nodebb-plugin-session-sharing 4.7.1 → 5.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "4.7.1",
+  "version": "5.1.0",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {
@@ -39,7 +39,7 @@
     "@commitlint/cli": "^9.1.2",
     "async": "^2",
     "eslint": "^7.7.0",
-    "jsonwebtoken": "5.5.4",
+    "jsonwebtoken": "^8.5.1",
     "lint-staged": "^10.0.9",
     "lodash": "^4.17.14"
   },
@@ -50,6 +50,8 @@
     "eslint-config-airbnb-base": "^12.1.0",
     "eslint-plugin-import": "^2.8.0",
     "husky": "^2.4.0",
-    "lint-staged": "^10.0.9"
+    "lint-staged": "^10.0.9",
+    "request": "^2.88.2",
+    "request-promise-native": "^1.0.9"
   }
 }

package/plugin.json

@@ -3,13 +3,14 @@
 	"url": "https://github.com/NodeBB/nodebb-plugin-session-sharing",
 	"library": "./library.js",
 	"hooks": [
-		{ "hook": "filter:router.page", "method": "addMiddleware" },
+		{ "hook": "response:router.page", "method": "addMiddleware" },
 		{ "hook": "static:app.load", "method": "init" },
 		{ "hook": "filter:admin.header.build", "method": "addAdminNavigation" },
 		{ "hook": "static:user.loggedOut", "method": "cleanup" },
 		{ "hook": "filter:config.get", "method": "appendConfig" },
 		{ "hook": "filter:middleware.render", "method": "appendTemplate" },
-		{ "hook": "action:settings.set", "method": "reloadSettings" }
+		{ "hook": "action:settings.set", "method": "reloadSettings" },
+		{ "hook": "action:login.continue", "method": "saveReverseToken" }
 	],
 	"less": [
 		"static/style.less"

package/static/lib/admin.js

@@ -34,35 +34,37 @@ define('admin/plugins/session-sharing', ['settings'], function (Settings) {
 
 		ACP._searchDelay = setTimeout(function () {
 			delete ACP._searchDelay;
-
-			socket.emit('admin.user.search', {
+			
+			var qs = decodeURIComponent($.param({
 				query: element.val(),
-			}, function (err, results) {
-				var resultEl = $('#result');
-
-				if (err) {
-					return resultEl.text('We encountered an error while servicing this request:' + err.message);
-				}
-
-				if (results.users.length) {
-					socket.emit('plugins.sessionSharing.showUserIds', {
-						uids: results.users.map(function (user) {
-							return user.uid;
-						}),
-					}, function (err, remoteIds) {
-						if (err) {
-							resultEl.text('We encountered an error while servicing this request:' + err.message);
-						} else {
-							resultEl.empty();
-							results.users.forEach(function (userObj, idx) {
-								resultEl.append('<p>Username: ' + userObj.username + '<br />NodeBB uid: ' + userObj.uid + '<br />Remote id: ' + (remoteIds[idx] || '<em>Not Found</em>'));
-							});
-						}
-					});
-				} else {
-					resultEl.text('No users matched your query');
-				}
-			});
+			}));
+			
+			$.get(config.relative_path + '/api/admin/manage/users?' + qs)
+				.then(function (results) {
+					var resultEl = $('#result');
+
+					if (results.users.length) {
+						socket.emit('plugins.sessionSharing.showUserIds', {
+							uids: results.users.map(function (user) {
+								return user.uid;
+							}),
+						}, function (err, remoteIds) {
+							if (err) {
+								resultEl.text('We encountered an error while servicing this request:' + err.message);
+							} else {
+								resultEl.empty();
+								results.users.forEach(function (userObj, idx) {
+									resultEl.append('<p>Username: ' + userObj.username + '<br />NodeBB uid: ' + userObj.uid + '<br />Remote id: ' + (remoteIds[idx] || '<em>Not Found</em>'));
+								});
+							}
+						});
+					} else {
+						resultEl.text('No users matched your query');
+					}
+				})
+				.fail(function (err) {
+					$('#result').text('We encountered an error while servicing this request:' + err.message);
+				});
 		}, 500);
 	};
 

package/static/templates/admin/plugins/session-sharing.tpl

@@ -46,6 +46,7 @@
 						<select class="form-control" name="behaviour" id="behaviour">
 							<option value="trust">"Trust" &rarr; Shared cookie token used once only to authenticate, session persists even if cookie cleared</option>
 							<option value="revalidate">"Revalidate" &rarr; Shared cookie is checked on every page load, and updated/logged out to reflect changes in cookie</option>
+							<option value="update">"Update" &rarr; Shared cookie is checked on every page load, and updated to reflect changes in cookie. But user is not logged out when cookie is missing</option>
 						</select>
 					</div>
 					<div class="checkbox">
@@ -54,7 +55,7 @@
 								<span class="mdl-switch__label"><strong>Apply revalidation rules to administrators as well</strong></span>
 							</label>
 							<p class="help-block">
-								Administrators are exempt from the <code>revalidate</code> behaviour because a 
+								Administrators are exempt from the <code>revalidate</code> behaviour because a
 								misconfiguration could lock them out of the admin panel. Enable this option to force
 								administrators to also undergo cookie revalidation, and thereby increasing security.
 							</p>
@@ -82,6 +83,15 @@
 							NodeBB to automatically sync up the local profile with the information provided.
 						</div>
 					</div>
+					<div class="checkbox">
+						<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+							<input class="mdl-switch__input" type="checkbox" id="allowBannedUsers" name="allowBannedUsers" />
+							<span class="mdl-switch__label"><strong>Allow banned users to be logged in and placed into banned user group</strong></span>
+						</label>
+						<p class="help-block">
+							By default banned users arent logged in and an error is thrown. If enabled, banned users are logged in and placed in the banned group.
+						</p>
+					</div>
 					<div class="checkbox">
 						<label class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
 							<input class="mdl-switch__input" type="checkbox" id="syncGroupJoin" name="syncGroupJoin" />
@@ -232,6 +242,25 @@
 					</div>
 				</div>
 			</div>
+			<div class="row">
+				<div class="col-sm-2 col-xs-12 settings-header">Reverse Token</div>
+				<div class="col-sm-10 col-xs-12">
+					<div class="form-group">
+						<div class="checkbox">
+							<label for="reverseToken" class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+								<input type="checkbox" class="mdl-switch__input" id="reverseToken" name="reverseToken">
+								<span class="mdl-switch__label"><strong>Enabled</strong></span>
+							</label>
+						</div>
+						<p class="help-block">
+							If enabled, NodeBB will save a cookie called <code>nbb_token</code> that can be read by other sites on the same domain. It will allow other sites to authenticate a user session based on NodeBB login state.
+						</p>
+						<p class="help-block">
+							Similar to what is accepted by the session-sharing plugin, the reverse token is a signed <a href="//jwt.io">JWT</a> containing the logged in user's username and uid. Guests will not have an `nbb_token`.
+						</p>
+					</div>
+				</div>
+			</div>
 		</div>
 		<div class="col-md-3">
 			<div class="panel panel-default">

package/test/index.js

@@ -0,0 +1,183 @@
+'use strict';
+
+/* globals describe, it */
+
+// MUST BE RUN WITH ENV VAR "TEST_ENV=development"
+// Don't forget to add this plugin to `test_plugins` array in `config.json`
+
+const assert = require('assert');
+const url = require('url');
+const util = require('util');
+const request = require('request-promise-native');
+
+// eslint-disable-next-line no-unused-vars
+const db = require.main.require('./test/mocks/databasemock');
+
+const nconf = require.main.require('nconf');
+const meta = require.main.require('./src/meta');
+
+describe('nodebb-plugin-session-sharing', () => {
+	const userJar = request.jar();
+	const anonJar = request.jar();
+	const { protocol, hostname } = url.parse(nconf.get('url'));
+
+	describe('debug route', () => {
+		it('should 404 when no secret is set', async () => {
+			const response = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+				resolveWithFullResponse: true,
+				simple: false,
+			});
+
+			assert.strictEqual(response.statusCode, 404);
+
+			await meta.settings.setOne('session-sharing', 'secret', 's3cr37c47');
+		});
+
+		it('should generate a valid session when called', async () => {
+			const body = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+			assert.strictEqual(body, 'OK');
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+			assert(cookies.some(cookie => cookie.key === 'token'));
+		});
+	});
+
+	describe('token processing middleware', () => {
+		it('should automatically log in a user with a valid token', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should transparently pass-through as guest without a token', async () => {
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = anonJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies.every(cookie => cookie.key !== 'express.sid'));
+		});
+
+		it('should redirect a guest to a specified redirection target if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'guestRedirect', 'https://example.org');
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org');
+			await meta.settings.setOne('session-sharing', 'guestRedirect', '');
+		});
+
+		it('should maintain the login if behaviour is "revalidate"', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			await meta.settings.setOne('session-sharing', 'behaviour', 'revalidate');
+
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should log the user out if behaviour is "revalidate" and the token is gone', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+
+			userJar.setCookie('token=', `${protocol}//${hostname}/`);	// remove the token
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && (!sessionObj.passport || !sessionObj.passport.uid));
+
+			// Restore userJar's session again
+			await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+		});
+	});
+
+	describe('login override', () => {
+		it('should redirect a guest to a specified login override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'loginOverride', 'https://example.org/login');
+			const response = await request(`${nconf.get('url')}/login`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/login');
+		});
+	});
+
+	describe('register override', () => {
+		it('should redirect a guest to a specified register override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'registerOverride', 'https://example.org/register');
+			const response = await request(`${nconf.get('url')}/register`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/register');
+		});
+	});
+});