ldap-authentication 3.2.1 → 3.2.4

package/.devcontainer/docker-compose.yml

@@ -18,3 +18,4 @@ services:
       - LDAP_ADMIN_PASSWORD=password
       - LDAP_USERS=gauss,einstein
       - LDAP_PASSWORDS=password,password
+      - LDAP_GROUP=科学A部

package/.github/workflows/integration-test.yml

@@ -27,7 +27,7 @@ jobs:
         run: sudo apt-get install -y ldap-utils
 
       - name: Start containers
-        run: docker-compose -f "docker-compose.yml" up -d
+        run: docker compose -f "docker-compose.yml" up -d
 
       - name: Wait for LDAP server to become available
         uses: nick-fields/retry@v2
@@ -51,4 +51,4 @@ jobs:
 
       - name: Stop containers
         if: always()
-        run: docker-compose -f "docker-compose.yml" down
+        run: docker compose -f "docker-compose.yml" down

package/.github/workflows/npm-publish.yml

@@ -0,0 +1,33 @@
+# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+
+name: Publish to NPM
+
+on:
+  release:
+    types: [created]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm ci
+
+
+  publish-npm:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org/
+      - run: npm ci
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.npm_token}}

package/README.md

@@ -187,7 +187,7 @@ In version 2, The user object has a `raw` field that has the raw data from the L
 Buffer data can now be accessed by `user.raw.profilePhoto`, etc, instead of `user.profilePhoto`.
 
 In version 3, the `raw` field is no longer used. Instead, append `;binary` to the attributes you
-want to get back as buffer. Check the following example on how to get a user's profile photo:
+want to get back as base64-encoded string. Check the following example on how to get a user's profile photo:
 
 ```javascript
 export async function verifyLogin(email: string, password: string) {
@@ -210,7 +210,7 @@ export async function verifyLogin(email: string, password: string) {
     const profilePhoto = ldapUser['thumbnailPhoto;binary'];
 
     /* using the image
-	<img src={`data:image/*;base64,${user.profilePhoto}`} />
+	<img src={`data:image/*;base64,${profilePhoto}`} />
     */
     return { user: ldapUser };
   }

package/docker-compose.yml

@@ -10,3 +10,4 @@ services:
       - LDAP_ADMIN_PASSWORD=password
       - LDAP_USERS=gauss,einstein
       - LDAP_PASSWORDS=password,password
+      - LDAP_GROUP=科学A部

package/index.js

@@ -1,6 +1,46 @@
 const assert = require('assert')
 const ldap = require('ldapjs')
 
+// convert an escaped utf8 string returned from ldapjs
+function _isHex(c) {
+  return (
+    (c >= '0' && c <= '9') || (c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F')
+  )
+}
+function _parseEscapedHexToUtf8(s) {
+  // convert 'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
+  // to 'cn=研发A部,ou=users,dc=example,dc=com'
+  let ret = Buffer.alloc(0)
+  let len = s.length
+  for (let i = 0; i < len; i++) {
+    let c = s[i]
+    let item
+    if (c == '\\' && i < len - 2 && _isHex(s[i + 1]) && _isHex(s[i + 2])) {
+      item = Buffer.from(s.substring(i + 1, i + 3), 'hex')
+      i += 2
+    } else {
+      item = Buffer.from(c)
+    }
+    ret = Buffer.concat([ret, item])
+  }
+  return ret.toString()
+}
+
+function _recursiveParseHexString(obj) {
+  if (Array.isArray(obj)) {
+    return obj.map((ele) => _recursiveParseHexString(ele))
+  }
+  if (typeof obj == 'string') {
+    return _parseEscapedHexToUtf8(obj)
+  }
+  if (typeof obj == 'object') {
+    for (let key in obj) {
+      obj[key] = _recursiveParseHexString(obj[key])
+    }
+    return obj
+  }
+  return obj
+}
 // convert a SearchResultEntry object in ldapjs 3.0
 // to a user object to maintain backward compatibility
 
@@ -11,7 +51,7 @@ function _searchResultToUser(pojo) {
     user[attribute.type] =
       attribute.values.length == 1 ? attribute.values[0] : attribute.values
   })
-  return user
+  return _recursiveParseHexString(user)
 }
 // bind and return the ldap client
 function _ldapBind(dn, password, starttls, ldapOpts) {
@@ -142,7 +182,7 @@ async function _searchUserGroups(
           return
         }
         res.on('searchEntry', function (entry) {
-          groups.push(entry.pojo)
+          groups.push(_recursiveParseHexString(entry.pojo))
         })
         res.on('searchReference', function (referral) {})
         res.on('error', function (err) {
@@ -366,7 +406,8 @@ async function authenticate(options) {
       options.groupsSearchBase,
       options.groupClass,
       options.groupMemberAttribute,
-      options.groupMemberUserAttribute
+      options.groupMemberUserAttribute,
+      options.attributes
     )
   }
   assert(options.userPassword, 'userPassword must be provided')
@@ -422,3 +463,9 @@ class LdapAuthenticationError extends Error {
 
 module.exports.authenticate = authenticate
 module.exports.LdapAuthenticationError = LdapAuthenticationError
+
+module.exports.exportForTesting = {
+  _isHex,
+  _parseEscapedHexToUtf8,
+  _recursiveParseHexString,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-authentication",
-  "version": "3.2.1",
+  "version": "3.2.4",
   "description": "A simple async nodejs library for LDAP user authentication",
   "main": "index.js",
   "types": "./index.d.ts",
@@ -39,6 +39,6 @@
     "ldapjs": "^3.0.7"
   },
   "devDependencies": {
-    "jasmine": "^5.1.0"
+    "jasmine": "^5.3.0"
   }
 }

package/test/string.spec.js

@@ -0,0 +1,43 @@
+const { exportForTesting } = require('../index.js')
+const { _isHex, _parseEscapedHexToUtf8, _recursiveParseHexString } =
+  exportForTesting
+
+describe('string conversion test', () => {
+  it('unescape string test', () => {
+    let s =
+      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=研发A部,ou=users,dc=example,dc=com')
+  })
+  it('unescape string test2', () => {
+    let s =
+      'cn=\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=研发A部©,ou=users,dc=example,dc=com')
+  })
+  it('unescape string test3', () => {
+    let s = 'cn=ABC,ou=users,dc=example,dc=com'
+    let us = _parseEscapedHexToUtf8(s)
+    expect(us).toEqual('cn=ABC,ou=users,dc=example,dc=com')
+  })
+  it('convert obj', () => {
+    let target = {
+      a: ['研发A部©', 'abc'],
+      b: 'xyz',
+      c: true,
+      d: null,
+      e: '研发A部©',
+      f: 1000,
+    }
+    let obj = {
+      a: ['\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9', 'abc'],
+      b: 'xyz',
+      c: true,
+      d: null,
+      e: '\\e7\\a0\\94\\e5\\8f\\91A\\e9\\83\\a8\\c2\\a9',
+      f: 1000,
+    }
+    let converted = _recursiveParseHexString(obj)
+    expect(converted).toEqual(target)
+  })
+})

package/test/test.spec.js

@@ -20,6 +20,26 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
   })
+  it('Use an admin user to check if user exists and return attributes', async () => {
+    let options = {
+      ldapOpts: {
+        url: url,
+      },
+      adminDn: 'cn=read-only-admin,dc=example,dc=com',
+      adminPassword: 'password',
+      verifyUserExists: true,
+      userSearchBase: 'dc=example,dc=com',
+      usernameAttribute: 'uid',
+      username: 'gauss',
+      attributes: ['uid', 'sn'],
+    }
+
+    let user = await authenticate(options)
+    expect(user).toBeTruthy()
+    expect(user.uid).toEqual('gauss')
+    expect(user.sn).toEqual('Bar1')
+    expect(user.cn).toBeUndefined()
+  })
   it('Use an admin user to authenticate a regular user', async () => {
     let options = {
       ldapOpts: {
@@ -37,7 +57,7 @@ describe('ldap-authentication test', () => {
     expect(user).toBeTruthy()
     expect(user.uid).toEqual('gauss')
   })
-  it('Use an admin user to authenticate a regular user and return attrubutes', async () => {
+  it('Use an admin user to authenticate a regular user and return attributes', async () => {
     let options = {
       ldapOpts: {
         url: url,
@@ -124,6 +144,9 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].objectName).toEqual(
+      'cn=科学A部,ou=users,dc=example,dc=com'
+    )
   })
   it('Use regular user to authenticate and fetch user group information', async () => {
     let options = {
@@ -144,6 +167,9 @@ describe('ldap-authentication test', () => {
     let user = await authenticate(options)
     expect(user).toBeTruthy()
     expect(user.groups.length).toBeGreaterThan(0)
+    expect(user.groups[0].objectName).toEqual(
+      'cn=科学A部,ou=users,dc=example,dc=com'
+    )
   })
   it('Not specifying groupMemberAttribute or groupMemberUserAttribute should not cause an error and fallback to default values', async () => {
     let options = {