diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index b996d572..bcb4c5de 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -34,7 +34,7 @@ Interested in more documentation on the API routes? Check out the [API documenta server ├── api - All API routes are contained within here │ └── middlewares - Koa middlewares specific to the API -├── auth - OAuth routes for Slack and Google, plus email authentication routes +├── auth - Authentication providers, in the form of passport.js strategies ├── commands - We are gradually moving to the command pattern for new write logic ├── config - Database configuration ├── emails - Transactional email templates diff --git a/app/components/GoogleLogo.js b/app/components/AuthLogo/GoogleLogo.js similarity index 100% rename from app/components/GoogleLogo.js rename to app/components/AuthLogo/GoogleLogo.js diff --git a/app/components/AuthLogo/index.js b/app/components/AuthLogo/index.js new file mode 100644 index 00000000..87d2de6f --- /dev/null +++ b/app/components/AuthLogo/index.js @@ -0,0 +1,19 @@ +// @flow +import * as React from "react"; +import SlackLogo from "../SlackLogo"; +import GoogleLogo from "./GoogleLogo"; + +type Props = {| + providerName: string, +|}; + +export default function AuthLogo({ providerName }: Props) { + switch (providerName) { + case "slack": + return ; + case "google": + return ; + default: + return null; + } +} diff --git a/app/components/NoticeAlert.js b/app/components/NoticeAlert.js index 92efbed9..c10b768d 100644 --- a/app/components/NoticeAlert.js +++ b/app/components/NoticeAlert.js @@ -11,7 +11,7 @@ export default function AlertNotice({ children }: { children: React.Node }) { viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg" - style={{ position: "relative", top: "2px" }} + style={{ position: "relative", top: "2px", marginRight: "4px" }} > - Authentication failed - we were unable to sign you in at this time. + Authentication failed – we were unable to sign you in at this time. Please try again. )} @@ -51,6 +51,12 @@ export default function Notices({ notice }: Props) { please contact a team admin. )} + {notice === "authentication-provider-disabled" && ( + + Authentication failed – this login method was disabled by a team + admin. + + )} ); } diff --git a/app/scenes/Login/Service.js b/app/scenes/Login/Provider.js similarity index 87% rename from app/scenes/Login/Service.js rename to app/scenes/Login/Provider.js index 633ffcb1..e166ea99 100644 --- a/app/scenes/Login/Service.js +++ b/app/scenes/Login/Provider.js @@ -2,10 +2,9 @@ import { EmailIcon } from "outline-icons"; import * as React from "react"; import styled from "styled-components"; +import AuthLogo from "components/AuthLogo"; import ButtonLarge from "components/ButtonLarge"; -import GoogleLogo from "components/GoogleLogo"; import InputLarge from "components/InputLarge"; -import SlackLogo from "components/SlackLogo"; import { client } from "utils/ApiClient"; type Props = { @@ -22,7 +21,7 @@ type State = { email: string, }; -class Service extends React.Component { +class Provider extends React.Component { state = { showEmailSignin: false, isSubmitting: false, @@ -98,22 +97,13 @@ class Service extends React.Component { ); } - const icon = - id === "slack" ? ( - - - - ) : id === "google" ? ( - - - - ) : undefined; + const icon = ; return ( (window.location.href = authUrl)} - icon={icon} + icon={icon ? {icon} : null} fullwidth > {isCreate ? "Sign up" : "Continue"} with {name} @@ -142,4 +132,4 @@ const Form = styled.form` justify-content: space-between; `; -export default Service; +export default Provider; diff --git a/app/scenes/Login/index.js b/app/scenes/Login/index.js index 0760b1ff..f98f0200 100644 --- a/app/scenes/Login/index.js +++ b/app/scenes/Login/index.js @@ -15,7 +15,7 @@ import OutlineLogo from "components/OutlineLogo"; import PageTitle from "components/PageTitle"; import TeamLogo from "components/TeamLogo"; import Notices from "./Notices"; -import Service from "./Service"; +import Provider from "./Provider"; import env from "env"; import useStores from "hooks/useStores"; @@ -41,8 +41,6 @@ function Login({ location }: Props) { auth.fetchConfig(); }, [auth]); - console.log(config); - if (auth.authenticated) { return ; } @@ -52,10 +50,10 @@ function Login({ location }: Props) { return null; } - const hasMultipleServices = config.services.length > 1; - const defaultService = find( - config.services, - (service) => service.id === auth.lastSignedIn && !isCreate + const hasMultipleProviders = config.providers.length > 1; + const defaultProvider = find( + config.providers, + (provider) => provider.id === auth.lastSignedIn && !isCreate ); const header = @@ -113,33 +111,35 @@ function Login({ location }: Props) { - {defaultService && ( - - + - {hasMultipleServices && ( + {hasMultipleProviders && ( <> - You signed in with {defaultService.name} last time. + + You signed in with {defaultProvider.name} last time. + )} )} - {config.services.map((service) => { - if (defaultService && service.id === defaultService.id) { + {config.providers.map((provider) => { + if (defaultProvider && provider.id === defaultProvider.id) { return null; } return ( - ); })} diff --git a/app/stores/AuthStore.js b/app/stores/AuthStore.js index 48f01972..2a779171 100644 --- a/app/stores/AuthStore.js +++ b/app/stores/AuthStore.js @@ -14,7 +14,7 @@ import { getCookieDomain } from "utils/domains"; const AUTH_STORE = "AUTH_STORE"; const NO_REDIRECT_PATHS = ["/", "/create", "/home"]; -type Service = {| +type Provider = {| id: string, name: string, authUrl: string, @@ -23,7 +23,7 @@ type Service = {| type Config = {| name?: string, hostname?: string, - services: Service[], + providers: Provider[], |}; export default class AuthStore { diff --git a/flow-typed/globals.js b/flow-typed/globals.js index 4687e9e9..4cee7a7d 100644 --- a/flow-typed/globals.js +++ b/flow-typed/globals.js @@ -1,6 +1,7 @@ // @flow declare var process: { exit: (code?: number) => void, + cwd: () => string, env: { [string]: string, }, diff --git a/flow-typed/npm/google-auth-library_vx.x.x.js b/flow-typed/npm/google-auth-library_vx.x.x.js deleted file mode 100644 index 8bfbed00..00000000 --- a/flow-typed/npm/google-auth-library_vx.x.x.js +++ /dev/null @@ -1,161 +0,0 @@ -// flow-typed signature: cb42a60ec13995444fb6e5202fef8698 -// flow-typed version: <>/google-auth-library_v^5.5.1/flow_v0.104.0 - -/** - * This is an autogenerated libdef stub for: - * - * 'google-auth-library' - * - * Fill this stub out by replacing all the `any` types. - * - * Once filled out, we encourage you to share your work with the - * community by sending a pull request to: - * https://github.com/flowtype/flow-typed - */ - -declare module 'google-auth-library' { - declare module.exports: any; -} - -/** - * We include stubs for each file inside this npm package in case you need to - * require those files directly. Feel free to delete any files that aren't - * needed. - */ -declare module 'google-auth-library/build/src/auth/authclient' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/computeclient' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/credentials' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/envDetect' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/googleauth' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/iam' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/idtokenclient' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/jwtaccess' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/jwtclient' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/loginticket' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/oauth2client' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/auth/refreshclient' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/crypto/browser/crypto' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/crypto/crypto' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/crypto/node/crypto' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/messages' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/options' { - declare module.exports: any; -} - -declare module 'google-auth-library/build/src/transporters' { - declare module.exports: any; -} - -// Filename aliases -declare module 'google-auth-library/build/src/auth/authclient.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/authclient'>; -} -declare module 'google-auth-library/build/src/auth/computeclient.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/computeclient'>; -} -declare module 'google-auth-library/build/src/auth/credentials.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/credentials'>; -} -declare module 'google-auth-library/build/src/auth/envDetect.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/envDetect'>; -} -declare module 'google-auth-library/build/src/auth/googleauth.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/googleauth'>; -} -declare module 'google-auth-library/build/src/auth/iam.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/iam'>; -} -declare module 'google-auth-library/build/src/auth/idtokenclient.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/idtokenclient'>; -} -declare module 'google-auth-library/build/src/auth/jwtaccess.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/jwtaccess'>; -} -declare module 'google-auth-library/build/src/auth/jwtclient.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/jwtclient'>; -} -declare module 'google-auth-library/build/src/auth/loginticket.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/loginticket'>; -} -declare module 'google-auth-library/build/src/auth/oauth2client.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/oauth2client'>; -} -declare module 'google-auth-library/build/src/auth/refreshclient.js' { - declare module.exports: $Exports<'google-auth-library/build/src/auth/refreshclient'>; -} -declare module 'google-auth-library/build/src/crypto/browser/crypto.js' { - declare module.exports: $Exports<'google-auth-library/build/src/crypto/browser/crypto'>; -} -declare module 'google-auth-library/build/src/crypto/crypto.js' { - declare module.exports: $Exports<'google-auth-library/build/src/crypto/crypto'>; -} -declare module 'google-auth-library/build/src/crypto/node/crypto.js' { - declare module.exports: $Exports<'google-auth-library/build/src/crypto/node/crypto'>; -} -declare module 'google-auth-library/build/src/index' { - declare module.exports: $Exports<'google-auth-library/build/src'>; -} -declare module 'google-auth-library/build/src/index.js' { - declare module.exports: $Exports<'google-auth-library/build/src'>; -} -declare module 'google-auth-library/build/src/messages.js' { - declare module.exports: $Exports<'google-auth-library/build/src/messages'>; -} -declare module 'google-auth-library/build/src/options.js' { - declare module.exports: $Exports<'google-auth-library/build/src/options'>; -} -declare module 'google-auth-library/build/src/transporters.js' { - declare module.exports: $Exports<'google-auth-library/build/src/transporters'>; -} diff --git a/package.json b/package.json index ad6bf72e..d68a8494 100644 --- a/package.json +++ b/package.json @@ -66,6 +66,7 @@ "@babel/preset-env": "^7.11.0", "@babel/preset-flow": "^7.10.4", "@babel/preset-react": "^7.10.4", + "@outlinewiki/koa-passport": "^4.1.4", "@rehooks/window-scroll-position": "^1.0.1", "@sentry/node": "^6.1.0", "@sentry/react": "^6.1.0", @@ -94,7 +95,6 @@ "flow-typed": "^2.6.2", "focus-visible": "^5.1.0", "fs-extra": "^4.0.2", - "google-auth-library": "^5.5.1", "http-errors": "1.4.0", "i18next": "^19.8.3", "i18next-http-backend": "^1.0.21", @@ -129,6 +129,9 @@ "nodemailer": "^4.4.0", "outline-icons": "^1.24.0", "oy-vey": "^0.10.0", + "passport": "^0.4.1", + "passport-google-oauth2": "^0.2.0", + "passport-slack-oauth2": "^1.1.0", "pg": "^8.5.1", "pg-hstore": "^2.3.3", "polished": "3.6.5", diff --git a/server/api/auth.js b/server/api/auth.js index 6d67a9be..429c496b 100644 --- a/server/api/auth.js +++ b/server/api/auth.js @@ -1,57 +1,45 @@ // @flow +import path from "path"; import Router from "koa-router"; -import { reject } from "lodash"; +import { find } from "lodash"; import { parseDomain, isCustomSubdomain } from "../../shared/utils/domains"; import { signin } from "../../shared/utils/routeHelpers"; import auth from "../middlewares/authentication"; import { Team } from "../models"; import { presentUser, presentTeam, presentPolicies } from "../presenters"; import { isCustomDomain } from "../utils/domains"; +import { requireDirectory } from "../utils/fs"; const router = new Router(); +let providers = []; -let services = []; - -if (process.env.GOOGLE_CLIENT_ID) { - services.push({ - id: "google", - name: "Google", - authUrl: signin("google"), - }); -} - -if (process.env.SLACK_KEY) { - services.push({ - id: "slack", - name: "Slack", - authUrl: signin("slack"), - }); -} - -services.push({ - id: "email", - name: "Email", - authUrl: "", -}); - -function filterServices(team) { - let output = services; - - const providerNames = team - ? team.authenticationProviders.map((provider) => provider.name) - : []; - - if (team && !providerNames.includes("google")) { - output = reject(output, (service) => service.id === "google"); - } - if (team && !providerNames.includes("slack")) { - output = reject(output, (service) => service.id === "slack"); - } - if (!team || !team.guestSignin) { - output = reject(output, (service) => service.id === "email"); +requireDirectory(path.join(__dirname, "..", "auth")).forEach( + ([{ config }, id]) => { + if (config && config.enabled) { + providers.push({ + id, + name: config.name, + authUrl: signin(id), + }); + } } +); - return output; +function filterProviders(team) { + return providers + .sort((provider) => (provider.id === "email" ? 1 : -1)) + .filter((provider) => { + // guest sign-in is an exception as it does not have an authentication + // provider using passport, instead it exists as a boolean option on the team + if (provider.id === "email") { + return team && team.guestSignin; + } + + return ( + !team || + find(team.authenticationProviders, { name: provider.id, enabled: true }) + ); + }); } router.post("auth.config", async (ctx) => { @@ -66,7 +54,7 @@ router.post("auth.config", async (ctx) => { ctx.body = { data: { name: team.name, - services: filterServices(team), + providers: filterProviders(team), }, }; return; @@ -83,7 +71,7 @@ router.post("auth.config", async (ctx) => { data: { name: team.name, hostname: ctx.request.hostname, - services: filterServices(team), + providers: filterProviders(team), }, }; return; @@ -108,7 +96,7 @@ router.post("auth.config", async (ctx) => { data: { name: team.name, hostname: ctx.request.hostname, - services: filterServices(team), + providers: filterProviders(team), }, }; return; @@ -118,7 +106,7 @@ router.post("auth.config", async (ctx) => { // Otherwise, we're requesting from the standard root signin page ctx.body = { data: { - services: filterServices(), + providers: filterProviders(), }, }; }); diff --git a/server/api/auth.test.js b/server/api/auth.test.js index a70bb71c..df6e3a65 100644 --- a/server/api/auth.test.js +++ b/server/api/auth.test.js @@ -41,3 +41,149 @@ describe("#auth.info", () => { expect(res.status).toEqual(401); }); }); + +describe("#auth.config", () => { + it("should return available SSO providers", async () => { + const res = await server.post("/api/auth.config"); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(2); + expect(body.data.providers[0].name).toBe("Slack"); + expect(body.data.providers[1].name).toBe("Google"); + }); + + it("should return available providers for team subdomain", async () => { + process.env.URL = "http://localoutline.com"; + + await buildTeam({ + guestSignin: false, + subdomain: "example", + authenticationProviders: [ + { + name: "slack", + providerId: "123", + }, + ], + }); + const res = await server.post("/api/auth.config", { + headers: { host: `example.localoutline.com` }, + }); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(1); + expect(body.data.providers[0].name).toBe("Slack"); + }); + + it("should return available providers for team custom domain", async () => { + await buildTeam({ + guestSignin: false, + domain: "docs.mycompany.com", + authenticationProviders: [ + { + name: "slack", + providerId: "123", + }, + ], + }); + const res = await server.post("/api/auth.config", { + headers: { host: "docs.mycompany.com" }, + }); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(1); + expect(body.data.providers[0].name).toBe("Slack"); + }); + + it("should return email provider for team when guest signin enabled", async () => { + process.env.URL = "http://localoutline.com"; + + await buildTeam({ + guestSignin: true, + subdomain: "example", + authenticationProviders: [ + { + name: "slack", + providerId: "123", + }, + ], + }); + const res = await server.post("/api/auth.config", { + headers: { host: "example.localoutline.com" }, + }); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(2); + expect(body.data.providers[0].name).toBe("Slack"); + expect(body.data.providers[1].name).toBe("Email"); + }); + + it("should not return provider when disabled", async () => { + process.env.URL = "http://localoutline.com"; + + await buildTeam({ + guestSignin: false, + subdomain: "example", + authenticationProviders: [ + { + name: "slack", + providerId: "123", + enabled: false, + }, + ], + }); + const res = await server.post("/api/auth.config", { + headers: { host: "example.localoutline.com" }, + }); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(0); + }); + + describe("self hosted", () => { + it("should return available providers for team", async () => { + process.env.DEPLOYMENT = ""; + + await buildTeam({ + guestSignin: false, + authenticationProviders: [ + { + name: "slack", + providerId: "123", + }, + ], + }); + const res = await server.post("/api/auth.config"); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(1); + expect(body.data.providers[0].name).toBe("Slack"); + }); + + it("should return email provider for team when guest signin enabled", async () => { + process.env.DEPLOYMENT = ""; + + await buildTeam({ + guestSignin: true, + authenticationProviders: [ + { + name: "slack", + providerId: "123", + }, + ], + }); + const res = await server.post("/api/auth.config"); + const body = await res.json(); + + expect(res.status).toEqual(200); + expect(body.data.providers.length).toBe(2); + expect(body.data.providers[0].name).toBe("Slack"); + expect(body.data.providers[1].name).toBe("Email"); + }); + }); +}); diff --git a/server/auth/README.md b/server/auth/README.md new file mode 100644 index 00000000..3da4f8fd --- /dev/null +++ b/server/auth/README.md @@ -0,0 +1,12 @@ +# Authentication Providers + +A new auth provider can be added with the addition of a single file in this +folder, and (optionally) a matching logo in `/app/components/AuthLogo/index.js` +that will appear on the signin button. + +Auth providers generally use [Passport](http://www.passportjs.org/) strategies, +although they can use any custom logic if needed. See the `google` auth provider for the cleanest example of what is required – some rules: + +- The strategy name _must_ be lowercase +- The stragegy _must_ call the `accountProvisioner` command in the verify callback +- The auth file _must_ export a `config` object with `name` and `enabled` keys diff --git a/server/auth/email.js b/server/auth/email.js index 1e40d8bd..59e22942 100644 --- a/server/auth/email.js +++ b/server/auth/email.js @@ -12,6 +12,11 @@ import { getUserForEmailSigninToken } from "../utils/jwt"; const router = new Router(); +export const config = { + name: "Email", + enabled: true, +}; + router.use(methodOverride()); router.use(validation()); diff --git a/server/auth/google.js b/server/auth/google.js index 948f8ddb..9f85c227 100644 --- a/server/auth/google.js +++ b/server/auth/google.js @@ -1,135 +1,100 @@ // @flow -import * as Sentry from "@sentry/node"; -import { OAuth2Client } from "google-auth-library"; -import invariant from "invariant"; +import passport from "@outlinewiki/koa-passport"; import Router from "koa-router"; import { capitalize } from "lodash"; -import Sequelize from "sequelize"; -import teamCreator from "../commands/teamCreator"; -import userCreator from "../commands/userCreator"; +import { Strategy as GoogleStrategy } from "passport-google-oauth2"; +import accountProvisioner from "../commands/accountProvisioner"; +import env from "../env"; +import { + GoogleWorkspaceRequiredError, + GoogleWorkspaceInvalidError, +} from "../errors"; import auth from "../middlewares/authentication"; -import { User } from "../models"; +import passportMiddleware from "../middlewares/passport"; +import { StateStore } from "../utils/passport"; const router = new Router(); -const client = new OAuth2Client( - process.env.GOOGLE_CLIENT_ID, - process.env.GOOGLE_CLIENT_SECRET, - `${process.env.URL}/auth/google.callback` -); +const providerName = "google"; +const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID; +const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET; const allowedDomainsEnv = process.env.GOOGLE_ALLOWED_DOMAINS; +const allowedDomains = allowedDomainsEnv ? allowedDomainsEnv.split(",") : []; -// start the oauth process and redirect user to Google -router.get("google", async (ctx) => { - // Generate the url that will be used for the consent dialog. - const authorizeUrl = client.generateAuthUrl({ - access_type: "offline", - scope: [ - "https://www.googleapis.com/auth/userinfo.profile", - "https://www.googleapis.com/auth/userinfo.email", - ], - prompt: "select_account consent", - }); - ctx.redirect(authorizeUrl); -}); +const scopes = [ + "https://www.googleapis.com/auth/userinfo.profile", + "https://www.googleapis.com/auth/userinfo.email", +]; -// signin callback from Google -router.get("google.callback", auth({ required: false }), async (ctx) => { - const { code } = ctx.request.query; - ctx.assertPresent(code, "code is required"); - const response = await client.getToken(code); - client.setCredentials(response.tokens); +export const config = { + name: "Google", + enabled: !!GOOGLE_CLIENT_ID, +}; - const profile = await client.request({ - url: "https://www.googleapis.com/oauth2/v1/userinfo", - }); - - if (!profile.data.hd) { - ctx.redirect("/?notice=google-hd"); - return; - } - - // allow all domains by default if the env is not set - const allowedDomains = allowedDomainsEnv && allowedDomainsEnv.split(","); - if (allowedDomains && !allowedDomains.includes(profile.data.hd)) { - ctx.redirect("/?notice=hd-not-allowed"); - return; - } - - const domain = profile.data.hd; - const subdomain = profile.data.hd.split(".")[0]; - const teamName = capitalize(subdomain); - - let result; - try { - result = await teamCreator({ - name: teamName, - domain, - subdomain, - authenticationProvider: { - name: "google", - providerId: domain, +if (GOOGLE_CLIENT_ID) { + passport.use( + new GoogleStrategy( + { + clientID: GOOGLE_CLIENT_ID, + clientSecret: GOOGLE_CLIENT_SECRET, + callbackURL: `${env.URL}/auth/google.callback`, + prompt: "select_account consent", + passReqToCallback: true, + store: new StateStore(), + scope: scopes, }, - }); - } catch (err) { - if (err instanceof Sequelize.UniqueConstraintError) { - ctx.redirect(`/?notice=auth-error&error=team-exists`); - return; - } - } + async function (req, accessToken, refreshToken, profile, done) { + try { + const domain = profile._json.hd; - invariant(result, "Team creator result must exist"); - const { team, isNewTeam, authenticationProvider } = result; + if (!domain) { + throw new GoogleWorkspaceRequiredError(); + } - try { - const result = await userCreator({ - name: profile.data.name, - email: profile.data.email, - isAdmin: isNewTeam, - avatarUrl: profile.data.picture, - teamId: team.id, - ip: ctx.request.ip, - authentication: { - authenticationProviderId: authenticationProvider.id, - providerId: profile.data.id, - accessToken: response.tokens.access_token, - refreshToken: response.tokens.refresh_token, - scopes: response.tokens.scope.split(" "), - }, - }); + if (allowedDomains.length && !allowedDomains.includes(domain)) { + throw new GoogleWorkspaceInvalidError(); + } - const { user, isNewUser } = result; + const subdomain = domain.split(".")[0]; + const teamName = capitalize(subdomain); - if (isNewTeam) { - await team.provisionFirstCollection(user.id); - } - - // set cookies on response and redirect to team subdomain - ctx.signIn(user, team, "google", isNewUser); - } catch (err) { - if (err instanceof Sequelize.UniqueConstraintError) { - const exists = await User.findOne({ - where: { - email: profile.data.email, - teamId: team.id, - }, - }); - - if (exists) { - ctx.redirect(`${team.url}?notice=email-auth-required`); - } else { - if (process.env.SENTRY_DSN) { - Sentry.captureException(err); - } else { - console.error(err); + const result = await accountProvisioner({ + ip: req.ip, + team: { + name: teamName, + domain, + subdomain, + }, + user: { + name: profile.displayName, + email: profile.email, + avatarUrl: profile.picture, + }, + authenticationProvider: { + name: providerName, + providerId: domain, + }, + authentication: { + providerId: profile.id, + accessToken, + refreshToken, + scopes, + }, + }); + return done(null, result.user, result); + } catch (err) { + return done(err, null); } - ctx.redirect(`${team.url}?notice=auth-error`); } + ) + ); - return; - } + router.get("google", passport.authenticate(providerName)); - throw err; - } -}); + router.get( + "google.callback", + auth({ required: false }), + passportMiddleware(providerName) + ); +} export default router; diff --git a/server/auth/index.js b/server/auth/index.js index deb716a3..6939f3a8 100644 --- a/server/auth/index.js +++ b/server/auth/index.js @@ -1,5 +1,7 @@ // @flow +import passport from "@outlinewiki/koa-passport"; import addMonths from "date-fns/add_months"; +import debug from "debug"; import Koa from "koa"; import bodyParser from "koa-body"; import Router from "koa-router"; @@ -7,17 +9,25 @@ import { AuthenticationError } from "../errors"; import auth from "../middlewares/authentication"; import validation from "../middlewares/validation"; import { Team } from "../models"; +import { requireDirectory } from "../utils/fs"; -import email from "./email"; -import google from "./google"; -import slack from "./slack"; - +const log = debug("server"); const app = new Koa(); const router = new Router(); -router.use("/", slack.routes()); -router.use("/", google.routes()); -router.use("/", email.routes()); +router.use(passport.initialize()); + +// dynamically load available authentication providers +requireDirectory(__dirname).forEach(([{ default: provider, config }]) => { + if (provider && provider.routes) { + if (!config) { + throw new Error("Auth providers must export a 'config' object"); + } + + router.use("/", provider.routes()); + log(`loaded ${config.name} auth provider`); + } +}); router.get("/redirect", auth(), async (ctx) => { const user = ctx.state.user; diff --git a/server/auth/slack.js b/server/auth/slack.js index 70d2f292..350fabaf 100644 --- a/server/auth/slack.js +++ b/server/auth/slack.js @@ -1,138 +1,164 @@ // @flow -import * as Sentry from "@sentry/node"; -import addHours from "date-fns/add_hours"; -import invariant from "invariant"; +import passport from "@outlinewiki/koa-passport"; import Router from "koa-router"; -import Sequelize from "sequelize"; -import { slackAuth } from "../../shared/utils/routeHelpers"; -import teamCreator from "../commands/teamCreator"; -import userCreator from "../commands/userCreator"; +import { Strategy as SlackStrategy } from "passport-slack-oauth2"; +import accountProvisioner from "../commands/accountProvisioner"; +import env from "../env"; import auth from "../middlewares/authentication"; -import { Authentication, Collection, Integration, User, Team } from "../models"; +import passportMiddleware from "../middlewares/passport"; +import { Authentication, Collection, Integration, Team } from "../models"; import * as Slack from "../slack"; -import { getCookieDomain } from "../utils/domains"; +import { StateStore } from "../utils/passport"; const router = new Router(); +const providerName = "slack"; +const SLACK_CLIENT_ID = process.env.SLACK_KEY; +const SLACK_CLIENT_SECRET = process.env.SLACK_SECRET; -// start the oauth process and redirect user to Slack -router.get("slack", async (ctx) => { - const state = Math.random().toString(36).substring(7); +const scopes = [ + "identity.email", + "identity.basic", + "identity.avatar", + "identity.team", +]; - ctx.cookies.set("state", state, { - httpOnly: false, - expires: addHours(new Date(), 1), - domain: getCookieDomain(ctx.request.hostname), - }); - ctx.redirect(slackAuth(state)); -}); +export const config = { + name: "Slack", + enabled: !!SLACK_CLIENT_ID, +}; -// signin callback from Slack -router.get("slack.callback", auth({ required: false }), async (ctx) => { - const { code, error, state } = ctx.request.query; - ctx.assertPresent(code || error, "code is required"); - ctx.assertPresent(state, "state is required"); - - if (state !== ctx.cookies.get("state")) { - ctx.redirect("/?notice=auth-error&error=state_mismatch"); - return; - } - if (error) { - ctx.redirect(`/?notice=auth-error&error=${error}`); - return; - } - - const data = await Slack.oauthAccess(code); - - let result; - try { - result = await teamCreator({ - name: data.team.name, - subdomain: data.team.domain, - avatarUrl: data.team.image_230, - authenticationProvider: { - name: "slack", - providerId: data.team.id, - }, - }); - } catch (err) { - if (err instanceof Sequelize.UniqueConstraintError) { - ctx.redirect(`/?notice=auth-error&error=team-exists`); - return; - } - throw err; - } - - invariant(result, "Team creator result must exist"); - const { authenticationProvider, team, isNewTeam } = result; - - try { - const result = await userCreator({ - name: data.user.name, - email: data.user.email, - isAdmin: isNewTeam, - avatarUrl: data.user.image_192, - teamId: team.id, - ip: ctx.request.ip, - authentication: { - authenticationProviderId: authenticationProvider.id, - providerId: data.user.id, - accessToken: data.access_token, - scopes: data.scope.split(","), - }, - }); - - const { user, isNewUser } = result; - - if (isNewTeam) { - await team.provisionFirstCollection(user.id); - } - - // set cookies on response and redirect to team subdomain - ctx.signIn(user, team, "slack", isNewUser); - } catch (err) { - if (err instanceof Sequelize.UniqueConstraintError) { - const exists = await User.findOne({ - where: { - email: data.user.email, - teamId: team.id, - }, - }); - - if (exists) { - ctx.redirect(`${team.url}?notice=email-auth-required`); - } else { - if (process.env.SENTRY_DSN) { - Sentry.captureException(err); - } else { - console.error(err); - } - ctx.redirect(`${team.url}?notice=auth-error`); - } - - return; - } - - throw err; - } -}); - -router.get("slack.commands", auth({ required: false }), async (ctx) => { - const { code, state, error } = ctx.request.query; - const user = ctx.state.user; - ctx.assertPresent(code || error, "code is required"); - - if (error) { - ctx.redirect(`/settings/integrations/slack?error=${error}`); - return; - } - - // this code block accounts for the root domain being unable to - // access authentication for subdomains. We must forward to the appropriate - // subdomain to complete the oauth flow - if (!user) { - if (state) { +if (SLACK_CLIENT_ID) { + const strategy = new SlackStrategy( + { + clientID: SLACK_CLIENT_ID, + clientSecret: SLACK_CLIENT_SECRET, + callbackURL: `${env.URL}/auth/slack.callback`, + passReqToCallback: true, + store: new StateStore(), + scope: scopes, + }, + async function (req, accessToken, refreshToken, profile, done) { try { - const team = await Team.findByPk(state); + const result = await accountProvisioner({ + ip: req.ip, + team: { + name: profile.team.name, + subdomain: profile.team.domain, + avatarUrl: profile.team.image_230, + }, + user: { + name: profile.user.name, + email: profile.user.email, + avatarUrl: profile.user.image_192, + }, + authenticationProvider: { + name: providerName, + providerId: profile.team.id, + }, + authentication: { + providerId: profile.user.id, + accessToken, + refreshToken, + scopes, + }, + }); + return done(null, result.user, result); + } catch (err) { + return done(err, null); + } + } + ); + + // For some reason the author made the strategy name capatilised, I don't know + // why but we need everything lowercase so we just monkey-patch it here. + strategy.name = providerName; + passport.use(strategy); + + router.get("slack", passport.authenticate(providerName)); + + router.get( + "slack.callback", + auth({ required: false }), + passportMiddleware(providerName) + ); + + router.get("slack.commands", auth({ required: false }), async (ctx) => { + const { code, state, error } = ctx.request.query; + const user = ctx.state.user; + ctx.assertPresent(code || error, "code is required"); + + if (error) { + ctx.redirect(`/settings/integrations/slack?error=${error}`); + return; + } + + // this code block accounts for the root domain being unable to + // access authentication for subdomains. We must forward to the appropriate + // subdomain to complete the oauth flow + if (!user) { + if (state) { + try { + const team = await Team.findByPk(state); + return ctx.redirect( + `${team.url}/auth${ctx.request.path}?${ctx.request.querystring}` + ); + } catch (err) { + return ctx.redirect( + `/settings/integrations/slack?error=unauthenticated` + ); + } + } else { + return ctx.redirect( + `/settings/integrations/slack?error=unauthenticated` + ); + } + } + + const endpoint = `${process.env.URL || ""}/auth/slack.commands`; + const data = await Slack.oauthAccess(code, endpoint); + + const authentication = await Authentication.create({ + service: "slack", + userId: user.id, + teamId: user.teamId, + token: data.access_token, + scopes: data.scope.split(","), + }); + + await Integration.create({ + service: "slack", + type: "command", + userId: user.id, + teamId: user.teamId, + authenticationId: authentication.id, + settings: { + serviceTeamId: data.team_id, + }, + }); + + ctx.redirect("/settings/integrations/slack"); + }); + + router.get("slack.post", auth({ required: false }), async (ctx) => { + const { code, error, state } = ctx.request.query; + const user = ctx.state.user; + ctx.assertPresent(code || error, "code is required"); + + const collectionId = state; + ctx.assertUuid(collectionId, "collectionId must be an uuid"); + + if (error) { + ctx.redirect(`/settings/integrations/slack?error=${error}`); + return; + } + + // this code block accounts for the root domain being unable to + // access authentcation for subdomains. We must forward to the + // appropriate subdomain to complete the oauth flow + if (!user) { + try { + const collection = await Collection.findByPk(state); + const team = await Team.findByPk(collection.teamId); return ctx.redirect( `${team.url}/auth${ctx.request.path}?${ctx.request.querystring}` ); @@ -141,91 +167,36 @@ router.get("slack.commands", auth({ required: false }), async (ctx) => { `/settings/integrations/slack?error=unauthenticated` ); } - } else { - return ctx.redirect(`/settings/integrations/slack?error=unauthenticated`); } - } - const endpoint = `${process.env.URL || ""}/auth/slack.commands`; - const data = await Slack.oauthAccess(code, endpoint); + const endpoint = `${process.env.URL || ""}/auth/slack.post`; + const data = await Slack.oauthAccess(code, endpoint); - const authentication = await Authentication.create({ - service: "slack", - userId: user.id, - teamId: user.teamId, - token: data.access_token, - scopes: data.scope.split(","), + const authentication = await Authentication.create({ + service: "slack", + userId: user.id, + teamId: user.teamId, + token: data.access_token, + scopes: data.scope.split(","), + }); + + await Integration.create({ + service: "slack", + type: "post", + userId: user.id, + teamId: user.teamId, + authenticationId: authentication.id, + collectionId, + events: [], + settings: { + url: data.incoming_webhook.url, + channel: data.incoming_webhook.channel, + channelId: data.incoming_webhook.channel_id, + }, + }); + + ctx.redirect("/settings/integrations/slack"); }); - - await Integration.create({ - service: "slack", - type: "command", - userId: user.id, - teamId: user.teamId, - authenticationId: authentication.id, - settings: { - serviceTeamId: data.team_id, - }, - }); - - ctx.redirect("/settings/integrations/slack"); -}); - -router.get("slack.post", auth({ required: false }), async (ctx) => { - const { code, error, state } = ctx.request.query; - const user = ctx.state.user; - ctx.assertPresent(code || error, "code is required"); - - const collectionId = state; - ctx.assertUuid(collectionId, "collectionId must be an uuid"); - - if (error) { - ctx.redirect(`/settings/integrations/slack?error=${error}`); - return; - } - - // this code block accounts for the root domain being unable to - // access authentcation for subdomains. We must forward to the - // appropriate subdomain to complete the oauth flow - if (!user) { - try { - const collection = await Collection.findByPk(state); - const team = await Team.findByPk(collection.teamId); - return ctx.redirect( - `${team.url}/auth${ctx.request.path}?${ctx.request.querystring}` - ); - } catch (err) { - return ctx.redirect(`/settings/integrations/slack?error=unauthenticated`); - } - } - - const endpoint = `${process.env.URL || ""}/auth/slack.post`; - const data = await Slack.oauthAccess(code, endpoint); - - const authentication = await Authentication.create({ - service: "slack", - userId: user.id, - teamId: user.teamId, - token: data.access_token, - scopes: data.scope.split(","), - }); - - await Integration.create({ - service: "slack", - type: "post", - userId: user.id, - teamId: user.teamId, - authenticationId: authentication.id, - collectionId, - events: [], - settings: { - url: data.incoming_webhook.url, - channel: data.incoming_webhook.channel, - channelId: data.incoming_webhook.channel_id, - }, - }); - - ctx.redirect("/settings/integrations/slack"); -}); +} export default router; diff --git a/server/commands/accountProvisioner.js b/server/commands/accountProvisioner.js new file mode 100644 index 00000000..e05bd614 --- /dev/null +++ b/server/commands/accountProvisioner.js @@ -0,0 +1,119 @@ +// @flow +import invariant from "invariant"; +import Sequelize from "sequelize"; +import { + AuthenticationError, + EmailAuthenticationRequiredError, + AuthenticationProviderDisabledError, +} from "../errors"; +import { Team, User } from "../models"; +import teamCreator from "./teamCreator"; +import userCreator from "./userCreator"; + +type Props = {| + ip: string, + user: {| + name: string, + email: string, + avatarUrl?: string, + |}, + team: {| + name: string, + domain?: string, + subdomain: string, + avatarUrl?: string, + |}, + authenticationProvider: {| + name: string, + providerId: string, + |}, + authentication: {| + providerId: string, + scopes: string[], + accessToken?: string, + refreshToken?: string, + |}, +|}; + +export type AccountProvisionerResult = {| + user: User, + team: Team, + isNewTeam: boolean, + isNewUser: boolean, +|}; + +export default async function accountProvisioner({ + ip, + user: userParams, + team: teamParams, + authenticationProvider: authenticationProviderParams, + authentication: authenticationParams, +}: Props): Promise { + let result; + try { + result = await teamCreator({ + name: teamParams.name, + domain: teamParams.domain, + subdomain: teamParams.subdomain, + avatarUrl: teamParams.avatarUrl, + authenticationProvider: authenticationProviderParams, + }); + } catch (err) { + throw new AuthenticationError(err.message); + } + + invariant(result, "Team creator result must exist"); + const { authenticationProvider, team, isNewTeam } = result; + + if (!authenticationProvider.enabled) { + throw new AuthenticationProviderDisabledError(); + } + + try { + const result = await userCreator({ + name: userParams.name, + email: userParams.email, + isAdmin: isNewTeam, + avatarUrl: userParams.avatarUrl, + teamId: team.id, + ip, + authentication: { + ...authenticationParams, + authenticationProviderId: authenticationProvider.id, + }, + }); + + const { isNewUser, user } = result; + + if (isNewTeam) { + await team.provisionFirstCollection(user.id); + } + + return { + user, + team, + isNewUser, + isNewTeam, + }; + } catch (err) { + if (err instanceof Sequelize.UniqueConstraintError) { + const exists = await User.findOne({ + where: { + email: userParams.email, + teamId: team.id, + }, + }); + + if (exists) { + throw new EmailAuthenticationRequiredError( + "Email authentication required", + team.url + ); + } else { + throw new AuthenticationError(err.message, team.url); + } + } + + throw err; + } +} diff --git a/server/commands/accountProvisioner.test.js b/server/commands/accountProvisioner.test.js new file mode 100644 index 00000000..15c7d181 --- /dev/null +++ b/server/commands/accountProvisioner.test.js @@ -0,0 +1,182 @@ +// @flow +import { Collection, UserAuthentication } from "../models"; +import { buildUser, buildTeam } from "../test/factories"; +import { flushdb } from "../test/support"; +import accountProvisioner from "./accountProvisioner"; + +jest.mock("aws-sdk", () => { + const mS3 = { putObject: jest.fn().mockReturnThis(), promise: jest.fn() }; + return { + S3: jest.fn(() => mS3), + Endpoint: jest.fn(), + }; +}); + +beforeEach(() => flushdb()); + +describe("accountProvisioner", () => { + const ip = "127.0.0.1"; + + it("should create a new user and team", async () => { + const { user, team, isNewTeam, isNewUser } = await accountProvisioner({ + ip, + user: { + name: "Jenny Tester", + email: "jenny@example.com", + avatarUrl: "https://example.com/avatar.png", + }, + team: { + name: "New team", + avatarUrl: "https://example.com/avatar.png", + subdomain: "example", + }, + authenticationProvider: { + name: "google", + providerId: "example.com", + }, + authentication: { + providerId: "123456789", + accessToken: "123", + scopes: ["read"], + }, + }); + + const authentications = await user.getAuthentications(); + const auth = authentications[0]; + + expect(auth.accessToken).toEqual("123"); + expect(auth.scopes.length).toEqual(1); + expect(auth.scopes[0]).toEqual("read"); + expect(team.name).toEqual("New team"); + expect(user.email).toEqual("jenny@example.com"); + expect(isNewUser).toEqual(true); + expect(isNewTeam).toEqual(true); + + const collectionCount = await Collection.count(); + expect(collectionCount).toEqual(1); + }); + + it("should update exising user and authentication", async () => { + const existingTeam = await buildTeam(); + const providers = await existingTeam.getAuthenticationProviders(); + const authenticationProvider = providers[0]; + const existing = await buildUser({ teamId: existingTeam.id }); + const authentications = await existing.getAuthentications(); + const authentication = authentications[0]; + const newEmail = "test@example.com"; + + const { user } = await accountProvisioner({ + ip, + user: { + name: existing.name, + email: newEmail, + avatarUrl: existing.avatarUrl, + }, + team: { + name: existingTeam.name, + avatarUrl: existingTeam.avatarUrl, + subdomain: "example", + }, + authenticationProvider: { + name: authenticationProvider.name, + providerId: authenticationProvider.providerId, + }, + authentication: { + providerId: authentication.providerId, + accessToken: "123", + scopes: ["read"], + }, + }); + + const auth = await UserAuthentication.findByPk(authentication.id); + expect(auth.accessToken).toEqual("123"); + expect(auth.scopes.length).toEqual(1); + expect(auth.scopes[0]).toEqual("read"); + expect(user.email).toEqual(newEmail); + + const collectionCount = await Collection.count(); + expect(collectionCount).toEqual(0); + }); + + it("should throw an error when authentication provider is disabled", async () => { + const existingTeam = await buildTeam(); + const providers = await existingTeam.getAuthenticationProviders(); + const authenticationProvider = providers[0]; + await authenticationProvider.update({ enabled: false }); + + const existing = await buildUser({ teamId: existingTeam.id }); + const authentications = await existing.getAuthentications(); + const authentication = authentications[0]; + let error; + + try { + await accountProvisioner({ + ip, + user: { + name: existing.name, + email: existing.email, + avatarUrl: existing.avatarUrl, + }, + team: { + name: existingTeam.name, + avatarUrl: existingTeam.avatarUrl, + subdomain: "example", + }, + authenticationProvider: { + name: authenticationProvider.name, + providerId: authenticationProvider.providerId, + }, + authentication: { + providerId: authentication.providerId, + accessToken: "123", + scopes: ["read"], + }, + }); + } catch (err) { + error = err; + } + + expect(error).toBeTruthy(); + }); + + it("should create a new user in an existing team", async () => { + const team = await buildTeam(); + const authenticationProviders = await team.getAuthenticationProviders(); + const authenticationProvider = authenticationProviders[0]; + + const { user, isNewUser } = await accountProvisioner({ + ip, + user: { + name: "Jenny Tester", + email: "jenny@example.com", + avatarUrl: "https://example.com/avatar.png", + }, + team: { + name: team.name, + avatarUrl: team.avatarUrl, + subdomain: "example", + }, + authenticationProvider: { + name: authenticationProvider.name, + providerId: authenticationProvider.providerId, + }, + authentication: { + providerId: "123456789", + accessToken: "123", + scopes: ["read"], + }, + }); + + const authentications = await user.getAuthentications(); + const auth = authentications[0]; + + expect(auth.accessToken).toEqual("123"); + expect(auth.scopes.length).toEqual(1); + expect(auth.scopes[0]).toEqual("read"); + expect(user.email).toEqual("jenny@example.com"); + expect(isNewUser).toEqual(true); + + const collectionCount = await Collection.count(); + expect(collectionCount).toEqual(0); + }); +}); diff --git a/server/errors.js b/server/errors.js index 2ae4b9ba..412195d7 100644 --- a/server/errors.js +++ b/server/errors.js @@ -1,10 +1,15 @@ // @flow import httpErrors from "http-errors"; +import env from "./env"; export function AuthenticationError( - message: string = "Invalid authentication" + message: string = "Invalid authentication", + redirectUrl: string = env.URL ) { - return httpErrors(401, message, { id: "authentication_required" }); + return httpErrors(401, message, { + redirectUrl, + id: "authentication_required", + }); } export function AuthorizationError( @@ -57,3 +62,38 @@ export function FileImportError( ) { return httpErrors(400, message, { id: "import_error" }); } + +export function OAuthStateMismatchError( + message: string = "State returned in OAuth flow did not match" +) { + return httpErrors(400, message, { id: "state_mismatch" }); +} + +export function EmailAuthenticationRequiredError( + message: string = "User must authenticate with email", + redirectUrl: string = env.URL +) { + return httpErrors(400, message, { redirectUrl, id: "email_auth_required" }); +} + +export function GoogleWorkspaceRequiredError( + message: string = "Google Workspace is required to authenticate" +) { + return httpErrors(400, message, { id: "google_hd" }); +} + +export function GoogleWorkspaceInvalidError( + message: string = "Google Workspace is invalid" +) { + return httpErrors(400, message, { id: "hd_not_allowed" }); +} + +export function AuthenticationProviderDisabledError( + message: string = "Authentication method has been disabled by an admin", + redirectUrl: string = env.URL +) { + return httpErrors(400, message, { + redirectUrl, + id: "authentication_provider_disabled", + }); +} diff --git a/server/middlewares/passport.js b/server/middlewares/passport.js new file mode 100644 index 00000000..5dee8e9b --- /dev/null +++ b/server/middlewares/passport.js @@ -0,0 +1,33 @@ +// @flow +import passport from "@outlinewiki/koa-passport"; +import type { AccountProvisionerResult } from "../commands/accountProvisioner"; +import type { ContextWithAuthMiddleware } from "../types"; + +export default function createMiddleware(providerName: string) { + return function passportMiddleware(ctx: ContextWithAuthMiddleware) { + return passport.authorize( + providerName, + { session: false }, + (err, _, result: AccountProvisionerResult) => { + if (err) { + if (err.id) { + console.error(err); + const notice = err.id.replace(/_/g, "-"); + return ctx.redirect(`${err.redirectUrl || "/"}?notice=${notice}`); + } + + if (process.env.NODE_ENV === "development") { + throw err; + } + return ctx.redirect(`/?notice=auth-error`); + } + + if (result.user.isSuspended) { + return ctx.redirect("/?notice=suspended"); + } + + ctx.signIn(result.user, result.team, providerName, result.isNewUser); + } + )(ctx); + }; +} diff --git a/server/migrations/20210310051804-passport.js b/server/migrations/20210310051804-passport.js new file mode 100644 index 00000000..0bf0ea04 --- /dev/null +++ b/server/migrations/20210310051804-passport.js @@ -0,0 +1,19 @@ +'use strict'; + +module.exports = { + up: async (queryInterface, Sequelize) => { + await queryInterface.removeColumn("users", "slackData"); + await queryInterface.removeColumn("teams", "slackData"); + }, + + down: async (queryInterface, Sequelize) => { + await queryInterface.addColumn("teams", "slackData", { + type: 'JSONB', + allowNull: true, + }); + await queryInterface.addColumn("users", "slackData", { + type: 'JSONB', + allowNull: true, + }); + } +}; diff --git a/server/models/Team.js b/server/models/Team.js index 1fb2ae1f..8d65d200 100644 --- a/server/models/Team.js +++ b/server/models/Team.js @@ -10,6 +10,7 @@ import { } from "../../shared/utils/domains"; import { ValidationError } from "../errors"; import { DataTypes, sequelize, Op } from "../sequelize"; +import { generateAvatarUrl } from "../utils/avatars"; import { publicS3Endpoint, uploadToS3FromUrl } from "../utils/s3"; import Collection from "./Collection"; @@ -66,7 +67,6 @@ const Team = sequelize.define( allowNull: false, defaultValue: true, }, - slackData: DataTypes.JSONB, }, { paranoid: true, @@ -85,7 +85,11 @@ const Team = sequelize.define( }, logoUrl() { return ( - this.avatarUrl || (this.slackData ? this.slackData.image_88 : null) + this.avatarUrl || + generateAvatarUrl({ + id: this.id, + name: this.name, + }) ); }, }, @@ -164,17 +168,10 @@ Team.prototype.provisionFirstCollection = async function (userId) { "Our Editor", "What is Outline", ]; + for (const title of onboardingDocs) { const text = await readFile( - path.join( - __dirname, - "..", - "..", - "..", - "server", - "onboarding", - `${title}.md` - ), + path.join(process.cwd(), "server", "onboarding", `${title}.md`), "utf8" ); const document = await Document.create({ diff --git a/server/models/User.js b/server/models/User.js index 02a4ab01..dfde40a9 100644 --- a/server/models/User.js +++ b/server/models/User.js @@ -8,11 +8,10 @@ import { languages } from "../../shared/i18n"; import { ValidationError } from "../errors"; import { sendEmail } from "../mailer"; import { DataTypes, sequelize, encryptedFields } from "../sequelize"; +import { DEFAULT_AVATAR_HOST } from "../utils/avatars"; import { publicS3Endpoint, uploadToS3FromUrl } from "../utils/s3"; import { Star, Team, Collection, NotificationSetting, ApiKey } from "."; -const DEFAULT_AVATAR_HOST = "https://tiley.herokuapp.com"; - const User = sequelize.define( "user", { @@ -28,7 +27,6 @@ const User = sequelize.define( isAdmin: DataTypes.BOOLEAN, service: { type: DataTypes.STRING, allowNull: true }, serviceId: { type: DataTypes.STRING, allowNull: true, unique: true }, - slackData: DataTypes.JSONB, jwtSecret: encryptedFields().vault("jwtSecret"), lastActiveAt: DataTypes.DATE, lastActiveIp: { type: DataTypes.STRING, allowNull: true }, @@ -210,7 +208,6 @@ const removeIdentifyingInfo = async (model, options) => { model.avatarUrl = ""; model.serviceId = null; model.username = null; - model.slackData = null; model.lastActiveIp = null; model.lastSignedInIp = null; diff --git a/server/presenters/user.test.js b/server/presenters/user.test.js index fece314c..602e465e 100644 --- a/server/presenters/user.test.js +++ b/server/presenters/user.test.js @@ -6,9 +6,6 @@ it("presents a user", async () => { id: "123", name: "Test User", username: "testuser", - slackData: { - image_192: "http://example.com/avatar.png", - }, }); expect(user).toMatchSnapshot(); @@ -19,7 +16,6 @@ it("presents a user without slack data", async () => { id: "123", name: "Test User", username: "testuser", - slackData: null, }); expect(user).toMatchSnapshot(); diff --git a/server/services/index.js b/server/services/index.js index 8d822dfd..c0ea09ff 100644 --- a/server/services/index.js +++ b/server/services/index.js @@ -1,27 +1,18 @@ // @flow -import path from "path"; import debug from "debug"; -import fs from "fs-extra"; +import { requireDirectory } from "../utils/fs"; const log = debug("services"); const services = {}; if (!process.env.SINGLE_RUN) { - fs.readdirSync(__dirname) - .filter( - (file) => - file.indexOf(".") !== 0 && - file !== path.basename(__filename) && - !file.includes(".test") - ) - .forEach((fileName) => { - const servicePath = path.join(__dirname, fileName); - const name = path.basename(servicePath.replace(/\.js$/, "")); - // $FlowIssue - const Service = require(servicePath).default; + requireDirectory(__dirname).forEach(([module, name]) => { + if (module && module.default) { + const Service = module.default; services[name] = new Service(); log(`loaded ${name} service`); - }); + } + }); } export default services; diff --git a/server/test/helper.js b/server/test/helper.js index 3b7c3e8f..7572493f 100644 --- a/server/test/helper.js +++ b/server/test/helper.js @@ -4,6 +4,8 @@ require("dotenv").config({ silent: true }); // test environment variables process.env.DATABASE_URL = process.env.DATABASE_URL_TEST; process.env.NODE_ENV = "test"; +process.env.GOOGLE_CLIENT_ID = "123"; +process.env.SLACK_KEY = "123"; // This is needed for the relative manual mock to be picked up jest.mock("../events"); diff --git a/server/types.js b/server/types.js index 5fde708a..ace65484 100644 --- a/server/types.js +++ b/server/types.js @@ -1,6 +1,6 @@ // @flow import { type Context } from "koa"; -import { User } from "./models"; +import { User, Team } from "./models"; export type ContextWithState = {| ...$Exact, @@ -10,3 +10,13 @@ export type ContextWithState = {| authType: "app" | "api", }, |}; + +export type ContextWithAuthMiddleware = {| + ...$Exact, + signIn: ( + user: User, + team: Team, + providerName: string, + isFirstSignin: boolean + ) => void, +|}; diff --git a/server/utils/avatars.js b/server/utils/avatars.js index a86e530a..ed207222 100644 --- a/server/utils/avatars.js +++ b/server/utils/avatars.js @@ -2,6 +2,8 @@ import crypto from "crypto"; import fetch from "isomorphic-fetch"; +export const DEFAULT_AVATAR_HOST = "https://tiley.herokuapp.com"; + export async function generateAvatarUrl({ id, domain, @@ -27,6 +29,6 @@ export async function generateAvatarUrl({ } } - const tileyUrl = `https://tiley.herokuapp.com/avatar/${hashedId}/${name[0]}.png`; + const tileyUrl = `${DEFAULT_AVATAR_HOST}/avatar/${hashedId}/${name[0]}.png`; return cbUrl && cbResponse && cbResponse.status === 200 ? cbUrl : tileyUrl; } diff --git a/server/utils/fs.js b/server/utils/fs.js new file mode 100644 index 00000000..32012ceb --- /dev/null +++ b/server/utils/fs.js @@ -0,0 +1,22 @@ +// @flow +import path from "path"; +import fs from "fs-extra"; + +export function requireDirectory(dirName: string): [T, string][] { + return fs + .readdirSync(dirName) + .filter( + (file) => + file.indexOf(".") !== 0 && + file.endsWith(".js") && + file !== path.basename(__filename) && + !file.includes(".test") + ) + .map((fileName) => { + const filePath = path.join(dirName, fileName); + const name = path.basename(filePath.replace(/\.js$/, "")); + + // $FlowIssue + return [require(filePath), name]; + }); +} diff --git a/server/utils/passport.js b/server/utils/passport.js new file mode 100644 index 00000000..4d94bb1a --- /dev/null +++ b/server/utils/passport.js @@ -0,0 +1,50 @@ +// @flow +import addMinutes from "date-fns/add_minutes"; +import subMinutes from "date-fns/sub_minutes"; +import { type Request } from "koa"; +import { OAuthStateMismatchError } from "../errors"; +import { getCookieDomain } from "./domains"; + +export class StateStore { + key: string = "state"; + + store = (req: Request, callback: (err: ?Error, state?: string) => void) => { + const state = Math.random().toString(36).substring(7); + + // $FlowFixMe + req.cookies.set(this.key, state, { + httpOnly: false, + expires: addMinutes(new Date(), 10), + domain: getCookieDomain(req.hostname), + }); + + callback(null, state); + }; + + verify = ( + req: Request, + providedState: string, + callback: (err: ?Error, ?boolean) => void + ) => { + // $FlowFixMe + const state = req.cookies.get(this.key); + if (!state) { + return callback( + new OAuthStateMismatchError("State not return in OAuth flow") + ); + } + + // $FlowFixMe + req.cookies.set(this.key, "", { + httpOnly: false, + expires: subMinutes(new Date(), 1), + domain: getCookieDomain(req.hostname), + }); + + if (state !== providedState) { + return callback(new OAuthStateMismatchError()); + } + + callback(null, true); + }; +} diff --git a/yarn.lock b/yarn.lock index e7c0fdb1..b8e6a367 100644 --- a/yarn.lock +++ b/yarn.lock @@ -1698,6 +1698,13 @@ dependencies: "@types/node" ">= 8" +"@outlinewiki/koa-passport@^4.1.4": + version "4.1.4" + resolved "https://registry.yarnpkg.com/@outlinewiki/koa-passport/-/koa-passport-4.1.4.tgz#f7536b81860b28065227c0521e9c9fddb532968a" + integrity sha512-CgBAGLQU52rMy3WqsW/VSChSVJkMg4iT7P0ITvPigOedvmd0HNDuAmuOf2IBKsv2vpe4qYoVb7uBFjah7dA31A== + dependencies: + passport "^0.4.0" + "@popperjs/core@^2.5.4": version "2.6.0" resolved "https://registry.yarnpkg.com/@popperjs/core/-/core-2.6.0.tgz#f022195afdfc942e088ee2101285a1d31c7d727f" @@ -2291,13 +2298,6 @@ abbrev@1: resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-1.1.1.tgz#f8f2c887ad10bf67f634f005b6987fed3179aac8" integrity sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q== -abort-controller@^3.0.0: - version "3.0.0" - resolved "https://registry.yarnpkg.com/abort-controller/-/abort-controller-3.0.0.tgz#eaf54d53b62bae4138e809ca225c8439a6efb392" - integrity sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg== - dependencies: - event-target-shim "^5.0.0" - accepts@^1.3.5, accepts@~1.3.4: version "1.3.7" resolved "https://registry.yarnpkg.com/accepts/-/accepts-1.3.7.tgz#531bc726517a3b2b41f850021c6cc15eaab507cd" @@ -2579,11 +2579,6 @@ arrify@^1.0.1: resolved "https://registry.yarnpkg.com/arrify/-/arrify-1.0.1.tgz#898508da2226f380df904728456849c1501a4b0d" integrity sha1-iYUI2iIm84DfkEcoRWhJwVAaSw0= -arrify@^2.0.0: - version "2.0.1" - resolved "https://registry.yarnpkg.com/arrify/-/arrify-2.0.1.tgz#c9655e9331e0abcd588d2a7cad7e9956f66701fa" - integrity sha512-3duEwti880xqi4eAMN8AyR4a0ByT90zoYdLlevfrvU43vb0YZwZVfxOgxWrLXXXpyugL0hNZc9G6BiB5B3nUug== - asn1.js@^5.2.0: version "5.4.1" resolved "https://registry.yarnpkg.com/asn1.js/-/asn1.js-5.4.1.tgz#11a980b84ebb91781ce35b0fdc2ee294e3783f07" @@ -2973,7 +2968,7 @@ base64-arraybuffer@0.1.5: resolved "https://registry.yarnpkg.com/base64-arraybuffer/-/base64-arraybuffer-0.1.5.tgz#73926771923b5a19747ad666aa5cd4bf9c6e9ce8" integrity sha1-c5JncZI7Whl0etZmqlzUv5xunOg= -base64-js@^1.0.2, base64-js@^1.2.0, base64-js@^1.3.0, base64-js@^1.3.1: +base64-js@^1.0.2, base64-js@^1.2.0, base64-js@^1.3.1: version "1.5.1" resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a" integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA== @@ -2983,6 +2978,11 @@ base64id@2.0.0: resolved "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz#2770ac6bc47d312af97a8bf9a634342e0cd25cb6" integrity sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog== +base64url@3.x.x: + version "3.0.1" + resolved "https://registry.yarnpkg.com/base64url/-/base64url-3.0.1.tgz#6399d572e2bc3f90a9a8b22d5dbb0a32d33f788d" + integrity sha512-ir1UPr3dkwexU7FdV8qBBbNDRUhMmIekYMFZfi+C/sLNnRESKPl23nB9b2pltqfOQNnGzsDdId90AEtG5tCx4A== + base@^0.11.1: version "0.11.2" resolved "https://registry.yarnpkg.com/base/-/base-0.11.2.tgz#7bde5ced145b6d551a90db87f83c558b4eb48a8f" @@ -3030,11 +3030,6 @@ big.js@^5.2.2: resolved "https://registry.yarnpkg.com/big.js/-/big.js-5.2.2.tgz#65f0af382f578bcdc742bd9c281e9cb2d7768328" integrity sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ== -bignumber.js@^9.0.0: - version "9.0.1" - resolved "https://registry.yarnpkg.com/bignumber.js/-/bignumber.js-9.0.1.tgz#8d7ba124c882bfd8e43260c67475518d0689e4e5" - integrity sha512-IdZR9mh6ahOBv/hYGiXyVuyCetmGJhtYkqLBpTStdhEGjegpPlUawydyaF3pbIOFynJTpllEs+NP+CS9jKFLjA== - binary-extensions@^1.0.0: version "1.13.1" resolved "https://registry.yarnpkg.com/binary-extensions/-/binary-extensions-1.13.1.tgz#598afe54755b2868a5330d2aff9d4ebb53209b65" @@ -4776,7 +4771,7 @@ ecc-jsbn@~0.1.1: jsbn "~0.1.0" safer-buffer "^2.1.0" -ecdsa-sig-formatter@1.0.11, ecdsa-sig-formatter@^1.0.11: +ecdsa-sig-formatter@1.0.11: version "1.0.11" resolved "https://registry.yarnpkg.com/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz#ae0f0fa2d85045ef14a817daa3ce9acd0489e5bf" integrity sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ== @@ -5320,11 +5315,6 @@ event-emitter@^0.3.5: d "1" es5-ext "~0.10.14" -event-target-shim@^5.0.0: - version "5.0.1" - resolved "https://registry.yarnpkg.com/event-target-shim/-/event-target-shim-5.0.1.tgz#5d4d3ebdf9583d63a5333ce2deb7480ab2b05789" - integrity sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ== - events@1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/events/-/events-1.1.1.tgz#9ebdb7635ad099c70dcc4c2a1f5004288e8bd924" @@ -5466,7 +5456,7 @@ extend-shallow@^3.0.0, extend-shallow@^3.0.2: assign-symbols "^1.0.0" is-extendable "^1.0.1" -extend@^3.0.0, extend@^3.0.2, extend@~3.0.2: +extend@^3.0.0, extend@~3.0.2: version "3.0.2" resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz#f8b1136b4071fbd8eb140aff858b1019ec2915fa" integrity sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g== @@ -5520,11 +5510,6 @@ fast-levenshtein@^2.0.6, fast-levenshtein@~2.0.6: resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917" integrity sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc= -fast-text-encoding@^1.0.0: - version "1.0.3" - resolved "https://registry.yarnpkg.com/fast-text-encoding/-/fast-text-encoding-1.0.3.tgz#ec02ac8e01ab8a319af182dae2681213cfe9ce53" - integrity sha512-dtm4QZH9nZtcDt8qJiOH9fcQd1NAgi+K1O2DbE6GG1PPCK/BWfOH3idCTRQ4ImXRUOyopDEgDEnVEE7Y/2Wrig== - fb-watchman@^2.0.0: version "2.0.1" resolved "https://registry.yarnpkg.com/fb-watchman/-/fb-watchman-2.0.1.tgz#fc84fb39d2709cf3ff6d743706157bb5708a8a85" @@ -5895,25 +5880,6 @@ functional-red-black-tree@^1.0.1: resolved "https://registry.yarnpkg.com/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz#1b0ab3bd553b2a0d6399d29c0e3ea0b252078327" integrity sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc= -gaxios@^2.1.0: - version "2.3.4" - resolved "https://registry.yarnpkg.com/gaxios/-/gaxios-2.3.4.tgz#eea99353f341c270c5f3c29fc46b8ead56f0a173" - integrity sha512-US8UMj8C5pRnao3Zykc4AAVr+cffoNKRTg9Rsf2GiuZCW69vgJj38VK2PzlPuQU73FZ/nTk9/Av6/JGcE1N9vA== - dependencies: - abort-controller "^3.0.0" - extend "^3.0.2" - https-proxy-agent "^5.0.0" - is-stream "^2.0.0" - node-fetch "^2.3.0" - -gcp-metadata@^3.4.0: - version "3.5.0" - resolved "https://registry.yarnpkg.com/gcp-metadata/-/gcp-metadata-3.5.0.tgz#6d28343f65a6bbf8449886a0c0e4a71c77577055" - integrity sha512-ZQf+DLZ5aKcRpLzYUyBS3yo3N0JSa82lNDO8rj3nMSlovLcz2riKFBsYgDzeXcv75oo5eqB2lx+B14UvPoCRnA== - dependencies: - gaxios "^2.1.0" - json-bigint "^0.3.0" - gensync@^1.0.0-beta.1: version "1.0.0-beta.2" resolved "https://registry.yarnpkg.com/gensync/-/gensync-1.0.0-beta.2.tgz#32a6ee76c3d7f52d46b2b1ae5d93fea8580a25e0" @@ -6110,21 +6076,6 @@ good-listener@^1.2.2: dependencies: delegate "^3.1.2" -google-auth-library@^5.5.1: - version "5.10.1" - resolved "https://registry.yarnpkg.com/google-auth-library/-/google-auth-library-5.10.1.tgz#504ec75487ad140e68dd577c21affa363c87ddff" - integrity sha512-rOlaok5vlpV9rSiUu5EpR0vVpc+PhN62oF4RyX/6++DG1VsaulAFEMlDYBLjJDDPI6OcNOCGAKy9UVB/3NIDXg== - dependencies: - arrify "^2.0.0" - base64-js "^1.3.0" - ecdsa-sig-formatter "^1.0.11" - fast-text-encoding "^1.0.0" - gaxios "^2.1.0" - gcp-metadata "^3.4.0" - gtoken "^4.1.0" - jws "^4.0.0" - lru-cache "^5.0.0" - google-closure-compiler-js@^20170423.0.0: version "20170423.0.0" resolved "https://registry.yarnpkg.com/google-closure-compiler-js/-/google-closure-compiler-js-20170423.0.0.tgz#e9e8b40dadfdf0e64044c9479b5d26d228778fbc" @@ -6134,13 +6085,6 @@ google-closure-compiler-js@^20170423.0.0: vinyl "^2.0.1" webpack-core "^0.6.8" -google-p12-pem@^2.0.0: - version "2.0.4" - resolved "https://registry.yarnpkg.com/google-p12-pem/-/google-p12-pem-2.0.4.tgz#036462394e266472632a78b685f0cc3df4ef337b" - integrity sha512-S4blHBQWZRnEW44OcR7TL9WR+QCqByRvhNDZ/uuQfpxywfupikf/miba8js1jZi6ZOGv5slgSuoshCWh6EMDzg== - dependencies: - node-forge "^0.9.0" - got@^6.7.1: version "6.7.1" resolved "https://registry.yarnpkg.com/got/-/got-6.7.1.tgz#240cd05785a9a18e561dc1b44b41c763ef1e8db0" @@ -6196,16 +6140,6 @@ growly@^1.3.0: resolved "https://registry.yarnpkg.com/growly/-/growly-1.3.0.tgz#f10748cbe76af964b7c96c93c6bcc28af120c081" integrity sha1-8QdIy+dq+WS3yWyTxrzCivEgwIE= -gtoken@^4.1.0: - version "4.1.4" - resolved "https://registry.yarnpkg.com/gtoken/-/gtoken-4.1.4.tgz#925ff1e7df3aaada06611d30ea2d2abf60fcd6a7" - integrity sha512-VxirzD0SWoFUo5p8RDP8Jt2AGyOmyYcT/pOUgDKJCK+iSw0TMqwrVfY37RXTNmoKwrzmDHSk0GMT9FsgVmnVSA== - dependencies: - gaxios "^2.1.0" - google-p12-pem "^2.0.0" - jws "^4.0.0" - mime "^2.2.0" - gulp-sort@^2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/gulp-sort/-/gulp-sort-2.0.0.tgz#c6762a2f1f0de0a3fc595a21599d3fac8dba1aca" @@ -7819,13 +7753,6 @@ jsesc@~0.5.0: resolved "https://registry.yarnpkg.com/jsesc/-/jsesc-0.5.0.tgz#e7dee66e35d6fc16f710fe91d5cf69f70f08911d" integrity sha1-597mbjXW/Bb3EP6R1c9p9w8IkR0= -json-bigint@^0.3.0: - version "0.3.1" - resolved "https://registry.yarnpkg.com/json-bigint/-/json-bigint-0.3.1.tgz#0c1729d679f580d550899d6a2226c228564afe60" - integrity sha512-DGWnSzmusIreWlEupsUelHrhwmPPE+FiQvg+drKfk2p+bdEYa5mp4PJ8JsCWqae0M2jQNb0HPvnwvf1qOTThzQ== - dependencies: - bignumber.js "^9.0.0" - json-buffer@3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/json-buffer/-/json-buffer-3.0.0.tgz#5b1f397afc75d677bde8bcfc0e47e1f9a3d9a898" @@ -7973,15 +7900,6 @@ jwa@^1.4.1: ecdsa-sig-formatter "1.0.11" safe-buffer "^5.0.1" -jwa@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/jwa/-/jwa-2.0.0.tgz#a7e9c3f29dae94027ebcaf49975c9345593410fc" - integrity sha512-jrZ2Qx916EA+fq9cEAeCROWPTfCwi1IVHqT2tapuqLEVVDKFDENFw1oL+MwrTvH6msKxsd1YTDVw6uKEcsrLEA== - dependencies: - buffer-equal-constant-time "1.0.1" - ecdsa-sig-formatter "1.0.11" - safe-buffer "^5.0.1" - jws@^3.2.2: version "3.2.2" resolved "https://registry.yarnpkg.com/jws/-/jws-3.2.2.tgz#001099f3639468c9414000e99995fa52fb478304" @@ -7990,14 +7908,6 @@ jws@^3.2.2: jwa "^1.4.1" safe-buffer "^5.0.1" -jws@^4.0.0: - version "4.0.0" - resolved "https://registry.yarnpkg.com/jws/-/jws-4.0.0.tgz#2d4e8cf6a318ffaa12615e9dec7e86e6c97310f4" - integrity sha512-KDncfTmOZoOMTFG4mBlG0qUIOlc03fmzH+ru6RgYVZhPkyiy/92Owlt/8UEN+a4TXR1FQetfIpJE8ApdvdVxTg== - dependencies: - jwa "^2.0.0" - safe-buffer "^5.0.1" - keygrip@~1.1.0: version "1.1.0" resolved "https://registry.yarnpkg.com/keygrip/-/keygrip-1.1.0.tgz#871b1681d5e159c62a445b0c74b615e0917e7226" @@ -8676,7 +8586,7 @@ lru-cache@^4.0.1, lru-cache@^4.1.5: pseudomap "^1.0.2" yallist "^2.1.2" -lru-cache@^5.0.0, lru-cache@^5.1.1: +lru-cache@^5.1.1: version "5.1.1" resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-5.1.1.tgz#1da27e6710271947695daf6848e847f01d84b920" integrity sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w== @@ -8931,7 +8841,7 @@ mime-types@^2.1.12, mime-types@^2.1.18, mime-types@~2.1.19, mime-types@~2.1.24: dependencies: mime-db "1.44.0" -mime@2.4.6, mime@^2.2.0: +mime@2.4.6: version "2.4.6" resolved "https://registry.yarnpkg.com/mime/-/mime-2.4.6.tgz#e5b407c90db442f2beb5b162373d07b69affa4d1" integrity sha512-RZKhC3EmpBchfTGBVb8fb+RL2cWyw/32lshnsETttkBAyAUXSGHxbEJWWRXc751DrIxG1q04b8QwMbAwkRPpUA== @@ -9213,7 +9123,7 @@ nocache@2.1.0: resolved "https://registry.yarnpkg.com/nocache/-/nocache-2.1.0.tgz#120c9ffec43b5729b1d5de88cd71aa75a0ba491f" integrity sha512-0L9FvHG3nfnnmaEQPjT9xhfN4ISk0A8/2j4M37Np4mcDesJjHgEUfgPhdCyZuFI954tjokaIj/A3NdpFNdEh4Q== -node-fetch@2.6.1, node-fetch@^2.1.2, node-fetch@^2.3.0, node-fetch@^2.6.1: +node-fetch@2.6.1, node-fetch@^2.1.2, node-fetch@^2.6.1: version "2.6.1" resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.1.tgz#045bd323631f76ed2e2b55573394416b639a0052" integrity sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw== @@ -9226,11 +9136,6 @@ node-fetch@^1.0.1: encoding "^0.1.11" is-stream "^1.0.1" -node-forge@^0.9.0: - version "0.9.2" - resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.9.2.tgz#b35a44c28889b2ea55cabf8c79e3563f9676190a" - integrity sha512-naKSScof4Wn+aoHU6HBsifh92Zeicm1GDQKd1vp3Y/kOi8ub0DozCa9KpvYNCXslFHYRmLNiqRopGdTGwNLpNw== - node-gyp-build@^3.8.0: version "3.9.0" resolved "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-3.9.0.tgz#53a350187dd4d5276750da21605d1cb681d09e25" @@ -9406,6 +9311,11 @@ oauth-sign@~0.9.0: resolved "https://registry.yarnpkg.com/oauth-sign/-/oauth-sign-0.9.0.tgz#47a7b016baa68b5fa0ecf3dee08a85c679ac6455" integrity sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ== +oauth@0.9.x: + version "0.9.15" + resolved "https://registry.yarnpkg.com/oauth/-/oauth-0.9.15.tgz#bd1fefaf686c96b75475aed5196412ff60cfb9c1" + integrity sha1-vR/vr2hslrdUda7VGWQS/2DPucE= + object-assign@^4.0.1, object-assign@^4.1.0, object-assign@^4.1.1: version "4.1.1" resolved "https://registry.yarnpkg.com/object-assign/-/object-assign-4.1.1.tgz#2109adc7965887cfc05cbbd442cac8bfbb360863" @@ -9918,6 +9828,45 @@ pascalcase@^0.1.1: resolved "https://registry.yarnpkg.com/pascalcase/-/pascalcase-0.1.1.tgz#b363e55e8006ca6fe21784d2db22bd15d7917f14" integrity sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ= +passport-google-oauth2@^0.2.0: + version "0.2.0" + resolved "https://registry.yarnpkg.com/passport-google-oauth2/-/passport-google-oauth2-0.2.0.tgz#fc9ea59e7091f02e24fd16d6be9257ea982ebbc3" + integrity sha512-62EdPtbfVdc55nIXi0p1WOa/fFMM8v/M8uQGnbcXA4OexZWCnfsEi3wo2buag+Is5oqpuHzOtI64JpHk0Xi5RQ== + dependencies: + passport-oauth2 "^1.1.2" + +passport-oauth2@^1.1.2, passport-oauth2@^1.5.0: + version "1.5.0" + resolved "https://registry.yarnpkg.com/passport-oauth2/-/passport-oauth2-1.5.0.tgz#64babbb54ac46a4dcab35e7f266ed5294e3c4108" + integrity sha512-kqBt6vR/5VlCK8iCx1/KpY42kQ+NEHZwsSyt4Y6STiNjU+wWICG1i8ucc1FapXDGO15C5O5VZz7+7vRzrDPXXQ== + dependencies: + base64url "3.x.x" + oauth "0.9.x" + passport-strategy "1.x.x" + uid2 "0.0.x" + utils-merge "1.x.x" + +passport-slack-oauth2@^1.1.0: + version "1.1.0" + resolved "https://registry.yarnpkg.com/passport-slack-oauth2/-/passport-slack-oauth2-1.1.0.tgz#4a153b3d0d5a9e1a5041b61599d2b41a4b9486f1" + integrity sha512-rd0V5lWhtNMTmDWuIIk1eXj+ANgP74fD9h28XEp6AtgtQgWPa577qfeM9YLkl7oUNn8gIQeghsvtW6ziWt52dQ== + dependencies: + passport-oauth2 "^1.5.0" + pkginfo "^0.4.1" + +passport-strategy@1.x.x: + version "1.0.0" + resolved "https://registry.yarnpkg.com/passport-strategy/-/passport-strategy-1.0.0.tgz#b5539aa8fc225a3d1ad179476ddf236b440f52e4" + integrity sha1-tVOaqPwiWj0a0XlHbd8ja0QPUuQ= + +passport@^0.4.0, passport@^0.4.1: + version "0.4.1" + resolved "https://registry.yarnpkg.com/passport/-/passport-0.4.1.tgz#941446a21cb92fc688d97a0861c38ce9f738f270" + integrity sha512-IxXgZZs8d7uFSt3eqNjM9NQ3g3uQCW5avD8mRNoXV99Yig50vjuaez6dQK2qC0kVWPRTujxY0dWgGfT09adjYg== + dependencies: + passport-strategy "1.x.x" + pause "0.0.1" + passthrough-counter@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/passthrough-counter/-/passthrough-counter-1.0.0.tgz#1967d9e66da572b5c023c787db112a387ab166fa" @@ -9999,6 +9948,11 @@ path-type@^4.0.0: resolved "https://registry.yarnpkg.com/path-type/-/path-type-4.0.0.tgz#84ed01c0a7ba380afe09d90a8c180dcd9d03043b" integrity sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw== +pause@0.0.1: + version "0.0.1" + resolved "https://registry.yarnpkg.com/pause/-/pause-0.0.1.tgz#1d408b3fdb76923b9543d96fb4c9dfd535d9cb5d" + integrity sha1-HUCLP9t2kjuVQ9lvtMnf1TXZy10= + pbkdf2@^3.0.3: version "3.1.1" resolved "https://registry.yarnpkg.com/pbkdf2/-/pbkdf2-3.1.1.tgz#cb8724b0fada984596856d1a6ebafd3584654b94" @@ -10133,6 +10087,11 @@ pkg-dir@^4.1.0, pkg-dir@^4.2.0: dependencies: find-up "^4.0.0" +pkginfo@^0.4.1: + version "0.4.1" + resolved "https://registry.yarnpkg.com/pkginfo/-/pkginfo-0.4.1.tgz#b5418ef0439de5425fc4995042dced14fb2a84ff" + integrity sha1-tUGO8EOd5UJfxJlQQtztFPsqhP8= + pngjs@^3.0.0, pngjs@^3.3.3: version "3.4.0" resolved "https://registry.yarnpkg.com/pngjs/-/pngjs-3.4.0.tgz#99ca7d725965fb655814eaf65f38f12bbdbf555f" @@ -12995,7 +12954,7 @@ uglify-js@3.4.x: commander "~2.19.0" source-map "~0.6.1" -uid2@0.0.3: +uid2@0.0.3, uid2@0.0.x: version "0.0.3" resolved "https://registry.yarnpkg.com/uid2/-/uid2-0.0.3.tgz#483126e11774df2f71b8b639dcd799c376162b82" integrity sha1-SDEm4Rd03y9xuLY53NeZw3YWK4I= @@ -13320,6 +13279,11 @@ utila@~0.4: resolved "https://registry.yarnpkg.com/utila/-/utila-0.4.0.tgz#8a16a05d445657a3aea5eecc5b12a4fa5379772c" integrity sha1-ihagXURWV6Oupe7MWxKk+lN5dyw= +utils-merge@1.x.x: + version "1.0.1" + resolved "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713" + integrity sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM= + uuid@2.0.2: version "2.0.2" resolved "https://registry.yarnpkg.com/uuid/-/uuid-2.0.2.tgz#48bd5698f0677e3c7901a1c46ef15b1643794726"