@furystack/rest-service 4.0.19

package/src/api-manager.ts

@@ -0,0 +1,222 @@
+import { Disposable, PathHelper, usingAsync } from '@furystack/utils'
+import { deserializeQueryString, RestApi } from '@furystack/rest'
+import { Injectable, Injector } from '@furystack/inject'
+import { ServerManager, OnRequest } from './server-manager'
+import { pathToRegexp, match } from 'path-to-regexp'
+import { NotFoundAction } from './actions/not-found-action'
+import { CorsOptions } from './models/cors-options'
+import { Utils } from './utils'
+import { ErrorAction } from './actions/error-action'
+import './server-response-extensions'
+import { IdentityContext, User } from '@furystack/core'
+import { HttpUserContext } from './http-user-context'
+import { RequestAction } from './request-action-implementation'
+
+export type RestApiImplementation<T extends RestApi> = {
+  [TMethod in keyof T]: {
+    [TUrl in keyof T[TMethod]]: T[TMethod][TUrl] extends { result: unknown } ? RequestAction<T[TMethod][TUrl]> : never
+  }
+}
+
+export interface ImplementApiOptions<T extends RestApi> {
+  api: RestApiImplementation<T>
+  injector: Injector
+  hostName?: string
+  root: string
+  port: number
+  cors?: CorsOptions
+  deserializeQueryParams?: (param: string) => any
+}
+
+export type CompiledApi = {
+  [K: string]: {
+    [R: string]: { fullPath: string; regex: RegExp; action: RequestAction<any> }
+  }
+}
+
+export type OnRequestOptions = OnRequest & {
+  compiledApi: CompiledApi
+  hostName?: string
+  port: number
+  rootApiPath: string
+  injector: Injector
+  cors?: CorsOptions
+  supportedMethods: string[]
+  deserializeQueryParams?: (param: string) => any
+}
+
+@Injectable({ lifetime: 'singleton' })
+export class ApiManager implements Disposable {
+  private readonly apis = new Map<string, CompiledApi>()
+
+  public dispose() {
+    this.apis.clear()
+  }
+
+  private getSuportedMethods<T extends RestApi>(api: RestApiImplementation<T>): string[] {
+    return Object.keys(api) as any
+  }
+
+  private compileApi<T extends RestApi>(api: RestApiImplementation<T>, root: string) {
+    const compiledApi = {} as CompiledApi
+    this.getSuportedMethods(api).forEach((method) => {
+      const endpoint = {}
+
+      Object.entries((api as any)[method]).forEach(([path, action]) => {
+        const fullPath = `/${PathHelper.joinPaths(root, path)}`
+        const regex = pathToRegexp(fullPath)
+        ;(endpoint as any)[path] = { regex, action, fullPath }
+      })
+      ;(compiledApi as any)[method] = endpoint
+    })
+    return compiledApi
+  }
+
+  public async addApi<T extends RestApi>({
+    api,
+    hostName,
+    port,
+    root,
+    cors,
+    injector,
+    deserializeQueryParams,
+  }: ImplementApiOptions<T>) {
+    const supportedMethods = this.getSuportedMethods(api)
+    const rootApiPath = PathHelper.normalize(root)
+    const server = await this.serverManager.getOrCreate({ hostName, port })
+    const compiledApi = this.compileApi(api, root)
+    server.apis.push({
+      shouldExec: (msg) =>
+        this.shouldExecRequest({
+          ...msg,
+          method: msg.req.method?.toUpperCase(),
+          rootApiPath,
+          supportedMethods,
+          url: PathHelper.normalize(msg.req.url || ''),
+        }),
+      onRequest: (msg) =>
+        this.onMessage({
+          ...msg,
+          compiledApi,
+          rootApiPath,
+          port,
+          supportedMethods,
+          cors,
+          injector,
+          hostName,
+          deserializeQueryParams,
+        }),
+    })
+  }
+
+  public shouldExecRequest(options: {
+    method?: string
+    url?: string
+    rootApiPath: string
+    supportedMethods: string[]
+  }): boolean {
+    return options.method &&
+      options.url &&
+      (options.supportedMethods.includes(options.method) || options.method === 'OPTIONS') &&
+      PathHelper.normalize(options.url).startsWith(options.rootApiPath)
+      ? true
+      : false
+  }
+
+  private getActionFromEndpoint(compiledEndpoint: CompiledApi, fullUrl: URL, method: string) {
+    return (Object.values(compiledEndpoint[method]).find((route) => (route as any).regex.test(fullUrl.pathname)) ||
+      undefined) as
+      | {
+          action: RequestAction<{ body: {}; result: {}; query: {}; url: {}; headers: {} }>
+          regex: RegExp
+          fullPath: string
+        }
+      | undefined
+  }
+
+  private async executeAction({
+    injector,
+    req,
+    res,
+    fullUrl,
+    action,
+    regex,
+    fullPath,
+    deserializeQueryParams,
+  }: OnRequestOptions & {
+    fullUrl: URL
+    action: RequestAction<{ body: {}; result: {}; query: {}; url: {}; headers: {} }>
+    regex: RegExp
+    fullPath: string
+  }) {
+    await usingAsync(injector.createChild(), async (i) => {
+      const utils = i.getInstance(Utils)
+      const httpUserContext = i.getInstance(HttpUserContext)
+      i.setExplicitInstance<IdentityContext>(
+        {
+          getCurrentUser: <TUser extends User>() => httpUserContext.getCurrentUser(req) as Promise<TUser>,
+          isAuthorized: (...roles) => httpUserContext.isAuthorized(req, ...roles),
+          isAuthenticated: () => httpUserContext.isAuthenticated(req),
+        },
+        IdentityContext,
+      )
+      try {
+        const actionResult = await action({
+          request: req,
+          response: res,
+          injector: i,
+          getBody: () => utils.readPostBody<any>(req),
+          headers: req.headers,
+          getQuery: () =>
+            deserializeQueryParams ? deserializeQueryParams(fullUrl.search) : deserializeQueryString(fullUrl.search),
+          getUrlParams: () => {
+            if (!req.url || !regex) {
+              throw new Error('Error parsing request parameters. Missing URL or RegExp.')
+            }
+            const matcher = match(fullPath, { decode: decodeURIComponent })
+            const { params } = matcher(fullUrl.pathname) as any
+            return params
+          },
+        })
+        res.sendActionResult(actionResult)
+      } catch (error) {
+        const errorActionResult = await ErrorAction({
+          request: req,
+          response: res,
+          injector: i,
+          getBody: async () => error,
+        })
+        res.sendActionResult(errorActionResult)
+      }
+      return
+    })
+  }
+
+  private async onMessage(options: OnRequestOptions) {
+    const fullUrl = new URL(
+      PathHelper.joinPaths(
+        'http://',
+        `${options.hostName || ServerManager.DEFAULT_HOST}:${options.port}`,
+        options.req.url as string,
+      ),
+    )
+
+    options.cors && options.injector.getInstance(Utils).addCorsHeaders(options.cors, options.req, options.res)
+    if (options.req.method === 'OPTIONS') {
+      options.res.writeHead(200)
+      options.res.end()
+      return
+    }
+
+    const action = this.getActionFromEndpoint(options.compiledApi, fullUrl, options.req.method?.toUpperCase() as string)
+    if (action) {
+      await this.executeAction({ ...options, ...action, fullUrl })
+    } else {
+      options.res.sendActionResult(
+        await NotFoundAction({ injector: options.injector, request: options.req, response: options.res }),
+      )
+    }
+  }
+
+  constructor(private readonly serverManager: ServerManager) {}
+}

package/src/authenticate.spec.ts

@@ -0,0 +1,78 @@
+import { IncomingMessage } from 'http'
+import { Injector } from '@furystack/inject'
+import { usingAsync } from '@furystack/utils'
+import { HttpUserContext } from './http-user-context'
+import { Authenticate } from './authenticate'
+import { ServerResponse } from 'http'
+import { IdentityContext } from '@furystack/core'
+import { EmptyResult } from './request-action-implementation'
+
+describe('Authenticate', () => {
+  const response = {} as any as ServerResponse
+  const request = { url: 'http://google.com' } as IncomingMessage
+
+  it('Should return 403 w/o basic auth header, when unauthorized and basic auth is disabled', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthenticatedAction = jest.fn(async () => false)
+
+      i.setExplicitInstance(
+        { isAuthenticated: isAuthenticatedAction, getCurrentUser: async () => Promise.reject(':(') },
+        IdentityContext,
+      )
+
+      i.setExplicitInstance(
+        {
+          authentication: { enableBasicAuth: false },
+        },
+        HttpUserContext,
+      )
+      const exampleAuthenticatedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authenticate()(exampleAuthenticatedAction)
+
+      const result = await authorized({ injector: i, request, response })
+      expect(result.statusCode).toBe(401)
+      expect(result.chunk).toEqual({ error: 'unauthorized' })
+      expect(result.headers).toEqual({ 'Content-Type': 'application/json' })
+      expect(exampleAuthenticatedAction).not.toBeCalled()
+    })
+  })
+
+  it('Should return 403 with basic auth headers when unauthorized and basic auth is enabled', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthenticatedAction = jest.fn(async () => false)
+      i.setExplicitInstance(
+        {
+          isAuthenticated: isAuthenticatedAction,
+          getCurrentUser: async () => Promise.reject(':('),
+          authentication: { enableBasicAuth: true },
+        },
+        HttpUserContext,
+      )
+      const exampleAuthenticatedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authenticate()(exampleAuthenticatedAction)
+
+      const result = await authorized({ injector: i, request, response })
+      expect(result.statusCode).toBe(401)
+      expect(result.chunk).toEqual({ error: 'unauthorized' })
+      expect(result.headers).toEqual({ 'Content-Type': 'application/json', 'WWW-Authenticate': 'Basic' })
+      expect(exampleAuthenticatedAction).not.toBeCalled()
+    })
+  })
+
+  it('Should exec the original action if authorized', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthenticatedAction = jest.fn(async () => true)
+      i.setExplicitInstance(
+        { isAuthenticated: isAuthenticatedAction, getCurrentUser: async () => Promise.reject(':(') },
+        IdentityContext,
+      )
+      const exampleAuthenticatedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authenticate()(exampleAuthenticatedAction)
+      const params = { injector: i, body: undefined, query: undefined, request, response }
+      const result = await authorized(params)
+      expect(result.statusCode).toBe(200)
+      expect(result.chunk).toBe(undefined)
+      expect(exampleAuthenticatedAction).toBeCalledWith(params)
+    })
+  })
+})

package/src/authenticate.ts

@@ -0,0 +1,22 @@
+import { sleepAsync } from '@furystack/utils'
+import { HttpUserContext } from './http-user-context'
+import { ActionResult, JsonResult, RequestAction, RequestActionOptions } from './request-action-implementation'
+
+export const Authenticate =
+  () =>
+  <T extends { result: unknown }>(action: RequestAction<T>): RequestAction<T> => {
+    return async (args: RequestActionOptions<T>): Promise<ActionResult<T>> => {
+      const authenticated = await args.injector.isAuthenticated()
+      if (!authenticated) {
+        await sleepAsync(Math.random() * 1000)
+        return JsonResult(
+          { error: 'unauthorized' },
+          401,
+          args.injector.getInstance(HttpUserContext).authentication.enableBasicAuth
+            ? { 'WWW-Authenticate': 'Basic' }
+            : {},
+        ) as unknown as ActionResult<T>
+      }
+      return (await action(args)) as any
+    }
+  }

package/src/authorize.spec.ts

@@ -0,0 +1,69 @@
+import { IncomingMessage } from 'http'
+import { Injector } from '@furystack/inject'
+import { usingAsync } from '@furystack/utils'
+import { User, IdentityContext } from '@furystack/core'
+import { Authorize } from './authorize'
+import { ServerResponse } from 'http'
+import { EmptyResult } from './request-action-implementation'
+
+describe('Authorize', () => {
+  const response = {} as any as ServerResponse
+  const request = { url: 'http://google.com' } as IncomingMessage
+
+  it('Should return 403 when failed to get current user', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthorizedAction = jest.fn(async () => false)
+      i.setExplicitInstance(
+        { isAuthorized: isAuthorizedAction, getCurrentUser: () => Promise.reject(':(') },
+        IdentityContext,
+      )
+      const exampleAuthorizedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authorize('Role1')(exampleAuthorizedAction)
+
+      const result = await authorized({ injector: i, request, response })
+      expect(result.statusCode).toBe(403)
+      expect(result.chunk).toEqual({ error: 'forbidden' })
+      expect(exampleAuthorizedAction).not.toBeCalled()
+    })
+  })
+
+  it('Should return 403 if the current user does not have the role', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthorizedAction = jest.fn(async () => false)
+      i.setExplicitInstance(
+        {
+          isAuthorized: isAuthorizedAction,
+          getCurrentUser: async () => Promise.resolve<User>({ username: 'a', roles: ['Role1'] }),
+        },
+        IdentityContext,
+      )
+      const exampleAuthorizedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authorize('Role2')(exampleAuthorizedAction)
+
+      const result = await authorized({ injector: i, request, response })
+      expect(result.statusCode).toBe(403)
+      expect(result.chunk).toEqual({ error: 'forbidden' })
+      expect(exampleAuthorizedAction).not.toBeCalled()
+    })
+  })
+
+  it('Should exec the original action if authorized', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      const isAuthorizedAction = jest.fn(async () => true)
+      i.setExplicitInstance(
+        {
+          isAuthorized: isAuthorizedAction,
+          getCurrentUser: async () => Promise.resolve<User>({ username: 'a', roles: ['Role1'] }),
+        },
+        IdentityContext,
+      )
+      const exampleAuthorizedAction = jest.fn(async (_args: any) => EmptyResult())
+      const authorized = Authorize('Role1')(exampleAuthorizedAction)
+      const params = { injector: i, body: undefined, query: undefined, request, response }
+      const result = await authorized(params)
+      expect(result.statusCode).toBe(200)
+      expect(result.chunk).toBe(undefined)
+      expect(exampleAuthorizedAction).toBeCalledWith(params)
+    })
+  })
+})

package/src/authorize.ts

@@ -0,0 +1,19 @@
+import { sleepAsync } from '@furystack/utils'
+import { ActionResult, JsonResult, RequestAction, RequestActionOptions } from './request-action-implementation'
+
+export const Authorize =
+  (...roles: string[]) =>
+  <T extends { result: unknown }>(action: RequestAction<T>): RequestAction<T> => {
+    return async (options: RequestActionOptions<T>): Promise<ActionResult<T>> => {
+      try {
+        const authorized = await options.injector.isAuthorized(...roles)
+        if (!authorized) {
+          await sleepAsync(Math.random() * 1000)
+          return JsonResult({ error: 'forbidden' }, 403) as any
+        }
+      } catch (error) {
+        return JsonResult({ error: 'forbidden' }, 403) as any
+      }
+      return (await action(options)) as any
+    }
+  }

package/src/endpoint-generators/create-delete-endpoint.spec.ts

@@ -0,0 +1,34 @@
+import { usingAsync } from '@furystack/utils'
+import { Injector } from '@furystack/inject'
+import { DeleteEndpoint } from '@furystack/rest'
+import { createDeleteEndpoint } from './create-delete-endpoint'
+import got from 'got'
+import { MockClass, setupContext } from './utils'
+
+describe('createDeleteEndpoint', () => {
+  it('Should delete the entity and report the success', async () => {
+    await usingAsync(new Injector(), async (i) => {
+      setupContext(i)
+      await i.useRestService<{ DELETE: { '/:id': DeleteEndpoint<MockClass, 'id'> } }>({
+        root: '/api',
+        port: 1111,
+        api: {
+          DELETE: {
+            '/:id': createDeleteEndpoint({ model: MockClass, primaryKey: 'id' }),
+          },
+        },
+      })
+      await i.getDataSetFor(MockClass, 'id').add(i, { id: 'mock', value: 'mock' })
+
+      const countBeforeDelete = await i.getDataSetFor(MockClass, 'id').count(i)
+      expect(countBeforeDelete).toBe(1)
+
+      const response = await got('http://127.0.0.1:1111/api/mock', { method: 'DELETE' })
+      expect(response.statusCode).toBe(204)
+      expect(response.body).toBe('')
+
+      const countAfterDelete = await i.getDataSetFor(MockClass, 'id').count(i)
+      expect(countAfterDelete).toBe(0)
+    })
+  })
+})