1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
import debug from 'debug';
import { ROLE_PERMISSIONS, ROLES, SHARE_TOKEN_HEADER } from '@/lib/constants';
import { secret } from '@/lib/crypto';
import { getRandomChars } from '@/lib/generate';
import { createSecureToken, parseSecureToken, parseToken } from '@/lib/jwt';
import redis from '@/lib/redis';
import { ensureArray } from '@/lib/utils';
import { getUser } from '@/queries/prisma/user';
const log = debug('umami:auth');
export function getBearerToken(request: Request) {
const auth = request.headers.get('authorization');
return auth?.split(' ')[1];
}
export async function checkAuth(request: Request) {
const token = getBearerToken(request);
const payload = parseSecureToken(token, secret());
const shareToken = await parseShareToken(request);
let user = null;
const { userId, authKey } = payload || {};
if (userId) {
user = await getUser(userId);
} else if (redis.enabled && authKey) {
const key = await redis.client.get(authKey);
if (key?.userId) {
user = await getUser(key.userId);
}
}
log({ token, payload, authKey, shareToken, user });
if (!user?.id && !shareToken) {
log('User not authorized');
return null;
}
if (user) {
user.isAdmin = user.role === ROLES.admin;
}
return {
token,
authKey,
shareToken,
user,
};
}
export async function saveAuth(data: any, expire = 0) {
const authKey = `auth:${getRandomChars(32)}`;
if (redis.enabled) {
await redis.client.set(authKey, data);
if (expire) {
await redis.client.expire(authKey, expire);
}
}
return createSecureToken({ authKey }, secret());
}
export async function hasPermission(role: string, permission: string | string[]) {
return ensureArray(permission).some(e => ROLE_PERMISSIONS[role]?.includes(e));
}
export function parseShareToken(request: Request) {
try {
return parseToken(request.headers.get(SHARE_TOKEN_HEADER), secret());
} catch (e) {
log(e);
return null;
}
}
|