-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add routes and session for staff sso oauth * Add account view * Test OAuth config * Complete adding tests and refactor into plugin * Add manifests for CF deploy * Fix docker images * Rename docker images for consistency * Move to single root manifest with app name var * Attempt at magical substitution * Another attempt at magical substitution * Manual substitution * Prevent eager substitution in sed command * Force https for redirect url * Force https for redirect url - debug * Generate auth cookie password * Show logout link in header * Use service URL var to determine force https config * Remove TODO * Enforce login for form pages if SSO config set * Remove account view * Rename vars to be less specific * Update README * Update components diagram * Reformat README * Fix for undefined request * Use @hapi/bell as it is more up-to-date * Move login redirect logic to engine plugin * Remove CloudFoundry manifest * Prefer official hapi library and use secure cookie * Remove unnecessary comment * Reset session on logout * Run all tests O_o
- Loading branch information
Showing
18 changed files
with
473 additions
and
40 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| import AuthCookie from "@hapi/cookie"; | ||
| import Bell from "@hapi/bell"; | ||
|
|
||
| import config from "server/config"; | ||
| import { HapiRequest, HapiResponseToolkit } from "server/types"; | ||
| import { redirectTo } from "server/plugins/engine"; | ||
| import generateCookiePassword from "server/utils/generateCookiePassword"; | ||
|
|
||
| export const shouldLogin = (request: HapiRequest) => | ||
| config.authEnabled && !request.auth.isAuthenticated; | ||
|
|
||
| export default { | ||
| plugin: { | ||
| name: "auth", | ||
| register: async (server) => { | ||
| if (!config.authEnabled) { | ||
| return; | ||
| } | ||
|
|
||
| await server.register(AuthCookie); | ||
| await server.register(Bell); | ||
|
|
||
| server.auth.strategy("session", "cookie", { | ||
| cookie: { | ||
| name: "auth", | ||
| password: config.sessionCookiePassword || generateCookiePassword(), | ||
| isSecure: true, | ||
| }, | ||
| }); | ||
|
|
||
| server.auth.strategy("oauth", "bell", { | ||
| provider: { | ||
| name: "oauth", | ||
| protocol: "oauth2", | ||
| auth: config.authClientAuthUrl, | ||
| token: config.authClientTokenUrl, | ||
| scope: ["read write"], | ||
| profile: async (credentials, _params, get) => { | ||
| const { email, first_name, last_name, user_id } = await get( | ||
| config.authClientProfileUrl | ||
| ); | ||
| credentials.profile = { email, first_name, last_name, user_id }; | ||
| }, | ||
| }, | ||
| password: config.sessionCookiePassword || generateCookiePassword(), | ||
| clientId: config.authClientId, | ||
| clientSecret: config.authClientSecret, | ||
| forceHttps: config.serviceUrl.startsWith("https"), | ||
| }); | ||
|
|
||
| server.auth.default({ strategy: "session", mode: "try" }); | ||
|
|
||
| server.route({ | ||
| method: ["GET", "POST"], | ||
| path: "/login", | ||
| config: { | ||
| auth: "oauth", | ||
| handler: (request: HapiRequest, h: HapiResponseToolkit) => { | ||
| if (request.auth.isAuthenticated) { | ||
| request.cookieAuth.set(request.auth.credentials.profile); | ||
| const returnUrl = | ||
| request.auth.credentials.query?.returnUrl || "/"; | ||
| return redirectTo(request, h, returnUrl); | ||
| } | ||
|
|
||
| return h.response(JSON.stringify(request)); | ||
| }, | ||
| }, | ||
| }); | ||
|
|
||
| server.route({ | ||
| method: "get", | ||
| path: "/logout", | ||
| handler: async (request: HapiRequest, h: HapiResponseToolkit) => { | ||
| request.cookieAuth.clear(); | ||
| request.yar.reset(); | ||
|
|
||
| return redirectTo(request, h, "/"); | ||
| }, | ||
| }); | ||
| }, | ||
| }, | ||
| }; |
Oops, something went wrong.