@harperfast/harper 5.0.0-alpha.10 → 5.0.0-beta.3

package/security/data_objects/PermissionResponseObject.js

@@ -0,0 +1,115 @@
+'use strict';
+
+const PermissionTableResponseObject = require('./PermissionTableResponseObject.js');
+const PermissionAttributeResponseObject = require('./PermissionAttributeResponseObject.js');
+const { HDB_ERROR_MSGS } = require('../../utility/errors/commonErrors.js');
+
+/**
+ * This object organizes permission checks into a cohesive response object that will be returned to
+ * the user in the case of a failed permissions check.
+ */
+class PermissionResponseObject {
+	constructor() {
+		this.error = HDB_ERROR_MSGS.OP_AUTH_PERMS_ERROR;
+		this.unauthorized_access = {};
+		this.invalid_schema_items = [];
+	}
+
+	/**
+	 * This method sets the passed error message to the unauthorizedAccess array and returns the perms response object
+	 * to be returned to the API - i.e. operation requires SU role so response is sent back immediately with that error message
+	 * @param errMsg
+	 * @returns { PermissionResponseObject }
+	 */
+	handleUnauthorizedItem(errMsg) {
+		this.invalid_schema_items = [];
+		this.unauthorized_access = [errMsg];
+		return this;
+	}
+
+	/**
+	 * This method sets the passed error message to the invalidSchemaItems array and returns the perms response object
+	 * to be returned to the API - i.e. operation on schema that user does not have access to or doesn't exist so response
+	 * is sent back immediately with that error message
+	 * @param errMsg
+	 * @returns { PermissionResponseObject }
+	 */
+	handleInvalidItem(errMsg) {
+		this.invalid_schema_items = [errMsg];
+		this.unauthorized_access = [];
+		return this;
+	}
+
+	/**
+	 * This method is used to add an invalid schema item message to the invalidSchemaItems array if there is not an
+	 * unauthorizedAccess value already tracked for the table - this ensures that we are not providing schema meta-data
+	 * to the user that they should not have
+	 * @param item - error string to add to array
+	 * @param schema - schema that the item is a part of
+	 * @param table - table that the item is a part of
+	 */
+	addInvalidItem(item, schema, table) {
+		if (schema && table) {
+			const schemaTable = `${schema}_${table}`;
+			if (this.unauthorized_access[schemaTable]) {
+				return;
+			}
+		}
+		this.invalid_schema_items.push(item);
+	}
+
+	/**
+	 * This method is used to add an unauthorized table object to the unauthorizedAccess array
+	 * @param schema - schema that table is under
+	 * @param table - table name that user does not have correct perms on
+	 * @param requiredPerms - permission/s that user does not have on the table to complete the operation
+	 */
+	addUnauthorizedTable(schema, table, requiredTablePerms) {
+		const failedTable = new PermissionTableResponseObject(schema, table, requiredTablePerms);
+
+		const schemaTable = `${schema}_${table}`;
+		this.unauthorized_access[schemaTable] = failedTable;
+	}
+
+	/**
+	 * This method is used to add unauthorized table attribute objects to a new or, if already tracked, an existing table
+	 * object tracked in the unauthorizedAccess array
+	 * @param attrKeys - attribute names that are restricted
+	 * @param schema - schema of table where attr restrictions exist
+	 * @param table - table where attr restrictions exist
+	 * @param restrictedAttrs - the perms restrictions for each attr
+	 */
+	addUnauthorizedAttributes(attrKeys, schema, table, restrictedAttrs) {
+		const unauthorizedTableAttributes = [];
+		attrKeys.forEach((attr) => {
+			const attributeObject = new PermissionAttributeResponseObject(attr, restrictedAttrs[attr]);
+			unauthorizedTableAttributes.push(attributeObject);
+		});
+
+		const schemaTable = `${schema}_${table}`;
+
+		if (this.unauthorized_access[schemaTable]) {
+			this.unauthorized_access[schemaTable].required_attribute_permissions = unauthorizedTableAttributes;
+		} else {
+			const failedPermObject = new PermissionTableResponseObject(schema, table, [], unauthorizedTableAttributes);
+			this.unauthorized_access[schemaTable] = failedPermObject;
+		}
+	}
+
+	/**
+	 * This method is used to evaluate whether or not there are permissions issues tracked and, if so, returns the response
+	 * object and, if not, returns a null value meaning the validation step has passed
+	 *
+	 * @returns { null| PermissionResponseObject }
+	 */
+	getPermsResponse() {
+		const unauthorizedAccessArr = Object.values(this.unauthorized_access);
+		if (unauthorizedAccessArr.length > 0 || this.invalid_schema_items.length > 0) {
+			this.unauthorized_access = unauthorizedAccessArr;
+			return this;
+		}
+		return null;
+	}
+}
+
+module.exports = PermissionResponseObject;

package/security/data_objects/PermissionTableResponseObject.js

@@ -0,0 +1,20 @@
+'use strict';
+
+class PermissionTableResponseObject {
+	/**
+	 * Organizes permission checks into a cohesive response object that will be returned to
+	 * the user in the case of a failed permissions check.
+	 * @param schema {String}
+	 * @param table  {String}
+	 * @param requiredTablePerms {Array}
+	 * @param requiredAttrPerms {Array}
+	 */
+	constructor(schema, table, requiredTablePerms = [], requiredAttrPerms = []) {
+		this.schema = schema;
+		this.table = table;
+		this.required_table_permissions = requiredTablePerms;
+		this.required_attribute_permissions = requiredAttrPerms;
+	}
+}
+
+module.exports = PermissionTableResponseObject;

package/security/fastifyAuth.js

@@ -0,0 +1,169 @@
+'use strict';
+
+const validation = require('../validation/check_permissions.js');
+const passport = require('passport');
+const LocalStrategy = require('passport-local').Strategy;
+const BasicStrategy = require('passport-http').BasicStrategy;
+const util = require('util');
+const userFunctions = require('./user.ts');
+const cbFindValidateUsers = util.callbackify(userFunctions.findAndValidateUser);
+const hdbTerms = require('../utility/hdbTerms.ts');
+const tokenAuthentication = require('./tokenAuthentication.ts');
+const { AccessViolation } = require('../utility/errors/hdbError');
+
+passport.use(
+	new LocalStrategy(function (username, password, done) {
+		cbFindValidateUsers(username, password, done);
+	})
+);
+
+passport.use(
+	new BasicStrategy(function (username, password, done) {
+		cbFindValidateUsers(username, password, done);
+	})
+);
+
+passport.serializeUser(function (user, done) {
+	done(null, user);
+});
+
+passport.deserializeUser(function (user, done) {
+	done(null, user);
+});
+
+function authorize(req, res, next) {
+	if (req.raw?.user !== undefined) return next(null, req.raw.user);
+	let strategy;
+	let token;
+	if (req.headers?.authorization) {
+		let splitAuthHeader = req.headers.authorization.split(' ');
+		strategy = splitAuthHeader[0];
+		token = splitAuthHeader[1];
+	}
+
+	function handleResponse(err, user) {
+		if (err) {
+			return next(err);
+		}
+		if (!user) {
+			return next(new AccessViolation());
+		}
+		return next(null, user);
+	}
+
+	switch (strategy) {
+		case 'Basic':
+			passport.authenticate('basic', { session: false }, (err, user) => {
+				handleResponse(err, user);
+			})(req, res, next);
+			break;
+		case 'Bearer':
+			if (req.body?.operation && req.body.operation === hdbTerms.OPERATIONS_ENUM.REFRESH_OPERATION_TOKEN) {
+				tokenAuthentication
+					.validateRefreshToken(token)
+					.then((user) => {
+						req.body.refresh_token = token;
+						next(null, user);
+					})
+					.catch((e) => {
+						next(e);
+					});
+			} else {
+				tokenAuthentication
+					.validateOperationToken(token)
+					.then((user) => {
+						next(null, user);
+					})
+					.catch((e) => {
+						next(e);
+					});
+			}
+			break;
+		default:
+			passport.authenticate('local', { session: false }, function (err, user) {
+				handleResponse(err, user);
+			})(req, res, next);
+			break;
+	}
+}
+
+function checkPermissions(checkPermissionObj, callback) {
+	let validationResults = validation(checkPermissionObj);
+
+	if (validationResults) {
+		callback(validationResults);
+		return;
+	}
+
+	let authoriziationObj = {
+		authorized: true,
+		messages: [],
+	};
+
+	let role = checkPermissionObj.user.role;
+
+	if (!role?.permission) {
+		return callback('Invalid role');
+	}
+	let permission = JSON.parse(role.permission);
+
+	if (permission.super_user) {
+		return callback(null, authoriziationObj);
+	}
+
+	if (!permission[checkPermissionObj.schema]) {
+		authoriziationObj.authorized = false;
+		authoriziationObj.messages.push(`Not authorized to access ${checkPermissionObj.schema} schema`);
+		return callback(null, authoriziationObj);
+	}
+
+	if (!permission[checkPermissionObj.schema].tables[checkPermissionObj.table]) {
+		authoriziationObj.authorized = false;
+		authoriziationObj.messages.push(`Not authorized to access ${checkPermissionObj.table} table`);
+		return callback(null, authoriziationObj);
+	}
+
+	if (!permission[checkPermissionObj.schema].tables[checkPermissionObj.table][checkPermissionObj.operation]) {
+		authoriziationObj.authorized = false;
+		authoriziationObj.messages.push(
+			`Not authorized to access ${checkPermissionObj.operation} on ${checkPermissionObj.table} table`
+		);
+		return callback(null, authoriziationObj);
+	}
+
+	if (
+		permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions &&
+		!checkPermissionObj.attributes
+	) {
+		authoriziationObj.authorized = false;
+		authoriziationObj.messages.push(
+			`${checkPermissionObj.schema}.${checkPermissionObj.table} has attribute permissions. Missing attributes to validate`
+		);
+		return callback(null, authoriziationObj);
+	}
+
+	if (
+		permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions &&
+		checkPermissionObj.attributes
+	) {
+		let restrictedAttrs = permission[checkPermissionObj.schema].tables[checkPermissionObj.table].attribute_permissions;
+		for (let rAttr in restrictedAttrs) {
+			if (
+				checkPermissionObj.attributes.indexOf(restrictedAttrs[rAttr].attribute_name) > -1 &&
+				!restrictedAttrs[rAttr][checkPermissionObj.operation]
+			) {
+				authoriziationObj.authorized = false;
+				authoriziationObj.messages.push(
+					`Not authorized to ${checkPermissionObj.operation} ${restrictedAttrs[rAttr].attribute_name} `
+				);
+			}
+		}
+	}
+
+	return callback(null, authoriziationObj);
+}
+
+module.exports = {
+	authorize,
+	checkPermissions,
+};

package/security/impersonation.ts

@@ -0,0 +1,160 @@
+import type { User } from './user.ts';
+import type { ImpersonatePayload } from '../server/operationsServer.ts';
+import { getUsersWithRolesCache } from './user.ts';
+import { validateOperations } from '../utility/operationPermissions.ts';
+import { ClientError } from '../utility/errors/hdbError.js';
+import harperLogger from '../utility/logging/harper_logger.js';
+import { getRoleByName } from './role.js';
+
+/**
+ * Applies impersonation to a request. The authenticated user must be a super_user.
+ * Returns a new User object with downgraded permissions based on the impersonate payload.
+ *
+ * Mode A (inline role): `impersonate.role` is present — builds a synthetic user with the given permissions.
+ * Mode B (existing user): `impersonate.username` is present (no role/role_name) — looks up the user from cache.
+ * Mode C (existing role): `impersonate.role_name` is present (no role) — looks up the role by name and builds a synthetic user.
+ */
+export async function applyImpersonation(authenticatedUser: User, payload: ImpersonatePayload): Promise<User> {
+	// Gate: only super_user can impersonate
+	if (!authenticatedUser?.role?.permission?.super_user) {
+		throw new ClientError('Only super_user can use impersonation', 403);
+	}
+
+	validatePayload(payload);
+
+	let impersonatedUser: User;
+
+	if (payload.role) {
+		// Mode A: inline permissions
+		impersonatedUser = buildInlineUser(authenticatedUser, payload);
+	} else if (payload.role_name) {
+		// Mode C: look up existing role by name
+		impersonatedUser = await lookupRole(authenticatedUser, payload);
+	} else {
+		// Mode B: look up existing user by username
+		impersonatedUser = await lookupUser(payload.username!);
+	}
+
+	// Enforce downgrade: never allow escalation
+	enforceDowngrade(impersonatedUser);
+
+	// Tag for audit trail
+	impersonatedUser._impersonated = true;
+	impersonatedUser._impersonatedBy = authenticatedUser.username;
+
+	harperLogger.info(
+		`Impersonation applied: "${authenticatedUser.username}" impersonating as "${impersonatedUser.username}"`
+	);
+
+	return impersonatedUser;
+}
+
+function validatePayload(payload: ImpersonatePayload): void {
+	if (typeof payload !== 'object' || payload === null || Array.isArray(payload)) {
+		throw new ClientError('Invalid impersonate payload: must be an object');
+	}
+
+	const hasRole = payload.role !== undefined;
+	const hasUsername = typeof payload.username === 'string' && payload.username.length > 0;
+	const hasRoleName = typeof payload.role_name === 'string' && payload.role_name.length > 0;
+
+	if (!hasRole && !hasUsername && !hasRoleName) {
+		throw new ClientError(
+			"Invalid impersonate payload: must include 'username', 'role_name', or 'role' with 'permission'"
+		);
+	}
+
+	if (hasRole) {
+		if (typeof payload.role !== 'object' || payload.role === null) {
+			throw new ClientError("Invalid impersonate payload: 'role' must be an object");
+		}
+		if (typeof payload.role.permission !== 'object' || payload.role.permission === null) {
+			throw new ClientError("Invalid impersonate payload: 'role.permission' must be an object");
+		}
+		validateOperationsField(payload.role.permission);
+	}
+}
+
+function validateOperationsField(permission: Record<string, unknown>): void {
+	const operations = permission.operations;
+	if (operations === undefined) return;
+
+	if (!Array.isArray(operations)) {
+		throw new ClientError("Invalid impersonate payload: 'operations' must be an array");
+	}
+
+	const invalidOp = validateOperations(operations);
+	if (invalidOp !== null) {
+		throw new ClientError(`Invalid impersonate payload: unknown operation '${invalidOp}'`);
+	}
+}
+
+function buildInlineUser(authenticatedUser: User, payload: ImpersonatePayload): User {
+	const username = payload.username || authenticatedUser.username;
+
+	return {
+		username,
+		active: true,
+		role: {
+			permission: { ...payload.role!.permission },
+			role: `_impersonated`,
+			id: `_impersonated_${username}`,
+			__updatedtime__: Date.now(),
+			__createdtime__: Date.now(),
+		},
+	};
+}
+
+async function lookupUser(username: string): Promise<User> {
+	const cache = await getUsersWithRolesCache();
+	const cachedUser = cache.get(username);
+
+	if (!cachedUser) {
+		throw new ClientError(`Impersonation target user '${username}' not found`, 404);
+	}
+
+	if (cachedUser.active === false) {
+		throw new ClientError(`Impersonation target user '${username}' is inactive`, 403);
+	}
+
+	// Shallow-clone to avoid mutating cache (same pattern as auth.ts)
+	const cloned: User = {
+		...cachedUser,
+		role: cachedUser.role
+			? {
+					...cachedUser.role,
+					permission: { ...cachedUser.role.permission },
+					id: `_impersonated_${username}`,
+				}
+			: cachedUser.role,
+	};
+	return cloned;
+}
+
+async function lookupRole(authenticatedUser: User, payload: ImpersonatePayload): Promise<User> {
+	const role = await getRoleByName(payload.role_name);
+
+	if (!role) {
+		throw new ClientError(`Impersonation target role '${payload.role_name}' not found`, 404);
+	}
+
+	const username = payload.username || authenticatedUser.username;
+
+	return {
+		username,
+		active: true,
+		role: {
+			permission: { ...role.permission },
+			role: role.role,
+			id: `_impersonated_${username}`,
+			__updatedtime__: Date.now(),
+			__createdtime__: Date.now(),
+		},
+	};
+}
+
+function enforceDowngrade(user: User): void {
+	if (!user.role?.permission) return;
+	user.role.permission.super_user = false;
+	user.role.permission.cluster_user = false;
+}