overleaf/services/web/app/coffee/Features/Authentication/AuthenticationController.coffee

231 lines
7.9 KiB
CoffeeScript
Raw Normal View History

2014-02-12 05:23:40 -05:00
AuthenticationManager = require ("./AuthenticationManager")
LoginRateLimiter = require("../Security/LoginRateLimiter")
UserUpdater = require "../User/UserUpdater"
Metrics = require('metrics-sharelatex')
2014-02-12 05:23:40 -05:00
logger = require("logger-sharelatex")
querystring = require('querystring')
Url = require("url")
Settings = require "settings-sharelatex"
2015-06-30 07:04:41 -04:00
basicAuth = require('basic-auth-connect')
UserHandler = require("../User/UserHandler")
UserSessionsManager = require("../User/UserSessionsManager")
2016-08-11 09:09:45 -04:00
Analytics = require "../Analytics/AnalyticsManager"
passport = require 'passport'
2014-02-12 05:23:40 -05:00
module.exports = AuthenticationController =
2016-09-05 05:28:47 -04:00
2016-09-02 11:17:37 -04:00
serializeUser: (user, callback) ->
lightUser =
_id: user._id
first_name: user.first_name
last_name: user.last_name
isAdmin: user.isAdmin
email: user.email
referal_id: user.referal_id
session_created: (new Date()).toISOString()
ip_address: user._login_req_ip
callback(null, lightUser)
deserializeUser: (user, cb) ->
cb(null, user)
afterLoginSessionSetup: (req, user, callback=(err)->) ->
req.login user, (err) ->
if err?
logger.err {user_id: user._id, err}, "error from req.login"
return callback(err)
# Regenerate the session to get a new sessionID (cookie value) to
# protect against session fixation attacks
oldSession = req.session
req.session.destroy (err) ->
if err?
logger.err {user_id: user._id, err}, "error when trying to destroy old session"
return callback(err)
req.sessionStore.generate(req)
for key, value of oldSession
req.session[key] = value
# copy to the old `session.user` location, for backward-comptability
req.session.user = req.session.passport.user
req.session.save (err) ->
if err?
logger.err {user_id: user._id}, "error saving regenerated session after login"
return callback(err)
UserSessionsManager.trackSession(user, req.sessionID, () ->)
callback(null)
passportLogin: (req, res, next) ->
# This function is middleware which wraps the passport.authenticate middleware,
# so we can send back our custom `{message: {text: "", type: ""}}` responses on failure,
# and send a `{redir: ""}` response on success
passport.authenticate('local', (err, user, info) ->
if err?
return next(err)
if user # `user` is either a user object or false
AuthenticationController.finishLogin(user, req, res, next)
else
if info.redir?
res.json {redir: info.redir}
else
res.json message: info
)(req, res, next)
finishLogin: (user, req, res, next) ->
redir = AuthenticationController._getRedirectFromSession(req) || "/project"
AuthenticationController._loginAsyncHandlers(req, user)
AuthenticationController.afterLoginSessionSetup req, user, (err) ->
if err?
return next(err)
AuthenticationController._clearRedirectFromSession(req)
if req.headers?['accept']?.match(/^application\/json.*$/)
res.json {redir: redir}
else
res.redirect(redir)
2016-09-02 11:17:37 -04:00
doPassportLogin: (req, username, password, done) ->
email = username.toLowerCase()
Modules = require "../../infrastructure/Modules"
Modules.hooks.fire 'preDoPassportLogin', req, email, (err, infoList) ->
return next(err) if err?
info = infoList.find((i) => i?)
if info?
return done(null, false, info)
LoginRateLimiter.processLoginRequest email, (err, isAllowed)->
return done(err) if err?
if !isAllowed
logger.log email:email, "too many login requests"
return done(null, null, {text: req.i18n.translate("to_many_login_requests_2_mins"), type: 'error'})
AuthenticationManager.authenticate email: email, password, (error, user) ->
return done(error) if error?
if user?
# async actions
return done(null, user)
else
AuthenticationController._recordFailedLogin()
logger.log email: email, "failed log in"
return done(
null,
false,
{text: req.i18n.translate("email_or_password_wrong_try_again"), type: 'error'}
)
2016-09-02 11:17:37 -04:00
_loginAsyncHandlers: (req, user) ->
UserHandler.setupLoginData(user, ()->)
LoginRateLimiter.recordSuccessfulLogin(user.email)
AuthenticationController._recordSuccessfulLogin(user._id)
Analytics.recordEvent(user._id, "user-logged-in", {ip:req.ip})
Analytics.identifyUser(user._id, req.sessionID)
logger.log email: user.email, user_id: user._id.toString(), "successful log in"
req.session.justLoggedIn = true
# capture the request ip for use when creating the session
user._login_req_ip = req.ip
setInSessionUser: (req, props) ->
for key, value of props
if req?.session?.passport?.user?
req.session.passport.user[key] = value
if req?.session?.user?
req.session.user[key] = value
2016-09-05 10:58:31 -04:00
isUserLoggedIn: (req) ->
user_id = AuthenticationController.getLoggedInUserId(req)
return (user_id not in [null, undefined, false])
2016-09-02 11:17:37 -04:00
2016-09-05 10:58:31 -04:00
# TODO: perhaps should produce an error if the current user is not present
getLoggedInUserId: (req) ->
2016-09-06 10:22:13 -04:00
user = AuthenticationController.getSessionUser(req)
if user
2016-09-06 10:22:13 -04:00
return user._id
else
return null
getSessionUser: (req) ->
if req?.session?.user?
2016-09-06 10:22:13 -04:00
return req.session.user
else if req?.session?.passport?.user
2016-09-06 10:22:13 -04:00
return req.session.passport.user
else
2016-09-05 10:58:31 -04:00
return null
2014-02-12 05:23:40 -05:00
2016-03-10 12:15:14 -05:00
requireLogin: () ->
2014-02-12 05:23:40 -05:00
doRequest = (req, res, next = (error) ->) ->
2016-09-06 08:21:22 -04:00
if !AuthenticationController.isUserLoggedIn(req)
AuthenticationController._redirectToLoginOrRegisterPage(req, res)
2014-02-12 05:23:40 -05:00
else
2016-09-22 08:54:13 -04:00
req.user = AuthenticationController.getSessionUser(req)
2016-09-06 08:21:22 -04:00
next()
2014-02-12 05:23:40 -05:00
return doRequest
_globalLoginWhitelist: []
addEndpointToLoginWhitelist: (endpoint) ->
AuthenticationController._globalLoginWhitelist.push endpoint
requireGlobalLogin: (req, res, next) ->
if req._parsedUrl.pathname in AuthenticationController._globalLoginWhitelist
return next()
if req.headers['authorization']?
return AuthenticationController.httpAuth(req, res, next)
else if AuthenticationController.isUserLoggedIn(req)
return next()
else
logger.log url:req.url, "user trying to access endpoint not in global whitelist"
AuthenticationController._setRedirectInSession(req)
return res.redirect "/login"
2015-06-30 07:04:41 -04:00
httpAuth: basicAuth (user, pass)->
isValid = Settings.httpAuthUsers[user] == pass
if !isValid
logger.err user:user, pass:pass, "invalid login details"
return isValid
_redirectToLoginOrRegisterPage: (req, res)->
2018-06-25 19:27:47 -04:00
if (req.query.zipUrl? or req.query.project_name? or req.path == '/user/subscription/new')
return AuthenticationController._redirectToRegisterPage(req, res)
else
AuthenticationController._redirectToLoginPage(req, res)
_redirectToLoginPage: (req, res) ->
logger.log url: req.url, "user not logged in so redirecting to login page"
AuthenticationController._setRedirectInSession(req)
url = "/login?#{querystring.stringify(req.query)}"
res.redirect url
Metrics.inc "security.login-redirect"
2014-02-12 05:23:40 -05:00
_redirectToRegisterPage: (req, res) ->
logger.log url: req.url, "user not logged in so redirecting to register page"
AuthenticationController._setRedirectInSession(req)
2014-02-12 05:23:40 -05:00
url = "/register?#{querystring.stringify(req.query)}"
res.redirect url
Metrics.inc "security.login-redirect"
_recordSuccessfulLogin: (user_id, callback = (error) ->) ->
UserUpdater.updateUser user_id.toString(), {
$set: { "lastLoggedIn": new Date() },
$inc: { "loginCount": 1 }
}, (error) ->
callback(error) if error?
Metrics.inc "user.login.success"
callback()
_recordFailedLogin: (callback = (error) ->) ->
Metrics.inc "user.login.failed"
callback()
_setRedirectInSession: (req, value) ->
if !value?
value = if Object.keys(req.query).length > 0 then "#{req.path}?#{querystring.stringify(req.query)}" else "#{req.path}"
if (
req.session? &&
!value.match(new RegExp('^\/(socket.io|js|stylesheets|img)\/.*$')) &&
!value.match(new RegExp('^.*\.(png|jpeg|svg)$'))
)
req.session.postLoginRedirect = value
_getRedirectFromSession: (req) ->
return req?.session?.postLoginRedirect || null
_clearRedirectFromSession: (req) ->
if req.session?
delete req.session.postLoginRedirect