Refactor auth access config. Closes #2992. Closes #2998

Author: hueniverse

lib/auth.js

@@ -117,15 +117,25 @@ internals.Auth.prototype._setupRoute = function (options, path) {
 
     options.mode = options.mode || 'required';
 
-    if (options.scope) {
-        if (typeof options.scope === 'string') {
-            options.scope = [options.scope];
-        }
+    if (options.entity !== undefined ||
+        options.scope !== undefined) {
+
+        options.access = [{ entity: options.entity, scope: options.scope }];
+        delete options.entity;
+        delete options.scope;
+    }
 
-        for (let i = 0; i < options.scope.length; ++i) {
-            if (/{([^}]+)}/.test(options.scope[i])) {
-                options.hasScopeParameters = true;
-                break;
+    if (options.access) {
+        for (let i = 0; i < options.access.length; ++i) {
+            const access = options.access[i];
+            if (access.scope) {                                         // Avoid processing the defaults
+                access.hasScopeParameters = false;
+                for (let j = 0; j < access.scope.length; ++j) {
+                    if (/{([^}]+)}/.test(access.scope[j])) {
+                        access.hasScopeParameters = true;
+                        break;
+                    }
+                }
             }
         }
     }
@@ -135,14 +145,15 @@ internals.Auth.prototype._setupRoute = function (options, path) {
     }
 
     let hasAuthenticatePayload = false;
-    options.strategies.forEach((name) => {
-
+    for (let i = 0; i < options.strategies.length; ++i) {
+        const name = options.strategies[i];
         const strategy = this._strategies[name];
         Hoek.assert(strategy, 'Unknown authentication strategy', name, 'in', path);
+
         Hoek.assert(strategy.methods.payload || options.payload !== 'required', 'Payload validation can only be required when all strategies support it in', path);
         hasAuthenticatePayload = hasAuthenticatePayload || strategy.methods.payload;
         Hoek.assert(!strategy.methods.options.payload || options.payload === undefined || options.payload === 'required', 'Cannot set authentication payload to', options.payload, 'when a strategy requires payload validation in', path);
-    });
+    }
 
     Hoek.assert(!options.payload || hasAuthenticatePayload, 'Payload authentication requires at least one strategy with payload support in', path);
 
@@ -363,60 +374,73 @@ internals.Authenticator = class {
         request.auth.credentials = credentials;
         request.auth.artifacts = result.artifacts;
 
-        // Check scope
+        const authenticated = () => {
 
-        if (config.scope) {
-            let scopes = config.scope;
-            if (config.hasScopeParameters) {
-                scopes = [];
-                const context = { params: request.params, query: request.query };
-                for (let i = 0; i < config.scope.length; ++i) {
-                    scopes[i] = Hoek.reachTemplate(context, config.scope[i]);
-                }
-            }
+            request._log(['auth', name]);
+            request.auth.isAuthenticated = true;
+            return next();
+        };
 
-            if (!credentials.scope ||
-                (typeof credentials.scope === 'string' ? scopes.indexOf(credentials.scope) === -1 : !Hoek.intersect(scopes, credentials.scope).length)) {
+        // Check access rules
 
-                request._log(['auth', 'scope', 'error', name], { got: credentials.scope, need: scopes });
-                return next(Boom.forbidden('Insufficient scope, expected any of: ' + scopes));
-            }
+        if (!config.access) {
+            return authenticated();
         }
 
-        // Check entity
+        const requestEntity = (credentials.user ? 'user' : 'app');
 
-        const entity = config.entity || 'any';
+        const scopeErrors = [];
+        for (let i = 0; i < config.access.length; ++i) {
+            const access = config.access[i];
 
-        // Entity: 'any'
+            // Check entity
 
-        if (entity === 'any') {
-            request._log(['auth', name]);
-            request.auth.isAuthenticated = true;
-            return next();
-        }
+            const entity = access.entity;
+            if (entity &&
+                entity !== 'any' &&
+                entity !== requestEntity) {
+
+                continue;
+            }
 
-        // Entity: 'user'
+            // Check scope
 
-        if (entity === 'user') {
-            if (!credentials.user) {
-                request._log(['auth', 'entity', 'user', 'error', name]);
-                return next(Boom.forbidden('Application credentials cannot be used on a user endpoint'));
+            let scope = access.scope;
+            if (scope) {
+                if (access.hasScopeParameters) {
+                    scope = [];
+                    const context = { params: request.params, query: request.query };
+                    for (let j = 0; j < access.scope.length; ++j) {
+                        scope[j] = Hoek.reachTemplate(context, access.scope[j]);
+                    }
+                }
+
+                if (!credentials.scope ||
+                    (typeof credentials.scope === 'string' ? scope.indexOf(credentials.scope) === -1 : !Hoek.intersect(scope, credentials.scope).length)) {
+
+                    scopeErrors.push(scope);
+                    continue;
+                }
             }
 
-            request._log(['auth', name]);
-            request.auth.isAuthenticated = true;
-            return next();
+            return authenticated();
         }
 
-        // Entity: 'app'
+        // Scope error
 
-        if (credentials.user) {
-            request._log(['auth', 'entity', 'app', 'error', name]);
-            return next(Boom.forbidden('User credentials cannot be used on an application endpoint'));
+        if (scopeErrors.length) {
+            request._log(['auth', 'scope', 'error', name], { got: credentials.scope, need: scopeErrors });
+            return next(Boom.forbidden('Insufficient scope'));
         }
 
-        request._log(['auth', name]);
-        request.auth.isAuthenticated = true;
-        return next();
+        // Entity error
+
+        if (requestEntity === 'user') {
+            request._log(['auth', 'entity', 'user', 'error', name]);
+            return next(Boom.forbidden('Application credentials cannot be used on a user endpoint'));
+        }
+
+        request._log(['auth', 'entity', 'app', 'error', name]);
+        return next(Boom.forbidden('User credentials cannot be used on an application endpoint'));
     }
 };

lib/schema.js

@@ -31,24 +31,26 @@ internals.cache = Joi.object({
 }).unknown();
 
 
-internals.strategy = Joi.object({
+internals.access = Joi.object({
     entity: Joi.string().valid('user', 'app', 'any'),
-    payload: [
-        Joi.string().valid('required', 'optional'),
-        Joi.boolean()
-    ],
-    scope: [false, Joi.string(), Joi.array()]
+    scope: [false, Joi.array().items(Joi.string()).single()]
 });
 
 
 internals.auth = Joi.alternatives([
     Joi.string(),
-    internals.strategy.keys({
+    internals.access.keys({
         mode: Joi.string().valid('required', 'optional', 'try'),
         strategy: Joi.string(),
-        strategies: Joi.array().items(Joi.string(), internals.strategy.keys({ name: Joi.string().required() })).min(1)
+        strategies: Joi.array().items(Joi.string()).min(1),
+        access: Joi.array().items(internals.access.or('entity', 'scope')).single().min(1),
+        payload: [
+            Joi.string().valid('required', 'optional'),
+            Joi.boolean()
+        ]
     })
         .without('strategy', 'strategies')
+        .without('access', ['scope', 'entity'])
 ]);
 
 

test/auth.js

@@ -1074,6 +1074,96 @@ describe('authentication', () => {
             });
         });
 
+        it('matches scope (access single)', (done) => {
+
+            const handler = function (request, reply) {
+
+                return reply(request.auth.credentials.user);
+            };
+
+            const server = new Hapi.Server();
+            server.connection();
+            server.auth.scheme('custom', internals.implementation);
+            server.auth.strategy('default', 'custom', true, { users: { steve: { scope: ['one'] } } });
+            server.route({
+                method: 'GET',
+                path: '/',
+                config: {
+                    handler: handler,
+                    auth: {
+                        access: {
+                            scope: 'one'
+                        }
+                    }
+                }
+            });
+
+            server.inject({ url: '/', headers: { authorization: 'Custom steve' } }, (res) => {
+
+                expect(res.statusCode).to.equal(200);
+                done();
+            });
+        });
+
+        it('matches scope (access array)', (done) => {
+
+            const handler = function (request, reply) {
+
+                return reply(request.auth.credentials.user);
+            };
+
+            const server = new Hapi.Server();
+            server.connection();
+            server.auth.scheme('custom', internals.implementation);
+            server.auth.strategy('default', 'custom', true, { users: { steve: { scope: ['one'] } } });
+            server.route({
+                method: 'GET',
+                path: '/',
+                config: {
+                    handler: handler,
+                    auth: {
+                        access: [
+                            { scope: 'other' },
+                            { scope: 'one' }
+                        ]
+                    }
+                }
+            });
+
+            server.inject({ url: '/', headers: { authorization: 'Custom steve' } }, (res) => {
+
+                expect(res.statusCode).to.equal(200);
+                done();
+            });
+        });
+
+        it('matches any entity', (done) => {
+
+            const server = new Hapi.Server();
+            server.connection();
+            server.auth.scheme('custom', internals.implementation);
+            server.auth.strategy('default', 'custom', true, { users: { steve: { user: 'steve' } } });
+            server.route({
+                method: 'GET',
+                path: '/',
+                config: {
+                    handler: function (request, reply) {
+
+                        return reply(request.auth.credentials.user);
+                    },
+                    auth: {
+                        entity: 'any'
+                    }
+                }
+            });
+
+            server.inject({ url: '/', headers: { authorization: 'Custom steve' } }, (res) => {
+
+                expect(res.statusCode).to.equal(200);
+                done();
+            });
+        });
+
         it('matches user entity', (done) => {
 
             const server = new Hapi.Server();