Repository: rickbergfalk/sqlpad
Pull request #775 (2020-07-07 19:10:55)

userpassAuthDisabled


Patch:
diff --git a/config-example.env b/config-example.env
index e42588c0..9c114161 100644
--- a/config-example.env
+++ b/config-example.env
@@ -36,7 +36,7 @@ SQLPAD_AUTH_DISABLED="false"
 SQLPAD_AUTH_DISABLED_DEFAULT_ROLE="editor"
 
 # Set to TRUE to disable built-in user authentication. Use to restrict auth to OAuth only.
-DISABLE_USERPASS_AUTH="false"
+SQLPAD_USERPASS_AUTH_DISABLED="false"
 
 # Set to TRUE if LDAP enable, FALSE if LDAP disable.
 ENABLE_LDAP_AUTH="false"
diff --git a/docs/authentication.md b/docs/authentication.md
index e3a26f51..f9c52e2a 100644
--- a/docs/authentication.md
+++ b/docs/authentication.md
@@ -10,7 +10,7 @@ Once an initial admin account has been created, all future users must be added b
 
 If for whatever reason you lose admin rights, and the last-admin-standing won't give you admin rights back, you can reinstate them to yourself by setting environment variable `SQLPAD_ADMIN=yourEmailAddress@domain.com`.
 
-Local authentication can be disabled by setting `SQLPAD_DISABLE_USERPASS_AUTH=true`.
+Local authentication can be disabled by setting `SQLPAD_USERPASS_AUTH_DISABLED=true`.
 
 ## No Authentication
 
@@ -75,7 +75,7 @@ For OAuth to be useful this usually involves the following:
 - `SQLPAD_GOOGLE_CLIENT_ID`
 - `SQLPAD_GOOGLE_CLIENT_SECRET`
 - `PUBLIC_URL`=`http://localhost`
-- `DISABLE_USERPASS_AUTH`=`true` (optional - disables plain local user logins)
+- `SQLPAD_USERPASS_AUTH_DISABLED`=`true` (optional - disables plain local user logins)
 
 ## OpenID Connect
 
@@ -125,7 +125,7 @@ SAML-based authentication can be enabled by setting the necessary environment va
 - `SQLPAD_SAML_AUTO_SIGN_UP`
 - `SQLPAD_SAML_DEFAULT_ROLE`
 - `PUBLIC_URL`
-- `DISABLE_USERPASS_AUTH`=`true` (optional - disables plain local user logins)
+- `SQLPAD_USERPASS_AUTH_DISABLED`=`true` (optional - disables plain local user logins)
 
 SQLPad users do not need to be added ahead of time, and may be created on the fly using `SQLPAD_SAML_AUTO_SIGN_UP`. Whenever a new user is detected (unable to match to existing user email), a user record will be added to SQLPad's user table and a user signed in. By default users are not auto-created and must otherwise be added ahead of time.
 
@@ -138,7 +138,7 @@ LDAP-based authentication can be enabled by setting the necessary environment va
 - `LDAP_BASE_DN` - Base LDAP DN to search for users in, eg: `dc=domain,dc=com`.
 - `LDAP_USERNAME` - The bind user will be used to lookup information about other LDAP users.
 - `LDAP_PASSWORD` - The password to bind with for the lookup user.
-- `DISABLE_USERPASS_AUTH`=`false` (need to enable local user logins)
+- `SQLPAD_USERPASS_AUTH_DISABLED`=`false` (need to enable local user logins)
 
 LDAP-based authentication can be enabled and used with local authencation together. LDAP-based users need to be added and set relavant roles ahead of time. When LDAP-based authentication enabled, local user login/registration must be enabled. Users can sign in to SQLPad with an LDAP username (not an e-mail address) and LDAP password using LDAP-based authentication, and with an e-mail address and local password by local authencation.
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 5264ad86..f313dd4d 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -144,12 +144,12 @@ Acceptable values: `admin`, `editor`.
 - Key: `authDisabledDefaultRole`
 - Env: `SQLPAD_AUTH_DISABLED_DEFAULT_ROLE`
 
-## disableUserpassAuth
+## userpassAuthDisabled
 
 Set to TRUE to disable built-in user authentication. Probably desired when using other auths like OAuth or SAML.
 
-- Key: `disableUserpassAuth`
-- Env: `DISABLE_USERPASS_AUTH`
+- Key: `userpassAuthDisabled`
+- Env: `SQLPAD_USERPASS_AUTH_DISABLED`
 
 ## editorWordWrap
 
diff --git a/server/auth-strategies/basic.js b/server/auth-strategies/basic.js
index 36e9a5fa..be62ad56 100644
--- a/server/auth-strategies/basic.js
+++ b/server/auth-strategies/basic.js
@@ -4,7 +4,7 @@ const appLog = require('../lib/app-log');
 const passhash = require('../lib/passhash.js');
 
 function enableBasic(config) {
-  if (config.get('disableUserpassAuth')) {
+  if (config.get('userpassAuthDisabled') || config.get('disableUserpassAuth')) {
     return;
   }
 
diff --git a/server/auth-strategies/local.js b/server/auth-strategies/local.js
index 8cee5454..b79589a2 100644
--- a/server/auth-strategies/local.js
+++ b/server/auth-strategies/local.js
@@ -4,7 +4,7 @@ const appLog = require('../lib/app-log');
 const passhash = require('../lib/passhash.js');
 
 function enableLocal(config) {
-  if (config.get('disableUserpassAuth')) {
+  if (config.get('userpassAuthDisabled') || config.get('disableUserpassAuth')) {
     return;
   }
 
diff --git a/server/lib/config/config-items.js b/server/lib/config/config-items.js
index d7d276ae..f98a8e43 100644
--- a/server/lib/config/config-items.js
+++ b/server/lib/config/config-items.js
@@ -141,7 +141,15 @@ const configItems = [
     key: 'disableUserpassAuth',
     envVar: 'DISABLE_USERPASS_AUTH',
     default: false,
+    deprecated:
+      'To be removed in v6. Use SQLPAD_USERPASS_AUTH_DISABLED instead.',
   },
+  {
+    key: 'userpassAuthDisabled',
+    envVar: 'SQLPAD_USERPASS_AUTH_DISABLED',
+    default: false,
+  },
+
   {
     key: 'enableLdapAuth',
     envVar: 'ENABLE_LDAP_AUTH',
@@ -176,7 +184,7 @@ const configItems = [
     key: 'disableAuth',
     envVar: 'DISABLE_AUTH',
     default: false,
-    deprecated: 'To be deprecated in v6. Use AUTH_DISABLED instead.',
+    deprecated: 'To be removed in v6. Use AUTH_DISABLED instead.',
   },
   {
     key: `authDisabled`,
@@ -188,7 +196,7 @@ const configItems = [
     envVar: 'SQLPAD_DISABLE_AUTH_DEFAULT_ROLE',
     default: 'editor',
     deprecated:
-      'To be deprecated in v6. Use SQLPAD_AUTH_DISABLED_DEFAULT_ROLE instead.',
+      'To be removed in v6. Use SQLPAD_AUTH_DISABLED_DEFAULT_ROLE instead.',
   },
   {
     key: 'authDisabledDefaultRole',
diff --git a/server/middleware/sessionless-auth.js b/server/middleware/sessionless-auth.js
index e5b91d65..f0c2c6b4 100644
--- a/server/middleware/sessionless-auth.js
+++ b/server/middleware/sessionless-auth.js
@@ -59,7 +59,11 @@ function sessionlessAuth(req, res, next) {
 
     // If authoriztion starts with Basic and local auth isn't disabled,
     // try HTTP basic authentication
-    if (authHeader.startsWith('Basic ') && !config.get('disableUserpassAuth')) {
+    if (
+      authHeader.startsWith('Basic ') &&
+      !config.get('userpassAuthDisabled') &&
+      !config.get('disableUserpassAuth')
+    ) {
       return passport.authenticate('basic', handleAuth)(req, res, next);
     }
   }
diff --git a/server/routes/app.js b/server/routes/app.js
index 8b67e6f0..f6c952cf 100644
--- a/server/routes/app.js
+++ b/server/routes/app.js
@@ -28,7 +28,9 @@ async function getApp(req, res) {
       defaultConnectionId: config.get('defaultConnectionId'),
       editorWordWrap: config.get('editorWordWrap'),
       googleAuthConfigured: config.googleAuthConfigured(),
-      localAuthConfigured: !config.get('disableUserpassAuth'),
+      localAuthConfigured: !(
+        config.get('userpassAuthDisabled') || config.get('disableUserpassAuth')
+      ),
       publicUrl: config.get('publicUrl'),
       samlConfigured: Boolean(
         config.get('samlEntryPoint') || config.get('samlEntryPoint_d')
diff --git a/server/routes/signin.js b/server/routes/signin.js
index ea2a136a..513bc97b 100644
--- a/server/routes/signin.js
+++ b/server/routes/signin.js
@@ -48,7 +48,12 @@ function handleSignin(req, res, next) {
     return passport.authenticate('ActiveDirectory', handleAuth)(req, res, next);
   }
 
-  if (body.email && body.password && !config.get('disableUserpassAuth')) {
+  if (
+    body.email &&
+    body.password &&
+    !config.get('userpassAuthDisabled') &&
+    !config.get('disableUserpassAuth')
+  ) {
     return passport.authenticate('local', handleAuth)(req, res, next);
   }
 
diff --git a/server/routes/signup.js b/server/routes/signup.js
index f4242d20..30a8ae03 100644
--- a/server/routes/signup.js
+++ b/server/routes/signup.js
@@ -12,7 +12,7 @@ const wrap = require('../lib/wrap');
 async function handleSignup(req, res, next) {
   const { models, config } = req;
 
-  if (config.get('disableUserpassAuth')) {
+  if (config.get('userpassAuthDisabled') || config.get('disableUserpassAuth')) {
     return res.utils.forbidden();
   }
 


Test patch:
diff --git a/server/test/api/signup.js b/server/test/api/signup.js
index 8741ab5e..ed300df8 100644
--- a/server/test/api/signup.js
+++ b/server/test/api/signup.js
@@ -5,7 +5,7 @@ const TestUtil = require('../utils');
 describe('api/signup', function () {
   it('only allowed if local auth enabled', async function () {
     const utils = new TestUtil({
-      disableUserpassAuth: 'true',
+      userpassAuthDisabled: 'true',
       authProxyEnabled: false,
     });