summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/config/default.js28
-rw-r--r--lib/config/dockerSecret.js4
-rw-r--r--lib/config/environment.js30
-rw-r--r--lib/config/index.js6
-rw-r--r--lib/models/revision.js8
-rw-r--r--lib/models/user.js18
-rwxr-xr-xlib/response.js15
-rw-r--r--lib/web/auth/index.js2
-rw-r--r--lib/web/auth/ldap/index.js5
-rw-r--r--lib/web/auth/mattermost/index.js49
-rw-r--r--lib/web/auth/saml/index.js95
11 files changed, 248 insertions, 12 deletions
diff --git a/lib/config/default.js b/lib/config/default.js
index a14a4294..d04485ce 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -7,6 +7,12 @@ module.exports = {
urladdport: false,
alloworigin: ['localhost'],
usessl: false,
+ hsts: {
+ enable: true,
+ maxAgeSeconds: 31536000,
+ includeSubdomains: true,
+ preload: true
+ },
protocolusessl: false,
usecdn: true,
allowanonymous: true,
@@ -68,6 +74,11 @@ module.exports = {
clientSecret: undefined,
scope: undefined
},
+ mattermost: {
+ baseURL: undefined,
+ clientID: undefined,
+ clientSecret: undefined
+ },
dropbox: {
clientID: undefined,
clientSecret: undefined
@@ -87,6 +98,21 @@ module.exports = {
searchAttributes: undefined,
tlsca: undefined
},
+ saml: {
+ idpSsoUrl: undefined,
+ idpCert: undefined,
+ issuer: undefined,
+ identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
+ groupAttribute: undefined,
+ externalGroups: [],
+ requiredGroups: [],
+ attribute: {
+ id: undefined,
+ username: undefined,
+ email: undefined
+ }
+ },
email: true,
- allowemailregister: true
+ allowemailregister: true,
+ allowpdfexport: true
}
diff --git a/lib/config/dockerSecret.js b/lib/config/dockerSecret.js
index eea2fafd..ac54fd19 100644
--- a/lib/config/dockerSecret.js
+++ b/lib/config/dockerSecret.js
@@ -38,6 +38,10 @@ if (fs.existsSync(basePath)) {
clientID: getSecret('gitlab_clientID'),
clientSecret: getSecret('gitlab_clientSecret')
},
+ mattermost: {
+ clientID: getSecret('mattermost_clientID'),
+ clientSecret: getSecret('mattermost_clientSecret')
+ },
dropbox: {
clientID: getSecret('dropbox_clientID'),
clientSecret: getSecret('dropbox_clientSecret')
diff --git a/lib/config/environment.js b/lib/config/environment.js
index 75381ffc..b7b0e3f8 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -6,8 +6,14 @@ module.exports = {
domain: process.env.HMD_DOMAIN,
urlpath: process.env.HMD_URL_PATH,
port: process.env.HMD_PORT,
- urladdport: process.env.HMD_URL_ADDPORT,
+ urladdport: toBooleanConfig(process.env.HMD_URL_ADDPORT),
usessl: toBooleanConfig(process.env.HMD_USESSL),
+ hsts: {
+ enable: toBooleanConfig(process.env.HMD_HSTS_ENABLE),
+ maxAgeSeconds: process.env.HMD_HSTS_MAX_AGE,
+ includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS),
+ preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD)
+ },
protocolusessl: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL),
alloworigin: process.env.HMD_ALLOW_ORIGIN ? process.env.HMD_ALLOW_ORIGIN.split(',') : undefined,
usecdn: toBooleanConfig(process.env.HMD_USECDN),
@@ -43,6 +49,11 @@ module.exports = {
clientSecret: process.env.HMD_GITLAB_CLIENTSECRET,
scope: process.env.HMD_GITLAB_SCOPE
},
+ mattermost: {
+ baseURL: process.env.HMD_MATTERMOST_BASEURL,
+ clientID: process.env.HMD_MATTERMOST_CLIENTID,
+ clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET
+ },
dropbox: {
clientID: process.env.HMD_DROPBOX_CLIENTID,
clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET
@@ -62,6 +73,21 @@ module.exports = {
searchAttributes: process.env.HMD_LDAP_SEARCHATTRIBUTES,
tlsca: process.env.HMD_LDAP_TLS_CA
},
+ saml: {
+ idpSsoUrl: process.env.HMD_SAML_IDPSSOURL,
+ idpCert: process.env.HMD_SAML_IDPCERT,
+ issuer: process.env.HMD_SAML_ISSUER,
+ identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT,
+ groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE,
+ externalGroups: process.env.HMD_SAML_EXTERNALGROUPS ? process.env.HMD_SAML_EXTERNALGROUPS.split('|') : [],
+ requiredGroups: process.env.HMD_SAML_REQUIREDGROUPS ? process.env.HMD_SAML_REQUIREDGROUPS.split('|') : [],
+ attribute: {
+ id: process.env.HMD_SAML_ATTRIBUTE_ID,
+ username: process.env.HMD_SAML_ATTRIBUTE_USERNAME,
+ email: process.env.HMD_SAML_ATTRIBUTE_EMAIL
+ }
+ },
email: toBooleanConfig(process.env.HMD_EMAIL),
- allowemailregister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER)
+ allowemailregister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER),
+ allowpdfexport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT)
}
diff --git a/lib/config/index.js b/lib/config/index.js
index bea5a6af..3ac3de53 100644
--- a/lib/config/index.js
+++ b/lib/config/index.js
@@ -1,3 +1,4 @@
+
'use strict'
const fs = require('fs')
@@ -89,7 +90,10 @@ config.isTwitterEnable = config.twitter.consumerKey && config.twitter.consumerSe
config.isEmailEnable = config.email
config.isGitHubEnable = config.github.clientID && config.github.clientSecret
config.isGitLabEnable = config.gitlab.clientID && config.gitlab.clientSecret
+config.isMattermostEnable = config.mattermost.clientID && config.mattermost.clientSecret
config.isLDAPEnable = config.ldap.url
+config.isSAMLEnable = config.saml.idpSsoUrl
+config.isPDFExportEnable = config.allowpdfexport
// generate correct path
config.sslcapath = path.join(appRootPath, config.sslcapath)
@@ -106,7 +110,7 @@ config.errorpath = path.join(appRootPath, config.errorpath)
config.prettypath = path.join(appRootPath, config.prettypath)
config.slidepath = path.join(appRootPath, config.slidepath)
-// maek config readonly
+// make config readonly
config = deepFreeze(config)
module.exports = config
diff --git a/lib/models/revision.js b/lib/models/revision.js
index 6f3a746f..225a95d4 100644
--- a/lib/models/revision.js
+++ b/lib/models/revision.js
@@ -110,7 +110,7 @@ module.exports = function (sequelize, DataTypes) {
where: {
noteId: note.id
},
- order: '"createdAt" DESC'
+ order: [['createdAt', 'DESC']]
}).then(function (revisions) {
var data = []
for (var i = 0, l = revisions.length; i < l; i++) {
@@ -131,7 +131,7 @@ module.exports = function (sequelize, DataTypes) {
where: {
noteId: note.id
},
- order: '"createdAt" DESC'
+ order: [['createdAt', 'DESC']]
}).then(function (revisions) {
if (revisions.length <= 0) return callback(null, null)
// measure target revision position
@@ -142,7 +142,7 @@ module.exports = function (sequelize, DataTypes) {
$gte: time
}
},
- order: '"createdAt" DESC'
+ order: [['createdAt', 'DESC']]
}).then(function (count) {
if (count <= 0) return callback(null, null)
sendDmpWorker({
@@ -231,7 +231,7 @@ module.exports = function (sequelize, DataTypes) {
where: {
noteId: note.id
},
- order: '"createdAt" DESC'
+ order: [['createdAt', 'DESC']]
}).then(function (revisions) {
if (revisions.length <= 0) {
// if no revision available
diff --git a/lib/models/user.js b/lib/models/user.js
index e59b86cc..f421fe43 100644
--- a/lib/models/user.js
+++ b/lib/models/user.js
@@ -111,6 +111,15 @@ module.exports = function (sequelize, DataTypes) {
photo = letterAvatars(profile.username)
}
break
+ case 'mattermost':
+ photo = profile.avatarUrl
+ if (photo) {
+ if (bigger) photo = photo.replace(/(\?s=)\d*$/i, '$1400')
+ else photo = photo.replace(/(\?s=)\d*$/i, '$196')
+ } else {
+ photo = letterAvatars(profile.username)
+ }
+ break
case 'dropbox':
// no image api provided, use gravatar
photo = 'https://www.gravatar.com/avatar/' + md5(profile.emails[0].value)
@@ -134,6 +143,15 @@ module.exports = function (sequelize, DataTypes) {
photo = letterAvatars(profile.username)
}
break
+ case 'saml':
+ if (profile.emails[0]) {
+ photo = 'https://www.gravatar.com/avatar/' + md5(profile.emails[0])
+ if (bigger) photo += '?s=400'
+ else photo += '?s=96'
+ } else {
+ photo = letterAvatars(profile.username)
+ }
+ break
}
return photo
},
diff --git a/lib/response.js b/lib/response.js
index a22d1e70..9f3d5a44 100755
--- a/lib/response.js
+++ b/lib/response.js
@@ -64,11 +64,14 @@ function showIndex (req, res, next) {
twitter: config.isTwitterEnable,
github: config.isGitHubEnable,
gitlab: config.isGitLabEnable,
+ mattermost: config.isMattermostEnable,
dropbox: config.isDropboxEnable,
google: config.isGoogleEnable,
ldap: config.isLDAPEnable,
+ saml: config.isSAMLEnable,
email: config.isEmailEnable,
allowemailregister: config.allowemailregister,
+ allowpdfexport: config.allowpdfexport,
signin: req.isAuthenticated(),
infoMessage: req.flash('info'),
errorMessage: req.flash('error')
@@ -94,11 +97,14 @@ function responseHackMD (res, note) {
twitter: config.isTwitterEnable,
github: config.isGitHubEnable,
gitlab: config.isGitLabEnable,
+ mattermost: config.isMattermostEnable,
dropbox: config.isDropboxEnable,
google: config.isGoogleEnable,
ldap: config.isLDAPEnable,
+ saml: config.isSAMLEnable,
email: config.isEmailEnable,
- allowemailregister: config.allowemailregister
+ allowemailregister: config.allowemailregister,
+ allowpdfexport: config.allowpdfexport
})
}
@@ -382,7 +388,12 @@ function noteActions (req, res, next) {
actionInfo(req, res, note)
break
case 'pdf':
- actionPDF(req, res, note)
+ if (config.allowpdfexport) {
+ actionPDF(req, res, note)
+ } else {
+ logger.error('PDF export failed: Disabled by config. Set "allowpdfexport: true" to enable. Check the documentation for details')
+ response.errorForbidden(res)
+ }
break
case 'gist':
actionGist(req, res, note)
diff --git a/lib/web/auth/index.js b/lib/web/auth/index.js
index b5ca8434..db5ff11d 100644
--- a/lib/web/auth/index.js
+++ b/lib/web/auth/index.js
@@ -33,9 +33,11 @@ if (config.isFacebookEnable) authRouter.use(require('./facebook'))
if (config.isTwitterEnable) authRouter.use(require('./twitter'))
if (config.isGitHubEnable) authRouter.use(require('./github'))
if (config.isGitLabEnable) authRouter.use(require('./gitlab'))
+if (config.isMattermostEnable) authRouter.use(require('./mattermost'))
if (config.isDropboxEnable) authRouter.use(require('./dropbox'))
if (config.isGoogleEnable) authRouter.use(require('./google'))
if (config.isLDAPEnable) authRouter.use(require('./ldap'))
+if (config.isSAMLEnable) authRouter.use(require('./saml'))
if (config.isEmailEnable) authRouter.use(require('./email'))
// logout
diff --git a/lib/web/auth/ldap/index.js b/lib/web/auth/ldap/index.js
index 766c5cbc..9a63578a 100644
--- a/lib/web/auth/ldap/index.js
+++ b/lib/web/auth/ldap/index.js
@@ -23,9 +23,10 @@ passport.use(new LDAPStrategy({
tlsOptions: config.ldap.tlsOptions || null
}
}, function (user, done) {
+ var uuid = user.uidNumber || user.uid || user.sAMAccountName
var profile = {
- id: 'LDAP-' + user.uidNumber,
- username: user.uid,
+ id: 'LDAP-' + uuid,
+ username: uuid,
displayName: user.displayName,
emails: user.mail ? [user.mail] : [],
avatarUrl: null,
diff --git a/lib/web/auth/mattermost/index.js b/lib/web/auth/mattermost/index.js
new file mode 100644
index 00000000..9ccf3de5
--- /dev/null
+++ b/lib/web/auth/mattermost/index.js
@@ -0,0 +1,49 @@
+'use strict'
+
+const Router = require('express').Router
+const passport = require('passport')
+const Mattermost = require('mattermost')
+const OAuthStrategy = require('passport-oauth2').Strategy
+const config = require('../../../config')
+const {setReturnToFromReferer, passportGeneralCallback} = require('../utils')
+
+const mattermost = new Mattermost.Client()
+
+let mattermostAuth = module.exports = Router()
+
+let mattermostStrategy = new OAuthStrategy({
+ authorizationURL: config.mattermost.baseURL + '/oauth/authorize',
+ tokenURL: config.mattermost.baseURL + '/oauth/access_token',
+ clientID: config.mattermost.clientID,
+ clientSecret: config.mattermost.clientSecret,
+ callbackURL: config.serverurl + '/auth/mattermost/callback'
+}, passportGeneralCallback)
+
+mattermostStrategy.userProfile = (accessToken, done) => {
+ mattermost.setUrl(config.mattermost.baseURL)
+ mattermost.token = accessToken
+ mattermost.useHeaderToken()
+ mattermost.getMe(
+ (data) => {
+ done(null, data)
+ },
+ (err) => {
+ done(err)
+ }
+ )
+}
+
+passport.use(mattermostStrategy)
+
+mattermostAuth.get('/auth/mattermost', function (req, res, next) {
+ setReturnToFromReferer(req)
+ passport.authenticate('oauth2')(req, res, next)
+})
+
+// mattermost auth callback
+mattermostAuth.get('/auth/mattermost/callback',
+ passport.authenticate('oauth2', {
+ successReturnToOrRedirect: config.serverurl + '/',
+ failureRedirect: config.serverurl + '/'
+ })
+)
diff --git a/lib/web/auth/saml/index.js b/lib/web/auth/saml/index.js
new file mode 100644
index 00000000..386293ae
--- /dev/null
+++ b/lib/web/auth/saml/index.js
@@ -0,0 +1,95 @@
+'use strict'
+
+const Router = require('express').Router
+const passport = require('passport')
+const SamlStrategy = require('passport-saml').Strategy
+const config = require('../../../config')
+const models = require('../../../models')
+const logger = require('../../../logger')
+const {urlencodedParser} = require('../../utils')
+const fs = require('fs')
+const intersection = function (array1, array2) { return array1.filter((n) => array2.includes(n)) }
+
+let samlAuth = module.exports = Router()
+
+passport.use(new SamlStrategy({
+ callbackUrl: config.serverurl + '/auth/saml/callback',
+ entryPoint: config.saml.idpSsoUrl,
+ issuer: config.saml.issuer || config.serverurl,
+ cert: fs.readFileSync(config.saml.idpCert, 'utf-8'),
+ identifierFormat: config.saml.identifierFormat
+}, function (user, done) {
+ // check authorization if needed
+ if (config.saml.externalGroups && config.saml.grouptAttribute) {
+ var externalGroups = intersection(config.saml.externalGroups, user[config.saml.groupAttribute])
+ if (externalGroups.length > 0) {
+ logger.error('saml permission denied: ' + externalGroups.join(', '))
+ return done('Permission denied', null)
+ }
+ }
+ if (config.saml.requiredGroups && config.saml.grouptAttribute) {
+ if (intersection(config.saml.requiredGroups, user[config.saml.groupAttribute]).length === 0) {
+ logger.error('saml permission denied')
+ return done('Permission denied', null)
+ }
+ }
+ // user creation
+ var uuid = user[config.saml.attribute.id] || user.nameID
+ var profile = {
+ provider: 'saml',
+ id: 'SAML-' + uuid,
+ username: user[config.saml.attribute.username] || user.nameID,
+ emails: user[config.saml.attribute.email] ? [user[config.saml.attribute.email]] : []
+ }
+ if (profile.emails.length === 0 && config.saml.identifierFormat === 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress') {
+ profile.emails.push(user.nameID)
+ }
+ var stringifiedProfile = JSON.stringify(profile)
+ models.User.findOrCreate({
+ where: {
+ profileid: profile.id.toString()
+ },
+ defaults: {
+ profile: stringifiedProfile
+ }
+ }).spread(function (user, created) {
+ if (user) {
+ var needSave = false
+ if (user.profile !== stringifiedProfile) {
+ user.profile = stringifiedProfile
+ needSave = true
+ }
+ if (needSave) {
+ user.save().then(function () {
+ if (config.debug) { logger.debug('user login: ' + user.id) }
+ return done(null, user)
+ })
+ } else {
+ if (config.debug) { logger.debug('user login: ' + user.id) }
+ return done(null, user)
+ }
+ }
+ }).catch(function (err) {
+ logger.error('saml auth failed: ' + err)
+ return done(err, null)
+ })
+}))
+
+samlAuth.get('/auth/saml',
+ passport.authenticate('saml', {
+ successReturnToOrRedirect: config.serverurl + '/',
+ failureRedirect: config.serverurl + '/'
+ })
+)
+
+samlAuth.post('/auth/saml/callback', urlencodedParser,
+ passport.authenticate('saml', {
+ successReturnToOrRedirect: config.serverurl + '/',
+ failureRedirect: config.serverurl + '/'
+ })
+)
+
+samlAuth.get('/auth/saml/metadata', function (req, res) {
+ res.type('application/xml')
+ res.send(passport._strategy('saml').generateServiceProviderMetadata())
+})
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 10:02:48 +0000