Identity System Overhaul

nt-web-app/entity/User.ts

@@ -1,12 +1,12 @@
-import {Entity, PrimaryColumn, Column, UpdateDateColumn, CreateDateColumn} from "typeorm"
+import { Entity, PrimaryColumn, Column, UpdateDateColumn, CreateDateColumn } from "typeorm"
 
-export type LoginProvider = 'local'|'twitch'
+export type LoginProvider = string
 
 /**
  * @module DBUser
  */
-@Entity({name: "user", synchronize: true})
-export class User{
+@Entity({ name: "user", synchronize: true })
+export class User {
     @PrimaryColumn()
     id: string
 
@@ -16,7 +16,7 @@ export class User{
     @Column()
     display_name: string
 
-    private _access: Role|null = null;
+    private _access: Role | null = null;
 
     @Column({ type: "text", nullable: false })
     get access(): string {
@@ -30,8 +30,8 @@ export class User{
         return '';
     }
 
-    set access(value: string|null) {
-        if(!value){
+    set access(value: string | null) {
+        if (!value) {
             this._access = new RoleImpl()
             return
         }
@@ -51,9 +51,9 @@ export class User{
 
     uaccess?: number
 
-    constructor(id: string, twitch_user_name: string, access: Role, provider: LoginProvider) {
+    constructor(id: string, user_name: string, access: Role, provider: LoginProvider) {
         this._access = access
-        this.display_name = twitch_user_name
+        this.display_name = user_name
         this.id = id
         this.provider = provider
         this.uaccess = 0
@@ -109,4 +109,4 @@ export const defaultRoles = {
     canListLobbies: true,
     elevatedRoomPermissions: false,
     isModerator: false
-} as Role
+} as Role

nt-web-app/entity/identity.ts

@@ -0,0 +1,8 @@
+export interface UserData {
+  //Subscribder Id
+  sub: string,
+  preferred_username: string,
+  picture?: string,
+  email?: string,
+}
+

nt-web-app/identity/forgejo.ts

@@ -0,0 +1,107 @@
+/* =======
+ *  NOTES
+ * =======
+ *
+ * Scope:
+ *  This implementation should be a pretty cut and dry OIDC
+ *  integration, very little should need to be changed to 
+ *  interface with any other standard oidc provider. It was
+ *  developed against forgejo since it's the oidc provider
+ *  I had available locally.
+ *
+ * Documentation Referenced In Implementation
+ *   https://forgejo.org/docs/v1.19/user/oauth2-provider/
+ *   https://forgejo.org/docs/v1.19/user/api-usage/
+ *
+ * Vars
+ *   FORGEJO_API_KEY: Key for general api, needs access to read users
+ *   FORGEJO_CLIENT_SECRET: OIDC Client Secret, generated in /user/settings/applications
+ *   FORGEJO_CLIENT_ID: OIDC Client id, generated in /user/settings/applications
+ *  
+ *   FORGEJO_GETUSER_ENDPOINT: Forgejo Static API endpoint that uses general API key to get user info by id
+ *                                                                                         
+ *   The following vars are all ripped from https://[YOUR-FORGEJO-URL]/.well-known/openid-configuration
+ *   This likely could be used to automatically grab the appropriate url, it simply isn't in this 
+ *   implementation for convenience.
+ *
+ *   FORGEJO_USERINFO_ENDPOINT 
+ *   FORGEJO_AUTHORIZATION_ENDPOINT 
+ *   FORGEJO_ACCESSTOKEN_ENDPOINT 
+ *
+ */
+
+// =====================
+//  Imports and Globals
+// =====================
+import axios, { AxiosResponse } from "axios";
+import { UserData } from "../entity/identity";
+
+const FORGEJO_API_KEY = process.env.FORGEJO_API_KEY as string
+const FORGEJO_CLIENT_SECRET = process.env.FORGEJO_CLIENT_SECRET as string
+const FORGEJO_CLIENT_ID = process.env.FORGEJO_CLIENT_ID as string
+
+const FORGEJO_USERINFO_ENDPOINT = process.env.FORGEJO_USERINFO_ENDPOINT as string
+const FORGEJO_AUTHORIZATION_ENDPOINT = process.env.FORGEJO_AUTHORIZATION_ENDPOINT as string
+const FORGEJO_GETUSER_ENDPOINT = process.env.FORGEJO_GETUSER_ENDPOINT as string
+const FORGEJO_ACCESSTOKEN_ENDPOINT = process.env.FORGEJO_ACCESSTOKEN_ENDPOINT as string
+
+const provider = "forgejo";
+
+// ====================
+//  Exported Functions
+// ====================
+
+const getUser = async (accessToken: string): Promise<UserData> => {
+  return axios.get(FORGEJO_USERINFO_ENDPOINT, {
+    headers: {
+      'Authorization': `Bearer ${accessToken}`
+    }
+  })
+    .then((res) => res.data);
+}
+
+const getUsersById = async (userIds: string[]): Promise<UserData[] | null> => {
+  const userDataPromises = userIds.map((userId) =>
+    axios.get(`${FORGEJO_GETUSER_ENDPOINT}?access_token=${FORGEJO_API_KEY}&uid=${userId}`)
+      .then(resp => resp.data)
+      .then((data: UserData) => data)
+  );
+  return Promise.all(userDataPromises);
+}
+
+const validateAuthServer = async (): Promise<Boolean> => {
+  return new Promise(() => true);
+}
+
+const getRedirectURL = (redirectURL: string, scope: string, state: string): string =>
+  `${FORGEJO_AUTHORIZATION_ENDPOINT}?response_type=code&client_id=${FORGEJO_CLIENT_ID}&redirect_uri=${redirectURL}&scope=${scope}&state=${state}`;
+
+const handleRedirectResponse = async (code: string, state: string, redirectUri: string, grantType: string): Promise<UserData> => {
+  const response = await axios.post(FORGEJO_ACCESSTOKEN_ENDPOINT, {
+    client_id: FORGEJO_CLIENT_ID,
+    client_secret: FORGEJO_CLIENT_SECRET,
+    code: code,
+    grant_type: grantType,
+    redirect_uri: redirectUri,
+  }, {
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  });
+
+  const { access_token } = response.data;
+
+  const userData = await getUser(access_token)
+
+  return userData;
+};
+
+export {
+  getUser,
+  getUsersById,
+  getRedirectURL,
+  handleRedirectResponse,
+  validateAuthServer,
+
+  provider,
+}

nt-web-app/identity/google.ts

@@ -0,0 +1,112 @@
+/* =======
+ *  NOTES
+ * =======
+ *
+ * Scope:
+ *  Simple plug and play usage of the google api library to run identity provider functions
+ *  Currently lacks the ability to fetch a user by subscriber identifier, might not be possible
+ *  with the tooling provided.
+ *
+ * Documentation Referenced In Implementation
+ *  https://github.com/googleapis/google-api-nodejs-client?tab=readme-ov-file#oauth2-client 
+ *
+ * Vars
+ *   GOOGLE_CLIENT_SECRET: OIDC Client Secret, accessed in google developer console
+ *   GOOGLE_CLIENT_ID: OIDC Client id, accessed in google developer console
+ *
+ */
+
+// =====================
+//  Imports and Globals
+// =====================
+import axios, { AxiosResponse } from "axios";
+import { UserData } from "../entity/identity";
+import { google } from 'googleapis';
+import jwt from "jsonwebtoken";
+
+const GOOGLE_CLIENT_SECRET = process.env.GOOGLE_CLIENT_SECRET as string
+const GOOGLE_CLIENT_ID = process.env.GOOGLE_CLIENT_ID as string
+
+
+const OAUTH_REDIRECT_URI = process.env.OAUTH_REDIRECT_URI as string;
+
+const provider = "google";
+
+const oauth2Client = new google.auth.OAuth2(
+  GOOGLE_CLIENT_ID,
+  GOOGLE_CLIENT_SECRET,
+  OAUTH_REDIRECT_URI + "/api/auth/code",
+);
+
+const scopes = [
+  'email',
+  'profile',
+
+];
+// ====================
+//
+//  Exported Functions
+// ====================
+
+const getUser = async (id_token: string): Promise<UserData> => {
+  try {
+    const userData = jwt.decode(id_token, {
+      json: true
+    });
+
+    if (userData) {
+      return Promise.resolve({
+        sub: userData.sub!,
+        preferred_username: userData.name!,
+        picture: userData.picture!,
+        email: userData.email!,
+      });
+    }
+  } catch (ex) {
+    console.error(ex);
+  }
+  return new Promise(() => { });
+}
+
+//TODO ADAPT TO GOOGLE
+const getUsersById = async (userIds: string[]): Promise<UserData[] | null> => {
+  return null
+}
+
+const validateAuthServer = async (): Promise<Boolean> => {
+  return new Promise(() => true);
+}
+
+const getRedirectURL = (redirectURL: string, scope: string, state: string): string => {
+  const url = oauth2Client.generateAuthUrl({
+    scope: scopes
+  });
+
+  return url;
+}
+
+
+const handleRedirectResponse = async (code: string, state: string, redirectUri: string, grantType: string): Promise<UserData> => {
+  const response = await oauth2Client.getToken({
+    client_id: GOOGLE_CLIENT_ID,
+    code: code,
+    codeVerifier: state,
+    redirect_uri: redirectUri,
+  });
+
+  const access_token = response.tokens.id_token ?? "";
+
+  const userData = await getUser(access_token);
+
+  return userData;
+};
+
+export {
+  getUser,
+  getUsersById,
+  getRedirectURL,
+  handleRedirectResponse,
+  validateAuthServer,
+
+  provider,
+}

nt-web-app/identity/identity.ts

@@ -0,0 +1,28 @@
+import { getUser, getUsersById, getRedirectURL, handleRedirectResponse, validateAuthServer, provider } from './twitch';
+
+export {
+  getUser,
+  getUsersById,
+  getRedirectURL,
+  handleRedirectResponse,
+  provider,
+  validateAuthServer,
+}
+
+
+/*
+import { UserData } from '../entity/identity';
+
+Potential IdentityProvider Interface to make sure identity providers are handled consistently
+
+interface IdentityProvider {
+  getUser(): Promise<UserData>;
+  getUsersById(): Promise<UserData[]>;
+  getRedirectURL(): string;
+  handleRedirectResponse(): UserData;
+  validateAuthServer(): Promise<Boolean>;
+
+  provider: string;
+}
+*/
+