Skip to content

Commit 4f419dd

Browse files
soceanainnseamuswn
soceanainn
and
seamuswn
authored
AWS Cognito Proxy for Github (#7014)
* feat: support using 'Bearer' keyword instead of 'token' for Github backend * feat: add additional configuration options to PKCE authenticator * feat: add working AWS proxy and update Github and Git Gateway implementations to allow for it --------- Co-authored-by: Seamus O Ceanainn <[email protected]>
1 parent debab39 commit 4f419dd

File tree

16 files changed

+263
-32
lines changed

16 files changed

+263
-32
lines changed

‎packages/decap-cms-app/package.json

+1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"dayjs": "^1.11.10",
3333
"decap-cms-backend-azure": "^3.1.0-beta.0",
3434
"decap-cms-backend-bitbucket": "^3.1.0-beta.0",
35+
"decap-cms-backend-aws-cognito-github-proxy": "^3.1.0-beta.0",
3536
"decap-cms-backend-git-gateway": "^3.1.0-beta.0",
3637
"decap-cms-backend-github": "^3.1.0-beta.1",
3738
"decap-cms-backend-gitlab": "^3.1.0-beta.0",

‎packages/decap-cms-app/src/extensions.js

+2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
import { DecapCmsCore as CMS } from 'decap-cms-core';
33
// Backends
44
import { AzureBackend } from 'decap-cms-backend-azure';
5+
import { AwsCognitoGitHubProxyBackend } from 'decap-cms-backend-aws-cognito-github-proxy';
56
import { GitHubBackend } from 'decap-cms-backend-github';
67
import { GitLabBackend } from 'decap-cms-backend-gitlab';
78
import { GiteaBackend } from 'decap-cms-backend-gitea';
@@ -33,6 +34,7 @@ import * as locales from 'decap-cms-locales';
3334
// Register all the things
3435
CMS.registerBackend('git-gateway', GitGatewayBackend);
3536
CMS.registerBackend('azure', AzureBackend);
37+
CMS.registerBackend('aws-cognito-github-proxy', AwsCognitoGitHubProxyBackend);
3638
CMS.registerBackend('github', GitHubBackend);
3739
CMS.registerBackend('gitlab', GitLabBackend);
3840
CMS.registerBackend('gitea', GiteaBackend);

‎packages/decap-cms-backend-aws-cognito-github-proxy/README.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# GitHub backend
2+
3+
An abstraction layer between the CMS and a proxied version of [Github](https://docs.github.com/en/rest).
4+
5+
## Code structure
6+
7+
`Implementation` - wraps [Github Backend](https://github.com/decaporg/decap-cms/tree/master/packages/decap-cms-lib-auth/README.md) for proxied version of Github.
8+
9+
`AuthenticationPage` - uses [lib-auth](https://github.com/decaporg/decap-cms/tree/master/packages/decap-cms-lib-auth/README.md) to create an AWS Cognito compatible generic Authentication page supporting PKCE.

‎packages/decap-cms-backend-aws-cognito-github-proxy/package.json

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{
2+
"name": "decap-cms-backend-aws-cognito-github-proxy",
3+
"description": "GitHub backend for Decap CMS proxied through AWS Cognito",
4+
"version": "3.1.0-beta.1",
5+
"license": "MIT",
6+
"repository": "https://github.com/decaporg/decap-cms/tree/master/packages/decap-cms-backend-aws-cognito-github-proxy",
7+
"bugs": "https://github.com/decaporg/decap-cms/issues",
8+
"module": "dist/esm/index.js",
9+
"main": "dist/decap-cms-backend-aws-cognito-github-proxy.js",
10+
"keywords": [
11+
"decap-cms",
12+
"backend",
13+
"github",
14+
"aws-cognito"
15+
],
16+
"sideEffects": false,
17+
"scripts": {
18+
"develop": "yarn build:esm --watch",
19+
"build": "cross-env NODE_ENV=production webpack",
20+
"build:esm": "cross-env NODE_ENV=esm babel src --out-dir dist/esm --ignore \"**/__tests__\" --root-mode upward --extensions \".js,.jsx,.ts,.tsx\"",
21+
"createFragmentTypes": "node scripts/createFragmentTypes.js"
22+
},
23+
"dependencies": {
24+
"apollo-cache-inmemory": "^1.6.2",
25+
"apollo-client": "^2.6.3",
26+
"apollo-link-context": "^1.0.18",
27+
"apollo-link-http": "^1.5.15",
28+
"common-tags": "^1.8.0",
29+
"graphql": "^15.0.0",
30+
"graphql-tag": "^2.10.1",
31+
"js-base64": "^3.0.0",
32+
"semaphore": "^1.1.0"
33+
},
34+
"peerDependencies": {
35+
"@emotion/react": "^11.11.1",
36+
"@emotion/styled": "^11.11.0",
37+
"decap-cms-lib-auth": "^3.0.0",
38+
"decap-cms-backend-github": "^3.0.0",
39+
"decap-cms-lib-util": "^3.0.0",
40+
"decap-cms-ui-default": "^3.0.0",
41+
"lodash": "^4.17.11",
42+
"prop-types": "^15.7.2",
43+
"react": "^18.2.0"
44+
}
45+
}

‎packages/decap-cms-backend-aws-cognito-github-proxy/src/AuthenticationPage.js

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
import React from 'react';
2+
import PropTypes from 'prop-types';
3+
import styled from '@emotion/styled';
4+
import { PkceAuthenticator } from 'decap-cms-lib-auth';
5+
import { AuthenticationPage, Icon } from 'decap-cms-ui-default';
6+
7+
const LoginButtonIcon = styled(Icon)`
8+
margin-right: 18px;
9+
`;
10+
11+
export default class GenericPKCEAuthenticationPage extends React.Component {
12+
static propTypes = {
13+
inProgress: PropTypes.bool,
14+
config: PropTypes.object.isRequired,
15+
onLogin: PropTypes.func.isRequired,
16+
t: PropTypes.func.isRequired,
17+
};
18+
19+
state = {};
20+
21+
componentDidMount() {
22+
const {
23+
base_url = '',
24+
app_id = '',
25+
auth_endpoint = 'oauth2/authorize',
26+
auth_token_endpoint = 'oauth2/token',
27+
redirect_uri = document.location.origin + document.location.pathname,
28+
} = this.props.config.backend;
29+
this.auth = new PkceAuthenticator({
30+
base_url,
31+
auth_endpoint,
32+
app_id,
33+
auth_token_endpoint,
34+
redirect_uri,
35+
auth_token_endpoint_content_type: 'application/x-www-form-urlencoded; charset=utf-8',
36+
});
37+
// Complete authentication if we were redirected back to from the provider.
38+
this.auth.completeAuth((err, data) => {
39+
if (err) {
40+
this.setState({ loginError: err.toString() });
41+
return;
42+
}
43+
this.props.onLogin(data);
44+
});
45+
}
46+
47+
handleLogin = e => {
48+
e.preventDefault();
49+
this.auth.authenticate({ scope: 'https://api.github.com/repo openid email' }, (err, data) => {
50+
if (err) {
51+
this.setState({ loginError: err.toString() });
52+
return;
53+
}
54+
this.props.onLogin(data);
55+
});
56+
};
57+
58+
render() {
59+
const { inProgress, config, t } = this.props;
60+
return (
61+
<AuthenticationPage
62+
onLogin={this.handleLogin}
63+
loginDisabled={inProgress}
64+
loginErrorMessage={this.state.loginError}
65+
logoUrl={config.logo_url}
66+
siteUrl={config.site_url}
67+
renderButtonContent={() => (
68+
<React.Fragment>
69+
<LoginButtonIcon type="link" /> {inProgress ? t('auth.loggingIn') : t('auth.login')}
70+
</React.Fragment>
71+
)}
72+
t={t}
73+
/>
74+
);
75+
}
76+
}

‎packages/decap-cms-backend-aws-cognito-github-proxy/src/implementation.tsx

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import * as React from 'react';
2+
import { GitHubBackend } from 'decap-cms-backend-github';
3+
4+
import AuthenticationPage from './AuthenticationPage';
5+
6+
import type { GitHubUser } from 'decap-cms-backend-github/src/implementation';
7+
import type { Config } from 'decap-cms-lib-util/src';
8+
9+
export default class AwsCognitoGitHubProxyBackend extends GitHubBackend {
10+
constructor(config: Config, options = {}) {
11+
super(config, options);
12+
13+
this.bypassWriteAccessCheckForAppTokens = true;
14+
this.tokenKeyword = 'Bearer';
15+
}
16+
17+
authComponent() {
18+
const wrappedAuthenticationPage = (props: Record<string, unknown>) => (
19+
<AuthenticationPage {...props} backend={this} />
20+
);
21+
wrappedAuthenticationPage.displayName = 'AuthenticationPage';
22+
return wrappedAuthenticationPage;
23+
}
24+
25+
async currentUser({ token }: { token: string }): Promise<GitHubUser> {
26+
if (!this._currentUserPromise) {
27+
this._currentUserPromise = fetch(this.baseUrl + '/oauth2/userInfo', {
28+
headers: {
29+
Authorization: `${this.tokenKeyword} ${token}`,
30+
},
31+
}).then(async (res: Response): Promise<GitHubUser> => {
32+
if (res.status == 401) {
33+
this.logout();
34+
return Promise.reject('Token expired');
35+
}
36+
const userInfo = await res.json();
37+
const owner = this.originRepo.split('/')[1];
38+
return {
39+
name: userInfo.email,
40+
login: owner,
41+
avatar_url: `https://github.com/${owner}.png`,
42+
} as GitHubUser;
43+
});
44+
}
45+
return this._currentUserPromise;
46+
}
47+
}

‎packages/decap-cms-backend-aws-cognito-github-proxy/src/index.ts

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
import { API } from 'decap-cms-backend-github';
2+
3+
import AwsCognitoGitHubProxyBackend from './implementation';
4+
import AuthenticationPage from './AuthenticationPage';
5+
6+
export const DecapCmsBackendAwsCognitoGithubProxy = {
7+
AwsCognitoGitHubProxyBackend,
8+
API,
9+
AuthenticationPage,
10+
};
11+
12+
export { AwsCognitoGitHubProxyBackend, API, AuthenticationPage };

‎packages/decap-cms-backend-aws-cognito-github-proxy/webpack.config.js

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
const { getConfig } = require('../../scripts/webpack.js');
2+
3+
module.exports = getConfig();

‎packages/decap-cms-backend-git-gateway/src/GitHubAPI.ts

+5-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import type { Config as GitHubConfig, Diff } from 'decap-cms-backend-github/src/
55
import type { FetchError } from 'decap-cms-lib-util';
66
import type { Octokit } from '@octokit/rest';
77

8-
type Config = GitHubConfig & {
8+
type Config = Omit<GitHubConfig, 'getUser'> & {
99
apiRoot: string;
1010
tokenPromise: () => Promise<string>;
1111
commitAuthor: { name: string };
@@ -18,7 +18,10 @@ export default class API extends GithubAPI {
1818
isLargeMedia: (filename: string) => Promise<boolean>;
1919

2020
constructor(config: Config) {
21-
super(config);
21+
super({
22+
getUser: () => Promise.reject('Never used'),
23+
...config,
24+
});
2225
this.apiRoot = config.apiRoot;
2326
this.tokenPromise = config.tokenPromise;
2427
this.commitAuthor = config.commitAuthor;

‎packages/decap-cms-backend-gitea/src/AuthenticationPage.js

+2
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ export default class GiteaAuthenticationPage extends React.Component {
2525
auth_endpoint: 'login/oauth/authorize',
2626
app_id,
2727
auth_token_endpoint: 'login/oauth/access_token',
28+
auth_token_endpoint_content_type: 'application/json; charset=utf-8',
29+
redirect_uri: document.location.origin + document.location.pathname,
2830
});
2931
// Complete authentication if we were redirected back to from the provider.
3032
this.auth.completeAuth((err, data) => {

‎packages/decap-cms-backend-github/src/API.ts

+12-8
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,16 @@ export const MOCK_PULL_REQUEST = -1;
5050
export interface Config {
5151
apiRoot?: string;
5252
token?: string;
53+
tokenKeyword?: string;
5354
branch?: string;
5455
useOpenAuthoring?: boolean;
5556
repo?: string;
5657
originRepo?: string;
5758
squashMerges: boolean;
5859
initialWorkflowStatus: string;
5960
cmsLabelPrefix: string;
61+
baseUrl?: string;
62+
getUser: ({ token }: { token: string }) => Promise<GitHubUser>;
6063
}
6164

6265
interface TreeFile {
@@ -173,6 +176,7 @@ let migrationNotified = false;
173176
export default class API {
174177
apiRoot: string;
175178
token: string;
179+
tokenKeyword: string;
176180
branch: string;
177181
useOpenAuthoring?: boolean;
178182
repo: string;
@@ -186,7 +190,8 @@ export default class API {
186190
mergeMethod: string;
187191
initialWorkflowStatus: string;
188192
cmsLabelPrefix: string;
189-
193+
baseUrl?: string;
194+
getUser: ({ token }: { token: string }) => Promise<GitHubUser>;
190195
_userPromise?: Promise<GitHubUser>;
191196
_metadataSemaphore?: Semaphore;
192197

@@ -195,6 +200,7 @@ export default class API {
195200
constructor(config: Config) {
196201
this.apiRoot = config.apiRoot || 'https://api.github.com';
197202
this.token = config.token || '';
203+
this.tokenKeyword = config.tokenKeyword || 'token';
198204
this.branch = config.branch || 'master';
199205
this.useOpenAuthoring = config.useOpenAuthoring;
200206
this.repo = config.repo || '';
@@ -213,21 +219,19 @@ export default class API {
213219
this.mergeMethod = config.squashMerges ? 'squash' : 'merge';
214220
this.cmsLabelPrefix = config.cmsLabelPrefix;
215221
this.initialWorkflowStatus = config.initialWorkflowStatus;
222+
this.baseUrl = config.baseUrl;
223+
this.getUser = config.getUser;
216224
}
217225

218226
static DEFAULT_COMMIT_MESSAGE = 'Automatically generated by Decap CMS';
219227

220228
user(): Promise<{ name: string; login: string }> {
221229
if (!this._userPromise) {
222-
this._userPromise = this.getUser();
230+
this._userPromise = this.getUser({ token: this.token });
223231
}
224232
return this._userPromise;
225233
}
226234

227-
getUser() {
228-
return this.request('/user') as Promise<GitHubUser>;
229-
}
230-
231235
async hasWriteAccess() {
232236
try {
233237
const result: Octokit.ReposGetResponse = await this.request(this.repoURL);
@@ -251,7 +255,7 @@ export default class API {
251255
};
252256

253257
if (this.token) {
254-
baseHeader.Authorization = `token ${this.token}`;
258+
baseHeader.Authorization = `${this.tokenKeyword} ${this.token}`;
255259
return Promise.resolve(baseHeader);
256260
}
257261

@@ -576,7 +580,7 @@ export default class API {
576580
}
577581

578582
try {
579-
const user: GitHubUser = await this.request(`/users/${pullRequest.user.login}`);
583+
const user = await this.user();
580584
return user.name || user.login;
581585
} catch {
582586
return;

‎packages/decap-cms-backend-github/src/GraphQLAPI.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ export default class GraphQLAPI extends API {
108108
headers: {
109109
'Content-Type': 'application/json; charset=utf-8',
110110
...headers,
111-
authorization: this.token ? `token ${this.token}` : '',
111+
authorization: this.token ? `${this.tokenKeyword} ${this.token}` : '',
112112
},
113113
};
114114
});

0 commit comments

Comments
 (0)