@flink-app/generic-request-plugin 2.0.0-alpha.113 → 2.0.0-alpha.115

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @flink-app/generic-request-plugin
 
+## 2.0.0-alpha.115
+
+### Patch Changes
+
+-   @flink-app/flink@2.0.0-alpha.115
+
+## 2.0.0-alpha.114
+
+### Patch Changes
+
+-   383c91b: Fix auth rejections being treated as authenticated. `genericRequestPlugin` routes, `streamingPlugin` routes and the s3-plugin legacy upload route checked the auth result with `if (!authenticated)`. A `FlinkResponse` — the shape an auth plugin returns to replace the default 401, e.g. from jwt-auth-plugin's `onAuthFailure` — is a truthy object, so those routes let the rejected request through to the handler. They now use `isAuthSuccess()` and send the plugin's response verbatim (its `headers` applied to the response and stripped from the JSON body, status defaulting to 401), falling back to each route's existing default response when the plugin simply returned `false`. Headers from a successful authentication are applied too — on streaming routes before the stream headers are flushed.
+-   Updated dependencies [5f11719]
+    -   @flink-app/flink@2.0.0-alpha.114
+
 ## 2.0.0-alpha.113
 
 ### Patch Changes

package/dist/index.js

@@ -1,4 +1,15 @@
 "use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -35,11 +46,23 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.genericRequestPlugin = exports.HttpMethod = void 0;
+var flink_1 = require("@flink-app/flink");
 var node_color_log_1 = __importDefault(require("node-color-log"));
 var HttpMethod;
 (function (HttpMethod) {
@@ -63,7 +86,7 @@ function init(app, options) {
         throw new Error("Express app not initialized");
     }
     expressApp[options.method](options.path, function (req, res) { return __awaiter(_this, void 0, void 0, function () {
-        var authenticated;
+        var authResult, headers, body, status, authHeaders;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
@@ -73,8 +96,19 @@ function init(app, options) {
                     }
                     return [4 /*yield*/, app.auth.authenticateRequest(req, options.permissions, app.ctx)];
                 case 1:
-                    authenticated = _a.sent();
-                    if (!authenticated) {
+                    authResult = _a.sent();
+                    // Only `true` and a FlinkAuthSuccess mean authenticated. A FlinkResponse is a
+                    // rejection the plugin shaped itself and is sent verbatim (its `headers` are
+                    // applied to the response and stripped from the JSON body, status defaults to 401).
+                    if (!(0, flink_1.isAuthSuccess)(authResult)) {
+                        if (authResult && typeof authResult === "object") {
+                            headers = authResult.headers, body = __rest(authResult, ["headers"]);
+                            status = authResult.status || 401;
+                            if (headers) {
+                                res.set(headers);
+                            }
+                            return [2 /*return*/, res.status(status).json(__assign(__assign({}, body), { status: status }))];
+                        }
                         return [2 /*return*/, res.status(401).json({
                                 status: 401,
                                 error: {
@@ -83,6 +117,10 @@ function init(app, options) {
                                 },
                             })];
                     }
+                    authHeaders = (0, flink_1.getAuthSuccessHeaders)(authResult);
+                    if (authHeaders) {
+                        res.set(authHeaders);
+                    }
                     _a.label = 2;
                 case 2:
                     // Call the handler

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flink-app/generic-request-plugin",
-  "version": "2.0.0-alpha.113",
+  "version": "2.0.0-alpha.115",
   "description": "Flink plugin that makes it possible to override default request handlers and handle specific requests manually",
   "author": "johan@frost.se",
   "publishConfig": {
@@ -11,7 +11,7 @@
   "main": "dist/index.js",
   "dependencies": {
     "node-color-log": "^5.3.1",
-    "@flink-app/flink": "2.0.0-alpha.113"
+    "@flink-app/flink": "2.0.0-alpha.115"
   },
   "devDependencies": {
     "@types/jasmine": "^3.7.1",
@@ -19,7 +19,7 @@
   },
   "gitHead": "4243e3b3cd6d4e1ca001a61baa8436bf2bbe4113",
   "peerDependencies": {
-    "@flink-app/flink": ">=2.0.0-alpha.113"
+    "@flink-app/flink": ">=2.0.0-alpha.115"
   },
   "scripts": {
     "test": "jasmine-ts --config=./spec/support/jasmine.json",

package/spec/GenericRequestPlugin.spec.ts

@@ -7,6 +7,9 @@ describe("GenericRequestPlugin", () => {
   let mockAuth: FlinkAuthPlugin;
   let registeredRoutes: Map<string, Function>;
 
+  // The app context, passed to authenticateRequest as third argument
+  const mockCtx = { repos: {}, plugins: {} };
+
   beforeEach(() => {
     registeredRoutes = new Map();
 
@@ -36,6 +39,7 @@ describe("GenericRequestPlugin", () => {
     mockApp = {
       expressApp: mockExpressApp,
       auth: mockAuth,
+      ctx: mockCtx,
     } as unknown as FlinkApp<any>;
   });
 
@@ -197,7 +201,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "read");
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "read", mockCtx);
       expect(handlerSpy).toHaveBeenCalled();
     });
 
@@ -223,7 +227,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, ["read", "write", "admin"]);
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, ["read", "write", "admin"], mockCtx);
       expect(handlerSpy).toHaveBeenCalled();
     });
 
@@ -254,7 +258,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "read");
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "read", mockCtx);
       expect(mockRes.status).toHaveBeenCalledWith(401);
       expect(mockJsonSpy).toHaveBeenCalledWith({
         status: 401,
@@ -266,6 +270,95 @@ describe("GenericRequestPlugin", () => {
       expect(handlerSpy).not.toHaveBeenCalled();
     });
 
+    it("should reject and send the FlinkResponse when the auth plugin shapes the failure", async () => {
+      const rejection = {
+        status: 403,
+        error: { id: "1", code: "PERMISSION_DENIED", title: "Permission denied" },
+        headers: { "set-cookie": "jwt=deleted; path=/;" },
+      };
+      mockAuth.authenticateRequest = jasmine.createSpy("authenticateRequest").and.returnValue(Promise.resolve(rejection));
+
+      const handlerSpy = jasmine.createSpy("handler");
+      const plugin = genericRequestPlugin({
+        path: "/protected",
+        method: HttpMethod.get,
+        permissions: "read",
+        handler: handlerSpy,
+      });
+
+      plugin.init(mockApp);
+
+      const routeHandler = registeredRoutes.get("GET:/protected")!;
+      const mockJsonSpy = jasmine.createSpy("json");
+      const mockRes = {
+        status: jasmine.createSpy("status").and.returnValue({ json: mockJsonSpy }),
+        set: jasmine.createSpy("set"),
+      } as any;
+
+      await routeHandler({} as FlinkRequest, mockRes);
+
+      expect(handlerSpy).not.toHaveBeenCalled();
+      expect(mockRes.status).toHaveBeenCalledWith(403);
+      expect(mockRes.set).toHaveBeenCalledWith(rejection.headers);
+      // headers are transport level and must not leak into the JSON body
+      expect(mockJsonSpy).toHaveBeenCalledWith({ status: 403, error: rejection.error });
+    });
+
+    it("should default a shaped rejection without status to 401", async () => {
+      mockAuth.authenticateRequest = jasmine
+        .createSpy("authenticateRequest")
+        .and.returnValue(Promise.resolve({ error: { id: "1", code: "NOPE", title: "Nope" } }));
+
+      const handlerSpy = jasmine.createSpy("handler");
+      const plugin = genericRequestPlugin({
+        path: "/protected",
+        method: HttpMethod.get,
+        permissions: "read",
+        handler: handlerSpy,
+      });
+
+      plugin.init(mockApp);
+
+      const routeHandler = registeredRoutes.get("GET:/protected")!;
+      const mockRes = {
+        status: jasmine.createSpy("status").and.returnValue({ json: () => {} }),
+        set: jasmine.createSpy("set"),
+      } as any;
+
+      await routeHandler({} as FlinkRequest, mockRes);
+
+      expect(handlerSpy).not.toHaveBeenCalled();
+      expect(mockRes.status).toHaveBeenCalledWith(401);
+    });
+
+    it("should call the handler when the auth plugin returns an authenticated result with headers", async () => {
+      mockAuth.authenticateRequest = jasmine
+        .createSpy("authenticateRequest")
+        .and.returnValue(Promise.resolve({ authenticated: true, headers: { "set-cookie": "jwt=renewed; path=/;" } }));
+
+      const handlerSpy = jasmine.createSpy("handler");
+      const plugin = genericRequestPlugin({
+        path: "/protected",
+        method: HttpMethod.get,
+        permissions: "read",
+        handler: handlerSpy,
+      });
+
+      plugin.init(mockApp);
+
+      const routeHandler = registeredRoutes.get("GET:/protected")!;
+      const mockRes = {
+        status: jasmine.createSpy("status").and.returnValue({ json: () => {} }),
+        set: jasmine.createSpy("set"),
+      } as any;
+
+      await routeHandler({} as FlinkRequest, mockRes);
+
+      expect(handlerSpy).toHaveBeenCalled();
+      expect(mockRes.status).not.toHaveBeenCalled();
+      expect(mockRes.set).toHaveBeenCalledWith({ "set-cookie": "jwt=renewed; path=/;" });
+    });
+
     it("should not call handler when authentication fails", async () => {
       mockAuth.authenticateRequest = jasmine.createSpy("authenticateRequest").and.returnValue(Promise.resolve(false));
 
@@ -380,7 +473,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "*");
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "*", mockCtx);
       expect(handlerSpy).toHaveBeenCalled();
     });
   });
@@ -415,7 +508,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "webhook:stripe");
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "webhook:stripe", mockCtx);
       expect(webhookData).toEqual({ event: "payment.success" });
       expect(mockJsonSpy).toHaveBeenCalledWith({ received: true });
     });
@@ -451,7 +544,7 @@ describe("GenericRequestPlugin", () => {
 
       await routeHandler(mockReq, mockRes);
 
-      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "file:download");
+      expect(mockAuth.authenticateRequest).toHaveBeenCalledWith(mockReq, "file:download", mockCtx);
       expect(mockSetHeaderSpy).toHaveBeenCalledWith("Content-Type", "application/pdf");
       expect(mockEndSpy).toHaveBeenCalledWith("file-data");
     });

package/src/index.ts

@@ -1,4 +1,4 @@
-import { FlinkApp, FlinkPlugin, FlinkRequest } from "@flink-app/flink";
+import { FlinkApp, FlinkPlugin, FlinkRequest, getAuthSuccessHeaders, isAuthSuccess } from "@flink-app/flink";
 import log from "node-color-log";
 
 export enum HttpMethod {
@@ -56,9 +56,23 @@ function init(app: FlinkApp<any>, options: GenericRequestOptions) {
 
             // Express Request is structurally compatible with FlinkRequest for auth purposes
             // (both have headers and user properties). This follows the same pattern as FlinkApp.ts:826
-            const authenticated = await app.auth.authenticateRequest(req as FlinkRequest, options.permissions, app.ctx);
+            const authResult = await app.auth.authenticateRequest(req as FlinkRequest, options.permissions, app.ctx);
+
+            // Only `true` and a FlinkAuthSuccess mean authenticated. A FlinkResponse is a
+            // rejection the plugin shaped itself and is sent verbatim (its `headers` are
+            // applied to the response and stripped from the JSON body, status defaults to 401).
+            if (!isAuthSuccess(authResult)) {
+                if (authResult && typeof authResult === "object") {
+                    const { headers, ...body } = authResult;
+                    const status = authResult.status || 401;
+
+                    if (headers) {
+                        res.set(headers);
+                    }
+
+                    return res.status(status).json({ ...body, status });
+                }
 
-            if (!authenticated) {
                 return res.status(401).json({
                     status: 401,
                     error: {
@@ -67,6 +81,13 @@ function init(app: FlinkApp<any>, options: GenericRequestOptions) {
                     },
                 });
             }
+
+            // Headers contributed by a successful authentication, e.g. a renewed session cookie
+            const authHeaders = getAuthSuccessHeaders(authResult);
+
+            if (authHeaders) {
+                res.set(authHeaders);
+            }
         }
 
         // Call the handler