feat(client): auth handler for enhanced auth (mqttjs#1380)

Yoseph Maguire · quickstar · Cédric von Allmen · web-flow · commit d5850b7ba265 · 2021-12-22T14:09:32.000-08:00
* add draft of extended auth

* expose handleAuth for api

* do not handle auth packet directly for now

* handle auth packet

* point to dev version of mqtt-packet to make use of auth packages

* solve hacky connected/disconnected flagging to send auth packages

* remove unused code in handle auth

* add packetcallback to auth handler

* fix this and that issue

* point to mqtt-packet dev master

* switch to mqtt-packet 6.7.0 as our PR was merged

* merge

Co-authored-by: Lukas Läderach &lt;lukas.laederach@3volutions.ch&gt;
Co-authored-by: Cédric von Allmen &lt;cedric.vonallmen@gmail.com&gt;
diff --git a/lib/client.js b/lib/client.js
@@ -547,6 +547,10 @@ MqttClient.prototype._handlePacket = function (packet, done) {
       this._handleConnack(packet)
       done()
       break
+    case 'auth':
+      this._handleAuth(packet)
+      done()
+      break
     case 'pingresp':
       this._handlePingresp(packet)
       done()
@@ -1208,6 +1212,13 @@ MqttClient.prototype._sendPacket = function (packet, cb, cbStorePut) {
   }
 
   if (!this.connected) {
+    // allow auth packets to be sent while authenticating with the broker (mqtt5 enhanced auth)
+    if (packet.cmd === 'auth') {
+      this._shiftPingInterval()
+      sendPacket(this, packet, cb)
+      return
+    }
+
     debug('_sendPacket :: client not connected. Storing packet offline.')
     this._storePacket(packet, cb, cbStorePut)
     return
@@ -1384,6 +1395,45 @@ MqttClient.prototype._handleConnack = function (packet) {
   }
 }
 
+MqttClient.prototype._handleAuth = function (packet) {
+  const options = this.options
+  const version = options.protocolVersion
+  const rc = version === 5 ? packet.reasonCode : packet.returnCode
+
+  if (version !== 5) {
+    const err = new Error('Protocol error: Auth packets are only supported in MQTT 5. Your version:' + version)
+    err.code = rc
+    this.emit('error', err)
+    return
+  }
+
+  const that = this
+  this.handleAuth(packet, function (err, packet) {
+    if (err) {
+      that.emit('error', err)
+      return
+    }
+
+    if (rc === 24) {
+      that.reconnecting = false
+      that._sendPacket(packet)
+    } else {
+      const error = new Error('Connection refused: ' + errors[rc])
+      err.code = rc
+      that.emit('error', error)
+    }
+  })
+}
+
+/**
+ * @param packet the packet received by the broker
+ * @return the auth packet to be returned to the broker
+ * @api public
+ */
+MqttClient.prototype.handleAuth = function (packet, callback) {
+  callback()
+}
+
 /**
  * _handlePublish
  *
diff --git a/types/lib/client.d.ts b/types/lib/client.d.ts
@@ -8,7 +8,7 @@ import {
   IClientReconnectOptions
 } from './client-options'
 import { Store } from './store'
-import { Packet, IConnectPacket, IPublishPacket, IDisconnectPacket, QoS, IConnackPacket } from 'mqtt-packet'
+import { IAuthPacket, IConnectPacket, IPublishPacket, IDisconnectPacket, IConnackPacket, Packet, QoS } from 'mqtt-packet'
 
 export interface ISubscriptionGrant {
   /**
@@ -232,6 +232,27 @@ export declare class MqttClient extends events.EventEmitter {
    */
   public handleMessage (packet: Packet, callback: PacketCallback): void
 
+  /**
+   * Handle auth packages for MQTT 5 enhanced authentication methods such
+   * as challenge response authentication.
+   *
+   * Challenge-response authentication flow would look something like this:
+   *
+   * --> CONNECT | authMethod = "mathChallenge" -->
+   * <-- AUTH | authMethod = "mathChallenge", authData = "12 + 34" <--
+   * --> AUTH | authMethod = "mathChallenge", authData = "46" -->
+   * <-- CONNACK | reasonCode = SUCCESS <--
+   *
+   * This form of authentication has several advantages over traditional
+   * credential-based approaches. For instance authentication without the direct
+   * exchange of authentication secrets.
+   *
+   * @param packet the auth packet to handle
+   * @param callback call when finished
+   * @api public
+   */
+  public handleAuth (packet: IAuthPacket, callback: PacketCallback): void
+
   /**
    * getLastMessageId
    */
