@kumologica/sdk 3.0.0

package/src/app/ui/editor-api/lib/auth/permissions.js

@@ -0,0 +1,51 @@
+ 
+
+var util = require('util');
+
+var readRE = /^((.+)\.)?read$/
+var writeRE = /^((.+)\.)?write$/
+
+function hasPermission(userScope,permission) {
+    if (permission === "") {
+        return true;
+    }
+    var i;
+
+    if (util.isArray(permission)) {
+        // Multiple permissions requested - check each one
+        for (i=0;i<permission.length;i++) {
+            if (!hasPermission(userScope,permission[i])) {
+                return false;
+            }
+        }
+        // All permissions check out
+        return true;
+    }
+
+    if (util.isArray(userScope)) {
+        if (userScope.length === 0) {
+            return false;
+        }
+        for (i=0;i<userScope.length;i++) {
+            if (hasPermission(userScope[i],permission)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    if (userScope === "*" || userScope === permission) {
+        return true;
+    }
+
+    if (userScope === "read" || userScope === "*.read") {
+        return readRE.test(permission);
+    } else if (userScope === "write" || userScope === "*.write") {
+        return writeRE.test(permission);
+    }
+    return false;
+}
+
+module.exports = {
+    hasPermission: hasPermission,
+}

package/src/app/ui/editor-api/lib/auth/strategies.js

@@ -0,0 +1,144 @@
+ 
+
+var BearerStrategy = require('passport-http-bearer').Strategy;
+var ClientPasswordStrategy = require('passport-oauth2-client-password')
+  .Strategy;
+
+var passport = require('passport');
+var crypto = require('crypto');
+var util = require('util');
+
+var Tokens = require('./tokens');
+var Users = require('./users');
+var Clients = require('./clients');
+var permissions = require('./permissions');
+
+const { util: runtimeUtil } = require('../../../../lib/runtime-loader');
+const log = runtimeUtil.log;
+
+var bearerStrategy = function(accessToken, done) {
+  // is this a valid token?
+  Tokens.get(accessToken).then(function(token) {
+    if (token) {
+      Users.get(token.user).then(function(user) {
+        if (user) {
+          done(null, user, { scope: token.scope });
+        } else {
+          log.audit({ event: 'auth.invalid-token' });
+          done(null, false);
+        }
+      });
+    } else {
+      log.audit({ event: 'auth.invalid-token' });
+      done(null, false);
+    }
+  });
+};
+bearerStrategy.BearerStrategy = new BearerStrategy(bearerStrategy);
+
+var clientPasswordStrategy = function(clientId, clientSecret, done) {
+  Clients.get(clientId).then(function(client) {
+    if (client && client.secret == clientSecret) {
+      done(null, client);
+    } else {
+      log.audit({ event: 'auth.invalid-client', client: clientId });
+      done(null, false);
+    }
+  });
+};
+clientPasswordStrategy.ClientPasswordStrategy = new ClientPasswordStrategy(
+  clientPasswordStrategy
+);
+
+var loginAttempts = [];
+var loginSignInWindow = 600000; // 10 minutes
+
+var passwordTokenExchange = function(client, username, password, scope, done) {
+  var now = Date.now();
+  loginAttempts = loginAttempts.filter(function(logEntry) {
+    return logEntry.time + loginSignInWindow > now;
+  });
+  loginAttempts.push({ time: now, user: username });
+  var attemptCount = 0;
+  loginAttempts.forEach(function(logEntry) {
+    /* istanbul ignore else */
+    if (logEntry.user == username) {
+      attemptCount++;
+    }
+  });
+  if (attemptCount > 5) {
+    log.audit({
+      event: 'auth.login.fail.too-many-attempts',
+      username: username,
+      client: client.id
+    });
+    done(
+      new Error('Too many login attempts. Wait 10 minutes and try again'),
+      false
+    );
+    return;
+  }
+
+  Users.authenticate(username, password).then(function(user) {
+    if (user) {
+      if (scope === '') {
+        scope = user.permissions;
+      }
+      if (permissions.hasPermission(user.permissions, scope)) {
+        loginAttempts = loginAttempts.filter(function(logEntry) {
+          return logEntry.user !== username;
+        });
+        Tokens.create(username, client.id, scope).then(function(tokens) {
+          log.audit({
+            event: 'auth.login',
+            username: username,
+            client: client.id,
+            scope: scope
+          });
+          done(null, tokens.accessToken, null, {
+            expires_in: tokens.expires_in
+          });
+        });
+      } else {
+        log.audit({
+          event: 'auth.login.fail.permissions',
+          username: username,
+          client: client.id,
+          scope: scope
+        });
+        done(null, false);
+      }
+    } else {
+      log.audit({
+        event: 'auth.login.fail.credentials',
+        username: username,
+        client: client.id,
+        scope: scope
+      });
+      done(null, false);
+    }
+  });
+};
+
+function AnonymousStrategy() {
+  passport.Strategy.call(this);
+  this.name = 'anon';
+}
+util.inherits(AnonymousStrategy, passport.Strategy);
+AnonymousStrategy.prototype.authenticate = function(req) {
+  var self = this;
+  Users.default().then(function(anon) {
+    if (anon) {
+      self.success(anon, { scope: anon.permissions });
+    } else {
+      self.fail(401);
+    }
+  });
+};
+
+module.exports = {
+  bearerStrategy: bearerStrategy,
+  clientPasswordStrategy: clientPasswordStrategy,
+  passwordTokenExchange: passwordTokenExchange,
+  anonymousStrategy: new AnonymousStrategy()
+};

package/src/app/ui/editor-api/lib/auth/tokens.js

@@ -0,0 +1,138 @@
+ 
+
+function generateToken(length) {
+    var c = "ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890";
+    var token = [];
+    for (var i=0;i<length;i++) {
+        token.push(c[Math.floor(Math.random()*c.length)]);
+    }
+    return token.join("");
+}
+
+
+var storage;
+var sessionExpiryTime
+var sessions = {};
+var loadedSessions = null;
+var apiAccessTokens;
+var sessionExpiryListeners = [];
+var expiryTimeout;
+
+function expireSessions() {
+    if (expiryTimeout) {
+        clearTimeout(expiryTimeout);
+        expiryTimeout = null;
+    }
+    var nextExpiry = Number.MAX_SAFE_INTEGER;
+    var now = Date.now();
+    var modified = false;
+    for (var t in sessions) {
+        if (sessions.hasOwnProperty(t)) {
+            var session = sessions[t];
+            if (!session.hasOwnProperty("expires") || session.expires < now) {
+                sessionExpiryListeners.forEach(listener => { listener(session) })
+                delete sessions[t];
+                modified = true;
+            } else {
+                if (session.expires < nextExpiry) {
+                    nextExpiry = session.expires;
+                }
+            }
+        }
+    }
+    if (nextExpiry < Number.MAX_SAFE_INTEGER) {
+        // Allow 5 seconds grace
+        expiryTimeout = setTimeout(expireSessions,Math.min(2147483647,(nextExpiry - Date.now()) + 5000))
+    }
+    if (modified) {
+        return storage.saveSessions(sessions);
+    } else {
+        return Promise.resolve();
+    }
+}
+function loadSessions() {
+    if (loadedSessions === null) {
+        loadedSessions = storage.getSessions().then(function(_sessions) {
+             sessions = _sessions||{};
+             return expireSessions();
+        });
+    }
+    return loadedSessions;
+}
+
+module.exports = {
+    init: function(adminAuthSettings, _storage) {
+        storage = _storage;
+
+        sessionExpiryListeners = [];
+
+        sessionExpiryTime = adminAuthSettings.sessionExpiryTime || 604800; // 1 week in seconds
+        // At this point, storage will not have been initialised, so defer loading
+        // the sessions until there's a request for them.
+        loadedSessions = null;
+
+        apiAccessTokens = {};
+        if ( Array.isArray(adminAuthSettings.tokens) ) {
+            apiAccessTokens = adminAuthSettings.tokens.reduce(function(prev, current) {
+                prev[current.token] = {
+                    user: current.user,
+                    scope: current.scope
+                };
+                return prev;
+            }, {});
+        }
+        return Promise.resolve();
+    },
+    get: function(token) {
+        return loadSessions().then(function() {
+            var info = apiAccessTokens[token] || null;
+
+            if (info) {
+                return Promise.resolve(info);
+            } else {
+                if (sessions[token]) {
+                    if (sessions[token].expires < Date.now()) {
+                        return expireSessions().then(function() { return null });
+                    }
+                }
+                return Promise.resolve(sessions[token]);
+            }
+        });
+    },
+    create: function(user,client,scope) {
+        return loadSessions().then(function() {
+            var accessToken = generateToken(128);
+
+            var accessTokenExpiresAt = Date.now() + (sessionExpiryTime*1000);
+
+            var session = {
+                user:user,
+                client:client,
+                scope:scope,
+                accessToken: accessToken,
+                expires: accessTokenExpiresAt
+            };
+            sessions[accessToken] = session;
+
+            if (!expiryTimeout) {
+                expiryTimeout = setTimeout(expireSessions,Math.min(2147483647,(accessTokenExpiresAt - Date.now()) + 5000))
+            }
+
+            return storage.saveSessions(sessions).then(function() {
+                return {
+                    accessToken: accessToken,
+                    expires_in: sessionExpiryTime
+                }
+            });
+        });
+    },
+    revoke: function(token) {
+        return loadSessions().then(function() {
+            delete sessions[token];
+            return storage.saveSessions(sessions);
+        });
+    },
+    onSessionExpiry: function(callback) {
+        sessionExpiryListeners.push(callback);
+    }
+}

package/src/app/ui/editor-api/lib/auth/users.js

@@ -0,0 +1,122 @@
+/**
+* Copyright JS Foundation and other contributors, http://js.foundation
+*
+* Licensed under the Apache License, Version 2.0 (the "License");
+* you may not use this file except in compliance with the License.
+* You may obtain a copy of the License at
+*
+* http://www.apache.org/licenses/LICENSE-2.0
+*
+* Unless required by applicable law or agreed to in writing, software
+* distributed under the License is distributed on an "AS IS" BASIS,
+* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+* See the License for the specific language governing permissions and
+* limitations under the License.
+**/
+
+var util = require("util");
+var clone = require("clone");
+var bcrypt;
+try { bcrypt = require('bcrypt'); }
+catch(e) { bcrypt = require('bcryptjs'); }
+var users = {};
+var defaultUser = null;
+
+function authenticate() {
+    var username = arguments[0];
+    if (typeof username !== 'string') {
+        username = username.username;
+    }
+    const args = Array.from(arguments);
+    return api.get(username).then(function(user) {
+        if (user) {
+            if (args.length === 2) {
+                // Username/password authentication
+                var password = args[1];
+                return new Promise(function(resolve,reject) {
+                    bcrypt.compare(password, user.password, function(err, res) {
+                        resolve(res?cleanUser(user):null);
+                    });
+                });
+            } else {
+                // Try to extract common profile information
+                if (args[0].hasOwnProperty('photos') && args[0].photos.length > 0) {
+                    user.image = args[0].photos[0].value;
+                }
+                return cleanUser(user);
+            }
+        }
+        return null;
+    });
+}
+function get(username) {
+    return Promise.resolve(users[username]);
+}
+function getDefaultUser() {
+    return Promise.resolve(null);
+}
+
+var api = {
+    get: get,
+    authenticate: authenticate,
+    default: getDefaultUser
+}
+
+function init(config) {
+    users = {};
+    defaultUser = null;
+    if (config.type == "credentials" || config.type == "strategy") {
+        if (config.users) {
+            if (typeof config.users === "function") {
+                api.get = config.users;
+            } else {
+                var us = config.users;
+                /* istanbul ignore else */
+                if (!util.isArray(us)) {
+                    us = [us];
+                }
+                for (var i=0;i<us.length;i++) {
+                    var u = us[i];
+                    users[u.username] = clone(u);
+                }
+            }
+        }
+        if (config.authenticate && typeof config.authenticate === "function") {
+            api.authenticate = config.authenticate;
+        } else {
+            api.authenticate = authenticate;
+        }
+    } else {
+        api.get = get;
+        api.authenticate = authenticate;
+        api.default = api.default;
+    }
+    if (config.default) {
+        if (typeof config.default === "function") {
+            api.default = config.default;
+        } else {
+            api.default = function() {
+                return Promise.resolve({
+                    "anonymous": true,
+                    "permissions":config.default.permissions
+                });
+            }
+        }
+    } else {
+        api.default = getDefaultUser;
+    }
+}
+function cleanUser(user) {
+    if (user && user.hasOwnProperty('password')) {
+        user = clone(user);
+        delete user.password;
+    }
+    return user;
+}
+
+module.exports = {
+    init: init,
+    get: function(username) { return api.get(username).then(cleanUser)},
+    authenticate: function() { return api.authenticate.apply(null, arguments) },
+    default: function() { return api.default(); }
+};

package/src/app/ui/editor-api/lib/editor/comms.js

@@ -0,0 +1,247 @@
+var ws = require('ws');
+var url = require('url');
+
+const { util: runtimeUtil } = require('../../../../lib/runtime-loader');
+const log = runtimeUtil.log;
+
+var Tokens;
+var Users;
+var Permissions;
+
+var server;
+var settings;
+var runtimeAPI;
+
+var wsServer;
+var activeConnections = [];
+
+var anonymousUser;
+
+var retained = {};
+
+var heartbeatTimer;
+var lastSentTime;
+
+function init(_server, _settings, _runtimeAPI) {
+  server = _server;
+  settings = _settings;
+  runtimeAPI = _runtimeAPI;
+  Tokens = require('../auth/tokens');
+  Tokens.onSessionExpiry(handleSessionExpiry);
+  Users = require('../auth/users');
+  Permissions = require('../auth/permissions');
+}
+function handleSessionExpiry(session) {
+  activeConnections.forEach((connection) => {
+    if (connection.token === session.accessToken) {
+      connection.ws.send(JSON.stringify({ auth: 'fail' }));
+      connection.ws.close();
+    }
+  });
+}
+function generateSession(length) {
+  var c = 'ABCDEFGHIJKLMNOPQRSTUZWXYZabcdefghijklmnopqrstuvwxyz1234567890';
+  var token = [];
+  for (var i = 0; i < length; i++) {
+    token.push(c[Math.floor(Math.random() * c.length)]);
+  }
+  return token.join('');
+}
+
+function CommsConnection(ws) {
+  this.session = generateSession(32);
+  this.ws = ws;
+  this.stack = [];
+  this.user = null;
+  this.lastSentTime = 0;
+  var self = this;
+
+  log.audit({ event: 'comms.open' });
+  log.trace('comms.open ' + self.session);
+  var pendingAuth = settings.adminAuth != null;
+
+  if (!pendingAuth) {
+    addActiveConnection(self);
+  }
+  ws.on('close', function () {
+    log.audit({ event: 'comms.close', user: self.user, session: self.session });
+    log.trace('comms.close ' + self.session);
+    removeActiveConnection(self);
+  });
+  ws.on('message', function (data, flags) {
+    var msg = null;
+    try {
+      msg = JSON.parse(data);
+    } catch (err) {
+      log.trace('comms received malformed message : ' + err.toString());
+      return;
+    }
+    if (!pendingAuth) {
+      if (msg.subscribe) {
+        self.subscribe(msg.subscribe);
+        // handleRemoteSubscription(ws,msg.subscribe);
+      }
+    } else {
+      var completeConnection = function (userScope, session, sendAck) {
+        try {
+          if (
+            !userScope ||
+            !Permissions.hasPermission(userScope, 'status.read')
+          ) {
+            ws.send(JSON.stringify({ auth: 'fail' }));
+            ws.close();
+          } else {
+            pendingAuth = false;
+            addActiveConnection(self);
+            self.token = msg.auth;
+            if (sendAck) {
+              ws.send(JSON.stringify({ auth: 'ok' }));
+            }
+          }
+        } catch (err) {
+          console.log(err.stack);
+          // Just in case the socket closes before we attempt
+          // to send anything.
+        }
+      };
+      if (msg.auth) {
+        Tokens.get(msg.auth).then(function (client) {
+          if (client) {
+            Users.get(client.user).then(function (user) {
+              if (user) {
+                self.user = user;
+                log.audit({ event: 'comms.auth', user: self.user });
+                completeConnection(client.scope, msg.auth, true);
+              } else {
+                log.audit({ event: 'comms.auth.fail' });
+                completeConnection(null, null, false);
+              }
+            });
+          } else {
+            log.audit({ event: 'comms.auth.fail' });
+            completeConnection(null, null, false);
+          }
+        });
+      } else {
+        if (anonymousUser) {
+          log.audit({ event: 'comms.auth', user: anonymousUser });
+          self.user = anonymousUser;
+          completeConnection(anonymousUser.permissions, null, false);
+          //TODO: duplicated code - pull non-auth message handling out
+          if (msg.subscribe) {
+            self.subscribe(msg.subscribe);
+          }
+        } else {
+          log.audit({ event: 'comms.auth.fail' });
+          completeConnection(null, null, false);
+        }
+      }
+    }
+  });
+  ws.on('error', function (err) {
+    log.warn(`Communication channel error: ${err.toString()}`);
+  });
+}
+
+CommsConnection.prototype.send = function (topic, data) {
+  var self = this;
+  if (topic && data) {
+    this.stack.push({ topic: topic, data: data });
+  }
+  if (!this._xmitTimer) {
+    this._xmitTimer = setTimeout(function () {
+      try {
+        self.ws.send(JSON.stringify(self.stack));
+        self.lastSentTime = Date.now();
+      } catch (err) {
+        removeActiveConnection(self);
+        log.warn(`Communication send error: ${err.toString()}`);
+      }
+      delete self._xmitTimer;
+      self.stack = [];
+    }, 50);
+  }
+};
+
+CommsConnection.prototype.subscribe = function (topic) {
+  runtimeAPI.comms.subscribe({
+    user: this.user,
+    client: this,
+    topic: topic,
+  });
+};
+
+function start() {
+  if (!settings.disableEditor) {
+    Users.default().then(function (_anonymousUser) {
+      anonymousUser = _anonymousUser;
+      var webSocketKeepAliveTime = settings.webSocketKeepAliveTime || 15000;
+      var commsPath = settings.httpAdminRoot || '/';
+      commsPath =
+        (commsPath.slice(0, 1) != '/' ? '/' : '') +
+        commsPath +
+        (commsPath.slice(-1) == '/' ? '' : '/') +
+        'comms';
+      wsServer = new ws.Server({ noServer: true });
+      wsServer.on('connection', function (ws) {
+        var commsConnection = new CommsConnection(ws);
+      });
+      wsServer.on('error', function (err) {
+        log.warn(`Communication server error: ${err.toString()}`);
+      });
+
+      server.on('upgrade', function upgrade(request, socket, head) {
+        const pathname = url.parse(request.url).pathname;
+        if (pathname === commsPath) {
+          wsServer.handleUpgrade(request, socket, head, function done(ws) {
+            wsServer.emit('connection', ws, request);
+          });
+        }
+        // Don't destroy the socket as other listeners may want to handle the
+        // event.
+      });
+
+      lastSentTime = Date.now();
+
+      heartbeatTimer = setInterval(function () {
+        var now = Date.now();
+        if (now - lastSentTime > webSocketKeepAliveTime) {
+          activeConnections.forEach((connection) =>
+            connection.send('hb', lastSentTime)
+          );
+        }
+      }, webSocketKeepAliveTime);
+    });
+  }
+}
+
+function stop() {
+  if (heartbeatTimer) {
+    clearInterval(heartbeatTimer);
+    heartbeatTimer = null;
+  }
+  if (wsServer) {
+    wsServer.close();
+    wsServer = null;
+  }
+}
+
+function addActiveConnection(connection) {
+  activeConnections.push(connection);
+  runtimeAPI.comms.addConnection({ client: connection });
+}
+function removeActiveConnection(connection) {
+  for (var i = 0; i < activeConnections.length; i++) {
+    if (activeConnections[i] === connection) {
+      activeConnections.splice(i, 1);
+      runtimeAPI.comms.removeConnection({ client: connection });
+      break;
+    }
+  }
+}
+
+module.exports = {
+  init: init,
+  start: start,
+  stop: stop,
+};