mirror of
https://github.com/TryGhost/Ghost.git
synced 2025-02-03 23:00:14 -05:00
9be9531ef8
* Added admin specific auth{enticate,orize} middleware
refs #9865
This middleware will be used by the admin api to authenticate and
authorize requests
* Update v2/admin to use authAdminApi middleware
refs #9865
This changes thh auth middleware to use the adminApi authenticate and
authorize middlewares underneath, it also renames the middleware to be
consistent with the naming of the api.
* Removed oauth specific endpoints from /v2/admin
refs #9865
These are not to be used in v2/admin
* Wired up the session controller to the admin api
refs #9865
These endpoints will be used by ghost admin to login, confirm logged in status and logout
106 lines
4.6 KiB
JavaScript
106 lines
4.6 KiB
JavaScript
const passport = require('passport');
|
|
const authUtils = require('./utils');
|
|
const models = require('../../models');
|
|
const common = require('../../lib/common');
|
|
const session = require('./session');
|
|
|
|
const authenticate = {
|
|
// ### Authenticate Client Middleware
|
|
authenticateClient: function authenticateClient(req, res, next) {
|
|
/**
|
|
* In theory, client authentication is not required for public clients, only for confidential clients.
|
|
* See e.g. https://tools.ietf.org/html/rfc6749#page-38. Ghost has no differentiation for this at the moment.
|
|
* See also See https://tools.ietf.org/html/rfc6749#section-2.1.
|
|
*
|
|
* Ghost requires client authentication for `grant_type: password`, because we have to ensure that
|
|
* we tie a client to a new access token. That means `grant_type: refresh_token` does not require
|
|
* client authentication, because binding a client already happened.
|
|
*
|
|
* To sum up:
|
|
* - password authentication requires client authentication
|
|
* - refreshing a token does not require client authentication
|
|
* - public API requires client authentication
|
|
* - as soon as you send an access token in the header or via query
|
|
* - we deny public API access
|
|
* - API access with a Bearer does not require client authentication
|
|
*/
|
|
if (authUtils.getBearerAutorizationToken(req) && !authUtils.hasGrantType(req, 'password')) {
|
|
return next();
|
|
}
|
|
|
|
if (req.query && req.query.client_id) {
|
|
req.body.client_id = req.query.client_id;
|
|
}
|
|
|
|
if (req.query && req.query.client_secret) {
|
|
req.body.client_secret = req.query.client_secret;
|
|
}
|
|
|
|
if (!req.body.client_id || !req.body.client_secret) {
|
|
return next(new common.errors.UnauthorizedError({
|
|
message: common.i18n.t('errors.middleware.auth.accessDenied'),
|
|
context: common.i18n.t('errors.middleware.auth.clientCredentialsNotProvided'),
|
|
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://api.ghost.org/docs/client-authentication'})
|
|
}));
|
|
}
|
|
|
|
return passport.authenticate(['oauth2-client-password'], {session: false, failWithError: false},
|
|
function authenticate(err, client) {
|
|
if (err) {
|
|
return next(err); // will generate a 500 error
|
|
}
|
|
|
|
// req.body needs to be null for GET requests to build options correctly
|
|
delete req.body.client_id;
|
|
delete req.body.client_secret;
|
|
|
|
if (!client) {
|
|
return next(new common.errors.UnauthorizedError({
|
|
message: common.i18n.t('errors.middleware.auth.accessDenied'),
|
|
context: common.i18n.t('errors.middleware.auth.clientCredentialsNotValid'),
|
|
help: common.i18n.t('errors.middleware.auth.forInformationRead', {url: 'https://api.ghost.org/docs/client-authentication'})
|
|
}));
|
|
}
|
|
|
|
req.client = client;
|
|
|
|
common.events.emit('client.authenticated', client);
|
|
return next(null, client);
|
|
}
|
|
)(req, res, next);
|
|
},
|
|
|
|
// ### Authenticate User Middleware
|
|
authenticateUser: function authenticateUser(req, res, next) {
|
|
return passport.authenticate('bearer', {session: false, failWithError: false},
|
|
function authenticate(err, user, info) {
|
|
if (err) {
|
|
return next(err); // will generate a 500 error
|
|
}
|
|
|
|
if (user) {
|
|
req.authInfo = info;
|
|
req.user = user;
|
|
|
|
common.events.emit('user.authenticated', user);
|
|
return next(null, user, info);
|
|
} else if (authUtils.getBearerAutorizationToken(req)) {
|
|
return next(new common.errors.UnauthorizedError({
|
|
message: common.i18n.t('errors.middleware.auth.accessDenied')
|
|
}));
|
|
} else if (req.client) {
|
|
req.user = {id: models.User.externalUser};
|
|
return next();
|
|
}
|
|
|
|
return next(new common.errors.UnauthorizedError({
|
|
message: common.i18n.t('errors.middleware.auth.accessDenied')
|
|
}));
|
|
}
|
|
)(req, res, next);
|
|
},
|
|
|
|
authenticateAdminAPI: [session.safeGetSession, session.getUser]
|
|
};
|
|
|
|
module.exports = authenticate;
|