Claude
31b31c3a17
Refactor authentication into a provider-agnostic session layer and build
two new auth surfaces on top of it, without changing local password/TOTP
behavior. Every flow now issues sessions through
sessionService.createSession(user, authMethod).
Part 1 — Session abstraction (backward-compatible refactor):
- New server/src/auth/: token.js (JWT/cookie primitives), session.service.js
(create/validate/partial-TOTP/revoke), session.middleware.js
(attachSession/requireAuth/requireRole). utils/auth.js is now a thin
compat facade so existing imports are unchanged.
Part 2 — Mobile bearer auth (additive):
- /api/v1/auth/mobile/{login,refresh,logout}: short-lived access JWT +
long-lived refresh token, stored hashed and rotated on use, in a new
mobile_refresh_tokens table. Reuses web bot-scoring/backoff; single-request
TOTP. token.signToken gains a backward-compatible expiresIn option.
Part 3 — Pluggable SSO (Google, Discord, generic OIDC):
- OAuth2Provider base + built-in Google/Discord (fixed endpoints) + generic
OIDC, a registry with health/validation, PKCE+CSRF transaction state, and
discovery (GET /auth/providers), start/link/callback routes.
- Link-only policy: SSO signs in only to an already-linked account; external
identities are never auto-provisioned. Client secrets encrypted at rest
(AES-256-GCM, utils/secretBox.js). Admin CRUD (/admin/auth/providers) and
account linking (/admin/account/identities). New auth_providers +
user_identities tables.
Frontend:
- Login page renders provider buttons from /auth/providers (inline SVG icons,
graceful with zero providers). New Authentication admin view
(Local/Google/Discord/Custom). Account page linked-accounts section.
Tests: 83 passing (session, mobile, providers, registry, secretBox, ssoState,
ssoCallback) — all DB-free via fetch mocks + model stubs. README + .env.example
updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
2.1 KiB
JavaScript
51 lines
2.1 KiB
JavaScript
// Auth-provider config store. Thin logic layer over authProviders.db, mirroring
|
|
// the users model split. Owns encryption of the client secret at the boundary so
|
|
// the DB layer only ever sees ciphertext and callers only ever see the decrypted
|
|
// secret when they explicitly ask (getWithSecret) — the plain list/get paths
|
|
// never surface it.
|
|
|
|
const db = require('./authProviders.db')
|
|
const secretBox = require('../../utils/secretBox')
|
|
|
|
// All configured provider rows (secret column left as ciphertext; callers that
|
|
// need the secret use getWithSecret).
|
|
async function list() {
|
|
return db.list()
|
|
}
|
|
|
|
async function get(id) {
|
|
return db.get(id)
|
|
}
|
|
|
|
// Provider row with the client secret decrypted (server-side only — used by the
|
|
// registry at token-exchange time). Returns null if the provider does not exist.
|
|
async function getWithSecret(id) {
|
|
const row = await db.get(id)
|
|
if (!row) return null
|
|
return { ...row, client_secret: row.client_secret_enc ? secretBox.decrypt(row.client_secret_enc) : null }
|
|
}
|
|
|
|
// Create/update a provider. `secret` (raw) is encrypted here; pass secret ===
|
|
// undefined to leave an existing secret untouched, or '' to keep it unchanged as
|
|
// well (blank means "no change" from the admin UI). Returns the stored row.
|
|
async function save(id, { kind, name, enabled, clientId, secret, authorizeUrl, tokenUrl, userinfoUrl, scopes, priority }) {
|
|
const fields = {}
|
|
if (kind !== undefined) fields.kind = kind
|
|
if (name !== undefined) fields.name = name
|
|
if (enabled !== undefined) fields.enabled = enabled ? 1 : 0
|
|
if (clientId !== undefined) fields.client_id = clientId
|
|
if (secret) fields.client_secret_enc = secretBox.encrypt(secret) // only when a new secret is given
|
|
if (authorizeUrl !== undefined) fields.authorize_url = authorizeUrl
|
|
if (tokenUrl !== undefined) fields.token_url = tokenUrl
|
|
if (userinfoUrl !== undefined) fields.userinfo_url = userinfoUrl
|
|
if (scopes !== undefined) fields.scopes = scopes
|
|
if (priority !== undefined) fields.priority = priority
|
|
return db.upsert(id, fields)
|
|
}
|
|
|
|
async function remove(id) {
|
|
return db.remove(id)
|
|
}
|
|
|
|
module.exports = { list, get, getWithSecret, save, remove }
|