@aikidosec/broker-client 1.0.3 → 1.0.5

package/app/client.js

@@ -12,6 +12,7 @@ import { Address4, Address6 } from 'ip-address';
 import dns from 'native-dns';
 import fs from 'fs';
 import { ResourceManager } from './resourceManager.js';
+import { HttpsProxyAgent } from 'https-proxy-agent';
 
 // Configure logging
 const log = {
@@ -36,9 +37,12 @@ const DNS_SERVERS = process.env.DNS_SERVERS
   : null;
 
 // Configure axios defaults
+const MAX_RESPONSE_SIZE = 100 * 1024 * 1024; // 100 MB
 const axiosConfig = {
   timeout: 30000,
-  maxRedirects: 5
+  maxRedirects: 5,
+  maxContentLength: MAX_RESPONSE_SIZE,
+  maxBodyLength: MAX_RESPONSE_SIZE
 };
 
 // Create axios instance for internal requests
@@ -213,36 +217,9 @@ function isInternalUrl(url) {
   }
 }
 
-/**
- * Check if a resource is registered with the broker.
- */
-function isResourceAllowed(resource) {
-  const registeredResources = resourceManager.getResources();
-  
-  // If no resources registered yet, deny (customer must register resources first)
-  if (Object.keys(registeredResources).length === 0) {
-    log.warn("No resources registered - customer must register resources via setup mode");
-    return false;
-  }
-  
-  // Normalize the target URL for comparison
-  const resourceParsed = new URL(resource);
-  const resourceNormalized = `${resourceParsed.protocol}//${resourceParsed.host}${resourceParsed.pathname || '/'}`;
-  
-  // Check if the exact base_url is registered
-  for (const baseUrl of Object.keys(registeredResources)) {
-    const baseParsed = new URL(baseUrl);
-    const baseNormalized = `${baseParsed.protocol}//${baseParsed.host}${baseParsed.pathname || '/'}`;
-    
-    // Allow if target URL starts with registered base URL
-    if (resourceNormalized.startsWith(baseNormalized)) {
-      log.info(`Resource ${resource} matches registered base_url ${baseUrl}`);
-      return true;
-    }
-  }
-  
-  log.warn(`Resource ${resource} not found in registered resources: ${Object.keys(registeredResources)}`);
-  return false;
+let agent;
+if (process.env.HTTPS_PROXY || process.env.ALL_PROXY) {
+  agent = new HttpsProxyAgent(process.env.HTTPS_PROXY || process.env.ALL_PROXY);
 }
 
 // Create Socket.IO client
@@ -250,13 +227,16 @@ const socket = io(SERVER_URL, {
   auth: {
     client_secret: CLIENT_SECRET
   },
+  agent,
   transports: ['websocket', 'polling'],
   reconnection: true,
   reconnectionAttempts: Infinity,
   reconnectionDelay: 1000,
   reconnectionDelayMax: 30000,
   randomizationFactor: 0.5,
-  autoConnect: false  // Don't connect until after registration
+  tryAllTransports: true, // if we don't, it won't try to fallback from websocket to polling
+  autoConnect: false,  // Don't connect until after registration
+  withCredentials: true // make sure cookies work for sticky sessions
 });
 
 // Socket.IO event handlers
@@ -324,17 +304,17 @@ socket.on('forward_request', async (data, callback) => {
       request_id: requestId,
       status_code: 403,
       headers: {},
-      body: 'Target URL is not an allowed internal resource'
+      body: formatMessageBody('Target URL is not an allowed internal resource')
     });
     return;
   }
 
-  if (!isResourceAllowed(targetUrl)) {
+  if (!(await resourceManager.isResourceAllowedWithSync(targetUrl))) {
     callback({
       request_id: requestId,
       status_code: 403,
       headers: {},
-      body: 'Target URL is not in the allowed resources list'
+      body: formatMessageBody('Target URL is not in the allowed resources list')
     });
     return;
   }
@@ -361,30 +341,41 @@ socket.on('forward_request', async (data, callback) => {
       url: resolvedUrl,
       headers,
       data: body,
-      validateStatus: () => true // Accept any status code
+      validateStatus: () => true, // Accept any status code
+      responseType: 'arraybuffer', // Get raw bytes, don't parse JSON
     });
     
     log.info(`Successfully forwarded request ${requestId} to ${targetUrl}, status: ${response.status}`);
     
     // Return response via acknowledgement
+    // Send body as base64 to preserve binary data byte-for-byte (critical for Docker registry digests)
+    const responseBody = response.data ? Buffer.from(response.data).toString('base64') : null;
+    
     callback({
       request_id: requestId,
       status_code: response.status,
       headers: response.headers,
-      body: typeof response.data === 'string' ? response.data : JSON.stringify(response.data)
+      body: responseBody,
+      version: 2
     });
     
   } catch (error) {
-    log.error(`Error forwarding request ${requestId} to ${targetUrl}: ${error.message}`);
+    log.error(`Error forwarding request ${requestId} to ${targetUrl}: ${error?.response?.status || error.message}`);
+    const errorMessage = `Error reaching internal resource: ${error?.response?.status || error.message}`;
     callback({
       request_id: requestId,
       status_code: 502,
       headers: {},
-      body: `Error reaching internal resource: ${error.message}`
+      body: formatMessageBody(errorMessage),
+      version: 2
     });
   }
 });
 
+function formatMessageBody(message) {
+  return Buffer.from(message, 'utf-8').toString('base64');
+}
+
 /**
  * Register this client with the broker server
  */

package/app/resourceManager.js

@@ -29,6 +29,8 @@ export class ResourceManager {
     this._serverUrl = null;
     this._clientId = null;
     this._clientSecret = null;
+    this._lastResourceSync = 0;
+    this._syncThrottleMs = 30000; // 30 seconds
     this._loadFromFile();
   }
 
@@ -114,6 +116,70 @@ export class ResourceManager {
     return { ...this._resources };
   }
 
+  /**
+   * Check if a resource URL is allowed (registered).
+   * @param {string} resource - The full URL to check
+   * @returns {boolean} True if allowed, false otherwise
+   */
+  isResourceAllowed(resource) {
+    // If no resources registered yet, deny
+    if (Object.keys(this._resources).length === 0) {
+      log.warn("No resources registered - customer must register resources via setup mode");
+      return false;
+    }
+    
+    // Normalize the target URL for comparison
+    const resourceParsed = new URL(resource);
+    const resourceNormalized = `${resourceParsed.protocol}//${resourceParsed.host}${resourceParsed.pathname || '/'}`;
+    
+    // Check if the exact base_url is registered
+    for (const baseUrl of Object.keys(this._resources)) {
+      const baseParsed = new URL(baseUrl);
+      const baseNormalized = `${baseParsed.protocol}//${baseParsed.host}${baseParsed.pathname || '/'}`;
+      
+      // Allow if target URL starts with registered base URL
+      if (resourceNormalized.startsWith(baseNormalized)) {
+        log.info(`Resource ${resource} matches registered base_url ${baseUrl}`);
+        return true;
+      }
+    }
+    
+    log.warn(`Resource ${resource} not found in registered resources: ${Object.keys(this._resources)}`);
+    return false;
+  }
+
+  /**
+   * Check if a resource is allowed, with automatic sync retry if not found.
+   * Syncs from broker if resource not found and throttle period has passed.
+   * @param {string} resource - The full URL to check
+   * @returns {Promise<boolean>} True if allowed, false otherwise
+   */
+  async isResourceAllowedWithSync(resource) {
+    // First check without syncing
+    if (this.isResourceAllowed(resource)) {
+      return true;
+    }
+    
+    // Resource not found - try syncing from broker if enough time has passed
+    const now = Date.now();
+    if (now - this._lastResourceSync > this._syncThrottleMs) {
+      log.info(`Resource ${resource} not found, syncing from broker...`);
+      this._lastResourceSync = now;
+      try {
+        await this.syncFromBroker();
+        // Check again after sync
+        if (this.isResourceAllowed(resource)) {
+          log.info(`Resource ${resource} found after sync`);
+          return true;
+        }
+      } catch (error) {
+        log.error(`Failed to sync resources: ${error.message}`);
+      }
+    }
+    
+    return false;
+  }
+
   /**
    * Get resource_id for a base_url.
    * @param {string} baseUrl - The base URL to look up
@@ -177,6 +243,7 @@ export class ResourceManager {
         
         // Sync from broker response
         this.syncFromCore(resources);
+        this._lastResourceSync = Date.now();
         log.info(`✓ Synced ${Object.keys(resources).length} resources from broker`);
       } else {
         log.warn(`Failed to fetch resources: ${response.status} - ${response.data}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikidosec/broker-client",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Aikido Broker Client - Runs in customer network to forward requests to internal resources",
   "main": "app/client.js",
   "type": "module",
@@ -33,6 +33,7 @@
   },
   "dependencies": {
     "axios": "1.13.2",
+    "https-proxy-agent": "^7.0.6",
     "ip-address": "10.0.1",
     "native-dns": "0.7.0",
     "socket.io-client": "4.8.1"