[next] Permit (#1899)

* feat: replaced custom auth extraction logic with permit

* fix: fixed tests

src/core/server/app/middleware/passport/jwt.spec.ts

@@ -4,65 +4,34 @@ import { Config } from "talk-common/config";
 import {
   createJWTSigningConfig,
   extractJWTFromRequest,
-  parseAuthHeader,
 } from "talk-server/app/middleware/passport/jwt";
 import { Request } from "talk-server/types/express";
 
-describe("parseAuthHeader", () => {
-  it("parses valid headers", () => {
-    const parsed = {
-      scheme: "bearer",
-      value: "token",
-    };
-
-    expect(parseAuthHeader("Bearer token")).toEqual(parsed);
-
-    expect(parseAuthHeader("bearer token")).toEqual(parsed);
-
-    expect(parseAuthHeader("bearer  token")).toEqual(parsed);
-  });
-
-  it("parses invalid headers", () => {
-    expect(parseAuthHeader("this-is-a-wrong-header")).toEqual(null);
-    expect(parseAuthHeader("bearerthis-is-a-wrong-header")).toEqual(null);
-  });
-});
-
 describe("extractJWTFromRequest", () => {
   it("extracts the token from header", () => {
     const req = {
-      get: sinon
-        .stub()
-        .withArgs("authorization")
-        .returns("Bearer token"),
+      headers: {
+        authorization: "Bearer token",
+      },
+      url: "",
     };
 
     expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
-    expect(req.get.calledOnce).toBeTruthy();
 
-    req.get.reset();
-    req.get.returns(null);
+    delete req.headers.authorization;
+
     expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
-    expect(req.get.calledOnce).toBeTruthy();
   });
 
   it("extracts the token from query string", () => {
     const req = {
-      get: sinon
-        .stub()
-        .withArgs("authorization")
-        .returns(null),
-      query: { access_token: "token" },
+      url: "",
     };
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
+
+    req.url = "https://talk.coralproject.net/api?access_token=token";
 
     expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
-    expect(req.get.calledOnce).toBeTruthy();
-
-    delete req.query.access_token;
-
-    req.get.reset();
-    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
-    expect(req.get.calledOnce).toBeTruthy();
   });
 });
 

src/core/server/app/middleware/passport/jwt.ts

@@ -2,41 +2,20 @@ import { Redis } from "ioredis";
 import jwt, { SignOptions } from "jsonwebtoken";
 import { Db } from "mongodb";
 import { Strategy } from "passport-strategy";
+import { Bearer } from "permit";
 import uuid from "uuid";
 
 import { Config } from "talk-common/config";
 import { retrieveUser, User } from "talk-server/models/user";
 import { Request } from "talk-server/types/express";
 
-const authHeaderRegex = /(\S+)\s+(\S+)/;
-
-export function parseAuthHeader(header: string) {
-  const matches = header.match(authHeaderRegex);
-  if (!matches || matches.length < 3) {
-    return null;
-  }
-
-  return {
-    scheme: matches[1].toLowerCase(),
-    value: matches[2],
-  };
-}
-
 export function extractJWTFromRequest(req: Request) {
-  const header = req.get("authorization");
-  if (header) {
-    const parts = parseAuthHeader(header);
-    if (parts && parts.scheme === "bearer") {
-      return parts.value;
-    }
-  }
+  const permit = new Bearer({
+    basic: "password",
+    query: "access_token",
+  });
 
-  const token: string | undefined | false = req.query && req.query.access_token;
-  if (token) {
-    return token;
-  }
-
-  return null;
+  return permit.check(req) || null;
 }
 
 function generateJTIBlacklistKey(jti: string) {