@steedos/service-identity-jwt 2.3.2-beta.9 → 2.3.3-beta.1

package/main/default/routes/apps.router.js

@@ -3,9 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 const account_1 = require("./account");
 const passport = require('passport');
-const router = require('@steedos/router').staticRouter();
+const express = require('express');
+const router = express.Router();
 router.use('/accounts/jwt/login', passport.authenticate('jwt', { session: false }), (req, res) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
     account_1.Account.ssoLogin(req, res, { err: null, user: req.user, redirect: false, accessToken: null }).then((loginResult) => {
+        if (req.query.redirect) {
+            return res.redirect(req.query.redirect);
+        }
         delete loginResult.user.services;
         delete loginResult.user.thirdPartyUser;
         return res.status(200).send(loginResult);

package/main/default/routes/external_app.router.d.ts

@@ -0,0 +1,5 @@
+declare const express: any;
+declare const router: any;
+declare const core: any;
+declare const objectql: any;
+declare const jwt: any;

package/main/default/routes/external_app.router.js

@@ -0,0 +1,48 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const express = require('express');
+const router = express.Router();
+const core = require('@steedos/core');
+const objectql = require('@steedos/objectql');
+const jwt = require('jsonwebtoken');
+router.get('/api/external/app/:appId', core.requireAuthentication, function (req, res) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const userSession = req.user;
+            const { appId } = req.params;
+            const appObj = objectql.getObject('apps');
+            const appDoc = yield appObj.findOne(appId);
+            if (!appDoc) {
+                throw new Error(`not found app by ${appId}`);
+            }
+            const { url, secret } = appDoc;
+            if (!url) {
+                throw new Error(`url is null in ${appId}`);
+            }
+            if (!secret) {
+                throw new Error(`secret is null in ${appId}`);
+            }
+            const options = { expiresIn: 10 * 60 };
+            const token = jwt.sign({
+                profile: {
+                    name: userSession.name,
+                    username: userSession.username,
+                    email: userSession.email
+                }
+            }, secret, options);
+            res.redirect(`${url}?t=${token}`);
+        }
+        catch (error) {
+            objectql.getSteedosSchema().broker.logger.error(error.stack);
+            res.status(500).send({ success: false, message: error.message });
+        }
+    });
+});
+exports.default = router;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@steedos/service-identity-jwt",
-    "version": "2.3.2-beta.9",
+    "version": "2.3.3-beta.1",
     "main": "package.service.js",
     "keywords": [
         "steedos"
@@ -11,8 +11,9 @@
     "description": "steedos package",
     "repository": {},
     "dependencies": {
-        "@steedos/accounts": "2.3.2-beta.9",
+        "@steedos/accounts": "2.3.3-beta.1",
         "express": "4.18.1",
+        "jsonwebtoken": "8.5.1",
         "passport": "^0.6.0",
         "passport-jwt": "^4.0.0"
     },
@@ -21,5 +22,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "e20a307e760a2a28f2f447ff16fca94f42852309"
+    "gitHead": "70ac301dccf90c0723115e3f4a8d73ce8cd4f5fc"
 }

package/package.service.js

@@ -1,8 +1,8 @@
 /*
  * @Author: baozhoutao@steedos.com
  * @Date: 2022-06-11 18:09:20
- * @LastEditors: baozhoutao@steedos.com
- * @LastEditTime: 2022-07-18 11:41:42
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-11-29 16:09:26
  * @Description: 
  */
 "use strict";
@@ -13,6 +13,7 @@ const packageLoader = require('@steedos/service-package-loader');
 const passport = require('passport');
 const JwtStrategy = require("passport-jwt").Strategy
 const ExtractJwt = require('passport-jwt').ExtractJwt;
+const jwt = require('jsonwebtoken');
 
 
 const authError = function (done, message, err = null) {
@@ -33,7 +34,7 @@ module.exports = {
 		packageInfo: {
 			path: __dirname,
 			name: packageName,
-			isPackage: true
+			isPackage: false,
 		},
 		jwt: {
 			secret: process.env.STEEDOS_IDENTITY_JWT_SECRET,
@@ -64,9 +65,9 @@ module.exports = {
 	 */
 	methods: {
 		beforeStart: async function () {
-			if(!this.settings.jwt.secret){
-				throw new Error(`${packageName} jwt secret is not defined`);
-			}
+			// if(!this.settings.jwt.secret){
+			// 	throw new Error(`${packageName} jwt secret is not defined`);
+			// }
 		}
 	},
 
@@ -81,34 +82,65 @@ module.exports = {
 	 */
 	async started() {
 		try {
-            if(this.settings.jwt.secret){
-				const jwtOptions = {
-					secretOrKey: this.settings.jwt.secret,
-					jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken()
-				}
-				
-				const jwtAuthenticate = function (jwt_payload, done) {
+			const secret = this.settings.jwt.secret
+			const jwtOptions = {
+				// secretOrKey: this.settings.jwt.secret,
+				secretOrKeyProvider: function (request, rawJwtToken, done) {
 					try {
-						const { profile } = jwt_payload;
-						if(profile && profile.email){
-							objectql.getObject('users').find({filters: [['email', '=', profile.email]], fields: ['_id', 'name', 'email', 'username']}).then((records)=>{
+						let decoded = jwt.decode(rawJwtToken, { complete: true });
+						let payload = decoded.payload
+						const app_code = payload.app_code
+						if (app_code) { // 走应用认证
+							objectql.getObject('apps').find({filters: [['code', '=', app_code]], fields: ['secret']}).then((records)=>{
 								if(records.length > 0){
-									const user = records[0];
-									return done(null, Object.assign({}, user, {id: user._id}))
+									const app = records[0];
+									if (app.secret) {
+										return done(null, app.secret)
+									}
+									else {
+										done(`app ${app_code}'s secret is null`, null)
+									}
 								}else{
-									return done('user not find', null)
+									return done('app not find', null)
 								}
 							})
-						}else{
-							return done('JWT invalid', null)
 						}
-					} catch (err) {
-						return authError(done, "JWT invalid", err)
+						else if (secret) { // 走全局配置
+							return done(null, secret)
+						}
+						else { // 都没有则认证不通过
+							return done('need secret', null)
+						}
+					} catch (error) {
+						// console.error(error)
+						return done(error.message, null)
+					}
+					
+				},
+				jwtFromRequest: ExtractJwt.fromExtractors([ExtractJwt.fromAuthHeaderAsBearerToken(), ExtractJwt.fromUrlQueryParameter('t')]) 
+			}
+			
+			const jwtAuthenticate = function (jwt_payload, done) {
+				try {
+					const { profile } = jwt_payload;
+					if(profile && profile.email){
+						objectql.getObject('users').find({filters: [['email', '=', profile.email]], fields: ['_id', 'name', 'email', 'username']}).then((records)=>{
+							if(records.length > 0){
+								const user = records[0];
+								return done(null, Object.assign({}, user, {id: user._id}))
+							}else{
+								return done('user not find', null)
+							}
+						})
+					}else{
+						return done('JWT invalid', null)
 					}
+				} catch (err) {
+					return authError(done, "JWT invalid", err)
 				}
-				
-				passport.use(new JwtStrategy(jwtOptions, jwtAuthenticate))
 			}
+			
+			passport.use(new JwtStrategy(jwtOptions, jwtAuthenticate))
         } catch (error) {
             // this.setError(error);
 			this.broker.logger.error(error)

package/src/routes/apps.router.ts

@@ -1,17 +1,20 @@
 /*
  * @Author: baozhoutao@steedos.com
  * @Date: 2022-06-08 23:28:39
- * @LastEditors: baozhoutao@steedos.com
- * @LastEditTime: 2022-11-16 14:19:32
+ * @LastEditors: sunhaolin@hotoa.com
+ * @LastEditTime: 2022-11-29 15:53:46
  * @Description: 
  */
 import { Account } from './account'
 const passport = require('passport');
-
-const router =require('@steedos/router').staticRouter()
+const express = require('express');
+const router =express.Router();
 
 router.use('/accounts/jwt/login', passport.authenticate('jwt', { session: false }), async (req: any, res) => {
     Account.ssoLogin(req, res, { err: null, user: req.user, redirect: false, accessToken: null }).then((loginResult) => {
+        if (req.query.redirect) { // 如果url传递了重定向的参数则优先重定向
+            return res.redirect(req.query.redirect)
+        }
         delete loginResult.user.services;
         delete loginResult.user.thirdPartyUser;
         return res.status(200).send(loginResult)

package/src/routes/external_app.router.ts

@@ -0,0 +1,55 @@
+/*
+ * @Author: sunhaolin@hotoa.com
+ * @Date: 2022-11-23 15:54:33
+ * @LastEditors: baozhoutao@steedos.com
+ * @LastEditTime: 2022-11-28 17:59:06
+ * @Description: 新增jwt 接口(GET), 所有第三方应用都通过此接口转发出去, 自动带上 jwt 加密(app.secret)后的数据,比如username、email等.
+ */
+const express = require('express');
+const router =express.Router();
+const core = require('@steedos/core');
+const objectql = require('@steedos/objectql')
+const jwt = require('jsonwebtoken')
+
+router.get('/api/external/app/:appId', core.requireAuthentication, async function (req, res) {
+    try {
+        const userSession = req.user;
+        // const spaceId = userSession.spaceId;
+        // const userId = userSession.userId;
+        // const isSpaceAdmin = userSession.is_space_admin;
+        const { appId } = req.params
+
+        const appObj = objectql.getObject('apps')
+
+        const appDoc = await appObj.findOne(appId)
+
+        if (!appDoc) {
+            throw new Error(`not found app by ${appId}`)
+        }
+
+        const { url, secret } = appDoc
+
+        if (!url) {
+            throw new Error(`url is null in ${appId}`)
+        }
+
+        if (!secret) {
+            throw new Error(`secret is null in ${appId}`)
+        }
+
+        const options = { expiresIn: 10 * 60 } // 有效期十分钟
+        const token = jwt.sign({
+            profile: {
+                name: userSession.name,
+                username: userSession.username,
+                email: userSession.email
+            }
+        }, secret, options);
+
+        res.redirect(`${url}?t=${token}`);
+    } catch (error) {
+        objectql.getSteedosSchema().broker.logger.error(error.stack)
+        res.status(500).send({ success: false, message: error.message })
+    }
+});
+exports.default = router;