@mug-lab/cookie-auth-proxy 0.1.0

package/src/server/proxy-server.js

@@ -0,0 +1,671 @@
+const http = require("node:http");
+const https = require("node:https");
+const net = require("node:net");
+const {
+  addHistory,
+  applyJsonOverrides,
+  findJsonOverrides,
+  findStub,
+  historyBodyFromBuffer,
+  historyBodyFromStoredBuffer,
+  parseRequestBody,
+  queryParamsObject,
+  stubBodyBuffer,
+} = require("../runtime");
+const { getActiveApiCookie } = require("../config");
+const { log } = require("../logger");
+const {
+  rewriteBody,
+  rewriteRequestHeaders,
+  rewriteResponseHeaders,
+  shouldApplyJsonOverrides,
+  shouldRewriteBody,
+} = require("./rewrite");
+
+/**
+ * ブラウザからアクセスされるプロキシサーバを起動する。
+ * リクエストはパス判定によりclientまたはリモートAPIへ振り分ける。
+ *
+ * @param {object} config runtime状態を含むマージ済みプロキシ設定。
+ * @returns {import("node:http").Server} listen済みのHTTPサーバ。
+ */
+function startProxyServer(config) {
+  const server = http.createServer((req, res) => {
+    const useApi = shouldUseApi(req, config.matchers);
+    if (useApi && isCrossSiteBrowserRequest(req, config.publicOriginUrl.origin)) {
+      sendForbiddenCrossSiteApiRequest(req, res, config);
+      return;
+    }
+
+    if (useApi && !config.apiOriginUrl) {
+      sendMissingApiOrigin(req, res, config);
+      return;
+    }
+
+    const target = useApi ? config.apiOriginUrl : config.clientOriginUrl;
+    proxyHttp(
+      req,
+      res,
+      target,
+      config.publicOriginUrl,
+      config,
+      useApi ? "api" : "client",
+    ).catch((error) => {
+      log(config, "error", req.method, req.url, error.message);
+      if (!res.headersSent) {
+        res.writeHead(error.statusCode || 500, {
+          "content-type": "text/plain; charset=utf-8",
+        });
+      }
+      res.end(error.message);
+    });
+  });
+
+  server.on("upgrade", (req, socket, head) => {
+    proxyUpgrade(
+      req,
+      socket,
+      head,
+      config.clientOriginUrl,
+      config.publicOriginUrl,
+      config,
+    );
+  });
+
+  server.listen(config.listenPort, config.listenHost, () => {
+    log(config, "info", `Proxy listening on ${config.publicOriginUrl.origin}`);
+    log(config, "info", `Client  -> ${config.clientOriginUrl.origin}`);
+    log(
+      config,
+      "info",
+      `API     -> ${config.apiOriginUrl ? config.apiOriginUrl.origin : "(not set)"}`,
+    );
+  });
+
+  return server;
+}
+
+/**
+ * ブラウザからのcross-site APIリクエストか判定する。
+ */
+function isCrossSiteBrowserRequest(req, expectedOrigin) {
+  const origin = req.headers.origin;
+  if (origin && origin !== expectedOrigin) return true;
+
+  const fetchSite = String(req.headers["sec-fetch-site"] || "").toLowerCase();
+  return fetchSite === "cross-site";
+}
+
+/**
+ * cross-site APIリクエストを拒否して履歴へ残す。
+ */
+function sendForbiddenCrossSiteApiRequest(req, res, config) {
+  const requestUrl = new URL(req.url, "http://local.proxy");
+  const body = Buffer.from(
+    "Cross-site API requests are not allowed.",
+    "utf8",
+  );
+  const headers = {
+    "content-type": "text/plain; charset=utf-8",
+    "content-length": body.length,
+  };
+  res.writeHead(403, headers);
+  res.end(body);
+  addHistory(config, {
+    type: "error",
+    method: req.method,
+    path: `${requestUrl.pathname}${requestUrl.search}`,
+    origin: config.apiOriginUrl ? config.apiOriginUrl.origin : "",
+    status: 403,
+    durationMs: 0,
+    responseHeaders: headers,
+    requestQuery: queryParamsObject(requestUrl.searchParams),
+    requestBody: null,
+    responseBody: body.toString("utf8"),
+  });
+}
+
+/**
+ * API Origin未設定時のAPI向けリクエストへ、設定を促すエラーを返す。
+ */
+function sendMissingApiOrigin(req, res, config) {
+  const requestUrl = new URL(req.url, "http://local.proxy");
+  const body = Buffer.from(
+    "API origin is not configured. Set it in the admin app.",
+    "utf8",
+  );
+  const headers = {
+    "content-type": "text/plain; charset=utf-8",
+    "content-length": body.length,
+  };
+  res.writeHead(502, headers);
+  res.end(body);
+  addHistory(config, {
+    type: "error",
+    method: req.method,
+    path: `${requestUrl.pathname}${requestUrl.search}`,
+    origin: "",
+    status: 502,
+    durationMs: 0,
+    responseHeaders: headers,
+    requestQuery: queryParamsObject(requestUrl.searchParams),
+    requestBody: null,
+    responseBody: body.toString("utf8"),
+  });
+}
+
+/**
+ * リクエストパスをclientではなくAPIへ送るか判定する。
+ */
+function shouldUseApi(req, matchers) {
+  const requestUrl = new URL(req.url, "http://local.proxy");
+  const pathname = requestUrl.pathname;
+
+  if (matchers.apiExcludes.some((pattern) => pattern.test(pathname))) {
+    return false;
+  }
+
+  return matchers.apiIncludes.some((pattern) => pattern.test(pathname));
+}
+
+/**
+ * Locationヘッダーを通常書き換えから保護するパスか判定する。
+ */
+function shouldPreserveLocationHeader(pathname, matchers) {
+  return matchers.preserveLocation.some((pattern) => pattern.test(pathname));
+}
+
+/**
+ * HTTPリクエスト本文をBufferとして読み込む。
+ */
+function readRequestBuffer(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => {
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}
+
+/**
+ * リクエストBodyをStub/Override条件判定用に読み込むか判定する。
+ */
+function shouldInspectRequestBody(req, maxBytes) {
+  const contentLength = Number(req.headers["content-length"]);
+  return (
+    Number.isFinite(contentLength) &&
+    contentLength > 0 &&
+    contentLength <= maxBytes
+  );
+}
+
+/**
+ * 数値として信用できるContent-Lengthを返す。
+ */
+function getContentLength(headers) {
+  const contentLength = Number(headers["content-length"]);
+  return Number.isFinite(contentLength) && contentLength >= 0
+    ? contentLength
+    : null;
+}
+
+/**
+ * レスポンス本文を書き換え対象としてバッファリングしてよいサイズか判定する。
+ */
+function canBufferForRewrite(headers, maxBytes) {
+  const contentLength = getContentLength(headers);
+  return contentLength === null || contentLength <= maxBytes;
+}
+
+/**
+ * ストリーミング中に履歴表示用の末尾バイトだけ保持する。
+ */
+function createTailRecorder(maxBytes) {
+  const chunks = [];
+  let storedBytes = 0;
+  let totalBytes = 0;
+
+  return {
+    write(chunk) {
+      totalBytes += chunk.length;
+      if (maxBytes <= 0) return;
+
+      chunks.push(chunk);
+      storedBytes += chunk.length;
+      while (storedBytes > maxBytes && chunks.length > 0) {
+        const excess = storedBytes - maxBytes;
+        const first = chunks[0];
+        if (first.length <= excess) {
+          chunks.shift();
+          storedBytes -= first.length;
+        } else {
+          chunks[0] = first.subarray(excess);
+          storedBytes -= excess;
+        }
+      }
+    },
+    toHistory(encoding) {
+      return historyBodyFromStoredBuffer(
+        Buffer.concat(chunks, storedBytes),
+        totalBytes,
+        encoding,
+      );
+    },
+  };
+}
+
+/**
+ * Bodyを書き換えずにブラウザへストリーミングし、履歴用本文だけ上限付きで残す。
+ */
+function streamOriginalResponse(proxyRes, res, responseHeaders, options) {
+  const { statusCode, statusMessage, historyEncoding, maxHistoryBodyBytes } = options;
+  const contentLength = getContentLength(proxyRes.headers);
+  const tail = createTailRecorder(maxHistoryBodyBytes);
+
+  if (contentLength !== null) {
+    responseHeaders["content-length"] = contentLength;
+  }
+
+  res.writeHead(statusCode, statusMessage, responseHeaders);
+
+  return new Promise((resolve, reject) => {
+    proxyRes.on("data", (chunk) => {
+      tail.write(chunk);
+    });
+    proxyRes.on("end", () => {
+      resolve(tail.toHistory(historyEncoding));
+    });
+    proxyRes.on("error", (error) => {
+      res.destroy(error);
+      reject(error);
+    });
+    proxyRes.pipe(res);
+  });
+}
+
+/**
+ * 上限内ならBody書き換え用にバッファし、超えたら未加工Bodyをストリーミングする。
+ */
+function bufferOrStreamOriginalResponse(proxyRes, res, responseHeaders, options) {
+  const {
+    statusCode,
+    statusMessage,
+    historyEncoding,
+    maxHistoryBodyBytes,
+    maxRewriteBytes,
+  } = options;
+
+  if (!canBufferForRewrite(proxyRes.headers, maxRewriteBytes)) {
+    return streamOriginalResponse(proxyRes, res, responseHeaders, {
+      statusCode,
+      statusMessage,
+      historyEncoding,
+      maxHistoryBodyBytes,
+    }).then((historyBody) => ({ streamed: true, historyBody }));
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    const tail = createTailRecorder(maxHistoryBodyBytes);
+    let total = 0;
+    let streaming = false;
+
+    proxyRes.on("data", (chunk) => {
+      tail.write(chunk);
+
+      if (streaming) {
+        return;
+      }
+
+      total += chunk.length;
+      if (total <= maxRewriteBytes) {
+        chunks.push(chunk);
+        return;
+      }
+
+      streaming = true;
+      res.writeHead(statusCode, statusMessage, responseHeaders);
+      chunks.forEach((entry) => res.write(entry));
+      res.write(chunk);
+      proxyRes.pipe(res, { end: false });
+      chunks.length = 0;
+    });
+
+    proxyRes.on("end", () => {
+      if (streaming) {
+        res.end();
+        resolve({ streamed: true, historyBody: tail.toHistory(historyEncoding) });
+        return;
+      }
+
+      resolve({ streamed: false, rawBody: Buffer.concat(chunks, total) });
+    });
+
+    proxyRes.on("error", (error) => {
+      if (streaming) {
+        res.destroy(error);
+      }
+      reject(error);
+    });
+  });
+}
+
+/**
+ * 上流レスポンス読み込み失敗をブラウザへ返す。
+ */
+function sendProxyReadError(res, error) {
+  if (!res.headersSent) {
+    res.writeHead(error.statusCode || 502, {
+      "content-type": "text/plain; charset=utf-8",
+    });
+  }
+  res.end(error.message);
+}
+
+/**
+ * ブラウザからのHTTPリクエスト1件をclientまたはリモートAPIへ中継する。
+ * API向けリクエストではStub、JSON Override、Cookie注入、履歴記録も扱う。
+ *
+ * @param {import("node:http").IncomingMessage} req ブラウザからのリクエスト。
+ * @param {import("node:http").ServerResponse} res ブラウザへ返すレスポンス。
+ * @param {URL} targetOrigin 選択された上流Origin。
+ * @param {URL} publicOrigin ブラウザから見えるローカルプロキシOrigin。
+ * @param {object} config runtime状態を含むマージ済みプロキシ設定。
+ * @param {"api"|"client"} label 挙動分岐とログに使う転送先ラベル。
+ */
+async function proxyHttp(req, res, targetOrigin, publicOrigin, config, label) {
+  const requestUrl = new URL(req.url, targetOrigin);
+  const requestPath = `${requestUrl.pathname}${requestUrl.search}`;
+  const transport = requestUrl.protocol === "https:" ? https : http;
+  const started = Date.now();
+  const isApi = label === "api";
+  const inspectRequestBody =
+    isApi && shouldInspectRequestBody(req, config.maxRequestBodyInspectionBytes);
+  const requestBodyBuffer = inspectRequestBody ? await readRequestBuffer(req) : null;
+  const requestMatch = {
+    pathname: requestUrl.pathname,
+    queryParams: queryParamsObject(requestUrl.searchParams),
+    requestBody: parseRequestBody(req.headers, requestBodyBuffer),
+  };
+  const preserveLocationHeader = shouldPreserveLocationHeader(
+    requestUrl.pathname,
+    config.matchers,
+  );
+  const stub = isApi ? findStub(config, req.method, requestMatch) : null;
+
+  if (stub) {
+    const body = stubBodyBuffer(stub);
+    const headers = {
+      ...stub.headers,
+      "content-length": Buffer.byteLength(body),
+    };
+    res.writeHead(stub.status, headers);
+    res.end(body);
+    addHistory(config, {
+      type: "stub",
+      method: req.method,
+      path: requestPath,
+      origin: targetOrigin.origin,
+      status: stub.status,
+      durationMs: Date.now() - started,
+      responseHeaders: headers,
+      requestQuery: requestMatch.queryParams,
+      requestBody: requestMatch.requestBody,
+      ...historyBodyFromBuffer(body, stub.bodyEncoding),
+      stubId: stub.id,
+      stub: ruleHistorySummary(stub),
+    });
+    return;
+  }
+
+  const proxyReq = transport.request(
+    {
+      protocol: requestUrl.protocol,
+      hostname: requestUrl.hostname,
+      port: requestUrl.port,
+      method: req.method,
+      path: requestPath,
+      headers: rewriteRequestHeaders(req, targetOrigin, publicOrigin, {
+        apiCookie: isApi ? getActiveApiCookie(config) : "",
+      }),
+      timeout: config.requestTimeoutMs,
+    },
+    (proxyRes) => {
+      const responseHeaders = rewriteResponseHeaders(
+        proxyRes.headers,
+        targetOrigin,
+        publicOrigin,
+        {
+          preserveLocationHeader,
+          clientOrigin: config.clientOriginUrl,
+          requestPathname: requestUrl.pathname,
+          locationHeaderQueryOverrideRules:
+            config.locationHeaderQueryOverrideRules,
+        },
+      );
+
+      if (isApi && shouldRewriteBody(proxyRes.headers)) {
+        const matchedJsonOverrides = shouldApplyJsonOverrides(proxyRes.headers)
+          ? findJsonOverrides(config, req.method, requestMatch)
+          : [];
+        bufferOrStreamOriginalResponse(proxyRes, res, responseHeaders, {
+          statusCode: proxyRes.statusCode || 502,
+          statusMessage: proxyRes.statusMessage,
+          historyEncoding: "text",
+          maxHistoryBodyBytes: config.maxHistoryBodyBytes,
+          maxRewriteBytes: config.maxResponseBodyRewriteBytes,
+        })
+          .then((result) => {
+            if (result.streamed) {
+              addHistory(config, {
+                type: "remote",
+                method: req.method,
+                path: requestPath,
+                origin: targetOrigin.origin,
+                status: proxyRes.statusCode || 502,
+                durationMs: Date.now() - started,
+                responseHeaders,
+                appliedOverrideIds: [],
+                skippedOverrides: matchedJsonOverrides.map(ruleHistorySummary),
+                requestQuery: requestMatch.queryParams,
+                requestBody: requestMatch.requestBody,
+                responseBodyRewriteSkipped: true,
+                jsonOverrideSkipped: matchedJsonOverrides.length > 0,
+                skippedOverrideIds: matchedJsonOverrides.map(
+                  (override) => override.id,
+                ),
+                ...result.historyBody,
+              });
+              log(
+                config,
+                "debug",
+                label,
+                req.method,
+                req.url,
+                proxyRes.statusCode,
+                `${Date.now() - started}ms`,
+                "body rewrite skipped by size limit",
+              );
+              return;
+            }
+
+            const rawBody = result.rawBody;
+            let body = rewriteBody(rawBody, targetOrigin, publicOrigin);
+            let appliedOverrideIds = [];
+            if (isApi && shouldApplyJsonOverrides(proxyRes.headers)) {
+              const result = applyJsonOverrides(
+                body,
+                matchedJsonOverrides,
+              );
+              body = result.body;
+              appliedOverrideIds = result.appliedOverrideIds;
+            }
+            responseHeaders["content-length"] = Buffer.byteLength(body);
+            res.writeHead(
+              proxyRes.statusCode || 502,
+              proxyRes.statusMessage,
+              responseHeaders,
+            );
+            res.end(body);
+            if (isApi) {
+              addHistory(config, {
+                type: "remote",
+                method: req.method,
+                path: requestPath,
+                origin: targetOrigin.origin,
+                status: proxyRes.statusCode || 502,
+                durationMs: Date.now() - started,
+                responseHeaders,
+                appliedOverrideIds,
+                appliedOverrides: matchedJsonOverrides
+                  .filter((override) => appliedOverrideIds.includes(override.id))
+                  .map(ruleHistorySummary),
+                requestQuery: requestMatch.queryParams,
+                requestBody: requestMatch.requestBody,
+                ...historyBodyFromBuffer(
+                  body,
+                  "text",
+                  config.maxHistoryBodyBytes,
+                ),
+              });
+            }
+            log(
+              config,
+              "debug",
+              label,
+              req.method,
+              req.url,
+              proxyRes.statusCode,
+              `${Date.now() - started}ms`,
+            );
+          })
+          .catch((error) => {
+            sendProxyReadError(res, error);
+            log(config, "error", label, req.method, req.url, error.message);
+          });
+        return;
+      }
+
+      streamOriginalResponse(proxyRes, res, responseHeaders, {
+        statusCode: proxyRes.statusCode || 502,
+        statusMessage: proxyRes.statusMessage,
+        historyEncoding: "base64",
+        maxHistoryBodyBytes: config.maxHistoryBodyBytes,
+      })
+        .then((historyBody) => {
+          if (isApi) {
+            addHistory(config, {
+              type: "remote",
+              method: req.method,
+              path: requestPath,
+              origin: targetOrigin.origin,
+              status: proxyRes.statusCode || 502,
+              durationMs: Date.now() - started,
+              responseHeaders,
+              requestQuery: requestMatch.queryParams,
+              requestBody: requestMatch.requestBody,
+              ...historyBody,
+            });
+          }
+          log(
+            config,
+            "debug",
+            label,
+            req.method,
+            req.url,
+            proxyRes.statusCode,
+            `${Date.now() - started}ms`,
+          );
+        })
+        .catch((error) => {
+          sendProxyReadError(res, error);
+          log(config, "error", label, req.method, req.url, error.message);
+        });
+    },
+  );
+
+  proxyReq.on("timeout", () => {
+    proxyReq.destroy(
+      new Error(`Proxy request timed out after ${config.requestTimeoutMs}ms.`),
+    );
+  });
+
+  proxyReq.on("error", (error) => {
+    if (!res.headersSent) {
+      res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+    }
+
+    res.end(
+      `Proxy error while connecting to ${targetOrigin.origin}: ${error.message}`,
+    );
+    if (isApi) {
+      addHistory(config, {
+        type: "error",
+        method: req.method,
+        path: requestPath,
+        origin: targetOrigin.origin,
+        status: 502,
+        durationMs: Date.now() - started,
+        responseHeaders: { "content-type": "text/plain; charset=utf-8" },
+        requestQuery: requestMatch.queryParams,
+        requestBody: requestMatch.requestBody,
+        responseBody: error.message,
+      });
+    }
+    log(config, "error", label, req.method, req.url, error.message);
+  });
+
+  if (isApi && requestBodyBuffer !== null) {
+    proxyReq.end(requestBodyBuffer);
+  } else {
+    req.pipe(proxyReq);
+  }
+}
+
+/**
+ * WebSocket upgradeリクエストをclient dev serverへ中継する。
+ */
+function proxyUpgrade(req, socket, head, targetOrigin, publicOrigin, config) {
+  const targetSocket = net.connect(
+    Number(targetOrigin.port || 80),
+    targetOrigin.hostname,
+    () => {
+      const headers = rewriteRequestHeaders(req, targetOrigin, publicOrigin);
+      const headerLines = Object.entries(headers).map(
+        ([key, value]) => `${key}: ${value}`,
+      );
+
+      targetSocket.write(
+        `${req.method} ${req.url} HTTP/${req.httpVersion}\r\n`,
+      );
+      targetSocket.write(`${headerLines.join("\r\n")}\r\n\r\n`);
+      if (head.length) targetSocket.write(head);
+
+      targetSocket.pipe(socket);
+      socket.pipe(targetSocket);
+    },
+  );
+
+  targetSocket.on("error", (error) => {
+    socket.end(
+      `HTTP/1.1 502 Bad Gateway\r\nContent-Type: text/plain\r\n\r\n${error.message}`,
+    );
+    log(config, "error", "ws", req.url, error.message);
+  });
+}
+
+/**
+ * 履歴詳細に残すルール概要を作る。
+ */
+function ruleHistorySummary(rule) {
+  return {
+    id: rule.id,
+    name: rule.name,
+    method: rule.method,
+    pathPattern: rule.pathPattern,
+  };
+}
+
+module.exports = { startProxyServer };