@m-ld/gateway
Version:
m-ld gateway for services
68 lines • 5.79 kB
JavaScript
import { AccountOwnedId, AuthKey } from '../lib/index.js';
import { UserKey } from '../data/index.js';
import { UnauthorizedError } from '../http/errors.js';
import { decode } from 'jsonwebtoken';
export class Authorization {
static fromRequest(req) {
if (req.authorization == null)
throw new UnauthorizedError;
switch (req.authorization.scheme) {
case 'Bearer':
return new JwtAuthorization(req.authorization.credentials);
case 'Basic':
const { username, password } = req.authorization.basic;
return new KeyAuthorization(username, password);
default:
throw new UnauthorizedError('Unrecognised authorization');
}
}
async getUserAccount(gateway, user) {
if (!AccountOwnedId.isComponentId(user))
throw new UnauthorizedError('Bad user %s', user);
const userAcc = await gateway.account(user);
if (userAcc == null)
throw new UnauthorizedError('Not found: %s', user);
return userAcc;
}
}
export class KeyAuthorization extends Authorization {
/**
* @param user
* @param key an authorisation key associated with this Account
*/
constructor(user, key) {
super();
this.user = user;
this.key = key;
}
async verifyUser(gateway, access) {
const userAcc = await this.getUserAccount(gateway, this.user);
const authKey = AuthKey.fromString(this.key);
const userKey = await userAcc.authorise(authKey.keyid, access);
if (!userKey.matches(authKey))
throw new UnauthorizedError;
return { acc: userAcc, keyid: userKey.keyid };
}
}
export class JwtAuthorization extends Authorization {
/** @param jwt a JWT containing a keyid associated with this Account */
constructor(jwt) {
super();
this.jwt = jwt;
}
async verifyUser(gateway, access) {
const payload = decode(this.jwt, { json: true });
if (payload?.sub == null)
throw new UnauthorizedError('Missing user identity');
const userAcc = await this.getUserAccount(gateway, payload.sub);
let keyid;
try { // Verify the JWT against its declared keyid
await UserKey.verifyJwt(this.jwt, async (header) => userAcc.authorise(keyid = header.kid, access));
}
catch (e) {
throw new UnauthorizedError(e);
}
return { acc: userAcc, keyid: keyid };
}
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQXV0aG9yaXphdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2ZXIvQXV0aG9yaXphdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzFELE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUMzQyxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQztBQUd0RCxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBYXRDLE1BQU0sT0FBZ0IsYUFBYTtJQUNqQyxNQUFNLENBQUMsV0FBVyxDQUFDLEdBQVk7UUFDN0IsSUFBSSxHQUFHLENBQUMsYUFBYSxJQUFJLElBQUk7WUFDM0IsTUFBTSxJQUFJLGlCQUFpQixDQUFDO1FBQzlCLFFBQVEsR0FBRyxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUU7WUFDaEMsS0FBSyxRQUFRO2dCQUNYLE9BQU8sSUFBSSxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQzdELEtBQUssT0FBTztnQkFDVixNQUFNLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUMsS0FBTSxDQUFDO2dCQUN4RCxPQUFPLElBQUksZ0JBQWdCLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQ2xEO2dCQUNFLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO1NBQzdEO0lBQ0gsQ0FBQztJQVlTLEtBQUssQ0FBQyxjQUFjLENBQUMsT0FBZ0IsRUFBRSxJQUFZO1FBQzNELElBQUksQ0FBQyxjQUFjLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQztZQUNyQyxNQUFNLElBQUksaUJBQWlCLENBQUMsYUFBYSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQ25ELE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM1QyxJQUFJLE9BQU8sSUFBSSxJQUFJO1lBQ2pCLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDckQsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztDQUNGO0FBRUQsTUFBTSxPQUFPLGdCQUFpQixTQUFRLGFBQWE7SUFDakQ7OztPQUdHO0lBQ0gsWUFDbUIsSUFBWSxFQUNaLEdBQVc7UUFFNUIsS0FBSyxFQUFFLENBQUM7UUFIUyxTQUFJLEdBQUosSUFBSSxDQUFRO1FBQ1osUUFBRyxHQUFILEdBQUcsQ0FBUTtJQUc5QixDQUFDO0lBRUQsS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFnQixFQUFFLE1BQXNCO1FBQ3ZELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzlELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzdDLE1BQU0sT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQy9ELElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQztZQUMzQixNQUFNLElBQUksaUJBQWlCLENBQUM7UUFDOUIsT0FBTyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUNoRCxDQUFDO0NBQ0Y7QUFFRCxNQUFNLE9BQU8sZ0JBQWlCLFNBQVEsYUFBYTtJQUNqRCx1RUFBdUU7SUFDdkUsWUFDbUIsR0FBVztRQUU1QixLQUFLLEVBQUUsQ0FBQztRQUZTLFFBQUcsR0FBSCxHQUFHLENBQVE7SUFHOUIsQ0FBQztJQUVELEtBQUssQ0FBQyxVQUFVLENBQUMsT0FBZ0IsRUFBRSxNQUFzQjtRQUN2RCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELElBQUksT0FBTyxFQUFFLEdBQUcsSUFBSSxJQUFJO1lBQ3RCLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hFLElBQUksS0FBYSxDQUFDO1FBQ2xCLElBQUksRUFBRSw0Q0FBNEM7WUFDaEQsTUFBTSxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFDLE1BQU0sRUFBQyxFQUFFLENBQy9DLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxHQUFHLE1BQU0sQ0FBQyxHQUFJLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztTQUNuRDtRQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQ1YsTUFBTSxJQUFJLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDO1NBQ2hDO1FBQ0QsT0FBTyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEtBQU0sRUFBRSxDQUFDO0lBQ3pDLENBQUM7Q0FDRiJ9