nodebb-plugin-session-sharing 5.0.0 → 5.1.0

package/library.js

@@ -97,25 +97,14 @@ SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
 		throw new Error('no-uids-supplied');
 	}
 
-	return Promise.all(uids.map(async (uid) => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid)));
-};
-
-SocketPlugins.sessionSharing.showUserIds = async (socket, data) => {
-	// Retrieve the hash and find matches
-	const { uids } = data;
-	
-	if (!uids.length) {
-		throw new Error('no-uids-supplied');
-	}
-	
-	return Promise.all(uids.map(async (uid) => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid)));
+	return Promise.all(uids.map(async uid => db.getSortedSetRangeByScore(plugin.settings.name + ':uid', 0, -1, uid, uid)));
 };
 
 SocketPlugins.sessionSharing.findUserByRemoteId = async (socket, data) => {
 	if (!data.remoteId) {
 		throw new Error('no-remote-id-supplied');
 	}
-	
+
 	return plugin.getUser(data.remoteId);
 };
 
@@ -202,7 +191,7 @@ plugin.verifyUser = async (token, uid, isNewUser) => {
 		isNewUser: isNewUser,
 		token: token,
 	});
-	
+
 	// Check ban state of user
 	const isBanned = await user.bans.isBanned(uid);
 
@@ -217,15 +206,15 @@ plugin.findOrCreateUser = async (userData) => {
 	let isNewUser = false;
 	let userId = null;
 	let queries = [db.sortedSetScore(plugin.settings.name + ':uid', userData.id)];
-	
+
 	if (userData.email && userData.email.length) {
 		queries = [...queries, db.sortedSetScore('email:uid', userData.email)];
 	}
-	
+
 	let [uid, mergeUid] = await Promise.all(queries);
 	uid = parseInt(uid, 10);
 	mergeUid = parseInt(mergeUid, 10);
-	
+
 	/* check if found something to work with */
 	if (uid && !isNaN(uid)) {
 		try {
@@ -243,13 +232,13 @@ plugin.findOrCreateUser = async (userData) => {
 			winston.warn('[session-sharing] Error while testing user existance', error);
 		}
 	}
-	
+
 	if (!userId && mergeUid && !isNaN(mergeUid)) {
 		winston.info('[session-sharing] Found user via their email, associating this id (' + id + ') with their NodeBB account');
 		await db.sortedSetAdd(plugin.settings.name + ':uid', mergeUid, id);
 		userId = mergeUid;
 	}
-	
+
 	/* create the user from payload if necessary */
 	winston.debug('createUser?', !userId);
 	if (!userId) {
@@ -281,7 +270,7 @@ plugin.updateUserProfile = async (uid, userData, isNewUser) => {
 
 		return result;
 	}, {});
-	
+
 	if (Object.keys(obj).length) {
 		winston.debug('[session-sharing] Updating profile fields:', obj);
 		obj.uid = uid;
@@ -296,13 +285,13 @@ plugin.updateUserProfile = async (uid, userData, isNewUser) => {
 			winston.warn('[session-sharing] Unable to update profile information for uid: ' + uid + '(' + error.message + ')');
 		}
 	}
-	
+
 	if (userData.picture) {
 		await db.setObjectField('user:' + uid, 'picture', userData.picture);
 	}
 };
 
-plugin.updateUserGroups = async (uid, userData, isNewUser) => {
+plugin.updateUserGroups = async (uid, userData) => {
 	if (!userData.groups || !Array.isArray(userData.groups)) {
 		return;
 	}
@@ -310,14 +299,14 @@ plugin.updateUserGroups = async (uid, userData, isNewUser) => {
 	// Retrieve user groups
 	let [userGroups] = await groups.getUserGroupsFromSet('groups:createtime', [uid]);
 	// Normalize user group data to just group names
-	userGroups = userGroups.map((groupObj) => groupObj.name);
-	
+	userGroups = userGroups.map(groupObj => groupObj.name);
+
 	// Build join and leave arrays
-	let join = userData.groups.filter((name) => !userGroups.includes(name));
+	let join = userData.groups.filter(name => !userGroups.includes(name));
 	if (plugin.settings.syncGroupList === 'on') {
-		join = join.filter((group) => plugin.settings.syncGroups.includes(group));
+		join = join.filter(group => plugin.settings.syncGroups.includes(group));
 	}
-	
+
 	let leave = userGroups.filter((name) => {
 		// `registered-users` is always a joined group
 		if (name === 'registered-users') {
@@ -327,7 +316,7 @@ plugin.updateUserGroups = async (uid, userData, isNewUser) => {
 		return !userData.groups.includes(name);
 	});
 	if (plugin.settings.syncGroupList === 'on') {
-		leave = leave.filter((group) => plugin.settings.syncGroups.includes(group));
+		leave = leave.filter(group => plugin.settings.syncGroups.includes(group));
 	}
 
 	await executeJoinLeave(uid, join, leave);
@@ -340,27 +329,27 @@ async function executeJoinLeave(uid, join, leave) {
 				return;
 			}
 
-			await Promise.all(join.map((name) => groups.join(name, uid)));
+			await Promise.all(join.map(name => groups.join(name, uid)));
 		})(),
 		(async () => {
 			if (plugin.settings.syncGroupLeave !== 'on') {
 				return;
 			}
 
-			await Promise.all(leave.map((name) => groups.leave(name, uid)));
+			await Promise.all(leave.map(name => groups.leave(name, uid)));
 		})(),
 	]);
 }
 
 plugin.createUser = async (userData) => {
 	winston.verbose('[session-sharing] No user found, creating a new user for this login');
-	
+
 	const uid = await user.create(_.pick(userData, profileFields));
 	await db.sortedSetAdd(plugin.settings.name + ':uid', uid, userData.id);
 	return uid;
 };
 
-plugin.addMiddleware = async function (req, res, next) {
+plugin.addMiddleware = async function ({ req, res }) {
 	const { hostWhitelist, guestRedirect, editOverride, loginOverride, registerOverride } = await meta.settings.get('session-sharing');
 
 	if (hostWhitelist) {
@@ -374,18 +363,16 @@ plugin.addMiddleware = async function (req, res, next) {
 		}
 
 		if (!whitelisted) {
-			return next();
+			return;
 		}
 	}
 
-	function handleGuest(req, res, next) {
+	function handleGuest(req, res) {
 		if (guestRedirect && !req.originalUrl.startsWith(nconf.get('relative_path') + '/login?local=1')) {
 			// If a guest redirect is specified, follow it
 			res.redirect(guestRedirect.replace('%1', encodeURIComponent(req.protocol + '://' + req.get('host') + req.originalUrl)));
 		} else if (res.locals.fullRefresh === true) {
 			res.redirect(nconf.get('relative_path') + req.url);
-		} else {
-			next();
 		}
 	}
 
@@ -402,7 +389,7 @@ plugin.addMiddleware = async function (req, res, next) {
 		// Let requests through under "update" or "revalidate" behaviour only if they're logging in for the first time
 		delete req.session.loginLock;	// remove login lock for "update" or "revalidate" logins
 
-		return next();
+		return;
 	}
 
 	if (editOverride && hasSession && req.originalUrl.match(/\/user\/.*\/edit$/)) {
@@ -425,28 +412,28 @@ plugin.addMiddleware = async function (req, res, next) {
 		}
 
 		await plugin.cleanup({ res: res });
-		return handleGuest.call(null, req, res, next);
+		return handleGuest.call(null, req, res);
 	}
-	
+
 	if (Object.keys(req.cookies).length && req.cookies.hasOwnProperty(plugin.settings.cookieName) && req.cookies[plugin.settings.cookieName].length) {
 		try {
 			const uid = await plugin.process(req.cookies[plugin.settings.cookieName]);
 			winston.verbose('[session-sharing] Processing login for uid ' + uid + ', path ' + req.originalUrl);
 			req.uid = uid;
-			
+
 			if (plugin.settings.behaviour === 'revalidate') {
 				res.locals.reroll = false;	// disable session rerolling in core
 			}
-			
+
 			await nbbAuthController.doLogin(req, uid);
-			
+
 			req.session.loginLock = true;
 			const url = req.session.returnTo || req.originalUrl.replace(nconf.get('relative_path'), '');
 			delete req.session.returnTo;
 			res.redirect(nconf.get('relative_path') + url);
 		} catch (error) {
 			let handleAsGuest = false;
-			
+
 			switch (error.message) {
 			case 'payload-invalid':
 				winston.warn('[session-sharing] The passed-in payload was invalid and could not be processed');
@@ -468,29 +455,22 @@ plugin.addMiddleware = async function (req, res, next) {
 			});
 
 			if (data.handleAsGuest) {
-				return handleGuest.call(error, req, res, next);
+				return handleGuest.call(error, req, res);
 			}
 
-			return next(error);
+			throw error;
 		}
 	} else if (hasSession) {
-		try {
-			// Has login session but no cookie, can assume "revalidate" behaviour
-			const isAdmin = await user.isAdministrator(req.user.uid);
-
-			if (plugin.settings.behaviour !== 'update' && (plugin.settings.adminRevalidate === 'on' || !isAdmin)) {
-				req.logout();
-				res.locals.fullRefresh = true;
-				return handleGuest(req, res, next);
-			}
+		// Has login session but no cookie, can assume "revalidate" behaviour
+		const isAdmin = await user.isAdministrator(req.user.uid);
 
-			// Admins can bypass
-			return next();
-		} catch (error) {
-			return next(error);
+		if (plugin.settings.behaviour !== 'update' && (plugin.settings.adminRevalidate === 'on' || !isAdmin)) {
+			req.logout();
+			res.locals.fullRefresh = true;
+			return handleGuest(req, res);
 		}
 	} else {
-		return handleGuest.call(null, req, res, next);
+		return handleGuest.call(null, req, res);
 	}
 };
 
@@ -503,11 +483,21 @@ plugin.cleanup = async (data) => {
 			path: '/',
 		});
 	}
-	
+
+	data.res.clearCookie('nbb_token', {
+		domain: plugin.settings.cookieDomain,
+		expires: new Date(),
+		path: '/',
+	});
+
 	return true;
 };
 
 plugin.generate = function (req, res) {
+	if (!plugin.ready) {
+		return res.sendStatus(404);
+	}
+
 	let payload = {};
 	payload[plugin.settings['payload:id']] = 1;
 	payload[plugin.settings['payload:username']] = 'testUser';
@@ -594,4 +584,22 @@ plugin.appendTemplate = async (data) => {
 	return data;
 };
 
+plugin.saveReverseToken = async ({ req, userData: data }) => {
+	if (!plugin.ready || plugin.settings.reverseToken !== 'on') {
+		return;	// no reverse token if secret not set
+	}
+
+	const res = req.res;
+	const userData = await user.getUserFields(data.uid, ['uid', 'username', 'picture', 'reputation', 'postcount', 'banned']);
+	const token = jwt.sign(userData, plugin.settings.secret);
+
+	res.cookie('nbb_token', token, {
+		maxAge: meta.getSessionTTLSeconds() * 1000,
+		httpOnly: !req.secure,
+		domain: plugin.settings.cookieDomain,
+	});
+
+	winston.info(`[plugins/session-sharing] Saving reverse cookie for uid ${userData.uid}, session: ${req.session.id}`);
+};
+
 module.exports = plugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-session-sharing",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Allows login sessions from your app to persist in NodeBB",
   "main": "library.js",
   "repository": {
@@ -39,7 +39,7 @@
     "@commitlint/cli": "^9.1.2",
     "async": "^2",
     "eslint": "^7.7.0",
-    "jsonwebtoken": "5.5.4",
+    "jsonwebtoken": "^8.5.1",
     "lint-staged": "^10.0.9",
     "lodash": "^4.17.14"
   },
@@ -50,6 +50,8 @@
     "eslint-config-airbnb-base": "^12.1.0",
     "eslint-plugin-import": "^2.8.0",
     "husky": "^2.4.0",
-    "lint-staged": "^10.0.9"
+    "lint-staged": "^10.0.9",
+    "request": "^2.88.2",
+    "request-promise-native": "^1.0.9"
   }
 }

package/plugin.json

@@ -3,13 +3,14 @@
 	"url": "https://github.com/NodeBB/nodebb-plugin-session-sharing",
 	"library": "./library.js",
 	"hooks": [
-		{ "hook": "filter:router.page", "method": "addMiddleware" },
+		{ "hook": "response:router.page", "method": "addMiddleware" },
 		{ "hook": "static:app.load", "method": "init" },
 		{ "hook": "filter:admin.header.build", "method": "addAdminNavigation" },
 		{ "hook": "static:user.loggedOut", "method": "cleanup" },
 		{ "hook": "filter:config.get", "method": "appendConfig" },
 		{ "hook": "filter:middleware.render", "method": "appendTemplate" },
-		{ "hook": "action:settings.set", "method": "reloadSettings" }
+		{ "hook": "action:settings.set", "method": "reloadSettings" },
+		{ "hook": "action:login.continue", "method": "saveReverseToken" }
 	],
 	"less": [
 		"static/style.less"

package/static/templates/admin/plugins/session-sharing.tpl

@@ -55,7 +55,7 @@
 								<span class="mdl-switch__label"><strong>Apply revalidation rules to administrators as well</strong></span>
 							</label>
 							<p class="help-block">
-								Administrators are exempt from the <code>revalidate</code> behaviour because a 
+								Administrators are exempt from the <code>revalidate</code> behaviour because a
 								misconfiguration could lock them out of the admin panel. Enable this option to force
 								administrators to also undergo cookie revalidation, and thereby increasing security.
 							</p>
@@ -242,6 +242,25 @@
 					</div>
 				</div>
 			</div>
+			<div class="row">
+				<div class="col-sm-2 col-xs-12 settings-header">Reverse Token</div>
+				<div class="col-sm-10 col-xs-12">
+					<div class="form-group">
+						<div class="checkbox">
+							<label for="reverseToken" class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+								<input type="checkbox" class="mdl-switch__input" id="reverseToken" name="reverseToken">
+								<span class="mdl-switch__label"><strong>Enabled</strong></span>
+							</label>
+						</div>
+						<p class="help-block">
+							If enabled, NodeBB will save a cookie called <code>nbb_token</code> that can be read by other sites on the same domain. It will allow other sites to authenticate a user session based on NodeBB login state.
+						</p>
+						<p class="help-block">
+							Similar to what is accepted by the session-sharing plugin, the reverse token is a signed <a href="//jwt.io">JWT</a> containing the logged in user's username and uid. Guests will not have an `nbb_token`.
+						</p>
+					</div>
+				</div>
+			</div>
 		</div>
 		<div class="col-md-3">
 			<div class="panel panel-default">

package/test/index.js

@@ -0,0 +1,183 @@
+'use strict';
+
+/* globals describe, it */
+
+// MUST BE RUN WITH ENV VAR "TEST_ENV=development"
+// Don't forget to add this plugin to `test_plugins` array in `config.json`
+
+const assert = require('assert');
+const url = require('url');
+const util = require('util');
+const request = require('request-promise-native');
+
+// eslint-disable-next-line no-unused-vars
+const db = require.main.require('./test/mocks/databasemock');
+
+const nconf = require.main.require('nconf');
+const meta = require.main.require('./src/meta');
+
+describe('nodebb-plugin-session-sharing', () => {
+	const userJar = request.jar();
+	const anonJar = request.jar();
+	const { protocol, hostname } = url.parse(nconf.get('url'));
+
+	describe('debug route', () => {
+		it('should 404 when no secret is set', async () => {
+			const response = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+				resolveWithFullResponse: true,
+				simple: false,
+			});
+
+			assert.strictEqual(response.statusCode, 404);
+
+			await meta.settings.setOne('session-sharing', 'secret', 's3cr37c47');
+		});
+
+		it('should generate a valid session when called', async () => {
+			const body = await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+			assert.strictEqual(body, 'OK');
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+			assert(cookies.some(cookie => cookie.key === 'token'));
+		});
+	});
+
+	describe('token processing middleware', () => {
+		it('should automatically log in a user with a valid token', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should transparently pass-through as guest without a token', async () => {
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+			});
+			assert.strictEqual(response.statusCode, 200);
+
+			const cookies = anonJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies.every(cookie => cookie.key !== 'express.sid'));
+		});
+
+		it('should redirect a guest to a specified redirection target if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'guestRedirect', 'https://example.org');
+			const response = await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org');
+			await meta.settings.setOne('session-sharing', 'guestRedirect', '');
+		});
+
+		it('should maintain the login if behaviour is "revalidate"', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+			await meta.settings.setOne('session-sharing', 'behaviour', 'revalidate');
+
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+			assert(sessionObj && sessionObj.passport && sessionObj.passport.user);
+			assert(parseInt(sessionObj.passport.user, 10) > 0);
+		});
+
+		it('should log the user out if behaviour is "revalidate" and the token is gone', async () => {
+			const getSession = util.promisify(db.sessionStore.get.bind(db.sessionStore));
+
+			userJar.setCookie('token=', `${protocol}//${hostname}/`);	// remove the token
+			await request(`${nconf.get('url')}`, {
+				resolveWithFullResponse: true,
+				jar: userJar,	// now with no token
+				followRedirect: false,
+				simple: false,
+			});
+
+			const cookies = userJar.getCookies(`${protocol}//${hostname}/`);
+			assert(cookies);
+
+			const sidCookie = cookies.find(cookie => cookie.key === 'express.sid');
+			assert(sidCookie);
+
+			let sid = sidCookie.value.match(/s%3A([^.]+)/);
+			assert(sid && sid[1]);
+			sid = sid[1];
+			const sessionObj = await getSession(sid);
+
+			assert(sessionObj && (!sessionObj.passport || !sessionObj.passport.uid));
+
+			// Restore userJar's session again
+			await request(`${nconf.get('url')}/debug/session`, {
+				jar: userJar,
+			});
+		});
+	});
+
+	describe('login override', () => {
+		it('should redirect a guest to a specified login override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'loginOverride', 'https://example.org/login');
+			const response = await request(`${nconf.get('url')}/login`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/login');
+		});
+	});
+
+	describe('register override', () => {
+		it('should redirect a guest to a specified register override if configured', async () => {
+			await meta.settings.setOne('session-sharing', 'registerOverride', 'https://example.org/register');
+			const response = await request(`${nconf.get('url')}/register`, {
+				resolveWithFullResponse: true,
+				jar: anonJar,
+				followRedirect: false,
+				simple: false,
+			});
+
+			assert(response.statusCode, 302);
+			assert.strictEqual(response.headers.location, 'https://example.org/register');
+		});
+	});
+});