lamassu/lamassu-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: server code formatting

Browse source
This commit is contained in:
Rafael Taranto 2025-05-12 15:35:00 +01:00
parent aedabcbdee
commit 68517170e2
234 changed files with 9824 additions and 6195 deletions
Download patch file Download diff file Expand all files Collapse all files

246
packages/server/lib/new-admin/graphql/modules/authentication/FIDO2FAStrategy.js
View file

@ -12,60 +12,70 @@ const devMode = require('minimist')(process.argv.slice(2)).dev
const REMEMBER_ME_AGE = 90 * T.day
const generateAttestationOptions = (session, options) => {
return users.getUserById(options.userId).then(user => {
return Promise.all([credentials.getHardwareCredentialsByUserId(user.id), user])
}).then(([userDevices, user]) => {
const opts = simpleWebauthn.generateAttestationOptions({
rpName: 'Lamassu',
rpID: options.domain,
userName: user.username,
userID: user.id,
timeout: 60000,
attestationType: 'indirect',
excludeCredentials: userDevices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
})),
authenticatorSelection: {
userVerification: 'discouraged',
requireResidentKey: false
}
return users
.getUserById(options.userId)
.then(user => {
return Promise.all([
credentials.getHardwareCredentialsByUserId(user.id),
user,
])
})
session.webauthn = {
attestation: {
challenge: opts.challenge
}
}
return opts
})
}
const generateAssertionOptions = (session, options) => {
return userManagement.authenticateUser(options.username, options.password).then(user => {
return credentials.getHardwareCredentialsByUserId(user.id).then(devices => {
const opts = simpleWebauthn.generateAssertionOptions({
.then(([userDevices, user]) => {
const opts = simpleWebauthn.generateAttestationOptions({
rpName: 'Lamassu',
rpID: options.domain,
userName: user.username,
userID: user.id,
timeout: 60000,
allowCredentials: devices.map(dev => ({
attestationType: 'indirect',
excludeCredentials: userDevices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
userVerification: 'discouraged',
rpID: options.domain
authenticatorSelection: {
userVerification: 'discouraged',
requireResidentKey: false,
},
})
session.webauthn = {
assertion: {
challenge: opts.challenge
}
attestation: {
challenge: opts.challenge,
},
}
return opts
})
})
}
const generateAssertionOptions = (session, options) => {
return userManagement
.authenticateUser(options.username, options.password)
.then(user => {
return credentials
.getHardwareCredentialsByUserId(user.id)
.then(devices => {
const opts = simpleWebauthn.generateAssertionOptions({
timeout: 60000,
allowCredentials: devices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
userVerification: 'discouraged',
rpID: options.domain,
})
session.webauthn = {
assertion: {
challenge: opts.challenge,
},
}
return opts
})
})
}
const validateAttestation = (session, options) => {
@ -78,98 +88,112 @@ const validateAttestation = (session, options) => {
credential: options.attestationResponse,
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain
})
])
.then(([user, verification]) => {
const { verified, attestationInfo } = verification
expectedRPID: options.domain,
}),
]).then(([user, verification]) => {
const { verified, attestationInfo } = verification
if (!(verified || attestationInfo)) {
session.webauthn = null
return false
}
if (!(verified || attestationInfo)) {
session.webauthn = null
return false
}
const {
counter,
credentialPublicKey,
credentialID
} = attestationInfo
const { counter, credentialPublicKey, credentialID } = attestationInfo
return credentials.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(device => device.data.credentialID === credentialID)
return credentials
.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(
device => device.data.credentialID === credentialID,
)
if (!existingDevice) {
const newDevice = {
counter,
credentialPublicKey,
credentialID
}
credentials.createHardwareCredential(user.id, newDevice)
if (!existingDevice) {
const newDevice = {
counter,
credentialPublicKey,
credentialID,
}
credentials.createHardwareCredential(user.id, newDevice)
}
session.webauthn = null
return verified
})
})
session.webauthn = null
return verified
})
})
}
const validateAssertion = (session, options) => {
return userManagement.authenticateUser(options.username, options.password).then(user => {
const expectedChallenge = session.webauthn.assertion.challenge
return userManagement
.authenticateUser(options.username, options.password)
.then(user => {
const expectedChallenge = session.webauthn.assertion.challenge
return credentials.getHardwareCredentialsByUserId(user.id).then(devices => {
const dbAuthenticator = _.find(dev => {
return Buffer.from(dev.data.credentialID).compare(base64url.toBuffer(options.assertionResponse.rawId)) === 0
}, devices)
return credentials
.getHardwareCredentialsByUserId(user.id)
.then(devices => {
const dbAuthenticator = _.find(dev => {
return (
Buffer.from(dev.data.credentialID).compare(
base64url.toBuffer(options.assertionResponse.rawId),
) === 0
)
}, devices)
if (!dbAuthenticator.data) {
throw new Error(`Could not find authenticator matching ${options.assertionResponse.id}`)
}
if (!dbAuthenticator.data) {
throw new Error(
`Could not find authenticator matching ${options.assertionResponse.id}`,
)
}
const convertedAuthenticator = _.merge(
dbAuthenticator.data,
{ credentialPublicKey: Buffer.from(dbAuthenticator.data.credentialPublicKey) }
)
const convertedAuthenticator = _.merge(dbAuthenticator.data, {
credentialPublicKey: Buffer.from(
dbAuthenticator.data.credentialPublicKey,
),
})
let verification
try {
verification = simpleWebauthn.verifyAssertionResponse({
credential: options.assertionResponse,
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain,
authenticator: convertedAuthenticator
})
} catch (err) {
console.error(err)
return false
}
let verification
try {
verification = simpleWebauthn.verifyAssertionResponse({
credential: options.assertionResponse,
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain,
authenticator: convertedAuthenticator,
})
} catch (err) {
console.error(err)
return false
}
const { verified, assertionInfo } = verification
const { verified, assertionInfo } = verification
if (!verified) {
session.webauthn = null
return false
}
if (!verified) {
session.webauthn = null
return false
}
dbAuthenticator.data.counter = assertionInfo.newCounter
return credentials.updateHardwareCredential(dbAuthenticator)
.then(() => {
const finalUser = { id: user.id, username: user.username, role: user.role }
session.user = finalUser
if (options.rememberMe) session.cookie.maxAge = REMEMBER_ME_AGE
dbAuthenticator.data.counter = assertionInfo.newCounter
return credentials
.updateHardwareCredential(dbAuthenticator)
.then(() => {
const finalUser = {
id: user.id,
username: user.username,
role: user.role,
}
session.user = finalUser
if (options.rememberMe) session.cookie.maxAge = REMEMBER_ME_AGE
session.webauthn = null
return verified
session.webauthn = null
return verified
})
})
})
})
}
module.exports = {
generateAttestationOptions,
generateAssertionOptions,
validateAttestation,
validateAssertion
validateAssertion,
}

161
packages/server/lib/new-admin/graphql/modules/authentication/FIDOPasswordlessStrategy.js
View file

@ -11,35 +11,41 @@ const devMode = require('minimist')(process.argv.slice(2)).dev
const REMEMBER_ME_AGE = 90 * T.day
const generateAttestationOptions = (session, options) => {
return users.getUserById(options.userId).then(user => {
return Promise.all([credentials.getHardwareCredentialsByUserId(user.id), user])
}).then(([userDevices, user]) => {
const opts = simpleWebauthn.generateAttestationOptions({
rpName: 'Lamassu',
rpID: options.domain,
userName: user.username,
userID: user.id,
timeout: 60000,
attestationType: 'indirect',
excludeCredentials: userDevices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
})),
authenticatorSelection: {
userVerification: 'discouraged',
requireResidentKey: false
}
return users
.getUserById(options.userId)
.then(user => {
return Promise.all([
credentials.getHardwareCredentialsByUserId(user.id),
user,
])
})
.then(([userDevices, user]) => {
const opts = simpleWebauthn.generateAttestationOptions({
rpName: 'Lamassu',
rpID: options.domain,
userName: user.username,
userID: user.id,
timeout: 60000,
attestationType: 'indirect',
excludeCredentials: userDevices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
authenticatorSelection: {
userVerification: 'discouraged',
requireResidentKey: false,
},
})
session.webauthn = {
attestation: {
challenge: opts.challenge
session.webauthn = {
attestation: {
challenge: opts.challenge,
},
}
}
return opts
})
return opts
})
}
const generateAssertionOptions = (session, options) => {
@ -50,16 +56,16 @@ const generateAssertionOptions = (session, options) => {
allowCredentials: devices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
userVerification: 'discouraged',
rpID: options.domain
rpID: options.domain,
})
session.webauthn = {
assertion: {
challenge: opts.challenge
}
challenge: opts.challenge,
},
}
return opts
@ -77,40 +83,38 @@ const validateAttestation = (session, options) => {
credential: options.attestationResponse,
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain
})
])
.then(([user, verification]) => {
const { verified, attestationInfo } = verification
expectedRPID: options.domain,
}),
]).then(([user, verification]) => {
const { verified, attestationInfo } = verification
if (!(verified || attestationInfo)) {
session.webauthn = null
return false
}
if (!(verified || attestationInfo)) {
session.webauthn = null
return false
}
const {
counter,
credentialPublicKey,
credentialID
} = attestationInfo
const { counter, credentialPublicKey, credentialID } = attestationInfo
return credentials.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(device => device.data.credentialID === credentialID)
return credentials
.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(
device => device.data.credentialID === credentialID,
)
if (!existingDevice) {
const newDevice = {
counter,
credentialPublicKey,
credentialID
}
credentials.createHardwareCredential(user.id, newDevice)
if (!existingDevice) {
const newDevice = {
counter,
credentialPublicKey,
credentialID,
}
credentials.createHardwareCredential(user.id, newDevice)
}
session.webauthn = null
return verified
})
})
session.webauthn = null
return verified
})
})
}
const validateAssertion = (session, options) => {
@ -119,17 +123,24 @@ const validateAssertion = (session, options) => {
return credentials.getHardwareCredentialsByUserId(user.id).then(devices => {
const dbAuthenticator = _.find(dev => {
return Buffer.from(dev.data.credentialID).compare(base64url.toBuffer(options.assertionResponse.rawId)) === 0
return (
Buffer.from(dev.data.credentialID).compare(
base64url.toBuffer(options.assertionResponse.rawId),
) === 0
)
}, devices)
if (!dbAuthenticator.data) {
throw new Error(`Could not find authenticator matching ${options.assertionResponse.id}`)
throw new Error(
`Could not find authenticator matching ${options.assertionResponse.id}`,
)
}
const convertedAuthenticator = _.merge(
dbAuthenticator.data,
{ credentialPublicKey: Buffer.from(dbAuthenticator.data.credentialPublicKey) }
)
const convertedAuthenticator = _.merge(dbAuthenticator.data, {
credentialPublicKey: Buffer.from(
dbAuthenticator.data.credentialPublicKey,
),
})
let verification
try {
@ -138,7 +149,7 @@ const validateAssertion = (session, options) => {
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain,
authenticator: convertedAuthenticator
authenticator: convertedAuthenticator,
})
} catch (err) {
console.error(err)
@ -148,20 +159,22 @@ const validateAssertion = (session, options) => {
const { verified, assertionInfo } = verification
if (!verified) {
context.req.session.webauthn = null
return false
}
dbAuthenticator.data.counter = assertionInfo.newCounter
return credentials.updateHardwareCredential(dbAuthenticator)
.then(() => {
const finalUser = { id: user.id, username: user.username, role: user.role }
session.user = finalUser
if (options.rememberMe) session.cookie.maxAge = REMEMBER_ME_AGE
return credentials.updateHardwareCredential(dbAuthenticator).then(() => {
const finalUser = {
id: user.id,
username: user.username,
role: user.role,
}
session.user = finalUser
if (options.rememberMe) session.cookie.maxAge = REMEMBER_ME_AGE
session.webauthn = null
return verified
})
session.webauthn = null
return verified
})
})
})
}
@ -170,5 +183,5 @@ module.exports = {
generateAttestationOptions,
generateAssertionOptions,
validateAttestation,
validateAssertion
validateAssertion,
}

148
packages/server/lib/new-admin/graphql/modules/authentication/FIDOUsernamelessStrategy.js
View file

@ -22,19 +22,19 @@ const generateAttestationOptions = (session, options) => {
excludeCredentials: devices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
authenticatorSelection: {
authenticatorAttachment: 'cross-platform',
userVerification: 'discouraged',
requireResidentKey: false
}
requireResidentKey: false,
},
})
session.webauthn = {
attestation: {
challenge: opts.challenge
}
challenge: opts.challenge,
},
}
return opts
@ -48,16 +48,16 @@ const generateAssertionOptions = (session, options) => {
allowCredentials: devices.map(dev => ({
id: dev.data.credentialID,
type: 'public-key',
transports: ['usb', 'ble', 'nfc', 'internal']
transports: ['usb', 'ble', 'nfc', 'internal'],
})),
userVerification: 'discouraged',
rpID: options.domain
rpID: options.domain,
})
session.webauthn = {
assertion: {
challenge: opts.challenge
}
challenge: opts.challenge,
},
}
return opts
})
@ -73,50 +73,52 @@ const validateAttestation = (session, options) => {
credential: options.attestationResponse,
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain
})
])
.then(([user, verification]) => {
const { verified, attestationInfo } = verification
expectedRPID: options.domain,
}),
]).then(([user, verification]) => {
const { verified, attestationInfo } = verification
if (!(verified || attestationInfo)) {
session.webauthn = null
return verified
}
const {
fmt,
counter,
aaguid,
credentialPublicKey,
credentialID,
credentialType,
userVerified,
attestationObject,
} = attestationInfo
return credentials
.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(
device => device.data.credentialID === credentialID,
)
if (!existingDevice) {
const newDevice = {
fmt,
counter,
aaguid,
credentialPublicKey,
credentialID,
credentialType,
userVerified,
attestationObject,
}
credentials.createHardwareCredential(user.id, newDevice)
}
if (!(verified || attestationInfo)) {
session.webauthn = null
return verified
}
const {
fmt,
counter,
aaguid,
credentialPublicKey,
credentialID,
credentialType,
userVerified,
attestationObject
} = attestationInfo
return credentials.getHardwareCredentialsByUserId(user.id)
.then(userDevices => {
const existingDevice = userDevices.find(device => device.data.credentialID === credentialID)
if (!existingDevice) {
const newDevice = {
fmt,
counter,
aaguid,
credentialPublicKey,
credentialID,
credentialType,
userVerified,
attestationObject
}
credentials.createHardwareCredential(user.id, newDevice)
}
session.webauthn = null
return verified
})
})
})
})
}
const validateAssertion = (session, options) => {
@ -124,17 +126,24 @@ const validateAssertion = (session, options) => {
return credentials.getHardwareCredentials().then(devices => {
const dbAuthenticator = _.find(dev => {
return Buffer.from(dev.data.credentialID).compare(base64url.toBuffer(options.assertionResponse.rawId)) === 0
return (
Buffer.from(dev.data.credentialID).compare(
base64url.toBuffer(options.assertionResponse.rawId),
) === 0
)
}, devices)
if (!dbAuthenticator.data) {
throw new Error(`Could not find authenticator matching ${options.assertionResponse.id}`)
throw new Error(
`Could not find authenticator matching ${options.assertionResponse.id}`,
)
}
const convertedAuthenticator = _.merge(
dbAuthenticator.data,
{ credentialPublicKey: Buffer.from(dbAuthenticator.data.credentialPublicKey) }
)
const convertedAuthenticator = _.merge(dbAuthenticator.data, {
credentialPublicKey: Buffer.from(
dbAuthenticator.data.credentialPublicKey,
),
})
let verification
try {
@ -143,7 +152,7 @@ const validateAssertion = (session, options) => {
expectedChallenge: `${expectedChallenge}`,
expectedOrigin: `https://${options.domain}${devMode ? `:3001` : ``}`,
expectedRPID: options.domain,
authenticator: convertedAuthenticator
authenticator: convertedAuthenticator,
})
} catch (err) {
console.error(err)
@ -160,16 +169,19 @@ const validateAssertion = (session, options) => {
dbAuthenticator.data.counter = assertionInfo.newCounter
return Promise.all([
credentials.updateHardwareCredential(dbAuthenticator),
users.getUserById(dbAuthenticator.user_id)
])
.then(([_, user]) => {
const finalUser = { id: user.id, username: user.username, role: user.role }
session.user = finalUser
session.cookie.maxAge = REMEMBER_ME_AGE
session.webauthn = null
return verified
})
users.getUserById(dbAuthenticator.user_id),
]).then(([, user]) => {
const finalUser = {
id: user.id,
username: user.username,
role: user.role,
}
session.user = finalUser
session.cookie.maxAge = REMEMBER_ME_AGE
session.webauthn = null
return verified
})
})
}
@ -177,5 +189,5 @@ module.exports = {
generateAttestationOptions,
generateAssertionOptions,
validateAttestation,
validateAssertion
validateAssertion,
}

4
packages/server/lib/new-admin/graphql/modules/authentication/index.js
View file

@ -5,7 +5,7 @@ const FIDOUsernameless = require('./FIDOUsernamelessStrategy')
const STRATEGIES = {
FIDO2FA,
FIDOPasswordless,
FIDOUsernameless
FIDOUsernameless,
}
// FIDO2FA, FIDOPasswordless or FIDOUsernameless
@ -13,5 +13,5 @@ const CHOSEN_STRATEGY = 'FIDO2FA'
module.exports = {
CHOSEN_STRATEGY,
strategy: STRATEGIES[CHOSEN_STRATEGY]
strategy: STRATEGIES[CHOSEN_STRATEGY],
}