Add 'packages/auth/' from commit '1274ad6b0d9c288ab5366e8f3f977e50418166af'
git-subtree-dir: packages/auth git-subtree-mainline:6890bbf53fgit-subtree-split:1274ad6b0d
This commit is contained in:
Tobe O
commit
e887b1d21f
33 changed files with 1867 additions and 0 deletions
packages/auth
.gitignore
.idea
.travis.ymlCHANGELOG.mdLICENSEREADME.mdanalysis_options.yamlexample
lib
pubspec.yamltest
76
packages/auth/.gitignore
vendored
Normal file
76
packages/auth/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,76 @@
|
||||||
|
# Created by .ignore support plugin (hsz.mobi)
|
||||||
|
### Dart template
|
||||||
|
# See https://www.dartlang.org/tools/private-files.html
|
||||||
|
|
||||||
|
# Files and directories created by pub
|
||||||
|
.buildlog
|
||||||
|
.packages
|
||||||
|
.project
|
||||||
|
.pub/
|
||||||
|
build/
|
||||||
|
**/packages/
|
||||||
|
|
||||||
|
# Files created by dart2js
|
||||||
|
# (Most Dart developers will use pub build to compile Dart, use/modify these
|
||||||
|
# rules if you intend to use dart2js directly
|
||||||
|
# Convention is to use extension '.dart.js' for Dart compiled to Javascript to
|
||||||
|
# differentiate from explicit Javascript files)
|
||||||
|
*.dart.js
|
||||||
|
*.part.js
|
||||||
|
*.js.deps
|
||||||
|
*.js.map
|
||||||
|
*.info.json
|
||||||
|
|
||||||
|
# Directory created by dartdoc
|
||||||
|
doc/api/
|
||||||
|
|
||||||
|
# Don't commit pubspec lock file
|
||||||
|
# (Library packages only! Remove pattern if developing an application package)
|
||||||
|
pubspec.lock
|
||||||
|
### JetBrains template
|
||||||
|
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
|
||||||
|
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
|
||||||
|
|
||||||
|
# User-specific stuff:
|
||||||
|
.idea/workspace.xml
|
||||||
|
.idea/tasks.xml
|
||||||
|
.idea/dictionaries
|
||||||
|
.idea/vcs.xml
|
||||||
|
.idea/jsLibraryMappings.xml
|
||||||
|
|
||||||
|
# Sensitive or high-churn files:
|
||||||
|
.idea/dataSources.ids
|
||||||
|
.idea/dataSources.xml
|
||||||
|
.idea/dataSources.local.xml
|
||||||
|
.idea/sqlDataSources.xml
|
||||||
|
.idea/dynamic.xml
|
||||||
|
.idea/uiDesigner.xml
|
||||||
|
|
||||||
|
# Gradle:
|
||||||
|
.idea/gradle.xml
|
||||||
|
.idea/libraries
|
||||||
|
|
||||||
|
# Mongo Explorer plugin:
|
||||||
|
.idea/mongoSettings.xml
|
||||||
|
|
||||||
|
## File-based project format:
|
||||||
|
*.iws
|
||||||
|
|
||||||
|
## Plugin-specific files:
|
||||||
|
|
||||||
|
# IntelliJ
|
||||||
|
/out/
|
||||||
|
|
||||||
|
# mpeltonen/sbt-idea plugin
|
||||||
|
.idea_modules/
|
||||||
|
|
||||||
|
# JIRA plugin
|
||||||
|
atlassian-ide-plugin.xml
|
||||||
|
|
||||||
|
# Crashlytics plugin (for Android Studio and IntelliJ)
|
||||||
|
com_crashlytics_export_strings.xml
|
||||||
|
crashlytics.properties
|
||||||
|
crashlytics-build.properties
|
||||||
|
fabric.properties
|
||||||
|
|
||||||
|
.dart_tool
|
||||||
17
packages/auth/.idea/angel_auth.iml
Normal file
17
packages/auth/.idea/angel_auth.iml
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<module type="WEB_MODULE" version="4">
|
||||||
|
<component name="NewModuleRootManager">
|
||||||
|
<content url="file://$MODULE_DIR$">
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/.dart_tool" />
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/.pub" />
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/.tmp" />
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/build" />
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/temp" />
|
||||||
|
<excludeFolder url="file://$MODULE_DIR$/tmp" />
|
||||||
|
</content>
|
||||||
|
<orderEntry type="inheritedJdk" />
|
||||||
|
<orderEntry type="sourceFolder" forTests="false" />
|
||||||
|
<orderEntry type="library" name="Dart SDK" level="project" />
|
||||||
|
<orderEntry type="library" name="Dart Packages" level="project" />
|
||||||
|
</component>
|
||||||
|
</module>
|
||||||
28
packages/auth/.idea/misc.xml
Normal file
28
packages/auth/.idea/misc.xml
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<project version="4">
|
||||||
|
<component name="JavaScriptSettings">
|
||||||
|
<option name="languageLevel" value="ES6" />
|
||||||
|
</component>
|
||||||
|
<component name="ProjectInspectionProfilesVisibleTreeState">
|
||||||
|
<entry key="Project Default">
|
||||||
|
<profile-state>
|
||||||
|
<expanded-state>
|
||||||
|
<State>
|
||||||
|
<id />
|
||||||
|
</State>
|
||||||
|
<State>
|
||||||
|
<id>General</id>
|
||||||
|
</State>
|
||||||
|
<State>
|
||||||
|
<id>XPath</id>
|
||||||
|
</State>
|
||||||
|
</expanded-state>
|
||||||
|
<selected-state>
|
||||||
|
<State>
|
||||||
|
<id>AngularJS</id>
|
||||||
|
</State>
|
||||||
|
</selected-state>
|
||||||
|
</profile-state>
|
||||||
|
</entry>
|
||||||
|
</component>
|
||||||
|
</project>
|
||||||
8
packages/auth/.idea/modules.xml
Normal file
8
packages/auth/.idea/modules.xml
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<project version="4">
|
||||||
|
<component name="ProjectModuleManager">
|
||||||
|
<modules>
|
||||||
|
<module fileurl="file://$PROJECT_DIR$/.idea/angel_auth.iml" filepath="$PROJECT_DIR$/.idea/angel_auth.iml" />
|
||||||
|
</modules>
|
||||||
|
</component>
|
||||||
|
</project>
|
||||||
8
packages/auth/.idea/runConfigurations/All_Tests.xml
Normal file
8
packages/auth/.idea/runConfigurations/All_Tests.xml
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="All Tests" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test" />
|
||||||
|
<option name="scope" value="FOLDER" />
|
||||||
|
<option name="testRunnerOptions" value="-j 4" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="Auth Token Tests" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test/auth_token_test.dart" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
6
packages/auth/.idea/runConfigurations/Callback_Tests.xml
Normal file
6
packages/auth/.idea/runConfigurations/Callback_Tests.xml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="Callback Tests" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test/callback_test.dart" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
6
packages/auth/.idea/runConfigurations/Local_Tests.xml
Normal file
6
packages/auth/.idea/runConfigurations/Local_Tests.xml
Normal file
|
|
@ -0,0 +1,6 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="Local Tests" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test/local_test.dart" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="preserve existing user in callback_test.dart" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true" nameIsGenerated="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test/callback_test.dart" />
|
||||||
|
<option name="scope" value="GROUP_OR_TEST_BY_NAME" />
|
||||||
|
<option name="testName" value="preserve existing user" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
<component name="ProjectRunConfigurationManager">
|
||||||
|
<configuration default="false" name="tests in protect_cookie_test.dart" type="DartTestRunConfigurationType" factoryName="Dart Test" singleton="true" nameIsGenerated="true">
|
||||||
|
<option name="filePath" value="$PROJECT_DIR$/test/protect_cookie_test.dart" />
|
||||||
|
<option name="testRunnerOptions" value="-j4" />
|
||||||
|
<method />
|
||||||
|
</configuration>
|
||||||
|
</component>
|
||||||
4
packages/auth/.travis.yml
Normal file
4
packages/auth/.travis.yml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
language: dart
|
||||||
|
dart:
|
||||||
|
- dev
|
||||||
|
- stable
|
||||||
83
packages/auth/CHANGELOG.md
Normal file
83
packages/auth/CHANGELOG.md
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
# 2.1.5+1
|
||||||
|
* Fix error in popup page.
|
||||||
|
|
||||||
|
# 2.1.5
|
||||||
|
* Modify `_apply` to honor an existing `User` over `Future<User>`.
|
||||||
|
|
||||||
|
# 2.1.4
|
||||||
|
* Deprecate `decodeJwt`, in favor of asynchronous injections.
|
||||||
|
|
||||||
|
# 2.1.3
|
||||||
|
* Use `await` on redirects, etc.
|
||||||
|
|
||||||
|
# 2.1.2
|
||||||
|
* Change empty cookie string to have double quotes (thanks @korsvanloon).
|
||||||
|
|
||||||
|
# 2.1.1
|
||||||
|
* Added `scopes` to `ExternalAuthOptions`.
|
||||||
|
|
||||||
|
# 2.1.0
|
||||||
|
* Added `ExternalAuthOptions`.
|
||||||
|
|
||||||
|
# 2.0.4
|
||||||
|
* `successRedirect` was previously explicitly returning a `200`; remove this and allow the default `302`.
|
||||||
|
|
||||||
|
# 2.0.3
|
||||||
|
* Updates for streaming parse of request bodies.
|
||||||
|
|
||||||
|
# 2.0.2
|
||||||
|
* Handle `null` return in `authenticate` + `failureRedirect`.
|
||||||
|
|
||||||
|
# 2.0.1
|
||||||
|
* Add generic parameter to `options` on `AuthStrategy.authenticate`.
|
||||||
|
|
||||||
|
# 2.0.0+1
|
||||||
|
* Meta update to improve Pub score.
|
||||||
|
|
||||||
|
# 2.0.0
|
||||||
|
* Made `AuthStrategy` generic.
|
||||||
|
* `AngelAuth.strategies` is now a `Map<String, AuthStrategy<User>>`.
|
||||||
|
* Removed `AuthStrategy.canLogout`.
|
||||||
|
* Made `AngelAuthTokenCallback` generic.
|
||||||
|
|
||||||
|
# 2.0.0-alpha
|
||||||
|
* Depend on Dart 2 and Angel 2.
|
||||||
|
* Remove `dart2_constant`.
|
||||||
|
* Remove `requireAuth`.
|
||||||
|
* Remove `userKey`, instead favoring generic parameters.
|
||||||
|
|
||||||
|
# 1.2.0
|
||||||
|
* Deprecate `requireAuth`, in favor of `requireAuthentication`.
|
||||||
|
* Allow configuring of the `userKey`.
|
||||||
|
* Deprecate `middlewareName`.
|
||||||
|
|
||||||
|
# 1.1.1+6
|
||||||
|
* Fix a small logic bug that prevented `LocalAuthStrategy`
|
||||||
|
from correctly propagating the authenticated user when
|
||||||
|
using `Basic` auth.
|
||||||
|
|
||||||
|
# 1.1.1+5
|
||||||
|
* Prevent duplication of cookies.
|
||||||
|
* Regenerate the JWT if `tokenCallback` is called.
|
||||||
|
|
||||||
|
# 1.1.1+4
|
||||||
|
* Patched `logout` to properly erase cookies
|
||||||
|
* Fixed checking of expired tokens.
|
||||||
|
|
||||||
|
# 1.1.1+3
|
||||||
|
* `authenticate` returns the current user, if one is present.
|
||||||
|
|
||||||
|
# 1.1.1+2
|
||||||
|
* `_apply` now always sends a `token` cookie.
|
||||||
|
|
||||||
|
# 1.1.1+1
|
||||||
|
* Update `protectCookie` to only send `maxAge` when it is not `-1`.
|
||||||
|
|
||||||
|
# 1.1.1
|
||||||
|
* Added `protectCookie`, to better protect data sent in cookies.
|
||||||
|
|
||||||
|
# 1.1.0+2
|
||||||
|
* `LocalAuthStrategy` returns `true` on `Basic` authentication.
|
||||||
|
|
||||||
|
# 1.1.0+1
|
||||||
|
* Modified `LocalAuthStrategy`'s handling of `Basic` authentication.
|
||||||
21
packages/auth/LICENSE
Normal file
21
packages/auth/LICENSE
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
The MIT License (MIT)
|
||||||
|
|
||||||
|
Copyright (c) 2016 angel-dart
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
85
packages/auth/README.md
Normal file
85
packages/auth/README.md
Normal file
|
|
@ -0,0 +1,85 @@
|
||||||
|
# angel_auth
|
||||||
|
|
||||||
|
[](https://pub.dartlang.org/packages/angel_auth)
|
||||||
|
[](https://travis-ci.org/angel-dart/auth)
|
||||||
|
|
||||||
|
A complete authentication plugin for Angel. Inspired by Passport.
|
||||||
|
|
||||||
|
# Wiki
|
||||||
|
[Click here](https://github.com/angel-dart/auth/wiki).
|
||||||
|
|
||||||
|
# Bundled Strategies
|
||||||
|
* Local (with and without Basic Auth)
|
||||||
|
* Find other strategies (Twitter, Google, OAuth2, etc.) on Pub!!!
|
||||||
|
|
||||||
|
# Example
|
||||||
|
Ensure you have read the [wiki](https://github.com/angel-dart/auth/wiki).
|
||||||
|
|
||||||
|
```dart
|
||||||
|
configureServer(Angel app) async {
|
||||||
|
var auth = AngelAuth<User>();
|
||||||
|
auth.serializer = ...;
|
||||||
|
auth.deserializer = ...;
|
||||||
|
auth.strategies['local'] = LocalAuthStrategy(...);
|
||||||
|
|
||||||
|
// POST route to handle username+password
|
||||||
|
app.post('/local', auth.authenticate('local'));
|
||||||
|
|
||||||
|
// Using Angel's asynchronous injections, we can parse the JWT
|
||||||
|
// on demand. It won't be parsed until we check.
|
||||||
|
app.get('/profile', ioc((User user) {
|
||||||
|
print(user.description);
|
||||||
|
}));
|
||||||
|
|
||||||
|
// Use a comma to try multiple strategies!!!
|
||||||
|
//
|
||||||
|
// Each strategy is run sequentially. If one succeeds, the loop ends.
|
||||||
|
// Authentication failures will just cause the loop to continue.
|
||||||
|
//
|
||||||
|
// If the last strategy throws an authentication failure, then
|
||||||
|
// a `401 Not Authenticated` is thrown.
|
||||||
|
var chainedHandler = auth.authenticate(
|
||||||
|
['basic','facebook'],
|
||||||
|
authOptions
|
||||||
|
);
|
||||||
|
|
||||||
|
// Apply angel_auth-specific configuration.
|
||||||
|
await app.configure(auth.configureServer);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
# Default Authentication Callback
|
||||||
|
A frequent use case within SPA's is opening OAuth login endpoints in a separate window.
|
||||||
|
[`angel_client`](https://github.com/angel-dart/client)
|
||||||
|
provides a facility for this, which works perfectly with the default callback provided
|
||||||
|
in this package.
|
||||||
|
|
||||||
|
```dart
|
||||||
|
configureServer(Angel app) async {
|
||||||
|
var handler = auth.authenticate(
|
||||||
|
'facebook',
|
||||||
|
AngelAuthOptions(callback: confirmPopupAuthentication()));
|
||||||
|
app.get('/auth/facebook', handler);
|
||||||
|
|
||||||
|
// Use a comma to try multiple strategies!!!
|
||||||
|
//
|
||||||
|
// Each strategy is run sequentially. If one succeeds, the loop ends.
|
||||||
|
// Authentication failures will just cause the loop to continue.
|
||||||
|
//
|
||||||
|
// If the last strategy throws an authentication failure, then
|
||||||
|
// a `401 Not Authenticated` is thrown.
|
||||||
|
var chainedHandler = auth.authenticate(
|
||||||
|
['basic','facebook'],
|
||||||
|
authOptions
|
||||||
|
);
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
This renders a simple HTML page that fires the user's JWT as a `token` event in `window.opener`.
|
||||||
|
`angel_client` [exposes this as a Stream](https://github.com/angel-dart/client#authentication):
|
||||||
|
|
||||||
|
```dart
|
||||||
|
app.authenticateViaPopup('/auth/google').listen((jwt) {
|
||||||
|
// Do something with the JWT
|
||||||
|
});
|
||||||
|
```
|
||||||
4
packages/auth/analysis_options.yaml
Normal file
4
packages/auth/analysis_options.yaml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
include: package:pedantic/analysis_options.yaml
|
||||||
|
analyzer:
|
||||||
|
strong-mode:
|
||||||
|
implicit-casts: false
|
||||||
39
packages/auth/example/example.dart
Normal file
39
packages/auth/example/example.dart
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'package:angel_auth/angel_auth.dart';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'package:angel_framework/http.dart';
|
||||||
|
|
||||||
|
main() async {
|
||||||
|
var app = Angel();
|
||||||
|
var auth = AngelAuth<User>();
|
||||||
|
|
||||||
|
auth.serializer = (user) => user.id;
|
||||||
|
|
||||||
|
auth.deserializer = (id) => fetchAUserByIdSomehow(id);
|
||||||
|
|
||||||
|
// Middleware to decode JWT's and inject a user object...
|
||||||
|
await app.configure(auth.configureServer);
|
||||||
|
|
||||||
|
auth.strategies['local'] = LocalAuthStrategy((username, password) {
|
||||||
|
// Retrieve a user somehow...
|
||||||
|
// If authentication succeeds, return a User object.
|
||||||
|
//
|
||||||
|
// Otherwise, return `null`.
|
||||||
|
});
|
||||||
|
|
||||||
|
app.post('/auth/local', auth.authenticate('local'));
|
||||||
|
|
||||||
|
var http = AngelHttp(app);
|
||||||
|
await http.startServer('127.0.0.1', 3000);
|
||||||
|
|
||||||
|
print('Listening at http://127.0.0.1:3000');
|
||||||
|
}
|
||||||
|
|
||||||
|
class User {
|
||||||
|
String id, username, password;
|
||||||
|
}
|
||||||
|
|
||||||
|
Future<User> fetchAUserByIdSomehow(id) async {
|
||||||
|
// Fetch a user somehow...
|
||||||
|
throw UnimplementedError();
|
||||||
|
}
|
||||||
10
packages/auth/lib/angel_auth.dart
Normal file
10
packages/auth/lib/angel_auth.dart
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
library angel_auth;
|
||||||
|
|
||||||
|
export 'src/middleware/require_auth.dart';
|
||||||
|
export 'src/strategies/strategies.dart';
|
||||||
|
export 'src/auth_token.dart';
|
||||||
|
export 'src/configuration.dart';
|
||||||
|
export 'src/options.dart';
|
||||||
|
export 'src/plugin.dart';
|
||||||
|
export 'src/popup_page.dart';
|
||||||
|
export 'src/strategy.dart';
|
||||||
4
packages/auth/lib/auth_token.dart
Normal file
4
packages/auth/lib/auth_token.dart
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
/// Stand-alone JWT library.
|
||||||
|
library angel_auth.auth_token;
|
||||||
|
|
||||||
|
export 'src/auth_token.dart';
|
||||||
124
packages/auth/lib/src/auth_token.dart
Normal file
124
packages/auth/lib/src/auth_token.dart
Normal file
|
|
@ -0,0 +1,124 @@
|
||||||
|
import 'dart:collection';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'dart:convert';
|
||||||
|
import 'package:crypto/crypto.dart';
|
||||||
|
|
||||||
|
/// Calls [BASE64URL], but also works for strings with lengths
|
||||||
|
/// that are *not* multiples of 4.
|
||||||
|
String decodeBase64(String str) {
|
||||||
|
var output = str.replaceAll('-', '+').replaceAll('_', '/');
|
||||||
|
|
||||||
|
switch (output.length % 4) {
|
||||||
|
case 0:
|
||||||
|
break;
|
||||||
|
case 2:
|
||||||
|
output += '==';
|
||||||
|
break;
|
||||||
|
case 3:
|
||||||
|
output += '=';
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
throw 'Illegal base64url string!"';
|
||||||
|
}
|
||||||
|
|
||||||
|
return utf8.decode(base64Url.decode(output));
|
||||||
|
}
|
||||||
|
|
||||||
|
class AuthToken {
|
||||||
|
final SplayTreeMap<String, String> _header =
|
||||||
|
SplayTreeMap.from({"alg": "HS256", "typ": "JWT"});
|
||||||
|
|
||||||
|
String ipAddress;
|
||||||
|
DateTime issuedAt;
|
||||||
|
num lifeSpan;
|
||||||
|
var userId;
|
||||||
|
Map<String, dynamic> payload = {};
|
||||||
|
|
||||||
|
AuthToken(
|
||||||
|
{this.ipAddress,
|
||||||
|
this.lifeSpan = -1,
|
||||||
|
this.userId,
|
||||||
|
DateTime issuedAt,
|
||||||
|
Map payload = const {}}) {
|
||||||
|
this.issuedAt = issuedAt ?? DateTime.now();
|
||||||
|
this.payload.addAll(
|
||||||
|
payload?.keys?.fold({}, (out, k) => out..[k.toString()] = payload[k]) ??
|
||||||
|
{});
|
||||||
|
}
|
||||||
|
|
||||||
|
factory AuthToken.fromJson(String jsons) =>
|
||||||
|
AuthToken.fromMap(json.decode(jsons) as Map);
|
||||||
|
|
||||||
|
factory AuthToken.fromMap(Map data) {
|
||||||
|
return AuthToken(
|
||||||
|
ipAddress: data["aud"].toString(),
|
||||||
|
lifeSpan: data["exp"] as num,
|
||||||
|
issuedAt: DateTime.parse(data["iat"].toString()),
|
||||||
|
userId: data["sub"],
|
||||||
|
payload: data["pld"] as Map ?? {});
|
||||||
|
}
|
||||||
|
|
||||||
|
factory AuthToken.parse(String jwt) {
|
||||||
|
var split = jwt.split(".");
|
||||||
|
|
||||||
|
if (split.length != 3)
|
||||||
|
throw AngelHttpException.notAuthenticated(message: "Invalid JWT.");
|
||||||
|
|
||||||
|
var payloadString = decodeBase64(split[1]);
|
||||||
|
return AuthToken.fromMap(json.decode(payloadString) as Map);
|
||||||
|
}
|
||||||
|
|
||||||
|
factory AuthToken.validate(String jwt, Hmac hmac) {
|
||||||
|
var split = jwt.split(".");
|
||||||
|
|
||||||
|
if (split.length != 3)
|
||||||
|
throw AngelHttpException.notAuthenticated(message: "Invalid JWT.");
|
||||||
|
|
||||||
|
// var headerString = decodeBase64(split[0]);
|
||||||
|
var payloadString = decodeBase64(split[1]);
|
||||||
|
var data = split[0] + "." + split[1];
|
||||||
|
var signature = base64Url.encode(hmac.convert(data.codeUnits).bytes);
|
||||||
|
|
||||||
|
if (signature != split[2])
|
||||||
|
throw AngelHttpException.notAuthenticated(
|
||||||
|
message: "JWT payload does not match hashed version.");
|
||||||
|
|
||||||
|
return AuthToken.fromMap(json.decode(payloadString) as Map);
|
||||||
|
}
|
||||||
|
|
||||||
|
String serialize(Hmac hmac) {
|
||||||
|
var headerString = base64Url.encode(json.encode(_header).codeUnits);
|
||||||
|
var payloadString = base64Url.encode(json.encode(toJson()).codeUnits);
|
||||||
|
var data = headerString + "." + payloadString;
|
||||||
|
var signature = hmac.convert(data.codeUnits).bytes;
|
||||||
|
return data + "." + base64Url.encode(signature);
|
||||||
|
}
|
||||||
|
|
||||||
|
Map toJson() {
|
||||||
|
return _splayify({
|
||||||
|
"iss": "angel_auth",
|
||||||
|
"aud": ipAddress,
|
||||||
|
"exp": lifeSpan,
|
||||||
|
"iat": issuedAt.toIso8601String(),
|
||||||
|
"sub": userId,
|
||||||
|
"pld": _splayify(payload)
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
SplayTreeMap _splayify(Map map) {
|
||||||
|
var data = {};
|
||||||
|
map.forEach((k, v) {
|
||||||
|
data[k] = _splay(v);
|
||||||
|
});
|
||||||
|
return SplayTreeMap.from(data);
|
||||||
|
}
|
||||||
|
|
||||||
|
_splay(value) {
|
||||||
|
if (value is Iterable) {
|
||||||
|
return value.map(_splay).toList();
|
||||||
|
} else if (value is Map)
|
||||||
|
return _splayify(value);
|
||||||
|
else
|
||||||
|
return value;
|
||||||
|
}
|
||||||
133
packages/auth/lib/src/configuration.dart
Normal file
133
packages/auth/lib/src/configuration.dart
Normal file
|
|
@ -0,0 +1,133 @@
|
||||||
|
import 'package:charcode/ascii.dart';
|
||||||
|
import 'package:collection/collection.dart';
|
||||||
|
import 'package:meta/meta.dart';
|
||||||
|
import 'package:quiver_hashcode/hashcode.dart';
|
||||||
|
|
||||||
|
/// A common class containing parsing and validation logic for third-party authentication configuration.
|
||||||
|
class ExternalAuthOptions {
|
||||||
|
/// The user's identifier, otherwise known as an "application id".
|
||||||
|
final String clientId;
|
||||||
|
|
||||||
|
/// The user's secret, other known as an "application secret".
|
||||||
|
final String clientSecret;
|
||||||
|
|
||||||
|
/// The user's redirect URI.
|
||||||
|
final Uri redirectUri;
|
||||||
|
|
||||||
|
/// The scopes to be passed to the external server.
|
||||||
|
final Set<String> scopes;
|
||||||
|
|
||||||
|
ExternalAuthOptions._(
|
||||||
|
this.clientId, this.clientSecret, this.redirectUri, this.scopes) {
|
||||||
|
if (clientId == null) {
|
||||||
|
throw ArgumentError.notNull('clientId');
|
||||||
|
} else if (clientSecret == null) {
|
||||||
|
throw ArgumentError.notNull('clientSecret');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
factory ExternalAuthOptions(
|
||||||
|
{@required String clientId,
|
||||||
|
@required String clientSecret,
|
||||||
|
@required redirectUri,
|
||||||
|
Iterable<String> scopes = const []}) {
|
||||||
|
if (redirectUri is String) {
|
||||||
|
return ExternalAuthOptions._(
|
||||||
|
clientId, clientSecret, Uri.parse(redirectUri), scopes.toSet());
|
||||||
|
} else if (redirectUri is Uri) {
|
||||||
|
return ExternalAuthOptions._(
|
||||||
|
clientId, clientSecret, redirectUri, scopes.toSet());
|
||||||
|
} else {
|
||||||
|
throw ArgumentError.value(
|
||||||
|
redirectUri, 'redirectUri', 'must be a String or Uri');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Returns a JSON-friendly representation of this object.
|
||||||
|
///
|
||||||
|
/// Parses the following fields:
|
||||||
|
/// * `client_id`
|
||||||
|
/// * `client_secret`
|
||||||
|
/// * `redirect_uri`
|
||||||
|
factory ExternalAuthOptions.fromMap(Map map) {
|
||||||
|
return ExternalAuthOptions(
|
||||||
|
clientId: map['client_id'] as String,
|
||||||
|
clientSecret: map['client_secret'] as String,
|
||||||
|
redirectUri: map['redirect_uri'],
|
||||||
|
scopes: map['scopes'] is Iterable
|
||||||
|
? ((map['scopes'] as Iterable).map((x) => x.toString()))
|
||||||
|
: <String>[],
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
@override
|
||||||
|
int get hashCode => hash4(clientId, clientSecret, redirectUri, scopes);
|
||||||
|
|
||||||
|
@override
|
||||||
|
bool operator ==(other) =>
|
||||||
|
other is ExternalAuthOptions &&
|
||||||
|
other.clientId == clientId &&
|
||||||
|
other.clientSecret == other.clientSecret &&
|
||||||
|
other.redirectUri == other.redirectUri &&
|
||||||
|
const SetEquality<String>().equals(other.scopes, scopes);
|
||||||
|
|
||||||
|
/// Creates a copy of this object, with the specified changes.
|
||||||
|
ExternalAuthOptions copyWith(
|
||||||
|
{String clientId,
|
||||||
|
String clientSecret,
|
||||||
|
redirectUri,
|
||||||
|
Iterable<String> scopes}) {
|
||||||
|
return ExternalAuthOptions(
|
||||||
|
clientId: clientId ?? this.clientId,
|
||||||
|
clientSecret: clientSecret ?? this.clientSecret,
|
||||||
|
redirectUri: redirectUri ?? this.redirectUri,
|
||||||
|
scopes: (scopes ??= []).followedBy(this.scopes),
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Returns a JSON-friendly representation of this object.
|
||||||
|
///
|
||||||
|
/// Contains the following fields:
|
||||||
|
/// * `client_id`
|
||||||
|
/// * `client_secret`
|
||||||
|
/// * `redirect_uri`
|
||||||
|
///
|
||||||
|
/// If [obscureSecret] is `true` (default), then the [clientSecret] will
|
||||||
|
/// be replaced by the string `<redacted>`.
|
||||||
|
Map<String, dynamic> toJson({bool obscureSecret = true}) {
|
||||||
|
return {
|
||||||
|
'client_id': clientId,
|
||||||
|
'client_secret': obscureSecret ? '<redacted>' : clientSecret,
|
||||||
|
'redirect_uri': redirectUri.toString(),
|
||||||
|
'scopes': scopes.toList(),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Returns a [String] representation of this object.
|
||||||
|
///
|
||||||
|
/// If [obscureText] is `true` (default), then the [clientSecret] will be
|
||||||
|
/// replaced by asterisks in the output.
|
||||||
|
///
|
||||||
|
/// If no [asteriskCount] is given, then the number of asterisks will equal the length of
|
||||||
|
/// the actual [clientSecret].
|
||||||
|
@override
|
||||||
|
String toString({bool obscureSecret = true, int asteriskCount}) {
|
||||||
|
String secret;
|
||||||
|
|
||||||
|
if (!obscureSecret) {
|
||||||
|
secret = clientSecret;
|
||||||
|
} else {
|
||||||
|
var codeUnits =
|
||||||
|
List<int>.filled(asteriskCount ?? clientSecret.length, $asterisk);
|
||||||
|
secret = String.fromCharCodes(codeUnits);
|
||||||
|
}
|
||||||
|
|
||||||
|
var b = StringBuffer('ExternalAuthOptions(');
|
||||||
|
b.write('clientId=$clientId');
|
||||||
|
b.write(', clientSecret=$secret');
|
||||||
|
b.write(', redirectUri=$redirectUri');
|
||||||
|
b.write(', scopes=${scopes.toList()}');
|
||||||
|
b.write(')');
|
||||||
|
return b.toString();
|
||||||
|
}
|
||||||
|
}
|
||||||
41
packages/auth/lib/src/middleware/require_auth.dart
Normal file
41
packages/auth/lib/src/middleware/require_auth.dart
Normal file
|
|
@ -0,0 +1,41 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
|
||||||
|
/// Forces Basic authentication over the requested resource, with the given [realm] name, if no JWT is present.
|
||||||
|
///
|
||||||
|
/// [realm] defaults to `'angel_auth'`.
|
||||||
|
RequestHandler forceBasicAuth<User>({String realm}) {
|
||||||
|
return (RequestContext req, ResponseContext res) async {
|
||||||
|
if (req.container.has<User>())
|
||||||
|
return true;
|
||||||
|
else if (req.container.has<Future<User>>()) {
|
||||||
|
await req.container.makeAsync<User>();
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
res.headers['www-authenticate'] = 'Basic realm="${realm ?? 'angel_auth'}"';
|
||||||
|
throw AngelHttpException.notAuthenticated();
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Restricts access to a resource via authentication.
|
||||||
|
RequestHandler requireAuthentication<User>() {
|
||||||
|
return (RequestContext req, ResponseContext res,
|
||||||
|
{bool throwError = true}) async {
|
||||||
|
bool _reject(ResponseContext res) {
|
||||||
|
if (throwError) {
|
||||||
|
res.statusCode = 403;
|
||||||
|
throw AngelHttpException.forbidden();
|
||||||
|
} else
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (req.container.has<User>() || req.method == 'OPTIONS')
|
||||||
|
return true;
|
||||||
|
else if (req.container.has<Future<User>>()) {
|
||||||
|
await req.container.makeAsync<User>();
|
||||||
|
return true;
|
||||||
|
} else
|
||||||
|
return _reject(res);
|
||||||
|
};
|
||||||
|
}
|
||||||
30
packages/auth/lib/src/options.dart
Normal file
30
packages/auth/lib/src/options.dart
Normal file
|
|
@ -0,0 +1,30 @@
|
||||||
|
import 'dart:async';
|
||||||
|
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'auth_token.dart';
|
||||||
|
|
||||||
|
typedef FutureOr AngelAuthCallback(
|
||||||
|
RequestContext req, ResponseContext res, String token);
|
||||||
|
|
||||||
|
typedef FutureOr AngelAuthTokenCallback<User>(
|
||||||
|
RequestContext req, ResponseContext res, AuthToken token, User user);
|
||||||
|
|
||||||
|
class AngelAuthOptions<User> {
|
||||||
|
AngelAuthCallback callback;
|
||||||
|
AngelAuthTokenCallback<User> tokenCallback;
|
||||||
|
String successRedirect;
|
||||||
|
String failureRedirect;
|
||||||
|
|
||||||
|
/// If `false` (default: `true`), then successful authentication will return `true` and allow the
|
||||||
|
/// execution of subsequent handlers, just like any other middleware.
|
||||||
|
///
|
||||||
|
/// Works well with `Basic` authentication.
|
||||||
|
bool canRespondWithJson;
|
||||||
|
|
||||||
|
AngelAuthOptions(
|
||||||
|
{this.callback,
|
||||||
|
this.tokenCallback,
|
||||||
|
this.canRespondWithJson = true,
|
||||||
|
this.successRedirect,
|
||||||
|
String this.failureRedirect});
|
||||||
|
}
|
||||||
449
packages/auth/lib/src/plugin.dart
Normal file
449
packages/auth/lib/src/plugin.dart
Normal file
|
|
@ -0,0 +1,449 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'dart:io';
|
||||||
|
import 'dart:math' as Math;
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'package:crypto/crypto.dart';
|
||||||
|
import 'auth_token.dart';
|
||||||
|
import 'options.dart';
|
||||||
|
import 'strategy.dart';
|
||||||
|
|
||||||
|
/// Handles authentication within an Angel application.
|
||||||
|
class AngelAuth<User> {
|
||||||
|
Hmac _hs256;
|
||||||
|
int _jwtLifeSpan;
|
||||||
|
final StreamController<User> _onLogin = StreamController<User>(),
|
||||||
|
_onLogout = StreamController<User>();
|
||||||
|
Math.Random _random = Math.Random.secure();
|
||||||
|
final RegExp _rgxBearer = RegExp(r"^Bearer");
|
||||||
|
|
||||||
|
/// If `true` (default), then JWT's will be stored and retrieved from a `token` cookie.
|
||||||
|
final bool allowCookie;
|
||||||
|
|
||||||
|
/// If `true` (default), then users can include a JWT in the query string as `token`.
|
||||||
|
final bool allowTokenInQuery;
|
||||||
|
|
||||||
|
/// Whether emitted cookies should have the `secure` and `HttpOnly` flags,
|
||||||
|
/// as well as being restricted to a specific domain.
|
||||||
|
final bool secureCookies;
|
||||||
|
|
||||||
|
/// A domain to restrict emitted cookies to.
|
||||||
|
///
|
||||||
|
/// Only applies if [allowCookie] is `true`.
|
||||||
|
final String cookieDomain;
|
||||||
|
|
||||||
|
/// A path to restrict emitted cookies to.
|
||||||
|
///
|
||||||
|
/// Only applies if [allowCookie] is `true`.
|
||||||
|
final String cookiePath;
|
||||||
|
|
||||||
|
/// If `true` (default), then JWT's will be considered invalid if used from a different IP than the first user's it was issued to.
|
||||||
|
///
|
||||||
|
/// This is a security provision. Even if a user's JWT is stolen, a remote attacker will not be able to impersonate anyone.
|
||||||
|
final bool enforceIp;
|
||||||
|
|
||||||
|
/// The endpoint to mount [reviveJwt] at. If `null`, then no revival route is mounted. Default: `/auth/token`.
|
||||||
|
String reviveTokenEndpoint;
|
||||||
|
|
||||||
|
/// A set of [AuthStrategy] instances used to authenticate users.
|
||||||
|
Map<String, AuthStrategy<User>> strategies = {};
|
||||||
|
|
||||||
|
/// Serializes a user into a unique identifier associated only with one identity.
|
||||||
|
FutureOr Function(User) serializer;
|
||||||
|
|
||||||
|
/// Deserializes a unique identifier into its associated identity. In most cases, this is a user object or model instance.
|
||||||
|
FutureOr<User> Function(Object) deserializer;
|
||||||
|
|
||||||
|
/// Fires the result of [deserializer] whenever a user signs in to the application.
|
||||||
|
Stream<User> get onLogin => _onLogin.stream;
|
||||||
|
|
||||||
|
/// Fires `req.user`, which is usually the result of [deserializer], whenever a user signs out of the application.
|
||||||
|
Stream<User> get onLogout => _onLogout.stream;
|
||||||
|
|
||||||
|
/// The [Hmac] being used to encode JWT's.
|
||||||
|
Hmac get hmac => _hs256;
|
||||||
|
|
||||||
|
String _randomString(
|
||||||
|
{int length = 32,
|
||||||
|
String validChars =
|
||||||
|
"ABCDEFHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_"}) {
|
||||||
|
var chars = <int>[];
|
||||||
|
while (chars.length < length) chars.add(_random.nextInt(validChars.length));
|
||||||
|
return String.fromCharCodes(chars);
|
||||||
|
}
|
||||||
|
|
||||||
|
/// `jwtLifeSpan` - should be in *milliseconds*.
|
||||||
|
AngelAuth(
|
||||||
|
{String jwtKey,
|
||||||
|
this.serializer,
|
||||||
|
this.deserializer,
|
||||||
|
num jwtLifeSpan,
|
||||||
|
this.allowCookie = true,
|
||||||
|
this.allowTokenInQuery = true,
|
||||||
|
this.enforceIp = true,
|
||||||
|
this.cookieDomain,
|
||||||
|
this.cookiePath = '/',
|
||||||
|
this.secureCookies = true,
|
||||||
|
this.reviveTokenEndpoint = "/auth/token"})
|
||||||
|
: super() {
|
||||||
|
_hs256 = Hmac(sha256, (jwtKey ?? _randomString()).codeUnits);
|
||||||
|
_jwtLifeSpan = jwtLifeSpan?.toInt() ?? -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Configures an Angel server to decode and validate JSON Web tokens on demand,
|
||||||
|
/// whenever an instance of [User] is injected.
|
||||||
|
Future<void> configureServer(Angel app) async {
|
||||||
|
if (serializer == null)
|
||||||
|
throw StateError(
|
||||||
|
'An `AngelAuth` plug-in was called without its `serializer` being set. All authentication will fail.');
|
||||||
|
if (deserializer == null)
|
||||||
|
throw StateError(
|
||||||
|
'An `AngelAuth` plug-in was called without its `deserializer` being set. All authentication will fail.');
|
||||||
|
|
||||||
|
app.container.registerSingleton(this);
|
||||||
|
if (runtimeType != AngelAuth)
|
||||||
|
app.container.registerSingleton(this, as: AngelAuth);
|
||||||
|
|
||||||
|
if (!app.container.has<_AuthResult<User>>()) {
|
||||||
|
app.container
|
||||||
|
.registerLazySingleton<Future<_AuthResult<User>>>((container) async {
|
||||||
|
var req = container.make<RequestContext>();
|
||||||
|
var res = container.make<ResponseContext>();
|
||||||
|
var result = await _decodeJwt(req, res);
|
||||||
|
if (result != null) {
|
||||||
|
return result;
|
||||||
|
} else {
|
||||||
|
throw AngelHttpException.forbidden();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
app.container.registerLazySingleton<Future<User>>((container) async {
|
||||||
|
var result = await container.makeAsync<_AuthResult<User>>();
|
||||||
|
return result.user;
|
||||||
|
});
|
||||||
|
|
||||||
|
app.container.registerLazySingleton<Future<AuthToken>>((container) async {
|
||||||
|
var result = await container.makeAsync<_AuthResult<User>>();
|
||||||
|
return result.token;
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
if (reviveTokenEndpoint != null) {
|
||||||
|
app.post(reviveTokenEndpoint, reviveJwt);
|
||||||
|
}
|
||||||
|
|
||||||
|
app.shutdownHooks.add((_) {
|
||||||
|
_onLogin.close();
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
void _apply(
|
||||||
|
RequestContext req, ResponseContext res, AuthToken token, User user) {
|
||||||
|
if (!req.container.has<User>()) {
|
||||||
|
req.container.registerSingleton<User>(user);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!req.container.has<AuthToken>()) {
|
||||||
|
req.container.registerSingleton<AuthToken>(token);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (allowCookie == true) {
|
||||||
|
_addProtectedCookie(res, 'token', token.serialize(_hs256));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// DEPRECATED: A middleware that decodes a JWT from a request, and injects a corresponding user.
|
||||||
|
///
|
||||||
|
/// Now that `package:angel_framework` supports asynchronous injections, this middleware
|
||||||
|
/// is no longer directly necessary. Instead, call [configureServer]. You can then use
|
||||||
|
/// `makeAsync<User>`, or Angel's injections directly:
|
||||||
|
///
|
||||||
|
/// ```dart
|
||||||
|
/// var auth = AngelAuth<User>(...);
|
||||||
|
/// await app.configure(auth.configureServer);
|
||||||
|
///
|
||||||
|
/// app.get('/hmm', (User user) async {
|
||||||
|
/// // `package:angel_auth` decodes the JWT on demand.
|
||||||
|
/// print(user.name);
|
||||||
|
/// });
|
||||||
|
///
|
||||||
|
/// @Expose('/my')
|
||||||
|
/// class MyController extends Controller {
|
||||||
|
/// @Expose('/hmm')
|
||||||
|
/// String getUsername(User user) => user.name
|
||||||
|
/// }
|
||||||
|
/// ```
|
||||||
|
@deprecated
|
||||||
|
Future decodeJwt(RequestContext req, ResponseContext res) async {
|
||||||
|
if (req.method == "POST" && req.path == reviveTokenEndpoint) {
|
||||||
|
return await reviveJwt(req, res);
|
||||||
|
} else {
|
||||||
|
await _decodeJwt(req, res);
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Future<_AuthResult<User>> _decodeJwt(
|
||||||
|
RequestContext req, ResponseContext res) async {
|
||||||
|
String jwt = getJwt(req);
|
||||||
|
|
||||||
|
if (jwt != null) {
|
||||||
|
var token = AuthToken.validate(jwt, _hs256);
|
||||||
|
|
||||||
|
if (enforceIp) {
|
||||||
|
if (req.ip != null && req.ip != token.ipAddress)
|
||||||
|
throw AngelHttpException.forbidden(
|
||||||
|
message: "JWT cannot be accessed from this IP address.");
|
||||||
|
}
|
||||||
|
|
||||||
|
if (token.lifeSpan > -1) {
|
||||||
|
var expiry =
|
||||||
|
token.issuedAt.add(Duration(milliseconds: token.lifeSpan.toInt()));
|
||||||
|
|
||||||
|
if (!expiry.isAfter(DateTime.now()))
|
||||||
|
throw AngelHttpException.forbidden(message: "Expired JWT.");
|
||||||
|
}
|
||||||
|
|
||||||
|
var user = await deserializer(token.userId);
|
||||||
|
_apply(req, res, token, user);
|
||||||
|
return _AuthResult(user, token);
|
||||||
|
}
|
||||||
|
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Retrieves a JWT from a request, if any was sent at all.
|
||||||
|
String getJwt(RequestContext req) {
|
||||||
|
if (req.headers.value("Authorization") != null) {
|
||||||
|
final authHeader = req.headers.value("Authorization");
|
||||||
|
|
||||||
|
// Allow Basic auth to fall through
|
||||||
|
if (_rgxBearer.hasMatch(authHeader))
|
||||||
|
return authHeader.replaceAll(_rgxBearer, "").trim();
|
||||||
|
} else if (allowCookie &&
|
||||||
|
req.cookies.any((cookie) => cookie.name == "token")) {
|
||||||
|
return req.cookies.firstWhere((cookie) => cookie.name == "token").value;
|
||||||
|
} else if (allowTokenInQuery &&
|
||||||
|
req.uri.queryParameters['token'] is String) {
|
||||||
|
return req.uri.queryParameters['token']?.toString();
|
||||||
|
}
|
||||||
|
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
void _addProtectedCookie(ResponseContext res, String name, String value) {
|
||||||
|
if (!res.cookies.any((c) => c.name == name)) {
|
||||||
|
res.cookies.add(protectCookie(Cookie(name, value)));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Applies security protections to a [cookie].
|
||||||
|
Cookie protectCookie(Cookie cookie) {
|
||||||
|
if (secureCookies != false) {
|
||||||
|
cookie.httpOnly = true;
|
||||||
|
cookie.secure = true;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (_jwtLifeSpan > 0) {
|
||||||
|
cookie.maxAge ??= _jwtLifeSpan < 0 ? -1 : _jwtLifeSpan ~/ 1000;
|
||||||
|
cookie.expires ??=
|
||||||
|
DateTime.now().add(Duration(milliseconds: _jwtLifeSpan));
|
||||||
|
}
|
||||||
|
|
||||||
|
cookie.domain ??= cookieDomain;
|
||||||
|
cookie.path ??= cookiePath;
|
||||||
|
return cookie;
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Attempts to revive an expired (or still alive) JWT.
|
||||||
|
Future<Map<String, dynamic>> reviveJwt(
|
||||||
|
RequestContext req, ResponseContext res) async {
|
||||||
|
try {
|
||||||
|
var jwt = getJwt(req);
|
||||||
|
|
||||||
|
if (jwt == null) {
|
||||||
|
var body = await req.parseBody().then((_) => req.bodyAsMap);
|
||||||
|
jwt = body['token']?.toString();
|
||||||
|
}
|
||||||
|
if (jwt == null) {
|
||||||
|
throw AngelHttpException.forbidden(message: "No JWT provided");
|
||||||
|
} else {
|
||||||
|
var token = AuthToken.validate(jwt, _hs256);
|
||||||
|
if (enforceIp) {
|
||||||
|
if (req.ip != token.ipAddress)
|
||||||
|
throw AngelHttpException.forbidden(
|
||||||
|
message: "JWT cannot be accessed from this IP address.");
|
||||||
|
}
|
||||||
|
|
||||||
|
if (token.lifeSpan > -1) {
|
||||||
|
var expiry = token.issuedAt
|
||||||
|
.add(Duration(milliseconds: token.lifeSpan.toInt()));
|
||||||
|
|
||||||
|
if (!expiry.isAfter(DateTime.now())) {
|
||||||
|
//print(
|
||||||
|
// 'Token has indeed expired! Resetting assignment date to current timestamp...');
|
||||||
|
// Extend its lifespan by changing iat
|
||||||
|
token.issuedAt = DateTime.now();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (allowCookie) {
|
||||||
|
_addProtectedCookie(res, 'token', token.serialize(_hs256));
|
||||||
|
}
|
||||||
|
|
||||||
|
final data = await deserializer(token.userId);
|
||||||
|
return {'data': data, 'token': token.serialize(_hs256)};
|
||||||
|
}
|
||||||
|
} catch (e) {
|
||||||
|
if (e is AngelHttpException) rethrow;
|
||||||
|
throw AngelHttpException.badRequest(message: "Malformed JWT");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Attempts to authenticate a user using one or more strategies.
|
||||||
|
///
|
||||||
|
/// [type] is a strategy name to try, or a `List` of such.
|
||||||
|
///
|
||||||
|
/// If a strategy returns `null` or `false`, either the next one is tried,
|
||||||
|
/// or a `401 Not Authenticated` is thrown, if it is the last one.
|
||||||
|
///
|
||||||
|
/// Any other result is considered an authenticated user, and terminates the loop.
|
||||||
|
RequestHandler authenticate(type, [AngelAuthOptions<User> options]) {
|
||||||
|
return (RequestContext req, ResponseContext res) async {
|
||||||
|
List<String> names = [];
|
||||||
|
var arr = type is Iterable
|
||||||
|
? type.map((x) => x.toString()).toList()
|
||||||
|
: [type.toString()];
|
||||||
|
|
||||||
|
for (String t in arr) {
|
||||||
|
var n = t
|
||||||
|
.split(',')
|
||||||
|
.map((s) => s.trim())
|
||||||
|
.where((String s) => s.isNotEmpty)
|
||||||
|
.toList();
|
||||||
|
names.addAll(n);
|
||||||
|
}
|
||||||
|
|
||||||
|
for (int i = 0; i < names.length; i++) {
|
||||||
|
var name = names[i];
|
||||||
|
|
||||||
|
var strategy = strategies[name] ??=
|
||||||
|
throw ArgumentError('No strategy "$name" found.');
|
||||||
|
|
||||||
|
var hasExisting = req.container.has<User>();
|
||||||
|
var result = hasExisting
|
||||||
|
? req.container.make<User>()
|
||||||
|
: await strategy.authenticate(req, res, options);
|
||||||
|
if (result == true)
|
||||||
|
return result;
|
||||||
|
else if (result != false && result != null) {
|
||||||
|
var userId = await serializer(result);
|
||||||
|
|
||||||
|
// Create JWT
|
||||||
|
var token = AuthToken(
|
||||||
|
userId: userId, lifeSpan: _jwtLifeSpan, ipAddress: req.ip);
|
||||||
|
var jwt = token.serialize(_hs256);
|
||||||
|
|
||||||
|
if (options?.tokenCallback != null) {
|
||||||
|
if (!req.container.has<User>()) {
|
||||||
|
req.container.registerSingleton<User>(result);
|
||||||
|
}
|
||||||
|
|
||||||
|
var r = await options.tokenCallback(req, res, token, result);
|
||||||
|
if (r != null) return r;
|
||||||
|
jwt = token.serialize(_hs256);
|
||||||
|
}
|
||||||
|
|
||||||
|
_apply(req, res, token, result);
|
||||||
|
|
||||||
|
if (allowCookie) {
|
||||||
|
_addProtectedCookie(res, 'token', jwt);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (options?.callback != null) {
|
||||||
|
return await options.callback(req, res, jwt);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (options?.successRedirect?.isNotEmpty == true) {
|
||||||
|
await res.redirect(options.successRedirect);
|
||||||
|
return false;
|
||||||
|
} else if (options?.canRespondWithJson != false &&
|
||||||
|
req.accepts('application/json')) {
|
||||||
|
var user = hasExisting
|
||||||
|
? result
|
||||||
|
: await deserializer(await serializer(result));
|
||||||
|
_onLogin.add(user);
|
||||||
|
return {"data": user, "token": jwt};
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
} else {
|
||||||
|
if (i < names.length - 1) continue;
|
||||||
|
// Check if not redirect
|
||||||
|
if (res.statusCode == 301 ||
|
||||||
|
res.statusCode == 302 ||
|
||||||
|
res.headers.containsKey('location'))
|
||||||
|
return false;
|
||||||
|
else if (options?.failureRedirect != null) {
|
||||||
|
await res.redirect(options.failureRedirect);
|
||||||
|
return false;
|
||||||
|
} else
|
||||||
|
throw AngelHttpException.notAuthenticated();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Log a user in on-demand.
|
||||||
|
Future login(AuthToken token, RequestContext req, ResponseContext res) async {
|
||||||
|
var user = await deserializer(token.userId);
|
||||||
|
_apply(req, res, token, user);
|
||||||
|
_onLogin.add(user);
|
||||||
|
|
||||||
|
if (allowCookie) {
|
||||||
|
_addProtectedCookie(res, 'token', token.serialize(_hs256));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Log a user in on-demand.
|
||||||
|
Future loginById(userId, RequestContext req, ResponseContext res) async {
|
||||||
|
var user = await deserializer(userId);
|
||||||
|
var token =
|
||||||
|
AuthToken(userId: userId, lifeSpan: _jwtLifeSpan, ipAddress: req.ip);
|
||||||
|
_apply(req, res, token, user);
|
||||||
|
_onLogin.add(user);
|
||||||
|
|
||||||
|
if (allowCookie) {
|
||||||
|
_addProtectedCookie(res, 'token', token.serialize(_hs256));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/// Log an authenticated user out.
|
||||||
|
RequestHandler logout([AngelAuthOptions<User> options]) {
|
||||||
|
return (RequestContext req, ResponseContext res) async {
|
||||||
|
if (req.container.has<User>()) {
|
||||||
|
var user = req.container.make<User>();
|
||||||
|
_onLogout.add(user);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (allowCookie == true) {
|
||||||
|
res.cookies.removeWhere((cookie) => cookie.name == "token");
|
||||||
|
_addProtectedCookie(res, 'token', '""');
|
||||||
|
}
|
||||||
|
|
||||||
|
if (options != null &&
|
||||||
|
options.successRedirect != null &&
|
||||||
|
options.successRedirect.isNotEmpty) {
|
||||||
|
await res.redirect(options.successRedirect);
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class _AuthResult<User> {
|
||||||
|
final User user;
|
||||||
|
final AuthToken token;
|
||||||
|
|
||||||
|
_AuthResult(this.user, this.token);
|
||||||
|
}
|
||||||
36
packages/auth/lib/src/popup_page.dart
Normal file
36
packages/auth/lib/src/popup_page.dart
Normal file
|
|
@ -0,0 +1,36 @@
|
||||||
|
import 'dart:convert';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'package:http_parser/http_parser.dart';
|
||||||
|
import 'options.dart';
|
||||||
|
|
||||||
|
/// Displays a default callback page to confirm authentication via popups.
|
||||||
|
AngelAuthCallback confirmPopupAuthentication({String eventName = 'token'}) {
|
||||||
|
return (req, ResponseContext res, String jwt) {
|
||||||
|
var evt = json.encode(eventName);
|
||||||
|
var detail = json.encode({'detail': jwt});
|
||||||
|
|
||||||
|
res
|
||||||
|
..contentType = MediaType('text', 'html')
|
||||||
|
..write('''
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
|
<title>Authentication Success</title>
|
||||||
|
<script>
|
||||||
|
var ev = new CustomEvent($evt, $detail);
|
||||||
|
window.opener.dispatchEvent(ev);
|
||||||
|
window.close();
|
||||||
|
</script>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<h1>Authentication Success</h1>
|
||||||
|
<p>
|
||||||
|
Now logging you in... If you continue to see this page, you may need to enable JavaScript.
|
||||||
|
</p>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
''');
|
||||||
|
return false;
|
||||||
|
};
|
||||||
|
}
|
||||||
97
packages/auth/lib/src/strategies/local.dart
Normal file
97
packages/auth/lib/src/strategies/local.dart
Normal file
|
|
@ -0,0 +1,97 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'dart:convert';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import '../options.dart';
|
||||||
|
import '../strategy.dart';
|
||||||
|
|
||||||
|
bool _validateString(String str) => str != null && str.isNotEmpty;
|
||||||
|
|
||||||
|
/// Determines the validity of an incoming username and password.
|
||||||
|
typedef FutureOr<User> LocalAuthVerifier<User>(
|
||||||
|
String username, String password);
|
||||||
|
|
||||||
|
class LocalAuthStrategy<User> extends AuthStrategy<User> {
|
||||||
|
RegExp _rgxBasic = RegExp(r'^Basic (.+)$', caseSensitive: false);
|
||||||
|
RegExp _rgxUsrPass = RegExp(r'^([^:]+):(.+)$');
|
||||||
|
|
||||||
|
LocalAuthVerifier<User> verifier;
|
||||||
|
String usernameField;
|
||||||
|
String passwordField;
|
||||||
|
String invalidMessage;
|
||||||
|
final bool allowBasic;
|
||||||
|
final bool forceBasic;
|
||||||
|
String realm;
|
||||||
|
|
||||||
|
LocalAuthStrategy(this.verifier,
|
||||||
|
{String this.usernameField = 'username',
|
||||||
|
String this.passwordField = 'password',
|
||||||
|
String this.invalidMessage =
|
||||||
|
'Please provide a valid username and password.',
|
||||||
|
bool this.allowBasic = true,
|
||||||
|
bool this.forceBasic = false,
|
||||||
|
String this.realm = 'Authentication is required.'});
|
||||||
|
|
||||||
|
@override
|
||||||
|
Future<User> authenticate(RequestContext req, ResponseContext res,
|
||||||
|
[AngelAuthOptions options_]) async {
|
||||||
|
AngelAuthOptions options = options_ ?? AngelAuthOptions();
|
||||||
|
User verificationResult;
|
||||||
|
|
||||||
|
if (allowBasic) {
|
||||||
|
String authHeader = req.headers.value('authorization') ?? "";
|
||||||
|
|
||||||
|
if (_rgxBasic.hasMatch(authHeader)) {
|
||||||
|
String base64AuthString = _rgxBasic.firstMatch(authHeader).group(1);
|
||||||
|
String authString =
|
||||||
|
String.fromCharCodes(base64.decode(base64AuthString));
|
||||||
|
if (_rgxUsrPass.hasMatch(authString)) {
|
||||||
|
Match usrPassMatch = _rgxUsrPass.firstMatch(authString);
|
||||||
|
verificationResult =
|
||||||
|
await verifier(usrPassMatch.group(1), usrPassMatch.group(2));
|
||||||
|
} else
|
||||||
|
throw AngelHttpException.badRequest(errors: [invalidMessage]);
|
||||||
|
|
||||||
|
if (verificationResult == false || verificationResult == null) {
|
||||||
|
res
|
||||||
|
..statusCode = 401
|
||||||
|
..headers['www-authenticate'] = 'Basic realm="$realm"';
|
||||||
|
await res.close();
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
return verificationResult;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (verificationResult == null) {
|
||||||
|
var body = await req
|
||||||
|
.parseBody()
|
||||||
|
.then((_) => req.bodyAsMap)
|
||||||
|
.catchError((_) => <String, dynamic>{});
|
||||||
|
if (_validateString(body[usernameField]?.toString()) &&
|
||||||
|
_validateString(body[passwordField]?.toString())) {
|
||||||
|
verificationResult = await verifier(
|
||||||
|
body[usernameField]?.toString(), body[passwordField]?.toString());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (verificationResult == false || verificationResult == null) {
|
||||||
|
if (options.failureRedirect != null &&
|
||||||
|
options.failureRedirect.isNotEmpty) {
|
||||||
|
await res.redirect(options.failureRedirect, code: 401);
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (forceBasic) {
|
||||||
|
res.headers['www-authenticate'] = 'Basic realm="$realm"';
|
||||||
|
throw AngelHttpException.notAuthenticated();
|
||||||
|
}
|
||||||
|
|
||||||
|
return null;
|
||||||
|
} else if (verificationResult != null && verificationResult != false) {
|
||||||
|
return verificationResult;
|
||||||
|
} else {
|
||||||
|
throw AngelHttpException.notAuthenticated();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
1
packages/auth/lib/src/strategies/strategies.dart
Normal file
1
packages/auth/lib/src/strategies/strategies.dart
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
export 'local.dart';
|
||||||
10
packages/auth/lib/src/strategy.dart
Normal file
10
packages/auth/lib/src/strategy.dart
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'options.dart';
|
||||||
|
|
||||||
|
/// A function that handles login and signup for an Angel application.
|
||||||
|
abstract class AuthStrategy<User> {
|
||||||
|
/// Authenticates or rejects an incoming user.
|
||||||
|
FutureOr<User> authenticate(RequestContext req, ResponseContext res,
|
||||||
|
[AngelAuthOptions<User> options]);
|
||||||
|
}
|
||||||
21
packages/auth/pubspec.yaml
Normal file
21
packages/auth/pubspec.yaml
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
name: angel_auth
|
||||||
|
description: A complete authentication plugin for Angel. Includes support for stateless JWT tokens, Basic Auth, and more.
|
||||||
|
version: 2.1.5+1
|
||||||
|
author: Tobe O <thosakwe@gmail.com>
|
||||||
|
homepage: https://github.com/angel-dart/angel_auth
|
||||||
|
environment:
|
||||||
|
sdk: ">=2.0.0-dev <3.0.0"
|
||||||
|
dependencies:
|
||||||
|
angel_framework: ^2.0.0-rc.6
|
||||||
|
charcode: ^1.0.0
|
||||||
|
collection: ^1.0.0
|
||||||
|
crypto: ^2.0.0
|
||||||
|
http_parser: ^3.0.0
|
||||||
|
meta: ^1.0.0
|
||||||
|
quiver_hashcode: ^2.0.0
|
||||||
|
dev_dependencies:
|
||||||
|
http: ^0.12.0
|
||||||
|
io: ^0.3.2
|
||||||
|
logging: ^0.11.0
|
||||||
|
pedantic: ^1.0.0
|
||||||
|
test: ^1.0.0
|
||||||
34
packages/auth/test/auth_token_test.dart
Normal file
34
packages/auth/test/auth_token_test.dart
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
import "package:angel_auth/src/auth_token.dart";
|
||||||
|
import "package:crypto/crypto.dart";
|
||||||
|
import "package:test/test.dart";
|
||||||
|
|
||||||
|
main() async {
|
||||||
|
final Hmac hmac = Hmac(sha256, "angel_auth".codeUnits);
|
||||||
|
|
||||||
|
test("sample serialization", () {
|
||||||
|
var token = AuthToken(ipAddress: "localhost", userId: "thosakwe");
|
||||||
|
var jwt = token.serialize(hmac);
|
||||||
|
print(jwt);
|
||||||
|
|
||||||
|
var parsed = AuthToken.validate(jwt, hmac);
|
||||||
|
print(parsed.toJson());
|
||||||
|
expect(parsed.toJson()['aud'], equals(token.ipAddress));
|
||||||
|
expect(parsed.toJson()['sub'], equals(token.userId));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('custom payload', () {
|
||||||
|
var token = AuthToken(ipAddress: "localhost", userId: "thosakwe", payload: {
|
||||||
|
"foo": "bar",
|
||||||
|
"baz": {
|
||||||
|
"one": 1,
|
||||||
|
"franken": ["stein"]
|
||||||
|
}
|
||||||
|
});
|
||||||
|
var jwt = token.serialize(hmac);
|
||||||
|
print(jwt);
|
||||||
|
|
||||||
|
var parsed = AuthToken.validate(jwt, hmac);
|
||||||
|
print(parsed.toJson());
|
||||||
|
expect(parsed.toJson()['pld'], equals(token.payload));
|
||||||
|
});
|
||||||
|
}
|
||||||
141
packages/auth/test/callback_test.dart
Normal file
141
packages/auth/test/callback_test.dart
Normal file
|
|
@ -0,0 +1,141 @@
|
||||||
|
import 'dart:io';
|
||||||
|
import 'package:angel_auth/angel_auth.dart';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'package:angel_framework/http.dart';
|
||||||
|
import 'dart:convert';
|
||||||
|
import 'package:http/http.dart' as http;
|
||||||
|
import 'package:io/ansi.dart';
|
||||||
|
import 'package:logging/logging.dart';
|
||||||
|
import 'package:test/test.dart';
|
||||||
|
|
||||||
|
class User extends Model {
|
||||||
|
String username, password;
|
||||||
|
|
||||||
|
User({this.username, this.password});
|
||||||
|
|
||||||
|
static User parse(Map map) {
|
||||||
|
return User(
|
||||||
|
username: map['username'] as String,
|
||||||
|
password: map['password'] as String,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
Map<String, dynamic> toJson() {
|
||||||
|
return {
|
||||||
|
'id': id,
|
||||||
|
'username': username,
|
||||||
|
'password': password,
|
||||||
|
'created_at': createdAt?.toIso8601String(),
|
||||||
|
'updated_at': updatedAt?.toIso8601String()
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
main() {
|
||||||
|
Angel app;
|
||||||
|
AngelHttp angelHttp;
|
||||||
|
AngelAuth<User> auth;
|
||||||
|
http.Client client;
|
||||||
|
HttpServer server;
|
||||||
|
String url;
|
||||||
|
|
||||||
|
setUp(() async {
|
||||||
|
hierarchicalLoggingEnabled = true;
|
||||||
|
app = Angel();
|
||||||
|
angelHttp = AngelHttp(app);
|
||||||
|
app.use('/users', MapService());
|
||||||
|
|
||||||
|
var oldErrorHandler = app.errorHandler;
|
||||||
|
app.errorHandler = (e, req, res) {
|
||||||
|
app.logger.severe(e.message, e, e.stackTrace ?? StackTrace.current);
|
||||||
|
return oldErrorHandler(e, req, res);
|
||||||
|
};
|
||||||
|
|
||||||
|
app.logger = Logger('angel_auth')
|
||||||
|
..level = Level.FINEST
|
||||||
|
..onRecord.listen((rec) {
|
||||||
|
print(rec);
|
||||||
|
|
||||||
|
if (rec.error != null) {
|
||||||
|
print(yellow.wrap(rec.error.toString()));
|
||||||
|
}
|
||||||
|
|
||||||
|
if (rec.stackTrace != null) {
|
||||||
|
print(yellow.wrap(rec.stackTrace.toString()));
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
await app
|
||||||
|
.findService('users')
|
||||||
|
.create({'username': 'jdoe1', 'password': 'password'});
|
||||||
|
|
||||||
|
auth = AngelAuth<User>();
|
||||||
|
auth.serializer = (u) => u.id;
|
||||||
|
auth.deserializer =
|
||||||
|
(id) async => await app.findService('users').read(id) as User;
|
||||||
|
|
||||||
|
await app.configure(auth.configureServer);
|
||||||
|
|
||||||
|
auth.strategies['local'] = LocalAuthStrategy((username, password) async {
|
||||||
|
var users = await app
|
||||||
|
.findService('users')
|
||||||
|
.index()
|
||||||
|
.then((it) => it.map<User>((m) => User.parse(m as Map)).toList());
|
||||||
|
return users.firstWhere(
|
||||||
|
(user) => user.username == username && user.password == password,
|
||||||
|
orElse: () => null);
|
||||||
|
});
|
||||||
|
|
||||||
|
app.post(
|
||||||
|
'/login',
|
||||||
|
auth.authenticate('local',
|
||||||
|
AngelAuthOptions(callback: (req, res, token) {
|
||||||
|
res
|
||||||
|
..write('Hello!')
|
||||||
|
..close();
|
||||||
|
})));
|
||||||
|
|
||||||
|
app.chain([
|
||||||
|
(req, res) {
|
||||||
|
if (!req.container.has<User>()) {
|
||||||
|
req.container.registerSingleton<User>(
|
||||||
|
User(username: req.params['name']?.toString()));
|
||||||
|
}
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
]).post(
|
||||||
|
'/existing/:name',
|
||||||
|
auth.authenticate('local'),
|
||||||
|
);
|
||||||
|
|
||||||
|
client = http.Client();
|
||||||
|
server = await angelHttp.startServer();
|
||||||
|
url = 'http://${server.address.address}:${server.port}';
|
||||||
|
});
|
||||||
|
|
||||||
|
tearDown(() async {
|
||||||
|
client.close();
|
||||||
|
await angelHttp.close();
|
||||||
|
app = null;
|
||||||
|
client = null;
|
||||||
|
url = null;
|
||||||
|
});
|
||||||
|
|
||||||
|
test('login', () async {
|
||||||
|
final response = await client.post('$url/login',
|
||||||
|
body: {'username': 'jdoe1', 'password': 'password'});
|
||||||
|
print('Response: ${response.body}');
|
||||||
|
expect(response.body, equals('Hello!'));
|
||||||
|
},
|
||||||
|
skip: Platform.version.contains('2.0.0-dev')
|
||||||
|
? 'Blocked on https://github.com/dart-lang/sdk/issues/33594'
|
||||||
|
: null);
|
||||||
|
|
||||||
|
test('preserve existing user', () async {
|
||||||
|
final response = await client.post('$url/existing/foo',
|
||||||
|
body: {'username': 'jdoe1', 'password': 'password'},
|
||||||
|
headers: {'accept': 'application/json'});
|
||||||
|
print('Response: ${response.body}');
|
||||||
|
expect(json.decode(response.body)['data']['username'], equals('foo'));
|
||||||
|
});
|
||||||
|
}
|
||||||
162
packages/auth/test/config_test.dart
Normal file
162
packages/auth/test/config_test.dart
Normal file
|
|
@ -0,0 +1,162 @@
|
||||||
|
import 'package:angel_auth/angel_auth.dart';
|
||||||
|
import 'package:test/test.dart';
|
||||||
|
|
||||||
|
void main() {
|
||||||
|
var options = ExternalAuthOptions(
|
||||||
|
clientId: 'foo',
|
||||||
|
clientSecret: 'bar',
|
||||||
|
redirectUri: 'http://example.com',
|
||||||
|
);
|
||||||
|
|
||||||
|
test('parses uri', () {
|
||||||
|
expect(options.redirectUri, Uri(scheme: 'http', host: 'example.com'));
|
||||||
|
});
|
||||||
|
|
||||||
|
group('copyWith', () {
|
||||||
|
test('empty produces exact copy', () {
|
||||||
|
expect(options.copyWith(), options);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('all fields', () {
|
||||||
|
expect(
|
||||||
|
options.copyWith(
|
||||||
|
clientId: 'hey',
|
||||||
|
clientSecret: 'hello',
|
||||||
|
redirectUri: 'https://yes.no',
|
||||||
|
scopes: ['a', 'b'],
|
||||||
|
),
|
||||||
|
ExternalAuthOptions(
|
||||||
|
clientId: 'hey',
|
||||||
|
clientSecret: 'hello',
|
||||||
|
redirectUri: 'https://yes.no',
|
||||||
|
scopes: ['a', 'b'],
|
||||||
|
),
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('not equal to original if different', () {
|
||||||
|
expect(options.copyWith(clientId: 'hey'), isNot(options));
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
group('new()', () {
|
||||||
|
test('accepts uri', () {
|
||||||
|
expect(
|
||||||
|
ExternalAuthOptions(
|
||||||
|
clientId: 'foo',
|
||||||
|
clientSecret: 'bar',
|
||||||
|
redirectUri: Uri.parse('http://example.com'),
|
||||||
|
),
|
||||||
|
options,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('accepts string', () {
|
||||||
|
expect(
|
||||||
|
ExternalAuthOptions(
|
||||||
|
clientId: 'foo',
|
||||||
|
clientSecret: 'bar',
|
||||||
|
redirectUri: 'http://example.com',
|
||||||
|
),
|
||||||
|
options,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('rejects invalid redirectUri', () {
|
||||||
|
expect(
|
||||||
|
() => ExternalAuthOptions(
|
||||||
|
clientId: 'foo', clientSecret: 'bar', redirectUri: 24.5),
|
||||||
|
throwsArgumentError,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('ensures id not null', () {
|
||||||
|
expect(
|
||||||
|
() => ExternalAuthOptions(
|
||||||
|
clientId: null,
|
||||||
|
clientSecret: 'bar',
|
||||||
|
redirectUri: 'http://example.com'),
|
||||||
|
throwsArgumentError,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('ensures secret not null', () {
|
||||||
|
expect(
|
||||||
|
() => ExternalAuthOptions(
|
||||||
|
clientId: 'foo',
|
||||||
|
clientSecret: null,
|
||||||
|
redirectUri: 'http://example.com'),
|
||||||
|
throwsArgumentError,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
group('fromMap()', () {
|
||||||
|
test('rejects invalid map', () {
|
||||||
|
expect(
|
||||||
|
() => ExternalAuthOptions.fromMap({'yes': 'no'}),
|
||||||
|
throwsArgumentError,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('accepts correct map', () {
|
||||||
|
expect(
|
||||||
|
ExternalAuthOptions.fromMap({
|
||||||
|
'client_id': 'foo',
|
||||||
|
'client_secret': 'bar',
|
||||||
|
'redirect_uri': 'http://example.com',
|
||||||
|
}),
|
||||||
|
options,
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
group('toString()', () {
|
||||||
|
test('produces correct string', () {
|
||||||
|
expect(
|
||||||
|
options.toString(obscureSecret: false),
|
||||||
|
'ExternalAuthOptions(clientId=foo, clientSecret=bar, redirectUri=http://example.com, scopes=[])',
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('obscures secret', () {
|
||||||
|
expect(
|
||||||
|
options.toString(),
|
||||||
|
'ExternalAuthOptions(clientId=foo, clientSecret=***, redirectUri=http://example.com, scopes=[])',
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('asteriskCount', () {
|
||||||
|
expect(
|
||||||
|
options.toString(asteriskCount: 7),
|
||||||
|
'ExternalAuthOptions(clientId=foo, clientSecret=*******, redirectUri=http://example.com, scopes=[])',
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
|
||||||
|
group('toJson()', () {
|
||||||
|
test('obscures secret', () {
|
||||||
|
expect(
|
||||||
|
options.toJson(),
|
||||||
|
{
|
||||||
|
'client_id': 'foo',
|
||||||
|
'client_secret': '<redacted>',
|
||||||
|
'redirect_uri': 'http://example.com',
|
||||||
|
'scopes': [],
|
||||||
|
},
|
||||||
|
);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('produces correct map', () {
|
||||||
|
expect(
|
||||||
|
options.toJson(obscureSecret: false),
|
||||||
|
{
|
||||||
|
'client_id': 'foo',
|
||||||
|
'client_secret': 'bar',
|
||||||
|
'redirect_uri': 'http://example.com',
|
||||||
|
'scopes': [],
|
||||||
|
},
|
||||||
|
);
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
124
packages/auth/test/local_test.dart
Normal file
124
packages/auth/test/local_test.dart
Normal file
|
|
@ -0,0 +1,124 @@
|
||||||
|
import 'dart:async';
|
||||||
|
import 'dart:io';
|
||||||
|
import 'package:angel_auth/angel_auth.dart';
|
||||||
|
import 'package:angel_framework/angel_framework.dart';
|
||||||
|
import 'package:angel_framework/http.dart';
|
||||||
|
import 'dart:convert';
|
||||||
|
import 'package:http/http.dart' as http;
|
||||||
|
import 'package:logging/logging.dart';
|
||||||
|
import 'package:test/test.dart';
|
||||||
|
|
||||||
|
final AngelAuth<Map<String, String>> auth = AngelAuth<Map<String, String>>();
|
||||||
|
var headers = <String, String>{'accept': 'application/json'};
|
||||||
|
var localOpts = AngelAuthOptions<Map<String, String>>(
|
||||||
|
failureRedirect: '/failure', successRedirect: '/success');
|
||||||
|
Map<String, String> sampleUser = {'hello': 'world'};
|
||||||
|
|
||||||
|
Future<Map<String, String>> verifier(String username, String password) async {
|
||||||
|
if (username == 'username' && password == 'password') {
|
||||||
|
return sampleUser;
|
||||||
|
} else
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
|
||||||
|
Future wireAuth(Angel app) async {
|
||||||
|
auth.serializer = (user) async => 1337;
|
||||||
|
auth.deserializer = (id) async => sampleUser;
|
||||||
|
|
||||||
|
auth.strategies['local'] = LocalAuthStrategy(verifier);
|
||||||
|
await app.configure(auth.configureServer);
|
||||||
|
}
|
||||||
|
|
||||||
|
main() async {
|
||||||
|
Angel app;
|
||||||
|
AngelHttp angelHttp;
|
||||||
|
http.Client client;
|
||||||
|
String url;
|
||||||
|
String basicAuthUrl;
|
||||||
|
|
||||||
|
setUp(() async {
|
||||||
|
client = http.Client();
|
||||||
|
app = Angel();
|
||||||
|
angelHttp = AngelHttp(app, useZone: false);
|
||||||
|
await app.configure(wireAuth);
|
||||||
|
app.get('/hello', (req, res) => 'Woo auth',
|
||||||
|
middleware: [auth.authenticate('local')]);
|
||||||
|
app.post('/login', (req, res) => 'This should not be shown',
|
||||||
|
middleware: [auth.authenticate('local', localOpts)]);
|
||||||
|
app.get('/success', (req, res) => "yep", middleware: [
|
||||||
|
requireAuthentication<Map<String, String>>(),
|
||||||
|
]);
|
||||||
|
app.get('/failure', (req, res) => "nope");
|
||||||
|
|
||||||
|
app.logger = Logger('angel_auth')
|
||||||
|
..onRecord.listen((rec) {
|
||||||
|
if (rec.error != null) {
|
||||||
|
print(rec.error);
|
||||||
|
print(rec.stackTrace);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
HttpServer server = await angelHttp.startServer('127.0.0.1', 0);
|
||||||
|
url = "http://${server.address.host}:${server.port}";
|
||||||
|
basicAuthUrl =
|
||||||
|
"http://username:password@${server.address.host}:${server.port}";
|
||||||
|
});
|
||||||
|
|
||||||
|
tearDown(() async {
|
||||||
|
await angelHttp.close();
|
||||||
|
client = null;
|
||||||
|
url = null;
|
||||||
|
basicAuthUrl = null;
|
||||||
|
});
|
||||||
|
|
||||||
|
test('can use "auth" as middleware', () async {
|
||||||
|
var response = await client
|
||||||
|
.get("$url/success", headers: {'Accept': 'application/json'});
|
||||||
|
print(response.body);
|
||||||
|
expect(response.statusCode, equals(403));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('successRedirect', () async {
|
||||||
|
Map postData = {'username': 'username', 'password': 'password'};
|
||||||
|
var response = await client.post("$url/login",
|
||||||
|
body: json.encode(postData),
|
||||||
|
headers: {'content-type': 'application/json'});
|
||||||
|
expect(response.statusCode, equals(302));
|
||||||
|
expect(response.headers['location'], equals('/success'));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('failureRedirect', () async {
|
||||||
|
Map postData = {'username': 'password', 'password': 'username'};
|
||||||
|
var response = await client.post("$url/login",
|
||||||
|
body: json.encode(postData),
|
||||||
|
headers: {'content-type': 'application/json'});
|
||||||
|
print("Login response: ${response.body}");
|
||||||
|
expect(response.headers['location'], equals('/failure'));
|
||||||
|
expect(response.statusCode, equals(401));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('allow basic', () async {
|
||||||
|
String authString = base64.encode("username:password".runes.toList());
|
||||||
|
var response = await client
|
||||||
|
.get("$url/hello", headers: {'authorization': 'Basic $authString'});
|
||||||
|
expect(response.body, equals('"Woo auth"'));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('allow basic via URL encoding', () async {
|
||||||
|
var response = await client.get("$basicAuthUrl/hello");
|
||||||
|
expect(response.body, equals('"Woo auth"'));
|
||||||
|
});
|
||||||
|
|
||||||
|
test('force basic', () async {
|
||||||
|
auth.strategies.clear();
|
||||||
|
auth.strategies['local'] =
|
||||||
|
LocalAuthStrategy(verifier, forceBasic: true, realm: 'test');
|
||||||
|
var response = await client.get("$url/hello", headers: {
|
||||||
|
'accept': 'application/json',
|
||||||
|
'content-type': 'application/json'
|
||||||
|
});
|
||||||
|
print(response.headers);
|
||||||
|
print('Body <${response.body}>');
|
||||||
|
expect(response.headers['www-authenticate'], equals('Basic realm="test"'));
|
||||||
|
});
|
||||||
|
}
|
||||||
44
packages/auth/test/protect_cookie_test.dart
Normal file
44
packages/auth/test/protect_cookie_test.dart
Normal file
|
|
@ -0,0 +1,44 @@
|
||||||
|
import 'dart:io';
|
||||||
|
|
||||||
|
import 'package:angel_auth/angel_auth.dart';
|
||||||
|
import 'package:test/test.dart';
|
||||||
|
|
||||||
|
const Duration threeDays = const Duration(days: 3);
|
||||||
|
|
||||||
|
void main() {
|
||||||
|
Cookie defaultCookie;
|
||||||
|
var auth = AngelAuth(
|
||||||
|
secureCookies: true,
|
||||||
|
cookieDomain: 'SECURE',
|
||||||
|
jwtLifeSpan: threeDays.inMilliseconds,
|
||||||
|
);
|
||||||
|
|
||||||
|
setUp(() => defaultCookie = Cookie('a', 'b'));
|
||||||
|
|
||||||
|
test('sets maxAge', () {
|
||||||
|
expect(auth.protectCookie(defaultCookie).maxAge, threeDays.inSeconds);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('sets expires', () {
|
||||||
|
var now = DateTime.now();
|
||||||
|
var expiry = auth.protectCookie(defaultCookie).expires;
|
||||||
|
var diff = expiry.difference(now);
|
||||||
|
expect(diff.inSeconds, threeDays.inSeconds);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('sets httpOnly', () {
|
||||||
|
expect(auth.protectCookie(defaultCookie).httpOnly, true);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('sets secure', () {
|
||||||
|
expect(auth.protectCookie(defaultCookie).secure, true);
|
||||||
|
});
|
||||||
|
|
||||||
|
test('sets domain', () {
|
||||||
|
expect(auth.protectCookie(defaultCookie).domain, 'SECURE');
|
||||||
|
});
|
||||||
|
|
||||||
|
test('preserves domain if present', () {
|
||||||
|
expect(auth.protectCookie(defaultCookie..domain = 'foo').domain, 'foo');
|
||||||
|
});
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue