@mug-lab/cookie-auth-proxy 0.1.0

package/src/config/index.js

@@ -0,0 +1,372 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { URL } = require("node:url");
+const { compileSafeRegex } = require("../regex");
+
+/**
+ * ローカルプロキシのデフォルト設定。
+ * buildConfig()で設定ファイル、環境変数、CLI引数をこの値へ上書きマージする。
+ */
+const DEFAULTS = {
+  listenHost: "localhost",
+  listenPort: 4300,
+  clientOrigin: "http://localhost:8080",
+  apiOrigin: "",
+  apiOriginAllowedPatterns: [],
+  apiPathPatterns: ["^/api(?:/|$)"],
+  apiPathExcludes: [
+    "^/$",
+    "^/favicon\\.ico$",
+    "^/(?:assets|static)(?:/|$)",
+    "^/sockjs-node(?:/|$)",
+  ],
+  preserveLocationHeaderPatterns: [],
+  locationHeaderQueryOverrides: [],
+  apiCookie: "",
+  sensitiveHeaderNames: [
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+  ],
+  sensitiveCookieNames: [],
+  adminNotice: "",
+  startupStubImportDir: "cookie-auth-proxy/stubs",
+  startupOverrideImportDir: "cookie-auth-proxy/overrides",
+  serverAppPath: "/",
+  adminHost: "localhost",
+  adminPort: 4301,
+  historyLimit: 200,
+  maxAdminBodyBytes: 1024 * 1024,
+  maxRequestBodyInspectionBytes: 10 * 1024 * 1024,
+  maxResponseBodyRewriteBytes: 50 * 1024 * 1024,
+  maxHistoryBodyBytes: 512 * 1024,
+  allowRemoteAccess: false,
+  stubsEnabled: false,
+  stubs: [],
+  jsonOverridesEnabled: false,
+  jsonOverrides: [],
+  requestTimeoutMs: 120000,
+  logLevel: "info",
+};
+
+/**
+ * CLI引数、環境変数、設定ファイルからプロキシ設定を作り、
+ * 実行時に使うURLオブジェクトと正規表現matcherも事前生成する。
+ *
+ * @param {string[]} argv node本体とscript pathを除いたCLI引数。
+ * @returns {object} マージ済みかつ実行準備済みの設定。
+ */
+function buildConfig(argv) {
+  const args = parseArgs(argv);
+  const fileConfig = readConfig(args.config);
+  const config = mergeConfig(DEFAULTS, fileConfig, readEnv(), args);
+  validateLocalOnlyHosts(config);
+
+  config.apiOriginAllowedMatchers = compilePatterns(
+    config.apiOriginAllowedPatterns,
+    "apiOriginAllowedPatterns",
+  );
+  setClientOrigin(config, config.clientOrigin);
+  setApiOrigin(config, config.apiOrigin);
+  config.publicOriginUrl = new URL(
+    `http://${config.listenHost}:${config.listenPort}`,
+  );
+  config.matchers = {
+    apiIncludes: compilePatterns(config.apiPathPatterns, "apiPathPatterns"),
+    apiExcludes: compilePatterns(config.apiPathExcludes, "apiPathExcludes"),
+    preserveLocation: compilePatterns(
+      config.preserveLocationHeaderPatterns,
+      "preserveLocationHeaderPatterns",
+    ),
+  };
+  config.locationHeaderQueryOverrideRules = compileLocationHeaderQueryOverrides(
+    config.locationHeaderQueryOverrides,
+  );
+
+  return config;
+}
+
+/**
+ * CLI引数をキー付きオプションと位置引数へ分解する。
+ */
+function parseArgs(argv) {
+  const args = { _: [] };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const raw = argv[i];
+    if (!raw.startsWith("--")) {
+      args._.push(raw);
+      continue;
+    }
+
+    const eq = raw.indexOf("=");
+    const key = raw.slice(2, eq === -1 ? undefined : eq);
+    const next = argv[i + 1];
+    const value =
+      eq === -1
+        ? next && !next.startsWith("--")
+          ? next
+          : true
+        : raw.slice(eq + 1);
+
+    if (eq === -1 && next && !next.startsWith("--")) i += 1;
+    args[key] = value;
+  }
+
+  return args;
+}
+
+/**
+ * 指定された設定ファイルを読み込む。
+ */
+function readConfig(configPath) {
+  if (!configPath) return {};
+
+  const absolutePath = path.resolve(process.cwd(), configPath);
+  return readJsonFile(absolutePath);
+}
+
+/**
+ * BOMを除去してJSONファイルを読み込む。
+ */
+function readJsonFile(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf8").replace(/^\uFEFF/, ""));
+}
+
+/**
+ * 環境変数からプロキシ設定に対応する値を読み取る。
+ */
+function readEnv() {
+  return {
+    listenHost: process.env.PROXY_HOST,
+    listenPort: process.env.PROXY_PORT && Number(process.env.PROXY_PORT),
+    clientOrigin: process.env.CLIENT_ORIGIN,
+    apiOrigin: process.env.API_ORIGIN,
+    runtimeApiCookie: process.env.API_COOKIE,
+    startupStubImportDir: process.env.STARTUP_STUB_IMPORT_DIR,
+    startupOverrideImportDir: process.env.STARTUP_OVERRIDE_IMPORT_DIR,
+    serverAppPath: process.env.SERVER_APP_PATH,
+    adminHost: process.env.ADMIN_HOST,
+    adminPort: process.env.ADMIN_PORT && Number(process.env.ADMIN_PORT),
+    allowRemoteAccess: parseBoolean(process.env.ALLOW_REMOTE_ACCESS),
+    logLevel: process.env.LOG_LEVEL,
+  };
+}
+
+/**
+ * undefinedと空文字の設定値を取り除いたオブジェクトを返す。
+ */
+function compact(value) {
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      ([, entry]) => entry !== undefined && entry !== "",
+    ),
+  );
+}
+
+/**
+ * デフォルト、設定ファイル、環境変数、CLI引数を優先順にマージする。
+ */
+function mergeConfig(defaults, fileConfig, envConfig, args) {
+  const positionalApiOrigin = args._[0];
+  const cliConfig = compact({
+    listenHost: args.host,
+    listenPort: args.port && Number(args.port),
+    clientOrigin: args.client,
+    apiOrigin: args.api || positionalApiOrigin,
+    runtimeApiCookie: args.cookie,
+    startupStubImportDir: args["startup-stub-import-dir"],
+    startupOverrideImportDir: args["startup-override-import-dir"],
+    serverAppPath: args["server-app-path"],
+    adminHost: args["admin-host"],
+    adminPort: args["admin-port"] && Number(args["admin-port"]),
+    allowRemoteAccess: parseBoolean(args["allow-remote-access"]),
+    logLevel: args.logLevel,
+  });
+
+  return {
+    ...defaults,
+    ...compact(fileConfig),
+    ...compact(envConfig),
+    ...cliConfig,
+  };
+}
+
+/**
+ * 真偽値として扱う設定値をbooleanへ変換する。
+ */
+function parseBoolean(value) {
+  if (value === undefined || value === "") return undefined;
+  if (value === true || value === false) return value;
+
+  const normalized = String(value).trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(normalized)) return true;
+  if (["0", "false", "no", "off"].includes(normalized)) return false;
+  return Boolean(value);
+}
+
+/**
+ * 明示許可なしで管理画面やプロキシをLAN公開しないようにする。
+ */
+function validateLocalOnlyHosts(config) {
+  if (config.allowRemoteAccess) return;
+
+  [
+    ["listenHost", config.listenHost],
+    ["adminHost", config.adminHost],
+  ].forEach(([name, host]) => {
+    if (!isLoopbackHost(host)) {
+      throw new Error(
+        `${name} must be localhost, 127.0.0.1, or ::1 unless --allow-remote-access is specified.`,
+      );
+    }
+  });
+}
+
+/**
+ * localhostまたはループバックアドレスか判定する。
+ */
+function isLoopbackHost(host) {
+  const value = String(host || "").trim().toLowerCase();
+  return value === "localhost" || value === "127.0.0.1" || value === "::1";
+}
+
+/**
+ * Client OriginをOriginだけのURLへ正規化して設定へ反映する。
+ *
+ * @param {object} config マージ済みプロキシ設定。
+ * @param {string} clientOrigin 設定ファイル、CLI、管理画面から入力されたOrigin。
+ */
+function setClientOrigin(config, clientOrigin) {
+  const clientOriginUrl = asOrigin(clientOrigin, "clientOrigin");
+  config.clientOrigin = clientOriginUrl.origin;
+  config.clientOriginUrl = clientOriginUrl;
+}
+
+/**
+ * API OriginをoriginだけのURLへ正規化し、ホワイトリスト検証後に設定へ反映する。
+ *
+ * @param {object} config マージ済みプロキシ設定。
+ * @param {string} apiOrigin 設定ファイル、CLI、管理画面から入力されたOrigin。
+ */
+function setApiOrigin(config, apiOrigin) {
+  if (!apiOrigin) {
+    config.apiOrigin = "";
+    config.apiOriginUrl = null;
+    return;
+  }
+
+  const apiOriginUrl = asOrigin(apiOrigin, "apiOrigin");
+  const allowedMatchers = config.apiOriginAllowedMatchers || [];
+  if (
+    allowedMatchers.length > 0 &&
+    !allowedMatchers.some((pattern) => pattern.test(apiOriginUrl.origin))
+  ) {
+    const error = new Error(
+      `API origin is not allowed: ${apiOriginUrl.origin}`,
+    );
+    error.statusCode = 400;
+    throw error;
+  }
+
+  config.apiOrigin = apiOriginUrl.origin;
+  config.apiOriginUrl = apiOriginUrl;
+}
+
+/**
+ * 管理画面またはCLIから指定されたAPI Cookieを実行時設定へ反映する。
+ */
+function setApiCookie(config, apiCookie) {
+  config.apiCookie = apiCookie || "";
+  config.runtimeApiCookie = apiCookie || "";
+}
+
+/**
+ * 現在APIへ注入するCookie文字列を取得する。
+ */
+function getActiveApiCookie(config) {
+  return config.runtimeApiCookie || config.apiCookie || "";
+}
+
+/**
+ * 入力URLをoriginだけのURLへ正規化する。
+ */
+function asOrigin(value, name) {
+  if (!value) {
+    throw new Error(`${name} is required.`);
+  }
+
+  const url = new URL(value);
+  url.pathname = "";
+  url.search = "";
+  url.hash = "";
+  return url;
+}
+
+/**
+ * 正規表現文字列の配列をRegExp配列へ変換する。
+ */
+function compilePatterns(patterns, label) {
+  if (!Array.isArray(patterns)) {
+    throw new Error(`${label} must be an array of regular expression strings.`);
+  }
+
+  return patterns.map((pattern, index) =>
+    compileSafeRegex(pattern, `${label}[${index}]`),
+  );
+}
+
+/**
+ * Locationヘッダ内URLのクエリパラメータ書き換えルールを検証し、正規表現を事前コンパイルする。
+ */
+function compileLocationHeaderQueryOverrides(rules) {
+  if (!Array.isArray(rules)) {
+    throw new Error("locationHeaderQueryOverrides must be an array.");
+  }
+
+  return rules.map((rule, index) => {
+    if (!rule || typeof rule !== "object") {
+      throw new Error(
+        `locationHeaderQueryOverrides[${index}] must be an object.`,
+      );
+    }
+
+    if (!rule.pathPattern) {
+      throw new Error(
+        `locationHeaderQueryOverrides[${index}].pathPattern is required.`,
+      );
+    }
+
+    if (!rule.queryParams || typeof rule.queryParams !== "object") {
+      throw new Error(
+        `locationHeaderQueryOverrides[${index}].queryParams is required.`,
+      );
+    }
+
+    return {
+      ...rule,
+      pathMatcher: compileSafeRegex(
+        rule.pathPattern,
+        `locationHeaderQueryOverrides[${index}].pathPattern`,
+      ),
+      locationMatcher: rule.locationPattern
+        ? compileSafeRegex(
+            rule.locationPattern,
+            `locationHeaderQueryOverrides[${index}].locationPattern`,
+          )
+        : null,
+      queryParams: { ...rule.queryParams },
+    };
+  });
+}
+
+module.exports = {
+  buildConfig,
+  getActiveApiCookie,
+  setApiCookie,
+  setApiOrigin,
+  setClientOrigin,
+};

package/src/cookie-auth-proxy.schema.json

@@ -0,0 +1,233 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Cookie Auth Proxy config",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "$schema": {
+      "type": "string"
+    },
+    "listenHost": {
+      "type": "string",
+      "default": "localhost"
+    },
+    "listenPort": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "default": 4300
+    },
+    "clientOrigin": {
+      "type": "string",
+      "format": "uri",
+      "default": "http://localhost:8080"
+    },
+    "apiOrigin": {
+      "type": "string",
+      "default": ""
+    },
+    "apiOriginAllowedPatterns": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
+    "apiPathPatterns": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "apiPathExcludes": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "preserveLocationHeaderPatterns": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "locationHeaderQueryOverrides": {
+      "type": "array",
+      "items": {
+        "type": "object"
+      }
+    },
+    "apiCookie": {
+      "type": "string",
+      "default": ""
+    },
+    "sensitiveHeaderNames": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": [
+        "authorization",
+        "cookie",
+        "proxy-authorization",
+        "set-cookie",
+        "x-api-key",
+        "x-auth-token"
+      ]
+    },
+    "sensitiveCookieNames": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
+    "adminNotice": {
+      "type": "string",
+      "default": ""
+    },
+    "startupStubImportDir": {
+      "type": "string"
+    },
+    "startupOverrideImportDir": {
+      "type": "string"
+    },
+    "serverAppPath": {
+      "type": "string",
+      "default": "/"
+    },
+    "adminHost": {
+      "type": "string",
+      "default": "localhost"
+    },
+    "adminPort": {
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 65535,
+      "default": 4301
+    },
+    "historyLimit": {
+      "type": "integer",
+      "minimum": 0,
+      "default": 200
+    },
+    "maxAdminBodyBytes": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "maxRequestBodyInspectionBytes": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "maxResponseBodyRewriteBytes": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "maxHistoryBodyBytes": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "allowRemoteAccess": {
+      "type": "boolean",
+      "default": false
+    },
+    "stubsEnabled": {
+      "type": "boolean",
+      "default": false
+    },
+    "stubs": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/stub"
+      }
+    },
+    "jsonOverridesEnabled": {
+      "type": "boolean",
+      "default": false
+    },
+    "jsonOverrides": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/jsonOverride"
+      }
+    },
+    "requestTimeoutMs": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "logLevel": {
+      "type": "string",
+      "enum": ["silent", "error", "info", "debug"],
+      "default": "info"
+    }
+  },
+  "definitions": {
+    "ruleCriteria": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "method": {
+          "type": "string",
+          "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "*"]
+        },
+        "pathPattern": {
+          "type": "string"
+        },
+        "queryParams": {
+          "type": "object"
+        },
+        "requestBody": {
+          "type": "object"
+        }
+      }
+    },
+    "stub": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ruleCriteria"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "type": "integer",
+              "minimum": 100,
+              "maximum": 599
+            },
+            "headers": {
+              "type": "object"
+            },
+            "bodyEncoding": {
+              "type": "string",
+              "enum": ["json", "text", "base64"]
+            },
+            "body": {},
+            "bodyBase64": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    },
+    "jsonOverride": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ruleCriteria"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "value": {
+              "type": "object"
+            }
+          }
+        }
+      ]
+    }
+  }
+}