Authentication: update passport-ldapauth to 3.0.1; fix minor issues

.yarn/patches/ldapauth-fork+5.0.5.patch

@@ -1,41 +1,41 @@
 diff --git a/node_modules/ldapauth-fork/lib/ldapauth.js b/node_modules/ldapauth-fork/lib/ldapauth.js
-index 85ecf36a8b..a7d07e0f78 100644
+index 88398ed..0334177 100644
 --- a/node_modules/ldapauth-fork/lib/ldapauth.js
 +++ b/node_modules/ldapauth-fork/lib/ldapauth.js
-@@ -69,6 +69,7 @@ function LdapAuth(opts) {
+@@ -87,6 +87,7 @@ function LdapAuth(opts) {
    this.opts.bindProperty || (this.opts.bindProperty = 'dn');
    this.opts.groupSearchScope || (this.opts.groupSearchScope = 'sub');
    this.opts.groupDnProperty || (this.opts.groupDnProperty = 'dn');
 +  this.opts.tlsStarted = false;
-
+ 
    EventEmitter.call(this);
-
+ 
-@@ -108,21 +109,7 @@ function LdapAuth(opts) {
+@@ -126,21 +127,7 @@ function LdapAuth(opts) {
    this._userClient.on('error', this._handleError.bind(this));
-
+ 
    var self = this;
 -  if (this.opts.starttls) {
 -    // When starttls is enabled, this callback supplants the 'connect' callback
--    this._adminClient.starttls(this.opts.tlsOptions, this._adminClient.controls, function(err) {
+-    this._adminClient.starttls(this.opts.tlsOptions, this._adminClient.controls, function (err) {
 -      if (err) {
 -        self._handleError(err);
 -      } else {
 -        self._onConnectAdmin();
 -      }
 -    });
--    this._userClient.starttls(this.opts.tlsOptions, this._userClient.controls, function(err) {
+-    this._userClient.starttls(this.opts.tlsOptions, this._userClient.controls, function (err) {
 -      if (err) {
 -        self._handleError(err);
 -      }
 -    });
 -  } else if (opts.reconnect) {
 +  if (opts.reconnect && !this.opts.starttls) {
-     this.once('_installReconnectListener', function() {
+     this.once('_installReconnectListener', function () {
        self.log && self.log.trace('install reconnect listener');
-       self._adminClient.on('connect', function() {
+       self._adminClient.on('connect', function () {
-@@ -384,6 +371,28 @@ LdapAuth.prototype._findGroups = function(user, callback) {
+@@ -401,6 +388,37 @@ LdapAuth.prototype._findGroups = function (user, callback) {
   */
- LdapAuth.prototype.authenticate = function(username, password, callback) {
+ LdapAuth.prototype.authenticate = function (username, password, callback) {
    var self = this;
 +  if (this.opts.starttls && !this.opts.tlsStarted) {
 +    // When starttls is enabled, this callback supplants the 'connect' callback
@@ -56,9 +56,18 @@ index 85ecf36a8b..a7d07e0f78 100644
 +  }
 +};
 +
++/**
++ * Authenticate given credentials against LDAP server
++ * 
++ * @private
++ * @param {string} username - The username to authenticate
++ * @param {string} password - The password to verify
++ * @param {resultCallback} callback - Result handling callback
++ * @returns {undefined}
++ */
 +LdapAuth.prototype._handleAuthenticate = function (username, password, callback) {
 +  this.opts.tlsStarted = true;
 +  var self = this;
-
+ 
    if (typeof password === 'undefined' || password === null || password === '') {
      return callback(new Error('no password given'));

services/web/modules/authentication/ldap/app/src/LDAPAuthenticationManager.mjs

@@ -1,5 +1,4 @@
 import Settings from '@overleaf/settings'
-import { callbackify } from '@overleaf/promise-utils'
 import UserCreator from '../../../../../app/src/Features/User/UserCreator.mjs'
 import { ParallelLoginError } from '../../../../../app/src/Features/Authentication/AuthenticationErrors.mjs'
 import { User } from '../../../../../app/src/models/User.mjs'

services/web/modules/authentication/ldap/app/src/LDAPContacts.mjs

@@ -2,7 +2,7 @@ import Settings from '@overleaf/settings'
 import logger from '@overleaf/logger'
 import { promisify } from 'util'
 import passport from 'passport'
-import ldapjs from 'ldapauth-fork/node_modules/ldapjs/lib/index.js'
+import ldapjs from 'ldapjs'
 import UserGetter from '../../../../../app/src/Features/User/UserGetter.mjs'
 import { splitFullName } from '../../../utils.mjs'
 

services/web/modules/authentication/ldap/app/src/LDAPModuleManager.mjs

@@ -59,13 +59,8 @@ const LDAPModuleManager = {
     }
   },
 
-  async getContacts(userId, contacts, callback) {
+  getContacts(userId, contacts) {
-    try {
+    return fetchLDAPContacts(userId, contacts)
-      const newContacts = await fetchLDAPContacts(userId, contacts)
-      callback(null, newContacts)
-    } catch (error) {
-      callback(error)
-    }
   },
 
   initPolicy() {

services/web/modules/authentication/ldap/index.mjs

@@ -8,8 +8,10 @@ if (process.env.EXTERNAL_AUTH?.includes('ldap')) {
     name: 'ldap-authentication',
     hooks: {
       passportSetup: LDAPModuleManager.passportSetup,
-      getContacts: LDAPModuleManager.getContacts,
       getGroupPolicyForUser: LDAPModuleManager.getGroupPolicyForUser,
+      promises: {
+        getContacts: LDAPModuleManager.getContacts,
+      },
     },
     router: router,
   }

services/web/modules/authentication/oidc/app/src/OIDCAuthenticationController.mjs

@@ -5,7 +5,6 @@ import AuthenticationController from '../../../../../app/src/Features/Authentica
 import UserController from '../../../../../app/src/Features/User/UserController.mjs'
 import ThirdPartyIdentityManager from '../../../../../app/src/Features/User/ThirdPartyIdentityManager.mjs'
 import OIDCAuthenticationManager from './OIDCAuthenticationManager.mjs'
-import { acceptsJson } from '../../../../../app/src/infrastructure/RequestContentTypeDetection.mjs'
 
 const OIDCAuthenticationController = {
   passportLogin(req, res, next) {
@@ -142,17 +141,10 @@ const OIDCAuthenticationController = {
         initiatorId: userId,
       }
       await ThirdPartyIdentityManager.promises.unlink(userId, providerId, auditLog)
-      return res.status(200).end()
+      return res.status(204).end()
     } catch (error) {
-      logger.error(error.info, error.message)
+      logger.error('Unexpected error in uninkAccount')
-      return {
+      return next({ stack: error.stack, info: {userId: req.user?._id} })
-        user: false,
-        info: {
-          type: 'error',
-          text: 'Can not unlink account',
-          status: 200,
-	}
-      }
     }
   },
   async passportLogout(req, res, next) {

services/web/modules/authentication/oidc/app/src/OIDCModuleManager.mjs

@@ -1,7 +1,6 @@
 import logger from '@overleaf/logger'
-import passport from 'passport'
 import Settings from '@overleaf/settings'
-import { readFilesContentFromEnv, numFromEnv, boolFromEnv } from '../../../utils.mjs'
+import { boolFromEnv } from '../../../utils.mjs'
 import PermissionsManager from '../../../../../app/src/Features/Authorization/PermissionsManager.mjs'
 import OIDCAuthenticationController from './OIDCAuthenticationController.mjs'
 import { Strategy as OIDCStrategy } from 'passport-openidconnect'

services/web/modules/authentication/saml/app/src/SAMLModuleManager.mjs

@@ -1,5 +1,4 @@
 import logger from '@overleaf/logger'
-import passport from 'passport'
 import Settings from '@overleaf/settings'
 import { readFilesContentFromEnv, numFromEnv, boolFromEnv } from '../../../utils.mjs'
 import PermissionsManager from '../../../../../app/src/Features/Authorization/PermissionsManager.mjs'

services/web/package.json

@@ -148,6 +148,7 @@
     "jose": "^4.3.8",
     "json2csv": "^4.3.3",
     "jsonwebtoken": "^9.0.3",
+    "ldapjs": "^2.3.3",
     "lodash": "^4.18.1",
     "lru-cache": "^7.10.1",
     "marked": "^4.1.0",
@@ -171,7 +172,7 @@
     "parse-data-url": "^2.0.0",
     "passport": "^0.6.0",
     "passport-google-oauth20": "^2.0.0",
-    "passport-ldapauth": "^2.1.4",
+    "passport-ldapauth": "^3.0.1",
     "passport-local": "^1.0.0",
     "passport-oauth2": "patch:passport-oauth2@npm%3A1.6.1#~/.yarn/patches/passport-oauth2-npm-1.6.1.patch",
     "passport-openidconnect": "^0.1.2",