fix(API): Use OIDC email claim instead of sub for auth

relaycorp · Sep 22, 2023 · 94931ce · 94931ce
1 parent 1c6bcaa
commit 94931ce
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 6 deletions.
diff --git a/docs/api-server.md b/docs/api-server.md
@@ -8,7 +8,7 @@ This server exposes a RESTful API to manage VeraId organisations and the endpoin
 
 ## Authentication and authorisation
 
-We use OAuth2 with JWKS to delegate authentication to an external identity provider. We require the JWT token's `sub` claim to be the email address of the user.
+We use OAuth2 with JWKS to delegate authentication to an external identity provider. We require the JWT token to define the user's email address in the [OIDC `email` claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims).
 
 The API employs the following roles:
 

diff --git a/src/api/orgAuthPlugin.ts b/src/api/orgAuthPlugin.ts
@@ -15,7 +15,7 @@ interface OrgRequestParams {
 }
 
 interface AuthenticatedFastifyRequest extends FastifyRequest {
-  user: { sub: string };
+  user: { email: string };
 }
 
 interface AuthorisedFastifyRequest extends AuthenticatedFastifyRequest {
@@ -76,7 +76,7 @@ function registerOrgAuth(fastify: FastifyInstance, _opts: PluginMetadata, done:
 
   fastify.addHook('onRequest', async (request, reply) => {
     const superAdmin = envVar.get('AUTHORITY_SUPERADMIN').asString();
-    const userEmail = (request as AuthenticatedFastifyRequest).user.sub;
+    const userEmail = (request as AuthenticatedFastifyRequest).user.email;
     const decision = await decideAuthorisation(userEmail, request, fastify.mongoose, superAdmin);
     const reason = decision.didSucceed ? decision.result.reason : decision.context;
     if (decision.didSucceed) {
@@ -102,11 +102,11 @@ const requireUserToBeAdmin: any = async (
   reply: FastifyReply,
 ) => {
   if (!request.isUserAdmin) {
-    await denyAuthorisation('User is not an admin', reply, request.user.sub);
+    await denyAuthorisation('User is not an admin', reply, request.user.email);
   }
 };
 
 const orgAuthPlugin = fastifyPlugin(registerOrgAuth, { name: 'org-auth' });
 export default orgAuthPlugin;
 
-export { requireUserToBeAdmin };
+export { type AuthenticatedFastifyRequest, requireUserToBeAdmin };
diff --git a/src/testUtils/apiServer.ts b/src/testUtils/apiServer.ts
@@ -13,6 +13,7 @@ import type { PluginDone } from '../utilities/fastify/PluginDone.js';
 import { HTTP_STATUS_CODES } from '../utilities/http.js';
 import { MemberModelSchema, Role } from '../models/Member.model.js';
 import type { Result, SuccessfulResult } from '../utilities/result.js';
+import type { AuthenticatedFastifyRequest } from '../api/orgAuthPlugin.js';
 
 import { makeTestServer, type TestServerFixture } from './server.js';
 import { OAUTH2_JWKS_URL, OAUTH2_TOKEN_AUDIENCE, OAUTH2_TOKEN_ISSUER } from './authn.js';
@@ -83,7 +84,7 @@ function getMockAuthenticateFromServer(fastify: FastifyInstance) {
 function setAuthUser(fastify: FastifyInstance, userEmail: string) {
   // eslint-disable-next-line @typescript-eslint/require-await
   getMockAuthenticateFromServer(fastify).mockImplementation(async (request) => {
-    (request as unknown as { user: { sub: string } }).user = { sub: userEmail };
+    (request as AuthenticatedFastifyRequest).user = { email: userEmail };
   });
 }