From dda7e862a2bccc48fc42a51bc732cc615809ef90 Mon Sep 17 00:00:00 2001
From: Himanshu Mishra <himanshu@orkohunter.net>
Date: Wed, 23 Jun 2021 15:13:02 +0200
Subject: [PATCH] remove the "catch-all" auth endpoint and register each
 separately

200: for properly registered auth providers
404 (with proper message): misconfigured
404 (plain): for unknown providers

Co-authored-by: Mike Lewis <mtlewis@users.noreply.github.com>
Signed-off-by: Himanshu Mishra <himanshu@orkohunter.net>
---
 plugins/auth-backend/src/service/router.ts | 107 +++++++++++----------
 1 file changed, 55 insertions(+), 52 deletions(-)

diff --git a/plugins/auth-backend/src/service/router.ts b/plugins/auth-backend/src/service/router.ts
index 548c551150..1945e6cb2d 100644
--- a/plugins/auth-backend/src/service/router.ts
+++ b/plugins/auth-backend/src/service/router.ts
@@ -86,47 +86,64 @@ export async function createRouter({
     ...providerFactories,
   };
   const providersConfig = config.getConfig('auth.providers');
-  const providers = providersConfig.keys();
+  const configuredProviders = providersConfig.keys();
 
-  for (const providerId of providers) {
-    logger.info(`Configuring provider, ${providerId}`);
-    try {
-      const providerFactory = allProviderFactories[providerId];
-      if (!providerFactory) {
-        throw Error(`No auth provider available for '${providerId}'`);
+  for (const providerId of Object.keys(allProviderFactories)) {
+    if (configuredProviders.includes(providerId)) {
+      logger.info(`Configuring provider, ${providerId}`);
+      try {
+        const providerFactory = allProviderFactories[providerId];
+        if (!providerFactory) {
+          throw Error(`No auth provider available for '${providerId}'`);
+        }
+
+        const provider = providerFactory({
+          providerId,
+          globalConfig: { baseUrl: authUrl, appUrl },
+          config: providersConfig.getConfig(providerId),
+          logger,
+          tokenIssuer,
+          discovery,
+          catalogApi,
+        });
+
+        const r = Router();
+
+        r.get('/start', provider.start.bind(provider));
+        r.get('/handler/frame', provider.frameHandler.bind(provider));
+        r.post('/handler/frame', provider.frameHandler.bind(provider));
+        if (provider.logout) {
+          r.post('/logout', provider.logout.bind(provider));
+        }
+        if (provider.refresh) {
+          r.get('/refresh', provider.refresh.bind(provider));
+        }
+
+        router.use(`/${providerId}`, r);
+      } catch (e) {
+        if (process.env.NODE_ENV !== 'development') {
+          throw new Error(
+            `Failed to initialize ${providerId} auth provider, ${e.message}`,
+          );
+        }
+
+        logger.warn(`Skipping ${providerId} auth provider, ${e.message}`);
+
+        router.use(`/${providerId}`, () => {
+          // If the user added the provider under auth.providers but the clientId and clientSecret etc. were not found.
+          throw new NotFoundError(
+            `Auth provider registered for '${providerId}' is misconfigured. This could mean the configs under ` +
+              `auth.providers.${providerId} are missing or the environment variables used are not defined. ` +
+              `Check the auth backend plugin logs when the backend starts to see more details.`,
+          );
+        });
       }
-
-      const provider = providerFactory({
-        providerId,
-        globalConfig: { baseUrl: authUrl, appUrl },
-        config: providersConfig.getConfig(providerId),
-        logger,
-        tokenIssuer,
-        discovery,
-        catalogApi,
-      });
-
-      const r = Router();
-
-      r.get('/start', provider.start.bind(provider));
-      r.get('/handler/frame', provider.frameHandler.bind(provider));
-      r.post('/handler/frame', provider.frameHandler.bind(provider));
-      if (provider.logout) {
-        r.post('/logout', provider.logout.bind(provider));
-      }
-      if (provider.refresh) {
-        r.get('/refresh', provider.refresh.bind(provider));
-      }
-
-      router.use(`/${providerId}`, r);
-    } catch (e) {
-      if (process.env.NODE_ENV !== 'development') {
-        throw new Error(
-          `Failed to initialize ${providerId} auth provider, ${e.message}`,
+    } else {
+      router.use(`/${providerId}`, () => {
+        throw new NotFoundError(
+          `No auth provider registered for '${providerId}'`,
         );
-      }
-
-      logger.warn(`Skipping ${providerId} auth provider, ${e.message}`);
+      });
     }
   }
 
@@ -137,19 +154,5 @@ export async function createRouter({
     }),
   );
 
-  router.use('/:provider/', req => {
-    const { provider } = req.params;
-    if (providers.includes(provider)) {
-      // If the user added the provider under auth.providers but the clientId and clientSecret etc. were not found.
-      throw new NotFoundError(
-        `Auth provider registered for '${provider}' is misconfigured. This could mean the configs under ` +
-          `auth.providers.${provider} are missing or the environment variables used are not defined. ` +
-          `Check the auth backend plugin logs when the backend starts to see more details.`,
-      );
-    } else {
-      throw new NotFoundError(`No auth provider registered for '${provider}'`);
-    }
-  });
-
   return router;
 }