Skip to main content

Abstract Class: BaseAuthBasicRouteSQL

Defined in: auth/src/routes/sql/BaseAuthBasicRouteSQL.ts:8

Authenticates a user via HTTP Basic (RFC 7617) against their stored password/app-password secrets. This is the route a downstream service with no interactive UI - e.g. a mail server validating a legacy mail client's credentials against this authorization server - would call.

An account with requireMFA set cannot complete a real password login here (Basic auth has no way to prompt for a second factor), UNLESS the submitted value matches one of the account's own app-password secrets (see SecretType.APP_PASSWORD, BaseSecretRoute.validateAppPasswordCreate()). That bypass is the entire point of app passwords: a standing, individually-revocable, high-entropy credential the user explicitly creates for one Basic-auth-only client that can't do MFA, so enabling that one client doesn't require disabling MFA for the account as a whole. A real password remains subject to requireMFA here exactly as before - the bypass only ever applies to an app-password secret.

Extends​

Constructors​

Constructor​

new BaseAuthBasicRouteSQL(): BaseAuthBasicRouteSQL

Returns​

BaseAuthBasicRouteSQL

Inherited from​

BaseAuthBasicRoute.constructor

Properties​

aliasClass​

protected aliasClass: any = AliasSQL

Defined in: auth/src/routes/sql/BaseAuthBasicRouteSQL.ts:9

Overrides​

BaseAuthBasicRoute.aliasClass

appPasswordEnabled​

protected appPasswordEnabled: boolean = true

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:69

Set to false to disable the app-password bypass below deployment-wide. An already-created app password stops authenticating (falling through to the normal requireMFA/password checks, which then reject it since it isn't a password-type secret) but is not deleted - re-enabling this restores it exactly as it was. See BaseSecretRoute.appPasswordEnabled, which independently gates creating new app passwords - the two are meant to be kept in sync, but this route reads its own copy of the config so authentication doesn't depend on BaseSecretRoute being mounted.

Inherited from​

BaseAuthBasicRoute.appPasswordEnabled

auditLogUtils?​

protected optional auditLogUtils?: AuditLogUtils

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:72

Inherited from​

BaseAuthBasicRoute.auditLogUtils

authMiddleware?​

protected optional authMiddleware?: AuthMiddleware

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:75

Inherited from​

BaseAuthBasicRoute.authMiddleware

defaultScopes​

protected defaultScopes: string[] = []

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:78

Inherited from​

BaseAuthBasicRoute.defaultScopes

jwtConfig?​

protected optional jwtConfig?: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:81

Inherited from​

BaseAuthBasicRoute.jwtConfig

logger​

protected logger: any

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:84

Inherited from​

BaseAuthBasicRoute.logger

passwordConfig​

protected passwordConfig: PasswordConfig

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:87

Inherited from​

BaseAuthBasicRoute.passwordConfig

rateLimiter?​

protected optional rateLimiter?: RateLimiter

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:90

Inherited from​

BaseAuthBasicRoute.rateLimiter

secretClass​

protected secretClass: any = SecretSQL

Defined in: auth/src/routes/sql/BaseAuthBasicRouteSQL.ts:10

Overrides​

BaseAuthBasicRoute.secretClass

secretRepo?​

protected optional secretRepo?: RepoUtils<SecretSQL>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:92

Inherited from​

BaseAuthBasicRoute.secretRepo

tokenUtils?​

protected optional tokenUtils?: TokenUtils

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:95

Inherited from​

BaseAuthBasicRoute.tokenUtils

trustedProxies​

protected trustedProxies: string[] = []

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:98

Inherited from​

BaseAuthBasicRoute.trustedProxies

userClass​

protected userClass: any = UserSQL

Defined in: auth/src/routes/sql/BaseAuthBasicRouteSQL.ts:11

Overrides​

BaseAuthBasicRoute.userClass

userUtils?​

protected optional userUtils?: UserUtils<UserSQL, AliasSQL>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:100

Inherited from​

BaseAuthBasicRoute.userUtils

Methods​

authenticate()​

authenticate(user, req, res): Promise<AuthResult | undefined>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:286

Authenticates the user using HTTP Basic and returns a JSON Web Token access token to be used with future API requests.

Parameters​

user​

JWTUser

req​

HttpRequest

res​

HttpResponse

Returns​

Promise<AuthResult | undefined>

Inherited from​

BaseAuthBasicRoute.authenticate

initialize()​

protected initialize(): Promise<void>

Defined in: auth/src/routes/BaseAuthBasicRoute.ts:106

Called on server startup to initialize the route with any defaults.

Returns​

Promise<void>

Inherited from​

BaseAuthBasicRoute.initialize