@nocobase/auth 2.2.0-beta.9 → 3.0.0-alpha.1

package/lib/actions.d.ts

@@ -6,5 +6,5 @@
  * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
  * For more information, please refer to: https://www.nocobase.com/agreement.
  */
-import { Handlers } from '@nocobase/resourcer';
+import type { Handlers } from '@nocobase/resourcer';
 export declare const actions: Handlers;

package/lib/actions.js

@@ -30,7 +30,28 @@ __export(actions_exports, {
   actions: () => actions
 });
 module.exports = __toCommonJS(actions_exports);
+var import_utils = require("@nocobase/utils");
 /* istanbul ignore file -- @preserve */
+const localeNamespace = "auth";
+function assertTrustedSignInOrigin(ctx) {
+  const originContext = {
+    protocol: ctx.protocol,
+    headers: ctx.headers,
+    get: /* @__PURE__ */ __name((name) => ctx.get(name), "get")
+  };
+  const origin = ctx.get("origin");
+  if (origin) {
+    if (!(0, import_utils.isTrustedOrigin)(originContext, origin)) {
+      ctx.throw(403, ctx.t("Invalid sign-in origin", { ns: localeNamespace }));
+    }
+    return;
+  }
+  const refererOrigin = (0, import_utils.getOrigin)(ctx.get("referer"));
+  if (refererOrigin && !(0, import_utils.isTrustedOrigin)(originContext, refererOrigin)) {
+    ctx.throw(403, ctx.t("Invalid sign-in origin", { ns: localeNamespace }));
+  }
+}
+__name(assertTrustedSignInOrigin, "assertTrustedSignInOrigin");
 function filterHiddenFields(ctx, user) {
   var _a, _b;
   if (!user) {
@@ -51,6 +72,7 @@ function filterHiddenFields(ctx, user) {
 __name(filterHiddenFields, "filterHiddenFields");
 const actions = {
   signIn: /* @__PURE__ */ __name(async (ctx, next) => {
+    assertTrustedSignInOrigin(ctx);
     ctx.body = await ctx.auth.signIn();
     await next();
   }, "signIn"),
@@ -66,7 +88,11 @@ const actions = {
   check: /* @__PURE__ */ __name(async (ctx, next) => {
     ctx.body = filterHiddenFields(ctx, ctx.auth.user);
     await next();
-  }, "check")
+  }, "check"),
+  syncCookies: /* @__PURE__ */ __name(async (ctx, next) => {
+    ctx.body = await ctx.auth.syncCookies();
+    await next();
+  }, "syncCookies")
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/lib/auth-manager.d.ts

@@ -83,4 +83,5 @@ export declare class AuthManager {
     }, next: Next) => Promise<any>;
     private getDefaultJWTSecret;
 }
+export declare function csrfMiddleware(ctx: Context, next: Next): Promise<any>;
 export {};

package/lib/auth-manager.js

@@ -37,7 +37,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var auth_manager_exports = {};
 __export(auth_manager_exports, {
-  AuthManager: () => AuthManager
+  AuthManager: () => AuthManager,
+  csrfMiddleware: () => csrfMiddleware
 });
 module.exports = __toCommonJS(auth_manager_exports);
 var import_utils = require("@nocobase/utils");
@@ -45,6 +46,7 @@ var import_jwt_service = require("./base/jwt-service");
 var import_path = __toESM(require("path"));
 var import_fs = __toESM(require("fs"));
 var import_crypto = __toESM(require("crypto"));
+const SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 const _AuthManager = class _AuthManager {
   /**
    * @internal
@@ -144,23 +146,66 @@ const _AuthManager = class _AuthManager {
   middleware() {
     const self = this;
     return /* @__PURE__ */ __name(async function AuthManagerMiddleware(ctx, next) {
-      const name = ctx.get(self.options.authKey) || self.options.default;
+      var _a, _b;
+      const headerAuthenticator = ctx.get(self.options.authKey);
+      const cookieName = (0, import_utils.getAuthCookieName)("authenticator", ctx.app.name);
+      const cookieAuthenticator = headerAuthenticator ? null : ctx.cookies.get(cookieName);
+      const name = headerAuthenticator || cookieAuthenticator || self.options.default;
       let authenticator;
       try {
         authenticator = await ctx.app.authManager.get(name, ctx);
         ctx.auth = authenticator;
       } catch (err) {
-        ctx.auth = {};
-        ctx.logger.warn(err.message, { method: "check", authenticator: name });
-        return next();
+        if (cookieAuthenticator && !headerAuthenticator && self.options.default && name !== self.options.default) {
+          ctx.cookies.set(cookieName, null, (0, import_utils.getAuthCookieOptions)(ctx));
+          try {
+            authenticator = await ctx.app.authManager.get(self.options.default, ctx);
+            ctx.auth = authenticator;
+          } catch (defaultErr) {
+            ctx.auth = {};
+            ctx.logger.warn(defaultErr.message, { method: "check", authenticator: self.options.default });
+            return next();
+          }
+        } else {
+          ctx.auth = {};
+          ctx.logger.warn(err.message, { method: "check", authenticator: name });
+          return next();
+        }
       }
       if (!authenticator) {
+        ctx.auth = {};
         return next();
       }
       if (await ctx.auth.skipCheck()) {
         return next();
       }
-      const user = await ctx.auth.check();
+      let user;
+      try {
+        user = await ctx.auth.check();
+      } catch (err) {
+        if (((_a = ctx.state) == null ? void 0 : _a.optionalAuth) === true && ((_b = ctx.state) == null ? void 0 : _b.pendingAuthTokenSource) === "cookie" && (err.status === 401 || err.statusCode === 401)) {
+          const authTokenCookieName = (0, import_utils.getAuthCookieName)("authToken", ctx.app.name);
+          const authCookieOptions = (0, import_utils.getAuthCookieOptions)(ctx);
+          ctx.cookies.set(authTokenCookieName, null, authCookieOptions);
+          const rawPublicPath = process.env.APP_PUBLIC_PATH;
+          if (rawPublicPath && rawPublicPath !== authCookieOptions.path) {
+            ctx.cookies.set(authTokenCookieName, null, { ...authCookieOptions, path: rawPublicPath });
+          }
+          ctx.state.currentUser = void 0;
+          ctx.state.authTokenSource = void 0;
+          ctx.state.pendingAuthTokenSource = void 0;
+          try {
+            return await next();
+          } catch (anonymousErr) {
+            const setCookieHeader = ctx.res.getHeader("set-cookie");
+            if (setCookieHeader) {
+              anonymousErr.headers = { ...anonymousErr.headers, "set-cookie": setCookieHeader };
+            }
+            throw anonymousErr;
+          }
+        }
+        throw err;
+      }
       if (user) {
         ctx.auth.user = user;
       }
@@ -192,7 +237,24 @@ const _AuthManager = class _AuthManager {
 };
 __name(_AuthManager, "AuthManager");
 let AuthManager = _AuthManager;
+async function csrfMiddleware(ctx, next) {
+  var _a, _b;
+  if (SAFE_METHODS.has(ctx.method)) {
+    return next();
+  }
+  if (((_a = ctx.state) == null ? void 0 : _a.authTokenSource) !== "cookie" || !((_b = ctx.state) == null ? void 0 : _b.currentUser)) {
+    return next();
+  }
+  const cookieToken = ctx.cookies.get((0, import_utils.getAuthCookieName)("csrfToken", ctx.app.name));
+  const headerToken = ctx.get("X-CSRF-Token");
+  if (!cookieToken || cookieToken.length < 16 || headerToken !== cookieToken) {
+    return ctx.throw(403, ctx.t("Invalid CSRF token", { ns: "auth" }));
+  }
+  await next();
+}
+__name(csrfMiddleware, "csrfMiddleware");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  AuthManager
+  AuthManager,
+  csrfMiddleware
 });

package/lib/auth.d.ts

@@ -41,6 +41,7 @@ interface IAuth {
     signIn(): Promise<any>;
     signUp(): Promise<any>;
     signOut(): Promise<any>;
+    syncCookies(): Promise<unknown>;
 }
 export declare abstract class Auth implements IAuth {
     /**
@@ -54,7 +55,7 @@ export declare abstract class Auth implements IAuth {
     };
     protected ctx: Context;
     constructor(config: AuthConfig);
-    skipCheck(): Promise<any>;
+    skipCheck(): Promise<boolean>;
     abstract check(): Promise<Model>;
     abstract checkToken(): Promise<{
         tokenStatus: 'valid' | 'expired' | 'invalid';
@@ -67,5 +68,6 @@ export declare abstract class Auth implements IAuth {
     signIn(): Promise<any>;
     signUp(): Promise<any>;
     signOut(): Promise<any>;
+    syncCookies(): Promise<unknown>;
 }
 export {};

package/lib/auth.js

@@ -64,17 +64,28 @@ const _Auth = class _Auth {
     this.ctx = ctx;
   }
   async skipCheck() {
+    var _a, _b;
     if (this.ctx.skipAuthCheck === true) {
       return true;
     }
+    const { resourceName, actionName } = this.ctx.action;
+    const acl = this.ctx.dataSource.acl;
+    const isPublic = await acl.allowManager.isPublic(resourceName, actionName, this.ctx);
+    if (isPublic) {
+      return true;
+    }
+    const hasExplicitToken = Boolean(this.ctx.get("Authorization") || this.ctx.query.token);
+    if (!hasExplicitToken && this.ctx.app.options.acl === false && ((_a = this.ctx.state) == null ? void 0 : _a.optionalAuth) !== true) {
+      return true;
+    }
     const token = this.ctx.getBearerToken();
+    if (!token && ((_b = this.ctx.state) == null ? void 0 : _b.optionalAuth) === true) {
+      return true;
+    }
     if (!token && this.ctx.app.options.acl === false) {
       return true;
     }
-    const { resourceName, actionName } = this.ctx.action;
-    const acl = this.ctx.dataSource.acl;
-    const isPublic = await acl.allowManager.isPublic(resourceName, actionName, this.ctx);
-    return isPublic;
+    return false;
   }
   // The following methods are mainly designed for user authentications.
   async signIn() {
@@ -83,6 +94,9 @@ const _Auth = class _Auth {
   }
   async signOut() {
   }
+  async syncCookies() {
+    return void 0;
+  }
 };
 __name(_Auth, "Auth");
 /**

package/lib/base/auth.d.ts

@@ -25,6 +25,11 @@ export declare class BaseAuth extends Auth {
      */
     get jwt(): JwtService;
     get tokenController(): ITokenControlService;
+    protected get appName(): any;
+    protected getSessionCookieMaxAge(): Promise<number>;
+    protected setAuthCookies(token: string, maxAge?: number): void;
+    protected setSessionCookies(user: Model, maxAge?: number): Promise<void>;
+    protected clearAuthCookies(): void;
     set user(user: Model);
     get user(): Model;
     /**
@@ -50,5 +55,8 @@ export declare class BaseAuth extends Auth {
         user: Model<any, any>;
         token: string;
     }>;
+    syncCookies(): Promise<{
+        synced: true;
+    }>;
     signOut(): Promise<any>;
 }

package/lib/base/auth.js

@@ -40,6 +40,8 @@ __export(auth_exports, {
   BaseAuth: () => BaseAuth
 });
 module.exports = __toCommonJS(auth_exports);
+var import_utils = require("@nocobase/utils");
+var import_crypto = __toESM(require("crypto"));
 var import_jsonwebtoken = __toESM(require("jsonwebtoken"));
 var import_auth = require("../auth");
 const localeNamespace = "auth";
@@ -62,6 +64,100 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
   get tokenController() {
     return this.ctx.app.authManager.tokenController;
   }
+  get appName() {
+    var _a;
+    return ((_a = this.ctx.app) == null ? void 0 : _a.name) || "main";
+  }
+  async getSessionCookieMaxAge() {
+    var _a, _b, _c;
+    try {
+      return (_a = await this.tokenController.getConfig()) == null ? void 0 : _a.sessionExpirationTime;
+    } catch (error) {
+      (_c = (_b = this.ctx.logger) == null ? void 0 : _b.warn) == null ? void 0 : _c.call(_b, error, { method: "auth.getSessionCookieMaxAge" });
+      return void 0;
+    }
+  }
+  setAuthCookies(token, maxAge) {
+    var _a;
+    if (!this.ctx.cookies) {
+      return;
+    }
+    const options = (0, import_utils.getAuthCookieOptions)(this.ctx, true, maxAge);
+    this.ctx.cookies.set((0, import_utils.getAuthCookieName)("authToken", this.appName), token, options);
+    if ((_a = this.authenticator) == null ? void 0 : _a.name) {
+      this.ctx.cookies.set((0, import_utils.getAuthCookieName)("authenticator", this.appName), this.authenticator.name, options);
+    }
+  }
+  async setSessionCookies(user, maxAge) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q;
+    if (!this.ctx.cookies) {
+      return;
+    }
+    this.ctx.cookies.set(
+      (0, import_utils.getAuthCookieName)("csrfToken", this.appName),
+      import_crypto.default.randomBytes(24).toString("base64url"),
+      (0, import_utils.getAuthCookieOptions)(this.ctx, false, maxAge)
+    );
+    const currentRole = (_a = this.ctx.state) == null ? void 0 : _a.currentRole;
+    let roleName = typeof currentRole === "string" ? currentRole : (_c = (_b = this.ctx).get) == null ? void 0 : _c.call(_b, "X-Role");
+    const userId = typeof user.get === "function" ? user.get("id") : user.id;
+    if (!roleName) {
+      try {
+        const rolesUser = await ((_f = (_e = (_d = this.ctx.db) == null ? void 0 : _d.getRepository) == null ? void 0 : _e.call(_d, "rolesUsers")) == null ? void 0 : _f.findOne({
+          where: {
+            userId,
+            default: true
+          },
+          raw: true
+        }));
+        roleName = rolesUser == null ? void 0 : rolesUser.roleName;
+      } catch {
+        roleName = void 0;
+      }
+    }
+    if (!roleName) {
+      try {
+        const roles = await ((_i = (_h = (_g = this.ctx.db) == null ? void 0 : _g.getRepository) == null ? void 0 : _h.call(_g, "users.roles", userId)) == null ? void 0 : _i.find({
+          raw: true
+        }));
+        roleName = (_j = roles == null ? void 0 : roles[0]) == null ? void 0 : _j.name;
+      } catch {
+        roleName = void 0;
+      }
+    }
+    if (!roleName) {
+      try {
+        if (typeof user.getRoles === "function") {
+          roleName = (_l = (_k = await user.getRoles({ raw: true })) == null ? void 0 : _k[0]) == null ? void 0 : _l.name;
+        } else if (userId) {
+          const userModel = await this.userRepository.findOne({
+            filter: { id: userId }
+          });
+          roleName = (_o = (_n = await ((_m = userModel == null ? void 0 : userModel.getRoles) == null ? void 0 : _m.call(userModel, { raw: true }))) == null ? void 0 : _n[0]) == null ? void 0 : _o.name;
+        }
+      } catch (error) {
+        (_q = (_p = this.ctx.logger) == null ? void 0 : _p.warn) == null ? void 0 : _q.call(_p, error, { method: "auth.setSessionCookies" });
+        roleName = void 0;
+      }
+    }
+    if (roleName) {
+      this.ctx.cookies.set(
+        (0, import_utils.getAuthCookieName)("role", this.appName),
+        roleName,
+        (0, import_utils.getAuthCookieOptions)(this.ctx, false, maxAge)
+      );
+    }
+  }
+  clearAuthCookies() {
+    if (!this.ctx.cookies) {
+      return;
+    }
+    const options = (0, import_utils.getAuthCookieOptions)(this.ctx);
+    this.ctx.cookies.set((0, import_utils.getAuthCookieName)("authToken", this.appName), null, options);
+    this.ctx.cookies.set((0, import_utils.getAuthCookieName)("authenticator", this.appName), null, options);
+    this.ctx.cookies.set((0, import_utils.getAuthCookieName)("role", this.appName), null, (0, import_utils.getAuthCookieOptions)(this.ctx, false));
+    this.ctx.cookies.set((0, import_utils.getAuthCookieName)("csrfToken", this.appName), null, (0, import_utils.getAuthCookieOptions)(this.ctx, false));
+  }
   set user(user) {
     this.ctx.state.currentUser = user;
   }
@@ -83,7 +179,9 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
   async checkToken() {
     var _a, _b, _c;
     const cache = this.ctx.cache;
+    this.ctx.state = this.ctx.state || {};
     const token = this.ctx.getBearerToken();
+    const tokenSource = this.ctx.state.pendingAuthTokenSource;
     if (!token) {
       this.ctx.throw(401, {
         message: this.ctx.t("Unauthenticated. Please sign in to continue.", { ns: localeNamespace }),
@@ -136,6 +234,7 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
     }
     if (!temp) {
       if (tokenStatus === "valid") {
+        this.ctx.state.authTokenSource = tokenSource;
         return { tokenStatus, user, temp };
       } else {
         this.ctx.throw(401, {
@@ -185,8 +284,10 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
           code: import_auth.AuthErrorCode.INVALID_TOKEN
         });
       }
+      this.ctx.state.authTokenSource = tokenSource;
       return { tokenStatus, user, jti, signInTime, temp };
     }
+    this.ctx.state.authTokenSource = tokenSource;
     return { tokenStatus, user, jti, signInTime, temp };
   }
   async check() {
@@ -224,6 +325,7 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
           { jwtid: renewedResult.jti, expiresIn }
         );
         this.ctx.res.setHeader("x-new-token", newToken);
+        this.setAuthCookies(newToken, tokenPolicy.sessionExpirationTime);
       } catch (err) {
         this.ctx.logger.error("token renew failed", {
           method: "auth.check",
@@ -275,12 +377,31 @@ const _BaseAuth = class _BaseAuth extends import_auth.Auth {
       });
     }
     const token = await this.signNewToken(user.id);
+    const maxAge = await this.getSessionCookieMaxAge();
+    this.setAuthCookies(token, maxAge);
+    await this.setSessionCookies(user, maxAge);
     return {
       user,
       token
     };
   }
+  async syncCookies() {
+    const tokenHeader = this.ctx.res.getHeader("x-new-token");
+    const token = typeof tokenHeader === "string" ? tokenHeader : this.ctx.getBearerToken();
+    const user = this.user || this.ctx.state.currentUser;
+    if (!token || !user) {
+      this.ctx.throw(401, {
+        message: this.ctx.t("Unauthenticated. Please sign in to continue.", { ns: localeNamespace }),
+        code: import_auth.AuthErrorCode.EMPTY_TOKEN
+      });
+    }
+    const maxAge = await this.getSessionCookieMaxAge();
+    this.setAuthCookies(token, maxAge);
+    await this.setSessionCookies(user, maxAge);
+    return { synced: true };
+  }
   async signOut() {
+    this.clearAuthCookies();
     const token = this.ctx.getBearerToken();
     if (!token) {
       return;

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@nocobase/auth",
-  "version": "2.2.0-beta.9",
+  "version": "3.0.0-alpha.1",
   "description": "",
   "license": "Apache-2.0",
   "main": "./lib/index.js",
   "types": "./lib/index.d.ts",
   "dependencies": {
-    "@nocobase/actions": "2.2.0-beta.9",
-    "@nocobase/cache": "2.2.0-beta.9",
-    "@nocobase/database": "2.2.0-beta.9",
-    "@nocobase/resourcer": "2.2.0-beta.9",
-    "@nocobase/utils": "2.2.0-beta.9",
+    "@nocobase/actions": "3.0.0-alpha.1",
+    "@nocobase/cache": "3.0.0-alpha.1",
+    "@nocobase/database": "3.0.0-alpha.1",
+    "@nocobase/resourcer": "3.0.0-alpha.1",
+    "@nocobase/utils": "3.0.0-alpha.1",
     "@types/jsonwebtoken": "^9.0.9",
     "jsonwebtoken": "^9.0.2"
   },
@@ -19,5 +19,5 @@
     "url": "git+https://github.com/nocobase/nocobase.git",
     "directory": "packages/auth"
   },
-  "gitHead": "60e3d7abbaa0c7cead76f71a4f3d5eedb6b8acdb"
+  "gitHead": "22d8be8ece179cfa5c8a4ebb2c896c92bd418e03"
 }