feat: move sso and ldap logins into plugins (C2)

src/backend/database/routes/auth-compat-routes.ts

@@ -0,0 +1,165 @@
+/**
+ * The 2.8 login URLs that something outside Termix still depends on:
+ * identity providers configured with the old callback and back-channel
+ * logout URLs, and clients built against 2.8 such as Termix-Mobile. Each one
+ * forwards to the login method or plugin route that replaced it, so none of
+ * them can sign anyone in on its own.
+ */
+
+import type { Request, Router } from "express";
+import { authLogger } from "../../utils/logger.js";
+import { getRequestBasePath } from "../../utils/request-origin.js";
+import {
+  listLegacySsoProviders,
+  startRedirectLogin,
+  verifyFormLogin,
+} from "./auth-routes.js";
+
+/**
+ * A path on this install, keeping the query string. Relative, so the browser
+ * stays on the scheme and host it used, whatever a proxy told us.
+ */
+function pluginUrl(req: Request, path: string): string {
+  const query = req.originalUrl.indexOf("?");
+  return `${getRequestBasePath(req)}${path}${
+    query >= 0 ? req.originalUrl.slice(query) : ""
+  }`;
+}
+
+export function registerAuthCompatRoutes(router: Router): void {
+  /**
+   * @openapi
+   * /users/oidc-config:
+   *   get:
+   *     summary: Get the default SSO provider's public configuration (2.8 route)
+   *     description: Kept for 2.8 clients. Redirects to the sso plugin's /plugin-api/sso/config.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       307:
+   *         description: Redirect to the sso plugin.
+   */
+  router.get("/oidc-config", (req, res) => {
+    res.redirect(307, pluginUrl(req, "/plugin-api/sso/config"));
+  });
+
+  /**
+   * @openapi
+   * /users/oidc/authorize:
+   *   get:
+   *     summary: Start an SSO login (2.8 route)
+   *     description: Kept for 2.8 clients such as Termix-Mobile. Same as /users/auth/oidc/start, with the provider in providerId.
+   *     tags:
+   *       - Auth
+   *     parameters:
+   *       - in: query
+   *         name: providerId
+   *         schema:
+   *           type: string
+   *       - in: query
+   *         name: rememberMe
+   *         schema:
+   *           type: boolean
+   *     responses:
+   *       200:
+   *         description: The authorization URL in auth_url.
+   *       404:
+   *         description: SSO is not available.
+   */
+  router.get("/oidc/authorize", (req, res) =>
+    startRedirectLogin(
+      req,
+      res,
+      "oidc",
+      typeof req.query.providerId === "string" && req.query.providerId
+        ? req.query.providerId
+        : null,
+    ),
+  );
+
+  /**
+   * @openapi
+   * /users/oidc/callback:
+   *   get:
+   *     summary: SSO callback (2.8 URL)
+   *     description: The redirect URI identity providers were set up with before 2.9. Permanently redirects to /plugin-api/sso/callback with the same query, so existing provider configurations keep working.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       308:
+   *         description: Redirect to the sso plugin's callback.
+   *   post:
+   *     summary: SSO callback, form post (2.8 URL)
+   *     description: Same as the GET form.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       308:
+   *         description: Redirect to the sso plugin's callback.
+   */
+  router.all("/oidc/callback", (req, res) => {
+    res.redirect(308, pluginUrl(req, "/plugin-api/sso/callback"));
+  });
+
+  /**
+   * @openapi
+   * /users/oidc/backchannel-logout:
+   *   post:
+   *     summary: OIDC back-channel logout (2.8 URL)
+   *     description: Permanently redirects to /plugin-api/sso/backchannel-logout, so identity providers set up before 2.9 keep working.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       308:
+   *         description: Redirect to the sso plugin.
+   */
+  router.post("/oidc/backchannel-logout", (req, res) => {
+    res.redirect(308, pluginUrl(req, "/plugin-api/sso/backchannel-logout"));
+  });
+
+  /**
+   * @openapi
+   * /users/sso-providers:
+   *   get:
+   *     summary: List sign-in providers (2.8 route)
+   *     description: Kept for 2.8 clients. Every enabled instance of every external login method, in the 2.8 shape. /users/auth/methods is the current route.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       200:
+   *         description: Providers.
+   */
+  router.get("/sso-providers", async (_req, res) => {
+    try {
+      res.json(await listLegacySsoProviders());
+    } catch (error) {
+      authLogger.error("Failed to list SSO providers", error);
+      res.status(500).json({ error: "Failed to list SSO providers" });
+    }
+  });
+
+  /**
+   * @openapi
+   * /users/ldap/login:
+   *   post:
+   *     summary: LDAP login (2.8 route)
+   *     description: Kept for 2.8 clients. Same as /users/auth/ldap/verify, with the provider in providerId.
+   *     tags:
+   *       - Auth
+   *     responses:
+   *       200:
+   *         description: Login successful, or a second factor is required.
+   *       401:
+   *         description: Invalid credentials.
+   *       404:
+   *         description: LDAP is not available.
+   */
+  router.post("/ldap/login", (req, res) =>
+    verifyFormLogin(
+      req,
+      res,
+      "ldap",
+      req.body?.providerId != null ? String(req.body.providerId) : null,
+    ),
+  );
+}