diff --git a/.changeset/eighty-phones-drum.md b/.changeset/eighty-phones-drum.md new file mode 100644 index 00000000000..d473dc805d5 --- /dev/null +++ b/.changeset/eighty-phones-drum.md @@ -0,0 +1,7 @@ +--- +'@keystonejs/app-admin-ui': patch +'@keystonejs/auth-passport': patch +'@keystonejs/keystone': patch +--- + +Removed the undocumented `audiences` feature. diff --git a/.changeset/lovely-beds-carry.md b/.changeset/lovely-beds-carry.md new file mode 100644 index 00000000000..1b70f8cb637 --- /dev/null +++ b/.changeset/lovely-beds-carry.md @@ -0,0 +1,6 @@ +--- +'@keystonejs/session': major +'@keystonejs/app-graphql': patch +--- + +Removed the undocumented `restrictAudienceMiddleware` function. diff --git a/packages/app-admin-ui/index.js b/packages/app-admin-ui/index.js index 9763e9bce4e..79d8e7ccf4c 100644 --- a/packages/app-admin-ui/index.js +++ b/packages/app-admin-ui/index.js @@ -66,9 +66,7 @@ class AdminUIApp { return ( req.user && - this._isAccessAllowed({ authentication: { item: req.user, listKey: req.authedListKey } }) && - req.session.audiences && - req.session.audiences.includes('admin') + this._isAccessAllowed({ authentication: { item: req.user, listKey: req.authedListKey } }) ); } @@ -80,8 +78,6 @@ class AdminUIApp { // Short-circuit GET requests when the user already signed in (avoids // downloading UI bundle, doing a client side redirect, etc) app.get(signinPath, (req, res, next) => - // This session is currently authenticated as part of the 'admin' - // audience. this.isAccessAllowed(req) ? res.redirect(this.adminPath) : next() ); diff --git a/packages/app-graphql/index.js b/packages/app-graphql/index.js index 02c90a37390..b6b73a28b11 100644 --- a/packages/app-graphql/index.js +++ b/packages/app-graphql/index.js @@ -1,5 +1,4 @@ const express = require('express'); -const { restrictAudienceMiddleware } = require('@keystonejs/session'); const { GraphQLPlaygroundApp } = require('@keystonejs/app-graphql-playground'); const { createApolloServer } = require('./lib/apolloServer'); const validation = require('./validation'); @@ -22,10 +21,6 @@ class GraphQLApp { */ prepareMiddleware({ keystone, dev }) { const server = createApolloServer(keystone, this._apollo, this._schemaName, dev); - // GraphQL API always exists independent of any adminUI or Session - // settings We currently make the admin UI public. In the future we want - // to be able to restrict this to a limited audience, while setting up a - // separate public API with much stricter access control. const apiPath = this._apiPath; const graphiqlPath = this._graphiqlPath; const app = express(); @@ -40,9 +35,6 @@ class GraphQLApp { // { cors: false } - prevent ApolloServer from overriding Keystone's CORS configuration. // https://www.apollographql.com/docs/apollo-server/api/apollo-server.html#ApolloServer-applyMiddleware - // This probably isn't the right place to put this restriction middleware. -TL - const restrict = restrictAudienceMiddleware({ isPublic: true }); - app.use(apiPath, restrict); app.use(server.getMiddleware({ path: apiPath, cors: false })); return app; } diff --git a/packages/auth-passport/lib/Passport.js b/packages/auth-passport/lib/Passport.js index 2baab82c1cd..6c547de269e 100644 --- a/packages/auth-passport/lib/Passport.js +++ b/packages/auth-passport/lib/Passport.js @@ -506,12 +506,9 @@ class PassportAuthStrategy { } async _authenticateItem(item, accessToken, isNewItem, req, res, next) { - const audiences = ['admin']; - const token = await startAuthedSession( req, { item, list: this._getList() }, - audiences, this._cookieSecret ); this._onAuthenticated({ token, item, isNewItem }, req, res, next); diff --git a/packages/keystone/lib/Keystone/index.js b/packages/keystone/lib/Keystone/index.js index 1771b324d53..0a362b2f64f 100644 --- a/packages/keystone/lib/Keystone/index.js +++ b/packages/keystone/lib/Keystone/index.js @@ -222,8 +222,8 @@ module.exports = class Keystone { return { schemaName, - startAuthedSession: ({ item, list }, audiences) => - startAuthedSession(req, { item, list }, audiences, this._cookieSecret), + startAuthedSession: ({ item, list }) => + startAuthedSession(req, { item, list }, this._cookieSecret), endAuthedSession: endAuthedSession.bind(null, req), authedItem: req.user, authedListKey: req.authedListKey, diff --git a/packages/keystone/lib/providers/listAuth.js b/packages/keystone/lib/providers/listAuth.js index 3bc568c7aa0..403c6d71fe6 100644 --- a/packages/keystone/lib/providers/listAuth.js +++ b/packages/keystone/lib/providers/listAuth.js @@ -109,18 +109,13 @@ class ListAuthProvider { const gqlName = this.gqlNames.authenticateMutationName; this.checkAccess(context, 'mutation', { gqlName }); - // This is currently hard coded to enable authenticating with the admin UI. - // In the near future we will set up the admin-ui application and api to be - // non-public. - const audiences = ['admin']; - // Verify incoming details const { item, success, message } = await this.authStrategy.validate(args); if (!success) { throw new Error(message); } - const token = await context.startAuthedSession({ item, list: this.list }, audiences); + const token = await context.startAuthedSession({ item, list: this.list }); return { token, item }; } diff --git a/packages/session/index.js b/packages/session/index.js index e780105e6bd..0862405ab82 100644 --- a/packages/session/index.js +++ b/packages/session/index.js @@ -1,13 +1,3 @@ -const { - commonSessionMiddleware, - restrictAudienceMiddleware, - startAuthedSession, - endAuthedSession, -} = require('./lib/session'); +const { commonSessionMiddleware, startAuthedSession, endAuthedSession } = require('./lib/session'); -module.exports = { - commonSessionMiddleware, - restrictAudienceMiddleware, - startAuthedSession, - endAuthedSession, -}; +module.exports = { commonSessionMiddleware, startAuthedSession, endAuthedSession }; diff --git a/packages/session/lib/session.js b/packages/session/lib/session.js index 7dde9b03759..f937811d05c 100644 --- a/packages/session/lib/session.js +++ b/packages/session/lib/session.js @@ -90,39 +90,17 @@ function populateAuthedItemMiddleware(keystone) { } req.user = item; req.authedListKey = list.key; - req.audiences = req.session.audiences; next(); }; } -function restrictAudienceMiddleware({ isPublic, audiences }) { - return (req, res, next) => { - if (isPublic) { - // If the session restriction is marked public, we let everything through. - next(); - } else if ( - req.audiences && - audiences && - Array.isArray(audiences) && - req.audiences.some(audience => audiences.includes(audience)) - ) { - // Otherwise, if one of the session audiences matches one of the restriction audiences, we let them through. - next(); - } else { - // If the don't make it through, we simply respond with a 403 Permission Denied - res.status(403).send(); - } - }; -} - -function startAuthedSession(req, { item, list }, audiences, cookieSecret) { +function startAuthedSession(req, { item, list }, cookieSecret) { return new Promise((resolve, reject) => req.session.regenerate(err => { if (err) return reject(err); req.session.keystoneListKey = list.key; req.session.keystoneItemId = item.id; - req.session.audiences = audiences; resolve(cookieSignature.sign(req.session.id, cookieSecret)); }) ); @@ -137,9 +115,4 @@ function endAuthedSession(req) { ); } -module.exports = { - commonSessionMiddleware, - restrictAudienceMiddleware, - startAuthedSession, - endAuthedSession, -}; +module.exports = { commonSessionMiddleware, startAuthedSession, endAuthedSession };