@3wks/gae-node-nestjs/dist/auth/auth.service.js

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const tslib_1 = require("tslib");
const common_1 = require("@nestjs/common");
const bcrypt = require("bcryptjs");
const emails = require("email-addresses");
const t = require("io-ts");
const io_ts_reporters_1 = require("io-ts-reporters");
const lodash_1 = require("lodash");
const __1 = require("..");
const configuration_1 = require("../configuration");
const auth_repository_1 = require("./auth.repository");
const user_service_1 = require("./user.service");
const auth_callbacks_1 = require("./auth.callbacks");
const userProfile = t.interface({
    id: t.string,
    emails: t.array(t.interface({
        value: t.string,
        verified: t.boolean,
    })),
    displayName: t.string,
});
class AuthenticationFailedException extends common_1.HttpException {
    constructor(message) {
        super(message, common_1.HttpStatus.UNAUTHORIZED);
    }
}
exports.AuthenticationFailedException = AuthenticationFailedException;
const PASSWORD_ROUNDS = 10;
async function hashPassword(password) {
    return await bcrypt.hash(password, PASSWORD_ROUNDS);
}
exports.hashPassword = hashPassword;
let AuthService = class AuthService {
    constructor(authRepository, userService, configurationProvider, authCallbacks) {
        this.authRepository = authRepository;
        this.userService = userService;
        this.configurationProvider = configurationProvider;
        this.authCallbacks = authCallbacks;
        this.logger = __1.createLogger('account-service');
    }
    async validateUser(context, username, password) {
        const account = await this.getAccountByEmail(context, username);
        if (!account) {
            throw new AuthenticationFailedException('No credentials found for user');
        }
        if (account.type !== 'password') {
            throw new AuthenticationFailedException('No credentials found for user');
        }
        const result = await bcrypt.compare(password, account.password);
        if (!result) {
            throw new AuthenticationFailedException(`Invalid password for user`);
        }
        return await this.loadUserAndCheckEnabled(context, account.userId);
    }
    async validateFakeLogin(context, secret, email, name, roles, orgId, props) {
        this.logger.info(`Validating fake login for ${email}`);
        const configSecret = this.configurationProvider.auth.fake.secret;
        if (configSecret && configSecret !== secret) {
            throw new AuthenticationFailedException('Fake login secret invalid');
        }
        const user = await this.userService.getByEmail(context, email);
        if (user) {
            if (!user.enabled) {
                throw new AuthenticationFailedException('User account is disabled');
            }
            return await this.userService.update(context, user.id, Object.assign({}, user, { name,
                roles,
                orgId,
                props }));
        }
        else {
            return await this.userService.create(context, {
                email,
                name,
                roles,
                orgId,
                props,
                enabled: true,
            });
        }
    }
    async validateUserGoogle(context, inputProfile) {
        const validationResult = userProfile.decode(inputProfile);
        if (validationResult.isLeft()) {
            throw new Error(io_ts_reporters_1.reporter(validationResult).join(', '));
        }
        const profile = validationResult.value;
        const accountEmails = profile.emails.find(accountEmail => accountEmail.verified);
        if (!accountEmails) {
            throw new AuthenticationFailedException('No credentials found for user');
        }
        const email = accountEmails.value;
        const account = await this.getAccountByEmail(context, email);
        if (!account) {
            if (!this.configurationProvider.auth.google || !this.configurationProvider.auth.google.signUpEnabled) {
                throw new AuthenticationFailedException('No credentials found for user');
            }
            const { domain } = emails.parseOneAddress(email);
            const signUpDomains = this.configurationProvider.auth.google.signUpDomains || [];
            if (!signUpDomains.includes(domain)) {
                throw new AuthenticationFailedException('No credentials found for user');
            }
            const createdUser = await this.userService.create(context, {
                roles: this.configurationProvider.auth.google.signUpRoles,
                email,
                name: profile.displayName,
                enabled: true,
            });
            await this.authRepository.save(context, {
                id: email,
                type: 'google',
                userId: createdUser.id,
            });
            return createdUser;
        }
        if (account.type !== 'google' && account.type !== 'password') {
            throw new AuthenticationFailedException('No credentials found for user');
        }
        return await this.loadUserAndCheckEnabled(context, account.userId);
    }
    async validateUserSaml(context, profile) {
        return this.validateOrCreateExternalAuthAccount(context, profile.email, {
            type: 'saml',
            newUserRequest: () => ({
                roles: [],
                email: profile.email,
                name: this.toName(profile),
                enabled: true,
            }),
        });
    }
    async validateUserOidc(context, profile, overwriteCredentials) {
        const profileJson = profile['_json'];
        const email = profile.email || (profileJson && profileJson.email);
        const roles = this.buildUserRoles(profile, []);
        const props = this.buildUserProperties(profile, {});
        return this.validateOrCreateExternalAuthAccount(context, email, {
            type: 'oidc',
            overwriteCredentials,
            newUserRequest: () => ({
                email,
                name: profile.displayName,
                roles,
                props,
                enabled: true,
            }),
            updateUser: user => {
                return this.userService.update(context, user.id, Object.assign({}, user, { roles,
                    props, name: profile.displayName }));
            },
        });
    }
    buildUserRoles(ipdProfileData, defaultRoles = []) {
        if (this.authCallbacks && this.authCallbacks.buildUserRolesList) {
            return this.authCallbacks.buildUserRolesList(ipdProfileData);
        }
        return defaultRoles;
    }
    buildUserProperties(ipdProfileData, defaultProperties = {}) {
        if (this.authCallbacks && this.authCallbacks.buildUserPropertiesObject) {
            return this.authCallbacks.buildUserPropertiesObject(ipdProfileData);
        }
        return defaultProperties;
    }
    async validateUserAuth0(context, email, name, orgId, roles, props) {
        return this.validateOrCreateExternalAuthAccount(context, email, {
            type: 'auth0',
            newUserRequest: () => ({
                roles,
                orgId,
                email,
                name,
                props,
                enabled: true,
            }),
            updateUser: user => {
                user.name = name;
                user.roles = roles;
                user.orgId = orgId;
                user.props = props;
                return this.userService.update(context, user.id, user);
            },
        });
    }
    async createAccount(context, email, password, account) {
        const existingCredentials = await this.getAccountByEmail(context, email);
        if (!existingCredentials) {
            return await this.authRepository.save(context, {
                id: email,
                password: await hashPassword(password),
                userId: account,
                type: 'password',
            });
        }
        return existingCredentials;
    }
    async validateOrCreateExternalAuthAccount(context, email, options) {
        const { newUserRequest, updateUser, type } = options;
        this.logger.info(`Validating ${type} user profile`);
        const account = await this.getAccountByEmail(context, email);
        if (!account) {
            this.logger.info(`No login credentials found for ${email}, creating credentials and creating or updating user.`);
            const updatedUser = await this.userService.createOrUpdate(context, newUserRequest(), this.validateUserEnabled);
            await this.authRepository.save(context, {
                id: email,
                type,
                userId: updatedUser.id,
            });
            return updatedUser;
        }
        if (!options.overwriteCredentials && account.type !== type) {
            throw new AuthenticationFailedException('No credentials found for user');
        }
        const user = await this.loadUserAndCheckEnabled(context, account.userId);
        if (account.type !== type) {
            this.logger.info(`Updating auth type to [${type}] for [${email}]`);
            await this.authRepository.save(context, {
                id: account.id,
                type,
                userId: account.userId,
            });
        }
        this.logger.info(`User ${email} validated`);
        return updateUser ? await updateUser(user) : user;
    }
    async loadUserAndCheckEnabled(context, userId) {
        const user = await this.userService.get(context, userId);
        if (!user) {
            throw new AuthenticationFailedException('User not found');
        }
        this.validateUserEnabled(user);
        return user;
    }
    validateUserEnabled(user) {
        if (!user.enabled) {
            throw new AuthenticationFailedException('User account is disabled');
        }
    }
    getAccountByEmail(context, email) {
        const normalisedEmail = __1.normaliseEmail(email);
        this.logger.info(`Looking up user by email ${normalisedEmail}`);
        return this.authRepository.get(context, normalisedEmail);
    }
    toName(profile) {
        return [profile.firstName, profile.lastName].filter(part => !lodash_1.isNil(part)).join(' ');
    }
};
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, Object, String, String, Array, String, Object]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "validateFakeLogin", null);
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, Object]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "validateUserGoogle", null);
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, Object]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "validateUserSaml", null);
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, Object, Boolean]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "validateUserOidc", null);
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, String, String, String, Array, Object]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "validateUserAuth0", null);
tslib_1.__decorate([
    __1.Transactional(),
    tslib_1.__metadata("design:type", Function),
    tslib_1.__metadata("design:paramtypes", [Object, String, String, String]),
    tslib_1.__metadata("design:returntype", Promise)
], AuthService.prototype, "createAccount", null);
AuthService = tslib_1.__decorate([
    common_1.Injectable(),
    tslib_1.__param(1, common_1.Inject(user_service_1.USER_SERVICE)),
    tslib_1.__param(2, common_1.Inject(configuration_1.CONFIGURATION)),
    tslib_1.__param(3, common_1.Optional()), tslib_1.__param(3, common_1.Inject(auth_callbacks_1.AUTH_CALLBACKS)),
    tslib_1.__metadata("design:paramtypes", [auth_repository_1.CredentialRepository, Object, Object, Object])
], AuthService);
exports.AuthService = AuthService;
//# sourceMappingURL=auth.service.js.map