fix(oauth): add support for client_credentials flow

src/node/handler/APIHandler.ts

@@ -20,9 +20,10 @@
  */
 
 import {MapArrayType} from "../types/MapType";
-
+import { jwtDecode } from "jwt-decode";
 const api = require('../db/API');
 const padManager = require('../db/PadManager');
+const settings = require('../utils/Settings');
 import createHTTPError from 'http-errors';
 import {Http2ServerRequest} from "node:http2";
 import {publicKeyExported} from "../security/OAuth2Provider";
@@ -182,8 +183,17 @@ exports.handle = async function (apiVersion: string, functionName: string, field
       throw new createHTTPError.Unauthorized('no or wrong API Key');
     }
     try {
-      await jwtVerify(req.headers.authorization!.replace("Bearer ", ""), publicKeyExported!, {algorithms: ['RS256'],
-        requiredClaims: ["admin"]})
+      const clientIds: string[] = settings.sso.clients?.map((client: {client_id: string}) => client.client_id);
+      const jwtToCheck = req.headers.authorization.replace("Bearer ", "")
+      const payload = jwtDecode(jwtToCheck)
+      // client_credentials
+      if (clientIds.includes(<string>payload.sub)) {
+        await jwtVerify(jwtToCheck, publicKeyExported!, {algorithms: ['RS256']})
+      } else {
+        // authorization_code
+        await jwtVerify(jwtToCheck, publicKeyExported!, {algorithms: ['RS256'],
+          requiredClaims: ["admin"]})
+      }
     } catch (e) {
       throw new createHTTPError.Unauthorized('no or wrong OAuth token');
     }

src/node/security/OAuth2Provider.ts

@@ -30,7 +30,7 @@ const configuration: Configuration = {
         if(account === undefined) {
             return undefined
         }
-        if (account.is_admin) {
+        if (account.is_admin ) {
             return {
                 accountId: id,
                 claims: () => ({

src/package.json

@@ -70,6 +70,7 @@
     "socket.io-client": "^4.8.1",
     "superagent": "10.2.0",
     "swagger-ui-express": "^5.0.1",
+    "jwt-decode": "^4.0.0",
     "tinycon": "0.6.8",
     "tsx": "4.19.3",
     "ueberdb2": "^5.0.6",