@authx/authx/dist/oauth2.js

"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const uuid_1 = require("uuid");
const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
const crypto_1 = require("crypto");
const model_1 = require("./model");
const errors_1 = require("./errors");
const scopes_1 = require("./util/scopes");
const scopes_2 = require("@authx/scopes");
const x_1 = __importDefault(require("./x"));
async function assertPermissions(realm, tx, grant, values) {
    if (
    // Check that we have every relevant user scope:
    !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
        type: "user",
        userId: grant.userId
    }, {
        basic: "r"
    }))) ||
        // Check that we have every relevant grant scope:
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "grant",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "grant",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "",
            secrets: "r"
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "grant",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "r",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "grant",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "w",
            scopes: "",
            secrets: "w"
        }))) ||
        // Check that we have every relevant authorization scope:
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "r",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "r",
            scopes: "",
            secrets: "r"
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "w",
            scopes: "",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "w",
            scopes: "w",
            secrets: ""
        }))) ||
        !(await grant.can(tx, values, scopes_1.createV2AuthXScope(realm, {
            type: "authorization",
            authorizationId: "*",
            clientId: grant.clientId,
            grantId: grant.id,
            userId: grant.userId
        }, {
            basic: "w",
            scopes: "",
            secrets: "w"
        })))) {
        throw new OAuthError("invalid_grant", "The grant contains insufficient permission for OAuth.", undefined, grant.clientId, 403);
    }
}
class OAuthError extends Error {
    constructor(code, message, uri, clientId, statusCode = 400) {
        super(typeof message === "undefined" ? code : message);
        this.code = code;
        this.uri = uri || null;
        this.clientId = clientId;
        this.statusCode = statusCode;
    }
}
// Loop through an iterable of grant secrets and select the secret that was most
// recently issued
function getRefreshToken(secrets) {
    let refreshToken = null;
    let max = 0;
    for (const secret of secrets) {
        const issuedString = Buffer.from(secret, "base64")
            .toString("utf8")
            .split(":")[1];
        const issuedNumber = parseInt(issuedString);
        if (issuedString && issuedNumber && issuedNumber > max) {
            refreshToken = secret;
            max = issuedNumber;
        }
    }
    return refreshToken;
}
async function oAuth2Middleware(ctx) {
    var _a, _b, _c;
    ctx.response.set("Cache-Control", "no-store");
    ctx.response.set("Pragma", "no-cache");
    const { pool, realm, jwtValidityDuration, codeValidityDuration, privateKey } = ctx[x_1.default];
    try {
        const tx = await pool.connect();
        try {
            // Make sure the body is an object.
            const request = ctx.request.body;
            if (!request || typeof request !== "object") {
                throw new OAuthError("invalid_request", "The request body must be a JSON object.");
            }
            const grantType = typeof request.grant_type === "string" ? request.grant_type : undefined;
            // Authorization Code
            // ==================
            if (grantType === "authorization_code") {
                try {
                    tx.query("BEGIN DEFERRABLE");
                    const now = Math.floor(Date.now() / 1000);
                    const paramsClientId = typeof request.client_id === "string"
                        ? request.client_id
                        : undefined;
                    const paramsClientSecret = typeof request.client_secret === "string"
                        ? request.client_secret
                        : undefined;
                    const paramsCode = typeof request.code === "string" ? request.code : undefined;
                    const paramsNonce = typeof request.nonce === "string" ? request.nonce : undefined;
                    if (!paramsClientId || !paramsClientSecret || !paramsCode) {
                        throw new OAuthError("invalid_request", "The request body must include fields `client_id`, `client_secret`, and `code`.", undefined, paramsClientId);
                    }
                    // Authenticate the client with its secret.
                    let client;
                    try {
                        client = await model_1.Client.read(tx, paramsClientId);
                    }
                    catch (error) {
                        if (!(error instanceof errors_1.NotFoundError))
                            throw error;
                        throw new OAuthError("invalid_client", undefined, undefined, paramsClientId);
                    }
                    if (!client.secrets.has(paramsClientSecret)) {
                        throw new OAuthError("invalid_client", undefined, undefined, paramsClientId);
                    }
                    if (!client.enabled) {
                        throw new OAuthError("unauthorized_client", undefined, undefined, paramsClientId);
                    }
                    // Invoke the client.
                    await client.invoke(tx, {
                        id: uuid_1.v4(),
                        createdAt: new Date()
                    });
                    // Decode and validate the authorization code.
                    const [grantId, issuedAt, nonce] = Buffer.from(paramsCode, "base64")
                        .toString("utf8")
                        .split(":");
                    if (!grantId || !issuedAt || !nonce) {
                        throw new OAuthError("invalid_grant", "The authorization code is malformed.", undefined, paramsClientId);
                    }
                    if (parseInt(issuedAt, 10) + codeValidityDuration < now) {
                        throw new OAuthError("invalid_grant", "The authorization code is expired.", undefined, paramsClientId);
                    }
                    // Fetch the grant.
                    let grant;
                    try {
                        grant = await model_1.Grant.read(tx, grantId);
                    }
                    catch (error) {
                        if (!(error instanceof errors_1.NotFoundError))
                            throw error;
                        throw new OAuthError("invalid_grant", "The authorization code is invalid.", undefined, paramsClientId);
                    }
                    if (!grant.enabled) {
                        throw new OAuthError("invalid_grant", "The authorization code is invalid.", undefined, paramsClientId);
                    }
                    if (!grant.codes.has(paramsCode)) {
                        throw new OAuthError("invalid_grant", "The authorization code is invalid.", undefined, paramsClientId);
                    }
                    // Invoke the grant.
                    await grant.invoke(tx, {
                        id: uuid_1.v4(),
                        createdAt: new Date()
                    });
                    // Fetch the user.
                    const user = await grant.user(tx);
                    if (!user.enabled) {
                        throw new OAuthError("invalid_grant", "The authorization code is invalid.", undefined, paramsClientId);
                    }
                    const requestedScopes = grant.scopes;
                    const values = {
                        currentUserId: grant.userId,
                        currentGrantId: grant.id,
                        currentClientId: grant.clientId,
                        currentAuthorizationId: null
                    };
                    // Make sure we have the necessary access.
                    await assertPermissions(realm, tx, grant, values);
                    // Get all enabled authorizations of this grant.
                    const authorizations = (await grant.authorizations(tx)).filter(t => t.enabled);
                    // Look for an existing active authorization for this grant with all
                    // grant scopes.
                    const possibleRootAuthorizations = authorizations.filter(t => scopes_2.isEqual("**:**:**", t.scopes));
                    let rootAuthorization;
                    if (possibleRootAuthorizations.length) {
                        // Use an existing authorization.
                        ctx[x_1.default].authorization = rootAuthorization =
                            possibleRootAuthorizations[0];
                    }
                    else {
                        // Create a new authorization.
                        const authorizationId = uuid_1.v4();
                        ctx[x_1.default].authorization = rootAuthorization = await model_1.Authorization.write(tx, {
                            id: authorizationId,
                            enabled: true,
                            userId: user.id,
                            grantId: grant.id,
                            secret: crypto_1.randomBytes(16).toString("hex"),
                            scopes: ["**:**:**"]
                        }, {
                            recordId: uuid_1.v4(),
                            createdByAuthorizationId: authorizationId,
                            createdByCredentialId: null,
                            createdAt: new Date()
                        });
                    }
                    // Look for an existing active authorization for this grant with the
                    // requested scopes.
                    const possibleRequestedAuthorizations = authorizations.filter(t => scopes_2.isEqual(requestedScopes, t.scopes));
                    let requestedAuthorization;
                    if (possibleRequestedAuthorizations.length) {
                        // Use an existing authorization.
                        requestedAuthorization = possibleRequestedAuthorizations[0];
                    }
                    else {
                        // Create a new authorization.
                        requestedAuthorization = await model_1.Authorization.write(tx, {
                            id: uuid_1.v4(),
                            enabled: true,
                            userId: user.id,
                            grantId: grant.id,
                            secret: crypto_1.randomBytes(16).toString("hex"),
                            scopes: requestedScopes
                        }, {
                            recordId: uuid_1.v4(),
                            createdByAuthorizationId: rootAuthorization.id,
                            createdByCredentialId: null,
                            createdAt: new Date()
                        });
                    }
                    // Remove the authorization code we used, and prune any others that
                    // have expired.
                    const codes = [...grant.codes].filter(code => {
                        const issued = Buffer.from(code, "base64")
                            .toString("utf8")
                            .split(":")[1];
                        return (code !== paramsCode &&
                            issued &&
                            parseInt(issued) + codeValidityDuration > now);
                    });
                    grant = await model_1.Grant.write(tx, {
                        ...grant,
                        codes
                    }, {
                        recordId: uuid_1.v4(),
                        createdByAuthorizationId: rootAuthorization.id,
                        createdAt: new Date()
                    });
                    const scopes = await requestedAuthorization.access(tx);
                    const tokenId = uuid_1.v4();
                    await requestedAuthorization.invoke(tx, {
                        id: tokenId,
                        format: "bearer",
                        createdAt: new Date()
                    });
                    const body = {
                        /* eslint-disable @typescript-eslint/camelcase */
                        token_type: "bearer",
                        access_token: jsonwebtoken_1.default.sign({
                            aid: requestedAuthorization.id,
                            scopes,
                            nonce: paramsNonce
                        }, privateKey, {
                            jwtid: tokenId,
                            algorithm: "RS512",
                            expiresIn: jwtValidityDuration,
                            audience: client.id,
                            subject: user.id,
                            issuer: realm
                        }),
                        refresh_token: getRefreshToken(grant.secrets),
                        expires_in: jwtValidityDuration,
                        scope: scopes.join(" ")
                        /* eslint-enable @typescript-eslint/camelcase */
                    };
                    await tx.query("COMMIT");
                    ctx.response.body = body;
                    return;
                }
                catch (error) {
                    await tx.query("ROLLBACK");
                    throw error;
                }
            }
            // Refresh Token
            // =============
            if (grantType === "refresh_token") {
                try {
                    tx.query("BEGIN DEFERRABLE");
                    const paramsClientId = typeof request.client_id === "string"
                        ? request.client_id
                        : undefined;
                    const paramsClientSecret = typeof request.client_secret === "string"
                        ? request.client_secret
                        : undefined;
                    const paramsRefreshToken = typeof request.refresh_token === "string"
                        ? request.refresh_token
                        : undefined;
                    const paramsScope = typeof request.scope === "string" ? request.scope : undefined;
                    const paramsNonce = typeof request.nonce === "string" ? request.nonce : undefined;
                    if (!paramsClientId || !paramsClientSecret || !paramsRefreshToken) {
                        throw new OAuthError("invalid_request", "The request body must include fields `client_id`, `client_secret`, and `refresh_token`.", undefined, paramsClientId);
                    }
                    const requestedScopeTemplates = paramsScope
                        ? paramsScope.split(" ")
                        : [];
                    if (paramsScope &&
                        !requestedScopeTemplates.every(scopes_2.isValidScopeTemplate)) {
                        throw new OAuthError("invalid_scope", undefined, undefined, paramsClientId);
                    }
                    // Authenticate the client with its secret.
                    let client;
                    try {
                        client = await model_1.Client.read(tx, paramsClientId);
                    }
                    catch (error) {
                        if (!(error instanceof errors_1.NotFoundError))
                            throw error;
                        throw new OAuthError("invalid_client", undefined, undefined, paramsClientId);
                    }
                    if (!client.secrets.has(paramsClientSecret)) {
                        throw new OAuthError("invalid_client", undefined, undefined, paramsClientId);
                    }
                    if (!client.enabled) {
                        throw new OAuthError("unauthorized_client", undefined, undefined, paramsClientId);
                    }
                    // Invoke the client.
                    await client.invoke(tx, {
                        id: uuid_1.v4(),
                        createdAt: new Date()
                    });
                    // Decode and validate the authorization code.
                    const [grantId, issuedAt, nonce] = Buffer.from(paramsRefreshToken, "base64")
                        .toString("utf8")
                        .split(":");
                    if (!grantId || !issuedAt || !nonce) {
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    // Fetch the grant.
                    let grant;
                    try {
                        grant = await model_1.Grant.read(tx, grantId);
                    }
                    catch (error) {
                        if (!(error instanceof errors_1.NotFoundError))
                            throw error;
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    if (!grant.enabled) {
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    if (grant.clientId !== client.id) {
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    if (!grant.secrets.has(paramsRefreshToken)) {
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    // Invoke the grant.
                    await grant.invoke(tx, {
                        id: uuid_1.v4(),
                        createdAt: new Date()
                    });
                    // Fetch the user.
                    const user = await grant.user(tx);
                    if (!user.enabled) {
                        throw new OAuthError("invalid_grant", "Invalid authorization code.", undefined, paramsClientId);
                    }
                    // Make sure we have the necessary access.
                    await assertPermissions(realm, tx, grant, {
                        currentUserId: grant.userId,
                        currentGrantId: grant.id,
                        currentClientId: grant.clientId,
                        currentAuthorizationId: null
                    });
                    // Get all enabled authorizations of this grant.
                    const authorizations = (await grant.authorizations(tx)).filter(t => t.enabled);
                    // Look for an existing active authorization for this grant with all
                    // grant scopes.
                    const possibleRootAuthorizations = authorizations.filter(t => scopes_2.isEqual("**:**:**", t.scopes));
                    let rootAuthorization;
                    if (possibleRootAuthorizations.length) {
                        // Use an existing authorization.
                        ctx[x_1.default].authorization = rootAuthorization =
                            possibleRootAuthorizations[0];
                    }
                    else {
                        // Create a new authorization.
                        const authorizationId = uuid_1.v4();
                        ctx[x_1.default].authorization = rootAuthorization = await model_1.Authorization.write(tx, {
                            id: authorizationId,
                            enabled: true,
                            userId: user.id,
                            grantId: grant.id,
                            secret: crypto_1.randomBytes(16).toString("hex"),
                            scopes: ["**:**:**"]
                        }, {
                            recordId: uuid_1.v4(),
                            createdByAuthorizationId: authorizationId,
                            createdByCredentialId: null,
                            createdAt: new Date()
                        });
                    }
                    // Look for an existing active authorization for this grant with the
                    // requested scopes.
                    const possibleRequestedAuthorizations = authorizations.filter(t => {
                        var _a, _b, _c, _d;
                        return scopes_2.isEqual(scopes_2.inject(requestedScopeTemplates, {
                            /* eslint-disable @typescript-eslint/camelcase */
                            current_user_id: (_a = grant.userId) !== null && _a !== void 0 ? _a : null,
                            current_grant_id: (_b = grant.id) !== null && _b !== void 0 ? _b : null,
                            current_client_id: (_c = grant.clientId) !== null && _c !== void 0 ? _c : null,
                            current_authorization_id: (_d = t.id) !== null && _d !== void 0 ? _d : null
                            /* eslint-enable @typescript-eslint/camelcase */
                        }), t.scopes);
                    });
                    let requestedAuthorization;
                    if (possibleRequestedAuthorizations.length) {
                        // Use an existing authorization.
                        requestedAuthorization = possibleRequestedAuthorizations[0];
                    }
                    else {
                        // Create a new authorization.
                        const authorizationId = uuid_1.v4();
                        requestedAuthorization = await model_1.Authorization.write(tx, {
                            id: authorizationId,
                            enabled: true,
                            userId: user.id,
                            grantId: grant.id,
                            secret: crypto_1.randomBytes(16).toString("hex"),
                            scopes: scopes_2.inject(requestedScopeTemplates, {
                                /* eslint-disable @typescript-eslint/camelcase */
                                current_user_id: (_a = grant.userId) !== null && _a !== void 0 ? _a : null,
                                current_grant_id: (_b = grant.id) !== null && _b !== void 0 ? _b : null,
                                current_client_id: (_c = grant.clientId) !== null && _c !== void 0 ? _c : null,
                                current_authorization_id: authorizationId !== null && authorizationId !== void 0 ? authorizationId : null
                                /* eslint-enable @typescript-eslint/camelcase */
                            })
                        }, {
                            recordId: uuid_1.v4(),
                            createdByAuthorizationId: rootAuthorization.id,
                            createdByCredentialId: null,
                            createdAt: new Date()
                        });
                    }
                    const scopes = await requestedAuthorization.access(tx);
                    const tokenId = uuid_1.v4();
                    await requestedAuthorization.invoke(tx, {
                        id: tokenId,
                        format: "bearer",
                        createdAt: new Date()
                    });
                    const body = {
                        /* eslint-disable @typescript-eslint/camelcase */
                        token_type: "bearer",
                        access_token: jsonwebtoken_1.default.sign({
                            aid: requestedAuthorization.id,
                            scopes,
                            nonce: paramsNonce
                        }, privateKey, {
                            jwtid: tokenId,
                            algorithm: "RS512",
                            expiresIn: jwtValidityDuration,
                            audience: client.id,
                            subject: user.id,
                            issuer: realm
                        }),
                        refresh_token: getRefreshToken(grant.secrets),
                        expires_in: jwtValidityDuration,
                        scope: scopes.join(" ")
                        /* eslint-enabme @typescript-eslint/camelcase */
                    };
                    await tx.query("COMMIT");
                    ctx.response.body = body;
                    return;
                }
                catch (error) {
                    await tx.query("ROLLBACK");
                    throw error;
                }
            }
            // Unsupported Grant Type
            throw new OAuthError("unsupported_grant_type");
        }
        finally {
            tx.release();
        }
    }
    catch (error) {
        if (!(error instanceof OAuthError))
            throw error;
        const body = { error: error.code };
        if (error.message !== error.code) {
            // eslint-disable-next-line @typescript-eslint/camelcase
            body.error_message = error.message;
        }
        if (error.uri) {
            // eslint-disable-next-line @typescript-eslint/camelcase
            body.error_uri = error.uri;
        }
        ctx.response.status = error.statusCode;
        ctx.response.body = body;
        ctx.app.emit("error", error, ctx);
    }
}
exports.default = oAuth2Middleware;
//# sourceMappingURL=oauth2.js.map