meili-ng/meiling.js

meiliNG: Easy Identity/Login Infrastructure, Next Generation. Supports oAuth2 and OpenID Connect specifications

meiling.js's Issues

Add Automated Tests

Create Automated Tests for Testing meiliNG/oAuth2 Endpoints.

Implement meiling endpoints for editing applications

Things to implement

• Basic Check of User Authentication
• Revoking User Application Authentication
• Deleting Application
• Authorized Permissions
• Redirect URI updates
• Add/Remove Allowed Permissions on Application
• Add/Remove Client Secret
• Creating Application

Add OAuth2.0 and OpenID Connect Discovery endpoints

https://swagger.io/docs/specification/authentication/openid-connect-discovery/

https://[base-server-url]/.well-known/openid-configuration
https://[base-server-url]/.well-known/oauth-authorization-server

Implement /v1/meiling/signup

Prerequisites

#5, #6

Use `fastify-swagger` for Machine generated API docs

[https://github.com/fastify/fastify-swagger]

Create Public `staging` server

Currently, Testing Full functionality of Meiling Gatekeeper requires a proper frontend:

Which is available as following:

• Stella IT's proprietary frontend (hosted on Stella IT Accounts)
• an open-source frontend based on React (https://github.com/stella-IT/meiling-dev.stella-it.com)
  -> development was ceased due to favor of new proprietary frontend based on vue + nuxt.js.

But testing requires proper frontend at the moment.
Therefore, We can host Stella IT's proprietary frontend (with removed some proprietary stuff that only works on Stella IT's internal fork. e.g. Stella IT Korean ID Verification System, E2E Session Exchange) on fe.staging.meili.ng for everyone to test it out.

Essential scopes doesn't setup upon installation

Essential scopes such as openid, profile, email doesn't setup since table Permission is empty on clean installation.

Please refer OpenID Connect Spec for details.

Fix wrongly configured CORS policy on /v1/oauth/*

Currently CORS Policy for /v1/meiling/* is enforced on /v1/oauth/*.
This seems to be a relatively easy fix.

CORS policy for /v1/oauth/* should be wildcard.
Since JavaScript Applications can access it.

Implement Opensource frontend of meiliNG

Currently it is implemented by @kdhkr, but due to lack of API Docs, This seems to be a hard task.
This issue is for tracking any issues arise from implementing opensource frontend of meiliNG

Implement Client_Secret less implicit flows

If the client doesn't have registered client_secret, It will be considered as public application.

Public applications can NOT have proper client_secret, therefore PKCE as defined on #1 should be implemented beforehand.

Use Fastify's Request Validation instead of Implementation of its own

• building schema using TypeBox
• fastify validation

Prisma 5 Migration

Make code utilize Fastify's automatic error handling

• #42
  ex. throw new Meiling.V1.Error({ type: Meiling.V1.Error.ErrorType.INVALID_REQUEST })
• make sure error returned by implemenation of #38 to have backwards compatibility with previous errors.

Add support for automated account deletion

Requested by @o0000ol

Implement PKCE

/auth and /token endpoints should implement PKCE (Proof Key for Code Exchange)

Video Reference

Implement email/phone verification

Things to do

• Add external notification api configuration point (currently, private repository)
• Create common function to call external notification api
• implement phone verification in session

Implement /v1/oauth2/tokeninfo

https://developers.google.com/identity/sign-in/web/backend-auth#calling-the-tokeninfo-endpoint

• Implemented for access_token
• Implemented for refresh_token
• Implemented for id_token

Add support for SAML 2.0

Since there are several services that utilizes SAML 2.0 (e.g. Notion.so).
how about consider supporting one?

e.g. https://www.notion.so/help/saml-sso-configuration

Implement South Korean NPKI based Authentication

Reference:
https://openapi.kftc.or.kr/main

Add support for LDAP

https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol

Use `filterJson` prisma experimental feature

Since meiling is using Prisma 3.7.0. We can now utilize Database-side implementation of JSON filtering. Which significantly improves performance than current approach (getting all, run Array.prototype.filter() on meiling)

Docs: https://www.prisma.io/docs/concepts/components/prisma-client/working-with-fields/working-with-json-fields

---

Requested by @Baw-Appie

Implement /v1/oauth2/token

Grant Type

Minimum Requirements

• authorization_code
  • PKCE #1
• refresh_token

MVP Requirements

• device_code

OpenID Connect Core Certification

Current Progress

implement signup options

meiling should able to define user data to collect (ex. firstname = optional).
This should be implemented in config.json

Create Password Reset

Feature to implement

User should able to reset password since a lot of user forgot their password, and very frequently.

Implement flow

• Requesting challenge
• Verify Challenge
• Change Password

WebAuthn Requests are not validated properly

Fix misuse of term: authorization and authentication on Interfaces

Escalated from Stella IT Community Discord.
Reported by @RutsuKun

Migrate `sendMeilingError` based Error handling to `fastify`'s internal `Error` throw detection

Is it possible to provide a test account?

A publicly available test account is required for client unit testing.

This is an example that requires a publicly available test account.
@zeroday0619/httpx-oauth/commit/c1a27f281e1d906cd50d16de0e88bd568eff4f1c

FASTIFY_LISTEN configuration for UNIX Socket does not work

How to reproduce

1. Use meiliNG v0.9.5 or later
2. Set FASTIFY_LISTEN to unix socket path
3. Start meiliNG with yarn start
4. See fastify logs reporting meiliNG has started up with wrong port.

Add Passwordless Sign-in(WebAuthn) Support

Implement OpenID id_token

The /v1/oauth/token endpoint should return JWT based id_token when it was requested with openid permission.