fix(connect-ui): enforce session token integrations (#3032)

## Describe your changes Fixes https://linear.app/nango/issue/NAN-1945/enforce-allowed-integrations-in-each-auth-endpoint - Enforce session token's allowed integrations
NangoHQ · Nov 21, 2024 · 4941f74 · 4941f74
1 parent 1732178
commit 4941f74
Show file tree

Hide file tree

Showing 14 changed files with 160 additions and 13 deletions.
diff --git a/packages/server/lib/controllers/apiAuth.controller.ts b/packages/server/lib/controllers/apiAuth.controller.ts
@@ -23,6 +23,7 @@ import {
 import { linkConnection } from '../services/endUser.service.js';
 import db from '@nangohq/database';
 import { hmacCheck } from '../utils/hmac.js';
+import { isIntegrationAllowed } from '../utils/auth.js';
 import type { MessageRowInsert } from '@nangohq/types';
 
 class ApiAuthController {
@@ -89,6 +90,10 @@ class ApiAuthController {
                 return;
             }
 
+            if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+                return;
+            }
+
             await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
             if (!req.body.apiKey) {
@@ -265,6 +270,10 @@ class ApiAuthController {
                 return;
             }
 
+            if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+                return;
+            }
+
             const credentials: BasicApiCredentials = {
                 type: 'BASIC',
                 username,

diff --git a/packages/server/lib/controllers/appStoreAuth.controller.ts b/packages/server/lib/controllers/appStoreAuth.controller.ts
@@ -9,6 +9,7 @@ import { connectionCreated as connectionCreatedHook, connectionCreationFailed as
 import { linkConnection } from '../services/endUser.service.js';
 import db from '@nangohq/database';
 import { hmacCheck } from '../utils/hmac.js';
+import { isIntegrationAllowed } from '../utils/auth.js';
 
 class AppStoreAuthController {
     async auth(req: Request, res: Response<any, Required<RequestLocals>>, next: NextFunction) {
@@ -74,6 +75,10 @@ class AppStoreAuthController {
                 return;
             }
 
+            if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+                return;
+            }
+
             await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
             if (!req.body.privateKeyId) {

diff --git a/packages/server/lib/controllers/auth/postBill.ts b/packages/server/lib/controllers/auth/postBill.ts
@@ -21,6 +21,7 @@ import { connectionCreated as connectionCreatedHook, connectionCreationFailed as
 import { connectionCredential, connectionIdSchema, providerConfigKeySchema } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z
     .object({
@@ -121,6 +122,10 @@ export const postPublicBillAuthorization = asyncWrapper<PostPublicBillAuthorizat
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const { success, error, response: credentials } = await connectionService.getBillCredentials(provider, userName, password, organizationId, devkey);

diff --git a/packages/server/lib/controllers/auth/postJwt.ts b/packages/server/lib/controllers/auth/postJwt.ts
@@ -25,6 +25,7 @@ import {
 import { connectionCredential, connectionIdSchema, providerConfigKeySchema } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z
     .object({
@@ -130,6 +131,10 @@ export const postPublicJwtAuthorization = asyncWrapper<PostPublicJwtAuthorizatio
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const { success, error, response: credentials } = connectionService.getJwtCredentials(provider as ProviderJwt, privateKey, privateKeyId, issuerId);

diff --git a/packages/server/lib/controllers/auth/postSignature.ts b/packages/server/lib/controllers/auth/postSignature.ts
@@ -25,6 +25,7 @@ import {
 import { connectionCredential, connectionIdSchema, providerConfigKeySchema } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z
     .object({
@@ -124,6 +125,10 @@ export const postPublicSignatureAuthorization = asyncWrapper<PostPublicSignature
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const { success, error, response: credentials } = connectionService.getSignatureCredentials(provider as ProviderSignature, username, password);

diff --git a/packages/server/lib/controllers/auth/postTableau.ts b/packages/server/lib/controllers/auth/postTableau.ts
@@ -21,6 +21,7 @@ import { connectionCreated as connectionCreatedHook, connectionCreationFailed as
 import { connectionCredential, connectionIdSchema, providerConfigKeySchema } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z
     .object({
@@ -120,6 +121,10 @@ export const postPublicTableauAuthorization = asyncWrapper<PostPublicTableauAuth
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const {

diff --git a/packages/server/lib/controllers/auth/postTba.ts b/packages/server/lib/controllers/auth/postTba.ts
@@ -24,6 +24,7 @@ import {
 import { connectionCredential, connectionIdSchema, providerConfigKeySchema } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z
     .object({
@@ -130,6 +131,10 @@ export const postPublicTbaAuthorization = asyncWrapper<PostPublicTbaAuthorizatio
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const tbaCredentials: TbaCredentials = {

diff --git a/packages/server/lib/controllers/auth/postTwoStep.ts b/packages/server/lib/controllers/auth/postTwoStep.ts
@@ -21,6 +21,7 @@ import { connectionCreated as connectionCreatedHook, connectionCreationFailed as
 import { connectionIdSchema, providerConfigKeySchema, connectionCredential } from '../../helpers/validation.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const bodyValidation = z.object({}).catchall(z.any()).strict();
 
@@ -114,6 +115,10 @@ export const postPublicTwoStepAuthorization = asyncWrapper<PostPublicTwoStepAuth
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const {

diff --git a/packages/server/lib/controllers/auth/postUnauthenticated.integration.test.ts b/packages/server/lib/controllers/auth/postUnauthenticated.integration.test.ts
@@ -1,6 +1,6 @@
 import { seeders } from '@nangohq/shared';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
-import { isSuccess, runServer } from '../../utils/tests.js';
+import { isError, isSuccess, runServer } from '../../utils/tests.js';
 
 let api: Awaited<ReturnType<typeof runServer>>;
 
@@ -25,7 +25,7 @@ describe(`GET ${endpoint}`, () => {
             params: { providerConfigKey: config.unique_key }
         });
 
-        isSuccess(res);
+        isSuccess(res.json);
         expect(res.json).toStrictEqual<typeof res.json>({
             connectionId: 'a',
             providerConfigKey: 'unauthenticated'
@@ -43,10 +43,59 @@ describe(`GET ${endpoint}`, () => {
             params: { providerConfigKey: config.unique_key }
         });
 
-        isSuccess(res);
+        isSuccess(res.json);
         expect(res.json).toStrictEqual<typeof res.json>({
             connectionId: expect.any(String),
             providerConfigKey: 'unauthenticated'
         });
     });
+
+    it('should create one connection with sessionToken', async () => {
+        const env = await seeders.createEnvironmentSeed();
+        const config = await seeders.createConfigSeed(env, 'unauthenticated', 'unauthenticated');
+
+        const resSession = await api.fetch('/connect/sessions', {
+            method: 'POST',
+            token: env.secret_key,
+            body: { end_user: { id: '1', email: '[email protected]' } }
+        });
+        isSuccess(resSession.json);
+
+        const res = await api.fetch(endpoint, {
+            method: 'POST',
+            token: env.secret_key,
+            query: { connect_session_token: resSession.json.data.token },
+            params: { providerConfigKey: config.unique_key }
+        });
+
+        isSuccess(res.json);
+        expect(res.json).toStrictEqual<typeof res.json>({
+            connectionId: expect.any(String),
+            providerConfigKey: 'unauthenticated'
+        });
+    });
+
+    it('should not be allowed to create an integration if disallowed by sessionToken', async () => {
+        const env = await seeders.createEnvironmentSeed();
+        const config = await seeders.createConfigSeed(env, 'unauthenticated', 'unauthenticated');
+
+        const resSession = await api.fetch('/connect/sessions', {
+            method: 'POST',
+            token: env.secret_key,
+            body: { end_user: { id: '1', email: '[email protected]' }, allowed_integrations: ['not_this_one'] }
+        });
+        isSuccess(resSession.json);
+
+        const res = await api.fetch(endpoint, {
+            method: 'POST',
+            token: env.secret_key,
+            query: { connect_session_token: resSession.json.data.token },
+            params: { providerConfigKey: config.unique_key }
+        });
+
+        isError(res.json);
+        expect(res.json).toStrictEqual<typeof res.json>({
+            error: { code: 'integration_not_allowed' }
+        });
+    });
 });
diff --git a/packages/server/lib/controllers/auth/postUnauthenticated.ts b/packages/server/lib/controllers/auth/postUnauthenticated.ts
@@ -11,6 +11,7 @@ import { hmacCheck } from '../../utils/hmac.js';
 import { connectionCreated, connectionCreationFailed } from '../../hooks/hooks.js';
 import { linkConnection } from '../../services/endUser.service.js';
 import db from '@nangohq/database';
+import { isIntegrationAllowed } from '../../utils/auth.js';
 
 const queryStringValidation = z
     .object({
@@ -90,6 +91,10 @@ export const postPublicUnauthenticated = asyncWrapper<PostPublicUnauthenticatedA
             return;
         }
 
+        if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+            return;
+        }
+
         await logCtx.enrichOperation({ integrationId: config.id!, integrationName: config.unique_key, providerName: config.provider });
 
         const [updatedConnection] = await connectionService.upsertUnauthConnection({

diff --git a/packages/server/lib/controllers/oauth.controller.ts b/packages/server/lib/controllers/oauth.controller.ts
@@ -51,6 +51,7 @@ import { linkConnection } from '../services/endUser.service.js';
 import db from '@nangohq/database';
 import { getConnectSession } from '../services/connectSession.service.js';
 import { hmacCheck } from '../utils/hmac.js';
+import { isIntegrationAllowed } from '../utils/auth.js';
 
 class OAuthController {
     public async oauthRequest(req: Request, res: Response<any, Required<RequestLocals>>, _next: NextFunction) {
@@ -142,6 +143,10 @@ class OAuthController {
                 return publisher.notifyErr(res, wsClientId, providerConfigKey, connectionId, error);
             }
 
+            if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+                return;
+            }
+
             const session: OAuthSession = {
                 providerConfigKey: providerConfigKey,
                 provider: config.provider,
@@ -326,6 +331,10 @@ class OAuthController {
                 return;
             }
 
+            if (!(await isIntegrationAllowed({ config, res, logCtx }))) {
+                return;
+            }
+
             if (missesInterpolationParam(tokenUrl, connectionConfig)) {
                 const error = WSErrBuilder.InvalidConnectionConfig(tokenUrl, JSON.stringify(connectionConfig));
                 await logCtx.error(error.message, { connectionConfig });

diff --git a/packages/server/lib/utils/auth.ts b/packages/server/lib/utils/auth.ts
@@ -0,0 +1,29 @@
+import type { LogContext } from '@nangohq/logs';
+import type { ApiError, IntegrationConfig } from '@nangohq/types';
+
+import type { Response } from 'express';
+import type { RequestLocals } from './express';
+
+export async function isIntegrationAllowed({
+    config,
+    logCtx,
+    res
+}: {
+    config: IntegrationConfig;
+    logCtx: LogContext;
+    res: Response<ApiError<'integration_not_allowed'>, Required<RequestLocals>>;
+}): Promise<boolean> {
+    if (res.locals['authType'] !== 'connectSession') {
+        return true;
+    }
+
+    const session = res.locals['connectSession'];
+    if (!session.allowedIntegrations || session.allowedIntegrations.includes(config.unique_key)) {
+        return true;
+    }
+
+    await logCtx.error('Integration not allowed by this token', { integration: config.unique_key, allowed: session.allowedIntegrations });
+    await logCtx.failed();
+    res.status(400).send({ error: { code: 'integration_not_allowed' } });
+    return false;
+}
diff --git a/packages/server/lib/utils/tests.ts b/packages/server/lib/utils/tests.ts
@@ -3,7 +3,7 @@ import type { Server } from 'node:http';
 import { createServer } from 'node:http';
 import express from 'express';
 import { expect } from 'vitest';
-import type { APIEndpoints, APIEndpointsPicker, APIEndpointsPickerWithPath, ApiError } from '@nangohq/types';
+import type { APIEndpoints, APIEndpointsPicker, APIEndpointsPickerWithPath } from '@nangohq/types';
 import getPort from 'get-port';
 import { migrateLogsMapping } from '@nangohq/logs';
 import db, { multipleMigrations } from '@nangohq/database';
@@ -78,7 +78,9 @@ export function apiFetch(baseUrl: string) {
 /**
  * Assert API response is an error
  */
-export function isError(json: any): asserts json is ApiError<any> {
+export function isError<TType extends Record<string, any>>(
+    json: TType extends { json: any } ? never : TType
+): asserts json is Extract<TType extends { json: any } ? never : TType, { error: any }> {
     if (!('error' in json)) {
         console.log('isError', inspect(json, true, 100));
         throw new Error('Response is not an error');
@@ -88,7 +90,9 @@ export function isError(json: any): asserts json is ApiError<any> {
 /**
  * Assert API response is a success
  */
-export function isSuccess<TType extends Record<string, any>>(json: TType): asserts json is Exclude<TType, { error: any }> {
+export function isSuccess<TType extends Record<string, any>>(
+    json: TType extends { json: any } ? never : TType
+): asserts json is Exclude<TType extends { json: any } ? never : TType, { error: any }> {
     if (json && 'error' in json) {
         console.log('isSuccess', inspect(json, true, 100));
         throw new Error('Response is not a success');