From c38817c62e8109f1d5837dcda4a07f1b73976c72 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Karol=20S=C3=B3jko?= Date: Mon, 23 Jan 2023 15:31:44 +0100 Subject: [PATCH] feat(auth): add configurable user verification requirement on u2f via env vars --- packages/auth/src/Bootstrap/Container.ts | 5 +++++ packages/auth/src/Bootstrap/Types.ts | 1 + .../VerifyAuthenticatorAuthenticationResponse.spec.ts | 1 + .../VerifyAuthenticatorAuthenticationResponse.ts | 2 ++ .../VerifyAuthenticatorRegistrationResponse.spec.ts | 1 + .../VerifyAuthenticatorRegistrationResponse.ts | 2 ++ 6 files changed, 12 insertions(+) diff --git a/packages/auth/src/Bootstrap/Container.ts b/packages/auth/src/Bootstrap/Container.ts index 7510a302c..8adba523e 100644 --- a/packages/auth/src/Bootstrap/Container.ts +++ b/packages/auth/src/Bootstrap/Container.ts @@ -465,6 +465,9 @@ export class ContainerConfigLoader { container .bind(TYPES.U2F_EXPECTED_ORIGIN) .toConstantValue(env.get('U2F_EXPECTED_ORIGIN', true) ?? 'https://app.standardnotes.com') + container + .bind(TYPES.U2F_REQUIRE_USER_VERIFICATION) + .toConstantValue(env.get('U2F_REQUIRE_USER_VERIFICATION', true) === 'true') // Services container.bind(TYPES.DeviceDetector).toConstantValue(new UAParser()) container.bind(TYPES.SessionService).to(SessionService) @@ -579,6 +582,7 @@ export class ContainerConfigLoader { container.get(TYPES.AuthenticatorChallengeRepository), container.get(TYPES.U2F_RELYING_PARTY_ID), container.get(TYPES.U2F_EXPECTED_ORIGIN), + container.get(TYPES.U2F_REQUIRE_USER_VERIFICATION), ), ) container @@ -597,6 +601,7 @@ export class ContainerConfigLoader { container.get(TYPES.AuthenticatorChallengeRepository), container.get(TYPES.U2F_RELYING_PARTY_ID), container.get(TYPES.U2F_EXPECTED_ORIGIN), + container.get(TYPES.U2F_REQUIRE_USER_VERIFICATION), ), ) container diff --git a/packages/auth/src/Bootstrap/Types.ts b/packages/auth/src/Bootstrap/Types.ts index ce26b53ba..9ac3ae91e 100644 --- a/packages/auth/src/Bootstrap/Types.ts +++ b/packages/auth/src/Bootstrap/Types.ts @@ -97,6 +97,7 @@ const TYPES = { U2F_RELYING_PARTY_ID: Symbol.for('U2F_RELYING_PARTY_ID'), U2F_RELYING_PARTY_NAME: Symbol.for('U2F_RELYING_PARTY_NAME'), U2F_EXPECTED_ORIGIN: Symbol.for('U2F_EXPECTED_ORIGIN'), + U2F_REQUIRE_USER_VERIFICATION: Symbol.for('U2F_REQUIRE_USER_VERIFICATION'), // use cases AuthenticateUser: Symbol.for('AuthenticateUser'), AuthenticateRequest: Symbol.for('AuthenticateRequest'), diff --git a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.spec.ts b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.spec.ts index 04d379f28..22ab83d5d 100644 --- a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.spec.ts +++ b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.spec.ts @@ -18,6 +18,7 @@ describe('VerifyAuthenticatorAuthenticationResponse', () => { authenticatorChallengeRepository, 'standardnotes.com', 'https://app.standardnotes.com', + true, ) beforeEach(() => { diff --git a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.ts b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.ts index 5f17624c1..c2d0b2685 100644 --- a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.ts +++ b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorAuthenticationResponse/VerifyAuthenticatorAuthenticationResponse.ts @@ -12,6 +12,7 @@ export class VerifyAuthenticatorAuthenticationResponse implements UseCaseInterfa private authenticatorChallengeRepository: AuthenticatorChallengeRepositoryInterface, private relyingPartyId: string, private expectedOrigin: string, + private requireUserVerification: boolean, ) {} async execute(dto: VerifyAuthenticatorAuthenticationResponseDTO): Promise> { @@ -43,6 +44,7 @@ export class VerifyAuthenticatorAuthenticationResponse implements UseCaseInterfa expectedChallenge: authenticatorChallenge.props.challenge.toString(), expectedOrigin: this.expectedOrigin, expectedRPID: this.relyingPartyId, + requireUserVerification: this.requireUserVerification, authenticator: { counter: authenticator.props.counter, credentialID: authenticator.props.credentialId, diff --git a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.spec.ts b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.spec.ts index b97df6b5d..017bd2c0e 100644 --- a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.spec.ts +++ b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.spec.ts @@ -18,6 +18,7 @@ describe('VerifyAuthenticatorRegistrationResponse', () => { authenticatorChallengeRepository, 'standardnotes.com', 'https://app.standardnotes.com', + true, ) beforeEach(() => { diff --git a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.ts b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.ts index f409c02cf..e39685cec 100644 --- a/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.ts +++ b/packages/auth/src/Domain/UseCase/VerifyAuthenticatorRegistrationResponse/VerifyAuthenticatorRegistrationResponse.ts @@ -12,6 +12,7 @@ export class VerifyAuthenticatorRegistrationResponse implements UseCaseInterface private authenticatorChallengeRepository: AuthenticatorChallengeRepositoryInterface, private relyingPartyId: string, private expectedOrigin: string, + private requireUserVerification: boolean, ) {} async execute(dto: VerifyAuthenticatorRegistrationResponseDTO): Promise> { @@ -38,6 +39,7 @@ export class VerifyAuthenticatorRegistrationResponse implements UseCaseInterface expectedChallenge: authenticatorChallenge.props.challenge.toString(), expectedOrigin: this.expectedOrigin, expectedRPID: this.relyingPartyId, + requireUserVerification: this.requireUserVerification, }) if (!verification.verified) {