@verdaccio/auth 8.0.0-next-8.11 → 8.0.0-next-8.13

package/src/types.ts

@@ -1,46 +0,0 @@
-import { NextFunction, Request, Response } from 'express';
-
-import { VerdaccioError } from '@verdaccio/core';
-import { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
-
-export interface AESPayload {
-  user: string;
-  password: string;
-}
-
-export type BasicPayload = AESPayload | void;
-export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
-
-export interface AuthTokenHeader {
-  scheme: string;
-  token: string;
-}
-export type AllowActionCallbackResponse = boolean | undefined;
-export type AllowActionCallback = (
-  error: VerdaccioError | null,
-  allowed?: AllowActionCallbackResponse
-) => void;
-
-export type AllowAction = (
-  user: RemoteUser,
-  pkg: AuthPackageAllow,
-  callback: AllowActionCallback
-) => void;
-
-export interface TokenEncryption {
-  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
-  aesEncrypt(buf: string): string | void;
-}
-
-export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
-
-// remove
-export interface IAuthMiddleware {
-  apiJWTmiddleware(): $NextFunctionVer;
-  webUIJWTmiddleware(): $NextFunctionVer;
-}
-
-export type $RequestExtend = Request & { remote_user?: any; log: Logger };
-export type $ResponseExtend = Response & { cookies?: any };
-export type $NextFunctionVer = NextFunction & any;
-export { NextFunction };

package/src/utils.ts

@@ -1,252 +0,0 @@
-import buildDebug from 'debug';
-import _ from 'lodash';
-
-import { createAnonymousRemoteUser } from '@verdaccio/config';
-import {
-  API_ERROR,
-  HTTP_STATUS,
-  TOKEN_BASIC,
-  TOKEN_BEARER,
-  errorUtils,
-  pluginUtils,
-} from '@verdaccio/core';
-import {
-  aesDecrypt,
-  aesDecryptDeprecated,
-  parseBasicPayload,
-  verifyPayload,
-} from '@verdaccio/signature';
-import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
-
-import {
-  ActionsAllowed,
-  AllowAction,
-  AllowActionCallback,
-  AuthMiddlewarePayload,
-  AuthTokenHeader,
-  TokenEncryption,
-} from './types';
-
-const debug = buildDebug('verdaccio:auth:utils');
-
-/**
- * Split authentication header eg: Bearer [secret_token]
- * @param authorizationHeader auth token
- */
-export function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {
-  const parts = authorizationHeader.split(' ');
-  const [scheme, token] = parts;
-
-  return { scheme, token };
-}
-
-export function parseAESCredentials(authorizationHeader: string, secret: string) {
-  debug('parseAESCredentials init');
-  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
-
-  // basic is deprecated and should not be enforced
-  // basic is currently being used for functional test
-  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
-    debug('legacy header basic');
-    const credentials = convertPayloadToBase64(token).toString();
-
-    return credentials;
-  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
-    debug('legacy header bearer');
-    debug('secret length %o', secret.length);
-    const isLegacyUnsecure = secret.length > 32;
-    debug('is legacy unsecure %o', isLegacyUnsecure);
-    if (isLegacyUnsecure) {
-      debug('legacy unsecure enabled');
-      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');
-    } else {
-      debug('legacy secure enabled');
-      return aesDecrypt(token.toString(), secret);
-    }
-  }
-}
-
-export function getMiddlewareCredentials(
-  security: Security,
-  secretKey: string,
-  authorizationHeader: string
-): AuthMiddlewarePayload {
-  debug('getMiddlewareCredentials init');
-  // comment out for debugging purposes
-  if (isAESLegacy(security)) {
-    debug('is legacy');
-    const credentials = parseAESCredentials(authorizationHeader, secretKey);
-    if (!credentials) {
-      debug('parse legacy credentials failed');
-      return;
-    }
-
-    const parsedCredentials = parseBasicPayload(credentials);
-    if (!parsedCredentials) {
-      debug('parse legacy basic payload credentials failed');
-      return;
-    }
-
-    return parsedCredentials;
-  }
-  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
-
-  debug('is jwt');
-  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
-    return verifyJWTPayload(token, secretKey);
-  }
-}
-
-export function isAESLegacy(security: Security): boolean {
-  const { legacy, jwt } = security.api;
-
-  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;
-}
-
-export async function getApiToken(
-  auth: TokenEncryption,
-  config: Config,
-  remoteUser: RemoteUser,
-  aesPassword: string
-): Promise<string | void> {
-  debug('get api token');
-  const { security } = config;
-
-  if (isAESLegacy(security)) {
-    debug('security legacy enabled');
-    // fallback all goes to AES encryption
-    return await new Promise((resolve): void => {
-      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));
-    });
-  }
-  const { jwt } = security.api;
-
-  if (jwt?.sign) {
-    return await auth.jwtEncrypt(remoteUser, jwt.sign);
-  }
-  return await new Promise((resolve): void => {
-    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));
-  });
-}
-
-export const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];
-
-export function verifyJWTPayload(token: string, secret: string): RemoteUser {
-  try {
-    const payload: RemoteUser = verifyPayload(token, secret);
-
-    return payload;
-  } catch (error: any) {
-    // #168 this check should be removed as soon AES encrypt is removed.
-    if (expireReasons.includes(error.name)) {
-      // it might be possible the jwt configuration is enabled and
-      // old tokens fails still remains in usage, thus
-      // we return an anonymous user to force log in.
-      return createAnonymousRemoteUser();
-    }
-    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);
-  }
-}
-
-export function isAuthHeaderValid(authorization: string): boolean {
-  return authorization.split(' ').length === 2;
-}
-
-/**
- * Return a default configuration for authentication if none is provided.
- * @param logger {Logger}
- * @returns object of default implementations.
- */
-export function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {
-  return {
-    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {
-      debug('triggered default authenticate method');
-      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));
-    },
-
-    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {
-      debug('triggered default adduser method');
-      // since adduser is not implemented but optional, continue without error
-      // this assumes that the user is added by an external system
-      cb(null, true);
-    },
-
-    // @ts-ignore
-    allow_access: allow_action('access', logger),
-    // @ts-ignore
-    allow_publish: allow_action('publish', logger),
-    allow_unpublish: handleSpecialUnpublish(logger),
-  };
-}
-
-export function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {
-  return function allowActionCallback(
-    user: RemoteUser,
-    pkg: AuthPackageAllow,
-    callback: AllowActionCallback
-  ): void {
-    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);
-    const { name, groups } = user;
-    debug('allow_action "%s": groups %s', action, groups);
-    const groupAccess = pkg[action] as string[];
-    debug('allow_action "%s": groupAccess %s', action, groupAccess);
-    const hasPermission = groupAccess.some((group) => {
-      return name === group || groups.includes(group);
-    });
-    debug('package "%s" has permission "%s"', name, hasPermission);
-    logger.trace(
-      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },
-      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`
-    );
-
-    if (hasPermission) {
-      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);
-      return callback(null, true);
-    }
-
-    if (name) {
-      callback(
-        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)
-      );
-    } else {
-      callback(
-        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)
-      );
-    }
-  };
-}
-
-/**
- *
- */
-export function handleSpecialUnpublish(logger: Logger): any {
-  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {
-    const action = 'unpublish';
-    // verify whether the unpublish prop has been defined
-    const isUnpublishMissing: boolean = !pkg[action];
-    debug('is unpublish method missing ? %s', isUnpublishMissing);
-    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;
-    logger.trace(
-      { user: user.name, name: pkg.name, hasGroups },
-      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`
-    );
-
-    if (isUnpublishMissing || hasGroups === false) {
-      return callback(null, undefined);
-    }
-
-    logger.trace(
-      { user: user.name, name: pkg.name, action, hasGroups },
-      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`
-    );
-    return allow_action(action, logger)(user, pkg, callback);
-  };
-}
-
-export function buildUser(name: string, password: string): string {
-  return String(`${name}:${password}`);
-}
-
-export function convertPayloadToBase64(payload: string): Buffer {
-  return Buffer.from(payload, 'base64');
-}

package/test/auth-utils-middleware.spec.ts

@@ -1,260 +0,0 @@
-import _ from 'lodash';
-import path from 'path';
-import { describe, expect, test, vi } from 'vitest';
-
-import {
-  Config as AppConfig,
-  createAnonymousRemoteUser,
-  createRemoteUser,
-  parseConfigFile,
-} from '@verdaccio/config';
-import { getDefaultConfig } from '@verdaccio/config';
-import { TOKEN_BEARER } from '@verdaccio/core';
-import { logger, setup } from '@verdaccio/logger';
-import { signPayload } from '@verdaccio/signature';
-import { Config, RemoteUser, Security } from '@verdaccio/types';
-import { buildToken, buildUserBuffer } from '@verdaccio/utils';
-
-import { Auth, getApiToken, getMiddlewareCredentials, verifyJWTPayload } from '../src';
-
-setup({});
-
-const parseConfigurationFile = (conf) => {
-  const { name, ext } = path.parse(conf);
-  const format = ext.startsWith('.') ? ext.substring(1) : 'yaml';
-
-  return path.join(__dirname, `./partials/config/${format}/security/${name}.${format}`);
-};
-
-describe('Auth utilities', () => {
-  vi.setConfig({ testTimeout: 20000 });
-
-  const parseConfigurationSecurityFile = (name) => {
-    return parseConfigurationFile(`security/${name}`);
-  };
-
-  function getConfig(configFileName: string, secret: string) {
-    const conf = parseConfigFile(parseConfigurationSecurityFile(configFileName));
-    // @ts-ignore
-    const secConf = _.merge(getDefaultConfig(), conf);
-    secConf.secret = secret;
-    const config: Config = new AppConfig(secConf);
-
-    return config;
-  }
-
-  async function getTokenByConfiguration(
-    configFileName: string,
-    username: string,
-    password: string,
-    secret = '12345',
-    methodToSpy: string,
-    methodNotBeenCalled: string
-  ): Promise<string> {
-    const config: Config = getConfig(configFileName, secret);
-    const auth: Auth = new Auth(config, logger);
-    await auth.init();
-    // @ts-ignore
-    const spy = vi.spyOn(auth, methodToSpy);
-    // @ts-ignore
-    const spyNotCalled = vi.spyOn(auth, methodNotBeenCalled);
-    const user: RemoteUser = {
-      name: username,
-      real_groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
-      groups: ['company-role1', 'company-role2'],
-    };
-    const token = await getApiToken(auth, config, user, password);
-    expect(spy).toHaveBeenCalled();
-    expect(spy).toHaveBeenCalledTimes(1);
-    expect(spyNotCalled).not.toHaveBeenCalled();
-    expect(token).toBeDefined();
-
-    return token as string;
-  }
-
-  describe('getMiddlewareCredentials test', () => {
-    describe('should get AES credentials', () => {
-      test.concurrent('should unpack aes token and credentials bearer auth', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const user = 'test';
-        const pass = 'test';
-        const token = await getTokenByConfiguration(
-          'security-legacy',
-          user,
-          pass,
-          secret,
-          'aesEncrypt',
-          'jwtEncrypt'
-        );
-        const config: Config = getConfig('security-legacy', secret);
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(security, secret, `Bearer ${token}`);
-        expect(credentials).toBeDefined();
-        // @ts-ignore
-        expect(credentials.user).toEqual(user);
-        // @ts-ignore
-        expect(credentials.password).toEqual(pass);
-      });
-
-      test.concurrent('should unpack aes token and credentials basic auth', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const user = 'test';
-        const pass = 'test';
-        // basic authentication need send user as base64
-        const token = buildUserBuffer(user, pass).toString('base64');
-        const config: Config = getConfig('security-legacy', secret);
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(security, secret, `Basic ${token}`);
-        expect(credentials).toBeDefined();
-        // @ts-ignore
-        expect(credentials.user).toEqual(user);
-        // @ts-ignore
-        expect(credentials.password).toEqual(pass);
-      });
-
-      test.concurrent('should return empty credential wrong secret key', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const token = await getTokenByConfiguration(
-          'security-legacy',
-          'test',
-          'test',
-          secret,
-          'aesEncrypt',
-          'jwtEncrypt'
-        );
-        const config: Config = getConfig('security-legacy', secret);
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          'b2df428b9929d3ace7c598bbf4e496_BAD_TOKEN',
-          buildToken(TOKEN_BEARER, token)
-        );
-        expect(credentials).not.toBeDefined();
-      });
-
-      test.concurrent('should return empty credential wrong scheme', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const token = await getTokenByConfiguration(
-          'security-legacy',
-          'test',
-          'test',
-          secret,
-          'aesEncrypt',
-          'jwtEncrypt'
-        );
-        const config: Config = getConfig('security-legacy', secret);
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          secret,
-          buildToken('BAD_SCHEME', token)
-        );
-        expect(credentials).not.toBeDefined();
-      });
-
-      test.concurrent('should return empty credential corrupted payload', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const config: Config = getConfig('security-legacy', secret);
-        const auth: Auth = new Auth(config, logger);
-        await auth.init();
-        // @ts-expect-error
-        const token = auth.aesEncrypt(null);
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          secret,
-          buildToken(TOKEN_BEARER, token as string)
-        );
-        expect(credentials).not.toBeDefined();
-      });
-    });
-
-    describe('verifyJWTPayload', () => {
-      test('should fail on verify the token and return anonymous users', () => {
-        expect(verifyJWTPayload('fakeToken', 'b2df428b9929d3ace7c598bbf4e496b2')).toEqual(
-          createAnonymousRemoteUser()
-        );
-      });
-
-      test('should verify the token and return a remote user', async () => {
-        const remoteUser = createRemoteUser('foo', []);
-        const token = await signPayload(remoteUser, '12345');
-        const verifiedToken = verifyJWTPayload(token, '12345');
-        expect(verifiedToken.groups).toEqual(remoteUser.groups);
-        expect(verifiedToken.name).toEqual(remoteUser.name);
-      });
-    });
-
-    describe('should get JWT credentials', () => {
-      test('should return anonymous whether token is corrupted', () => {
-        const config: Config = getConfig('security-jwt', '12345');
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          '12345',
-          buildToken(TOKEN_BEARER, 'fakeToken')
-        ) as RemoteUser;
-
-        expect(credentials).toBeDefined();
-        expect(credentials.name).not.toBeDefined();
-        expect(credentials.real_groups).toBeDefined();
-
-        expect(credentials.groups).toEqual(['$all', '$anonymous', '@all', '@anonymous']);
-      });
-
-      test('should return anonymous whether token and scheme are corrupted', () => {
-        const config: Config = getConfig('security-jwt', '12345');
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          '12345',
-          buildToken('FakeScheme', 'fakeToken')
-        );
-
-        expect(credentials).not.toBeDefined();
-      });
-
-      test('should verify successfully a JWT token', async () => {
-        const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
-        const user = 'test';
-        const config: Config = getConfig('security-jwt', secret);
-        const token = await getTokenByConfiguration(
-          'security-jwt',
-          user,
-          'secretTest',
-          secret,
-          'jwtEncrypt',
-          'aesEncrypt'
-        );
-        const security: Security = config.security;
-        const credentials = getMiddlewareCredentials(
-          security,
-          secret,
-          buildToken(TOKEN_BEARER, token)
-        ) as RemoteUser;
-        expect(credentials).toBeDefined();
-
-        expect(credentials.name).toEqual(user);
-        expect(credentials.real_groups).toBeDefined();
-        expect(credentials.real_groups).toEqual([
-          'test',
-          '$all',
-          '$authenticated',
-          '@all',
-          '@authenticated',
-          'all',
-        ]);
-        expect(credentials.groups).toEqual([
-          'company-role1',
-          'company-role2',
-          'test',
-          '$all',
-          '$authenticated',
-          '@all',
-          '@authenticated',
-          'all',
-        ]);
-      });
-    });
-  });
-});