feat: srp removal

backend/src/services/auth/auth-fns.ts

@@ -1,8 +1,16 @@
+import { TUsers } from "@app/db/schemas";
+import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
 import { crypto } from "@app/lib/crypto";
-import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 
-import { AuthModeProviderJwtTokenPayload, AuthModeProviderSignUpTokenPayload, AuthTokenType } from "./auth-type";
+import {
+  AuthMethod,
+  AuthModeProviderJwtTokenPayload,
+  AuthModeProviderSignUpTokenPayload,
+  AuthTokenType
+} from "./auth-type";
 
 export const validateProviderAuthToken = (providerToken: string, username?: string) => {
   if (!providerToken) throw new UnauthorizedError();
@@ -97,3 +105,50 @@ export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?:
     }
   }
 };
+
+export const verifyCaptcha = async (user: TUsers, captchaToken?: string) => {
+  const appCfg = getConfig();
+  if (
+    user.consecutiveFailedPasswordAttempts &&
+    user.consecutiveFailedPasswordAttempts >= 10 &&
+    Boolean(appCfg.CAPTCHA_SECRET)
+  ) {
+    if (!captchaToken) {
+      throw new BadRequestError({
+        name: "Captcha Required",
+        message: "Accomplish the required captcha by logging in via Web"
+      });
+    }
+
+    // validate captcha token
+    const response = await request.postForm<{ success: boolean }>("https://api.hcaptcha.com/siteverify", {
+      response: captchaToken,
+      secret: appCfg.CAPTCHA_SECRET
+    });
+
+    if (!response.data.success) {
+      throw new BadRequestError({
+        name: "Invalid Captcha"
+      });
+    }
+  }
+};
+
+export const getAuthMethodAndOrgId = (email: string, providerAuthToken?: string) => {
+  let authMethod = AuthMethod.EMAIL;
+  let organizationId: string | undefined;
+
+  if (providerAuthToken) {
+    const decodedProviderToken = validateProviderAuthToken(providerAuthToken, email);
+
+    authMethod = decodedProviderToken.authMethod;
+    if (
+      (isAuthMethodSaml(authMethod) || [AuthMethod.LDAP, AuthMethod.OIDC].includes(authMethod)) &&
+      decodedProviderToken.orgId
+    ) {
+      organizationId = decodedProviderToken.orgId;
+    }
+  }
+
+  return { authMethod, organizationId };
+};