Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
66 lines
2.5 KiB
JavaScript
66 lines
2.5 KiB
JavaScript
// ── Auth provider contract (base) ──────────────────────────────────────────
|
|
//
|
|
// The abstract interface every auth provider implements. Concrete providers:
|
|
// - local → username/password (LocalProvider, unchanged live flow)
|
|
// - google, discord, generic OIDC → OAuth2Provider subclasses
|
|
//
|
|
// A provider config (a row from auth_providers, or a built-in default) looks like:
|
|
// { id, kind, name, enabled, clientId, clientSecret,
|
|
// authorizeUrl, tokenUrl, userinfoUrl, scopes, priority }
|
|
//
|
|
// Interface (per the Part 3 spec). OAuth providers implement the SSO-flow methods;
|
|
// LocalProvider implements authenticate(). Anything not applicable stays a throw.
|
|
|
|
class BaseProvider {
|
|
constructor(config = {}) {
|
|
this.config = config
|
|
this.id = config.id || config.kind || 'base'
|
|
this.name = config.name || this.id
|
|
this.kind = config.kind || 'base'
|
|
this.type = this.kind // legacy alias
|
|
}
|
|
|
|
isEnabled() {
|
|
return Boolean(this.config.enabled)
|
|
}
|
|
|
|
// Direct-credential auth (local providers). Resolve to an internal user or null.
|
|
// eslint-disable-next-line no-unused-vars
|
|
async authenticate(credentials) {
|
|
throw new Error(`authenticate() not implemented for provider '${this.id}'`)
|
|
}
|
|
|
|
// Begin an SSO redirect flow: the provider's authorization URL.
|
|
// eslint-disable-next-line no-unused-vars
|
|
getAuthorizationUrl(state, options) {
|
|
throw new Error(`getAuthorizationUrl() not implemented for provider '${this.id}'`)
|
|
}
|
|
|
|
// Complete an SSO redirect flow: exchange the callback code for a normalized
|
|
// user profile ({ subject, email, name }).
|
|
// eslint-disable-next-line no-unused-vars
|
|
async handleCallback(params) {
|
|
throw new Error(`handleCallback() not implemented for provider '${this.id}'`)
|
|
}
|
|
|
|
// Fetch the raw external profile using an access token.
|
|
// eslint-disable-next-line no-unused-vars
|
|
async getUserProfile(accessToken) {
|
|
throw new Error(`getUserProfile() not implemented for provider '${this.id}'`)
|
|
}
|
|
|
|
// Normalize a raw external profile to { subject, email, name }.
|
|
// eslint-disable-next-line no-unused-vars
|
|
mapUser(profile) {
|
|
throw new Error(`mapUser() not implemented for provider '${this.id}'`)
|
|
}
|
|
|
|
// Link an external identity to an internal user (shared by OAuth2Provider).
|
|
// eslint-disable-next-line no-unused-vars
|
|
async linkAccount(user, profile) {
|
|
throw new Error(`linkAccount() not implemented for provider '${this.id}'`)
|
|
}
|
|
}
|
|
|
|
module.exports = BaseProvider
|