@things-factory/auth-google 6.1.186

package/helps/auth-google/auth-google.md

@@ -0,0 +1,160 @@
+# AuthGoogle
+
+Paragraphs are separated by a blank line.
+
+2nd paragraph. _Italic_, **bold**, and `monospace`. Itemized lists
+look like:
+
+- this one
+- that one
+- the other one
+
+Note that --- not considering the asterisk --- the actual text
+content starts at 4-columns in.
+
+> Block quotes are
+> written like so.
+>
+> They can span multiple paragraphs,
+> if you like.
+
+Use 3 dashes for an em-dash. Use 2 dashes for ranges (ex., "it's all
+in chapters 12--14"). Three dots ... will be converted to an ellipsis.
+Unicode is supported. ☺
+
+## An h2 header
+
+Here's a numbered list:
+
+1. first item
+2. second item
+3. third item
+
+Note again how the actual text starts at 4 columns in (4 characters
+from the left side). Here's a code sample:
+
+# Let me re-iterate ...
+
+for i in 1 .. 10 { do-something(i) }
+
+As you probably guessed, indented 4 spaces. By the way, instead of
+indenting the block, you can use delimited blocks, if you like:
+
+```
+define foobar() {
+print "Welcome to flavor country!";
+}
+```
+
+(which makes copying & pasting easier). You can optionally mark the
+delimited block for Pandoc to syntax highlight it:
+
+```python
+import time
+# Quick, count to ten!
+for i in range(10):
+# (but not *too* quick)
+time.sleep(0.5)
+print(i)
+```
+
+### An h3 header
+
+Now a nested list:
+
+1. First, get these ingredients:
+
+- carrots
+- celery
+- lentils
+
+2. Boil some water.
+
+3. Dump everything in the pot and follow
+   this algorithm:
+
+find wooden spoon
+uncover pot
+stir
+cover pot
+balance wooden spoon precariously on pot handle
+wait 10 minutes
+goto first step (or shut off burner when done)
+
+Do not bump wooden spoon or it will fall.
+
+Notice again how text always lines up on 4-space indents (including
+that last line which continues item 3 above).
+
+Here's a link to [a website](http://foo.bar), to a [local
+doc](local-doc.html), and to a [section heading in the current
+doc](#an-h2-header). Here's a footnote [^1].
+
+[^1]: Some footnote text.
+
+Tables can look like this:
+
+Name Size Material Color
+
+---
+
+All Business 9 leather brown
+Roundabout 10 hemp canvas natural
+Cinderella 11 glass transparent
+
+Table: Shoes sizes, materials, and colors.
+
+(The above is the caption for the table.) Pandoc also supports
+multi-line tables:
+
+---
+
+Keyword Text
+
+---
+
+red Sunsets, apples, and
+other red or reddish
+things.
+
+green Leaves, grass, frogs
+and other things it's
+not easy being.
+
+---
+
+A horizontal rule follows.
+
+---
+
+Here's a definition list:
+
+apples
+: Good for making applesauce.
+
+oranges
+: Citrus!
+
+tomatoes
+: There's no "e" in tomatoe.
+
+Again, text is indented 4 spaces. (Put a blank line between each
+term and its definition to spread things out more.)
+
+Here's a "line block" (note how whitespace is honored):
+
+| Line one
+| Line too
+| Line tree
+
+and images can be specified like so:
+
+![example image](example-image.jpg 'An exemplary image')
+
+Inline math equation: $\omega = d\phi / dt$. Display
+math should get its own line like so:
+
+$$I = \int \rho R^{2} dV$$
+
+And note that you can backslash-escape any punctuation characters
+which you wish to be displayed literally, ex.: \`foo\`, \*bar\*, etc.

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@things-factory/auth-google",
+  "version": "6.1.186",
+  "main": "dist-server/index.js",
+  "browser": "dist-client/index.js",
+  "things-factory": true,
+  "license": "MIT",
+  "author": "heartyoh <heartyoh@hatiolab.com>",
+  "description": "Module for Supporting User Authentication with Google",
+  "publishConfig": {
+    "access": "public",
+    "@things-factory:registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hatiolab/things-factory.git",
+    "directory": "packages/auth-google"
+  },
+  "scripts": {
+    "build": "npm run build:server && npm run build:client",
+    "copy:files": "copyfiles -e \"./client/**/*.{ts,js,json}\" -u 1 \"./client/**/*\" dist-client",
+    "build:client": "npm run copy:files && npx tsc --p ./client/tsconfig.json",
+    "build:server": "npx tsc --p ./server/tsconfig.json",
+    "clean:client": "npx rimraf dist-client",
+    "clean:server": "npx rimraf dist-server",
+    "clean": "npm run clean:server && npm run clean:client",
+    "migration:create": "node ../../node_modules/typeorm/cli.js migration:create -d ./server/migrations"
+  },
+  "dependencies": {
+    "@operato/graphql": "^1.0.0",
+    "@operato/shell": "^1.0.0",
+    "@things-factory/auth-base": "^6.1.186",
+    "@things-factory/shell": "^6.1.186",
+    "passport": "^0.6.0",
+    "passport-google-oauth20": "^2.0.0"
+  },
+  "gitHead": "ddf508496cdd7d4b9d0e020703a2f7a586a42ec5"
+}

package/server/controllers/get-access-token.ts

@@ -0,0 +1,30 @@
+import fetch from 'node-fetch'
+
+import { AuthProvider } from '@things-factory/auth-base'
+
+const authorityHostUrl = 'https://login.microsoftonline.com'
+
+export async function getAccessToken(authProvider: AuthProvider): Promise<string | null> {
+  try {
+    const { clientId, clientSecret, tenantId } = authProvider
+
+    const authorityUrl = `${authorityHostUrl}/${tenantId}`
+    const resource = 'https://graph.microsoft.com'
+    const OAUTH2_URL = `${authorityUrl}/oauth2/token?api-version=1.0`
+
+    const tokenResponse = await fetch(OAUTH2_URL, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/x-www-form-urlencoded'
+      },
+      body: `client_id=${clientId}&resource=${resource}&client_secret=${clientSecret}&grant_type=client_credentials`
+    })
+
+    const result = await tokenResponse.json()
+    const { access_token } = result
+    return access_token
+  } catch (error) {
+    console.error('Error fetching access token:', error)
+    return null
+  }
+}

package/server/controllers/subscribe-users-change.ts

@@ -0,0 +1,34 @@
+import fetch from 'node-fetch'
+
+import { getAccessToken } from './get-access-token'
+import { AuthProvider } from '@things-factory/auth-base'
+
+var clientState
+
+export function getClientState() {
+  return clientState
+}
+
+export async function msgraphSubscriptions(authProvider: AuthProvider) {
+  const accessToken = await getAccessToken(authProvider)
+  const expirationDateTime = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000)
+
+  clientState = `${authProvider.domainId}:${authProvider.id}` // TODO make secure
+
+  const response = await fetch('https://graph.microsoft.com/v1.0/subscriptions', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      'Content-Type': 'application/json'
+    },
+    body: JSON.stringify({
+      changeType: 'created,updated',
+      notificationUrl: 'YOUR_WEBHOOK_ENDPOINT_BASE' + '/webhook/google-users',
+      resource: '/users',
+      expirationDateTime: expirationDateTime.toISOString() /* 최대 3일 이내, UTC 타임으로 설정 */,
+      clientState
+    })
+  })
+
+  const data = await response.json()
+}

package/server/controllers/sync-user-info.ts

@@ -0,0 +1,129 @@
+import fetch from 'node-fetch'
+
+import { AuthProvider, User, UserStatus, UsersAuthProviders } from '@things-factory/auth-base'
+import { getAccessToken } from './get-access-token'
+
+export async function syncAllUserInfo(authProvider: AuthProvider, context: ResolverContext) {
+  const accessToken = await getAccessToken(authProvider)
+
+  if (!accessToken) {
+    throw new Error('Failed to obtain access token')
+  }
+
+  const latestData = await fetch('https://graph.microsoft.com/v1.0/users', {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    }
+  }).then(res => res.json())
+
+  latestData.value
+    .filter(({ mail }) => mail)
+    .forEach(async user => {
+      await updateUserInfo(authProvider, user, context)
+    })
+}
+
+export async function updateUserInfo(authProvider: AuthProvider, userInfo, context: ResolverContext) {
+  const { tx, domain, user } = context.state
+
+  // {
+  //   "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
+  //   "businessPhones": [
+  //     "+1 412 555 0109"
+  //   ],
+  //   "displayName": "John Doe",
+  //   "givenName": "John",
+  //   "jobTitle": "Developer",
+  //   "mail": "john.doe@contoso.com",
+  //   "mobilePhone": "+1 412 555 0109",
+  //   "officeLocation": "Floor 2",
+  //   "preferredLanguage": "en-US",
+  //   "surname": "Doe",
+  //   "userPrincipalName": "john.doe@contoso.com"
+  // }
+  const {
+    id,
+    businessPhones,
+    displayName,
+    givenName,
+    surname,
+    jobTitle,
+    mail,
+    mobilePhone,
+    officeLocation,
+    preferredLanguage,
+    userPricipalName
+  } = userInfo
+
+  const repository = tx.getRepository(User)
+
+  // 1. 사용자를 찾는다.(email 정보로)
+  const existingUser = await repository.findOne({
+    where: { email: mail },
+    relations: ['domains']
+  })
+
+  if (!existingUser) {
+    // 2. 사용자가 없다면, 생성한다.
+    const salt = User.generateSalt()
+
+    /* normally they don't login with this password. */
+    const password = salt
+
+    const createdUser = await repository.save({
+      id,
+      name: displayName,
+      email: mail,
+      creator: user,
+      updater: user,
+      domains: domain ? [domain] : [],
+      roles: [],
+      salt,
+      userType: 'user',
+      // ssoId: id,
+      locale: preferredLanguage,
+      status: UserStatus.ACTIVATED,
+      passwordUpdatedAt: new Date(),
+      password: User.encode(password, salt)
+    })
+
+    await tx.getRepository(UsersAuthProviders).save({
+      domain,
+      user: createdUser,
+      authProvider,
+      ssoId: id
+    })
+
+    return createdUser
+  } else {
+    // 3. 사용자가 있다면, 업데이트한다.
+    const { domains } = existingUser
+
+    if (!domains.find(existing => existing.id == domain.id)) {
+      domains.push(domain)
+    }
+
+    const updatedUser = await repository.save({
+      ...existingUser,
+      name: displayName,
+      // ssoId: id,
+      domains,
+      locale: preferredLanguage,
+      updater: user
+    })
+
+    const usersAuthProviders = await tx.getRepository(UsersAuthProviders).findOne({
+      where: { domain: { id: domain.id }, user: { id: updatedUser.id }, authProvider: { id: authProvider.id } }
+    })
+
+    await tx.getRepository(UsersAuthProviders).save({
+      ...usersAuthProviders,
+      domain,
+      user: updatedUser,
+      authProvider,
+      ssoId: id
+    })
+
+    return updatedUser
+  }
+}

package/server/index.ts

@@ -0,0 +1,18 @@
+export * from './middlewares'
+export * from './service'
+
+import './routes'
+
+import { AuthProvider } from '@things-factory/auth-base'
+import { syncAllUserInfo } from './controllers/sync-user-info'
+
+AuthProvider.register('google', {
+  type: 'google',
+  description: 'Authentication Provider for Google',
+  help: '',
+  parameterSpec: null,
+  async synchronizeUsers(authProvider: AuthProvider, context: ResolverContext): Promise<boolean> {
+    await syncAllUserInfo(authProvider, context)
+    return true
+  }
+})

package/server/middlewares/google-authenticate-middleware.ts

@@ -0,0 +1,70 @@
+import passport from 'koa-passport'
+import { Strategy as GoogleStrategy } from 'passport-google-oauth20'
+
+import { config } from '@things-factory/env'
+import { User } from '@things-factory/auth-base'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+if (SSOGoogleConfig) {
+  passport.use(
+    new GoogleStrategy(SSOGoogleConfig, async (token, tokenSecret, profile, done) => {
+      if (!profile) {
+        return done(new Error('No profile found'), null)
+      }
+
+      try {
+        const { email } = profile
+
+        const user = await User.checkAuthWithEmail({ email })
+
+        const { id, userType, status } = user
+
+        return done(null, {
+          id,
+          userType,
+          status
+        })
+      } catch (error) {
+        return done(error)
+      }
+    })
+  )
+}
+
+export async function authGoogleMiddleware(context, next) {
+  const { path } = context
+  const { user } = context.state
+
+  if (user) {
+    return await next()
+  }
+
+  await passport.authenticate('google', {
+    failureRedirect: '/auth/signin',
+    successRedirect: '/auth/checkin'
+  })(context, next)
+}
+
+export async function googleSubscriptionMiddleware(context, next) {
+  const { path } = context
+  const { user } = context.state
+
+  if (user) {
+    return await next()
+  }
+
+  await passport.authenticate('google', {
+    failureRedirect: '/auth/signin',
+    successRedirect: '/auth/checkin'
+  })(context)
+
+  /* 다음은, websocket 에서 인증을 처리하기 위한 작업임. */
+  const passportObject = context.session?.passport
+  if (passportObject) {
+    const userEntity = await User.checkAuth(passportObject?.user)
+    context.state.user = userEntity
+  }
+
+  return await next()
+}

package/server/middlewares/index.ts

@@ -0,0 +1,13 @@
+import { config } from '@things-factory/env'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+import { googleSubscriptionMiddleware } from './google-authenticate-middleware'
+
+if (SSOGoogleConfig) {
+  process.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {
+    subscriptionMiddleware.unshift(googleSubscriptionMiddleware)
+  })
+}
+
+export * from './google-authenticate-middleware'

package/server/router/auth-google-router.ts

@@ -0,0 +1,14 @@
+import Router from 'koa-router'
+
+import passport from 'koa-passport'
+import { authGoogleMiddleware } from '../middlewares'
+
+export const authGoogleRouter = new Router()
+
+authGoogleRouter.get(
+  '/auth/callback-auth-google',
+  passport.authenticate('google', { failureRedirect: '/auth/signin' }),
+  ctx => {
+    ctx.redirect('/auth/checkin')
+  }
+)

package/server/router/auth-google-webhook-router.ts

@@ -0,0 +1,96 @@
+import Router from 'koa-router'
+import fetch from 'node-fetch'
+
+import { getRepository, getDataSource } from '@things-factory/shell'
+
+import { updateUserInfo } from '../controllers/sync-user-info'
+import { getAccessToken } from '../controllers/get-access-token'
+import { AuthProvider } from '@things-factory/auth-base'
+
+export const authGoogleWebhookRouter = new Router()
+
+// Microsoft Graph에서 발송되는 알림을 처리하기 위한 타입 정의
+interface Notification {
+  resourceData: {
+    id: string
+  }
+}
+
+authGoogleWebhookRouter.post('/webhook/google-users', async context => {
+  const notifications: Notification[] = context.request.body.value
+  const clientState = context.request.body.clientState
+  const [domainId, authProviderId] = clientState?.split(':') || []
+
+  if (!domainId || !authProviderId) {
+    context.status = 401 // unauthorized
+    context.body = 'Invalid ClientState'
+    return
+  }
+
+  await getDataSource('tx').transaction(async tx => {
+    const wrap = context.app.createContext(context.req || {}, context.res || {})
+
+    wrap.state = {
+      ...context.state,
+      domain: null,
+      tx
+    }
+    wrap.t = context.t
+
+    const authProvider = await tx.getRepository(AuthProvider).findOne({
+      where: {
+        domain: { id: domainId },
+        id: authProviderId
+      }
+    })
+
+    if (!authProvider) {
+      context.status = 401 // unauthorized
+      context.body = 'Invalid ClientState'
+      return
+    }
+
+    const accessToken = await getAccessToken(authProvider)
+
+    for (const notification of notifications) {
+      const userId = notification.resourceData.id
+
+      try {
+        const userResponse = await fetch(`https://graph.microsoft.com/v1.0/users/${userId}`, {
+          headers: {
+            Authorization: `Bearer ${accessToken}`
+          }
+        })
+
+        if (!userResponse.ok) {
+          throw new Error(`Failed to fetch user data: ${userResponse.statusText}`)
+        }
+
+        const userInfo = await userResponse.json()
+
+        // {
+        //   "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
+        //   "businessPhones": ["+1 412 555 0109"],
+        //   "displayName": "Megan Bowen",
+        //   "givenName": "Megan",
+        //   "jobTitle": "Auditor",
+        //   "mail": "MeganB@M365x214355.onmicrosoft.com",
+        //   "mobilePhone": "+1 412 555 0109",
+        //   "officeLocation": "12/1110",
+        //   "preferredLanguage": "en-US",
+        //   "surname": "Bowen",
+        //   "userPrincipalName": "MeganB@M365x214355.onmicrosoft.com",
+        //   "id": "48d31887-5fad-4d73-a9f5-3c356e68a038"
+        // }
+
+        // webhook 호출로부터 호출한 tenant를 알 수 있다면, 매핑된 도메인 정보를 포함할 수 있을 것 같은데..
+
+        await updateUserInfo(authProvider, userInfo, wrap)
+      } catch (error) {
+        console.error('Error fetching user data from Microsoft Graph:', error)
+      }
+    }
+  })
+
+  context.status = 202
+})

package/server/router/index.ts

@@ -0,0 +1,2 @@
+export * from './auth-google-router'
+export * from './auth-google-webhook-router'

package/server/routes.ts

@@ -0,0 +1,28 @@
+import passport from 'koa-passport'
+import { config } from '@things-factory/env'
+import { setAccessTokenCookie } from '@things-factory/auth-base'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+import { authGoogleMiddleware } from './middlewares'
+import { authGoogleRouter, authGoogleWebhookRouter } from './router'
+
+if (SSOGoogleConfig) {
+  process.on('bootstrap-collect-sso-middleware' as any, (_, ssoMiddlewares) => {
+    ssoMiddlewares.push(authGoogleMiddleware)
+  })
+
+  process.on('bootstrap-module-domain-public-route' as any, (app, domainPublicRouter) => {
+    domainPublicRouter.use(authGoogleRouter.routes(), authGoogleRouter.allowedMethods())
+    domainPublicRouter.use(authGoogleWebhookRouter.routes(), authGoogleWebhookRouter.allowedMethods())
+  })
+
+  process.on('bootstrap-module-global-public-route' as any, (app, globalPublicRouter) => {
+    globalPublicRouter.get(
+      '/auth/signin-with-google',
+      passport.authenticate('google', {
+        scope: ['https://www.googleapis.com/auth/plus.login']
+      })
+    )
+  })
+}

package/server/service/auth-google/auth-google-mutation.ts

@@ -0,0 +1,24 @@
+import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'
+
+import { syncAllUserInfo } from '../../controllers/sync-user-info'
+
+@Resolver()
+export class AuthGoogleMutation {
+  // @Directive('@transaction')
+  // @Directive('@privilege(superUserGranted:true)')
+  // @Mutation(returns => Boolean, { description: 'To synchronize google users' })
+  // async synchronizeGoogleUsers(@Ctx() context: ResolverContext): Promise<boolean> {
+  //   syncAllUserInfo(context)
+
+  //   return true
+  // }
+
+  @Directive('@transaction')
+  @Directive('@privilege(superUserGranted:true)')
+  @Mutation(returns => Boolean, { description: 'To subscribe google users' })
+  async subscribeGoogleUsers(@Ctx() context: ResolverContext): Promise<boolean> {
+    const { domain, user, tx } = context.state
+
+    return true
+  }
+}

package/server/service/auth-google/index.ts

@@ -0,0 +1,3 @@
+import { AuthGoogleMutation } from './auth-google-mutation'
+
+export const resolvers = [AuthGoogleMutation]

package/server/service/index.ts

@@ -0,0 +1,19 @@
+/* EXPORT ENTITY TYPES */
+
+/* IMPORT ENTITIES AND RESOLVERS */
+import { resolvers as AuthGoogleResolvers } from './auth-google'
+
+export const entities = [
+  /* ENTITIES */
+]
+
+export const subscribers = [
+  /* SUBSCRIBERS */
+]
+
+export const schema = {
+  resolverClasses: [
+    /* RESOLVER CLASSES */
+    ...AuthGoogleResolvers
+  ]
+}