Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const rootDir = __dirname;
const clientDir = path.join(rootDir, "../../client/dist");
// In a local dev environment add these to a .env file (but don't commit it)
// In Azure add these as application settings
const {
clientId = "clientID", // FIXME CHANGE THE default CLIENT_ID
tenantId,
UseScopeLevelAuth,
Scopes
} = process.env;
const level: "info" | "warn" | "error" = "info";
// Application specific scopes. Define in .env file if to use scopes and what the scopes are
const scopes = UseScopeLevelAuth === "true" ? Scopes.split(",") : null;
$log.info(`Scopes to use: ${scopes}`);
@ServerSettings({
rootDir,
acceptMimes: ["application/json"],
port: process.env.PORT || "8081",
httpsPort: false,
logger: {
debug: false,
logRequest: true,
requestFields: ["reqId", "method", "url", "headers", "query", "params", "duration"]
},
componentsScan: [
`${rootDir}/protocols/**/*.ts`,
`${rootDir}/services/**/*.ts`,
`${rootDir}/middlewares/**/*.ts`,
`${rootDir}/filters/**/*.ts`
const verifier = async (req: Req, token: ITokenPayload, done: VerifyCallback) => {
// Verify is the right place to check given token and return userinfo
try {
const options = req.ctx.endpoint.get(OAuthBearerOptions) || {}; // retrieve options configured for the endpoint
// check precondition and authenticate user by their token and given options
try {
const user = authService.verify(token, options);
if (!user) {
authService.add(token);
$log.info({event: "BearerStrategy - token: ", token});
return done(null, token);
}
$log.info({event: "BearerStrategy - user: ", token});
return done(null, user, token);
} catch (error) {
$log.error({event: "BearerStrategy", token, error});
return done(error);
}
} catch (error) {
return done(error);
}
};
verify(token: ITokenPayload, options: any): ITokenPayload {
if (token.tid !== AuthService.getTenantId()) {
throw new TenantIdError();
}
if (token.aud !== AuthService.getClientId()) {
throw new ClientIdError();
}
$log.info({event: "verify", options, UseScopeLevelAuth: process.env.UseScopeLevelAuth});
const {scopes} = options;
if (!scopes) {
// This is the case when on the endpoint is "@OAuthBearer()" ie. no scope
return token;
}
if (!(scopes && scopes.length && this.tokenInGivenOrApplicationScope(token.scp, scopes))) {
const requiredScope = scopes.length ? options.scopes[0] : null;
throw new InsufficientScopePermissions(requiredScope, token.scp);
}
return token;
}
whoAmI(@Session() session: any) {
$log.info("User in session =>", session.user);
return session.user && session.user.id ? `Hello user ${session.user.name}` : "Hello world";
}
helloNoAuthWorld(@OAuthParams("scopes") scopes: string[]) {
$log.info({event: "helloNoAuthWorld", scopes});
return {text: "hello world with no authorisation"};
}
postNoAuth(@OAuthParams("scopes") scopes: string[], @BodyParams() message: any) {
$log.info({event: "postNoAuth", scopes});
return {text: "No Auth: " + message.text};
}
}
postAuthNotScopedHead(@OAuthParams("scopes") scopes: string[], @BodyParams() message: any) {
$log.info({event: "postAuthNotScopedHead", scopes});
return {text: "Auth wout Scopes: " + message.text};
}
helloAuthScopesWorld(@OAuthParams("scopes") scopes: string[]) {
$log.info({event: "helloAuthScopesWorld", scopes});
return {text: "hello world with scopes"};
}
helloAuthNoScopesWorld(@OAuthParams("scopes") scopes: string[]) {
$log.info({event: "helloAuthNoScopesWorld", scopes});
return {text: "hello world auth but no scopes"};
}
postAuthScoped(@OAuthParams("scopes") scopes: string[], @BodyParams() message: any) {
$log.info({event: "postAuthScoped", scopes});
return {text: "Auth w Scopes: " + message.text};
}