cloudron-box/src/oidc.js

'use strict';

exports = module.exports = {
    getProvider,
    clients: {
        add: clientsAdd,
        get: clientsGet,
        del: clientsDel,
        update: clientsUpdate,
        list: clientsList
    },
    routes: {
        renderInteractionPage,
        interactionLogin,
        interactionConfirm,
        interactionAbort
    }
};

const assert = require('assert'),
    BoxError = require('./boxerror.js'),
    database = require('./database.js'),
    debug = require('debug')('box:oidc'),
    fs = require('fs'),
    middleware = require('./middleware'),
    path = require('path'),
    paths = require('./paths.js'),
    HttpError = require('connect-lastmile').HttpError,
    HttpSuccess = require('connect-lastmile').HttpSuccess,
    users = require('./users.js'),
    safe = require('safetydance'),
    settings = require('./settings.js');

const OIDC_CLIENTS_TABLE_NAME = 'oidcClients';
const OIDC_CLIENTS_FIELDS = [ 'id', 'secret', 'loginRedirectUri', 'logoutRedirectUri' ];

async function clientsAdd(id, secret, loginRedirectUri, logoutRedirectUri) {
    assert.strictEqual(typeof id, 'string');
    assert.strictEqual(typeof secret, 'string');
    assert.strictEqual(typeof loginRedirectUri, 'string');
    assert.strictEqual(typeof logoutRedirectUri, 'string');

    const query = 'INSERT INTO oidcClients (id, secret, loginRedirectUri, logoutRedirectUri) VALUES (?, ?, ?)';
    const args = [ id, secret, loginRedirectUri, logoutRedirectUri ];

    const [error] = await safe(database.query(query, args));
    if (error && error.code === 'ER_DUP_ENTRY') throw new BoxError(BoxError.ALREADY_EXISTS, 'client already exists');
    if (error) throw error;
}

async function clientsGet(id) {
    assert.strictEqual(typeof id, 'string');

    debug(`clientsGet: id:${id}`);

    const result = await database.query(`SELECT ${OIDC_CLIENTS_FIELDS} FROM ${OIDC_CLIENTS_TABLE_NAME} WHERE id = ?`, [ id ]);
    if (result.length === 0) return null;

    return result[0];
}

async function clientsUpdate(id, secret, loginRedirectUri, logoutRedirectUri) {
    assert.strictEqual(typeof id, 'string');
    assert.strictEqual(typeof secret, 'string');
    assert.strictEqual(typeof loginRedirectUri, 'string');
    assert.strictEqual(typeof logoutRedirectUri, 'string');

    const result = await database.query(`UPDATE ${OIDC_CLIENTS_TABLE_NAME} SET secret=?, loginRedirectUri=?, logoutRedirectUri=? WHERE id = ?`, [ secret, loginRedirectUri, logoutRedirectUri, id]);
    if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'client not found');
}

async function clientsDel(id) {
    assert.strictEqual(typeof id, 'string');

    const result = await database.query(`DELETE FROM ${OIDC_CLIENTS_TABLE_NAME} WHERE id = ?`, [ id ]);
    if (result.affectedRows !== 1) throw new BoxError(BoxError.NOT_FOUND, 'client not found');
}

async function clientsList() {
    const results = await database.query(`SELECT * FROM ${OIDC_CLIENTS_TABLE_NAME}`, []);
    return results;
}

class CloudronAdapter {

  /**
   *
   * Creates an instance of MyAdapter for an oidc-provider model.
   *
   * @constructor
   * @param {string} name Name of the oidc-provider model. One of "Grant, "Session", "AccessToken",
   * "AuthorizationCode", "RefreshToken", "ClientCredentials", "Client", "InitialAccessToken",
   * "RegistrationAccessToken", "DeviceCode", "Interaction", "ReplayDetection",
   * "BackchannelAuthenticationRequest", or "PushedAuthorizationRequest"
   *
   */
    constructor(name) {
        this.name = name;

        if (this.name === 'Client') {
            this.store = null;
            this.fileStorePath = null;
        } else {
            this.fileStorePath = path.join(paths.OIDC_STORE_DIR, `${name}.json`);

            debug(`Creating adapter for ${name} backed by ${this.fileStorePath}`);

            let data = {};
            try {
                data = JSON.parse(fs.readFileSync(this.fileStorePath), 'utf8');
            } catch (e) {
                debug(`filestore for adapter ${name} not found, start with new one`);
            }

            this.store = data;
        }
    }

  /**
   *
   * Update or Create an instance of an oidc-provider model.
   *
   * @return {Promise} Promise fulfilled when the operation succeeded. Rejected with error when
   * encountered.
   * @param {string} id Identifier that oidc-provider will use to reference this model instance for
   * future operations.
   * @param {object} payload Object with all properties intended for storage.
   * @param {integer} expiresIn Number of seconds intended for this model to be stored.
   *
   */
    async upsert(id, payload, expiresIn) {
        debug(`[${this.name}] upsert id:${id} expiresIn:${expiresIn}`, payload);

        if (this.name === 'Client') {
            console.log('WARNING!! this should not happen as it is stored in our db');
        } else {
            this.store[id] = { id, expiresIn, payload, consumed: false };
            if (this.fileStorePath) fs.writeFileSync(this.fileStorePath, JSON.stringify(this.store), 'utf8');
        }
    }

  /**
   *
   * Return previously stored instance of an oidc-provider model.
   *
   * @return {Promise} Promise fulfilled with what was previously stored for the id (when found and
   * not dropped yet due to expiration) or falsy value when not found anymore. Rejected with error
   * when encountered.
   * @param {string} id Identifier of oidc-provider model
   *
   */
    async find(id) {
        debug(`[${this.name}] find id:${id}`);

        if (this.name === 'Client') {
            const [error, client] = await safe(clientsGet(id));
            if (error) return null;

            debug(`[${this.name}] find id:${id}`, client);

            return {
                client_id: id,
                client_secret: client.secret,
                redirect_uris: [ client.loginRedirectUri ],
                post_logout_redirect_uris: [ client.logoutRedirectUri ],
            };
        } else {
            if (!this.store[id]) return false;

            debug(`[${this.name}] find id:${id}`, this.store[id]);

            return this.store[id].payload;
        }
    }

  /**
   *
   * Return previously stored instance of DeviceCode by the end-user entered user code. You only
   * need this method for the deviceFlow feature
   *
   * @return {Promise} Promise fulfilled with the stored device code object (when found and not
   * dropped yet due to expiration) or falsy value when not found anymore. Rejected with error
   * when encountered.
   * @param {string} userCode the user_code value associated with a DeviceCode instance
   *
   */
    async findByUserCode(userCode) {
        debug(`[${this.name}] FIXME findByUserCode userCode:${userCode}`);
    }

  /**
   *
   * Return previously stored instance of Session by its uid reference property.
   *
   * @return {Promise} Promise fulfilled with the stored session object (when found and not
   * dropped yet due to expiration) or falsy value when not found anymore. Rejected with error
   * when encountered.
   * @param {string} uid the uid value associated with a Session instance
   *
   */
    async findByUid(uid) {
        debug(`[${this.name}] findByUid uid:${uid}`);

        if (this.name === 'Client') {
            console.log('WARNING!! this should not happen as it is stored in our db');
        } else {
            for (let d in this.store) {
                if (this.store[d].payload.uid === uid) return this.store[d].payload;
            }

            return false;
        }
    }

  /**
   *
   * Mark a stored oidc-provider model as consumed (not yet expired though!). Future finds for this
   * id should be fulfilled with an object containing additional property named "consumed" with a
   * truthy value (timestamp, date, boolean, etc).
   *
   * @return {Promise} Promise fulfilled when the operation succeeded. Rejected with error when
   * encountered.
   * @param {string} id Identifier of oidc-provider model
   *
   */
    async consume(id) {
        debug(`[${this.name}] consume id:${id}`);

        if (this.name === 'Client') {
            console.log('WARNING!! this should not happen as it is stored in our db');
        } else {
            if (this.store[id]) this.store[id].consumed = true;

            if (this.fileStorePath) fs.writeFileSync(this.fileStorePath, JSON.stringify(this.store), 'utf8');
        }
    }

  /**
   *
   * Destroy/Drop/Remove a stored oidc-provider model. Future finds for this id should be fulfilled
   * with falsy values.
   *
   * @return {Promise} Promise fulfilled when the operation succeeded. Rejected with error when
   * encountered.
   * @param {string} id Identifier of oidc-provider model
   *
   */
    async destroy(id) {
        debug(`[${this.name}] destroy id:${id}`);

        if (this.name === 'Client') {
            console.log('WARNING!! this should not happen as it is stored in our db');
        } else {
            delete this.store[id];

            if (this.fileStorePath) fs.writeFileSync(this.fileStorePath, JSON.stringify(this.store), 'utf8');
        }
    }

  /**
   *
   * Destroy/Drop/Remove a stored oidc-provider model by its grantId property reference. Future
   * finds for all tokens having this grantId value should be fulfilled with falsy values.
   *
   * @return {Promise} Promise fulfilled when the operation succeeded. Rejected with error when
   * encountered.
   * @param {string} grantId the grantId value associated with a this model's instance
   *
   */
    async revokeByGrantId(grantId) {
        debug(`[${this.name}] revokeByGrantId grantId:${grantId}`);

        if (this.name === 'Client') {
            console.log('WARNING!! this should not happen as it is stored in our db');
        } else {
            for (let d in this.store) {
                if (this.store[d].grantId === grantId) {
                    delete this.store[d];
                    return;
                }
            }
        }
    }
}

function renderInteractionPage(routePrefix, provider) {
    assert.strictEqual(typeof routePrefix, 'string');
    assert.strictEqual(typeof provider, 'object');

    return async function (req, res, next) {
        try {
            const { uid, prompt, params, session } = await provider.interactionDetails(req, res);
            console.log('details', await provider.interactionDetails(req, res));

            debug(`route interaction get uid:${uid} prompt.name:${prompt.name} client_id:${params.client_id} session:${session}`);

            const client = await provider.Client.find(params.client_id);

            switch (prompt.name) {
                case 'login': {
                    return res.render('login', {
                        client,
                        submitUrl: `${routePrefix}/interaction/${uid}/login`,
                        uid,
                        details: prompt.details,
                        params,
                        title: 'Sign-in',
                        session: session ? debug(session) : undefined,
                        dbg: {
                            params: debug(params),
                            prompt: debug(prompt),
                        },
                    });
                }
                case 'consent': {
                    return res.render('interaction', {
                        client,
                        submitUrl: `${routePrefix}/interaction/${uid}/confirm`,
                        uid,
                        details: prompt.details,
                        params,
                        title: 'Authorize',
                        session: session ? debug(session) : undefined,
                        dbg: {
                            params: debug(params),
                            prompt: debug(prompt),
                        },
                    });
                }
                default:
                    return undefined;
            }
        } catch (error) {
            debug(`route interaction get uid:${uid} error`);
            console.log(error);

            return next(error);
        }
    };
}

function interactionLogin(provider) {
    assert.strictEqual(typeof provider, 'object');

    return async function(req, res, next) {
        const [detailsError, details] = await safe(provider.interactionDetails(req, res));
        if (detailsError) return next(new HttpError(500, detailsError));

        const uid = details.uid;
        const prompt = details.prompt;
        const name = prompt.name;

        debug(`route interaction login post uid:${uid} prompt.name:${name}`, req.body);

        assert.equal(name, 'login');

        if (!req.body.username || typeof req.body.username !== 'string') return next(new HttpError(400, 'A username must be non-empty string'));
        if (!req.body.password || typeof req.body.password !== 'string') return next(new HttpError(400, 'A password must be non-empty string'));
        if ('totpToken' in req.body && typeof req.body.totpToken !== 'string') return next(new HttpError(400, 'totpToken must be a string' ));

        const { username, password, totpToken } = req.body;

        const verifyFunc = username.indexOf('@') === -1 ? users.verifyWithUsername : users.verifyWithEmail;

        const [verifyError, user] =  await safe(verifyFunc(username, password, users.AP_WEBADMIN, { totpToken }));
        if (verifyError && verifyError.reason === BoxError.INVALID_CREDENTIALS) return next(new HttpError(401, verifyError.message));
        if (verifyError && verifyError.reason === BoxError.NOT_FOUND) return next(new HttpError(401, 'Unauthorized'));
        if (verifyError) return next(new HttpError(500, verifyError));
        if (!user) return next(new HttpError(401, 'Unauthorized'));

        // TODO we may have to check what else the Account class provides, in which case we have to map those things
        const result = {
            login: {
                accountId: user.id,
            },
        };

        const [interactionFinishError, redirectTo] = await safe(provider.interactionResult(req, res, result));
        if (interactionFinishError) return next(new HttpError(500, interactionFinishError));

        debug(`route interaction login post result redirectTo:${redirectTo}`);

        res.status(200).send({ redirectTo });
    };
}

function interactionConfirm(provider) {
    assert.strictEqual(typeof provider, 'object');

    return async function (req, res, next) {
        try {
            const interactionDetails = await provider.interactionDetails(req, res);
            const { uid, prompt: { name, details }, params, session: { accountId } } = interactionDetails;

            debug(`route interaction confirm post uid:${uid} prompt.name:${name} accountId:${accountId}`);

            assert.equal(name, 'consent');

            let { grantId } = interactionDetails;
            let grant;

            if (grantId) {
                // we'll be modifying existing grant in existing session
                grant = await provider.Grant.find(grantId);
            } else {
                // we're establishing a new grant
                grant = new provider.Grant({
                    accountId,
                    clientId: params.client_id,
                });
            }

            if (details.missingOIDCScope) {
                grant.addOIDCScope(details.missingOIDCScope.join(' '));
            }
            if (details.missingOIDCClaims) {
                grant.addOIDCClaims(details.missingOIDCClaims);
            }
            if (details.missingResourceScopes) {
                // eslint-disable-next-line no-restricted-syntax
                for (const [indicator, scopes] of Object.entries(details.missingResourceScopes)) {
                    grant.addResourceScope(indicator, scopes.join(' '));
                }
            }

            grantId = await grant.save();

            const consent = {};
            if (!interactionDetails.grantId) {
                // we don't have to pass grantId to consent, we're just modifying existing one
                consent.grantId = grantId;
            }

            const result = { consent };
            await provider.interactionFinished(req, res, result, { mergeWithLastSubmission: true });
        } catch (err) {
            next(err);
        }
    };
}

function interactionAbort(provider) {
    assert.strictEqual(typeof provider, 'object');

    return async function (req, res, next) {
        debug(`route interaction abort`);

        try {
            const result = {
                error: 'access_denied',
                error_description: 'End-User aborted interaction',
            };
            await provider.interactionFinished(req, res, result, { mergeWithLastSubmission: false });
        } catch (err) {
            next(err);
        }
    };
}

/**
   * @param use - can either be "id_token" or "userinfo", depending on
   *   where the specific claims are intended to be put in.
   * @param scope - the intended scope, while oidc-provider will mask
   *   claims depending on the scope automatically you might want to skip
   *   loading some claims from external resources etc. based on this detail
   *   or not return them in id tokens but only userinfo and so on.
   */
async function claims(userId, use, scope) {
    debug(`claims: userId:${userId} use:${use} scope:${scope}`);

    const [error, user] = await safe(users.get(userId));
    if (error) return { error: 'user not found' };

    const displayName = user.displayName || user.username || ''; // displayName can be empty and username can be null
    const nameParts = displayName.split(' ');
    const firstName = nameParts[0];
    const lastName = nameParts.length > 1  ? nameParts[nameParts.length - 1] : ''; // choose last part, if it exists

    const claims = {
        sub: user.username, // it is essential to always return a sub claim
        email: user.email,
        email_verified: true,
        family_name: lastName,
        given_name: firstName,
        locale: 'en-US',
        name: user.displayName,
        preferred_username: user.username
    };

    debug(`claims: userId:${userId} result`, claims);

    return claims;
}

async function logoutSource(ctx, form) {
  // @param ctx - koa request context
  // @param form - form source (id="op.logoutForm") to be embedded in the page and submitted by
  //   the End-User
  ctx.body = `<!DOCTYPE html>
    <head>
      <title>Logout Request</title>
      <style>/* css and html classes omitted for brevity, see lib/helpers/defaults.js */</style>
    </head>
    <body>
      <div>
        <h1>Cloudron Do you want to sign-out from ${ctx.host}?</h1>
        ${form}
        <button autofocus type="submit" form="op.logoutForm" value="yes" name="logout">Yes, sign me out</button>
        <button type="submit" form="op.logoutForm">No, stay signed in</button>
      </div>
    </body>
    </html>`;
}

async function postLogoutSuccessSource(ctx) {
  // @param ctx - koa request context
  const {
    clientId, clientName, clientUri, initiateLoginUri, logoUri, policyUri, tosUri,
  } = ctx.oidc.client || {}; // client is defined if the user chose to stay logged in with the OP
  const display = clientName || clientId;
  ctx.body = `<!DOCTYPE html>
    <head>
      <title>Sign-out Success</title>
      <style>/* css and html classes omitted for brevity, see lib/helpers/defaults.js */</style>
    </head>
    <body>
      <div>
        <h1>Cloudron Sign-out Success</h1>
        <p>Your sign-out ${display ? `with ${display}` : ''} was successful.</p>
      </div>
    </body>
    </html>`;
}

async function getProvider(routePrefix) {
    assert.strictEqual(typeof routePrefix, 'string');

    const { Provider } = await import('oidc-provider');

    const configuration = {
        async findAccount(ctx, id) {
            debug(`findAccount id:${id}`);

            return {
                accountId: id,
                async claims(use, scope) { return await claims(id, use, scope); },
            };
        },
        adapter: CloudronAdapter,
        interactions: {
            url: async function(ctx, interaction) {
                return `${routePrefix}/interaction/${interaction.uid}`;
            }
        },
        claims: {
            email: ['email', 'email_verified'],
            profile: [ 'family_name', 'given_name', 'locale', 'name', 'preferred_username' ]
        },
        features: {
            devInteractions: { enabled: false },
            rpInitiatedLogout: {
                enabled: true,
                logoutSource,
                postLogoutSuccessSource
            },
        },
        // if a client only has one redirect uri specified, the client does not have to provide it in the request
        allowOmittingSingleRegisteredRedirectUri: true,
        clients: [],
        cookies: {
            // FIXME https://github.com/panva/node-oidc-provider/blob/b1c1a9318036c2d3793cc9e668f99937c5c36bc6/lib/helpers/defaults.js#L770
            keys: [ 'cookiesecret1', 'cookiesecret2' ]
        },
        pkce: {
            required: function pkceRequired(ctx, client) {
                return false;
            }
        },
        ttl: {
            // in seconds, can also be a function returning the seconds https://github.com/panva/node-oidc-provider/blob/b1c1a9318036c2d3793cc9e668f99937c5c36bc6/docs/README.md#ttl
            AccessToken: 3600, // 1 hour
            IdToken: 3600, // 1 hour
            Grant: 1209600, // 14 days
            Session: 1209600, // 14 days
            Interaction: 3600 // 1 hour
        }
    };

    const provider = new Provider(`https://${settings.dashboardFqdn()}${routePrefix}`, configuration);
    provider.proxy = true

    return provider;
}