snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/oauth2-server/model.ts

@@ -0,0 +1,285 @@
+import type {
+	AuthorizationCode,
+	AuthorizationCodeModel,
+	Client,
+	Falsey,
+	RefreshToken,
+	RefreshTokenModel,
+	Token,
+	User,
+} from '@node-oauth/oauth2-server';
+import { OAuthApps, OAuthAuthCodes, OAuthAccessTokens, OAuthRefreshTokens, Users } from '@rocket.chat/models';
+
+export type ModelConfig = {
+	debug?: boolean;
+};
+
+export class Model implements AuthorizationCodeModel, RefreshTokenModel {
+	private debug: boolean;
+
+	private grants = ['authorization_code', 'refresh_token'];
+
+	constructor(config: ModelConfig = {}) {
+		this.debug = !!config.debug;
+	}
+
+	async verifyScope(token: Token, scope: string | string[]): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in grantTypeAllowed (clientId:', token.client.id, ', grantType:', `${scope})`);
+		}
+
+		if (!Array.isArray(scope)) {
+			scope = [scope];
+		}
+
+		const allowed = this.grants.filter((t) => scope.includes(t)).length > 0;
+		return allowed;
+	}
+
+	async getAccessToken(accessToken: string): Promise<Token | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in getAccessToken (bearerToken:', accessToken, ')');
+		}
+
+		const token = await OAuthAccessTokens.findOneByAccessToken(accessToken);
+
+		if (!token) {
+			return;
+		}
+
+		const client = await this.getClient(token.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const user = await Users.findOneActiveById(token.userId, { projection: { _id: 1 } });
+		if (!user) {
+			return;
+		}
+
+		const result: Token = {
+			accessToken: token.accessToken,
+			client,
+			user: {
+				id: token.userId,
+			},
+		};
+
+		return result;
+	}
+
+	async getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');
+		}
+
+		let client;
+		if (clientSecret == null) {
+			client = await OAuthApps.findOneActiveByClientId(clientId);
+		} else {
+			client = await OAuthApps.findOneActiveByClientIdAndClientSecret(clientId, clientSecret);
+		}
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const result: Client = {
+			grants: this.grants,
+			redirectUris: client.redirectUri.split(','),
+			id: client.clientId,
+		};
+
+		return result;
+	}
+
+	async getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);
+		}
+
+		const code = await OAuthAuthCodes.findOneByAuthCode(authorizationCode);
+		if (!code) {
+			throw new Error('Invalid authCode');
+		}
+
+		const client = await this.getClient(code.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const authCode: AuthorizationCode = {
+			authorizationCode,
+			expiresAt: code.expires,
+			user: {
+				id: code.userId,
+			},
+			client: {
+				id: client.id,
+				grants: client.grants,
+			},
+			redirectUri: code.redirectUri,
+		};
+
+		return authCode;
+	}
+
+	async saveAuthorizationCode(
+		code: Pick<AuthorizationCode, 'authorizationCode' | 'expiresAt' | 'redirectUri' | 'scope'>,
+		client: Client,
+		user: User,
+	): Promise<AuthorizationCode | Falsey> {
+		if (this.debug === true) {
+			console.log(
+				'[OAuth2Server]',
+				'in saveAuthCode (code:',
+				code.authorizationCode,
+				', clientId:',
+				client.id,
+				', expires:',
+				code.expiresAt,
+				', user:',
+				user,
+				')',
+			);
+		}
+
+		await OAuthAuthCodes.updateOne(
+			{ authCode: code.authorizationCode },
+			{
+				$set: {
+					authCode: code.authorizationCode,
+					clientId: client.id,
+					userId: user.id,
+					expires: code.expiresAt,
+					redirectUri: code.redirectUri,
+				},
+			},
+			{ upsert: true },
+		);
+
+		const newCode = {
+			...code,
+			client,
+			user,
+		};
+
+		return newCode;
+	}
+
+	async saveToken(token: Token, client: Client, user: User): Promise<Token | Falsey> {
+		if (this.debug === true) {
+			console.log(
+				'[OAuth2Server]',
+				'in saveToken (token:',
+				token.accessToken,
+				', refreshToken:',
+				token.refreshToken,
+				', clientId:',
+				client.id,
+				', user:',
+				user,
+				', expires:',
+				token.accessTokenExpiresAt,
+				', refreshTokenExpires:',
+				token.refreshTokenExpiresAt,
+				')',
+			);
+		}
+
+		const tokenId = (
+			await OAuthAccessTokens.insertOne({
+				accessToken: token.accessToken,
+				refreshToken: token.refreshToken,
+				expires: token.accessTokenExpiresAt,
+				refreshTokenExpiresAt: token.refreshTokenExpiresAt,
+				clientId: client.id,
+				userId: user.id,
+			})
+		).insertedId;
+
+		const result: Token = {
+			id: tokenId,
+			accessToken: token.accessToken,
+			refreshToken: token.refreshToken,
+			accessTokenExpiresAt: token.accessTokenExpiresAt,
+			refreshTokenExpiresAt: token.refreshTokenExpiresAt,
+			client,
+			user,
+		};
+
+		return result;
+	}
+
+	async getRefreshToken(refreshToken: string): Promise<RefreshToken | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in getRefreshToken (refreshToken: ${refreshToken})`);
+		}
+
+		// Keep compatibility with old collection
+		// Deprecated: Remove on next major within a migration
+		const token =
+			(await OAuthAccessTokens.findOneByRefreshToken(refreshToken)) || (await OAuthRefreshTokens.findOneByRefreshToken(refreshToken));
+
+		if (!token) {
+			throw new Error('Invalid token');
+		}
+
+		const client = await this.getClient(token.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const user = await Users.findOneActiveById(token.userId, { projection: { _id: 1 } });
+		if (!user) {
+			throw new Error('Invalid token');
+		}
+
+		const result: RefreshToken = {
+			// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+			refreshToken: token.refreshToken!,
+			// Keep compatibility with old collection
+			// Deprecated: Remove on next major within a migration
+			refreshTokenExpiresAt: 'refreshTokenExpiresAt' in token ? token.refreshTokenExpiresAt : token.expires,
+			client: {
+				id: client.id,
+				grants: client.grants,
+			},
+			user: {
+				id: token.userId,
+			},
+		};
+
+		return result;
+	}
+
+	async revokeToken(token: RefreshToken | Token): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in revokeToken (token: ${token.accessToken})`);
+		}
+
+		if (token.refreshToken) {
+			await OAuthAccessTokens.deleteOne({ refreshToken: token.refreshToken });
+			// Keep compatibility with old collection
+			// Deprecated: Remove on next major within a migration
+			await OAuthRefreshTokens.deleteOne({ refreshToken: token.refreshToken });
+		}
+
+		if (token.accessToken) {
+			await OAuthAccessTokens.deleteOne({ accessToken: token.accessToken });
+		}
+
+		return true;
+	}
+
+	async revokeAuthorizationCode(code: AuthorizationCode): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in revokeAuthorizationCode (code: ${code.authorizationCode})`);
+		}
+		await OAuthAuthCodes.deleteOne({ authCode: code.authorizationCode });
+		return true;
+	}
+}

apps/meteor/server/oauth2-server/oauth.ts

@@ -0,0 +1,209 @@
+import OAuthServer, { OAuthError, UnauthorizedRequestError } from '@node-oauth/oauth2-server';
+import { OAuthApps, Users } from '@rocket.chat/models';
+import express from 'express';
+import type { Express, NextFunction, Request, Response } from 'express';
+import { Accounts } from 'meteor/accounts-base';
+
+import type { ModelConfig } from './model';
+import { Model } from './model';
+
+export class OAuth2Server {
+	public app: Express;
+
+	private oauth: OAuthServer;
+
+	private config: ModelConfig;
+
+	constructor(config: ModelConfig) {
+		if (config == null) {
+			config = {};
+		}
+
+		this.config = config;
+		this.app = express();
+		this.app.use(
+			'/oauth/*',
+			express.json({
+				limit: '50mb',
+			}),
+			express.urlencoded({
+				extended: true,
+				limit: '50mb',
+			}),
+			express.query({}),
+		);
+
+		this.oauth = new OAuthServer({
+			model: new Model(this.config),
+		});
+
+		this.initRoutes();
+
+		return this;
+	}
+
+	initRoutes() {
+		const { config, oauth } = this;
+
+		const debugMiddleware = function (req: Request, _res: Response, next: NextFunction) {
+			if (config.debug === true) {
+				console.log('[OAuth2Server]', req.method, req.url);
+			}
+			return next();
+		};
+
+		const handleResponse = function (res: Response, response: OAuthServer.Response, next: NextFunction) {
+			if (response.status === 302 && response.headers?.location) {
+				const { location } = response.headers;
+				delete response.headers.location;
+				res.set(response.headers);
+				res.redirect(location);
+			} else if (response.status) {
+				res.set(response.headers);
+				res.status(response.status).send(response.body);
+			} else {
+				next();
+			}
+		};
+
+		// Transforms requests which are POST and aren't "x-www-form-urlencoded" content type
+		// and they pass the required information as query strings
+		const transformRequestsNotUsingFormUrlencodedType = function (req: Request, _res: Response, next: NextFunction) {
+			if (!req.is('application/x-www-form-urlencoded') && req.method === 'POST') {
+				if (config.debug === true) {
+					console.log('[OAuth2Server]', 'Transforming a request to form-urlencoded with the query going to the body.');
+				}
+				req.headers['content-type'] = 'application/x-www-form-urlencoded';
+				req.body = Object.assign({}, req.body, req.query);
+			}
+			return next();
+		};
+
+		const validateTokenPayload = function (req: Request, res: Response, next: NextFunction) {
+			const grantParams = ['client_id', 'client_secret', 'refresh_token', 'code', 'grant_type', 'scope', 'redirect_uri'];
+
+			for (const param of grantParams) {
+				for (const source of [req.body, req.query]) {
+					if (source?.[param] !== undefined && typeof source[param] !== 'string') {
+						return res.status(400).send({
+							error: 'invalid_request',
+							error_description: `Invalid parameter: ${param} must be a string`,
+						});
+					}
+				}
+			}
+			return next();
+		};
+
+		this.app.all(
+			'/oauth/token',
+			debugMiddleware,
+			transformRequestsNotUsingFormUrlencodedType,
+			validateTokenPayload,
+			async (req, res, next) => {
+				const request = new OAuthServer.Request(req);
+				const response = new OAuthServer.Response(res);
+
+				try {
+					await oauth.token(request, response);
+
+					handleResponse(res, response, next);
+				} catch (e: any) {
+					next(e);
+				}
+			},
+		);
+
+		this.app.get('/oauth/authorize', debugMiddleware, async (req, res, next) => {
+			if (typeof req.query.client_id !== 'string') {
+				return res.redirect('/oauth/error/404');
+			}
+
+			const client = await OAuthApps.findOneActiveByClientId(req.query.client_id);
+			if (client == null) {
+				return res.redirect('/oauth/error/404');
+			}
+
+			const redirectUris: string[] = client.redirectUri.split(',');
+
+			if (typeof req.query.redirect_uri === 'string' && !redirectUris.includes(req.query.redirect_uri)) {
+				return res.redirect('/oauth/error/invalid_redirect_uri');
+			}
+
+			return next();
+		});
+
+		this.app.post('/oauth/authorize', debugMiddleware, async (req, res, next) => {
+			if (req.body.allow !== 'yes') {
+				res.status(401);
+				return res.send({ error: 'access_denied', error_description: 'The user denied access to your application' });
+			}
+
+			// The new version of the library is expecting a new name. Doing this for compatibility
+			if (req.body.token && !req.body.access_token) {
+				req.body.access_token = req.body.token;
+			}
+
+			if (req.body.access_token == null) {
+				return res.status(401).send('No token');
+			}
+
+			const user = await Users.findOne(
+				{
+					'services.resume.loginTokens.hashedToken': Accounts._hashLoginToken(req.body.access_token),
+				},
+				{ projection: { _id: 1 } },
+			);
+
+			if (user == null) {
+				return res.status(401).send('Invalid token');
+			}
+
+			res.locals.user = { id: user._id };
+
+			return next();
+		});
+
+		this.app.post('/oauth/authorize', debugMiddleware, async (req: Request, res: Response, next: NextFunction) => {
+			const request = new OAuthServer.Request(req);
+			const response = new OAuthServer.Response(res);
+
+			try {
+				await oauth.authorize(request, response, {
+					authenticateHandler: {
+						async handle() {
+							const clientId = request.body.client_id || request.query?.client_id;
+
+							if (!clientId) {
+								throw new Error('Missing parameter: `client_id`');
+							}
+
+							if (req.body.allow === 'yes') {
+								await Users.updateOne({ _id: res.locals.user.id }, { $addToSet: { 'oauth.authorizedClients': clientId } });
+							}
+							return { id: res.locals.user.id };
+						},
+					},
+				});
+
+				handleResponse(res, response, next);
+			} catch (e: any) {
+				next(e);
+			}
+		});
+
+		this.app.use('/oauth/*', (err: Error, _req: Request, res: Response, next: NextFunction) => {
+			if (!(err instanceof OAuthError)) return next(err);
+
+			delete err.stack;
+
+			res.status(err.code);
+
+			if (err instanceof UnauthorizedRequestError) {
+				return res.send();
+			}
+
+			res.send({ error: err.name, error_description: err.message });
+		});
+	}
+}