@authx/authx/dist/index.js

"use strict";
function __export(m) {
    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
}
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const koa_body_1 = __importDefault(require("koa-body"));
const uuid_1 = require("uuid");
const graphql_playground_middleware_koa_1 = __importDefault(require("graphql-playground-middleware-koa"));
const koa_router_1 = __importDefault(require("koa-router"));
const graphql_api_koa_1 = require("graphql-api-koa");
const auth_header_1 = require("auth-header");
const pg_1 = require("pg");
const x_1 = __importDefault(require("./x"));
const oauth2_1 = __importDefault(require("./oauth2"));
const Config_1 = require("./Config");
const graphql_1 = require("./graphql");
const getAuthorization_1 = require("./util/getAuthorization");
const StrategyCollection_1 = require("./StrategyCollection");
const errors_1 = require("./errors");
const explanations_1 = require("./explanations");
__export(require("./x"));
__export(require("./errors"));
__export(require("./model"));
__export(require("./graphql"));
__export(require("./StrategyCollection"));
__export(require("./Config"));
__export(require("./util/validateIdFormat"));
class AuthX extends koa_router_1.default {
    constructor(config) {
        Config_1.assertConfig(config);
        super(config);
        const explanations = explanations_1.createAuthXExplanations({ [config.realm]: "AuthX" });
        const strategies = config.strategies instanceof StrategyCollection_1.StrategyCollection
            ? config.strategies
            : new StrategyCollection_1.StrategyCollection(config.strategies);
        // create a database pool
        this.pool = new pg_1.Pool(config.pg);
        // define the context middleware
        const contextMiddleware = async (ctx, next) => {
            const tx = await this.pool.connect();
            try {
                let authorization = null;
                const auth = ctx.request.header.authorization
                    ? auth_header_1.parse(ctx.request.header.authorization)
                    : null;
                // HTTP Basic Authorization
                const basic = auth && auth.scheme === "Basic" && typeof auth.token === "string"
                    ? auth.token
                    : null;
                if (basic) {
                    authorization = await getAuthorization_1.fromBasic(tx, basic);
                    // Invoke the authorization. Because the resource validates basic
                    // tokens by making a GraphQL request here, each request can be
                    // considered an invocation.
                    await authorization.invoke(tx, {
                        id: uuid_1.v4(),
                        format: "basic",
                        createdAt: new Date()
                    });
                }
                // Bearer Token Authorization
                const bearer = auth && auth.scheme === "Bearer" && typeof auth.token === "string"
                    ? auth.token
                    : null;
                if (bearer) {
                    authorization = await getAuthorization_1.fromBearer(tx, config.publicKeys, bearer);
                    // There is no need to invoke this authorization here, since it was
                    // invoked when the bearer token was generated.
                }
                // An authorization header exists, but did not match a known format.
                if (ctx.request.header.authorization && !authorization) {
                    throw new Error("An authorization header must be of either HTTP Basic or Bearer format.");
                }
                const context = {
                    ...ctx[x_1.default],
                    ...config,
                    strategies,
                    authorization,
                    pool: this.pool,
                    explanations: explanations
                };
                ctx[x_1.default] = context;
            }
            finally {
                tx.release();
            }
            await next();
        };
        // GraphQL
        // =======
        // The GraphQL endpoint is the primary API for interacting with AuthX.
        this.post("/graphql", graphql_api_koa_1.errorHandler(), contextMiddleware, 
        // The GraphQL endpoint only accepts JSON. This helps protect against CSRF
        // attacks that send urlenceded data via HTML forms.
        async (ctx, next) => {
            if (!ctx.is("json"))
                throw new errors_1.UnsupportedMediaTypeError("Requests to the AuthX GraphQL endpoint MUST specify a Content-Type of `application/json`.");
            await next();
        }, koa_body_1.default({ multipart: false, urlencoded: false, text: false, json: true }), graphql_api_koa_1.execute({
            schema: config.processSchema
                ? config.processSchema(graphql_1.createSchema(strategies))
                : graphql_1.createSchema(strategies),
            override: (ctx) => {
                const contextValue = ctx[x_1.default];
                return {
                    contextValue
                };
            }
        }));
        // GraphiQL
        // ========
        // This is a graphical (get it, graph-i-QL) interface to the AuthX API.
        this.all("/graphiql", graphql_playground_middleware_koa_1.default({ endpoint: "/graphql" }));
        // OAuth
        // =====
        // The core AuthX library supports the following OAuth2 grant types:
        //
        // - `authorization_code`
        // - `refresh_token`
        //
        // Because it involves presentation elements, the core AuthX library does
        // **not** implement the `code` grant type. Instead, a compatible reference
        // implementation of this flow is provided by the `authx-interface` NPM
        // package.
        this.post("/", contextMiddleware, koa_body_1.default({ multipart: false, urlencoded: true, text: false, json: true }), oauth2_1.default);
    }
}
exports.AuthX = AuthX;
exports.default = AuthX;
//# sourceMappingURL=index.js.map