Refractor auth logic

+ Add possibility (_requireAdminAuthentication, _requireTeamleaderAuthentication) to make auth optional
+ Add possibility to combine multiple auth types into one function

dev.sh

@@ -52,6 +52,7 @@ if [ "$RECREATE" = true ]; then
         -e DATABASE_URL="postgresql://server:server@postgres:5432/management?schema=public" \
         -e NODE_ENV="development" \
         -e PORT="${D_PORT}" \
+        -e JWT_SECRET="not_for_production" \
         -p "${D_PORT}":"${D_PORT}" \
         --entrypoint "/app/scripts/docker-entrypoint.dev.sh" \
         node

src/Middleware/auth/auth.ts

@@ -6,6 +6,9 @@ import { authClient } from "../../lib/redis";
 import jwt, { JsonWebTokenError, JwtPayload } from "jsonwebtoken";
 import prisma from "../../lib/prisma";
 import AuthError from "../error/AuthError";
+import { TeamleaderJWTPayload, _requireTeamleaderAuthentication } from "./teamleaderAuth";
+
+require("express-async-errors");
 
 const JWT_SECRET = process.env.JWT_SECRET;
 
@@ -13,7 +16,9 @@ export const verifyAuthorizationFormat = (authorization: string) => /^Bearer .+$
 
 export const getBearerToken = (authorization: string) => authorization.slice(7);
 
-export const requireAuthentication = async (req: Request, res: Response, next: NextFunction) => {
+const _requireAdminAuthentication =
+  (config: { optional?: Boolean; controlled?: Boolean } = { optional: false, controlled: false }) =>
+  async (req: Request, res: Response, next: NextFunction) => {
     if (!JWT_SECRET) {
       throw new Error("JWT_SECRET not set");
     }
@@ -21,6 +26,10 @@ export const requireAuthentication = async (req: Request, res: Response, next: N
     const { authorization } = req.headers;
 
     if (!authorization) {
+      if (config.optional) {
+        return false;
+      }
+
       return res.status(403).send({
         type: "error",
         payload: {
@@ -58,6 +67,14 @@ export const requireAuthentication = async (req: Request, res: Response, next: N
 
     const token_payload = token_payload_ as AuthJWTPayload;
 
+    if (!token_payload.permission_level || !token_payload.pid || !token_payload.revision) {
+      if (typeof (token_payload as unknown as TeamleaderJWTPayload).team === "string") {
+        return false;
+      }
+
+      throw new AuthError("The token did not include the required information!");
+    }
+
     const { pid, revision } = token_payload;
 
     let db_revision = await authClient.get(pid);
@@ -91,8 +108,70 @@ export const requireAuthentication = async (req: Request, res: Response, next: N
       revision: token_payload.revision,
     };
 
+    if (!config.controlled) {
       next();
-};
+    }
+
+    return true;
+  };
+
+export const requireAuthentication = _requireAdminAuthentication({ optional: false, controlled: false });
+
+type AuthType = "admin" | "teamleader";
+interface AuthTypeConfig {
+  admin?: Boolean;
+  teamleader?: Boolean;
+}
+
+interface AuthConfiguration {
+  type: AuthType | AuthTypeConfig;
+
+  optional: Boolean;
+}
+
+function getAuthTypes(type: AuthType | AuthTypeConfig): AuthType[] {
+  if (typeof type === "string") {
+    return [type];
+  }
+
+  return Object.entries(type)
+    .filter(([_, value]) => value)
+    .map(([key, _]) => key as AuthType);
+}
+
+export const requireConfiguredAuthentication =
+  (config: AuthConfiguration = { optional: false, type: "admin" }) =>
+  async (req: Request, res: Response, next: NextFunction) => {
+    const types = getAuthTypes(config.type);
+    const optional = config.optional;
+
+    let adminFinished = false;
+    let teamleaderFinished = false;
+
+    if (types.includes("admin")) {
+      adminFinished = Boolean(await _requireAdminAuthentication({ optional: true, controlled: true })(req, res, next));
+
+      if (adminFinished) {
+        return next();
+      }
+    }
+
+    if (types.includes("teamleader")) {
+      teamleaderFinished = Boolean(
+        _requireTeamleaderAuthentication({ optional: true, controlled: true })(req, res, next)
+      );
+
+      if (teamleaderFinished) {
+        return next();
+      }
+    }
+
+    if (!config.optional) {
+      throw new AuthError("No sufficient authorization was provided for this operation");
+    }
+
+    next();
+  };
 
 export function requireResponsibleForGroup(auth: AuthJWTPayload | undefined, groupPid: string) {
   if (auth?.permission_level === "ELEVATED") {

src/Middleware/auth/teamleaderAuth.ts

@@ -23,7 +23,9 @@ export function generateTeamleaderJWT(teamleader: Team) {
   return jwt.sign(payload, JWT_SECRET, { expiresIn: "4 days" });
 }
 
-export async function requireTeamleaderAuthentication(req: Request, res: Response, next: NextFunction) {
+export const _requireTeamleaderAuthentication =
+  (config: { optional: Boolean; controlled: Boolean } = { optional: false, controlled: false }) =>
+  (req: Request, res: Response, next: NextFunction) => {
     if (!JWT_SECRET) {
       throw new Error("JWT_SECRET not set");
     }
@@ -31,6 +33,10 @@ export async function requireTeamleaderAuthentication(req: Request, res: Respons
     const { authorization } = req.headers;
 
     if (!authorization) {
+      if (config.optional) {
+        return false;
+      }
+
       return res.status(403).send({
         type: "error",
         payload: {
@@ -58,7 +64,11 @@ export async function requireTeamleaderAuthentication(req: Request, res: Respons
         team: token_payload.team,
       };
 
+      if (!config.controlled) {
         next();
+      }
+
+      return true;
     } catch (e) {
       if (e instanceof JsonWebTokenError) {
         return res.status(403).json({
@@ -68,10 +78,12 @@ export async function requireTeamleaderAuthentication(req: Request, res: Respons
           },
         });
       }
-  }
 
       throw e;
-}
+    }
+  };
+
+export const requireTeamleaderAuthentication = _requireTeamleaderAuthentication({ optional: false, controlled: false });
 
 export function requireLeaderOfTeam(auth: TeamleaderJWTPayload | undefined, teamPid: string) {
   if (auth?.team !== teamPid) {