fix(passportjs): Fix authorization middleware

packages/passport/src/decorators/authenticate.ts

@@ -1,6 +1,11 @@
 import {UseAuth} from "@tsed/common";
-import {AuthenticateMiddleware} from "../middlewares/AuthenticateMiddleware";
+import {PassportMiddleware} from "../middlewares/PassportMiddleware";
 
 export function Authenticate(protocol: string | string[], options: any = {}): Function {
-  return UseAuth(AuthenticateMiddleware, {protocol, security: options.security, options});
+  return UseAuth(PassportMiddleware, {
+    protocol,
+    method: "authorize",
+    security: options.security,
+    options
+  });
 }

packages/passport/src/decorators/authorize.ts

@@ -1,6 +1,11 @@
 import {UseAuth} from "@tsed/common";
-import {AuthorizeMiddleware} from "../middlewares/AuthorizeMiddleware";
+import {PassportMiddleware} from "../middlewares/PassportMiddleware";
 
-export function Authorize(protocol: string, options: any = {}): Function {
-  return UseAuth(AuthorizeMiddleware, {protocol, security: options.security, options});
+export function Authorize(protocol: string | string[], options: any = {}): Function {
+  return UseAuth(PassportMiddleware, {
+    protocol,
+    method: "authorize",
+    security: options.security,
+    options
+  });
 }

packages/passport/src/index.ts

@@ -16,5 +16,4 @@ export * from "./services/ProtocolsService";
 export * from "./services/PassportSerializerService";
 
 // Middlewares
-export * from "./middlewares/AuthenticateMiddleware";
-export * from "./middlewares/AuthorizeMiddleware";
+export * from "./middlewares/PassportMiddleware";

packages/passport/src/middlewares/PassportMiddleware.ts

@@ -0,0 +1,23 @@
+import {EndpointInfo, Inject, Middleware, Req} from "@tsed/common";
+import * as Passport from "passport";
+import {Unauthorized} from "ts-httpexceptions";
+import {ProtocolsService} from "../services/ProtocolsService";
+import {getProtocolsFromRequest} from "../utils/getProtocolsFromRequest";
+
+@Middleware()
+export class PassportMiddleware {
+  @Inject(ProtocolsService)
+  protocolsService: ProtocolsService;
+
+  use(@Req() request: Req, @EndpointInfo() endpoint: EndpointInfo) {
+    const {options, protocol, method} = endpoint.store.get(PassportMiddleware);
+    const protocols = getProtocolsFromRequest(request, protocol, this.protocolsService.getProtocolsNames());
+
+    if (protocols.length === 0) {
+      throw new Unauthorized("Not authorized");
+    }
+
+    // @ts-ignore
+    return Passport[method](protocols.length === 1 ? protocol[0] : protocols, options);
+  }
+}

packages/passport/src/services/ProtocolsService.ts

@@ -15,7 +15,7 @@ export class ProtocolsService {
     return Array.from(this.injector.getProviders(PROVIDER_TYPE_PROTOCOL));
   }
 
-  public getProviderNames(): string[] {
+  public getProtocolsNames(): string[] {
     return this.getProtocols().map(provider => this.getOptions(provider).name);
   }
 

packages/passport/src/utils/getProtocolsFromRequest.ts

@@ -0,0 +1,35 @@
+function getProtocolName(req: any) {
+  const {query = {}, params = {}, body = {}} = req;
+
+  return params.protocol || query.protocol || body.protocol;
+}
+
+const add = (protocols: string[], protocol: string): string[] => {
+  if (!protocol || protocols.includes(protocol)) {
+    return protocols;
+  }
+
+  return protocols.concat(protocol);
+};
+
+export function getProtocolsFromRequest(req: any, protocol: string | string[], defaultProtocols: string[]): string[] {
+  let protocols: string[] = [].concat(protocol as never);
+
+  if (protocols.includes("*")) {
+    return defaultProtocols;
+  }
+
+  protocols = protocols.reduce((protocols: string[], protocol: string) => {
+    if (protocol === ":protocol") {
+      return add(protocols, getProtocolName(req));
+    }
+
+    if (protocol === getProtocolName(req)) {
+      return add(protocols, protocol);
+    }
+
+    return protocols;
+  }, [] as string[]);
+
+  return protocols;
+}

packages/passport/test/utils/getProtocolsFromRequest.spec.ts

@@ -0,0 +1,83 @@
+import {expect} from "chai";
+import {getProtocolsFromRequest} from "../../src/utils/getProtocolsFromRequest";
+
+describe("getProtocolsFromRequest", () => {
+  it("should allow all protocol (from default protocols)", () => {
+    const defaultProtocols = ["default"];
+    const req = {};
+    const result = getProtocolsFromRequest(req, "*", defaultProtocols);
+
+    expect(result).to.deep.equal(["default"]);
+  });
+
+  it("should get protocol from request (params)", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      params: {
+        protocol: "basic"
+      }
+    };
+    const result = getProtocolsFromRequest(req, ":protocol", defaultProtocols);
+
+    expect(result).to.deep.equal(["basic"]);
+  });
+
+  it("should not get protocol from request", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      params: {}
+    };
+    const result = getProtocolsFromRequest(req, ":protocol", defaultProtocols);
+
+    expect(result).to.deep.equal([]);
+  });
+
+  it("should get protocol from request (query)", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      query: {
+        protocol: "basic"
+      }
+    };
+    const result = getProtocolsFromRequest(req, ":protocol", defaultProtocols);
+
+    expect(result).to.deep.equal(["basic"]);
+  });
+
+  it("should get protocol from request (body)", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      body: {
+        protocol: "basic"
+      }
+    };
+    const result = getProtocolsFromRequest(req, ":protocol", defaultProtocols);
+
+    expect(result).to.deep.equal(["basic"]);
+  });
+
+
+  it("should return basic protocol", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      params: {
+        protocol: "basic"
+      }
+    };
+    const result = getProtocolsFromRequest(req, "basic", defaultProtocols);
+
+    expect(result).to.deep.equal(["basic"]);
+  });
+
+  it("should not return protocol when protocol doesn\'t match", () => {
+    const defaultProtocols = ["default"];
+    const req = {
+      params: {
+        protocol: "basic"
+      }
+    };
+    const result = getProtocolsFromRequest(req, "other", defaultProtocols);
+
+    expect(result).to.deep.equal([]);
+  });
+});