# all files / red/api/auth/ strategies.js

98.55% Statements 68/69
95% Branches 19/20
100% Functions 15/15
98.55% Lines 68/69
1 branch Ignored

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135

    1×
    1×

    1×
    1×
    1×

    1×
    1×
    1×
    1×

    1×

    1×

    3×
    3×
    2×
    2×
    1×

    1×
    1×

    1×
    1×

    1×

    1×
    3×
    3×
    1×

    2×
    2×

    1×

    1×
    1×

    1×
    9×
    9×
    18×

    9×
    9×
    9×

    27×
    27×

    9×
    1×
    1×
    1×

    8×
    8×
    2×

    2×
    1×
    3×

    1×
    1×
    1×

    1×
    1×

    6×
    6×

    1×
    1×
    1×

    1×
    1×
    2×
    2×
    2×
    1×

    1×

    1×

    3×

     /**
     * Copyright JS Foundation and other contributors, http://js.foundation
     *
     * Licensed under the Apache License, Version 2.0 (the "License");
     * you may not use this file except in compliance with the License.
     * You may obtain a copy of the License at
     *
     * http://www.apache.org/licenses/LICENSE-2.0
     *
     * Unless required by applicable law or agreed to in writing, software
     * distributed under the License is distributed on an "AS IS" BASIS,
     * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     * See the License for the specific language governing permissions and
     * limitations under the License.
     **/

    var BearerStrategy = require('passport-http-bearer').Strategy;
    var ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy;

    var passport = require("passport");
    var crypto = require("crypto");
    var util = require("util");

    var Tokens = require("./tokens");
    var Users = require("./users");
    var Clients = require("./clients");
    var permissions = require("./permissions");

    var log;

    var bearerStrategy = function (accessToken, done) {
        // is this a valid token?
        Tokens.get(accessToken).then(function(token) {
            if (token) {
                Users.get(token.user).then(function(user) {
                    if (user) {
                        done(null,user,{scope:token.scope});
                    } else {
                        log.audit({event: "auth.invalid-token"});
                        done(null,false);
                    }
                });
            } else {
                log.audit({event: "auth.invalid-token"});
                done(null,false);
            }
        });
    }
    bearerStrategy.BearerStrategy = new BearerStrategy(bearerStrategy);

    var clientPasswordStrategy = function(clientId, clientSecret, done) {
        Clients.get(clientId).then(function(client) {
            if (client && client.secret == clientSecret) {
                done(null,client);
            } else {
                log.audit({event: "auth.invalid-client",client:clientId});
                done(null,false);
            }
        });
    }
    clientPasswordStrategy.ClientPasswordStrategy = new ClientPasswordStrategy(clientPasswordStrategy);

    var loginAttempts = [];
    var loginSignInWindow = 600000; // 10 minutes

    var passwordTokenExchange = function(client, username, password, scope, done) {
        var now = Date.now();
        loginAttempts = loginAttempts.filter(function(logEntry) {
            return logEntry.time + loginSignInWindow > now;
        });
        loginAttempts.push({time:now, user:username});
        var attemptCount = 0;
        loginAttempts.forEach(function(logEntry) {
            /* istanbul ignore else */
            Eif (logEntry.user == username) {
                attemptCount++;
            }
        });
        if (attemptCount > 5) {
            log.audit({event: "auth.login.fail.too-many-attempts",username:username,client:client.id});
            done(new Error("Too many login attempts. Wait 10 minutes and try again"),false);
            return;
        }

        Users.authenticate(username,password).then(function(user) {
            if (user) {
                Iif (scope === "") {
                    scope = user.permissions;
                }
                if (permissions.hasPermission(user.permissions,scope)) {
                    loginAttempts = loginAttempts.filter(function(logEntry) {
                        return logEntry.user !== username;
                    });
                    Tokens.create(username,client.id,scope).then(function(tokens) {
                        log.audit({event: "auth.login",username:username,client:client.id,scope:scope});
                        done(null,tokens.accessToken,null,{expires_in:tokens.expires_in});
                    });
                } else {
                    log.audit({event: "auth.login.fail.permissions",username:username,client:client.id,scope:scope});
                    done(null,false);
                }
            } else {
                log.audit({event: "auth.login.fail.credentials",username:username,client:client.id,scope:scope});
                done(null,false);
            }
        });
    }

    function AnonymousStrategy() {
      passport.Strategy.call(this);
      this.name = 'anon';
    }
    util.inherits(AnonymousStrategy, passport.Strategy);
    AnonymousStrategy.prototype.authenticate = function(req) {
        var self = this;
        Users.default().then(function(anon) {
            if (anon) {
                self.success(anon,{scope:anon.permissions});
            } else {
                self.fail(401);
            }
        });
    }

    module.exports = {
        init: function(runtime) {
            log = runtime.log;
        },
        bearerStrategy: bearerStrategy,
        clientPasswordStrategy: clientPasswordStrategy,
        passwordTokenExchange: passwordTokenExchange,
        anonymousStrategy: new AnonymousStrategy()
    }