if (!strategy.settings.profile.displayName) {
+        strategy.settings.profile.displayName = 'name';
+    }
+    if (!strategy.settings.profile.email) {
+        strategy.settings.profile.email = 'email';
+    }
+    if (!strategy.settings.profile.id) {
+        strategy.settings.profile.id = 'sub';
+    }
+}
+function initialize(strategy) {
+    configure(strategy);
+    setDefaults(strategy);
+    app.get(`/auth/${strategy.name}/signin`, function (req, res, next) {
+        passport.authenticate(strategy.name, {
+            scope: strategy.settings.scope,
+            state: req.query.state
+        })(req, res, next);
+    });
+}
+;
+module.exports = {
+    initialize
+};
+//# sourceMappingURL=openidconnect.js.map

package/lib/authentication/openidconnect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openidconnect.js","sourceRoot":"","sources":["../../src/authentication/openidconnect.js"],"names":[],"mappings":";AAAA,MAAM,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EACpE,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EACxB,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,cAAc,EACzD,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EACvB,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEzD,SAAS,SAAS,CAAC,QAAQ;IACzB,GAAG,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAEzD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,qBAAqB,CAAC;QACpD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;QAC5C,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAChC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB;QACpD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;QACpC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU;QACzC,WAAW,EAAE,SAAS,QAAQ,CAAC,IAAI,WAAW;QAC9C,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;KAC/B,EAAE,UAAU,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI;QAChG,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAA;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE;YACd,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,kDAAkD,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;SAC/F;QAED,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,GAAG,EAAE,IAAI;YAChF,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE;gBACT,iCAAiC;gBACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,IAAI;oBAC3C,IAAI,GAAG;wBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBAE1B,MAAM,IAAI,GAAG;wBACX,QAAQ,EAAE,SAAS;wBACnB,WAAW,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,SAAS;wBAC5E,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBACnD,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc,EAAE;4BACd,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,EAAE,EAAE,SAAS;4BACb,2BAA2B,EAAE;gCAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;6BACpB;yBACF;qBACF,CAAC;oBAEF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;4BAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;4BACtG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;yBACpI;wBACD,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;aACJ;iBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvB,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;aAC/H;iBAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBACnE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;gBACnG,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;aACnI;iBAAM;gBACL,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACzB;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,CAAC;IAEJ,SAAS,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAClC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YACjE,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,6EAA6E;YAC7E,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;YAE5B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAEhB,0EAA0E;YAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjC,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,mCAAmC,CAAC,CAAC;gBACnG,OAAO,IAAI,EAAE,CAAC;aACf;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,EAAE;gBACtD,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,oBAAoB,CAAC,CAAC;gBAC1F,OAAO,IAAI,EAAE,CAAC;aACf;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAC5D,GAAG,CAAC,IAAI,CAAC,4CAA4C,GAAG,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;gBACjI,OAAO,IAAI,EAAE,CAAC;aACf;YAED,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC/E,IAAI,CAAC,KAAK,CAAC,EAAE;gBACZ,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;gBAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;gBACf,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,WAAW,EACvC,YAAY,EACZ,UAAU,GAAG,EAAE,GAAG;QAChB,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE;YAChC,IAAI,GAAG,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;gBACzC,GAAG,GAAG,qCAAqC,GAAG,CAAC,IAAI,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;aAC1F;iBAAM;gBACL,GAAG,GAAG,mCAAmC,GAAG,CAAC,KAAK,EAAE,CAAA;aACrD;YAED,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACnB;aAAM;YACL,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACpG;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAQ;IAC3B,kCAAkC;IAClC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;KACtC;SAAM;QACL,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAC/C,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;SACxC;KACF;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC9B,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;KAChC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QAC1C,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;KAChD;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC;KAC3C;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE;QACjC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;KACtC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAQ;IAC1B,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpB,WAAW,CAAC,QAAQ,CAAC,CAAC;IAEtB,GAAG,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,SAAS,EACrC,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK;SACvB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC;AAAA,CAAC;AAEF,MAAM,CAAC,OAAO,GAAG;IACf,UAAU;CACX,CAAA"}

package/lib/authentication/saml.d.ts

@@ -0,0 +1,2 @@
+export function initialize(strategy: any): void;
+//# sourceMappingURL=saml.d.ts.map

package/lib/authentication/saml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../../src/authentication/saml.js"],"names":[],"mappings":"AAyNA,gDA2GC"}

package/lib/authentication/saml.js

@@ -0,0 +1,287 @@
+"use strict";
+const SamlStrategy = require('passport-saml').Strategy, log = require('winston'), User = require('../models/user'), Role = require('../models/role'), Device = require('../models/device'), TokenAssertion = require('./verification').TokenAssertion, api = require('../api'), userTransformer = require('../transformers/user'), AuthenticationInitializer = require('./index'), authenticationApiAppender = require('../utilities/authenticationApiAppender');
+function configure(strategy) {
+    log.info('Configuring ' + strategy.title + ' authentication');
+    const options = {
+        path: `/auth/${strategy.name}/callback`,
+        entryPoint: strategy.settings.options.entryPoint,
+        issuer: strategy.settings.options.issuer
+    };
+    if (strategy.settings.cert) {
+        options.cert = strategy.settings.cert;
+    }
+    if (strategy.settings.privateCert) {
+        options.privateCert = strategy.settings.privateCert;
+    }
+    if (strategy.settings.decryptionPvk) {
+        options.decryptionPvk = strategy.settings.decryptionPvk;
+    }
+    if (strategy.settings.signatureAlgorithm) {
+        options.signatureAlgorithm = strategy.settings.signatureAlgorithm;
+    }
+    if (strategy.settings.audience) {
+        options.audience = strategy.settings.audience;
+    }
+    if (strategy.settings.identifierFormat) {
+        options.identifierFormat = strategy.settings.identifierFormat;
+    }
+    if (strategy.settings.acceptedClockSkewMs) {
+        options.acceptedClockSkewMs = strategy.settings.acceptedClockSkewMs;
+    }
+    if (strategy.settings.attributeConsumingServiceIndex) {
+        options.attributeConsumingServiceIndex = strategy.settings.attributeConsumingServiceIndex;
+    }
+    if (strategy.settings.disableRequestedAuthnContext) {
+        options.disableRequestedAuthnContext = strategy.settings.disableRequestedAuthnContext;
+    }
+    if (strategy.settings.authnContext) {
+        options.authnContext = strategy.settings.authnContext;
+    }
+    if (strategy.settings.forceAuthn) {
+        options.forceAuthn = strategy.settings.forceAuthn;
+    }
+    if (strategy.settings.skipRequestCompression) {
+        options.skipRequestCompression = strategy.settings.skipRequestCompression;
+    }
+    if (strategy.settings.authnRequestBinding) {
+        options.authnRequestBinding = strategy.settings.authnRequestBinding;
+    }
+    if (strategy.settings.RACComparison) {
+        options.RACComparison = strategy.settings.RACComparison;
+    }
+    if (strategy.settings.providerName) {
+        options.providerName = strategy.settings.providerName;
+    }
+    if (strategy.settings.idpIssuer) {
+        options.idpIssuer = strategy.settings.idpIssuer;
+    }
+    if (strategy.settings.validateInResponseTo) {
+        options.validateInResponseTo = strategy.settings.validateInResponseTo;
+    }
+    if (strategy.settings.requestIdExpirationPeriodMs) {
+        options.requestIdExpirationPeriodMs = strategy.settings.requestIdExpirationPeriodMs;
+    }
+    if (strategy.settings.logoutUrl) {
+        options.logoutUrl = strategy.settings.logoutUrl;
+    }
+    AuthenticationInitializer.passport.use(new SamlStrategy(options, function (profile, done) {
+        const uid = profile[strategy.settings.profile.id];
+        if (!uid) {
+            log.warn('Failed to find property uid. SAML profile keys ' + Object.keys(profile));
+            return done('Failed to load user id from SAML profile');
+        }
+        User.getUserByAuthenticationStrategy(strategy.type, uid, function (err, user) {
+            if (err)
+                return done(err);
+            if (!user) {
+                // Create an account for the user
+                Role.getRole('USER_ROLE', function (err, role) {
+                    if (err)
+                        return done(err);
+                    const user = {
+                        username: uid,
+                        displayName: profile[strategy.settings.profile.displayName],
+                        email: profile[strategy.settings.profile.email],
+                        active: false,
+                        roleId: role._id,
+                        authentication: {
+                            type: strategy.name,
+                            id: uid,
+                            authenticationConfiguration: {
+                                name: strategy.name
+                            }
+                        }
+                    };
+                    new api.User().create(user).then(newUser => {
+                        if (!newUser.authentication.authenticationConfiguration.enabled) {
+                            log.warn(newUser.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                            return done(null, false, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+                        }
+                        return done(null, newUser);
+                    }).catch(err => done(err));
+                });
+            }
+            else if (!user.active) {
+                return done(null, user, { message: "User is not approved, please contact your MAGE administrator to approve your account." });
+            }
+            else if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn(user.authentication.authenticationConfiguration.title + " authentication is not enabled");
+                return done(null, user, { message: 'Authentication method is not enabled, please contact a MAGE administrator for assistance.' });
+            }
+            else {
+                return done(null, user);
+            }
+        });
+    }));
+    function authenticate(req, res, next) {
+        AuthenticationInitializer.passport.authenticate(strategy.name, function (err, user, info = {}) {
+            if (err)
+                return next(err);
+            req.user = user;
+            // For inactive or disabled accounts don't generate an authorization token
+            if (!user.active || !user.enabled) {
+                log.warn('Failed user login attempt: User ' + user.username + ' account is inactive or disabled.');
+                return next();
+            }
+            if (!user.authentication.authenticationConfigurationId) {
+                log.warn('Failed user login attempt: ' + user.authentication.type + ' is not configured');
+                return next();
+            }
+            if (!user.authentication.authenticationConfiguration.enabled) {
+                log.warn('Failed user login attempt: Authentication ' + user.authentication.authenticationConfiguration.title + ' is disabled.');
+                return next();
+            }
+            // DEPRECATED session authorization, remove req.login which creates session in next version
+            req.login(user, function (err) {
+                AuthenticationInitializer.tokenService.generateToken(user._id.toString(), TokenAssertion.Authorized, 60 * 5)
+                    .then(token => {
+                    req.token = token;
+                    req.user = user;
+                    req.info = info;
+                    next();
+                }).catch(err => {
+                    next(err);
+                });
+            });
+        })(req, res, next);
+    }
+    AuthenticationInitializer.app.post(`/auth/${strategy.name}/callback`, authenticate, function (req, res) {
+        let state = {};
+        try {
+            state = JSON.parse(req.body.RelayState);
+        }
+        catch (ignore) { }
+        if (state.initiator === 'mage') {
+            if (state.client === 'mobile') {
+                let uri;
+                if (!req.user.active || !req.user.enabled) {
+                    uri = `mage://app/invalid_account?active=${req.user.active}&enabled=${req.user.enabled}`;
+                }
+                else {
+                    uri = `mage://app/authentication?token=${req.token}`;
+                }
+                res.redirect(uri);
+            }
+            else {
+                res.render('authentication', { host: req.getRoot(), login: { token: req.token, user: req.user } });
+            }
+        }
+        else {
+            if (req.user.active && req.user.enabled) {
+                res.redirect(`/#/signin?strategy=${strategy.name}&action=authorize-device&token=${req.token}`);
+            }
+            else {
+                const action = !req.user.active ? 'inactive-account' : 'disabled-account';
+                res.redirect(`/#/signin?strategy=${strategy.name}&action=${action}`);
+            }
+        }
+    });
+}
+function setDefaults(strategy) {
+    if (!strategy.settings.profile) {
+        strategy.settings.profile = {};
+    }
+    if (!strategy.settings.profile.displayName) {
+        strategy.settings.profile.displayName = 'email';
+    }
+    if (!strategy.settings.profile.email) {
+        strategy.settings.profile.email = 'email';
+    }
+    if (!strategy.settings.profile.id) {
+        strategy.settings.profile.id = 'uid';
+    }
+    if (!strategy.settings.options) {
+        strategy.settings.options = {};
+    }
+}
+function initialize(strategy) {
+    const app = AuthenticationInitializer.app;
+    const passport = AuthenticationInitializer.passport;
+    const provision = AuthenticationInitializer.provision;
+    setDefaults(strategy);
+    configure(strategy);
+    function parseLoginMetadata(req, res, next) {
+        req.loginOptions = {
+            userAgent: req.headers['user-agent'],
+            appVersion: req.param('appVersion')
+        };
+        next();
+    }
+    app.get('/auth/' + strategy.name + '/signin', function (req, res, next) {
+        const state = {
+            initiator: 'mage',
+            client: req.query.state
+        };
+        passport.authenticate(strategy.name, {
+            additionalParams: { RelayState: JSON.stringify(state) }
+        })(req, res, next);
+    });
+    // DEPRECATED retain old routes as deprecated until next major version.
+    // Create a new device
+    // Any authenticated user can create a new device, the registered field
+    // will be set to false.
+    app.post('/auth/' + strategy.name + '/devices', function (req, res, next) {
+        if (req.user) {
+            next();
+        }
+        else {
+            res.sendStatus(401);
+        }
+    }, function (req, res, next) {
+        const newDevice = {
+            uid: req.param('uid'),
+            name: req.param('name'),
+            registered: false,
+            description: req.param('description'),
+            userAgent: req.headers['user-agent'],
+            appVersion: req.param('appVersion'),
+            userId: req.user.id
+        };
+        Device.getDeviceByUid(newDevice.uid)
+            .then(device => {
+            if (device) {
+                // already exists, do not register
+                return res.json(device);
+            }
+            Device.createDevice(newDevice)
+                .then(device => res.json(device))
+                .catch(err => next(err));
+        })
+            .catch(err => next(err));
+    });
+    // DEPRECATED session authorization, remove in next version.
+    app.post('/auth/' + strategy.name + '/authorize', function (req, res, next) {
+        if (req.user) {
+            log.warn('session authorization is deprecated, please use jwt');
+            return next();
+        }
+        passport.authenticate('authorization', function (err, user, info = {}) {
+            if (!user)
+                return res.status(401).send(info.message);
+            req.user = user;
+            next();
+        })(req, res, next);
+    }, provision.check(strategy.name), parseLoginMetadata, function (req, res, next) {
+        new api.User().login(req.user, req.provisionedDevice, req.loginOptions, function (err, token) {
+            if (err)
+                return next(err);
+            authenticationApiAppender.append(strategy.api).then(api => {
+                res.json({
+                    token: token.token,
+                    expirationDate: token.expirationDate,
+                    user: userTransformer.transform(req.user, { path: req.getRoot() }),
+                    device: req.provisionedDevice,
+                    api: api
+                });
+            }).catch(err => {
+                next(err);
+            });
+        });
+        req.session = null;
+    });
+}
+;
+module.exports = {
+    initialize
+};
+//# sourceMappingURL=saml.js.map

package/lib/authentication/saml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.js","sourceRoot":"","sources":["../../src/authentication/saml.js"],"names":[],"mappings":";AAAA,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,EAClD,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,EACxB,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,EAChC,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,EACpC,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,cAAc,EACzD,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EACvB,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,EACjD,yBAAyB,GAAG,OAAO,CAAC,SAAS,CAAC,EAC9C,yBAAyB,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;AAElF,SAAS,SAAS,CAAC,QAAQ;IACzB,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,KAAK,GAAG,iBAAiB,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,SAAS,QAAQ,CAAC,IAAI,WAAW;QACvC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;QAChD,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;KACzC,CAAA;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC1B,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;KACvC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;QACjC,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;KACrD;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE;QACnC,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;KACzD;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE;QACxC,OAAO,CAAC,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;KACnE;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC7B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC/C;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE;QACrC,OAAO,CAAC,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;KAC/D;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACxC,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KACrE;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,8BAA8B,EAAE;QACnD,OAAO,CAAC,8BAA8B,GAAG,QAAQ,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KAC3F;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,EAAE;QACjD,OAAO,CAAC,4BAA4B,GAAG,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACvF;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE;QACjC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;KACvD;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE;QAC/B,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;KACnD;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE;QAC3C,OAAO,CAAC,sBAAsB,GAAG,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KAC3E;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACxC,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;KACrE;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE;QAClC,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;KACzD;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE;QACjC,OAAO,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;KACvD;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC9B,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,EAAE;QACzC,OAAO,CAAC,oBAAoB,GAAG,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC;KACvE;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,2BAA2B,EAAE;QAChD,OAAO,CAAC,2BAA2B,GAAG,QAAQ,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KACrF;IACD,IAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC9B,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;KACjD;IAED,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,UAAU,OAAO,EAAE,IAAI;QACtF,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,EAAE;YACR,GAAG,CAAC,IAAI,CAAC,iDAAiD,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC,0CAA0C,CAAC,CAAC;SACzD;QAED,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,GAAG,EAAE,IAAI;YAC1E,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,CAAC,IAAI,EAAE;gBACT,iCAAiC;gBACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,GAAG,EAAE,IAAI;oBAC3C,IAAI,GAAG;wBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;oBAE1B,MAAM,IAAI,GAAG;wBACX,QAAQ,EAAE,GAAG;wBACb,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;wBAC3D,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBAC/C,MAAM,EAAE,KAAK;wBACb,MAAM,EAAE,IAAI,CAAC,GAAG;wBAChB,cAAc,EAAE;4BACd,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,EAAE,EAAE,GAAG;4BACP,2BAA2B,EAAE;gCAC3B,IAAI,EAAE,QAAQ,CAAC,IAAI;6BACpB;yBACF;qBACF,CAAC;oBAEF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;4BAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;4BACtG,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;yBACpI;wBACD,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC7B,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,CAAC,CAAC;aACJ;iBAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACvB,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;aAC/H;iBAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBACnE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,gCAAgC,CAAC,CAAC;gBACnG,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2FAA2F,EAAE,CAAC,CAAC;aACnI;iBAAM;gBACL,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACzB;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,CAAC;IAEJ,SAAS,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAClC,yBAAyB,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YAC3F,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAEhB,0EAA0E;YAC1E,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;gBACjC,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,GAAG,mCAAmC,CAAC,CAAC;gBACnG,OAAO,IAAI,EAAE,CAAC;aACf;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,6BAA6B,EAAE;gBACtD,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,oBAAoB,CAAC,CAAC;gBAC1F,OAAO,IAAI,EAAE,CAAC;aACf;YAED,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,OAAO,EAAE;gBAC5D,GAAG,CAAC,IAAI,CAAC,4CAA4C,GAAG,IAAI,CAAC,cAAc,CAAC,2BAA2B,CAAC,KAAK,GAAG,eAAe,CAAC,CAAC;gBACjI,OAAO,IAAI,EAAE,CAAC;aACf;YAED,2FAA2F;YAC3F,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG;gBAC3B,yBAAyB,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;qBACzG,IAAI,CAAC,KAAK,CAAC,EAAE;oBACZ,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;oBAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;oBAChB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAA;oBACf,IAAI,EAAE,CAAC;gBACT,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;oBACb,IAAI,CAAC,GAAG,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAChC,SAAS,QAAQ,CAAC,IAAI,WAAW,EACjC,YAAY,EACZ,UAAU,GAAG,EAAE,GAAG;QAChB,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI;YACF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;SACxC;QAAC,OAAM,MAAM,EAAE,GAAE;QAElB,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE;gBAC7B,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;oBACzC,GAAG,GAAG,qCAAqC,GAAG,CAAC,IAAI,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;iBAC1F;qBAAM;oBACL,GAAG,GAAG,mCAAmC,GAAG,CAAC,KAAK,EAAE,CAAA;iBACrD;gBAED,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;aACnB;iBAAM;gBACL,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACpG;SACF;aAAM;YACL,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;gBACvC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,QAAQ,CAAC,IAAI,kCAAkC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;aAChG;iBAAM;gBACL,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAC1E,GAAG,CAAC,QAAQ,CAAC,sBAAsB,QAAQ,CAAC,IAAI,WAAW,MAAM,EAAE,CAAC,CAAC;aACtE;SACF;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAQ;IAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC9B,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;KAChC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;QAC1C,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC;KACjD;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC;KAC3C;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE;QACjC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC;KACtC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;QAC9B,QAAQ,CAAC,QAAQ,CAAC,OAAO,GAAG,EAAE,CAAC;KAChC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAQ;IAC1B,MAAM,GAAG,GAAG,yBAAyB,CAAC,GAAG,CAAC;IAC1C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC;IACpD,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC;IAEtD,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtB,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpB,SAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QACxC,GAAG,CAAC,YAAY,GAAG;YACjB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YACpC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;SACpC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IACD,GAAG,CAAC,GAAG,CACL,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,SAAS,EACpC,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK;SACxB,CAAC;QAEF,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE;YACnC,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;SACxD,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CACF,CAAC;IAEF,uEAAuE;IACvE,sBAAsB;IACtB,uEAAuE;IACvE,wBAAwB;IACxB,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,UAAU,EAC5C,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE;YACZ,IAAI,EAAE,CAAC;SACR;aAAM;YACL,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACrB;IACH,CAAC,EACD,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,MAAM,SAAS,GAAG;YAChB,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YACrB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACvB,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;YACrC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;YACpC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;SACpB,CAAC;QAEF,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC;aACjC,IAAI,CAAC,MAAM,CAAC,EAAE;YACb,IAAI,MAAM,EAAE;gBACV,kCAAkC;gBAClC,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;aACzB;YAED,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;iBAChC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC,CACF,CAAC;IAEF,4DAA4D;IAC5D,GAAG,CAAC,IAAI,CACN,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,YAAY,EACvC,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE;YACZ,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAChE,OAAO,IAAI,EAAE,CAAC;SACf;QAED,QAAQ,CAAC,YAAY,CAAC,eAAe,EAAE,UAAU,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;YACnE,IAAI,CAAC,IAAI;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAErD,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,EACD,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC9B,kBAAkB,EAClB,UAAU,GAAG,EAAE,GAAG,EAAE,IAAI;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,GAAG,EAAE,KAAK;YAC1F,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAE1B,yBAAyB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACxD,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;oBAClE,MAAM,EAAE,GAAG,CAAC,iBAAiB;oBAC7B,GAAG,EAAE,GAAG;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IACrB,CAAC,CACF,CAAC;AAEJ,CAAC;AAAA,CAAC;AAEF,MAAM,CAAC,OAAO,GAAG;IACf,UAAU;CACX,CAAA"}

package/lib/authentication/verification.d.ts

@@ -0,0 +1,33 @@
+export function payload(subject: any, assertion: any): {
+    subject: string;
+    assertion: any;
+};
+export namespace TokenAssertion {
+    const Authorized: string;
+    const Captcha: string;
+}
+export class TokenGenerateError extends Error {
+    constructor(subject: any, assertion: any, secondsToLive: any, cause: any);
+    subject: any;
+    assertion: any;
+    secondsToLive: any;
+    cause: any;
+}
+export namespace VerificationErrorReason {
+    const NoToken: string;
+    const Subject: string;
+    const Assertion: string;
+    const Expired: string;
+    const Decode: string;
+    const Implementation: string;
+}
+export const JWTService: {
+    new (secret: any, issuer: any): {
+        _secret: any;
+        _issuer: any;
+        _algorithm: string;
+        generateToken(subject: any, assertion: any, secondsToLive: any, claims?: {}): Promise<any>;
+        verifyToken(token: any, expected: any): Promise<any>;
+    };
+};
+//# sourceMappingURL=verification.d.ts.map

package/lib/authentication/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/authentication/verification.js"],"names":[],"mappings":"AAEA;;;EAEC;;;;;AAgBD;IAEE,0EAYC;IATC,aAAsB;IACtB,eAA0B;IAC1B,mBAAkC;IAClC,WAAkB;CAOrB;;;;;;;;;AAsCD;;;;;;;;EAwEC"}

package/lib/authentication/verification.js

@@ -0,0 +1,144 @@
+"use strict";
+const JWT = require('jsonwebtoken');
+function payload(subject, assertion) {
+    return { subject: `${subject}`, assertion: assertion };
+}
+const VerificationErrorReason = {
+    NoToken: 'no_token',
+    Subject: 'subject',
+    Assertion: 'assertion',
+    Expired: 'expired',
+    Decode: 'decode',
+    Implementation: 'implementation'
+};
+const TokenAssertion = {
+    Authorized: 'urn:mage:auth:authorized',
+    Captcha: 'urn:mage:signup:captcha'
+};
+class TokenGenerateError extends Error {
+    constructor(subject, assertion, secondsToLive, cause) {
+        super();
+        this.name = 'TokenVerificationError';
+        this.subject = subject;
+        this.assertion = assertion;
+        this.secondsToLive = secondsToLive;
+        this.cause = cause;
+        let causeMessage = '';
+        if (cause) {
+            causeMessage = 'cause=' + (cause instanceof Error ? `${"\n" + cause.stack || `${cause.name}: ${cause.message}`}` : `${cause}`);
+        }
+        this.message = `error generating token: subject=${subject}; assertion=${assertion}; secondsToLive=${secondsToLive}; ${causeMessage}`;
+    }
+}
+class TokenVerificationError extends Error {
+    /**
+     * @param reason why the verification failed
+     * @param subject the expected subject
+     * @param assertion the expected assertion
+     * @param token the encoded token string
+     * @param decoded the decoded payload of the token
+     * @param cause cause of the verification error from the underlying token implementation
+     */
+    constructor(reason, expected, token, decoded, cause) {
+        super();
+        this.reason = reason;
+        this.expected = expected || { subject: null, assertion: null };
+        this.token = token;
+        this.decoded = decoded;
+        let reasonMessage = `${reason}`;
+        let causeMessage = '';
+        if (cause) {
+            causeMessage = 'cause=' + (cause instanceof Error ? `${"\n" + cause.stack || `${cause.name}: ${cause.message}`}` : `${cause}`);
+        }
+        decoded = decoded || { subject: null, assertion: null, expiration: null };
+        if (reason === VerificationErrorReason.Subject) {
+            reasonMessage = `subject was ${decoded.subject}`;
+        }
+        else if (reason === VerificationErrorReason.Assertion) {
+            reasonMessage = `assertion was ${decoded.assertion}`;
+        }
+        else if (reason === VerificationErrorReason.Expired) {
+            reasonMessage = `token expired ${new Date(decoded.expiration || 0)} (${decoded.expiration})`;
+        }
+        else if (reason === VerificationErrorReason.Decode) {
+            reasonMessage = `failed to decode token`;
+        }
+        this.message = `TokenVerificationError (${reasonMessage}): expected subject=${this.expected.subject}, assertion=${this.expected.assertion}; token=${token}; ${causeMessage}`;
+    }
+}
+const JWTService = class {
+    constructor(secret, issuer) {
+        this._secret = secret;
+        this._issuer = issuer;
+        this._algorithm = 'HS256';
+    }
+    generateToken(subject, assertion, secondsToLive, claims = {}) {
+        return new Promise((resolve, reject) => {
+            const payload = Object.assign({ assertion: assertion }, claims);
+            JWT.sign(payload, this._secret, {
+                algorithm: this._algorithm,
+                issuer: this._issuer,
+                expiresIn: secondsToLive,
+                subject: subject,
+            }, (err, token) => {
+                if (err) {
+                    reject(new TokenGenerateError(subject, assertion, secondsToLive, err));
+                }
+                else {
+                    resolve(token);
+                }
+            });
+        });
+    }
+    verifyToken(token, expected) {
+        return new Promise((resolve, reject) => {
+            JWT.verify(token, this._secret, { algorithms: [this._algorithm], issuer: this._issuer }, (err, payload) => {
+                if (!expected) {
+                    expected = { subject: null, assertion: null };
+                }
+                if (err) {
+                    let reason = VerificationErrorReason.Implementation;
+                    let decoded = null;
+                    try {
+                        const jwt = JWT.decode(token, { json: true });
+                        if (jwt) {
+                            decoded = Object.assign({}, jwt, {
+                                subject: jwt.sub || null,
+                                assertion: jwt.assertion || null,
+                                expiration: jwt.exp || null
+                            });
+                        }
+                    }
+                    catch (err) {
+                        reason = VerificationErrorReason.Decode;
+                    }
+                    if (!decoded) {
+                        reason = VerificationErrorReason.Decode;
+                        decoded = { subject: null, assertion: null, expiration: null };
+                    }
+                    else if (err instanceof JWT.TokenExpiredError) {
+                        reason = VerificationErrorReason.Expired;
+                    }
+                    return reject(new TokenVerificationError(reason, expected, token, payload, err));
+                }
+                else if (expected.subject && payload.sub !== expected.subject) {
+                    return reject(new TokenVerificationError(VerificationErrorReason.Subject, expected, token, payload));
+                }
+                else if (expected.assertion && payload.assertion !== expected.assertion) {
+                    return reject(new TokenVerificationError(VerificationErrorReason.Assertion, expected, token, payload));
+                }
+                resolve(Object.assign({}, payload, {
+                    subject: payload.sub || null,
+                    assertion: payload.assertion || null,
+                    expiration: payload.exp || null
+                }));
+            });
+        });
+    }
+};
+exports.payload = payload;
+exports.TokenAssertion = TokenAssertion;
+exports.TokenGenerateError = TokenGenerateError;
+exports.VerificationErrorReason = VerificationErrorReason;
+exports.JWTService = JWTService;
+//# sourceMappingURL=verification.js.map