root
/
telebit-relay.js
mirror of https://git.coolaj86.com/coolaj86/telebit-relay.js.git
2
0
Fork 0
Code Issues Releases Wiki Activity
telebit-relay.js/lib/extensions/index.js

1178 lines
37 KiB
JavaScript
Raw Blame History

'use strict';
var PromiseA;
try {
PromiseA = require('bluebird');
} catch(e) {
PromiseA = global.Promise;
}
var fs = require('fs');
var sfs = require('safe-replace').create({ tmp: 'tmp', bak: 'bak' });
var path = require('path');
var util = require('util');
var crypto = require('crypto');
var escapeHtml = require('escape-html');
var jwt = require('jsonwebtoken');
var requestAsync = util.promisify(require('@coolaj86/urequest'));
//var readFileAsync = util.promisify(fs.readFile);
var mkdirpAsync = util.promisify(require('mkdirp'));
var TRUSTED_ISSUERS = [ 'oauth3.org' ];
var DB = {};
DB._savefile = path.join(__dirname, 'permissions.json');
DB._load = function () {
try {
DB._perms = require(DB._savefile);
} catch(e) {
try {
DB._perms = require(DB._savefile + '.bak');
} catch(e) {
DB._perms = [];
}
}
DB._byDomain = {};
DB._byPort = {};
DB._byEmail = {};
DB._byPpid = {};
DB._byId = {};
DB._grants = {};
DB._grantsMap = {};
DB._perms.forEach(function (acc) {
if (acc.id) {
// if account has an id
DB._byId[acc.id] = acc;
if (!DB._grants[acc.id]) {
DB._grantsMap[acc.id] = {};
DB._grants[acc.id] = [];
}
acc.domains.forEach(function (d) {
DB._grants[d.name + '|id|' + acc.id] = true;
if (!DB._grantsMap[acc.id][d.name]) {
DB._grantsMap[acc.id][d.name] = d;
DB._grants[acc.id].push(d);
}
});
acc.ports.forEach(function (p) {
DB._grants[p.number + '|id|' + acc.id] = true;
if (!DB._grantsMap[acc.id][p.number]) {
DB._grantsMap[acc.id][p.number] = p;
DB._grants[acc.id].push(p);
}
});
} else if (acc.nodes[0] && 'email' === acc.nodes[0].type) {
// if primary (first) node is email
//console.log("XXXX email", acc.nodes[0].name);
if (!DB._byEmail[acc.nodes[0].name]) {
DB._byEmail[acc.nodes[0].name] = {
account: acc
, node: acc.nodes[0]
};
}
}
// map domains to all nodes that have permission
// (which permission could be granted by more than one account)
acc.nodes.forEach(function (node) {
if ('mailto' === node.scheme || 'email' === node.type) {
if (!DB._grants[node.name]) {
DB._grantsMap[node.name] = {};
DB._grants[node.name] = [];
}
acc.domains.forEach(function (d) {
DB._grants[d.name + '|' + (node.scheme||node.type) + '|' + node.name] = true;
if (!DB._grantsMap[node.name][d.name]) {
DB._grantsMap[node.name][d.name] = d;
DB._grants[node.name].push(d);
}
});
acc.ports.forEach(function (p) {
DB._grants[p.number + '|' + (node.scheme||node.type) + '|' + node.name] = true;
if (!DB._grantsMap[node.name][p.number]) {
DB._grantsMap[node.name][p.number] = p;
DB._grants[node.name].push(p);
}
});
}
});
// TODO this also should be maps/arrays (... or just normal database)
acc.domains.forEach(function (domain) {
if (DB._byDomain[domain.name]) {
console.warn("duplicate domain '" + domain.name + "'");
console.warn("::existing account '" + acc.nodes.map(function (node) { return node.name; }) + "'");
console.warn("::new account '" + DB._byDomain[domain.name].account.nodes.map(function (node) { return node.name; }) + "'");
}
DB._byDomain[domain.name] = {
account: acc
, domain: domain
};
});
acc.ports.forEach(function (port) {
if (DB._byPort[port.number]) {
console.warn("duplicate port '" + port.number + "'");
console.warn("::existing account '" + acc.nodes.map(function (node) { return node.name; }) + "'");
console.warn("::new account '" + DB._byPort[port.number].account.nodes.map(function (node) { return node.name; }) + "'");
}
DB._byPort[port.number] = {
account: acc
, port: port
};
});
});
};
DB._load();
DB.accounts = {};
DB.accounts.get = function (obj) {
return PromiseA.resolve().then(function () {
//console.log('XXXX obj.name', DB._byEmail[obj.name]);
return DB._byId[obj.name] || (DB._byEmail[obj.name] || {}).account || null;
});
};
DB.accounts.add = function (obj) {
return PromiseA.resolve().then(function () {
if (obj.id) {
// TODO more checks
DB._perms.push(obj);
} else if ('email' === obj.nodes[0].type || obj.email) {
obj.email = undefined;
DB._perms.push(obj);
}
});
};
DB.domains = {};
DB.domains.available = function (name) {
return PromiseA.resolve().then(function () {
return !DB._byDomain[name];
});
};
DB.domains._add = function (acc, opts) {
// TODO verifications to change ownership of a domain
return PromiseA.resolve().then(function () {
var err;
//var acc = DB._byId[aid];
var domain = {
name: (opts.domain || opts.name)
, hostname: opts.hostname
, os: opts.os
, createdAt: new Date().toISOString()
, wildcard: opts.wildcard
};
var pdomain;
var parts = (opts.domain || domain.name).split('.').map(function (el, i, arr) {
return arr.slice(i).join('.');
}).reverse();
parts.shift();
parts.pop();
if (parts.some(function (part) {
if (DB._byDomain[part]) {
pdomain = part;
return true;
}
})) {
err = new Error("'" + domain.name + "' exists as '" + pdomain + "' and therefore requires an admin to review and approve");
err.code = "E_REQ_ADMIN";
throw err;
}
if (DB._byDomain[domain.name]) {
if (acc !== DB._byDomain[domain.name].account) {
throw new Error("domain '" + domain.name + "' exists");
}
// happily ignore non-change
return;
}
DB._byDomain[domain.name] = {
account: acc
, domain: domain
};
acc.domains.push(domain);
});
};
DB.ports = {};
DB.ports.available = function (number) {
return PromiseA.resolve().then(function () {
return !DB._byPort[number];
});
};
DB.ports._add = function (acc, opts) {
return PromiseA.resolve().then(function () {
//var acc = DB._byId[aid];
var port = {
number: opts.port || opts.number
, hostname: opts.hostname
, os: opts.os
, createdAt: new Date().toISOString()
};
if (DB._byPort[port.number]) {
// TODO verifications
throw new Error("port '" + port.number + "' exists");
}
DB._byPort[port.number] = {
account: acc
, port: port
};
acc.ports.push(port);
});
};
DB._save = function () {
return sfs.writeFileAsync(DB._savefile, JSON.stringify(DB._perms));
};
DB._saveToken = null;
DB._savePromises = [];
DB._savePromise = PromiseA.resolve();
DB.save = function () {
clearTimeout(DB._saveToken);
return new PromiseA(function (resolve, reject) {
function doSave() {
DB._savePromise = DB._savePromise.then(function () {
return DB._save().then(function (yep) {
DB._savePromises.forEach(function (p) {
p.resolve(yep);
});
DB._savePromises.length = 1;
}, function (err) {
DB._savePromises.forEach(function (p) {
p.reject(err);
});
DB._savePromises.length = 1;
});
});
return DB._savePromise;
}
DB._saveToken = setTimeout(doSave, 2500);
DB._savePromises.push({ resolve: resolve, reject: reject });
});
};
var _auths = module.exports._auths = {};
var Auths = {};
Auths._no_pin = {
toString: function () {
return Math.random().toString();
}
};
Auths.get = function (idOrSecret) {
var auth = _auths[idOrSecret];
if (!auth) { return; }
if (auth.exp && auth.exp < Date.now()) { return; }
return auth;
};
Auths.getBySecret = function (secret) {
var auth = Auths.get(secret);
if (!auth) { return; }
if (!crypto.timingSafeEqual(
Buffer.from(auth.secret.padStart(127, ' '))
, Buffer.from((secret || '').padStart(127, ' '))
)) {
return;
}
return auth;
};
Auths.getBySecretAndPin = function (secret, pin) {
var auth = Auths.getBySecret(secret);
if (!auth) { return; }
// TODO v1.0.0 : Security XXX : clients must define a pin
// 1. Check if the client defined a pin (it should)
if (auth.pin === Auths._no_pin) {
// 2. If the browser defined a pin, it should be some variation of 000 000
if (pin && 0 !== parseInt(pin, 10)) { return; }
} else if (!crypto.timingSafeEqual(
Buffer.from(auth.pin.toString().padStart(127, ' '))
, Buffer.from((pin || '').padStart(127, ' '))
)) {
// 3. The client defined a pin and it doesn't match what the browser defined
return;
}
return auth;
};
Auths.set = function (auth, id, secret) {
auth.id = auth.id || id || crypto.randomBytes(12).toString('hex');
auth.secret = auth.secret || secret || crypto.randomBytes(12).toString('hex');
_auths[auth.id] = auth;
_auths[auth.secret] = auth;
return auth;
};
Auths._clean = function () {
Object.keys(_auths).forEach(function (key) {
var err;
if (_auths[key]) {
if (_auths[key].exp < Date.now()) {
if ('function' === typeof _auths[key].reject) {
err = new Error("Login Failure: Magic Link was not clicked within 5 minutes");
err.code = 'E_LOGIN_TIMEOUT';
_auths[key].reject(err);
}
_auths[key] = null;
delete _auths[key];
}
}
});
};
var sfs = require('safe-replace');
var Accounts = {};
Accounts._getTokenId = function (auth) {
return auth.data.sub + '@' + (auth.data.iss||'').replace(/\/|\\/g, '-');
};
Accounts._accPath = function (req, accId) {
return path.join(req._state.config.accountsDir, 'self', accId);
};
Accounts._subPath = function (req, id) {
return path.join(req._state.config.accountsDir, 'oauth3', id);
};
Accounts._setSub = function (req, id, subData) {
var subpath = Accounts._subPath(req, id);
return mkdirpAsync(subpath).then(function () {
return sfs.writeFileAsync(path.join(subpath, 'index.json'), JSON.stringify(subData));
});
};
Accounts._setAcc = function (req, accId, acc) {
var accpath = Accounts._accPath(req, accId);
return mkdirpAsync(accpath).then(function () {
return sfs.writeFileAsync(path.join(accpath, 'index.json'), JSON.stringify(acc));
});
};
Accounts.create = function (req) {
var id = Accounts._getTokenId(req.auth);
var acc = {
sub: crypto.randomBytes(16).toString('hex')
// TODO use something from the request to know which of the domains to use
, iss: req._state.config.webminDomain
, contacts: []
};
var accId = Accounts._getTokenId(acc);
acc.id = accId;
// TODO notify any non-authorized accounts that they've been added?
return Accounts.getBySub(req).then(function (subData) {
subData.accounts.push({ type: 'self', id: accId });
acc.contacts.push({ type: 'oauth3', id: subData.id, sub: subData.sub, iss: subData.iss });
return Accounts._setSub(req, id, subData).then(function () {
return Accounts._setAcc(req, accId, acc).then(function () {
return acc;
});
});
});
};
/*
// TODO an owner of an asset can give permission to another entity
// but that does not mean that that owner has access to that entity's things
// Example:
// A 3rd party login's email verification cannot be trusted for auth
// Only 1st party verifications can be trusted for authorization
Accounts.link = function (req) {
};
*/
Accounts.getOrCreate = function (req) {
var id = Accounts._getTokenId(req.auth);
var idNode = { createdAt: new Date().toISOString(), type: 'ppid', name: id };
return DB.accounts.get(idNode).then(function (acc) {
if (acc) { return acc; }
acc = { createdAt: idNode.createdAt, id: id, sub: req.auth.sub, iss: req.auth.iss,
domains: [], ports: [], nodes: [ idNode ] };
return DB.accounts.add(acc).then(function () {
// intentionally not returned to the promise chain
DB.save().catch(function (err) {
console.error('DB.save() failed:');
console.error(err);
});
return acc;
});
});
};
function sendMail(state, auth) {
console.log('[DEBUG] ext auth', auth);
/*
curl -s --user 'api:YOUR_API_KEY' \
https://api.mailgun.net/v3/YOUR_DOMAIN_NAME/messages \
-F from='Excited User <mailgun@YOUR_DOMAIN_NAME>' \
-F to=YOU@YOUR_DOMAIN_NAME \
-F to=bar@example.com \
-F subject='Hello' \
-F text='Testing some Mailgun awesomeness!'
*/
var subj = 'Confirm New Device Connection';
var text = "You tried connecting with '{{hostname}}' for the first time. Confirm to continue connecting:\n"
+ '\n'
+ ' https://' + state.config.webminDomain + '/login/#/magic={{secret}}\n'
+ '\n'
+ "({{os_arch}} {{os_platform}} {{os_release}})\n"
+ '\n'
;
var html = "You tried connecting with '{{hostname}}' for the first time. Confirm to continue connecting:<br>"
+ '<br>'
+ '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href="https://' + state.config.webminDomain + '/login/#/magic={{secret}}">Confirm Device</a><br>'
+ '<br>'
+ '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <small>or copy and paste this link:</small><br>'
+ '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <small>https://' + state.config.webminDomain + '/login/#/magic={{secret}}</small><br>'
+ '<br>'
+ "({{os_arch}} {{os_platform}} {{os_release}})<br>"
+ '<br>'
;
[ 'id', 'secret', 'hostname', 'os_arch', 'os_platform', 'os_release' ].forEach(function (key) {
var val = escapeHtml(auth[key]);
subj = subj.replace(new RegExp('{{' + key + '}}', 'g'), val);
text = text.replace(new RegExp('{{' + key + '}}', 'g'), val);
html = html.replace(new RegExp('{{' + key + '}}', 'g'), val);
});
return requestAsync({
url: state.config.mailer.url
, method: 'POST'
, auth: { user: 'api', pass: state.config.mailer.apiKey }
, formData: {
from: state.config.mailer.from
, to: auth.subject
, subject: subj
, text: text
, html: html
}
}).then(function (resp) {
var pathname = path.join(__dirname, 'emails', auth.subject);
fs.writeFile(pathname, JSON.stringify(auth), function (err) {
if (err) {
console.error('[ERROR] in writing auth details');
console.error(err);
}
});
// anything in the 200 range
if (2 === Math.floor(resp.statusCode / 100)) {
console.log("[DEBUG] email was sent, or so they say");
} else {
console.error("[Error] email failed to send, or so they say:");
console.error(resp.headers);
console.error(resp.statusCode, resp.body);
return PromiseA.reject(new Error("Error sending email: " + resp.statusCode + " " + resp.body));
}
});
}
// TODO replace with OAuth3 function
function oauth3Auth(req, res, next) {
var jwt = require('jsonwebtoken');
var verifyJwt = util.promisify(jwt.verify);
var token = (req.headers.authorization||'').replace(/^bearer /i, '');
var auth;
var authData;
if (!token) {
res.send({
error: {
code: "E_NOAUTH"
, message: "no authorization header"
}
});
return;
}
try {
authData = jwt.decode(token, { complete: true });
} catch(e) {
authData = null;
}
if (!authData) {
res.send({
error: {
code: "E_PARSEAUTH"
, message: "could not parse authorization header as JWT"
}
});
return;
}
auth = authData.payload;
if (!auth.sub && ('*' === auth.aud || '*' === auth.azp)) {
res.send({
error: {
code: "E_NOIMPL"
, message: "missing 'sub' and a wildcard 'azp' or 'aud' indicates that this is an exchange token,"
+ " however, this app has not yet implemented opaque token exchange"
}
});
return;
}
if ([ 'sub', 'iss' ].some(function (key) {
if ('string' !== typeof auth[key]) {
res.send({
error: {
code: "E_PARSEAUTH"
, message: "could not read property '" + key + "' of authorization token"
}
});
return true;
}
})) { return; }
if ([ 'kid' ].some(function (key) {
if (/\/|\\/.test(authData.header[key])) {
res.send({
error: {
code: "E_PARSESUBJECT"
, message: "'" + key + "' `" + JSON.stringify(authData.header[key]) + "' contains invalid characters"
}
});
return true;
}
})) { return; }
if ([ 'sub', 'kid' ].some(function (key) {
if (/\/|\\/.test(auth[key])) {
res.send({
error: {
code: "E_PARSESUBJECT"
, message: "'" + key + "' `" + JSON.stringify(auth[key]) + "' contains invalid characters"
}
});
return true;
}
})) { return; }
// TODO needs to work with app:// and custom://
function prefixHttps(str) {
return (str||'').replace(/^(https?:\/\/)?/i, 'https://');
}
var url = require('url');
var discoveryUrl = url.resolve(prefixHttps(auth.iss), '_apis/oauth3.org/index.json');
console.log('discoveryUrl: ', discoveryUrl, auth.iss);
return requestAsync({
url: discoveryUrl
, json: true
}).then(function (resp) {
// TODO
// it may be necessary to exchange the token,
if (200 !== resp.statusCode || 'object' !== typeof resp.body || !resp.body.retrieve_jwk
|| 'string' !== typeof resp.body.retrieve_jwk.url || 'string' !== typeof resp.body.api) {
res.send({
error: {
code: "E_NOTFOUND"
, message: resp.statusCode + ": issuer `" + JSON.stringify(auth.iss)
+ "' does not declare 'api' & 'retrieve_key' and hence the token you provided cannot be verified."
, _status: resp.statusCode
, _url: discoveryUrl
, _body: resp.body
}
});
return;
}
var keyUrl = url.resolve(
prefixHttps(resp.body.api).replace(/:hostname/g, auth.iss)
, resp.body.retrieve_jwk.url
.replace(/:hostname/g, auth.iss)
.replace(/:sub/g, auth.sub)
// TODO
.replace(/:kid/g, authData.header.kid || auth.iss)
);
console.log('keyUrl: ', keyUrl);
return requestAsync({
url: keyUrl
, json: true
}).then(function (resp) {
var jwk = resp.body;
console.log('Retrieved token\'s JWK: ', resp.body);
if (200 !== resp.statusCode || 'object' !== typeof resp.body) {
//headers.authorization
res.send({
error: {
code: "E_NOTFOUND"
, message: resp.statusCode + ": did not retrieve public key from `" + JSON.stringify(auth.iss)
+ "' for token validation and hence the token you provided cannot be verified."
, _status: resp.statusCode
, _url: keyUrl
, _body: resp.body
}
});
return;
}
var pubpem;
try {
pubpem = require('jwk-to-pem')(jwk, { private: false });
} catch(e) {
console.error("jwk-to-pem", e);
pubpem = null;
}
return verifyJwt(token, pubpem, {
algorithms: [ 'RS256', 'RS384', 'RS512', 'ES256', 'ES384', 'ES512' ]
}).then(function (decoded) {
if (!decoded) {
res.send({
error: {
code: "E_UNVERIFIED"
, message: "retrieved jwk does not verify provided token."
, _jwk: jwk
}
});
}
req.auth = {};
req.auth.jwt = token;
req.auth.data = auth;
next();
});
});
}).catch(function (err) {
res.send({
error: {
code: err.code || "E_GENERIC"
, message: err.toString()
}
});
});
}
var OAUTH3 = require('oauth3.js').create({ pathname: process.cwd() });
/*
// TODO all of the above should be replace with the official lib
return OAUTH3.jwk.verifyToken(req.auth.jwt).then(function (token) {
}).catch(function (err) {
});
*/
module.exports.pairRequest = function (opts) {
console.log("It's auth'n time!");
var state = opts.state;
var authReq = opts.auth;
var jwt = require('jsonwebtoken');
var auth;
authReq.id = crypto.randomBytes(12).toString('hex');
authReq.secret = crypto.randomBytes(12).toString('hex');
return sendMail(state, authReq).then(function () {
var now = Date.now();
var pin = (authReq.otp || '').toString().replace(/\s\+/g, '') || Auths._no_pin;
var authnData = {
domains: []
, ports: []
, aud: state.config.webminDomain
, iat: Math.round(now / 1000)
, id: authReq.id
, sub: authReq.subject
, pin: pin
, hostname: authReq.hostname
, os_type: authReq.os_type
, os_platform: authReq.os_platform
, os_release: authReq.os_release
, os_arch: authReq.os_arch
};
auth = {
id: authReq.id
, secret: authReq.secret
, subject: authReq.subject
, pin: pin
, dt: now
, exp: now + (2 * 60 * 60 * 1000)
, request: authReq
};
// Setting extra authnData
auth.authn = jwt.sign(authnData, state.secret);
authnData.jwt = auth.authn;
auth.authnData = authnData;
Auths.set(auth, authReq.id, authReq.secret);
return authnData;
});
};
DB.getDomainAndPort = function (state) {
var domainCount = 0;
var portCount = 0;
function chooseDomain() {
var err;
if (domainCount >= 3) {
err = new Error("there too few unallocated domains left");
err.code = "E_DOMAINS_EXHAUSTED";
return PromiseA.reject(err);
}
domainCount += 1;
var hri = require('human-readable-ids').hri;
var i = Math.floor(Math.random() * state.config.sharedDomains.length);
var hrname = hri.random() + '.' + state.config.sharedDomains[i];
return DB.domains.available(hrname).then(function (available) {
if (!available) { return chooseDomain(); }
return hrname;
});
}
function choosePort() {
var err;
if (portCount >= 3) {
err = new Error("there too few unallocated ports left");
err.code = "E_PORTS_EXHAUSTED";
return PromiseA.reject(err);
}
portCount += 1;
var portnumber = (1024 + 1) + Math.round(Math.random() * 65535);
return DB.ports.available(portnumber).then(function (available) {
if (!available) { return choosePort(); }
return portnumber;
});
}
return PromiseA.all([
chooseDomain()
, choosePort()
]).then(function (two) {
return {
domain: two[0]
, port: two[1]
};
});
};
module.exports.pairPin = function (opts) {
var state = opts.state;
return state.Promise.resolve().then(function () {
var pin = opts.pin;
var secret = opts.secret;
var auth = Auths.getBySecret(secret);
console.log('[pairPin] validating secret and pin');
if (!auth) {
throw new Error("Invalid magic link token '" + secret + "'");
}
auth = Auths.getBySecretAndPin(secret, pin);
if (!auth) {
throw new Error("Invalid pairing code '" + pin + "' for magic link token '" + secret + "'");
}
if (auth._offered) {
console.log('[pairPin] already has offer to return');
return auth._offered;
}
console.log('[pairPin] generating offer');
return DB.getDomainAndPort(state).then(function (grantable) {
var emailNode = { scheme: 'mailto', type: 'email', name: auth.subject };
return DB.accounts.get(emailNode).then(function (_acc) {
var acc = _acc;
if (!acc) {
acc = { email: true, domains: [], ports: [], nodes: [ emailNode ] };
}
return PromiseA.all([
DB.domains._add(acc, { domain: grantable.domain, wildcard: true, hostname: auth.authnData.hostname,
os: auth.authnData.os_type, arch: auth.authnData.os_arch })
, DB.ports._add(acc, { port: grantable.port, hostname: auth.authnData.hostname,
os: auth.authnData.os_type, arch: auth.authnData.os_arch })
]).then(function () {
var authzData = {
id: auth.id
, domains: [ grantable.domain ]
, ports: [ grantable.port ]
, aud: state.config.webminDomain
, iat: Math.round(Date.now() / 1000)
// of the client's computer
, hostname: auth.hostname
};
auth.authz = jwt.sign(authzData, state.secret);
auth.authzData = authzData;
authzData.jwt = auth.authz;
auth._offered = authzData;
if (auth.resolve) {
console.log('[pairPin] resolving');
auth.resolve(auth);
} else {
console.log('[pairPin] not resolvable');
}
if (!_acc) {
return DB.accounts.add(acc).then(function () {
// intentionally not returned to the promise chain
DB.save().catch(function (err) {
console.error('DB.save() failed:');
console.error(err);
});
return authzData;
});
} else {
return authzData;
}
});
});
/*
var pathname = path.join(__dirname, 'emails', auth.subject + '.' + hrname + '.data');
fs.writeFile(pathname, JSON.stringify(authzData), function (err) {
if (err) {
console.error('[ERROR] in writing token details');
console.error(err);
}
});
*/
});
});
};
// From a WS connection
module.exports.authHelper = function (meta) {
console.log('[authHelper] 1');
var state = meta.state;
console.log('[authHelper] 2');
return state.Promise.resolve().then(function () {
console.log('[authHelper] 3');
var auth = meta.session;
console.log('[authHelper] 4', auth);
if (!auth || 'string' !== typeof auth.authz || 'object' !== typeof auth.authzData) {
console.log('[authHelper] 5');
console.error("[SANITY FAIL] should not complete auth without authz data and access_token");
console.error(auth);
return;
}
console.log("[authHelper] passing authzData right along", auth.authzData);
return auth.authzData;
});
};
// opts = { state: state, auth: auth_request OR access_token }
module.exports.authenticate = function (opts) {
var jwt = require('jsonwebtoken');
var state = opts.state;
var auth;
var decoded;
function getPromise(auth) {
if (auth.promise) { return auth.promise; }
auth.promise = new state.Promise(function (resolve, reject) {
// Resolve
// this should resolve when the magic link is clicked in the email
// and the pair code is entered in successfully
// Reject
// this should reject when the pair code is entered incorrectly
// multiple times (or something else goes wrong)
// this will cause the websocket to disconnect
auth.resolve = function (auth) {
auth.resolve = null;
auth.reject = null;
// NOTE XXX: This is premature in the sense that we can't be 100% sure
// that the client is still on the other end. We'll need to implement some
// sort of check that the client actually received the token
// (i.e. when the grant event gets an ack)
auth._claimed = true;
// this is probably not necessary anymore
opts.auth = auth.authz;
return module.exports.authHelper({
state: state
, session: auth
}).then(resolve);
};
auth.reject = function (err) {
auth.resolve = null;
auth.reject = null;
reject(err);
};
});
return auth.promise;
}
// Promise Authz on Auth Creds
// TODO: remove
if ('object' === typeof opts.auth && /^.+@.+\..+$/.test(opts.auth.subject)) {
console.log("[wss.ext.authenticate] [1] Request Pair for Credentials");
return module.exports.pairRequest(opts).then(function (authnData) {
console.log("[wss.ext.authenticate] [2] Promise Authz on Pair Complete");
var auth = Auths.get(authnData.id);
return getPromise(auth);
//getPromise(auth);
//return state.defaults.authenticate(authnData.jwt);
});
}
try {
decoded = jwt.decode(opts.auth, { complete: true });
auth = Auths.get(decoded.payload.id);
} catch(e) {
console.log("[wss.ext.authenticate] [Error] could not parse token");
decoded = null;
}
console.log("[wss.ext.authenticate] incoming token decoded:");
console.log(decoded);
if (!auth) {
console.log("[wss.ext.authenticate] no session / auth handshake. Pass to default auth");
return state.defaults.authenticate(opts.auth);
}
// TODO technically this could leak the token through a timing attack
// but it would require already knowing the semi-secret id and having
// completed the pair code
if (auth.authn === opts.auth || auth.authz === opts.auth) {
if (!auth.authz) {
console.log("[wss.ext.authenticate] Create authz promise and passthru");
return getPromise(auth);
}
// If they used authn but now authz is available, use authz
// (i.e. connects, but no domains or ports)
opts.auth = auth.authz;
// The browser may poll for this value
// otherwise we could also remove the auth at this time
auth._claimed = true;
}
console.log("[wss.ext.authenticate] Already using authz, skipping promise");
return module.exports.authHelper({ state: state, session: auth });
};
//var loaded = false;
var express = require('express');
var app = express();
var staticApp = express();
var nowww = require('nowww')();
var CORS = require('connect-cors');
var bodyParser = require('body-parser');
var urls = {
pairState: '/api/telebit.cloud/pair_state/:id'
};
staticApp.use('/', express.static(path.join(__dirname, 'admin')));
app.use('/api', CORS({
credentials: true
, headers: [ 'Authorization', 'X-Requested-With', 'X-HTTP-Method-Override', 'Content-Type', 'Accept' ]
}));
app.use('/api', bodyParser.json());
app.use('/api/telebit.cloud/account', oauth3Auth);
Accounts._associateEmails = function (req) {
if (-1 === (req._state.config.trustedIssuers||TRUSTED_ISSUERS).indexOf(req.auth.data.iss)) {
// again, make sure that untrusted issuers do not get
return null;
}
// oauth3.org, issuer@oauth3.org, profile
return OAUTH3.request({
url: "https://api." + req.auth.data.iss + "/api/issuer@oauth3.org/acl/profile"
, session: { accessToken: req.auth.jwt, token: req.auth.data }
}).then(function (resp) {
var email;
var err;
(resp.data.nodes||[]).some(function (/*node*/) {
// TODO use verified email addresses
return true;
});
// back-compat for current way email is stored
if (!email && /@/.test(resp.data.username)) {
email = resp.data.username;
}
if (!email) {
err = new Error ("could not find a verified email address in profile settings");
err.code = "E_NO_EMAIL";
return PromiseA.reject(err);
}
return [ { scheme: 'mailto', type: 'email', name: email } ];
});
};
app.get('/api/telebit.cloud/account', function (req, res) {
return Accounts.getOrCreate(req).then(function (acc) {
var hasEmail = acc.nodes.some(function (node) {
return 'email' === node.type;
});
function getAllGrants() {
return PromiseA.all(acc.nodes.map(function (node) {
//console.log('XXXX node', node);
return DB.accounts.get(node);
})).then(function (grants) {
//console.log('XXXX grants');
//console.log(grants);
var domainsMap = {};
var portsMap = {};
var result = JSON.parse(JSON.stringify(acc));
result.domains.length = 0;
result.ports.length = 0;
grants.forEach(function (account) {
if (!account) { return; }
//console.log('XXXX grants.forEach.account: ', account);
account.domains.forEach(function (d) {
domainsMap[d.name] = d;
});
account.ports.forEach(function (p) {
portsMap[p.number] = p;
});
});
result.domains = Object.keys(domainsMap).map(function (k) {
return domainsMap[k];
});
result.ports = Object.keys(portsMap).map(function (k) {
return portsMap[k];
});
return result;
});
}
if (!hasEmail) {
return Accounts._associateEmails(req).then(function (nodes) {
nodes.forEach(function (node) {
acc.nodes.push(node);
});
return getAllGrants();
});
} else {
return getAllGrants();
}
}).then(function (result) {
res.send(result);
}).catch(function (err) {
return res.send({
error: {
code: err.code || "E_GENERIC"
, message: err.toString()
, _stack: err.stack
}
});
});
});
app.post('/api/telebit.cloud/account', function (req, res) {
return Accounts.create(req).then(function (acc) {
res.send({
success: true
, id: acc.id
, sub: acc.sub
, iss: acc.iss
});
});
});
// From Device (which knows id, but not secret)
app.post('/api/telebit.cloud/pair_request', function (req, res) {
var auth = req.body;
console.log('[ext] pair_request (request)', req.headers);
console.log('[ext] pair_request (request)', req.body);
module.exports.pairRequest({ state: req._state, auth: auth }).then(function (tokenData) {
console.log('[ext] pair_request (response)', tokenData);
// res.send({ success: true, message: "pair request sent" });
var stateUrl = 'https://' + req._state.config.apiDomain + urls.pairState.replace(/:id/g, tokenData.id);
res.statusCode = 201;
res.setHeader('Location', stateUrl);
res.setHeader('Link', '<' + stateUrl + '>;rel="next"');
res.send(tokenData);
}, function (err) {
console.error(err);
res.send({ error: { code: err.code, message: err.toString() } });
});
});
// From Browser (which knows secret, but not pin)
app.get('/api/telebit.cloud/pair_request/:secret', function (req, res) {
var secret = req.params.secret;
var auth = Auths.getBySecret(secret);
//var crypto = require('crypto');
var response = {};
if (!auth) {
res.send({ error: { message: "Invalid" } });
return;
}
auth.referer = req.headers.referer;
auth.user_agent = req.headers['user-agent'];
response.id = auth.id;
// do not reveal email or otp
[ 'scope', 'hostname', 'os_type', 'os_platform', 'os_release', 'os_arch' ].forEach(function (key) {
response[key] = auth.request[key];
});
res.send(response);
});
// From User (which has entered pin)
function pairCode(req, res) {
console.log("DEBUG telebit.cloud magic");
console.log(req.body || req.params);
var magic;
var pin;
if (req.body) {
magic = req.body.magic;
pin = req.body.pin;
} else {
magic = req.params.magic || req.query.magic;
pin = req.params.pin || req.query.pin;
}
return module.exports.pairPin({
state: req._state
, secret: magic
, pin: pin
}).then(function (tokenData) {
res.send(tokenData);
}, function (err) {
console.error('[error] pairCode:');
console.error(err);
res.send({ error: { message: err.toString() } });
//res.send(tokenData || { error: { code: "E_TOKEN", message: "Invalid or expired magic link. (" + magic + ")" } });
});
}
app.post('/api/telebit.cloud/pair_code', pairCode);
// Alternate From User (TODO remove in favor of the above)
app.get('/api/telebit.cloud/magic/:magic/:pin?', pairCode);
// From Device and Browser (polling)
app.get(urls.pairState, function (req, res) {
// check if pair is complete
// respond immediately if so
// wait for a little bit otherwise
// respond if/when it completes
// or respond after time if it does not complete
var auth = Auths.get(req.params.id); // id or secret accepted
if (!auth) {
console.log("[pair_state] invalid (bad state id)", req.params.id);
res.send({ status: 'invalid' });
return;
}
function check(i) {
if (auth._claimed) {
res.send({
status: 'complete'
});
} else if (auth._offered) {
res.send({
status: 'ready', access_token: auth.authz
, grant: { domains: auth.domains || [], ports: auth.ports || [] }
});
} else if (false === auth._offered) {
res.send({ status: 'failed', error: { message: "device pairing failed" } });
} else if (i >= 7) {
var stateUrl = 'https://' + req._state.config.apiDomain + urls.pairState.replace(/:id/g, auth.id);
res.statusCode = 200;
res.setHeader('Location', stateUrl);
res.setHeader('Link', '<' + stateUrl + '>;rel="next"');
res.send({ status: 'pending' });
} else {
setTimeout(check, 250, i + 1);
}
}
check(0);
});
module.exports.webadmin = function (state, req, res) {
//if (!loaded) { loaded = true; app.use('/', state.defaults.webadmin); }
var host = (req.headers.host || '').toLowerCase().split(':')[0];
if (state.config.webminDomain === host) {
console.log("[static] " + req.headers.host + req.url);
staticApp(req, res);
return;
}
if ((state.config.apiDomain || ('api.' + state.config.webminDomain )) === host) {
console.log("[api] " + req.headers.host + req.url);
req._state = state;
app(req, res);
return;
}
if ('www.' + state.config.webminDomain === host) {
console.log("[nowww] " + req.headers.host + req.url);
nowww(req, res);
return;
}
console.warn("[unhandled] " + req.headers.host + req.url);
res.end("Didn't recognize '" + escapeHtml(host) + "'. Not sure what to do.");
};
Reference in New Issue View Git Blame Copy Permalink