overleaf/services/web/app/coffee/Features/Authentication/AuthenticationController.coffee

145 lines
4.7 KiB
CoffeeScript
Raw Normal View History

2014-02-12 05:23:40 -05:00
AuthenticationManager = require ("./AuthenticationManager")
LoginRateLimiter = require("../Security/LoginRateLimiter")
UserGetter = require "../User/UserGetter"
UserUpdater = require "../User/UserUpdater"
Metrics = require('../../infrastructure/Metrics')
logger = require("logger-sharelatex")
querystring = require('querystring')
Url = require("url")
Settings = require "settings-sharelatex"
2015-06-30 07:04:41 -04:00
basicAuth = require('basic-auth-connect')
UserHandler = require("../User/UserHandler")
2014-02-12 05:23:40 -05:00
module.exports = AuthenticationController =
login: (req, res, next = (error) ->) ->
AuthenticationController.doLogin req.body, req, res, next
doLogin: (options, req, res, next) ->
email = options.email?.toLowerCase()
password = options.password
redir = Url.parse(options.redir or "/project").path
2014-02-12 05:23:40 -05:00
LoginRateLimiter.processLoginRequest email, (err, isAllowed)->
if !isAllowed
logger.log email:email, "too many login requests"
res.statusCode = 429
return res.send
2014-02-12 05:23:40 -05:00
message:
text: req.i18n.translate("to_many_login_requests_2_mins"),
2014-02-12 05:23:40 -05:00
type: 'error'
AuthenticationManager.authenticate email: email, password, (error, user) ->
return next(error) if error?
if user?
UserHandler.setupLoginData user, ->
2014-02-12 05:23:40 -05:00
LoginRateLimiter.recordSuccessfulLogin email
AuthenticationController._recordSuccessfulLogin user._id
AuthenticationController.establishUserSession req, user, (error) ->
2014-02-12 05:23:40 -05:00
return next(error) if error?
req.session.justLoggedIn = true
2014-02-12 05:23:40 -05:00
logger.log email: email, user_id: user._id.toString(), "successful log in"
res.json redir: redir
2014-02-12 05:23:40 -05:00
else
AuthenticationController._recordFailedLogin()
logger.log email: email, "failed log in"
res.json message:
text: req.i18n.translate("email_or_password_wrong_try_again"),
2014-02-12 05:23:40 -05:00
type: 'error'
getLoggedInUserId: (req, callback = (error, user_id) ->) ->
if req?.session?.user?._id?
callback null, req.session.user._id.toString()
else
callback null, null
2014-02-12 05:23:40 -05:00
2016-03-10 12:15:14 -05:00
getLoggedInUser: (req, callback = (error, user) ->) ->
2014-02-12 05:23:40 -05:00
if req.session?.user?._id?
query = req.session.user._id
else
return callback null, null
UserGetter.getUser query, callback
2016-03-10 12:15:14 -05:00
requireLogin: () ->
2014-02-12 05:23:40 -05:00
doRequest = (req, res, next = (error) ->) ->
2016-03-10 12:15:14 -05:00
if !req.session.user?
AuthenticationController._redirectToLoginOrRegisterPage(req, res)
2014-02-12 05:23:40 -05:00
else
2016-03-10 12:15:14 -05:00
req.user = req.session.user
return next()
2014-02-12 05:23:40 -05:00
return doRequest
_globalLoginWhitelist: []
addEndpointToLoginWhitelist: (endpoint) ->
AuthenticationController._globalLoginWhitelist.push endpoint
requireGlobalLogin: (req, res, next) ->
if req._parsedUrl.pathname in AuthenticationController._globalLoginWhitelist
return next()
if req.headers['authorization']?
return AuthenticationController.httpAuth(req, res, next)
else if req.session.user?
return next()
else
logger.log url:req.url, "user trying to access endpoint not in global whitelist"
return res.redirect "/login"
2015-06-30 07:04:41 -04:00
httpAuth: basicAuth (user, pass)->
isValid = Settings.httpAuthUsers[user] == pass
if !isValid
logger.err user:user, pass:pass, "invalid login details"
return isValid
_redirectToLoginOrRegisterPage: (req, res)->
if req.query.zipUrl? or req.query.project_name?
return AuthenticationController._redirectToRegisterPage(req, res)
else
AuthenticationController._redirectToLoginPage(req, res)
_redirectToLoginPage: (req, res) ->
logger.log url: req.url, "user not logged in so redirecting to login page"
req.query.redir = req.path
url = "/login?#{querystring.stringify(req.query)}"
res.redirect url
Metrics.inc "security.login-redirect"
2014-02-12 05:23:40 -05:00
_redirectToRegisterPage: (req, res) ->
logger.log url: req.url, "user not logged in so redirecting to register page"
req.query.redir = req.path
url = "/register?#{querystring.stringify(req.query)}"
res.redirect url
Metrics.inc "security.login-redirect"
_recordSuccessfulLogin: (user_id, callback = (error) ->) ->
UserUpdater.updateUser user_id.toString(), {
$set: { "lastLoggedIn": new Date() },
$inc: { "loginCount": 1 }
}, (error) ->
callback(error) if error?
Metrics.inc "user.login.success"
callback()
_recordFailedLogin: (callback = (error) ->) ->
Metrics.inc "user.login.failed"
callback()
establishUserSession: (req, user, callback = (error) ->) ->
lightUser =
2014-02-12 05:23:40 -05:00
_id: user._id
first_name: user.first_name
last_name: user.last_name
isAdmin: user.isAdmin
email: user.email
referal_id: user.referal_id
# Regenerate the session to get a new sessionID (cookie value) to
# protect against session fixation attacks
oldSession = req.session
req.session.destroy()
req.sessionStore.generate(req)
for key, value of oldSession
req.session[key] = value
2014-02-12 05:23:40 -05:00
req.session.user = lightUser
callback()