tachybase_todo/packages/plugins/@nocobase/plugin-oidc/src/server/oidc-auth.ts
chenos b359f9eac6
feat: supports subdirectory deployment (#3731)
* feat: supports subdirectory deployment

* feat: auto publicPath

* fix: buildIndexHtml

* fix: format

* fix: regexp

* fix: test error

* fix: nocobase.conf

* fix: path

* fix: nocobase.conf

* fix: bugs

* fix: resourcer prefix

* fix: cas
2024-03-16 20:01:34 +08:00

139 lines
4.2 KiB
TypeScript

import { AuthConfig, BaseAuth } from '@nocobase/auth';
import { AuthModel } from '@nocobase/plugin-auth';
import { Issuer } from 'openid-client';
import { cookieName } from '../constants';
export class OIDCAuth extends BaseAuth {
constructor(config: AuthConfig) {
const { ctx } = config;
super({
...config,
userCollection: ctx.db.getCollection('users'),
});
}
getRedirectUri() {
const ctx = this.ctx;
const { http, port } = this.getOptions();
const protocol = http ? 'http' : 'https';
const host = port ? `${ctx.hostname}${port ? `:${port}` : ''}` : ctx.host;
return `${protocol}://${host}${process.env.API_BASE_PATH}oidc:redirect`;
}
getOptions() {
return this.options?.oidc || {};
}
getExchangeBody() {
const options = this.getOptions();
const { exchangeBodyKeys } = options;
if (!exchangeBodyKeys) {
return {};
}
const body = {};
exchangeBodyKeys
.filter((item: { enabled: boolean }) => item.enabled)
.forEach((item: { paramName: string; optionsKey: string }) => {
const name = item.paramName || item.optionsKey;
body[name] = options[item.optionsKey];
});
return body;
}
mapField(userInfo: { [source: string]: any }) {
const { fieldMap } = this.getOptions();
if (!fieldMap) {
return userInfo;
}
fieldMap.forEach((item: { source: string; target: string }) => {
const { source, target } = item;
if (userInfo[source]) {
userInfo[target] = userInfo[source];
}
});
return userInfo;
}
async createOIDCClient() {
const { issuer, clientId, clientSecret, idTokenSignedResponseAlg } = this.getOptions();
const oidc = await Issuer.discover(issuer);
return new oidc.Client({
client_id: clientId,
client_secret: clientSecret,
id_token_signed_response_alg: idTokenSignedResponseAlg || 'RS256',
});
}
async validate() {
const ctx = this.ctx;
const { params: values } = ctx.action;
const { userInfoMethod = 'GET', accessTokenVia = 'header', stateToken } = this.getOptions();
const token = stateToken || ctx.cookies.get(cookieName);
const search = new URLSearchParams(decodeURIComponent(values.state));
if (search.get('token') !== token) {
ctx.logger.error('nocobase_oidc state mismatch', { method: 'validate' });
return null;
}
const client = await this.createOIDCClient();
const tokens = await client.callback(
this.getRedirectUri(),
{
code: values.code,
iss: values.iss,
},
{},
{ exchangeBody: this.getExchangeBody() },
);
const userInfo: { [key: string]: any } = await client.userinfo(tokens, {
method: userInfoMethod,
via: accessTokenVia !== 'query' ? accessTokenVia : 'header',
params:
accessTokenVia === 'query'
? {
access_token: tokens.access_token,
}
: {},
});
const mappedUserInfo = this.mapField(userInfo);
const { nickname, username, name, sub, email, phone } = mappedUserInfo;
const authenticator = this.authenticator as AuthModel;
let user = await authenticator.findUser(sub);
if (user) {
return user;
}
// Bind existed user
const { userBindField = 'email' } = this.getOptions();
if (userBindField === 'email' && email) {
user = await this.userRepository.findOne({
filter: { email },
});
} else if (userBindField === 'username' && username) {
user = await this.userRepository.findOne({
filter: { username },
});
}
if (user) {
await authenticator.addUser(user.id, {
through: {
uuid: sub,
},
});
return user;
}
// Create new user
const { autoSignup } = this.options?.public || {};
if (!autoSignup) {
throw new Error('User not found');
}
if (username && !this.validateUsername(username)) {
throw new Error('Username must be 2-16 characters in length (excluding @.<>"\'/)');
}
return await authenticator.newUser(sub, {
username: username ?? null,
nickname: nickname || name || username || sub,
email: email ?? null,
phone: phone ?? null,
});
}
}