forked from clerk/javascript
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathauthorization.ts
More file actions
163 lines (141 loc) · 5.37 KB
/
Copy pathauthorization.ts
File metadata and controls
163 lines (141 loc) · 5.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
import type {
__experimental_ReverificationConfig,
__experimental_SessionVerificationLevel,
__experimental_SessionVerificationTypes,
CheckAuthorizationWithCustomPermissions,
OrganizationCustomPermissionKey,
OrganizationCustomRoleKey,
} from '@clerk/types';
type TypesToConfig = Record<
__experimental_SessionVerificationTypes,
Exclude<__experimental_ReverificationConfig, __experimental_SessionVerificationTypes>
>;
type AuthorizationOptions = {
userId: string | null | undefined;
orgId: string | null | undefined;
orgRole: string | null | undefined;
orgPermissions: string[] | null | undefined;
__experimental_factorVerificationAge: [number, number] | null;
};
type CheckOrgAuthorization = (
params: { role?: OrganizationCustomRoleKey; permission?: OrganizationCustomPermissionKey },
{ orgId, orgRole, orgPermissions }: AuthorizationOptions,
) => boolean | null;
type CheckStepUpAuthorization = (
params: {
__experimental_reverification?: __experimental_ReverificationConfig;
},
{ __experimental_factorVerificationAge }: AuthorizationOptions,
) => boolean | null;
const TYPES_TO_OBJECTS: TypesToConfig = {
strict_mfa: {
afterMinutes: 10,
level: 'multi_factor',
},
strict: {
afterMinutes: 10,
level: 'second_factor',
},
moderate: {
afterMinutes: 60,
level: 'second_factor',
},
lax: {
afterMinutes: 1_440,
level: 'second_factor',
},
};
const ALLOWED_LEVELS = new Set<__experimental_SessionVerificationLevel>([
'first_factor',
'second_factor',
'multi_factor',
]);
const ALLOWED_TYPES = new Set<__experimental_SessionVerificationTypes>(['strict_mfa', 'strict', 'moderate', 'lax']);
// Helper functions
const isValidMaxAge = (maxAge: any) => typeof maxAge === 'number' && maxAge > 0;
const isValidLevel = (level: any) => ALLOWED_LEVELS.has(level);
const isValidVerificationType = (type: any) => ALLOWED_TYPES.has(type);
/**
* Checks if a user has the required organization-level authorization.
* Verifies if the user has the specified role or permission within their organization.
* @returns null, if unable to determine due to missing data or unspecified role/permission.
*/
const checkOrgAuthorization: CheckOrgAuthorization = (params, options) => {
const { orgId, orgRole, orgPermissions } = options;
if (!params.role && !params.permission) {
return null;
}
if (!orgId || !orgRole || !orgPermissions) {
return null;
}
if (params.permission) {
return orgPermissions.includes(params.permission);
}
if (params.role) {
return orgRole === params.role;
}
return null;
};
const validateReverificationConfig = (config: __experimental_ReverificationConfig | undefined) => {
const convertConfigToObject = (config: __experimental_ReverificationConfig) => {
if (typeof config === 'string') {
return TYPES_TO_OBJECTS[config];
}
return config;
};
if (typeof config === 'string' && isValidVerificationType(config)) {
return convertConfigToObject.bind(null, config);
}
if (typeof config === 'object' && isValidLevel(config.level) && isValidMaxAge(config.afterMinutes)) {
return convertConfigToObject.bind(null, config);
}
return false;
};
/**
* Evaluates if the user meets step-up authentication requirements.
* Compares the user's factor verification ages against the specified maxAge.
* Handles different verification levels (first factor, second factor, multi-factor).
* @returns null, if requirements or verification data are missing.
*/
const checkStepUpAuthorization: CheckStepUpAuthorization = (params, { __experimental_factorVerificationAge }) => {
if (!params.__experimental_reverification || !__experimental_factorVerificationAge) {
return null;
}
const isValidReverification = validateReverificationConfig(params.__experimental_reverification);
if (!isValidReverification) {
return null;
}
const { level, afterMinutes } = isValidReverification();
const [factor1Age, factor2Age] = __experimental_factorVerificationAge;
// -1 indicates the factor group (1fa,2fa) is not enabled
// -1 for 1fa is not a valid scenario, but we need to make sure we handle it properly
const isValidFactor1 = factor1Age !== -1 ? afterMinutes > factor1Age : null;
const isValidFactor2 = factor2Age !== -1 ? afterMinutes > factor2Age : null;
switch (level) {
case 'first_factor':
return isValidFactor1;
case 'second_factor':
return factor2Age !== -1 ? isValidFactor2 : isValidFactor1;
case 'multi_factor':
return factor2Age === -1 ? isValidFactor1 : isValidFactor1 && isValidFactor2;
}
};
/**
* Creates a function for comprehensive user authorization checks.
* Combines organization-level and step-up authentication checks.
* The returned function authorizes if both checks pass, or if at least one passes
* when the other is indeterminate. Fails if userId is missing.
*/
export const createCheckAuthorization = (options: AuthorizationOptions): CheckAuthorizationWithCustomPermissions => {
return (params): boolean => {
if (!options.userId) {
return false;
}
const orgAuthorization = checkOrgAuthorization(params, options);
const stepUpAuthorization = checkStepUpAuthorization(params, options);
if ([orgAuthorization, stepUpAuthorization].some(a => a === null)) {
return [orgAuthorization, stepUpAuthorization].some(a => a === true);
}
return [orgAuthorization, stepUpAuthorization].every(a => a === true);
};
};