@uppy/companion: remove oauthOrigin

[aduh95]

No description provided.

[github-actions]

Diff output files

diff --git a/packages/@uppy/companion/lib/config/companion.js b/packages/@uppy/companion/lib/config/companion.js
index 5931656..1839910 100644
--- a/packages/@uppy/companion/lib/config/companion.js
+++ b/packages/@uppy/companion/lib/config/companion.js
@@ -107,8 +107,8 @@ const validateConfig = (companionOptions) => {
       "startup.uploadUrls",
     );
   }
-  if (!companionOptions.oauthOrigin) {
-    throw new TypeError("Option oauthOrigin is required. To disable security, pass \"*\"");
+  if (companionOptions.corsOrigins == null) {
+    throw new TypeError("Option corsOrigins is required. To disable security, pass true");
   }
   if (
     periodicPingUrls != null && (!Array.isArray(periodicPingUrls)
diff --git a/packages/@uppy/companion/lib/server/controllers/connect.d.ts b/packages/@uppy/companion/lib/server/controllers/connect.d.ts
index e2b73d9..668b7e4 100644
--- a/packages/@uppy/companion/lib/server/controllers/connect.d.ts
+++ b/packages/@uppy/companion/lib/server/controllers/connect.d.ts
@@ -1,2 +1,2 @@
-declare function _exports(req: object, res: object): void;
+declare function _exports(req: object, res: object, next: any): void;
 export = _exports;
diff --git a/packages/@uppy/companion/lib/server/controllers/connect.js b/packages/@uppy/companion/lib/server/controllers/connect.js
index 374cd76..7d7d616 100644
--- a/packages/@uppy/companion/lib/server/controllers/connect.js
+++ b/packages/@uppy/companion/lib/server/controllers/connect.js
@@ -1,42 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const oAuthState = require("../helpers/oauth-state");
-const queryString = (params, prefix = "?") => {
-  const str = new URLSearchParams(params).toString();
-  return str ? `${prefix}${str}` : "";
-};
 /**
- * initializes the oAuth flow for a provider.
- *
- * @param {object} req
- * @param {object} res
+ * Derived from `cors` npm package.
+ * @see https://github.com/expressjs/cors/blob/791983ebc0407115bc8ae8e64830d440da995938/lib/index.js#L19-L34
+ * @param {string} origin
+ * @param {*} allowedOrigins
+ * @returns {boolean}
  */
-module.exports = function connect(req, res) {
-  const { secret, oauthOrigin } = req.companion.options;
-  const stateObj = oAuthState.generateState();
-  // not sure if we need to store origin in the session state (e.g. we could've just gotten it directly inside send-token)
-  // but we're afraid to change the logic there
-  if (!Array.isArray(oauthOrigin)) {
-    // If the server only allows a single origin, we ignore the client-supplied
-    // origin from query because we don't need it.
-    stateObj.origin = oauthOrigin;
-  } else if (oauthOrigin.length < 2) {
-    // eslint-disable-next-line prefer-destructuring
-    stateObj.origin = oauthOrigin[0];
-  } else {
-    // If we have multiple allowed origins, we need to check the client-supplied origin from query.
-    // If the client provides an untrusted origin,
-    // we want to send `undefined`. `undefined` means `/`, which is the same origin when passed to `postMessage`.
-    // https://html.spec.whatwg.org/multipage/web-messaging.html#dom-window-postmessage-options-dev
-    const { origin } = JSON.parse(atob(req.query.state));
-    stateObj.origin = oauthOrigin.find(o => o === origin);
+function isOriginAllowed(origin, allowedOrigins) {
+  if (Array.isArray(allowedOrigins)) {
+    return allowedOrigins.some(allowedOrigin => isOriginAllowed(origin, allowedOrigin));
   }
-  if (req.companion.options.server.oauthDomain) {
-    stateObj.companionInstance = req.companion.buildURL("", true);
-  }
-  if (req.query.uppyPreAuthToken) {
-    stateObj.preAuthToken = req.query.uppyPreAuthToken;
+  if (typeof allowedOrigins === "string") {
+    return origin === allowedOrigins;
   }
+  return allowedOrigins.test?.(origin) ?? !!allowedOrigins;
+}
+const queryString = (params, prefix = "?") => {
+  const str = new URLSearchParams(params).toString();
+  return str ? `${prefix}${str}` : "";
+};
+function encodeStateAndRedirect(req, res, stateObj) {
+  const { secret } = req.companion.options;
   const state = oAuthState.encodeState(stateObj, secret);
   const { providerClass, providerGrantConfig } = req.companion;
   // pass along grant's dynamic config (if specified for the provider in its grant config `dynamic` section)
@@ -62,4 +48,62 @@ module.exports = function connect(req, res) {
   });
   // Now we redirect to grant's /connect endpoint, see `app.use(Grant(grantConfig))`
   res.redirect(req.companion.buildURL(`/connect/${oauthProvider}${qs}`, true));
+}
+function getClientOrigin(base64EncodedState) {
+  try {
+    const { origin } = JSON.parse(atob(base64EncodedState));
+    return origin;
+  } catch {
+    return undefined;
+  }
+}
+/**
+ * Initializes the oAuth flow for a provider.
+ *
+ * The client has open a new tab and is about to be redirected to the auth
+ * provider. When the user will return to companion, we'll have to send the auth
+ * token back to Uppy with `window.postMessage()`.
+ * To prevent other tabs and unauthorized origins from accessing that token, we
+ * reuse origin(s) from `corsOrigins` to limit the scope of `postMessage()`, which
+ * has `targetOrigin` parameter, required for cross-origin messages (i.e. if Uppy
+ * and Companion are served from different origins).
+ * We support multiple origins in `corsOrigins`, we have to figure out which
+ * origin the current connect request is coming from. Because the OAuth window
+ * was opened with `window.open()`, starting a new browsing context, the request
+ * is not cross origin and we don't have a `Origin` header to work with.
+ * That's why we use the client-provided base64-encoded parameter, check if it
+ * matches origin(s) allowed in `corsOrigins` Companion option, and use that as
+ * our `targetOrigin` for the `window.postMessage()` call (see `send-token.js`).
+ *
+ * @param {object} req
+ * @param {object} res
+ */
+module.exports = function connect(req, res, next) {
+  const stateObj = oAuthState.generateState();
+  if (req.companion.options.server.oauthDomain) {
+    stateObj.companionInstance = req.companion.buildURL("", true);
+  }
+  if (req.query.uppyPreAuthToken) {
+    stateObj.preAuthToken = req.query.uppyPreAuthToken;
+  }
+  // Get the computed header generated by `cors` in a previous middleware.
+  stateObj.origin = res.getHeader("Access-Control-Allow-Origin");
+  let clientOrigin;
+  if (!stateObj.origin && (clientOrigin = getClientOrigin(req.query.state))) {
+    const { corsOrigins } = req.companion.options;
+    if (typeof corsOrigins === "function") {
+      corsOrigins(clientOrigin, (err, finalOrigin) => {
+        if (err) {
+          next(err);
+        }
+        stateObj.origin = finalOrigin;
+        encodeStateAndRedirect(req, res, stateObj);
+      });
+      return;
+    }
+    if (isOriginAllowed(clientOrigin, req.companion.options.corsOrigins)) {
+      stateObj.origin = clientOrigin;
+    }
+  }
+  encodeStateAndRedirect(req, res, stateObj);
 };
diff --git a/packages/@uppy/companion/lib/server/controllers/index.d.ts b/packages/@uppy/companion/lib/server/controllers/index.d.ts
index a782333..044ac31 100644
--- a/packages/@uppy/companion/lib/server/controllers/index.d.ts
+++ b/packages/@uppy/companion/lib/server/controllers/index.d.ts
@@ -6,7 +6,7 @@ export let thumbnail: typeof import("./thumbnail");
 export let list: typeof import("./list");
 export let simpleAuth: typeof import("./simple-auth");
 export let logout: typeof import("./logout");
-export let connect: (req: any, res: any) => void;
+export let connect: (req: any, res: any, next: any) => void;
 export let preauth: typeof import("./preauth");
 export let redirect: (req: any, res: any) => void;
 export let refreshToken: typeof import("./refresh-token");
diff --git a/packages/@uppy/companion/lib/standalone/helper.js b/packages/@uppy/companion/lib/standalone/helper.js
index fa5d55f..5c3e44d 100644
--- a/packages/@uppy/companion/lib/standalone/helper.js
+++ b/packages/@uppy/companion/lib/standalone/helper.js
@@ -40,9 +40,18 @@ const hasProtocol = (url) => {
 const companionProtocol = process.env.COMPANION_PROTOCOL || "http";
 function getCorsOrigins() {
   if (process.env.COMPANION_CLIENT_ORIGINS) {
-    return process.env.COMPANION_CLIENT_ORIGINS
-      .split(",")
-      .map((url) => (hasProtocol(url) ? url : `${companionProtocol}://${url}`));
+    switch (process.env.COMPANION_CLIENT_ORIGINS) {
+      case "true":
+        return true;
+      case "false":
+        return false;
+      case "*":
+        return "*";
+      default:
+        return process.env.COMPANION_CLIENT_ORIGINS
+          .split(",")
+          .map((url) => (hasProtocol(url) ? url : `${companionProtocol}://${url}`));
+    }
   }
   if (process.env.COMPANION_CLIENT_ORIGINS_REGEX) {
     return new RegExp(process.env.COMPANION_CLIENT_ORIGINS_REGEX);
@@ -179,9 +188,6 @@ const getConfigFromEnv = () => {
     corsOrigins: getCorsOrigins(),
     testDynamicOauthCredentials: process.env.COMPANION_TEST_DYNAMIC_OAUTH_CREDENTIALS === "true",
     testDynamicOauthCredentialsSecret: process.env.COMPANION_TEST_DYNAMIC_OAUTH_CREDENTIALS_SECRET,
-    oauthOrigin: process.env.COMPANION_OAUTH_ORIGIN?.includes(",")
-      ? process.env.COMPANION_OAUTH_ORIGIN.split(",")
-      : process.env.COMPANION_OAUTH_ORIGIN,
   };
 };
 /**

[Murderlon]

Let's link to this option in the docs

[Murderlon]

Code LGTM.