@openstax/ts-utils 1.34.0 → 1.34.1

package/packages/utils/src/services/authProvider/index.ts

@@ -1,93 +0,0 @@
-import cookie from 'cookie';
-import type { FetchConfig } from '../../fetch';
-import { tuple } from '../../misc/helpers';
-import type { HttpHeaders, QueryParams } from '../../routing';
-import { getHeader } from '../../routing/helpers';
-import type { Logger } from '../logger';
-
-export type ConsentPreferences = {
-  consent_preferences: {
-    accepted: string[];
-    rejected: string[];
-  };
-};
-
-export type TokenUser = {
-  id: number;
-  name: string;
-  uuid: string;
-  faculty_status: string;
-  is_admin: boolean;
-};
-
-export type ApiUser = TokenUser & {
-  first_name: string;
-  last_name: string;
-  full_name: string;
-  contact_infos: Array<{
-    type: string;
-    value: string;
-    is_verified: boolean;
-    is_guessed_preferred: boolean;
-  }>;
-  applications: Array<{
-    id: number;
-    name: string;
-    roles: string[];
-  }>;
-  external_ids: string[];
-  is_not_gdpr_location: boolean;
-  self_reported_role: string;
-  signed_contract_names: string[];
-  using_openstax: boolean;
-} & Partial<ConsentPreferences>;
-
-export type User = TokenUser | ApiUser;
-
-export type AuthProvider = {
-  getAuthToken: () => Promise<string | null>;
-  getUser: () => Promise<User | undefined>;
-  /**
-   * gets second argument for `fetch` that has authentication token or cookie
-   */
-  getAuthorizedFetchConfig: () => Promise<FetchConfig>;
-  loadUserData: () => Promise<ApiUser | undefined>;
-};
-
-export type CookieAuthProviderRequest = {
-  cookies?: string[];
-  headers: HttpHeaders;
-  queryStringParameters?: QueryParams;
-};
-
-export type CookieAuthProvider<T extends AuthProvider = AuthProvider> = (
-  inputs: {request: CookieAuthProviderRequest; logger: Logger}
-) => T;
-export type StubAuthProvider = (user: User | undefined) => AuthProvider;
-
-export const stubAuthProvider = (user?: User) => {
-  const getUser = () => Promise.resolve(user);
-
-  return {
-    getAuthToken: () => Promise.resolve('authToken'),
-    getUser,
-    getAuthorizedFetchConfig: () => Promise.resolve(
-      user ? {headers: {Authorization: user.uuid}} : {}
-    ),
-    // This is not technically correct, but most tests won't care
-    loadUserData: getUser
-  } as AuthProvider;
-};
-
-export const getAuthTokenOrCookie = (request: CookieAuthProviderRequest, cookieName: string, queryKey = 'auth') => {
-  const authParam = request.queryStringParameters ? request.queryStringParameters[queryKey] : undefined;
-  const authHeader = getHeader(request.headers, 'authorization');
-  const cookieValue = cookie.parse(request.cookies?.join('; ') ?? '')[cookieName];
-  return typeof authParam === 'string'
-  ? tuple(authParam, {Authorization: `Bearer ${authParam}`})
-  : authHeader && authHeader.length >= 8 && authHeader.startsWith('Bearer ')
-    ? tuple(authHeader.slice(7), {Authorization: authHeader})
-    : cookieValue
-      ? tuple(cookieValue, {cookie: cookie.serialize(cookieName, cookieValue)})
-      : tuple(null, {});
-};

package/packages/utils/src/services/authProvider/stub.spec.ts

@@ -1,29 +0,0 @@
-import { ApiUser, stubAuthProvider, User } from '.';
-
-describe('stubAuthProvider', () => {
-  it ('gets auth token', async() => {
-    const provider = stubAuthProvider();
-
-    expect(await provider.getAuthToken()).toBe('authToken');
-  });
-
-  it ('gets user', async() => {
-    const userResponse = {} as User;
-    const provider = stubAuthProvider(userResponse);
-
-    expect(await provider.getUser()).toBe(userResponse);
-  });
-
-  it ('gets undefined user', async() => {
-    const provider = stubAuthProvider();
-
-    expect(await provider.getUser()).toBeUndefined();
-  });
-
-  it ('loads user data', async() => {
-    const userResponse = {} as ApiUser;
-    const provider = stubAuthProvider(userResponse);
-
-    expect(await provider.loadUserData()).toBe(userResponse);
-  });
-});

package/packages/utils/src/services/authProvider/subrequest.spec.ts

@@ -1,105 +0,0 @@
-import { GenericFetch } from '../../fetch';
-import { createCoreLogger } from '../logger';
-import { subrequestAuthProvider } from './subrequest';
-import { User } from '.';
-
-describe('cookie subrequest', () => {
-  let fetchSpy: jest.SpyInstance;
-  let initializer: { fetch: GenericFetch };
-
-  beforeEach(() => {
-    fetchSpy = jest.fn();
-    initializer = {fetch: fetchSpy as any};
-  });
-  const config = {
-    subrequest: {
-      cookieName: 'sweet_cookie',
-      accountsBase: 'accountsBase',
-    }
-  };
-
-  describe('no authorization header or authorization header doesn\'t start with "Bearer "', () => {
-    // To show blank Authorization headers are ignored (excluding "Bearer " prefix)
-    const request = {headers: {Authorization: 'Bearer '}};
-    const logger = createCoreLogger(jest.fn());
-    const middleware = {request, logger};
-
-    it('returns null auth token without a cookie', async() => {
-      const token = await subrequestAuthProvider(initializer)(config)(middleware).getAuthToken();
-      expect(token).toBeNull();
-    });
-
-    it('resolves undefined without a cookie', async() => {
-      const user = await subrequestAuthProvider(initializer)(config)(middleware).getUser();
-      expect(user).toBeUndefined();
-    });
-
-    it('resolves undefined without the right cookie', async() => {
-      const user = await subrequestAuthProvider(initializer)(config)({...middleware, request: {...request, cookies: ['bad_cookie=bad-bad-bad']}}).getUser();
-      expect(user).toBeUndefined();
-    });
-
-    it('returns auth token from the right cookie', async() => {
-      const loader = subrequestAuthProvider(initializer)(config)({...middleware, request: {...request, cookies: ['bad_cookie=bad-bad-bad', 'sweet_cookie=yum']}});
-      const token = await loader.getAuthToken();
-      expect(token).toBe('yum');
-    });
-
-    it('subrequests using the right cookie', async() => {
-      const userResponse = {} as User;
-      fetchSpy.mockReturnValue(Promise.resolve({headers: {get: () => null}, json: () => userResponse}));
-      const loader = subrequestAuthProvider(initializer)(config)({...middleware, request: {...request, cookies: ['bad_cookie=bad-bad-bad', 'sweet_cookie=yum']}});
-      await loader.getUser();
-      await loader.getUser();
-      const user = await loader.getUser();
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      expect(fetchSpy).toHaveBeenCalledWith('accountsBase/api/user', {
-        headers: {cookie: 'sweet_cookie=yum'},
-      });
-      expect(user).toBe(userResponse);
-    });
-
-    it('generates empty fetch-config', async () => {
-      const provider = subrequestAuthProvider(initializer)(config)({...middleware, request: {...request, cookies: ['bad_cookie=bad-bad-bad']}});
-      expect(await provider.getAuthorizedFetchConfig()).toEqual({});
-    });
-
-    it('generates authorized fetch-config', async () => {
-      const provider = subrequestAuthProvider(initializer)(config)({...middleware, request: {...request, cookies: ['bad_cookie=bad-bad-bad', 'sweet_cookie=yum']}});
-      expect(await provider.getAuthorizedFetchConfig()).toEqual({headers: {cookie: 'sweet_cookie=yum'}});
-    });
-  });
-
-  describe('authorization header starts with "Bearer "', () => {
-    const request = {
-      headers: {Authorization: 'Bearer yummier'}, cookies: ['bad_cookie=bad-bad-bad', 'sweet_cookie=yum']
-    };
-    const logger = createCoreLogger(jest.fn());
-    const middleware = {request, logger};
-
-    it('returns auth token from the authorization header', async() => {
-      const loader = subrequestAuthProvider(initializer)(config)(middleware);
-      const token = await loader.getAuthToken();
-      expect(token).toBe('yummier');
-    });
-
-    it('subrequests using the authorization header', async() => {
-      const userResponse = {} as User;
-      fetchSpy.mockReturnValue(Promise.resolve({headers: {get: () => null}, json: () => userResponse}));
-      const loader = subrequestAuthProvider(initializer)(config)(middleware);
-      await loader.getUser();
-      await loader.getUser();
-      const user = await loader.getUser();
-      expect(fetchSpy).toHaveBeenCalledTimes(1);
-      expect(fetchSpy).toHaveBeenCalledWith('accountsBase/api/user', {
-        headers: {cookie: 'sweet_cookie=yummier'},
-      });
-      expect(user).toBe(userResponse);
-    });
-
-    it('generates authorized fetch-config', async () => {
-      const provider = subrequestAuthProvider(initializer)(config)(middleware);
-      expect(await provider.getAuthorizedFetchConfig()).toEqual({headers: {Authorization: 'Bearer yummier'}});
-    });
-  });
-});

package/packages/utils/src/services/authProvider/subrequest.ts

@@ -1,68 +0,0 @@
-import { once } from '../..';
-import { ConfigProviderForConfig, resolveConfigValue } from '../../config';
-import { GenericFetch } from '../../fetch';
-import { ifDefined } from '../../guards';
-import { loadUserData } from './utils/userSubrequest';
-import { ApiUser, CookieAuthProvider, getAuthTokenOrCookie } from '.';
-
-type Config = {
-  accountsBase: string;
-  cookieName: string;
-};
-interface Initializer<C> {
-  configSpace?: C;
-  fetch: GenericFetch;
-}
-
-export const subrequestAuthProvider = <C extends string = 'subrequest'>(initializer: Initializer<C>) => (configProvider: {[_key in C]: ConfigProviderForConfig<Config>}): CookieAuthProvider => {
-  const config = configProvider[ifDefined(initializer.configSpace, 'subrequest' as C)];
-  const cookieName = once(() => resolveConfigValue(config.cookieName));
-  const accountsBase = once(() => resolveConfigValue(config.accountsBase));
-
-  return ({request, logger}) => {
-    let user: ApiUser | undefined;
-
-    const getAuthToken = async() => getAuthTokenOrCookie(request, await cookieName())[0];
-
-    const getAuthorizedFetchConfig = async() => {
-      const [token, headers] = getAuthTokenOrCookie(request, await cookieName());
-
-      if (!token) {
-        return {};
-      }
-
-      return { headers };
-    };
-
-    const loadUser = async() => {
-      const resolvedCookieName = await cookieName();
-      const [token] = getAuthTokenOrCookie(request, resolvedCookieName);
-
-      if (!token) {
-        return undefined;
-      }
-
-      const user = await loadUserData(initializer.fetch, await accountsBase(), resolvedCookieName, token);
-
-      if (user) {
-        logger.setContext({user: user.uuid});
-      }
-      return user;
-    };
-
-    const getUser = async() => {
-      if (!user) {
-        user = await loadUser();
-      }
-
-      return user;
-    };
-
-    return {
-      getAuthToken,
-      getAuthorizedFetchConfig,
-      getUser,
-      loadUserData: getUser
-    };
-  };
-};

package/packages/utils/src/services/authProvider/utils/decryptAndVerify.spec.ts

@@ -1,128 +0,0 @@
-import { createCipheriv, generateKeyPair, randomBytes, sign } from 'crypto';
-import { decryptJwe, verifyJws } from './decryptAndVerify';
-
-describe('decryptJwe', () => {
-  const header = { alg: 'dir', enc: 'A256GCM' };
-  const plaintext = 'plaintext';
-  const key = randomBytes(32);
-  const iv = randomBytes(12);
-
-  beforeEach(() => {
-    header.alg = 'dir';
-    header.enc = 'A256GCM';
-  });
-
-  const createJwe = () => {
-    const headerBuffer = Buffer.from(JSON.stringify(header));
-    // The AAD encoding is weird
-    const aad = Buffer.from(headerBuffer.toString('base64url'));
-    const encryptedKey = Buffer.from('');
-    const cipher = createCipheriv('aes-256-gcm', key, iv, { authTagLength: 16 });
-    cipher.setAAD(aad, { plaintextLength: plaintext.length });
-    const cipherText = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-
-    return [
-      headerBuffer, encryptedKey, iv, cipherText, authTag
-    ].map((buffer) => buffer.toString('base64url')).join('.');
-  };
-
-  it('decrypts a valid JWE', () => {
-    expect(decryptJwe(createJwe(), key)).toBe(plaintext);
-  });
-
-  it('returns undefined if the jwe has the wrong number of parts', () => {
-    const jwe = createJwe();
-    expect(decryptJwe(jwe.split('.').slice(0, 4).join('.'), key)).toBeUndefined();
-    expect(decryptJwe(`${jwe}.extra`, key)).toBeUndefined();
-
-    const [header, _, iv, cipherText, authTag] = jwe.split('.');
-    expect(decryptJwe([header, 'something', iv, cipherText, authTag].join('.'), key)).toBeUndefined();
-  });
-
-  it('returns undefined if the alg or enc are unsupported', () => {
-    header.alg = 'RSA-OAEP-256';
-    expect(decryptJwe(createJwe(), key)).toBeUndefined();
-
-    header.alg = 'dir';
-    header.enc = 'A128GCM';
-    expect(decryptJwe(createJwe(), key)).toBeUndefined();
-  });
-
-  it('returns undefined if the cipherText or authTag are invalid', () => {
-    const jweParts = createJwe().split('.');
-    expect(decryptJwe(jweParts.slice(0, 3).concat(['invalid', jweParts[4]]).join('.'), key)).toBeUndefined();
-    expect(decryptJwe(jweParts.slice(0, 4).concat(['invalid']).join('.'), key)).toBeUndefined();
-  });
-});
-
-describe('verifyJws', () => {
-  const header = { alg: 'RS256', typ: 'JWT' };
-  const payload = { test: true };
-  let payloadString = JSON.stringify(payload);
-  const keys = new Promise<{ publicKey: string; privateKey: string }>((resolve, reject) => generateKeyPair(
-    'rsa',
-    {
-      modulusLength: 4096,
-      publicKeyEncoding: {
-        type: 'spki',
-        format: 'pem'
-      },
-      privateKeyEncoding: {
-        type: 'pkcs8',
-        format: 'pem',
-      }
-    },
-    (err, publicKey, privateKey) => err ? reject(err) : resolve({ publicKey, privateKey })
-  ));
-
-  beforeEach(() => {
-    header.alg = 'RS256';
-    header.typ = 'JWT';
-  });
-
-  const createJws = async() => {
-    const { privateKey } = await keys;
-    const signedContent = [
-      Buffer.from(JSON.stringify(header)),
-      Buffer.from(payloadString)
-    ].map((buffer) => buffer.toString('base64url')).join('.');
-    const signature = sign('RSA-SHA256', Buffer.from(signedContent), privateKey);
-    return `${signedContent}.${signature.toString('base64url')}`;
-  };
-
-  it('verifies a valid JWS signature', async() => {
-    const { publicKey } = await keys;
-    expect(verifyJws(await createJws(), publicKey)).toEqual(payload);
-  });
-
-  it('returns undefined if the jws has the wrong number of parts', async() => {
-    const { publicKey } = await keys;
-    const jws = await createJws();
-    expect(verifyJws(jws.split('.').slice(0, 2).join('.'), publicKey)).toBeUndefined();
-    expect(verifyJws(`${jws}.extra`, publicKey)).toBeUndefined();
-  });
-
-  it('returns undefined if the alg or typ are unsupported', async() => {
-    const { publicKey } = await keys;
-
-    header.alg = 'ES256';
-    expect(verifyJws(await createJws(), publicKey)).toBeUndefined();
-
-    header.alg = 'RS256';
-    header.typ = 'JWS';
-    expect(verifyJws(await createJws(), publicKey)).toBeUndefined();
-  });
-
-  it('returns undefined if the payload is not valid JSON', async() => {
-    payloadString = 'test';
-    const { publicKey } = await keys;
-    expect(verifyJws(await createJws(), publicKey)).toBeUndefined();
-  });
-
-  it('returns undefined if the signature is invalid', async() => {
-    const { publicKey } = await keys;
-    const jws = await createJws();
-    expect(verifyJws(jws.split('.').slice(0, 2).concat(['invalid']).join('.'), publicKey)).toBeUndefined();
-  });
-});

package/packages/utils/src/services/authProvider/utils/decryptAndVerify.ts

@@ -1,106 +0,0 @@
-import { createDecipheriv, verify } from 'crypto';
-import type { User } from '..';
-import { isPlainObject } from '../../../guards';
-
-export const decryptJwe = (jwe: string, encryptionPrivateKey: Buffer | string) => {
-  const jweParts = jwe.split('.', 6);
-  if (jweParts.length !== 5 || jweParts[1]) { return undefined; } // Invalid/unsupported JWE
-
-  const header = JSON.parse(Buffer.from(jweParts[0], 'base64url').toString());
-  if (header.alg !== 'dir' || header.enc !== 'A256GCM') {
-    // Unsupported signature/encryption algorithm
-    return undefined;
-  }
-
-  const aad = Buffer.from(jweParts[0]);
-  const iv = Buffer.from(jweParts[2], 'base64url');
-  const cipherText = Buffer.from(jweParts[3], 'base64url');
-  const authTag = Buffer.from(jweParts[4], 'base64url');
-
-  // Verify token signature and decrypt
-  const decipher = createDecipheriv('aes-256-gcm', encryptionPrivateKey, iv, { authTagLength: 16 });
-  decipher.setAAD(aad, { plaintextLength: cipherText.length });
-
-  try {
-    decipher.setAuthTag(authTag);
-    return `${decipher.update(cipherText)}${decipher.final()}`;
-  } catch(error: any) {
-    // Invalid cipherText or authTag
-    return undefined;
-  }
-};
-
-type MaybeAccountsSSOToken = {
-  iss?: string;
-  sub?: User | string;
-  aud?: string;
-  exp?: number;
-  nbf?: number;
-  iat?: number;
-  jti?: string;
-};
-
-const issuer = 'OpenStax Accounts';
-const audience = 'OpenStax';
-const clockTolerance = 300; // 5 minutes
-
-export const verifyJws = (jws: string, signaturePublicKey: Buffer | string): MaybeAccountsSSOToken | undefined => {
-  const jwsParts = jws.split('.', 4);
-  if (jwsParts.length !== 3) { return undefined; } // Invalid JWS
-
-  const header = JSON.parse(Buffer.from(jwsParts[0], 'base64url').toString());
-  if (header.alg !== 'RS256' || header.typ !== 'JWT') { return undefined; } // Unsupported JWS
-
-  const signedContent = Buffer.from(`${jwsParts[0]}.${jwsParts[1]}`);
-  const signature = Buffer.from(jwsParts[2], 'base64url');
-
-  if (!verify('RSA-SHA256', signedContent, signaturePublicKey, signature)) {
-    return undefined;
-  }
-
-  const payload = Buffer.from(jwsParts[1], 'base64url').toString();
-
-  try {
-    return JSON.parse(payload);
-  } catch(error: any) {
-    return undefined;
-  }
-};
-
-/**
- * Decrypts and verifies a SSO cookie.
- *
- * @param token the encrypted token
- * @param encryptionPrivateKey the private key used to encrypt the token
- * @param signaturePublicKey the public key used to verify the decrypted token
- * @returns {user: User; exp: number} (success) or {error: string} (failure)
- */
-export const decryptAndVerify = (
-  token: string, encryptionPrivateKey: string, signaturePublicKey: string
-): {user: User; exp: number} | {error: string; exp?: number} => {
-  const timestamp = Math.floor(Date.now() / 1000);
-
-  const jws = decryptJwe(token, encryptionPrivateKey);
-  if (!jws) { return {error: 'invalid token'}; }
-
-  const payload = verifyJws(jws, signaturePublicKey);
-
-  // Ensure payload contains all the claims we expect
-  // Normally "sub" would be a string but Accounts uses an object for it instead
-  if (!isPlainObject(payload) ||
-      !isPlainObject(payload.sub) || !payload.sub.uuid ||
-      payload.iss !== issuer ||
-      payload.aud !== audience ||
-      !payload.exp ||
-      !payload.nbf || payload.nbf > timestamp + clockTolerance ||
-      !payload.iat || payload.iat > timestamp + clockTolerance ||
-      !payload.jti) {
-    return {error: 'invalid token'};
-  }
-
-  if (payload.exp < timestamp - clockTolerance) {
-    return {error: 'expired token', exp: payload.exp};
-  }
-
-  return {user: payload.sub, exp: payload.exp};
-};

package/packages/utils/src/services/authProvider/utils/embeddedAuthProvider.spec.ts

@@ -1,26 +0,0 @@
-import { Window } from '../browser';
-import { embeddedAuthProvider } from './embeddedAuthProvider';
-
-describe('embeddedAuthProvider', () => {
-  let addEventListener: jest.SpyInstance;
-  let removeEventListener: jest.SpyInstance;
-  let window: Window;
-
-  beforeEach(() => {
-    addEventListener = jest.fn();
-    removeEventListener = jest.fn();
-
-    window = {addEventListener, removeEventListener} as any;
-  });
-
-  it('mounts', () => {
-    embeddedAuthProvider(jest.fn(), {window});
-    expect(addEventListener).toHaveBeenCalled();
-  });
-
-  it('unmounts', () => {
-    const {unmount} = embeddedAuthProvider(jest.fn(), {window});
-    unmount();
-    expect(removeEventListener).toHaveBeenCalled();
-  });
-});

package/packages/utils/src/services/authProvider/utils/embeddedAuthProvider.ts

@@ -1,57 +0,0 @@
-import queryString from 'query-string';
-import { User } from '..';
-import { EventHandler, Window } from '../browser';
-
-export type UserData<T = User> = {
-  user?: T;
-  token: string | null;
-};
-
-type UserDataLoader = () => Promise<UserData>;
-
-export enum PostMessageTypes {
-  ReceiveUser = 'receive-user',
-  RequestUser = 'request-user',
-}
-
-export const embeddedAuthProvider = (
-  getUserData: UserDataLoader,
-  { authQuery, window }: { authQuery?: { key: string; value: string | null }; window: Window }
-) => {
-  const trustedEmbeds = new Set<string>();
-  const embeddedQueryKey = 'embedded';
-  const embeddedQueryValue = 'true';
-
-  const messageHandler: EventHandler = event => {
-    if (event.data.type === PostMessageTypes.RequestUser && trustedEmbeds.has(event.origin)) {
-      getUserData().then(data => {
-        event.source.postMessage({type: PostMessageTypes.ReceiveUser, userData: data}, event.origin);
-      });
-    }
-  };
-
-  window.addEventListener('message', messageHandler);
-
-  const getAuthorizedEmbedUrl = (urlString: string, extraParams?: { [key: string]: string }) => {
-    const url = new URL(urlString);
-    trustedEmbeds.add(url.origin);
-    const params = queryString.parse(url.search);
-    url.search = queryString.stringify({
-      ...params,
-      ...extraParams,
-      ...(authQuery && authQuery.value ? { [authQuery.key]: authQuery.value } : {auth: 'embedded' }),
-      [embeddedQueryKey]: embeddedQueryValue,
-      subcontent: 'true',
-    });
-    return url.href;
-  };
-
-  return {
-    embeddedQueryKey,
-    embeddedQueryValue,
-    getAuthorizedEmbedUrl,
-    unmount: () => {
-      window.removeEventListener('message', messageHandler);
-    }
-  };
-};