[WIP] API Key auth

core/server/api/index.js

@@ -272,6 +272,7 @@ http = (apiMethod) => {
                 context: {
                     // @TODO: forward the client and user obj (options.context.user.id)
                     user: ((req.user && req.user.id) || (req.user && models.User.isExternalUser(req.user.id))) ? req.user.id : null,
+                    api_key: (req.api_key && req.api_key.id) ? req.api_key.id : null,
                     client: (req.client && req.client.slug) ? req.client.slug : null,
                     client_id: (req.client && req.client.id) ? req.client.id : null
                 }

core/server/api/invites.js

@@ -163,7 +163,7 @@ const invites = {
                     return invite.destroy(options);
                 })
                 .then(() => {
-                    return options; 
+                    return options;
                 });
         }
 
@@ -193,7 +193,10 @@ const invites = {
                 const loggedInUserRole = loggedInUser.related('roles').models[0].get('name');
                 let allowed = [];
 
-                if (loggedInUserRole === 'Owner' || loggedInUserRole === 'Administrator') {
+                let userHasAdminRole = options.context.user && (loggedInUserRole === 'Owner' || loggedInUserRole === 'Administrator');
+
+                // admin api keys have an equivalent of the Adminstrator role
+                if (options.context.api_key || userHasAdminRole) {
                     allowed = ['Administrator', 'Editor', 'Author', 'Contributor'];
                 } else if (loggedInUserRole === 'Editor') {
                     allowed = ['Author', 'Contributor'];
@@ -205,7 +208,7 @@ const invites = {
                     }));
                 }
             }).then(() => {
-                return options; 
+                return options;
             });
         }
 
@@ -234,11 +237,29 @@ const invites = {
                 });
         }
 
+        function fetchOwner(options) {
+            return models.User.getOwnerUser(merge({}, omit(options, 'data'), {withRelated: ['roles']}))
+                .then((owner) => {
+                    loggedInUser = owner;
+                    return options;
+                });
+        }
+
+        // API Key requests are not tied to a user so send the invite from the
+        // owner user instead
+        function fetchLoggedInUserOrOwner(options) {
+            if (options.context.api_key && !options.context.user) {
+                return fetchOwner(options);
+            }
+
+            return fetchLoggedInUser(options);
+        }
+
         tasks = [
             localUtils.validate(docName, {opts: ['email']}),
             localUtils.convertOptions(allowedIncludes),
             localUtils.handlePermissions(docName, 'add'),
-            fetchLoggedInUser,
+            fetchLoggedInUserOrOwner,
             validation,
             checkIfUserExists,
             destroyOldInvite,

core/server/api/mail.js

@@ -100,6 +100,7 @@ const apiMail = {
      * @param {Object} options required property 'to' which contains the recipient address
      * @returns {Promise}
      */
+    // TODO: ensure this can't be triggered by API Key requests
     sendTest(options) {
         let tasks;
 

core/server/api/posts.js

@@ -45,7 +45,8 @@ posts = {
 
         // Workaround to remove static pages from results
         // TODO: rework after https://github.com/TryGhost/Ghost/issues/5151
-        if (options && options.context && (options.context.user || options.context.internal)) {
+        // TODO: always allow staticPages for v2 Admin API requests?
+        if (options && options.context && (options.context.user || options.context.api_key || options.context.internal)) {
             extraOptions.push('staticPages');
         }
         permittedOptions = localUtils.browseDefaultOptions.concat(extraOptions);

core/server/api/users.js

@@ -129,6 +129,7 @@ users = {
          * @param {Object} options
          * @returns {Object} options
          */
+        // TODO: update for API Key requests which won't have options.context.user
         function handlePermissions(options) {
             if (options.id === 'me' && options.context && options.context.user) {
                 options.id = options.context.user;

core/server/data/migrations/versions/2.2/2-add-integrations-tables.js

@@ -0,0 +1,81 @@
+const commands = require('../../../schema').commands;
+const logging = require('../../../../lib/common/logging');
+const merge = require('lodash/merge');
+const models = require('../../../../models');
+const utils = require('../../../schema/fixtures/utils');
+const _private = {};
+
+_private.createTable = function createTable(table, message, options) {
+    return options.connection.schema.hasTable(table)
+        .then((exists) => {
+            if (exists) {
+                logging.warn(message);
+                return Promise.resolve();
+            }
+
+            logging.info(message);
+            return commands.createTable(table, options.connection);
+        });
+};
+
+_private.addIntegrationsTable = function addIntegrationsTable(options) {
+    let table = 'integrations';
+    let message = 'Adding "Integrations" table';
+
+    return _private.createTable(table, message, options);
+};
+
+_private.addApiKeysTable = function addApiKeysTable(options) {
+    let table = 'api_keys';
+    let message = 'Adding "API Keys" table';
+
+    return _private.createTable(table, message, options);
+};
+
+_private.addApiKeyRole = function addApiKeyRole(options) {
+    let message = 'Adding "Admin API Client" role to roles table';
+    let apiKeyRole = utils.findModelFixtureEntry('Role', {name: 'Admin API Client'});
+
+    return models.Role.findOne({name: apiKeyRole.name}, options)
+        .then((role) => {
+            if (!role) {
+                logging.info(message);
+                return utils.addFixturesForModel({
+                    name: 'Role',
+                    entries: [apiKeyRole]
+                }, options);
+            }
+
+            logging.warn(message);
+        });
+};
+
+_private.addApiKeyPermissions = function addApiKeyPermissions(options) {
+    let message = 'Adding permissions_roles fixtures for the admin_api_key role';
+    let relations = utils.findRelationFixture('Role', 'Permission');
+
+    return utils.addFixturesForRelation({
+        from: relations.from,
+        to: relations.to,
+        entries: {
+            'Admin API Client': relations.entries['Admin API Client']
+        }
+    }, options).then((result) => {
+        if (result.done === result.expected) {
+            logging.info(message);
+        }
+
+        logging.warn(`(${result.done}/${result.expected}) ${message}`);
+    });
+};
+
+module.exports.up = function setupIntegrations(options) {
+    let localOptions = merge({
+        context: {internal: true}
+    }, options);
+
+    return _private.addIntegrationsTable(localOptions)
+        .then(() => _private.addApiKeysTable(localOptions))
+        .then(() => _private.addApiKeyRole(localOptions))
+        .then(() => _private.addApiKeyPermissions(localOptions));
+};

core/server/data/schema/fixtures/fixtures.json

@@ -44,24 +44,28 @@
             "name": "Role",
             "entries": [
                 {
-                    "name":             "Administrator",
-                    "description":      "Administrators"
+                    "name": "Administrator",
+                    "description": "Administrators"
                 },
                 {
-                    "name":             "Editor",
-                    "description":      "Editors"
+                    "name": "Editor",
+                    "description": "Editors"
                 },
                 {
-                    "name":             "Author",
-                    "description":      "Authors"
+                    "name": "Author",
+                    "description": "Authors"
                 },
                 {
-                    "name":             "Contributor",
-                    "description":      "Contributors"
+                    "name": "Contributor",
+                    "description": "Contributors"
                 },
                 {
-                    "name":             "Owner",
-                    "description":      "Blog Owner"
+                    "name": "Owner",
+                    "description": "Blog Owner"
+                },
+                {
+                    "name": "Admin API Client",
+                    "description": "External Apps"
                 }
             ]
         },
@@ -332,6 +336,56 @@
                     "name": "Delete webhooks",
                     "action_type": "destroy",
                     "object_type": "webhook"
+                },
+                {
+                    "name": "Browse integrations",
+                    "action_type": "browse",
+                    "object_type": "integration"
+                },
+                {
+                    "name": "Read integrations",
+                    "action_type": "read",
+                    "object_type": "integration"
+                },
+                {
+                    "name": "Edit integrations",
+                    "action_type": "edit",
+                    "object_type": "integration"
+                },
+                {
+                    "name": "Add integrations",
+                    "action_type": "add",
+                    "object_type": "integration"
+                },
+                {
+                    "name": "Delete integrations",
+                    "action_type": "destroy",
+                    "object_type": "integration"
+                },
+                {
+                    "name": "Browse API keys",
+                    "action_type": "browse",
+                    "object_type": "api_key"
+                },
+                {
+                    "name": "Read API keys",
+                    "action_type": "read",
+                    "object_type": "api_key"
+                },
+                {
+                    "name": "Edit API keys",
+                    "action_type": "edit",
+                    "object_type": "api_key"
+                },
+                {
+                    "name": "Add API keys",
+                    "action_type": "add",
+                    "object_type": "api_key"
+                },
+                {
+                    "name": "Delete API keys",
+                    "action_type": "destroy",
+                    "object_type": "api_key"
                 }
             ]
         },
@@ -485,6 +539,24 @@
             "entries": {
                 "Administrator": {
                     "db": "all",
+                    "mail": "all",
+                    "notification": "all",
+                    "post": "all",
+                    "setting": "all",
+                    "slug": "all",
+                    "tag": "all",
+                    "theme": "all",
+                    "user": "all",
+                    "role": "all",
+                    "client": "all",
+                    "subscriber": "all",
+                    "invite": "all",
+                    "redirect": "all",
+                    "webhook": "all",
+                    "integration": "all",
+                    "api_key": "all"
+                },
+                "Admin API Client": {
                     "mail": "all",
                     "notification": "all",
                     "post": "all",

core/server/data/schema/schema.js

@@ -300,5 +300,34 @@ module.exports = {
         created_by: {type: 'string', maxlength: 24, nullable: false},
         updated_at: {type: 'dateTime', nullable: true},
         updated_by: {type: 'string', maxlength: 24, nullable: true}
+    },
+    integrations: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        name: {type: 'string', maxlength: 191, nullable: false},
+        slug: {type: 'string', maxlength: 191, nullable: false, unique: true},
+        icon: {type: 'string', maxlength: 2000, nullable: true},
+        description: {type: 'string', maxlength: 2000, nullable: true},
+        created_at: {type: 'dateTime', nullable: false},
+        created_by: {type: 'string', maxlength: 24, nullable: false},
+        updated_at: {type: 'dateTime', nullable: true},
+        updated_by: {type: 'string', maxlength: 24, nullable: true}
+    },
+    api_keys: {
+        id: {type: 'string', maxlength: 24, nullable: false, primary: true},
+        type: {
+            type: 'string',
+            maxlength: 50,
+            nullable: false,
+            validations: {isIn: [['content', 'admin']]}
+        },
+        secret: {type: 'string', maxlength: 191, nullable: false, unique: true, validations: {isLength: {min: 128}}},
+        role_id: {type: 'string', maxlength: 24, nullable: true},
+        integration_id: {type: 'string', maxlength: 24, nullable: true},
+        last_seen_at: {type: 'dateTime', nullable: true},
+        last_seen_version: {type: 'string', maxlength: 50, nullable: true},
+        created_at: {type: 'dateTime', nullable: false},
+        created_by: {type: 'string', maxlength: 24, nullable: false},
+        updated_at: {type: 'dateTime', nullable: true},
+        updated_by: {type: 'string', maxlength: 24, nullable: true}
     }
 };

core/server/models/api-key.js

@@ -0,0 +1,63 @@
+const crypto = require('crypto');
+const ghostBookshelf = require('./base');
+const {Role} = require('./role');
+
+const ApiKey = ghostBookshelf.Model.extend({
+    tableName: 'api_keys',
+
+    defaults() {
+        // 512bit key for HS256 JWT signing
+        let secret = crypto.randomBytes(64).toString('hex');
+
+        return {
+            secret
+        };
+    },
+
+    role() {
+        return this.belongsTo('Role');
+    },
+
+    integration() {
+        return this.belongsTo('Integration');
+    },
+
+    onSaving(/* model, attrs, options */) {
+        let tasks = [];
+
+        ghostBookshelf.Model.prototype.onSaving.apply(this, arguments);
+
+        // enforce roles which are currently hardcoded
+        // - admin key = Adminstrator role
+        // - content key = no role
+        if (this.hasChanged('type')) {
+            if (this.get('type') === 'admin') {
+                tasks.setAdminRole = Role.findOne({name: 'Admin API Client'}, {columns: ['id']})
+                    .then((role) => {
+                        this.set('role_id', role.get('id'));
+                    });
+            }
+
+            if (this.get('type') === 'content') {
+                this.set('role_id', null);
+            }
+        }
+
+        return Promise.props(tasks);
+    }
+}, {
+    add(data, unfilteredOptions) {
+        const options = ApiKey.filterOptions(unfilteredOptions, 'add');
+
+        return ghostBookshelf.Model.add.call(this, data, options);
+    }
+});
+
+const ApiKeys = ghostBookshelf.Collection.extend({
+    model: ApiKey
+});
+
+module.exports = {
+    ApiKey: ghostBookshelf.model('ApiKey', ApiKey),
+    ApiKeys: ghostBookshelf.collection('ApiKeys', ApiKeys)
+};