#494

pending completion

Build # #494

Build Type

push

github-actions

Committed by

web-flow

Commit Message

<a href="https://github.com/Badgerati/Pode/commit/<a class=hub.com/Badgerati/Pode/commit/344215709e6d5c1e06f21d05568fc7dd3c1a935d">344215709<a href="https://github.com/Badgerati/Pode/commit/344215709e6d5c1e06f21d05568fc7dd3c1a935d">">Merge </a><a class="double-link" href="https://github.com/Badgerati/Pode/commit/<a class="double-link" href="https://github.com/Badgerati/Pode/commit/bdccd648e73b9088aef5a6148407509608e5f421">bdccd648e</a>">bdccd648e</a><a href="https://github.com/Badgerati/Pode/commit/344215709e6d5c1e06f21d05568fc7dd3c1a935d"> into 62a7af809">62a7af809</a>

Run Details

12 of 12 new or added lines in 2 files covered. (100.0%)

2289 of 4641 relevant lines covered (49.32%)

1.26 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

12.5

/src/Private/Authentication.ps1

function Get-PodeAuthBasicType
{
    return {
        param($e, $options)

        # get the auth header
        $header = (Get-PodeHeader -Name 'Authorization')
        if ($null -eq $header) {
            return @{
                Message = 'No Authorization header found'
                Code = 401
            }
        }

        # ensure the first atom is basic (or opt override)
        $atoms = $header -isplit '\s+'
        if ($atoms[0] -ine $options.HeaderTag) {
            return @{
                Message = "Header is not $($options.HeaderTag) Authorization"
                Code = 400
            }
        }

        # decode the aut header
        try {
            $enc = [System.Text.Encoding]::GetEncoding($options.Encoding)
        }
        catch {
            return @{
                Message = 'Invalid encoding specified for Authorization'
                Code = 400
            }
        }

        try {
            $decoded = $enc.GetString([System.Convert]::FromBase64String($atoms[1]))
        }
        catch {
            return @{
                Message = 'Invalid Base64 string found in Authorization header'
                Code = 400
            }
        }

        # validate and return user/result
        $index = $decoded.IndexOf(':')
        $username = $decoded.Substring(0, $index)
        $password = $decoded.Substring($index + 1)

        # return data for calling validator
        return @($username, $password)
    }
}

function Get-PodeAuthFormType
{
    return {
        param($e, $options)

        # get user/pass keys to get from payload
        $userField = $options.Fields.Username
        $passField = $options.Fields.Password

        # get the user/pass
        $username = $e.Data.$userField
        $password = $e.Data.$passField

        # if either are empty, fail auth
        if ([string]::IsNullOrWhiteSpace($username) -or [string]::IsNullOrWhiteSpace($password)) {
            return @{
                Message = 'Username or Password not supplied'
                Code = 401
            }
        }

        # return data for calling validator
        return @($username, $password)
    }
}

function Get-PodeAuthInbuiltMethod
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateSet('WindowsAd')]
        [string]
        $Type
    )

    switch ($Type.ToLowerInvariant())
    {
        'windowsad' {
            $script = {
                param($username, $password, $options)

                # validate and retrieve the AD user
                $noGroups = $options.NoGroups
                $result = Get-PodeAuthADUser -Fqdn $options.Fqdn -Username $username -Password $password -NoGroups:$noGroups

                # if there's a message, fail and return the message
                if (!(Test-IsEmpty $result.Message)) {
                    return $result
                }

                # if there's no user, then, err, oops
                if (Test-IsEmpty $result.User) {
                    return @{ Message = 'An unexpected error occured' }
                }

                # if there are no groups/users supplied, return the user
                if ((Test-IsEmpty $options.Users) -and (Test-IsEmpty $options.Groups)){
                    return $result
                }

                # before checking supplied groups, is the user in the supplied list of authorised users?
                if (!(Test-IsEmpty $options.Users) -and (@($options.Users) -icontains $result.User.Username)) {
                    return $result
                }

                # if there are groups supplied, check the user is a member of one
                if (!(Test-IsEmpty $options.Groups)) {
                    foreach ($group in $options.Groups) {
                        if (@($result.User.Groups) -icontains $group) {
                            return $result
                        }
                    }
                }

                # else, they shall not pass!
                return @{ Message = 'You are not authorised to access this website' }
            }
        }
    }

    return $script
}

function Get-PodeAuthMiddlewareScript
{
    return {
        param($e, $opts)

        # route options for using sessions
        $storeInSession = !$opts.Sessionless
        $usingSessions = (!(Test-IsEmpty $e.Session))

        # check for logout command
        if ($opts.Logout) {
            Remove-PodeAuthSession -Event $e
            $opts.Failure.Url = (Protect-PodeValue -Value $opts.Failure.Url -Default $e.Request.Url.AbsolutePath)
            return (Set-PodeAuthStatus -StatusCode 302 -Options $opts)
        }

        # if the session already has a user/isAuth'd, then skip auth
        if ($usingSessions -and !(Test-IsEmpty $e.Session.Data.Auth.User) -and $e.Session.Data.Auth.IsAuthenticated) {
            $e.Auth = $e.Session.Data.Auth
            return (Set-PodeAuthStatus -Options $opts)
        }

        # check if the auto-login flag is set, in which case just return
        if ($opts.AutoLogin) {
            if (!(Test-IsEmpty $e.Session.Data.Auth)) {
                Remove-PodeSessionCookie -Session $e.Session
            }

            return $true
        }

        # get the auth method
        $auth = $PodeContext.Server.Authentications[$opts.Name]

        try {
            # run auth type script to parse request for data
            $result = (Invoke-PodeScriptBlock -ScriptBlock $auth.Type.ScriptBlock -Arguments (@($e) + @($auth.Type.Arguments)) -Return -Splat)

            # if data is a hashtable, then don't call validator (parser either failed, or forced a success)
            if ($result -isnot [hashtable]) {
                $result = (Invoke-PodeScriptBlock -ScriptBlock $auth.ScriptBlock -Arguments (@($result) + @($auth.Arguments)) -Return -Splat)
            }
        }
        catch {
            $_ | Write-PodeErrorLog
            return (Set-PodeAuthStatus -StatusCode 500 -Description $_.Exception.Message -Options $opts)
        }

        # if there is no result, return false (failed auth)
        if ((Test-IsEmpty $result) -or (Test-IsEmpty $result.User)) {
            $_code = (Protect-PodeValue -Value $result.Code -Default 401)

            if (![string]::IsNullOrWhiteSpace($auth.Type.Name) -and ($_code -eq 401)) {
                $_wwwAuth = $auth.Type.Name
                if (![string]::IsNullOrWhiteSpace($auth.Type.Realm)) {
                    $_wwwAuth += " realm=`"$($auth.Type.Realm)`""
                }

                Set-PodeHeader -Name 'WWW-Authenticate' -Value $_wwwAuth
            }

            return (Set-PodeAuthStatus `
                -StatusCode $_code `
                -Description $result.Message `
                -Options $opts)
        }

        # assign the user to the session, and wire up a quick method
        $e.Auth = @{}
        $e.Auth.User = $result.User
        $e.Auth.IsAuthenticated = $true
        $e.Auth.Store = $storeInSession

        # continue
        return (Set-PodeAuthStatus -Options $opts)
    }
}

function Remove-PodeAuthSession
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        $Event
    )

    # blank out the auth
    $Event.Auth = @{}

    # if a session auth is found, blank it
    if (!(Test-IsEmpty $Event.Session.Data.Auth)) {
        $Event.Session.Data.Remove('Auth')
    }

    # Delete the session (remove from store, blank it, and remove from Response)
    Remove-PodeSessionCookie -Session $Event.Session
}

function Set-PodeAuthStatus
{
    param (
        [Parameter()]
        [int]
        $StatusCode = 0,

        [Parameter()]
        [string]
        $Description,

        [Parameter()]
        [hashtable]
        $Options
    )

    # if a statuscode supplied, assume failure
    if ($StatusCode -gt 0)
    {
        # override description with the failureMessage if supplied
        $Description = (Protect-PodeValue -Value $Options.Failure.Message -Default $Description)

        # add error to flash if flagged
        if ($Options.Failure.FlashEnabled) {
            Add-PodeFlashMessage -Name 'auth-error' -Message $Description
        }

        # check if we have a failure url redirect
        if (![string]::IsNullOrWhiteSpace($Options.Failure.Url)) {
            Move-PodeResponseUrl -Url $Options.Failure.Url
        }
        else {
            Set-PodeResponseStatus -Code $StatusCode -Description $Description
        }

        return $false
    }

    # if no statuscode, success, so check if we have a success url redirect
    if (![string]::IsNullOrWhiteSpace($Options.Success.Url)) {
        Move-PodeResponseUrl -Url $Options.Success.Url
        return $false
    }

    return $true
}

function Get-PodeAuthADUser
{
    param (
        [Parameter()]
        [string]
        $Fqdn,

        [Parameter()]
        [string]
        $Username,

        [Parameter()]
        [string]
        $Password,

        [switch]
        $NoGroups
    )

    try
    {
        # setup the dns domain
        $Fqdn = Protect-PodeValue -Value $Fqdn -Default $env:USERDNSDOMAIN

        # validate the user's AD creds
        $ad = (New-Object System.DirectoryServices.DirectoryEntry "LDAP://$($Fqdn)", "$($Username)", "$($Password)")
        if (Test-IsEmpty $ad.distinguishedName) {
            return @{ Message = 'Invalid credentials supplied' }
        }

        # generate query to find user/groups
        $query = New-Object System.DirectoryServices.DirectorySearcher $ad
        $query.filter = "(&(objectCategory=person)(samaccountname=$($Username)))"

        $user = $query.FindOne().Properties
        if (Test-IsEmpty $user) {
            return @{ Message = 'User not found in Active Directory' }
        }

        # get the users groups
        $groups =@()
        if (!$NoGroups) {
            $groups = Get-PodeAuthADGroups -Query $query -CategoryName $Username -CategoryType 'person'
        }

        # return the user
        return @{
            User = @{
                Username = $Username
                Name = @($user.name)[0]
                Fqdn = $Fqdn
                Groups = $groups
            }
        }
    }
    finally {
        if (!(Test-IsEmpty $ad.distinguishedName)) {
            Close-PodeDisposable -Disposable $query
            Close-PodeDisposable -Disposable $ad -Close
        }
    }
}

function Get-PodeAuthADGroups
{
    param (
        [Parameter(Mandatory=$true)]
        [System.DirectoryServices.DirectorySearcher]
        $Query,

        [Parameter(Mandatory=$true)]
        [string]
        $CategoryName,

        [Parameter(Mandatory=$true)]
        [ValidateSet('group', 'person')]
        [string]
        $CategoryType,

        [Parameter()]
        [hashtable]
        $GroupsFound = $null
    )

    # setup found groups
    if ($null -eq $GroupsFound) {
        $GroupsFound = @{}
    }

    # get the groups for the category
    $Query.filter = "(&(objectCategory=$($CategoryType))(samaccountname=$($CategoryName)))"

    $groups = @{}
    foreach ($member in $Query.FindOne().Properties.memberof) {
        if ($member -imatch '^CN=(?<group>.+?),') {
            $g = $Matches['group']
            $groups[$g] = ($member -imatch '=builtin,')
        }
    }

    foreach ($group in $groups.Keys) {
        # don't bother if we've already looked up the group
        if ($GroupsFound.ContainsKey($group)) {
            continue
        }

        # add group to checked groups
        $GroupsFound[$group] = $true

        # don't bother if it's inbuilt
        if ($groups[$group]) {
            continue
        }

        # get the groups
        Get-PodeAuthADGroups -Query $Query -CategoryName $group -CategoryType 'group' -GroupsFound $GroupsFound
    }

    if ($CategoryType -ieq 'person') {
        return $GroupsFound.Keys
    }
}

1	function Get-PodeAuthBasicType
2	{
3	return {	×
4	param($e, $options)
5
6	# get the auth header
7	$header = (Get-PodeHeader -Name 'Authorization')	×
8	if ($null -eq $header) {	×
9	return @{	×
10	Message = 'No Authorization header found'	×
11	Code = 401	×
12	}
13	}
14
15	# ensure the first atom is basic (or opt override)
16	$atoms = $header -isplit '\s+'	×
17	if ($atoms[0] -ine $options.HeaderTag) {	×
18	return @{	×
19	Message = "Header is not $($options.HeaderTag) Authorization"	×
20	Code = 400	×
21	}
22	}
23
24	# decode the aut header
25	try {
26	$enc = [System.Text.Encoding]::GetEncoding($options.Encoding)	×
27	}
28	catch {
29	return @{	×
30	Message = 'Invalid encoding specified for Authorization'	×
31	Code = 400	×
32	}
33	}
34
35	try {
36	$decoded = $enc.GetString([System.Convert]::FromBase64String($atoms[1]))	×
37	}
38	catch {
39	return @{	×
40	Message = 'Invalid Base64 string found in Authorization header'	×
41	Code = 400	×
42	}
43	}
44
45	# validate and return user/result
46	$index = $decoded.IndexOf(':')	×
47	$username = $decoded.Substring(0, $index)	×
48	$password = $decoded.Substring($index + 1)	×
49
50	# return data for calling validator
51	return @($username, $password)	×
52	}
53	}
54
55	function Get-PodeAuthFormType
56	{
57	return {	×
58	param($e, $options)
59
60	# get user/pass keys to get from payload
61	$userField = $options.Fields.Username	×
62	$passField = $options.Fields.Password	×
63
64	# get the user/pass
65	$username = $e.Data.$userField	×
66	$password = $e.Data.$passField	×
67
68	# if either are empty, fail auth
69	if ([string]::IsNullOrWhiteSpace($username) -or [string]::IsNullOrWhiteSpace($password)) {	×
70	return @{	×
71	Message = 'Username or Password not supplied'	×
72	Code = 401	×
73	}
74	}
75
76	# return data for calling validator
77	return @($username, $password)	×
78	}
79	}
80
81	function Get-PodeAuthInbuiltMethod
82	{
83	param (
84	[Parameter(Mandatory=$true)]
85	[ValidateSet('WindowsAd')]
86	[string]
87	$Type
88	)
89
90	switch ($Type.ToLowerInvariant())	2✔
91	{
92	'windowsad' {
93	$script = {	×
94	param($username, $password, $options)
95
96	# validate and retrieve the AD user
97	$noGroups = $options.NoGroups	×
98	$result = Get-PodeAuthADUser -Fqdn $options.Fqdn -Username $username -Password $password -NoGroups:$noGroups	×
99
100	# if there's a message, fail and return the message
101	if (!(Test-IsEmpty $result.Message)) {	×
102	return $result	×
103	}
104
105	# if there's no user, then, err, oops
106	if (Test-IsEmpty $result.User) {	×
107	return @{ Message = 'An unexpected error occured' }	×
108	}
109
110	# if there are no groups/users supplied, return the user
111	if ((Test-IsEmpty $options.Users) -and (Test-IsEmpty $options.Groups)){	×
112	return $result	×
113	}
114
115	# before checking supplied groups, is the user in the supplied list of authorised users?
116	if (!(Test-IsEmpty $options.Users) -and (@($options.Users) -icontains $result.User.Username)) {	×
117	return $result	×
118	}
119
120	# if there are groups supplied, check the user is a member of one
121	if (!(Test-IsEmpty $options.Groups)) {	×
122	foreach ($group in $options.Groups) {	×
123	if (@($result.User.Groups) -icontains $group) {	×
124	return $result	×
125	}
126	}
127	}
128
129	# else, they shall not pass!
130	return @{ Message = 'You are not authorised to access this website' }	×
131	}
132	}
133	}
134
135	return $script	2✔
136	}
137
138	function Get-PodeAuthMiddlewareScript
139	{
140	return {	×
141	param($e, $opts)
142
143	# route options for using sessions
144	$storeInSession = !$opts.Sessionless	×
145	$usingSessions = (!(Test-IsEmpty $e.Session))	×
146
147	# check for logout command
148	if ($opts.Logout) {	×
149	Remove-PodeAuthSession -Event $e	×
150	$opts.Failure.Url = (Protect-PodeValue -Value $opts.Failure.Url -Default $e.Request.Url.AbsolutePath)	×
151	return (Set-PodeAuthStatus -StatusCode 302 -Options $opts)	×
152	}
153
154	# if the session already has a user/isAuth'd, then skip auth
155	if ($usingSessions -and !(Test-IsEmpty $e.Session.Data.Auth.User) -and $e.Session.Data.Auth.IsAuthenticated) {	×
156	$e.Auth = $e.Session.Data.Auth	×
157	return (Set-PodeAuthStatus -Options $opts)	×
158	}
159
160	# check if the auto-login flag is set, in which case just return
161	if ($opts.AutoLogin) {	×
162	if (!(Test-IsEmpty $e.Session.Data.Auth)) {	×
163	Remove-PodeSessionCookie -Session $e.Session	×
164	}
165
166	return $true	×
167	}
168
169	# get the auth method
170	$auth = $PodeContext.Server.Authentications[$opts.Name]	×
171
172	try {
173	# run auth type script to parse request for data
174	$result = (Invoke-PodeScriptBlock -ScriptBlock $auth.Type.ScriptBlock -Arguments (@($e) + @($auth.Type.Arguments)) -Return -Splat)	×
175
176	# if data is a hashtable, then don't call validator (parser either failed, or forced a success)
177	if ($result -isnot [hashtable]) {	×
178	$result = (Invoke-PodeScriptBlock -ScriptBlock $auth.ScriptBlock -Arguments (@($result) + @($auth.Arguments)) -Return -Splat)	×
179	}
180	}
181	catch {
182	$_ \| Write-PodeErrorLog	×
183	return (Set-PodeAuthStatus -StatusCode 500 -Description $_.Exception.Message -Options $opts)	×
184	}
185
186	# if there is no result, return false (failed auth)
187	if ((Test-IsEmpty $result) -or (Test-IsEmpty $result.User)) {	×
188	$_code = (Protect-PodeValue -Value $result.Code -Default 401)	×
189
190	if (![string]::IsNullOrWhiteSpace($auth.Type.Name) -and ($_code -eq 401)) {	×
191	$_wwwAuth = $auth.Type.Name	×
192	if (![string]::IsNullOrWhiteSpace($auth.Type.Realm)) {	×
193	$_wwwAuth += " realm=`"$($auth.Type.Realm)`""	×
194	}
195
196	Set-PodeHeader -Name 'WWW-Authenticate' -Value $_wwwAuth	×
197	}
198
199	return (Set-PodeAuthStatus `	×
200	-StatusCode $_code `
201	-Description $result.Message `
202	-Options $opts)
203	}
204
205	# assign the user to the session, and wire up a quick method
206	$e.Auth = @{}	×
207	$e.Auth.User = $result.User	×
208	$e.Auth.IsAuthenticated = $true	×
209	$e.Auth.Store = $storeInSession	×
210
211	# continue
212	return (Set-PodeAuthStatus -Options $opts)	×
213	}
214	}
215
216	function Remove-PodeAuthSession
217	{
218	param (
219	[Parameter(Mandatory=$true)]
220	[ValidateNotNull()]
221	$Event
222	)
223
224	# blank out the auth
225	$Event.Auth = @{}	2✔
226
227	# if a session auth is found, blank it
228	if (!(Test-IsEmpty $Event.Session.Data.Auth)) {	4✔
229	$Event.Session.Data.Remove('Auth')	2✔
230	}
231
232	# Delete the session (remove from store, blank it, and remove from Response)
233	Remove-PodeSessionCookie -Session $Event.Session	2✔
234	}
235
236	function Set-PodeAuthStatus
237	{
238	param (
239	[Parameter()]
240	[int]
241	$StatusCode = 0,
242
243	[Parameter()]
244	[string]
245	$Description,
246
247	[Parameter()]
248	[hashtable]
249	$Options
250	)
251
252	# if a statuscode supplied, assume failure
253	if ($StatusCode -gt 0)	2✔
254	{
255	# override description with the failureMessage if supplied
256	$Description = (Protect-PodeValue -Value $Options.Failure.Message -Default $Description)	4✔
257
258	# add error to flash if flagged
259	if ($Options.Failure.FlashEnabled) {	2✔
260	Add-PodeFlashMessage -Name 'auth-error' -Message $Description	×
261	}
262
263	# check if we have a failure url redirect
264	if (![string]::IsNullOrWhiteSpace($Options.Failure.Url)) {	2✔
265	Move-PodeResponseUrl -Url $Options.Failure.Url	2✔
266	}
267	else {
268	Set-PodeResponseStatus -Code $StatusCode -Description $Description	2✔
269	}
270
271	return $false	2✔
272	}
273
274	# if no statuscode, success, so check if we have a success url redirect
275	if (![string]::IsNullOrWhiteSpace($Options.Success.Url)) {	2✔
276	Move-PodeResponseUrl -Url $Options.Success.Url	2✔
277	return $false	2✔
278	}
279
280	return $true	2✔
281	}
282
283	function Get-PodeAuthADUser
284	{
285	param (
286	[Parameter()]
287	[string]
288	$Fqdn,
289
290	[Parameter()]
291	[string]
292	$Username,
293
294	[Parameter()]
295	[string]
296	$Password,
297
298	[switch]
299	$NoGroups
300	)
301
302	try
303	{
304	# setup the dns domain
305	$Fqdn = Protect-PodeValue -Value $Fqdn -Default $env:USERDNSDOMAIN	×
306
307	# validate the user's AD creds
308	$ad = (New-Object System.DirectoryServices.DirectoryEntry "LDAP://$($Fqdn)", "$($Username)", "$($Password)")	×
309	if (Test-IsEmpty $ad.distinguishedName) {	×
310	return @{ Message = 'Invalid credentials supplied' }	×
311	}
312
313	# generate query to find user/groups
314	$query = New-Object System.DirectoryServices.DirectorySearcher $ad	×
315	$query.filter = "(&(objectCategory=person)(samaccountname=$($Username)))"	×
316
317	$user = $query.FindOne().Properties	×
318	if (Test-IsEmpty $user) {	×
319	return @{ Message = 'User not found in Active Directory' }	×
320	}
321
322	# get the users groups
323	$groups =@()	×
324	if (!$NoGroups) {	×
325	$groups = Get-PodeAuthADGroups -Query $query -CategoryName $Username -CategoryType 'person'	×
326	}
327
328	# return the user
329	return @{	×
330	User = @{	×
331	Username = $Username	×
332	Name = @($user.name)[0]	×
333	Fqdn = $Fqdn	×
334	Groups = $groups	×
335	}
336	}
337	}
338	finally {
339	if (!(Test-IsEmpty $ad.distinguishedName)) {	×
340	Close-PodeDisposable -Disposable $query	×
341	Close-PodeDisposable -Disposable $ad -Close	×
342	}
343	}
344	}
345
346	function Get-PodeAuthADGroups
347	{
348	param (
349	[Parameter(Mandatory=$true)]
350	[System.DirectoryServices.DirectorySearcher]
351	$Query,
352
353	[Parameter(Mandatory=$true)]
354	[string]
355	$CategoryName,
356
357	[Parameter(Mandatory=$true)]
358	[ValidateSet('group', 'person')]
359	[string]
360	$CategoryType,
361
362	[Parameter()]
363	[hashtable]
364	$GroupsFound = $null
365	)
366
367	# setup found groups
368	if ($null -eq $GroupsFound) {	×
369	$GroupsFound = @{}	×
370	}
371
372	# get the groups for the category
373	$Query.filter = "(&(objectCategory=$($CategoryType))(samaccountname=$($CategoryName)))"	×
374
375	$groups = @{}	×
376	foreach ($member in $Query.FindOne().Properties.memberof) {	×
377	if ($member -imatch '^CN=(?<group>.+?),') {	×
378	$g = $Matches['group']	×
379	$groups[$g] = ($member -imatch '=builtin,')	×
380	}
381	}
382
383	foreach ($group in $groups.Keys) {	×
384	# don't bother if we've already looked up the group
385	if ($GroupsFound.ContainsKey($group)) {	×
386	continue
387	}
388
389	# add group to checked groups
390	$GroupsFound[$group] = $true	×
391
392	# don't bother if it's inbuilt
393	if ($groups[$group]) {	×
394	continue
395	}
396
397	# get the groups
398	Get-PodeAuthADGroups -Query $Query -CategoryName $group -CategoryType 'group' -GroupsFound $GroupsFound	×
399	}
400
401	if ($CategoryType -ieq 'person') {	×
402	return $GroupsFound.Keys	×
403	}
404	}

Badgerati / Pode / #494

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous