@mondaydotcomorg/monday-authorization 0.0.0-featidanlepublish-snapshot.ede6904

package/LICENSE.md

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2020, monday.com
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/README.md

@@ -0,0 +1,82 @@
+# Monday Authorization
+
+Use it to authorize your microservice's endpoints through the monolith.
+For example, in your microservice you want to know if a user can access a post.
+The middleware will execute an http call to the monolith, that will do the authorization:
+
+```
+user.can?(:show, post)
+```
+
+show is the action, post is the resource.
+
+## Install
+
+```
+yarn add @mondaydotcomorg/monday-authorization
+```
+
+## Usage
+
+First init the package in order for it to work properly
+
+app.ts:
+
+```ts
+import { startServer, getPrometheus } from '@mondaydotcomorg/monday-server-runner';
+import * as MondayAuthorization from '@mondaydotcomorg/monday-authorization';
+
+...
+
+MondayAuthorization.init({ prometheus: getPrometheus() });
+startServer(...)
+```
+
+Then add this code to any route declaration:
+
+```ts
+import { Router } from 'express';
+import {
+  getAuthorizationMiddleware,
+  skipAuthorizationMiddleware,
+  authorizationCheckMiddleware,
+} from '@mondaydotcomorg/monday-authorization';
+import { like } from 'src/controllers/likes/likes-controller';
+
+const action = 'like';
+const resourceGetter = request => {
+  return [
+    {
+      id: request.params.postId,
+      type: 'post',
+      wrapper_data: { item_id: 431234 }, //optional
+    },
+  ];
+};
+router = Router();
+router.use(authorizationCheckMiddleware);
+router.post('/posts/:postId/like', getAuthorizationMiddleware(action, resourceGetter), like);
+router.get('/internal/some_unauthorized_endpoint', skipAuthorizationMiddleware, handler);
+```
+
+`resourceGetter` is a function that gets the request and return an array of resources.
+`wrapper_data` is additional data to create a wrapper model in the monolith. It is optional.
+In this example the monolith can instantiate a wrapper of post instead of the post itself.
+The item_id is all that needed for the authorization of posts.
+
+`accountId` and `userId` are needed for the authorization and are taken from the authentication middelware
+by default. If you're not using the authentication middleware, you will have to provide a contextGetter
+function, that looks like this:
+
+```ts
+(request) => {
+  return ({
+    accountId: ...,
+    userId: ...
+  })
+}
+```
+
+Add `authorizationCheckMiddleware` to make sure that all routes are covered by authorization check. Put this
+middleware before you define the routes.
+If you want to skip authorization, use `skipAuthorizationMiddleware`.

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@mondaydotcomorg/monday-authorization",
+  "version": "0.0.0-featidanlepublish-snapshot.ede6904",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "license": "BSD-3-Clause",
+  "scripts": {
+    "test": "mocha -r ts-node/register -r tsconfig-paths/register './tests/*.test.ts' --timeout 5000 --exit",
+    "build": "tsc --build"
+  },
+  "dependencies": {
+    "@mondaydotcomorg/monday-fetch": "^0.0.0-featidanlepublish-snapshot.ede6904",
+    "@mondaydotcomorg/monday-jwt": "^2.0.4",
+    "@mondaydotcomorg/monday-logger": "^0.0.0-featidanlepublish-snapshot.ede6904",
+    "@types/express": "^4.17.12",
+    "node-fetch": "^2.6.1",
+    "ts-node": "^10.0.0"
+  },
+  "devDependencies": {
+    "@types/mocha": "^8.2.2",
+    "@types/on-headers": "^1.0.0",
+    "@types/supertest": "^2.0.11",
+    "express": "^4.17.1",
+    "mocha": "^9.0.1",
+    "on-headers": "^1.0.2",
+    "supertest": "^6.1.3",
+    "tsconfig-paths": "^3.9.0",
+    "typescript": "^4.3.4"
+  },
+  "files": [
+    "dist/"
+  ],
+  "gitHead": "ede6904ed02e87af9782c73d2a21ca95c7e7eafb"
+}