88 lines
2.8 KiB
JavaScript
88 lines
2.8 KiB
JavaScript
import isNativeToken from "./common/is-native-token.js";
|
|
import { Users, AccessTokens, Apps } from "../../models/index.js";
|
|
import { Cache } from "../../misc/cache.js";
|
|
import { localUserByIdCache, localUserByNativeTokenCache } from "../../services/user-cache.js";
|
|
const appCache = new Cache("app", 60 * 30);
|
|
export class AuthenticationError extends Error {
|
|
constructor(message){
|
|
super(message);
|
|
this.name = "AuthenticationError";
|
|
}
|
|
}
|
|
export default (async (authorization, bodyToken, bypassUserCache = false)=>{
|
|
let token = null;
|
|
// check if there is an authorization header set
|
|
if (authorization != null) {
|
|
if (bodyToken != null) {
|
|
throw new AuthenticationError("using multiple authorization schemes");
|
|
}
|
|
// check if OAuth 2.0 Bearer tokens are being used
|
|
// Authorization schemes are case insensitive
|
|
if (authorization.substring(0, 7).toLowerCase() === "bearer ") {
|
|
token = authorization.substring(7);
|
|
} else {
|
|
throw new AuthenticationError("unsupported authentication scheme");
|
|
}
|
|
} else if (bodyToken != null) {
|
|
token = bodyToken;
|
|
} else {
|
|
return [
|
|
null,
|
|
null
|
|
];
|
|
}
|
|
if (isNativeToken(token)) {
|
|
const user = bypassUserCache ? await Users.findOneBy({
|
|
token
|
|
}) : await localUserByNativeTokenCache.fetch(token, ()=>Users.findOneBy({
|
|
token: token ?? undefined
|
|
}), true);
|
|
if (user == null) {
|
|
throw new AuthenticationError("unknown token");
|
|
}
|
|
return [
|
|
user,
|
|
null
|
|
];
|
|
} else {
|
|
const accessToken = await AccessTokens.findOne({
|
|
where: [
|
|
{
|
|
hash: token.toLowerCase()
|
|
},
|
|
{
|
|
token: token
|
|
}
|
|
]
|
|
});
|
|
if (accessToken == null) {
|
|
throw new AuthenticationError("unknown token");
|
|
}
|
|
AccessTokens.update(accessToken.id, {
|
|
lastUsedAt: new Date()
|
|
});
|
|
const user = bypassUserCache ? await Users.findOneBy({
|
|
id: accessToken.userId
|
|
}) : await localUserByIdCache.fetch(accessToken.userId, ()=>Users.findOneBy({
|
|
id: accessToken.userId
|
|
}), true);
|
|
if (accessToken.appId) {
|
|
const app = await appCache.fetch(accessToken.appId, ()=>Apps.findOneByOrFail({
|
|
id: accessToken.appId
|
|
}), true);
|
|
return [
|
|
user,
|
|
{
|
|
id: accessToken.id,
|
|
permission: app.permission
|
|
}
|
|
];
|
|
} else {
|
|
return [
|
|
user,
|
|
accessToken
|
|
];
|
|
}
|
|
}
|
|
});
|