feat: initial local passport strategy

src/core/server/app/middleware/passport/index.ts

@@ -1,63 +1,33 @@
+import { NextFunction, Response } from "express";
 import { Db } from "mongodb";
 import passport, { Authenticator } from "passport";
 
-import { NextFunction, Response } from "express";
-import OIDCStrategy, {
-  Token,
-  VerifyCallback,
-} from "talk-server/app/middleware/passport/oidc";
-import { GQLUSER_ROLE } from "talk-server/graph/tenant/schema/__generated__/types";
-import { Tenant } from "talk-server/models/tenant";
-import { create, retrieveWithProfile, User } from "talk-server/models/user";
+import { createLocalStrategy } from "talk-server/app/middleware/passport/local";
+import { createOIDCStrategy } from "talk-server/app/middleware/passport/oidc";
+import { User } from "talk-server/models/user";
 import { Request } from "talk-server/types/express";
 
+export type VerifyCallback = (
+  err?: Error | null,
+  user?: User | null,
+  info?: object
+) => void;
+
 export interface PassportOptions {
   db: Db;
 }
 
-async function verifyOIDC(
-  db: Db,
-  tenant: Tenant,
-  { iss, sub, email, email_verified }: Token,
-  done: VerifyCallback
-) {
-  try {
-    // Construct the profile that will be used to query for the user.
-    const profile = {
-      type: "oidc",
-      provider: iss,
-      id: sub,
-    };
-
-    // Try to lookup user given their id provided in the `sub` claim.
-    let user = await retrieveWithProfile(db, tenant.id, profile);
-    if (!user) {
-      // FIXME: implement rules.
-
-      // Create the new user, as one didn't exist before!
-      user = await create(db, tenant.id, {
-        username: null,
-        role: GQLUSER_ROLE.COMMENTER,
-        email,
-        email_verified,
-        profiles: [profile],
-      });
-    }
-
-    return done(null, user);
-  } catch (err) {
-    return done(err);
-  }
-}
-
 export function createPassport({
   db,
 }: PassportOptions): passport.Authenticator {
   // Create the authenticator.
   const auth = new Authenticator();
 
-  // Process the OIDC Strategy.
-  auth.use(new OIDCStrategy({ db }, verifyOIDC.bind(null, db)));
+  // Use the OIDC Strategy.
+  auth.use(createOIDCStrategy({ db }));
+
+  // Use the LocalStrategy.
+  auth.use(createLocalStrategy({ db }));
 
   return auth;
 }

src/core/server/app/middleware/passport/local.ts

@@ -0,0 +1,61 @@
+import { Db } from "mongodb";
+import { Strategy as LocalStrategy } from "passport-local";
+
+import { VerifyCallback } from "talk-server/app/middleware/passport";
+import {
+  retrieveUserWithProfile,
+  verifyUserPassword,
+} from "talk-server/models/user";
+import { Request } from "talk-server/types/express";
+
+async function verify(
+  db: Db,
+  req: Request,
+  email: string,
+  password: string,
+  done: VerifyCallback
+) {
+  try {
+    // The tenant is guaranteed at this point.
+    const tenant = req.tenant!;
+
+    // TODO: rate limit the ip address
+
+    // Get the user from the database.
+    const user = await retrieveUserWithProfile(db, tenant.id, {
+      id: email,
+      type: "local",
+    });
+    if (!user) {
+      // The user didn't exist.
+      return done(null, null);
+    }
+
+    // Verify the password.
+    const passwordVerified = await verifyUserPassword(user, password);
+    if (!passwordVerified) {
+      // TODO: return better error
+      return done(new Error("invalid password"));
+    }
+
+    return done(null, user);
+  } catch (err) {
+    return done(err);
+  }
+}
+
+export interface LocalStrategyOptions {
+  db: Db;
+}
+
+export function createLocalStrategy({ db }: LocalStrategyOptions) {
+  return new LocalStrategy(
+    {
+      usernameField: "email",
+      passwordField: "password",
+      session: false,
+      passReqToCallback: true,
+    },
+    verify.bind(null, db)
+  );
+}

src/core/server/app/middleware/passport/oidc.ts

@@ -1,57 +1,106 @@
 import jwt from "jsonwebtoken";
 import jwks, { JwksClient } from "jwks-rsa";
+import { Db } from "mongodb";
 import { Strategy as OAuth2Strategy } from "passport-oauth2";
 import { Strategy } from "passport-strategy";
 
 import { reconstructURL } from "talk-server/app/url";
+import { GQLUSER_ROLE } from "talk-server/graph/tenant/schema/__generated__/types";
 import { OIDCAuthIntegration, Tenant } from "talk-server/models/tenant";
-import { User } from "talk-server/models/user";
+import { createUser, retrieveUserWithProfile } from "talk-server/models/user";
 import { Request } from "talk-server/types/express";
 
-export type OIDCStrategyOptions = any;
+import { VerifyCallback } from "./index";
 
 export interface Params {
   id_token?: string;
 }
 
-export type VerifyCallback = (
-  err?: Error | null,
-  user?: User | null,
-  info?: object
-) => void;
-
-export interface Token {
+export interface OIDCIDToken {
   iss: string;
   sub: string;
   email: string;
   email_verified?: boolean;
 }
 
-export type OIDCStrategyCallback = (
-  tenant: Tenant,
-  token: Token,
-  done: VerifyCallback
-) => void;
-
 export interface StrategyItem {
   strategy: OAuth2Strategy;
   jwksClient?: JwksClient;
 }
 
+export interface OIDCStrategyOptions {
+  db: Db;
+}
+
+export function isOIDCToken(token: OIDCIDToken | object): token is OIDCIDToken {
+  if (
+    (token as OIDCIDToken).iss &&
+    (token as OIDCIDToken).sub &&
+    (token as OIDCIDToken).email
+  ) {
+    return true;
+  }
+
+  return false;
+}
+
+export async function findOrCreateOIDCUser(
+  db: Db,
+  tenant: Tenant,
+  { iss, sub, email, email_verified }: OIDCIDToken
+) {
+  // Construct the profile that will be used to query for the user.
+  const profile = {
+    type: "oidc",
+    provider: iss,
+    id: sub,
+  };
+
+  // Try to lookup user given their id provided in the `sub` claim.
+  let user = await retrieveUserWithProfile(db, tenant.id, profile);
+  if (!user) {
+    // FIXME: implement rules.
+
+    // Create the new user, as one didn't exist before!
+    user = await createUser(db, tenant.id, {
+      username: null,
+      role: GQLUSER_ROLE.COMMENTER,
+      email,
+      email_verified,
+      profiles: [profile],
+    });
+  }
+
+  return user;
+}
+
 // FIXME: attach strategy to cache updates of the tenants
 
 export default class OIDCStrategy extends Strategy {
   public name: string;
 
-  private verify: OIDCStrategyCallback;
+  private db: Db;
   private cache: Map<string, StrategyItem>;
 
-  constructor(options: OIDCStrategyOptions, verify: OIDCStrategyCallback) {
+  constructor({ db }: OIDCStrategyOptions) {
     super();
 
     this.name = "oidc";
     this.cache = new Map();
-    this.verify = verify;
+    this.db = db;
+  }
+
+  private async verify(
+    tenant: Tenant,
+    token: OIDCIDToken,
+    done: VerifyCallback
+  ) {
+    try {
+      const user = await findOrCreateOIDCUser(this.db, tenant, token);
+      return done(null, user);
+    } catch (err) {
+      return done(err);
+    }
   }
 
   private lookupJWKSClient(
@@ -139,7 +188,7 @@ export default class OIDCStrategy extends Strategy {
           return done(err);
         }
 
-        this.verify(tenant!, decoded as Token, done);
+        this.verify(tenant!, decoded as OIDCIDToken, done);
       }
     );
   }
@@ -183,6 +232,12 @@ export default class OIDCStrategy extends Strategy {
       throw new Error("integration not found");
     }
 
+    // Handle when the integration is enabled/disabled.
+    if (!integration.enabled) {
+      // TODO: return a better error.
+      throw new Error("integration not enabled");
+    }
+
     // Try to get the Tenant's cached integrations.
     let entry = this.cache.get(tenant.id);
     if (!entry) {
@@ -202,22 +257,30 @@ export default class OIDCStrategy extends Strategy {
   }
 
   public async authenticate(req: Request) {
-    // Lookup the strategy.
-    const strategy = await this.lookupStrategy(req);
-    if (!strategy) {
-      return;
+    try {
+      // Lookup the strategy.
+      const strategy = await this.lookupStrategy(req);
+      if (!strategy) {
+        throw new Error("strategy not found");
+      }
+
+      // Augment the strategy with the request method bindings.
+      strategy.error = this.error.bind(this);
+      strategy.fail = this.fail.bind(this);
+      strategy.pass = this.pass.bind(this);
+      strategy.redirect = this.redirect.bind(this);
+      strategy.success = this.success.bind(this);
+
+      // Authenticate with the strategy, binding the current context to the method
+      // to provide it with the augmented passport handlers. We also request the
+      // 'openid' scope so we can get an id_token back.
+      strategy.authenticate(req, { scope: "openid email", session: false });
+    } catch (err) {
+      return this.error(err);
     }
-
-    // Augment the strategy with the request method bindings.
-    strategy.error = this.error.bind(this);
-    strategy.fail = this.fail.bind(this);
-    strategy.pass = this.pass.bind(this);
-    strategy.redirect = this.redirect.bind(this);
-    strategy.success = this.success.bind(this);
-
-    // Authenticate with the strategy, binding the current context to the method
-    // to provide it with the augmented passport handlers. We also request the
-    // 'openid' scope so we can get an id_token back.
-    strategy.authenticate(req, { scope: "openid email", session: false });
   }
 }
+
+export function createOIDCStrategy({ db }: OIDCStrategyOptions) {
+  return new OIDCStrategy({ db });
+}

src/core/server/app/router.ts

@@ -33,6 +33,11 @@ async function createTenantRouter(app: AppOptions, options: RouterOptions) {
   router.use(tenantMiddleware({ db: app.mongo }));
 
   router.use(options.passport.initialize());
+  router.use(
+    "/auth/local",
+    express.json(),
+    authenticate(options.passport, "local")
+  );
   router.use("/auth/oidc", authenticate(options.passport, "oidc"));
   router.use("/auth/oidc/callback", authenticate(options.passport, "oidc"));
   // router.use("/auth/google", options.passport.authenticate("google"));
@@ -64,6 +69,10 @@ async function createAPIRouter(app: AppOptions, options: RouterOptions) {
 }
 
 export interface RouterOptions {
+  /**
+   * passport is the instance of the Authenticator that can be used to create
+   * and mount new authentication middleware.
+   */
   passport: passport.Authenticator;
 }
 

src/core/server/app/url.ts

@@ -1,11 +1,10 @@
 import { Request } from "talk-server/types/express";
 import { URL } from "url";
 
-export function reconstructURL(req: Request, input?: string): string {
+export function reconstructURL(req: Request, path: string = "/"): string {
   const scheme = req.secure ? "https" : "http";
   const host = req.get("host");
   const base = `${scheme}://${host}`;
-  const path = input || req.originalUrl;
 
   const url = new URL(path, base);
 

src/core/server/graph/tenant/loaders/comments.ts

@@ -6,17 +6,23 @@ import {
   CommentToRepliesArgs,
 } from "talk-server/graph/tenant/schema/__generated__/types";
 import {
-  retrieveAssetConnection,
-  retrieveMany,
-  retrieveRepliesConnection,
+  retrieveCommentAssetConnection,
+  retrieveManyComments,
+  retrieveCommentRepliesConnection,
 } from "talk-server/models/comment";
 
 export default (ctx: Context) => ({
   comment: new DataLoader((ids: string[]) =>
-    retrieveMany(ctx.db, ctx.tenant.id, ids)
+    retrieveManyComments(ctx.db, ctx.tenant.id, ids)
   ),
   forAsset: (assetID: string, input: AssetToCommentsArgs) =>
-    retrieveAssetConnection(ctx.db, ctx.tenant.id, assetID, input),
+    retrieveCommentAssetConnection(ctx.db, ctx.tenant.id, assetID, input),
   forParent: (assetID: string, parentID: string, input: CommentToRepliesArgs) =>
-    retrieveRepliesConnection(ctx.db, ctx.tenant.id, assetID, parentID, input),
+    retrieveCommentRepliesConnection(
+      ctx.db,
+      ctx.tenant.id,
+      assetID,
+      parentID,
+      input
+    ),
 });

src/core/server/graph/tenant/loaders/users.ts

@@ -1,9 +1,9 @@
 import DataLoader from "dataloader";
 import Context from "talk-server/graph/tenant/context";
-import { retrieveMany, User } from "talk-server/models/user";
+import { retrieveManyUsers, User } from "talk-server/models/user";
 
 export default (ctx: Context) => ({
   user: new DataLoader<string, User | null>(ids =>
-    retrieveMany(ctx.db, ctx.tenant.id, ids)
+    retrieveManyUsers(ctx.db, ctx.tenant.id, ids)
   ),
 });

src/core/server/graph/tenant/schema/schema.graphql

@@ -284,6 +284,41 @@ enum USER_ROLE {
   ADMIN
 }
 
+enum USER_USERNAME_STATUS {
+  """
+  UNSET is used when the username can be changed, and does not necessarily
+  require moderator action to become active. This can be used when the user
+  signs up with a social login and has the option of setting their own
+  username.
+  """
+  UNSET
+
+  """
+  SET is used when the username has been set for the first time, but cannot
+  change without the username being rejected by a moderator and that moderator
+  agreeing that the username should be allowed to change.
+  """
+  SET
+
+  """
+  APPROVED is used when the username was changed, and subsequently approved by
+  said moderator.
+  """
+  APPROVED
+
+  """
+  REJECTED is used when the username was changed, and subsequently rejected by
+  said moderator.
+  """
+  REJECTED
+
+  """
+  CHANGED is used after a user has changed their username after it was
+  rejected.
+  """
+  CHANGED
+}
+
 """
 User is someone that leaves Comments, and logs in.
 """

src/core/server/models/comment.ts

@@ -34,7 +34,7 @@ export enum CommentStatus {
 
 export interface Comment extends TenantResource {
   readonly id: string;
-  parent_id?: string;
+  parent_id: string | null;
   author_id: string;
   asset_id: string;
   body: string;
@@ -45,9 +45,7 @@ export interface Comment extends TenantResource {
   reply_count: number;
   created_at: Date;
   deleted_at?: Date;
-  metadata?: {
-    [_: string]: any;
-  };
+  metadata?: Record<string, any>;
 }
 
 export type CreateCommentInput = Omit<
@@ -60,7 +58,7 @@ export type CreateCommentInput = Omit<
   | "status_history"
 >;
 
-export async function create(
+export async function createComment(
   db: Db,
   tenantID: string,
   input: CreateCommentInput
@@ -106,11 +104,15 @@ export async function create(
   return comment;
 }
 
-export async function retrieve(db: Db, tenantID: string, id: string) {
+export async function retrieveComment(db: Db, tenantID: string, id: string) {
   return collection(db).findOne({ id, tenant_id: tenantID });
 }
 
-export async function retrieveMany(db: Db, tenantID: string, ids: string[]) {
+export async function retrieveManyComments(
+  db: Db,
+  tenantID: string,
+  ids: string[]
+) {
   const cursor = await collection(db).find({
     id: {
       $in: ids,
@@ -164,7 +166,7 @@ function nodesToEdge(input: ConnectionInput, nodes: Comment[]) {
  * @param parentID the parent id for the comment to retrieve
  * @param input connection configuration
  */
-export async function retrieveRepliesConnection(
+export async function retrieveCommentRepliesConnection(
   db: Db,
   tenantID: string,
   assetID: string,
@@ -190,7 +192,7 @@ export async function retrieveRepliesConnection(
  * @param assetID the Asset id for the comment to retrieve
  * @param input connection configuration
  */
-export async function retrieveAssetConnection(
+export async function retrieveCommentAssetConnection(
   db: Db,
   tenantID: string,
   assetID: string,

src/core/server/models/tenant.ts

@@ -210,7 +210,7 @@ export async function retrieveTenantByDomain(db: Db, domain: string) {
   return collection(db).findOne({ domain });
 }
 
-export async function retrieve(db: Db, id: string) {
+export async function retrieveTenant(db: Db, id: string) {
   return collection(db).findOne({ id });
 }
 

src/core/server/models/user.ts

@@ -1,9 +1,13 @@
+import bcrypt from "bcryptjs";
 import { merge } from "lodash";
 import { Db } from "mongodb";
 import uuid from "uuid";
 
 import { Omit, Sub } from "talk-common/types";
-import { GQLUSER_ROLE } from "talk-server/graph/tenant/schema/__generated__/types";
+import {
+  GQLUSER_ROLE,
+  GQLUSER_USERNAME_STATUS,
+} from "talk-server/graph/tenant/schema/__generated__/types";
 import { ActionCounts } from "talk-server/models/actions";
 import { TenantResource } from "talk-server/models/tenant";
 
@@ -14,7 +18,7 @@ function collection(db: Db) {
 export interface Profile {
   readonly id: string;
   readonly type: string;
-  provider: string;
+  provider?: string;
 }
 
 export interface Token {
@@ -23,31 +27,6 @@ export interface Token {
   active: boolean;
 }
 
-export enum UserUsernameStatus {
-  // UNSET is used when the username can be changed, and does not necessarily
-  // require moderator action to become active. This can be used when the user
-  // signs up with a social login and has the option of setting their own
-  // username.
-  UNSET = "UNSET",
-
-  // SET is used when the username has been set for the first time, but cannot
-  // change without the username being rejected by a moderator and that moderator
-  // agreeing that the username should be allowed to change.
-  SET = "SET",
-
-  // APPROVED is used when the username was changed, and subsequently approved by
-  // said moderator.
-  APPROVED = "APPROVED",
-
-  // REJECTED is used when the username was changed, and subsequently rejected by
-  // said moderator.
-  REJECTED = "REJECTED",
-
-  // CHANGED is used after a user has changed their username after it was
-  // rejected.
-  CHANGED = "CHANGED",
-}
-
 export interface UserStatusHistory<T> {
   status: T; // TODO: migrate field
   assigned_by?: string;
@@ -61,7 +40,7 @@ export interface UserStatusItem<T> {
 }
 
 export interface UserStatus {
-  username: UserStatusItem<UserUsernameStatus>;
+  username: UserStatusItem<GQLUSER_USERNAME_STATUS>;
   banned: UserStatusItem<boolean>;
   suspension: UserStatusItem<Date | null>;
 }
@@ -92,7 +71,11 @@ export type CreateUserInput = Omit<
   | "created_at"
 >;
 
-export async function create(db: Db, tenantID: string, input: CreateUserInput) {
+export async function createUser(
+  db: Db,
+  tenantID: string,
+  input: CreateUserInput
+) {
   const now = new Date();
 
   // default are the properties set by the application when a new user is
@@ -114,8 +97,8 @@ export async function create(db: Db, tenantID: string, input: CreateUserInput) {
       },
       username: {
         status: input.username
-          ? UserUsernameStatus.SET
-          : UserUsernameStatus.UNSET,
+          ? GQLUSER_USERNAME_STATUS.SET
+          : GQLUSER_USERNAME_STATUS.UNSET,
         history: [],
       },
     },
@@ -131,11 +114,15 @@ export async function create(db: Db, tenantID: string, input: CreateUserInput) {
   return user;
 }
 
-export async function retrieve(db: Db, tenantID: string, id: string) {
+export async function retrieveUser(db: Db, tenantID: string, id: string) {
   return collection(db).findOne({ id, tenant_id: tenantID });
 }
 
-export async function retrieveMany(db: Db, tenantID: string, ids: string[]) {
+export async function retrieveManyUsers(
+  db: Db,
+  tenantID: string,
+  ids: string[]
+) {
   const cursor = await collection(db).find({
     id: {
       $in: ids,
@@ -148,7 +135,7 @@ export async function retrieveMany(db: Db, tenantID: string, ids: string[]) {
   return ids.map(id => users.find(comment => comment.id === id) || null);
 }
 
-export async function retrieveWithProfile(
+export async function retrieveUserWithProfile(
   db: Db,
   tenantID: string,
   profile: Profile
@@ -161,7 +148,7 @@ export async function retrieveWithProfile(
   });
 }
 
-export async function updateRole(
+export async function updateUserRole(
   db: Db,
   tenantID: string,
   id: string,
@@ -175,3 +162,11 @@ export async function updateRole(
 
   return result.value || null;
 }
+
+export async function verifyUserPassword(user: User, password: string) {
+  if (user.password) {
+    return bcrypt.compare(user.password, password);
+  }
+
+  return false;
+}

src/core/server/services/comments/index.ts

@@ -4,7 +4,7 @@ import { Omit } from "talk-common/types";
 import {
   Comment,
   CommentStatus,
-  create as createComment,
+  createComment,
   CreateCommentInput,
 } from "talk-server/models/comment";