#252645665

Committed 15 Nov 2023 10:20PM UTC coverage: 71.162% (-1.1%) from 72.267%

Build Type

Committed by

Commit Message

still 7 issues, reverting to previous testing fork solution

Pull Request Pull Request #456: staging version 1.9.2491

Run Details

1759 of 3422 branches covered (0.0%)

Branch coverage included in aggregate %.

126 of 258 new or added lines in 18 files covered. (48.84%)

45 existing lines in 11 files now uncovered.

8097 of 10428 relevant lines covered (77.65%)

27.51 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

30.81

/lib/router.github.js

// /api/v2/oauth/github

let RSAKey = require("../lib/thinx/rsakey.js");
let rsakey = new RSAKey();
let GitHub = require("../lib/thinx/github.js");

let envi = require("../_envi.json");
let owner = envi.oid;

const Globals = require("./thinx/globals");
const prefix = Globals.prefix();
const Database = require("../lib/thinx/database.js");
let db_uri = new Database().uri();
let userlib = require("nano")(db_uri).use(prefix + "managed_users"); // lgtm [js/unused-local-variable]

const github_ocfg = Globals.github_ocfg();
const https = require('https');
const sha256 = require("sha256");
const url = require('url');

const app_config = Globals.app_config();

let AuditLog = require("../lib/thinx/audit"); let alog = new AuditLog();

const Util = require("./thinx/util");

//
// OAuth2 for GitHub
//

module.exports = function (app) {

    /*
    * OAuth 2 with GitHub
    */

    let user = app.owner;

    let githubOAuth;

    if (typeof (process.env.GITHUB_CLIENT_SECRET) !== "undefined" && process.env.GITHUB_CLIENT_SECRET !== null) {
        try {
            let specs = {
                githubClient: process.env.GITHUB_CLIENT_ID,
                githubSecret: process.env.GITHUB_CLIENT_SECRET,
                baseURL: github_ocfg.base_url, // should be rather gotten from global config!
                loginURI: '/api/oauth/github',
                callbackURI: '/api/oauth/github/callback',
                scope: 'user'
            };
            githubOAuth = require('./thinx/oauth-github.js')(specs);
        } catch (e) {
            console.log(`[debug] [oauth] [github] github_ocfg init error: ${e}`);
        }
    }

    function validateGithubUser(response, token, userWrapper) {

        let owner_id = userWrapper.owner; // must not be nil

        // Check user and make note on user login
        userlib.get(owner_id, (error, udoc) => {

            // Error case covers creating new user/managing deleted account
            if (error) {

                if (error.toString().indexOf("Error: deleted") !== -1) {
                    console.log("🔨 [debug] [oauth] [check] user document deleted");
                    response.redirect(
                        app_config.public_url + '/error.html?success=failed&title=Sorry&reason=' +
                        encodeURI('Account document deleted.')
                    );
                    return;
                }

                // May exist, but be deleted. Can be cleared using Filtered Replication Handler "del"
                if (typeof (udoc) !== "undefined" && udoc !== null) {
                    if ((typeof (udoc.deleted) !== "undefined") && udoc.deleted === true) {
                        console.log("🔨 [debug] [oauth] [check] user account marked as deleted");
                        response.redirect(
                            app_config.public_url + '/error.html?success=failed&title=Sorry&reason=' +
                            encodeURI('Account deleted.')
                        );
                        return;
                    }
                } else {
                    console.log("No such owner, should create one...");
                }

                // No such owner, create without activation.
                this.user.create(userWrapper, false, response, (/* res, success, status*/) => {

                    console.log("[OID:" + owner_id + "] [NEW_SESSION] [oauth] 2485:");

                    alog.log(owner_id, "OAuth User created. ");

                    app.redis_client.v4.set(token, JSON.stringify(userWrapper));
                    app.redis_client.v4.expire(token, 30);

                    const courl = app_config.public_url + "/auth.html?t=" + token + "&g=true"; // require GDPR consent

                    response.redirect(courl); // for successful login, this must be a response to /oauth/<idp>/callback 
                });
                return;
            }

            user.trackUserLogin(owner_id);

            app.redis_client.v4.set(token, JSON.stringify(userWrapper));
            app.redis_client.v4.expire(token, 3600);

            let gdpr = false;
            if (typeof (udoc) !== "undefined" && udoc !== null) {
                if (typeof (udoc.info) !== "undefined") {
                    if (typeof (udoc.gdpr_consent) !== "undefined" && udoc.gdpr_consent === true) {
                        gdpr = true;
                    }
                }
            }

            const ourl = app_config.public_url + "/auth.html?t=" + token + "&g=" + gdpr; // require GDPR consent
            response.redirect(ourl);
        }); // userlib.get
    }

    function githubLogin(access_token, hdata, res, original_response) {
        let token = "ghat:" + access_token;
        let owner_id, given_name, family_name, email;
    
        if ((typeof (hdata.name) !== "undefined") && hdata.name !== null) {
            let in_name_array = hdata.name.split(" ");
            given_name = in_name_array[0];
            family_name = in_name_array[in_name_array.count - 1];
        } else {
            family_name = hdata.login;
            given_name = hdata.login;
            console.log("🔨 [debug] [github] [token] Warning: no name in GitHub access token response, using login: ", { hdata }); // logs personal data in case the user has no name!
        }
        email = hdata.email || hdata.login;
    
        try {
            owner_id = sha256(prefix + email);
        } catch (e) {
            console.log("☣️ [error] [github] [token] error parsing e-mail: " + e + " email: " + email);
            return res.redirect(app_config.public_url + '/error.html?success=failed&title=Sorry&reason=Missing%20e-mail.');
        }
        validateGithubUser(original_response, token, {
            first_name: given_name,
            last_name: family_name,
            email: email,
            owner: owner_id,
            username: owner_id
        });
    }

    function secureGithubCallbacks(original_response, callback) {

        if (typeof (githubOAuth) === "undefined") {
            console.log("[critical] [githubOAuth] undefined on secure! attempting to fix...");

            try {
                let specs = {
                    githubClient: process.env.GITHUB_CLIENT_ID,
                    githubSecret: process.env.GITHUB_CLIENT_SECRET,
                    baseURL: github_ocfg.base_url, // should be rather gotten from global config!
                    loginURI: '/api/oauth/github',
                    callbackURI: '/api/oauth/github/callback',
                    scope: 'user'
                };
                githubOAuth = require('./thinx/oauth-github.js')(specs);

            } catch (e) {
                console.log(`[debug] [oauth] [github] github_ocfg init error: ${e}`);
            }
        }

        // configure callbacks for Emitter events

        githubOAuth.on('error', (err) => {
            console.error('[debug] [oauth] [github] there was a login error', err);
            if (process.env.ENVIRONMENT == "test")
                if (typeof (original_response) !== "undefined") original_response.end("test-ok");
        });

        githubOAuth.on('token', (access_token, /* resp, _res, req */) => {

            if (!Util.isDefined(access_token)) {
                original_response.status(401).end();
                console.log("[github] oauth_response missing (test or intrusion)");
                return;
            }

            if ((!access_token) || (access_token.indexOf("bad_verification") !== -1)) {
                console.log("🔨 [debug] [github] [token] No token, exiting.");
                original_response.status(401).end();
                return;
            }

            const requestOptions = {
                host: 'api.github.com',
                port: 443,
                path: '/user',
                headers: {
                    'User-Agent': 'THiNX', // Application name from GitHub / Settings / Developer Settings 
                    'Authorization': 'token ' + access_token, 
                    'Accept': 'application/vnd.github+json' 
                } 
            };

            https.get(requestOptions, (res) => {
                let data = '';
                res.on('data', (chunk) => {
                    data += chunk;
                });
                res.on('end', () => {
                    githubLogin(access_token, JSON.parse(data), res, original_response);
                });
            });
        });

        callback(); // async completes the secureGithubCallbacks()
    }

    // Initial page redirecting to OAuth2 provider
    app.get('/api/oauth/github', function (req, res) {
        if (typeof (req.session) !== "undefined") {
            console.log("🔨 [debug] GET /api/oauth/github will destroy old session...");
            req.session.destroy();
        }
        if (typeof (githubOAuth) !== "undefined") {
            console.log("🔨 [debug] GET /api/oauth/github calling githubOAuth.login");
            githubOAuth.login(req, res);
        } else {
            res.status(400).end();
        }
    });

    // Callback service parsing the authorization token and asking for the access token
    // Allow-limits: This endpoint should be called by GitHub/Browser only.

    // This is called redirect_uri in config, callbackURI in github-oauth.js params (spec)
    app.get('/api/oauth/github/callback', function (req, original_response) {
        var query = url.parse(req.url, true).query;
        var code = query.code;
        var state = query.state;

        console.log("🔨 [debug] GET /api/oauth/github/callback query state is:", {state});
        //if (!code || code.length < 4) {

        // save original response to callbacks in this code path... when callback is called, response is used to reply (except for error)
        secureGithubCallbacks(original_response, () => {
            githubOAuth.callback(code, state, original_response, (err) => {
                console.log("[spec] GitHub OAuth result", err);
            });
        });
    });

    app.post('/api/github/token', (req, res) => {
        let token = req.body.token;
        rsakey.list(owner, (success, list) => {
            console.log("RSAKey list success:", success);
            if (list.length == 0) return console.log("No RSA Keys to add from", list);
            let key = list[0];
            let pubkey = key.pubkey;
            console.log("GitHub adding pub key:", pubkey);
            GitHub.addPublicKey(token, pubkey, (result) => {
                res.status(200).end(result);
            });
        });
    });
};

1	// /api/v2/oauth/github
2
3	let RSAKey = require("../lib/thinx/rsakey.js");	1✔
4	let rsakey = new RSAKey();	1✔
5	let GitHub = require("../lib/thinx/github.js");	1✔
6
7	let envi = require("../_envi.json");	1✔
8	let owner = envi.oid;	1✔
9
10	const Globals = require("./thinx/globals");	1✔
11	const prefix = Globals.prefix();	1✔
12	const Database = require("../lib/thinx/database.js");	1✔
13	let db_uri = new Database().uri();	1✔
14	let userlib = require("nano")(db_uri).use(prefix + "managed_users"); // lgtm [js/unused-local-variable]	1✔
15
16	const github_ocfg = Globals.github_ocfg();	1✔
17	const https = require('https');	1✔
18	const sha256 = require("sha256");	1✔
19	const url = require('url');	1✔
20
21	const app_config = Globals.app_config();	1✔
22
23	let AuditLog = require("../lib/thinx/audit"); let alog = new AuditLog();	1✔
24
25	const Util = require("./thinx/util");	1✔
26
27	//
28	// OAuth2 for GitHub
29	//
30
31	module.exports = function (app) {	1✔
32
33	/*
34	* OAuth 2 with GitHub
35	*/
36
37	let user = app.owner;	15✔
38
39	let githubOAuth;
40
41	if (typeof (process.env.GITHUB_CLIENT_SECRET) !== "undefined" && process.env.GITHUB_CLIENT_SECRET !== null) {	15!
42	try {	15✔
43	let specs = {	15✔
44	githubClient: process.env.GITHUB_CLIENT_ID,
45	githubSecret: process.env.GITHUB_CLIENT_SECRET,
46	baseURL: github_ocfg.base_url, // should be rather gotten from global config!
47	loginURI: '/api/oauth/github',
48	callbackURI: '/api/oauth/github/callback',
49	scope: 'user'
50	};
51	githubOAuth = require('./thinx/oauth-github.js')(specs);	15✔
52	} catch (e) {
53	console.log(`[debug] [oauth] [github] github_ocfg init error: ${e}`);	×
54	}
55	}
56
57	function validateGithubUser(response, token, userWrapper) {
58
59	let owner_id = userWrapper.owner; // must not be nil	×
60
61	// Check user and make note on user login
NEW 62	userlib.get(owner_id, (error, udoc) => {	×
63
64	// Error case covers creating new user/managing deleted account
65	if (error) {	×
66
67	if (error.toString().indexOf("Error: deleted") !== -1) {	×
68	console.log("🔨 [debug] [oauth] [check] user document deleted");	×
69	response.redirect(	×
70	app_config.public_url + '/error.html?success=failed&title=Sorry&reason=' +
71	encodeURI('Account document deleted.')
72	);
73	return;	×
74	}
75
76	// May exist, but be deleted. Can be cleared using Filtered Replication Handler "del"
77	if (typeof (udoc) !== "undefined" && udoc !== null) {	×
78	if ((typeof (udoc.deleted) !== "undefined") && udoc.deleted === true) {	×
79	console.log("🔨 [debug] [oauth] [check] user account marked as deleted");	×
80	response.redirect(	×
81	app_config.public_url + '/error.html?success=failed&title=Sorry&reason=' +
82	encodeURI('Account deleted.')
83	);
84	return;	×
85	}
86	} else {
87	console.log("No such owner, should create one...");	×
88	}
89
90	// No such owner, create without activation.
91	this.user.create(userWrapper, false, response, (/* res, success, status*/) => {	×
92
93	console.log("[OID:" + owner_id + "] [NEW_SESSION] [oauth] 2485:");	×
94
95	alog.log(owner_id, "OAuth User created. ");	×
96
97	app.redis_client.v4.set(token, JSON.stringify(userWrapper));	×
98	app.redis_client.v4.expire(token, 30);	×
99
100	const courl = app_config.public_url + "/auth.html?t=" + token + "&g=true"; // require GDPR consent	×
101
102	response.redirect(courl); // for successful login, this must be a response to /oauth/<idp>/callback	×
103	});
104	return;	×
105	}
106
107	user.trackUserLogin(owner_id);	×
108
109	app.redis_client.v4.set(token, JSON.stringify(userWrapper));	×
110	app.redis_client.v4.expire(token, 3600);	×
111
112	let gdpr = false;	×
113	if (typeof (udoc) !== "undefined" && udoc !== null) {	×
114	if (typeof (udoc.info) !== "undefined") {	×
115	if (typeof (udoc.gdpr_consent) !== "undefined" && udoc.gdpr_consent === true) {	×
116	gdpr = true;	×
117	}
118	}
119	}
120
121	const ourl = app_config.public_url + "/auth.html?t=" + token + "&g=" + gdpr; // require GDPR consent	×
122	response.redirect(ourl);	×
123	}); // userlib.get
124	}
125
126	function githubLogin(access_token, hdata, res, original_response) {
127	let token = "ghat:" + access_token;	×
128	let owner_id, given_name, family_name, email;
129
130	if ((typeof (hdata.name) !== "undefined") && hdata.name !== null) {	×
131	let in_name_array = hdata.name.split(" ");	×
132	given_name = in_name_array[0];	×
133	family_name = in_name_array[in_name_array.count - 1];	×
134	} else {
135	family_name = hdata.login;	×
136	given_name = hdata.login;	×
137	console.log("🔨 [debug] [github] [token] Warning: no name in GitHub access token response, using login: ", { hdata }); // logs personal data in case the user has no name!	×
138	}
139	email = hdata.email \|\| hdata.login;	×
140
141	try {	×
142	owner_id = sha256(prefix + email);	×
143	} catch (e) {
144	console.log("☣️ [error] [github] [token] error parsing e-mail: " + e + " email: " + email);	×
145	return res.redirect(app_config.public_url + '/error.html?success=failed&title=Sorry&reason=Missing%20e-mail.');	×
146	}
147	validateGithubUser(original_response, token, {	×
148	first_name: given_name,
149	last_name: family_name,
150	email: email,
151	owner: owner_id,
152	username: owner_id
153	});
154	}
155
156	function secureGithubCallbacks(original_response, callback) {
157
158	if (typeof (githubOAuth) === "undefined") {	2!
159	console.log("[critical] [githubOAuth] undefined on secure! attempting to fix...");	×
160
161	try {	×
162	let specs = {	×
163	githubClient: process.env.GITHUB_CLIENT_ID,
164	githubSecret: process.env.GITHUB_CLIENT_SECRET,
165	baseURL: github_ocfg.base_url, // should be rather gotten from global config!
166	loginURI: '/api/oauth/github',
167	callbackURI: '/api/oauth/github/callback',
168	scope: 'user'
169	};
170	githubOAuth = require('./thinx/oauth-github.js')(specs);	×
171
172	} catch (e) {
173	console.log(`[debug] [oauth] [github] github_ocfg init error: ${e}`);	×
174	}
175	}
176
177	// configure callbacks for Emitter events
178
179	githubOAuth.on('error', (err) => {	2✔
180	console.error('[debug] [oauth] [github] there was a login error', err);	3✔
181	if (process.env.ENVIRONMENT == "test")	3!
182	if (typeof (original_response) !== "undefined") original_response.end("test-ok");	3!
183	});
184
185	githubOAuth.on('token', (access_token, /* resp, _res, req */) => {	2✔
186
187	if (!Util.isDefined(access_token)) {	×
188	original_response.status(401).end();	×
189	console.log("[github] oauth_response missing (test or intrusion)");	×
190	return;	×
191	}
192
193	if ((!access_token) \|\| (access_token.indexOf("bad_verification") !== -1)) {	×
194	console.log("🔨 [debug] [github] [token] No token, exiting.");	×
195	original_response.status(401).end();	×
196	return;	×
197	}
198
199	const requestOptions = {	×
200	host: 'api.github.com',
201	port: 443,
202	path: '/user',
203	headers: {
204	'User-Agent': 'THiNX', // Application name from GitHub / Settings / Developer Settings
205	'Authorization': 'token ' + access_token,
206	'Accept': 'application/vnd.github+json'
207	}
208	};
209
210	https.get(requestOptions, (res) => {	×
211	let data = '';	×
212	res.on('data', (chunk) => {	×
213	data += chunk;	×
214	});
215	res.on('end', () => {	×
216	githubLogin(access_token, JSON.parse(data), res, original_response);	×
217	});
218	});
219	});
220
221	callback(); // async completes the secureGithubCallbacks()	2✔
222	}
223
224	// Initial page redirecting to OAuth2 provider
225	app.get('/api/oauth/github', function (req, res) {	15✔
226	if (typeof (req.session) !== "undefined") {	1!
227	console.log("🔨 [debug] GET /api/oauth/github will destroy old session...");	1✔
228	req.session.destroy();	1✔
229	}
230	if (typeof (githubOAuth) !== "undefined") {	1!
231	console.log("🔨 [debug] GET /api/oauth/github calling githubOAuth.login");	1✔
232	githubOAuth.login(req, res);	1✔
233	} else {
234	res.status(400).end();	×
235	}
236	});
237
238	// Callback service parsing the authorization token and asking for the access token
239	// Allow-limits: This endpoint should be called by GitHub/Browser only.
240
241	// This is called redirect_uri in config, callbackURI in github-oauth.js params (spec)
242	app.get('/api/oauth/github/callback', function (req, original_response) {	15✔
243	var query = url.parse(req.url, true).query;	2✔
244	var code = query.code;	2✔
245	var state = query.state;	2✔
246
247	console.log("🔨 [debug] GET /api/oauth/github/callback query state is:", {state});	2✔
248	//if (!code \|\| code.length < 4) {
249
250	// save original response to callbacks in this code path... when callback is called, response is used to reply (except for error)
251	secureGithubCallbacks(original_response, () => {	2✔
252	githubOAuth.callback(code, state, original_response, (err) => {	2✔
UNCOV 253	console.log("[spec] GitHub OAuth result", err);	×
254	});
255	});
256	});
257
258	app.post('/api/github/token', (req, res) => {	15✔
259	let token = req.body.token;	×
260	rsakey.list(owner, (success, list) => {	×
261	console.log("RSAKey list success:", success);	×
262	if (list.length == 0) return console.log("No RSA Keys to add from", list);	×
263	let key = list[0];	×
264	let pubkey = key.pubkey;	×
265	console.log("GitHub adding pub key:", pubkey);	×
266	GitHub.addPublicKey(token, pubkey, (result) => {	×
267	res.status(200).end(result);	×
268	});
269	});
270	});
271	};

suculent / thinx-device-api / #252645665

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous