@tsed/passport 8.44.0 → 8.44.1

package/lib/esm/index.js

@@ -20,3 +20,4 @@ export * from "./PassportModule.js";
 export * from "./services/PassportSerializerService.js";
 export * from "./services/ProtocolsService.js";
 export * from "./utils/getProtocolsFromRequest.js";
+export * from "./utils/sessionProtocol.js";

package/lib/esm/middlewares/PassportMiddleware.js

@@ -1,29 +1,58 @@
 var PassportMiddleware_1;
 import { __decorate, __metadata, __param } from "tslib";
+import { isArray } from "@tsed/core";
 import { Context } from "@tsed/platform-params";
 import { Inject } from "@tsed/di";
 import { Middleware } from "@tsed/platform-middlewares";
 import { ProtocolsService } from "../services/ProtocolsService.js";
 import { getProtocolsFromRequest } from "../utils/getProtocolsFromRequest.js";
+import { getSessionProtocol, hasLoginSession } from "../utils/sessionProtocol.js";
+/**
+ * Reserved protocol name satisfied by an existing login session. It never runs a Passport strategy.
+ */
+export const SESSION_PROTOCOL = "session";
 let PassportMiddleware = PassportMiddleware_1 = class PassportMiddleware {
-    shouldSkip(ctx) {
+    /**
+     * Return true when an existing login session satisfies the protocols declared on the endpoint:
+     *
+     * - the endpoint accepts any protocol (`"*"`),
+     * - the endpoint accepts the reserved `"session"` protocol and the request carries a persisted login session,
+     * - or the persisted login session was established by one of the endpoint protocols.
+     *
+     * A session established by another protocol never satisfies the endpoint: its strategies run instead.
+     */
+    shouldSkip(protocol, protocols, ctx) {
         const request = ctx.getRequest();
-        return request.user && request.isAuthenticated();
+        if (!(request.user && request.isAuthenticated?.())) {
+            return false;
+        }
+        const acceptsAny = isArray(protocol) ? protocol.includes("*") : protocol === "*";
+        if (acceptsAny) {
+            return true;
+        }
+        // The session rules require a persisted login session, not only a user set by a stateless strategy.
+        if (!hasLoginSession(request)) {
+            return false;
+        }
+        const sessionProtocol = getSessionProtocol(request);
+        return protocols.includes(SESSION_PROTOCOL) || (!!sessionProtocol && protocols.includes(sessionProtocol));
     }
     async use(ctx) {
         const endpoint = ctx.endpoint;
         const request = ctx.getRequest();
-        if (this.shouldSkip(ctx)) {
-            return;
-        }
         const { options, protocol, method, originalUrl = true } = endpoint.store.get(PassportMiddleware_1);
         const protocols = getProtocolsFromRequest(request, protocol, this.protocolsService.getProtocolsNames());
+        if (this.shouldSkip(protocol, protocols, ctx)) {
+            return;
+        }
+        // The session protocol has been checked above: it never runs a Passport strategy.
+        const strategies = protocols.filter((name) => name !== SESSION_PROTOCOL);
         if (originalUrl) {
             request.url = request.originalUrl;
         }
         await (method === "authenticate"
-            ? this.protocolsService.authenticate(protocols, options, ctx)
-            : this.protocolsService.authorize(protocols, options, ctx));
+            ? this.protocolsService.authenticate(strategies, options, ctx)
+            : this.protocolsService.authorize(strategies, options, ctx));
     }
 };
 __decorate([

package/lib/esm/services/ProtocolsService.js

@@ -7,12 +7,19 @@ import { PassportMessage } from "../errors/PassportMessage.js";
 import { Unauthorized } from "@tsed/exceptions";
 import { ancestorsOf } from "@tsed/core";
 import { promisify } from "node:util";
+import { setSessionProtocol } from "../utils/sessionProtocol.js";
+/**
+ * Context key holding the name of the protocol whose verify callback accepted the request.
+ * @ignore
+ */
+const VERIFIED_PROTOCOL = "PASSPORT_VERIFIED_PROTOCOL";
 /**
  * @ignore
  */
 export class ProtocolsService {
     constructor() {
         this.strategies = new Map();
+        this.loginOnlyProtocols = new Set();
         this.platformHandler = inject(PlatformHandler);
     }
     getProtocols() {
@@ -21,18 +28,31 @@ export class ProtocolsService {
     getProtocolsNames() {
         return Array.from(this.strategies.keys());
     }
+    /**
+     * Return true when the protocol must only run on login endpoints (`@Authenticate()`).
+     * @param name
+     */
+    isLoginOnly(name) {
+        return this.loginOnlyProtocols.has(name);
+    }
     /**
      * Invoke provider and bind it to passport.
      * @param provider
      */
     async invoke(provider) {
-        let { name, useStrategy: strategy, settings } = this.getOptions(provider);
+        let { name, useStrategy: strategy, settings, loginOnly } = this.getOptions(provider);
         const protocol = inject(provider.token);
         if (protocol.$beforeInstall) {
             settings = (await protocol.$beforeInstall(settings)) || settings;
         }
         const instance = new strategy(settings, this.createHandler(provider));
         this.strategies.set(name, instance);
+        if (loginOnly) {
+            this.loginOnlyProtocols.add(name);
+        }
+        else {
+            this.loginOnlyProtocols.delete(name);
+        }
         Passport.use(name, instance);
         if (protocol.$onInstall) {
             await protocol.$onInstall(instance);
@@ -56,7 +76,9 @@ export class ProtocolsService {
      * @param ctx
      */
     authorize(protocols, options, ctx) {
-        return this.call("authorize", protocols, options, ctx);
+        // Login-only protocols never run on a guarded route: they are accepted through their session only.
+        const strategies = [].concat(protocols).filter((name) => !this.isLoginOnly(name));
+        return this.call("authorize", strategies, options, ctx);
     }
     /**
      * Call passport authenticate or authorize depending on the chosen method.
@@ -73,6 +95,7 @@ export class ProtocolsService {
         if (protocols.length === 0) {
             throw new Unauthorized("Not authorized");
         }
+        const restoreLogIn = method === "authenticate" ? this.recordSessionProtocol(protocols, ctx) : undefined;
         try {
             options.failWithError = true;
             // @ts-ignore
@@ -85,6 +108,41 @@ export class ProtocolsService {
             }
             throw er;
         }
+        finally {
+            restoreLogIn?.();
+        }
+    }
+    /**
+     * Wrap `req.logIn()` for the running `@Authenticate()` call to record the protocol that establishes the
+     * login session. The record is written in the `req.logIn()` callback, once Passport.js has finished updating
+     * the session (`keepSessionInfo` merge, Passport.js 0.4 session object replacement) and before it ends the
+     * request itself (`successRedirect`).
+     *
+     * Return a function restoring the original `req.logIn()`.
+     */
+    recordSessionProtocol(protocols, ctx) {
+        const request = ctx.getRequest();
+        const logIn = request.logIn;
+        if (typeof logIn !== "function") {
+            return;
+        }
+        request.login = request.logIn = function (user, options, done) {
+            if (typeof options === "function") {
+                done = options;
+                options = {};
+            }
+            return logIn.call(this, user, options, (err) => {
+                const verified = ctx.get(VERIFIED_PROTOCOL);
+                const protocol = protocols.includes(verified) ? verified : protocols.length === 1 ? protocols[0] : undefined;
+                if (!err && options?.session !== false && protocol) {
+                    setSessionProtocol(this, protocol);
+                }
+                done?.(err);
+            });
+        };
+        return () => {
+            request.login = request.logIn = logIn;
+        };
     }
     /**
      * Create strategy options based on decorator metadata and global configuration
@@ -92,11 +150,12 @@ export class ProtocolsService {
      * @private
      */
     getOptions(provider) {
-        const { name } = provider.store.get("protocol");
-        const { useStrategy = Strategy, settings = {} } = constant(`passport.protocols.${name}`) || {};
+        const { name, ...metadata } = provider.store.get("protocol");
+        const { useStrategy = Strategy, settings = {}, loginOnly = metadata.loginOnly ?? false } = constant(`passport.protocols.${name}`) ?? {};
         return {
             name,
             useStrategy,
+            loginOnly,
             settings: {
                 ...settings,
                 passReqToCallback: true
@@ -110,13 +169,18 @@ export class ProtocolsService {
      */
     createHandler(provider) {
         const middleware = this.platformHandler.createCustomHandler(provider, "$onVerify");
+        const { name } = provider.store.get("protocol");
         return async (req, ...args) => {
             const done = args[args.length - 1];
             if (req.$ctx) {
                 req.$ctx.set("PROTOCOL_ARGS", args.slice(0, -1));
                 try {
                     await middleware(req.$ctx);
-                    done(null, ...[].concat(req.$ctx.data));
+                    const results = [].concat(req.$ctx.data);
+                    if (results[0]) {
+                        req.$ctx.set(VERIFIED_PROTOCOL, name);
+                    }
+                    done(null, ...results);
                 }
                 catch (err) {
                     const error = err;

package/lib/esm/utils/sessionProtocol.js

@@ -0,0 +1,31 @@
+/**
+ * Session key used by Passport.js to store the login state (`req.session.passport.user`).
+ * @ignore
+ */
+const PASSPORT_SESSION_KEY = "passport";
+/**
+ * Return true when the request carries a login session persisted by Passport.js. `req.isAuthenticated()` is not
+ * enough: a stateless strategy (`session: false`) sets `req.user` without any session.
+ * @ignore
+ */
+export function hasLoginSession(req) {
+    return req.session?.[PASSPORT_SESSION_KEY]?.user !== undefined;
+}
+/**
+ * Return the name of the protocol that established the current login session.
+ * @ignore
+ */
+export function getSessionProtocol(req) {
+    return req.session?.[PASSPORT_SESSION_KEY]?.protocol;
+}
+/**
+ * Record the protocol that established the current login session, next to the user stored by Passport.js.
+ * The record is dropped with the login state on `req.logout()`.
+ * @ignore
+ */
+export function setSessionProtocol(req, protocol) {
+    const state = req.session?.[PASSPORT_SESSION_KEY];
+    if (state && state.user !== undefined) {
+        state.protocol = protocol;
+    }
+}

package/lib/types/index.d.ts

@@ -20,3 +20,4 @@ export * from "./PassportModule.js";
 export * from "./services/PassportSerializerService.js";
 export * from "./services/ProtocolsService.js";
 export * from "./utils/getProtocolsFromRequest.js";
+export * from "./utils/sessionProtocol.js";

package/lib/types/interfaces/ProtocolOptions.d.ts

@@ -4,4 +4,14 @@ export interface ProtocolOptions<Settings = any> {
     name: string;
     useStrategy: Type<Strategy>;
     settings: Settings;
+    /**
+     * Run the strategy only on login endpoints decorated with `@Authenticate()`.
+     *
+     * A route decorated with `@Authorize()` then accepts this protocol only through the session it established,
+     * and never runs the strategy itself. Use it for interactive login strategies (`passport-local`, OAuth, ...)
+     * so that credentials sent to a business route do not open a new login flow.
+     *
+     * @default false
+     */
+    loginOnly?: boolean;
 }

package/lib/types/middlewares/PassportMiddleware.d.ts

@@ -1,7 +1,20 @@
 import { Context } from "@tsed/platform-params";
 import { ProtocolsService } from "../services/ProtocolsService.js";
+/**
+ * Reserved protocol name satisfied by an existing login session. It never runs a Passport strategy.
+ */
+export declare const SESSION_PROTOCOL = "session";
 export declare class PassportMiddleware {
     protocolsService: ProtocolsService;
-    shouldSkip(ctx: Context): any;
+    /**
+     * Return true when an existing login session satisfies the protocols declared on the endpoint:
+     *
+     * - the endpoint accepts any protocol (`"*"`),
+     * - the endpoint accepts the reserved `"session"` protocol and the request carries a persisted login session,
+     * - or the persisted login session was established by one of the endpoint protocols.
+     *
+     * A session established by another protocol never satisfies the endpoint: its strategies run instead.
+     */
+    shouldSkip(protocol: string | string[], protocols: string[], ctx: Context): boolean;
     use(ctx: Context): Promise<void>;
 }

package/lib/types/services/ProtocolsService.d.ts

@@ -7,9 +7,15 @@ import type { ProtocolMethods } from "../interfaces/ProtocolMethods.js";
  */
 export declare class ProtocolsService {
     readonly strategies: Map<string, Strategy>;
+    readonly loginOnlyProtocols: Set<string>;
     protected platformHandler: PlatformHandler;
     getProtocols(): Provider[];
     getProtocolsNames(): string[];
+    /**
+     * Return true when the protocol must only run on login endpoints (`@Authenticate()`).
+     * @param name
+     */
+    isLoginOnly(name: string): boolean;
     /**
      * Invoke provider and bind it to passport.
      * @param provider
@@ -38,6 +44,15 @@ export declare class ProtocolsService {
      * @private
      */
     private call;
+    /**
+     * Wrap `req.logIn()` for the running `@Authenticate()` call to record the protocol that establishes the
+     * login session. The record is written in the `req.logIn()` callback, once Passport.js has finished updating
+     * the session (`keepSessionInfo` merge, Passport.js 0.4 session object replacement) and before it ends the
+     * request itself (`successRedirect`).
+     *
+     * Return a function restoring the original `req.logIn()`.
+     */
+    private recordSessionProtocol;
     /**
      * Create strategy options based on decorator metadata and global configuration
      * @param provider

package/lib/types/utils/sessionProtocol.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Return true when the request carries a login session persisted by Passport.js. `req.isAuthenticated()` is not
+ * enough: a stateless strategy (`session: false`) sets `req.user` without any session.
+ * @ignore
+ */
+export declare function hasLoginSession(req: any): boolean;
+/**
+ * Return the name of the protocol that established the current login session.
+ * @ignore
+ */
+export declare function getSessionProtocol(req: any): string | undefined;
+/**
+ * Record the protocol that established the current login session, next to the user stored by Passport.js.
+ * The record is dropped with the login state on `req.logout()`.
+ * @ignore
+ */
+export declare function setSessionProtocol(req: any, protocol: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsed/passport",
-  "version": "8.44.0",
+  "version": "8.44.1",
   "description": "Passport package for Ts.ED framework",
   "source": "./src/index.ts",
   "type": "module",
@@ -28,12 +28,12 @@
     "tslib": ">=2.7.0"
   },
   "devDependencies": {
-    "@tsed/barrels": "8.44.0",
-    "@tsed/core": "8.44.0",
-    "@tsed/di": "8.44.0",
-    "@tsed/platform-http": "8.44.0",
-    "@tsed/platform-router": "8.44.0",
-    "@tsed/typescript": "8.44.0",
+    "@tsed/barrels": "8.44.1",
+    "@tsed/core": "8.44.1",
+    "@tsed/di": "8.44.1",
+    "@tsed/platform-http": "8.44.1",
+    "@tsed/platform-router": "8.44.1",
+    "@tsed/typescript": "8.44.1",
     "@types/passport": "1.0.16",
     "@types/passport-http": "0.3.11",
     "@types/passport-local": "1.0.38",