Skip to content

Commit c0e8306

Browse files
YukaiiYukaii
committed
Merge branch 'frontend-next' into t216-refactor-common
2 parents 0f833f0 + 3d6b319 commit c0e8306

18 files changed

Lines changed: 306 additions & 69 deletions

‎README.md‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,18 @@ Environment variables (will overwrite other server configs)
130130
| HMD_DROPBOX_CLIENTSECRET | no example | Dropbox API client secret |
131131
| HMD_GOOGLE_CLIENTID | no example | Google API client id |
132132
| HMD_GOOGLE_CLIENTSECRET | no example | Google API client secret |
133+
| HMD_LDAP_URL | ldap://example.com | url of LDAP server |
134+
| HMD_LDAP_BINDDN | no example | bindDn for LDAP access |
135+
| HMD_LDAP_BINDCREDENTIALS | no example | bindCredentials for LDAP access |
136+
| HMD_LDAP_TOKENSECRET | supersecretkey | secret used for generating access/refresh tokens |
137+
| HMD_LDAP_SEARCHBASE | o=users,dc=example,dc=com | LDAP directory to begin search from |
138+
| HMD_LDAP_SEARCHFILTER | (uid={{username}}) | LDAP filter to search with |
139+
| HMD_LDAP_SEARCHATTRIBUTES | no example | LDAP attributes to search with |
140+
| HMD_LDAP_TLS_CA | no example | Root CA for LDAP TLS in PEM format |
141+
| HMD_LDAP_PROVIDERNAME | My institution | Optional name to be displayed at login form indicating the LDAP provider |
133142
| HMD_IMGUR_CLIENTID | no example | Imgur API client id |
134-
| HMD_EMAIL | `true` or `false` | set to allow email register and signin |
143+
| HMD_EMAIL | `true` or `false` | set to allow email signin |
144+
| HMD_ALLOW_EMAIL_REGISTER | `true` or `false` | set to allow email register (only applied when email is set, default is `true`) |
135145
| HMD_IMAGE_UPLOAD_TYPE | `imgur`, `s3` or `filesystem` | Where to upload image. For S3, see our [S3 Image Upload Guide](docs/guides/s3-image-upload.md) |
136146
| HMD_S3_ACCESS_KEY_ID | no example | AWS access key id |
137147
| HMD_S3_SECRET_ACCESS_KEY | no example | AWS secret key |
@@ -175,7 +185,8 @@ Application settings `config.json`
175185
| heartbeatinterval | `5000` | socket.io heartbeat interval |
176186
| heartbeattimeout | `10000` | socket.io heartbeat timeout |
177187
| documentmaxlength | `100000` | note max length |
178-
| email | `true` or `false` | set to allow email register and signin |
188+
| email | `true` or `false` | set to allow email signin |
189+
| allowemailregister | `true` or `false` | set to allow email register (only applied when email is set, default is `true`) |
179190
| imageUploadType | `imgur`(default), `s3` or `filesystem` | Where to upload image
180191
| s3 | `{ "accessKeyId": "YOUR_S3_ACCESS_KEY_ID", "secretAccessKey": "YOUR_S3_ACCESS_KEY", "region": "YOUR_S3_REGION", "bucket": "YOUR_S3_BUCKET_NAME" }` | When `imageUploadType` be setted to `s3`, you would also need to setup this key, check our [S3 Image Upload Guide](docs/guides/s3-image-upload.md) |
181192

@@ -184,7 +195,7 @@ Third-party integration api key settings
184195

185196
| service | settings location | description |
186197
| ------- | --------- | ----------- |
187-
| facebook, twitter, github, gitlab, dropbox, google | environment variables or `config.json` | for signin |
198+
| facebook, twitter, github, gitlab, dropbox, google, ldap | environment variables or `config.json` | for signin |
188199
| imgur | environment variables or `config.json` | for image upload |
189200
| google drive(`google/apiKey`, `google/clientID`), dropbox(`dropbox/appKey`) | `config.json` | for export and import |
190201

‎app.js‎

Lines changed: 40 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -381,36 +381,50 @@ if (config.google) {
381381
failureRedirect: config.serverurl + '/'
382382
}));
383383
}
384+
// ldap auth
385+
if (config.ldap) {
386+
app.post('/auth/ldap', urlencodedParser, function (req, res, next) {
387+
if (!req.body.username || !req.body.password) return response.errorBadRequest(res);
388+
setReturnToFromReferer(req);
389+
passport.authenticate('ldapauth', {
390+
successReturnToOrRedirect: config.serverurl + '/',
391+
failureRedirect: config.serverurl + '/',
392+
failureFlash: true
393+
})(req, res, next);
394+
});
395+
}
384396
// email auth
385397
if (config.email) {
386-
app.post('/register', urlencodedParser, function (req, res, next) {
387-
if (!req.body.email || !req.body.password) return response.errorBadRequest(res);
388-
if (!validator.isEmail(req.body.email)) return response.errorBadRequest(res);
389-
models.User.findOrCreate({
390-
where: {
391-
email: req.body.email
392-
},
393-
defaults: {
394-
password: req.body.password
395-
}
396-
}).spread(function (user, created) {
397-
if (user) {
398-
if (created) {
399-
if (config.debug) logger.info('user registered: ' + user.id);
400-
req.flash('info', "You've successfully registered, please signin.");
401-
} else {
402-
if (config.debug) logger.info('user found: ' + user.id);
403-
req.flash('error', "This email has been used, please try another one.");
398+
if (config.allowemailregister)
399+
app.post('/register', urlencodedParser, function (req, res, next) {
400+
if (!req.body.email || !req.body.password) return response.errorBadRequest(res);
401+
if (!validator.isEmail(req.body.email)) return response.errorBadRequest(res);
402+
models.User.findOrCreate({
403+
where: {
404+
email: req.body.email
405+
},
406+
defaults: {
407+
password: req.body.password
408+
}
409+
}).spread(function (user, created) {
410+
if (user) {
411+
if (created) {
412+
if (config.debug) logger.info('user registered: ' + user.id);
413+
req.flash('info', "You've successfully registered, please signin.");
414+
} else {
415+
if (config.debug) logger.info('user found: ' + user.id);
416+
req.flash('error', "This email has been used, please try another one.");
417+
}
418+
return res.redirect(config.serverurl + '/');
404419
}
420+
req.flash('error', "Failed to register your account, please try again.");
405421
return res.redirect(config.serverurl + '/');
406-
}
407-
req.flash('error', "Failed to register your account, please try again.");
408-
return res.redirect(config.serverurl + '/');
409-
}).catch(function (err) {
410-
logger.error('auth callback failed: ' + err);
411-
return response.errorInternalError(res);
422+
}).catch(function (err) {
423+
logger.error('auth callback failed: ' + err);
424+
return response.errorInternalError(res);
425+
});
412426
});
413-
});
427+
414428
app.post('/login', urlencodedParser, function (req, res, next) {
415429
if (!req.body.email || !req.body.password) return response.errorBadRequest(res);
416430
if (!validator.isEmail(req.body.email)) return response.errorBadRequest(res);
@@ -627,7 +641,7 @@ process.on('SIGINT', function () {
627641
var checkCleanTimer = setInterval(function () {
628642
if (history.isReady() && realtime.isReady()) {
629643
models.Revision.checkAllNotesRevision(function (err, notes) {
630-
if (err) throw new Error(err);
644+
if (err) return logger.error(err);
631645
if (!notes || notes.length <= 0) {
632646
clearInterval(checkCleanTimer);
633647
return process.exit(0);

‎config.json.example‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,18 @@
5353
"clientSecret": "change this",
5454
"apiKey": "change this"
5555
},
56+
"ldap": {
57+
"url": "ldap://change_this",
58+
"bindDn": null,
59+
"bindCredentials": null,
60+
"tokenSecret": "change this",
61+
"searchBase": "change this",
62+
"searchFilter": "change this",
63+
"searchAttributes": "change this",
64+
"tlsOptions": {
65+
"changeme": "See https://nodejs.org/api/tls.html#tls_tls_connect_options_callback"
66+
}
67+
},
5668
"imgur": {
5769
"clientID": "change this"
5870
}

‎lib/auth.js‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ var GithubStrategy = require('passport-github').Strategy;
77
var GitlabStrategy = require('passport-gitlab2').Strategy;
88
var DropboxStrategy = require('passport-dropbox-oauth2').Strategy;
99
var GoogleStrategy = require('passport-google-oauth20').Strategy;
10+
var LdapStrategy = require('passport-ldapauth');
1011
var LocalStrategy = require('passport-local').Strategy;
1112
var validator = require('validator');
1213

@@ -110,6 +111,62 @@ if (config.google) {
110111
callbackURL: config.serverurl + '/auth/google/callback'
111112
}, callback));
112113
}
114+
// ldap
115+
if (config.ldap) {
116+
passport.use(new LdapStrategy({
117+
server: {
118+
url: config.ldap.url || null,
119+
bindDn: config.ldap.bindDn || null,
120+
bindCredentials: config.ldap.bindCredentials || null,
121+
searchBase: config.ldap.searchBase || null,
122+
searchFilter: config.ldap.searchFilter || null,
123+
searchAttributes: config.ldap.searchAttributes || null,
124+
tlsOptions: config.ldap.tlsOptions || null
125+
},
126+
},
127+
function(user, done) {
128+
var profile = {
129+
id: 'LDAP-' + user.uidNumber,
130+
username: user.uid,
131+
displayName: user.displayName,
132+
emails: user.mail ? [user.mail] : [],
133+
avatarUrl: null,
134+
profileUrl: null,
135+
provider: 'ldap',
136+
}
137+
var stringifiedProfile = JSON.stringify(profile);
138+
models.User.findOrCreate({
139+
where: {
140+
profileid: profile.id.toString()
141+
},
142+
defaults: {
143+
profile: stringifiedProfile,
144+
}
145+
}).spread(function (user, created) {
146+
if (user) {
147+
var needSave = false;
148+
if (user.profile != stringifiedProfile) {
149+
user.profile = stringifiedProfile;
150+
needSave = true;
151+
}
152+
if (needSave) {
153+
user.save().then(function () {
154+
if (config.debug)
155+
logger.info('user login: ' + user.id);
156+
return done(null, user);
157+
});
158+
} else {
159+
if (config.debug)
160+
logger.info('user login: ' + user.id);
161+
return done(null, user);
162+
}
163+
}
164+
}).catch(function (err) {
165+
logger.error('ldap auth failed: ' + err);
166+
return done(err, null);
167+
});
168+
}));
169+
}
113170
// email
114171
if (config.email) {
115172
passport.use(new LocalStrategy({
@@ -130,4 +187,4 @@ if (config.email) {
130187
return done(err);
131188
});
132189
}));
133-
}
190+
}

‎lib/config.js‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,44 @@ var google = (process.env.HMD_GOOGLE_CLIENTID && process.env.HMD_GOOGLE_CLIENTSE
9595
clientID: process.env.HMD_GOOGLE_CLIENTID,
9696
clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET
9797
} : (config.google && config.google.clientID && config.google.clientSecret) || false;
98+
var ldap = config.ldap || (
99+
process.env.HMD_LDAP_URL ||
100+
process.env.HMD_LDAP_BINDDN ||
101+
process.env.HMD_LDAP_BINDCREDENTIALS ||
102+
process.env.HMD_LDAP_TOKENSECRET ||
103+
process.env.HMD_LDAP_SEARCHBASE ||
104+
process.env.HMD_LDAP_SEARCHFILTER ||
105+
process.env.HMD_LDAP_SEARCHATTRIBUTES ||
106+
process.env.HMD_LDAP_PROVIDERNAME
107+
) || false;
108+
if (ldap == true)
109+
ldap = {};
110+
if (process.env.HMD_LDAP_URL)
111+
ldap.url = process.env.HMD_LDAP_URL;
112+
if (process.env.HMD_LDAP_BINDDN)
113+
ldap.bindDn = process.env.HMD_LDAP_BINDDN;
114+
if (process.env.HMD_LDAP_BINDCREDENTIALS)
115+
ldap.bindCredentials = process.env.HMD_LDAP_BINDCREDENTIALS;
116+
if (process.env.HMD_LDAP_TOKENSECRET)
117+
ldap.tokenSecret = process.env.HMD_LDAP_TOKENSECRET;
118+
if (process.env.HMD_LDAP_SEARCHBASE)
119+
ldap.searchBase = process.env.HMD_LDAP_SEARCHBASE;
120+
if (process.env.HMD_LDAP_SEARCHFILTER)
121+
ldap.searchFilter = process.env.HMD_LDAP_SEARCHFILTER;
122+
if (process.env.HMD_LDAP_SEARCHATTRIBUTES)
123+
ldap.searchAttributes = process.env.HMD_LDAP_SEARCHATTRIBUTES;
124+
if (process.env.HMD_LDAP_TLS_CA) {
125+
var ca = {
126+
ca: process.env.HMD_LDAP_TLS_CA
127+
}
128+
ldap.tlsOptions = ldap.tlsOptions ? Object.assign(ldap.tlsOptions, ca) : ca
129+
}
130+
if (process.env.HMD_LDAP_PROVIDERNAME) {
131+
ldap.providerName = process.env.HMD_LDAP_PROVIDERNAME;
132+
}
98133
var imgur = process.env.HMD_IMGUR_CLIENTID || config.imgur || false;
99134
var email = process.env.HMD_EMAIL ? (process.env.HMD_EMAIL === 'true') : !!config.email;
135+
var allowemailregister = process.env.HMD_ALLOW_EMAIL_REGISTER ? (process.env.HMD_ALLOW_EMAIL_REGISTER === 'true') : ((typeof config.allowemailregister === 'boolean') ? config.allowemailregister : true);
100136

101137
function getserverurl() {
102138
var url = '';
@@ -156,8 +192,10 @@ module.exports = {
156192
gitlab: gitlab,
157193
dropbox: dropbox,
158194
google: google,
195+
ldap: ldap,
159196
imgur: imgur,
160197
email: email,
198+
allowemailregister: allowemailregister,
161199
imageUploadType: imageUploadType,
162200
s3: s3,
163201
s3bucket: s3bucket

‎lib/letter-avatars.js‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
"use strict";
2+
3+
// external modules
4+
var randomcolor = require('randomcolor');
5+
6+
// core
7+
module.exports = function(name) {
8+
var color = randomcolor({
9+
seed: name,
10+
luminosity: 'dark'
11+
});
12+
var letter = name.substring(0, 1).toUpperCase();
13+
14+
var svg = '<?xml version="1.0" encoding="UTF-8" standalone="no"?>';
15+
svg += '<svg xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://www.w3.org/2000/svg" height="96" width="96" version="1.1" viewBox="0 0 96 96">';
16+
svg += '<g>';
17+
svg += '<rect width="96" height="96" fill="' + color + '" />';
18+
svg += '<text font-size="64px" font-family="sans-serif" text-anchor="middle" fill="#ffffff">';
19+
svg += '<tspan x="48" y="72" stroke-width=".26458px" fill="#ffffff">' + letter + '</tspan>';
20+
svg += '</text>';
21+
svg += '</g>';
22+
svg += '</svg>';
23+
24+
return 'data:image/svg+xml;base64,' + new Buffer(svg).toString('base64');
25+
};

‎lib/models/note.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ var logger = require("../logger.js");
2323
var ot = require("../ot/index.js");
2424

2525
// permission types
26-
var permissionTypes = ["freely", "editable", "locked", "private"];
26+
var permissionTypes = ["freely", "editable", "limited", "locked", "protected", "private"];
2727

2828
module.exports = function (sequelize, DataTypes) {
2929
var Note = sequelize.define("Note", {
@@ -333,7 +333,7 @@ module.exports = function (sequelize, DataTypes) {
333333
if (meta.slideOptions && (typeof meta.slideOptions == "object"))
334334
_meta.slideOptions = meta.slideOptions;
335335
}
336-
return _meta;
336+
return _meta;
337337
},
338338
updateAuthorshipByOperation: function (operation, userId, authorships) {
339339
var index = 0;
@@ -532,4 +532,4 @@ module.exports = function (sequelize, DataTypes) {
532532
});
533533

534534
return Note;
535-
};
535+
};

‎lib/models/user.js‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ var scrypt = require('scrypt');
77

88
// core
99
var logger = require("../logger.js");
10+
var letterAvatars = require('../letter-avatars.js');
1011

1112
module.exports = function (sequelize, DataTypes) {
1213
var User = sequelize.define("User", {
@@ -105,6 +106,16 @@ module.exports = function (sequelize, DataTypes) {
105106
case "google":
106107
photo = profile.photos[0].value.replace(/(\?sz=)\d*$/i, '$196');
107108
break;
109+
case "ldap":
110+
//no image api provided,
111+
//use gravatar if email exists,
112+
//otherwise generate a letter avatar
113+
if (profile.emails[0]) {
114+
photo = 'https://www.gravatar.com/avatar/' + md5(profile.emails[0]) + '?s=96';
115+
} else {
116+
photo = letterAvatars(profile.username);
117+
}
118+
break;
108119
}
109120
return photo;
110121
},

0 commit comments

Comments
 (0)