Auth rework #953
Open
Auth rework #953
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Yadhap/user roles
* Remove existing manual login/logout code for fresh start * save progress * introduce new login introduce login/register, basic layout component. Able to be accessed by /login and /register respectively. Will need to rework login and load order and such later * Max characters applied * update look and feel * Further css adjustments * give new-password so autocomplete doesn't happen * added autoComplete off in login page aswell --------- Co-authored-by: yadhap Dahal <yadhap.dahal@lexisnexisrisk.com>
…tiy functions. Modified RoleTypes, UserRoles model, added migration file and model for refresh_token
…ue for registrationStatus
…ch as read, update, delete
Added registration and login routes, middlewares, controlles and util…
* Remove existing manual login/logout code for fresh start * save progress * introduce new login introduce login/register, basic layout component. Able to be accessed by /login and /register respectively. Will need to rework login and load order and such later * Max characters applied * update look and feel * Further css adjustments * give new-password so autocomplete doesn't happen * added autoComplete off in login page aswell * add forgot password, password complexity validator, reset password --------- Co-authored-by: yadhap Dahal <yadhap.dahal@lexisnexisrisk.com>
Yadhap/user related actions
* Remove existing manual login/logout code for fresh start * save progress * introduce new login introduce login/register, basic layout component. Able to be accessed by /login and /register respectively. Will need to rework login and load order and such later * Max characters applied * update look and feel * Further css adjustments * give new-password so autocomplete doesn't happen * added autoComplete off in login page aswell * add forgot password, password complexity validator, reset password * remove i18n and language switcher * adjust footer * add comment * home css and structure adjustments * rename css class --------- Co-authored-by: yadhap Dahal <yadhap.dahal@lexisnexisrisk.com>
…ock data with a dedicated test database for more accurate unit tests. Implemented end-to-end route tests for authentication and user routes.
Refactored testing environment to mirror production setup.
* create my account page * Adjust look and feel Change password replaces logout in top left, one form for displaying and editing information.
* create my account page * Initial Framework Still need to add Modals and functionality, but waiting on wiring basic flow first so we can have real data to test with. * save
additional auth routes and session mgmt routes
…password and new password, added utility function that makes call to the server to update the password, added the new component to the browser router
… and adhere to the DRY principle
…function to use the new getAUser utility function
…ing password could be used
…registration-flow Yadhap/add verification to registration flow
…reated-users Merged authReworkBranch
…ner-admin-created-users Yadhap/password rest for owner admin created users
…not throw error if these items are undefined
Merged with authRework
* bug fixes for application creation/deletion/switching for left nav and application screens * remove console logs * remove unused functions from application screen * Save Progress * fixes * Update Backend.js * Fix Header for stability * save progress * Update to control reader disabled * Update to allow user to logout no matter what * Allow user to update their own account and create allowed resource list
…gistered-user Yadhap/verify email self registered user
* bug fixes for application creation/deletion/switching for left nav and application screens * remove console logs * remove unused functions from application screen * Save Progress * fixes * Update Backend.js * Fix Header for stability * save progress * Update to control reader disabled * Update to allow user to logout no matter what * Allow user to update their own account and create allowed resource list * Handle login invalid values * 403 fallback page * save * fix spelling error * fix spelling * Patch to not show owner/admin no route access and also fix authController to return user roles and applications on verify email login * Add more conditionals
* Model and Migration * Routes, Controllers, Middleware for instance settings
* bug fixes for application creation/deletion/switching for left nav and application screens * remove console logs * remove unused functions from application screen * Save Progress * fixes * Update Backend.js * Fix Header for stability * save progress * Update to control reader disabled * Update to allow user to logout no matter what * Allow user to update their own account and create allowed resource list * Handle login invalid values * 403 fallback page * save * save * Model and Migration * Routes, Controllers, Middleware for instance settings * save * save progresss * save * finish * Update error message * Changed Steps on Start up Wizard to horizontal --------- Co-authored-by: yadhap Dahal <yadhap.dahal@lexisnexisrisk.com>
* bug fixes for application creation/deletion/switching for left nav and application screens * remove console logs * remove unused functions from application screen * Save Progress * fixes * Update Backend.js * Fix Header for stability * save progress * Update to control reader disabled * Update to allow user to logout no matter what * Allow user to update their own account and create allowed resource list * Handle login invalid values * 403 fallback page * save * save * Model and Migration * Routes, Controllers, Middleware for instance settings * save * save progresss * save * finish * request access route * Only Owners or Admins should see tours * Finish notification * remove extra /
…es in front end so the front end gets right kind of code from Azure before sending to backend
Added login/register with azure option in the back end and made chang…
* Oauth2 front end * wire front and backend azure login * Show/hide traditional * small bug fix to prevent multiple logins from being fired * Fixed login loop that occured when MS login failed. Also fixed issue where the roles and applications for newly created azure user was coming back undefined --------- Co-authored-by: yadhap Dahal <yadhap.dahal@lexisnexisrisk.com>
* Remove unused packages * Bug Fixes for left nav, constraints, and consumers
* Remove unused packages * Bug Fixes for left nav, constraints, and consumers * updates * Users Page and various docs updates * adjustments
* Fix user registration to not show success unless error message is shown and remove duplicate create basic user route * Set width of all components to 40rem for login for consistency * hide change password method for microsoft accounts
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| //add application to user object in local storage so user has immediate access to it | ||
| const { user_app_id, id, title, description } = responseData; | ||
| user.applications.push({ id: user_app_id, application: { id, title, description } }); | ||
| await localStorage.setItem('user', JSON.stringify(user)); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
| //remove it from users applications | ||
| const user = JSON.parse(localStorage.getItem('user')); | ||
| user.applications = user.applications.filter((app) => app.application.id !== app_id); | ||
| localStorage.setItem('user', JSON.stringify(user)); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 14 hours ago
To fix the problem, we need to ensure that any sensitive information stored in local storage is encrypted. We can use the crypto-js library to encrypt and decrypt the data. The encryption key should be securely managed and not hardcoded in the code.
- Install the
crypto-jslibrary. - Import the necessary functions from
crypto-js. - Encrypt the
userobject before storing it in local storage. - Decrypt the
userobject when retrieving it from local storage.
Suggested changeset
3
Tombolo/client-reactjs/src/components/admin/apps/Applications.js
| @@ -9,3 +9,3 @@ | ||
| import AddApplication from './AddApplication'; | ||
|
|
||
| import CryptoJS from 'crypto-js'; | ||
| import Text from '../../common/Text'; | ||
| @@ -74,5 +74,5 @@ | ||
| //remove it from users applications | ||
| const user = JSON.parse(localStorage.getItem('user')); | ||
| const user = JSON.parse(CryptoJS.AES.decrypt(localStorage.getItem('user'), 'encryption_key').toString(CryptoJS.enc.Utf8)); | ||
| user.applications = user.applications.filter((app) => app.application.id !== app_id); | ||
| localStorage.setItem('user', JSON.stringify(user)); | ||
| localStorage.setItem('user', CryptoJS.AES.encrypt(JSON.stringify(user), 'encryption_key').toString()); | ||
|
|
Tombolo/client-reactjs/src/components/login/ResetTempPw.jsx
Outside changed files
| @@ -4,3 +4,3 @@ | ||
| import passwordComplexityValidator from '../common/passwordComplexityValidator'; | ||
|
|
||
| import CryptoJS from 'crypto-js'; | ||
| function ResetTempPassword() { | ||
| @@ -38,3 +38,3 @@ | ||
| // Save user token to local storage | ||
| localStorage.setItem('user', JSON.stringify(result.data)); | ||
| localStorage.setItem('user', CryptoJS.AES.encrypt(JSON.stringify(result.data), 'encryption_key').toString()); | ||
| window.location.href = '/'; |
Tombolo/client-reactjs/package.json
Outside changed files
| @@ -30,3 +30,4 @@ | ||
| "socket.io-client": "^4.1.3", | ||
| "validator": "^13.11.0" | ||
| "validator": "^13.11.0", | ||
| "crypto-js": "^4.2.0" | ||
| }, |
This fix introduces these dependencies
| Package | Version | Security advisories |
| crypto-js (npm) | 4.2.0 | None |
Copilot is powered by AI and may make mistakes. Always verify output.
| const oldUser = JSON.parse(localStorage.getItem('user')); | ||
| const newUser = { ...oldUser, firstName: response.data.firstName, lastName: response.data.lastName }; | ||
|
|
||
| localStorage.setItem('user', JSON.stringify(newUser)); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 14 hours ago
To fix the problem, we need to ensure that any sensitive information stored in localStorage is encrypted. We can use the crypto-js library to encrypt and decrypt the data before storing and retrieving it from localStorage.
- Install the
crypto-jslibrary. - Import the necessary functions from
crypto-js. - Encrypt the user data before storing it in
localStorage. - Decrypt the user data when retrieving it from
localStorage.
Suggested changeset
3
Tombolo/client-reactjs/src/components/application/myAccount/myAccountInfo.jsx
| @@ -1,2 +1,3 @@ | ||
| import React, { useState, useEffect } from 'react'; | ||
| import CryptoJS from 'crypto-js'; | ||
| import { Card, Form, Row, Col, Input, Button, Spin, message } from 'antd'; | ||
| @@ -44,6 +45,8 @@ | ||
|
|
||
| const oldUser = JSON.parse(localStorage.getItem('user')); | ||
| const encryptedOldUser = localStorage.getItem('user'); | ||
| const oldUser = encryptedOldUser ? JSON.parse(CryptoJS.AES.decrypt(encryptedOldUser, 'secret-key').toString(CryptoJS.enc.Utf8)) : {}; | ||
| const newUser = { ...oldUser, firstName: response.data.firstName, lastName: response.data.lastName }; | ||
|
|
||
| localStorage.setItem('user', JSON.stringify(newUser)); | ||
| const encryptedNewUser = CryptoJS.AES.encrypt(JSON.stringify(newUser), 'secret-key').toString(); | ||
| localStorage.setItem('user', encryptedNewUser); | ||
| window.dispatchEvent(new Event('userStorage')); |
Tombolo/client-reactjs/src/components/login/ResetTempPw.jsx
Outside changed files
| @@ -1,2 +1,3 @@ | ||
| import React, { useState, useEffect } from 'react'; | ||
| import CryptoJS from 'crypto-js'; | ||
| import { Form, Input, Button, Spin, message, Popover } from 'antd'; | ||
| @@ -38,3 +39,4 @@ | ||
| // Save user token to local storage | ||
| localStorage.setItem('user', JSON.stringify(result.data)); | ||
| const encryptedUser = CryptoJS.AES.encrypt(JSON.stringify(result.data), 'secret-key').toString(); | ||
| localStorage.setItem('user', encryptedUser); | ||
| window.location.href = '/'; |
Tombolo/client-reactjs/package.json
Outside changed files
| @@ -30,3 +30,4 @@ | ||
| "socket.io-client": "^4.1.3", | ||
| "validator": "^13.11.0" | ||
| "validator": "^13.11.0", | ||
| "crypto-js": "^4.2.0" | ||
| }, |
This fix introduces these dependencies
| Package | Version | Security advisories |
| crypto-js (npm) | 4.2.0 | None |
Copilot is powered by AI and may make mistakes. Always verify output.
| if (!user) return; | ||
| if (user?.token !== token) { | ||
| user.token = token; | ||
| await localStorage.setItem('user', JSON.stringify(user)); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Copilot Autofix AI about 14 hours ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| const result = await resetTempPassword(values); | ||
|
|
||
| // Save user token to local storage | ||
| localStorage.setItem('user', JSON.stringify(result.data)); |
Check failure
Code scanning / CodeQL
Clear text storage of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 14 hours ago
To fix the problem, we need to ensure that any sensitive information stored in local storage is encrypted. We can use the crypto-js library to encrypt the data before storing it and decrypt it when needed. This will protect the data from being easily accessed in plain text.
- Install the
crypto-jslibrary. - Import the necessary functions from
crypto-js. - Encrypt the data before storing it in local storage.
- Decrypt the data when retrieving it from local storage.
Suggested changeset
2
Tombolo/client-reactjs/src/components/login/ResetTempPw.jsx
| @@ -4,2 +4,3 @@ | ||
| import passwordComplexityValidator from '../common/passwordComplexityValidator'; | ||
| import CryptoJS from 'crypto-js'; | ||
|
|
||
| @@ -38,3 +39,4 @@ | ||
| // Save user token to local storage | ||
| localStorage.setItem('user', JSON.stringify(result.data)); | ||
| const encryptedData = CryptoJS.AES.encrypt(JSON.stringify(result.data), 'secret-key').toString(); | ||
| localStorage.setItem('user', encryptedData); | ||
| window.location.href = '/'; |
Tombolo/client-reactjs/package.json
Outside changed files
| @@ -30,3 +30,4 @@ | ||
| "socket.io-client": "^4.1.3", | ||
| "validator": "^13.11.0" | ||
| "validator": "^13.11.0", | ||
| "crypto-js": "^4.2.0" | ||
| }, |
This fix introduces these dependencies
| Package | Version | Security advisories |
| crypto-js (npm) | 4.2.0 | None |
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
Fixes # (issue)
Type of change
Developer Checklist:
Reviewer Checklist