From 9e07bdb43d7372c92201eef2e0a60cea7b1f520f Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Sat, 5 Sep 2020 13:42:58 +0200 Subject: [PATCH] auth-backend: slim down oauth start interface and allow for state modifications --- .../auth-backend/src/lib/oauth/OAuthAdapter.ts | 17 +++++++---------- plugins/auth-backend/src/lib/oauth/index.ts | 2 ++ plugins/auth-backend/src/lib/oauth/types.ts | 10 ++++++---- .../src/providers/auth0/provider.ts | 15 +++++++-------- .../src/providers/github/provider.ts | 12 +++++++----- .../src/providers/gitlab/provider.ts | 12 +++++++----- .../src/providers/google/provider.ts | 15 +++++++-------- .../src/providers/microsoft/provider.ts | 12 +++++++----- .../src/providers/oauth2/provider.ts | 15 +++++++-------- .../auth-backend/src/providers/okta/provider.ts | 15 +++++++-------- 10 files changed, 64 insertions(+), 61 deletions(-) diff --git a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts index 0f092ae780..a0583cdd9e 100644 --- a/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts +++ b/plugins/auth-backend/src/lib/oauth/OAuthAdapter.ts @@ -24,9 +24,9 @@ import { } from '../../providers/types'; import { InputError } from '@backstage/backend-common'; import { TokenIssuer } from '../../identity'; -import { verifyNonce, encodeState } from './helpers'; +import { verifyNonce } from './helpers'; import { postMessageResponse, ensuresXRequestedWith } from '../flow'; -import { OAuthHandlers } from './types'; +import { OAuthHandlers, OAuthStartRequest } from './types'; export const THOUSAND_DAYS_MS = 1000 * 24 * 60 * 60 * 1000; export const TEN_MINUTES_MS = 600 * 1000; @@ -86,15 +86,12 @@ export class OAuthAdapter implements AuthProviderRouteHandlers { // set a nonce cookie before redirecting to oauth provider this.setNonceCookie(res, nonce); - const stateObject = { nonce: nonce, env: env }; - const stateParameter = encodeState(stateObject); + const state = { nonce: nonce, env: env }; + const forwardReq = Object.assign(req, { scope, state }); - const queryParameters = { - scope, - state: stateParameter, - }; - - const { url, status } = await this.handlers.start(req, queryParameters); + const { url, status } = await this.handlers.start( + forwardReq as OAuthStartRequest, + ); res.statusCode = status || 302; res.setHeader('Location', url); diff --git a/plugins/auth-backend/src/lib/oauth/index.ts b/plugins/auth-backend/src/lib/oauth/index.ts index 05c8bd9d3d..20a1ca6f99 100644 --- a/plugins/auth-backend/src/lib/oauth/index.ts +++ b/plugins/auth-backend/src/lib/oauth/index.ts @@ -16,10 +16,12 @@ export { OAuthEnvironmentHandler } from './OAuthEnvironmentHandler'; export { OAuthAdapter } from './OAuthAdapter'; +export { encodeState } from './helpers'; export type { OAuthHandlers, OAuthProviderInfo, OAuthProviderOptions, OAuthResponse, OAuthState, + OAuthStartRequest, } from './types'; diff --git a/plugins/auth-backend/src/lib/oauth/types.ts b/plugins/auth-backend/src/lib/oauth/types.ts index a854326bed..f3a50e8596 100644 --- a/plugins/auth-backend/src/lib/oauth/types.ts +++ b/plugins/auth-backend/src/lib/oauth/types.ts @@ -67,6 +67,11 @@ export type OAuthState = { env: string; }; +export type OAuthStartRequest = express.Request<{}> & { + scope: string; + state: OAuthState; +}; + /** * Any OAuth provider needs to implement this interface which has provider specific * handlers for different methods to perform authentication, get access tokens, @@ -78,10 +83,7 @@ export interface OAuthHandlers { * @param {express.Request} req * @param options */ - start( - req: express.Request, - options: Record, - ): Promise; + start(req: OAuthStartRequest): Promise; /** * Handles the redirect from the auth provider when the user has signed in. diff --git a/plugins/auth-backend/src/providers/auth0/provider.ts b/plugins/auth-backend/src/providers/auth0/provider.ts index 3b7817ffe9..d71ee1bbed 100644 --- a/plugins/auth-backend/src/providers/auth0/provider.ts +++ b/plugins/auth-backend/src/providers/auth0/provider.ts @@ -23,6 +23,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import { executeFetchUserProfileStrategy, @@ -81,16 +83,13 @@ export class Auth0AuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - const providerOptions = { - ...options, + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { accessType: 'offline', prompt: 'consent', - }; - return await executeRedirectStrategy(req, this._strategy, providerOptions); + scope: req.scope, + state: encodeState(req.state), + }); } async handler( diff --git a/plugins/auth-backend/src/providers/github/provider.ts b/plugins/auth-backend/src/providers/github/provider.ts index 2205fb6794..bab7b3fc28 100644 --- a/plugins/auth-backend/src/providers/github/provider.ts +++ b/plugins/auth-backend/src/providers/github/provider.ts @@ -29,6 +29,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import passport from 'passport'; @@ -117,11 +119,11 @@ export class GithubAuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - return await executeRedirectStrategy(req, this._strategy, options); + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { + scope: req.scope, + state: encodeState(req.state), + }); } async handler(req: express.Request) { diff --git a/plugins/auth-backend/src/providers/gitlab/provider.ts b/plugins/auth-backend/src/providers/gitlab/provider.ts index 97f0b2bd22..4d4ecc3b56 100644 --- a/plugins/auth-backend/src/providers/gitlab/provider.ts +++ b/plugins/auth-backend/src/providers/gitlab/provider.ts @@ -29,6 +29,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import passport from 'passport'; @@ -122,11 +124,11 @@ export class GitlabAuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - return await executeRedirectStrategy(req, this._strategy, options); + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { + scope: req.scope, + state: encodeState(req.state), + }); } async handler(req: express.Request): Promise<{ response: OAuthResponse }> { diff --git a/plugins/auth-backend/src/providers/google/provider.ts b/plugins/auth-backend/src/providers/google/provider.ts index 9ee2e1d680..2eb7b8573b 100644 --- a/plugins/auth-backend/src/providers/google/provider.ts +++ b/plugins/auth-backend/src/providers/google/provider.ts @@ -31,6 +31,8 @@ import { OAuthProviderOptions, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import passport from 'passport'; @@ -79,16 +81,13 @@ export class GoogleAuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - const providerOptions = { - ...options, + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { accessType: 'offline', prompt: 'consent', - }; - return await executeRedirectStrategy(req, this._strategy, providerOptions); + scope: req.scope, + state: encodeState(req.state), + }); } async handler( diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts index edc5509d84..2eba3b5191 100644 --- a/plugins/auth-backend/src/providers/microsoft/provider.ts +++ b/plugins/auth-backend/src/providers/microsoft/provider.ts @@ -35,6 +35,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import got from 'got'; @@ -111,11 +113,11 @@ export class MicrosoftAuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - return await executeRedirectStrategy(req, this._strategy, options); + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { + scope: req.scope, + state: encodeState(req.state), + }); } async handler( diff --git a/plugins/auth-backend/src/providers/oauth2/provider.ts b/plugins/auth-backend/src/providers/oauth2/provider.ts index 5a4882fa6f..4a510f8c25 100644 --- a/plugins/auth-backend/src/providers/oauth2/provider.ts +++ b/plugins/auth-backend/src/providers/oauth2/provider.ts @@ -23,6 +23,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import { executeFetchUserProfileStrategy, @@ -84,16 +86,13 @@ export class OAuth2AuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - const providerOptions = { - ...options, + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { accessType: 'offline', prompt: 'consent', - }; - return await executeRedirectStrategy(req, this._strategy, providerOptions); + scope: req.scope, + state: encodeState(req.state), + }); } async handler( diff --git a/plugins/auth-backend/src/providers/okta/provider.ts b/plugins/auth-backend/src/providers/okta/provider.ts index 0368bd8415..0ac75beaf8 100644 --- a/plugins/auth-backend/src/providers/okta/provider.ts +++ b/plugins/auth-backend/src/providers/okta/provider.ts @@ -20,6 +20,8 @@ import { OAuthHandlers, OAuthResponse, OAuthEnvironmentHandler, + OAuthStartRequest, + encodeState, } from '../../lib/oauth'; import { Strategy as OktaStrategy } from 'passport-okta-oauth'; import passport from 'passport'; @@ -101,16 +103,13 @@ export class OktaAuthProvider implements OAuthHandlers { ); } - async start( - req: express.Request, - options: Record, - ): Promise { - const providerOptions = { - ...options, + async start(req: OAuthStartRequest): Promise { + return await executeRedirectStrategy(req, this._strategy, { accessType: 'offline', prompt: 'consent', - }; - return await executeRedirectStrategy(req, this._strategy, providerOptions); + scope: req.scope, + state: encodeState(req.state), + }); } async handler(