@steedos/service-identity-jwt 2.3.2-beta.10 → 2.3.2-beta.12

package/main/default/routes/external_app.router.d.ts

@@ -0,0 +1,4 @@
+declare const router: any;
+declare const core: any;
+declare const objectql: any;
+declare const jwt: any;

package/main/default/routes/external_app.router.js

@@ -0,0 +1,47 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const router = require('@steedos/router').staticRouter();
+const core = require('@steedos/core');
+const objectql = require('@steedos/objectql');
+const jwt = require('jsonwebtoken');
+router.get('/api/external/app/:appId', core.requireAuthentication, function (req, res) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const userSession = req.user;
+            const { appId } = req.params;
+            const appObj = objectql.getObject('apps');
+            const appDoc = yield appObj.findOne(appId);
+            if (!appDoc) {
+                throw new Error(`not found app by ${appId}`);
+            }
+            const { url, secret } = appDoc;
+            if (!url) {
+                throw new Error(`url is null in ${appId}`);
+            }
+            if (!secret) {
+                throw new Error(`secret is null in ${appId}`);
+            }
+            const options = { expiresIn: 10 * 60 };
+            const token = jwt.sign({
+                profile: {
+                    name: userSession.name,
+                    username: userSession.username,
+                    email: userSession.email
+                }
+            }, secret, options);
+            res.redirect(`${url}?t=${token}`);
+        }
+        catch (error) {
+            objectql.getSteedosSchema().broker.logger.error(error.stack);
+            res.status(500).send({ success: false, message: error.message });
+        }
+    });
+});
+exports.default = router;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@steedos/service-identity-jwt",
-    "version": "2.3.2-beta.10",
+    "version": "2.3.2-beta.12",
     "main": "package.service.js",
     "keywords": [
         "steedos"
@@ -11,8 +11,9 @@
     "description": "steedos package",
     "repository": {},
     "dependencies": {
-        "@steedos/accounts": "2.3.2-beta.10",
+        "@steedos/accounts": "2.3.2-beta.12",
         "express": "4.18.1",
+        "jsonwebtoken": "8.5.1",
         "passport": "^0.6.0",
         "passport-jwt": "^4.0.0"
     },
@@ -21,5 +22,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "44b1617fea53eb016e82e72174e1d33bdbfe3fd1"
+    "gitHead": "f738241842b61c66eae2b1fe7bf5c0bfb66348d6"
 }

package/package.service.js

@@ -1,8 +1,8 @@
 /*
  * @Author: baozhoutao@steedos.com
  * @Date: 2022-06-11 18:09:20
- * @LastEditors: baozhoutao@steedos.com
- * @LastEditTime: 2022-07-18 11:41:42
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-11-24 13:06:15
  * @Description: 
  */
 "use strict";
@@ -13,6 +13,7 @@ const packageLoader = require('@steedos/service-package-loader');
 const passport = require('passport');
 const JwtStrategy = require("passport-jwt").Strategy
 const ExtractJwt = require('passport-jwt').ExtractJwt;
+const jwt = require('jsonwebtoken');
 
 
 const authError = function (done, message, err = null) {
@@ -33,7 +34,7 @@ module.exports = {
 		packageInfo: {
 			path: __dirname,
 			name: packageName,
-			isPackage: true
+			isPackage: false,
 		},
 		jwt: {
 			secret: process.env.STEEDOS_IDENTITY_JWT_SECRET,
@@ -64,9 +65,9 @@ module.exports = {
 	 */
 	methods: {
 		beforeStart: async function () {
-			if(!this.settings.jwt.secret){
-				throw new Error(`${packageName} jwt secret is not defined`);
-			}
+			// if(!this.settings.jwt.secret){
+			// 	throw new Error(`${packageName} jwt secret is not defined`);
+			// }
 		}
 	},
 
@@ -81,34 +82,59 @@ module.exports = {
 	 */
 	async started() {
 		try {
-            if(this.settings.jwt.secret){
-				const jwtOptions = {
-					secretOrKey: this.settings.jwt.secret,
-					jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken()
-				}
-				
-				const jwtAuthenticate = function (jwt_payload, done) {
-					try {
-						const { profile } = jwt_payload;
-						if(profile && profile.email){
-							objectql.getObject('users').find({filters: [['email', '=', profile.email]], fields: ['_id', 'name', 'email', 'username']}).then((records)=>{
-								if(records.length > 0){
-									const user = records[0];
-									return done(null, Object.assign({}, user, {id: user._id}))
-								}else{
-									return done('user not find', null)
+			const secret = this.settings.jwt.secret
+			const jwtOptions = {
+				// secretOrKey: this.settings.jwt.secret,
+				secretOrKeyProvider: function (request, rawJwtToken, done) {
+					let decoded = jwt.decode(rawJwtToken, { complete: true });
+					let payload = decoded.payload
+					const app_code = payload.app_code
+					if (app_code) { // 走应用认证
+						objectql.getObject('apps').find({filters: [['code', '=', app_code]], fields: ['secret']}).then((records)=>{
+							if(records.length > 0){
+								const app = records[0];
+								if (app.secret) {
+									return done(null, app.secret)
 								}
-							})
-						}else{
-							return done('JWT invalid', null)
-						}
-					} catch (err) {
-						return authError(done, "JWT invalid", err)
+								else {
+									done(`app ${app_code}'s secret is null`, null)
+								}
+							}else{
+								return done('app not find', null)
+							}
+						})
+					}
+					else if (secret) { // 走全局配置
+						return done(null, secret)
+					}
+					else { // 都没有则认证不通过
+						return done('need secret', null)
+					}
+				},
+				jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken()
+			}
+			
+			const jwtAuthenticate = function (jwt_payload, done) {
+				try {
+					const { profile } = jwt_payload;
+					if(profile && profile.email){
+						objectql.getObject('users').find({filters: [['email', '=', profile.email]], fields: ['_id', 'name', 'email', 'username']}).then((records)=>{
+							if(records.length > 0){
+								const user = records[0];
+								return done(null, Object.assign({}, user, {id: user._id}))
+							}else{
+								return done('user not find', null)
+							}
+						})
+					}else{
+						return done('JWT invalid', null)
 					}
+				} catch (err) {
+					return authError(done, "JWT invalid", err)
 				}
-				
-				passport.use(new JwtStrategy(jwtOptions, jwtAuthenticate))
 			}
+			
+			passport.use(new JwtStrategy(jwtOptions, jwtAuthenticate))
         } catch (error) {
             // this.setError(error);
 			this.broker.logger.error(error)

package/src/routes/external_app.router.ts

@@ -0,0 +1,54 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2022-11-23 15:54:33
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-11-23 16:45:17
+ * @Description: 新增jwt 接口(GET), 所有第三方应用都通过此接口转发出去, 自动带上 jwt 加密(app.secret)后的数据,比如username、email等.
+ */
+const router = require('@steedos/router').staticRouter()
+const core = require('@steedos/core');
+const objectql = require('@steedos/objectql')
+const jwt = require('jsonwebtoken')
+
+router.get('/api/external/app/:appId', core.requireAuthentication, async function (req, res) {
+    try {
+        const userSession = req.user;
+        // const spaceId = userSession.spaceId;
+        // const userId = userSession.userId;
+        // const isSpaceAdmin = userSession.is_space_admin;
+        const { appId } = req.params
+
+        const appObj = objectql.getObject('apps')
+
+        const appDoc = await appObj.findOne(appId)
+
+        if (!appDoc) {
+            throw new Error(`not found app by ${appId}`)
+        }
+
+        const { url, secret } = appDoc
+
+        if (!url) {
+            throw new Error(`url is null in ${appId}`)
+        }
+
+        if (!secret) {
+            throw new Error(`secret is null in ${appId}`)
+        }
+
+        const options = { expiresIn: 10 * 60 } // 有效期十分钟
+        const token = jwt.sign({
+            profile: {
+                name: userSession.name,
+                username: userSession.username,
+                email: userSession.email
+            }
+        }, secret, options);
+
+        res.redirect(`${url}?t=${token}`);
+    } catch (error) {
+        objectql.getSteedosSchema().broker.logger.error(error.stack)
+        res.status(500).send({ success: false, message: error.message })
+    }
+});
+exports.default = router;