Skip to content

Commit

Permalink
Lint and some changes required by Typescript after the linter added i…
Browse files Browse the repository at this point in the history 
…mports

Signed-off-by: Jochen Kressin <jochen.kressin-gh@eliatra.com>
  • Loading branch information
@jochen-kressin
jochen-kressin committed Dec 11, 2023
1 parent fd928ce commit 0f39953
Show file tree
Hide file tree
Showing 2 changed files with 57 additions and 60 deletions.
45 changes: 25 additions & 20 deletions server/auth/types/jwt/jwt_auth.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,21 +25,21 @@ import {
AuthToolkit,
IOpenSearchDashboardsResponse,
} from 'opensearch-dashboards/server';
import { ServerStateCookieOptions } from '@hapi/hapi';
import { SecurityPluginConfigType } from '../../..';
import { SecuritySessionCookie } from '../../../session/security_cookie';
import { AuthenticationType } from '../authentication_type';
import { JwtAuthRoutes } from './routes';
import {ServerStateCookieOptions} from "@hapi/hapi";
import {
ExtraAuthStorageOptions,
getExtraAuthStorageValue,
setExtraAuthStorage,
} from "../../../session/cookie_splitter";
} from '../../../session/cookie_splitter';

export const JWT_DEFAULT_EXTRA_STORAGE_OPTIONS: ExtraAuthStorageOptions = {
cookiePrefix: 'security_authentication_jwt',
additionalCookies: 5,
}
};

export class JwtAuthentication extends AuthenticationType {
public readonly type: string = 'jwt';
Expand Down Expand Up @@ -68,7 +68,7 @@ export class JwtAuthentication extends AuthenticationType {
// @ts-ignore
const hapiServer: Server = this.sessionStorageFactory.asScoped({}).server;

const {cookiePrefix, additionalCookies} = this.getExtraAuthStorageOptions();
const { cookiePrefix, additionalCookies } = this.getExtraAuthStorageOptions();
const extraCookieSettings: ServerStateCookieOptions = {
isSecure: this.config.cookie.secure,
isSameSite: this.config.cookie.isSameSite,
Expand All @@ -87,11 +87,15 @@ export class JwtAuthentication extends AuthenticationType {
}

private getExtraAuthStorageOptions(): ExtraAuthStorageOptions {
let extraAuthStorageOptions: ExtraAuthStorageOptions = {
cookiePrefix: this.config.jwt?.extra_storage.cookie_prefix || JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
additionalCookies: this.config.jwt?.extra_storage.additional_cookies || JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
logger: this.logger
}
const extraAuthStorageOptions: ExtraAuthStorageOptions = {
cookiePrefix:
this.config.jwt?.extra_storage.cookie_prefix ||
JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
additionalCookies:
this.config.jwt?.extra_storage.additional_cookies ||
JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
logger: this.logger,
};

return extraAuthStorageOptions;
}
Expand Down Expand Up @@ -122,8 +126,6 @@ export class JwtAuthentication extends AuthenticationType {
return true;
}



const urlParamName = this.config.jwt?.url_param;
if (urlParamName && request.url.searchParams.get(urlParamName)) {
return true;
Expand All @@ -149,7 +151,7 @@ export class JwtAuthentication extends AuthenticationType {
): SecuritySessionCookie {
setExtraAuthStorage(
request,
this.getBearerToken(request) || '', // TODO Does an empty string make sense?,
this.getBearerToken(request) || '',
this.getExtraAuthStorageOptions()
);
return {
Expand All @@ -162,14 +164,14 @@ export class JwtAuthentication extends AuthenticationType {
};
}

async isValidCookie(cookie: SecuritySessionCookie, request: OpenSearchDashboardsRequest): Promise<boolean> {
// TODO Double check this, implemented too quickly
const hasAuthHeaderValue = (cookie.credentials?.authHeaderValue || this.getExtraAuthStorageValue(request, cookie))
async isValidCookie(
cookie: SecuritySessionCookie,
request: OpenSearchDashboardsRequest
): Promise<boolean> {
const hasAuthHeaderValue =
cookie.credentials?.authHeaderValue || this.getExtraAuthStorageValue(request, cookie);
return (
cookie.authType === this.type &&
cookie.username &&
cookie.expiryTime &&
hasAuthHeaderValue
cookie.authType === this.type && cookie.username && cookie.expiryTime && hasAuthHeaderValue
);
}

Expand All @@ -196,7 +198,10 @@ export class JwtAuthentication extends AuthenticationType {
return extraValue;
}

buildAuthHeaderFromCookie(cookie: SecuritySessionCookie, request: OpenSearchDashboardsRequest): any {
buildAuthHeaderFromCookie(
cookie: SecuritySessionCookie,
request: OpenSearchDashboardsRequest
): any {
const header: any = {};
if (cookie.credentials.authHeaderValueExtra) {
try {
Expand Down
72 changes: 32 additions & 40 deletions server/auth/types/jwt/jwt_helper.test.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,43 +14,40 @@
*/

import { getAuthenticationHandler } from '../../auth_handler_factory';
import {
JWT_DEFAULT_EXTRA_STORAGE_OPTIONS,
JwtAuthentication
} from "./jwt_auth";
import { JWT_DEFAULT_EXTRA_STORAGE_OPTIONS } from './jwt_auth';
import {
CoreSetup,
ILegacyClusterClient,
IRouter,
Logger,
OpenSearchDashboardsRequest,
SessionStorageFactory
} from "../../../../../../src/core/server";
import {SecuritySessionCookie} from "../../../session/security_cookie";
import {SecurityPluginConfigType} from "../../../index";
import {httpServerMock} from "../../../../../../src/core/server/http/http_server.mocks";
import {deflateValue} from "../../../utils/compression";
SessionStorageFactory,
} from '../../../../../../src/core/server';
import { SecuritySessionCookie } from '../../../session/security_cookie';
import { SecurityPluginConfigType } from '../../../index';
import { httpServerMock } from '../../../../../../src/core/server/http/http_server.mocks';
import { deflateValue } from '../../../utils/compression';

describe('test jwt auth library', () => {
const router: IRouter = { post: (body) => {} };
let core: CoreSetup = {
const router: Partial<IRouter> = { post: (body) => {} };
const core = {
http: {
basePath: {
serverBasePath: '/'
}
}
};
serverBasePath: '/',
},
},
} as CoreSetup;
let esClient: ILegacyClusterClient;
let sessionStorageFactory: SessionStorageFactory<SecuritySessionCookie> = {
const sessionStorageFactory: SessionStorageFactory<SecuritySessionCookie> = {
asScoped: jest.fn().mockImplementation(() => {
return {
server: {
states: {
add: jest.fn()
}
}
}
})
add: jest.fn(),
},
},
};
}),
};
let logger: Logger;

Expand All @@ -65,12 +62,10 @@ describe('test jwt auth library', () => {
},
};



function getTestJWTAuthenticationHandlerWithConfig(config: SecurityPluginConfigType) {
return getAuthenticationHandler(
'jwt',
router,
router as IRouter,
config,
core,
esClient,
Expand All @@ -87,8 +82,8 @@ describe('test jwt auth library', () => {
url_param: 'authorization',
extra_storage: {
cookie_prefix: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
additional_cookies: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies
}
additional_cookies: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
},
},
};
const auth = await getTestJWTAuthenticationHandlerWithConfig(config);
Expand All @@ -111,8 +106,8 @@ describe('test jwt auth library', () => {
url_param: 'urlParamName',
extra_storage: {
cookie_prefix: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
additional_cookies: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies
}
additional_cookies: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
},
},
};
const auth = await getTestJWTAuthenticationHandlerWithConfig(config);
Expand All @@ -128,22 +123,20 @@ describe('test jwt auth library', () => {
});

test('make sure that cookies with authHeaderValue instead of split cookies are still valid', async () => {
const config = ({
const config = {
...cookieConfig,
jwt: {
header: 'Authorization',
url_param: 'authorization',
extra_storage: {
cookie_prefix: 'testcookie',
additional_cookies: 2,
}
cookie_prefix: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.cookiePrefix,
additional_cookies: JWT_DEFAULT_EXTRA_STORAGE_OPTIONS.additionalCookies,
},
},
} as unknown) as SecurityPluginConfigType;
} as SecurityPluginConfigType;

const jwtAuthentication = await getTestJWTAuthenticationHandlerWithConfig(config);

console.log('What sessionstorageFactory did I use?', sessionStorageFactory)

const mockRequest = httpServerMock.createRawRequest();
const osRequest = OpenSearchDashboardsRequest.from(mockRequest);

Expand All @@ -157,24 +150,23 @@ describe('test jwt auth library', () => {
authorization: 'Bearer eyToken',
};


const headers = jwtAuthentication.buildAuthHeaderFromCookie(cookie, osRequest);

expect(headers).toEqual(expectedHeaders);
});

test('get authHeaderValue from split cookies', async () => {
const config = ({
const config = {
...cookieConfig,
jwt: {
header: 'Authorization',
url_param: 'authorization',
extra_storage: {
cookie_prefix: 'testcookie',
additional_cookies: 2,
}
},
},
} as unknown) as SecurityPluginConfigType;
} as SecurityPluginConfigType;

const jwtAuthentication = await getTestJWTAuthenticationHandlerWithConfig(config);

Expand Down

0 comments on commit 0f39953

Please sign in to comment.