Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
@inject(AuthorizationBindings.USER_PERMISSIONS)
private readonly getUserPermissions: UserPermissionsFn,
@repository(AuthClientRepository)
public authClientRepository: AuthClientRepository,
@repository(UserRepository)
public userRepo: UserRepository,
@repository(UserTenantRepository)
public userTenantRepo: UserTenantRepository,
@repository(UserTenantPermissionRepository)
public utPermsRepo: UserTenantPermissionRepository,
@repository(RefreshTokenRepository)
public refreshTokenRepo: RefreshTokenRepository,
) {}
// sonarignore_end
@authenticateClient(STRATEGY.CLIENT_PASSWORD)
@authenticate(STRATEGY.LOCAL)
@authorize(['*'])
@post('/auth/login', {
responses: {
[STATUS_CODE.OK]: {
description: 'Auth Code',
content: {
[CONTENT_TYPE.JSON]: Object,
},
},
},
})
async login(
@requestBody()
req: LoginRequest,
): Promise<{
}
const authClient = await this.authClientRepository.findOne({
where: {
clientId: refreshPayload.clientId,
},
});
if (!authClient) {
throw new HttpErrors.Unauthorized(AuthErrorKeys.ClientInvalid);
}
return this.createJWT(
{clientId: refreshPayload.clientId, userId: refreshPayload.userId},
authClient,
);
}
@authenticateClient(STRATEGY.CLIENT_PASSWORD)
@authenticate(
STRATEGY.GOOGLE_OAUTH2,
{
accessType: 'offline',
scope: ['profile', 'email'],
authorizationURL: process.env.GOOGLE_AUTH_URL,
callbackURL: process.env.GOOGLE_AUTH_CALLBACK_URL,
clientID: process.env.GOOGLE_AUTH_CLIENT_ID,
clientSecret: process.env.GOOGLE_AUTH_CLIENT_SECRET,
tokenURL: process.env.GOOGLE_AUTH_TOKEN_URL,
},
(req: Request) => {
return {
accessType: 'offline',
state: Object.keys(req.query)
.map(key => key + '=' + req.query[key])