Dorong Dorong 💻😴

class SecuritySchemes {
95    constructor(securitySchemes, securityHandlers, securities) {
96        this.securitySchemes = securitySchemes;
97        this.securityHandlers = securityHandlers;
98        this.securities = securities;
99    }
100    async executeHandlers(req) {
101        // use a fallback handler if security handlers is not specified
102        // This means if security handlers is specified, the user must define
103        // all security handlers
104        const fallbackHandler = !this.securityHandlers
105            ? defaultSecurityHandler
106            : null;
107        const promises = this.securities.map(async (s) => {
108            if (Util.isEmptyObject(s)) {
109                // anonymous security
110                return [{ success: true }];
111            }
112            return Promise.all(Object.keys(s).map(async (securityKey) => {
113                var _a, _b, _c;
114                try {
115                    const scheme = this.securitySchemes[securityKey];
116                    const handler = (_b =
117                        (_a = this.securityHandlers) === null || _a === void 0
118                            ? void 0
119                            : _a[securityKey]) !== null && _b !== void 0
120                        ? _b
121                        : fallbackHandler;
122                    const scopesTmp = s[securityKey];
123                    const scopes = Array.isArray(scopesTmp) ? scopesTmp : [];
124                    if (!scheme) {
125                        const message = `components.securitySchemes.${securityKey} does not exist`;
126                        throw new types_1.InternalServerError({ message });
127                    }
128                    if (!scheme.hasOwnProperty('type')) {
129                        const message = `components.securitySchemes.${securityKey} must have property 'type'`;
130                        throw new types_1.InternalServerError({ message });
131                    }
132                    if (!handler) {
133                        const message = `a security handler for '${securityKey}' does not exist`;
134                        throw new types_1.InternalServerError({ message });
135                    }
136                    new AuthValidator(req, scheme, scopes).validate();
137                    // expected handler results are:
138                    // - throw exception,
139                    // - return true,
140                    // - return Promise<true>,
141                    // - return false,
142                    // - return Promise<false>
143                    // everything else should be treated as false
144                    const securityScheme = scheme;
145                    const success = await handler(req, scopes, securityScheme);
146                    if (success === true) {
147                        return { success };
148                    }
149                    else {
150                        throw Error();
151                    }
152                }
153                catch (e) {
154                    return {
155                        success: false,
156                        status: (_c = e.status) !== null && _c !== void 0 ? _c : 401,
157                        error: e,
158                    };
159                }
160            }));
161        });
162        return Promise.all(promises);
163    }
164}

class AuthValidator {
166    constructor(req, scheme, scopes = []) {
167        const openapi = req.openapi;
168        this.req = req;
169        this.scheme = scheme;
170        this.path = openapi.openApiRoute;
171        this.scopes = scopes;
172    }
173    validate() {
174        this.validateApiKey();
175        this.validateHttp();
176        this.validateOauth2();
177        this.validateOpenID();
178    }
179    validateOauth2() {
180        const { req, scheme, path } = this;
181        if (['oauth2'].includes(scheme.type.toLowerCase())) {
182            // TODO oauth2 validation
183        }
184    }
185    validateOpenID() {
186        const { req, scheme, path } = this;
187        if (['openIdConnect'].includes(scheme.type.toLowerCase())) {
188            // TODO openidconnect validation
189        }
190    }
191    validateHttp() {
192        const { req, scheme, path } = this;
193        if (['http'].includes(scheme.type.toLowerCase())) {
194            const authHeader = req.headers['authorization'] &&
195                req.headers['authorization'].toLowerCase();
196            if (!authHeader) {
197                throw Error(`Authorization header required`);
198            }
199            const type = scheme.scheme && scheme.scheme.toLowerCase();
200            if (type === 'bearer' && !authHeader.includes('bearer')) {
201                throw Error(`Authorization header with scheme 'Bearer' required`);
202            }
203            if (type === 'basic' && !authHeader.includes('basic')) {
204                throw Error(`Authorization header with scheme 'Basic' required`);
205            }
206        }
207    }
208    validateApiKey() {
209        var _d;
210        const { req, scheme, path } = this;
211        if (scheme.type === 'apiKey') {
212            if (scheme.in === 'header') {
213                if (!req.headers[scheme.name.toLowerCase()]) {
214                    throw Error(`'${scheme.name}' header required`);
215                }
216            }
217            else if (scheme.in === 'query') {
218                if (!req.query[scheme.name]) {
219                    throw Error(`query parameter '${scheme.name}' required`);
220                }
221            }
222            else if (scheme.in === 'cookie') {
223                if (!req.cookies[scheme.name] && !((_d = req.signedCookies) === null || _d === void 0 ? void 0 : _d[scheme.name])) {
224                    throw Error(`cookie '${scheme.name}' required`);
225                }
226            }
227        }
228    }
229}