mirror of https://github.com/Budibase/budibase.git
Keviin Åberg Kultalahti
5 years ago
86 changed files with 5982 additions and 573 deletions
@ -0,0 +1,5 @@ |
|||||
|
const env = require("../src/environment") |
||||
|
|
||||
|
env._set("NODE_ENV", "jest") |
||||
|
env._set("JWT_SECRET", "test-jwtsecret") |
||||
|
env._set("LOG_LEVEL", "silent") |
||||
@ -0,0 +1,128 @@ |
|||||
|
const fetch = require("node-fetch") |
||||
|
const OIDCStrategy = require("@techpass/passport-openidconnect").Strategy |
||||
|
const { authenticateThirdParty } = require("./third-party-common") |
||||
|
|
||||
|
/** |
||||
|
* @param {*} issuer The identity provider base URL |
||||
|
* @param {*} sub The user ID |
||||
|
* @param {*} profile The user profile information. Created by passport from the /userinfo response |
||||
|
* @param {*} jwtClaims The parsed id_token claims |
||||
|
* @param {*} accessToken The access_token for contacting the identity provider - may or may not be a JWT |
||||
|
* @param {*} refreshToken The refresh_token for obtaining a new access_token - usually not a JWT |
||||
|
* @param {*} idToken The id_token - always a JWT |
||||
|
* @param {*} params The response body from requesting an access_token |
||||
|
* @param {*} done The passport callback: err, user, info |
||||
|
*/ |
||||
|
async function authenticate( |
||||
|
issuer, |
||||
|
sub, |
||||
|
profile, |
||||
|
jwtClaims, |
||||
|
accessToken, |
||||
|
refreshToken, |
||||
|
idToken, |
||||
|
params, |
||||
|
done |
||||
|
) { |
||||
|
const thirdPartyUser = { |
||||
|
// store the issuer info to enable sync in future
|
||||
|
provider: issuer, |
||||
|
providerType: "oidc", |
||||
|
userId: profile.id, |
||||
|
profile: profile, |
||||
|
email: getEmail(profile, jwtClaims), |
||||
|
oauth2: { |
||||
|
accessToken: accessToken, |
||||
|
refreshToken: refreshToken, |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
return authenticateThirdParty( |
||||
|
thirdPartyUser, |
||||
|
false, // don't require local accounts to exist
|
||||
|
done |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* @param {*} profile The structured profile created by passport using the user info endpoint |
||||
|
* @param {*} jwtClaims The claims returned in the id token |
||||
|
*/ |
||||
|
function getEmail(profile, jwtClaims) { |
||||
|
// profile not guaranteed to contain email e.g. github connected azure ad account
|
||||
|
if (profile._json.email) { |
||||
|
return profile._json.email |
||||
|
} |
||||
|
|
||||
|
// fallback to id token email
|
||||
|
if (jwtClaims.email) { |
||||
|
return jwtClaims.email |
||||
|
} |
||||
|
|
||||
|
// fallback to id token preferred username
|
||||
|
const username = jwtClaims.preferred_username |
||||
|
if (username && validEmail(username)) { |
||||
|
return username |
||||
|
} |
||||
|
|
||||
|
throw new Error( |
||||
|
`Could not determine user email from profile ${JSON.stringify( |
||||
|
profile |
||||
|
)} and claims ${JSON.stringify(jwtClaims)}` |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
function validEmail(value) { |
||||
|
return ( |
||||
|
value && |
||||
|
!!value.match( |
||||
|
/^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/ |
||||
|
) |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* Create an instance of the oidc passport strategy. This wrapper fetches the configuration |
||||
|
* from couchDB rather than environment variables, using this factory is necessary for dynamically configuring passport. |
||||
|
* @returns Dynamically configured Passport OIDC Strategy |
||||
|
*/ |
||||
|
exports.strategyFactory = async function (config, callbackUrl) { |
||||
|
try { |
||||
|
const { clientID, clientSecret, configUrl } = config |
||||
|
|
||||
|
if (!clientID || !clientSecret || !callbackUrl || !configUrl) { |
||||
|
throw new Error( |
||||
|
"Configuration invalid. Must contain clientID, clientSecret, callbackUrl and configUrl" |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
const response = await fetch(configUrl) |
||||
|
|
||||
|
if (!response.ok) { |
||||
|
throw new Error( |
||||
|
`Unexpected response when fetching openid-configuration: ${response.statusText}` |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
const body = await response.json() |
||||
|
|
||||
|
return new OIDCStrategy( |
||||
|
{ |
||||
|
issuer: body.issuer, |
||||
|
authorizationURL: body.authorization_endpoint, |
||||
|
tokenURL: body.token_endpoint, |
||||
|
userInfoURL: body.userinfo_endpoint, |
||||
|
clientID: clientID, |
||||
|
clientSecret: clientSecret, |
||||
|
callbackURL: callbackUrl, |
||||
|
}, |
||||
|
authenticate |
||||
|
) |
||||
|
} catch (err) { |
||||
|
console.error(err) |
||||
|
throw new Error("Error constructing OIDC authentication strategy", err) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// expose for testing
|
||||
|
exports.authenticate = authenticate |
||||
@ -0,0 +1,74 @@ |
|||||
|
// Mock data
|
||||
|
|
||||
|
const { data } = require("./utilities/mock-data") |
||||
|
|
||||
|
const googleConfig = { |
||||
|
callbackURL: "http://somecallbackurl", |
||||
|
clientID: data.clientID, |
||||
|
clientSecret: data.clientSecret, |
||||
|
} |
||||
|
|
||||
|
const profile = { |
||||
|
id: "mockId", |
||||
|
_json: { |
||||
|
email : data.email |
||||
|
}, |
||||
|
provider: "google" |
||||
|
} |
||||
|
|
||||
|
const user = data.buildThirdPartyUser("google", "google", profile) |
||||
|
|
||||
|
describe("google", () => { |
||||
|
describe("strategyFactory", () => { |
||||
|
// mock passport strategy factory
|
||||
|
jest.mock("passport-google-oauth") |
||||
|
const mockStrategy = require("passport-google-oauth").OAuth2Strategy |
||||
|
|
||||
|
it("should create successfully create a google strategy", async () => { |
||||
|
const google = require("../google") |
||||
|
|
||||
|
await google.strategyFactory(googleConfig) |
||||
|
|
||||
|
const expectedOptions = { |
||||
|
clientID: googleConfig.clientID, |
||||
|
clientSecret: googleConfig.clientSecret, |
||||
|
callbackURL: googleConfig.callbackURL, |
||||
|
} |
||||
|
|
||||
|
expect(mockStrategy).toHaveBeenCalledWith( |
||||
|
expectedOptions, |
||||
|
expect.anything() |
||||
|
) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("authenticate", () => { |
||||
|
afterEach(() => { |
||||
|
jest.clearAllMocks(); |
||||
|
}); |
||||
|
|
||||
|
// mock third party common authentication
|
||||
|
jest.mock("../third-party-common") |
||||
|
const authenticateThirdParty = require("../third-party-common").authenticateThirdParty |
||||
|
|
||||
|
// mock the passport callback
|
||||
|
const mockDone = jest.fn() |
||||
|
|
||||
|
it("delegates authentication to third party common", async () => { |
||||
|
const google = require("../google") |
||||
|
|
||||
|
await google.authenticate( |
||||
|
data.accessToken, |
||||
|
data.refreshToken, |
||||
|
profile, |
||||
|
mockDone |
||||
|
) |
||||
|
|
||||
|
expect(authenticateThirdParty).toHaveBeenCalledWith( |
||||
|
user, |
||||
|
true, |
||||
|
mockDone) |
||||
|
}) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
@ -0,0 +1,143 @@ |
|||||
|
// Mock data
|
||||
|
|
||||
|
const { data } = require("./utilities/mock-data") |
||||
|
|
||||
|
const issuer = "mockIssuer" |
||||
|
const sub = "mockSub" |
||||
|
const profile = { |
||||
|
id: "mockId", |
||||
|
_json: { |
||||
|
email : data.email |
||||
|
} |
||||
|
} |
||||
|
let jwtClaims = {} |
||||
|
const idToken = "mockIdToken" |
||||
|
const params = {} |
||||
|
|
||||
|
const callbackUrl = "http://somecallbackurl" |
||||
|
|
||||
|
// response from .well-known/openid-configuration
|
||||
|
const oidcConfigUrlResponse = { |
||||
|
issuer: issuer, |
||||
|
authorization_endpoint: "mockAuthorizationEndpoint", |
||||
|
token_endpoint: "mockTokenEndpoint", |
||||
|
userinfo_endpoint: "mockUserInfoEndpoint" |
||||
|
} |
||||
|
|
||||
|
const oidcConfig = { |
||||
|
configUrl: "http://someconfigurl", |
||||
|
clientID: data.clientID, |
||||
|
clientSecret: data.clientSecret, |
||||
|
} |
||||
|
|
||||
|
const user = data.buildThirdPartyUser(issuer, "oidc", profile) |
||||
|
|
||||
|
describe("oidc", () => { |
||||
|
describe("strategyFactory", () => { |
||||
|
// mock passport strategy factory
|
||||
|
jest.mock("@techpass/passport-openidconnect") |
||||
|
const mockStrategy = require("@techpass/passport-openidconnect").Strategy |
||||
|
|
||||
|
// mock the request to retrieve the oidc configuration
|
||||
|
jest.mock("node-fetch") |
||||
|
const mockFetch = require("node-fetch") |
||||
|
mockFetch.mockReturnValue({ |
||||
|
ok: true, |
||||
|
json: () => oidcConfigUrlResponse |
||||
|
}) |
||||
|
|
||||
|
it("should create successfully create an oidc strategy", async () => { |
||||
|
const oidc = require("../oidc") |
||||
|
|
||||
|
await oidc.strategyFactory(oidcConfig, callbackUrl) |
||||
|
|
||||
|
expect(mockFetch).toHaveBeenCalledWith(oidcConfig.configUrl) |
||||
|
|
||||
|
const expectedOptions = { |
||||
|
issuer: oidcConfigUrlResponse.issuer, |
||||
|
authorizationURL: oidcConfigUrlResponse.authorization_endpoint, |
||||
|
tokenURL: oidcConfigUrlResponse.token_endpoint, |
||||
|
userInfoURL: oidcConfigUrlResponse.userinfo_endpoint, |
||||
|
clientID: oidcConfig.clientID, |
||||
|
clientSecret: oidcConfig.clientSecret, |
||||
|
callbackURL: callbackUrl, |
||||
|
} |
||||
|
expect(mockStrategy).toHaveBeenCalledWith( |
||||
|
expectedOptions, |
||||
|
expect.anything() |
||||
|
) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("authenticate", () => { |
||||
|
afterEach(() => { |
||||
|
jest.clearAllMocks(); |
||||
|
}); |
||||
|
|
||||
|
// mock third party common authentication
|
||||
|
jest.mock("../third-party-common") |
||||
|
const authenticateThirdParty = require("../third-party-common").authenticateThirdParty |
||||
|
|
||||
|
// mock the passport callback
|
||||
|
const mockDone = jest.fn() |
||||
|
|
||||
|
async function doAuthenticate() { |
||||
|
const oidc = require("../oidc") |
||||
|
|
||||
|
await oidc.authenticate( |
||||
|
issuer, |
||||
|
sub, |
||||
|
profile, |
||||
|
jwtClaims, |
||||
|
data.accessToken, |
||||
|
data.refreshToken, |
||||
|
idToken, |
||||
|
params, |
||||
|
mockDone |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
async function doTest() { |
||||
|
await doAuthenticate() |
||||
|
|
||||
|
expect(authenticateThirdParty).toHaveBeenCalledWith( |
||||
|
user, |
||||
|
false, |
||||
|
mockDone) |
||||
|
} |
||||
|
|
||||
|
it("delegates authentication to third party common", async () => { |
||||
|
doTest() |
||||
|
}) |
||||
|
|
||||
|
it("uses JWT email to get email", async () => { |
||||
|
delete profile._json.email |
||||
|
jwtClaims = { |
||||
|
email : "mock@budibase.com" |
||||
|
} |
||||
|
|
||||
|
doTest() |
||||
|
}) |
||||
|
|
||||
|
it("uses JWT username to get email", async () => { |
||||
|
delete profile._json.email |
||||
|
jwtClaims = { |
||||
|
preferred_username : "mock@budibase.com" |
||||
|
} |
||||
|
|
||||
|
doTest() |
||||
|
}) |
||||
|
|
||||
|
it("uses JWT invalid username to get email", async () => { |
||||
|
delete profile._json.email |
||||
|
|
||||
|
jwtClaims = { |
||||
|
preferred_username : "invalidUsername" |
||||
|
} |
||||
|
|
||||
|
await expect(doAuthenticate()).rejects.toThrow("Could not determine user email from profile"); |
||||
|
}) |
||||
|
|
||||
|
}) |
||||
|
}) |
||||
|
|
||||
@ -0,0 +1,152 @@ |
|||||
|
// Mock data
|
||||
|
|
||||
|
require("./utilities/test-config") |
||||
|
|
||||
|
const database = require("../../../db") |
||||
|
const { authenticateThirdParty } = require("../third-party-common") |
||||
|
const { data } = require("./utilities/mock-data") |
||||
|
|
||||
|
const { |
||||
|
StaticDatabases, |
||||
|
generateGlobalUserID |
||||
|
} = require("../../../db/utils") |
||||
|
const { newid } = require("../../../hashing") |
||||
|
|
||||
|
let db |
||||
|
|
||||
|
const done = jest.fn() |
||||
|
|
||||
|
const getErrorMessage = () => { |
||||
|
return done.mock.calls[0][2].message |
||||
|
} |
||||
|
|
||||
|
describe("third party common", () => { |
||||
|
describe("authenticateThirdParty", () => { |
||||
|
let thirdPartyUser |
||||
|
|
||||
|
beforeEach(() => { |
||||
|
db = database.getDB(StaticDatabases.GLOBAL.name) |
||||
|
thirdPartyUser = data.buildThirdPartyUser() |
||||
|
}) |
||||
|
|
||||
|
afterEach(async () => { |
||||
|
jest.clearAllMocks() |
||||
|
await db.destroy() |
||||
|
}) |
||||
|
|
||||
|
describe("validation", () => { |
||||
|
const testValidation = async (message) => { |
||||
|
await authenticateThirdParty(thirdPartyUser, false, done) |
||||
|
expect(done.mock.calls.length).toBe(1) |
||||
|
expect(getErrorMessage()).toContain(message) |
||||
|
} |
||||
|
|
||||
|
it("provider fails", async () => { |
||||
|
delete thirdPartyUser.provider |
||||
|
testValidation("third party user provider required") |
||||
|
}) |
||||
|
|
||||
|
it("user id fails", async () => { |
||||
|
delete thirdPartyUser.userId |
||||
|
testValidation("third party user id required") |
||||
|
}) |
||||
|
|
||||
|
it("email fails", async () => { |
||||
|
delete thirdPartyUser.email |
||||
|
testValidation("third party user email required") |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
const expectUserIsAuthenticated = () => { |
||||
|
const user = done.mock.calls[0][1] |
||||
|
expect(user).toBeDefined() |
||||
|
expect(user._id).toBeDefined() |
||||
|
expect(user._rev).toBeDefined() |
||||
|
expect(user.token).toBeDefined() |
||||
|
return user |
||||
|
} |
||||
|
|
||||
|
const expectUserIsSynced = (user, thirdPartyUser) => { |
||||
|
expect(user.provider).toBe(thirdPartyUser.provider) |
||||
|
expect(user.email).toBe(thirdPartyUser.email) |
||||
|
expect(user.firstName).toBe(thirdPartyUser.profile.name.givenName) |
||||
|
expect(user.lastName).toBe(thirdPartyUser.profile.name.familyName) |
||||
|
expect(user.thirdPartyProfile).toStrictEqual(thirdPartyUser.profile._json) |
||||
|
expect(user.oauth2).toStrictEqual(thirdPartyUser.oauth2) |
||||
|
} |
||||
|
|
||||
|
describe("when the user doesn't exist", () => { |
||||
|
describe("when a local account is required", () => { |
||||
|
it("returns an error message", async () => { |
||||
|
await authenticateThirdParty(thirdPartyUser, true, done) |
||||
|
expect(done.mock.calls.length).toBe(1) |
||||
|
expect(getErrorMessage()).toContain("Email does not yet exist. You must set up your local budibase account first.") |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("when a local account isn't required", () => { |
||||
|
it("creates and authenticates the user", async () => { |
||||
|
await authenticateThirdParty(thirdPartyUser, false, done) |
||||
|
const user = expectUserIsAuthenticated() |
||||
|
expectUserIsSynced(user, thirdPartyUser) |
||||
|
expect(user.roles).toStrictEqual({}) |
||||
|
}) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("when the user exists", () => { |
||||
|
let dbUser |
||||
|
let id |
||||
|
let email |
||||
|
|
||||
|
const createUser = async () => { |
||||
|
dbUser = { |
||||
|
_id: id, |
||||
|
email: email, |
||||
|
} |
||||
|
const response = await db.post(dbUser) |
||||
|
dbUser._rev = response.rev |
||||
|
} |
||||
|
|
||||
|
const expectUserIsUpdated = (user) => { |
||||
|
// id is unchanged
|
||||
|
expect(user._id).toBe(id) |
||||
|
// user is updated
|
||||
|
expect(user._rev).not.toBe(dbUser._rev) |
||||
|
} |
||||
|
|
||||
|
describe("exists by email", () => { |
||||
|
beforeEach(async () => { |
||||
|
id = generateGlobalUserID(newid()) // random id
|
||||
|
email = thirdPartyUser.email // matching email
|
||||
|
await createUser() |
||||
|
}) |
||||
|
|
||||
|
it("syncs and authenticates the user", async () => { |
||||
|
await authenticateThirdParty(thirdPartyUser, true, done) |
||||
|
|
||||
|
const user = expectUserIsAuthenticated() |
||||
|
expectUserIsSynced(user, thirdPartyUser) |
||||
|
expectUserIsUpdated(user) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
|
describe("exists by id", () => { |
||||
|
beforeEach(async () => { |
||||
|
id = generateGlobalUserID(thirdPartyUser.userId) // matching id
|
||||
|
email = "test@test.com" // random email
|
||||
|
await createUser() |
||||
|
}) |
||||
|
|
||||
|
it("syncs and authenticates the user", async () => { |
||||
|
await authenticateThirdParty(thirdPartyUser, true, done) |
||||
|
|
||||
|
const user = expectUserIsAuthenticated() |
||||
|
expectUserIsSynced(user, thirdPartyUser) |
||||
|
expectUserIsUpdated(user) |
||||
|
}) |
||||
|
}) |
||||
|
}) |
||||
|
}) |
||||
|
}) |
||||
|
|
||||
@ -0,0 +1,20 @@ |
|||||
|
const PouchDB = require("pouchdb") |
||||
|
const allDbs = require("pouchdb-all-dbs") |
||||
|
const env = require("../../../../environment") |
||||
|
|
||||
|
let POUCH_DB_DEFAULTS |
||||
|
|
||||
|
// should always be test but good to do the sanity check
|
||||
|
if (env.isTest()) { |
||||
|
PouchDB.plugin(require("pouchdb-adapter-memory")) |
||||
|
POUCH_DB_DEFAULTS = { |
||||
|
prefix: undefined, |
||||
|
adapter: "memory", |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
const Pouch = PouchDB.defaults(POUCH_DB_DEFAULTS) |
||||
|
|
||||
|
allDbs(Pouch) |
||||
|
|
||||
|
module.exports = Pouch |
||||
@ -0,0 +1,54 @@ |
|||||
|
// Mock Data
|
||||
|
|
||||
|
const mockClientID = "mockClientID" |
||||
|
const mockClientSecret = "mockClientSecret" |
||||
|
|
||||
|
const mockEmail = "mock@budibase.com" |
||||
|
const mockAccessToken = "mockAccessToken" |
||||
|
const mockRefreshToken = "mockRefreshToken" |
||||
|
|
||||
|
const mockProvider = "mockProvider" |
||||
|
const mockProviderType = "mockProviderType" |
||||
|
|
||||
|
const mockProfile = { |
||||
|
id: "mockId", |
||||
|
name: { |
||||
|
givenName: "mockGivenName", |
||||
|
familyName: "mockFamilyName", |
||||
|
}, |
||||
|
_json: { |
||||
|
email: mockEmail, |
||||
|
}, |
||||
|
} |
||||
|
|
||||
|
const buildOauth2 = ( |
||||
|
accessToken = mockAccessToken, |
||||
|
refreshToken = mockRefreshToken |
||||
|
) => ({ |
||||
|
accessToken: accessToken, |
||||
|
refreshToken: refreshToken, |
||||
|
}) |
||||
|
|
||||
|
const buildThirdPartyUser = ( |
||||
|
provider = mockProvider, |
||||
|
providerType = mockProviderType, |
||||
|
profile = mockProfile, |
||||
|
email = mockEmail, |
||||
|
oauth2 = buildOauth2() |
||||
|
) => ({ |
||||
|
provider: provider, |
||||
|
providerType: providerType, |
||||
|
userId: profile.id, |
||||
|
profile: profile, |
||||
|
email: email, |
||||
|
oauth2: oauth2, |
||||
|
}) |
||||
|
|
||||
|
exports.data = { |
||||
|
clientID: mockClientID, |
||||
|
clientSecret: mockClientSecret, |
||||
|
email: mockEmail, |
||||
|
accessToken: mockAccessToken, |
||||
|
refreshToken: mockRefreshToken, |
||||
|
buildThirdPartyUser, |
||||
|
} |
||||
@ -0,0 +1,3 @@ |
|||||
|
const packageConfiguration = require("../../../../index") |
||||
|
const CouchDB = require("./db") |
||||
|
packageConfiguration.init(CouchDB) |
||||
@ -0,0 +1,129 @@ |
|||||
|
const env = require("../../environment") |
||||
|
const jwt = require("jsonwebtoken") |
||||
|
const database = require("../../db") |
||||
|
const { StaticDatabases, generateGlobalUserID } = require("../../db/utils") |
||||
|
const { authError } = require("./utils") |
||||
|
const { newid } = require("../../hashing") |
||||
|
const { createASession } = require("../../security/sessions") |
||||
|
const { getGlobalUserByEmail } = require("../../utils") |
||||
|
|
||||
|
/** |
||||
|
* Common authentication logic for third parties. e.g. OAuth, OIDC. |
||||
|
*/ |
||||
|
exports.authenticateThirdParty = async function ( |
||||
|
thirdPartyUser, |
||||
|
requireLocalAccount = true, |
||||
|
done |
||||
|
) { |
||||
|
if (!thirdPartyUser.provider) |
||||
|
return authError(done, "third party user provider required") |
||||
|
if (!thirdPartyUser.userId) |
||||
|
return authError(done, "third party user id required") |
||||
|
if (!thirdPartyUser.email) |
||||
|
return authError(done, "third party user email required") |
||||
|
|
||||
|
const db = database.getDB(StaticDatabases.GLOBAL.name) |
||||
|
|
||||
|
let dbUser |
||||
|
|
||||
|
// use the third party id
|
||||
|
const userId = generateGlobalUserID(thirdPartyUser.userId) |
||||
|
|
||||
|
// try to load by id
|
||||
|
try { |
||||
|
dbUser = await db.get(userId) |
||||
|
} catch (err) { |
||||
|
// abort when not 404 error
|
||||
|
if (!err.status || err.status !== 404) { |
||||
|
return authError( |
||||
|
done, |
||||
|
"Unexpected error when retrieving existing user", |
||||
|
err |
||||
|
) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// fallback to loading by email
|
||||
|
if (!dbUser) { |
||||
|
dbUser = await getGlobalUserByEmail(thirdPartyUser.email) |
||||
|
} |
||||
|
|
||||
|
// exit early if there is still no user and auto creation is disabled
|
||||
|
if (!dbUser && requireLocalAccount) { |
||||
|
return authError( |
||||
|
done, |
||||
|
"Email does not yet exist. You must set up your local budibase account first." |
||||
|
) |
||||
|
} |
||||
|
|
||||
|
// first time creation
|
||||
|
if (!dbUser) { |
||||
|
// setup a blank user using the third party id
|
||||
|
dbUser = { |
||||
|
_id: userId, |
||||
|
roles: {}, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
dbUser = syncUser(dbUser, thirdPartyUser) |
||||
|
|
||||
|
// create or sync the user
|
||||
|
const response = await db.post(dbUser) |
||||
|
dbUser._rev = response.rev |
||||
|
|
||||
|
// authenticate
|
||||
|
const sessionId = newid() |
||||
|
await createASession(dbUser._id, sessionId) |
||||
|
|
||||
|
dbUser.token = jwt.sign( |
||||
|
{ |
||||
|
userId: dbUser._id, |
||||
|
sessionId, |
||||
|
}, |
||||
|
env.JWT_SECRET |
||||
|
) |
||||
|
|
||||
|
return done(null, dbUser) |
||||
|
} |
||||
|
|
||||
|
/** |
||||
|
* @returns a user that has been sync'd with third party information |
||||
|
*/ |
||||
|
function syncUser(user, thirdPartyUser) { |
||||
|
// provider
|
||||
|
user.provider = thirdPartyUser.provider |
||||
|
user.providerType = thirdPartyUser.providerType |
||||
|
|
||||
|
// email
|
||||
|
user.email = thirdPartyUser.email |
||||
|
|
||||
|
if (thirdPartyUser.profile) { |
||||
|
const profile = thirdPartyUser.profile |
||||
|
|
||||
|
if (profile.name) { |
||||
|
const name = profile.name |
||||
|
// first name
|
||||
|
if (name.givenName) { |
||||
|
user.firstName = name.givenName |
||||
|
} |
||||
|
// last name
|
||||
|
if (name.familyName) { |
||||
|
user.lastName = name.familyName |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// profile
|
||||
|
user.thirdPartyProfile = { |
||||
|
...profile._json, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// oauth tokens for future use
|
||||
|
if (thirdPartyUser.oauth2) { |
||||
|
user.oauth2 = { |
||||
|
...thirdPartyUser.oauth2, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return user |
||||
|
} |
||||
@ -0,0 +1,14 @@ |
|||||
|
/** |
||||
|
* Utility to handle authentication errors. |
||||
|
* |
||||
|
* @param {*} done The passport callback. |
||||
|
* @param {*} message Message that will be returned in the response body |
||||
|
* @param {*} err (Optional) error that will be logged |
||||
|
*/ |
||||
|
exports.authError = function (done, message, err = null) { |
||||
|
return done( |
||||
|
err, |
||||
|
null, // never return a user
|
||||
|
{ message: message } |
||||
|
) |
||||
|
} |
||||
File diff suppressed because it is too large
|
After Width: | Height: | Size: 25 KiB |
|
After Width: | Height: | Size: 4.3 KiB |
|
After Width: | Height: | Size: 20 KiB |
|
After Width: | Height: | Size: 24 KiB |
|
After Width: | Height: | Size: 7.2 KiB |
@ -0,0 +1,59 @@ |
|||||
|
<script> |
||||
|
import { ActionButton } from "@budibase/bbui" |
||||
|
import OidcLogo from "assets/oidc-logo.png" |
||||
|
import Auth0Logo from "assets/auth0-logo.png" |
||||
|
import MicrosoftLogo from "assets/microsoft-logo.png" |
||||
|
import OktaLogo from "assets/okta-logo.png" |
||||
|
import OneLoginLogo from "assets/onelogin-logo.png" |
||||
|
|
||||
|
import { oidc, organisation } from "stores/portal" |
||||
|
import { onMount } from "svelte" |
||||
|
|
||||
|
$: show = $organisation.oidc |
||||
|
|
||||
|
let preDefinedIcons = { |
||||
|
Oidc: OidcLogo, |
||||
|
Auth0: Auth0Logo, |
||||
|
Microsoft: MicrosoftLogo, |
||||
|
Okta: OktaLogo, |
||||
|
OneLogin: OneLoginLogo, |
||||
|
} |
||||
|
|
||||
|
onMount(async () => { |
||||
|
await oidc.init() |
||||
|
}) |
||||
|
|
||||
|
$: src = !$oidc.logo |
||||
|
? OidcLogo |
||||
|
: preDefinedIcons[$oidc.logo] || `/global/logos_oidc/${$oidc.logo}` |
||||
|
</script> |
||||
|
|
||||
|
{#if show} |
||||
|
<ActionButton |
||||
|
on:click={() => |
||||
|
window.open(`/api/admin/auth/oidc/configs/${$oidc.uuid}`, "_blank")} |
||||
|
> |
||||
|
<div class="inner"> |
||||
|
<img {src} alt="oidc icon" /> |
||||
|
<p>{`Sign in with ${$oidc.name || "OIDC"}`}</p> |
||||
|
</div> |
||||
|
</ActionButton> |
||||
|
{/if} |
||||
|
|
||||
|
<style> |
||||
|
.inner { |
||||
|
display: flex; |
||||
|
flex-direction: row; |
||||
|
align-items: center; |
||||
|
justify-content: center; |
||||
|
padding-top: var(--spacing-xs); |
||||
|
padding-bottom: var(--spacing-xs); |
||||
|
} |
||||
|
.inner img { |
||||
|
width: 18px; |
||||
|
margin: 3px 10px 3px 3px; |
||||
|
} |
||||
|
.inner p { |
||||
|
margin: 0; |
||||
|
} |
||||
|
</style> |
||||
|
After Width: | Height: | Size: 319 B |
@ -1,13 +0,0 @@ |
|||||
<script> |
|
||||
import { goto } from "@roxi/routify" |
|
||||
|
|
||||
export let value |
|
||||
</script> |
|
||||
|
|
||||
<span on:click={() => $goto(`./${value}`)}>{value}</span> |
|
||||
|
|
||||
<style> |
|
||||
span { |
|
||||
text-transform: capitalize; |
|
||||
} |
|
||||
</style> |
|
||||
@ -0,0 +1,33 @@ |
|||||
|
import { writable } from "svelte/store" |
||||
|
import api from "builderStore/api" |
||||
|
|
||||
|
const OIDC_CONFIG = { |
||||
|
logo: undefined, |
||||
|
name: undefined, |
||||
|
uuid: undefined, |
||||
|
} |
||||
|
|
||||
|
export function createOidcStore() { |
||||
|
const store = writable(OIDC_CONFIG) |
||||
|
const { set, subscribe } = store |
||||
|
|
||||
|
async function init() { |
||||
|
const res = await api.get(`/api/admin/configs/publicOidc`) |
||||
|
const json = await res.json() |
||||
|
|
||||
|
if (json.status === 400) { |
||||
|
set(OIDC_CONFIG) |
||||
|
} else { |
||||
|
// Just use the first config for now. We will be support multiple logins buttons later on.
|
||||
|
set(...json) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
return { |
||||
|
subscribe, |
||||
|
set, |
||||
|
init, |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
export const oidc = createOidcStore() |
||||
Loading…
Reference in new issue