Allow oauth2 clients to exercise permissions independent to the user

.drone.yml

@@ -24,12 +24,33 @@ steps:
         from_secret: deploy_ssh_port
       script:
         - cd /home/coreid/CoreID
+        - git checkout master
+        - git pull
+        - git checkout ${DRONE_TAG}
         - git pull
         - yarn install
     when:
       event:
         - tag
         - promote
+  - name: restart production services
+    image: appleboy/drone-ssh
+    settings:
+      host:
+        from_secret: deploy_ssh_host
+      username:
+        from_secret: deploy_ssh_admin_user
+      key:
+        from_secret: deploy_ssh_key
+      port:
+        from_secret: deploy_ssh_port
+      script:
+        - systemctl restart coreid-www
+        - systemctl restart coreid-jobs
+    when:
+      event:
+        - tag
+        - promote
   - name: send success notifications
     image: plugins/webhook
     settings:

app/ldap/controllers/Users.controller.js

@@ -218,10 +218,12 @@ class UsersController extends LDAPController {
     // TODO flitter-orm chunk query
     // TODO generalize scoped search logic
     async search_people(req, res, next) {
-        if ( !req.user.can('ldap:search:users') ) {
+        if ( !req.user.can('ldap:search:users:me') ) {
             return next(new LDAP.InsufficientAccessRightsError())
         }
 
+        const can_search_all = req.user.can('ldap:search:users')
+
         const iam_targets = this.parse_iam_targets(req.filter)
         if ( req.scope === 'base' ) {
             // If scope is base, check if the base DN matches the filter.
@@ -231,7 +233,12 @@ class UsersController extends LDAPController {
             const user = await this.get_resource_from_dn(req.dn)
 
             // Make sure the user is ldap visible && match the filter
-            if ( user && user.ldap_visible && req.filter.matches(await user.to_ldap(iam_targets)) ) {
+            if (
+                user
+                && user.ldap_visible
+                && req.filter.matches(await user.to_ldap(iam_targets))
+                && (req.user.id === user.id || can_search_all)
+            ) {
 
                 // If so, send the object
                 res.send({
@@ -255,6 +262,7 @@ class UsersController extends LDAPController {
             // Fetch the LDAP-visible users
             const users = await this.User.ldap_directory()
             for ( const user of users ) {
+                if ( user.id !== req.user.id && !can_search_all ) continue
 
                 // Make sure the user os of the appropriate scope
                 if ( req.dn.equals(user.dn) || user.dn.parent().equals(req.dn) ) {
@@ -283,6 +291,7 @@ class UsersController extends LDAPController {
             this.output.debug(`Filter:`)
             this.output.debug(this.filter_to_obj(req.filter.json))
             for ( const user of users ) {
+                if ( user.id !== req.user.id && !can_search_all ) continue
                 this.output.debug(`Checking ${user.uid}...`)
                 this.output.debug(`DN: ${user.dn}`)
                 this.output.debug(`Req DN equals: ${req.dn.equals(user.dn)}`)

app/routing/middleware/api/Permission.middleware.js

@@ -17,13 +17,18 @@ class PermissionMiddleware extends Middleware {
                     req,
                     reason,
                     check,
-                    oauth_client_id: req.oauth.client.id,
+                    oauth_client_id: req.oauth.client.uuid,
                 })
 
                 return res.status(401)
                     .message('Insufficient permissions (OAuth2 Client).')
                     .api()
             }
+
+            // If the oauth2 client has this permission, then allow the request to continue,
+            // even if the user does not.
+            // OAuth2Clients need to be able to query users via the API.
+            return next()
         }
 
         const policy_denied = await Policy.check_user_denied(req.user, check)

app/routing/middleware/auth/APIRoute.middleware.js

@@ -7,9 +7,11 @@ class APIRouteMiddleware extends Middleware {
 
     async test(req, res, next, { allow_token = true, allow_user = true }) {
         // First, check if there is a user in the session.
-        if ( allow_user && req.is_auth ) {
+        if ( allow_user && req.user ) {
             return next()
         } else if ( allow_token ) {
+            if ( !req.oauth ) req.oauth = {}
+
             return req.app.oauth2.authorise()(req, res, async e => {
                 if ( e ) return next(e)
                 // Look up the OAuth2 client an inject it into the route
@@ -51,10 +53,10 @@ class APIRouteMiddleware extends Middleware {
 
                 next()
             })
-        }
+        } else {
-
             return res.status(401).api()
         }
     }
+}
 
 module.exports = exports = APIRouteMiddleware

config/auth.config.js

@@ -194,6 +194,7 @@ const auth_config = {
 
             // LDAP Binding
             'ldap:bind',
+            'ldap:search:users:me',
         ],
 
         root: ['v1', 'ldap', 'saml', 'profile', 'oauth', 'app', 'auth', 'iam'],