495 lines
17 KiB
JavaScript
495 lines
17 KiB
JavaScript
var _ = require('lodash'),
|
|
crypto = require('crypto'),
|
|
oAuth1 = require('node-oauth1'),
|
|
urlEncoder = require('postman-url-encoder'),
|
|
RequestBody = require('postman-collection').RequestBody,
|
|
bodyBuilder = require('../requester/core-body-builder'),
|
|
|
|
EMPTY = '',
|
|
RSA = 'RSA',
|
|
HYPHEN = '-',
|
|
PROTOCOL_HTTP = 'http',
|
|
PROTOCOL_SEPARATOR = '://',
|
|
HTTPS_PORT = '443',
|
|
HTTP_PORT = '80',
|
|
|
|
OAUTH1_PARAMS = {
|
|
oauthConsumerKey: 'oauth_consumer_key',
|
|
oauthToken: 'oauth_token',
|
|
oauthSignatureMethod: 'oauth_signature_method',
|
|
oauthTimestamp: 'oauth_timestamp',
|
|
oauthNonce: 'oauth_nonce',
|
|
oauthVersion: 'oauth_version',
|
|
oauthSignature: 'oauth_signature',
|
|
oauthCallback: 'oauth_callback',
|
|
oauthVerifier: 'oauth_verifier',
|
|
oauthBodyHash: 'oauth_body_hash'
|
|
};
|
|
|
|
/**
|
|
* Returns a OAuth1.0-a compatible representation of the request URL, also called "Base URL".
|
|
* For details, http://oauth.net/core/1.0a/#anchor13
|
|
*
|
|
* todo: should we ignore the auth parameters of the URL or not? (the standard does not mention them)
|
|
* we currently are.
|
|
*
|
|
* @private
|
|
* @param {Url} url - Node's URL object
|
|
* @returns {String}
|
|
*/
|
|
function getOAuth1BaseUrl (url) {
|
|
var port = url.port ? url.port : undefined,
|
|
host = ((port === HTTP_PORT ||
|
|
port === HTTPS_PORT ||
|
|
port === undefined) && url.hostname) || url.host,
|
|
path = url.path,
|
|
|
|
// trim to convert 'http:' from Node's URL object to 'http'
|
|
protocol = _.trimEnd(url.protocol || PROTOCOL_HTTP, PROTOCOL_SEPARATOR);
|
|
|
|
protocol = (_.endsWith(protocol, PROTOCOL_SEPARATOR) ? protocol : protocol + PROTOCOL_SEPARATOR);
|
|
|
|
return protocol.toLowerCase() + host.toLowerCase() + path;
|
|
}
|
|
|
|
/**
|
|
* Query parameters are encoded with WHATWG encoding in the request. OAuth1.0
|
|
* requires the query params to be encoded with the RFC-3986 standard. This
|
|
* function decodes the query parameters and encodes them to the required RFC-3986
|
|
* standard. For details: https://oauth.net/core/1.0a/#encoding_parameters
|
|
*
|
|
* @param {Request} request - request to update query parameters
|
|
* @param {Object} url - Node.js like url object
|
|
*/
|
|
function updateQueryParamEncoding (request, url) {
|
|
// early bailout if no query is set.
|
|
if (!url.query) {
|
|
return;
|
|
}
|
|
|
|
const queryParams = oAuth1.decodeForm(url.query);
|
|
|
|
// clear all query parameters
|
|
request.url.query.clear();
|
|
|
|
_.forEach(queryParams, function (param) {
|
|
request.url.query.add({
|
|
key: param[0] && oAuth1.percentEncode(param[0]),
|
|
value: param[1] && oAuth1.percentEncode(param[1])
|
|
});
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Calculates body hash with given algorithm and digestEncoding.
|
|
*
|
|
* @param {RequestBody} body Request body
|
|
* @param {String} algorithm Hash algorithm to use
|
|
* @param {String} digestEncoding Encoding of the hash
|
|
* @param {Function} callback Callback function that will be called with body hash
|
|
*/
|
|
function computeBodyHash (body, algorithm, digestEncoding, callback) {
|
|
if (!(algorithm && digestEncoding)) { return callback(); }
|
|
|
|
var hash = crypto.createHash(algorithm),
|
|
originalReadStream,
|
|
rawBody,
|
|
graphqlBody;
|
|
|
|
// if body is not available, return hash of empty string
|
|
if (!body || body.isEmpty()) {
|
|
return callback(hash.digest(digestEncoding));
|
|
}
|
|
|
|
if (body.mode === RequestBody.MODES.raw) {
|
|
rawBody = bodyBuilder.raw(body.raw).body;
|
|
hash.update(rawBody);
|
|
|
|
return callback(hash.digest(digestEncoding));
|
|
}
|
|
|
|
// calculations for url-encoded body are not done here unlike other
|
|
// auths(i.e. AWS/HAWK) because it is not required for OAuth1.0
|
|
|
|
if (body.mode === RequestBody.MODES.file) {
|
|
originalReadStream = _.get(body, 'file.content');
|
|
|
|
if (!originalReadStream) {
|
|
return callback();
|
|
}
|
|
|
|
return originalReadStream.cloneReadStream(function (err, clonedStream) {
|
|
if (err) { return callback(); }
|
|
|
|
clonedStream.on('data', function (chunk) {
|
|
hash.update(chunk);
|
|
});
|
|
|
|
clonedStream.on('end', function () {
|
|
callback(hash.digest(digestEncoding));
|
|
});
|
|
});
|
|
}
|
|
|
|
if (body.mode === RequestBody.MODES.graphql) {
|
|
graphqlBody = bodyBuilder.graphql(body.graphql).body;
|
|
hash.update(graphqlBody);
|
|
|
|
return callback(hash.digest(digestEncoding));
|
|
}
|
|
|
|
// @todo: Figure out a way to calculate hash for formdata body type.
|
|
|
|
// ensure that callback is called if body.mode doesn't match with any of the above modes
|
|
return callback();
|
|
}
|
|
|
|
/**
|
|
* @implements {AuthHandlerInterface}
|
|
*/
|
|
module.exports = {
|
|
/**
|
|
* @property {AuthHandlerInterface~AuthManifest}
|
|
*/
|
|
manifest: {
|
|
info: {
|
|
name: 'oauth1',
|
|
version: '1.0.0'
|
|
},
|
|
updates: [
|
|
{
|
|
property: 'Authorization',
|
|
type: 'header'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthConsumerKey,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthToken,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthCallback,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthVerifier,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthBodyHash,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthSignatureMethod,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthTimestamp,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthNonce,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthVersion,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthSignature,
|
|
type: 'url.param'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthConsumerKey,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthToken,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthCallback,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthVerifier,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthSignatureMethod,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthTimestamp,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthNonce,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthVersion,
|
|
type: 'body.urlencoded'
|
|
},
|
|
{
|
|
property: OAUTH1_PARAMS.oauthSignature,
|
|
type: 'body.urlencoded'
|
|
}
|
|
]
|
|
},
|
|
|
|
/**
|
|
* Initializes an item (extracts parameters from intermediate requests if any, etc)
|
|
* before the actual authorization step.
|
|
*
|
|
* @param {AuthInterface} auth
|
|
* @param {Response} response
|
|
* @param {AuthHandlerInterface~authInitHookCallback} done
|
|
*/
|
|
init: function (auth, response, done) {
|
|
done(null);
|
|
},
|
|
|
|
/**
|
|
* Verifies whether the request has valid basic auth credentials (which is always).
|
|
* Sanitizes the auth parameters if needed.
|
|
*
|
|
* @param {AuthInterface} auth
|
|
* @param {AuthHandlerInterface~authPreHookCallback} done
|
|
*/
|
|
pre: function (auth, done) {
|
|
done(null, true);
|
|
},
|
|
|
|
/**
|
|
* Verifies whether the basic auth succeeded.
|
|
*
|
|
* @param {AuthInterface} auth
|
|
* @param {Response} response
|
|
* @param {AuthHandlerInterface~authPostHookCallback} done
|
|
*/
|
|
post: function (auth, response, done) {
|
|
done(null, true);
|
|
},
|
|
|
|
/**
|
|
* Generates and adds oAuth1 data to the request. This function modifies the
|
|
* request passed in the argument.
|
|
*
|
|
* @param {Request} request - request to add oauth1 parameters
|
|
* @param {Object} params - oauth data to generate signature
|
|
* @param {Object} protocolProfileBehavior - Protocol profile behaviors
|
|
* @param {Function} done - callback function
|
|
*/
|
|
addAuthDataToRequest: function (request, params, protocolProfileBehavior, done) {
|
|
var url = urlEncoder.toNodeUrl(request.url),
|
|
signatureParams,
|
|
urlencodedBody,
|
|
bodyParams,
|
|
allParams,
|
|
signature,
|
|
message,
|
|
header,
|
|
accessor = {
|
|
consumerSecret: params.consumerSecret || EMPTY,
|
|
tokenSecret: params.tokenSecret || EMPTY,
|
|
privateKey: params.privateKey || EMPTY
|
|
},
|
|
disableUrlEncoding = protocolProfileBehavior && protocolProfileBehavior.disableUrlEncoding;
|
|
|
|
signatureParams = [
|
|
{system: true, key: OAUTH1_PARAMS.oauthConsumerKey, value: params.consumerKey},
|
|
{system: true, key: OAUTH1_PARAMS.oauthToken, value: params.token},
|
|
{system: true, key: OAUTH1_PARAMS.oauthSignatureMethod, value: params.signatureMethod},
|
|
{system: true, key: OAUTH1_PARAMS.oauthTimestamp, value: params.timestamp},
|
|
{system: true, key: OAUTH1_PARAMS.oauthNonce, value: params.nonce},
|
|
{system: true, key: OAUTH1_PARAMS.oauthVersion, value: params.version}
|
|
];
|
|
|
|
// bodyHash, callback and verifier parameters are part of extensions of the original OAuth1 spec.
|
|
// So we only include those in signature if they are non-empty, ignoring the addEmptyParamsToSign setting.
|
|
// Otherwise it causes problem for servers that don't support the respective OAuth1 extensions.
|
|
// Issue: https://github.com/postmanlabs/postman-app-support/issues/8737
|
|
if (params.bodyHash) {
|
|
signatureParams.push({system: true, key: OAUTH1_PARAMS.oauthBodyHash, value: params.bodyHash});
|
|
}
|
|
|
|
if (params.callback) {
|
|
signatureParams.push({system: true, key: OAUTH1_PARAMS.oauthCallback, value: params.callback});
|
|
}
|
|
|
|
if (params.verifier) {
|
|
signatureParams.push({system: true, key: OAUTH1_PARAMS.oauthVerifier, value: params.verifier});
|
|
}
|
|
|
|
// filter empty signature parameters
|
|
signatureParams = _.filter(signatureParams, function (param) {
|
|
return params.addEmptyParamsToSign || param.value;
|
|
});
|
|
|
|
urlencodedBody = request.body &&
|
|
request.body.mode === RequestBody.MODES.urlencoded &&
|
|
request.body.urlencoded;
|
|
|
|
// Body params only need to be included if they are URL encoded.
|
|
// http://oauth.net/core/1.0a/#anchor13
|
|
bodyParams = urlencodedBody ? urlencodedBody.filter(function (param) {
|
|
return !param.disabled;
|
|
}) : [];
|
|
|
|
allParams = [].concat(signatureParams, bodyParams);
|
|
|
|
message = {
|
|
action: getOAuth1BaseUrl(url),
|
|
method: request.method,
|
|
parameters: _.map(allParams, function (param) {
|
|
return [param.key, param.value];
|
|
})
|
|
};
|
|
|
|
try {
|
|
signature = oAuth1.SignatureMethod.sign(message, accessor);
|
|
}
|
|
catch (err) {
|
|
// handle invalid private key errors for RSA signatures
|
|
return done(err);
|
|
}
|
|
|
|
// Update the encoding for query parameters to RFC-3986 in accordance with the
|
|
// OAuth1.0a specification: https://oauth.net/core/1.0a/#encoding_parameters
|
|
// disableUrlEncoding option should be respected in authorization flow as well
|
|
if (disableUrlEncoding !== true) {
|
|
updateQueryParamEncoding(request, url);
|
|
}
|
|
|
|
signatureParams.push({system: true, key: OAUTH1_PARAMS.oauthSignature, value: signature});
|
|
|
|
// Add signature params to the request. The OAuth specification says
|
|
// that we should add parameters in the following order of preference:
|
|
// 1. Auth Header
|
|
// 2. Body parameters
|
|
// 3. Query parameters
|
|
//
|
|
// http://oauth.net/core/1.0/#consumer_req_param
|
|
if (params.addParamsToHeader) {
|
|
header = oAuth1.getAuthorizationHeader(params.realm, _.map(signatureParams, function (param) {
|
|
return [param.key, param.value];
|
|
}), params.disableHeaderEncoding);
|
|
|
|
request.addHeader({
|
|
key: 'Authorization',
|
|
value: header,
|
|
system: true
|
|
});
|
|
}
|
|
else if ((/PUT|POST/).test(request.method) && urlencodedBody) {
|
|
_.forEach(signatureParams, function (param) {
|
|
urlencodedBody.add(param);
|
|
});
|
|
}
|
|
else if (disableUrlEncoding === true) {
|
|
// disableUrlEncoding option should be respected in authorization flow as well
|
|
request.addQueryParams(signatureParams);
|
|
}
|
|
else {
|
|
_.forEach(signatureParams, function (param) {
|
|
request.url.query.add({
|
|
key: param.key && oAuth1.percentEncode(param.key),
|
|
value: param.value && oAuth1.percentEncode(param.value),
|
|
system: true
|
|
});
|
|
});
|
|
}
|
|
|
|
done();
|
|
},
|
|
|
|
/**
|
|
* Signs a request.
|
|
*
|
|
* @param {AuthInterface} auth
|
|
* @param {Request} request
|
|
* @param {AuthHandlerInterface~authSignHookCallback} done
|
|
*/
|
|
sign: function (auth, request, done) {
|
|
var self = this,
|
|
params = auth.get([
|
|
'consumerKey',
|
|
'consumerSecret',
|
|
'token',
|
|
'tokenSecret',
|
|
'privateKey',
|
|
'signatureMethod',
|
|
'callback',
|
|
'verifier',
|
|
'timestamp',
|
|
'nonce',
|
|
'version',
|
|
'realm',
|
|
'includeBodyHash',
|
|
'addParamsToHeader',
|
|
'addEmptyParamsToSign',
|
|
'disableHeaderEncoding'
|
|
]),
|
|
urlencodedBody = request.body,
|
|
signatureAlgo,
|
|
hashAlgo,
|
|
protocolProfileBehavior = auth._protocolProfileBehavior;
|
|
|
|
// extract hash and signature algorithm form signatureMethod
|
|
// signature methods are in this format: '<signatureAlgo>-<hashAlgo>' e.g. RSA-SHA1
|
|
hashAlgo = _.split(params.signatureMethod, HYPHEN);
|
|
signatureAlgo = _.upperCase(hashAlgo[0]);
|
|
hashAlgo = hashAlgo[1];
|
|
|
|
if (!params.consumerKey ||
|
|
(signatureAlgo !== RSA && !params.consumerSecret) ||
|
|
(signatureAlgo === RSA && !params.privateKey)) {
|
|
return done(); // Nothing to do if required parameters are not present.
|
|
}
|
|
|
|
// before this: urlencodedBody = request.body
|
|
// after this: urlencodedBody = request.body.urlencoded or undefined
|
|
urlencodedBody = (urlencodedBody &&
|
|
urlencodedBody.mode === RequestBody.MODES.urlencoded
|
|
) ? urlencodedBody.urlencoded : undefined;
|
|
|
|
// Remove existing headers and params (if any)
|
|
request.removeHeader('Authorization');
|
|
request.removeQueryParams(_.values(OAUTH1_PARAMS));
|
|
urlencodedBody && urlencodedBody.remove(function (param) {
|
|
return _.includes(_.values(OAUTH1_PARAMS), param.key);
|
|
});
|
|
|
|
// Generate a new nonce and timestamp
|
|
params.nonce = params.nonce || oAuth1.nonce(11).toString();
|
|
params.timestamp = params.timestamp || oAuth1.timestamp().toString();
|
|
|
|
// Ensure that empty parameters are not added to the signature
|
|
if (!params.addEmptyParamsToSign) {
|
|
params = _.reduce(params, function (accumulator, value, key) {
|
|
if (_.isString(value) && (value.trim() === EMPTY)) {
|
|
return accumulator;
|
|
}
|
|
accumulator[key] = value;
|
|
|
|
return accumulator;
|
|
}, {});
|
|
}
|
|
|
|
// Don't include body hash as defined in specification
|
|
// @see: https://tools.ietf.org/id/draft-eaton-oauth-bodyhash-00.html#when_to_include
|
|
if (urlencodedBody || !(params.includeBodyHash && hashAlgo)) {
|
|
return self.addAuthDataToRequest(request, params, protocolProfileBehavior, done);
|
|
}
|
|
|
|
computeBodyHash(request.body, hashAlgo, 'base64', function (bodyHash) {
|
|
params.bodyHash = bodyHash;
|
|
|
|
return self.addAuthDataToRequest(request, params, protocolProfileBehavior, done);
|
|
});
|
|
}
|
|
};
|