itsi 0.1.19 → 0.2.2

data/crates/itsi_server/src/server/middleware_stack/middlewares/compression.rs

@@ -25,6 +25,7 @@ use std::convert::Infallible;
 use tokio::io::{AsyncRead, AsyncReadExt, BufReader};
 use tokio_stream::StreamExt;
 use tokio_util::io::{ReaderStream, StreamReader};
+use tracing::debug;
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Compression {
     min_size: usize,
@@ -40,8 +41,8 @@ enum CompressionLevel {
     Fastest,
     #[serde(rename(deserialize = "best"))]
     Best,
-    #[serde(rename(deserialize = "default"))]
-    Default,
+    #[serde(rename(deserialize = "balanced"))]
+    Balanced,
     #[serde(rename(deserialize = "precise"))]
     Precise(i32),
 }
@@ -51,7 +52,7 @@ impl CompressionLevel {
         match self {
             CompressionLevel::Fastest => Level::Fastest,
             CompressionLevel::Best => Level::Best,
-            CompressionLevel::Default => Level::Default,
+            CompressionLevel::Balanced => Level::Default,
             CompressionLevel::Precise(level) => Level::Precise(*level),
         }
     }
@@ -61,14 +62,14 @@ impl CompressionLevel {
 pub enum CompressionAlgorithm {
     #[serde(rename(deserialize = "gzip"))]
     Gzip,
-    #[serde(rename(deserialize = "brotli"))]
+    #[serde(rename(deserialize = "br"))]
     Brotli,
     #[serde(rename(deserialize = "deflate"))]
     Deflate,
     #[serde(rename(deserialize = "zstd"))]
     Zstd,
-    #[serde(rename(deserialize = "none"))]
-    None,
+    #[serde(rename(deserialize = "identity"))]
+    Identity,
 }
 
 impl CompressionAlgorithm {
@@ -78,7 +79,7 @@ impl CompressionAlgorithm {
             CompressionAlgorithm::Brotli => "br",
             CompressionAlgorithm::Deflate => "deflate",
             CompressionAlgorithm::Zstd => "zstd",
-            CompressionAlgorithm::None => "none",
+            CompressionAlgorithm::Identity => "identity",
         }
     }
 
@@ -99,6 +100,8 @@ enum MimeType {
     Audio,
     #[serde(rename(deserialize = "video"))]
     Video,
+    #[serde(rename(deserialize = "font"))]
+    Font,
     #[serde(rename(deserialize = "other"))]
     Other(String),
     #[serde(rename(deserialize = "all"))]
@@ -113,6 +116,7 @@ impl MimeType {
             MimeType::Application => header_contains(content_encodings, "application/*"),
             MimeType::Audio => header_contains(content_encodings, "audio/*"),
             MimeType::Video => header_contains(content_encodings, "video/*"),
+            MimeType::Font => header_contains(content_encodings, "font/*"),
             MimeType::Other(v) => header_contains(content_encodings, v),
             MimeType::All => header_contains(content_encodings, "*"),
         }
@@ -162,16 +166,28 @@ impl MiddlewareLayer for Compression {
             .iter()
             .any(|mt| mt.matches(&resp.headers().get_all(CONTENT_TYPE)))
         {
+            debug!(
+                target: "middleware::compress",
+                "Mime type not supported for compression"
+            );
             return resp;
         }
 
         // Don't compress streams unless compress streams is enabled.
         if body_size.is_none() && !self.compress_streams {
+            debug!(
+                target: "middleware::compress",
+                "Stream compression disabled"
+            );
             return resp;
         }
 
         // Don't compress too small bodies
         if body_size.is_some_and(|s| s < self.min_size as u64) {
+            debug!(
+                target: "middleware::compress",
+                "Body size too small for compression"
+            );
             return resp;
         }
 
@@ -181,6 +197,10 @@ impl MiddlewareLayer for Compression {
                 for encoding in encodings.split(',').map(str::trim) {
                     let encoding = encoding.split(';').next().unwrap_or(encoding).trim();
                     if self.algorithms.iter().any(|algo| algo.as_str() == encoding) {
+                        debug!(
+                            target: "middleware::compress",
+                            "Body already compressed with supported algorithm"
+                        );
                         return resp;
                     }
                 }
@@ -195,10 +215,14 @@ impl MiddlewareLayer for Compression {
             Some("br") => CompressionAlgorithm::Brotli,
             Some("deflate") => CompressionAlgorithm::Deflate,
             Some("zstd") => CompressionAlgorithm::Zstd,
-            _ => CompressionAlgorithm::None,
+            _ => CompressionAlgorithm::Identity,
         };
 
-        if matches!(compression_method, CompressionAlgorithm::None) {
+        debug!(
+            target: "middleware::compress",
+            "Selected compression method: {:?}", compression_method
+        );
+        if matches!(compression_method, CompressionAlgorithm::Identity) {
             return resp;
         }
 
@@ -250,7 +274,7 @@ impl MiddlewareLayer for Compression {
                     encoder.read_to_end(&mut buf).await.unwrap();
                     buf
                 }
-                CompressionAlgorithm::None => unreachable!(),
+                CompressionAlgorithm::Identity => unreachable!(),
             };
             BoxBody::new(Full::new(Bytes::from(compressed_bytes)))
         } else {
@@ -276,13 +300,16 @@ impl MiddlewareLayer for Compression {
                     reader,
                     self.level.to_async_compression_level(),
                 )),
-                CompressionAlgorithm::None => unreachable!(),
+                CompressionAlgorithm::Identity => unreachable!(),
             }
         };
 
         update_content_encoding(&mut parts, compression_method.header_value());
         parts.headers.remove(CONTENT_LENGTH);
-
+        debug!(
+            target: "middleware::compress",
+            "Response compressed"
+        );
         Response::from_parts(parts, new_body)
     }
 }

data/crates/itsi_server/src/server/middleware_stack/middlewares/cors.rs

@@ -10,14 +10,15 @@ use http_body_util::{combinators::BoxBody, Empty};
 use itsi_error::ItsiError;
 use magnus::error::Result;
 use serde::Deserialize;
+use tracing::debug;
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct Cors {
-    pub allowed_origins: Vec<String>,
-    pub allowed_methods: Vec<HttpMethod>,
-    pub allowed_headers: Vec<String>,
-    pub exposed_headers: Vec<String>,
+    pub allow_origins: Vec<String>,
+    pub allow_methods: Vec<HttpMethod>,
+    pub allow_headers: Vec<String>,
     pub allow_credentials: bool,
+    pub expose_headers: Vec<String>,
     pub max_age: Option<u64>,
 }
 
@@ -74,6 +75,7 @@ impl Cors {
 
         if origin.is_empty() {
             // When credentials are allowed, you cannot return "*".
+            debug!(target: "middleware::cors", "Origin empty {}", origin);
             if !self.allow_credentials {
                 headers.insert(
                     "Access-Control-Allow-Origin",
@@ -84,13 +86,13 @@ impl Cors {
         }
 
         // Only return a header if the origin is allowed.
-        if self.allowed_origins.iter().any(|o| o == origin || o == "*") {
+        if self.allow_origins.iter().any(|o| o == origin || o == "*") {
             // If credentials are allowed, we must echo back the exact origin.
             let value = if self.allow_credentials {
                 origin
             } else {
                 // If not, and if "*" is allowed, you can still use "*".
-                if self.allowed_origins.iter().any(|o| o == "*") {
+                if self.allow_origins.iter().any(|o| o == "*") {
                     "*"
                 } else {
                     origin
@@ -102,10 +104,10 @@ impl Cors {
             );
         }
 
-        if !self.allowed_methods.is_empty() {
+        if !self.allow_methods.is_empty() {
             headers.insert(
                 "Access-Control-Allow-Methods",
-                self.allowed_methods
+                self.allow_methods
                     .iter()
                     .map(HttpMethod::to_str)
                     .collect::<Vec<&str>>()
@@ -114,10 +116,10 @@ impl Cors {
                     .map_err(ItsiError::new)?,
             );
         }
-        if !self.allowed_headers.is_empty() {
+        if !self.allow_headers.is_empty() {
             headers.insert(
                 "Access-Control-Allow-Headers",
-                self.allowed_headers
+                self.allow_headers
                     .join(", ")
                     .parse()
                     .map_err(ItsiError::new)?,
@@ -135,10 +137,10 @@ impl Cors {
                 max_age.to_string().parse().map_err(ItsiError::new)?,
             );
         }
-        if !self.exposed_headers.is_empty() {
+        if !self.expose_headers.is_empty() {
             headers.insert(
                 "Access-Control-Expose-Headers",
-                self.exposed_headers
+                self.expose_headers
                     .join(", ")
                     .parse()
                     .map_err(ItsiError::new)?,
@@ -159,27 +161,31 @@ impl Cors {
 
         let origin = match origin {
             Some(o) if !o.is_empty() => o,
-            _ => return Ok(headers), // Missing Origin – preflight fails
+            _ => {
+                debug!(target: "middleware::cors", "Missing Origin – preflight fails");
+                return Ok(headers);
+            }
         };
 
         if !self
-            .allowed_origins
+            .allow_origins
             .iter()
             .any(|allowed| allowed == "*" || allowed == origin)
         {
+            debug!(target: "middleware::cors", "Origin not allowed");
             return Ok(headers);
         }
 
         let request_method = match req_method {
             Some(m) if !m.is_empty() => m,
-            _ => return Ok(headers), // Missing request method – preflight fails
+            _ => {
+                debug!(target: "middleware::cors", "Missing request method – preflight fails");
+                return Ok(headers);
+            }
         };
 
-        if !self
-            .allowed_methods
-            .iter()
-            .any(|m| m.matches(request_method))
-        {
+        if !self.allow_methods.iter().any(|m| m.matches(request_method)) {
+            debug!(target: "middleware::cors", "Method not allowed");
             return Ok(headers);
         }
 
@@ -191,10 +197,11 @@ impl Cors {
                 .collect();
             for header in req_headers_list {
                 if !self
-                    .allowed_headers
+                    .allow_headers
                     .iter()
                     .any(|allowed| allowed.eq_ignore_ascii_case(header))
                 {
+                    debug!(target: "middleware::cors", "Header not allowed {}", header);
                     return Ok(headers);
                 }
             }
@@ -203,7 +210,7 @@ impl Cors {
         headers.insert("Access-Control-Allow-Origin", origin.parse().unwrap());
         headers.insert(
             "Access-Control-Allow-Methods",
-            self.allowed_methods
+            self.allow_methods
                 .iter()
                 .map(HttpMethod::to_str)
                 .collect::<Vec<&str>>()
@@ -213,7 +220,7 @@ impl Cors {
         );
         headers.insert(
             "Access-Control-Allow-Headers",
-            self.allowed_headers
+            self.allow_headers
                 .join(", ")
                 .parse()
                 .map_err(ItsiError::new)?,
@@ -230,10 +237,10 @@ impl Cors {
                 max_age.to_string().parse().map_err(ItsiError::new)?,
             );
         }
-        if !self.exposed_headers.is_empty() {
+        if !self.expose_headers.is_empty() {
             headers.insert(
                 "Access-Control-Expose-Headers",
-                self.exposed_headers
+                self.expose_headers
                     .join(", ")
                     .parse()
                     .map_err(ItsiError::new)?,
@@ -257,11 +264,12 @@ impl MiddlewareLayer for Cors {
         context: &mut HttpRequestContext,
     ) -> Result<either::Either<HttpRequest, HttpResponse>> {
         let origin = req.header("Origin");
+        debug!(target: "middleware::cors", "Origin: {:?}", origin);
         if req.method() == Method::OPTIONS {
             let ac_request_method = req.header("Access-Control-Request-Method");
             let ac_request_headers = req.header("Access-Control-Request-Headers");
             let headers = self.preflight_headers(origin, ac_request_method, ac_request_headers)?;
-
+            debug!(target: "middleware::cors", "Preflight Headers: {:?}", headers);
             let mut response_builder = Response::builder().status(204);
             *response_builder.headers_mut().unwrap() = headers;
             let response = response_builder
@@ -273,14 +281,15 @@ impl MiddlewareLayer for Cors {
         Ok(either::Either::Left(req))
     }
 
-    // The after hook can be used to inject CORS headers into non-preflight responses.
     async fn after(
         &self,
         mut resp: HttpResponse,
         context: &mut HttpRequestContext,
     ) -> HttpResponse {
         if let Some(Some(origin)) = context.origin.get() {
+            debug!(target: "middleware::cors", "fetching cors headers for origin {}", origin);
             if let Ok(cors_headers) = self.cors_headers(origin) {
+                debug!(target: "middleware::cors", "Cors Headers: {:?}", cors_headers);
                 for (key, value) in cors_headers.iter() {
                     resp.headers_mut().insert(key.clone(), value.clone());
                 }

data/crates/itsi_server/src/server/middleware_stack/middlewares/csp.rs

@@ -0,0 +1,193 @@
+use super::FromValue;
+use crate::{
+    server::http_message_types::{HttpRequest, HttpResponse},
+    services::itsi_http_service::HttpRequestContext,
+};
+use async_trait::async_trait;
+use bytes::{Bytes, BytesMut};
+use either::Either;
+use futures::TryStreamExt;
+use http::{HeaderValue, StatusCode};
+use http_body_util::{combinators::BoxBody, BodyExt, Empty};
+use itsi_error::ItsiError;
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use std::{path::PathBuf, sync::OnceLock};
+use tokio::sync::Mutex;
+use tokio::time::{self, Duration};
+use tracing::debug;
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct CspReport {
+    #[serde(rename = "csp-report")]
+    pub report: ReportDetails,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ReportDetails {
+    #[serde(rename = "document-uri")]
+    pub document_uri: String,
+    #[serde(rename = "referrer")]
+    pub referrer: Option<String>,
+    #[serde(rename = "violated-directive")]
+    pub violated_directive: String,
+    #[serde(rename = "original-policy")]
+    pub original_policy: String,
+    #[serde(rename = "blocked-uri")]
+    pub blocked_uri: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CspConfig {
+    pub default_src: Vec<String>,
+    pub script_src: Vec<String>,
+    pub style_src: Vec<String>,
+    pub report_uri: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Csp {
+    pub policy: Option<CspConfig>,
+    pub reporting_enabled: bool,
+    pub report_file: Option<PathBuf>,
+    pub report_endpoint: String,
+    pub flush_interval: f64,
+
+    #[serde(skip)]
+    pub computed_policy: OnceLock<String>,
+    #[serde(skip)]
+    pub pending_reports: Arc<Mutex<Vec<CspReport>>>,
+    #[serde(skip)]
+    pub flush_task: OnceLock<tokio::task::JoinHandle<()>>,
+}
+
+#[async_trait]
+impl super::MiddlewareLayer for Csp {
+    async fn initialize(&self) -> Result<(), magnus::error::Error> {
+        if let Some(policy_config) = &self.policy {
+            let mut parts = Vec::new();
+            if !policy_config.default_src.is_empty() {
+                parts.push(format!(
+                    "default-src {}",
+                    policy_config.default_src.join(" ")
+                ));
+            }
+            if !policy_config.script_src.is_empty() {
+                parts.push(format!("script-src {}", policy_config.script_src.join(" ")));
+            }
+            if !policy_config.style_src.is_empty() {
+                parts.push(format!("style-src {}", policy_config.style_src.join(" ")));
+            }
+            if !policy_config.report_uri.is_empty() {
+                parts.push(format!("report-uri {}", policy_config.report_uri.join(" ")));
+            }
+            let policy = parts.join("; ");
+            debug!(target: "middleware::csp", "Computed CSP policy: {}", policy);
+            self.computed_policy
+                .set(policy)
+                .map_err(|_| ItsiError::new("Failed to set computed CSP policy"))?;
+        }
+
+        if self.reporting_enabled {
+            if let Some(ref report_file) = self.report_file {
+                let flush_interval = self.flush_interval;
+                let report_path = report_file.clone();
+                let pending_reports = Arc::clone(&self.pending_reports);
+                let handle = tokio::spawn(async move {
+                    let mut interval = time::interval(Duration::from_secs_f64(flush_interval));
+                    loop {
+                        interval.tick().await;
+
+                        let mut reports = pending_reports.lock().await;
+                        if !reports.is_empty() {
+                            let mut lines = String::new();
+                            for report in reports.iter() {
+                                if let Ok(line) = serde_json::to_string(report) {
+                                    lines.push_str(&line);
+                                    lines.push('\n');
+                                }
+                            }
+                            reports.clear();
+
+                            debug!("Flushing CSP report to file {:?}", &report_path.display());
+
+                            use tokio::io::AsyncWriteExt;
+
+                            match tokio::fs::OpenOptions::new()
+                                .append(true)
+                                .create(true)
+                                .open(&report_path)
+                                .await
+                            {
+                                Ok(mut file) => {
+                                    if let Err(e) = file.write_all(lines.as_bytes()).await {
+                                        eprintln!("Error writing CSP reports: {:?}", e);
+                                    }
+                                }
+                                Err(e) => {
+                                    eprintln!("Error opening CSP report file: {:?}", e);
+                                }
+                            }
+                        }
+                    }
+                });
+                self.flush_task
+                    .set(handle)
+                    .map_err(|_| ItsiError::new("Failed to set flush task handle"))?;
+            }
+        }
+        Ok(())
+    }
+
+    async fn before(
+        &self,
+        req: HttpRequest,
+        _context: &mut HttpRequestContext,
+    ) -> Result<Either<HttpRequest, HttpResponse>, magnus::error::Error> {
+        if self.reporting_enabled && req.uri().path() == self.report_endpoint {
+            debug!(target: "middleware::csp", "Received CSP report");
+            let full_bytes: Result<Bytes, _> = req
+                .into_body()
+                .into_data_stream()
+                .try_fold(BytesMut::new(), |mut acc, chunk| async move {
+                    acc.extend_from_slice(&chunk);
+                    Ok(acc)
+                })
+                .await
+                .map(|b| b.freeze());
+
+            if let Ok(body_bytes) = full_bytes {
+                if let Ok(report) = serde_json::from_slice::<CspReport>(&body_bytes) {
+                    debug!(target: "middleware::csp", "Report: {:?}", report);
+                    let mut pending = self.pending_reports.lock().await;
+                    pending.push(report);
+                }
+            }
+
+            let mut resp = HttpResponse::new(BoxBody::new(Empty::new()));
+            *resp.status_mut() = StatusCode::NO_CONTENT;
+            return Ok(Either::Right(resp));
+        }
+        Ok(Either::Left(req))
+    }
+
+    async fn after(&self, resp: HttpResponse, _context: &mut HttpRequestContext) -> HttpResponse {
+        if let Some(policy) = self.computed_policy.get() {
+            if !resp.headers().contains_key("Content-Security-Policy") {
+                debug!(target: "middleware::csp", "Adding CSP header");
+                let (mut parts, body) = resp.into_parts();
+                if let Ok(header_value) = HeaderValue::from_str(policy) {
+                    parts
+                        .headers
+                        .insert("Content-Security-Policy", header_value);
+                }
+                return HttpResponse::from_parts(parts, body);
+            } else {
+                debug!(target: "middleware::csp", "CSP header already present");
+            }
+        }
+        resp
+    }
+}
+
+impl FromValue for Csp {}

data/crates/itsi_server/src/server/middleware_stack/middlewares/deny_list.rs

@@ -3,20 +3,22 @@ use crate::{
     services::itsi_http_service::HttpRequestContext,
 };
 
-use super::{ErrorResponse, FromValue, MiddlewareLayer};
+use super::{token_source::TokenSource, ErrorResponse, FromValue, MiddlewareLayer};
 use async_trait::async_trait;
 use either::Either;
 use itsi_error::ItsiError;
 use magnus::error::Result;
 use regex::RegexSet;
 use serde::Deserialize;
-use std::sync::OnceLock;
+use std::{collections::HashMap, sync::OnceLock};
+use tracing::debug;
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct DenyList {
     #[serde(skip_deserializing)]
     pub denied_ips: OnceLock<RegexSet>,
     pub denied_patterns: Vec<String>,
+    pub trusted_proxies: HashMap<String, TokenSource>,
     #[serde(default = "forbidden_error_response")]
     pub error_response: ErrorResponse,
 }
@@ -40,8 +42,15 @@ impl MiddlewareLayer for DenyList {
         req: HttpRequest,
         context: &mut HttpRequestContext,
     ) -> Result<Either<HttpRequest, HttpResponse>> {
+        let addr = if self.trusted_proxies.contains_key(&context.addr) {
+            let source = self.trusted_proxies.get(&context.addr).unwrap();
+            source.extract_token(&req).unwrap_or(&context.addr)
+        } else {
+            &context.addr
+        };
         if let Some(denied_ips) = self.denied_ips.get() {
-            if denied_ips.is_match(&context.addr) {
+            if denied_ips.is_match(addr) {
+                debug!(target: "middleware::deny_list", "IP address {} is not allowed", addr);
                 return Ok(Either::Right(
                     self.error_response
                         .to_http_response(req.accept().into())