@aeriajs/security 0.0.0

package/LICENSE

@@ -0,0 +1,19 @@
+Copyright 2023 João Santos (joaosan177@gmail.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the “Software”), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# `@aeriajs/security`
+
+## Introduction
+
+This package implements common security checks.
+The checks can be used separatelly, or through a function called `useSecurity()`. This function returns an object with two functions:
+
+- `beforeRead()`: checks to be made before reading data
+- `beforeWrite()`: checks to be made before writing data
+
+## References
+
+- `checkOwnershipRead()` and `checkOwnershipWrite()`: [CWE-284: Improper Access Control](https://cwe.mitre.org/data/definitions/284.html), [CWE-639: Authorization Bypass Through User-Controlled Key](https://cwe.mitre.org/data/definitions/639.html)
+- `checkImmutability()`: [CWE-471: Modification of Assumed-Immutable Data (MAID)](https://cwe.mitre.org/data/definitions/471.html )
+- `checkPagination()`: [CWE-770: Allocation of Resources Without Limits or Throttling](https://cwe.mitre.org/data/definitions/770.html)
+- `rateLimiting()`: [CWE-799: Improper Control of Interaction Frequency](https://cwe.mitre.org/data/definitions/799.html)
+

package/dist/define.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityPolicy } from '@aeriajs/types';
+export declare const defineSecurityPolicy: <const TSecurityPolicy extends SecurityPolicy>(policy: TSecurityPolicy) => TSecurityPolicy;

package/dist/define.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineSecurityPolicy = void 0;
+const defineSecurityPolicy = (policy) => {
+    return policy;
+};
+exports.defineSecurityPolicy = defineSecurityPolicy;

package/dist/define.mjs

@@ -0,0 +1,3 @@
+export var defineSecurityPolicy = function(policy) {
+    return policy;
+};

package/dist/immutability.d.ts

@@ -0,0 +1,4 @@
+import type { Context } from '@aeriajs/types';
+import type { SecurityCheckProps, SecurityCheckReadPayload, SecurityCheckWritePayload } from './types.js';
+import { ACErrors } from '@aeriajs/types';
+export declare const checkImmutability: (props: SecurityCheckProps<SecurityCheckReadPayload | SecurityCheckWritePayload>, context: Context) => Promise<import("@aeriajs/types").Right<SecurityCheckReadPayload | SecurityCheckWritePayload> | import("@aeriajs/types").Left<ACErrors.ImmutabilityParentNotFound> | import("@aeriajs/types").Left<ACErrors.ImmutabilityIncorrectChild> | import("@aeriajs/types").Left<ACErrors.ImmutabilityTargetImmutable>>;

package/dist/immutability.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkImmutability = void 0;
+const types_1 = require("@aeriajs/types");
+const common_1 = require("@aeriajs/common");
+const internalCheckImmutability = async (props, context) => {
+    const { propertyName = '', parentId, childId, payload, } = props;
+    const { description } = context;
+    const source = 'what' in payload
+        ? payload.what
+        : payload.filters;
+    const property = description.properties[propertyName];
+    if (!property) {
+        return (0, common_1.right)(props.payload);
+    }
+    const immutable = parentId && (description.immutable === true
+        || (Array.isArray(description.immutable) && description.immutable.includes(propertyName)));
+    const currentDocument = await context.collection.model.findOne({
+        _id: new types_1.ObjectId(parentId),
+    });
+    if (!currentDocument) {
+        return (0, common_1.left)(types_1.ACErrors.ImmutabilityParentNotFound);
+    }
+    if (childId) {
+        if ((Array.isArray(currentDocument[propertyName]) && !currentDocument[propertyName].some((child) => child.toString() === childId))
+            || (!Array.isArray(currentDocument[propertyName]) && currentDocument[propertyName] && currentDocument[propertyName] !== childId.toString())) {
+            return (0, common_1.left)(types_1.ACErrors.ImmutabilityIncorrectChild);
+        }
+    }
+    const fulfilled = currentDocument[propertyName]
+        && (typeof currentDocument[propertyName] === 'object' && !Object.keys(currentDocument[propertyName]).length);
+    if (immutable
+        && fulfilled
+        && (property.inline || (currentDocument[propertyName]).toString() !== source[propertyName])) {
+        return (0, common_1.left)(types_1.ACErrors.ImmutabilityTargetImmutable);
+    }
+    return (0, common_1.right)(props.payload);
+};
+const checkImmutability = async (props, context) => {
+    if (!props.parentId) {
+        return (0, common_1.right)(props.payload);
+    }
+    for (const propertyName of Object.keys(props.payload)) {
+        const result = await internalCheckImmutability({
+            ...props,
+            propertyName,
+        }, context);
+        if ((0, common_1.isLeft)(result)) {
+            return result;
+        }
+    }
+    return internalCheckImmutability(props, context);
+};
+exports.checkImmutability = checkImmutability;

package/dist/immutability.mjs

@@ -0,0 +1,325 @@
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, g, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    };
+    return g = {
+        next: verb(0),
+        "throw": verb(1),
+        "return": verb(2)
+    }, typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(_)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { ACErrors, ObjectId } from "@aeriajs/types";
+import { left, right, isLeft } from "@aeriajs/common";
+var internalCheckImmutability = function() {
+    var _ref = _async_to_generator(function(props, context) {
+        var _props_propertyName, propertyName, parentId, childId, payload, description, source, property, immutable, currentDocument, fulfilled;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    _props_propertyName = props.propertyName, propertyName = _props_propertyName === void 0 ? "" : _props_propertyName, parentId = props.parentId, childId = props.childId, payload = props.payload;
+                    description = context.description;
+                    source = "what" in payload ? payload.what : payload.filters;
+                    property = description.properties[propertyName];
+                    if (!property) {
+                        return [
+                            2,
+                            right(props.payload)
+                        ];
+                    }
+                    immutable = parentId && (description.immutable === true || Array.isArray(description.immutable) && description.immutable.includes(propertyName));
+                    return [
+                        4,
+                        context.collection.model.findOne({
+                            _id: new ObjectId(parentId)
+                        })
+                    ];
+                case 1:
+                    currentDocument = _state.sent();
+                    if (!currentDocument) {
+                        return [
+                            2,
+                            left(ACErrors.ImmutabilityParentNotFound)
+                        ];
+                    }
+                    if (childId) {
+                        if (Array.isArray(currentDocument[propertyName]) && !currentDocument[propertyName].some(function(child) {
+                            return child.toString() === childId;
+                        }) || !Array.isArray(currentDocument[propertyName]) && currentDocument[propertyName] && currentDocument[propertyName] !== childId.toString()) {
+                            return [
+                                2,
+                                left(ACErrors.ImmutabilityIncorrectChild)
+                            ];
+                        }
+                    }
+                    fulfilled = currentDocument[propertyName] && typeof currentDocument[propertyName] === "object" && !Object.keys(currentDocument[propertyName]).length;
+                    if (immutable && fulfilled && (property.inline || currentDocument[propertyName].toString() !== source[propertyName])) {
+                        return [
+                            2,
+                            left(ACErrors.ImmutabilityTargetImmutable)
+                        ];
+                    }
+                    return [
+                        2,
+                        right(props.payload)
+                    ];
+            }
+        });
+    });
+    return function internalCheckImmutability(props, context) {
+        return _ref.apply(this, arguments);
+    };
+}();
+export var checkImmutability = function() {
+    var _ref = _async_to_generator(function(props, context) {
+        var _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, propertyName, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    if (!props.parentId) {
+                        return [
+                            2,
+                            right(props.payload)
+                        ];
+                    }
+                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        6,
+                        7,
+                        8
+                    ]);
+                    _iterator = Object.keys(props.payload)[Symbol.iterator]();
+                    _state.label = 2;
+                case 2:
+                    if (!!(_iteratorNormalCompletion = (_step = _iterator.next()).done)) return [
+                        3,
+                        5
+                    ];
+                    propertyName = _step.value;
+                    return [
+                        4,
+                        internalCheckImmutability(_object_spread_props(_object_spread({}, props), {
+                            propertyName: propertyName
+                        }), context)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    if (isLeft(result)) {
+                        return [
+                            2,
+                            result
+                        ];
+                    }
+                    _state.label = 4;
+                case 4:
+                    _iteratorNormalCompletion = true;
+                    return [
+                        3,
+                        2
+                    ];
+                case 5:
+                    return [
+                        3,
+                        8
+                    ];
+                case 6:
+                    err = _state.sent();
+                    _didIteratorError = true;
+                    _iteratorError = err;
+                    return [
+                        3,
+                        8
+                    ];
+                case 7:
+                    try {
+                        if (!_iteratorNormalCompletion && _iterator.return != null) {
+                            _iterator.return();
+                        }
+                    } finally{
+                        if (_didIteratorError) {
+                            throw _iteratorError;
+                        }
+                    }
+                    return [
+                        7
+                    ];
+                case 8:
+                    return [
+                        2,
+                        internalCheckImmutability(props, context)
+                    ];
+            }
+        });
+    });
+    return function checkImmutability(props, context) {
+        return _ref.apply(this, arguments);
+    };
+}();

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './define.js';
+export * from './immutability.js';
+export * from './ownership.js';
+export * from './pagination.js';
+export * from './rateLimiting.js';
+export * from './use.js';

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./define.js"), exports);
+__exportStar(require("./immutability.js"), exports);
+__exportStar(require("./ownership.js"), exports);
+__exportStar(require("./pagination.js"), exports);
+__exportStar(require("./rateLimiting.js"), exports);
+__exportStar(require("./use.js"), exports);

package/dist/index.mjs

@@ -0,0 +1,6 @@
+export * from "./define.mjs";
+export * from "./immutability.mjs";
+export * from "./ownership.mjs";
+export * from "./pagination.mjs";
+export * from "./rateLimiting.mjs";
+export * from "./use.mjs";

package/dist/ownership.d.ts

@@ -0,0 +1,5 @@
+import type { Context, InsertPayload } from '@aeriajs/types';
+import type { SecurityCheckProps, SecurityCheckReadPayload } from './types.js';
+import { ACErrors } from '@aeriajs/types';
+export declare const checkOwnershipRead: (props: SecurityCheckProps<SecurityCheckReadPayload>, context: Context) => Promise<import("@aeriajs/types").Right<SecurityCheckReadPayload>>;
+export declare const checkOwnershipWrite: (props: SecurityCheckProps<InsertPayload<any>>, context: Context) => Promise<import("@aeriajs/types").Right<InsertPayload<any>> | import("@aeriajs/types").Left<ACErrors.OwnershipError>>;

package/dist/ownership.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkOwnershipWrite = exports.checkOwnershipRead = void 0;
+const types_1 = require("@aeriajs/types");
+const common_1 = require("@aeriajs/common");
+const checkOwnershipRead = async (props, context) => {
+    const { token, description } = context;
+    const payload = Object.assign({}, props.payload);
+    if (token.authenticated && description.owned) {
+        if (!token.roles.includes('root')) {
+            payload.filters.owner = token.sub;
+        }
+    }
+    return (0, common_1.right)(payload);
+};
+exports.checkOwnershipRead = checkOwnershipRead;
+const checkOwnershipWrite = async (props, context) => {
+    const { token, description } = context;
+    const { parentId } = props;
+    const payload = Object.assign({}, props.payload);
+    if (token.authenticated && description.owned) {
+        if (!payload.what._id || description.owned === 'always') {
+            payload.what.owner = token.sub;
+        }
+        else {
+            return (0, common_1.right)(payload);
+        }
+    }
+    if ((!payload.what.owner && !parentId) && context.description.owned) {
+        return (0, common_1.left)(types_1.ACErrors.OwnershipError);
+    }
+    return (0, common_1.right)(payload);
+};
+exports.checkOwnershipWrite = checkOwnershipWrite;