@3wks/gae-node-nestjs/dist/auth/auth.configurer.js

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const tslib_1 = require("tslib");
const common_1 = require("@nestjs/common");
const jsonwebtoken_1 = require("jsonwebtoken");
const lodash_1 = require("lodash");
const passport = require("passport");
const passport_1 = require("passport");
const passport_auth0_1 = require("passport-auth0");
const passport_google_oauth20_1 = require("passport-google-oauth20");
const passport_local_1 = require("passport-local");
const passport_openidconnect_1 = require("passport-openidconnect");
const passport_saml_1 = require("passport-saml");
const context_1 = require("../datastore/context");
const datastore_provider_1 = require("../datastore/datastore.provider");
const logging_1 = require("../gcloud/logging");
const auth_service_1 = require("./auth.service");
const user_service_1 = require("./user.service");
const GOOGLE_SIGNIN = 'google';
const SAML_SIGNIN = 'saml';
const AUTH0_SIGNIN = 'auth0';
const OIDC_SIGNIN = 'oidc';
const LOCAL_SIGNIN = 'local-signin';
const FAKE_SIGNIN = 'fake-signin';
const DEFAULT_FAILURE_REDIRECT = '/';
let AuthConfigurer = class AuthConfigurer {
    constructor(datastoreProvider, configuration, userService, authService) {
        this.configuration = configuration;
        this.userService = userService;
        this.authService = authService;
        this.validate = async (username, password, done) => this.validateAuth(done, () => this.authService.validateUser(context_1.newContext(this.datastore), username, password));
        this.validateFakeLogin = async (req, username, password, done) => this.validateAuth(done, () => this.authService.validateFakeLogin(context_1.newContext(this.datastore), req.headers['x-fake-secret'], username, lodash_1.get(req, 'body.name', ''), lodash_1.get(req, 'body.roles', []), lodash_1.get(req, 'body.orgId', ''), lodash_1.get(req, 'body.props', {})));
        this.validateGmail = async (accessToken, refreshToken, profile, done) => this.validateAuth(done, () => this.authService.validateUserGoogle(context_1.newContext(this.datastore), profile));
        this.validateSaml = (profile, done) => this.validateAuth(done, () => this.authService.validateUserSaml(context_1.newContext(this.datastore), profile));
        this.validateOidc = (_issuer, _sub, profile, _accessToken, _refreshToken, done) => this.validateAuth(done, () => this.authService.validateUserOidc(context_1.newContext(this.datastore), profile, !!this.configuration.auth.oidc.replaceAuth));
        this.validateAuth0 = (accessToken, refreshToken, extraParams, profile, done) => this.validateAuth(done, () => {
            const decoded = jsonwebtoken_1.decode(extraParams.id_token);
            const { email, name } = decoded;
            const namespace = this.configuration.auth.auth0.namespace;
            const roles = decoded[`${namespace}roles`];
            const orgId = decoded[`${namespace}orgId`];
            const props = decoded[`${namespace}props`];
            if (!roles || !roles.length) {
                this.logger.warn(`No roles were provided by auth0 for ${email}`);
            }
            return this.authService.validateUserAuth0(context_1.newContext(this.datastore), email, name, orgId, roles, props);
        });
        this.validateAuth = async (done, auth) => {
            try {
                const user = await auth();
                if (!user) {
                    return done(null, false, new common_1.UnauthorizedException());
                }
                done(null, user);
            }
            catch (ex) {
                this.logger.error(ex);
                if (ex instanceof auth_service_1.AuthenticationFailedException) {
                    done(null, false, ex);
                }
                else {
                    done(new common_1.UnauthorizedException('Internal error', ex), false);
                }
            }
        };
        this.datastore = datastoreProvider.datastore;
        this.logger = logging_1.createLogger('auth');
        this.init();
    }
    init() {
        passport.serializeUser((user, done) => {
            done(null, { id: user.id });
        });
        passport.deserializeUser(async (user, done) => {
            done(null, { id: user.id });
        });
        if (this.configuration.auth.local && this.configuration.auth.local.enabled) {
            passport_1.use(LOCAL_SIGNIN, new passport_local_1.Strategy({}, this.validate));
        }
        if (this.configuration.auth.fake && this.configuration.auth.fake.enabled) {
            if (!this.configuration.isDevelopment()) {
                if (!this.configuration.auth.fake.secret) {
                    throw new Error('Fake login must have secret configured in non-development environments');
                }
                this.logger.warn('Fake login is enabled');
            }
            passport_1.use(FAKE_SIGNIN, new passport_local_1.Strategy({ passReqToCallback: true }, this.validateFakeLogin));
        }
        if (this.configuration.auth.google && this.configuration.auth.google.enabled) {
            passport_1.use(new passport_google_oauth20_1.Strategy({
                clientID: this.configuration.auth.google.clientId,
                clientSecret: this.configuration.auth.google.secret,
                callbackURL: `${this.configuration.host}/auth/signin/google/callback`,
                userProfileURL: 'https://www.googleapis.com/oauth2/v3/userinfo',
            }, this.validateGmail));
        }
        if (this.configuration.auth.saml && this.configuration.auth.saml.enabled) {
            passport_1.use(SAML_SIGNIN, new passport_saml_1.Strategy({
                entryPoint: this.configuration.auth.saml.identityProviderUrl,
                callbackUrl: `${this.configuration.host}/auth/signin/saml/acs`,
                issuer: this.configuration.host,
                acceptedClockSkewMs: 5000,
                cert: this.configuration.auth.saml.cert,
            }, this.validateSaml));
        }
        if (this.configuration.auth.auth0 && this.configuration.auth.auth0.enabled) {
            passport_1.use(AUTH0_SIGNIN, new passport_auth0_1.Strategy({
                domain: this.configuration.auth.auth0.domain,
                clientID: this.configuration.auth.auth0.clientId,
                clientSecret: this.configuration.auth.auth0.secret,
                callbackURL: `${this.configuration.host}/auth/signin/auth0/callback`,
            }, this.validateAuth0));
        }
        if (this.configuration.auth.oidc && this.configuration.auth.oidc.enabled) {
            const { authUrl, clientId, enabled, issuer, secret, tokenUrl, userInfoUrl } = this.configuration.auth.oidc;
            passport_1.use(OIDC_SIGNIN, new passport_openidconnect_1.Strategy({
                issuer,
                authorizationURL: authUrl,
                tokenURL: tokenUrl,
                userInfoURL: userInfoUrl,
                clientID: clientId,
                clientSecret: secret,
                callbackURL: `${this.configuration.host}/auth/signin/oidc/callback`,
                scope: 'profile email',
            }, this.validateOidc));
            this.logger.info(`Configured ${OIDC_SIGNIN} authentication strategy`);
        }
    }
    beginAuthenticateGoogle() {
        const options = {
            scope: ['profile', 'email'],
        };
        return passport.authenticate(GOOGLE_SIGNIN, options);
    }
    completeAuthenticateGoogle() {
        return passport.authenticate(GOOGLE_SIGNIN, {
            failureRedirect: this.configuration.auth.google.failureRedirect || DEFAULT_FAILURE_REDIRECT,
        });
    }
    beginAuthenticateSaml() {
        return passport.authenticate(SAML_SIGNIN, {
            failureRedirect: this.configuration.auth.saml.failureRedirect || DEFAULT_FAILURE_REDIRECT,
        });
    }
    completeAuthenticateSaml() {
        return passport.authenticate(SAML_SIGNIN, {
            failureRedirect: this.configuration.auth.saml.failureRedirect || DEFAULT_FAILURE_REDIRECT,
        });
    }
    beginAuthenticateOidc() {
        return passport.authenticate(OIDC_SIGNIN, {
            scope: ['openid', 'profile', 'email'],
        });
    }
    completeAuthenticateOidc() {
        return passport.authenticate(OIDC_SIGNIN, {
            failureRedirect: this.configuration.auth.oidc.failureRedirect || DEFAULT_FAILURE_REDIRECT,
        });
    }
    beginAuthenticateAuth0() {
        const options = {
            scope: ['openid', 'email', 'profile'],
        };
        return passport.authenticate(AUTH0_SIGNIN, options);
    }
    completeAuthenticateAuth0() {
        return passport.authenticate(AUTH0_SIGNIN, {
            failureRedirect: this.configuration.auth.auth0.failureRedirect || DEFAULT_FAILURE_REDIRECT,
        });
    }
    getSignoutUrlAuth0() {
        const clientId = this.configuration.auth.auth0.clientId;
        const domain = this.configuration.auth.auth0.domain;
        const host = this.configuration.host;
        return `https://${domain}/v2/logout?client_id=${clientId}&returnTo=${host}`;
    }
    authenticateLocal() {
        return passport.authenticate(LOCAL_SIGNIN, {});
    }
    authenticateFake() {
        return passport.authenticate(FAKE_SIGNIN, {});
    }
};
AuthConfigurer = tslib_1.__decorate([
    common_1.Injectable(),
    tslib_1.__param(1, common_1.Inject('Configuration')),
    tslib_1.__param(2, common_1.Inject(user_service_1.USER_SERVICE)),
    tslib_1.__metadata("design:paramtypes", [datastore_provider_1.DatastoreProvider, Object, Object, auth_service_1.AuthService])
], AuthConfigurer);
exports.AuthConfigurer = AuthConfigurer;
//# sourceMappingURL=auth.configurer.js.map