@logux/server 0.13.0 → 0.14.0

package/bind-backend-proxy/index.js

@@ -1,325 +0,0 @@
-import { LoguxError } from '@logux/core'
-import JSONStream from 'JSONStream'
-import { nanoid } from 'nanoid'
-import http from 'node:http'
-import https from 'node:https'
-
-const VERSION = 4
-
-const RESEND_KEYS = [
-  'channels',
-  'channel',
-  'nodes',
-  'node',
-  'clients',
-  'client',
-  'users',
-  'user'
-]
-
-function send(backend, command, events) {
-  let body = JSON.stringify({
-    commands: [command],
-    secret: backend.secret,
-    version: VERSION
-  })
-  let protocol = backend.protocol === 'https:' ? https : http
-  let req = protocol.request(
-    {
-      headers: {
-        'Content-Length': Buffer.byteLength(body),
-        'Content-Type': 'application/json'
-      },
-      host: backend.hostname,
-      method: 'POST',
-      path: backend.pathname + backend.search,
-      port: backend.port
-    },
-    res => {
-      if (res.statusCode < 200 || res.statusCode > 299) {
-        events.error(new Error(`Backend responded with ${res.statusCode} code`))
-      } else {
-        let data = false
-        res
-          .pipe(JSONStream.parse('*'))
-          .on('data', answer => {
-            if (
-              typeof answer !== 'object' ||
-              typeof answer.answer !== 'string'
-            ) {
-              events.error(new Error('Wrong back-end answer'))
-            } else if (answer.answer === 'error') {
-              let err = new Error('Error on back-end server')
-              err.stack = answer.details
-              events.error(err)
-            } else if (events.filter(answer)) {
-              if (!events[answer.answer]) {
-                events.error(new Error('Unknown back-end answer'))
-              } else {
-                data = true
-                events[answer.answer](answer)
-              }
-            }
-          })
-          .on('error', err => {
-            events.error(err)
-          })
-          .on('end', () => {
-            if (!data) {
-              events.error(new Error('Empty back-end answer'))
-            } else if (events.end) {
-              events.end()
-            }
-          })
-      }
-    }
-  )
-  req.on('error', err => {
-    events.error(err)
-  })
-  req.end(body)
-}
-
-export function bindBackendProxy(app) {
-  if (app.options.controlSecret) {
-    app.controls['POST /'] = {
-      command({ action, meta }, req) {
-        if (!app.types[action.type] && !app.getRegexProcessor(action.type)) {
-          meta.status = 'processed'
-        }
-        meta.backend = req.connection.remoteAddress
-        return app.log.add(action, meta)
-      },
-      isValid({ action, command, meta }) {
-        return (
-          command === 'action' &&
-          typeof action === 'object' &&
-          typeof action.type === 'string' &&
-          typeof meta === 'object'
-        )
-      }
-    }
-  }
-
-  if (!app.options.backend) return
-  if (!app.options.controlSecret) {
-    let e = new Error('`backend` requires `controlSecret` option')
-    e.code = 'LOGUX_NO_CONTROL_SECRET'
-    throw e
-  }
-
-  let backend = new URL(app.options.backend)
-  backend.secret = app.options.controlSecret
-
-  let resending = new Map()
-  let accessing = new Map()
-  let processing = new Map()
-  let actions = new Map()
-
-  function sendAction(action, meta, headers) {
-    let resendResolve
-    if (action.type !== 'logux/subscribe') {
-      resending.set(
-        meta.id,
-        new Promise(resolve => {
-          resendResolve = resolve
-        })
-      )
-    }
-    let accessReject, accessResolve
-    accessing.set(
-      meta.id,
-      new Promise((resolve, reject) => {
-        accessResolve = resolve
-        accessReject = reject
-      })
-    )
-    let processReject, processResolve
-    processing.set(
-      meta.id,
-      new Promise((resolve, reject) => {
-        processResolve = resolve
-        processReject = reject
-      })
-    )
-
-    let checked = false
-    let processed = false
-    let error = false
-    function currentReject(e) {
-      if (resendResolve) resendResolve()
-      if (checked) {
-        processReject(e)
-      } else {
-        accessReject(e)
-      }
-    }
-
-    let start = Date.now()
-    app.emitter.emit('backendSent', action, meta)
-    send(
-      backend,
-      { action, command: 'action', headers, meta },
-      {
-        action(data) {
-          let promise = app.log.add(data.action, {
-            status: 'processed',
-            ...data.meta
-          })
-          if (actions.has(meta.id)) {
-            actions.get(meta.id).push(promise)
-          } else {
-            actions.set(meta.id, [promise])
-          }
-        },
-        approved() {
-          if (resendResolve) resendResolve()
-          app.emitter.emit('backendGranted', action, meta, Date.now() - start)
-          checked = true
-          accessResolve(true)
-        },
-        end() {
-          if (!error && (!checked || !processed)) {
-            currentReject(new Error('Back-end do not send required answers'))
-          }
-        },
-        error(e) {
-          error = true
-          currentReject(e)
-        },
-        filter({ id }) {
-          return id === meta.id
-        },
-        forbidden() {
-          if (resendResolve) resendResolve()
-          error = true
-          accessResolve(false)
-        },
-        async processed() {
-          if (!checked) {
-            error = true
-            accessReject(new Error('Processed answer was sent before access'))
-          } else {
-            processed = true
-            await Promise.all(actions.get(meta.id) || [])
-            app.emitter.emit(
-              'backendProcessed',
-              action,
-              meta,
-              Date.now() - start
-            )
-            processResolve()
-          }
-        },
-        resend(answer) {
-          if (checked) {
-            error = true
-            currentReject(new Error('Resend answer was sent after access'))
-          } else if (action.type === 'logux/subscribe') {
-            error = true
-            accessReject(new Error('Resend can be called on subscription'))
-          } else {
-            let resend = {}
-            for (let key of RESEND_KEYS) {
-              if (typeof answer[key] !== 'undefined') {
-                resend[key] = answer[key]
-              }
-            }
-            resendResolve(resend)
-          }
-        },
-        unknownAction() {
-          resendResolve()
-          error = true
-          app.unknownType(action, meta)
-          accessResolve(false)
-        },
-        unknownChannel() {
-          error = true
-          app.wrongChannel(action, meta)
-          accessResolve(false)
-        }
-      }
-    )
-  }
-
-  app.auth(
-    ({ client, cookie, headers, token, userId }) =>
-      new Promise((resolve, reject) => {
-        let random = nanoid()
-        send(
-          backend,
-          {
-            authId: random,
-            command: 'auth',
-            cookie,
-            headers,
-            subprotocol: client.node.remoteSubprotocol,
-            token,
-            userId
-          },
-          {
-            authenticated({ subprotocol }) {
-              if (subprotocol) {
-                app.options.subprotocol = subprotocol
-                client.node.options.subprotocol = subprotocol
-              }
-              resolve(true)
-            },
-            denied() {
-              resolve(false)
-            },
-            error(e) {
-              reject(e)
-            },
-            filter({ authId }) {
-              return random === authId
-            },
-            wrongSubprotocol({ supported }) {
-              reject(
-                new LoguxError('wrong-subprotocol', {
-                  supported,
-                  used: client.node.remoteSubprotocol
-                })
-              )
-            }
-          }
-        )
-      })
-  )
-  app.otherType({
-    access(ctx, action, meta) {
-      sendAction(action, meta, ctx.headers)
-      return accessing.get(meta.id)
-    },
-    finally(ctx, action, meta) {
-      actions.delete(meta.id)
-      resending.delete(meta.id)
-      accessing.delete(meta.id)
-      processing.delete(meta.id)
-    },
-    process(ctx, action, meta) {
-      return processing.get(meta.id)
-    },
-    resend(ctx, action, meta) {
-      if (!resending.has(meta.id)) {
-        sendAction(action, meta, ctx.headers)
-      }
-      return resending.get(meta.id)
-    }
-  })
-  app.otherChannel({
-    access(ctx, action, meta) {
-      sendAction(action, meta, ctx.headers)
-      return accessing.get(meta.id)
-    },
-    finally(ctx, action, meta) {
-      actions.delete(meta.id)
-      accessing.delete(meta.id)
-      processing.delete(meta.id)
-    },
-    load(ctx, action, meta) {
-      return processing.get(meta.id)
-    }
-  })
-}

package/bind-control-server/index.js

@@ -1,136 +0,0 @@
-import { Netmask } from 'netmask'
-
-const MAX_VERSION = 4
-const MIN_VERSION = 4
-const NO_SECRET =
-  'Set LOGUX_CONTROL_SECRET environment variable for Logux ' +
-  'to have access to this page.\n' +
-  'Run `npx nanoid` to generate secure secret.'
-
-function isValidBody(body) {
-  if (typeof body !== 'object') return false
-  if (typeof body.version !== 'number') return false
-  if (typeof body.secret !== 'string') return false
-  if (!Array.isArray(body.commands)) return false
-  if (body.commands.some(i => typeof i !== 'object')) return false
-  return true
-}
-
-export function bindControlServer(app, custom) {
-  if (app.options.disableHttpServer) {
-    if (app.options.controlSecret) {
-      let err = new Error(
-        '`controlSecret` can not be set together with `disableHttpServer` option'
-      )
-      err.logux = true
-      throw err
-    }
-    return
-  }
-
-  let masks = app.options.controlMask.split(/,\s*/).map(i => new Netmask(i))
-  app.httpServer.on('request', async (req, res) => {
-    let urlString = req.url
-    if (/^\/\w+%3F/.test(urlString)) urlString = decodeURIComponent(urlString)
-    let reqUrl = new URL(urlString, 'http://localhost')
-    let rule = app.controls[req.method + ' ' + reqUrl.pathname]
-
-    if (!rule) {
-      if (custom) {
-        custom(req, res)
-      } else {
-        let accepts = Object.keys(app.controls)
-        if (accepts.some(i => i.endsWith(' ' + reqUrl.pathname))) {
-          res.statusCode = 405
-          res.end('Wrong method')
-        } else {
-          res.statusCode = 404
-          res.end('Wrong path')
-        }
-      }
-    } else {
-      let ipAddress = req.connection.remoteAddress
-      if (!(req.method === 'GET' && rule.safe)) {
-        if (masks.every(i => !i.contains(ipAddress))) {
-          app.emitter.emit('report', 'wrongControlIp', {
-            ipAddress,
-            mask: app.options.controlMask
-          })
-          res.statusCode = 403
-          res.end('IP address is not in LOGUX_CONTROL_MASK/controlMask')
-          return
-        }
-      }
-      if (req.method !== 'GET') {
-        let json = ''
-        req.on('data', chunk => {
-          json += chunk
-        })
-        req.on('end', async () => {
-          let body
-          try {
-            body = JSON.parse(json)
-          } catch {
-            res.statusCode = 400
-            res.end('Wrong format')
-            return
-          }
-          if (!isValidBody(body)) {
-            res.statusCode = 400
-            res.end('Wrong body')
-          } else if (body.version < MIN_VERSION || body.version > MAX_VERSION) {
-            res.statusCode = 400
-            res.end('Back-end protocol version is not supported')
-          } else if (app.isBruteforce(req.connection.remoteAddress)) {
-            res.statusCode = 429
-            res.end('Too many wrong secret attempts')
-          } else if (body.secret !== app.options.controlSecret) {
-            app.rememberBadAuth(req.connection.remoteAddress)
-            app.emitter.emit('report', 'wrongControlSecret', {
-              ipAddress,
-              wrongSecret: body.secret
-            })
-            res.statusCode = 403
-            res.end('Wrong secret')
-          } else {
-            for (let i of body.commands) {
-              if (!rule.isValid(i)) {
-                res.statusCode = 400
-                res.end('Wrong command')
-                return
-              }
-            }
-            await Promise.all(body.commands.map(i => rule.command(i, req)))
-            res.end()
-          }
-        })
-      } else {
-        if (!rule.safe) {
-          if (!app.options.controlSecret) {
-            res.statusCode = 500
-            res.end(NO_SECRET)
-            return
-          } else if (app.isBruteforce(req.connection.remoteAddress)) {
-            res.statusCode = 429
-            res.end('Too many wrong secret attempts')
-            return
-          } else if (reqUrl.search !== '?' + app.options.controlSecret) {
-            app.rememberBadAuth(req.connection.remoteAddress)
-            app.emitter.emit('report', 'wrongControlSecret', {
-              ipAddress,
-              wrongSecret: reqUrl.search.slice(1)
-            })
-            res.statusCode = 403
-            res.end('Wrong secret')
-            return
-          }
-        }
-        let answer = await rule.request(req)
-        for (let name in answer.headers) {
-          res.setHeader(name, answer.headers[name])
-        }
-        res.end(answer.body)
-      }
-    }
-  })
-}

package/request/test.test.js

@@ -1,134 +0,0 @@
-import { spy } from 'nanospy'
-import { expect, it } from 'vitest'
-
-import { del, get, patch, post, put, request, ResponseError } from '../index.js'
-
-it('has error', () => {
-  let error = new ResponseError(
-    403,
-    '/a',
-    { body: 'body', method: 'GET' },
-    'answer'
-  )
-  expect(error.name).toEqual('ResponseError')
-  expect(error.statusCode).toEqual(403)
-  expect(error.message).toEqual('403 response on GET /a {"body":"body"} answer')
-})
-
-it('throws an error on non-2xx response', async () => {
-  async function fetch() {
-    return {
-      status: 403,
-      async text() {
-        return 'answer'
-      }
-    }
-  }
-  await expect(
-    request('/a', { body: 'body', method: 'GET' }, fetch)
-  ).rejects.toThrow(
-    new ResponseError(403, '/a', { body: 'body', method: 'GET' }, 'answer')
-  )
-})
-
-it('parses JSON body', async () => {
-  async function fetch() {
-    return {
-      async json() {
-        return { answer: '1' }
-      },
-      status: 200
-    }
-  }
-  expect(await request('/a', { method: 'GET' }, fetch)).toEqual({ answer: '1' })
-})
-
-it('has shortcut for GET', async () => {
-  let fetch = spy(async () => ({
-    async json() {
-      return { answer: '1' }
-    },
-    status: 200
-  }))
-
-  expect(await get('/a', { headers: { a: 1 } }, fetch)).toEqual({ answer: '1' })
-  expect(fetch.calls).toEqual([
-    [
-      '/a',
-      {
-        headers: { a: 1 },
-        method: 'GET'
-      }
-    ]
-  ])
-})
-
-it('has shortcut for POST', async () => {
-  let fetch = spy(async () => ({ status: 204 }))
-  await post('/a', { headers: { a: 1 } }, fetch)
-  expect(fetch.calls).toEqual([
-    [
-      '/a',
-      {
-        headers: { a: 1 },
-        method: 'POST'
-      }
-    ]
-  ])
-})
-
-it('has shortcut for PUT', async () => {
-  let fetch = spy(async () => ({ status: 204 }))
-  await put('/a', { headers: { a: 1 } }, fetch)
-  expect(fetch.calls).toEqual([
-    [
-      '/a',
-      {
-        headers: { a: 1 },
-        method: 'PUT'
-      }
-    ]
-  ])
-})
-
-it('has shortcut for PATCH', async () => {
-  let fetch = spy(async () => ({ status: 204 }))
-  await patch('/a', { headers: { a: 1 } }, fetch)
-  expect(fetch.calls).toEqual([
-    [
-      '/a',
-      {
-        headers: { a: 1 },
-        method: 'PATCH'
-      }
-    ]
-  ])
-})
-
-it('has shortcut for DELETE', async () => {
-  let fetch = spy(async () => ({ status: 204 }))
-  await del('/a', { headers: { a: 1 } }, fetch)
-  expect(fetch.calls).toEqual([
-    [
-      '/a',
-      {
-        headers: { a: 1 },
-        method: 'DELETE'
-      }
-    ]
-  ])
-})
-
-it('works without option object', async () => {
-  async function fetch() {
-    return {
-      status: 404,
-      async text() {
-        return 'answer'
-      }
-    }
-  }
-  await expect(get('/a', undefined, fetch)).rejects.toThrow(
-    new ResponseError(404, '/a', { method: 'GET' }, 'answer')
-  )
-})