first commit

app/auth/apikey.js

@@ -0,0 +1,74 @@
+'use strict';
+
+/**
+ * this module allows to auth user using an pregenerated api key
+ */
+function ApikeyAuth(req, metadataBackend, username, apikeyToken) {
+    this.req = req;
+    this.metadataBackend = metadataBackend;
+    this.username = username;
+    this.apikeyToken = apikeyToken;
+}
+
+module.exports = ApikeyAuth;
+
+function usernameMatches(basicAuthUsername, requestUsername) {
+    return !(basicAuthUsername && (basicAuthUsername !== requestUsername));
+}
+
+ApikeyAuth.prototype.verifyCredentials = function (callback) {
+    this.metadataBackend.getApikey(this.username, this.apikeyToken, (err, apikey) => {
+        if (err) {
+            err.http_status = 500;
+            err.message = 'Unexpected error';
+
+            return callback(err);
+        }
+
+        if (isApiKeyFound(apikey)) {
+            if (!usernameMatches(apikey.user, this.username)) {
+                const usernameError = new Error('Forbidden');
+                usernameError.type = 'auth';
+                usernameError.subtype = 'api-key-username-mismatch';
+                usernameError.http_status = 403;
+
+                return callback(usernameError);
+            }
+
+            if (!apikey.grantsSql) {
+                const forbiddenError = new Error('forbidden');
+                forbiddenError.http_status = 403;
+
+                return callback(forbiddenError);
+            }
+
+            return callback(null, getAuthorizationLevel(apikey));
+        }  else {
+            const apiKeyNotFoundError = new Error('Unauthorized');
+            apiKeyNotFoundError.type = 'auth';
+            apiKeyNotFoundError.subtype = 'api-key-not-found';
+            apiKeyNotFoundError.http_status = 401;
+
+            return callback(apiKeyNotFoundError);
+        }
+    });
+};
+
+ApikeyAuth.prototype.hasCredentials = function () {
+    return !!this.apikeyToken;
+};
+
+ApikeyAuth.prototype.getCredentials = function () {
+    return this.apikeyToken;
+};
+
+function getAuthorizationLevel(apikey) {
+    return apikey.type;
+}
+
+function isApiKeyFound(apikey) {
+    return apikey.type !== null &&
+        apikey.user !== null &&
+        apikey.databasePassword !== null &&
+        apikey.databaseRole !== null;
+}

app/auth/auth_api.js

@@ -0,0 +1,48 @@
+'use strict';
+
+var ApiKeyAuth = require('./apikey'),
+    OAuthAuth  = require('./oauth');
+
+function AuthApi(req, requestParams) {
+    this.req = req;
+    this.authBackend = getAuthBackend(req, requestParams);
+
+    this._hasCredentials = null;
+}
+
+AuthApi.prototype.getType = function () {
+    if (this.authBackend instanceof ApiKeyAuth) {
+        return 'apiKey';
+    } else if (this.authBackend instanceof OAuthAuth) {
+        return 'oAuth';
+    }
+};
+
+AuthApi.prototype.hasCredentials = function() {
+    if (this._hasCredentials === null) {
+        this._hasCredentials = this.authBackend.hasCredentials();
+    }
+    return this._hasCredentials;
+};
+
+AuthApi.prototype.getCredentials = function() {
+    return this.authBackend.getCredentials();
+};
+
+AuthApi.prototype.verifyCredentials = function(callback) {
+    if (this.hasCredentials()) {
+        this.authBackend.verifyCredentials(callback);
+    } else {
+        callback(null, false);
+    }
+};
+
+function getAuthBackend(req, requestParams) {
+    if (requestParams.api_key) {
+        return new ApiKeyAuth(req, requestParams.metadataBackend, requestParams.user, requestParams.api_key);
+    } else {
+        return new OAuthAuth(req, requestParams.metadataBackend);
+    }
+}
+
+module.exports = AuthApi;

app/auth/oauth.js

@@ -0,0 +1,192 @@
+'use strict';
+
+// too bound to the request object, but ok for now
+var _ = require('underscore');
+var OAuthUtil = require('oauth-client');
+var step = require('step');
+var CdbRequest = require('../models/cartodb_request');
+var cdbReq = new CdbRequest();
+
+var oAuth = (function(){
+  var me = {
+    oauth_database: 3,
+    oauth_user_key: "rails:oauth_access_tokens:<%= oauth_access_key %>",
+    is_oauth_request: true
+  };
+
+  // oauth token cases:
+  // * in GET request
+  // * in header
+  me.parseTokens = function(req){
+    var query_oauth = _.clone(req.method === "POST" ? req.body: req.query);
+    var header_oauth = {};
+    var oauth_variables = ['oauth_body_hash',
+                           'oauth_consumer_key',
+                           'oauth_token',
+                           'oauth_signature_method',
+                           'oauth_signature',
+                           'oauth_timestamp',
+                           'oauth_nonce',
+                           'oauth_version'];
+
+    // pull only oauth tokens out of query
+    var non_oauth  = _.difference(_.keys(query_oauth), oauth_variables);
+    _.each(non_oauth, function(key){ delete query_oauth[key]; });
+
+    // pull oauth tokens out of header
+    var header_string = req.headers.authorization;
+    if (!_.isUndefined(header_string)) {
+      _.each(oauth_variables, function(oauth_key){
+        var matched_string = header_string.match(new RegExp(oauth_key + '=\"([^\"]+)\"'));
+        if (!_.isNull(matched_string)) {
+          header_oauth[oauth_key] = decodeURIComponent(matched_string[1]);
+        }
+      });
+    }
+
+    //merge header and query oauth tokens. preference given to header oauth
+    return _.defaults(header_oauth, query_oauth);
+  };
+
+  // remove oauthy tokens from an object
+  me.splitParams = function(obj) {
+    var removed = null;
+    for (var prop in obj) {
+        if (/^oauth_\w+$/.test(prop)) {
+            if(!removed) {
+                removed = {};
+            }
+            removed[prop] = obj[prop];
+            delete obj[prop];
+        }
+    }
+    return removed;
+  };
+
+  me.getAllowedHosts= function() {
+    var oauthConfig = global.settings.oauth || {};
+    return oauthConfig.allowedHosts || ['carto.com', 'cartodb.com'];
+  };
+
+  // do new fancy get User ID
+  me.verifyRequest = function(req, metadataBackend, callback) {
+    var that = this;
+    //TODO: review this
+    var httpProto = req.protocol;
+    if(!httpProto || (httpProto !== 'http' && httpProto !== 'https')) {
+      var msg = "Unknown HTTP protocol " + httpProto + ".";
+      var unknownProtocolErr = new Error(msg);
+      unknownProtocolErr.http_status = 500;
+      return callback(unknownProtocolErr);
+    }
+
+    var username = cdbReq.userByReq(req);
+    var requestTokens;
+    var signature;
+
+    step(
+      function getTokensFromURL(){
+        return oAuth.parseTokens(req);
+      },
+      function getOAuthHash(err, _requestTokens) {
+        if (err) {
+          throw err;
+        }
+
+        // this is oauth request only if oauth headers are present
+        this.is_oauth_request = !_.isEmpty(_requestTokens);
+
+        if (this.is_oauth_request) {
+          requestTokens = _requestTokens;
+          that.getOAuthHash(metadataBackend, requestTokens.oauth_token, this);
+        } else {
+          return null;
+        }
+      },
+      function regenerateSignature(err, oAuthHash){
+        if (err) {
+          throw err;
+        }
+        if (!this.is_oauth_request) {
+            return null;
+        }
+
+        var consumer     = OAuthUtil.createConsumer(oAuthHash.consumer_key, oAuthHash.consumer_secret);
+        var access_token = OAuthUtil.createToken(oAuthHash.access_token_token, oAuthHash.access_token_secret);
+        var signer       = OAuthUtil.createHmac(consumer, access_token);
+
+        var method = req.method;
+        var hostsToValidate = {};
+        var requestHost = req.headers.host;
+        hostsToValidate[requestHost] = true;
+        that.getAllowedHosts().forEach(function(allowedHost) {
+            hostsToValidate[username + '.' + allowedHost] = true;
+        });
+
+        that.splitParams(req.query);
+        // remove oauth_signature from body
+        if(req.body) {
+            delete req.body.oauth_signature;
+        }
+        signature = requestTokens.oauth_signature;
+        // remove signature from requestTokens
+        delete requestTokens.oauth_signature;
+        var requestParams = _.extend({}, req.body, requestTokens, req.query);
+
+        var hosts = Object.keys(hostsToValidate);
+        var requestSignatures = hosts.map(function(host) {
+            var url = httpProto + '://' + host + req.path;
+            return signer.sign(method, url, requestParams);
+        });
+
+        return requestSignatures.reduce(function(validSignature, requestSignature) {
+            if (signature === requestSignature && !_.isUndefined(requestSignature)) {
+                validSignature = true;
+            }
+            return validSignature;
+        }, false);
+      },
+      function finishValidation(err, hasValidSignature) {
+        const authorizationLevel = hasValidSignature ? 'master' : null;
+        return callback(err, authorizationLevel);
+      }
+    );
+  };
+
+  me.getOAuthHash = function(metadataBackend, oAuthAccessKey, callback){
+      metadataBackend.getOAuthHash(oAuthAccessKey, callback);
+  };
+
+  return me;
+})();
+
+function OAuthAuth(req, metadataBackend) {
+    this.req = req;
+    this.metadataBackend = metadataBackend;
+    this.isOAuthRequest = null;
+}
+
+OAuthAuth.prototype.verifyCredentials = function(callback) {
+    if (this.hasCredentials()) {
+        oAuth.verifyRequest(this.req, this.metadataBackend, callback);
+    } else {
+        callback(null, false);
+    }
+};
+
+OAuthAuth.prototype.getCredentials = function() {
+  return oAuth.parseTokens(this.req);
+};
+
+OAuthAuth.prototype.hasCredentials = function() {
+    if (this.isOAuthRequest === null) {
+        var passed_tokens = oAuth.parseTokens(this.req);
+        this.isOAuthRequest = !_.isEmpty(passed_tokens);
+    }
+
+    return this.isOAuthRequest;
+};
+
+
+module.exports = OAuthAuth;
+module.exports.backend = oAuth;