More work on OAuth support.
Ylian Saint-Hilaire committed
May 13, 2020 at 22:30 UTC
a01c9dd9454c77ab1b6d340098bcb9ab9be6a902
2 files changed
+30
-16
meshuser.js
+3
-4
@@ -1562,7 +1562,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1562
for (var i in command.users) {
1563
if (domain.usernameisemail) { if (command.users[i].email) { command.users[i].user = command.users[i].email; } else { command.users[i].email = command.users[i].user; } } // If the email is the username, set this here.
1564
if (common.validateUsername(command.users[i].user, 1, 256) == false) break; // Username is between 1 and 64 characters, no spaces
1565
- if ((command.users[i].user == '~') || (command.users[i].user.indexOf('/') >= 0)) break; // This is a reserved user name
1565
+ if ((command.users[i].user[0] == '~') || (command.users[i].user.indexOf('/') >= 0)) break; // This is a reserved user name or invalid name
1566
if (common.validateString(command.users[i].pass, 1, 256) == false) break; // Password is between 1 and 256 characters
1567
if (common.checkPasswordRequirements(command.users[i].pass, domain.passwordrequirements) == false) break; // Password does not meet requirements
1568
if ((command.users[i].email != null) && (common.validateEmail(command.users[i].email, 1, 1024) == false)) break; // Check if this is a valid email address
@@ -1635,15 +1635,14 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1635
if ((user.siteadmin & 2) == 0) { err = 'Permission denied'; }
1636
else if ((domain.auth == 'sspi') || (domain.auth == 'ldap')) { err = 'Unable to add user in this mode'; }
1637
else if (common.validateUsername(command.username, 1, 256) == false) { err = 'Invalid username'; } // Username is between 1 and 64 characters, no spaces
1638
+ else if ((command.username[0] == '~') || (command.username.indexOf('/') >= 0)) { err = 'Invalid username'; } // Usernames cant' start with ~ and can't have '/'
1639
else if (common.validateString(command.pass, 1, 256) == false) { err = 'Invalid password'; } // Password is between 1 and 256 characters
1639
- else if (command.username.indexOf('/') >= 0) { err = 'Invalid username'; } // Usernames can't have '/'
1640
else if ((command.randomPassword !== true) && (common.checkPasswordRequirements(command.pass, domain.passwordrequirements) == false)) { err = 'Invalid password'; } // Password does not meet requirements
1641
else if ((command.email != null) && (common.validateEmail(command.email, 1, 1024) == false)) { err = 'Invalid email'; } // Check if this is a valid email address
1642
else {
1643
newusername = command.username;
1644
newuserid = 'user/' + domain.id + '/' + command.username.toLowerCase();
1645
- if (newusername == '~') { err = 'Invalid username'; } // This is a reserved user name
1646
- else if (command.siteadmin != null) {
1645
+ if (command.siteadmin != null) {
1646
if ((typeof command.siteadmin != 'number') || (Number.isInteger(command.siteadmin) == false)) { err = 'Invalid site permissions'; } // Check permissions
1647
else if ((user.siteadmin != 0xFFFFFFFF) && ((command.siteadmin & (0xFFFFFFFF - 224)) != 0)) { err = 'Invalid site permissions'; }
1648
}
webserver.js
+27
-12
@@ -1007,6 +1007,15 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1007
// If the email is the username, set this here.
1008
if (domain.usernameisemail) { req.body.username = req.body.email; }
1009
1010
+ // Accounts that start with ~ are not allowed
1011
+ if ((typeof req.body.username != 'string') || (req.body.username.length < 1) || (req.body.username[0] == '~')) {
1012
+ parent.debug('web', 'handleCreateAccountRequest: unable to create account (0)');
1013
+ req.session.loginmode = '2';
1014
+ req.session.messageid = 100; // Unable to create account.
1015
+ if (direct === true) { handleRootRequestEx(req, res, domain); } else { res.redirect(domain.url + getQueryPortion(req)); }
1016
+ return;
1017
+ }
1018
+
1019
// Count the number of users in this domain
1020
var domainUserCount = 0;
1021
for (var i in obj.users) { if (obj.users[i].domain == domain.id) { domainUserCount++; } }
@@ -3991,6 +4000,9 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4000
// Setup passport if needed
4001
if (typeof domain.authstrategies == 'object') {
4002
const passport = domain.passport = require('passport');
4003
+ passport.serializeUser(function (user, done) { done(null, user.id); });
4004
+ passport.deserializeUser(function (id, done) { done(null, { id: id }); });
4005
+ obj.app.use(passport.initialize());
4006
if ((typeof domain.authstrategies.twitter == 'object') && (typeof domain.authstrategies.twitter.apikey == 'string') && (typeof domain.authstrategies.twitter.apisecret == 'string')) {
4007
const TwitterStrategy = require('passport-twitter');
4008
passport.use(new TwitterStrategy({
@@ -3999,16 +4011,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4011
callbackURL: url + 'auth-twitter-callback'
4012
},
4013
function (token, tokenSecret, profile, cb) {
4002
- console.log('Twitter1', token, tokenSecret, profile);
4003
- //User.findOrCreate({ twitterId: profile.id }, function (err, user) { return cb(err, user); });
4014
+ var user = { id: 'user/' + domain.id + '/~twitter:' + profile.id, name: profile.displayName };
4015
+ if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
4016
+ return cb(null, user);
4017
}
4018
));
4019
obj.app.get(url + 'auth-twitter', domain.passport.authenticate('twitter'));
4007
- obj.app.get(url + 'https://alt.meshcentral.com',
4020
+ obj.app.get(url + 'auth-twitter-callback',
4021
domain.passport.authenticate('twitter', { failureRedirect: '/' }),
4022
function (req, res) {
4023
// Successful authentication, redirect home.
4011
- console.log('Twitter2');
4024
+ console.log('Twitter', req.session, req.user);
4025
res.redirect('/');
4026
});
4027
}
@@ -4020,16 +4033,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4033
callbackURL: url + 'auth-google-callback'
4034
},
4035
function (token, tokenSecret, profile, cb) {
4023
- console.log('Google1', token, tokenSecret, profile);
4024
- //User.findOrCreate({ googleId: profile.id }, function (err, user) { return cb(err, user); });
4036
+ var user = { id: 'user/' + domain.id + '/~google:' + profile.id, name: profile.displayName };
4037
+ if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string') && (profile.emails[0].verified == true)) { user.email = profile.emails[0].value; }
4038
+ return cb(null, user);
4039
}
4040
));
4027
- obj.app.get(url + 'auth-google', domain.passport.authenticate('google'));
4041
+ obj.app.get(url + 'auth-google', domain.passport.authenticate('google', { scope: ['profile', 'email'] }));
4042
obj.app.get(url + 'auth-google-callback',
4043
domain.passport.authenticate('google', { failureRedirect: '/' }),
4044
function (req, res) {
4045
// Successful authentication, redirect home.
4032
- console.log('Google2');
4046
+ console.log('Google', req.session, req.user);
4047
res.redirect('/');
4048
});
4049
}
@@ -4041,16 +4055,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
4055
callbackURL: url + 'auth-github-callback'
4056
},
4057
function (token, tokenSecret, profile, cb) {
4044
- console.log('GitHub1', token, tokenSecret, profile);
4045
- //User.findOrCreate({ githubId: profile.id }, function (err, user) { return cb(err, user); });
4058
+ var user = { id: 'user/' + domain.id + '/~github:' + profile.id, name: profile.displayName };
4059
+ if ((typeof profile.emails == 'object') && (profile.emails[0] != null) && (typeof profile.emails[0].value == 'string')) { user.email = profile.emails[0].value; }
4060
+ return cb(null, user);
4061
}
4062
));
4063
obj.app.get(url + 'auth-github', domain.passport.authenticate('github', { scope: ['user:email'] }));
4064
obj.app.get(url + 'auth-github-callback',
4050
- domain.passport.authenticate('google', { failureRedirect: '/' }),
4065
+ domain.passport.authenticate('github', { failureRedirect: '/' }),
4066
function (req, res) {
4067
// Successful authentication, redirect home.
4053
- console.log('GitHub2');
4068
+ console.log('GitHub', req.session, req.user);
4069
res.redirect('/');
4070
});
4071
}