@things-factory/auth-google 8.0.0-beta.9 → 8.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-google",
-  "version": "8.0.0-beta.9",
+  "version": "8.0.2",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -27,13 +27,13 @@
     "migration:create": "node ../../node_modules/typeorm/cli.js migration:create ./server/migrations/migration"
   },
   "dependencies": {
-    "@operato/graphql": "^8.0.0-beta",
-    "@operato/shell": "^8.0.0-beta",
-    "@things-factory/auth-base": "^8.0.0-beta.9",
-    "@things-factory/shell": "^8.0.0-beta.9",
+    "@operato/graphql": "^8.0.0",
+    "@operato/shell": "^8.0.0",
+    "@things-factory/auth-base": "^8.0.2",
+    "@things-factory/shell": "^8.0.2",
     "googleapis": "^126.0.1",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0"
   },
-  "gitHead": "86b1dfa26292926a2d5447fdc23bfa5a9e983245"
+  "gitHead": "39d60f56e142561233ddf6d47b539c637971357c"
 }

package/server/controllers/get-oauth2-client.ts

@@ -0,0 +1,22 @@
+import { google } from 'googleapis'
+
+import { AuthProvider } from '@things-factory/auth-base'
+
+export async function getOauth2Client(authProvider: AuthProvider): Promise<any> {
+  try {
+    const { privateKey } = authProvider
+
+    const serviceAccount = JSON.parse(privateKey)
+
+    const client = new google.auth.JWT(serviceAccount.client_email, null, serviceAccount.private_key, [
+      'https://www.googleapis.com/auth/admin.directory.user'
+    ])
+
+    await client.authorize()
+
+    return client
+  } catch (error) {
+    console.error('Error fetching oauth2 client:', error)
+    return null
+  }
+}

package/server/controllers/subscribe-users-change.ts

@@ -0,0 +1,35 @@
+import fetch from 'node-fetch'
+
+import { getOauth2Client } from './get-oauth2-client'
+import { AuthProvider } from '@things-factory/auth-base'
+
+/* TODO Implement with google */
+var clientState
+
+export function getClientState() {
+  return clientState
+}
+
+export async function googleSubscriptions(authProvider: AuthProvider) {
+  const client = await getOauth2Client(authProvider)
+  // const expirationDateTime = new Date(Date.now() + 3 * 24 * 60 * 60 * 1000)
+
+  // clientState = `${authProvider.domainId}:${authProvider.id}` // TODO make secure
+
+  // const response = await fetch('https://graph.microsoft.com/v1.0/subscriptions', {
+  //   method: 'POST',
+  //   headers: {
+  //     Authorization: `Bearer ${accessToken}`,
+  //     'Content-Type': 'application/json'
+  //   },
+  //   body: JSON.stringify({
+  //     changeType: 'created,updated',
+  //     notificationUrl: 'YOUR_WEBHOOK_ENDPOINT_BASE' + '/webhook/google-users',
+  //     resource: '/users',
+  //     expirationDateTime: expirationDateTime.toISOString() /* 최대 3일 이내, UTC 타임으로 설정 */,
+  //     clientState
+  //   })
+  // })
+
+  // const data = await response.json()
+}

package/server/controllers/sync-user-info.ts

@@ -0,0 +1,156 @@
+import fetch from 'node-fetch'
+import { google } from 'googleapis'
+
+import {
+  AuthProvider,
+  User,
+  UserStatus,
+  UsersAuthProviders,
+  encryptState,
+  decryptState
+} from '@things-factory/auth-base'
+import { config } from '@things-factory/env'
+import { getOauth2Client } from './get-oauth2-client'
+
+export async function syncAllUserInfo(authProvider: AuthProvider, context: ResolverContext) {
+  const oauth2Client = await getOauth2Client(authProvider)
+
+  const service = google.admin({ version: 'directory_v1', auth: oauth2Client })
+
+  const res = await service.users.list({
+    customer: 'my_customer' /* 'my_customer'는 G Suite 도메인의 모든 사용자를 나타내는 특수 문자열입니다 */,
+    maxResults: 10,
+    orderBy: 'email'
+  })
+
+  const users = res.data.users
+
+  if (users && users.length) {
+    for (const user of users) {
+      await updateUserInfo(authProvider, user, context)
+    }
+  } else {
+    console.log('No users found.')
+  }
+}
+
+export async function updateUserInfo(authProvider: AuthProvider, userInfo, context: ResolverContext) {
+  const { tx, domain, user } = context.state
+
+  // {
+  //   "kind": "admin#directory#user",
+  //   "id": "user's unique ID",
+  //   "etag": "etag of this resource",
+  //   "primaryEmail": "user@example.com",
+  //   "name": {
+  //     "givenName": "First",
+  //     "familyName": "Last",
+  //     "fullName": "First Last"
+  //   },
+  //   "isAdmin": false,
+  //   "isDelegatedAdmin": false,
+  //   "lastLoginTime": "2021-04-05T12:07:41.000Z",
+  //   "creationTime": "2017-05-26T10:57:00.000Z",
+  //   "agreedToTerms": true,
+  //   "suspended": false,
+  //   "archived": false,
+  //   "changePasswordAtNextLogin": false,
+  //   "ipWhitelisted": false,
+  //   "emails": [
+  //     {
+  //       "address": "user@example.com",
+  //       "type": "work",
+  //       "customType": "",
+  //       "primary": true
+  //     }
+  //   ],
+  //   "organizations": [
+  //     {
+  //       "name": "Department Name",
+  //       "title": "Job Title",
+  //       "type": "work",
+  //       "primary": true
+  //     }
+  //   ],
+  //   "phones": [
+  //     {
+  //       "value": "+1 xxx-xxx-xxxx",
+  //       "type": "work",
+  //       "primary": true
+  //     }
+  //   ],
+  //   "aliases": ["alias@example.com"],
+  //   // ... 다른 필드들
+  // }
+  const { id, name, primaryEmail } = userInfo
+
+  const repository = tx.getRepository(User)
+
+  // 1. 사용자를 찾는다.(email 정보로)
+  const existingUser = await repository.findOne({
+    where: { email: primaryEmail },
+    relations: ['domains']
+  })
+
+  if (!existingUser) {
+    // 2. 사용자가 없다면, 생성한다.
+    const salt = User.generateSalt()
+
+    /* normally they don't login with this password. */
+    const password = salt
+
+    const createdUser = await repository.save({
+      id,
+      name: name.fullName,
+      email: primaryEmail,
+      creator: user,
+      updater: user,
+      domains: domain ? [domain] : [],
+      roles: [],
+      salt,
+      userType: 'user',
+      // locale: preferredLanguage,
+      status: UserStatus.ACTIVATED,
+      passwordUpdatedAt: new Date(),
+      password: User.encode(password, salt)
+    })
+
+    await tx.getRepository(UsersAuthProviders).save({
+      domain,
+      user: createdUser,
+      authProvider,
+      ssoId: id
+    })
+
+    return createdUser
+  } else {
+    // 3. 사용자가 있다면, 업데이트한다.
+    const { domains } = existingUser
+
+    if (!domains.find(existing => existing.id == domain.id)) {
+      domains.push(domain)
+    }
+
+    const updatedUser = await repository.save({
+      ...existingUser,
+      name: name.fullName,
+      domains,
+      // locale: preferredLanguage,
+      updater: user
+    })
+
+    const usersAuthProviders = await tx.getRepository(UsersAuthProviders).findOne({
+      where: { domain: { id: domain.id }, user: { id: updatedUser.id }, authProvider: { id: authProvider.id } }
+    })
+
+    await tx.getRepository(UsersAuthProviders).save({
+      ...usersAuthProviders,
+      domain,
+      user: updatedUser,
+      authProvider,
+      ssoId: id
+    })
+
+    return updatedUser
+  }
+}

package/server/index.ts

@@ -0,0 +1,18 @@
+export * from './middlewares'
+export * from './service'
+
+import './routes'
+
+import { AuthProvider } from '@things-factory/auth-base'
+import { syncAllUserInfo } from './controllers/sync-user-info'
+
+AuthProvider.register('google', {
+  type: 'google',
+  description: 'Authentication Provider for Google',
+  help: '',
+  parameterSpec: null,
+  async synchronizeUsers(authProvider: AuthProvider, context: ResolverContext): Promise<boolean> {
+    await syncAllUserInfo(authProvider, context)
+    return true
+  }
+})

package/server/middlewares/google-authenticate-middleware.ts

@@ -0,0 +1,78 @@
+import passport from 'koa-passport'
+import { Strategy as GoogleStrategy } from 'passport-google-oauth20'
+
+import { config } from '@things-factory/env'
+import { User } from '@things-factory/auth-base'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+if (SSOGoogleConfig) {
+  passport.use(
+    new GoogleStrategy(
+      {
+        ...SSOGoogleConfig,
+        scope: ['profile', 'https://www.googleapis.com/auth/userinfo.email']
+      },
+      async (token, tokenSecret, profile, done) => {
+        if (!profile) {
+          return done(new Error('No profile found'), null)
+        }
+
+        try {
+          const { emails, photos } = profile
+          const email = emails?.[0].value
+          const photo = photos?.[0].value
+
+          const user = await User.checkAuthWithEmail({ email })
+
+          const { id, userType, status } = user
+
+          return done(null, {
+            id,
+            userType,
+            status
+          })
+        } catch (error) {
+          return done(error)
+        }
+      }
+    )
+  )
+}
+
+export async function authGoogleMiddleware(context, next) {
+  const { path } = context
+  const { user } = context.state
+
+  if (user) {
+    return await next()
+  }
+
+  await passport.authenticate('google', {
+    failureRedirect: '/auth/signin',
+    successRedirect: '/auth/checkin'
+  })(context, next)
+}
+
+export async function googleSubscriptionMiddleware(context, next) {
+  const { path } = context
+  const { user } = context.state
+
+  if (user) {
+    return await next()
+  }
+
+  await passport.authenticate('google', {
+    failureRedirect: '/auth/signin',
+    successRedirect: '/auth/checkin'
+  })(context)
+
+  /* 다음은, websocket 에서 인증을 처리하기 위한 작업임. */
+  const passportObject = context.session?.passport
+  if (passportObject) {
+    const userEntity = await User.checkAuth(passportObject?.user)
+    context.state.user = userEntity
+  }
+
+  return await next()
+}

package/server/middlewares/index.ts

@@ -0,0 +1,13 @@
+import { config } from '@things-factory/env'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+import { googleSubscriptionMiddleware } from './google-authenticate-middleware'
+
+if (SSOGoogleConfig) {
+  process.on('bootstrap-module-subscription' as any, (app, subscriptionMiddleware) => {
+    subscriptionMiddleware.unshift(googleSubscriptionMiddleware)
+  })
+}
+
+export * from './google-authenticate-middleware'

package/server/router/auth-google-router.ts

@@ -0,0 +1,16 @@
+import Router from 'koa-router'
+
+import passport from 'koa-passport'
+import { authGoogleMiddleware } from '../middlewares'
+
+import { encryptState, decryptState } from '@things-factory/auth-base'
+
+export const authGoogleRouter = new Router()
+
+authGoogleRouter.get(
+  '/auth/callback-auth-google',
+  passport.authenticate('google', { failureRedirect: '/auth/signin', successRedirect: '/auth/checkin' }),
+  ctx => {
+    ctx.redirect('/auth/checkin')
+  }
+)

package/server/router/auth-google-webhook-router.ts

@@ -0,0 +1,97 @@
+import Router from 'koa-router'
+import fetch from 'node-fetch'
+
+import { getRepository, getDataSource } from '@things-factory/shell'
+
+import { updateUserInfo } from '../controllers/sync-user-info'
+import { getOauth2Client } from '../controllers/get-oauth2-client'
+import { AuthProvider } from '@things-factory/auth-base'
+
+export const authGoogleWebhookRouter = new Router()
+
+// Microsoft Graph에서 발송되는 알림을 처리하기 위한 타입 정의
+// TODO implement with google
+// interface Notification {
+//   resourceData: {
+//     id: string
+//   }
+// }
+
+authGoogleWebhookRouter.post('/webhook/google-users', async context => {
+  const notifications: Notification[] = context.request.body.value
+  const clientState = context.request.body.clientState
+  const [domainId, authProviderId] = clientState?.split(':') || []
+
+  if (!domainId || !authProviderId) {
+    context.status = 401 // unauthorized
+    context.body = 'Invalid ClientState'
+    return
+  }
+
+  await getDataSource('tx').transaction(async tx => {
+    const wrap = context.app.createContext(context.req || {}, context.res || {})
+
+    wrap.state = {
+      ...context.state,
+      domain: null,
+      tx
+    }
+    wrap.t = context.t
+
+    const authProvider = await tx.getRepository(AuthProvider).findOne({
+      where: {
+        domain: { id: domainId },
+        id: authProviderId
+      }
+    })
+
+    if (!authProvider) {
+      context.status = 401 // unauthorized
+      context.body = 'Invalid ClientState'
+      return
+    }
+
+    const oauth2Client = await getOauth2Client(authProvider)
+
+    // for (const notification of notifications) {
+    //   const userId = notification.resourceData.id
+
+    //   try {
+    //     const userResponse = await fetch(`https://graph.microsoft.com/v1.0/users/${userId}`, {
+    //       headers: {
+    //         Authorization: `Bearer ${accessToken}`
+    //       }
+    //     })
+
+    //     if (!userResponse.ok) {
+    //       throw new Error(`Failed to fetch user data: ${userResponse.statusText}`)
+    //     }
+
+    //     const userInfo = await userResponse.json()
+
+    //     // {
+    //     //   "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
+    //     //   "businessPhones": ["+1 412 555 0109"],
+    //     //   "displayName": "Megan Bowen",
+    //     //   "givenName": "Megan",
+    //     //   "jobTitle": "Auditor",
+    //     //   "mail": "MeganB@M365x214355.onmicrosoft.com",
+    //     //   "mobilePhone": "+1 412 555 0109",
+    //     //   "officeLocation": "12/1110",
+    //     //   "preferredLanguage": "en-US",
+    //     //   "surname": "Bowen",
+    //     //   "userPrincipalName": "MeganB@M365x214355.onmicrosoft.com",
+    //     //   "id": "48d31887-5fad-4d73-a9f5-3c356e68a038"
+    //     // }
+
+    //     // webhook 호출로부터 호출한 tenant를 알 수 있다면, 매핑된 도메인 정보를 포함할 수 있을 것 같은데..
+
+    //     await updateUserInfo(authProvider, userInfo, wrap)
+    //   } catch (error) {
+    //     console.error('Error fetching user data from Microsoft Graph:', error)
+    //   }
+    // }
+  })
+
+  context.status = 202
+})

package/server/router/index.ts

@@ -0,0 +1,2 @@
+export * from './auth-google-router'
+export * from './auth-google-webhook-router'

package/server/routes.ts

@@ -0,0 +1,28 @@
+import passport from 'koa-passport'
+import { config } from '@things-factory/env'
+import { setAccessTokenCookie } from '@things-factory/auth-base'
+
+const SSOGoogleConfig = config.get('sso/google/config')
+
+import { authGoogleMiddleware } from './middlewares'
+import { authGoogleRouter, authGoogleWebhookRouter } from './router'
+
+if (SSOGoogleConfig) {
+  process.on('bootstrap-collect-sso-middleware' as any, (_, ssoMiddlewares) => {
+    ssoMiddlewares.push(authGoogleMiddleware)
+  })
+
+  process.on('bootstrap-module-domain-public-route' as any, (app, domainPublicRouter) => {
+    domainPublicRouter.use(authGoogleRouter.routes(), authGoogleRouter.allowedMethods())
+    domainPublicRouter.use(authGoogleWebhookRouter.routes(), authGoogleWebhookRouter.allowedMethods())
+  })
+
+  process.on('bootstrap-module-global-public-route' as any, (app, globalPublicRouter) => {
+    globalPublicRouter.get(
+      '/auth/signin-with-google',
+      passport.authenticate('google', {
+        scope: ['profile', 'https://www.googleapis.com/auth/userinfo.email']
+      })
+    )
+  })
+}

package/server/service/auth-google/auth-google-mutation.ts

@@ -0,0 +1,24 @@
+import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'
+
+import { syncAllUserInfo } from '../../controllers/sync-user-info'
+
+@Resolver()
+export class AuthGoogleMutation {
+  // @Directive('@transaction')
+  // @Directive('@privilege(superUserGranted:true)')
+  // @Mutation(returns => Boolean, { description: 'To synchronize google users' })
+  // async synchronizeGoogleUsers(@Ctx() context: ResolverContext): Promise<boolean> {
+  //   syncAllUserInfo(context)
+
+  //   return true
+  // }
+
+  @Directive('@transaction')
+  @Directive('@privilege(superUserGranted:true)')
+  @Mutation(returns => Boolean, { description: 'To subscribe google users' })
+  async subscribeGoogleUsers(@Ctx() context: ResolverContext): Promise<boolean> {
+    const { domain, user, tx } = context.state
+
+    return true
+  }
+}

package/server/service/auth-google/index.ts

@@ -0,0 +1,3 @@
+import { AuthGoogleMutation } from './auth-google-mutation'
+
+export const resolvers = [AuthGoogleMutation]

package/server/service/index.ts

@@ -0,0 +1,19 @@
+/* EXPORT ENTITY TYPES */
+
+/* IMPORT ENTITIES AND RESOLVERS */
+import { resolvers as AuthGoogleResolvers } from './auth-google'
+
+export const entities = [
+  /* ENTITIES */
+]
+
+export const subscribers = [
+  /* SUBSCRIBERS */
+]
+
+export const schema = {
+  resolverClasses: [
+    /* RESOLVER CLASSES */
+    ...AuthGoogleResolvers
+  ]
+}

package/server/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig-base.json",
+  "compilerOptions": {
+    "strict": false,
+    "module": "commonjs",
+    "outDir": "../dist-server",
+    "baseUrl": "./"
+  },
+  "include": ["./**/*"]
+}