access token endpoints and other backend support

server/routers/accessToken/deleteAccessToken.ts

@@ -0,0 +1,67 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import response from "@server/utils/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { resourceAccessToken } from "@server/db/schema";
+import { and, eq } from "drizzle-orm";
+import db from "@server/db";
+
+const deleteAccessTokenParamsSchema = z.object({
+    accessTokenId: z.string()
+});
+
+export async function deleteAccessToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = deleteAccessTokenParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { accessTokenId } = parsedParams.data;
+
+        const [accessToken] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(and(eq(resourceAccessToken.accessTokenId, accessTokenId)));
+
+        if (!accessToken) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "Resource access token not found"
+                )
+            );
+        }
+
+        await db
+            .delete(resourceAccessToken)
+            .where(and(eq(resourceAccessToken.accessTokenId, accessTokenId)));
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Resource access token deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/accessToken/generateAccessToken.ts

@@ -0,0 +1,120 @@
+import { hash } from "@node-rs/argon2";
+import {
+    generateId,
+    generateIdFromEntropySize,
+    SESSION_COOKIE_EXPIRES
+} from "@server/auth";
+import db from "@server/db";
+import { resourceAccessToken, resources } from "@server/db/schema";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/utils/response";
+import { eq } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { createDate, TimeSpan } from "oslo";
+
+export const generateAccessTokenBodySchema = z.object({
+    validForSeconds: z.number().int().positive().optional(), // seconds
+    title: z.string().optional(),
+    description: z.string().optional()
+});
+
+export const generateAccssTokenParamsSchema = z.object({
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export type GenerateAccessTokenResponse = {
+    token: string;
+};
+
+export async function generateAccessToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    const parsedBody = generateAccessTokenBodySchema.safeParse(req.body);
+
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const parsedParams = generateAccssTokenParamsSchema.safeParse(req.params);
+
+    if (!parsedParams.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedParams.error).toString()
+            )
+        );
+    }
+
+    const { resourceId } = parsedParams.data;
+    const { validForSeconds, title, description } = parsedBody.data;
+
+    const [resource] = await db
+        .select()
+        .from(resources)
+        .where(eq(resources.resourceId, resourceId));
+
+    if (!resource) {
+        return next(createHttpError(HttpCode.NOT_FOUND, "Resource not found"));
+    }
+
+    try {
+        const sessionLength = validForSeconds
+            ? validForSeconds * 1000
+            : SESSION_COOKIE_EXPIRES;
+        const expiresAt = validForSeconds
+            ? createDate(new TimeSpan(validForSeconds, "s")).getTime()
+            : undefined;
+
+        const token = generateIdFromEntropySize(25);
+
+        const tokenHash = await hash(token, {
+            memoryCost: 19456,
+            timeCost: 2,
+            outputLen: 32,
+            parallelism: 1
+        });
+
+        const id = generateId(15);
+        await db.insert(resourceAccessToken).values({
+            accessTokenId: id,
+            orgId: resource.orgId,
+            resourceId,
+            tokenHash,
+            expiresAt: expiresAt || null,
+            sessionLength: sessionLength,
+            title: title || `${resource.name} Token ${new Date().getTime()}`,
+            description: description || null,
+            createdAt: new Date().getTime()
+        });
+
+        return response<GenerateAccessTokenResponse>(res, {
+            data: {
+                token: `${id}.${token}`
+            },
+            success: true,
+            error: false,
+            message: "Resource access token generated successfully",
+            status: HttpCode.OK
+        });
+    } catch (e) {
+        logger.error(e);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to authenticate with resource"
+            )
+        );
+    }
+}

server/routers/accessToken/index.ts

@@ -0,0 +1,3 @@
+export * from "./generateAccessToken";
+export * from "./listAccessTokens";
+export * from "./deleteAccessToken";

server/routers/accessToken/listAccessTokens.ts

@@ -0,0 +1,183 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db } from "@server/db";
+import {
+    resources,
+    userResources,
+    roleResources,
+    resourceAccessToken
+} from "@server/db/schema";
+import response from "@server/utils/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { sql, eq, or, inArray, and, count } from "drizzle-orm";
+import logger from "@server/logger";
+import stoi from "@server/utils/stoi";
+
+const listAccessTokensParamsSchema = z
+    .object({
+        resourceId: z
+            .string()
+            .optional()
+            .transform(stoi)
+            .pipe(z.number().int().positive().optional()),
+        orgId: z.string().optional()
+    })
+    .refine((data) => !!data.resourceId !== !!data.orgId, {
+        message: "Either resourceId or orgId must be provided, but not both"
+    });
+
+const listAccessTokensSchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative()),
+
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+function queryAccessTokens(
+    accessibleResourceIds: number[],
+    orgId?: string,
+    resourceId?: number
+) {
+    const cols = {
+        accessTokenId: resourceAccessToken.accessTokenId,
+        orgId: resourceAccessToken.orgId,
+        resourceId: resourceAccessToken.resourceId,
+        sessionLength: resourceAccessToken.sessionLength,
+        expiresAt: resourceAccessToken.expiresAt,
+        title: resourceAccessToken.title,
+        description: resourceAccessToken.description,
+        createdAt: resourceAccessToken.createdAt
+    };
+
+    if (orgId) {
+        return db
+            .select(cols)
+            .from(resourceAccessToken)
+            .where(
+                and(
+                    inArray(resourceAccessToken.resourceId, accessibleResourceIds),
+                    eq(resourceAccessToken.orgId, orgId)
+                )
+            );
+    } else if (resourceId) {
+        return db
+            .select(cols)
+            .from(resourceAccessToken)
+            .where(
+                and(
+                    inArray(resources.resourceId, accessibleResourceIds),
+                    eq(resources.resourceId, resourceId)
+                )
+            );
+    }
+}
+
+export type ListAccessTokensResponse = {
+    accessTokens: NonNullable<Awaited<ReturnType<typeof queryAccessTokens>>>;
+    pagination: { total: number; limit: number; offset: number };
+};
+
+export async function listAccessTokens(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = listAccessTokensSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedQuery.error.errors.map((e) => e.message).join(", ")
+                )
+            );
+        }
+        const { limit, offset } = parsedQuery.data;
+
+        const parsedParams = listAccessTokensParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    parsedParams.error.errors.map((e) => e.message).join(", ")
+                )
+            );
+        }
+        const { orgId, resourceId } = parsedParams.data;
+
+        if (orgId && orgId !== req.userOrgId) {
+            return next(
+                createHttpError(
+                    HttpCode.FORBIDDEN,
+                    "User does not have access to this organization"
+                )
+            );
+        }
+
+        const accessibleResources = await db
+            .select({
+                resourceId: sql<number>`COALESCE(${userResources.resourceId}, ${roleResources.resourceId})`
+            })
+            .from(userResources)
+            .fullJoin(
+                roleResources,
+                eq(userResources.resourceId, roleResources.resourceId)
+            )
+            .where(
+                or(
+                    eq(userResources.userId, req.user!.userId),
+                    eq(roleResources.roleId, req.userOrgRoleId!)
+                )
+            );
+
+        const accessibleResourceIds = accessibleResources.map(
+            (resource) => resource.resourceId
+        );
+
+        let countQuery: any = db
+            .select({ count: count() })
+            .from(resources)
+            .where(inArray(resources.resourceId, accessibleResourceIds));
+
+        const baseQuery = queryAccessTokens(
+            accessibleResourceIds,
+            orgId,
+            resourceId
+        );
+
+        const list = await baseQuery!.limit(limit).offset(offset);
+        const totalCountResult = await countQuery;
+        const totalCount = totalCountResult[0].count;
+
+        return response<ListAccessTokensResponse>(res, {
+            data: {
+                accessTokens: list,
+                pagination: {
+                    total: totalCount,
+                    limit,
+                    offset
+                }
+            },
+            success: true,
+            error: false,
+            message: "Access tokens retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        throw error;
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/auth/checkResourceSession.ts

@@ -4,7 +4,6 @@ import { z } from "zod";
 import { fromError } from "zod-validation-error";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/utils";
-import { validateSessionToken } from "@server/auth";
 import { validateResourceSessionToken } from "@server/auth/resource";
 
 export const params = z.object({

server/routers/badger/verifySession.ts

@@ -7,9 +7,11 @@ import { response } from "@server/utils/response";
 import { validateSessionToken } from "@server/auth";
 import db from "@server/db";
 import {
+    resourceAccessToken,
     resourcePassword,
     resourcePincode,
     resources,
+    resourceWhitelist,
     User,
     userOrgs
 } from "@server/db/schema";
@@ -89,7 +91,12 @@ export async function verifyResourceSession(
             return notAllowed(res);
         }
 
-        if (!resource.sso && !pincode && !password) {
+        if (
+            !resource.sso &&
+            !pincode &&
+            !password &&
+            !resource.emailWhitelistEnabled
+        ) {
             logger.debug("Resource allowed because no auth");
             return allowed(res);
         }
@@ -103,7 +110,7 @@ export async function verifyResourceSession(
         const sessionToken = sessions[config.server.session_cookie_name];
 
         // check for unified login
-        if (sso && sessionToken && !resource.otpEnabled) {
+        if (sso && sessionToken) {
             const { session, user } = await validateSessionToken(sessionToken);
             if (session && user) {
                 const isAllowed = await isUserAllowedToAccessResource(
@@ -125,69 +132,46 @@ export async function verifyResourceSession(
                 `${config.server.resource_session_cookie_name}_${resource.resourceId}`
             ];
 
-        if (
-            sso &&
-            sessionToken &&
-            resourceSessionToken &&
-            resource.otpEnabled
-        ) {
-            const { session, user } = await validateSessionToken(sessionToken);
-            const { resourceSession } = await validateResourceSessionToken(
-                resourceSessionToken,
-                resource.resourceId
-            );
-
-            if (session && user && resourceSession) {
-                if (!resourceSession.usedOtp) {
-                    logger.debug("Resource not allowed because OTP not used");
-                    return notAllowed(res, redirectUrl);
-                }
-
-                const isAllowed = await isUserAllowedToAccessResource(
-                    user,
-                    resource
-                );
-
-                if (isAllowed) {
-                    logger.debug(
-                        "Resource allowed because user and resource session is valid"
-                    );
-                    return allowed(res);
-                }
-            }
-        }
-
-        if ((pincode || password) && resourceSessionToken) {
+        if (resourceSessionToken) {
             const { resourceSession } = await validateResourceSessionToken(
                 resourceSessionToken,
                 resource.resourceId
             );
 
             if (resourceSession) {
-                if (resource.otpEnabled && !resourceSession.usedOtp) {
-                    logger.debug("Resource not allowed because OTP not used");
-                    return notAllowed(res, redirectUrl);
-                }
+                return allowed(res);
 
-                if (
-                    pincode &&
-                    resourceSession.pincodeId === pincode.pincodeId
-                ) {
-                    logger.debug(
-                        "Resource allowed because pincode session is valid"
-                    );
-                    return allowed(res);
-                }
-
-                if (
-                    password &&
-                    resourceSession.passwordId === password.passwordId
-                ) {
-                    logger.debug(
-                        "Resource allowed because password session is valid"
-                    );
-                    return allowed(res);
-                }
+                // Might not be needed
+                // if (pincode && resourceSession.pincodeId) {
+                //     logger.debug(
+                //         "Resource allowed because pincode session is valid"
+                //     );
+                //     return allowed(res);
+                // }
+                //
+                // if (password && resourceSession.passwordId) {
+                //     logger.debug(
+                //         "Resource allowed because password session is valid"
+                //     );
+                //     return allowed(res);
+                // }
+                //
+                // if (
+                //     resource.emailWhitelistEnabled &&
+                //     resourceSession.whitelistId
+                // ) {
+                //     logger.debug(
+                //         "Resource allowed because whitelist session is valid"
+                //     );
+                //     return allowed(res);
+                // }
+                //
+                // if (resourceSession.accessTokenId) {
+                //     logger.debug(
+                //         "Resource allowed because access token session is valid"
+                //     );
+                //     return allowed(res);
+                // }
             }
         }
 

server/routers/external.ts

@@ -6,8 +6,10 @@ import * as target from "./target";
 import * as user from "./user";
 import * as auth from "./auth";
 import * as role from "./role";
+import * as accessToken from "./accessToken";
 import HttpCode from "@server/types/HttpCode";
 import {
+    verifyAccessTokenAccess,
     rateLimitMiddleware,
     verifySessionMiddleware,
     verifySessionUserMiddleware,
@@ -114,11 +116,13 @@ authenticated.put(
     verifyUserHasAction(ActionsEnum.createResource),
     resource.createResource
 );
+
 authenticated.get(
     "/site/:siteId/resources",
     verifyUserHasAction(ActionsEnum.listResources),
     resource.listResources
 );
+
 authenticated.get(
     "/org/:orgId/resources",
     verifyOrgAccess,
@@ -278,31 +282,59 @@ authenticated.post(
 authenticated.post(
     `/resource/:resourceId/password`,
     verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.updateResource), // REVIEW: group all resource related updates under update resource?
+    verifyUserHasAction(ActionsEnum.setResourcePassword),
     resource.setResourcePassword
 );
 
 authenticated.post(
     `/resource/:resourceId/pincode`,
     verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.updateResource),
+    verifyUserHasAction(ActionsEnum.setResourcePincode),
     resource.setResourcePincode
 );
 
 authenticated.post(
     `/resource/:resourceId/whitelist`,
     verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.updateResource),
+    verifyUserHasAction(ActionsEnum.setResourceWhitelist),
     resource.setResourceWhitelist
 );
 
 authenticated.get(
     `/resource/:resourceId/whitelist`,
     verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.getResource),
+    verifyUserHasAction(ActionsEnum.getResourceWhitelist),
     resource.getResourceWhitelist
 );
 
+authenticated.post(
+    `/resource/:resourceId/access-token`,
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.generateAccessToken),
+    accessToken.generateAccessToken
+);
+
+authenticated.delete(
+    `/access-token/:accessTokenId`,
+    verifyAccessTokenAccess,
+    verifyUserHasAction(ActionsEnum.deleteAcessToken),
+    accessToken.deleteAccessToken
+);
+
+authenticated.get(
+    `/org/:orgId/access-tokens`,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listAccessTokens),
+    accessToken.listAccessTokens
+);
+
+authenticated.get(
+    `/resource/:resourceId/access-tokens`,
+    verifyResourceAccess,
+    verifyUserHasAction(ActionsEnum.listAccessTokens),
+    accessToken.listAccessTokens
+);
+
 unauthenticated.get("/resource/:resourceId/auth", resource.getResourceAuthInfo);
 
 // authenticated.get(
@@ -422,3 +454,7 @@ authRouter.post("/reset-password/", auth.resetPassword);
 authRouter.post("/resource/:resourceId/password", resource.authWithPassword);
 authRouter.post("/resource/:resourceId/pincode", resource.authWithPincode);
 authRouter.post("/resource/:resourceId/whitelist", resource.authWithWhitelist);
+authRouter.post(
+    "/resource/:resourceId/access-token",
+    resource.authWithAccessToken
+);

server/routers/resource/authWithAccessToken.ts

@@ -0,0 +1,157 @@
+import { generateSessionToken } from "@server/auth";
+import db from "@server/db";
+import { resourceAccessToken, resources } from "@server/db/schema";
+import HttpCode from "@server/types/HttpCode";
+import response from "@server/utils/response";
+import { eq, and } from "drizzle-orm";
+import { NextFunction, Request, Response } from "express";
+import createHttpError from "http-errors";
+import { z } from "zod";
+import { fromError } from "zod-validation-error";
+import {
+    createResourceSession,
+    serializeResourceSessionCookie
+} from "@server/auth/resource";
+import config from "@server/config";
+import logger from "@server/logger";
+import { verify } from "@node-rs/argon2";
+import { isWithinExpirationDate } from "oslo";
+
+const authWithAccessTokenBodySchema = z.object({
+    accessToken: z.string()
+});
+
+const authWithAccessTokenParamsSchema = z.object({
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+export type AuthWithAccessTokenResponse = {
+    session?: string;
+};
+
+export async function authWithAccessToken(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    const parsedBody = authWithAccessTokenBodySchema.safeParse(req.body);
+
+    if (!parsedBody.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedBody.error).toString()
+            )
+        );
+    }
+
+    const parsedParams = authWithAccessTokenParamsSchema.safeParse(req.params);
+
+    if (!parsedParams.success) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                fromError(parsedParams.error).toString()
+            )
+        );
+    }
+
+    const { resourceId } = parsedParams.data;
+    const { accessToken: at } = parsedBody.data;
+
+    const [accessTokenId, accessToken] = at.split(".");
+
+    try {
+        const [result] = await db
+            .select()
+            .from(resourceAccessToken)
+            .where(
+                and(
+                    eq(resourceAccessToken.resourceId, resourceId),
+                    eq(resourceAccessToken.accessTokenId, accessTokenId)
+                )
+            )
+            .leftJoin(
+                resources,
+                eq(resources.resourceId, resourceAccessToken.resourceId)
+            )
+            .limit(1);
+
+        const resource = result?.resources;
+        const tokenItem = result?.resourceAccessToken;
+
+        if (!tokenItem) {
+            return next(
+                createHttpError(
+                    HttpCode.UNAUTHORIZED,
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Email is not whitelisted"
+                    )
+                )
+            );
+        }
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, "Resource does not exist")
+            );
+        }
+
+        const validCode = await verify(tokenItem.tokenHash, accessToken, {
+            memoryCost: 19456,
+            timeCost: 2,
+            outputLen: 32,
+            parallelism: 1
+        });
+
+        if (!validCode) {
+            return next(
+                createHttpError(HttpCode.UNAUTHORIZED, "Invalid access token")
+            );
+        }
+
+        if (
+            tokenItem.expiresAt &&
+            !isWithinExpirationDate(new Date(tokenItem.expiresAt))
+        ) {
+            return next(
+                createHttpError(
+                    HttpCode.UNAUTHORIZED,
+                    "Access token has expired"
+                )
+            );
+        }
+
+        const token = generateSessionToken();
+        await createResourceSession({
+            resourceId,
+            token,
+            accessTokenId: tokenItem.accessTokenId,
+            sessionLength: tokenItem.sessionLength,
+            expiresAt: tokenItem.expiresAt,
+            doNotExtend: tokenItem.expiresAt ? false : true
+        });
+        const cookieName = `${config.server.resource_session_cookie_name}_${resource.resourceId}`;
+        const cookie = serializeResourceSessionCookie(cookieName, token);
+        res.appendHeader("Set-Cookie", cookie);
+
+        return response<AuthWithAccessTokenResponse>(res, {
+            data: {
+                session: token
+            },
+            success: true,
+            error: false,
+            message: "Authenticated with resource successfully",
+            status: HttpCode.OK
+        });
+    } catch (e) {
+        logger.error(e);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to authenticate with resource"
+            )
+        );
+    }
+}

server/routers/resource/authWithWhitelist.ts

@@ -174,7 +174,6 @@ export async function authWithWhitelist(
         const cookie = serializeResourceSessionCookie(
             cookieName,
             token,
-            resource.fullDomain
         );
         res.appendHeader("Set-Cookie", cookie);
 
@@ -188,7 +187,6 @@ export async function authWithWhitelist(
             status: HttpCode.OK
         });
     } catch (e) {
-        throw e;
         logger.error(e);
         return next(
             createHttpError(

server/routers/resource/index.ts

@@ -15,3 +15,4 @@ export * from "./authWithPincode";
 export * from "./setResourceWhitelist";
 export * from "./getResourceWhitelist";
 export * from "./authWithWhitelist";
+export * from "./authWithAccessToken";