👰 n8n 2826 um wedding FE<>BE (#2789)

* remove mocks * update authorization func * lock down default role * 🐛 fix requiring authentication for OPTIONS requests * 🐛 fix cors and cookie issues in dev * update setup route Co-authored-by: Ben Hesseldieck <b.hesseldieck@gmail.com>
n8n-io · Feb 14, 2022 · 20a0885 · 20a0885
1 parent e57368f
commit 20a0885
Show file tree

Hide file tree

Showing 15 changed files with 30 additions and 358 deletions.
diff --git a/packages/cli/src/Server.ts b/packages/cli/src/Server.ts
@@ -622,6 +622,7 @@ class App {
 			this.app.use((req: express.Request, res: express.Response, next: express.NextFunction) => {
 				// Allow access also from frontend when developing
 				res.header('Access-Control-Allow-Origin', 'http://localhost:8080');
+				res.header('Access-Control-Allow-Credentials', true);
 				res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
 				res.header(
 					'Access-Control-Allow-Headers',

diff --git a/packages/cli/src/UserManagement/routes/auth.ts b/packages/cli/src/UserManagement/routes/auth.ts
@@ -6,7 +6,7 @@ import { compare } from 'bcryptjs';
 import * as jwt from 'jsonwebtoken';
 import { IDataObject } from 'n8n-workflow';
 import { Db, ResponseHelper } from '../..';
-import { issueJWT, resolveJwtContent } from '../auth/jwt';
+import { issueCookie, resolveJwtContent } from '../auth/jwt';
 import { JwtPayload, N8nApp, PublicUser } from '../Interfaces';
 import config = require('../../../config');
 import { isInstanceOwnerSetup, sanitizeUser } from '../UserManagementHelper';
@@ -49,8 +49,7 @@ export function authenticationMethods(this: N8nApp): void {
 				throw error;
 			}
 
-			const userData = await issueJWT(user);
-			res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+			await issueCookie(res, user);
 
 			return sanitizeUser(user);
 		}),
@@ -97,14 +96,13 @@ export function authenticationMethods(this: N8nApp): void {
 				throw new Error('Invalid database state - user has password set.');
 			}
 
-			const userData = await issueJWT(user);
-			res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+			await issueCookie(res, user);
 
 			return sanitizeUser(user);
 		}),
 	);
 
-	this.app.get(
+	this.app.post(
 		`/${this.restEndpoint}/logout`,
 		ResponseHelper.send(async (req: Request, res: Response): Promise<IDataObject> => {
 			res.clearCookie('n8n-auth');

diff --git a/packages/cli/src/UserManagement/routes/index.ts b/packages/cli/src/UserManagement/routes/index.ts
@@ -45,6 +45,8 @@ export function addRoutes(this: N8nApp, ignoredEndpoints: string[], restEndpoint
 
 	this.app.use((req: Request, res: Response, next: NextFunction) => {
 		if (
+			// skip authentication for preflight requests
+			req.method === 'OPTIONS' ||
 			req.url.includes('login') ||
 			req.url.includes('logout') ||
 			req.url === '/index.html' ||

diff --git a/packages/cli/src/UserManagement/routes/me.ts b/packages/cli/src/UserManagement/routes/me.ts
@@ -6,7 +6,7 @@ import express = require('express');
 import validator from 'validator';
 
 import { Db, ResponseHelper } from '../..';
-import { issueJWT } from '../auth/jwt';
+import { issueCookie } from '../auth/jwt';
 import { N8nApp, PublicUser } from '../Interfaces';
 import { validatePassword, sanitizeUser } from '../UserManagementHelper';
 import type { AuthenticatedRequest, MeRequest } from '../../requests';
@@ -47,9 +47,7 @@ export function meNamespace(this: N8nApp): void {
 
 				const user = await Db.collections.User!.save(newUser);
 
-				const userData = await issueJWT(user);
-
-				res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+				await issueCookie(res, user);
 
 				return sanitizeUser(user);
 			},
@@ -67,8 +65,7 @@ export function meNamespace(this: N8nApp): void {
 
 			const user = await Db.collections.User!.save(req.user);
 
-			const userData = await issueJWT(user);
-			res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+			await issueCookie(res, user);
 
 			return { success: true };
 		}),

diff --git a/packages/cli/src/UserManagement/routes/owner.ts b/packages/cli/src/UserManagement/routes/owner.ts
@@ -9,7 +9,7 @@ import config = require('../../../config');
 import { User } from '../../databases/entities/User';
 import { validateEntity } from '../../GenericHelpers';
 import { OwnerRequest } from '../../requests';
-import { issueJWT } from '../auth/jwt';
+import { issueCookie } from '../auth/jwt';
 import { N8nApp } from '../Interfaces';
 import { sanitizeUser } from '../UserManagementHelper';
 
@@ -75,8 +75,7 @@ export function ownerNamespace(this: N8nApp): void {
 				{ value: JSON.stringify(true) },
 			);
 
-			const { token, expiresIn } = await issueJWT(owner);
-			res.cookie('n8n-auth', token, { maxAge: expiresIn, httpOnly: true });
+			await issueCookie(res, owner);
 
 			return sanitizeUser(owner);
 		}),

diff --git a/packages/cli/src/UserManagement/routes/passwordReset.ts b/packages/cli/src/UserManagement/routes/passwordReset.ts
@@ -12,7 +12,7 @@ import { N8nApp } from '../Interfaces';
 import { validatePassword } from '../UserManagementHelper';
 import * as UserManagementMailer from '../email';
 import type { PasswordResetRequest } from '../../requests';
-import { issueJWT } from '../auth/jwt';
+import { issueCookie } from '../auth/jwt';
 import { getBaseUrl } from '../../GenericHelpers';
 
 export function passwordResetNamespace(this: N8nApp): void {
@@ -104,8 +104,7 @@ export function passwordResetNamespace(this: N8nApp): void {
 				resetPasswordToken: null,
 			});
 
-			const userData = await issueJWT(req.user);
-			res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+			await issueCookie(res, req.user);
 		}),
 	);
 }
diff --git a/packages/cli/src/UserManagement/routes/users.ts b/packages/cli/src/UserManagement/routes/users.ts
@@ -14,7 +14,7 @@ import { User } from '../../databases/entities/User';
 import { SharedWorkflow } from '../../databases/entities/SharedWorkflow';
 import { SharedCredentials } from '../../databases/entities/SharedCredentials';
 import { getInstance } from '../email/UserManagementMailer';
-import { issueJWT } from '../auth/jwt';
+import { issueCookie } from '../auth/jwt';
 
 export function usersNamespace(this: N8nApp): void {
 	this.app.post(
@@ -205,8 +205,8 @@ export function usersNamespace(this: N8nApp): void {
 
 			const updatedUser = await Db.collections.User!.save(invitee);
 
-			const userData = await issueJWT(updatedUser);
-			res.cookie('n8n-auth', userData.token, { maxAge: userData.expiresIn, httpOnly: true });
+			await issueCookie(res, updatedUser);
+
 			return sanitizeUser(updatedUser);
 		}),
 	);

diff --git a/packages/cli/test/integration/auth.endpoints.test.ts b/packages/cli/test/integration/auth.endpoints.test.ts
@@ -125,11 +125,11 @@ describe('auth endpoints', () => {
 			expect(response.headers['set-cookie']).toBeUndefined();
 		});
 
-		test('GET /logout should log user out', async () => {
+		test('POST /logout should log user out', async () => {
 			const owner = await Db.collections.User!.findOneOrFail();
 			const ownerAgent = await utils.createAuthAgent(app, owner);
 
-			const response = await ownerAgent.get('/logout');
+			const response = await ownerAgent.post('/logout');
 
 			expect(response.statusCode).toBe(200);
 			expect(response.body).toEqual(LOGGED_OUT_RESPONSE_BODY);

diff --git a/packages/editor-ui/src/api/helpers.ts b/packages/editor-ui/src/api/helpers.ts
@@ -49,6 +49,9 @@ async function request(config: {method: Method, baseURL: string, endpoint: strin
 		baseURL,
 		headers,
 	};
+	if (process.env.NODE_ENV !== 'production' && !baseURL.includes('api.n8n.io') ) {
+		options.withCredentials = true;
+	}
 	if (['PATCH', 'POST', 'PUT'].includes(method)) {
 		options.data = data;
 	} else {
@@ -82,7 +85,7 @@ export async function makeRestApiRequest(context: IRestApiContext, method: Metho
 		method,
 		baseURL: context.baseUrl,
 		endpoint,
-		headers: {sessionid: context.sessionId},
+		headers: { sessionid: context.sessionId },
 		data,
 	});
 

diff --git a/packages/editor-ui/src/api/settings-mock.ts b/packages/editor-ui/src/api/settings-mock.ts