@fonoster/authz 0.8.24 → 0.8.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -6,7 +6,7 @@ import { ServerInterceptingCall } from "@grpc/grpc-js";
|
|
|
6
6
|
* @param {string} authzServer - The public key to validate the token
|
|
7
7
|
* @return {Function} - The gRPC interceptor
|
|
8
8
|
*/
|
|
9
|
-
declare function
|
|
9
|
+
declare function createCheckMethodAuthorized(authzServer: string, methods: string[]): (methodDefinition: {
|
|
10
10
|
path: string;
|
|
11
11
|
}, call: ServerInterceptingCall) => ServerInterceptingCall;
|
|
12
|
-
export {
|
|
12
|
+
export { createCheckMethodAuthorized };
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.createCheckMethodAuthorized = createCheckMethodAuthorized;
|
|
4
4
|
/*
|
|
5
5
|
* Copyright (C) 2024 by Fonoster Inc (https://fonoster.com)
|
|
6
6
|
* http://github.com/fonoster/fonoster
|
|
@@ -23,7 +23,6 @@ const common_1 = require("@fonoster/common");
|
|
|
23
23
|
const logger_1 = require("@fonoster/logger");
|
|
24
24
|
const grpc_js_1 = require("@grpc/grpc-js");
|
|
25
25
|
const AuthzClient_1 = require("./client/AuthzClient");
|
|
26
|
-
const identity_1 = require("@fonoster/identity");
|
|
27
26
|
const logger = (0, logger_1.getLogger)({ service: "authz", filePath: __filename });
|
|
28
27
|
/**
|
|
29
28
|
* This function is a gRPC interceptor that checks if the request a method is authorized
|
|
@@ -32,7 +31,7 @@ const logger = (0, logger_1.getLogger)({ service: "authz", filePath: __filename
|
|
|
32
31
|
* @param {string} authzServer - The public key to validate the token
|
|
33
32
|
* @return {Function} - The gRPC interceptor
|
|
34
33
|
*/
|
|
35
|
-
function
|
|
34
|
+
function createCheckMethodAuthorized(authzServer, methods) {
|
|
36
35
|
logger.verbose("creating check method authorized interceptor", {
|
|
37
36
|
authzServer,
|
|
38
37
|
methods
|
|
@@ -46,37 +45,51 @@ function makeCheckMethodAuthorized(authzServer, methods) {
|
|
|
46
45
|
* @param {ServerInterceptingCall} call - The call object
|
|
47
46
|
* @return {ServerInterceptingCall} - The modified call object
|
|
48
47
|
*/
|
|
49
|
-
return (methodDefinition, call)
|
|
48
|
+
return function checkMethodAuthorized(methodDefinition, call) {
|
|
50
49
|
const { path: method } = methodDefinition;
|
|
51
50
|
if (!methods.includes(method)) {
|
|
52
51
|
// Ignore the check if the method is not in the list
|
|
53
52
|
logger.silly("method is not in the list", { method });
|
|
54
53
|
return call;
|
|
55
54
|
}
|
|
56
|
-
|
|
57
|
-
|
|
55
|
+
const accessKeyId = (0, common_1.getAccessKeyIdFromCall)(call);
|
|
56
|
+
logger.verbose("checking if method is authorized", { method, accessKeyId });
|
|
58
57
|
return new grpc_js_1.ServerInterceptingCall(call, {
|
|
59
58
|
start: async (next) => {
|
|
60
59
|
try {
|
|
61
|
-
await authz.checkMethodAuthorized({
|
|
60
|
+
const authorized = await authz.checkMethodAuthorized({
|
|
62
61
|
accessKeyId,
|
|
63
62
|
method
|
|
64
63
|
});
|
|
65
|
-
logger.verbose("
|
|
64
|
+
logger.verbose("the status of the method authorization", {
|
|
66
65
|
method,
|
|
67
|
-
accessKeyId
|
|
66
|
+
accessKeyId,
|
|
67
|
+
authorized
|
|
68
68
|
});
|
|
69
|
+
if (!authorized) {
|
|
70
|
+
logger.verbose("method unauthorized by external service", {
|
|
71
|
+
method,
|
|
72
|
+
accessKeyId
|
|
73
|
+
});
|
|
74
|
+
(0, common_1.createInterceptingCall)({
|
|
75
|
+
call,
|
|
76
|
+
code: grpc_js_1.status.PERMISSION_DENIED,
|
|
77
|
+
details: `Method unauthorized`
|
|
78
|
+
});
|
|
79
|
+
return;
|
|
80
|
+
}
|
|
69
81
|
next();
|
|
70
82
|
}
|
|
71
83
|
catch (error) {
|
|
72
|
-
logger.
|
|
84
|
+
logger.error("error checking if method is authorized", {
|
|
73
85
|
method,
|
|
74
|
-
accessKeyId
|
|
86
|
+
accessKeyId,
|
|
87
|
+
error
|
|
75
88
|
});
|
|
76
89
|
(0, common_1.createInterceptingCall)({
|
|
77
90
|
call,
|
|
78
|
-
code: grpc_js_1.status.
|
|
79
|
-
details:
|
|
91
|
+
code: grpc_js_1.status.INTERNAL,
|
|
92
|
+
details: "Internal server error"
|
|
80
93
|
});
|
|
81
94
|
}
|
|
82
95
|
}
|
package/dist/index.d.ts
CHANGED
package/dist/index.js
CHANGED
|
@@ -34,5 +34,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
34
34
|
*/
|
|
35
35
|
__exportStar(require("./server"), exports);
|
|
36
36
|
__exportStar(require("./client"), exports);
|
|
37
|
-
__exportStar(require("./
|
|
37
|
+
__exportStar(require("./createCheckMethodAuthorized"), exports);
|
|
38
38
|
__exportStar(require("./types"), exports);
|
|
@@ -77,19 +77,11 @@ class AuthzServer {
|
|
|
77
77
|
checkSessionAuthorized: async (call, callback) => {
|
|
78
78
|
logger.verbose("checkSessionAuthorized called", call.request);
|
|
79
79
|
try {
|
|
80
|
-
const
|
|
81
|
-
|
|
82
|
-
callback(null, { authorized: true });
|
|
83
|
-
}
|
|
84
|
-
else {
|
|
85
|
-
callback({
|
|
86
|
-
code: grpc.status.PERMISSION_DENIED,
|
|
87
|
-
message: "Session is not authorized."
|
|
88
|
-
});
|
|
89
|
-
}
|
|
80
|
+
const authorized = await handler.checkSessionAuthorized(call.request);
|
|
81
|
+
callback(null, { authorized });
|
|
90
82
|
}
|
|
91
83
|
catch (error) {
|
|
92
|
-
logger.error("
|
|
84
|
+
logger.error("error in checkSessionAuthorized:", error);
|
|
93
85
|
callback({
|
|
94
86
|
code: grpc.status.INTERNAL,
|
|
95
87
|
message: "Internal server error."
|
|
@@ -99,19 +91,11 @@ class AuthzServer {
|
|
|
99
91
|
checkMethodAuthorized: async (call, callback) => {
|
|
100
92
|
logger.verbose("checkMethodAuthorized called", call.request);
|
|
101
93
|
try {
|
|
102
|
-
const
|
|
103
|
-
|
|
104
|
-
callback(null, { authorized: true });
|
|
105
|
-
}
|
|
106
|
-
else {
|
|
107
|
-
callback({
|
|
108
|
-
code: grpc.status.PERMISSION_DENIED,
|
|
109
|
-
message: "Method is not authorized."
|
|
110
|
-
});
|
|
111
|
-
}
|
|
94
|
+
const authorized = await handler.checkMethodAuthorized(call.request);
|
|
95
|
+
callback(null, { authorized });
|
|
112
96
|
}
|
|
113
97
|
catch (error) {
|
|
114
|
-
logger.error("
|
|
98
|
+
logger.error("error in checkMethodAuthorized:", error);
|
|
115
99
|
callback({
|
|
116
100
|
code: grpc.status.INTERNAL,
|
|
117
101
|
message: "Internal server error."
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@fonoster/authz",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.26",
|
|
4
4
|
"description": "Authorization module for Fonoster",
|
|
5
5
|
"author": "Pedro Sanders <psanders@fonoster.com>",
|
|
6
6
|
"homepage": "https://github.com/fonoster/fonoster#readme",
|
|
@@ -26,9 +26,9 @@
|
|
|
26
26
|
"access": "public"
|
|
27
27
|
},
|
|
28
28
|
"dependencies": {
|
|
29
|
-
"@fonoster/common": "^0.8.
|
|
30
|
-
"@fonoster/identity": "^0.8.
|
|
31
|
-
"@fonoster/logger": "^0.8.
|
|
29
|
+
"@fonoster/common": "^0.8.26",
|
|
30
|
+
"@fonoster/identity": "^0.8.26",
|
|
31
|
+
"@fonoster/logger": "^0.8.26",
|
|
32
32
|
"@grpc/grpc-js": "~1.10.6",
|
|
33
33
|
"deepmerge": "^4.3.1",
|
|
34
34
|
"grpc-health-check": "^2.0.2"
|
|
@@ -40,5 +40,5 @@
|
|
|
40
40
|
"bugs": {
|
|
41
41
|
"url": "https://github.com/fonoster/fonoster/issues"
|
|
42
42
|
},
|
|
43
|
-
"gitHead": "
|
|
43
|
+
"gitHead": "f01e634eca9a94b3a276369e998c6e75f8b75284"
|
|
44
44
|
}
|