node.js - Passport-Azure-Ad 似乎异步运行

Question

我正在使用 TSED - TypeScript Express Decorators ( https://tsed.io )，它取代了如下的快速代码:

   server.get('/api/tasks', passport.authenticate('oauth-bearer', { session: false }), listTasks);

带有带注释的中间件类 - https://tsed.io/docs/middlewares.html

现在对 passport.authenticate() 的调用位于 use() 方法中，如下所示:

@OverrideMiddleware(AuthenticatedMiddleware)
export class UserAuthMiddleware implements IMiddleware {
    constructor(@Inject() private authService: AuthService) {
    }

    public use(
        @EndpointInfo() endpoint: EndpointMetadata,
        @Request() request: express.Request,
        @Response() response: express.Response,
        @Next() next: express.NextFunction
    ) {
        const options = endpoint.get(AuthenticatedMiddleware) || {};
        this.authService.authenticate(request, response, next);  // <-- HERE
        if (!request.isAuthenticated()) {
            throw new Forbidden('Forbidden');
        }
        next();
    }
}

然后我的AuthService.authenticate()是

authenticate(request: express.Request, response: express.Response, next: express.NextFunction) {
    console.log(`before passport authenticate time: ${Date.now()}`);
    Passport.authenticate('oauth-bearer', {session: false})(request, response, next);
    console.log(`after passport authenticate time : ${Date.now()}`);

}

我的 Passport 配置是在同一个 AuthService 类中执行的:

@Service()
export class AuthService implements BeforeRoutesInit, AfterRoutesInit {
    users = [];
    owner = '';

    constructor(private serverSettings: ServerSettingsService,
                @Inject(ExpressApplication) private  expressApplication: ExpressApplication) {
    }

    $beforeRoutesInit() {
        this.expressApplication.use(Passport.initialize());
    }

    $afterRoutesInit() {
        this.setup();
    }

    setup() {
        Passport.use('oauth-bearer', new BearerStrategy(jwtOptions, (token: ITokenPayload, done: VerifyCallback) => {
            // TODO - reconsider the use of an array for Users
            const findById = (id, fn) => {
                for (let i = 0, len = this.users.length; i < len; i++) {
                    const user = this.users[i];
                    if (user.oid === id) {
                        logger.info('Found user: ', user);
                        return fn(null, user);
                    }
                }
                return fn(null, null);
            };

            console.log(token, 'was the token retrieved');

            findById(token.oid, (err, user) => {
                if (err) {
                    return done(err);
                }
                if (!user) {
                    // 'Auto-registration'
                    logger.info('User was added automatically as they were new. Their oid is: ', token.oid);
                    this.users.push(token);
                    this.owner = token.oid;
                    const val = done(null, token);
                    console.log(`after strategy done authenticate time: ${Date.now()}`)
                    return val;
                }
                this.owner = token.oid;
                const val = done(null, user, token);
                console.log(`after strategy done authenticate time: ${Date.now()}`);
                return val;
            });
        }));
    }

这一切都有效 - 我的 Azure 配置和设置登录并检索我的 API 的 access_token，并且此 token 成功进行身份验证并将用户对象放置在请求中。

然而，Passport.authenticate() 似乎是异步的，并且直到 request.isAuthenticated() 测试之后才完成。可以看出，我已经添加了时间评论。 afterpassportauthentication time: xxx 发生在 before 后 2 毫秒。

策略完成后验证时间:xxx发生在 Passport 验证时间后:xxx一秒后。

所以对我来说这看起来像是异步行为。

查看node_modules/passport/lib/middleware/authenticate.js ( https://github.com/jaredhanson/passport/blob/master/lib/middleware/authenticate.js )，没有提到 promise 或异步。然而，在 node_modules/passport-azure-ad/lib/bearerstrategy.js ( https://github.com/AzureAD/passport-azure-ad/blob/dev/lib/bearerstrategy.js ) 中是一个 async.waterfall:

/*
 * We let the metadata loading happen in `authenticate` function, and use waterfall
 * to make sure the authentication code runs after the metadata loading is finished.
 */
Strategy.prototype.authenticate = function authenticateStrategy(req, options) {
  const self = this;
  var params = {};
  var optionsToValidate = {};
  var tenantIdOrName = options && options.tenantIdOrName;

  /* Some introduction to async.waterfall (from the following link):
   * http://stackoverflow.com/questions/28908180/what-is-a-simple-implementation-of-async-waterfall
   *
   *   Runs the tasks array of functions in series, each passing their results 
   * to the next in the array. However, if any of the tasks pass an error to 
   * their own callback, the next function is not executed, and the main callback
   * is immediately called with the error.
   *
   * Example:
   *
   * async.waterfall([
   *   function(callback) {
   *     callback(null, 'one', 'two');
   *   },
   *   function(arg1, arg2, callback) {
   *     // arg1 now equals 'one' and arg2 now equals 'two'
   *     callback(null, 'three');
   *   },
   *   function(arg1, callback) {
   *     // arg1 now equals 'three'
   *     callback(null, 'done');
   *   }
   * ], function (err, result) {
   *      // result now equals 'done'    
   * }); 
   */
  async.waterfall([

    // compute metadataUrl
    (next) => {
      params.metadataURL = aadutils.concatUrl(self._options.identityMetadata,
        [
          `${aadutils.getLibraryProductParameterName()}=${aadutils.getLibraryProduct()}`,
          `${aadutils.getLibraryVersionParameterName()}=${aadutils.getLibraryVersion()}`
        ]
      );

      // if we are not using the common endpoint, but we have tenantIdOrName, just ignore it
      if (!self._options._isCommonEndpoint && tenantIdOrName) {
          ...
      ...
      return self.jwtVerify(req, token, params.metadata, optionsToValidate, verified);
    }],

    (waterfallError) => { // This function gets called after the three tasks have called their 'task callbacks'
      if (waterfallError) {
        return self.failWithLog(waterfallError);
      }
      return true;
    }
  );
};

这会导致异步代码吗？如果在“普通 express 中间件”中运行会有问题吗？有人可以证实我所说的或否认我所说的并提供一个有效的解决方案吗？

<小时/>

根据记录，我开始在我的 SO 问题中寻求有关 Passport-Azure-Ad 问题的帮助 - Azure AD open BearerStrategy "TypeError: self.success is not a function" 。那里的问题似乎已经解决了。

<小时/>

编辑 - 标题最初包含“在 TSED 框架中”，但我相信所描述的问题仅存在于 passport-azure-ad 中。

Answer 1

这是一个解决我认为 passport-azure-ad 异步问题的解决方案，但无法控制它。它不是我想要的答案 - 确认我所说的或否认我所说的并提供一个有效的解决方案。

以下是 https://tsed.io 的解决方案框架。在 https://github.com/TypedProject/ts-express-decorators/issues/559他们建议不要使用 @OverrideMiddleware(AuthenticatedMiddleware) 而是使用 @UseAuth 中间件。它的作用是为了说明目的，这在这里并不重要(我将很快处理反馈)。

@OverrideMiddleware(AuthenticatedMiddleware)
export class UserAuthMiddleware implements IMiddleware {
    constructor(@Inject() private authService: AuthService) {
    }

    // NO THIS VERSION DOES NOT WORK.  I even removed checkForAuthentication() and
    // inlined the setInterval() but it made no difference
    // Before the 200 is sent WITH content, a 204 NO CONTENT is

    // HAD TO CHANGE to the setTimeout() version
    // async checkForAuthentication(request: express.Request): Promise<void> {
    //     return new Promise<void>(resolve => {

    //         let iterations = 30;
    //        const id = setInterval(() => {
    //             if (request.isAuthenticated() || iterations-- <= 0) {
    //                 clearInterval(id);
    //                 resolve();
    //             }
    //         }, 50);
    //     });
    // }

    // @async
    public use(
        @EndpointInfo() endpoint: EndpointMetadata,
        @Request() request: express.Request,
        @Response() response: express.Response,
        @Next() next: express.NextFunction
    ) {
        const options = endpoint.get(AuthenticatedMiddleware) || {};
        this.authService.authenticate(request, response, next);

        // AS DISCUSSED above this doesn't work
        // await this.checkForAuthentication(request);
        // TODO - check roles in options against AD scopes
        // if (!request.isAuthenticated()) {
        //     throw new Forbidden('Forbidden');
        // }
        // next();

        // HAD TO USE setTimeout()
        setTimeout(() => {
            if (!request.isAuthenticated()) {
                console.log(`throw forbidden`);
                throw new Forbidden('Forbidden');
            }
            next();
        }, 1500);
}

<小时/>

编辑 - 我有一个使用 setInterval() 的版本，但我发现它不起作用。我什至尝试将代码内联到一个方法中，这样我就可以删除async。它似乎导致 UserAuthMiddleware 附加到的 @Post 立即完成并返回 204“无内容”。序列将在此之后完成，并且将返回包含所需内容的 200，但为时已晚。我不明白为什么。