Commit graph

70 commits

Author SHA1 Message Date
David Mehren
552cb05d92 refactor(api/private/tokens): validate POST data with DTO
This adds a `AuthTokenCreateDto` which allows
to fully validate incoming JSON data.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-06 22:24:21 +01:00
David Mehren
5eab4f42d6 refactor: merge AuthTokenDTOs into one file
Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-06 22:24:21 +01:00
David Mehren
de952fe3b2 feat(auth-service): accept undefined validUntil param
The `validUntil` parameter for `createTokenForUser` may be undefined
in some usages.
As it is easy to add handling for that here, this commit implements it.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-06 22:24:21 +01:00
David Mehren
7e8716ec95 fix: ensure dates are properly transformed
To correctly transform Date objects from ISO-strings in JSON
to instances, class-transformer requires the `@Type` annotation.

References:
https://github.com/typestack/class-transformer#%D1%81onverting-date-strings-into-date-objects
Signed-off-by: David Mehren <git@herrmehren.de>
2022-03-06 20:54:46 +01:00
Philip Molares
c6bb8f62e8 refactor: use a base dto class
This gives all dto classes a common super class for usage of the type system.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2022-02-20 20:56:09 +01:00
David Mehren
b0e2987987
refactor(auth-token): rename lastUsed to lastUsedAt
This is part of an effort to name all date attributes
consistently.

Signed-off-by: David Mehren <git@herrmehren.de>
2022-01-16 21:52:15 +01:00
David Mehren
3539216cf3
refactor(user): lazy-load relations
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-05 22:03:41 +01:00
David Mehren
de6d75238c
refactor(auth-token): lazy-load relations
Signed-off-by: David Mehren <git@herrmehren.de>
2021-11-16 18:39:52 +01:00
David Mehren
708ae86444
docs: explain the choice of sha-512 for auth tokens
Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-14 19:21:28 +01:00
David Mehren
b4a65b47f0
fix(auth): use sha-512 for auth tokens
Bcrypt hashes are too slow to be validated on every request.
As our tokens are random and have a fixed length, it is reasonable
to use SHA-512 instead.

SHA-512 is recommended as cryptographically strong by the BSI:
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile

Fixes https://github.com/hedgedoc/hedgedoc/issues/1881

Signed-off-by: David Mehren <git@herrmehren.de>
2021-12-09 23:04:00 +01:00
Philip Molares
b1d4696895
fix: the tests use the new typing from create methods
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-09-25 11:55:35 +02:00
Philip Molares
8cda5f99fb
fix: services use the new typings from create methods
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-09-25 11:52:42 +02:00
Philip Molares
d0b8e4cd36
feat: consolidate entities create
This was done to give better typings to the function signatures of entities `create` methods.
It also ensures that each field that should be set to `null` is set to `null` and doesn't leave that up to the typeorm handlers.

See: #1641
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-09-25 11:50:28 +02:00
Yannick Bungers
f4799c5ebe
Change createTokenForUser signature
user is now used instead of username

Signed-off-by: Yannick Bungers <git@innay.de>
2021-10-13 22:59:51 +02:00
Yannick Bungers
40103cb397
fix username spelling from userName
Signed-off-by: Yannick Bungers <git@innay.de>
2021-10-13 22:28:10 +02:00
Yannick Bungers
be27686610
change getTokensByUsername to getTokensByUser
Signed-off-by: Yannick Bungers <git@innay.de>
2021-10-13 22:22:08 +02:00
Philip Molares
5e4eb574c5
chore: add user relation enum
this enum is used to specify which relation of the user object should be populated.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-08-31 13:39:36 +02:00
Philip Molares
547f2239cc
chore: move password related functions from AuthService to utils file
As these methods will be used in both the AuthService and the IdentityService, it makes sense to extract them and use them in this manner. Especially if one considers that they are quite standalone functions.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-08-08 21:47:13 +02:00
Philip Molares
216baa42a1
refactor: move TokenAuthGuard in the same file as TokenStrategy
This should help to make clear why code is executed when the TokenAuthGuard is encountered by a request. Currently, one has to connect both files via the string 'token', which is a bit cryptic

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-09-04 18:03:41 +02:00
Yannick Bungers
3b5ccddfcc
Fix copy paste error in auth toAuthTokenDto test
Add an hour difference between createdAt and validUntil to better detect
these errors.

Signed-off-by: Yannick Bungers <git@innay.de>
2021-09-03 19:15:42 +02:00
David Mehren
9450f500d6
Cleanup some imports
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 18:57:00 +02:00
David Mehren
5ed2fae44e
Enforce import order with prettier
Signed-off-by: David Mehren <git@herrmehren.de>
2021-08-29 18:45:46 +02:00
David Mehren
f6d430c23f
Adjust tests to new Session and Author entities
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-17 22:28:35 +02:00
Philip Molares
875e848b80
refactor: Remove randomString function
This was done because it was only a wrapper for a nodejs function to check if the given parameter is a positive number.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-05-16 22:41:01 +02:00
David Mehren
eaf1852fe5
Format with Prettier 2.3
Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-15 21:13:44 +02:00
David Mehren
375cb4eae9
AuthTokenEntity: Make validUntil not nullable
As all tokens are valid for a maximum of 2 years, the
validUntil attribute is always populated.

This updates the database schema and the DTO to reflect that.

Fixes #1256

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-09 22:05:47 +02:00
David Mehren
0944f07834
Ensure optional properties of AuthTokenDto are initialized
Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 21:14:09 +02:00
David Mehren
246d053b68
Add explicit type annotations to nullable columns
TypeORM can't correctly infer the data type on properties with a `| null` type.
This commit adds explicit type annotations.

See also https://github.com/typeorm/typeorm/issues/2567#issuecomment-408599335

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 19:08:59 +02:00
David Mehren
22702b3390
Correctly type nullable columns
TypeORM columns with `nullable: true` can be `null` at runtime.
This commit ensures that the types of the corresponding properties reflect that.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 16:54:57 +02:00
David Mehren
52bb44a561
AuthService: Fix type of toAuthTokenWithSecretDto
toAuthTokenDto does not return nor accept a nullish value anymore,
so the types can be adjusted.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 16:07:58 +02:00
David Mehren
327f36af94
AuthService.randomString: Throw Error instead of returning null
A string with a negative length is invalid, so we should throw here
instead of complicating the type with a possible null return value.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 16:06:59 +02:00
David Mehren
5ee9b2a7e8
AuthTokenDto: Make properties consistently optional
validUntil and lastUsed already have a IsOptional decorator,
this makes the properties themselves also optional

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 15:55:11 +02:00
David Mehren
ef8b8d985e
AuthService: Throw NotInDBError on empty DB result
This adds error handling to various functions, so they throw a
NotInDBError instead of a TypeError

Signed-off-by: David Mehren <git@herrmehren.de>
2021-05-09 18:27:03 +02:00
David Mehren
dcc09747d2
AuthService: Remove null from toAuthTokenDto return type
toAuthTokenDto won't return null, as TS's strict mode
prevents authToken from being nullish

Signed-off-by: David Mehren <git@herrmehren.de>
2021-04-29 15:07:50 +02:00
Philip Molares
e90e2a8e19
Entities: Add onDelete CASCADE to entities
To better handle deletion of entities, all necessary other entities got the option onDelete CASCADE set. So everything that does not make any sense if something else is deleted will be deleted along side of it.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-03-11 15:03:23 +01:00
Philip Molares
846bbeb390
UnitTests: Add appConfigMock
This is necessary as the Logger needs this config for the loglevel.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-14 00:19:09 +02:00
Philip Molares
9759d85fdd
Tests: Fix eslint errors
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-12 18:05:27 +02:00
Philip Molares
ff44a6567e
Tests: Removed all eslint-disable lines
As we now disable what we don't need in the eslint config, we don't need this anymore.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-04-12 17:06:59 +02:00
David Mehren
b128efebff
Enforce explicit function return types
This re-enables the `@typescript-eslint/explicit-module-boundary-types`
check and also enables the
`@typescript-eslint/explicit-function-return-type` check.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-27 17:41:32 +01:00
David Mehren
cc1ca69bc1
Fix various ESLint errors in services
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-24 22:35:06 +01:00
David Mehren
21403ba606
Fix various ESLint errors in unit tests
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-24 20:20:04 +01:00
David Mehren
def4ef145e
AuthService: randomString does not need to by async
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-23 22:16:27 +01:00
David Mehren
fed3a12779
Add explicit Request type
Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-23 21:48:37 +01:00
David Mehren
e83f1e206b
ESLint: Enable @typescript-eslint/naming-convention rule
This check enforces consistent variable naming.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-20 21:15:45 +01:00
David Mehren
9485597e6f
ESLint: Enable @typescript-eslint/return-await rule
This ensures stack traces are helpful at the cost of a slightly
lower performance (one more tick in the event loop).

Fixes #838

Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-20 20:14:36 +01:00
Philip Molares
ba553f28da
Tests: Rewrote AuthService unit test
The unit test now uses per test mocking of the necessary functions instead of one mock in the beforeEach call.
Also some tests got expanded to cover more error cases.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-02-06 13:14:26 +01:00
David Mehren
99ddee7815
Add missing logging context at various places
Our custom logger supports providing the name of the function that
calls the logger, this commit adds this context string where it
was previously missing.

Signed-off-by: David Mehren <git@herrmehren.de>
2021-02-05 22:30:22 +01:00
Philip Molares
d457729ab7
Tests: Fix Mock Auth
This makes it possible to create the user before the mock auth guard does it's magic. This is necessary for some test, where we need the user object before the api is called.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-02-03 21:49:39 +01:00
Philip Molares
300b464efd
History: Add HistoryEntry
With this the backend now can hold a history entry.
Also included in this commit are some minor changes to tests and services so they can still work.

Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-02-03 21:15:39 +01:00
Philip Molares
5920a1c72f
tests: Fix tests as part of the DTO Refactor
Signed-off-by: Philip Molares <philip.molares@udo.edu>
2021-01-30 12:47:31 +01:00