@things-factory/auth-base 8.0.5 → 9.0.0-beta.12

package/dist-server/middlewares/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/middlewares/index.ts"],"names":[],"mappings":";;AAgBA,0CAwCC;;AAxDD,sEAAiC;AACjC,wEAAmC;AAEnC,6CAA4C;AAC5C,oDAA4C;AAE5C,+EAAyE;AACzE,qFAA+E;AAC/E,uFAAiF;AACjF,+EAAyE;AAEzE,+CAA2C;AAC3C,kDAA8C;AAE9C,MAAM,oBAAoB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAA;AAE/E,SAAgB,eAAe,CAAC,GAAQ;IACtC,yDAAyD;IACzD,GAAG,CAAC,IAAI,GAAG,CAAC,mBAAM,CAAC,CAAA;IACnB,GAAG,CAAC,GAAG,CACL,IAAA,qBAAO,EACL;QACE,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,iBAAO;QACf,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;KACb,EACD,GAAG,CACJ,CACF,CAAA;IAED,sBAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sBAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IAE9B,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IAE3B,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,uDAAyB,CAAC,CAAA;IAElC;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,+DAA6B,CAAC,CAAA;AACxC,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,+BAAsC,EAAE,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE;IACjF,sBAAsB,CAAC,IAAI,CAAC,uDAAyB,EAAE,6DAA4B,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,wEAA6C;AAC7C,2EAAgD;AAChD,8DAAmC;AACnC,gEAAqC;AACrC,wEAA6C","sourcesContent":["import session from 'koa-session'\nimport passport from 'koa-passport'\n\nimport { config } from '@things-factory/env'\nimport { SECRET } from '../utils/get-secret'\n\nimport { authenticate401Middleware } from './authenticate-401-middleware'\nimport { domainAuthenticateMiddleware } from './domain-authenticate-middleware'\nimport { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware'\nimport { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware'\n\nimport { User } from '../service/user/user'\nimport { MAX_AGE } from '../constants/max-age'\n\nconst accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')\n\nexport function initMiddlewares(app: any) {\n  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */\n  app.keys = [SECRET]\n  app.use(\n    session(\n      {\n        key: 'tfsession',\n        maxAge: MAX_AGE,\n        overwrite: true,\n        httpOnly: true,\n        signed: true,\n        rolling: false,\n        renew: false\n      },\n      app\n    )\n  )\n\n  passport.serializeUser((profile, done) => {\n    done(null, profile)\n  })\n\n  passport.deserializeUser(async (profile, done) => {\n    done(null, await User.checkAuth(profile))\n  })\n\n  /* passport initialize */\n  app.use(passport.initialize())\n\n  /* passport use session - for oauth transaction */\n  app.use(passport.session())\n\n  /* authentication error handling */\n  app.use(authenticate401Middleware)\n\n  /*\n   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.\n   * graphql app을 router에 적용하지 못하기 때문임.\n   */\n  app.use(graphqlAuthenticateMiddleware)\n}\n\nprocess.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {\n  subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)\n})\n\nexport * from './jwt-authenticate-middleware'\nexport * from './domain-authenticate-middleware'\nexport * from './signin-middleware'\nexport * from './webauthn-middleware'\nexport * from './authenticate-401-middleware'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/middlewares/index.ts"],"names":[],"mappings":";;AAgBA,0CAwCC;;AAxDD,sEAAiC;AACjC,wEAAmC;AAEnC,6CAA4C;AAC5C,0DAA+C;AAE/C,qFAA4E;AAC5E,2FAAkF;AAClF,6FAAoF;AACpF,qFAA4E;AAE5E,qDAA8C;AAC9C,wDAAiD;AAEjD,MAAM,oBAAoB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAA;AAE/E,SAAgB,eAAe,CAAC,GAAQ;IACtC,yDAAyD;IACzD,GAAG,CAAC,IAAI,GAAG,CAAC,sBAAM,CAAC,CAAA;IACnB,GAAG,CAAC,GAAG,CACL,IAAA,qBAAO,EACL;QACE,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,oBAAO;QACf,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,KAAK;KACb,EACD,GAAG,CACJ,CACF,CAAA;IAED,sBAAQ,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sBAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,EAAE,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,yBAAyB;IACzB,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,UAAU,EAAE,CAAC,CAAA;IAE9B,kDAAkD;IAClD,GAAG,CAAC,GAAG,CAAC,sBAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IAE3B,mCAAmC;IACnC,GAAG,CAAC,GAAG,CAAC,0DAAyB,CAAC,CAAA;IAElC;;;OAGG;IACH,GAAG,CAAC,GAAG,CAAC,kEAA6B,CAAC,CAAA;AACxC,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,+BAAsC,EAAE,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE;IACjF,sBAAsB,CAAC,IAAI,CAAC,0DAAyB,EAAE,gEAA4B,CAAC,CAAA;AACtF,CAAC,CAAC,CAAA;AAEF,2EAAgD;AAChD,8EAAmD;AACnD,iEAAsC;AACtC,mEAAwC;AACxC,2EAAgD","sourcesContent":["import session from 'koa-session'\nimport passport from 'koa-passport'\n\nimport { config } from '@things-factory/env'\nimport { SECRET } from '../utils/get-secret.js'\n\nimport { authenticate401Middleware } from './authenticate-401-middleware.js'\nimport { domainAuthenticateMiddleware } from './domain-authenticate-middleware.js'\nimport { graphqlAuthenticateMiddleware } from './graphql-authenticate-middleware.js'\nimport { jwtAuthenticateMiddleware } from './jwt-authenticate-middleware.js'\n\nimport { User } from '../service/user/user.js'\nimport { MAX_AGE } from '../constants/max-age.js'\n\nconst accessTokenCookieKey = config.get('accessTokenCookieKey', 'access_token')\n\nexport function initMiddlewares(app: any) {\n  /* oauth2orize-koa 에서 oauth 트랜잭션 관리를 위해서 session을 사용함. */\n  app.keys = [SECRET]\n  app.use(\n    session(\n      {\n        key: 'tfsession',\n        maxAge: MAX_AGE,\n        overwrite: true,\n        httpOnly: true,\n        signed: true,\n        rolling: false,\n        renew: false\n      },\n      app\n    )\n  )\n\n  passport.serializeUser((profile, done) => {\n    done(null, profile)\n  })\n\n  passport.deserializeUser(async (profile, done) => {\n    done(null, await User.checkAuth(profile))\n  })\n\n  /* passport initialize */\n  app.use(passport.initialize())\n\n  /* passport use session - for oauth transaction */\n  app.use(passport.session())\n\n  /* authentication error handling */\n  app.use(authenticate401Middleware)\n\n  /*\n   * post:graphql 에 대해서는 graphqlAuthenticationMiddleware를 적용한다.\n   * graphql app을 router에 적용하지 못하기 때문임.\n   */\n  app.use(graphqlAuthenticateMiddleware)\n}\n\nprocess.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {\n  subscriptionMiddleware.push(jwtAuthenticateMiddleware, domainAuthenticateMiddleware)\n})\n\nexport * from './jwt-authenticate-middleware.js'\nexport * from './domain-authenticate-middleware.js'\nexport * from './signin-middleware.js'\nexport * from './webauthn-middleware.js'\nexport * from './authenticate-401-middleware.js'\n"]}

package/dist-server/middlewares/jwt-authenticate-middleware.js

@@ -5,15 +5,15 @@ const tslib_1 = require("tslib");
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const passport_jwt_1 = require("passport-jwt");
 const env_1 = require("@things-factory/env");
-const make_verification_token_1 = require("../controllers/utils/make-verification-token");
-const save_verification_token_1 = require("../controllers/utils/save-verification-token");
-const user_1 = require("../service/user/user");
-const verification_token_1 = require("../service/verification-token/verification-token");
-const access_token_cookie_1 = require("../utils/access-token-cookie");
-const get_secret_1 = require("../utils/get-secret");
+const make_verification_token_js_1 = require("../controllers/utils/make-verification-token.js");
+const save_verification_token_js_1 = require("../controllers/utils/save-verification-token.js");
+const user_js_1 = require("../service/user/user.js");
+const verification_token_js_1 = require("../service/verification-token/verification-token.js");
+const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
+const get_secret_js_1 = require("../utils/get-secret.js");
 const sessionExpiryPolicy = env_1.config.get('session/expiryPolicy', 'fixed');
 koa_passport_1.default.use(new passport_jwt_1.Strategy({
-    secretOrKey: get_secret_1.SECRET,
+    secretOrKey: get_secret_js_1.SECRET,
     passReqToCallback: true,
     jwtFromRequest: passport_jwt_1.ExtractJwt.fromExtractors([
         passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
@@ -23,7 +23,7 @@ koa_passport_1.default.use(new passport_jwt_1.Strategy({
         passport_jwt_1.ExtractJwt.fromBodyField('access_token'),
         req => {
             var token = null;
-            token = (0, access_token_cookie_1.getAccessTokenCookie)(req === null || req === void 0 ? void 0 : req.ctx);
+            token = (0, access_token_cookie_js_1.getAccessTokenCookie)(req === null || req === void 0 ? void 0 : req.ctx);
             return token;
         }
     ])
@@ -44,16 +44,16 @@ async function jwtAuthenticateMiddleware(context, next) {
     return await koa_passport_1.default.authenticate('jwt', { session: false }, async (err, decoded, info) => {
         if (err || !decoded) {
             const e = (context.state.error = err || info);
-            (0, access_token_cookie_1.clearAccessTokenCookie)(context);
+            (0, access_token_cookie_js_1.clearAccessTokenCookie)(context);
             context.throw(401, e.message);
         }
         else {
-            const userEntity = await user_1.User.checkAuth(decoded);
-            if (userEntity.status === user_1.UserStatus.PWD_RESET_REQUIRED) {
+            const userEntity = await user_js_1.User.checkAuth(decoded);
+            if (userEntity.status === user_js_1.UserStatus.PWD_RESET_REQUIRED) {
                 try {
-                    const token = (0, make_verification_token_1.makeVerificationToken)();
-                    await (0, save_verification_token_1.saveVerificationToken)(userEntity.id, token, verification_token_1.VerificationTokenType.PASSWORD_RESET);
-                    (0, access_token_cookie_1.clearAccessTokenCookie)(context);
+                    const token = (0, make_verification_token_js_1.makeVerificationToken)();
+                    await (0, save_verification_token_js_1.saveVerificationToken)(userEntity.id, token, verification_token_js_1.VerificationTokenType.PASSWORD_RESET);
+                    (0, access_token_cookie_js_1.clearAccessTokenCookie)(context);
                     context.redirect(`/auth/reset-password?token=${token}`);
                 }
                 catch (e) {
@@ -66,7 +66,7 @@ async function jwtAuthenticateMiddleware(context, next) {
                 if (sessionExpiryPolicy == 'rolling') {
                     /* To renew the expiry time on each request, a token is issued and the session is updated. */
                     const token = await userEntity.sign();
-                    (0, access_token_cookie_1.setAccessTokenCookie)(context, token);
+                    (0, access_token_cookie_js_1.setAccessTokenCookie)(context, token);
                 }
                 await next();
             }

package/dist-server/middlewares/jwt-authenticate-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-authenticate-middleware.js","sourceRoot":"","sources":["../../server/middlewares/jwt-authenticate-middleware.ts"],"names":[],"mappings":";;AA0CA,8DAyCC;;AAnFD,wEAAmC;AACnC,+CAAkE;AAElE,6CAA4C;AAE5C,0FAAoF;AACpF,0FAAoF;AACpF,+CAAuD;AACvD,yFAAwF;AACxF,sEAAiH;AACjH,oDAA4C;AAE5C,MAAM,mBAAmB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;AAEvE,sBAAQ,CAAC,GAAG,CACV,IAAI,uBAAW,CACb;IACE,WAAW,EAAE,mBAAM;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,yBAAU,CAAC,cAAc,CAAC;QACxC,yBAAU,CAAC,2BAA2B,EAAE;QACxC,yBAAU,CAAC,UAAU,CAAC,eAAe,CAAC;QACtC,yBAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvC,yBAAU,CAAC,qBAAqB,CAAC,cAAc,CAAC;QAChD,yBAAU,CAAC,aAAa,CAAC,cAAc,CAAC;QACxC,GAAG,CAAC,EAAE;YACJ,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,KAAK,GAAG,IAAA,0CAAoB,EAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,GAAG,CAAC,CAAA;YACtC,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC;CACH,EACD,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACH,CAAC,CACF,CACF,CAAA;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAAO,EAAE,IAAI;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,CAAA;YAE7C,IAAA,4CAAsB,EAAC,OAAO,CAAC,CAAA;YAE/B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YAEhD,IAAI,UAAU,CAAC,MAAM,KAAK,iBAAU,CAAC,kBAAkB,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAA,+CAAqB,GAAE,CAAA;oBACrC,MAAM,IAAA,+CAAqB,EAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,0CAAqB,CAAC,cAAc,CAAC,CAAA;oBACvF,IAAA,4CAAsB,EAAC,OAAO,CAAC,CAAA;oBAC/B,OAAO,CAAC,QAAQ,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;gBACzD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,UAAU,CAAA;gBAC/B,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,OAAO,CAAA;gBAEpC,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;oBACrC,6FAA6F;oBAE7F,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAA;oBACrC,IAAA,0CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACtC,CAAC;gBAED,MAAM,IAAI,EAAE,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { ExtractJwt, Strategy as JWTstrategy } from 'passport-jwt'\n\nimport { config } from '@things-factory/env'\n\nimport { makeVerificationToken } from '../controllers/utils/make-verification-token'\nimport { saveVerificationToken } from '../controllers/utils/save-verification-token'\nimport { User, UserStatus } from '../service/user/user'\nimport { VerificationTokenType } from '../service/verification-token/verification-token'\nimport { clearAccessTokenCookie, getAccessTokenCookie, setAccessTokenCookie } from '../utils/access-token-cookie'\nimport { SECRET } from '../utils/get-secret'\n\nconst sessionExpiryPolicy = config.get('session/expiryPolicy', 'fixed')\n\npassport.use(\n  new JWTstrategy(\n    {\n      secretOrKey: SECRET,\n      passReqToCallback: true,\n      jwtFromRequest: ExtractJwt.fromExtractors([\n        ExtractJwt.fromAuthHeaderAsBearerToken(),\n        ExtractJwt.fromHeader('authorization'),\n        ExtractJwt.fromHeader('x-access-token'),\n        ExtractJwt.fromUrlQueryParameter('access_token'),\n        ExtractJwt.fromBodyField('access_token'),\n        req => {\n          var token = null\n          token = getAccessTokenCookie(req?.ctx)\n          return token\n        }\n      ])\n    },\n    async (request, decoded, done) => {\n      try {\n        return done(null, decoded)\n      } catch (error) {\n        return done(error)\n      }\n    }\n  )\n)\n\nexport async function jwtAuthenticateMiddleware(context, next) {\n  const { path } = context\n  const { user } = context.state\n  if (user) {\n    return await next()\n  }\n\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (err || !decoded) {\n      const e = (context.state.error = err || info)\n\n      clearAccessTokenCookie(context)\n\n      context.throw(401, e.message)\n    } else {\n      const userEntity = await User.checkAuth(decoded)\n\n      if (userEntity.status === UserStatus.PWD_RESET_REQUIRED) {\n        try {\n          const token = makeVerificationToken()\n          await saveVerificationToken(userEntity.id, token, VerificationTokenType.PASSWORD_RESET)\n          clearAccessTokenCookie(context)\n          context.redirect(`/auth/reset-password?token=${token}`)\n        } catch (e) {\n          throw err\n        }\n      } else {\n        context.state.user = userEntity\n        context.state.decodedToken = decoded\n\n        if (sessionExpiryPolicy == 'rolling') {\n          /* To renew the expiry time on each request, a token is issued and the session is updated. */\n\n          const token = await userEntity.sign()\n          setAccessTokenCookie(context, token)\n        }\n\n        await next()\n      }\n    }\n  })(context, next)\n}\n"]}
+{"version":3,"file":"jwt-authenticate-middleware.js","sourceRoot":"","sources":["../../server/middlewares/jwt-authenticate-middleware.ts"],"names":[],"mappings":";;AA0CA,8DAyCC;;AAnFD,wEAAmC;AACnC,+CAAkE;AAElE,6CAA4C;AAE5C,gGAAuF;AACvF,gGAAuF;AACvF,qDAA0D;AAC1D,+FAA2F;AAC3F,4EAAoH;AACpH,0DAA+C;AAE/C,MAAM,mBAAmB,GAAG,YAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;AAEvE,sBAAQ,CAAC,GAAG,CACV,IAAI,uBAAW,CACb;IACE,WAAW,EAAE,sBAAM;IACnB,iBAAiB,EAAE,IAAI;IACvB,cAAc,EAAE,yBAAU,CAAC,cAAc,CAAC;QACxC,yBAAU,CAAC,2BAA2B,EAAE;QACxC,yBAAU,CAAC,UAAU,CAAC,eAAe,CAAC;QACtC,yBAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvC,yBAAU,CAAC,qBAAqB,CAAC,cAAc,CAAC;QAChD,yBAAU,CAAC,aAAa,CAAC,cAAc,CAAC;QACxC,GAAG,CAAC,EAAE;YACJ,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,KAAK,GAAG,IAAA,6CAAoB,EAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,GAAG,CAAC,CAAA;YACtC,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC;CACH,EACD,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACH,CAAC,CACF,CACF,CAAA;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAAO,EAAE,IAAI;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAED,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,CAAA;YAE7C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAE/B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;YAEhD,IAAI,UAAU,CAAC,MAAM,KAAK,oBAAU,CAAC,kBAAkB,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAA,kDAAqB,GAAE,CAAA;oBACrC,MAAM,IAAA,kDAAqB,EAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,6CAAqB,CAAC,cAAc,CAAC,CAAA;oBACvF,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;oBAC/B,OAAO,CAAC,QAAQ,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;gBACzD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,UAAU,CAAA;gBAC/B,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,OAAO,CAAA;gBAEpC,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;oBACrC,6FAA6F;oBAE7F,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAA;oBACrC,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACtC,CAAC;gBAED,MAAM,IAAI,EAAE,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { ExtractJwt, Strategy as JWTstrategy } from 'passport-jwt'\n\nimport { config } from '@things-factory/env'\n\nimport { makeVerificationToken } from '../controllers/utils/make-verification-token.js'\nimport { saveVerificationToken } from '../controllers/utils/save-verification-token.js'\nimport { User, UserStatus } from '../service/user/user.js'\nimport { VerificationTokenType } from '../service/verification-token/verification-token.js'\nimport { clearAccessTokenCookie, getAccessTokenCookie, setAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { SECRET } from '../utils/get-secret.js'\n\nconst sessionExpiryPolicy = config.get('session/expiryPolicy', 'fixed')\n\npassport.use(\n  new JWTstrategy(\n    {\n      secretOrKey: SECRET,\n      passReqToCallback: true,\n      jwtFromRequest: ExtractJwt.fromExtractors([\n        ExtractJwt.fromAuthHeaderAsBearerToken(),\n        ExtractJwt.fromHeader('authorization'),\n        ExtractJwt.fromHeader('x-access-token'),\n        ExtractJwt.fromUrlQueryParameter('access_token'),\n        ExtractJwt.fromBodyField('access_token'),\n        req => {\n          var token = null\n          token = getAccessTokenCookie(req?.ctx)\n          return token\n        }\n      ])\n    },\n    async (request, decoded, done) => {\n      try {\n        return done(null, decoded)\n      } catch (error) {\n        return done(error)\n      }\n    }\n  )\n)\n\nexport async function jwtAuthenticateMiddleware(context, next) {\n  const { path } = context\n  const { user } = context.state\n  if (user) {\n    return await next()\n  }\n\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (err || !decoded) {\n      const e = (context.state.error = err || info)\n\n      clearAccessTokenCookie(context)\n\n      context.throw(401, e.message)\n    } else {\n      const userEntity = await User.checkAuth(decoded)\n\n      if (userEntity.status === UserStatus.PWD_RESET_REQUIRED) {\n        try {\n          const token = makeVerificationToken()\n          await saveVerificationToken(userEntity.id, token, VerificationTokenType.PASSWORD_RESET)\n          clearAccessTokenCookie(context)\n          context.redirect(`/auth/reset-password?token=${token}`)\n        } catch (e) {\n          throw err\n        }\n      } else {\n        context.state.user = userEntity\n        context.state.decodedToken = decoded\n\n        if (sessionExpiryPolicy == 'rolling') {\n          /* To renew the expiry time on each request, a token is issued and the session is updated. */\n\n          const token = await userEntity.sign()\n          setAccessTokenCookie(context, token)\n        }\n\n        await next()\n      }\n    }\n  })(context, next)\n}\n"]}

package/dist-server/middlewares/signin-middleware.js

@@ -4,14 +4,15 @@ exports.signinMiddleware = signinMiddleware;
 const tslib_1 = require("tslib");
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const passport_local_1 = require("passport-local");
-const signin_1 = require("../controllers/signin");
+const signin_js_1 = require("../controllers/signin.js");
 koa_passport_1.default.use('signin', new passport_local_1.Strategy({
-    usernameField: 'email',
-    passwordField: 'password'
-}, async (email, password, done) => {
+    usernameField: 'username',
+    passwordField: 'password',
+    passReqToCallback: true
+}, async (req, username, password, done) => {
     try {
-        const { user: userInfo, token, domains } = await (0, signin_1.signin)({
-            email,
+        const { user: userInfo, token, domains } = await (0, signin_js_1.signin)({
+            username,
             password
         });
         return done(null, {

package/dist-server/middlewares/signin-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"signin-middleware.js","sourceRoot":"","sources":["../../server/middlewares/signin-middleware.ts"],"names":[],"mappings":";;AAyCA,4CAaC;;AAtDD,wEAAmC;AACnC,mDAA0D;AAE1D,kDAA8C;AAE9C,sBAAQ,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,yBAAa,CACf;IACE,aAAa,EAAE,OAAO;IACtB,aAAa,EAAE,UAAU;CAC1B,EACD,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IAC9B,IAAI,CAAC;QACH,MAAM,EACJ,IAAI,EAAE,QAAQ,EACd,KAAK,EACL,OAAO,EACR,GAAG,MAAM,IAAA,eAAM,EAAC;YACf,KAAK;YACL,QAAQ;SACT,CAAC,CAAA;QAEF,OAAO,IAAI,CACT,IAAI,EACJ;YACE,IAAI,EAAE,QAAQ;YACd,KAAK;YACL,OAAO;SACR,EACD;YACE,OAAO,EAAE,wBAAwB;SAClC,CACF,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACH,CAAC,CACF,CACF,CAAA;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAO,EAAE,IAAI;IAClD,OAAO,sBAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACnF,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,GAAG,CAAA;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;YAEtC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAA;YAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;YAE3B,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { Strategy as localStrategy } from 'passport-local'\n\nimport { signin } from '../controllers/signin'\n\npassport.use(\n  'signin',\n  new localStrategy(\n    {\n      usernameField: 'email',\n      passwordField: 'password'\n    },\n    async (email, password, done) => {\n      try {\n        const {\n          user: userInfo,\n          token,\n          domains\n        } = await signin({\n          email,\n          password\n        })\n\n        return done(\n          null,\n          {\n            user: userInfo,\n            token,\n            domains\n          },\n          {\n            message: 'Logged in Successfully'\n          }\n        )\n      } catch (error) {\n        return done(error)\n      }\n    }\n  )\n)\n\nexport async function signinMiddleware(context, next) {\n  return passport.authenticate('signin', { session: false }, async (err, user, info) => {\n    if (err || !user) {\n      throw err\n    } else {\n      const { user: userInfo, token } = user\n\n      context.state.user = userInfo\n      context.state.token = token\n\n      await next()\n    }\n  })(context, next)\n}\n"]}
+{"version":3,"file":"signin-middleware.js","sourceRoot":"","sources":["../../server/middlewares/signin-middleware.ts"],"names":[],"mappings":";;AA0CA,4CAaC;;AAvDD,wEAAmC;AACnC,mDAA0D;AAE1D,wDAAiD;AAEjD,sBAAQ,CAAC,GAAG,CACV,QAAQ,EACR,IAAI,yBAAa,CACf;IACE,aAAa,EAAE,UAAU;IACzB,aAAa,EAAE,UAAU;IACzB,iBAAiB,EAAE,IAAI;CACxB,EACD,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IACtC,IAAI,CAAC;QACH,MAAM,EACJ,IAAI,EAAE,QAAQ,EACd,KAAK,EACL,OAAO,EACR,GAAG,MAAM,IAAA,kBAAM,EAAC;YACf,QAAQ;YACR,QAAQ;SACT,CAAC,CAAA;QAEF,OAAO,IAAI,CACT,IAAI,EACJ;YACE,IAAI,EAAE,QAAQ;YACd,KAAK;YACL,OAAO;SACR,EACD;YACE,OAAO,EAAE,wBAAwB;SAClC,CACF,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACH,CAAC,CACF,CACF,CAAA;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAO,EAAE,IAAI;IAClD,OAAO,sBAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QACnF,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,GAAG,CAAA;QACX,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;YAEtC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAA;YAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;YAE3B,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { Strategy as localStrategy } from 'passport-local'\n\nimport { signin } from '../controllers/signin.js'\n\npassport.use(\n  'signin',\n  new localStrategy(\n    {\n      usernameField: 'username',\n      passwordField: 'password',\n      passReqToCallback: true\n    },\n    async (req, username, password, done) => {\n      try {\n        const {\n          user: userInfo,\n          token,\n          domains\n        } = await signin({\n          username,\n          password\n        })\n\n        return done(\n          null,\n          {\n            user: userInfo,\n            token,\n            domains\n          },\n          {\n            message: 'Logged in Successfully'\n          }\n        )\n      } catch (error) {\n        return done(error)\n      }\n    }\n  )\n)\n\nexport async function signinMiddleware(context, next) {\n  return passport.authenticate('signin', { session: false }, async (err, user, info) => {\n    if (err || !user) {\n      throw err\n    } else {\n      const { user: userInfo, token } = user\n\n      context.state.user = userInfo\n      context.state.token = token\n\n      await next()\n    }\n  })(context, next)\n}\n"]}

package/dist-server/middlewares/verify-recaptcha-middleware.d.ts

@@ -0,0 +1,3 @@
+export declare function verifyRecaptcaMiddleware({ action }: {
+    action: string;
+}): (context: any, next: any) => Promise<void>;

package/dist-server/middlewares/verify-recaptcha-middleware.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRecaptcaMiddleware = verifyRecaptcaMiddleware;
+const recaptcha_enterprise_1 = require("@google-cloud/recaptcha-enterprise");
+const env_1 = require("@things-factory/env");
+const recaptchaConfig = env_1.config.get('recaptcha') || {};
+const { serviceAccount, siteKey } = recaptchaConfig || {};
+var client, projectPath;
+if (serviceAccount) {
+    try {
+        env_1.logger.info('creating reCAPTCHA service client...');
+        client = new recaptcha_enterprise_1.RecaptchaEnterpriseServiceClient({
+            projectId: serviceAccount.project_id,
+            credentials: serviceAccount
+        });
+        projectPath = client.projectPath(serviceAccount.project_id);
+        env_1.logger.info('reCAPTCHA service client created');
+    }
+    catch (err) {
+        env_1.logger.error('incorrect reCAPTCHA configuration');
+        env_1.logger.error(err);
+    }
+}
+/**
+ * Creates an assessment to analyze the risk of a UI action.
+ *
+ * projectID: The Google Cloud project ID.
+ * token: The generated token obtained from the client.
+ * recaptchaAction: The action name corresponding to the token.
+ */
+async function createReCaptchaAssessment({ token, recaptchaAction }) {
+    // Create the assessment request.
+    const request = {
+        assessment: {
+            event: {
+                token: token,
+                siteKey
+            }
+        },
+        parent: projectPath
+    };
+    const [response] = await client.createAssessment(request);
+    // Verify if the token is valid.
+    if (!response.tokenProperties.valid) {
+        console.log(`The CreateAssessment call failed because the token was: ${response.tokenProperties.invalidReason}`);
+        return null;
+    }
+    if (response.tokenProperties.action === recaptchaAction) {
+        // Get the risk score and reasons.
+        // For more details on interpreting the assessment, see:
+        // https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment
+        console.log(`The reCAPTCHA score is: ${response.riskAnalysis.score}`);
+        response.riskAnalysis.reasons.forEach(reason => {
+            console.log(reason);
+        });
+        return response.riskAnalysis.score;
+    }
+    else {
+        console.log('The action attribute in your reCAPTCHA tag does not match the action you are expecting to score');
+        return null;
+    }
+}
+function verifyRecaptcaMiddleware({ action }) {
+    return async (context, next) => {
+        if (!client) {
+            if (siteKey) {
+                console.error(`The RecaptchaEnterpriseServiceClient creation failed. Please check the service account configuration.`);
+            }
+            await next();
+            return;
+        }
+        const { 'recaptcha-response': recaptchaToken } = context.request.body;
+        // Handle error if token does not exist
+        if (!recaptchaToken) {
+            context.status = 400;
+            context.body = { message: 'reCAPTCHA token is required' };
+            return;
+        }
+        // Google reCAPTCHA assessment request
+        const score = await createReCaptchaAssessment({
+            token: recaptchaToken,
+            recaptchaAction: action
+        });
+        if (score === null || score < 0.5) {
+            // Treat as spam if the score is low
+            context.status = 400;
+            context.body = { message: 'Spam behavior detected. Please try again.' };
+            return;
+        }
+        // Continue processing the request if the score is valid
+        console.log(`reCAPTCHA score: ${score}`);
+        await next();
+    };
+}
+//# sourceMappingURL=verify-recaptcha-middleware.js.map

package/dist-server/middlewares/verify-recaptcha-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-recaptcha-middleware.js","sourceRoot":"","sources":["../../server/middlewares/verify-recaptcha-middleware.ts"],"names":[],"mappings":";;AAqEA,4DAwCC;AA7GD,6EAAqF;AACrF,6CAAoD;AAEpD,MAAM,eAAe,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;AACrD,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,eAAe,IAAI,EAAE,CAAA;AAEzD,IAAI,MAAM,EAAE,WAAW,CAAA;AAEvB,IAAI,cAAc,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,YAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;QAEnD,MAAM,GAAG,IAAI,uDAAgC,CAAC;YAC5C,SAAS,EAAE,cAAc,CAAC,UAAU;YACpC,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAA;QAEF,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;QAE3D,YAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACjD,YAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,EAAE,KAAK,EAAE,eAAe,EAA8C;IAC7G,iCAAiC;IACjC,MAAM,OAAO,GAAG;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO;aACR;SACF;QACD,MAAM,EAAE,WAAW;KACpB,CAAA;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAEzD,gCAAgC;IAChC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,2DAA2D,QAAQ,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC,CAAA;QAChH,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACxD,kCAAkC;QAClC,wDAAwD;QACxD,0EAA0E;QAC1E,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAA;QACrE,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC7C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAA;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAA;QAC9G,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CAAC,EAAE,MAAM,EAAsB;IACrE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,uGAAuG,CACxG,CAAA;YACH,CAAC;YAED,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;QAErE,uCAAuC;QACvC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAA;YACzD,OAAM;QACR,CAAC;QAED,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC;YAC5C,KAAK,EAAE,cAAc;YACrB,eAAe,EAAE,MAAM;SACxB,CAAC,CAAA;QAEF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAClC,oCAAoC;YACpC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAA;YACvE,OAAM;QACR,CAAC;QAED,wDAAwD;QACxD,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,EAAE,CAAC,CAAA;QAExC,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { RecaptchaEnterpriseServiceClient } from '@google-cloud/recaptcha-enterprise'\nimport { config, logger } from '@things-factory/env'\n\nconst recaptchaConfig = config.get('recaptcha') || {}\nconst { serviceAccount, siteKey } = recaptchaConfig || {}\n\nvar client, projectPath\n\nif (serviceAccount) {\n  try {\n    logger.info('creating reCAPTCHA service client...')\n\n    client = new RecaptchaEnterpriseServiceClient({\n      projectId: serviceAccount.project_id,\n      credentials: serviceAccount\n    })\n\n    projectPath = client.projectPath(serviceAccount.project_id)\n\n    logger.info('reCAPTCHA service client created')\n  } catch (err) {\n    logger.error('incorrect reCAPTCHA configuration')\n    logger.error(err)\n  }\n}\n\n/**\n * Creates an assessment to analyze the risk of a UI action.\n *\n * projectID: The Google Cloud project ID.\n * token: The generated token obtained from the client.\n * recaptchaAction: The action name corresponding to the token.\n */\nasync function createReCaptchaAssessment({ token, recaptchaAction }: { token: string; recaptchaAction: string }) {\n  // Create the assessment request.\n  const request = {\n    assessment: {\n      event: {\n        token: token,\n        siteKey\n      }\n    },\n    parent: projectPath\n  }\n\n  const [response] = await client.createAssessment(request)\n\n  // Verify if the token is valid.\n  if (!response.tokenProperties.valid) {\n    console.log(`The CreateAssessment call failed because the token was: ${response.tokenProperties.invalidReason}`)\n    return null\n  }\n\n  if (response.tokenProperties.action === recaptchaAction) {\n    // Get the risk score and reasons.\n    // For more details on interpreting the assessment, see:\n    // https://cloud.google.com/recaptcha-enterprise/docs/interpret-assessment\n    console.log(`The reCAPTCHA score is: ${response.riskAnalysis.score}`)\n    response.riskAnalysis.reasons.forEach(reason => {\n      console.log(reason)\n    })\n\n    return response.riskAnalysis.score\n  } else {\n    console.log('The action attribute in your reCAPTCHA tag does not match the action you are expecting to score')\n    return null\n  }\n}\n\nexport function verifyRecaptcaMiddleware({ action }: { action: string }) {\n  return async (context, next) => {\n    if (!client) {\n      if (siteKey) {\n        console.error(\n          `The RecaptchaEnterpriseServiceClient creation failed. Please check the service account configuration.`\n        )\n      }\n\n      await next()\n      return\n    }\n\n    const { 'recaptcha-response': recaptchaToken } = context.request.body\n\n    // Handle error if token does not exist\n    if (!recaptchaToken) {\n      context.status = 400\n      context.body = { message: 'reCAPTCHA token is required' }\n      return\n    }\n\n    // Google reCAPTCHA assessment request\n    const score = await createReCaptchaAssessment({\n      token: recaptchaToken,\n      recaptchaAction: action\n    })\n\n    if (score === null || score < 0.5) {\n      // Treat as spam if the score is low\n      context.status = 400\n      context.body = { message: 'Spam behavior detected. Please try again.' }\n      return\n    }\n\n    // Continue processing the request if the score is valid\n    console.log(`reCAPTCHA score: ${score}`)\n\n    await next()\n  }\n}\n"]}

package/dist-server/middlewares/webauthn-middleware.js

@@ -5,8 +5,8 @@ const tslib_1 = require("tslib");
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const passport_custom_1 = require("passport-custom");
 const shell_1 = require("@things-factory/shell");
-const auth_error_1 = require("../errors/auth-error");
-const web_auth_credential_1 = require("../service/web-auth-credential/web-auth-credential");
+const auth_error_js_1 = require("../errors/auth-error.js");
+const web_auth_credential_js_1 = require("../service/web-auth-credential/web-auth-credential.js");
 const server_1 = require("@simplewebauthn/server");
 koa_passport_1.default.use('webauthn-register', new passport_custom_1.Strategy(async (context, done) => {
     const { body, session, user, hostname, origin } = context;
@@ -21,14 +21,17 @@ koa_passport_1.default.use('webauthn-register', new passport_custom_1.Strategy(a
     });
     if (verification.verified) {
         const { registrationInfo } = verification;
-        const publicKey = Buffer.from(registrationInfo.credentialPublicKey).toString('base64');
+        const publicKey = Buffer.from(registrationInfo.credential.publicKey).toString('base64');
+        if (!registrationInfo) {
+            return done(null, false);
+        }
         if (user) {
-            const webAuthRepository = (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential);
+            const webAuthRepository = (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential);
             await webAuthRepository.save({
                 user,
-                credentialId: registrationInfo.credentialID,
+                credentialId: registrationInfo.credential.id,
                 publicKey,
-                counter: registrationInfo.counter,
+                counter: registrationInfo.credential.counter,
                 creator: user,
                 updater: user
             });
@@ -44,7 +47,7 @@ koa_passport_1.default.use('webauthn-login', new passport_custom_1.Strategy(asyn
         const { body, session, origin, hostname } = context;
         const challenge = session.challenge;
         const assertionResponse = body;
-        const credential = await (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential).findOne({
+        const credential = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).findOne({
             where: {
                 credentialId: assertionResponse.id
             },
@@ -59,16 +62,16 @@ koa_passport_1.default.use('webauthn-login', new passport_custom_1.Strategy(asyn
             expectedOrigin: origin,
             expectedRPID: hostname,
             requireUserVerification: false,
-            authenticator: {
-                credentialID: credential.credentialId,
-                credentialPublicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),
+            credential: {
+                id: credential.credentialId,
+                publicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),
                 counter: credential.counter
             }
         });
         if (verification.verified) {
             const { authenticationInfo } = verification;
             credential.counter = authenticationInfo.newCounter;
-            await (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential).save(credential);
+            await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).save(credential);
             const user = credential.user;
             return done(null, user);
         }
@@ -84,8 +87,8 @@ function createWebAuthnMiddleware(strategy) {
     return async function webAuthnMiddleware(context, next) {
         return koa_passport_1.default.authenticate(strategy, { session: true, failureMessage: true, failWithError: true }, async (err, user) => {
             if (err || !user) {
-                throw new auth_error_1.AuthError({
-                    errorCode: auth_error_1.AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED,
+                throw new auth_error_js_1.AuthError({
+                    errorCode: auth_error_js_1.AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED,
                     detail: err
                 });
             }

package/dist-server/middlewares/webauthn-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn-middleware.js","sourceRoot":"","sources":["../../server/middlewares/webauthn-middleware.ts"],"names":[],"mappings":";;AAyGA,4DAqBC;;AA9HD,wEAAmC;AACnC,qDAA4D;AAE5D,iDAAqD;AAGrD,qDAAgD;AAEhD,4FAAsF;AACtF,mDAAiG;AAIjG,sBAAQ,CAAC,GAAG,CACV,mBAAmB,EACnB,IAAI,0BAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAc,CAAA;IAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAEnC,MAAM,YAAY,GAAG,MAAM,IAAA,mCAA0B,EAAC;QACpD,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,SAAS;QAC5B,cAAc,EAAE,MAAM;QACtB,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,iBAAiB;QAC/B,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAEtF,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,IAAA,qBAAa,EAAC,uCAAiB,CAAC,CAAA;YAC1D,MAAM,iBAAiB,CAAC,IAAI,CAAC;gBAC3B,IAAI;gBACJ,YAAY,EAAE,gBAAgB,CAAC,YAAY;gBAC3C,SAAS;gBACT,OAAO,EAAE,gBAAgB,CAAC,OAAO;gBACjC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CACH,CAAA;AAED,sBAAQ,CAAC,GAAG,CACV,gBAAgB,EAChB,IAAI,0BAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAc,CAAA;QAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAEnC,MAAM,iBAAiB,GAAG,IAGzB,CAAA;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,uCAAiB,CAAC,CAAC,OAAO,CAAC;YAChE,KAAK,EAAE;gBACL,YAAY,EAAE,iBAAiB,CAAC,EAAE;aACnC;YACD,SAAS,EAAE,CAAC,MAAM,CAAC;SACpB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,qCAA4B,EAAC;YACtD,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,SAAS;YAC5B,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,uBAAuB,EAAE,KAAK;YAC9B,aAAa,EAAE;gBACb,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAChF,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;SACF,CAAC,CAAA;QAEF,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAA;YAC3C,UAAU,CAAC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAA;YAClD,MAAM,IAAA,qBAAa,EAAC,uCAAiB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;YAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAAC,OAAM,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAC,CACH,CAAA;AAED,SAAgB,wBAAwB,CAAC,QAAgD;IACvF,OAAO,KAAK,UAAU,kBAAkB,CAAC,OAAO,EAAE,IAAI;QACpD,OAAO,sBAAQ,CAAC,YAAY,CAC1B,QAAQ,EACR,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAC5D,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAClB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,sBAAS,CAAC;oBAClB,SAAS,EAAE,sBAAS,CAAC,WAAW,CAAC,yBAAyB;oBAC1D,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;gBAEzB,OAAO,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YACzC,CAAC;YAED,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CACF,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAClB,CAAC,CAAA;AACH,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { Strategy as CustomStrategy } from 'passport-custom'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { User } from '../service/user/user'\nimport { AuthError } from '../errors/auth-error'\n\nimport { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'\nimport { verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'\n\nimport { AuthenticatorAssertionResponse } from '@simplewebauthn/types'\n\npassport.use(\n  'webauthn-register',\n  new CustomStrategy(async (context, done) => {\n    const { body, session, user, hostname, origin } = context as any\n\n    const challenge = session.challenge\n\n    const verification = await verifyRegistrationResponse({\n      response: body,\n      expectedChallenge: challenge,\n      expectedOrigin: origin,\n      expectedRPID: hostname,\n      expectedType: 'webauthn.create',\n      requireUserVerification: false\n    })\n\n    if (verification.verified) {\n      const { registrationInfo } = verification\n      const publicKey = Buffer.from(registrationInfo.credentialPublicKey).toString('base64')\n\n      if (user) {\n        const webAuthRepository = getRepository(WebAuthCredential)\n        await webAuthRepository.save({\n          user,\n          credentialId: registrationInfo.credentialID,\n          publicKey,\n          counter: registrationInfo.counter,\n          creator: user,\n          updater: user\n        })\n      }\n\n      return done(null, user)\n    } else {\n      return done(null, false)\n    }\n  })\n)\n\npassport.use(\n  'webauthn-login',\n  new CustomStrategy(async (context, done) => {\n    try {\n      const { body, session, origin, hostname } = context as any\n\n      const challenge = session.challenge\n  \n      const assertionResponse = body as {\n        id: string\n        response: AuthenticatorAssertionResponse\n      }\n  \n      const credential = await getRepository(WebAuthCredential).findOne({\n        where: {\n          credentialId: assertionResponse.id\n        },\n        relations: ['user']\n      })\n  \n      if (!credential) {\n        return done(null, false)\n      }\n  \n      const verification = await verifyAuthenticationResponse({\n        response: body,\n        expectedChallenge: challenge,\n        expectedOrigin: origin,\n        expectedRPID: hostname,\n        requireUserVerification: false,\n        authenticator: {\n          credentialID: credential.credentialId,\n          credentialPublicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),\n          counter: credential.counter\n        }\n      })\n  \n      if (verification.verified) {\n        const { authenticationInfo } = verification\n        credential.counter = authenticationInfo.newCounter\n        await getRepository(WebAuthCredential).save(credential)\n  \n        const user = credential.user\n        return done(null, user)\n      } else {\n        return done(verification, false)\n      }\n    } catch(error) {\n      return done(error, false)\n    }\n  })\n)\n\nexport function createWebAuthnMiddleware(strategy: 'webauthn-register' | 'webauthn-login') {\n  return async function webAuthnMiddleware(context, next) {\n    return passport.authenticate(\n      strategy,\n      { session: true, failureMessage: true, failWithError: true },\n      async (err, user) => {\n        if (err || !user) {\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED,\n            detail: err\n          })\n        } else {\n          context.state.user = user\n\n          context.body = { user, verified: true }\n        }\n\n        await next()\n      }\n    )(context, next)\n  }\n}\n"]}
+{"version":3,"file":"webauthn-middleware.js","sourceRoot":"","sources":["../../server/middlewares/webauthn-middleware.ts"],"names":[],"mappings":";;AA4GA,4DAqBC;;AAjID,wEAAmC;AACnC,qDAA4D;AAE5D,iDAAqD;AAErD,2DAAmD;AAEnD,kGAAyF;AACzF,mDAI+B;AAE/B,sBAAQ,CAAC,GAAG,CACV,mBAAmB,EACnB,IAAI,0BAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAc,CAAA;IAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAEnC,MAAM,YAAY,GAAG,MAAM,IAAA,mCAA0B,EAAC;QACpD,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,SAAS;QAC5B,cAAc,EAAE,MAAM;QACtB,YAAY,EAAE,QAAQ;QACtB,YAAY,EAAE,iBAAiB;QAC/B,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAA;IAEF,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,EAAE,gBAAgB,EAAE,GAAG,YAAY,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACvF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,iBAAiB,GAAG,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAA;YAC1D,MAAM,iBAAiB,CAAC,IAAI,CAAC;gBAC3B,IAAI;gBACJ,YAAY,EAAE,gBAAgB,CAAC,UAAU,CAAC,EAAE;gBAC5C,SAAS;gBACT,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,OAAO;gBAC5C,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CACH,CAAA;AAED,sBAAQ,CAAC,GAAG,CACV,gBAAgB,EAChB,IAAI,0BAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAc,CAAA;QAE1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;QAEnC,MAAM,iBAAiB,GAAG,IAGzB,CAAA;QAED,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,OAAO,CAAC;YAChE,KAAK,EAAE;gBACL,YAAY,EAAE,iBAAiB,CAAC,EAAE;aACnC;YACD,SAAS,EAAE,CAAC,MAAM,CAAC;SACpB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,qCAA4B,EAAC;YACtD,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,SAAS;YAC5B,cAAc,EAAE,MAAM;YACtB,YAAY,EAAE,QAAQ;YACtB,uBAAuB,EAAE,KAAK;YAC9B,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,YAAY;gBAC3B,SAAS,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;SACF,CAAC,CAAA;QAEF,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAA;YAC3C,UAAU,CAAC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAA;YAClD,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;YAC5B,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;AACH,CAAC,CAAC,CACH,CAAA;AAED,SAAgB,wBAAwB,CAAC,QAAgD;IACvF,OAAO,KAAK,UAAU,kBAAkB,CAAC,OAAO,EAAE,IAAI;QACpD,OAAO,sBAAQ,CAAC,YAAY,CAC1B,QAAQ,EACR,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAC5D,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAClB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,yBAAS,CAAC;oBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,yBAAyB;oBAC1D,MAAM,EAAE,GAAG;iBACZ,CAAC,CAAA;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;gBAEzB,OAAO,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;YACzC,CAAC;YAED,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CACF,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAClB,CAAC,CAAA;AACH,CAAC","sourcesContent":["import passport from 'koa-passport'\nimport { Strategy as CustomStrategy } from 'passport-custom'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { AuthError } from '../errors/auth-error.js'\n\nimport { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential.js'\nimport {\n  AuthenticatorAssertionResponse,\n  verifyRegistrationResponse,\n  verifyAuthenticationResponse\n} from '@simplewebauthn/server'\n\npassport.use(\n  'webauthn-register',\n  new CustomStrategy(async (context, done) => {\n    const { body, session, user, hostname, origin } = context as any\n\n    const challenge = session.challenge\n\n    const verification = await verifyRegistrationResponse({\n      response: body,\n      expectedChallenge: challenge,\n      expectedOrigin: origin,\n      expectedRPID: hostname,\n      expectedType: 'webauthn.create',\n      requireUserVerification: false\n    })\n\n    if (verification.verified) {\n      const { registrationInfo } = verification\n      const publicKey = Buffer.from(registrationInfo.credential.publicKey).toString('base64')\n      if (!registrationInfo) {\n        return done(null, false)\n      }\n      if (user) {\n        const webAuthRepository = getRepository(WebAuthCredential)\n        await webAuthRepository.save({\n          user,\n          credentialId: registrationInfo.credential.id,\n          publicKey,\n          counter: registrationInfo.credential.counter,\n          creator: user,\n          updater: user\n        })\n      }\n\n      return done(null, user)\n    } else {\n      return done(null, false)\n    }\n  })\n)\n\npassport.use(\n  'webauthn-login',\n  new CustomStrategy(async (context, done) => {\n    try {\n      const { body, session, origin, hostname } = context as any\n\n      const challenge = session.challenge\n\n      const assertionResponse = body as {\n        id: string\n        response: AuthenticatorAssertionResponse\n      }\n\n      const credential = await getRepository(WebAuthCredential).findOne({\n        where: {\n          credentialId: assertionResponse.id\n        },\n        relations: ['user']\n      })\n\n      if (!credential) {\n        return done(null, false)\n      }\n\n      const verification = await verifyAuthenticationResponse({\n        response: body,\n        expectedChallenge: challenge,\n        expectedOrigin: origin,\n        expectedRPID: hostname,\n        requireUserVerification: false,\n        credential: {\n          id: credential.credentialId,\n          publicKey: new Uint8Array(Buffer.from(credential.publicKey, 'base64')),\n          counter: credential.counter\n        }\n      })\n\n      if (verification.verified) {\n        const { authenticationInfo } = verification\n        credential.counter = authenticationInfo.newCounter\n        await getRepository(WebAuthCredential).save(credential)\n\n        const user = credential.user\n        return done(null, user)\n      } else {\n        return done(verification, false)\n      }\n    } catch (error) {\n      return done(error, false)\n    }\n  })\n)\n\nexport function createWebAuthnMiddleware(strategy: 'webauthn-register' | 'webauthn-login') {\n  return async function webAuthnMiddleware(context, next) {\n    return passport.authenticate(\n      strategy,\n      { session: true, failureMessage: true, failWithError: true },\n      async (err, user) => {\n        if (err || !user) {\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED,\n            detail: err\n          })\n        } else {\n          context.state.user = user\n\n          context.body = { user, verified: true }\n        }\n\n        await next()\n      }\n    )(context, next)\n  }\n}\n"]}

package/dist-server/migrations/1548206416130-SeedUser.js

@@ -4,25 +4,26 @@ exports.SeedUsers1548206416130 = void 0;
 const typeorm_1 = require("typeorm");
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const user_1 = require("../service/user/user");
+const user_js_1 = require("../service/user/user.js");
 const ADMIN_ACCOUNT = env_1.config.get('adminAccount', {
+    username: 'admin',
     name: 'Admin',
     email: 'admin@hatiolab.com',
     password: 'admin'
 });
 const SEED_USERS = [
-    Object.assign(Object.assign({}, ADMIN_ACCOUNT), { userType: 'user', status: user_1.UserStatus.ACTIVATED })
+    Object.assign(Object.assign({}, ADMIN_ACCOUNT), { userType: 'user', status: user_js_1.UserStatus.ACTIVATED })
 ];
 class SeedUsers1548206416130 {
     async up(queryRunner) {
-        const userRepository = (0, shell_1.getRepository)(user_1.User);
+        const userRepository = (0, shell_1.getRepository)(user_js_1.User);
         const domainRepository = (0, shell_1.getRepository)(shell_1.Domain);
         const domain = await domainRepository.findOne({ where: { name: 'SYSTEM' } });
         try {
             for (let i = 0; i < SEED_USERS.length; i++) {
                 const user = SEED_USERS[i];
-                const salt = user_1.User.generateSalt();
-                const password = user_1.User.encode(user.password, salt);
+                const salt = user_js_1.User.generateSalt();
+                const password = user_js_1.User.encode(user.password, salt);
                 await userRepository.save(Object.assign(Object.assign({}, user), { salt,
                     password, domains: [domain] }));
             }
@@ -30,12 +31,12 @@ class SeedUsers1548206416130 {
         catch (e) {
             env_1.logger.error(e);
         }
-        const admin = await userRepository.findOne({ where: { email: (0, typeorm_1.ILike)('admin@hatiolab.com') } });
+        const admin = await userRepository.findOne({ where: { email: (0, typeorm_1.ILike)(ADMIN_ACCOUNT.email) } });
         domain.owner = admin.id;
         await domainRepository.save(domain);
     }
     async down(queryRunner) {
-        const repository = (0, shell_1.getRepository)(user_1.User);
+        const repository = (0, shell_1.getRepository)(user_js_1.User);
         SEED_USERS.reverse().forEach(async (user) => {
             let record = await repository.findOneBy({ email: (0, typeorm_1.ILike)(user.email) });
             await repository.remove(record);

package/dist-server/migrations/1548206416130-SeedUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"1548206416130-SeedUser.js","sourceRoot":"","sources":["../../server/migrations/1548206416130-SeedUser.ts"],"names":[],"mappings":";;;AAAA,qCAAgE;AAEhE,6CAAoD;AACpD,iDAA6D;AAE7D,+CAAuD;AAEvD,MAAM,aAAa,GAAG,YAAM,CAAC,GAAG,CAAC,cAAc,EAAE;IAC/C,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,OAAO;CAClB,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG;oCAEZ,aAAa,KAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,iBAAU,CAAC,SAAS;CAE/B,CAAA;AACD,MAAa,sBAAsB;IAC1B,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAA;QAC1C,MAAM,gBAAgB,GAAG,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;QAE9C,MAAM,MAAM,GAAW,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAEpF,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;gBAC1B,MAAM,IAAI,GAAG,WAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,QAAQ,GAAG,WAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAEjD,MAAM,cAAc,CAAC,IAAI,iCACpB,IAAI,KACP,IAAI;oBACJ,QAAQ,EACR,OAAO,EAAE,CAAC,MAAM,CAAC,IACjB,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7F,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAA;QAEvB,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB;QACxC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAA;QAEtC,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxC,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAtCD,wDAsCC","sourcesContent":["import { ILike, MigrationInterface, QueryRunner } from 'typeorm'\n\nimport { config, logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { User, UserStatus } from '../service/user/user'\n\nconst ADMIN_ACCOUNT = config.get('adminAccount', {\n  name: 'Admin',\n  email: 'admin@hatiolab.com',\n  password: 'admin'\n})\n\nconst SEED_USERS = [\n  {\n    ...ADMIN_ACCOUNT,\n    userType: 'user',\n    status: UserStatus.ACTIVATED\n  }\n]\nexport class SeedUsers1548206416130 implements MigrationInterface {\n  public async up(queryRunner: QueryRunner): Promise<any> {\n    const userRepository = getRepository(User)\n    const domainRepository = getRepository(Domain)\n\n    const domain: Domain = await domainRepository.findOne({ where: { name: 'SYSTEM' } })\n\n    try {\n      for (let i = 0; i < SEED_USERS.length; i++) {\n        const user = SEED_USERS[i]\n        const salt = User.generateSalt()\n        const password = User.encode(user.password, salt)\n\n        await userRepository.save({\n          ...user,\n          salt,\n          password,\n          domains: [domain]\n        })\n      }\n    } catch (e) {\n      logger.error(e)\n    }\n\n    const admin = await userRepository.findOne({ where: { email: ILike('admin@hatiolab.com') } })\n    domain.owner = admin.id\n\n    await domainRepository.save(domain)\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<any> {\n    const repository = getRepository(User)\n\n    SEED_USERS.reverse().forEach(async user => {\n      let record = await repository.findOneBy({ email: ILike(user.email) })\n      await repository.remove(record)\n    })\n  }\n}\n"]}
+{"version":3,"file":"1548206416130-SeedUser.js","sourceRoot":"","sources":["../../server/migrations/1548206416130-SeedUser.ts"],"names":[],"mappings":";;;AAAA,qCAAgE;AAEhE,6CAAoD;AACpD,iDAA6D;AAE7D,qDAA0D;AAE1D,MAAM,aAAa,GAAG,YAAM,CAAC,GAAG,CAAC,cAAc,EAAE;IAC/C,QAAQ,EAAE,OAAO;IACjB,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,oBAAoB;IAC3B,QAAQ,EAAE,OAAO;CAClB,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG;oCAEZ,aAAa,KAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAU,CAAC,SAAS;CAE/B,CAAA;AACD,MAAa,sBAAsB;IAC1B,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAC1C,MAAM,gBAAgB,GAAG,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;QAE9C,MAAM,MAAM,GAAW,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAEpF,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;gBAC1B,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;gBAEjD,MAAM,cAAc,CAAC,IAAI,iCACpB,IAAI,KACP,IAAI;oBACJ,QAAQ,EACR,OAAO,EAAE,CAAC,MAAM,CAAC,IACjB,CAAA;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5F,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAA;QAEvB,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB;QACxC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAEtC,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxC,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAtCD,wDAsCC","sourcesContent":["import { ILike, MigrationInterface, QueryRunner } from 'typeorm'\n\nimport { config, logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { User, UserStatus } from '../service/user/user.js'\n\nconst ADMIN_ACCOUNT = config.get('adminAccount', {\n  username: 'admin',\n  name: 'Admin',\n  email: 'admin@hatiolab.com',\n  password: 'admin'\n})\n\nconst SEED_USERS = [\n  {\n    ...ADMIN_ACCOUNT,\n    userType: 'user',\n    status: UserStatus.ACTIVATED\n  }\n]\nexport class SeedUsers1548206416130 implements MigrationInterface {\n  public async up(queryRunner: QueryRunner): Promise<any> {\n    const userRepository = getRepository(User)\n    const domainRepository = getRepository(Domain)\n\n    const domain: Domain = await domainRepository.findOne({ where: { name: 'SYSTEM' } })\n\n    try {\n      for (let i = 0; i < SEED_USERS.length; i++) {\n        const user = SEED_USERS[i]\n        const salt = User.generateSalt()\n        const password = User.encode(user.password, salt)\n\n        await userRepository.save({\n          ...user,\n          salt,\n          password,\n          domains: [domain]\n        })\n      }\n    } catch (e) {\n      logger.error(e)\n    }\n\n    const admin = await userRepository.findOne({ where: { email: ILike(ADMIN_ACCOUNT.email) } })\n    domain.owner = admin.id\n\n    await domainRepository.save(domain)\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<any> {\n    const repository = getRepository(User)\n\n    SEED_USERS.reverse().forEach(async user => {\n      let record = await repository.findOneBy({ email: ILike(user.email) })\n      await repository.remove(record)\n    })\n  }\n}\n"]}

package/dist-server/migrations/1566805283882-SeedPrivilege.js

@@ -3,10 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SeedPrivilege1566805283882 = void 0;
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const privilege_1 = require("../service/privilege/privilege");
+const privilege_js_1 = require("../service/privilege/privilege.js");
 class SeedPrivilege1566805283882 {
     async up(queryRunner) {
-        const privilegeRepository = (0, shell_1.getRepository)(privilege_1.Privilege);
+        const privilegeRepository = (0, shell_1.getRepository)(privilege_js_1.Privilege);
         const { schema } = require('@things-factory/shell/dist-server/schema');
         await schema();
         const privileges = process['PRIVILEGES'];

package/dist-server/migrations/1566805283882-SeedPrivilege.js.map

@@ -1 +1 @@
-{"version":3,"file":"1566805283882-SeedPrivilege.js","sourceRoot":"","sources":["../../server/migrations/1566805283882-SeedPrivilege.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,iDAAqD;AAErD,8DAA0D;AAE1D,MAAa,0BAA0B;IAC9B,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,qBAAS,CAAC,CAAA;QAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,0CAA0C,CAAC,CAAA;QACtE,MAAM,MAAM,EAAE,CAAA;QACd,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;QAExC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAA8B,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC1E,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB,IAAiB,CAAC;CAC7D;AApBD,gEAoBC","sourcesContent":["import { MigrationInterface, QueryRunner } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { getRepository } from '@things-factory/shell'\n\nimport { Privilege } from '../service/privilege/privilege'\n\nexport class SeedPrivilege1566805283882 implements MigrationInterface {\n  public async up(queryRunner: QueryRunner): Promise<any> {\n    const privilegeRepository = getRepository(Privilege)\n\n    const { schema } = require('@things-factory/shell/dist-server/schema')\n    await schema()\n    const privileges = process['PRIVILEGES']\n\n    try {\n      for (const [category, name] of Object.values(privileges as [string, string])) {\n        if (0 == (await privilegeRepository.count({ where: { category, name } }))) {\n          await privilegeRepository.save({ category, name })\n        }\n      }\n    } catch (e) {\n      logger.error(e)\n    }\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<any> {}\n}\n"]}
+{"version":3,"file":"1566805283882-SeedPrivilege.js","sourceRoot":"","sources":["../../server/migrations/1566805283882-SeedPrivilege.ts"],"names":[],"mappings":";;;AAEA,6CAA4C;AAC5C,iDAAqD;AAErD,oEAA6D;AAE7D,MAAa,0BAA0B;IAC9B,KAAK,CAAC,EAAE,CAAC,WAAwB;QACtC,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAA;QAEpD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,0CAA0C,CAAC,CAAA;QACtE,MAAM,MAAM,EAAE,CAAA;QACd,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;QAExC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAA8B,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC1E,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAAwB,IAAiB,CAAC;CAC7D;AApBD,gEAoBC","sourcesContent":["import { MigrationInterface, QueryRunner } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { getRepository } from '@things-factory/shell'\n\nimport { Privilege } from '../service/privilege/privilege.js'\n\nexport class SeedPrivilege1566805283882 implements MigrationInterface {\n  public async up(queryRunner: QueryRunner): Promise<any> {\n    const privilegeRepository = getRepository(Privilege)\n\n    const { schema } = require('@things-factory/shell/dist-server/schema')\n    await schema()\n    const privileges = process['PRIVILEGES']\n\n    try {\n      for (const [category, name] of Object.values(privileges as [string, string])) {\n        if (0 == (await privilegeRepository.count({ where: { category, name } }))) {\n          await privilegeRepository.save({ category, name })\n        }\n      }\n    } catch (e) {\n      logger.error(e)\n    }\n  }\n\n  public async down(queryRunner: QueryRunner): Promise<any> {}\n}\n"]}

package/dist-server/migrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/migrations/index.ts"],"names":[],"mappings":";;;AAAA,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAEjB,QAAA,UAAU,GAAG,EAAE,CAAA;AAE1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAS,IAAI;IACzE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAM;IAC3C,kBAAU,GAAG,kBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAClF,CAAC,CAAC,CAAA","sourcesContent":["const glob = require('glob')\nconst path = require('path')\n\nexport var migrations = []\n\nglob.sync(path.resolve(__dirname, '.', '**', '*.js')).forEach(function(file) {\n  if (file.indexOf('index.js') !== -1) return\n  migrations = migrations.concat(Object.values(require(path.resolve(file))) || [])\n})\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/migrations/index.ts"],"names":[],"mappings":";;;AAAA,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AAEjB,QAAA,UAAU,GAAG,EAAE,CAAA;AAE1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI;IAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAM;IAC3C,kBAAU,GAAG,kBAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAClF,CAAC,CAAC,CAAA","sourcesContent":["const glob = require('glob')\nconst path = require('path')\n\nexport var migrations = []\n\nglob.sync(path.resolve(__dirname, '.', '**', '*.js')).forEach(function (file) {\n  if (file.indexOf('index.js') !== -1) return\n  migrations = migrations.concat(Object.values(require(path.resolve(file))) || [])\n})\n"]}

package/dist-server/router/auth-checkin-router.js

@@ -5,10 +5,10 @@ const tslib_1 = require("tslib");
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const login_history_1 = require("../service/login-history/login-history");
-const accepts_1 = require("../utils/accepts");
-const access_token_cookie_1 = require("../utils/access-token-cookie");
-const get_user_domains_1 = require("../utils/get-user-domains");
+const login_history_js_1 = require("../service/login-history/login-history.js");
+const accepts_js_1 = require("../utils/accepts.js");
+const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
+const get_user_domains_js_1 = require("../utils/get-user-domains.js");
 const domainType = env_1.config.get('domainType');
 exports.authCheckinRouter = new koa_router_1.default();
 exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next) => {
@@ -16,10 +16,10 @@ exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next)
     const header = request.header;
     const { user } = context.state;
     let { subdomain } = context.params;
-    let domains = await (0, get_user_domains_1.getUserDomains)(user);
+    let domains = await (0, get_user_domains_js_1.getUserDomains)(user);
     if (domainType)
         domains = domains.filter(d => d.extType == domainType);
-    if (!(0, accepts_1.accepts)(header.accept, ['text/html', '*/*'])) {
+    if (!(0, accepts_js_1.accepts)(header.accept, ['text/html', '*/*'])) {
         // When request expects non html response
         try {
             if (!subdomain)
@@ -31,7 +31,7 @@ exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next)
             context.body = true;
         }
         catch (e) {
-            (0, access_token_cookie_1.clearAccessTokenCookie)(context);
+            (0, access_token_cookie_js_1.clearAccessTokenCookie)(context);
             throw e;
         }
     }
@@ -60,7 +60,13 @@ exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next)
                 pageElement: 'auth-checkin',
                 elementScript: '/auth/checkin.js',
                 data: {
-                    user: { email: user.email, locale: user.locale, name: user.name, userType: user.userType },
+                    user: {
+                        username: user.username,
+                        email: user.email,
+                        locale: user.locale,
+                        name: user.name,
+                        userType: user.userType
+                    },
                     domains,
                     domainType,
                     redirectTo,
@@ -69,14 +75,14 @@ exports.authCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next)
             });
         }
         catch (e) {
-            (0, access_token_cookie_1.clearAccessTokenCookie)(context);
-            context.redirect(`/auth/signin?email=${encodeURIComponent(user.email)}&redirect_to=${encodeURIComponent(redirectTo)}`);
+            (0, access_token_cookie_js_1.clearAccessTokenCookie)(context);
+            context.redirect(`/auth/signin?username=${encodeURIComponent(user.username)}&redirect_to=${encodeURIComponent(redirectTo)}`);
         }
     }
 });
 exports.authCheckinRouter.get('/auth/domains', async (context) => {
     const { user } = context.state;
-    var domains = await (0, get_user_domains_1.getUserDomains)(user);
+    var domains = await (0, get_user_domains_js_1.getUserDomains)(user);
     if (domainType) {
         domains = domains.filter(d => d.extType == domainType);
     }
@@ -87,7 +93,7 @@ async function checkIn(checkInDomain, redirectTo, context) {
     const remoteAddress = context.req.headers['x-forwarded-for']
         ? context.req.headers['x-forwarded-for'].split(',')[0].trim()
         : context.req.connection.remoteAddress;
-    await login_history_1.LoginHistory.stamp(checkInDomain, user, remoteAddress);
+    await login_history_js_1.LoginHistory.stamp(checkInDomain, user, remoteAddress);
     if (redirectTo) {
         return context.redirect((0, shell_1.getRedirectSubdomainPath)(context, checkInDomain.subdomain, redirectTo));
     }

package/dist-server/router/auth-checkin-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-checkin-router.js","sourceRoot":"","sources":["../../server/router/auth-checkin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,iDAA+F;AAE/F,0EAAqE;AAErE,8CAA0C;AAC1C,sEAAqE;AACrE,gEAA0D;AAE1D,MAAM,UAAU,GAAG,YAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAE9B,QAAA,iBAAiB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE7C,yBAAiB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAElC,IAAI,OAAO,GAAsB,MAAM,IAAA,iCAAc,EAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,UAAU;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAA;IAEtE,IAAI,CAAC,IAAA,iBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,yCAAyC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;YACrH,MAAM,aAAa,GAAgC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA,CAAC,wCAAwC;YACxI,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAEnF,MAAM,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YAC3C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,4CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEvD,IAAI,CAAC;YACH,IAAI,OAAe,CAAA;YAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,6CAA6C;gBAC7C,SAAS,GAAG,IAAA,6BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,aAA8B,CAAA;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;gBAC3D,IAAI,CAAC,aAAa;oBAAE,OAAO,GAAG,CAAC,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,MAAM,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,cAAc;gBAC3B,aAAa,EAAE,kBAAkB;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;oBAC1F,OAAO;oBACP,UAAU;oBACV,UAAU;oBACV,OAAO;iBACR;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,4CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,OAAO,CAAC,QAAQ,CACd,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACrG,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,yBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,OAAO,GAAG,MAAM,IAAA,iCAAc,EAAC,IAAI,CAAC,CAAA;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,KAAK,UAAU,OAAO,CACpB,aAA8B,EAC9B,UAAyB,EACzB,OAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,GAAmB,OAAO,CAAC,KAAK,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC5D,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACzE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAA;IAEtC,MAAM,4BAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE5D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAA,gCAAwB,EAAC,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;IACjG,CAAC;AACH,CAAC","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { Domain, findSubdomainFromPath, getRedirectSubdomainPath } from '@things-factory/shell'\n\nimport { LoginHistory } from '../service/login-history/login-history'\nimport { User } from '../service/user/user'\nimport { accepts } from '../utils/accepts'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie'\nimport { getUserDomains } from '../utils/get-user-domains'\n\nconst domainType = config.get('domainType')\n\nexport const authCheckinRouter = new Router()\n\nauthCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next) => {\n  const { request, t } = context\n  const header = request.header\n  const { user } = context.state\n  let { subdomain } = context.params\n\n  let domains: Partial<Domain>[] = await getUserDomains(user)\n  if (domainType) domains = domains.filter(d => d.extType == domainType)\n\n  if (!accepts(header.accept, ['text/html', '*/*'])) {\n    // When request expects non html response\n    try {\n      if (!subdomain) throw new Error(t('error.domain not specified', { subdomain })) // When params doesn't have subdomain\n      const checkInDomain: Partial<Domain> | undefined = domains.find(d => d.subdomain === subdomain) // When no matched domain with subdomain\n      if (!checkInDomain) throw new Error(t('error.domain not specified', { subdomain }))\n\n      await checkIn(checkInDomain, null, context)\n      context.body = true\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      throw e\n    }\n  } else {\n    // When request expects html response\n    const { redirect_to: redirectTo = '/' } = context.query\n\n    try {\n      let message: string\n\n      if (!subdomain) {\n        /* try to find domain from redirectTo path */\n        subdomain = findSubdomainFromPath(context, redirectTo)\n      }\n\n      let checkInDomain: Partial<Domain>\n      if (subdomain) {\n        checkInDomain = domains.find(d => d.subdomain == subdomain)\n        if (!checkInDomain) message = t('error.domain not allowed', { subdomain })\n      } else if (domains.length === 1) {\n        checkInDomain = domains[0]\n      }\n\n      if (checkInDomain) {\n        return await checkIn(checkInDomain, redirectTo, context)\n      }\n\n      await context.render('auth-page', {\n        pageElement: 'auth-checkin',\n        elementScript: '/auth/checkin.js',\n        data: {\n          user: { email: user.email, locale: user.locale, name: user.name, userType: user.userType },\n          domains,\n          domainType,\n          redirectTo,\n          message\n        }\n      })\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      context.redirect(\n        `/auth/signin?email=${encodeURIComponent(user.email)}&redirect_to=${encodeURIComponent(redirectTo)}`\n      )\n    }\n  }\n})\n\nauthCheckinRouter.get('/auth/domains', async context => {\n  const { user } = context.state\n  var domains = await getUserDomains(user)\n  if (domainType) {\n    domains = domains.filter(d => d.extType == domainType)\n  }\n\n  context.body = domains\n})\n\nasync function checkIn(\n  checkInDomain: Partial<Domain>,\n  redirectTo: string | null,\n  context: ResolverContext\n): Promise<void> {\n  const { user }: { user: User } = context.state\n  const remoteAddress = context.req.headers['x-forwarded-for'] \n  ? (context.req.headers['x-forwarded-for'] as string).split(',')[0].trim()\n  : context.req.connection.remoteAddress\n\n  await LoginHistory.stamp(checkInDomain, user, remoteAddress)\n\n  if (redirectTo) {\n    return context.redirect(getRedirectSubdomainPath(context, checkInDomain.subdomain, redirectTo))\n  }\n}\n"]}
+{"version":3,"file":"auth-checkin-router.js","sourceRoot":"","sources":["../../server/router/auth-checkin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,iDAA+F;AAE/F,gFAAwE;AAExE,oDAA6C;AAC7C,4EAAwE;AACxE,sEAA6D;AAE7D,MAAM,UAAU,GAAG,YAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;AAE9B,QAAA,iBAAiB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE7C,yBAAiB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAC7B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAElC,IAAI,OAAO,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,UAAU;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAA;IAEtE,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,yCAAyC;QACzC,IAAI,CAAC;YACH,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA,CAAC,qCAAqC;YACrH,MAAM,aAAa,GAAgC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA,CAAC,wCAAwC;YACxI,IAAI,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAEnF,MAAM,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;YAC3C,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,CAAC,CAAA;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qCAAqC;QACrC,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEvD,IAAI,CAAC;YACH,IAAI,OAAe,CAAA;YAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,6CAA6C;gBAC7C,SAAS,GAAG,IAAA,6BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAA;YACxD,CAAC;YAED,IAAI,aAA8B,CAAA;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;gBAC3D,IAAI,CAAC,aAAa;oBAAE,OAAO,GAAG,CAAC,CAAC,0BAA0B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;YAC5E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAC5B,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,MAAM,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,cAAc;gBAC3B,aAAa,EAAE,kBAAkB;gBACjC,IAAI,EAAE;oBACJ,IAAI,EAAE;wBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;oBACD,OAAO;oBACP,UAAU;oBACV,UAAU;oBACV,OAAO;iBACR;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;YAC/B,OAAO,CAAC,QAAQ,CACd,yBAAyB,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3G,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,yBAAiB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,OAAO,GAAG,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,KAAK,UAAU,OAAO,CACpB,aAA8B,EAC9B,UAAyB,EACzB,OAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,GAAmB,OAAO,CAAC,KAAK,CAAA;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC1D,CAAC,CAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACzE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAA;IAExC,MAAM,+BAAY,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE5D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAA,gCAAwB,EAAC,OAAO,EAAE,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;IACjG,CAAC;AACH,CAAC","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { Domain, findSubdomainFromPath, getRedirectSubdomainPath } from '@things-factory/shell'\n\nimport { LoginHistory } from '../service/login-history/login-history.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst domainType = config.get('domainType')\n\nexport const authCheckinRouter = new Router()\n\nauthCheckinRouter.get('/auth/checkin/:subdomain?', async (context, next) => {\n  const { request, t } = context\n  const header = request.header\n  const { user } = context.state\n  let { subdomain } = context.params\n\n  let domains: Partial<Domain>[] = await getUserDomains(user)\n  if (domainType) domains = domains.filter(d => d.extType == domainType)\n\n  if (!accepts(header.accept, ['text/html', '*/*'])) {\n    // When request expects non html response\n    try {\n      if (!subdomain) throw new Error(t('error.domain not specified', { subdomain })) // When params doesn't have subdomain\n      const checkInDomain: Partial<Domain> | undefined = domains.find(d => d.subdomain === subdomain) // When no matched domain with subdomain\n      if (!checkInDomain) throw new Error(t('error.domain not specified', { subdomain }))\n\n      await checkIn(checkInDomain, null, context)\n      context.body = true\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      throw e\n    }\n  } else {\n    // When request expects html response\n    const { redirect_to: redirectTo = '/' } = context.query\n\n    try {\n      let message: string\n\n      if (!subdomain) {\n        /* try to find domain from redirectTo path */\n        subdomain = findSubdomainFromPath(context, redirectTo)\n      }\n\n      let checkInDomain: Partial<Domain>\n      if (subdomain) {\n        checkInDomain = domains.find(d => d.subdomain == subdomain)\n        if (!checkInDomain) message = t('error.domain not allowed', { subdomain })\n      } else if (domains.length === 1) {\n        checkInDomain = domains[0]\n      }\n\n      if (checkInDomain) {\n        return await checkIn(checkInDomain, redirectTo, context)\n      }\n\n      await context.render('auth-page', {\n        pageElement: 'auth-checkin',\n        elementScript: '/auth/checkin.js',\n        data: {\n          user: {\n            username: user.username,\n            email: user.email,\n            locale: user.locale,\n            name: user.name,\n            userType: user.userType\n          },\n          domains,\n          domainType,\n          redirectTo,\n          message\n        }\n      })\n    } catch (e) {\n      clearAccessTokenCookie(context)\n      context.redirect(\n        `/auth/signin?username=${encodeURIComponent(user.username)}&redirect_to=${encodeURIComponent(redirectTo)}`\n      )\n    }\n  }\n})\n\nauthCheckinRouter.get('/auth/domains', async context => {\n  const { user } = context.state\n  var domains = await getUserDomains(user)\n  if (domainType) {\n    domains = domains.filter(d => d.extType == domainType)\n  }\n\n  context.body = domains\n})\n\nasync function checkIn(\n  checkInDomain: Partial<Domain>,\n  redirectTo: string | null,\n  context: ResolverContext\n): Promise<void> {\n  const { user }: { user: User } = context.state\n  const remoteAddress = context.req.headers['x-forwarded-for']\n    ? (context.req.headers['x-forwarded-for'] as string).split(',')[0].trim()\n    : context.req.connection.remoteAddress\n\n  await LoginHistory.stamp(checkInDomain, user, remoteAddress)\n\n  if (redirectTo) {\n    return context.redirect(getRedirectSubdomainPath(context, checkInDomain.subdomain, redirectTo))\n  }\n}\n"]}