|
| 1 | +import { FastifyBaseLogger, FastifyPluginAsync } from "fastify"; |
| 2 | +import { |
| 3 | + UnauthenticatedError, |
| 4 | + ValidationError, |
| 5 | +} from "../../../common/errors/index.js"; |
| 6 | +import * as z from "zod/v4"; |
| 7 | +import { |
| 8 | + checkPaidMembershipFromRedis, |
| 9 | + checkPaidMembershipFromTable, |
| 10 | +} from "../../functions/membership.js"; |
| 11 | +import rateLimiter from "api/plugins/rateLimiter.js"; |
| 12 | +import { FastifyZodOpenApiTypeProvider } from "fastify-zod-openapi"; |
| 13 | +import { withTags } from "api/components/index.js"; |
| 14 | +import jwt, { Algorithm } from "jsonwebtoken"; |
| 15 | +import { getJwksKey } from "api/plugins/auth.js"; |
| 16 | +import { issueAppleWalletMembershipCard } from "api/functions/mobileWallet.js"; |
| 17 | +import { Redis } from "api/types.js"; |
| 18 | + |
| 19 | +const UIUC_TENANT_ID = "44467e6f-462c-4ea2-823f-7800de5434e3"; |
| 20 | +const COULD_NOT_PARSE_MESSAGE = "ID token could not be parsed."; |
| 21 | + |
| 22 | +export const verifyUiucIdToken = async ({ |
| 23 | + idToken, |
| 24 | + redisClient, |
| 25 | + logger, |
| 26 | +}: { |
| 27 | + idToken: string | string[] | undefined; |
| 28 | + redisClient: Redis; |
| 29 | + logger: FastifyBaseLogger; |
| 30 | +}) => { |
| 31 | + if (!idToken) { |
| 32 | + throw new UnauthenticatedError({ |
| 33 | + message: "ID token not found.", |
| 34 | + }); |
| 35 | + } |
| 36 | + if (Array.isArray(idToken)) { |
| 37 | + throw new ValidationError({ |
| 38 | + message: "Multiple tokens cannot be specified!", |
| 39 | + }); |
| 40 | + } |
| 41 | + const decoded = jwt.decode(idToken, { complete: true }); |
| 42 | + if (!decoded) { |
| 43 | + throw new UnauthenticatedError({ |
| 44 | + message: COULD_NOT_PARSE_MESSAGE, |
| 45 | + }); |
| 46 | + } |
| 47 | + const header = decoded?.header; |
| 48 | + if (!header.kid) { |
| 49 | + throw new UnauthenticatedError({ |
| 50 | + message: COULD_NOT_PARSE_MESSAGE, |
| 51 | + }); |
| 52 | + } |
| 53 | + const signingKey = await getJwksKey({ |
| 54 | + redisClient, |
| 55 | + kid: header.kid, |
| 56 | + logger, |
| 57 | + }); |
| 58 | + const verifyOptions: jwt.VerifyOptions = { |
| 59 | + algorithms: ["RS256" as Algorithm], |
| 60 | + issuer: `https://login.microsoftonline.com/${UIUC_TENANT_ID}/v2.0`, |
| 61 | + }; |
| 62 | + let verifiedData; |
| 63 | + try { |
| 64 | + verifiedData = jwt.verify(idToken, signingKey, verifyOptions) as { |
| 65 | + preferred_username?: string; |
| 66 | + email?: string; |
| 67 | + name?: string; |
| 68 | + }; |
| 69 | + } catch (e) { |
| 70 | + if (e instanceof Error && e.name === "TokenExpiredError") { |
| 71 | + throw new UnauthenticatedError({ |
| 72 | + message: "Access token has expired.", |
| 73 | + }); |
| 74 | + } |
| 75 | + if (e instanceof Error && e.name === "JsonWebTokenError") { |
| 76 | + logger.error(e); |
| 77 | + throw new UnauthenticatedError({ |
| 78 | + message: COULD_NOT_PARSE_MESSAGE, |
| 79 | + }); |
| 80 | + } |
| 81 | + throw e; |
| 82 | + } |
| 83 | + return verifiedData; |
| 84 | +}; |
| 85 | + |
| 86 | +const mobileWalletV2Route: FastifyPluginAsync = async (fastify, _options) => { |
| 87 | + fastify.register(rateLimiter, { |
| 88 | + limit: 15, |
| 89 | + duration: 30, |
| 90 | + rateLimitIdentifier: "mobileWalletV2", |
| 91 | + }); |
| 92 | + fastify.withTypeProvider<FastifyZodOpenApiTypeProvider>().get( |
| 93 | + "/membership", |
| 94 | + { |
| 95 | + schema: withTags(["Mobile Wallet"], { |
| 96 | + summary: "Retrieve mobile wallet pass for ACM member.", |
| 97 | + headers: z.object({ |
| 98 | + "x-uiuc-id-token": z.jwt().min(1).meta({ |
| 99 | + description: |
| 100 | + "An access token for the user in the UIUC Entra ID tenant.", |
| 101 | + }), |
| 102 | + }), |
| 103 | + response: { |
| 104 | + 204: { |
| 105 | + description: "A mobile wallet pass has been generated.", |
| 106 | + content: { |
| 107 | + "application/vnd.apple.pkpass": { |
| 108 | + schema: z.any(), |
| 109 | + description: |
| 110 | + "A pkpass file which contains the user's ACM @ UIUC membership pass.", |
| 111 | + }, |
| 112 | + }, |
| 113 | + }, |
| 114 | + }, |
| 115 | + }), |
| 116 | + }, |
| 117 | + async (request, reply) => { |
| 118 | + const idToken = request.headers["x-uiuc-id-token"]; |
| 119 | + const verifiedData = await verifyUiucIdToken({ |
| 120 | + idToken, |
| 121 | + redisClient: fastify.redisClient, |
| 122 | + logger: request.log, |
| 123 | + }); |
| 124 | + const { preferred_username: upn, email, name } = verifiedData; |
| 125 | + if (!upn || !email || !name) { |
| 126 | + throw new UnauthenticatedError({ |
| 127 | + message: COULD_NOT_PARSE_MESSAGE, |
| 128 | + }); |
| 129 | + } |
| 130 | + const netId = upn.replace("@illinois.edu", ""); |
| 131 | + if (netId.includes("@")) { |
| 132 | + request.log.error( |
| 133 | + `Found UPN ${upn} which cannot be turned into NetID via simple replacement.`, |
| 134 | + ); |
| 135 | + throw new ValidationError({ |
| 136 | + message: "ID token could not be parsed.", |
| 137 | + }); |
| 138 | + } |
| 139 | + let isPaidMember = await checkPaidMembershipFromRedis( |
| 140 | + netId, |
| 141 | + fastify.redisClient, |
| 142 | + request.log, |
| 143 | + ); |
| 144 | + if (isPaidMember === null) { |
| 145 | + isPaidMember = await checkPaidMembershipFromTable( |
| 146 | + netId, |
| 147 | + fastify.dynamoClient, |
| 148 | + ); |
| 149 | + } |
| 150 | + |
| 151 | + if (!isPaidMember) { |
| 152 | + throw new UnauthenticatedError({ |
| 153 | + message: `${upn} is not a paid member.`, |
| 154 | + }); |
| 155 | + } |
| 156 | + |
| 157 | + const pkpass = await issueAppleWalletMembershipCard( |
| 158 | + { smClient: fastify.secretsManagerClient }, |
| 159 | + fastify.environmentConfig, |
| 160 | + fastify.runEnvironment, |
| 161 | + upn, |
| 162 | + upn, |
| 163 | + request.log, |
| 164 | + name, |
| 165 | + ); |
| 166 | + await reply |
| 167 | + .header("Content-Type", "application/vnd.apple.pkpass") |
| 168 | + .send(pkpass); |
| 169 | + }, |
| 170 | + ); |
| 171 | +}; |
| 172 | + |
| 173 | +export default mobileWalletV2Route; |
0 commit comments