-
Notifications
You must be signed in to change notification settings - Fork 55
/
auth.js
749 lines (689 loc) · 29 KB
/
auth.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
var Auth = (function() {
var msgpack = Platform.msgpack;
var MAX_TOKENOBJECT_LENGTH = Math.pow(2, 17);
var MAX_TOKENSTRING_LENGTH = 384;
function noop() {}
function random() { return ('000000' + Math.floor(Math.random() * 1E16)).slice(-16); }
var hmac, toBase64;
if(Platform.createHmac) {
toBase64 = function(str) { return (new Buffer(str, 'ascii')).toString('base64'); };
hmac = function(text, key) {
var inst = Platform.createHmac('SHA256', key);
inst.update(text);
return inst.digest('base64');
};
} else {
toBase64 = Base64.encode;
hmac = function(text, key) {
return CryptoJS.HmacSHA256(text, key).toString(CryptoJS.enc.Base64);
};
}
function c14n(capability) {
if(!capability)
return '';
if(typeof(capability) == 'string')
capability = JSON.parse(capability);
var c14nCapability = {};
var keys = Utils.keysArray(capability, true);
if(!keys)
return '';
keys.sort();
for(var i = 0; i < keys.length; i++) {
c14nCapability[keys[i]] = capability[keys[i]].sort();
}
return JSON.stringify(c14nCapability);
}
function logAndValidateTokenAuthMethod(authOptions) {
if(authOptions.authCallback) {
Logger.logAction(Logger.LOG_MINOR, 'Auth()', 'using token auth with authCallback');
} else if(authOptions.authUrl) {
Logger.logAction(Logger.LOG_MINOR, 'Auth()', 'using token auth with authUrl');
} else if(authOptions.key) {
Logger.logAction(Logger.LOG_MINOR, 'Auth()', 'using token auth with client-side signing');
} else if(authOptions.tokenDetails) {
Logger.logAction(Logger.LOG_MINOR, 'Auth()', 'using token auth with supplied token only');
} else {
var msg = 'authOptions must include valid authentication parameters';
Logger.logAction(Logger.LOG_ERROR, 'Auth()', msg);
throw new Error(msg);
}
}
function basicAuthForced(options) {
return 'useTokenAuth' in options && !options.useTokenAuth;
}
/* RSA4 */
function useTokenAuth(options) {
return options.useTokenAuth ||
(!basicAuthForced(options) &&
(options.clientId ||
options.authCallback ||
options.authUrl ||
options.token ||
options.tokenDetails))
}
function Auth(client, options) {
this.client = client;
this.tokenParams = options.defaultTokenParams || {};
if(useTokenAuth(options)) {
/* Token auth */
if(options.key && !hmac) {
var msg = 'client-side token request signing not supported';
Logger.logAction(Logger.LOG_ERROR, 'Auth()', msg);
throw new Error(msg);
}
this._saveTokenOptions(options.defaultTokenParams, options);
logAndValidateTokenAuthMethod(this.authOptions);
} else {
/* Basic auth */
if(options.clientId || !options.key) {
var msg = 'Cannot authenticate with basic auth' +
(options.clientId ? ' as a clientId implies token auth' :
(!options.key ? ' as no key was given' : ''));
Logger.logAction(Logger.LOG_ERROR, 'Auth()', msg);
throw new Error(msg);
}
Logger.logAction(Logger.LOG_MINOR, 'Auth()', 'anonymous, using basic auth');
this._saveBasicOptions(options);
}
}
/**
* Instructs the library to get a token immediately and ensures Token Auth
* is used for all future requests, storing the tokenParams and authOptions
* given as the new defaults for subsequent use.
*
* @param tokenParams
* an object containing the parameters for the requested token:
*
* - ttl: (optional) the requested life of any new token in ms. If none
* is specified a default of 1 hour is provided. The maximum lifetime
* is 24hours; any request exceeeding that lifetime will be rejected
* with an error.
*
* - capability: (optional) the capability to associate with the access token.
* If none is specified, a token will be requested with all of the
* capabilities of the specified key.
*
* - clientId: (optional) a client Id to associate with the token
*
* - timestamp: (optional) the time in ms since the epoch. If none is specified,
* the system will be queried for a time value to use.
*
* @param authOptions
* an object containing auth options relevant to token auth:
*
* - queryTime (optional) boolean indicating that the Ably system should be
* queried for the current time when none is specified explicitly.
*
* - tokenDetails: (optional) object: An authenticated TokenDetails object.
*
* - token: (optional) string: the `token` property of a tokenDetails object
*
* - authCallback: (optional) a javascript callback to be called to get auth information.
* authCallback should be a function of (tokenParams, callback) that calls
* the callback with (err, result), where result is any of:
* - a tokenRequest object (ie the result of a rest.auth.createTokenRequest call),
* - a tokenDetails object (ie the result of a rest.auth.requestToken call),
* - a token string
*
* - authUrl: (optional) a URL to be used to GET or POST a set of token request
* params, to obtain a signed token request.
*
* - authHeaders: (optional) a set of application-specific headers to be added to any request
* made to the authUrl.
*
* - authParams: (optional) a set of application-specific query params to be added to any
* request made to the authUrl.
*
*
* - requestHeaders (optional, unsupported, for testing only) extra headers to add to the
* requestToken request
*
* @param callback (err, tokenDetails)
*/
Auth.prototype.authorize = function(tokenParams, authOptions, callback) {
/* shuffle and normalise arguments as necessary */
if(typeof(tokenParams) == 'function' && !callback) {
callback = tokenParams;
authOptions = tokenParams = null;
} else if(typeof(authOptions) == 'function' && !callback) {
callback = authOptions;
authOptions = null;
}
callback = callback || noop;
var self = this;
/* RSA10a: authorize() call implies token auth. If a key is passed it, we
* just check if it doesn't clash and assume we're generating a token from it */
if(authOptions && authOptions.key && (this.key !== authOptions.key)) {
throw new ErrorInfo('Unable to update auth options with incompatible key', 40102, 401);
}
if(authOptions && ('force' in authOptions)) {
Logger.logAction(Logger.LOG_ERROR, 'Auth.authorize', 'Deprecation warning: specifying {force: true} in authOptions is no longer necessary, authorize() now always gets a new token. Please remove this, as in version 1.0 and later, having a non-null authOptions will overwrite stored library authOptions, which may not be what you want');
/* Emulate the old behaviour: if 'force' was the only member of authOptions,
* set it to null so it doesn't overwrite stored. TODO: remove in version 1.0 */
if(Utils.isOnlyPropIn(authOptions, 'force')) {
authOptions = null;
}
}
this._forceNewToken(tokenParams, authOptions, function(err, tokenDetails) {
if(err) {
callback(err);
return;
}
/* RTC8
* - When authorize called by an end user and have a realtime connection,
* don't call back till new token has taken effect.
* - Use self.client.connection as a proxy for (self.client instanceof Realtime),
* which doesn't work in node as Realtime isn't part of the vm context for Rest clients */
if(self.client.connection) {
self.client.connection.connectionManager.onAuthUpdated(tokenDetails, callback);
} else {
callback(null, tokenDetails);
}
})
};
Auth.prototype.authorise = function() {
Logger.deprecated('Auth.authorise', 'Auth.authorize');
this.authorize.apply(this, arguments);
};
/* For internal use, eg by connectionManager - useful when want to call back
* as soon as we have the new token, rather than waiting for it to take
* effect on the connection as #authorize does */
Auth.prototype._forceNewToken = function(tokenParams, authOptions, callback) {
var self = this;
/* get rid of current token even if still valid */
this.tokenDetails = null;
/* _save normalises the tokenParams and authOptions and updates the auth
* object. All subsequent operations should use the values on `this`,
* not the passed in ones. */
this._saveTokenOptions(tokenParams, authOptions);
logAndValidateTokenAuthMethod(this.authOptions);
this._ensureValidAuthCredentials(function(err, tokenDetails) {
/* RSA10g */
delete self.tokenParams.timestamp;
delete self.authOptions.queryTime;
callback(err, tokenDetails);
});
}
/**
* Request an access token
* @param authOptions
* an object containing the request options:
* - key: the key to use.
*
* - authCallback: (optional) a javascript callback to be called to get auth information.
* authCallback should be a function of (tokenParams, callback) that calls
* the callback with (err, result), where result is any of:
* - a tokenRequest object (ie the result of a rest.auth.createTokenRequest call),
* - a tokenDetails object (ie the result of a rest.auth.requestToken call),
* - a token string
*
* - authUrl: (optional) a URL to be used to GET or POST a set of token request
* params, to obtain a signed token request.
*
* - authHeaders: (optional) a set of application-specific headers to be added to any request
* made to the authUrl.
*
* - authParams: (optional) a set of application-specific query params to be added to any
* request made to the authUrl.
*
* - queryTime (optional) boolean indicating that the ably system should be
* queried for the current time when none is specified explicitly
*
* - requestHeaders (optional, unsupported, for testing only) extra headers to add to the
* requestToken request
*
* @param tokenParams
* an object containing the parameters for the requested token:
* - ttl: (optional) the requested life of the token in milliseconds. If none is specified
* a default of 1 hour is provided. The maximum lifetime is 24hours; any request
* exceeeding that lifetime will be rejected with an error.
*
* - capability: (optional) the capability to associate with the access token.
* If none is specified, a token will be requested with all of the
* capabilities of the specified key.
*
* - clientId: (optional) a client Id to associate with the token; if not
* specified, a clientId passed in constructing the Rest interface will be used
*
* - timestamp: (optional) the time in ms since the epoch. If none is specified,
* the system will be queried for a time value to use.
*
* @param callback (err, tokenDetails)
*/
Auth.prototype.requestToken = function(tokenParams, authOptions, callback) {
/* shuffle and normalise arguments as necessary */
if(typeof(tokenParams) == 'function' && !callback) {
callback = tokenParams;
authOptions = tokenParams = null;
}
else if(typeof(authOptions) == 'function' && !callback) {
callback = authOptions;
authOptions = null;
}
/* RSA8e: if authOptions passed in, they're used instead of stored, don't merge them */
authOptions = authOptions || this.authOptions;
tokenParams = tokenParams || Utils.copy(this.tokenParams);
callback = callback || noop;
var format = authOptions.format || 'json';
/* first set up whatever callback will be used to get signed
* token requests */
var tokenRequestCallback, client = this.client;
if(authOptions.authCallback) {
Logger.logAction(Logger.LOG_MINOR, 'Auth.requestToken()', 'using token auth with authCallback');
tokenRequestCallback = authOptions.authCallback;
} else if(authOptions.authUrl) {
Logger.logAction(Logger.LOG_MINOR, 'Auth.requestToken()', 'using token auth with authUrl');
/* if no authParams given, check if they were given in the URL */
if(!authOptions.authParams) {
var queryIdx = authOptions.authUrl.indexOf('?');
if(queryIdx > -1) {
authOptions.authParams = Utils.parseQueryString(authOptions.authUrl.slice(queryIdx));
authOptions.authUrl = authOptions.authUrl.slice(0, queryIdx);
}
}
tokenRequestCallback = function(params, cb) {
var authHeaders = Utils.mixin({accept: 'application/json, text/plain'}, authOptions.authHeaders),
authParams = Utils.mixin(params, authOptions.authParams);
var authUrlRequestCallback = function(err, body, headers, unpacked) {
if (err) {
Logger.logAction(Logger.LOG_MICRO, 'Auth.requestToken().tokenRequestCallback', 'Received Error; ' + JSON.stringify(err));
} else {
Logger.logAction(Logger.LOG_MICRO, 'Auth.requestToken().tokenRequestCallback', 'Received; body: ' + (BufferUtils.isBuffer(body) ? body.toString() : body));
}
if(err || unpacked) return cb(err, body);
if(BufferUtils.isBuffer(body)) body = body.toString();
var contentType = headers['content-type'];
if(!contentType) {
cb(new ErrorInfo('authUrl response is missing a content-type header', 40170, 401));
return;
}
var json = contentType.indexOf('application/json') > -1,
text = contentType.indexOf('text/plain') > -1;
if(!json && !text) {
cb(new ErrorInfo('authUrl responded with unacceptable content-type ' + contentType + ', should be either text/plain or application/json', 40170, 401));
return;
}
if(json) {
if(body.length > MAX_TOKENOBJECT_LENGTH) {
cb(new ErrorInfo('authUrl response exceeded max permitted length', 40170, 401));
return;
}
try {
body = JSON.parse(body);
} catch(e) {
cb(new ErrorInfo('Unexpected error processing authURL response; err = ' + e.message, 40170, 401));
return;
}
}
cb(null, body);
};
Logger.logAction(Logger.LOG_MICRO, 'Auth.requestToken().tokenRequestCallback', 'Sending; ' + authOptions.authUrl + '; Params: ' + JSON.stringify(authParams));
if(authOptions.authMethod && authOptions.authMethod.toLowerCase() === 'post') {
/* send body form-encoded */
var headers = authHeaders || {};
headers['content-type'] = 'application/x-www-form-urlencoded';
var body = Utils.toQueryString(authParams).slice(1); /* slice is to remove the initial '?' */
Http.postUri(client, authOptions.authUrl, headers, body, {}, authUrlRequestCallback);
} else {
Http.getUri(client, authOptions.authUrl, authHeaders || {}, authParams, authUrlRequestCallback);
}
};
} else if(authOptions.key) {
var self = this;
Logger.logAction(Logger.LOG_MINOR, 'Auth.requestToken()', 'using token auth with client-side signing');
tokenRequestCallback = function(params, cb) { self.createTokenRequest(params, authOptions, cb); };
} else {
var msg = "Need a new token, but authOptions does not include any way to request one";
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', msg);
callback(new ErrorInfo(msg, 40101, 401));
return;
}
/* normalise token params */
if('capability' in tokenParams)
tokenParams.capability = c14n(tokenParams.capability);
var client = this.client;
var tokenRequest = function(signedTokenParams, tokenCb) {
var requestHeaders,
keyName = signedTokenParams.keyName,
tokenUri = function(host) { return client.baseUri(host) + '/keys/' + keyName + '/requestToken';};
if(Http.post) {
requestHeaders = Utils.defaultPostHeaders(format);
if(authOptions.requestHeaders) Utils.mixin(requestHeaders, authOptions.requestHeaders);
Logger.logAction(Logger.LOG_MICRO, 'Auth.requestToken().requestToken', 'Sending POST; ' + tokenUri + '; Token params: ' + JSON.stringify(signedTokenParams));
signedTokenParams = (format == 'msgpack') ? msgpack.encode(signedTokenParams, true): JSON.stringify(signedTokenParams);
Http.post(client, tokenUri, requestHeaders, signedTokenParams, null, tokenCb);
} else {
requestHeaders = Utils.defaultGetHeaders();
if(authOptions.requestHeaders) Utils.mixin(requestHeaders, authOptions.requestHeaders);
Logger.logAction(Logger.LOG_MICRO, 'Auth.requestToken().requestToken', 'Sending GET; ' + tokenUri + '; Token params: ' + JSON.stringify(signedTokenParams));
Http.get(client, tokenUri, requestHeaders, signedTokenParams, tokenCb);
}
};
var tokenRequestCallbackTimeoutExpired = false,
timeoutLength = this.client.options.timeouts.realtimeRequestTimeout,
tokenRequestCallbackTimeout = setTimeout(function() {
tokenRequestCallbackTimeoutExpired = true;
var msg = 'Token request callback timed out after ' + (timeoutLength / 1000) + ' seconds';
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', msg);
callback(new ErrorInfo(msg, 40170, 401));
}, timeoutLength);
tokenRequestCallback(tokenParams, function(err, tokenRequestOrDetails) {
if(tokenRequestCallbackTimeoutExpired) return;
clearTimeout(tokenRequestCallbackTimeout);
if(err) {
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', 'token request signing call returned error; err = ' + Utils.inspectError(err));
if(!(err && err.code)) {
/* network errors don't have an error code, so assign them
* 40170 so they'll by connectionManager as nonfatal */
err = new ErrorInfo(Utils.inspectError(err), 40170, 401);
}
callback(err);
return;
}
/* the response from the callback might be a token string, a signed request or a token details */
if(typeof(tokenRequestOrDetails) === 'string') {
if(tokenRequestOrDetails.length > MAX_TOKENSTRING_LENGTH) {
callback(new ErrorInfo('Token string exceeded max permitted length (was ' + tokenRequestOrDetails.length + ' bytes)', 40170, 401));
} else {
callback(null, {token: tokenRequestOrDetails});
}
return;
}
if(typeof(tokenRequestOrDetails) !== 'object') {
var msg = 'Expected token request callback to call back with a token string or token request/details object, but got a ' + typeof(tokenRequestOrDetails);
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', msg);
callback(new ErrorInfo(msg, 40170, 401));
return;
}
var objectSize = JSON.stringify(tokenRequestOrDetails).length;
if(objectSize > MAX_TOKENOBJECT_LENGTH) {
callback(new ErrorInfo('Token request/details object exceeded max permitted stringified size (was ' + objectSize + ' bytes)', 40170, 401));
return;
}
if('issued' in tokenRequestOrDetails) {
/* a tokenDetails object */
callback(null, tokenRequestOrDetails);
return;
}
if(!('keyName' in tokenRequestOrDetails)) {
var msg = 'Expected token request callback to call back with a token string, token request object, or token details object';
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', msg);
callback(new ErrorInfo(msg, 40170, 401));
return;
}
/* it's a token request, so make the request */
tokenRequest(tokenRequestOrDetails, function(err, tokenResponse, headers, unpacked) {
if(err) {
Logger.logAction(Logger.LOG_ERROR, 'Auth.requestToken()', 'token request API call returned error; err = ' + Utils.inspectError(err));
callback(err);
return;
}
if(!unpacked) tokenResponse = (format == 'msgpack') ? msgpack.decode(tokenResponse) : JSON.parse(tokenResponse);
Logger.logAction(Logger.LOG_MINOR, 'Auth.getToken()', 'token received');
callback(null, tokenResponse);
});
});
};
/**
* Create and sign a token request based on the given options.
* NOTE this can only be used when the key value is available locally.
* Otherwise, signed token requests must be obtained from the key
* owner (either using the token request callback or url).
*
* @param authOptions
* an object containing the request options:
* - key: the key to use. If not specified, a key passed in constructing
* the Rest interface will be used
*
* - queryTime (optional) boolean indicating that the ably system should be
* queried for the current time when none is specified explicitly
*
* - requestHeaders (optional, unsupported, for testing only) extra headers to add to the
* requestToken request
*
* @param tokenParams
* an object containing the parameters for the requested token:
* - ttl: (optional) the requested life of the token in ms. If none is specified
* a default of 1 hour is provided. The maximum lifetime is 24hours; any request
* exceeeding that lifetime will be rejected with an error.
*
* - capability: (optional) the capability to associate with the access token.
* If none is specified, a token will be requested with all of the
* capabilities of the specified key.
*
* - clientId: (optional) a client Id to associate with the token; if not
* specified, a clientId passed in constructing the Rest interface will be used
*
* - timestamp: (optional) the time in ms since the epoch. If none is specified,
* the system will be queried for a time value to use.
*
*/
Auth.prototype.createTokenRequest = function(tokenParams, authOptions, callback) {
/* shuffle and normalise arguments as necessary */
if(typeof(tokenParams) == 'function' && !callback) {
callback = tokenParams;
authOptions = tokenParams = null;
} else if(typeof(authOptions) == 'function' && !callback) {
callback = authOptions;
authOptions = null;
}
/* RSA9h: if authOptions passed in, they're used instead of stored, don't merge them */
authOptions = authOptions || this.authOptions;
tokenParams = tokenParams || Utils.copy(this.tokenParams);
var key = authOptions.key;
if(!key) {
callback(new Error('No key specified'));
return;
}
var keyParts = key.split(':'),
keyName = keyParts[0],
keySecret = keyParts[1];
if(!keySecret) {
callback(new Error('Invalid key specified'));
return;
}
if(tokenParams.clientId === '') {
callback(new ErrorInfo('clientId can’t be an empty string', 40012, 400));
return;
}
tokenParams.capability = c14n(tokenParams.capability);
var request = Utils.mixin({ keyName: keyName }, tokenParams),
clientId = tokenParams.clientId || '',
ttl = tokenParams.ttl || '',
capability = tokenParams.capability,
self = this;
(function(authoriseCb) {
if(request.timestamp) {
authoriseCb();
return;
};
self.getTimestamp(authOptions && authOptions.queryTime, function(err, time) {
if(err) {callback(err); return;}
request.timestamp = time;
authoriseCb();
});
})(function() {
/* nonce */
/* NOTE: there is no expectation that the client
* specifies the nonce; this is done by the library
* However, this can be overridden by the client
* simply for testing purposes. */
var nonce = request.nonce || (request.nonce = random()),
timestamp = request.timestamp;
var signText
= request.keyName + '\n'
+ ttl + '\n'
+ capability + '\n'
+ clientId + '\n'
+ timestamp + '\n'
+ nonce + '\n';
/* mac */
/* NOTE: there is no expectation that the client
* specifies the mac; this is done by the library
* However, this can be overridden by the client
* simply for testing purposes. */
request.mac = request.mac || hmac(signText, keySecret);
Logger.logAction(Logger.LOG_MINOR, 'Auth.getTokenRequest()', 'generated signed request');
callback(null, request);
});
};
/**
* Get the auth query params to use for a websocket connection,
* based on the current auth parameters
*/
Auth.prototype.getAuthParams = function(callback) {
if(this.method == 'basic')
callback(null, {key: this.key});
else
this._ensureValidAuthCredentials(function(err, tokenDetails) {
if(err) {
callback(err);
return;
}
callback(null, {access_token: tokenDetails.token});
});
};
/**
* Get the authorization header to use for a REST or comet request,
* based on the current auth parameters
*/
Auth.prototype.getAuthHeaders = function(callback) {
if(this.method == 'basic') {
callback(null, {authorization: 'Basic ' + this.basicKey});
} else {
this._ensureValidAuthCredentials(function(err, tokenDetails) {
if(err) {
callback(err);
return;
}
callback(null, {authorization: 'Bearer ' + toBase64(tokenDetails.token)});
});
}
};
/**
* Get the current time based on the local clock,
* or if the option queryTime is true, return the server time.
* The server time offset from the local time is stored so that
* only one request to the server to get the time is ever needed
*/
Auth.prototype.getTimestamp = function(queryTime, callback) {
var offsetSet = !isNaN(parseInt(this.client.serverTimeOffset));
if (!offsetSet && (queryTime || this.authOptions.queryTime)) {
this.client.time(function(err, time) {
if(err) {
callback(err);
return;
}
callback(null, time);
});
} else {
callback(null, Utils.now() + (this.client.serverTimeOffset || 0));
}
};
Auth.prototype._saveBasicOptions = function(authOptions) {
this.method = 'basic';
this.key = authOptions.key;
this.basicKey = toBase64(authOptions.key);
this.authOptions = authOptions || {};
if('clientId' in authOptions) {
this._userSetClientId(authOptions.clientId);
}
}
Auth.prototype._saveTokenOptions = function(tokenParams, authOptions) {
this.method = 'token';
if(tokenParams) {
/* We temporarily persist tokenParams.timestamp in case a new token needs
* to be requested, then null it out in the callback of
* _ensureValidAuthCredentials for RSA10g compliance */
this.tokenParams = tokenParams;
}
if(authOptions) {
/* normalise */
if(authOptions.token) {
/* options.token may contain a token string or, for convenience, a TokenDetails */
authOptions.tokenDetails = (typeof(authOptions.token) === 'string') ? {token: authOptions.token} : authOptions.token;
}
if(authOptions.tokenDetails) {
this.tokenDetails = authOptions.tokenDetails;
}
if('clientId' in authOptions) {
this._userSetClientId(authOptions.clientId);
}
this.authOptions = authOptions;
}
};
Auth.prototype._ensureValidAuthCredentials = function(callback) {
var self = this,
token = this.tokenDetails;
var requestToken = function() {
self.requestToken(self.tokenParams, self.authOptions, function(err, tokenResponse) {
if(err) {
callback(err);
return;
}
callback(null, (self.tokenDetails = tokenResponse));
});
};
if(token) {
if(this._tokenClientIdMismatch(token.clientId)) {
callback(new ErrorInfo('Mismatch between clientId in token (' + token.clientId + ') and current clientId (' + this.clientId + ')', 40102, 401));
return;
}
this.getTimestamp(self.authOptions && self.authOptions.queryTime, function(err, time) {
if(err)
callback(err);
if(token.expires === undefined || (token.expires >= time)) {
Logger.logAction(Logger.LOG_MINOR, 'Auth.getToken()', 'using cached token; expires = ' + token.expires);
callback(null, token);
return;
} else {
/* expired, so remove */
Logger.logAction(Logger.LOG_MINOR, 'Auth.getToken()', 'deleting expired token');
self.tokenDetails = null;
}
requestToken();
});
} else {
requestToken();
}
};
/* User-set: check types, '*' is disallowed, throw any errors */
Auth.prototype._userSetClientId = function(clientId) {
if(!(typeof(clientId) === 'string' || clientId === null)) {
throw new ErrorInfo('clientId must be either a string or null', 40012, 400);
} else if(clientId === '*') {
throw new ErrorInfo('Can’t use "*" as a clientId as that string is reserved. (To change the default token request behaviour to use a wildcard clientId, instantiate the library with {defaultTokenParams: {clientId: "*"}}), or if calling authorize(), pass it in as a tokenParam: authorize({clientId: "*"}, authOptions)', 40012, 400);
} else {
var err = this._uncheckedSetClientId(clientId);
if(err) throw err;
}
};
/* Ably-set: no typechecking, '*' is allowed but not set on this.clientId), return errors to the caller */
Auth.prototype._uncheckedSetClientId = function(clientId) {
if(this._tokenClientIdMismatch(clientId)) {
/* Should never happen in normal circumstances as realtime should
* recognise mismatch and return an error */
var msg = 'Unexpected clientId mismatch: client has ' + this.clientId + ', requested ' + clientId;
var err = new ErrorInfo(msg, 40102, 401);
Logger.logAction(Logger.LOG_ERROR, 'Auth._uncheckedSetClientId()', msg);
return err;
} else if(clientId === '*') {
this.tokenParams.clientId = clientId;
} else {
/* RSA7a4: if options.clientId is provided and is not
* null, it overrides defaultTokenParams.clientId */
this.clientId = this.tokenParams.clientId = clientId;
return null;
}
};
Auth.prototype._tokenClientIdMismatch = function(tokenClientId) {
return this.clientId &&
tokenClientId &&
(tokenClientId !== '*') &&
(this.clientId !== tokenClientId);
};
Auth.isTokenErr = function(error) {
return error.code && (error.code >= 40140) && (error.code < 40150);
};
return Auth;
})();