@manyos/smileconnect-api 1.31.1 → 1.34.0

package/Dockerfile

@@ -2,20 +2,24 @@
 
 # We label our stage as 'builder'
 FROM node:12.14 as builder
-
+ARG NPM_TOKEN
 COPY package.json package-lock.json ./
 
 RUN npm set progress=false && npm config set depth 0 && npm cache clean --force
 
 ## Storing node modules on a separate layer will prevent unnecessary npm installs at each build
-RUN npm i
-
+RUN echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc && \
+  npm install && \
+  rm ~/.npmrc
+RUN rm -f .npmrc
 WORKDIR /home/node/app
 
 COPY . .
 
-## Build the angular app in production mode and store the artifacts in dist folder
-
 EXPOSE 3000
 
+RUN groupadd -g 999 appuser && \
+    useradd -r -u 999 -g appuser appuser
+USER appuser
+
 CMD npm start

package/app.js

@@ -11,6 +11,7 @@ const JwtStrategy = require('passport-jwt').Strategy,
 const bodyParser = require('body-parser');
 
 const config = require('./util/config');
+const authUtil = require('./util/auth');
 
 const cors = require('cors');
 
@@ -47,6 +48,8 @@ const https = require('https');
 
 const maxHTTPSockets = process.env.MAX_HTTP_SOCKETS || 10;
 
+const SSO_CLIENTNAME_ATTRIBUTE = process.env.SSO_CLIENTNAME_ATTRIBUTE || 'azp';
+
 http.globalAgent.maxSockets = maxHTTPSockets;
 https.globalAgent.maxSockets = maxHTTPSockets;
 
@@ -81,6 +84,8 @@ if (audienceArray.length > 0) {
     opts.audience = audienceArray;
 }
 
+opts.passReqToCallback = true
+
 // Do any necessary shutdown logic for our application here
 const shutdown = (signal, value) => {
     console.log("shutdown!");
@@ -128,22 +133,32 @@ app.use(compression()); //Compress all routes
 
 log.debug('Passport Opts', opts);
 passport.use(
-    new JwtStrategy(opts, function (jwt_payload, done) {
+    new JwtStrategy(opts, function (req, jwt_payload, done) {
         //log.info(jwt_payload);
         //log.info('token', jwt_payload.sub);
         //TODO: Config error abfangen
         //TODO: Add AdminScope and Impersonate
+        let clientId = jwt_payload[SSO_CLIENTNAME_ATTRIBUTE];
+
+        //check for master client
+        const requestedClientId = req.query.clientId
+        if (requestedClientId && authUtil.isMasterClient(clientId)) {
+            log.debug(`client ${clientId} acts as ${requestedClientId}`)
+            clientId = requestedClientId
+        }
+
         const user = {
             'id': jwt_payload.sub,
             'azp': jwt_payload.azp,
             'scope': jwt_payload.scope,
             'exp': jwt_payload.exp,
-            'config': config.getClientConfig(jwt_payload.azp),
+            'config': config.getClientConfig(clientId),
             'username': jwt_payload.preferred_username
         }
         log.debug('Passport User', jwt_payload);
         const resource_access = jwt_payload.resource_access;
         log.debug('User Resource Access', resource_access);
+        //TODO Prüfen ob das auch per
         if (resource_access !== null && resource_access !== undefined && resource_access[user.azp] !== null && resource_access[user.azp] !== undefined) {
             user.accessRoles = resource_access[user.azp].roles;
         }
@@ -156,6 +171,11 @@ passport.use(
 app.use(bodyParser.json({limit: '200mb'}));
 app.use(bodyParser.urlencoded({limit: '200mb', extended: true}));
 
+//health check
+app.use('/v1/health', function (req, res, next) {
+    res.json({status:"ok"})
+})
+
 const maxFilesize = process.env.MAX_FILESIZE || 5;
 
 app.use(fileUpload({

package/conf/clients.json

@@ -21,8 +21,10 @@
         "scripts": {}
       },
       "incident": {
-        "basequery": "1=2",
-        "fields": [],
+        "basequery": "1=1",
+        "fields": [
+          "Description"
+        ],
         "constants": [],
         "scripts": {}
       },

package/controller/taskController.js

@@ -112,7 +112,7 @@ async function createTask(clientConfig, rootForm, rootRequestId, taskData, creat
         }
     }
 }
-
+//Todo make dynamic
 async function createWorklog(clientConfig, taskId, summary, text, attachment) {
     const task = await getTask(clientConfig,taskId)
     const fields = clientConfig.taskWorklog.fields;

package/controller/ticketController.js

@@ -292,6 +292,7 @@ async function updateTicket(ticketConfig, clientConfig, id, ticketData) {
     const myMapping = [{"oldName":ticketConfig.requestIdField, "newName" :  "internalId"}];
     const ticket = await getTicket(ticketConfig, myClientConfig, id, myMapping);
     log.debug('Ticket to Update', ticket);
+    //todo Abfangen wenn getTicket nichts liefert.
     const mapping = config.getMapping(ticketConfig.requestType);
 
     //Constants work only on new.

package/docs/general/config.md

@@ -82,6 +82,15 @@ List of users who are allowed to access /v1/appconfig endpoints.
 Sample:
 ADMIN_USERS=username1, username2
 
+### MASTER_CLIENTS
+
+List of clients that can act on behalf of other clients. 
+
+The URL Parameter *clientId* is used for this.
+
+Sample:
+MASTER_CLIENTS=idm,adminTool
+
 ## Cache
 
 ### CACHETTL_CMDB

package/docs/openapi.json

@@ -2,7 +2,7 @@
     "openapi": "3.0.2",
     "info": {
         "title": "SMILEconnect",
-        "version": "1.22.1",
+        "version": "1.29.1",
         "contact": {
             "name": "manyos technology GmbH",
             "url": "https://manyos.it",
@@ -3401,6 +3401,119 @@
                 },
                 "summary": "Create a new Client"
             }
+        },
+        "/scripts": {
+            "get": {
+                "tags": [
+                    "Scripts"
+                ],
+                "responses": {
+                    "200": {
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "type": "array",
+                                    "items": {
+                                        "$ref": "#/components/schemas/script"
+                                    }
+                                }
+                            }
+                        },
+                        "description": "Returns an array with all scripts"
+                    }
+                },
+                "summary": "Get all scripts"
+            },
+            "post": {
+                "requestBody": {
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/script"
+                            }
+                        }
+                    },
+                    "required": true
+                },
+                "tags": [
+                    "Scripts"
+                ],
+                "responses": {
+                    "200": {
+                        "$ref": "#/components/responses/ScriptDefinitionResponse"
+                    }
+                },
+                "summary": "Create a new script",
+                "description": "Create a new script that is accessible by all catalog items."
+            }
+        },
+        "/scripts/{scriptId}": {
+            "get": {
+                "tags": [
+                    "Scripts"
+                ],
+                "responses": {
+                    "200": {
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/script"
+                                }
+                            }
+                        },
+                        "description": "Return a script"
+                    }
+                },
+                "summary": "Get a global script"
+            },
+            "put": {
+                "requestBody": {
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/script"
+                            }
+                        }
+                    },
+                    "required": true
+                },
+                "tags": [
+                    "Scripts"
+                ],
+                "responses": {
+                    "200": {
+                        "$ref": "#/components/responses/ScriptDefinitionResponse"
+                    }
+                },
+                "summary": "Update a script",
+                "description": "Updates a existing script that is accessible by all catalog item."
+            },
+            "delete": {
+                "tags": [
+                    "Scripts"
+                ],
+                "responses": {
+                    "200": {
+                        "$ref": "#/components/responses/DeleteResponse"
+                    }
+                },
+                "summary": "Delete this script"
+            },
+            "parameters": [
+                {
+                    "examples": {
+                        "catalogIdExample": {
+                            "value": "serverRestart"
+                        }
+                    },
+                    "name": "scriptId",
+                    "schema": {
+                        "type": "string"
+                    },
+                    "in": "path",
+                    "required": true
+                }
+            ]
         }
     },
     "components": {
@@ -15130,6 +15243,25 @@
                     "summary": "Email Password Reset",
                     "notes": "Reset the password for the email system"
                 }
+            },
+            "script": {
+                "title": "Root Type for script",
+                "description": "Scripts can be executed to gather data or perform actions.\n\nScripts always need to end with resolve() or reject().\n\nresolve(data) is called when the script execution was successful. Data will be returned as scriptResult. reject(error) is called when the script was not successful and an error needs to be returned.",
+                "type": "object",
+                "properties": {
+                    "id": {
+                        "description": "id of the script",
+                        "type": "string"
+                    },
+                    "code": {
+                        "description": "the code of the script",
+                        "type": "string"
+                    }
+                },
+                "example": {
+                    "id": "ars101",
+                    "code": "try {\n    const result = await adapter.remedy.search(params.form, params.query, params.valueField + ',' + params.labelField);\n    const data = result.data.map(item => {\n        return {\n            \"value\":item[params.valueField],\n            \"label\":item[params.labelField],\n        }\n    });\n    resolve(data);\n} catch (error) {\n    reject(error);\n}"
+                }
             }
         },
         "responses": {
@@ -15185,6 +15317,42 @@
                     }
                 },
                 "description": "Get the attachment of a worklog."
+            },
+            "ScriptDefinitionResponse": {
+                "content": {
+                    "application/json": {
+                        "schema": {
+                            "$ref": "#/components/schemas/script"
+                        }
+                    }
+                },
+                "description": "Returns a script definition"
+            },
+            "DeleteResponse": {
+                "content": {
+                    "application/json": {
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "id": {
+                                    "type": "string"
+                                },
+                                "status": {
+                                    "type": "string"
+                                }
+                            }
+                        },
+                        "examples": {
+                            "DeletionResponseExample": {
+                                "value": {
+                                    "id": "serverRestart",
+                                    "status": "deleted"
+                                }
+                            }
+                        }
+                    }
+                },
+                "description": "Returns deletion confirmation for the requested item"
             }
         },
         "securitySchemes": {
@@ -15241,6 +15409,10 @@
         {
             "name": "Templates",
             "description": ""
+        },
+        {
+            "name": "Scripts",
+            "description": ""
         }
     ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manyos/smileconnect-api",
-  "version": "1.31.1",
+  "version": "1.34.0",
   "description": "A proxy and abstraction layer for BMCs IT Service Management Suite",
   "main": "app.js",
   "scripts": {
@@ -11,7 +11,7 @@
   "author": "Robert Hannemann",
   "license": "ISC",
   "dependencies": {
-    "@manyos/adapter-foundation": "^1.1.1",
+    "@manyos/adapter-foundation": "^1.1.2",
     "@manyos/logger": "^1.3.0",
     "bunyan": "^1.8.15",
     "bunyan-express-serializer": "^1.0.0",
@@ -22,9 +22,9 @@
     "express-fileupload": "^1.2.1",
     "express-rate-limit": "^5.2.6",
     "express-request-id": "^1.4.1",
-    "express-validator": "^6.10.0",
+    "express-validator": "^6.10.1",
     "moment": "^2.29.1",
-    "mongoose": "^5.12.3",
+    "mongoose": "^5.12.5",
     "node-cache": "^4.2.1",
     "node-fetch": "^2.6.1",
     "only": "0.0.2",

package/util/auth.js

@@ -19,6 +19,20 @@ function isAuthorizedAdmin(req, res, next) {
     }
 }
 
+function isMasterClient(clientId) {
+    const masterClients = process.env.MASTER_CLIENTS;
+    if (masterClients !== null
+        && masterClients !== undefined
+        && clientId !== null
+        && clientId !== undefined
+        && isUserInList(masterClients, clientId)) {
+        log.debug('master client authorized', clientId);
+        return true
+    } else {
+        return false
+    }
+}
+
 function isUserInList(userList, userName) {
     log.debug('Check if user is in List', userName, userList)
     if (userList !== null && userList !== undefined && userName !== null && userName !== undefined) {
@@ -33,5 +47,5 @@ function isUserInList(userList, userName) {
 }
 
 module.exports = {
-    isAuthorizedAdmin
+    isAuthorizedAdmin, isMasterClient
 }