@mug-lab/cookie-auth-proxy 0.1.0

package/src/server/rewrite.js

@@ -0,0 +1,228 @@
+/**
+ * リモートAPIがローカルプロキシと同一Originに見えるように、
+ * ブラウザ向けリクエストと上流レスポンスを書き換える。
+ */
+
+function rewriteRequestHeaders(req, targetOrigin, publicOrigin, options = {}) {
+  const headers = { ...req.headers };
+
+  headers.host = targetOrigin.host;
+  headers.origin = targetOrigin.origin;
+
+  if (headers.referer) {
+    headers.referer = String(headers.referer).replace(
+      publicOrigin.origin,
+      targetOrigin.origin,
+    );
+  }
+
+  headers["x-forwarded-host"] = publicOrigin.host;
+  headers["x-forwarded-proto"] = publicOrigin.protocol.replace(":", "");
+  headers["x-forwarded-port"] =
+    publicOrigin.port || (publicOrigin.protocol === "https:" ? "443" : "80");
+
+  if (options.apiCookie) {
+    headers.cookie = options.apiCookie;
+  }
+
+  delete headers["accept-encoding"];
+  delete headers.connection;
+
+  return headers;
+}
+
+/**
+ * Set-Cookieをlocalhostで保存できる属性へ書き換える。
+ */
+function rewriteSetCookie(value, targetOrigin, publicOrigin) {
+  return value
+    .replace(
+      new RegExp(`;\\s*Domain=${escapeRegExp(targetOrigin.hostname)}`, "gi"),
+      "",
+    )
+    .replace(/;\s*Domain=[^;]+/gi, "")
+    .replace(
+      /;\s*Secure/gi,
+      publicOrigin.protocol === "https:" ? "; Secure" : "",
+    )
+    .replace(
+      /;\s*SameSite=None/gi,
+      publicOrigin.protocol === "https:" ? "; SameSite=None" : "; SameSite=Lax",
+    );
+}
+
+/**
+ * ヘッダー値内のAPI OriginをローカルOriginへ書き換える。
+ */
+function rewriteHeaderValue(value, targetOrigin, publicOrigin) {
+  if (Array.isArray(value)) {
+    return value.map((entry) =>
+      rewriteHeaderValue(entry, targetOrigin, publicOrigin),
+    );
+  }
+
+  if (typeof value !== "string") return value;
+  return value.replaceAll(targetOrigin.origin, publicOrigin.origin);
+}
+
+/**
+ * Locationヘッダ内URLのクエリパラメータを、設定された汎用ルールで差し替える。
+ */
+function rewriteLocationHeaderQuery(value, context) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => rewriteLocationHeaderQuery(entry, context));
+  }
+
+  if (typeof value !== "string") return value;
+
+  let locationUrl;
+  try {
+    locationUrl = new URL(value);
+  } catch {
+    return value;
+  }
+
+  const matchedRules = (context.locationHeaderQueryOverrideRules || []).filter(
+    (rule) => {
+      if (!rule.pathMatcher.test(context.requestPathname)) return false;
+      if (rule.locationMatcher && !rule.locationMatcher.test(locationUrl.href)) {
+        return false;
+      }
+      return true;
+    },
+  );
+
+  if (matchedRules.length === 0) return value;
+
+  matchedRules.forEach((rule) => {
+    Object.entries(rule.queryParams).forEach(([name, template]) => {
+      locationUrl.searchParams.set(
+        name,
+        renderLocationQueryTemplate(String(template), context),
+      );
+    });
+  });
+
+  return locationUrl.href;
+}
+
+/**
+ * Locationヘッダクエリ差し替え値のテンプレート変数をOrigin値で展開する。
+ */
+function renderLocationQueryTemplate(template, context) {
+  return template
+    .replaceAll("{publicOrigin}", context.publicOrigin.origin)
+    .replaceAll("{apiOrigin}", context.targetOrigin.origin)
+    .replaceAll("{clientOrigin}", context.clientOrigin.origin);
+}
+
+/**
+ * Cookieや同一OriginリンクがローカルプロキシOriginで動くように、
+ * 上流レスポンスヘッダーを書き換える。
+ *
+ * @param {object} headers 上流レスポンスヘッダー。
+ * @param {URL} targetOrigin リモートAPIまたはclientの上流Origin。
+ * @param {URL} publicOrigin ブラウザから見えるローカルプロキシOrigin。
+ * @param {object} options Locationヘッダの例外処理に使う書き換えオプション。
+ * @returns {object} ブラウザへ返せるヘッダー。
+ */
+function rewriteResponseHeaders(
+  headers,
+  targetOrigin,
+  publicOrigin,
+  options = {},
+) {
+  const rewritten = {};
+
+  for (const [key, value] of Object.entries(headers)) {
+    const lowerKey = key.toLowerCase();
+
+    if (lowerKey === "set-cookie") {
+      rewritten[key] = Array.isArray(value)
+        ? value.map((entry) =>
+            rewriteSetCookie(entry, targetOrigin, publicOrigin),
+          )
+        : rewriteSetCookie(String(value), targetOrigin, publicOrigin);
+      continue;
+    }
+
+    if (lowerKey === "location" && options.preserveLocationHeader) {
+      rewritten[key] = rewriteLocationHeaderQuery(value, {
+        publicOrigin,
+        targetOrigin,
+        clientOrigin: options.clientOrigin,
+        requestPathname: options.requestPathname,
+        locationHeaderQueryOverrideRules:
+          options.locationHeaderQueryOverrideRules,
+      });
+      continue;
+    }
+
+    if (
+      lowerKey === "location" ||
+      lowerKey === "content-location" ||
+      lowerKey === "refresh"
+    ) {
+      rewritten[key] = rewriteHeaderValue(value, targetOrigin, publicOrigin);
+      continue;
+    }
+
+    if (lowerKey === "content-security-policy") {
+      rewritten[key] = rewriteHeaderValue(value, targetOrigin, publicOrigin);
+      continue;
+    }
+
+    rewritten[key] = value;
+  }
+
+  delete rewritten["content-length"];
+  delete rewritten["Content-Length"];
+  delete rewritten["transfer-encoding"];
+  delete rewritten["Transfer-Encoding"];
+  return rewritten;
+}
+
+/**
+ * レスポンス本文内Originを書き換える対象content-typeか判定する。
+ */
+function shouldRewriteBody(headers) {
+  const contentType = String(headers["content-type"] || "");
+  return /text\/html|application\/json|text\/plain|application\/javascript|text\/javascript/i.test(
+    contentType,
+  );
+}
+
+/**
+ * レスポンス本文内のAPI OriginをローカルOriginへ書き換える。
+ */
+function rewriteBody(buffer, targetOrigin, publicOrigin) {
+  return Buffer.from(
+    buffer
+      .toString("utf8")
+      .replaceAll(targetOrigin.origin, publicOrigin.origin),
+    "utf8",
+  );
+}
+
+/**
+ * content-typeからJSON Override適用対象レスポンスか判定する。
+ */
+function shouldApplyJsonOverrides(headers) {
+  const contentType = String(headers["content-type"] || "");
+  return /application\/json|\+json/i.test(contentType);
+}
+
+/**
+ * 文字列を正規表現リテラル相当として扱えるようエスケープする。
+ */
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+module.exports = {
+  rewriteBody,
+  rewriteRequestHeaders,
+  rewriteResponseHeaders,
+  shouldApplyJsonOverrides,
+  shouldRewriteBody,
+};

package/stubs/README.md

@@ -0,0 +1,8 @@
+Place exported stub JSON files in this folder to import them at proxy startup.
+
+Files are loaded in filename order. Use names such as:
+
+- `001-common.json`
+- `010-user-admin.json`
+
+The file format is the same JSON produced by the admin screen's Stub Export.