[next] SSO Refactor (#1912)

* feat: support dual sso/jwt auth * feat: move verifier logic to seperate strategy * fix: adjusted tests and removed aud claim * fix: cleanup
2026-09-10 12:43:11 +08:00 · 2018-09-26 16:26:44 +00:00
parent 122b9e9871
commit b916914faa
19 changed files with 461 additions and 374 deletions
@@ -0,0 +1,31 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`createJWTSigningConfig parses a RSA certificate 1`] = `
+"-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAyxR2DVlvkQRquggUQTpHN+PxDs2iOiItGgn6u4+faUCdgGEV
+EnmG69//3lAZHnEQN9rkZS3/20zc41mTJnO7dslJbB316vWUSIwYcVY/VC9DTbk+
+MHWZd94p5hOB8PoY2vEGA53KiyWLqQC5FWE3u7cz7eYTr9/eRPDTc15IzohLXd5U
+C9EbO5ebho2CvWrBfrLozM5Kidp8r3Jp+A0o3kfJ/kRDDn/BmG6pM0TohWZFYMs2
+nQaGg+of9tcafgAs7hZAgBrrcc/jke6+MKxpC8algik79nMk7s7prxF1Z9EbAeQV
+1ssL2VgsjvGAHIV+Arckl6QJbVDvQXNAM0PqbQIDAQABAoIBAQCoG6D5vf5P8nMS
+2ltB/6cyyfsjgO/45Y+mTXqERwj0DOwUeMkDyRv6KCxb8LxKade+FPIaG7D/7amw
+fdcE7qrRUyD3YfnPbUk5oNcfAwFbg+BX969WWBMZmgvfDGj1fWKT4w9ScQ1YkFUD
+KrkLzLVhK+/N0Dad0VjiguTXTMZCSDFOY9fO8HRF6EA3aewEPeEY62J6rSjGXvWB
+GdW+FNvf/uRr36xGHNqiOP837pdVUppjgDyVsORnMfFtYMyWyxS2XD5r8gRwcRg7
+0nz6bLM53DjKweO+Yl+pIVPFAyXL0pwzQDlnjShsCzyzjA9lJftkQwbcMWopeegJ
+kPLmiq4VAoGBAOqDmySNx8vmWWMOaXKFuH6Gqu/Nd7gBHxZ73wvsEmvV52xwa0oi
+55h+v6P1YEaNZQWXDFsvILoOUHr2kwZY+Du/MC7tgqpj+Fu3h7UHslulJRE3A+sN
+oLbHjZuwm3wwsatpHdyEYOGg0HIGWXi+9pDT/1gy8g3L2Gf0X6rfkBBXAoGBAN2v
+lbii0+HvZ2y0D0P6NfUJ6cQDrSyuTe7UW6OVYjBjrVAk8+bhnQ4eKd9edCnUDqu6
+9C8ZSrqR6VBeItbt8y+5ZCRcrigxd2VdH8rL9g6idD9RPnSbHx7Al8DxSUv25xMK
+8Z/ZOAvuCmwDfdleycNDoTawKqLtWBzUEntLs5DbAoGAPlTKiJWylAxel8h92HWY
+SvDqQCChgGOz6prz9sxBPS42e4kJy0OpwMt3jlGqzDXKswipvRayoSEq3PPqshY1
+rFOtr9trDnTRzzbhuAkaq+ciCghQX0pY/BvgFJCFUyXyIzgmOrVotq+yl4v+fexr
+xqTCSqQH2AjlNQQr5VPUi7MCgYEAsNbbMXE6YlXug+lS8CANoM3qm4FvSGA3LNhb
+za9hp0YsP+1qXvgEp/lp35RiR+ewWE+HcHbVhOTWYFTnp9ojDyPtfZAtIUTsgIB7
+1vNC8kOnRccSckQ32/k4VSJlHOL1S9yECMZnjiSyTZ2va5HQkyJE3PJE4LlCe6S0
+pYQq1tcCgYEAoJDeSeAPqi5NIu+MWNUWzw4vo5raKyHrJi+cTvKyM/2zJFHvBc5f
+RaxkcIAOmIDoVdFgy6APY/0DnDnpqT1kMagUaxZjG9PLFIDds5DRaL99m+S7l8mt
+ySX/MbmhQHYWpVf2nL6pmfPuP4Ih6tbKIUUGA3wZXYYZ5r+pZFG1IrA=
+-----END RSA PRIVATE KEY-----"
+`;
@@ -0,0 +1,31 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`createJWTSigningConfig parses a RSA certificate 1`] = `
+"-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAyxR2DVlvkQRquggUQTpHN+PxDs2iOiItGgn6u4+faUCdgGEV
+EnmG69//3lAZHnEQN9rkZS3/20zc41mTJnO7dslJbB316vWUSIwYcVY/VC9DTbk+
+MHWZd94p5hOB8PoY2vEGA53KiyWLqQC5FWE3u7cz7eYTr9/eRPDTc15IzohLXd5U
+C9EbO5ebho2CvWrBfrLozM5Kidp8r3Jp+A0o3kfJ/kRDDn/BmG6pM0TohWZFYMs2
+nQaGg+of9tcafgAs7hZAgBrrcc/jke6+MKxpC8algik79nMk7s7prxF1Z9EbAeQV
+1ssL2VgsjvGAHIV+Arckl6QJbVDvQXNAM0PqbQIDAQABAoIBAQCoG6D5vf5P8nMS
+2ltB/6cyyfsjgO/45Y+mTXqERwj0DOwUeMkDyRv6KCxb8LxKade+FPIaG7D/7amw
+fdcE7qrRUyD3YfnPbUk5oNcfAwFbg+BX969WWBMZmgvfDGj1fWKT4w9ScQ1YkFUD
+KrkLzLVhK+/N0Dad0VjiguTXTMZCSDFOY9fO8HRF6EA3aewEPeEY62J6rSjGXvWB
+GdW+FNvf/uRr36xGHNqiOP837pdVUppjgDyVsORnMfFtYMyWyxS2XD5r8gRwcRg7
+0nz6bLM53DjKweO+Yl+pIVPFAyXL0pwzQDlnjShsCzyzjA9lJftkQwbcMWopeegJ
+kPLmiq4VAoGBAOqDmySNx8vmWWMOaXKFuH6Gqu/Nd7gBHxZ73wvsEmvV52xwa0oi
+55h+v6P1YEaNZQWXDFsvILoOUHr2kwZY+Du/MC7tgqpj+Fu3h7UHslulJRE3A+sN
+oLbHjZuwm3wwsatpHdyEYOGg0HIGWXi+9pDT/1gy8g3L2Gf0X6rfkBBXAoGBAN2v
+lbii0+HvZ2y0D0P6NfUJ6cQDrSyuTe7UW6OVYjBjrVAk8+bhnQ4eKd9edCnUDqu6
+9C8ZSrqR6VBeItbt8y+5ZCRcrigxd2VdH8rL9g6idD9RPnSbHx7Al8DxSUv25xMK
+8Z/ZOAvuCmwDfdleycNDoTawKqLtWBzUEntLs5DbAoGAPlTKiJWylAxel8h92HWY
+SvDqQCChgGOz6prz9sxBPS42e4kJy0OpwMt3jlGqzDXKswipvRayoSEq3PPqshY1
+rFOtr9trDnTRzzbhuAkaq+ciCghQX0pY/BvgFJCFUyXyIzgmOrVotq+yl4v+fexr
+xqTCSqQH2AjlNQQr5VPUi7MCgYEAsNbbMXE6YlXug+lS8CANoM3qm4FvSGA3LNhb
+za9hp0YsP+1qXvgEp/lp35RiR+ewWE+HcHbVhOTWYFTnp9ojDyPtfZAtIUTsgIB7
+1vNC8kOnRccSckQ32/k4VSJlHOL1S9yECMZnjiSyTZ2va5HQkyJE3PJE4LlCe6S0
+pYQq1tcCgYEAoJDeSeAPqi5NIu+MWNUWzw4vo5raKyHrJi+cTvKyM/2zJFHvBc5f
+RaxkcIAOmIDoVdFgy6APY/0DnDnpqT1kMagUaxZjG9PLFIDds5DRaL99m+S7l8mt
+ySX/MbmhQHYWpVf2nL6pmfPuP4Ih6tbKIUUGA3wZXYYZ5r+pZFG1IrA=
+-----END RSA PRIVATE KEY-----"
+`;
@@ -0,0 +1,53 @@
+import sinon from "sinon";
+
+import { Config } from "talk-common/config";
+import {
+  createJWTSigningConfig,
+  extractJWTFromRequest,
+} from "talk-server/services/jwt";
+import { Request } from "talk-server/types/express";
+
+describe("extractJWTFromRequest", () => {
+  it("extracts the token from header", () => {
+    const req = {
+      headers: {
+        authorization: "Bearer token",
+      },
+      url: "",
+    };
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
+
+    delete req.headers.authorization;
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
+  });
+
+  it("extracts the token from query string", () => {
+    const req = {
+      url: "",
+    };
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
+
+    req.url = "https://talk.coralproject.net/api?access_token=token";
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
+  });
+});
+
+describe("createJWTSigningConfig", () => {
+  it("parses a RSA certificate", () => {
+    const input = `-----BEGIN RSA PRIVATE KEY-----\\nMIIEpQIBAAKCAQEAyxR2DVlvkQRquggUQTpHN+PxDs2iOiItGgn6u4+faUCdgGEV\\nEnmG69//3lAZHnEQN9rkZS3/20zc41mTJnO7dslJbB316vWUSIwYcVY/VC9DTbk+\\nMHWZd94p5hOB8PoY2vEGA53KiyWLqQC5FWE3u7cz7eYTr9/eRPDTc15IzohLXd5U\\nC9EbO5ebho2CvWrBfrLozM5Kidp8r3Jp+A0o3kfJ/kRDDn/BmG6pM0TohWZFYMs2\\nnQaGg+of9tcafgAs7hZAgBrrcc/jke6+MKxpC8algik79nMk7s7prxF1Z9EbAeQV\\n1ssL2VgsjvGAHIV+Arckl6QJbVDvQXNAM0PqbQIDAQABAoIBAQCoG6D5vf5P8nMS\\n2ltB/6cyyfsjgO/45Y+mTXqERwj0DOwUeMkDyRv6KCxb8LxKade+FPIaG7D/7amw\\nfdcE7qrRUyD3YfnPbUk5oNcfAwFbg+BX969WWBMZmgvfDGj1fWKT4w9ScQ1YkFUD\\nKrkLzLVhK+/N0Dad0VjiguTXTMZCSDFOY9fO8HRF6EA3aewEPeEY62J6rSjGXvWB\\nGdW+FNvf/uRr36xGHNqiOP837pdVUppjgDyVsORnMfFtYMyWyxS2XD5r8gRwcRg7\\n0nz6bLM53DjKweO+Yl+pIVPFAyXL0pwzQDlnjShsCzyzjA9lJftkQwbcMWopeegJ\\nkPLmiq4VAoGBAOqDmySNx8vmWWMOaXKFuH6Gqu/Nd7gBHxZ73wvsEmvV52xwa0oi\\n55h+v6P1YEaNZQWXDFsvILoOUHr2kwZY+Du/MC7tgqpj+Fu3h7UHslulJRE3A+sN\\noLbHjZuwm3wwsatpHdyEYOGg0HIGWXi+9pDT/1gy8g3L2Gf0X6rfkBBXAoGBAN2v\\nlbii0+HvZ2y0D0P6NfUJ6cQDrSyuTe7UW6OVYjBjrVAk8+bhnQ4eKd9edCnUDqu6\\n9C8ZSrqR6VBeItbt8y+5ZCRcrigxd2VdH8rL9g6idD9RPnSbHx7Al8DxSUv25xMK\\n8Z/ZOAvuCmwDfdleycNDoTawKqLtWBzUEntLs5DbAoGAPlTKiJWylAxel8h92HWY\\nSvDqQCChgGOz6prz9sxBPS42e4kJy0OpwMt3jlGqzDXKswipvRayoSEq3PPqshY1\\nrFOtr9trDnTRzzbhuAkaq+ciCghQX0pY/BvgFJCFUyXyIzgmOrVotq+yl4v+fexr\\nxqTCSqQH2AjlNQQr5VPUi7MCgYEAsNbbMXE6YlXug+lS8CANoM3qm4FvSGA3LNhb\\nza9hp0YsP+1qXvgEp/lp35RiR+ewWE+HcHbVhOTWYFTnp9ojDyPtfZAtIUTsgIB7\\n1vNC8kOnRccSckQ32/k4VSJlHOL1S9yECMZnjiSyTZ2va5HQkyJE3PJE4LlCe6S0\\npYQq1tcCgYEAoJDeSeAPqi5NIu+MWNUWzw4vo5raKyHrJi+cTvKyM/2zJFHvBc5f\\nRaxkcIAOmIDoVdFgy6APY/0DnDnpqT1kMagUaxZjG9PLFIDds5DRaL99m+S7l8mt\\nySX/MbmhQHYWpVf2nL6pmfPuP4Ih6tbKIUUGA3wZXYYZ5r+pZFG1IrA=\\n-----END RSA PRIVATE KEY-----`;
+    const config = {
+      get: sinon.stub(),
+    };
+
+    config.get.withArgs("signing_secret").returns(input);
+    config.get.withArgs("signing_algorithm").returns("RS256");
+
+    const signingConfig = createJWTSigningConfig((config as any) as Config);
+
+    expect(signingConfig.algorithm).toEqual("RS256");
+    expect(signingConfig.secret.toString()).toMatchSnapshot();
+  });
+});
@@ -0,0 +1,132 @@
+import { Redis } from "ioredis";
+import jwt, { SignOptions } from "jsonwebtoken";
+import { Bearer } from "permit";
+import uuid from "uuid/v4";
+
+import { Config } from "talk-common/config";
+import { User } from "talk-server/models/user";
+import { Request } from "talk-server/types/express";
+
+export enum AsymmetricSigningAlgorithm {
+  RS256 = "RS256",
+  RS384 = "RS384",
+  RS512 = "RS512",
+  ES256 = "ES256",
+  ES384 = "ES384",
+  ES512 = "ES512",
+}
+
+export enum SymmetricSigningAlgorithm {
+  HS256 = "HS256",
+  HS384 = "HS384",
+  HS512 = "HS512",
+}
+
+export type JWTSigningAlgorithm =
+  | AsymmetricSigningAlgorithm
+  | SymmetricSigningAlgorithm;
+
+export interface JWTSigningConfig {
+  secret: Buffer;
+  algorithm: JWTSigningAlgorithm;
+}
+
+export function createAsymmetricSigningConfig(
+  algorithm: AsymmetricSigningAlgorithm,
+  secret: string
+): JWTSigningConfig {
+  return {
+    // Secrets have their newlines encoded with newline literals.
+    secret: Buffer.from(secret.replace(/\\n/g, "\n")),
+    algorithm,
+  };
+}
+
+export function createSymmetricSigningConfig(
+  algorithm: SymmetricSigningAlgorithm,
+  secret: string
+): JWTSigningConfig {
+  return {
+    secret: new Buffer(secret),
+    algorithm,
+  };
+}
+
+function isSymmetricSigningAlgorithm(
+  algorithm: string | SymmetricSigningAlgorithm
+): algorithm is SymmetricSigningAlgorithm {
+  return algorithm in SymmetricSigningAlgorithm;
+}
+
+function isAsymmetricSigningAlgorithm(
+  algorithm: string | AsymmetricSigningAlgorithm
+): algorithm is AsymmetricSigningAlgorithm {
+  return algorithm in AsymmetricSigningAlgorithm;
+}
+
+/**
+ * Parses the config and provides the signing config.
+ *
+ * @param config the server configuration
+ */
+export function createJWTSigningConfig(config: Config): JWTSigningConfig {
+  const secret = config.get("signing_secret");
+  const algorithm = config.get("signing_algorithm");
+  if (isSymmetricSigningAlgorithm(algorithm)) {
+    return createSymmetricSigningConfig(algorithm, secret);
+  } else if (isAsymmetricSigningAlgorithm(algorithm)) {
+    return createAsymmetricSigningConfig(algorithm, secret);
+  }
+
+  // TODO: (wyattjoh) return better error.
+  throw new Error("invalid algorithm specified");
+}
+
+export type SigningTokenOptions = Pick<SignOptions, "audience" | "issuer">;
+
+export const signTokenString = async (
+  { algorithm, secret }: JWTSigningConfig,
+  user: User,
+  options: SigningTokenOptions
+) =>
+  jwt.sign({}, secret, {
+    ...options,
+    jwtid: uuid(),
+    algorithm,
+    expiresIn: "1 day", // TODO: (wyattjoh) evaluate allowing configuration?
+    subject: user.id,
+  });
+
+export function extractJWTFromRequest(req: Request) {
+  const permit = new Bearer({
+    basic: "password",
+    query: "access_token",
+  });
+
+  return permit.check(req) || null;
+}
+
+function generateJTIBlacklistKey(jti: string) {
+  // jtib: JTI Blacklist namespace.
+  return `jtib:${jti}`;
+}
+
+export async function blacklistJWT(
+  redis: Redis,
+  jti: string,
+  validFor: number
+) {
+  await redis.setex(
+    generateJTIBlacklistKey(jti),
+    Math.ceil(validFor),
+    Date.now()
+  );
+}
+
+export async function checkBlacklistJWT(redis: Redis, jti: string) {
+  const expiredAtString = await redis.get(generateJTIBlacklistKey(jti));
+  if (expiredAtString) {
+    // TODO: (wyattjoh) return a better error.
+    throw new Error("JWT exists in blacklist");
+  }
+}
@@ -0,0 +1,50 @@
+import sinon from "sinon";
+
+import { Config } from "talk-common/config";
+import { Request } from "talk-server/types/express";
+import { createJWTSigningConfig, extractJWTFromRequest } from ".";
+
+describe("extractJWTFromRequest", () => {
+  it("extracts the token from header", () => {
+    const req = {
+      headers: {
+        authorization: "Bearer token",
+      },
+      url: "",
+    };
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
+
+    delete req.headers.authorization;
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
+  });
+
+  it("extracts the token from query string", () => {
+    const req = {
+      url: "",
+    };
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual(null);
+
+    req.url = "https://talk.coralproject.net/api?access_token=token";
+
+    expect(extractJWTFromRequest((req as any) as Request)).toEqual("token");
+  });
+});
+
+describe("createJWTSigningConfig", () => {
+  it("parses a RSA certificate", () => {
+    const input = `-----BEGIN RSA PRIVATE KEY-----\\nMIIEpQIBAAKCAQEAyxR2DVlvkQRquggUQTpHN+PxDs2iOiItGgn6u4+faUCdgGEV\\nEnmG69//3lAZHnEQN9rkZS3/20zc41mTJnO7dslJbB316vWUSIwYcVY/VC9DTbk+\\nMHWZd94p5hOB8PoY2vEGA53KiyWLqQC5FWE3u7cz7eYTr9/eRPDTc15IzohLXd5U\\nC9EbO5ebho2CvWrBfrLozM5Kidp8r3Jp+A0o3kfJ/kRDDn/BmG6pM0TohWZFYMs2\\nnQaGg+of9tcafgAs7hZAgBrrcc/jke6+MKxpC8algik79nMk7s7prxF1Z9EbAeQV\\n1ssL2VgsjvGAHIV+Arckl6QJbVDvQXNAM0PqbQIDAQABAoIBAQCoG6D5vf5P8nMS\\n2ltB/6cyyfsjgO/45Y+mTXqERwj0DOwUeMkDyRv6KCxb8LxKade+FPIaG7D/7amw\\nfdcE7qrRUyD3YfnPbUk5oNcfAwFbg+BX969WWBMZmgvfDGj1fWKT4w9ScQ1YkFUD\\nKrkLzLVhK+/N0Dad0VjiguTXTMZCSDFOY9fO8HRF6EA3aewEPeEY62J6rSjGXvWB\\nGdW+FNvf/uRr36xGHNqiOP837pdVUppjgDyVsORnMfFtYMyWyxS2XD5r8gRwcRg7\\n0nz6bLM53DjKweO+Yl+pIVPFAyXL0pwzQDlnjShsCzyzjA9lJftkQwbcMWopeegJ\\nkPLmiq4VAoGBAOqDmySNx8vmWWMOaXKFuH6Gqu/Nd7gBHxZ73wvsEmvV52xwa0oi\\n55h+v6P1YEaNZQWXDFsvILoOUHr2kwZY+Du/MC7tgqpj+Fu3h7UHslulJRE3A+sN\\noLbHjZuwm3wwsatpHdyEYOGg0HIGWXi+9pDT/1gy8g3L2Gf0X6rfkBBXAoGBAN2v\\nlbii0+HvZ2y0D0P6NfUJ6cQDrSyuTe7UW6OVYjBjrVAk8+bhnQ4eKd9edCnUDqu6\\n9C8ZSrqR6VBeItbt8y+5ZCRcrigxd2VdH8rL9g6idD9RPnSbHx7Al8DxSUv25xMK\\n8Z/ZOAvuCmwDfdleycNDoTawKqLtWBzUEntLs5DbAoGAPlTKiJWylAxel8h92HWY\\nSvDqQCChgGOz6prz9sxBPS42e4kJy0OpwMt3jlGqzDXKswipvRayoSEq3PPqshY1\\nrFOtr9trDnTRzzbhuAkaq+ciCghQX0pY/BvgFJCFUyXyIzgmOrVotq+yl4v+fexr\\nxqTCSqQH2AjlNQQr5VPUi7MCgYEAsNbbMXE6YlXug+lS8CANoM3qm4FvSGA3LNhb\\nza9hp0YsP+1qXvgEp/lp35RiR+ewWE+HcHbVhOTWYFTnp9ojDyPtfZAtIUTsgIB7\\n1vNC8kOnRccSckQ32/k4VSJlHOL1S9yECMZnjiSyTZ2va5HQkyJE3PJE4LlCe6S0\\npYQq1tcCgYEAoJDeSeAPqi5NIu+MWNUWzw4vo5raKyHrJi+cTvKyM/2zJFHvBc5f\\nRaxkcIAOmIDoVdFgy6APY/0DnDnpqT1kMagUaxZjG9PLFIDds5DRaL99m+S7l8mt\\nySX/MbmhQHYWpVf2nL6pmfPuP4Ih6tbKIUUGA3wZXYYZ5r+pZFG1IrA=\\n-----END RSA PRIVATE KEY-----`;
+    const config = {
+      get: sinon.stub(),
+    };
+
+    config.get.withArgs("signing_secret").returns(input);
+    config.get.withArgs("signing_algorithm").returns("RS256");
+
+    const signingConfig = createJWTSigningConfig((config as any) as Config);
+
+    expect(signingConfig.algorithm).toEqual("RS256");
+    expect(signingConfig.secret.toString()).toMatchSnapshot();
+  });
+});