Implement authentication through a Facebook flow

config/circleci.json

@@ -10,5 +10,12 @@
     "user": "ubuntu",
     "password": ""
   },
+  "userAuth": {
+    "sessionSecret": "v3erY secr€t",
+    "facebook": {
+      "clientID": "some_client_id",
+      "clientSecret": "some_client_secret"
+    }
+  },
   "version": "v1.0"
 }

config/sample.json

@@ -3,13 +3,21 @@
   "adminSessionSecret": "default",
   "env": "dev",
   "port": 8080,
+  "publicHost": "http://localhost:8080",
   "db": {
     "host": "localhost",
     "port": 5432,
     "name": "sensorweb",
     "user": "postgres",
     "password": "default"
   },
+  "userAuth": {
+    "sessionSecret": "default",
+    "facebook": {
+      "clientID": "",
+      "clientSecret": ""
+    }
+  },
   "sensorthings": {
     "server": "https://pg-api.sensorup.com",
     "path": "/st-playground/proxy/v1.0",

config/test.json

@@ -3,12 +3,20 @@
   "adminSessionSecret": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
   "env": "test",
   "port": 8080,
+  "publicHost": "http://localhost:8080",
   "db": {
     "host": "localhost",
     "port": 5432,
     "name": "sensorwebtest",
     "user": "postgres",
     "password": "default"
   },
+  "userAuth": {
+    "sessionSecret": "v3erY secr€t",
+    "facebook": {
+      "clientID": "some_client_id",
+      "clientSecret": "some_client_secret"
+    }
+  },
   "version": "v1.0"
 }

package.json

@@ -26,27 +26,36 @@
     "babel-cli": "^6.18.0",
     "babel-preset-env": "^1.1.8",
     "babel-register": "^6.18.0",
+    "co": "^4.6.0",
+    "co-mocha": "^1.1.3",
     "coveralls": "^2.11.14",
     "istanbul": "^0.4.5",
     "mocha": "^3.1.0",
+    "nock": "^9.0.2",
     "nodemon": "^1.10.2",
     "nyc": "^8.3.1",
     "should": "^11.1.0",
-    "supertest": "^2.0.0"
+    "supertest": "^2.0.0",
+    "supertest-as-promised": "^4.0.2"
   },
   "dependencies": {
     "body-parser": "^1.15.2",
     "btoa": "^1.1.2",
+    "connect-session-sequelize": "^4.1.0",
     "convict": "^1.5.0",
     "cors": "^2.8.1",
     "express": "^4.14.0",
     "express-http-proxy": "^0.10.0",
+    "express-session": "^1.14.2",
     "express-validator": "^2.20.10",
     "jsonwebtoken": "^7.1.9",
     "lodash": "^4.15.0",
     "morgan-body": "^0.9.1",
     "on-headers": "^1.0.1",
     "owasp-password-strength-test": "^1.3.0",
+    "passport": "^0.3.2",
+    "passport-facebook": "^2.1.1",
+    "passport-http": "^0.3.0",
     "pg": "^6.1.0",
     "sensorthings": "^0.0.10",
     "sequelize": "^3.24.5"

src/config.js

@@ -26,6 +26,15 @@ convict.addFormat({
   coerce: (val) => (val === null ? null : parseInt(val))
 });
 
+convict.addFormat({
+  name: 'hex',
+  validate: function(val) {
+    if (/[^a-fA-F0-9]/.test(val)) {
+      throw new Error('must be a hex key');
+    }
+  }
+});
+
 const conf = convict({
   adminPass: {
     doc: 'The password for the admin user. Follow OWASP guidelines for passwords',
@@ -72,6 +81,9 @@ const conf = convict({
       default: '',
     }
   },
+  publicHost: {
+    doc: 'Public host for this server, especially for auth callback'
+  },
   sensorthings: {
     server: {
       doc: 'SensorThings remote API server',
@@ -93,6 +105,39 @@ const conf = convict({
       }
     }
   },
+  behindProxy: {
+    doc: `Set this to true if the server runs behind a reverse proxy. This is
+          especially important if the proxy implements HTTPS with
+          userAuth.cookieSecure. Also with this Express will trust the
+          X-Forwarded-For header. Set to 1 or auto if you're behind a proxy.`,
+    default: false,
+    // Format is "*" because otherwise convict infers it's a boolean from the
+    // default value and will refuse 1 or "auto".
+    format: '*',
+  },
+  userAuth: {
+    cookieSecure: {
+      doc: `This configures whether the cookie should be set and sent for
+            HTTPS only. This is important to set to 'true' if the application
+            runs on HTTPS.`,
+      default: false,
+    },
+    sessionSecret: {
+      doc: 'This secret is used to sign session cookie',
+      default: defaultValue,
+      format: avoidDefault,
+    },
+    facebook: {
+      clientId: {
+        doc: 'Facebook clientId',
+        format: 'nat'
+      },
+      clientSecret: {
+        doc: 'Facebook clientSecret',
+        format: 'hex'
+      },
+    },
+  },
   version: {
     doc: 'API version. We follow SensorThing\'s versioning format as described at http://docs.opengeospatial.org/is/15-078r6/15-078r6.html#34',
     format: value => {

src/middlewares/auth.js

@@ -4,6 +4,7 @@
 
 import jwt    from 'jsonwebtoken';
 import config from '../config';
+import db     from '../models/db';
 
 import {
   ApiError,
@@ -16,13 +17,25 @@ function unauthorized(res) {
 }
 
 export default (scopes) => {
+  // For now we only allow 'admin' scope.
+  const validScopes = ['admin', 'client', 'user'].filter(
+    scope => scopes.includes(scope)
+  );
+
+  if (!validScopes.length) {
+    throw new Error(`No valid scope found in "${scopes}"`);
+  }
+
   return (req, res, next) => {
-    const authHeader = req.headers['authorization'];
-    if (!authHeader) {
+    const authHeader = req.headers.authorization;
+    // Accepting a query parameter as well allows GET requests.
+    const authQuery = req.query.authorizationToken;
+
+    if (!authHeader && !authQuery) {
       return unauthorized(res);
     }
 
-    const token = authHeader.split('Bearer ')[1];
+    const token = authHeader ? authHeader.split('Bearer ')[1] : authQuery;
     if (!token) {
       return unauthorized(res);
     }
@@ -31,36 +44,43 @@ export default (scopes) => {
     // need to get the owner of the token so we can get the appropriate secret.
     const decoded = jwt.decode(token);
 
-    // For now we only allow authenticated requests from the admin user.
-    // When this changes we will have a different secret per sensor and per
-    // user.
-    if (!decoded || !decoded.id || decoded.id !== 'admin') {
+    if (!decoded || !decoded.id || !decoded.scope) {
       return unauthorized(res);
-    };
+    }
 
-    const secret = config.get('adminSessionSecret');
+    if (!validScopes.includes(decoded.scope)) {
+      console.log('Error while authenticating, invalid scope', decoded);
+      return unauthorized(res);
+    }
 
-    // Verify JWT signature.
-    jwt.verify(token, secret, (error, decoded) => {
-      if (error) {
-        return unauthorized(res);
-      }
+    let secretPromise;
+    switch(decoded.scope) {
+      case 'client':
+        secretPromise = db().then(({ Clients }) =>
+          Clients.findById(decoded.id, { attributes: ['secret'] })
+        ).then(client => client.secret);
+        break;
+      case 'user':
+      case 'admin':
+        secretPromise = Promise.resolve(config.get('adminSessionSecret'));
+        break;
+      default:
+        // should not happen because we check this earlier
+        next(new Error(`Unknown scope ${decoded.scope}`));
+    }
 
-      // XXX Get allowed scopes from sensor/user.
+    // Verify JWT signature.
+    secretPromise.then(secret => {
+      jwt.verify(token, secret, (error) => {
+        if (error) {
+          console.log('Error while verifying the token', error);
+          return unauthorized(res);
+        }
 
-      // For now we only allow 'admin' scope.
-      const validScopes = ['admin'].filter(scopeIndex => {
-        return scopes.indexOf(scopeIndex) != -1;
+        req[decoded.scope] = decoded.id;
+        req.authScope = decoded.scope;
+        return next();
       });
-
-      if (!validScopes.length) {
-        return unauthorized(res);
-      }
-
-      // If everything is good, save the decoded payload for use in other
-      // routes.
-      req.decoded = decoded;
-      next();
-    });
+    }).catch(err => next(err || new Error('Unexpected error')));
   };
 };

src/models/db.js

@@ -27,7 +27,16 @@ let deferreds = [];
 let state = IDLE;
 let db    = null;
 
-module.exports = () => {
+const { name, user, password, host, port } = config.get('db');
+
+const sequelize = new Sequelize(name, user, password, {
+  host,
+  port,
+  dialect: 'postgres',
+  logging: false
+});
+
+export default function() {
   if (state === READY) {
     return Promise.resolve(db);
   }
@@ -41,24 +50,13 @@ module.exports = () => {
 
   state = INITIALIZING;
 
-  const dbConfig = config.get('db');
-  const { name, user, password, host, port } = dbConfig;
-
-  const sequelize = new Sequelize(name, user, password, {
-    host,
-    port,
-    dialect: 'postgres',
-    logging: false
-  });
-
   db = {};
 
   fs.readdirSync(__dirname)
     .filter(file => {
       return ((file.indexOf('.js') !== 0) &&
-              (file !== 'db.js') &&
-              (file !== 'users.js') &&
-              (file.indexOf('.swp') < 0));
+              !file.startsWith('.') &&
+              (file !== 'db.js'));
     })
     .forEach(file => {
       const model = sequelize.import(path.join(__dirname, file));
@@ -74,7 +72,7 @@ module.exports = () => {
   db.sequelize = sequelize;
   db.Sequelize = Sequelize;
 
-  return db.sequelize.sync().then(() => {
+  return sequelize.sync().then(() => {
     while (deferreds.length) {
       deferreds.pop().resolve(db);
     }
@@ -86,4 +84,6 @@ module.exports = () => {
       deferreds.pop().reject(e);
     }
   });
-};
+}
+
+export { sequelize, Sequelize };