passport-steam-openid 1.0.0

package/dist/strategy.js

@@ -0,0 +1,305 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SteamOpenIdStrategy = void 0;
+const tslib_1 = require("tslib");
+const querystring_1 = tslib_1.__importDefault(require("querystring"));
+const axios_1 = tslib_1.__importDefault(require("axios"));
+const passport_1 = require("passport");
+const error_1 = require("./error");
+const constant_1 = require("./constant");
+const type_1 = require("./type");
+/**
+ * Strategy that authenticates you via steam openid without the use of any external openid libraries,
+ * which can and are source of many vulnerabilities.
+ *
+ * Functionality should be similar to `passport-steam`.
+ *
+ * @class SteamOpenIdStrategy
+ */
+class SteamOpenIdStrategy extends passport_1.Strategy {
+    /**
+     * @constructor
+     *
+     * @param options.returnURL where steam redirects after parameters are passed
+     * @param options.profile if set, we will fetch user's profile from steam api
+     * @param options.apiKey api key to fetch user profile, not used if profile is false
+     * @param verify optional callback, called when user is successfully authenticated
+     */
+    constructor(options, verify) {
+        super();
+        this.name = 'steam-openid';
+        this.axios = axios_1.default.create();
+        this.returnURL = options.returnURL;
+        this.profile = options.profile;
+        if (options.profile)
+            this.apiKey = options.apiKey;
+        if (verify)
+            this.verify = verify;
+    }
+    /**
+     * Passport handle for authentication. We handle the query, passport does rest.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     */
+    authenticate(req) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                const user = yield this.handleRequest(req);
+                if (!this.verify) {
+                    this.success(user);
+                    return;
+                }
+                this.verify(req, user.steamid, user, (err, user) => {
+                    if (err) {
+                        this.error(err);
+                        return;
+                    }
+                    if (!user) {
+                        this.error(new Error('No user was received from callback.'));
+                        return;
+                    }
+                    this.success(user);
+                });
+            }
+            catch (err) {
+                if (this.isRetryableError(err)) {
+                    this.redirect(this.buildRedirectUrl());
+                    return;
+                }
+                this.error(err);
+            }
+        });
+    }
+    /**
+     * Handles validation request.
+     *
+     * Can be used in a middleware, if you don't like passport.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     * @returns
+     * @throws {SteamOpenIdError} User related problem, such as:
+     *  - open.mode was not correct
+     *  - query did not was pass validation
+     *  - steam rejected this query
+     *  - steamid is invalid
+     * @throws {Error} Non-recoverable errors, such as query object missing.
+     */
+    handleRequest(req) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const query = this.getQuery(req);
+            if (!this.hasAuthQuery(query)) {
+                throw new error_1.SteamOpenIdError('openid.mode is incorrect.', type_1.SteamOpenIdErrorType.InvalidMode);
+            }
+            if (!this.isQueryValid(query)) {
+                throw new error_1.SteamOpenIdError('Supplied query is invalid.', type_1.SteamOpenIdErrorType.InvalidQuery);
+            }
+            // TODO: validate nonce time
+            const valid = yield this.validateAgainstSteam(query);
+            if (!valid) {
+                throw new error_1.SteamOpenIdError('Failed to validate query against steam.', type_1.SteamOpenIdErrorType.Unauthorized);
+            }
+            const steamId = this.getSteamId(query);
+            return yield this.getUser(steamId);
+        });
+    }
+    /**
+     * Checks if error is retryable,
+     * meaning user gets redirected to steam openid page.
+     *
+     * @param err from catch clause
+     * @returns true, if error should be retried
+     * @returns false, if error is not retriable
+     *  and should be handled by the app.
+     */
+    isRetryableError(err) {
+        return (err instanceof error_1.SteamOpenIdError &&
+            err.code == type_1.SteamOpenIdErrorType.InvalidMode);
+    }
+    /**
+     * Retrieves query parameter from req object and checks if it is an object.
+     *
+     * @param req Base IncommingMessage request enhanced with parsed querystring.
+     * @returns query from said request
+     * @throws Error if query cannot be found, non-recoverable error.
+     */
+    getQuery(req) {
+        if (!req['query'] || typeof req['query'] != 'object') {
+            throw new Error('Query was not found on request object.');
+        }
+        return req['query'];
+    }
+    /**
+     * Checks if `mode` field from query is correct and thus authentication can begin
+     *
+     * @param query original query user submitted
+     * @returns true, if mode is correct, equal to `id_res`
+     * @returns false, if mode is incorrect
+     */
+    hasAuthQuery(query) {
+        return !!query['openid.mode'] && query['openid.mode'] == 'id_res';
+    }
+    /**
+     * Builds a redirect url for user that is about to authenticate
+     *
+     * @returns redirect url built with proper parameters
+     */
+    buildRedirectUrl() {
+        const openIdParams = {
+            'openid.mode': 'checkid_setup',
+            'openid.ns': constant_1.VALID_NONCE,
+            'openid.identity': constant_1.VALID_ID_SELECT,
+            'openid.claimed_id': constant_1.VALID_ID_SELECT,
+            'openid.return_to': this.returnURL,
+        };
+        return `${constant_1.VALID_OPENID_ENDPOINT}?${querystring_1.default.stringify(openIdParams)}`;
+    }
+    /**
+     * Validates user submitted query, if it contains correct parameters.
+     * No excess parameters can be used.
+     *
+     * @param query original query user submitted
+     * @returns true, query contains correct parameters
+     * @returns false, query contains incorrect parameters
+     */
+    isQueryValid(query) {
+        for (const key of constant_1.OPENID_QUERY_PROPS) {
+            if (!query[key]) {
+                return false;
+            }
+        }
+        if (query['openid.ns'] != constant_1.VALID_NONCE)
+            return false;
+        if (query['openid.op_endpoint'] != constant_1.VALID_OPENID_ENDPOINT)
+            return false;
+        if (query['openid.claimed_id'] !== query['openid.identity'])
+            return false;
+        if (!this.isValidIdentity(query['openid.claimed_id']))
+            return false;
+        return query['openid.return_to'] == this.returnURL;
+    }
+    /**
+     * Checks if identity starts with correct link.
+     *
+     * @param identity from querystring
+     * @returns true, if identity is a string and starts with correct endpoint
+     * @return false, if above criteria was violated
+     */
+    isValidIdentity(identity) {
+        return (typeof identity == 'string' &&
+            !!identity.match(/^https:\/\/steamcommunity\.com\/openid\/id\/(7656119[0-9]{10})\/?$/));
+    }
+    /**
+     * Query trusted steam endpoint to validate supplied query.
+     *
+     * @param query original query user submitted
+     * @returns true, if positive response was received
+     * @returns false, if request failed, status is incorrect or data signals invalid
+     */
+    validateAgainstSteam(query) {
+        return this.axios
+            .post(constant_1.VALID_OPENID_ENDPOINT, this.getOpenIdValidationRequestBody(query), {
+            maxRedirects: 0,
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+        })
+            .then(({ data, status }) => {
+            if (status !== 200) {
+                return false;
+            }
+            return this.isSteamResponseValid(data);
+        })
+            .catch(() => {
+            return false;
+        });
+    }
+    /**
+     * Clones query from authentication request, changes mode and stringifies to form data.
+     * @param query original query user submitted
+     * @returns stringified form data with changed mode
+     */
+    getOpenIdValidationRequestBody(query) {
+        const data = Object.assign({}, query);
+        data['openid.mode'] = 'check_authentication';
+        return querystring_1.default.stringify(data);
+    }
+    /**
+     * Validates response from steam to see if query is correct.
+     *
+     * @param response response received from steama
+     * @returns true, if data was in correct format and signals valid query
+     * @return false, if data was corrupted or invalid query was signaled
+     */
+    isSteamResponseValid(response) {
+        if (typeof response != 'string')
+            return false;
+        const match = response.match(/^ns:(.+)\nis_valid:(.+)\n$/);
+        if (!match)
+            return false;
+        if (match[1] != constant_1.VALID_NONCE)
+            return false;
+        return match[2] == 'true';
+    }
+    /**
+     * Parses steamId from `claimed_id` field, which is what openid 2.0 uses.
+     *
+     * @param query original query user submitted
+     * @returns parsed steamId
+     */
+    getSteamId(query) {
+        return query['openid.claimed_id']
+            .replace(`${constant_1.VALID_IDENTITY_ENDPOINT}/`, '')
+            .replace('/', ''); // Incase steam starts sending links ending with /
+    }
+    /**
+     * Abstract method for getting user that has been authenticated.
+     * You can implement fetching user from steamid and thus validating even more,
+     * or if you are satisified with just steamId, you can return it as an object
+     * and continue without need of an steam api key.
+     *
+     * @param steamId steamId parsed from `claimed_id`
+     * @return generic that was chosen by child class
+     */
+    getUser(steamId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            // Kind of hacky way to force the generic, but will do for now.
+            if (this.profile) {
+                return this.fetchPlayerSummary(steamId);
+            }
+            return { steamid: steamId };
+        });
+    }
+    /**
+     * Fetches profile data for authenticated user.
+     * Validates the steamId even more.
+     *
+     * @param steamId parsed steamId from `claimed_id`
+     * @returns profile belonging to said steamId
+     *
+     * @throws {Error} if malformed response was received
+     * @throws {AxiosError} if status was not 200
+     * @throws {SteamOpenIdError} if profile was not found
+     */
+    fetchPlayerSummary(steamId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const summaryQuery = {
+                steamids: steamId,
+                key: this.apiKey,
+            };
+            return axios_1.default
+                .get(`${constant_1.PLAYER_SUMMARY_URL}/?${querystring_1.default.stringify(summaryQuery)}`)
+                .then(({ data }) => {
+                var _a;
+                if (!Array.isArray((_a = data === null || data === void 0 ? void 0 : data.response) === null || _a === void 0 ? void 0 : _a.players)) {
+                    throw new Error('Malformed response from steam.');
+                }
+                const user = data.response.players[0];
+                if (!user) {
+                    throw new error_1.SteamOpenIdError('Profile was not found on steam.', type_1.SteamOpenIdErrorType.InvalidSteamId);
+                }
+                return user;
+            });
+        });
+    }
+}
+exports.SteamOpenIdStrategy = SteamOpenIdStrategy;

package/dist/type.d.ts

@@ -0,0 +1,85 @@
+import { DoneCallback } from 'passport';
+export type BaseSteamOpenIdStrategyOptions = {
+    returnURL: string;
+};
+export type SteamOpenIdStrategyOptionsWithProfile = {
+    profile: true;
+    apiKey: string;
+} & BaseSteamOpenIdStrategyOptions;
+export type SteamOpenIdStrategyOptionsWithoutProfile = {
+    profile: false;
+} & BaseSteamOpenIdStrategyOptions;
+export type SteamOpenIdStrategyOptions = SteamOpenIdStrategyOptionsWithProfile | SteamOpenIdStrategyOptionsWithoutProfile;
+/**
+ * Enum used to distinguish between user-related errors.
+ *
+ * @enum SteamOpenIdErrorType
+ */
+export declare enum SteamOpenIdErrorType {
+    /**
+     * Invalid mode for authentication, should trigger redirect.
+     */
+    InvalidMode = 0,
+    /**
+     * Query has a wrong parameter or has excess parameters.
+     */
+    InvalidQuery = 1,
+    /**
+     * Steam rejected our query.
+     */
+    Unauthorized = 2,
+    /**
+     * SteamId is not valid.
+     */
+    InvalidSteamId = 3
+}
+/** When profile is not used, we just send a steamid. */
+export type SteamOpenIdUser = {
+    steamid: string;
+};
+/** Api response for profile */
+export type SteamPlayerSummaryResponse = {
+    response: {
+        players: SteamOpenIdUserProfile[];
+    };
+};
+/**
+ * Steam Player Summary
+ */
+export type SteamOpenIdUserProfile = {
+    steamid: string;
+    communityvisibilitystate: number;
+    profilestate: number;
+    personaname: string;
+    commentpermission: number;
+    profileurl: string;
+    avatar: string;
+    avatarmedium: string;
+    avatarfull: string;
+    avatarhash: string;
+    lastlogoff: number;
+    personastate: number;
+    realname: string;
+    primaryclanid: string;
+    timecreated: number;
+    personastateflags: number;
+    loccountrycode: string;
+    locstatecode: string;
+};
+/**
+ * Optional callback inserted into the constructor of SteamOpenIdStrategy.
+ */
+export type VerifyCallback<TUser extends SteamOpenIdUser | SteamOpenIdUserProfile> = (req: any, identifier: string, profile: TUser, done: DoneCallback) => any;
+export type SteamOpenIdQuery = {
+    'openid.ns': string;
+    'openid.mode': string;
+    'openid.op_endpoint': string;
+    'openid.claimed_id': string;
+    'openid.identity': string;
+    'openid.return_to': string;
+    'openid.response_nonce': string;
+    'openid.assoc_handle': string;
+    'openid.signed': string;
+    'openid.sig': string;
+};
+//# sourceMappingURL=type.d.ts.map

package/dist/type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../src/type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,MAAM,8BAA8B,GAAG;IAC3C,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAAG;IAClD,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,wCAAwC,GAAG;IACrD,OAAO,EAAE,KAAK,CAAC;CAChB,GAAG,8BAA8B,CAAC;AAEnC,MAAM,MAAM,0BAA0B,GAClC,qCAAqC,GACrC,wCAAwC,CAAC;AAE7C;;;;GAIG;AACH,oBAAY,oBAAoB;IAC9B;;OAEG;IACH,WAAW,IAAI;IACf;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,YAAY,IAAI;IAChB;;OAEG;IACH,cAAc,IAAI;CACnB;AAED,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,+BAA+B;AAC/B,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE;QACR,OAAO,EAAE,sBAAsB,EAAE,CAAC;KACnC,CAAC;CACH,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB,EAAE,MAAM,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,KAAK,SAAS,eAAe,GAAG,sBAAsB,IACpD,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,KAAK,GAAG,CAAC;AAE9E,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/type.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SteamOpenIdErrorType = void 0;
+/**
+ * Enum used to distinguish between user-related errors.
+ *
+ * @enum SteamOpenIdErrorType
+ */
+var SteamOpenIdErrorType;
+(function (SteamOpenIdErrorType) {
+    /**
+     * Invalid mode for authentication, should trigger redirect.
+     */
+    SteamOpenIdErrorType[SteamOpenIdErrorType["InvalidMode"] = 0] = "InvalidMode";
+    /**
+     * Query has a wrong parameter or has excess parameters.
+     */
+    SteamOpenIdErrorType[SteamOpenIdErrorType["InvalidQuery"] = 1] = "InvalidQuery";
+    /**
+     * Steam rejected our query.
+     */
+    SteamOpenIdErrorType[SteamOpenIdErrorType["Unauthorized"] = 2] = "Unauthorized";
+    /**
+     * SteamId is not valid.
+     */
+    SteamOpenIdErrorType[SteamOpenIdErrorType["InvalidSteamId"] = 3] = "InvalidSteamId";
+})(SteamOpenIdErrorType || (exports.SteamOpenIdErrorType = SteamOpenIdErrorType = {}));

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "passport-steam-openid",
+  "version": "1.0.0",
+  "description": "Passport strategy for authenticating with steam openid without the use of 3rd party openid packages.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "npx tsc",
+    "format": "npx prettier --write \"src/**/*.ts\"",
+    "lint": "npx eslint \"{src,test}/**/*.ts\" --fix",
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "prepare": "npx husky install",
+    "semantic-release": "semantic-release"
+  },
+  "keywords": [],
+  "author": "glencoco",
+  "license": "MIT",
+  "dependencies": {
+    "axios": "^1.4.0",
+    "passport": "^0.6.0"
+  },
+  "devDependencies": {
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@types/node": "^20.3.1",
+    "@types/passport": "^1.0.12",
+    "@typescript-eslint/eslint-plugin": "^5.59.11",
+    "@typescript-eslint/parser": "^5.59.11",
+    "cz-conventional-changelog": "^3.3.0",
+    "eslint": "^8.43.0",
+    "eslint-config-prettier": "^8.8.0",
+    "eslint-plugin-prettier": "^4.2.1",
+    "eslint-plugin-sonarjs": "^0.19.0",
+    "husky": "^8.0.3",
+    "lint-staged": "^13.2.2",
+    "prettier": "^2.8.8",
+    "semantic-release": "^21.0.5",
+    "typescript": "^5.1.3"
+  },
+  "config": {
+    "commitizen": {
+      "path": "./node_modules/cz-conventional-changelog"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/danocmx/passport-steam-openid.git"
+  }
+}

package/release.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  branches: ['master'],
+  plugins: [
+    '@semantic-release/commit-analyzer',
+    '@semantic-release/release-notes-generator',
+    '@semantic-release/npm',
+    '@semantic-release/git',
+  ],
+};

package/sample/.env.example

@@ -0,0 +1,3 @@
+NODE_ENV="development"
+URL_BASE="http://example.com"
+COOKIE_SECRET="secret"

package/sample/.eslintrc.js

@@ -0,0 +1,24 @@
+module.exports = {
+  parser: '@typescript-eslint/parser',
+  parserOptions: {
+    sourceType: 'module',
+  },
+  plugins: ['@typescript-eslint/eslint-plugin', 'sonarjs'],
+  extends: [
+    'plugin:@typescript-eslint/recommended',
+    'plugin:prettier/recommended',
+    'plugin:sonarjs/recommended',
+  ],
+  root: true,
+  env: {
+    node: true,
+    jest: true,
+  },
+  ignorePatterns: ['.eslintrc.js'],
+  rules: {
+    '@typescript-eslint/interface-name-prefix': 'off',
+    '@typescript-eslint/explicit-function-return-type': 'off',
+    '@typescript-eslint/explicit-module-boundary-types': 'off',
+    '@typescript-eslint/no-explicit-any': 'off',
+  },
+};

package/sample/.prettierrc

@@ -0,0 +1,4 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all"
+}

package/sample/README.md

@@ -0,0 +1,23 @@
+# passport-steam-openid sample
+Sample application to demonstate usage of `passport-steam-openid` in express.js enviroment.
+
+## Environment
+Set these variables in your `.env` file:
+- `NODE_ENV` - `production` or `development`.
+- `URL_BASE` - url used for return URL in `production` environment.
+- `COOKIE_SECRET` - used for encrypting sessions
+
+## Dependencies
+Install via npm:
+```
+npm install
+```
+After installing this application.
+
+## Compilation and running
+You can use package.json scripts:
+- `npm run build` for building with typescript
+- `npm start` for starting app on port 3000
+
+## License
+This sample is released under MIT license.