From 20356a17d81b30d65b1ce0874d53f17535a599ec Mon Sep 17 00:00:00 2001
From: Igor Serebryany <igor47@moomers.org>
Date: Fri, 6 Oct 2023 15:11:45 -0700
Subject: [PATCH] proxy auth users don't get a token

otherwise, they will stay logged in even after the proxy auth has
disabled them (with the saved token in the local store)
---
 server/Auth.js              | 10 ++++++++--
 server/objects/user/User.js | 23 +++++++++++++++--------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/server/Auth.js b/server/Auth.js
index eb0927b39..ede011c74 100644
--- a/server/Auth.js
+++ b/server/Auth.js
@@ -63,7 +63,7 @@ class Auth {
     }
 
     if (token == null && proxyUsername == null) {
-      Logger.error('Api called without a token and proxy auth is disabled', req.path)
+      Logger.error('Api called without a token and no proxy auth provided', req.path)
       return res.sendStatus(401)
     }
 
@@ -158,6 +158,8 @@ class Auth {
       email,
       type: 'user',
       isActive: true,
+      token: null,
+      isFromProxy: true,
     }
 
     return await this.createUser(account)
@@ -178,7 +180,11 @@ class Auth {
 
     account.pash = await this.hashPass(password)
 
-    account.token = await this.generateAccessToken({ userId: account.id, username })
+    // proxy users don't get a token
+    if (!account.isFromProxy) {
+      account.token = await this.generateAccessToken({ userId: account.id, username })
+    }
+
     account.createdAt = Date.now()
     const newUser = new User(account)
 
diff --git a/server/objects/user/User.js b/server/objects/user/User.js
index a9c9c767b..21ee8d7a0 100644
--- a/server/objects/user/User.js
+++ b/server/objects/user/User.js
@@ -24,6 +24,8 @@ class User {
     this.librariesAccessible = [] // Library IDs (Empty if ALL libraries)
     this.itemTagsSelected = [] // Empty if ALL item tags accessible
 
+    this.isFromProxy = false  // whether the user was authenticated in the proxy layer
+
     if (user) {
       this.construct(user)
     }
@@ -90,7 +92,8 @@ class User {
       createdAt: this.createdAt,
       permissions: this.permissions,
       librariesAccessible: [...this.librariesAccessible],
-      itemTagsSelected: [...this.itemTagsSelected]
+      itemTagsSelected: [...this.itemTagsSelected],
+      isFromProxy: this.isFromProxy,
     }
   }
 
@@ -111,7 +114,8 @@ class User {
       createdAt: this.createdAt,
       permissions: this.permissions,
       librariesAccessible: [...this.librariesAccessible],
-      itemTagsSelected: [...this.itemTagsSelected]
+      itemTagsSelected: [...this.itemTagsSelected],
+      isFromProxy: this.isFromProxy,
     }
     if (minimal) {
       delete json.mediaProgress
@@ -183,6 +187,9 @@ class User {
 
     this.librariesAccessible = [...(user.librariesAccessible || [])]
     this.itemTagsSelected = [...(user.itemTagsSelected || [])]
+
+
+    this.isFromProxy = false
   }
 
   update(payload) {
@@ -261,7 +268,7 @@ class User {
 
   /**
    * Get first available library id for user
-   * 
+   *
    * @param {string[]} libraryIds
    * @returns {string|null}
    */
@@ -332,9 +339,9 @@ class User {
 
   /**
    * Checks if a user can access a library item
-   * @param {string} libraryId 
-   * @param {boolean} explicit 
-   * @param {string[]} tags 
+   * @param {string} libraryId
+   * @param {boolean} explicit
+   * @param {string[]} tags
    */
   checkCanAccessLibraryItemWithData(libraryId, explicit, tags) {
     if (!this.checkCanAccessLibrary(libraryId)) return false
@@ -398,7 +405,7 @@ class User {
   /**
    * Number of podcast episodes not finished for library item
    * Note: libraryItem passed in from libraryHelpers is not a LibraryItem class instance
-   * @param {LibraryItem|object} libraryItem 
+   * @param {LibraryItem|object} libraryItem
    * @returns {number}
    */
   getNumEpisodesIncompleteForPodcast(libraryItem) {
@@ -413,4 +420,4 @@ class User {
     return numEpisodesIncomplete
   }
 }
-module.exports = User
\ No newline at end of file
+module.exports = User