[NAE-2241] Anonymous access refactor

nae.json

@@ -20,6 +20,16 @@
             "sessionTimeoutEnabled": false,
             "sessionTimeout": 900,
             "jwtBearer": "X-Jwt-Token",
+            "apiToken": {
+                "enabled": true,
+                "queryParameter": "token",
+                "realmQueryParameter": "realmId",
+                "removeFromUrl": true,
+                "allowedPaths": [
+                    "/tabbed-views",
+                    "/tabbed-views/**"
+                ]
+            },
             "sso": {
                 "enable": false,
                 "clientId": "dev-cluster-worker",

projects/nae-example-app/src/app/app.component.ts

@@ -28,7 +28,7 @@ export class AppComponent {
         translate.setTranslation('en', en, true);
         translate.setTranslation('sk', sk, true);
 
-        this.userService.user$.pipe(filter(u => !!u && u.id !== ''), take(1)).subscribe(() => {
+        this.userService.user$.pipe(filter(u => !!u && u.id !== '' && !u.isAnonymous()), take(1)).subscribe(() => {
             const allNets = allowedNetsFactory.createWithAllNets();
             allNets.allowedNetsIdentifiers$.pipe(take(1)).subscribe(nets => {
                 if (this.baseAllowedNets.allowedNets.length !== 0) {

projects/netgrif-components-core/schematics/_commons/schema.d.ts

@@ -47,11 +47,20 @@ export interface Auth {
     sessionBearer?: string;
     jwtEnabled?: boolean;
     jwtBearer?: string;
+    apiToken?: ApiTokenAuthentication;
     endpoints?: string | { [k: string]: string };
 
     [k: string]: any;
 }
 
+export interface ApiTokenAuthentication {
+    enabled?: boolean;
+    queryParameter?: string;
+    realmQueryParameter?: string;
+    removeFromUrl?: boolean;
+    allowedPaths?: Array<string>;
+}
+
 export interface Resource {
     name: string;
     address: string;

projects/netgrif-components-core/src/commons/schema.ts

@@ -45,12 +45,21 @@ export interface Auth {
     address: string;
     authentication: string;
     sessionBearer?: string;
+    apiToken?: ApiTokenAuthentication;
     endpoints?: string | { [k: string]: string };
     sso?: Sso;
 
     [k: string]: any;
 }
 
+export interface ApiTokenAuthentication {
+    enabled?: boolean;
+    queryParameter?: string;
+    realmQueryParameter?: string;
+    removeFromUrl?: boolean;
+    allowedPaths?: Array<string>;
+}
+
 export interface Sso {
     enable: boolean;
     redirectUrl: string;

projects/netgrif-components-core/src/lib/authentication/authentication.module.ts

@@ -6,7 +6,7 @@ import {ProxyAuthenticationService} from './proxyAuthentication.service';
 import {AuthenticationMethodService} from './services/authentication-method.service';
 import {OverlayModule} from '@angular/cdk/overlay';
 import {MatProgressSpinnerModule} from '@angular/material/progress-spinner';
-import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentication-interceptor';
+// import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentication-interceptor';
 
 
 @NgModule({
@@ -22,7 +22,7 @@ import {AnonymousAuthenticationInterceptor} from './services/anonymous-authentic
     ],
     providers: [
         { provide: HTTP_INTERCEPTORS, useClass: AuthenticationInterceptor, multi: true },
-        { provide: HTTP_INTERCEPTORS, useClass: AnonymousAuthenticationInterceptor, multi: true },
+        // { provide: HTTP_INTERCEPTORS, useClass: AnonymousAuthenticationInterceptor, multi: true },
         { provide: AuthenticationMethodService, useClass: ProxyAuthenticationService},
         // AuthenticationEffects
     ]

projects/netgrif-components-core/src/lib/authentication/proxyAuthentication.service.spec.ts

@@ -17,7 +17,8 @@ describe('ProxyAuthenticationService', () => {
                 auth: {
                     authentication: 'basic',
                     address: 'http://localhost:8080',
-                    endpoints: {login: '/api/auth/login'}
+                    endpoints: {login: '/api/auth/login'},
+                    apiToken: {}
                 }
             }
         } as any,
@@ -59,4 +60,19 @@ describe('ProxyAuthenticationService', () => {
 
         expect(response).toBeTruthy();
     }));
+
+    it('authenticates an API token with bearer and realm headers', fakeAsync(() => {
+        let response: any;
+
+        service.loginWithApiToken('user-id.secret', 'Admin').subscribe(res => response = res);
+
+        const req = httpMock.expectOne('http://localhost:8080/api/auth/login');
+        expect(req.request.method).toBe('GET');
+        expect(req.request.headers.get('Authorization')).toBe('Bearer user-id.secret');
+        expect(req.request.headers.get('X-Realm-ID')).toBe('Admin');
+        req.flush({id: '1', name: 'User'});
+
+        tick();
+        expect(response).toBeTruthy();
+    }));
 });

projects/netgrif-components-core/src/lib/authentication/proxyAuthentication.service.ts

@@ -1,12 +1,12 @@
 import {ConfigurationService} from '../configuration/configuration.service';
 import {NullAuthenticationService} from './services/methods/null-authentication/null-authentication.service';
 import {BasicAuthenticationService} from './services/methods/basic-authentication/basic-authentication.service';
-import {HttpClient} from '@angular/common/http';
+import {HttpClient, HttpHeaders} from '@angular/common/http';
 import {BasicWithRealmAuthenticationService} from "./services/methods/basic-authentication/basic-with-realm-authentication.service";
 import {filter, take} from "rxjs/operators";
 import {UserResource} from "../resources/interface/user-resource";
 import {Credentials} from "./models/credentials";
-import {Observable} from 'rxjs';
+import {Observable, throwError} from 'rxjs';
 import {Injectable} from "@angular/core";
 import {AuthenticationMethodService} from "./services/authentication-method.service";
 
@@ -46,6 +46,24 @@
         return this._proxyAuthMethod.login(credentials);
     }
 
+    loginWithApiToken(token: string, realmId?: string): Observable<UserResource> {
+        const auth = this._config.get().providers.auth;
+        const loginEndpoint = typeof auth.endpoints === 'object' ? auth.endpoints['login'] : undefined;
+        const url = auth.address + (loginEndpoint ?? '');
+        if (!loginEndpoint) {
+            return throwError(new Error('Login URL is not defined in the config [nae.providers.auth.endpoints.login]'));
+        }
+        if (!token?.trim()) {
+            return throwError(new Error('API token is empty'));
+        }
+
+        let headers = new HttpHeaders().set('Authorization', `Bearer ${token.trim()}`);
+        if (realmId?.trim()) {
+            headers = headers.set('X-Realm-ID', realmId.trim());
+        }
+        return this._http.get<UserResource>(url, {headers});
+    }
+
     logout(): Observable<object> {
         return this._proxyAuthMethod.logout();
     }

projects/netgrif-components-core/src/lib/authentication/public-api.ts

@@ -8,9 +8,7 @@ export * from './sign-up/public-api';
 /* MODULES */
 export * from './authentication.module';
 
-/* SERVICES */
-export * from './anonymous/anonymous.service';
-export * from './services/anonymous-authentication-interceptor'
+// export * from './services/anonymous-authentication-interceptor'
 export * from './services/authentication-interceptor'
 export * from './proxyAuthentication.service'