@things-factory/auth-base 6.1.171 → 6.1.174

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-base",
-  "version": "6.1.171",
+  "version": "6.1.174",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -30,18 +30,17 @@
     "migration:create": "node ../../node_modules/typeorm/cli.js migration:create -d ./server/migrations"
   },
   "dependencies": {
-    "@things-factory/email-base": "^6.1.166",
-    "@things-factory/env": "^6.1.166",
-    "@things-factory/i18n-base": "^6.1.166",
-    "@things-factory/shell": "^6.1.166",
-    "@things-factory/utils": "^6.1.166",
+    "@things-factory/email-base": "^6.1.174",
+    "@things-factory/env": "^6.1.174",
+    "@things-factory/i18n-base": "^6.1.174",
+    "@things-factory/shell": "^6.1.174",
+    "@things-factory/utils": "^6.1.174",
     "jsonwebtoken": "^9.0.0",
-    "koa-passport": "^4.1.4",
-    "koa-session": "^6.0.0",
+    "koa-passport": "^6.0.0",
+    "koa-session": "^6.4.0",
     "oauth2orize-koa": "^1.3.2",
-    "passport": "^0.4.1",
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0"
   },
-  "gitHead": "865a487a7e01d5d1b0479c5543d68319c73853da"
+  "gitHead": "582dea90062d7298e39e18d3634a7ac3c3a56310"
 }

package/server/middlewares/index.ts

@@ -1,19 +1,56 @@
+import session from 'koa-session'
 import passport from 'koa-passport'
 
+import { config } from '@things-factory/env'
+import { SECRET } from '../utils/get-secret'
+
 import { authenticate401Middleware } from './authenticate-401-middleware'
 import { domainAuthenticateMiddleware } from './domain-authenticate-middleware'
 import { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware'
 import { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware'
 
+import { User } from '../service/user/user'
+import { MAX_AGE } from '../constants/max-age'
+
+const accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')
+
 export function initMiddlewares(app: any) {
+  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */
+  app.keys = [SECRET]
+  app.use(
+    session(
+      {
+        key: accessTokenCookieKey,
+        maxAge: MAX_AGE,
+        overwrite: true,
+        httpOnly: true,
+        signed: true,
+        rolling: false,
+        renew: false
+      },
+      app
+    )
+  )
+
+  passport.serializeUser((profile, done) => {
+    done(null, profile)
+  })
+
+  passport.deserializeUser(async (profile, done) => {
+    done(null, await User.checkAuth(profile))
+  })
+
   /* passport initialize */
   app.use(passport.initialize())
 
+  /* passport use session - for oauth transaction */
+  app.use(passport.session())
+
   /* authentication error handling */
   app.use(authenticate401Middleware)
 
   /*
-   * post:graphql 에 대해서는 authenticationMiddleware를 적용한다.
+   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.
    * graphql app을 router에 적용하지 못하기 때문임.
    */
   app.use(graphqlAuthenticateMiddleware)
@@ -21,20 +58,6 @@ export function initMiddlewares(app: any) {
 
 process.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {
   subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)
-
-  // subscriptionMiddleware.push(jwtAuthenticateMiddleware, async (context, next) => {
-  //   const { domain, user } = context.state
-
-  //   if (domain && !user.domains.find(d => d.subdomain === domain.subdomain)) {
-  //     let message = `subdomain '${domain.subdomain}' is not allowed for the user`
-  //     debug('subscription', message)
-  //     context.throw(401, message)
-  //   }
-
-  //   debug('subscription', user.email, domain?.subdomain)
-
-  //   await next()
-  // })
 })
 
 export * from './jwt-authenticate-middleware'

package/server/middlewares/jwt-authenticate-middleware.ts

@@ -1,4 +1,4 @@
-import passport from 'passport'
+import passport from 'koa-passport'
 import { ExtractJwt, Strategy as JWTstrategy } from 'passport-jwt'
 
 import { makeVerificationToken } from '../controllers/utils/make-verification-token'
@@ -47,7 +47,6 @@ export async function jwtAuthenticateMiddleware(context, next) {
     if (err || !decoded) {
       const e = (context.state.error = err || info)
 
-      // TODO cookie 가 authenticate에 적용된 상황에서 오류가 발생한 경우만, 쿠키를 클리어한다.
       clearAccessTokenCookie(context)
 
       context.throw(401, e.message)

package/server/middlewares/signin-middleware.ts

@@ -1,4 +1,4 @@
-import passport from 'passport'
+import passport from 'koa-passport'
 import { Strategy as localStrategy } from 'passport-local'
 
 import { signin } from '../controllers/signin'

package/server/router/oauth2/passport-oauth2-client-password.ts

@@ -1,4 +1,4 @@
-import passport from 'passport'
+import passport from 'koa-passport'
 import util from 'util'
 
 /**

package/server/router/oauth2/passport-refresh-token.ts

@@ -1,4 +1,4 @@
-import passport from 'passport'
+import passport from 'koa-passport'
 import util from 'util'
 
 /**

package/server/router/site-root-router.ts

@@ -1,5 +1,5 @@
 import Router from 'koa-router'
-import passport from 'passport'
+import passport from 'koa-passport'
 
 import { Domain, domainMiddleware } from '@things-factory/shell'
 import { config } from '@things-factory/env'

package/server/routes.ts

@@ -1,5 +1,3 @@
-import session from 'koa-session'
-
 import { config } from '@things-factory/env'
 
 import { domainAuthenticateMiddleware, jwtAuthenticateMiddleware } from './middlewares'
@@ -14,13 +12,27 @@ import {
   pathBaseDomainRouter,
   siteRootRouter
 } from './router'
-import { SECRET } from './utils/get-secret'
+
+import { setAccessTokenCookie } from './utils/access-token-cookie'
+import { User } from './service/user/user'
 
 const isPathBaseDomain = !config.get('subdomain') && !config.get('useVirtualHostBasedDomain')
 
 process.on('bootstrap-module-global-public-route' as any, (app, globalPublicRouter) => {
   globalPublicRouter.use(siteRootRouter.routes(), siteRootRouter.allowedMethods())
   globalPublicRouter.use(authPublicProcessRouter.routes(), authPublicProcessRouter.allowedMethods())
+
+  /* ssoMiddleware가 정의되어있다면, /auth/sso-signin 패스를 활성화한다. */
+  if (app.ssoMiddlewares.length > 0) {
+    authSigninRouter.get('/auth/sso-signin', app.ssoMiddlewares[0], async context => {
+      const { user } = context.state
+
+      const token = user.sign()
+      setAccessTokenCookie(context, token)
+
+      context.redirect('/auth/checkin')
+    })
+  }
 })
 
 process.on('bootstrap-module-global-private-route' as any, (app, globalPrivateRouter) => {
@@ -36,10 +48,6 @@ process.on('bootstrap-module-domain-public-route' as any, (app, domainPublicRout
   domainPublicRouter.use(authSigninRouter.routes(), authSigninRouter.allowedMethods())
   domainPublicRouter.use(authSignupRouter.routes(), authSignupRouter.allowedMethods())
 
-  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */
-  app.keys = [SECRET]
-  app.use(session(app))
-
   /* path '/admin/oauth/...' is deprecated. should use path '/oauth/...' for oauth2 related routing */
   domainPublicRouter.use('/oauth', oauth2Router.routes(), oauth2Router.allowedMethods()) // if i use context
 })

package/server/service/user/user.ts

@@ -205,7 +205,57 @@ export class User {
     )
   }
 
+  static async checkAuthWithEmail(decoded) {
+    if (!decoded?.email) {
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    }
+
+    const repository = getRepository(User)
+    var user = await repository.findOne({
+      where: { email: decoded.email },
+      relations: ['domains'],
+      cache: true
+    })
+
+    if (!user)
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    else {
+      switch (user.status) {
+        case UserStatus.INACTIVE:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.LOCKED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_LOCKED,
+            detail: {
+              email: user.email
+            }
+          })
+        case UserStatus.DELETED:
+          throw new AuthError({
+            errorCode: AuthError.ERROR_CODES.USER_DELETED
+          })
+      }
+
+      return user
+    }
+  }
+
   static async checkAuth(decoded) {
+    if (decoded?.id === undefined) {
+      throw new AuthError({
+        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND
+      })
+    }
+
     const repository = getRepository(User)
     var user = await repository.findOne({
       where: { id: decoded.id },