@mug-lab/cookie-auth-proxy 0.1.0

package/src/diagnostics.js

@@ -0,0 +1,154 @@
+const fs = require("node:fs");
+const net = require("node:net");
+const path = require("node:path");
+const { buildConfig } = require("./config");
+const { createRuntimeState } = require("./runtime");
+
+/**
+ * 起動せずに設定と起動時Importを検証する。
+ */
+function validateStartup(argv) {
+  const config = buildConfig(argv);
+  config.runtime = createRuntimeState(config);
+  return config;
+}
+
+/**
+ * dry-runコマンドの結果を標準出力向けに作る。
+ */
+function dryRun(argv) {
+  const config = validateStartup(argv);
+  return [
+    "Dry run OK.",
+    `Proxy: ${config.publicOriginUrl.origin}`,
+    `Client: ${config.clientOriginUrl.origin}`,
+    `API: ${config.apiOriginUrl ? config.apiOriginUrl.origin : "(not set)"}`,
+    `Stubs: ${config.runtime.stubs.length}`,
+    `JSON Overrides: ${config.runtime.jsonOverrides.length}`,
+  ];
+}
+
+/**
+ * 設定、Importフォルダ、port空きなどを診断する。
+ */
+async function doctor(argv) {
+  const reports = [];
+  let config;
+  try {
+    config = validateStartup(argv);
+    reports.push(ok("config", "Configuration can be loaded."));
+  } catch (error) {
+    reports.push(fail("config", error.message));
+    return reports;
+  }
+
+  reports.push(...checkImportDirectory("stubs", config.startupStubImportDir));
+  reports.push(
+    ...checkImportDirectory("overrides", config.startupOverrideImportDir),
+  );
+  reports.push(await checkPort("proxy port", config.listenHost, config.listenPort));
+  reports.push(await checkPort("admin port", config.adminHost, config.adminPort));
+
+  if (!config.apiOriginUrl) {
+    reports.push(warn("api origin", "API origin is not set yet."));
+  } else {
+    reports.push(ok("api origin", config.apiOriginUrl.origin));
+  }
+
+  if (config.apiOriginAllowedPatterns.length === 0) {
+    reports.push(
+      warn(
+        "api origin allowlist",
+        "apiOriginAllowedPatterns is empty. Consider restricting API origins.",
+      ),
+    );
+  } else {
+    reports.push(ok("api origin allowlist", "Allowlist is configured."));
+  }
+
+  return reports;
+}
+
+/**
+ * 診断結果を表示用の文字列へ変換する。
+ */
+function formatDoctorReports(reports) {
+  return reports.map((report) => `${report.level} ${report.name}: ${report.message}`);
+}
+
+/**
+ * 診断結果にエラーが含まれるか判定する。
+ */
+function hasDoctorError(reports) {
+  return reports.some((report) => report.level === "ERROR");
+}
+
+/**
+ * 起動時Importフォルダの存在とJSONファイル数を確認する。
+ */
+function checkImportDirectory(name, directory) {
+  if (!directory) return [warn(name, "Import directory is not configured.")];
+  const resolved = path.resolve(process.cwd(), directory);
+  try {
+    const stat = fs.statSync(resolved);
+    if (!stat.isDirectory()) {
+      return [fail(name, `${directory} exists but is not a directory.`)];
+    }
+    const jsonCount = fs
+      .readdirSync(resolved, { withFileTypes: true })
+      .filter(
+        (entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".json"),
+      ).length;
+    return [ok(name, `${directory} (${jsonCount} JSON files)`)];
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [warn(name, `${directory} does not exist yet.`)];
+    }
+    return [fail(name, `${directory}: ${error.message}`)];
+  }
+}
+
+/**
+ * portが空いているか確認する。
+ */
+function checkPort(name, host, port) {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once("error", (error) => {
+      resolve(fail(name, `${host}:${port} is not available (${error.code}).`));
+    });
+    server.once("listening", () => {
+      server.close(() => resolve(ok(name, `${host}:${port} is available.`)));
+    });
+    server.listen(port, host);
+  });
+}
+
+/**
+ * OK診断結果を作る。
+ */
+function ok(name, message) {
+  return { level: "OK", name, message };
+}
+
+/**
+ * WARN診断結果を作る。
+ */
+function warn(name, message) {
+  return { level: "WARN", name, message };
+}
+
+/**
+ * ERROR診断結果を作る。
+ */
+function fail(name, message) {
+  return { level: "ERROR", name, message };
+}
+
+module.exports = {
+  doctor,
+  dryRun,
+  formatDoctorReports,
+  hasDoctorError,
+  validateStartup,
+};

package/src/init.js

@@ -0,0 +1,201 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const readline = require("node:readline/promises");
+
+const DEFAULT_CONFIG_FILENAME = "cookie-auth-proxy.config.json";
+const DEFAULT_SUPPORT_DIR = "cookie-auth-proxy";
+
+/**
+ * initサブコマンドの引数を解析する。
+ *
+ * @param {string[]} argv initより後ろのCLI引数。
+ * @returns {{configPath: string, force: boolean, supportDir?: string}} init実行設定。
+ */
+function parseInitArgs(argv) {
+  const args = { _: [], force: false };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const raw = argv[i];
+    if (raw === "--force" || raw === "-f") {
+      args.force = true;
+      continue;
+    }
+
+    if (raw === "--config") {
+      args.config = argv[i + 1];
+      i += 1;
+      continue;
+    }
+
+    if (raw.startsWith("--config=")) {
+      args.config = raw.slice("--config=".length);
+      continue;
+    }
+
+    if (raw === "--support-dir" || raw === "--data-dir") {
+      args.supportDir = argv[i + 1];
+      i += 1;
+      continue;
+    }
+
+    if (raw.startsWith("--support-dir=")) {
+      args.supportDir = raw.slice("--support-dir=".length);
+      continue;
+    }
+
+    if (raw.startsWith("--data-dir=")) {
+      args.supportDir = raw.slice("--data-dir=".length);
+      continue;
+    }
+
+    args._.push(raw);
+  }
+
+  return {
+    configPath: args.config || args._[0] || DEFAULT_CONFIG_FILENAME,
+    force: args.force,
+    supportDir: args.supportDir,
+  };
+}
+
+/**
+ * プロジェクトルート向けの設定ファイルを作成する。
+ *
+ * @param {string[]} argv initより後ろのCLI引数。
+ * @returns {Promise<{configPath: string, supportPaths: string[]}>} 作成した設定ファイルと補助ファイルの絶対パス。
+ */
+async function initConfig(argv) {
+  const options = parseInitArgs(argv);
+  const supportDir = await resolveSupportDir(options.supportDir);
+  const stubDir = toConfigPath(path.join(supportDir, "stubs"));
+  const overrideDir = toConfigPath(path.join(supportDir, "overrides"));
+  const schemaPath = toConfigPath(
+    path.join(supportDir, "cookie-auth-proxy.schema.json"),
+  );
+  const targetPath = path.resolve(process.cwd(), options.configPath);
+  const sourcePath = path.join(
+    __dirname,
+    "..",
+    "cookie-auth-proxy.config.example.json",
+  );
+  const files = [
+    {
+      sourcePath,
+      targetPath,
+      displayPath: options.configPath,
+    },
+    {
+      sourcePath: path.join(__dirname, "..", "stubs", "README.md"),
+      targetPath: path.resolve(process.cwd(), stubDir, "README.md"),
+      displayPath: toConfigPath(path.join(stubDir, "README.md")),
+    },
+    {
+      sourcePath: path.join(__dirname, "..", "overrides", "README.md"),
+      targetPath: path.resolve(process.cwd(), overrideDir, "README.md"),
+      displayPath: toConfigPath(path.join(overrideDir, "README.md")),
+    },
+    {
+      sourcePath: path.join(__dirname, "cookie-auth-proxy.schema.json"),
+      targetPath: path.resolve(process.cwd(), schemaPath),
+      displayPath: schemaPath,
+    },
+  ];
+
+  files.forEach((file) => assertCanCopyInitFile(file, options.force));
+  copyConfigFile({
+    sourcePath,
+    targetPath,
+    schemaPath,
+    startupStubImportDir: stubDir,
+    startupOverrideImportDir: overrideDir,
+  });
+  files.slice(1).forEach(copyInitFile);
+
+  return {
+    configPath: targetPath,
+    supportPaths: files.slice(1).map((file) => file.targetPath),
+  };
+}
+
+/**
+ * stubs/overridesを作成する親フォルダを決める。
+ */
+async function resolveSupportDir(inputDir) {
+  if (inputDir !== undefined) return normalizeSupportDir(inputDir);
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return DEFAULT_SUPPORT_DIR;
+
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  try {
+    const answer = await rl.question(
+      `Destination folder for stubs/overrides [${DEFAULT_SUPPORT_DIR}]: `,
+    );
+    return normalizeSupportDir(answer);
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * 入力された補助ファイル用フォルダをconfig向けの相対パスへ正規化する。
+ */
+function normalizeSupportDir(value) {
+  const trimmed = String(value || "").trim();
+  if (!trimmed) return DEFAULT_SUPPORT_DIR;
+  if (path.isAbsolute(trimmed)) {
+    throw new Error("Support directory must be relative to the project root.");
+  }
+
+  return toConfigPath(path.normalize(trimmed));
+}
+
+/**
+ * initで配布するテンプレートファイルをコピーできる状態か確認する。
+ */
+function assertCanCopyInitFile({ targetPath, displayPath }, force) {
+  if (fs.existsSync(targetPath) && !force) {
+    throw new Error(
+      `${displayPath} already exists. Use --force to overwrite it.`,
+    );
+  }
+}
+
+/**
+ * 設定テンプレートを読み込み、stubs/overridesの初期パスを書き換えて保存する。
+ */
+function copyConfigFile({
+  sourcePath,
+  targetPath,
+  startupStubImportDir,
+  startupOverrideImportDir,
+  schemaPath,
+}) {
+  const config = JSON.parse(fs.readFileSync(sourcePath, "utf8"));
+  config.$schema = toConfigPath(
+    path.relative(path.dirname(targetPath), path.resolve(process.cwd(), schemaPath)),
+  );
+  config.startupStubImportDir = startupStubImportDir;
+  config.startupOverrideImportDir = startupOverrideImportDir;
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+  fs.writeFileSync(`${targetPath}`, `${JSON.stringify(config, null, 2)}\n`);
+}
+
+/**
+ * initで配布するテンプレートファイルをコピーする。
+ */
+function copyInitFile({ sourcePath, targetPath }) {
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+  fs.copyFileSync(sourcePath, targetPath);
+}
+
+/**
+ * Windowsでもconfigにはスラッシュ区切りで保存する。
+ */
+function toConfigPath(value) {
+  return value.split(path.sep).join("/");
+}
+
+module.exports = { DEFAULT_CONFIG_FILENAME, DEFAULT_SUPPORT_DIR, initConfig };

package/src/logger.js

@@ -0,0 +1,18 @@
+/**
+ * プロキシ、管理サーバ、runtime読み込みで共通利用する最小限のロガー。
+ * logLevelはconfigに持たせ、各モジュールへloggerインスタンスを配らずに
+ * ログ出力量を調整できるようにしている。
+ *
+ * @param {object} config マージ済みプロキシ設定。
+ * @param {"silent"|"error"|"info"|"debug"} level ログ重要度。
+ * @param {...unknown} parts consoleへ渡すログ要素。
+ */
+function log(config, level, ...parts) {
+  const rank = { silent: 0, error: 1, info: 2, debug: 3 };
+  if ((rank[config.logLevel] || rank.info) < rank[level]) return;
+
+  const stream = level === "error" ? console.error : console.log;
+  stream(`[${new Date().toISOString()}]`, ...parts);
+}
+
+module.exports = { log };

package/src/proxy.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+
+const crypto = require("node:crypto");
+const { buildConfig } = require("./config");
+const {
+  doctor,
+  dryRun,
+  formatDoctorReports,
+  hasDoctorError,
+} = require("./diagnostics");
+const { initConfig } = require("./init");
+const { createRuntimeState } = require("./runtime");
+const { startAdminServer } = require("./server/admin-server");
+const { startProxyServer } = require("./server/proxy-server");
+const { version } = require("../package.json");
+
+/**
+ * CLIエントリポイント。
+ * 機能本体はサブモジュールへ分離し、起動時の問題を追いやすくしている。
+ */
+async function main() {
+  const argv = process.argv.slice(2);
+  if (shouldShowVersion(argv)) {
+    console.log(version);
+    return;
+  }
+
+  if (shouldShowHelp(argv)) {
+    console.log(helpText(argv[0]));
+    return;
+  }
+
+  if (argv[0] === "init") {
+    const result = await initConfig(argv.slice(1));
+    console.log(`Created ${result.configPath}`);
+    result.supportPaths.forEach((filePath) =>
+      console.log(`Created ${filePath}`),
+    );
+    return;
+  }
+
+  if (argv[0] === "doctor") {
+    const reports = await doctor(argv.slice(1));
+    formatDoctorReports(reports).forEach((line) => console.log(line));
+    process.exitCode = hasDoctorError(reports) ? 1 : 0;
+    return;
+  }
+
+  if (argv.includes("--dry-run")) {
+    dryRun(argv.filter((entry) => entry !== "--dry-run")).forEach((line) =>
+      console.log(line),
+    );
+    return;
+  }
+
+  const config = buildConfig(argv);
+  config.adminCsrfToken = crypto.randomBytes(32).toString("base64url");
+  config.runtime = createRuntimeState(config);
+
+  startProxyServer(config);
+  startAdminServer(config);
+}
+
+/**
+ * バージョン表示だけで終了するCLI指定か判定する。
+ */
+function shouldShowVersion(argv) {
+  return argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v");
+}
+
+/**
+ * ヘルプ表示だけで終了するCLI指定か判定する。
+ */
+function shouldShowHelp(argv) {
+  return (
+    argv.includes("--help") ||
+    argv.includes("-h")
+  );
+}
+
+/**
+ * サブコマンドに応じたCLIヘルプ本文を返す。
+ */
+function helpText(command) {
+  if (command === "init") {
+    return [
+      "Usage: cookie-auth-proxy init [configPath] [options]",
+      "",
+      "Create a project config file and support folders.",
+      "",
+      "Options:",
+      "  --config <path>        Config file path. Default: cookie-auth-proxy.config.json",
+      "  --support-dir <path>   Folder for stubs, overrides, and schema files.",
+      "  --force, -f            Overwrite existing files.",
+      "  --help, -h             Show this help.",
+    ].join("\n");
+  }
+
+  if (command === "doctor") {
+    return [
+      "Usage: cookie-auth-proxy doctor [options]",
+      "",
+      "Check config, import folders, ports, and API origin settings.",
+      "",
+      "Options:",
+      "  --config <path>        Config file path.",
+      "  --api <origin>         API origin for validation.",
+      "  --client <origin>      Client dev server origin.",
+      "  --host <host>          Proxy listen host.",
+      "  --port <port>          Proxy listen port.",
+      "  --admin-host <host>    Admin UI listen host.",
+      "  --admin-port <port>    Admin UI listen port.",
+      "  --allow-remote-access  Allow non-loopback listen hosts.",
+      "  --help, -h             Show this help.",
+    ].join("\n");
+  }
+
+  return [
+    "Usage: cookie-auth-proxy [apiOrigin] [options]",
+    "       cookie-auth-proxy init [configPath] [options]",
+    "       cookie-auth-proxy doctor [options]",
+    "",
+    "Local development proxy for cookie-authenticated web apps.",
+    "",
+    "Options:",
+    "  --config <path>        Config file path.",
+    "  --api <origin>         API origin. Also accepted as the first positional argument.",
+    "  --client <origin>      Client dev server origin.",
+    "  --cookie <cookie>      Cookie header injected into API requests.",
+    "  --host <host>          Proxy listen host. Default: localhost",
+    "  --port <port>          Proxy listen port. Default: 4300",
+    "  --admin-host <host>    Admin UI listen host. Default: localhost",
+    "  --admin-port <port>    Admin UI listen port. Default: 4301",
+    "  --allow-remote-access  Allow non-loopback listen hosts.",
+    "  --startup-stub-import-dir <path>",
+    "                         Folder loaded as stubs on startup.",
+    "  --startup-override-import-dir <path>",
+    "                         Folder loaded as JSON Overrides on startup.",
+    "  --server-app-path <path>",
+    "                         Path opened by the admin UI Open Server App button.",
+    "  --logLevel <silent|error|info|debug>",
+    "                         Log level. Default: info",
+    "  --dry-run              Validate config and startup imports, then exit.",
+    "  --version, -v          Show version.",
+    "  --help, -h             Show this help.",
+    "",
+    "Examples:",
+    "  cookie-auth-proxy --config cookie-auth-proxy.config.json",
+    "  cookie-auth-proxy https://test-api.invalid",
+    "  cookie-auth-proxy init --support-dir tools/cookie-auth-proxy",
+    "  cookie-auth-proxy doctor --config cookie-auth-proxy.config.json",
+  ].join("\n");
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/src/regex.js

@@ -0,0 +1,101 @@
+const MAX_PATTERN_LENGTH = 1000;
+
+/**
+ * ユーザー入力の正規表現を、明らかに危険な形だけ拒否してからRegExpへ変換する。
+ * 完全なReDoS防止ではなく、ローカル開発用設定の事故を減らすための軽量ガード。
+ */
+function compileSafeRegex(pattern, label) {
+  assertSafeRegexPattern(pattern, label);
+  try {
+    return new RegExp(pattern);
+  } catch (error) {
+    const wrapped = new Error(`${label}: invalid regular expression.`);
+    wrapped.statusCode = 400;
+    wrapped.cause = error;
+    throw wrapped;
+  }
+}
+
+/**
+ * 危険度が高い正規表現パターンを拒否する。
+ */
+function assertSafeRegexPattern(pattern, label) {
+  const value = String(pattern);
+
+  if (value.length > MAX_PATTERN_LENGTH) {
+    throwRegexError(label, "pattern is too long.");
+  }
+
+  if (hasBackreference(value)) {
+    throwRegexError(label, "backreferences are not allowed.");
+  }
+
+  if (hasNestedQuantifier(value)) {
+    throwRegexError(label, "nested quantified groups are not allowed.");
+  }
+}
+
+/**
+ * \1 や \k<name> のようなバックリファレンスを検出する。
+ */
+function hasBackreference(pattern) {
+  return /(^|[^\\])\\(?:[1-9]\d*|k<[^>]+>)/.test(pattern);
+}
+
+/**
+ * (a+)+ や (.*)+ のような、バックトラックが爆発しやすい形を検出する。
+ */
+function hasNestedQuantifier(pattern) {
+  const source = stripCharacterClassesAndEscapes(pattern);
+  const groupWithInnerQuantifierThenOuterQuantifier =
+    /\((?:\?:|\?=|\?!|\?<=|\?<!)?[^)]*(?:[+*]|\{\d+(?:,\d*)?\})[^)]*\)(?:[+*?]|\{\d+(?:,\d*)?\})/;
+
+  return groupWithInnerQuantifierThenOuterQuantifier.test(source);
+}
+
+/**
+ * 構造検査の誤検知を減らすため、文字クラスとエスケープ済み文字をプレースホルダ化する。
+ */
+function stripCharacterClassesAndEscapes(pattern) {
+  let result = "";
+  let inClass = false;
+
+  for (let i = 0; i < pattern.length; i += 1) {
+    const char = pattern[i];
+
+    if (char === "\\") {
+      result += "x";
+      i += 1;
+      continue;
+    }
+
+    if (inClass) {
+      if (char === "]") {
+        inClass = false;
+        result += "x";
+      }
+      continue;
+    }
+
+    if (char === "[") {
+      inClass = true;
+      result += "x";
+      continue;
+    }
+
+    result += char;
+  }
+
+  return result;
+}
+
+/**
+ * 管理APIで入力エラーとして返せるErrorを投げる。
+ */
+function throwRegexError(label, reason) {
+  const error = new Error(`${label}: potentially unsafe regular expression: ${reason}`);
+  error.statusCode = 400;
+  throw error;
+}
+
+module.exports = { assertSafeRegexPattern, compileSafeRegex };