806939307

Build Type

github

Committed by GitHub

Commit Message

Merge 77ab12005 into 298d82503

Pull Request Pull Request #347: Add support for JWT-based Authentication

Run Details

453 of 716 branches covered (63.27%)

Branch coverage included in aggregate %.

43 of 44 new or added lines in 3 files covered. (97.73%)

30 existing lines in 2 files now uncovered.

913 of 1222 relevant lines covered (74.71%)

16.86 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

91.49

/quirrel/src/api/scheduler/token-auth.ts

import {
  FastifyPluginCallback,
  FastifyReply,
  FastifyRequest,
  preValidationHookHandler,
} from "fastify";
import fp from "fastify-plugin";
import { IncomingMessage, IncomingHttpHeaders } from "http";
import { UsageMeter } from "../shared/usage-meter";
import basicAuth from "basic-auth";
import jwt from "jsonwebtoken";

interface TokenAuthService {
  authenticate(
    request: FastifyRequest | IncomingMessage
  ): Promise<string | null>;
}

declare module "fastify" {
  interface FastifyInstance {
    tokenAuth: TokenAuthService;
    tokenAuthPreValidation: preValidationHookHandler;
  }

  interface FastifyRequest {
    tokenId: string;
  }
}

interface TokenAuthPluginOpts {
  enable: boolean;
  passphrases: string[];
  jwtPublicKey?: string;
}

const tokenAuthServicePlugin: FastifyPluginCallback<TokenAuthPluginOpts> = (
  fastify,
  opts,
  done
) => {
  fastify.decorateRequest("tokenId", null);
  fastify.decorate(
    "tokenAuthPreValidation",
    async (request: FastifyRequest, reply: FastifyReply) => {
      const tokenId = await fastify.tokenAuth.authenticate(request);

      if (tokenId === null) {
        reply.status(401).send("Unauthenticated");
      } else {
        request.tokenId = tokenId;
      }
    }
  );

  function decorateTokenAuth(service: TokenAuthService) {
    fastify.decorate("tokenAuth", service);
  }

  if (!opts.enable) {
    decorateTokenAuth({
      async authenticate() {
        return "anonymous";
      },
    });

    return done();
  }

  async function checkJwt(
    token: string
  ): Promise<["not_a_jwt"] | ["success", string] | ["invalid"]> {
    const { jwtPublicKey } = opts;
    if (!jwtPublicKey) {
      return ["not_a_jwt"];
    }

    return await new Promise<["not_a_jwt"] | ["success", string] | ["invalid"]>(
      (resolve) => {
        jwt.verify(token, jwtPublicKey, (err, result) => {
          if (err) {
            return resolve(["invalid"]);
          }

          const { sub } = result as { sub?: string };
          if (sub) {
            resolve(["success", sub]);
          } else {
            resolve(["invalid"]);
          }
        });
      }
    );
  }

  async function getTokenID(headers: IncomingHttpHeaders) {
    const { authorization } = headers;
    if (!authorization) {
      return null;
    }

    if (authorization.startsWith("Bearer ")) {
      const [_, token] = authorization.split("Bearer ");
      const [result, jwtTokenId] = await checkJwt(token);
      switch (result) {
        case "not_a_jwt":
          break;
        case "invalid":
          return null;
        case "success":
          return { tokenId: jwtTokenId!, countUsage: true };
      }

      const redisTokenId = await fastify.tokens?.check(token);
      if (redisTokenId) {
        return { tokenId: redisTokenId, countUsage: true };
      }

      return null;
    } else if (authorization.startsWith("Basic ")) {
      const basicCredentials = basicAuth.parse(authorization);

      if (!basicCredentials) {
        return null;
      }

      const isRootUser = opts.passphrases.includes(basicCredentials.pass);
      if (isRootUser) {
        const countUsage = !!headers["x-quirrel-count-usage"];
        return { tokenId: basicCredentials.name, countUsage };
      }
    }

    return null;
  }

  const usageMeter = new UsageMeter(fastify.redis);

  decorateTokenAuth({
    async authenticate(request) {
      const result = await getTokenID(request.headers);
      if (!result) {
        return null;
      }

      const { tokenId, countUsage } = result;

      if (countUsage) {
        usageMeter.record(tokenId);
      }

      return tokenId;
    },
  });

  return done();
};

export default (fp as any)(
  tokenAuthServicePlugin
) as FastifyPluginCallback<TokenAuthPluginOpts>;

1	import {
2	FastifyPluginCallback,
3	FastifyReply,
4	FastifyRequest,
5	preValidationHookHandler,
6	} from "fastify";
7	import fp from "fastify-plugin";	14✔
8	import { IncomingMessage, IncomingHttpHeaders } from "http";
9	import { UsageMeter } from "../shared/usage-meter";	14✔
10	import basicAuth from "basic-auth";	14✔
11	import jwt from "jsonwebtoken";	14✔
12
13	interface TokenAuthService {
14	authenticate(
15	request: FastifyRequest \| IncomingMessage
16	): Promise<string \| null>;
17	}
18
19	declare module "fastify" {
20	interface FastifyInstance {
21	tokenAuth: TokenAuthService;
22	tokenAuthPreValidation: preValidationHookHandler;
23	}
24
25	interface FastifyRequest {
26	tokenId: string;
27	}
28	}
29
30	interface TokenAuthPluginOpts {
31	enable: boolean;
32	passphrases: string[];
33	jwtPublicKey?: string;
34	}
35
36	const tokenAuthServicePlugin: FastifyPluginCallback<TokenAuthPluginOpts> = (	14✔
37	fastify,
38	opts,
39	done
40	) => {
41	fastify.decorateRequest("tokenId", null);	25✔
42	fastify.decorate(	25✔
43	"tokenAuthPreValidation",
44	async (request: FastifyRequest, reply: FastifyReply) => {
45	const tokenId = await fastify.tokenAuth.authenticate(request);	117✔
46
47	if (tokenId === null) {	117✔
48	reply.status(401).send("Unauthenticated");	5✔
49	} else {
50	request.tokenId = tokenId;	112✔
51	}
52	}
53	);
54
55	function decorateTokenAuth(service: TokenAuthService) {
56	fastify.decorate("tokenAuth", service);	25✔
57	}
58
59	if (!opts.enable) {	25✔
60	decorateTokenAuth({	22✔
61	async authenticate() {
62	return "anonymous";	107✔
63	},
64	});
65
66	return done();	22✔
67	}
68
69	async function checkJwt(
70	token: string
71	): Promise<["not_a_jwt"] \| ["success", string] \| ["invalid"]> {
72	const { jwtPublicKey } = opts;	6✔
73	if (!jwtPublicKey) {	6✔
74	return ["not_a_jwt"];	4✔
75	}
76
77	return await new Promise<["not_a_jwt"] \| ["success", string] \| ["invalid"]>(	2✔
78	(resolve) => {
79	jwt.verify(token, jwtPublicKey, (err, result) => {	2✔
80	if (err) {	2✔
81	return resolve(["invalid"]);	1✔
82	}
83
84	const { sub } = result as { sub?: string };	1✔
85	if (sub) {	1!
86	resolve(["success", sub]);	1✔
87	} else {
NEW 88	resolve(["invalid"]);	×
89	}
90	});
91	}
92	);
93	}
94
95	async function getTokenID(headers: IncomingHttpHeaders) {
96	const { authorization } = headers;	12✔
97	if (!authorization) {	12✔
98	return null;	2✔
99	}
100
101	if (authorization.startsWith("Bearer ")) {	10✔
102	const [_, token] = authorization.split("Bearer ");	6✔
103	const [result, jwtTokenId] = await checkJwt(token);	6✔
104	switch (result) {	6✔
105	case "not_a_jwt":	6✔
106	break;	4✔
107	case "invalid":
108	return null;	1✔
109	case "success":
110	return { tokenId: jwtTokenId!, countUsage: true };	1✔
111	}
112
113	const redisTokenId = await fastify.tokens?.check(token);	4!
114	if (redisTokenId) {	4✔
115	return { tokenId: redisTokenId, countUsage: true };	2✔
116	}
117
118	return null;	2✔
119	} else if (authorization.startsWith("Basic ")) {	4!
120	const basicCredentials = basicAuth.parse(authorization);	4✔
121
122	if (!basicCredentials) {	4!
123	return null;	×
124	}
125
126	const isRootUser = opts.passphrases.includes(basicCredentials.pass);	4✔
127	if (isRootUser) {	4!
128	const countUsage = !!headers["x-quirrel-count-usage"];	4✔
129	return { tokenId: basicCredentials.name, countUsage };	4✔
130	}
131	}
132
133	return null;	×
134	}
135
136	const usageMeter = new UsageMeter(fastify.redis);	3✔
137
138	decorateTokenAuth({	3✔
139	async authenticate(request) {
140	const result = await getTokenID(request.headers);	12✔
141	if (!result) {	12✔
142	return null;	5✔
143	}
144
145	const { tokenId, countUsage } = result;	7✔
146
147	if (countUsage) {	7✔
148	usageMeter.record(tokenId);	5✔
149	}
150
151	return tokenId;	7✔
152	},
153	});
154
155	return done();	3✔
156	};
157
158	export default (fp as any)(	14✔
159	tokenAuthServicePlugin
160	) as FastifyPluginCallback<TokenAuthPluginOpts>;

quirrel-dev / quirrel / 806939307

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous