prow-authority 3.6.3

package/src/v1/controllers/auth/identity-token-controller.ts

@@ -0,0 +1,286 @@
+import { newUUIDv4 } from '@beseif-solutions/utility-functions/dist/utils/string-utils';
+import { Validator } from '@beseif-solutions/utility-functions/dist/utils/validation-utils';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import nconf from '../../../helpers/config';
+import RedisDao from '../../daos/redis-dao';
+import { identityAdminSchema, identityTokenSchema, newOTPSchema, refreshSchema, validateOTPSchema, validateRecaptchaSchema } from '../../schemas/auth/auth-schemas';
+import { User, UserStatus } from '../../types/admin/user-types';
+import { BearerAuthorization } from '../../types/auth/common-types';
+import { IdentityAccessInformation, IdentityRefreshInformation } from '../../types/auth/identity-token-types';
+import userController from '../admin/user-controller';
+import notificationController from '../admin/notification-controller';
+import tempCodeController from './temp-code-controller';
+import { TempCodeType } from '../../types/auth/otp-types';
+import { Requester } from '@beseif-solutions/utility-functions/dist/utils/http-utils';
+import FormData from 'form-data';
+
+class IdentityTokenController {
+
+  private readonly tokenDao = new RedisDao<IdentityAccessInformation | IdentityRefreshInformation>();
+
+  private readonly key = (type: `access_token` | `refresh_token` | `*`, user: number | `*`, pair: string, token: string) =>
+    `identity:${type}:${user}:${pair}:${token}`;
+
+  public readonly admin = async (data: Pick<User, `email`>): Promise<BearerAuthorization> => {
+    try {
+      const { email } = Validator.validate(identityAdminSchema, data);
+      const user = (await userController.list({ email: email }, { password: false }))[0];
+
+      if (!user) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No user found with provided email and password.`,
+        });
+      }
+
+      return await this.newBearerAuthorization(user);
+    } catch (e) { throw e; }
+  };
+
+  public readonly token = async (data: Pick<User, `email` | `password`>): Promise<BearerAuthorization> => {
+    try {
+      const { email, password } = Validator.validate(identityTokenSchema, data);
+      const user = (await userController.list({ email: email }, { password: true }))[0];
+
+      if (!user || userController.hashPassword(password) !== user.password) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No user found with provided email and password.`,
+        });
+      }
+
+      if (user.status === UserStatus.Blocked) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `This user has been blocked. Pease contact with your support representative to fix this issue.`,
+        });
+      }
+
+      // activate user after expired login
+      if (user.status === UserStatus.Expired) {
+        await userController.activate(user.id, { password: false });
+      }
+
+      return await this.newBearerAuthorization(user);
+    } catch (e) { throw e; }
+  };
+
+  public readonly refresh = async (access_token: string, data: Pick<BearerAuthorization, `refresh_token`>): Promise<BearerAuthorization> => {
+    try {
+      const { refresh_token } = Validator.validate(refreshSchema, data);
+      const refreshInfo = await this.tokenDao.get(this.key(`refresh_token`, `*`, `*`, refresh_token)) as IdentityRefreshInformation;
+
+      if (!refreshInfo || refreshInfo.access_token !== access_token) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid refresh token provided.`,
+        });
+      }
+
+      // get user
+      const user = await this.validate(refreshInfo);
+
+      // clear old tokens
+      await this.tokenDao.delete(this.key(`*`, user.id, refreshInfo.pair, `*`));
+
+      return await identityTokenController.newBearerAuthorization(user);
+    } catch (e) { throw e; }
+  };
+
+  public readonly delete = async (user: User, access_token: string): Promise<void> => {
+    try {
+      const accessInfo = await this.tokenDao.get(this.key(`access_token`, user.id, `*`, access_token)) as IdentityAccessInformation;
+      if (!accessInfo) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid token provided.`,
+        });
+      }
+
+      await this.tokenDao.delete(this.key(`*`, user.id, accessInfo.pair, `*`));
+    } catch (e) { throw e; }
+  };
+
+  public readonly deleteAll = async (user: User): Promise<void> => {
+    try {
+      await this.tokenDao.delete(this.key(`*`, user.id, `*`, `*`));
+    } catch (e) { throw e; }
+  };
+
+  public readonly check = async (token: string): Promise<User> => {
+    try {
+      const accessInfo: IdentityAccessInformation = await this.tokenDao.get(this.key(`access_token`, `*`, `*`, token));
+      if (!accessInfo) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid token provided.`,
+        });
+      }
+
+      // get user
+      const user = await this.validate(accessInfo);
+      return user;
+    } catch (e) { throw e; }
+  };
+
+  // otp access (+ password recover)
+  public readonly requestOTP = async (data: Pick<User, `email`> & { flow: TempCodeType.OTP | TempCodeType.Password }): Promise<void> => {
+    try {
+      const { email, flow } = Validator.validate(newOTPSchema, data);
+
+      const user = (await userController.list({ email: email }, { password: false }))[0];
+      if (!user) { return; }
+
+      if (user.status === UserStatus.Blocked) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `This user has been blocked. Pease contact with your support representative to fix this issue.`,
+        });
+      }
+
+      await notificationController[flow](user.id);
+    } catch (e) { throw e; }
+  };
+
+  public readonly validateOTP = async (data: Pick<User, `email`> & { code: string, flow: TempCodeType.OTP | TempCodeType.Password }): Promise<BearerAuthorization> => {
+    try {
+      const { email, code, flow } = Validator.validate(validateOTPSchema, data);
+
+      const user = (await userController.list({ email: email }, { password: false }))[0];
+      if (!user) { return; }
+
+      if (user.status === UserStatus.Blocked) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `This user has been blocked. Pease contact with your support representative to fix this issue.`,
+        });
+      }
+
+      await tempCodeController.validate(flow, user, code);
+
+      return await this.newBearerAuthorization(user);
+    } catch (e) { throw e; }
+  };
+
+  public readonly validateRecaptcha = async (data: { token: string }): Promise<void> => {
+    try {
+      const recaptchaValue = nconf.get(`SERVICES:AUTH:RECAPTCHA:VALUE`);
+
+      if (recaptchaValue > 0) {
+        const { token } = Validator.validate(validateRecaptchaSchema, data);
+        const recaptchaSecret = nconf.get(`SERVICES:AUTH:RECAPTCHA:SECRETKEY`);
+
+        const form = new FormData();
+        form.append(`secret`, recaptchaSecret);
+        form.append(`response`, token);
+
+        const response = await Requester.post(`https://www.google.com/recaptcha/api/siteverify`,
+          form,
+          {
+            headers: {
+              ...form.getHeaders(),
+            },
+          }
+        );
+
+        if (response.score < recaptchaValue) {
+          throw new APIError({
+            code: StatusCodes.UNAUTHORIZED,
+            detail: `Recaptcha validation failed: score too low (${response.score})`,
+          });
+        }
+      }
+
+    } catch (e) { throw e; }
+  };
+
+  public readonly socialGoogle = async (data: { code: string }): Promise<BearerAuthorization> => {
+    try {
+      const auth = await Requester.post(`https://oauth2.googleapis.com/token`, {
+        code: data.code,
+        client_id: nconf.get(`SERVICES:AUTH:SOCIAL:GOOGLE:CLIENT_ID`),
+        client_secret: nconf.get(`SERVICES:AUTH:SOCIAL:GOOGLE:CLIENT_SECRET`),
+        redirect_uri: nconf.get(`SERVICES:AUTH:SOCIAL:GOOGLE:REDIRECT_URI`),
+        grant_type: `authorization_code`,
+      });
+      if (!auth.access_token) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Could not recover access token from Google.`,
+        });
+      }
+
+      const profile = await Requester.get(`https://www.googleapis.com/oauth2/v3/userinfo`, {
+        headers: {
+          Authorization: `Bearer ${auth.access_token}`,
+        },
+      });
+      if (!profile.email) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Could not recover email from Google profile.`,
+        });
+      }
+
+      let user = (await userController.list({ email: profile.email }, { password: false }))[0];
+      if (!user) {
+        // create user with social profile data
+        user = (await userController.add({
+          email: profile.email,
+          password: null,
+          properties: {
+            name: profile.given_name,
+            surnames: profile.family_name,
+            image: profile.picture,
+          },
+        }, { password: false }))[0];
+
+        // activate user
+        await userController.activate(user.id, { password: false });
+      }
+
+      return await this.newBearerAuthorization(user);
+    } catch (e) { throw e; }
+  };
+
+  private readonly validate = async (accessInfo: IdentityAccessInformation): Promise<User> => {
+    try {
+      // get user
+      const user = (await userController.get(accessInfo.id, { password: false, timestamp: true }))[0];
+      if (!user) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No user found.`,
+        });
+      }
+
+      return user;
+    } catch (e) { throw e; }
+  };
+
+  private readonly newBearerAuthorization = async (user: User): Promise<BearerAuthorization> => {
+    try {
+      const pair = newUUIDv4();
+
+      const access_token = `id-${newUUIDv4()}`;
+      const aInfo: IdentityAccessInformation = { id: user.id, pair: pair };
+      await this.tokenDao.add(this.key(`access_token`, user.id, pair, access_token), aInfo, nconf.get(`SERVICES:AUTH:BEARER:TOKEN_EXPIRATION`));
+
+      const refresh_token = `id-${newUUIDv4()}`;
+      const rInfo: IdentityRefreshInformation = { ...aInfo, access_token: access_token };
+      await this.tokenDao.add(this.key(`refresh_token`, user.id, pair, refresh_token), rInfo, nconf.get(`SERVICES:AUTH:BEARER:REFRESH_EXPIRATION`));
+
+      return {
+        token_type: `Bearer`,
+        access_token: access_token,
+        refresh_token: refresh_token,
+        expires_in: nconf.get(`SERVICES:AUTH:BEARER:TOKEN_EXPIRATION`),
+      };
+    } catch (e) { throw e; }
+  };
+
+
+}
+
+const identityTokenController = new IdentityTokenController();
+export default identityTokenController;

package/src/v1/controllers/auth/organization-token-controller.ts

@@ -0,0 +1,277 @@
+import { newUUIDv4 } from '@beseif-solutions/utility-functions/dist/utils/string-utils';
+import { Validator } from '@beseif-solutions/utility-functions/dist/utils/validation-utils';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import nconf from '../../../helpers/config';
+import RedisDao from '../../daos/redis-dao';
+import { organizationTokenSchema, refreshSchema } from '../../schemas/auth/auth-schemas';
+import { LicenseType } from '../../types/admin/license-types';
+import { Organization, OrganizationStatus } from '../../types/admin/organization-types';
+import { UserOrganization, UserOrganizationRole } from '../../types/admin/user-organization-types';
+import { User, UserStatus } from '../../types/admin/user-types';
+import { BearerAuthorization } from '../../types/auth/common-types';
+import { Environment, OrganizationAccessInformation, OrganizationRefreshInformation } from '../../types/auth/organization-token-types';
+import organizationController from '../admin/organization-controller';
+import organizationLicenseController from '../admin/organization-license-controller';
+import serviceController from '../admin/service-controller';
+import userController from '../admin/user-controller';
+import userOrganizationController from '../admin/user-organization-controller';
+import authority, { omnipotentAccess } from '../../../helpers/authority';
+
+class OrganizationTokenController {
+
+  private readonly tokenDao = new RedisDao<OrganizationAccessInformation | OrganizationRefreshInformation>();
+
+  private readonly key = (type: `access_token` | `refresh_token` | `*`, organization: number | `*`, pair: string, token: string) =>
+    `organization:${type}:${organization}:${pair}:${token}`;
+
+
+  public readonly token = async (user: User, data: { organization: string }): Promise<BearerAuthorization> => {
+    try {
+      Validator.validate(organizationTokenSchema, data);
+
+      const organization = (await organizationController.list({ uuid: data.organization, status: { is: OrganizationStatus.Blocked, inverse: true } }, { timestamp: true }))[0];
+      if (!organization) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No organization ${data.organization} found.`,
+        });
+      }
+
+      let access: UserOrganization = (await userOrganizationController.list({
+        user: user.id,
+        organization: organization.id,
+        enabled: true,
+      }))[0];
+      if (!access || access.invite) {
+        if (!user.omnipotent) {
+          throw new APIError({
+            code: StatusCodes.FORBIDDEN,
+            detail: `Forbidden access to organization ${data.organization}`,
+          });
+        }
+
+        access = omnipotentAccess(user, organization);
+      }
+
+      const service = (await serviceController.list({ uuid: authority.configuration.uuid }))[0];
+      if (!service) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Could not find service.`,
+        });
+      }
+
+      const license = (await organizationLicenseController.list({
+        organization: organization.id,
+        service: service.id,
+        type: LicenseType.Base,
+        enabled: true,
+      }))[0];
+      if (!license) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `No license found for organization ${data.organization}`,
+        });
+      }
+
+      return await this.newBearerAuthorization({ user: user, access: access, organization: organization, license: license });
+    } catch (e) { throw e; }
+  };
+
+  public readonly refresh = async (access_token: string, data: Pick<BearerAuthorization, `refresh_token`>): Promise<BearerAuthorization> => {
+    try {
+      const { refresh_token } = Validator.validate(refreshSchema, data);
+      const refreshInfo = await this.tokenDao.get(this.key(`refresh_token`, `*`, `*`, refresh_token)) as OrganizationRefreshInformation;
+
+      if (!refreshInfo || refreshInfo.access_token !== access_token) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid refresh token provided.`,
+        });
+      }
+
+      const env = await this.validate(refreshInfo);
+
+      // clear old tokens
+      await this.tokenDao.delete(this.key(`*`, env.organization.id, refreshInfo.pair, `*`));
+
+      return await organizationTokenController.newBearerAuthorization(env);
+    } catch (e) { throw e; }
+  };
+
+  public readonly authorize = async (organization: Organization): Promise<BearerAuthorization> => {
+    try {
+      // get organization owner
+      const access = (await userOrganizationController.list({
+        organization: organization.id,
+        role: UserOrganizationRole.Owner,
+        enabled: true,
+      }))[0];
+      if (!access) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Forbidden access to organization ${organization}`,
+        });
+      }
+
+      const user = (await userController.list({ id: access.user, status: UserStatus.Active }, { password: false }))[0];
+      if (!user) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No user found.`,
+        });
+      }
+
+      // get organization license
+      const service = (await serviceController.list({ uuid: authority.configuration.uuid }))[0];
+      if (!service) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Could not find service.`,
+        });
+      }
+
+      const license = (await organizationLicenseController.list({
+        service: service.id,
+        organization: organization.id,
+        type: LicenseType.Base,
+        enabled: true,
+      }))[0];
+      if (!license) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `No license found for organization.`,
+        });
+      }
+
+      // generate auth token
+      return await this.newBearerAuthorization({ user: user, access: access, organization: organization, license: license }, false);
+    } catch (e) { throw e; }
+  };
+
+  public readonly delete = async (env: Environment, access_token: string): Promise<void> => {
+    try {
+      const accessInfo = await this.tokenDao.get(this.key(`access_token`, `*`, `*`, access_token)) as OrganizationAccessInformation;
+      if (!accessInfo) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid token provided.`,
+        });
+      }
+
+      await this.tokenDao.delete(this.key(`*`, env.organization.id, accessInfo.pair, `*`));
+    } catch (e) { throw e; }
+  };
+
+  public readonly deleteAll = async (env: Environment): Promise<void> => {
+    try {
+      await this.tokenDao.delete(this.key(`*`, env.organization.id, `*`, `*`));
+    } catch (e) { throw e; }
+  };
+
+  public readonly check = async (access_token: string): Promise<Environment> => {
+    try {
+      const accessInfo = await this.tokenDao.get(this.key(`access_token`, `*`, `*`, access_token)) as OrganizationAccessInformation;
+      if (!accessInfo) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid token provided.`,
+        });
+      }
+
+      return await this.validate(accessInfo);
+    } catch (e) { throw e; }
+  };
+
+  private readonly validate = async (accessInfo: OrganizationAccessInformation): Promise<Environment> => {
+    try {
+      // validate user
+      const user = (await userController.list({ id: accessInfo.user, status: UserStatus.Active }, { password: false, timestamp: true }))[0];
+      if (!user) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No user found.`,
+        });
+      }
+
+      // validate organization
+      const organization = (await organizationController.list({ id: accessInfo.organization, status: { is: OrganizationStatus.Blocked, inverse: true } }, { timestamp: true }))[0];
+      if (!organization) {
+        throw new APIError({
+          code: StatusCodes.NOT_FOUND,
+          detail: `No organization found.`,
+        });
+      }
+
+      // validate access
+      let access: UserOrganization = (await userOrganizationController.list({
+        id: accessInfo.access,
+        user: user.id,
+        organization: organization.id,
+        enabled: true,
+      }))[0];
+      if (!access) {
+        if (!user.omnipotent) {
+          throw new APIError({
+            code: StatusCodes.FORBIDDEN,
+            detail: `Forbidden access to organization.`,
+          });
+        }
+
+        access = omnipotentAccess(user, organization);
+      }
+
+      // validate license
+      const service = (await serviceController.list({ uuid: authority.configuration.uuid }))[0];
+      if (!service) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Could not find service.`,
+        });
+      }
+
+      const license = (await organizationLicenseController.list({
+        id: accessInfo.license,
+        organization: organization.id,
+        service: service.id,
+        enabled: true,
+      }))[0];
+      if (!license) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `No license found for organization.`,
+        });
+      }
+
+      return { user: user, access: access, organization: organization, license: license };
+    } catch (e) { throw e; }
+  };
+
+  private readonly newBearerAuthorization = async (env: Environment, refresh = true): Promise<BearerAuthorization> => {
+    try {
+      const pair = newUUIDv4();
+
+      const access_token = `org-${newUUIDv4()}`;
+      const aInfo: OrganizationAccessInformation = { user: env.user.id, access: env.access.id, organization: env.organization.id, license: env.license.id, pair: pair };
+      await this.tokenDao.add(this.key(`access_token`, env.organization.id, pair, access_token), aInfo, nconf.get(`SERVICES:AUTH:BEARER:TOKEN_EXPIRATION`));
+
+      const refresh_token = `org-${newUUIDv4()}`;
+      if (refresh) {
+        const rInfo: OrganizationRefreshInformation = { ...aInfo, access_token: access_token };
+        await this.tokenDao.add(this.key(`refresh_token`, env.organization.id, pair, refresh_token), rInfo, nconf.get(`SERVICES:AUTH:BEARER:REFRESH_EXPIRATION`));
+      }
+
+      return {
+        token_type: `Bearer`,
+        access_token: access_token,
+        refresh_token: refresh ? refresh_token : undefined,
+        expires_in: nconf.get(`SERVICES:AUTH:BEARER:TOKEN_EXPIRATION`),
+      };
+    } catch (e) { throw e; }
+  };
+
+
+}
+
+const organizationTokenController = new OrganizationTokenController();
+export default organizationTokenController;

package/src/v1/controllers/auth/temp-code-controller.ts

@@ -0,0 +1,60 @@
+import { StatusCodes } from "http-status-codes";
+import APIError from "../../../helpers/api-error";
+import nconf from "../../../helpers/config";
+import { generateRandomString, NUMERIC_CHARSET } from "../../../helpers/random";
+import RedisDao from "../../daos/redis-dao";
+import { User } from "../../types/admin/user-types";
+import { TempCode, TempCodeType } from "../../types/auth/otp-types";
+
+class TempCodeController {
+
+  private readonly tempCodeDao = new RedisDao<TempCode>();
+
+  private readonly key = (type: TempCodeType, user: number | `*`) =>
+    `temp:${type}:${user}`;
+
+  public readonly generate = async (type: TempCodeType, user: User): Promise<TempCode> => {
+    try {
+      // delete previous one time password code
+      await this.tempCodeDao.delete(this.key(type, user.id));
+
+      // store a new one
+      const otp: TempCode = {
+        code: generateRandomString(NUMERIC_CHARSET, nconf.get(`SERVICES:AUTH:TEMP:LENGTH`)),
+        attempts: 0,
+        expiration: nconf.get(`SERVICES:AUTH:TEMP:EXPIRATION`),
+      };
+
+      await this.tempCodeDao.add(this.key(type, user.id), otp, nconf.get(`SERVICES:AUTH:TEMP:EXPIRATION`));
+
+      return otp;
+    } catch (e) { throw e; }
+  };
+
+  public readonly validate = async (type: TempCodeType, user: User, code: string): Promise<void> => {
+    try {
+      const record = await this.tempCodeDao.get(this.key(type, user.id));
+      if (!record || record.code !== code) {
+        // delete if max attempts reached
+        if (record) {
+          if (record.attempts >= nconf.get(`SERVICES:AUTH:TEMP:ATTEMPTS`)) {
+            await this.tempCodeDao.delete(this.key(type, user.id));
+          } else {
+            await this.tempCodeDao.add(this.key(type, user.id), { ...record, attempts: record.attempts + 1 });
+          }
+        }
+
+        throw new APIError({
+          code: StatusCodes.BAD_REQUEST,
+          detail: `OTP is expired or code is invalid.`,
+        });
+      }
+
+      await this.tempCodeDao.delete(this.key(type, user.id));
+    } catch (e) { throw e; }
+  };
+
+}
+
+const tempCodeController = new TempCodeController();
+export default tempCodeController;