@rockcarver/frodo-lib 0.16.2-9 → 0.17.0

package/esm/ops/AdminOps.mjs

@@ -10,20 +10,19 @@ import { clientCredentialsGrant } from '../api/OAuth2OIDCApi';
 import { printMessage } from './utils/Console';
 import path from 'path';
 import { fileURLToPath } from 'url';
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
 const OAUTH2_CLIENT = JSON.parse(fs.readFileSync(path.resolve(__dirname, './templates/OAuth2ClientTemplate.json'), 'utf8'));
 const GENERIC_EXTENSION_ATTRIBUTES = JSON.parse(fs.readFileSync(path.resolve(__dirname, './templates/cloud/GenericExtensionAttributesTemplate.json'), 'utf8'));
 const protectedClients = ['ui', 'idm-provisioning'];
 const protectedSubjects = ['amadmin', 'autoid-resource-server'];
-const privilegedScopes = ['am-introspect-all-tokens', 'fr:idm:*', 'fr:idc:esv:*']; // const privilegedUsers = ['openidm-admin'];
-
+const privilegedScopes = ['am-introspect-all-tokens', 'fr:idm:*', 'fr:idc:esv:*'];
+// const privilegedUsers = ['openidm-admin'];
 const privilegedRoles = ['internal/role/openidm-authorized', 'internal/role/openidm-admin'];
 const adminScopes = ['fr:idm:*', 'fr:idc:esv:*'];
 const adminDefaultScopes = ['fr:idm:*'];
 const adminRoles = ['internal/role/openidm-authorized', 'internal/role/openidm-admin'];
 const autoIdRoles = ['internal/role/platform-provisioning', 'internal/role/openidm-authorized', 'internal/role/openidm-admin'];
+
 /*
  * List all oauth2 clients, which have a corresponding staticUserMapping
  * in the IDM authentication.json:
@@ -49,7 +48,6 @@ const autoIdRoles = ['internal/role/platform-provisioning', 'internal/role/openi
     }
   }
  */
-
 export async function listOAuth2CustomClients() {
   let clients = (await getOAuth2Clients()).data.result;
   clients = clients.map(client => client._id).filter(client => !protectedClients.includes(client));
@@ -58,6 +56,7 @@ export async function listOAuth2CustomClients() {
   const adminClients = subjects.filter(subject => clients.includes(subject));
   return adminClients;
 }
+
 /*
  * List all oauth2 clients, which have the fr:idm:* scope and a 
  * corresponding staticUserMapping in the IDM authentication.json
@@ -80,12 +79,10 @@ export async function listOAuth2CustomClients() {
     }
   }
  */
-
 export async function listOAuth2AdminClients() {
   let clients = (await getOAuth2Clients()).data.result;
   clients = clients.filter(client => {
     let isPrivileged = false;
-
     if (client.coreOAuth2ClientConfig.scopes) {
       client.coreOAuth2ClientConfig.scopes.forEach(scope => {
         if (privilegedScopes.includes(scope)) {
@@ -93,13 +90,11 @@ export async function listOAuth2AdminClients() {
         }
       });
     }
-
     return isPrivileged;
   }).map(client => client._id).filter(client => !protectedClients.includes(client));
   const authentication = await getConfigEntity('authentication');
   const subjects = authentication.rsFilter.staticUserMapping.filter(mapping => {
     let isPrivileged = false;
-
     if (mapping.roles) {
       mapping.roles.forEach(role => {
         if (privilegedRoles.includes(role)) {
@@ -107,12 +102,12 @@ export async function listOAuth2AdminClients() {
         }
       });
     }
-
     return isPrivileged;
   }).map(mapping => mapping.subject).filter(subject => !protectedSubjects.includes(subject));
   const adminClients = subjects.filter(subject => clients.includes(subject));
   return adminClients;
 }
+
 /*
  * List all static user mappings that are not oauth2 clients in authentication.json
  * and are assigned admin privileges:
@@ -154,14 +149,12 @@ export async function listOAuth2AdminClients() {
     }
   }
  */
-
 export async function listNonOAuth2AdminStaticUserMappings(showProtected) {
   let clients = (await getOAuth2Clients()).data.result;
   clients = clients.map(client => client._id).filter(client => !protectedClients.includes(client));
   const authentication = await getConfigEntity('authentication');
   let subjects = authentication.rsFilter.staticUserMapping.filter(mapping => {
     let isPrivileged = false;
-
     if (mapping.roles) {
       mapping.roles.forEach(role => {
         if (privilegedRoles.includes(role)) {
@@ -169,45 +162,35 @@ export async function listNonOAuth2AdminStaticUserMappings(showProtected) {
         }
       });
     }
-
     return isPrivileged;
   }).map(mapping => mapping.subject);
-
   if (!showProtected) {
     subjects = subjects.filter(subject => !protectedSubjects.includes(subject));
   }
-
   const adminSubjects = subjects.filter(subject => !clients.includes(subject));
   return adminSubjects;
 }
-
 async function getDynamicClientRegistrationScope() {
   const provider = (await getOAuth2Provider()).data;
   return provider.clientDynamicRegistrationConfig.dynamicClientRegistrationScope;
 }
-
 async function addAdminScopes(clientId, client) {
   const modClient = client;
   const allAdminScopes = adminScopes.concat([await getDynamicClientRegistrationScope()]);
   let addScopes = [];
-
   if (modClient.coreOAuth2ClientConfig.scopes && modClient.coreOAuth2ClientConfig.scopes.value) {
     addScopes = allAdminScopes.filter(scope => {
       let add = false;
-
       if (!modClient.coreOAuth2ClientConfig.scopes.value.includes(scope)) {
         add = true;
       }
-
       return add;
     });
     modClient.coreOAuth2ClientConfig.scopes.value = modClient.coreOAuth2ClientConfig.scopes.value.concat(addScopes);
   } else {
     modClient.coreOAuth2ClientConfig.scopes.value = allAdminScopes;
   }
-
   let addDefaultScope = false;
-
   if (modClient.coreOAuth2ClientConfig.defaultScopes && modClient.coreOAuth2ClientConfig.defaultScopes.value) {
     if (modClient.coreOAuth2ClientConfig.defaultScopes.value.length === 0) {
       addDefaultScope = true;
@@ -216,20 +199,16 @@ async function addAdminScopes(clientId, client) {
       printMessage(`Client "${clientId}" already has default scopes configured, not adding admin default scope.`);
     }
   }
-
   if (addScopes.length > 0 || addDefaultScope) {
     printMessage(`Adding admin scopes to client "${clientId}"...`);
   } else {
     printMessage(`Client "${clientId}" already has admin scopes.`);
   }
-
   return modClient;
 }
-
 function addClientCredentialsGrantType(clientId, client) {
   const modClient = client;
   let modified = false;
-
   if (modClient.advancedOAuth2ClientConfig.grantTypes && modClient.advancedOAuth2ClientConfig.grantTypes.value) {
     if (!modClient.advancedOAuth2ClientConfig.grantTypes.value.includes('client_credentials')) {
       modified = true;
@@ -238,27 +217,21 @@ function addClientCredentialsGrantType(clientId, client) {
   } else {
     modClient.advancedOAuth2ClientConfig.grantTypes.value = ['client_credentials'];
   }
-
   modClient.advancedOAuth2ClientConfig.grantTypes.inherited = false;
-
   if (modified) {
     printMessage(`Adding client credentials grant type to client "${clientId}"...`);
   } else {
     printMessage(`Client "${clientId}" already has client credentials grant type.`);
   }
-
   return modClient;
 }
-
 async function addAdminStaticUserMapping(name) {
   let authentication = {};
-
   try {
     authentication = await getConfigEntity('authentication');
   } catch (error) {
     printMessage(`Error reading IDM authentication configuration: ${error.message}`, 'error');
   }
-
   let needsAdminMapping = true;
   let addRoles = [];
   const mappings = authentication['rsFilter']['staticUserMapping'].map(mapping => {
@@ -266,22 +239,18 @@ async function addAdminStaticUserMapping(name) {
     if (mapping.subject !== name) {
       return mapping;
     }
-
     needsAdminMapping = false;
     addRoles = adminRoles.filter(role => {
       let add = false;
-
       if (!mapping.roles.includes(role)) {
         add = true;
       }
-
       return add;
     });
     const newMapping = mapping;
     newMapping.roles = newMapping.roles.concat(addRoles);
     return newMapping;
   });
-
   if (needsAdminMapping) {
     printMessage(`Creating static user mapping for client "${name}"...`);
     mappings.push({
@@ -291,12 +260,9 @@ async function addAdminStaticUserMapping(name) {
       roles: adminRoles
     });
   }
-
   authentication['rsFilter']['staticUserMapping'] = mappings;
-
   if (addRoles.length > 0 || needsAdminMapping) {
     printMessage(`Adding admin roles to static user mapping for client "${name}"...`);
-
     try {
       await putConfigEntity('authentication', authentication);
     } catch (putConfigEntityError) {
@@ -307,6 +273,7 @@ async function addAdminStaticUserMapping(name) {
     printMessage(`Static user mapping for client "${name}" already has admin roles.`);
   }
 }
+
 /*
  * Add AutoId static user mapping to authentication.json to enable dashboards and other AutoId-based functionality.
   {
@@ -328,8 +295,6 @@ async function addAdminStaticUserMapping(name) {
     }
   }
  */
-
-
 export async function addAutoIdStaticUserMapping() {
   const name = 'autoid-resource-server';
   const authentication = await getConfigEntity('authentication');
@@ -340,22 +305,18 @@ export async function addAutoIdStaticUserMapping() {
     if (mapping.subject !== name) {
       return mapping;
     }
-
     needsAdminMapping = false;
     addRoles = autoIdRoles.filter(role => {
       let add = false;
-
       if (!mapping.roles.includes(role)) {
         add = true;
       }
-
       return add;
     });
     const newMapping = mapping;
     newMapping.roles = newMapping.roles.concat(addRoles);
     return newMapping;
   });
-
   if (needsAdminMapping) {
     printMessage(`Creating static user mapping for AutoId client "${name}"...`);
     mappings.push({
@@ -365,12 +326,9 @@ export async function addAutoIdStaticUserMapping() {
       roles: autoIdRoles
     });
   }
-
   authentication.rsFilter.staticUserMapping = mappings;
-
   if (addRoles.length > 0 || needsAdminMapping) {
     printMessage(`Adding required roles to static user mapping for AutoId client "${name}"...`);
-
     try {
       await putConfigEntity('authentication', authentication);
     } catch (putConfigEntityError) {
@@ -383,73 +341,58 @@ export async function addAutoIdStaticUserMapping() {
 }
 export async function grantOAuth2ClientAdminPrivileges(clientId) {
   let client = (await getOAuth2Client(clientId)).data;
-
   if (client.coreOAuth2ClientConfig.clientName.value.length === 0) {
     client.coreOAuth2ClientConfig.clientName.value = [clientId];
   }
-
   if (client.advancedOAuth2ClientConfig.descriptions.value.length === 0 || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Modified by Frodo') || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Created by Frodo')) {
     client.advancedOAuth2ClientConfig.descriptions.value = [`Modified by Frodo on ${new Date().toLocaleString()}`];
   }
-
   client = await addAdminScopes(clientId, client);
   client = addClientCredentialsGrantType(clientId, client);
   await putOAuth2Client(clientId, client);
   await addAdminStaticUserMapping(clientId);
 }
-
 async function removeAdminScopes(name, client) {
   const modClient = client;
   const allAdminScopes = adminScopes.concat([await getDynamicClientRegistrationScope()]);
   let finalScopes = [];
-
   if (modClient.coreOAuth2ClientConfig.scopes && modClient.coreOAuth2ClientConfig.scopes.value) {
     finalScopes = modClient.coreOAuth2ClientConfig.scopes.value.filter(scope => !allAdminScopes.includes(scope));
   }
-
   if (modClient.coreOAuth2ClientConfig.scopes.value.length > finalScopes.length) {
     printMessage(`Removing admin scopes from client "${name}"...`);
     modClient.coreOAuth2ClientConfig.scopes.value = finalScopes;
   } else {
     printMessage(`Client "${name}" has no admin scopes.`);
   }
-
   let finalDefaultScopes = [];
-
   if (modClient.coreOAuth2ClientConfig.defaultScopes && modClient.coreOAuth2ClientConfig.defaultScopes.value) {
     finalDefaultScopes = modClient.coreOAuth2ClientConfig.defaultScopes.value.filter(scope => !adminDefaultScopes.includes(scope));
   }
-
   if (modClient.coreOAuth2ClientConfig.defaultScopes.value.length > finalDefaultScopes.length) {
     printMessage(`Removing admin default scopes from client "${name}"...`);
     modClient.coreOAuth2ClientConfig.defaultScopes.value = finalDefaultScopes;
   } else {
     printMessage(`Client "${name}" has no admin default scopes.`);
   }
-
   return modClient;
 }
-
 function removeClientCredentialsGrantType(clientId, client) {
   const modClient = client;
   let modified = false;
   let finalGrantTypes = [];
-
   if (modClient.advancedOAuth2ClientConfig.grantTypes && modClient.advancedOAuth2ClientConfig.grantTypes.value) {
     finalGrantTypes = modClient.advancedOAuth2ClientConfig.grantTypes.value.filter(grantType => grantType !== 'client_credentials');
     modified = modClient.advancedOAuth2ClientConfig.grantTypes.value.length > finalGrantTypes.length;
   }
-
   if (modified) {
     printMessage(`Removing client credentials grant type from client "${clientId}"...`);
     modClient.advancedOAuth2ClientConfig.grantTypes.value = finalGrantTypes;
   } else {
     printMessage(`Client "${clientId}" does not allow client credentials grant type.`);
   }
-
   return modClient;
 }
-
 async function removeAdminStaticUserMapping(name) {
   const authentication = await getConfigEntity('authentication');
   let finalRoles = [];
@@ -460,25 +403,20 @@ async function removeAdminStaticUserMapping(name) {
     if (mapping.subject !== name) {
       return mapping;
     }
-
     finalRoles = mapping.roles.filter(role => !adminRoles.includes(role));
     const newMapping = mapping;
     removeMapping = finalRoles.length === 0; // if there are no more roles left on this mapping, flag it for removal
-
     modified = mapping.roles.length > finalRoles.length; // if there were roles removed, set modified flag
-
     newMapping.roles = finalRoles;
     return newMapping;
   }).filter(mapping => mapping.subject !== name || !removeMapping);
   authentication.rsFilter.staticUserMapping = mappings;
-
   if (modified || removeMapping) {
     if (removeMapping) {
       printMessage(`Removing static user mapping for client "${name}"...`);
     } else {
       printMessage(`Removing admin roles from static user mapping for client "${name}"...`);
     }
-
     try {
       await putConfigEntity('authentication', authentication);
     } catch (putConfigEntityError) {
@@ -489,18 +427,14 @@ async function removeAdminStaticUserMapping(name) {
     printMessage(`Static user mapping for client "${name}" has no admin roles.`);
   }
 }
-
 export async function revokeOAuth2ClientAdminPrivileges(clientId) {
   let client = (await getOAuth2Client(clientId)).data;
-
   if (client.coreOAuth2ClientConfig.clientName.value.length === 0) {
     client.coreOAuth2ClientConfig.clientName.value = [clientId];
   }
-
   if (client.advancedOAuth2ClientConfig.descriptions.value.length === 0 || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Modified by Frodo') || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Created by Frodo')) {
     client.advancedOAuth2ClientConfig.descriptions.value = [`Modified by Frodo on ${new Date().toLocaleString()}`];
   }
-
   client = await removeAdminScopes(clientId, client);
   client = removeClientCredentialsGrantType(clientId, client);
   await putOAuth2Client(clientId, client);
@@ -511,7 +445,6 @@ export async function createOAuth2ClientWithAdminPrivileges(clientId, clientSecr
   client.coreOAuth2ClientConfig.userpassword = clientSecret;
   client.coreOAuth2ClientConfig.clientName.value = [clientId];
   client.advancedOAuth2ClientConfig.descriptions.value = [`Created by Frodo on ${new Date().toLocaleString()}`];
-
   try {
     client = await addAdminScopes(clientId, client);
     await putOAuth2Client(clientId, client);
@@ -523,21 +456,20 @@ export async function createOAuth2ClientWithAdminPrivileges(clientId, clientSecr
 export async function createLongLivedToken(clientId, clientSecret, scope, secret, lifetime) {
   // get oauth2 client
   const client = (await getOAuth2Client(clientId)).data;
-  client.userpassword = clientSecret; // remember current lifetime
-
-  const rememberedLifetime = client.coreOAuth2ClientConfig.accessTokenLifetime.value || 3600; // set long token lifetime
-
+  client.userpassword = clientSecret;
+  // remember current lifetime
+  const rememberedLifetime = client.coreOAuth2ClientConfig.accessTokenLifetime.value || 3600;
+  // set long token lifetime
   client.coreOAuth2ClientConfig.accessTokenLifetime.value = lifetime;
   await putOAuth2Client(clientId, client);
   const response = (await clientCredentialsGrant(clientId, clientSecret, scope)).data;
   const expires = new Date().getTime() + 1000 * response.expires_in;
-  response.expires_on = new Date(expires).toLocaleString(); // reset token lifetime
-
+  response.expires_on = new Date(expires).toLocaleString();
+  // reset token lifetime
   client.coreOAuth2ClientConfig.accessTokenLifetime.value = rememberedLifetime;
-  await putOAuth2Client(clientId, client); // create secret with token as value
-
+  await putOAuth2Client(clientId, client);
+  // create secret with token as value
   const description = 'Long-lived admin token';
-
   try {
     await putSecret(secret, response.access_token, description);
     response.secret = secret;
@@ -549,7 +481,6 @@ export async function createLongLivedToken(clientId, clientSecret, scope, secret
       response.secret = newSecret;
     }
   }
-
   delete response.access_token;
   return response;
 }
@@ -560,16 +491,13 @@ export async function removeStaticUserMapping(subject) {
     // find the subject and flag it
     if (mapping.subject === subject) {
       removeMapping = true;
-    } // ignore mappings for other subjects
-
-
+    }
+    // ignore mappings for other subjects
     return mapping.subject !== subject;
   });
   authentication.rsFilter.staticUserMapping = mappings;
-
   if (removeMapping) {
     printMessage(`Removing static user mapping for subject "${subject}"...`);
-
     try {
       await putConfigEntity('authentication', authentication);
     } catch (putConfigEntityError) {
@@ -588,12 +516,11 @@ export async function hideGenericExtensionAttributes(includeCustomized, dryRun)
     if (object.name !== getRealmManagedUser()) {
       return object;
     }
-
     propertyNames.forEach(name => {
       if (isEqualJson(GENERIC_EXTENSION_ATTRIBUTES[name], object.schema.properties[name], ['viewable', 'usageDescription']) || includeCustomized) {
         if (object.schema.properties[name].viewable) {
-          printMessage(`${name}: hide`); // eslint-disable-next-line no-param-reassign
-
+          printMessage(`${name}: hide`);
+          // eslint-disable-next-line no-param-reassign
           object.schema.properties[name].viewable = false;
         } else {
           printMessage(`${name}: ignore (already hidden)`);
@@ -605,7 +532,6 @@ export async function hideGenericExtensionAttributes(includeCustomized, dryRun)
     return object;
   });
   managed.objects = updatedObjects;
-
   if (dryRun) {
     printMessage('Dry-run only. Changes are not saved.');
   } else {
@@ -625,12 +551,11 @@ export async function showGenericExtensionAttributes(includeCustomized, dryRun)
     if (object.name !== getRealmManagedUser()) {
       return object;
     }
-
     propertyNames.forEach(name => {
       if (isEqualJson(GENERIC_EXTENSION_ATTRIBUTES[name], object.schema.properties[name], ['viewable', 'usageDescription']) || includeCustomized) {
         if (!object.schema.properties[name].viewable) {
-          printMessage(`${name}: show`); // eslint-disable-next-line no-param-reassign
-
+          printMessage(`${name}: show`);
+          // eslint-disable-next-line no-param-reassign
           object.schema.properties[name].viewable = true;
         } else {
           printMessage(`${name}: ignore (already showing)`);
@@ -642,7 +567,6 @@ export async function showGenericExtensionAttributes(includeCustomized, dryRun)
     return object;
   });
   managed.objects = updatedObjects;
-
   if (dryRun) {
     printMessage('Dry-run only. Changes are not saved.');
   } else {
@@ -654,7 +578,6 @@ export async function showGenericExtensionAttributes(includeCustomized, dryRun)
     }
   }
 }
-
 async function repairOrgModelUser(dryRun) {
   const managed = await getConfigEntity('managed');
   const RDVPs = ['memberOfOrgIDs'];
@@ -664,12 +587,11 @@ async function repairOrgModelUser(dryRun) {
     if (object.name !== getRealmManagedUser()) {
       return object;
     }
-
     printMessage(`${object.name}: checking...`);
     RDVPs.forEach(name => {
       if (!object.schema.properties[name].queryConfig.flattenProperties) {
-        printMessage(`- ${name}: repairing - needs flattening`, 'warn'); // eslint-disable-next-line no-param-reassign
-
+        printMessage(`- ${name}: repairing - needs flattening`, 'warn');
+        // eslint-disable-next-line no-param-reassign
         object.schema.properties[name].queryConfig.flattenProperties = true;
         repairData = true;
       } else {
@@ -679,7 +601,6 @@ async function repairOrgModelUser(dryRun) {
     return object;
   });
   managed.objects = updatedObjects;
-
   if (!dryRun) {
     try {
       await putConfigEntity('managed', managed);
@@ -688,10 +609,8 @@ async function repairOrgModelUser(dryRun) {
       printMessage(`Error: ${putConfigEntityError}`, 'error');
     }
   }
-
   return repairData;
 }
-
 async function repairOrgModelOrg(dryRun) {
   const managed = await getConfigEntity('managed');
   const RDVPs = ['adminIDs', 'ownerIDs', 'parentAdminIDs', 'parentOwnerIDs', 'parentIDs'];
@@ -701,12 +620,11 @@ async function repairOrgModelOrg(dryRun) {
     if (object.name !== getRealmManagedOrganization()) {
       return object;
     }
-
     printMessage(`${object.name}: checking...`);
     RDVPs.forEach(name => {
       if (!object.schema.properties[name].queryConfig.flattenProperties) {
-        printMessage(`- ${name}: repairing - needs flattening`, 'warn'); // eslint-disable-next-line no-param-reassign
-
+        printMessage(`- ${name}: repairing - needs flattening`, 'warn');
+        // eslint-disable-next-line no-param-reassign
         object.schema.properties[name].queryConfig.flattenProperties = true;
         repairData = true;
       } else {
@@ -716,7 +634,6 @@ async function repairOrgModelOrg(dryRun) {
     return object;
   });
   managed.objects = updatedObjects;
-
   if (!dryRun) {
     try {
       await putConfigEntity('managed', managed);
@@ -725,40 +642,37 @@ async function repairOrgModelOrg(dryRun) {
       printMessage(`Error: ${putConfigEntityError}`, 'error');
     }
   }
-
   return repairData;
 }
-
 async function repairOrgModelData(dryRun = false) {
-  if (!dryRun) {// const rootOrgs = await findRootOrganizations();
+  if (!dryRun) {
+    // const rootOrgs = await findRootOrganizations();
   }
 }
-
 async function extendOrgModelPermissins(dryRun = false) {
-  if (!dryRun) {// const rootOrgs = await findRootOrganizations();
+  if (!dryRun) {
+    // const rootOrgs = await findRootOrganizations();
   }
 }
-
 export async function repairOrgModel(excludeCustomized, extendPermissions, dryRun) {
   let repairData = false;
   repairData = repairData || (await repairOrgModelUser(dryRun));
   repairData = repairData || (await repairOrgModelOrg(dryRun));
-
-  if (excludeCustomized) {//
+  if (excludeCustomized) {
+    //
   }
-
   if (repairData) {
     await repairOrgModelData(dryRun);
   }
-
   if (extendPermissions) {
     await extendOrgModelPermissins(dryRun);
   }
-
   if (dryRun) {
     printMessage('Dry-run only. Changes are not saved.', 'warn');
   }
-} // suggested by John K.
+}
+
+// suggested by John K.
 // export async function removeRealmNameFromManagedObjectLabels() {}
 // export async function addRealmNameToManagedObjectLabels() {}
 // export async function cleanUpPostmanArtifacts() {}