Add LDAP login provider, provider-linked account lifecycle, and a shared provider-customizable login form

.github/workflows/playwright-tests.yml

@@ -92,6 +92,14 @@ jobs:
           AUTH_PROVIDERS: local
           PLAYWRIGHT_TEST_UNIT_ONLY: "true"
 
+      # Every plugin's tests tagged @unit, wherever the plugin lives
+      - name: Run Plugin Unit Tests
+        run: npm run test:plugins:unit -- --project=chromium
+        env:
+          SITE_ACCESS: ${{ matrix.site_access }}
+          AUTH_PROVIDERS: local
+          PLAYWRIGHT_TEST_UNIT_ONLY: "true"
+
       - name: Run E2E API Tests
         run: npx playwright test tests/e2e/api tests/e2e/security tests/e2e/startup --project=chromium
         env:
@@ -116,7 +124,10 @@ jobs:
         if: matrix.site_access == 'required' && github.event_name == 'pull_request'
         run: |
           git fetch --no-tags --depth=200 origin ${{ github.base_ref }}
-          bash tests/migration/run-legacy-compat.sh origin/${{ github.base_ref }}
+          # Seed with the last release before the auth refactor (the commit before scripts/auth-migrate.js was added)
+          added=$(git log --diff-filter=A --format=%H -1 origin/${{ github.base_ref }} -- scripts/auth-migrate.js)
+          if [ -n "$added" ]; then legacy="$added^"; else legacy=origin/${{ github.base_ref }}; fi
+          bash tests/migration/run-legacy-compat.sh "$legacy"
 
       - name: Upload test results
         if: always()
@@ -136,12 +147,29 @@ jobs:
 
   # The proxy login provider (the replacement for AUTH=csso), with the headers a
   # reverse proxy would add, under legacy network trust and the default secret trust.
-  proxy:
+  plugin-ci-list:
+    # Plugins whose tests need an outside service or settings declare "ci" in plugin.json (scripts/plugin-ci.js)
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.list.outputs.matrix }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: List plugin CI runs
+        id: list
+        run: echo "matrix=$(node scripts/plugin-ci.js list)" >> "$GITHUB_OUTPUT"
+
+  plugin-ci:
+    needs: plugin-ci-list
+    if: needs.plugin-ci-list.outputs.matrix != '[]'
+    name: plugin (${{ matrix.name }})
     timeout-minutes: 20
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        proxy_trust: [network, secret]
+        include: ${{ fromJSON(needs.plugin-ci-list.outputs.matrix) }}
 
     services:
       postgres:
@@ -180,7 +208,6 @@ jobs:
       - name: Setup test environment
         run: | # pragma: allowlist secret
           cp sample.env .env || touch .env
-          sed -i "/^SITE_ACCESS=/d;/^AUTH_PROVIDERS=/d;/^PROXY_/d" .env
           echo "NODE_ENV=test" >> .env
           echo "PORT=18888" >> .env
           echo "DB_HOST=localhost" >> .env
@@ -195,20 +222,16 @@ jobs:
           echo "HIDE_CONFIG=false" >> .env
           echo "SECRET=ci-test-session-secret-not-for-production" >> .env
 
-      - name: Run E2E Proxy Provider Tests
-        run: npx --no-install playwright test tests/e2e/proxy --project=chromium
+      - name: Run plugin tests
+        run: node scripts/plugin-ci.js run "$PLUGIN_DIR" "$PLUGIN_VARIANT" -- --project=chromium
         env:
-          SITE_ACCESS: required
-          AUTH_PROVIDERS: '["proxy","local"]'
-          PROXY_TRUST: ${{ matrix.proxy_trust }}
-          PROXY_SECRET: ${{ matrix.proxy_trust == 'secret' && 'ci-test-proxy-secret-not-for-production' || '' }} # pragma: allowlist secret
-          PROXY_GROUPS: '["mmgis-users"]'
-          PROXY_LEAD_GROUP: mmgis-leads
+          PLUGIN_DIR: ${{ matrix.dir }}
+          PLUGIN_VARIANT: ${{ matrix.variant }}
 
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: playwright-report-proxy-${{ matrix.proxy_trust }}
+          name: playwright-report-${{ matrix.slug }}
           path: playwright-report/
           retention-days: 30

.knowledge/AI-GETTING-STARTED.md

@@ -55,6 +55,7 @@ npm start
 | `npm run build`       | Build the main app for production                                                     |
 | `npm test`            | Run Playwright tests (`playwright test`)                                              |
 | `npm run test:unit`   | Run unit tests only                                                                   |
+| `npm run test:plugins:unit` | Run plugins' `@unit` tests                                                      |
 | `npm run test:e2e`    | Run E2E tests only                                                                    |
 | `npm run test:headed` | Run Playwright tests in headed mode                                                   |
 | `npm run test:debug`  | Run Playwright tests in debug mode                                                    |

API/connections/routes.js

@@ -3,6 +3,7 @@ const crypto = require("crypto");
 const express = require("express");
 const { rateLimit } = require("express-rate-limit");
 const logger = require("../logger");
+const { getAllowedOrigins, getRequestHost, isOriginAllowed } = require("../origin");
 const { DOCS_URL, STATE_TTL_MS, MAX_PENDING_STATES, withTimeout, ConnectionRequiredError, envSecrets, scrubbed } = require("./common");
 const { connectionMap, allConnections, getConnection, setupStatus } = require("./registry");
 const { principalOf, storageFor, grantRecord, ownerKey, readStored, writeStored, removeStored, serialized, adoptSessionConnections, revokeQuietly } = require("./storage");
@@ -132,11 +133,14 @@ function renderResult(res, view) {
   });
 }
 
+// Refuses only requests a browser marks as from another site: curl and scripts send no Origin and pass
 function sameOriginOnly(req, res, next) {
   const site = req.get("sec-fetch-site");
   const origin = req.get("origin");
   // The browser sets Sec-Fetch-Site itself; a proxy that rewrites Host would otherwise refuse it
   if (site === "same-origin") return next();
+  // Origins the site trusts with credentialed requests (CORS_ORIGINS) may post from their own pages
+  if (origin && getAllowedOrigins().length && isOriginAllowed(origin, getRequestHost(req))) return next();
   let foreign = site === "cross-site" || site === "same-site";
   if (!foreign && origin) {
     try {

API/logger.js

@@ -38,6 +38,8 @@ const SECRET_LOG_KEYS = new Set([
   "setup_code",
   "token",
   "retypepassword",
+  "resettoken",
+  "reset_token",
   "access_token",
   "accesstoken",
   "refresh_token",
@@ -59,8 +61,8 @@ function redactSecrets(key, value) {
 function redactCredentials(str) {
   if (typeof str !== "string") return str;
   return str
-    .replace(/\b(access_token|refresh_token|id_token|client_secret|code_verifier|code|password|token|api_?key)=[^\s&"',;]+/gi, "$1=_redacted_")
-    .replace(/(["']?\b(?:access_token|refresh_token|id_token|client_secret|code_verifier|password|api_?key)["']?\s*:\s*["']?)[^\s"',}]+/gi, "$1_redacted_")
+    .replace(/\b(access_token|refresh_token|id_token|client_secret|code_verifier|code|password|reset_?token|token|api_?key)=[^\s&"',;]+/gi, "$1=_redacted_")
+    .replace(/(["']?\b(?:access_token|refresh_token|id_token|client_secret|code_verifier|password|reset_?token|api_?key)["']?\s*:\s*["']?)[^\s"',}]+/gi, "$1_redacted_")
     .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/g, "$1 _redacted_");
 }
 

API/permissions/models.js

@@ -101,6 +101,11 @@ const AuthIdentity = sequelize.define(
     provider: { type: Sequelize.STRING, allowNull: false },
     // The provider's stable user id (e.g. the OIDC "sub" claim)
     subject: { type: Sequelize.STRING, allowNull: false },
+    // The provider's username at the last login, which may differ from the MMGIS username after a rename
+    username: { type: Sequelize.STRING, allowNull: true },
+    last_login_at: { type: Sequelize.DATE, allowNull: true },
+    // The provider's subject setting when linked (e.g. LDAP_SUBJECT_ATTRIBUTE), so a later change is noticed
+    subject_setting: { type: Sequelize.STRING, allowNull: true },
     user_id: {
       type: Sequelize.INTEGER,
       allowNull: false,
@@ -158,6 +163,11 @@ const up = async () => {
     `CREATE UNIQUE INDEX IF NOT EXISTS long_term_tokens_token_hash ON long_term_tokens (token_hash);`,
     "index long_term_tokens.token_hash"
   );
+  for (const col of ["username varchar(255) NULL", "last_login_at TIMESTAMPTZ NULL", "subject_setting varchar(255) NULL"])
+    await runQuery(
+      `ALTER TABLE IF EXISTS auth_identities ADD COLUMN IF NOT EXISTS ${col};`,
+      `add auth_identities.${col.split(" ")[0]} column`
+    );
   // Owning mission for data resources (null = global, SuperAdmin/Data Admin managed)
   await runQuery(
     `ALTER TABLE IF EXISTS geodatasets ADD COLUMN IF NOT EXISTS owner_mission_uuid UUID NULL;`,

API/permissions/principal.js

@@ -78,7 +78,7 @@ async function cached(key, build) {
 
 async function userPrincipal(userId) {
   return cached(`user:${userId}`, async () => {
-    const { User, AuthGroupMember } = models();
+    const { User, AuthGroup, AuthGroupMember } = models();
     const user = await User.findOne({
       where: { id: userId },
       attributes: ["id", "username"],
@@ -90,7 +90,19 @@ async function userPrincipal(userId) {
       attributes: ["group_id"],
       raw: true,
     });
-    const groupIds = memberships.map((m) => m.group_id);
+    // Groups whose members come from a provider that isn't in AUTH_PROVIDERS grant nothing until it's back
+    const groupIds =
+      memberships.length > 0
+        ? (
+            await AuthGroup.findAll({
+              where: { id: memberships.map((m) => m.group_id) },
+              attributes: ["id", "source"],
+              raw: true,
+            })
+          )
+            .filter((g) => g.source === "local" || siteAccess.hasProvider(g.source))
+            .map((g) => g.id)
+        : [];
     const subjects = [
       ["user", user.id],
       ["audience", "authenticated"],
@@ -211,24 +223,36 @@ function localAccountAllowed(p) {
   return !siteAccess.localAdminsOnly() || require("./policy").isAdministrator(p);
 }
 
-// Accounts created by a login provider follow that provider; the rest are local accounts
-async function accountAllowed(p) {
-  const links = await models().AuthIdentity.findAll({
-    where: { user_id: p.userId },
-    attributes: ["provider"],
-    raw: true,
-  });
-  if (links.length === 0) return localAccountAllowed(p);
-  return links.some((l) => siteAccess.hasProvider(l.provider));
+// Accounts linked to an enabled login provider follow that provider. An account whose links are all
+// to providers removed from AUTH_PROVIDERS counts as a local account only for a local session (it
+// got one with an MMGIS password, e.g. from a reset link); its tokens stay off until a provider is back
+const providerLinks = (userId) =>
+  models().AuthIdentity.findAll({ where: { user_id: userId }, attributes: ["provider"], raw: true });
+
+async function accountAllowed(p, localSession = false) {
+  const links = await providerLinks(p.userId);
+  const enabled = links.filter((l) => siteAccess.hasProvider(l.provider));
+  if (links.length === 0 || (enabled.length === 0 && localSession)) return localAccountAllowed(p);
+  for (const l of enabled) if (await require("./providers").stillLinked(p.userId, l.provider)) return true;
+  return false;
+}
+
+// The providers of an account that are all out of AUTH_PROVIDERS, so its tokens can't work for now; else []
+async function tokensOffFor(userId) {
+  const links = await providerLinks(userId);
+  return links.some((l) => siteAccess.hasProvider(l.provider)) ? [] : [...new Set(links.map((l) => l.provider))];
 }
 
 async function tokenPrincipal(authorization) {
   const raw = String(authorization).replace(/^Bearer:?\s+/i, "").trim();
   if (!raw) return null;
   const row = await findToken(raw);
   if (!row || row.created_by_user_id == null || tokenExpired(row)) return null;
+  const owner = await userPrincipal(row.created_by_user_id);
+  if (!owner || !(await accountAllowed(owner))) return null;
+  // Read again: the provider recheck in accountAllowed may have changed the owner's groups
   const creator = await userPrincipal(row.created_by_user_id);
-  if (!creator || !(await accountAllowed(creator))) return null;
+  if (!creator) return null;
   const { LongTermTokens } = models();
   if (
     !row.last_used_at ||
@@ -264,10 +288,17 @@ async function resolvePrincipal(req) {
   }
   const session = req.session || {};
   if (session.uid != null) {
-    const p = await userPrincipal(session.uid);
-    // Sessions started through a login provider follow that provider; the rest are local logins
-    const allowed =
-      p && (session.provider ? siteAccess.hasProvider(session.provider) : localAccountAllowed(p));
+    // Sessions started through a login provider follow that provider
+    const linked =
+      !session.provider ||
+      (siteAccess.hasProvider(session.provider) &&
+        (await require("./providers").stillLinked(session.uid, session.provider)));
+    let p = linked ? await userPrincipal(session.uid) : null;
+    // A local session of an account that has since been linked to an enabled provider (or whose
+    // provider came back) follows that provider's rechecks, like the account's tokens
+    const allowed = p && (session.provider ? true : await accountAllowed(p, true));
+    // Read again: that recheck may have changed the account's groups
+    if (allowed && !session.provider) p = (await userPrincipal(session.uid)) || p;
     if (allowed) {
       // Signed in locally while the proxy also identifies the request: like AUTH=csso, the
       // proxy user stays the identity and the local account's access is added on top
@@ -329,5 +360,6 @@ module.exports = {
   tokenExpired,
   unusableLegacyToken,
   scrubLegacyTokenColumn,
+  tokensOffFor,
   siteAccess,
 };