@inteli.city/node-red-contrib-http-plus 1.0.0

package/httpin+.js

@@ -0,0 +1,626 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var swagger = require("./libs/swagger");
+var swaggerInitialized = false;
+
+module.exports = function(RED) {
+    "use strict";
+
+    if (!swaggerInitialized) {
+        swagger.registerRoutes(RED);
+        swaggerInitialized = true;
+    }
+
+    var bodyParser = require("body-parser");
+    var multer = require("multer");
+    var cookieParser = require("cookie-parser");
+    var getBody = require('raw-body');
+    var cors = require('cors');
+    var onHeaders = require('on-headers');
+    var typer = require('content-type');
+    var mediaTyper = require('media-typer');
+    var isUtf8 = require('is-utf8');
+    var hashSum = require("hash-sum");
+    var jwt = require('jsonwebtoken');
+    var jwksRsa = require('jwks-rsa');
+    var { z } = require('zod');
+    var os   = require('os');
+
+    function rawBodyParser(req, res, next) {
+        if (req.skipRawBodyParser) { next(); } // don't parse this if told to skip
+        if (req._body) { return next(); }
+        req.body = "";
+        req._body = true;
+
+        var isText = true;
+        var checkUTF = false;
+
+        if (req.headers['content-type']) {
+            var contentType = typer.parse(req.headers['content-type'])
+            if (contentType.type) {
+                var parsedType = mediaTyper.parse(contentType.type);
+                if (parsedType.type === "text") {
+                    isText = true;
+                } else if (parsedType.subtype === "xml" || parsedType.suffix === "xml") {
+                    isText = true;
+                } else if (parsedType.type !== "application") {
+                    isText = false;
+                } else if ((parsedType.subtype !== "octet-stream")
+                    && (parsedType.subtype !== "cbor")
+                    && (parsedType.subtype !== "x-protobuf")) {
+                    checkUTF = true;
+                } else {
+                    // application/octet-stream or application/cbor
+                    isText = false;
+                }
+
+            }
+        }
+
+        getBody(req, {
+            length: req.headers['content-length'],
+            encoding: isText ? "utf8" : null
+        }, function (err, buf) {
+            if (err) { return next(err); }
+            if (!isText && checkUTF && isUtf8(buf)) {
+                buf = buf.toString()
+            }
+            req.body = buf;
+            next();
+        });
+    }
+
+    var corsSetup = false;
+
+    function createRequestWrapper(node,req) {
+        // This misses a bunch of properties (eg headers). Before we use this function
+        // need to ensure it captures everything documented by Express and HTTP modules.
+        var wrapper = {
+            _req: req
+        };
+        var toWrap = [
+            "param",
+            "get",
+            "is",
+            "acceptsCharset",
+            "acceptsLanguage",
+            "app",
+            "baseUrl",
+            "body",
+            "cookies",
+            "fresh",
+            "hostname",
+            "ip",
+            "ips",
+            "originalUrl",
+            "params",
+            "path",
+            "protocol",
+            "query",
+            "route",
+            "secure",
+            "signedCookies",
+            "stale",
+            "subdomains",
+            "xhr",
+            "socket" // TODO: tidy this up
+        ];
+        toWrap.forEach(function(f) {
+            if (typeof req[f] === "function") {
+                wrapper[f] = function() {
+                    node.warn(RED._("httpin.errors.deprecated-call",{method:"msg.req."+f}));
+                    var result = req[f].apply(req,arguments);
+                    if (result === req) {
+                        return wrapper;
+                    } else {
+                        return result;
+                    }
+                }
+            } else {
+                wrapper[f] = req[f];
+            }
+        });
+
+
+        return wrapper;
+    }
+    function createResponseWrapper(node,res) {
+        var wrapper = {
+            _res: res
+        };
+        var toWrap = [
+            "append",
+            "attachment",
+            "cookie",
+            "clearCookie",
+            "download",
+            "end",
+            "format",
+            "get",
+            "json",
+            "jsonp",
+            "links",
+            "location",
+            "redirect",
+            "render",
+            "send",
+            "sendfile",
+            "sendFile",
+            "sendStatus",
+            "set",
+            "status",
+            "type",
+            "vary"
+        ];
+        toWrap.forEach(function(f) {
+            wrapper[f] = function() {
+                node.warn(RED._("httpin.errors.deprecated-call",{method:"msg.res."+f}));
+                var result = res[f].apply(res,arguments);
+                if (result === res) {
+                    return wrapper;
+                } else {
+                    return result;
+                }
+            }
+        });
+        return wrapper;
+    }
+
+    var corsHandler = function(req,res,next) { next(); }
+
+    if (RED.settings.httpNodeCors) {
+        corsHandler = cors(RED.settings.httpNodeCors);
+        RED.httpNode.options("*",corsHandler);
+    }
+
+    function HTTPIn(n) {
+        RED.nodes.createNode(this,n);
+
+        // Zod schema compilation (once at deploy time)
+        var compiledSchema = null;
+        var schemaText = (n.zodSchema || "").trim();
+        if (n.enableZod === true && schemaText) {
+            try {
+                compiledSchema = eval(schemaText); // z is in scope
+            } catch(err) {
+                this.error("http.in+: invalid Zod schema — " + err.message);
+            }
+        }
+
+        if (compiledSchema && n.method === "get") {
+            try {
+                var _def = compiledSchema._def;
+                if (_def && _def.typeName === "ZodObject") {
+                    var _shape = typeof _def.shape === "function" ? _def.shape() : _def.shape;
+                    if (_shape.body) {
+                        this.warn(
+                            "http.in+: GET endpoint defines a body schema. " +
+                            "Use 'query' instead. Body will be ignored."
+                        );
+                    }
+                }
+            } catch(e) {
+                // ignore
+            }
+        }
+
+        if (compiledSchema) {
+            swagger.registerEndpoint({
+                nodeId: this.id,
+                method: n.method,
+                path: n.url && n.url[0] !== '/' ? '/' + n.url : n.url,
+                schema: compiledSchema,
+                rawSchemaText: schemaText
+            });
+        }
+
+        // Load auth config node (may be null if not configured)
+        var authConfig = RED.nodes.getNode(n.authConfig);
+
+        // Create JWKS client once per node instance (built-in key caching)
+        var jwksClient = null;
+        if (authConfig && authConfig.authType === 'cognito' && authConfig.jwksUrl) {
+            jwksClient = jwksRsa({
+                jwksUri: authConfig.jwksUrl,
+                cache: true,
+                cacheMaxEntries: 5,
+                cacheMaxAge: 3600000  // 1 hour
+            });
+        }
+
+        if (RED.settings.httpNodeRoot !== false) {
+
+            if (!n.url) {
+                this.warn(RED._("httpin.errors.missing-path"));
+                return;
+            }
+            this.url = n.url;
+            if (this.url[0] !== '/') {
+                this.url = '/'+this.url;
+            }
+            this.method        = n.method;
+            this.swaggerDoc    = n.swaggerDoc;
+            this.enableUpload  = n.enableUpload;
+            this.uploadStorage = n.uploadStorage || 'memory';
+            this.maxFileSize   = n.maxFileSize   || 5;
+            this.uploadDir     = n.uploadDir     || '';
+
+            var node = this;
+
+            this.errorHandler = function(err,req,res,next) {
+                node.warn(err);
+                res.sendStatus(500);
+            };
+
+            this.callback = function(req,res) {
+                // Dispatch msg downstream after successful auth
+                function dispatchMsg(user) {
+                    var msgid = RED.util.generateId();
+                    res._msgid = msgid;
+                    // Since Node 15, req.headers are lazily computed and the property
+                    // marked as non-enumerable.
+                    // That means it doesn't show up in the Debug sidebar.
+                    // This redefines the property causing it to be evaluated *and*
+                    // marked as enumerable again.
+                    Object.defineProperty(req, 'headers', {
+                        value: req.headers,
+                        enumerable: true
+                    });
+                    var msg = {_msgid:msgid, req:req, res:createResponseWrapper(node,res)};
+                    if (user !== undefined) { msg.user = user; }
+                    if (node.method.match(/^(post|delete|put|options|patch)$/)) {
+                        msg.payload = req.body;
+                    } else if (node.method == "get") {
+                        msg.payload = req.query;
+                    }
+                    if (req._uploadedFiles) { msg.files = req._uploadedFiles; }
+
+                    // ── Zod validation ─────────────────────────────────────
+                    if (compiledSchema) {
+                        var validationInput = {
+                            body:   msg.payload,
+                            query:  req.query,
+                            params: req.params,
+                            files:  msg.files
+                        };
+                        try {
+                            var parsed = compiledSchema.parse(validationInput);
+                            msg.validated = parsed;
+                        } catch(validationErr) {
+                            res.status(400).json({
+                                error: "invalid_request",
+                                details: validationErr.errors
+                            });
+                            return;
+                        }
+                    }
+
+                    node.send(msg);
+                }
+
+                // ── No auth config or authType "none" ──────────────────────
+                if (!authConfig || authConfig.authType === 'none') {
+                    return dispatchMsg();
+                }
+
+                // ── Basic Auth ─────────────────────────────────────────────
+                if (authConfig.authType === 'basic') {
+                    var basicHeader = req.headers['authorization'] || '';
+                    if (!basicHeader.startsWith('Basic ')) {
+                        res.set('WWW-Authenticate', 'Basic realm="Restricted"');
+                        return res.status(401).json({error: "unauthorized"});
+                    }
+                    var decoded = Buffer.from(basicHeader.slice(6), 'base64').toString('utf8');
+                    var colonIdx = decoded.indexOf(':');
+                    var reqUser = colonIdx >= 0 ? decoded.slice(0, colonIdx) : decoded;
+                    var reqPass = colonIdx >= 0 ? decoded.slice(colonIdx + 1) : '';
+                    var authed = false;
+                    if (authConfig.useJsonUsers) {
+                        try {
+                            var users = JSON.parse(authConfig.usersJson || '{}');
+                            authed = Object.prototype.hasOwnProperty.call(users, reqUser) &&
+                                     users[reqUser] === reqPass;
+                        } catch(e) {
+                            node.error('http.in+: invalid usersJson — ' + e.message);
+                        }
+                    } else {
+                        var creds = authConfig.credentials || {};
+                        authed = reqUser === creds.username && reqPass === creds.password;
+                    }
+                    if (authed) {
+                        if (req.headers && req.headers.authorization) {
+                            delete req.headers.authorization;
+                        }
+                        return dispatchMsg(reqUser);
+                    }
+                    res.set('WWW-Authenticate', 'Basic realm="Restricted"');
+                    return res.status(401).json({error: "unauthorized"});
+                }
+
+                // ── Cognito JWT ────────────────────────────────────────────
+                if (authConfig.authType === 'cognito') {
+                    if (!jwksClient) {
+                        node.warn('http.in+: cognito auth is configured but jwksUrl is missing');
+                        return res.status(401).json({error: "unauthorized"});
+                    }
+
+                    // Extract token: Bearer header first, then ?token= query param
+                    var bearerHeader = req.headers['authorization'] || '';
+                    var token = null;
+                    if (bearerHeader.startsWith('Bearer ')) {
+                        token = bearerHeader.slice(7);
+                    } else if (req.query && req.query.token) {
+                        token = req.query.token;
+                    }
+                    if (!token) {
+                        return res.status(401).json({error: "unauthorized"});
+                    }
+
+                    var verifyOptions = {};
+                    if (authConfig.audience) { verifyOptions.audience = authConfig.audience; }
+                    if (authConfig.issuer)   { verifyOptions.issuer   = authConfig.issuer; }
+
+                    function getKey(header, callback) {
+                        jwksClient.getSigningKey(header.kid, function(err, key) {
+                            if (err) { return callback(err); }
+                            var signingKey = key.getPublicKey
+                                ? key.getPublicKey()
+                                : (key.publicKey || key.rsaPublicKey);
+                            callback(null, signingKey);
+                        });
+                    }
+
+                    jwt.verify(token, getKey, verifyOptions, function(err, jwtPayload) {
+                        if (err) {
+                            return res.status(401).json({error: "unauthorized"});
+                        }
+                        if (req.headers && req.headers.authorization) {
+                            delete req.headers.authorization;
+                        }
+                        if (req.query && req.query.token) {
+                            delete req.query.token;
+                        }
+                        if (!authConfig.exposeUser) {
+                            return dispatchMsg();
+                        }
+                        var mappingStr = (authConfig.userMapping || '').trim();
+                        var mapping = null;
+                        try {
+                            mapping = JSON.parse(mappingStr);
+                        } catch(e) {
+                            node.warn('http.in+: invalid userMapping JSON — ' + e.message + '. msg.user will not be set.');
+                            return dispatchMsg();
+                        }
+                        var mappedUser = {};
+                        for (var key in mapping) {
+                            if (Object.prototype.hasOwnProperty.call(mapping, key)) {
+                                mappedUser[key] = jwtPayload[mapping[key]];
+                            }
+                        }
+                        dispatchMsg(mappedUser);
+                    });
+                    return; // async path — dispatchMsg called in jwt.verify callback
+                }
+
+                // ── Unknown authType — allow through ───────────────────────
+                dispatchMsg();
+            };
+
+            var httpMiddleware = function(req,res,next) { next(); }
+
+            if (RED.settings.httpNodeMiddleware) {
+                if (typeof RED.settings.httpNodeMiddleware === "function" || Array.isArray(RED.settings.httpNodeMiddleware)) {
+                    httpMiddleware = RED.settings.httpNodeMiddleware;
+                }
+            }
+
+            var maxApiRequestSize = RED.settings.apiMaxLength || '5mb';
+            var jsonParser = bodyParser.json({limit:maxApiRequestSize});
+            var urlencParser = bodyParser.urlencoded({limit:maxApiRequestSize,extended:true});
+
+            var metricsHandler = function(req,res,next) { next(); }
+            if (this.metric()) {
+                metricsHandler = function(req, res, next) {
+                    var startAt = process.hrtime();
+                    onHeaders(res, function() {
+                        if (res._msgid) {
+                            var diff = process.hrtime(startAt);
+                            var ms = diff[0] * 1e3 + diff[1] * 1e-6;
+                            var metricResponseTime = ms.toFixed(3);
+                            var metricContentLength = res.getHeader("content-length");
+                            //assuming that _id has been set for res._metrics in HttpOut node!
+                            node.metric("response.time.millis", {_msgid:res._msgid} , metricResponseTime);
+                            node.metric("response.content-length.bytes", {_msgid:res._msgid} , metricContentLength);
+                        }
+                    });
+                    next();
+                };
+            }
+
+            var multipartParser = function(req,res,next) { next(); }
+            if (this.enableUpload) {
+                var storageEngine;
+                if (this.uploadStorage === 'disk') {
+                    var uploadDest = this.uploadDir || os.tmpdir();
+                    storageEngine = multer.diskStorage({
+                        destination: uploadDest,
+                        filename: function(req, file, cb) {
+                            var name = Date.now() + '-' + Math.round(Math.random() * 1e9) + '-' + file.originalname;
+                            cb(null, name);
+                        }
+                    });
+                } else {
+                    storageEngine = multer.memoryStorage();
+                }
+                var uploadInstance = multer({
+                    storage: storageEngine,
+                    limits: { fileSize: (node.maxFileSize || 5) * 1024 * 1024 }
+                });
+                var uploadMiddleware    = uploadInstance.any();
+                var uploadStorageLabel  = node.uploadStorage || 'memory';
+                multipartParser = function(req, res, next) {
+                    uploadMiddleware(req, res, function(err) {
+                        if (err) {
+                            if (err.code === 'LIMIT_FILE_SIZE') {
+                                return res.status(413).json({ error: 'file_too_large' });
+                            }
+                            return next(err);
+                        }
+                        req._body = true;
+                        if (req.files && req.files.length > 0) {
+                            req._uploadedFiles = req.files.map(function(file) {
+                                return {
+                                    fieldname:    file.fieldname,
+                                    originalname: file.originalname,
+                                    mimetype:     file.mimetype,
+                                    size:         file.size,
+                                    storage:      uploadStorageLabel,
+                                    buffer:       uploadStorageLabel === 'memory' ? file.buffer : undefined,
+                                    path:         uploadStorageLabel === 'disk'   ? file.path   : undefined
+                                };
+                            });
+                        }
+                        next();
+                    });
+                };
+            }
+
+            if (this.method == "get") {
+                RED.httpNode.get(this.url,cookieParser(),httpMiddleware,corsHandler,metricsHandler,this.callback,this.errorHandler);
+            } else if (this.method == "post") {
+                RED.httpNode.post(this.url,cookieParser(),httpMiddleware,corsHandler,metricsHandler,jsonParser,urlencParser,multipartParser,rawBodyParser,this.callback,this.errorHandler);
+            } else if (this.method == "put") {
+                RED.httpNode.put(this.url,cookieParser(),httpMiddleware,corsHandler,metricsHandler,jsonParser,urlencParser,rawBodyParser,this.callback,this.errorHandler);
+            } else if (this.method == "patch") {
+                RED.httpNode.patch(this.url,cookieParser(),httpMiddleware,corsHandler,metricsHandler,jsonParser,urlencParser,rawBodyParser,this.callback,this.errorHandler);
+            } else if (this.method == "delete") {
+                RED.httpNode.delete(this.url,cookieParser(),httpMiddleware,corsHandler,metricsHandler,jsonParser,urlencParser,rawBodyParser,this.callback,this.errorHandler);
+            }
+
+            this.on("close",function() {
+                swagger.unregisterEndpoint(node.id);
+                RED.httpNode._router.stack.forEach(function(route,i,routes) {
+                    if (route.route && route.route.path === node.url && route.route.methods[node.method]) {
+                        routes.splice(i,1);
+                    }
+                });
+            });
+        } else {
+            this.warn(RED._("httpin.errors.not-created"));
+        }
+    }
+    RED.nodes.registerType("http.in+",HTTPIn);
+
+
+    function HTTPOut(n) {
+        RED.nodes.createNode(this,n);
+        var node = this;
+        this.headers = n.headers||{};
+        this.statusCode = parseInt(n.statusCode);
+        this.on("input",function(msg,_send,done) {
+            if (msg.res) {
+                var headers = RED.util.cloneMessage(node.headers);
+                if (msg.headers) {
+                    if (msg.headers.hasOwnProperty('x-node-red-request-node')) {
+                        var headerHash = msg.headers['x-node-red-request-node'];
+                        delete msg.headers['x-node-red-request-node'];
+                        var hash = hashSum(msg.headers);
+                        if (hash === headerHash) {
+                            delete msg.headers;
+                        }
+                    }
+                    if (msg.headers) {
+                        for (var h in msg.headers) {
+                            if (msg.headers.hasOwnProperty(h) && !headers.hasOwnProperty(h)) {
+                                headers[h] = msg.headers[h];
+                            }
+                        }
+                    }
+                }
+                // ── Streaming mode ─────────────────────────────────────────
+                var stream = msg.stream || (msg.payload && typeof msg.payload.pipe === 'function' && !Buffer.isBuffer(msg.payload) ? msg.payload : null);
+                if (stream) {
+                    var rawRes = msg.res._res;
+                    if (rawRes.headersSent) { return done(); }
+                    rawRes.statusCode = msg.statusCode || 200;
+                    for (var sh in headers) {
+                        if (headers.hasOwnProperty(sh)) { rawRes.setHeader(sh, headers[sh]); }
+                    }
+                    stream.on('error', function(err) {
+                        if (!rawRes.headersSent) {
+                            rawRes.statusCode = 500;
+                        }
+                        rawRes.end('Stream error');
+                        done();
+                    });
+                    stream.on('end', function() { done(); });
+                    stream.pipe(rawRes);
+                    return;
+                }
+
+                if (Object.keys(headers).length > 0) {
+                    msg.res._res.set(headers);
+                }
+
+                if (msg.cookies) {
+                    for (var name in msg.cookies) {
+                        if (msg.cookies.hasOwnProperty(name)) {
+                            if (msg.cookies[name] === null || msg.cookies[name].value === null) {
+                                if (msg.cookies[name]!==null) {
+                                    msg.res._res.clearCookie(name,msg.cookies[name]);
+                                } else {
+                                    msg.res._res.clearCookie(name);
+                                }
+                            } else if (typeof msg.cookies[name] === 'object') {
+                                msg.res._res.cookie(name,msg.cookies[name].value,msg.cookies[name]);
+                            } else {
+                                msg.res._res.cookie(name,msg.cookies[name]);
+                            }
+                        }
+                    }
+                }
+                var statusCode = node.statusCode || parseInt(msg.statusCode) || 200;
+                if (typeof msg.payload == "object" && !Buffer.isBuffer(msg.payload)) {
+                    msg.res._res.status(statusCode).jsonp(msg.payload);
+                } else {
+                    if (msg.res._res.get('content-length') == null) {
+                        var len;
+                        if (msg.payload == null) {
+                            len = 0;
+                        } else if (Buffer.isBuffer(msg.payload)) {
+                            len = msg.payload.length;
+                        } else if (typeof msg.payload == "number") {
+                            len = Buffer.byteLength(""+msg.payload);
+                        } else {
+                            len = Buffer.byteLength(msg.payload);
+                        }
+                        msg.res._res.set('content-length', len);
+                    }
+
+                    if (typeof msg.payload === "number") {
+                        msg.payload = ""+msg.payload;
+                    }
+                    msg.res._res.status(statusCode).send(msg.payload);
+                }
+            } else {
+                node.warn(RED._("httpin.errors.no-response"));
+            }
+            done();
+        });
+    }
+    RED.nodes.registerType("http.out+",HTTPOut);
+}