@foxtware/mineral 0.1.6 → 0.1.7

package/.creds.yml.sample

@@ -23,4 +23,7 @@ yotpo:
     MERCHANT_ID: _________________________
 
 linear:
-  API_KEY: _______________________________
+  API_KEY: _______________________________
+
+slack:
+  BOT_TOKEN: xoxb________________________________

package/.env.sample

@@ -0,0 +1,2 @@
+# Required by the requireHostedApiKey wrapper — requests must send this as the x-api-key header.
+HOSTED_API_KEY=________________________________

package/README.md

@@ -52,3 +52,8 @@ The [bedrock](https://github.com/GorgonFreeman/bedrock) middleware, refactored f
 Mineral gets pushed to from a larger repo that can also contain private functions. Mineral should be strictly useful stuff for the public, and can be used standalone, but needs to be instantiated for serving, setting stuff like which creds file to use. This allows it to be used as part of another repo in the same HTTP/curl way as by itself. Pass `--workspace` to locate `.creds.yml` and `--api_dirs` to serve additional function directories.
 
 For cloud deploy, workspaces use `hosting/.hosting.yml` and `npm run host` (same `--workspace` / `--api_dirs` flags as dev/serve). See `hosting/.hosting.yml.sample`.
+
+## What the thang do
+- Server makes functions available from the api/ route, where an export matches the filename. Run `npm run serve`, and they're all curlable.
+- .creds.yml is copied into .env when deploying, so creds can be accessed while hosted. Locally, it reads from the file directly.
+- Cloud deploy reads `hosting/.hosting.yml` for per-function config — `before_wrappers` / `after_wrappers` like `requireHostedApiKey`, `max_instances`, schedules — and deploys each function to Google Cloud.

package/api/shopify/shopifyDecodeSessionToken.js

@@ -0,0 +1,206 @@
+// https://shopify.dev/docs/apps/build/authentication-authorization/session-tokens/set-up-session-tokens
+
+const crypto = require('crypto');
+const { credsFromPayload, ArgsWarden } = require('../utils');
+const { credsValidator } = require('../validators');
+
+const sessionTokenValidator = (sessionToken) => {
+  return typeof sessionToken === 'string' && Boolean(sessionToken.trim());
+};
+
+const argsWarden = new ArgsWarden([
+  ['credsPayload', credsValidator],
+  ['sessionToken', sessionTokenValidator],
+]);
+
+const base64UrlDecodeJson = (input) => {
+  const base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+  const padding = '='.repeat((4 - base64.length % 4) % 4);
+
+  return JSON.parse(Buffer.from(`${ base64 }${ padding }`, 'base64').toString('utf8'));
+};
+
+const normalizeSessionToken = (sessionToken) => {
+  const trimmedToken = sessionToken.trim();
+
+  if (trimmedToken.toLowerCase().startsWith('bearer ')) {
+    return trimmedToken.slice(7).trim();
+  }
+
+  return trimmedToken;
+};
+
+const verifySessionTokenSignature = (token, apiSecret) => {
+  const [encodedHeader, encodedPayload, signature] = token.split('.');
+
+  if (!encodedHeader || !encodedPayload || !signature) {
+    return false;
+  }
+
+  const message = `${ encodedHeader }.${ encodedPayload }`;
+  const computedSignature = crypto
+    .createHmac('sha256', apiSecret)
+    .update(message)
+    .digest('base64url');
+
+  return computedSignature === signature;
+};
+
+const validateSessionTokenClaims = (
+  decoded,
+  {
+    checkAudience = true,
+    clientId,
+  } = {},
+) => {
+  const {
+    iss,
+    dest,
+    aud,
+    exp,
+    nbf,
+  } = decoded;
+
+  const currentTime = Math.floor(Date.now() / 1000);
+  const expValid = exp > currentTime;
+  const nbfValid = nbf <= currentTime;
+  const domainsValid = dest?.includes('myshopify.com') && iss?.includes('myshopify.com');
+  const audValid = !checkAudience || aud === clientId;
+
+  return expValid && nbfValid && domainsValid && audValid;
+};
+
+const decodeSessionTokenPayload = (token) => {
+  const encodedPayload = token.split('.')[1];
+
+  if (!encodedPayload) {
+    return null;
+  }
+
+  try {
+    return base64UrlDecodeJson(encodedPayload);
+  } catch (error) {
+    return null;
+  }
+};
+
+const shopifyDecodeSessionToken = async (
+  credsPayload,
+  sessionToken,
+  {
+    checkAudience = true,
+  } = {},
+) => {
+
+  const rejectResponse = await argsWarden.responseIfRejectingArgs({
+    credsPayload,
+    sessionToken,
+  });
+  if (rejectResponse) {
+    return rejectResponse;
+  }
+
+  const creds = await credsFromPayload(credsPayload);
+  const {
+    API_SECRET,
+    CLIENT_ID,
+  } = creds;
+
+  if (!API_SECRET || !CLIENT_ID) {
+    return {
+      ok: false,
+      error: {
+        code: 'INVALID_CREDS',
+        message: 'API_SECRET and CLIENT_ID are required.',
+      },
+    };
+  }
+
+  const token = normalizeSessionToken(sessionToken);
+  const decoded = decodeSessionTokenPayload(token);
+
+  if (!decoded) {
+    return {
+      ok: false,
+      error: {
+        code: 'INVALID_SESSION_TOKEN',
+        message: 'Session token could not be decoded.',
+      },
+    };
+  }
+
+  if (!verifySessionTokenSignature(token, API_SECRET)) {
+    return {
+      ok: false,
+      error: {
+        code: 'INVALID_SESSION_TOKEN',
+        message: 'Session token signature is invalid.',
+      },
+    };
+  }
+
+  if (!validateSessionTokenClaims(decoded, {
+    checkAudience,
+    clientId: CLIENT_ID,
+  })) {
+    return {
+      ok: false,
+      error: {
+        code: 'INVALID_SESSION_TOKEN',
+        message: 'Session token claims are invalid.',
+        details: decoded,
+      },
+    };
+  }
+
+  return {
+    ok: true,
+    data: decoded,
+  };
+};
+
+const funcApiConfig = {
+  argsWarden,
+};
+
+module.exports = {
+  shopifyDecodeSessionToken,
+  funcApiConfig,
+};
+
+/*
+curl -X POST "http://localhost:8000/shopifyDecodeSessionToken" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "credsPayload": { "credsPath": "tender.prod" },
+    "sessionToken": "<jwt>"
+  }'
+*/
+
+/*
+  Legacy usage:
+  const whichApp = req.headers['x-wf-app'];
+
+  const sessionToken = req?.headers?.authorization?.split(' ')?.pop();
+  if (!sessionToken) {
+    return respond(res, 401, {
+      error: 'Unauthorized: No session token',
+    });
+  }
+
+  const sessionTokenData = shopifyDecodeSessionToken(sessionToken, {
+    ...whichApp && { credsPath: whichApp },
+  });
+
+  const {
+    dest,
+    sub: customerGid,
+  } = sessionTokenData;
+
+  const config = domainToConfig(dest);
+  if (!config) {
+    return respond(res, 401, {
+      error: 'No config found for domain',
+    });
+  }
+*/

package/api/slack/slack.constants.js

@@ -0,0 +1,5 @@
+const SLACK_API_BASE_URL = 'https://slack.com/api';
+
+module.exports = {
+  SLACK_API_BASE_URL,
+};

package/api/slack/slack.utils.js

@@ -0,0 +1,46 @@
+const { SLACK_API_BASE_URL } = require('../slack/slack.constants');
+const {
+  FetchClient,
+  Chain,
+  appendUrlToBase,
+  fetchClientCommonSteps,
+} = require('../utils');
+
+const addUrlAndAuthHeaders = async (state) => {
+  const { requestPayload, context } = state;
+  const { creds } = context;
+  const {
+    BOT_TOKEN,
+  } = creds;
+
+  return {
+    requestPayload: {
+      ...requestPayload,
+      method: requestPayload.method || 'post',
+      url: appendUrlToBase(SLACK_API_BASE_URL, requestPayload.url),
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${ BOT_TOKEN }`,
+        ...requestPayload.headers,
+      },
+    },
+  };
+};
+
+
+const slackClientRequestPreparer = new Chain([
+  addUrlAndAuthHeaders,
+]);
+
+const slackClientResponseInterpreter = new Chain([
+  fetchClientCommonSteps.exitEarlyOnNotOk,
+]);
+
+const slackClient = new FetchClient({
+  requestPreparer: slackClientRequestPreparer,
+  responseInterpreter: slackClientResponseInterpreter,
+});
+
+module.exports = {
+  slackClient,
+};

package/api/slack/slackMessagePost.js

@@ -0,0 +1,85 @@
+// https://docs.slack.dev/reference/methods/chat.postmessage
+
+const { credsFromPayload, objHasAny, ArgsWarden } = require('../utils');
+const { credsValidator } = require('../validators');
+const { slackClient } = require('../slack/slack.utils');
+
+const channelIdentifierValidator = (channelIdentifier) => {
+  return objHasAny(channelIdentifier, ['channelName', 'channelId']);
+};
+
+const messagePayloadValidator = (messagePayload) => {
+  return objHasAny(messagePayload, ['text', 'blocks', 'markdownText']);
+};
+
+const argsWarden = new ArgsWarden([
+  ['credsPayload', credsValidator],
+  ['channelIdentifier', channelIdentifierValidator],
+  ['messagePayload', messagePayloadValidator],
+]);
+
+const slackMessagePost = async (
+  credsPayload,
+  channelIdentifier,
+  messagePayload,
+  {
+    inspect = false,
+  } = {},
+) => {
+
+  const rejectResponse = await argsWarden.responseIfRejectingArgs({
+    credsPayload,
+    channelIdentifier,
+    messagePayload,
+  });
+  if (rejectResponse) {
+    return rejectResponse;
+  }
+
+  const creds = await credsFromPayload(credsPayload);
+
+  const {
+    channelName,
+    channelId,
+  } = channelIdentifier;
+
+  const {
+    text,
+    blocks,
+    markdownText,
+  } = messagePayload;
+
+  const response = await slackClient.fetch({
+    url: '/chat.postMessage',
+    method: 'post',
+    body: {
+      channel: channelId || channelName,
+      ...text && { text },
+      ...blocks && { blocks },
+      ...markdownText && { markdown_text: markdownText },
+    },
+    context: { creds },
+    inspect,
+  });
+
+  return response;
+};
+
+const funcApiConfig = {
+  argsWarden,
+};
+
+module.exports = {
+  slackMessagePost,
+  funcApiConfig,
+};
+
+/*
+curl -X POST "http://localhost:8000/slackMessagePost" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "credsPayload": { "credsPath": "slack" },
+    "channelIdentifier": { "channelName": "#hidden_testing" },
+    "messagePayload": { "text": "new number, who dis?" }
+  }'
+*/

package/api/utils.js

@@ -146,14 +146,14 @@ const customFetch = async (url, {
       });
 
       const responseContentType = response.headers.get('content-type');
-      console.log(responseContentType);
+      !HOSTED && console.log('responseContentType', responseContentType);
 
       if (!responseParser) {
         responseParser = getResponseParser(responseContentType);
       }
 
       const parsedResponse = await responseParser(response);
-      logDeep({ parsedResponse });
+      !HOSTED && logDeep({ parsedResponse });
 
       if (response.ok) {
         return {
@@ -278,7 +278,6 @@ const pathAsArray = (path) => {
 
 const objectDigNodeAtPath = (obj, path) => {
   let nodes = pathAsArray(path);
-  console.log(nodes);
 
   let output = obj;
   for (const node of nodes) {
@@ -1161,7 +1160,6 @@ module.exports = {
   actionSingleOrMultiple,
   Processor,
   Getter,
-  capitaliseString,
   sentenceCaseString,
   ArgsWarden,
 };

package/hosting/.hosting.yml.sample

@@ -8,14 +8,14 @@ functions:
   exampleFunction:
     max_instances: 1
     timeout: 300s
-    wrappers:
-      - requireHostedApiKey
+    before_wrappers:
       - allowCrossOriginCallsAndHandleOptions
+      - requireHostedApiKey
     # entry_point: otherHandlerName
 
   pokemonPokeballThrow:
     max_instances: 1
-    wrappers:
+    before_wrappers:
       - checkTrainer
 
 groups:

package/hosting/deployFromHostingYml.js

@@ -107,7 +107,8 @@ const deployFunction = async ({
     entry_point,
     schedules,
     groups,
-    wrappers,
+    before_wrappers,
+    after_wrappers,
     source,
     env,
     ...gcloudArgs

package/hosting/generateHosted.js

@@ -5,15 +5,33 @@ const formatResolvedWrapperForHostedJs = ({ modulePath, wrapperName }) => (
   `require('${ modulePath }').${ wrapperName }`
 );
 
-const formatWrappersArg = (resolvedWrappers = []) => {
+const formatWrapperList = (resolvedWrappers = []) => {
   if (!resolvedWrappers.length) {
     return '';
   }
 
   const wrapperLines = resolvedWrappers.map((resolvedWrapper) => (
-    `    ${ formatResolvedWrapperForHostedJs(resolvedWrapper) },`
+    `      ${ formatResolvedWrapperForHostedJs(resolvedWrapper) },`
   ));
-  return `, [\n${ wrapperLines.join('\n') }\n  ]`;
+
+  return `\n${ wrapperLines.join('\n') }\n    `;
+};
+
+const formatWrappersArg = ({
+  resolvedBeforeWrappers = [],
+  resolvedAfterWrappers = [],
+} = {}) => {
+  if (!resolvedBeforeWrappers.length && !resolvedAfterWrappers.length) {
+    return '';
+  }
+
+  const beforeWrappersBlock = formatWrapperList(resolvedBeforeWrappers);
+  const afterWrappersBlock = formatWrapperList(resolvedAfterWrappers);
+
+  return `, {
+    beforeWrappers: [${ beforeWrappersBlock }],
+    afterWrappers: [${ afterWrappersBlock }],
+  }`;
 };
 
 const generateHostedJs = ({
@@ -22,8 +40,17 @@ const generateHostedJs = ({
   const exportLines = [];
 
   for (const hostedHandler of hostedHandlers) {
-    const { hostedName, handlerName, resolvedWrappers = [], requirePath } = hostedHandler;
-    const wrappersArg = formatWrappersArg(resolvedWrappers);
+    const {
+      hostedName,
+      handlerName,
+      resolvedBeforeWrappers = [],
+      resolvedAfterWrappers = [],
+      requirePath,
+    } = hostedHandler;
+    const wrappersArg = formatWrappersArg({
+      resolvedBeforeWrappers,
+      resolvedAfterWrappers,
+    });
 
     exportLines.push(
       `  ${ hostedName }: wrapHostedFunction(() => require('${ requirePath }'), '${ handlerName }'${ wrappersArg }),`,

package/hosting/hosting.utils.js

@@ -71,13 +71,16 @@ const getHostedEntries = (functions = {}) => (
   Object.entries(functions).map(([hostedName, functionConfig = {}]) => ({
     hostedName,
     handlerName: functionConfig.entry_point || functionConfig.entryPoint || hostedName,
-    wrappers: Array.isArray(functionConfig.wrappers) ? functionConfig.wrappers : [],
+    beforeWrappers: Array.isArray(functionConfig.before_wrappers) ? functionConfig.before_wrappers : [],
+    afterWrappers: Array.isArray(functionConfig.after_wrappers) ? functionConfig.after_wrappers : [],
   }))
 );
 
-const functionUsesWrapper = (functionConfig = {}, wrapperName) => (
-  Array.isArray(functionConfig.wrappers) && functionConfig.wrappers.includes(wrapperName)
-);
+const functionUsesWrapper = (functionConfig = {}, wrapperName) => {
+  const { before_wrappers = [], after_wrappers = [] } = functionConfig;
+
+  return before_wrappers.includes(wrapperName) || after_wrappers.includes(wrapperName);
+};
 
 const getFuncApiConfig = ({
   moduleExports,
@@ -100,7 +103,10 @@ const getFuncApiConfig = ({
   }
 };
 
-const wrapHostedFunction = (loader, exportName, wrappers = []) => {
+const wrapHostedFunction = (loader, exportName, {
+  beforeWrappers = [],
+  afterWrappers = [],
+} = {}) => {
   let handler = null;
   let usesFuncApi = false;
 
@@ -129,7 +135,10 @@ const wrapHostedFunction = (loader, exportName, wrappers = []) => {
       : await handler(...args);
   };
 
-  const wrappedHandler = wrapFunction(coreHandler, wrappers);
+  const wrappedHandler = wrapFunction(coreHandler, {
+    beforeWrappers,
+    afterWrappers,
+  });
 
   return async (req, res) => {
     try {
@@ -180,17 +189,6 @@ const readHostingYml = (workspace) => {
   return hostingConfig;
 };
 
-const getCredsJsonForDeploy = (workspace) => {
-  const credsPath = `${ workspace }/.creds.yml`;
-
-  if (!fs.existsSync(credsPath)) {
-    throw new Error(`Missing .creds.yml in workspace: ${ workspace }`);
-  }
-
-  const credsText = fs.readFileSync(credsPath, 'utf8');
-  return JSON.stringify(yaml.parse(credsText));
-};
-
 const ensureWorkspaceEnvForDeploy = (workspace) => {
   const { copyCredsToEnv } = require('./copyCredsToEnv');
   const envPath = `${ workspace.replace(/\/$/, '') }/.env`;
@@ -211,9 +209,16 @@ const resolveHostedHandlersForDeploy = ({
   const hostedEntries = getHostedEntries(functions);
 
   return hostedEntries.map((hostedEntry) => {
-    const { handlerName, wrappers = [] } = hostedEntry;
+    const {
+      handlerName,
+      beforeWrappers = [],
+      afterWrappers = [],
+    } = hostedEntry;
 
-    const resolvedWrappers = wrappers.map((wrapperName) => (
+    const resolvedBeforeWrappers = beforeWrappers.map((wrapperName) => (
+      resolveWrapperName(wrapperName, workspaceRequire)
+    ));
+    const resolvedAfterWrappers = afterWrappers.map((wrapperName) => (
       resolveWrapperName(wrapperName, workspaceRequire)
     ));
 
@@ -226,7 +231,8 @@ const resolveHostedHandlersForDeploy = ({
 
     return {
       ...hostedEntry,
-      resolvedWrappers,
+      resolvedBeforeWrappers,
+      resolvedAfterWrappers,
       requirePath: getRequirePathForHandler(handler, workspace),
     };
   });
@@ -240,7 +246,6 @@ module.exports = {
   getFuncApiConfig,
   wrapHostedFunction,
   readHostingYml,
-  getCredsJsonForDeploy,
   ensureWorkspaceEnvForDeploy,
   getHostedEntries,
   resolveHostedHandlersForDeploy,

package/hosting/wrappers.js

@@ -22,7 +22,7 @@ const allowCrossOriginCallsAndHandleOptions = async (req, res) => {
 
   res.setHeader('Access-Control-Allow-Origin', origin || '*');
   res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, x-api-key, x-wf-token, x-wf-value');
+  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, x-api-key, x-wf-token, x-wf-value');
 
   if (req.method === 'OPTIONS') {
     res.writeHead(204);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foxtware/mineral",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "bin": {
     "mineral": "bin/mineral.js"
   },

package/server.js

@@ -78,8 +78,6 @@ const directoriesToScan = ({
   return [MINERAL_API_DIR, ...extraDirs];
 };
 
-const getFuncApiConfigFromModule = getFuncApiConfig;
-
 const addHandlerFromFile = (filePath, handlers) => {
   const moduleExports = require(filePath);
   if (!moduleExports || typeof moduleExports !== 'object') {
@@ -92,7 +90,7 @@ const addHandlerFromFile = (filePath, handlers) => {
     return;
   }
 
-  const funcApiConfig = getFuncApiConfigFromModule({
+  const funcApiConfig = getFuncApiConfig({
     moduleExports,
     routeName,
   });

package/server.utils.js

@@ -1,8 +1,9 @@
 const { logDeep } = require('./api/utils');
+const { HOSTED } = require('./api/constants');
 const { StringDecoder } = require('string_decoder');
 
 const respondJson = (res, statusCode, payload) => {
-  logDeep(payload);
+  !HOSTED && logDeep(payload);
   const body = JSON.stringify(payload);
   res.writeHead(statusCode, {
     'Content-Type': 'application/json',
@@ -120,15 +121,48 @@ const runRequestHandler = async (requestHandler, requestContext) => {
   return mergeRequestContext(requestContext, handlerOutput);
 };
 
-const wrapFunction = (func, wrappers = []) => async (req, res, ...rest) => {
-  for (const wrapper of wrappers) {
-    const rejected = await wrapper(req, res);
-    if (rejected) {
-      return rejected;
+const wrapFunction = (func, {
+  beforeWrappers = [],
+  afterWrappers = [],
+} = {}) => async (req, res, ...rest) => {
+  for (const beforeWrapper of beforeWrappers) {
+    const beforeResult = await beforeWrapper(req, res);
+    if (beforeResult?.handled) {
+      return;
+    }
+    if (beforeResult) {
+      return beforeResult;
+    }
+  }
+
+  if (!afterWrappers.length) {
+    return func(req, res, ...rest);
+  }
+
+  let result;
+
+  try {
+    result = await func(req, res, ...rest);
+  } catch (error) {
+    result = {
+      ok: false,
+      error: {
+        code: 'UNHANDLED_ERROR',
+        message: 'Unhandled server error.',
+        details: errorToReadable(error),
+      },
+    };
+  }
+
+  for (const afterWrapper of afterWrappers) {
+    try {
+      await afterWrapper(req, res, result);
+    } catch (error) {
+      console.log('wrapFunction afterWrapper error', error);
     }
   }
 
-  return func(req, res, ...rest);
+  return result;
 };
 
 const statusCodeFromResult = (result) => {