@solidxai/core 0.1.10-beta.27 → 0.1.10-beta.28

package/src/controllers/microsoft-active-directory-authentication.controller.ts

@@ -0,0 +1,104 @@
+import {
+  Controller,
+  Get,
+  InternalServerErrorException,
+  Query,
+  Req,
+  Res,
+  UseGuards,
+} from "@nestjs/common";
+import { ApiQuery, ApiTags } from "@nestjs/swagger";
+import { Request, Response } from "express";
+import {
+  DEFAULT_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT,
+  MicrosoftActiveDirectoryAuthConfiguration,
+  isMicrosoftActiveDirectoryOAuthConfigured,
+} from "../helpers/microsoft-active-directory-oauth.helper";
+import { AuthenticationService } from "../services/authentication.service";
+import { SettingService } from "../services/setting.service";
+import { Public } from "src/decorators/public.decorator";
+import { Auth } from "../decorators/auth.decorator";
+import { AuthType } from "../enums/auth-type.enum";
+import { MicrosoftActiveDirectoryOauthGuard } from "../passport-strategies/microsoft-active-directory-oauth.strategy";
+import { UserService } from "../services/user.service";
+import type { SolidCoreSetting } from "../services/settings/default-settings-provider.service";
+
+@Auth(AuthType.None)
+@ApiTags("Solid Core")
+@Controller("iam/microsoft-active-directory")
+export class MicrosoftActiveDirectoryAuthenticationController {
+  constructor(
+    private readonly userService: UserService,
+    private readonly authService: AuthenticationService,
+    private readonly settingService: SettingService,
+  ) {}
+
+  private async getConfiguration(): Promise<MicrosoftActiveDirectoryAuthConfiguration> {
+    return {
+      clientID: this.settingService.getConfigValue<SolidCoreSetting>("MICROSOFT_ACTIVE_DIRECTORY_CLIENT_ID"),
+      clientSecret: this.settingService.getConfigValue<SolidCoreSetting>("MICROSOFT_ACTIVE_DIRECTORY_CLIENT_SECRET"),
+      tenant: this.settingService.getConfigValue<SolidCoreSetting>("MICROSOFT_ACTIVE_DIRECTORY_TENANT_ID" ) ?? DEFAULT_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT,
+      callbackURL: this.settingService.getConfigValue<SolidCoreSetting>("MICROSOFT_ACTIVE_DIRECTORY_CALLBACK_URL"), 
+      redirectURL: this.settingService.getConfigValue<SolidCoreSetting>("MICROSOFT_ACTIVE_DIRECTORY_REDIRECT_URL"),
+    };
+  }
+
+  private buildFrontendRedirectUrl(redirectURL: string, accessCode: string) {
+    const separator = redirectURL.includes("?") ? "&" : "?";
+    return `${redirectURL}${separator}accessCode=${encodeURIComponent(accessCode)}`;
+  }
+
+  private async validateConfiguration() {
+    const config = await this.getConfiguration();
+    if (!isMicrosoftActiveDirectoryOAuthConfigured(config)) {
+      throw new InternalServerErrorException("Microsoft Active Directory OAuth is not configured");
+    }
+    return config;
+  }
+
+  @Public()
+  @UseGuards(MicrosoftActiveDirectoryOauthGuard)
+  @Get("connect")
+  async connect() {
+    await this.validateConfiguration();
+  }
+
+  @Public()
+  @Get("connect/callback")
+  @UseGuards(MicrosoftActiveDirectoryOauthGuard)
+  async microsoftActiveDirectoryAuthCallback(
+    @Req() req: Request,
+    @Res() res: Response,
+  ) {
+    const config = await this.validateConfiguration();
+    const user = req.user;
+    return res.redirect(
+      this.buildFrontendRedirectUrl(config.redirectURL, user["accessCode"]),
+    );
+  }
+
+  @Public()
+  @Get("dummy-redirect")
+  async dummyMicrosoftActiveDirectoryAuthRedirect(
+    @Query("accessCode") accessCode,
+  ) {
+    await this.validateConfiguration();
+    const user = await this.userService.findOneByAccessCode(accessCode);
+
+    if (user) {
+      delete user["password"];
+    }
+
+    return user;
+  }
+
+  @Public()
+  @Get("authenticate")
+  @ApiQuery({ name: "accessCode", required: true, type: String })
+  async microsoftActiveDirectoryAuth(
+    @Query("accessCode") accessCode: string,
+  ) {
+    await this.validateConfiguration();
+    return this.authService.signInUsingMicrosoftActiveDirectory(accessCode);
+  }
+}

package/src/entities/user.entity.ts

@@ -89,6 +89,18 @@ export class User extends CommonEntity {
     // don't send to client
     microsoftProfilePicture: string;
 
+    @Column({ type: "varchar", nullable: true })
+    // don't send to client
+    microsoftActiveDirectoryId: string;
+
+    @Column({ type: "varchar", nullable: true })
+    // don't send to client
+    microsoftActiveDirectoryAccessToken: string;
+
+    @Column({ type: "varchar", nullable: true })
+    // don't send to client
+    microsoftActiveDirectoryProfilePicture: string;
+
     @Index()
     @Column({ default: true })
     @Expose()
@@ -194,4 +206,4 @@ export class User extends CommonEntity {
     @Expose()
     apiKeys: UserApiKey[];
 
-}
+}

package/src/helpers/microsoft-active-directory-oauth.helper.ts

@@ -0,0 +1,83 @@
+export type MicrosoftActiveDirectoryAuthConfiguration = {
+  clientID: string;
+  clientSecret: string;
+  tenant: string;
+  callbackURL: string;
+  redirectURL: string;
+};
+
+export const DEFAULT_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT = "common";
+export const MICROSOFT_ACTIVE_DIRECTORY_OAUTH_SCOPES = [
+  "openid",
+  "profile",
+  "email",
+  "User.Read",
+];
+
+type MicrosoftActiveDirectoryOauthProfileValue = {
+  value?: string;
+};
+
+export type MicrosoftActiveDirectoryOauthProfile = {
+  id?: string;
+  displayName?: string;
+  emails?: MicrosoftActiveDirectoryOauthProfileValue[];
+  photos?: MicrosoftActiveDirectoryOauthProfileValue[];
+  _json?: {
+    id?: string;
+    displayName?: string;
+    mail?: string;
+    userPrincipalName?: string;
+    email?: string;
+    preferred_username?: string;
+    picture?: string;
+  };
+};
+
+export const isMicrosoftActiveDirectoryOAuthConfigured = (
+  config: MicrosoftActiveDirectoryAuthConfiguration,
+): boolean => {
+  return !!(
+    config.clientID &&
+    config.clientSecret &&
+    config.tenant &&
+    config.callbackURL &&
+    config.redirectURL
+  );
+};
+
+export const getMicrosoftActiveDirectoryOAuthProfileId = (
+  profile: MicrosoftActiveDirectoryOauthProfile,
+): string | null => {
+  return profile.id || profile._json?.id || null;
+};
+
+export const getMicrosoftActiveDirectoryOAuthEmail = (
+  profile: MicrosoftActiveDirectoryOauthProfile,
+): string | null => {
+  const email =
+    profile.emails?.find((item) => !!item.value)?.value ||
+    profile._json?.mail ||
+    profile._json?.userPrincipalName ||
+    profile._json?.email ||
+    profile._json?.preferred_username ||
+    null;
+
+  return email?.trim().toLowerCase() || null;
+};
+
+export const getMicrosoftActiveDirectoryOAuthDisplayName = (
+  profile: MicrosoftActiveDirectoryOauthProfile,
+): string | null => {
+  return profile.displayName || profile._json?.displayName || null;
+};
+
+export const getMicrosoftActiveDirectoryOAuthPicture = (
+  profile: MicrosoftActiveDirectoryOauthProfile,
+): string | null => {
+  return (
+    profile.photos?.find((item) => !!item.value)?.value ||
+    profile._json?.picture ||
+    null
+  );
+};

package/src/helpers/user-helper.ts

@@ -15,6 +15,10 @@ export function getUserExcludedFields(): string[] {
     "facebookId",
     "microsoftAccessToken",
     "microsoftId",
+    "microsoftProfilePicture",
+    "microsoftActiveDirectoryAccessToken",
+    "microsoftActiveDirectoryId",
+    "microsoftActiveDirectoryProfilePicture",
     "forgotPasswordConfirmedAt",
     "verificationTokenOnForgotPassword",
     "verificationTokenOnForgotPasswordExpiresAt",
@@ -38,4 +42,4 @@ export function getUserExcludedFields(): string[] {
     "userViewMetadataIds",
     "userViewMetadataCommand",
   ];
-}
+}

package/src/index.ts

@@ -269,6 +269,7 @@ export * from './listeners/user-registration.listener'
 export * from './passport-strategies/google-oauth.strategy'
 export * from './passport-strategies/facebook-oauth.strategy'
 export * from './passport-strategies/microsoft-oauth.strategy'
+export * from './passport-strategies/microsoft-active-directory-oauth.strategy'
 
 export * from './services/selection-providers/list-of-values-selection-providers.service'
 

package/src/passport-strategies/microsoft-active-directory-oauth.strategy.ts

@@ -0,0 +1,63 @@
+import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
+import { AuthGuard, PassportStrategy } from '@nestjs/passport';
+import { Strategy } from 'passport-microsoft';
+import { DEFAULT_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT, MICROSOFT_ACTIVE_DIRECTORY_OAUTH_SCOPES, MicrosoftActiveDirectoryAuthConfiguration, getMicrosoftActiveDirectoryOAuthDisplayName, getMicrosoftActiveDirectoryOAuthEmail, getMicrosoftActiveDirectoryOAuthPicture, getMicrosoftActiveDirectoryOAuthProfileId, isMicrosoftActiveDirectoryOAuthConfigured } from 'src/helpers/microsoft-active-directory-oauth.helper';
+import { v4 as uuid } from 'uuid';
+import { UserService } from '../services/user.service';
+
+const DUMMY_CLIENT_ID = 'DUMMY_CLIENT_ID';
+const DUMMY_CLIENT_SECRET = 'DUMMY_CLIENT_SECRET';
+const DUMMY_CALLBACK_URL = 'DUMMY_CALLBACK_URL';
+
+@Injectable()
+export class MicrosoftActiveDirectoryOauthGuard extends AuthGuard('microsoft-active-directory') { }
+
+
+@Injectable()
+export class MicrosoftActiveDirectoryOAuthStrategy extends PassportStrategy(Strategy, 'microsoft-active-directory') {
+  private readonly logger = new Logger(MicrosoftActiveDirectoryOAuthStrategy.name);
+  constructor(private readonly userService: UserService) {
+    // TODO: Have added default dummy values for the configuration, since the configuration is not mandatory.
+    // Perhaps a cleaner way needs to be figured out
+    const clientID = process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CLIENT_ID || DUMMY_CLIENT_ID;
+    const clientSecret = process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CLIENT_SECRET || DUMMY_CLIENT_SECRET;
+    const tenant = process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT_ID || DEFAULT_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT;
+    const callbackURL = process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CALLBACK_URL || DUMMY_CALLBACK_URL;
+    const redirectURL = process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_REDIRECT_URL;
+
+    super({ clientID, clientSecret, callbackURL, tenant, scope: MICROSOFT_ACTIVE_DIRECTORY_OAUTH_SCOPES, addUPNAsEmail: true });
+
+    const microsoftActiveDirectoryOauth: MicrosoftActiveDirectoryAuthConfiguration = { clientID, clientSecret, tenant, callbackURL, redirectURL }
+    if (!isMicrosoftActiveDirectoryOAuthConfigured(microsoftActiveDirectoryOauth)) {
+      this.logger.debug('Microsoft Active Directory OAuth strategy is not configured');
+    }
+  }
+
+  async validate(_accessToken: string, _refreshToken: string, profile: any, done: any): Promise<any> {
+    const providerId = getMicrosoftActiveDirectoryOAuthProfileId(profile);
+
+    if (!providerId) {
+      return done(new UnauthorizedException('Microsoft Active Directory OAuth profile is missing an id'), false);
+    }
+
+    // generate a unique access code. 
+    const loginAccessCode: string = uuid();
+
+    const user = {
+      provider: 'microsoftActiveDirectory',
+      providerId,
+      email: getMicrosoftActiveDirectoryOAuthEmail(profile),
+      name: getMicrosoftActiveDirectoryOAuthDisplayName(profile) || getMicrosoftActiveDirectoryOAuthEmail(profile) || 'Microsoft Active Directory User',
+      picture: getMicrosoftActiveDirectoryOAuthPicture(profile),
+      accessCode: loginAccessCode,
+    };
+
+    // store the access code and the access token in the database. 
+    // while doing this we also check if the user exists in the database if not we create one. 
+    // if exists then we update the user and store the specified access code & token.
+    await this.userService.resolveUserOnOauthMicrosoftActiveDirectory({ ...user, accessToken: _accessToken, refreshToken: null });
+
+    done(null, user);
+  }
+
+}

package/src/services/authentication.service.ts

@@ -1997,6 +1997,84 @@ export class AuthenticationService {
     };
   }
 
+  async validateUserUsingMicrosoftActiveDirectory(user: User) {
+    if (
+      !user.microsoftActiveDirectoryAccessToken ||
+      !user.microsoftActiveDirectoryId
+    ) {
+      throw new UnauthorizedException(ERROR_MESSAGES.USER_NOT_FOUND);
+    }
+
+    try {
+      const response = await this.httpService.axiosRef.get(
+        `https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName`,
+        {
+          headers: {
+            Authorization: `Bearer ${user.microsoftActiveDirectoryAccessToken}`,
+          },
+        },
+      );
+      const userProfile = response.data;
+      const profileEmail = (userProfile.mail || userProfile.userPrincipalName)
+        ?.trim()
+        .toLowerCase();
+      const userEmail = user.email?.trim().toLowerCase();
+
+      if (
+        userProfile.id === user.microsoftActiveDirectoryId &&
+        (!userEmail || profileEmail === userEmail)
+      ) {
+        return userProfile;
+      } else {
+        throw new UnauthorizedException(ERROR_MESSAGES.INVALID_USER_PROFILE);
+      }
+    } catch (error: any) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+
+      throw new UnauthorizedException(
+        ERROR_MESSAGES.MICROSOFT_ACTIVE_DIRECTORY_OAUTH_PROFILE_FETCH_FAILED,
+      );
+    }
+  }
+
+  async signInUsingMicrosoftActiveDirectory(accessCode: string) {
+    const user = await this.userRepository.findOne({
+      where: {
+        accessCode: accessCode,
+      },
+      relations: {
+        roles: true,
+      },
+    });
+
+    if (!user) {
+      throw new UnauthorizedException(ERROR_MESSAGES.USER_NOT_FOUND);
+    }
+    this.checkAccountBlocked(user);
+
+    try {
+      await this.validateUserUsingMicrosoftActiveDirectory(user);
+    } catch (e) {
+      await this.incrementFailedAttempts(user);
+      throw e;
+    }
+
+    await this.resetFailedAttempts(user);
+    const tokens = await this.generateTokens(user);
+    return {
+      user: {
+        email: user.email,
+        mobile: user.mobile,
+        username: user.username,
+        id: user.id,
+        roles: user.roles.map((role) => role.name),
+      },
+      ...tokens,
+    };
+  }
+
   async signInUsingApple(accessCode: string) {
     const user = await this.userRepository.findOne({
       where: {

package/src/services/settings/default-settings-provider.service.ts

@@ -43,6 +43,16 @@ const getSolidCoreSettings = (isProd: boolean) =>
       sortOrder: 50,
       controlType: "boolean",
     },
+    {
+      moduleName: "solid-core",
+      key: "iamMicrosoftActiveDirectoryOAuthEnabled",
+      value: false,
+      level: SettingLevel.SystemAdminEditable,
+      label: "Allow Login / Signup With Microsoft Active Directory",
+      group: "authentication-settings",
+      sortOrder: 50,
+      controlType: "boolean",
+    },
     {
       moduleName: "solid-core",
       key: "authPagesLayout",
@@ -703,6 +713,55 @@ const getSolidCoreSettings = (isProd: boolean) =>
       level: SettingLevel.SystemAdminReadonly,
     },
 
+    // microsoft-active-directory-oauth-settings-provider.service.ts
+    {
+      moduleName: "solid-core",
+      key: "MICROSOFT_ACTIVE_DIRECTORY_CLIENT_ID",
+      value: process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CLIENT_ID,
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Microsoft Active Directory OAuth Client ID",
+      group: "oauth-settings",
+      sortOrder: 70,
+      controlType: "shortText",
+    },
+    {
+      moduleName: "solid-core",
+      key: "MICROSOFT_ACTIVE_DIRECTORY_CLIENT_SECRET",
+      value: process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CLIENT_SECRET,
+      level: SettingLevel.SystemEnv,
+    },
+    {
+      moduleName: "solid-core",
+      key: "MICROSOFT_ACTIVE_DIRECTORY_TENANT_ID",
+      value:
+        process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_TENANT_ID || "common",
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Microsoft Active Directory OAuth Tenant ID",
+      group: "oauth-settings",
+      sortOrder: 80,
+      controlType: "shortText",
+    },
+    {
+      moduleName: "solid-core",
+      key: "MICROSOFT_ACTIVE_DIRECTORY_CALLBACK_URL",
+      value: process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_CALLBACK_URL,
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Microsoft Active Directory OAuth Callback URL",
+      group: "oauth-settings",
+      sortOrder: 90,
+      controlType: "shortText",
+    },
+    {
+      moduleName: "solid-core",
+      key: "MICROSOFT_ACTIVE_DIRECTORY_REDIRECT_URL",
+      value: process.env.IAM_MICROSOFT_ACTIVE_DIRECTORY_OAUTH_REDIRECT_URL,
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Microsoft Active Directory OAuth Redirect URL",
+      group: "oauth-settings",
+      sortOrder: 100,
+      controlType: "shortText",
+    },
+
     // iam-settings-provider.service.ts
     {
       moduleName: "solid-core",

package/src/services/user.service.ts

@@ -30,6 +30,23 @@ export class UserService extends CRUDService<User> {
     return normalized || "facebook_user";
   }
 
+  private buildMicrosoftActiveDirectoryUsernameBase(
+    email?: string,
+    providerId?: string,
+    name?: string,
+  ): string {
+    const source =
+      email ||
+      name ||
+      (providerId ? `microsoft_active_directory_${providerId}` : "");
+    const normalized = source
+      .trim()
+      .toLowerCase()
+      .replace(/[^a-z0-9@._-]+/g, "_")
+      .replace(/^_+|_+$/g, "");
+    return normalized || "microsoft_active_directory_user";
+  }
+
   private async resolveUniqueUsername(
     preferredUsername: string,
     // fallbackUsername: string,
@@ -397,6 +414,50 @@ export class UserService extends CRUDService<User> {
     return user;
   }
 
+  async resolveUserOnOauthMicrosoftActiveDirectory(
+    oauthUserDto: OauthUserDto,
+  ): Promise<User> {
+    const user = await this.repo.findOne({
+      where: {
+        email: oauthUserDto.email,
+      },
+      relations: {
+        roles: true,
+      },
+    });
+
+    if (!user) {
+      const newUser = new User();
+      newUser.username = oauthUserDto.email;
+      newUser.email = oauthUserDto.email;
+      newUser.fullName = oauthUserDto.name;
+      newUser.lastLoginProvider = oauthUserDto.provider;
+      newUser.accessCode = oauthUserDto.accessCode;
+      newUser.microsoftActiveDirectoryAccessToken = oauthUserDto.accessToken;
+      newUser.microsoftActiveDirectoryId = oauthUserDto.providerId;
+      newUser.microsoftActiveDirectoryProfilePicture = oauthUserDto.picture;
+
+      const savedUser = await this.repo.save(newUser);
+
+      await this.initializeRolesForNewUser(
+        [this.settingService.getConfigValue<SolidCoreSetting>("defaultRole")],
+        savedUser,
+      );
+    } else {
+      const entity = await this.repo.preload({
+        id: user.id,
+        lastLoginProvider: oauthUserDto.provider,
+        accessCode: oauthUserDto.accessCode,
+        microsoftActiveDirectoryAccessToken: oauthUserDto.accessToken,
+        microsoftActiveDirectoryId: oauthUserDto.providerId,
+        microsoftActiveDirectoryProfilePicture: oauthUserDto.picture,
+      });
+
+      await this.repo.save(entity);
+    }
+    return user;
+  }
+
   async findUsersByRole(
     roleName: string,
     relations: any = {},

package/src/solid-core.module.ts

@@ -66,8 +66,10 @@ import { ActionMetadataService } from "./services/action-metadata.service";
 
 import { FacebookAuthenticationController } from "./controllers/facebook-authentication.controller";
 import { MicrosoftAuthenticationController } from "./controllers/microsoft-authentication.controller";
+import { MicrosoftActiveDirectoryAuthenticationController } from "./controllers/microsoft-active-directory-authentication.controller";
 import { FacebookOAuthStrategy } from "./passport-strategies/facebook-oauth.strategy";
 import { MicrosoftOAuthStrategy } from "./passport-strategies/microsoft-oauth.strategy";
+import { MicrosoftActiveDirectoryOAuthStrategy } from "./passport-strategies/microsoft-active-directory-oauth.strategy";
 
 import { GupshupOtpWhatsappService } from "./services/whatsapp/GupshupOtpWhatsappService";
 import { MetaCloudWhatsappService } from "./services/whatsapp/MetaCloudWhatsappService";
@@ -464,6 +466,7 @@ import { DashboardUserLayoutRepository } from './repositories/dashboard-user-lay
     GoogleAuthenticationController,
     FacebookAuthenticationController,
     MicrosoftAuthenticationController,
+    MicrosoftActiveDirectoryAuthenticationController,
     ImportTransactionController,
     ImportTransactionErrorLogController,
     ListOfValuesController,
@@ -637,6 +640,7 @@ import { DashboardUserLayoutRepository } from './repositories/dashboard-user-lay
     GoogleOauthStrategy,
     FacebookOAuthStrategy,
     MicrosoftOAuthStrategy,
+    MicrosoftActiveDirectoryOAuthStrategy,
     UserRegistrationListener,
     TestQueuePublisher,
     TestQueueSubscriber,