feat(authentication): resolve default authentication strategy

[derdeka]

Suggestion

Provide a lookup for a strategy name, if metadata is not provided by decorator.

Use Cases

Instead of annotating each controller or controller method, we would like to specify a default strategy name to make the application secure by default. In our user experiences, developers sometimes forget the @authenticate decorator, which makes the endpoint accidently public available.

Examples

Here is an example how we currently redefine the AuthenticationStrategyProvider:

import { AuthenticationBindings, AuthenticationMetadata, AuthenticationStrategy, AUTHENTICATION_STRATEGY_NOT_FOUND } from '@loopback/authentication';
import { BindingScope, Getter, inject } from '@loopback/context';
import { extensionPoint, extensions, Provider } from '@loopback/core';
import { RestBindings, Request } from '@loopback/rest';

/**
 * An authentication strategy provider responsible for
 * resolving an authentication strategy by name.
 *
 * It declares an extension point to which all authentication strategy
 * implementations must register themselves as extensions.
 */
@extensionPoint(
  AuthenticationBindings.AUTHENTICATION_STRATEGY_EXTENSION_POINT_NAME,
  { scope: BindingScope.TRANSIENT },
) //this needs to be transient, e.g. for request level context.
export class AuthenticationStrategyProvider implements Provider<AuthenticationStrategy | undefined> {

  noAuthUrlPattern: RegExp[] = [
    /^\/explorer/,
    /^\/openapi.json$/,
    /^\/favicon.ico$/,
  ];

  constructor(
    @extensions() private authenticationStrategies: Getter<AuthenticationStrategy[]>,
    @inject(RestBindings.Http.REQUEST) private request: Request,
    @inject(AuthenticationBindings.METADATA) private metadata?: AuthenticationMetadata,
  ) { }

  async value(): Promise<AuthenticationStrategy | undefined> {
    const { strategy: name = 'jwt' } = this.metadata || {};

    // workaround to whitelist api explorer
    if (this.noAuthUrlPattern.some(regexp => regexp.test(this.request.url))) {
      // allow unauthenticated access
      return undefined;
    }

    const strategy = await this.findAuthenticationStrategy(name);
    if (!strategy) {
      // important to throw a non-protocol-specific error here
      const error = new Error(`The strategy '${name}' is not available.`);
      Object.assign(error, {
        code: AUTHENTICATION_STRATEGY_NOT_FOUND,
      });
      throw error;
    }
    return strategy;
  }

  async findAuthenticationStrategy(name: string): Promise<AuthenticationStrategy | undefined> {
    const strategies = await this.authenticationStrategies();
    const matchingAuthStrategy = strategies.find(a => a.name === name);
    return matchingAuthStrategy;
  }
}

modified version of https://github.com/strongloop/loopback-next/blob/c944654881140119e44fe9e1db85a0f26e59d658/packages/authentication/src/providers/auth-strategy.provider.ts#L36-L41

Acceptance criteria

TBD - will be filled by the team.

[derdeka]

As an alternative to replacing the AuthenticationStrategyProvider it might be an option to replace the AuthenticationMetadataProvider. Is this the intended way of the @loopback/authentication design to resolve a default strategy?

import { AuthenticationMetadata, getAuthenticateMetadata } from '@loopback/authentication';
import { Constructor, inject, Provider } from '@loopback/context';
import { CoreBindings } from '@loopback/core';
import { RestBindings, Request } from '@loopback/rest';

const DEFAULT_METADATA = {
  strategy: 'jwt',
}

export class AuthenticationMetadataProvider implements Provider<AuthenticationMetadata | undefined> {

  noAuthUrlPattern: RegExp[] = [
    /^\/api/, // lb3app endpoints
    /^\/explorer/,
    /^\/openapi.json$/,
    /^\/favicon.ico$/,
  ];

  constructor(
    @inject(RestBindings.Http.REQUEST) private request: Request,
    @inject(CoreBindings.CONTROLLER_CLASS, { optional: true }) private readonly controllerClass: Constructor<{}>,
    @inject(CoreBindings.CONTROLLER_METHOD_NAME, { optional: true }) private readonly methodName: string,
  ) { }

  /**
   * @returns AuthenticationMetadata
   */
  value(): AuthenticationMetadata | undefined {
    // allow unauthenticated access for whitelisted urls
    if (this.noAuthUrlPattern.some(regexp => regexp.test(this.request.url))) return undefined;
    // use default strategy if controller info is not provided
    if (!this.controllerClass || !this.methodName) return DEFAULT_METADATA;
    // get metadata from decorators
    const metadata = getAuthenticateMetadata(this.controllerClass, this.methodName);
    // if we do not have a decorator, use the default strategy
    if (!metadata) return DEFAULT_METADATA;
    // if method is annotated with @authenticate('none') allow unauthenticated access
    if (metadata.strategy === 'none') return undefined;
    // if we found other metadata, return for use in AuthenticationStrategyProvider
    return metadata;
  }
}

[dhmlau]

@emonddr @jannyHou, could you please take a look? Thanks.

[jannyHou]

Thank you for @raymondfeng 's feature PR that supports the authentication component level default strategy and also class level @authenticate() in #3762

@derdeka Does the new feature meet your requirements in this story? Anything else you want to add?

[derdeka]

Thanks, works for me.