@apolitical/server 2.3.3-rc.test.1 → 2.4.1

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.1] - 2022-03-02
+### Changed
+- Update authorisation middleware to include authentication check in cases where we would like to protect endpoints
+
+## [2.4.0] - 2022-02-22
+### Added
+- User slug to error logs as metadata
+### Changed
+- Transition to new logger middleware format
+
 ## [2.3.3] - 2022-02-21
 ### Changed
 - maging sure index.html is not considered as a static asset by the middleware loader

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apolitical/server",
-  "version": "2.3.3-rc.test.1",
+  "version": "2.4.1",
   "description": "Node.js module to encapsulate Apolitical's express server setup",
   "author": "Apolitical Group Limited <engineering@apolitical.co>",
   "license": "MIT",

package/src/config.js

@@ -3,7 +3,7 @@
 const { NODE_ENV, LOG_LEVEL } = process.env;
 
 const NAME = 'apolitical-server';
-const VERSION = 'v2.0.0';
+const VERSION = '2.4.1';
 const ADMIN_ROLE = 'administrator';
 
 module.exports = {

package/src/container.js

@@ -31,6 +31,7 @@ const serverError = require('./errors/server.error');
 const jwtDecodeHelper = require('./helpers/jwt/decode.helper');
 const jwtEncodeHelper = require('./helpers/jwt/encode.helper');
 const jwtPassportHelper = require('./helpers/jwt/passport.helper');
+const loggerHelper = require('./helpers/logger.helper');
 // Loaders
 const documentationLoader = require('./loaders/documentation.loader');
 const loggerLoader = require('./loaders/logger.loader');
@@ -80,6 +81,7 @@ container.register({
   jwtDecodeHelper: asFunction(jwtDecodeHelper).singleton(),
   jwtEncodeHelper: asFunction(jwtEncodeHelper).singleton(),
   jwtPassportHelper: asFunction(jwtPassportHelper).singleton(),
+  loggerHelper: asFunction(loggerHelper).singleton(),
   // Loaders
   documentationLoader: asFunction(documentationLoader).singleton(),
   loggerLoader: asFunction(loggerLoader).singleton(),

package/src/helpers/logger.helper.js

@@ -0,0 +1,35 @@
+'use strict';
+
+module.exports = ({ morgan, config, logger }) => {
+  const {
+    LOGGED_OUT_SLUG,
+    TOKENS: { USER_SLUG },
+  } = config.SERVER.MORGAN_OPTIONS;
+
+  function getUserSlug(req) {
+    return req.user && req.user.slug ? req.user.slug : LOGGED_OUT_SLUG;
+  }
+
+  function buildCustomFormat(tokens, req, res) {
+    return [
+      tokens.method(req, res),
+      tokens.url(req, res),
+      tokens.status(req, res),
+      tokens[USER_SLUG](req),
+      tokens['response-time'](req, res),
+      'ms',
+    ].join(' ');
+  }
+
+  function buildMiddleware(labels) {
+    const childLogger = logger.where(__filename, 'load');
+    childLogger.debug('Started');
+    // Setup Morgan with custom format and Apolitical Logger stream
+    morgan.token(USER_SLUG, getUserSlug);
+    const morganMiddleware = morgan(buildCustomFormat, logger.where(__filename, 'morganMiddleware', labels));
+    childLogger.debug('Finished');
+    return morganMiddleware;
+  }
+
+  return { getUserSlug, buildMiddleware };
+};

package/src/loaders/logger.loader.js

@@ -1,39 +1,19 @@
 'use strict';
 
-module.exports = ({ apoliticalLogger, morgan, config, logger }) => {
-  const {
-    LOGGED_OUT_SLUG,
-    TOKENS: { USER_SLUG },
-  } = config.SERVER.MORGAN_OPTIONS;
-
-  function getUserSlug(req) {
-    return req.user && req.user.slug ? req.user.slug : LOGGED_OUT_SLUG;
-  }
-
-  function buildCustomFormat(tokens, req, res) {
-    return [
-      tokens.method(req, res),
-      tokens.url(req, res),
-      tokens.status(req, res),
-      tokens[USER_SLUG](req),
-      tokens['response-time'](req, res),
-      'ms',
-    ].join(' ');
-  }
-
+module.exports = ({ apoliticalLogger, config, logger, loggerHelper }) => {
   return async function load(app, { labels }) {
     const childLogger = logger.where(__filename, 'load');
     childLogger.debug('Started');
-    // Setup Morgan with custom format and Apolitical Logger stream
-    morgan.token(USER_SLUG, getUserSlug);
-    const morganMiddleware = morgan(buildCustomFormat, logger.where(__filename, 'morganMiddleware', labels));
-    app.use(morganMiddleware);
-    // Setup Google Cloud with Apolitical Logger
     if (config.NODE_ENV === 'production') {
+      // Setup Google Cloud with Apolitical Logger
       const winstonMiddleware = await apoliticalLogger.loggerMiddleware(
         logger.where(__filename, 'winstonMiddleware', labels),
       );
       app.use(winstonMiddleware);
+    } else {
+      // Setup Morgan with custom format and Apolitical Logger stream
+      const morganMiddleware = loggerHelper.buildMiddleware(labels);
+      app.use(morganMiddleware);
     }
     childLogger.debug('Finished');
   };

package/src/middlewares/authorisation.middleware.js

@@ -20,7 +20,9 @@ module.exports = ({ logger, serverError: { Forbidden }, config }) => {
       }
       // Check permissions and prevent unauthorised requests
       let unauthorised = false;
-      if (!allowNonAdmin && isNotAdmin && isNotMyselfSlug) {
+      if (!allowNonAdmin && !req.user) {
+        unauthorised = true;
+      } else if (!allowNonAdmin && isNotAdmin && isNotMyselfSlug) {
         unauthorised = true;
       } else if (!allowNonAdmin && isNotAdmin && !myselfSource) {
         unauthorised = true;

package/src/middlewares/error.middleware.js

@@ -7,12 +7,10 @@ module.exports =
       JWT: { AUTH0 },
     },
     logger,
+    loggerHelper: { getUserSlug },
     serverError: { GeneralError },
   }) =>
   ({ labels, redirectURL, fallbackController }) => {
-    // Apolitical Logger (with service metadata)
-    const errorLogger = logger.where(__filename, 'errorMiddleware', labels);
-
     // eslint-disable-next-line no-unused-vars
     return function handler(err, req, res, next) {
       const childLogger = logger.where(__filename, 'handler');
@@ -38,21 +36,26 @@ module.exports =
           errors = ['unknown-error'];
         }
       }
+      // Log the error with all the relevent info
+      const userSlug = getUserSlug(req);
       if (req.log) {
-        req.log.warn(message, { errors });
+        req.log.warn(message, { errors, userSlug });
       } else {
-        errorLogger.warn(message, { errors });
+        const errorLogger = logger.where(__filename, 'handler', labels);
+        errorLogger.warn(message, { errors, userSlug });
       }
-
+      // Use the redirect URL to redirect the request
       if (redirectURL) {
         return res.redirect(TEMPORARY_REDIRECT, `${redirectURL}?errorMessage=${encodeURI(message)}`);
       }
+      // Use the fallback controller to handle the response
       if (fallbackController) {
         // more known error messages can be added here
         if (message === 'Unexpected error: Cannot read items') {
           return fallbackController(req, res);
         }
       }
+      // Use the info on the error to send the response
       return res.status(code).json({ message, errors });
     };
   };