w-web-sso 1.0.0

package/server/WWebSso.mjs

@@ -0,0 +1,649 @@
+import path from 'path'
+import fs from 'fs'
+import ot from 'dayjs'
+import get from 'lodash-es/get.js'
+import each from 'lodash-es/each.js'
+import size from 'lodash-es/size.js'
+import keys from 'lodash-es/keys.js'
+import iseobj from 'wsemi/src/iseobj.mjs'
+import isestr from 'wsemi/src/isestr.mjs'
+import ispint from 'wsemi/src/ispint.mjs'
+import isearr from 'wsemi/src/isearr.mjs'
+import ispnum from 'wsemi/src/ispnum.mjs'
+import isfun from 'wsemi/src/isfun.mjs'
+import ispm from 'wsemi/src/ispm.mjs'
+import cint from 'wsemi/src/cint.mjs'
+import j2o from 'wsemi/src/j2o.mjs'
+import strleft from 'wsemi/src/strleft.mjs'
+import strright from 'wsemi/src/strright.mjs'
+import strdelright from 'wsemi/src/strdelright.mjs'
+import pm2resolve from 'wsemi/src/pm2resolve.mjs'
+import pmSeries from 'wsemi/src/pmSeries.mjs'
+import fsIsFolder from 'wsemi/src/fsIsFolder.mjs'
+import fsIsFile from 'wsemi/src/fsIsFile.mjs'
+import replace from 'wsemi/src/replace.mjs'
+import WServHapiServer from 'w-serv-hapi/src/WServHapiServer.mjs'
+import WServOrm from 'w-serv-orm/src/WServOrm.mjs'
+import ds from '../src/schema/index.mjs'
+import proc from './proc.mjs'
+// import { getUserRules } from '../src/plugins/mShare.mjs'
+
+
+/**
+ * 權限伺服器
+ *
+ * @class
+ * @param {Function} WOrm 輸入資料庫ORM函數
+ * @param {String} url 輸入資料庫連線字串，例如'mongodb://sername:password@$127.0.0.1:27017'
+ * @param {String} db 輸入資料庫名稱字串
+ * @param {Function} getUserByToken 輸入處理函數，函數會傳入使用者token，通過此函數處理後並回傳使用者資訊物件，並至少須提供'id'、'email'、'name'、'isAdmin'欄位，且'isAdmin'限輸入'y'或'n'，且輸入'y'時會複寫權限系統該使用者之'isAdmin'欄位值
+ * @param {Function} verifyBrowserUser 輸入驗證瀏覽使用者身份之處理函數，函數會傳入使用者資訊物件，通過此函數識別後回傳布林值，允許使用者回傳true，反之回傳false
+ * @param {Function} verifyAppUser 輸入驗證應用程序使用者身份之處理函數，函數會傳入使用者資訊物件，通過此函數識別後回傳布林值，允許使用者回傳true，反之回傳false
+ * @param {Object} [opt={}] 輸入設定物件，預設{}
+ * @param {Integer} [opt.serverPort=11007] 輸入伺服器通訊port，預設11006
+ * @param {Boolean} [opt.bCheckUser=false] 輸入是否檢查使用者資訊布林值，預設false
+ * @param {Function} [opt.getUserById=null] 輸入當bCheckUser=true時依照使用者ID取得使用者資訊物件函數，預設null
+ * @param {Boolean} [opt.bExcludeWhenNotAdmin=false] 輸入使用ORM的select方法時是否自動刪除數據內isActive欄位之布林值，預設false
+ * @param {Object} [opt.webName={}] 輸入站台名稱物件，至少包含語系eng與cht鍵的名稱，預設{}
+ * @param {Object} [opt.webDescription={}] 輸入站台描述物件，至少包含語系eng與cht鍵的名稱，預設{}
+ * @param {String} [opt.webLogo=''] 輸入站台logo字串，採base64格式，預設''
+ * @param {String} [opt.subfolder=''] 輸入站台所在子目錄字串，提供站台位於內網採反向代理進行服務時，故需支援位於子目錄情形，預設''
+ * @param {String} [opt.urlRedirect=''] 輸入錯誤時自動轉址字串，提供站台例如無法登入或驗證失敗時須自動轉址，預設''
+ * @param {String} [opt.mappingBy='email'] 輸入外部系統識別使用者token後所提供之資料物件，與權限系統之使用者資料物件，兩者間查找之對應欄位，可選'id'、'email'、'name'，預設'email'
+ * @returns {Object} 回傳物件，其內server為hapi伺服器實體，wsrv為w-converhp的伺服器事件物件，wsds為w-serv-webdata的伺服器事件物件，可監聽error事件
+ * @example
+ *
+ *
+ *
+ */
+function WWebSso(WOrm, url, db, getUserByToken, verifyBrowserUser, verifyAppUser, opt = {}) {
+    let instWServHapiServer = null
+
+
+    //check WOrm
+    if (!isfun(WOrm)) {
+        console.log('invalid WOrm', WOrm)
+        throw new Error('invalid WOrm')
+    }
+
+
+    //check url
+    if (!isestr(url)) {
+        console.log('invalid url', url)
+        throw new Error('invalid url')
+    }
+
+
+    //check db
+    if (!isestr(db)) {
+        console.log('invalid db', db)
+        throw new Error('invalid db')
+    }
+
+
+    //check getUserByToken
+    if (!isfun(getUserByToken)) {
+        console.log('invalid getUserByToken', getUserByToken)
+        throw new Error('invalid getUserByToken')
+    }
+
+
+    //check verifyBrowserUser
+    if (!isfun(verifyBrowserUser)) {
+        console.log('invalid verifyBrowserUser', verifyBrowserUser)
+        throw new Error('invalid verifyBrowserUser')
+    }
+
+
+    //check verifyAppUser
+    if (!isfun(verifyAppUser)) {
+        console.log('invalid verifyAppUser', verifyAppUser)
+        throw new Error('invalid verifyAppUser')
+    }
+
+
+    //serverPort
+    let serverPort = get(opt, 'serverPort')
+    if (!ispint(serverPort)) {
+        serverPort = 11007
+    }
+    serverPort = cint(serverPort)
+
+
+    //bCheckUser
+    let bCheckUser = get(opt, 'bCheckUser', false)
+
+
+    //getUserById
+    let getUserById = get(opt, 'getUserById', null)
+
+
+    //bExcludeWhenNotAdmin
+    let bExcludeWhenNotAdmin = get(opt, 'bExcludeWhenNotAdmin', false)
+
+
+    //webName
+    let webName = get(opt, 'webName', {})
+
+
+    //webDescription
+    let webDescription = get(opt, 'webDescription', {})
+
+
+    //webLogo
+    let webLogo = get(opt, 'webLogo', '')
+
+
+    //webBackgoundGradientColors
+    let webBackgoundGradientColors = get(opt, 'webBackgoundGradientColors', [])
+    if (!isearr(webBackgoundGradientColors)) {
+        webBackgoundGradientColors = ['#FFE0B2', '#FFCC80', '#FFF59D']
+    }
+
+
+    //webKey
+    let webKey = get(opt, 'webKey', '')
+
+
+    //salt
+    let salt = get(opt, 'salt', '')
+
+
+    //timeExpired
+    let timeExpired = get(opt, 'timeExpired', '')
+    if (ispnum(timeExpired)) {
+        timeExpired = 30
+    }
+
+    //subfolder
+    let subfolder = get(opt, 'subfolder', '')
+    if (isestr(subfolder)) {
+        if (strright(subfolder, 1) === '/') { //右邊不需要給「/」
+            subfolder = strdelright(subfolder, 1)
+        }
+        if (strleft(subfolder, 1) !== '/') { //左邊需要給「/」
+            subfolder = `/${subfolder}`
+        }
+    }
+
+
+    //urlRedirect
+    let urlRedirect = get(opt, 'urlRedirect', '')
+
+
+    //mappingBy
+    let mappingBy = get(opt, 'mappingBy', '')
+    if (mappingBy !== 'id' && mappingBy !== 'email' && mappingBy !== 'name') {
+        mappingBy = 'email'
+    }
+    // console.log('mappingBy', mappingBy)
+
+
+    //WServOrm
+    let optWServOrm = {
+        bCheckUser,
+        getUserById,
+        bExcludeWhenNotAdmin,
+    }
+    let wp = {}
+    try {
+        wp = WServOrm(ds, WOrm, url, db, optWServOrm)
+    }
+    catch (err) {
+        console.log(err)
+    }
+    let { woItems, procOrm } = wp
+
+
+    //getWebInfor
+    let getWebInfor = (_t) => {
+        return {
+            webName,
+            webDescription,
+            webLogo,
+            webBackgoundGradientColors,
+            webKey,
+        }
+    }
+
+
+    //proc
+    let p = proc(woItems, { salt, timeExpired })
+
+
+    //detect
+    let stCleanTokens = 'none'
+    setInterval(() => {
+        if (stCleanTokens === 'doing') {
+            return
+        }
+        stCleanTokens = 'doing'
+        p.cleanTokens()
+            .finally(() => {
+                stCleanTokens = 'none'
+            })
+    }, 1000)
+
+
+    // //parseToken
+    // let parseToken = (req) => {
+
+    //     //token
+    //     let token = get(req, 'query.token', '')
+    //     // console.log('token', token)
+
+    //     return token
+    // }
+
+
+    // //getTokenUser
+    // let getTokenUser = async(token) => {
+
+    //     //userSelf
+    //     let userSelf = null
+    //     if (isestr(token)) {
+    //         userSelf = getUserByToken(token)
+    //         if (ispm(userSelf)) {
+    //             userSelf = await userSelf
+    //         }
+    //     }
+    //     // console.log('userSelf', userSelf)
+
+    //     //check
+    //     if (!iseobj(userSelf)) {
+    //         console.log(`token`, token)
+    //         console.log(`can not find the user from token`)
+    //         return Promise.reject(`can not find the user from token`)
+    //     }
+
+    //     //check userSelf
+    //     if (true) {
+    //         let id = get(userSelf, 'id', '')
+    //         if (!isestr(id)) {
+    //             console.log('userSelf', userSelf)
+    //             console.log('can not get the userId')
+    //             return Promise.reject(`can not get the userId`)
+    //         }
+    //         let email = get(userSelf, 'email', '')
+    //         if (!isestr(email)) {
+    //             console.log('userSelf', userSelf)
+    //             console.log('can not get the email of user')
+    //             return Promise.reject(`can not get the email of user`)
+    //         }
+    //         let name = get(userSelf, 'name', '')
+    //         if (!isestr(name)) {
+    //             console.log('userSelf', userSelf)
+    //             console.log('can not get userName')
+    //             return Promise.reject(`can not get userName`)
+    //         }
+    //         let isAdmin = get(userSelf, 'isAdmin', '')
+    //         if (isAdmin !== 'y' && isAdmin !== 'n') {
+    //             console.log('userSelf', userSelf)
+    //             console.log('userSelf.isAdmin is not y or n', userSelf.isAdmin)
+    //             console.log('can not get the role of user')
+    //             return Promise.reject(`can not get the role of user`)
+    //         }
+    //     }
+
+    //     //須反查sso內users, 提供正規化屬性
+    //     let vSelf = get(userSelf, mappingBy, '')
+    //     // console.log('vSelf', vSelf)
+
+    //     //check
+    //     if (!isestr(vSelf)) {
+    //         console.log('userSelf', userSelf)
+    //         console.log('mappingBy', mappingBy)
+    //         console.log('can not get the prop of user by mappingBy')
+    //         return Promise.reject(`can not get the prop of user by mappingBy`)
+    //     }
+
+    //     //userFind
+    //     let userFind = await woItems.users.select({ [mappingBy]: vSelf, isActive: 'y' })
+    //     userFind = get(userFind, 0, null)
+    //     // console.log('userFind', userFind)
+
+    //     //check
+    //     if (!iseobj(userFind)) {
+    //         console.log('userSelf', userSelf)
+    //         console.log('mappingBy', mappingBy)
+    //         console.log('can not get the user from sso')
+    //         return Promise.reject(`can not get the user from sso`)
+    //     }
+
+    //     //複寫isAdmin
+    //     let isAdminSrc = get(userSelf, 'isAdmin', '')
+    //     let isAdminSelf = get(userFind, 'isAdmin', '')
+    //     if (isAdminSrc !== isAdminSelf) {
+    //         userFind.isAdmin = isAdminSelf
+    //     }
+    //     // console.log('userFind(isAdmin)', userFind)
+
+    //     return userFind
+    // }
+
+
+    // //getAndVerifyBrowserTokenUser
+    // let getAndVerifyBrowserTokenUser = async (token, caller = '') => {
+
+    //     //getTokenUser
+    //     let userSelf = await getTokenUser(token)
+
+    //     //verifyBrowserUser
+    //     let b = verifyBrowserUser(userSelf, caller)
+    //     if (ispm(b)) {
+    //         b = await b
+    //     }
+
+    //     //check
+    //     if (!b) {
+    //         console.log('userSelf', userSelf)
+    //         console.log(`user does not have permission`)
+    //         return Promise.reject(`user does not have permission`)
+    //     }
+
+    //     return userSelf
+    // }
+
+
+    // //getAndVerifyAppTokenUser
+    // let getAndVerifyAppTokenUser = async (token, caller = '') => {
+
+    //     //getTokenUser
+    //     let userSelf = await getTokenUser(token)
+
+    //     //verifyAppUser
+    //     let b = verifyAppUser(userSelf, caller)
+    //     if (ispm(b)) {
+    //         b = await b
+    //     }
+
+    //     //check
+    //     if (!b) {
+    //         console.log('userSelf', userSelf)
+    //         console.log(`user does not have permission`)
+    //         return Promise.reject(`user does not have permission`)
+    //     }
+
+    //     return userSelf
+    // }
+
+
+    // //parsePayload
+    // let parsePayload = async (req, key) => {
+
+    //     //inp
+    //     let inp = get(req, 'payload')
+
+    //     //to obj
+    //     if (isestr(inp)) {
+    //         inp = j2o(inp)
+    //     }
+
+    //     //check
+    //     if (!iseobj(inp)) {
+    //         console.log('inp', inp)
+    //         console.log('invalid inp from req')
+    //         return Promise.reject(`invalid inp from req`)
+    //     }
+
+    //     //from
+    //     let from = get(inp, 'from', '')
+
+    //     //check
+    //     if (!isestr(from)) {
+    //         console.log('inp', inp)
+    //         console.log('from', from)
+    //         console.log('invalid from from inp')
+    //         return Promise.reject(`invalid from from inp`)
+    //     }
+
+
+    //     //vs
+    //     let vs = get(inp, key, [])
+
+    //     //check
+    //     if (!isearr(vs)) {
+    //         console.log('inp', inp)
+    //         console.log(key, vs)
+    //         console.log(`invalid ${key} from inp`)
+    //         return Promise.reject(`invalid ${key} from inp`)
+    //     }
+
+    //     //resave
+    //     inp = {
+    //         from,
+    //         [key]: vs,
+    //     }
+
+    //     return inp
+    // }
+
+
+    // //syncAndReplaceRows
+    // let syncAndReplaceRows = async (params, key) => {
+
+    //     //from
+    //     let from = get(params, 'from', '')
+    //     // console.log('from', from)
+
+    //     //check
+    //     if (!isestr(from)) {
+    //         console.log('params', params)
+    //         console.log('from', from)
+    //         console.log(`invalid from`)
+    //         return Promise.reject(`invalid from`)
+    //     }
+
+    //     //vs
+    //     let vs = get(params, key, [])
+    //     // console.log(key, vs)
+
+    //     //check
+    //     if (!isearr(vs)) {
+    //         console.log('params', params)
+    //         console.log(key, vs)
+    //         console.log(`invalid ${key}`)
+    //         return Promise.reject(`invalid ${key}`)
+    //     }
+
+    //     //save from
+    //     each(vs, (v, k) => {
+    //         vs[k].from = from
+    //     })
+
+    //     //delAll from
+    //     await woItems[key].delAll({ from })
+
+    //     //insert
+    //     let r = await woItems[key].insert(vs)
+
+    //     return r
+    // }
+
+
+    //pathStaticFiles
+    let pathStaticFiles = 'dist'
+    let npmPathStaticFiles = './node_modules/w-web-sso/dist'
+    if (fsIsFolder(npmPathStaticFiles)) {
+        pathStaticFiles = npmPathStaticFiles
+    }
+    // console.log('pathStaticFiles', pathStaticFiles)
+
+
+    //subfolder
+    let fnEntryIn = 'index.tmp'
+    let fnEntryOut = 'index.html'
+    try {
+        let fpEntryIn = path.resolve(pathStaticFiles, fnEntryIn)
+        if (!fsIsFile(fpEntryIn)) {
+            fpEntryIn = path.resolve(pathStaticFiles, fnEntryOut) //本機開發另使用html替代tmp
+        }
+        if (!fsIsFile(fpEntryIn)) {
+            console.log('fpEntryIn', fpEntryIn)
+            throw new Error(`invalid fpEntryIn`)
+        }
+        let fpEntryOut = path.resolve(pathStaticFiles, fnEntryOut)
+        let c = fs.readFileSync(fpEntryIn, 'utf8')
+        c = replace(c, '/msso/', '{sfd}/') //方法同genEntry
+        c = replace(c, '{sfd}', subfolder)
+        c = replace(c, '{urlRedirect}', urlRedirect)
+        fs.writeFileSync(fpEntryOut, c, 'utf8')
+    }
+    catch (err) {
+        console.log(err)
+        console.log(`can not generate ${fnEntryOut}`)
+    }
+
+
+    //apis
+    let apis = [
+        // {
+        //     method: 'GET',
+        //     path: '/api/someAPI',
+        //     handler: async function (req, res) {
+
+        //         // //token
+        //         // let token = get(req, 'query.token', '')
+
+        //         return 'someAPI'
+        //     },
+        // },
+        {
+            method: 'GET',
+            path: '/getWebInfor',
+            handler: async function (req, res) {
+                return getWebInfor()
+            },
+        },
+        {
+            method: 'GET',
+            path: '/api/getUserByToken', //名稱getUserByToken為w-ui-loginout預設值, 若要更改兩邊須同時修改
+            handler: async function (req, res) {
+                // console.log('getUserByToken', req)
+
+                // async function core() {
+                //     //提供對象為browser使用者, 須先檢測token是否有效, 確認後回傳該使用者之資訊物件
+
+                //     //token
+                //     let token = get(req, 'query.token', '')
+                //     // console.log('token', token)
+
+                //     //getAndVerifyBrowserTokenUser
+                //     let userSelf = await getAndVerifyBrowserTokenUser(token, 'getUserByToken')
+                //     // console.log('userSelf', userSelf)
+
+                //     //check
+                //     if (!iseobj(userSelf)) {
+                //         console.log('token', token)
+                //         console.log('[API]getUserByToken/check userSelf: invalid userSelf')
+                //         console.log(`token does not have permission`)
+                //         return Promise.reject(`token does not have permission`)
+                //     }
+
+                //     return userSelf
+                // }
+
+                // //pm2resolve core
+                // let r = await pm2resolve(core)() //w-ui-loginout接收已預設格式用pm2resolve轉過, 須另提取state進行判斷
+                // // console.log('getUserByToken', r)
+
+                // return r
+
+                return null
+            },
+        },
+        {
+            method: 'GET',
+            path: '/api/getUsersByToken', //名稱getUserByToken為w-ui-loginout預設值, 若要更改兩邊須同時修改
+            handler: async function (req, res) {
+                // console.log('getUsersByToken', req)
+
+                // async function core() {
+                //     //提供對象為browser使用者, 須先檢測token是否有效, 確認後回傳該使用者之資訊物件
+
+                //     //token
+                //     let token = get(req, 'query.token', '')
+                //     // console.log('token', token)
+
+                //     //getAndVerifyBrowserTokenUser
+                //     let userSelf = await getAndVerifyBrowserTokenUser(token, 'getUsersByToken')
+                //     // console.log('userSelf', userSelf)
+
+                //     //check
+                //     if (!iseobj(userSelf)) {
+                //         console.log('token', token)
+                //         console.log('[API]getUserByToken/check userSelf: invalid userSelf')
+                //         console.log(`token does not have permission`)
+                //         return Promise.reject(`token does not have permission`)
+                //     }
+
+                //     return userSelf
+                // }
+
+                // //pm2resolve core
+                // let r = await pm2resolve(core)() //w-ui-loginout接收已預設格式用pm2resolve轉過, 須另提取state進行判斷
+                // // console.log('getUserByToken', r)
+
+                // return r
+
+                return null
+            },
+        },
+    ]
+
+
+    //tableNamesExec, tableNamesSync
+    let tableNamesExec = keys(ds)
+    // let tableNamesSync = filter(tableNamesExec, (v) => {
+    //     return strright(v, 5) !== 'Items'//不同步數據
+    // })
+    let tableNamesSync = []
+
+
+    //WServHapiServer
+    instWServHapiServer = new WServHapiServer({
+        port: opt.serverPort,
+        pathStaticFiles,
+        apis,
+        getUserIDFromToken: async (token) => { //可使用async或sync函數
+            return ''
+        },
+        useDbORM: true,
+        dbORMs: woItems,
+        operORM: procOrm, //procOrm的輸入為: userId, tableName, methodName, input
+        tableNamesExec,
+        methodsExec: ['select', 'insert', 'save', 'del', 'delAll'], //mix需於procOrm內註冊以提供
+        tableNamesSync,
+        extFuncs: { //接收參數第1個為userId, 之後才是前端給予參數
+            getWebInfor,
+            getUserByToken: (_t, token) => {
+                return p.getUserByToken(token)
+            },
+            loginByAccountAndPassword: (_t, account, password) => {
+                return p.loginByAccountAndPassword(account, password)
+            },
+            checkToken: (_t, token) => {
+                return p.checkToken(token)
+            },
+            refreshToken: (_t, token) => {
+                return p.refreshToken(token)
+            },
+            logOutByToken: (_t, token) => {
+                return p.logOutByToken(token)
+            },
+            getUsersList: (_t, token) => {
+                return p.getUsersList(token)
+            },
+            //...
+        },
+        hookBefores: null,
+        hookAfters: null,
+        fnTableTags: 'tableTags-web-sso.json',
+    })
+
+
+    return instWServHapiServer
+}
+
+
+export default WWebSso

package/server/hashPassword.mjs

@@ -0,0 +1,27 @@
+import get from 'lodash-es/get.js'
+import isestr from 'wsemi/src/isestr.mjs'
+import str2sha512 from 'wsemi/src/str2sha512.mjs'
+
+
+function hashPassword(pw, salt, opt = {}) {
+
+    //mode
+    let mode = get(opt, 'mode', '')
+    if (!isestr(mode)) {
+        mode = 'sha512'
+    }
+    if (mode !== 'sha512') {
+        throw new Error(`暫時不支援sha512以外方法`)
+    }
+
+    //加鹽
+    let t = `${pw}:${salt}`
+
+    //str2sha512
+    t = str2sha512(t)
+
+    return t
+}
+
+
+export default hashPassword