@boxyhq/saml-jackson 0.2.1-beta.155 → 0.2.1-beta.161

package/README.md

@@ -321,20 +321,23 @@ Configuration is done via env vars (and in the case of the npm library via an op
 
 The following options are supported and will have to be configured during deployment.
 
-| Key                               | Description                                                                                                                                                                                                                                                                                                                                                                                                          | Default                         |
-| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
-| HOST_URL                          | The URL to bind to                                                                                                                                                                                                                                                                                                                                                                                                   | `localhost`                     |
-| HOST_PORT                         | The port to bind to                                                                                                                                                                                                                                                                                                                                                                                                  | `5000`                          |
-| EXTERNAL_URL (npm: externalUrl)   | The public URL to reach this service, used internally for documenting the SAML configuration instructions.                                                                                                                                                                                                                                                                                                           | `http://{HOST_URL}:{HOST_PORT}` |
-| INTERNAL_HOST_URL                 | The URL to bind to expose the internal APIs. Do not configure this to a public network.                                                                                                                                                                                                                                                                                                                              | `localhost`                     |
-| INTERNAL_HOST_PORT                | The port to bind to for the internal APIs.                                                                                                                                                                                                                                                                                                                                                                           | `6000`                          |
-| JACKSON_API_KEYS                  | A comma separated list of API keys that will be validated when serving the Config API requests                                                                                                                                                                                                                                                                                                                       |                                 |
-| SAML_AUDIENCE (npm: samlAudience) | This is just an identifier to validate the SAML audience, this value will also get configured in the SAML apps created by your customers. Once set do not change this value unless you get your customers to reconfigure their SAML again. It is case-sensitive. This does not have to be a real URL.                                                                                                                | `https://saml.boxyhq.com`       |
-| IDP_ENABLED (npm: idpEnabled)     | Set to `true` to enable IdP initiated login for SAML. SP initiated login is the only recommended flow but you might have to support IdP login at times.                                                                                                                                                                                                                                                              | `false`                         |
-| DB_ENGINE (npm: db.engine)        | Supported values are `redis`, `sql`, `mongo`, `mem`.                                                                                                                                                                                                                                                                                                                                                                 | `sql`                           |
-| DB_URL (npm: db.url)              | The database URL to connect to. For example `postgres://postgres:postgres@localhost:5450/jackson`                                                                                                                                                                                                                                                                                                                    |                                 |
-| DB_TYPE (npm: db.type)            | Only needed when DB_ENGINE is `sql`. Supported values are `postgres`, `cockroachdb`, `mysql`, `mariadb`.                                                                                                                                                                                                                                                                                                             | `postgres`                      |
-| PRE_LOADED_CONFIG                 | If you only need a single tenant or a handful of pre-configured tenants then this config will help you read and load SAML configs. It works well with the mem DB engine so you don't have to configure any external databases for this to work (though it works with those as well). This is a path (absolute or relative) to a directory that contains files organized in the format described in the next section. |                                 |
+| Key                                       | Description                                                                                                                                                                                                                                                                                                                                                                                                          | Default                         |
+| ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- |
+| HOST_URL                                  | The URL to bind to                                                                                                                                                                                                                                                                                                                                                                                                   | `localhost`                     |
+| HOST_PORT                                 | The port to bind to                                                                                                                                                                                                                                                                                                                                                                                                  | `5000`                          |
+| EXTERNAL_URL (npm: externalUrl)           | The public URL to reach this service, used internally for documenting the SAML configuration instructions.                                                                                                                                                                                                                                                                                                           | `http://{HOST_URL}:{HOST_PORT}` |
+| INTERNAL_HOST_URL                         | The URL to bind to expose the internal APIs. Do not configure this to a public network.                                                                                                                                                                                                                                                                                                                              | `localhost`                     |
+| INTERNAL_HOST_PORT                        | The port to bind to for the internal APIs.                                                                                                                                                                                                                                                                                                                                                                           | `6000`                          |
+| JACKSON_API_KEYS                          | A comma separated list of API keys that will be validated when serving the Config API requests                                                                                                                                                                                                                                                                                                                       |                                 |
+| SAML_AUDIENCE (npm: samlAudience)         | This is just an identifier to validate the SAML audience, this value will also get configured in the SAML apps created by your customers. Once set do not change this value unless you get your customers to reconfigure their SAML again. It is case-sensitive. This does not have to be a real URL.                                                                                                                | `https://saml.boxyhq.com`       |
+| IDP_ENABLED (npm: idpEnabled)             | Set to `true` to enable IdP initiated login for SAML. SP initiated login is the only recommended flow but you might have to support IdP login at times.                                                                                                                                                                                                                                                              | `false`                         |
+| DB_ENGINE (npm: db.engine)                | Supported values are `redis`, `sql`, `mongo`, `mem`.                                                                                                                                                                                                                                                                                                                                                                 | `sql`                           |
+| DB_URL (npm: db.url)                      | The database URL to connect to. For example `postgres://postgres:postgres@localhost:5450/jackson`                                                                                                                                                                                                                                                                                                                    |                                 |
+| DB_TYPE (npm: db.type)                    | Only needed when DB_ENGINE is `sql`. Supported values are `postgres`, `cockroachdb`, `mysql`, `mariadb`.                                                                                                                                                                                                                                                                                                             | `postgres`                      |
+| DB_TTL (npm: db.ttl)                      | TTL for the code, session and token stores (in seconds).                                                                                                                                                                                                                                                                                                                                                             | 300                             |
+| DB_CLEANUP_LIMIT (npm: db.cleanupLimit)   | Limit cleanup of TTL entries to this number.                                                                                                                                                                                                                                                                                                                                                                         | 1000                            |
+| DB_ENCRYPTION_KEY (npm: db.encryptionKey) | To encrypt data at rest specify a 32 character key.                                                                                                                                                                                                                                                                                                                                                                  |                                 |
+| PRE_LOADED_CONFIG                         | If you only need a single tenant or a handful of pre-configured tenants then this config will help you read and load SAML configs. It works well with the mem DB engine so you don't have to configure any external databases for this to work (though it works with those as well). This is a path (absolute or relative) to a directory that contains files organized in the format described in the next section. |                                 |
 
 ## Pre-loaded SAML Configuration
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "0.2.1-beta.155",
+  "version": "0.2.1-beta.161",
   "license": "Apache 2.0",
   "description": "SAML 2.0 service",
   "main": "src/index.js",

package/src/controller/api.js

@@ -2,6 +2,7 @@ const saml = require('../saml/saml.js');
 const x509 = require('../saml/x509.js');
 const dbutils = require('../db/utils.js');
 const { indexNames } = require('./utils.js');
+const { JacksonError } = require('./error.js');
 
 const crypto = require('crypto');
 
@@ -22,6 +23,27 @@ const extractHostName = (url) => {
 const config = async (body) => {
   const { rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product } =
     body;
+
+  if (!rawMetadata) {
+    throw new JacksonError('Please provide rawMetadata', 400);
+  }
+
+  if (!defaultRedirectUrl) {
+    throw new JacksonError('Please provide a defaultRedirectUrl', 400);
+  }
+
+  if (!redirectUrl) {
+    throw new JacksonError('Please provide redirectUrl', 400);
+  }
+
+  if (!tenant) {
+    throw new JacksonError('Please provide tenant', 400);
+  }
+
+  if (!product) {
+    throw new JacksonError('Please provide product', 400);
+  }
+
   const idpMetadata = await saml.parseMetadataAsync(rawMetadata);
 
   // extract provider

package/src/db/db.js

@@ -3,18 +3,39 @@ const mongo = require('./mongo.js');
 const redis = require('./redis.js');
 const sql = require('./sql/sql.js');
 const store = require('./store.js');
+const encrypter = require('./encrypter.js');
+
+const decrypt = (res, encryptionKey) => {
+  if (res.iv && res.tag) {
+    return JSON.parse(
+      encrypter.decrypt(res.value, res.iv, res.tag, encryptionKey)
+    );
+  }
+
+  return JSON.parse(res.value);
+};
 
 class DB {
-  constructor(db) {
+  constructor(db, encryptionKey) {
     this.db = db;
+    this.encryptionKey = encryptionKey;
   }
 
   async get(namespace, key) {
-    return await this.db.get(namespace, key);
+    const res = await this.db.get(namespace, key);
+    if (!res) {
+      return null;
+    }
+
+    return decrypt(res, this.encryptionKey);
   }
 
   async getByIndex(namespace, idx) {
-    return await this.db.getByIndex(namespace, idx);
+    const res = await this.db.getByIndex(namespace, idx);
+    const encryptionKey = this.encryptionKey;
+    return res.map((r) => {
+      return decrypt(r, encryptionKey);
+    });
   }
 
   // ttl is in seconds
@@ -23,13 +44,11 @@ class DB {
       throw new Error('secondary indexes not allow on a store with ttl');
     }
 
-    return await this.db.put(
-      namespace,
-      key,
-      JSON.stringify(val),
-      ttl,
-      ...indexes
-    );
+    const dbVal = this.encryptionKey
+      ? encrypter.encrypt(JSON.stringify(val), this.encryptionKey)
+      : { value: JSON.stringify(val) };
+
+    return await this.db.put(namespace, key, dbVal, ttl, ...indexes);
   }
 
   async delete(namespace, key) {
@@ -43,15 +62,18 @@ class DB {
 
 module.exports = {
   new: async (options) => {
+    const encryptionKey = options.encryptionKey
+      ? Buffer.from(options.encryptionKey, 'latin1')
+      : null;
     switch (options.engine) {
       case 'redis':
-        return new DB(await redis.new(options));
+        return new DB(await redis.new(options), encryptionKey);
       case 'sql':
-        return new DB(await sql.new(options));
+        return new DB(await sql.new(options), encryptionKey);
       case 'mongo':
-        return new DB(await mongo.new(options));
+        return new DB(await mongo.new(options), encryptionKey);
       case 'mem':
-        return new DB(await mem.new(options));
+        return new DB(await mem.new(options), encryptionKey);
       default:
         throw new Error('unsupported db engine: ' + options.engine);
     }

package/src/db/db.test.js

@@ -2,6 +2,8 @@ const t = require('tap');
 
 const DB = require('./db.js');
 
+const encryptionKey = '3yGrTcnKPBqqHoH3zZMAU6nt4bmIYb2q';
+
 let configStores = [];
 let ttlStores = [];
 const ttl = 3;
@@ -17,39 +19,87 @@ const record2 = {
   city: 'London',
 };
 
+const memDbConfig = {
+  engine: 'mem',
+  ttl: 1,
+};
+
+const redisDbConfig = {
+  engine: 'redis',
+  url: 'redis://localhost:6379',
+};
+
+const postgresDbConfig = {
+  engine: 'sql',
+  url: 'postgresql://postgres:postgres@localhost:5432/postgres',
+  type: 'postgres',
+  ttl: 1,
+  cleanupLimit: 1,
+};
+
+const mongoDbConfig = {
+  engine: 'mongo',
+  url: 'mongodb://localhost:27017/jackson',
+};
+
+const mysqlDbConfig = {
+  engine: 'sql',
+  url: 'mysql://root:mysql@localhost:3307/mysql',
+  type: 'mysql',
+  ttl: 1,
+  cleanupLimit: 1,
+};
+
+const mariadbDbConfig = {
+  engine: 'sql',
+  url: 'mariadb://root@localhost:3306/mysql',
+  type: 'mariadb',
+  ttl: 1,
+  cleanupLimit: 1,
+};
+
 const dbs = [
   {
-    engine: 'mem',
-    ttl: 1,
+    ...memDbConfig,
+  },
+  {
+    ...memDbConfig,
+    encryptionKey,
+  },
+  {
+    ...redisDbConfig,
+  },
+  {
+    ...redisDbConfig,
+    encryptionKey,
+  },
+  {
+    ...postgresDbConfig,
+  },
+  {
+    ...postgresDbConfig,
+    encryptionKey,
+  },
+  {
+    ...mongoDbConfig,
   },
   {
-    engine: 'redis',
-    url: 'redis://localhost:6379',
+    ...mongoDbConfig,
+    encryptionKey,
   },
   {
-    engine: 'sql',
-    url: 'postgresql://postgres:postgres@localhost:5432/postgres',
-    type: 'postgres',
-    ttl: 1,
-    limit: 1,
+    ...mysqlDbConfig,
   },
   {
-    engine: 'mongo',
-    url: 'mongodb://localhost:27017/jackson',
+    ...mysqlDbConfig,
+    encryptionKey,
   },
   {
-    engine: 'sql',
-    url: 'mysql://root:mysql@localhost:3307/mysql',
-    type: 'mysql',
-    ttl: 1,
-    limit: 1,
+    ...mariadbDbConfig,
   },
   {
-    engine: 'sql',
-    url: 'mariadb://root@localhost:3306/mysql',
-    type: 'mariadb',
-    ttl: 1,
-    limit: 1,
+    ...mariadbDbConfig,
+    encryptionKey,
   },
 ];
 
@@ -224,7 +274,7 @@ t.test('dbs', ({ end }) => {
       }
 
       await new Promise((resolve) =>
-        setTimeout(resolve, (2*ttl + 0.5) * 1000)
+        setTimeout(resolve, (2 * ttl + 0.5) * 1000)
       );
 
       const ret1 = await ttlStore.get(record1.id);

package/src/db/encrypter.js

@@ -0,0 +1,36 @@
+const crypto = require('crypto');
+
+const ALGO = 'aes-256-gcm';
+const BLOCK_SIZE = 16; // 128 bit
+
+const encrypt = (text, key) => {
+  const iv = crypto.randomBytes(BLOCK_SIZE);
+  const cipher = crypto.createCipheriv(ALGO, key, iv);
+
+  let ciphertext = cipher.update(text, 'utf8', 'base64');
+  ciphertext += cipher.final('base64');
+  return {
+    iv: iv.toString('base64'),
+    tag: cipher.getAuthTag().toString('base64'),
+    value: ciphertext,
+  };
+};
+
+const decrypt = (ciphertext, iv, tag, key) => {
+  const decipher = crypto.createDecipheriv(
+    ALGO,
+    key,
+    Buffer.from(iv, 'base64')
+  );
+  decipher.setAuthTag(Buffer.from(tag, 'base64'));
+
+  let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
+  cleartext += decipher.final('utf8');
+
+  return cleartext;
+};
+
+module.exports = {
+  encrypt,
+  decrypt,
+};

package/src/db/mem.js

@@ -34,7 +34,7 @@ class Mem {
   async get(namespace, key) {
     let res = this.store[dbutils.key(namespace, key)];
     if (res) {
-      return JSON.parse(res);
+      return res;
     }
 
     return null;

package/src/db/mongo.js

@@ -25,7 +25,7 @@ class Mongo {
       _id: dbutils.key(namespace, key),
     });
     if (res && res.value) {
-      return JSON.parse(res.value);
+      return res.value;
     }
 
     return null;
@@ -40,7 +40,7 @@ class Mongo {
 
     const ret = [];
     for (const doc of docs || []) {
-      ret.push(JSON.parse(doc.value));
+      ret.push(doc.value);
     }
 
     return ret;

package/src/db/redis.js

@@ -46,7 +46,7 @@ class Redis {
     let tx = this.client.multi();
     const k = dbutils.key(namespace, key);
 
-    tx = tx.set(k, val);
+    tx = tx.set(k, JSON.stringify(val));
 
     if (ttl) {
       tx = tx.expire(k, ttl);

package/src/db/sql/entity/JacksonStore.js

@@ -27,6 +27,16 @@ module.exports = (type) => {
       value: {
         type: valueType(type),
       },
+      iv: {
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+      },
+      tag: {
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+      },
     },
   });
 };

package/src/db/sql/model/JacksonStore.js

@@ -1,7 +1,9 @@
 /*export */ class JacksonStore {
-  constructor(key, value) {
+  constructor(key, value, iv, tag) {
     this.key = key;
     this.value = value;
+    this.iv = iv;
+    this.tag = tag;
   }
 }
 

package/src/db/sql/sql.js

@@ -14,7 +14,7 @@ class Sql {
       while (true) {
         try {
           this.connection = await typeorm.createConnection({
-            name: options.type,
+            name: options.type + Math.floor(Math.random() * 100000),
             type: options.type,
             url: options.url,
             synchronize: true,
@@ -39,14 +39,14 @@ class Sql {
       this.indexRepository = this.connection.getRepository(JacksonIndex);
       this.ttlRepository = this.connection.getRepository(JacksonTTL);
 
-      if (options.ttl && options.limit) {
+      if (options.ttl && options.cleanupLimit) {
         this.ttlCleanup = async () => {
           const now = Date.now();
 
           while (true) {
             const ids = await this.ttlRepository
               .createQueryBuilder('jackson_ttl')
-              .limit(options.limit)
+              .limit(options.cleanupLimit)
               .where('jackson_ttl.expiresAt <= :expiresAt', { expiresAt: now })
               .getMany();
 
@@ -68,7 +68,7 @@ class Sql {
         this.timerId = setTimeout(this.ttlCleanup, options.ttl * 1000);
       } else {
         console.log(
-          'Warning: ttl cleanup not enabled, set both "ttl" and "limit" options to enable it!'
+          'Warning: ttl cleanup not enabled, set both "ttl" and "cleanupLimit" options to enable it!'
         );
       }
 
@@ -82,7 +82,11 @@ class Sql {
     });
 
     if (res && res.value) {
-      return JSON.parse(res.value);
+      return {
+        value: res.value,
+        iv: res.iv,
+        tag: res.tag,
+      };
     }
 
     return null;
@@ -97,7 +101,11 @@ class Sql {
 
     if (res) {
       res.forEach((r) => {
-        ret.push(JSON.parse(r.store.value));
+        ret.push({
+          value: r.store.value,
+          iv: r.store.iv,
+          tag: r.store.tag,
+        });
       });
     }
 
@@ -107,7 +115,7 @@ class Sql {
   async put(namespace, key, val, ttl = 0, ...indexes) {
     await this.connection.transaction(async (transactionalEntityManager) => {
       const dbKey = dbutils.key(namespace, key);
-      const store = new JacksonStore(dbKey, val);
+      const store = new JacksonStore(dbKey, val.value, val.iv, val.tag);
       await transactionalEntityManager.save(store);
 
       if (ttl) {

package/src/env.js

@@ -18,6 +18,7 @@ const db = {
   url: process.env.DB_URL,
   type: process.env.DB_TYPE,
   ttl: process.env.DB_TTL,
+  encryptionKey: process.env.DB_ENCRYPTION_KEY,
 };
 
 module.exports = {

package/src/index.js

@@ -22,7 +22,7 @@ const defaultOpts = (opts) => {
     newOpts.db.url || 'postgresql://postgres:postgres@localhost:5432/postgres';
   newOpts.db.type = newOpts.db.type || 'postgres'; // Only needed if DB_ENGINE is sql. Supported values: postgres, cockroachdb, mysql, mariadb
   newOpts.db.ttl = (newOpts.db.ttl || 300) * 1; // TTL for the code, session and token stores (in seconds)
-  newOpts.db.limit = (newOpts.db.limit || 1000) * 1; // Limit ttl cleanup to this many items at a time
+  newOpts.db.cleanupLimit = (newOpts.db.cleanupLimit || 1000) * 1; // Limit cleanup of TTL entries to this many items at a time
 
   return newOpts;
 };
@@ -56,7 +56,8 @@ module.exports = async function (opts) {
     }
   }
 
-  const type = opts.db.engine === 'sql' && opts.db.type ? ' Type: ' + opts.db.type : '';
+  const type =
+    opts.db.engine === 'sql' && opts.db.type ? ' Type: ' + opts.db.type : '';
   console.log(`Using engine: ${opts.db.engine}.${type}`);
 
   return {

package/src/test/api.test.js

@@ -0,0 +1,156 @@
+const tap = require('tap');
+const path = require('path');
+const sinon = require('sinon');
+const crypto = require('crypto');
+
+const readConfig = require('../read-config');
+const dbutils = require('../db/utils');
+
+let apiController;
+
+const options = {
+  externalUrl: 'https://my-cool-app.com',
+  samlAudience: 'https://saml.boxyhq.com',
+  samlPath: '/sso/oauth/saml',
+  db: {
+    engine: 'mem',
+  },
+};
+
+tap.before(async () => {
+  const controller = await require('../index.js')(options);
+
+  apiController = controller.apiController;
+});
+
+tap.teardown(async () => {
+  process.exit(0);
+});
+
+tap.test('controller/api', async (t) => {
+  const metadataPath = path.join(__dirname, '/data/metadata');
+  const config = await readConfig(metadataPath);
+
+  t.test('.config()', async (t) => {
+    t.test('when required fields are missing or invalid', async (t) => {
+      t.test('when `rawMetadata` is empty', async (t) => {
+        const body = Object.assign({}, config[0]);
+        delete body['rawMetadata'];
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting JacksonError.');
+        } catch (err) {
+          t.equal(err.message, 'Please provide rawMetadata');
+          t.equal(err.statusCode, 400);
+        }
+
+        t.end();
+      });
+
+      t.test('when `defaultRedirectUrl` is empty', async (t) => {
+        const body = Object.assign({}, config[0]);
+        delete body['defaultRedirectUrl'];
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting JacksonError.');
+        } catch (err) {
+          t.equal(err.message, 'Please provide a defaultRedirectUrl');
+          t.equal(err.statusCode, 400);
+        }
+
+        t.end();
+      });
+
+      t.test('when `redirectUrl` is empty', async (t) => {
+        const body = Object.assign({}, config[0]);
+        delete body['redirectUrl'];
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting JacksonError.');
+        } catch (err) {
+          t.equal(err.message, 'Please provide redirectUrl');
+          t.equal(err.statusCode, 400);
+        }
+
+        t.end();
+      });
+
+      t.test('when `tenant` is empty', async (t) => {
+        const body = Object.assign({}, config[0]);
+        delete body['tenant'];
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting JacksonError.');
+        } catch (err) {
+          t.equal(err.message, 'Please provide tenant');
+          t.equal(err.statusCode, 400);
+        }
+
+        t.end();
+      });
+
+      t.test('when `product` is empty', async (t) => {
+        const body = Object.assign({}, config[0]);
+        delete body['product'];
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting JacksonError.');
+        } catch (err) {
+          t.equal(err.message, 'Please provide product');
+          t.equal(err.statusCode, 400);
+        }
+
+        t.end();
+      });
+
+      t.test('when `rawMetadata` is not a valid XML', async (t) => {
+        const body = Object.assign({}, config[0]);
+        body['rawMetadata'] = 'not a valid XML';
+
+        try {
+          await apiController.config(body);
+          t.fail('Expecting Error.');
+        } catch (err) {
+          t.match(err.message, /Non-whitespace before first tag./);
+        }
+
+        t.end();
+      });
+    });
+
+    t.test('when the request is good', async (t) => {
+      const body = Object.assign({}, config[0]);
+
+      sinon
+        .stub(dbutils, 'keyDigest')
+        .returns('75edb050796a0eb1cf2cfb0da7245f85bc50baa7');
+
+      sinon
+        .stub(crypto, 'randomBytes')
+        .returns('f3b0f91eb8f4a9f7cc2254e08682d50b05b5d36262929e7f');
+
+      const response = await apiController.config(body);
+
+      t.equal(response.client_id, '75edb050796a0eb1cf2cfb0da7245f85bc50baa7');
+      t.equal(
+        response.client_secret,
+        'f3b0f91eb8f4a9f7cc2254e08682d50b05b5d36262929e7f'
+      );
+      t.equal(response.provider, 'accounts.google.com');
+
+      dbutils.keyDigest.restore();
+      crypto.randomBytes.restore();
+
+      t.end();
+    });
+
+    t.end();
+  });
+
+  t.end();
+});