botpress/lib/security/cloud/index.js

The world's first CMS for bots. Easily create, manage and extend chatbots.

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});

var _jsonwebtoken = require('jsonwebtoken');

var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);

var _provider = require('../provider');

var _provider2 = _interopRequireDefault(_provider);

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

function _asyncToGenerator(fn) { return function () { var gen = fn.apply(this, arguments); return new Promise(function (resolve, reject) { function step(key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { return Promise.resolve(value).then(function (value) { step("next", value); }, function (err) { step("throw", err); }); } } return step("next"); }); }; }

class CloudAuthentication extends _provider2.default {
  constructor(options) {
    super(options);

    const { botId } = this.cloud.getPairingInfo() || {};

    this.botId = botId;
    this.botEnv = this.cloud.getBotEnv();
    this.endpoint = this.cloud.getCloudEndpoint();
  }

  login() {
    return _asyncToGenerator(function* () {
      return { success: false, reason: 'Root authentication is disabled when using Botpress Cloud [BPCLOUDERR]' };
    })();
  }

  getAuthenticationInfo() {
    return {
      type: 'cloud',
      botId: this.botId,
      botEnv: this.botEnv,
      endpoint: this.endpoint
    };
  }

  authenticateWithError(authHeader, allowProof = false) {
    var _this = this;

    return _asyncToGenerator(function* () {
      if (!authHeader) {
        throw new Error('Missing auth header');
      }

      const [scheme, token] = authHeader.split(' ');

      if (scheme.toLowerCase() !== 'bearer') {
        throw new Error(`Wrong scheme '${scheme}', expected Bearer`);
      }

      const secret = yield _this.cloud.getCertificate();
      const algorithm = 'RS256';

      const decoded = _jsonwebtoken2.default.verify(token, secret, { algorithms: [algorithm] });

      if (!allowProof && decoded.identity_proof_only) {
        return false;
      }

      if (decoded.aud !== `urn:bot/${_this.botId}`) {
        return false;
      }

      return decoded.user;
    })();
  }

  refreshToken(authHeader) {
    return _asyncToGenerator(function* () {
      const [scheme, token] = authHeader.split(' ');
      if (scheme.toLowerCase() !== 'bearer') {
        // only support Bearer scheme
        return {
          success: false,
          reason: `Wrong scheme '${scheme}', expected Bearer`
        };
      }

      // doesn't matter, can return the same token
      return {
        success: true,
        token
      };
    })();
  }

  getUserIdentity(token) {
    var _this2 = this;

    return _asyncToGenerator(function* () {
      return _this2.authenticateWithError('bearer ' + token, true);
    })();
  }

  getJWTSecretOrCertificate() {
    var _this3 = this;

    return _asyncToGenerator(function* () {
      return _this3.cloud.getCertificate();
    })();
  }
}
exports.default = CloudAuthentication;
//# sourceMappingURL=index.js.map