snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/oauth2-server/model.ts

@@ -0,0 +1,285 @@
+import type {
+	AuthorizationCode,
+	AuthorizationCodeModel,
+	Client,
+	Falsey,
+	RefreshToken,
+	RefreshTokenModel,
+	Token,
+	User,
+} from '@node-oauth/oauth2-server';
+import { OAuthApps, OAuthAuthCodes, OAuthAccessTokens, OAuthRefreshTokens, Users } from '@rocket.chat/models';
+
+export type ModelConfig = {
+	debug?: boolean;
+};
+
+export class Model implements AuthorizationCodeModel, RefreshTokenModel {
+	private debug: boolean;
+
+	private grants = ['authorization_code', 'refresh_token'];
+
+	constructor(config: ModelConfig = {}) {
+		this.debug = !!config.debug;
+	}
+
+	async verifyScope(token: Token, scope: string | string[]): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in grantTypeAllowed (clientId:', token.client.id, ', grantType:', `${scope})`);
+		}
+
+		if (!Array.isArray(scope)) {
+			scope = [scope];
+		}
+
+		const allowed = this.grants.filter((t) => scope.includes(t)).length > 0;
+		return allowed;
+	}
+
+	async getAccessToken(accessToken: string): Promise<Token | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in getAccessToken (bearerToken:', accessToken, ')');
+		}
+
+		const token = await OAuthAccessTokens.findOneByAccessToken(accessToken);
+
+		if (!token) {
+			return;
+		}
+
+		const client = await this.getClient(token.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const user = await Users.findOneActiveById(token.userId, { projection: { _id: 1 } });
+		if (!user) {
+			return;
+		}
+
+		const result: Token = {
+			accessToken: token.accessToken,
+			client,
+			user: {
+				id: token.userId,
+			},
+		};
+
+		return result;
+	}
+
+	async getClient(clientId: string, clientSecret?: string): Promise<Client | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', 'in getClient (clientId:', clientId, ', clientSecret:', clientSecret, ')');
+		}
+
+		let client;
+		if (clientSecret == null) {
+			client = await OAuthApps.findOneActiveByClientId(clientId);
+		} else {
+			client = await OAuthApps.findOneActiveByClientIdAndClientSecret(clientId, clientSecret);
+		}
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const result: Client = {
+			grants: this.grants,
+			redirectUris: client.redirectUri.split(','),
+			id: client.clientId,
+		};
+
+		return result;
+	}
+
+	async getAuthorizationCode(authorizationCode: string): Promise<AuthorizationCode | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in getAuthorizationCode (authCode: ${authorizationCode})`);
+		}
+
+		const code = await OAuthAuthCodes.findOneByAuthCode(authorizationCode);
+		if (!code) {
+			throw new Error('Invalid authCode');
+		}
+
+		const client = await this.getClient(code.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const authCode: AuthorizationCode = {
+			authorizationCode,
+			expiresAt: code.expires,
+			user: {
+				id: code.userId,
+			},
+			client: {
+				id: client.id,
+				grants: client.grants,
+			},
+			redirectUri: code.redirectUri,
+		};
+
+		return authCode;
+	}
+
+	async saveAuthorizationCode(
+		code: Pick<AuthorizationCode, 'authorizationCode' | 'expiresAt' | 'redirectUri' | 'scope'>,
+		client: Client,
+		user: User,
+	): Promise<AuthorizationCode | Falsey> {
+		if (this.debug === true) {
+			console.log(
+				'[OAuth2Server]',
+				'in saveAuthCode (code:',
+				code.authorizationCode,
+				', clientId:',
+				client.id,
+				', expires:',
+				code.expiresAt,
+				', user:',
+				user,
+				')',
+			);
+		}
+
+		await OAuthAuthCodes.updateOne(
+			{ authCode: code.authorizationCode },
+			{
+				$set: {
+					authCode: code.authorizationCode,
+					clientId: client.id,
+					userId: user.id,
+					expires: code.expiresAt,
+					redirectUri: code.redirectUri,
+				},
+			},
+			{ upsert: true },
+		);
+
+		const newCode = {
+			...code,
+			client,
+			user,
+		};
+
+		return newCode;
+	}
+
+	async saveToken(token: Token, client: Client, user: User): Promise<Token | Falsey> {
+		if (this.debug === true) {
+			console.log(
+				'[OAuth2Server]',
+				'in saveToken (token:',
+				token.accessToken,
+				', refreshToken:',
+				token.refreshToken,
+				', clientId:',
+				client.id,
+				', user:',
+				user,
+				', expires:',
+				token.accessTokenExpiresAt,
+				', refreshTokenExpires:',
+				token.refreshTokenExpiresAt,
+				')',
+			);
+		}
+
+		const tokenId = (
+			await OAuthAccessTokens.insertOne({
+				accessToken: token.accessToken,
+				refreshToken: token.refreshToken,
+				expires: token.accessTokenExpiresAt,
+				refreshTokenExpiresAt: token.refreshTokenExpiresAt,
+				clientId: client.id,
+				userId: user.id,
+			})
+		).insertedId;
+
+		const result: Token = {
+			id: tokenId,
+			accessToken: token.accessToken,
+			refreshToken: token.refreshToken,
+			accessTokenExpiresAt: token.accessTokenExpiresAt,
+			refreshTokenExpiresAt: token.refreshTokenExpiresAt,
+			client,
+			user,
+		};
+
+		return result;
+	}
+
+	async getRefreshToken(refreshToken: string): Promise<RefreshToken | Falsey> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in getRefreshToken (refreshToken: ${refreshToken})`);
+		}
+
+		// Keep compatibility with old collection
+		// Deprecated: Remove on next major within a migration
+		const token =
+			(await OAuthAccessTokens.findOneByRefreshToken(refreshToken)) || (await OAuthRefreshTokens.findOneByRefreshToken(refreshToken));
+
+		if (!token) {
+			throw new Error('Invalid token');
+		}
+
+		const client = await this.getClient(token.clientId);
+
+		if (!client) {
+			throw new Error('Invalid clientId');
+		}
+
+		const user = await Users.findOneActiveById(token.userId, { projection: { _id: 1 } });
+		if (!user) {
+			throw new Error('Invalid token');
+		}
+
+		const result: RefreshToken = {
+			// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+			refreshToken: token.refreshToken!,
+			// Keep compatibility with old collection
+			// Deprecated: Remove on next major within a migration
+			refreshTokenExpiresAt: 'refreshTokenExpiresAt' in token ? token.refreshTokenExpiresAt : token.expires,
+			client: {
+				id: client.id,
+				grants: client.grants,
+			},
+			user: {
+				id: token.userId,
+			},
+		};
+
+		return result;
+	}
+
+	async revokeToken(token: RefreshToken | Token): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in revokeToken (token: ${token.accessToken})`);
+		}
+
+		if (token.refreshToken) {
+			await OAuthAccessTokens.deleteOne({ refreshToken: token.refreshToken });
+			// Keep compatibility with old collection
+			// Deprecated: Remove on next major within a migration
+			await OAuthRefreshTokens.deleteOne({ refreshToken: token.refreshToken });
+		}
+
+		if (token.accessToken) {
+			await OAuthAccessTokens.deleteOne({ accessToken: token.accessToken });
+		}
+
+		return true;
+	}
+
+	async revokeAuthorizationCode(code: AuthorizationCode): Promise<boolean> {
+		if (this.debug === true) {
+			console.log('[OAuth2Server]', `in revokeAuthorizationCode (code: ${code.authorizationCode})`);
+		}
+		await OAuthAuthCodes.deleteOne({ authCode: code.authorizationCode });
+		return true;
+	}
+}