@napp/dti-server 4.4.4 → 4.5.2

package/action.d.ts

@@ -1,5 +1,7 @@
-import { DtiAction } from "@napp/dti-core";
-import { IContext } from "./common";
+import type { DtiAction } from "@napp/dti-core";
+import type { IContext } from "./common";
+import type { DtiServer } from "./server";
+import type { Request } from "express";
 export interface ODtiServerAction<RESULT, PARAM> {
     action: (param: PARAM, ctx: IContext) => Promise<RESULT>;
 }
@@ -8,6 +10,6 @@ export declare class DtiServerAction<RESULT, PARAM> {
     private opt;
     private constructor();
     action(param: PARAM, ctx: IContext): Promise<RESULT>;
-    validation(param: PARAM): void;
+    validation(server: DtiServer, param: PARAM, req: Request, isBundler?: boolean): Promise<void>;
     static factory<RESULT, PARAM>(meta: DtiAction<RESULT, PARAM>, opt: ODtiServerAction<RESULT, PARAM>): DtiServerAction<RESULT, PARAM>;
 }

package/action.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DtiServerAction = void 0;
+const node_crypto_1 = require("node:crypto");
+function createHmacString(secret, data) {
+    const expected = (0, node_crypto_1.createHmac)("sha256", secret)
+        .update(data, "utf8")
+        .digest("base64");
+    return expected;
+}
 class DtiServerAction {
+    meta;
+    opt;
     constructor(meta, opt) {
         this.meta = meta;
         this.opt = opt;
@@ -9,8 +18,36 @@ class DtiServerAction {
     action(param, ctx) {
         return this.opt.action(param, ctx);
     }
-    validation(param) {
+    async validation(server, param, req, isBundler = false) {
         this.meta.validate(param);
+        if (server.signatureSecret && isBundler === false) {
+            const data = this.meta.sign(param);
+            if (data) {
+                const timestamp = req.get('X-DTI-Timestamp') ?? '';
+                const nonce = req.get('X-DTI-Nonce') ?? '';
+                const signature = req.get('X-DTI-Signature') ?? '';
+                if (!(timestamp && nonce && signature)) {
+                    throw new Error('requared signature');
+                }
+                const secret = await server.signatureSecret();
+                const expected = createHmacString(secret, `${timestamp}.${nonce}.${data}`);
+                // console.log('--------method', req.method, this.meta.getFullname() )
+                // console.log('secret', secret)
+                // console.log('timestamp', timestamp)
+                // console.log('nonce', nonce)
+                // console.log('signature', signature)
+                // console.log('expected', expected)
+                const a = Buffer.from(expected, "base64");
+                const b = Buffer.from(signature, 'base64');
+                if (a.length !== b.length) {
+                    throw new Error("invalid signature");
+                }
+                const valid = (0, node_crypto_1.timingSafeEqual)(new Uint8Array(a), new Uint8Array(b));
+                if (valid === false) {
+                    throw new Error("invalid signature");
+                }
+            }
+        }
     }
     static factory(meta, opt) {
         return new DtiServerAction(meta, opt);

package/bundler.js

@@ -1,58 +1,47 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BundlerServer = void 0;
 const dti_core_1 = require("@napp/dti-core");
 class BundlerServer {
+    server;
+    base62 = new dti_core_1.Base62();
     constructor(server) {
         this.server = server;
-        this.base62 = new dti_core_1.Base62();
     }
-    action(meta, ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let actions = [];
-            for (let it of meta) {
-                let action = this.server.getActionByName(it.name);
-                if (action) {
-                    action.validation(it.param);
-                    // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
-                    actions.push(() => __awaiter(this, void 0, void 0, function* () { return yield (action === null || action === void 0 ? void 0 : action.action(it.param, ctx)); }));
-                }
-                else {
-                    throw new Error('not defined action. name=' + it.name);
-                }
+    async action(meta, ctx) {
+        let actions = [];
+        for (let it of meta) {
+            let action = this.server.getActionByName(it.name);
+            if (action) {
+                await action.validation(this.server, it.param, ctx.req, true);
+                // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
+                actions.push(async () => await action?.action(it.param, ctx));
             }
-            return yield Promise.all(actions.map(it => it()));
-        });
+            else {
+                throw new Error('not defined action. name=' + it.name);
+            }
+        }
+        return await Promise.all(actions.map(it => it()));
     }
     setup(expressRoute, setuper) {
         if (setuper.factoryBodyparseJson) {
-            expressRoute.post('/__bundler_post__', setuper.factoryBodyparseJson(), (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+            expressRoute.post('/__bundler_post__', setuper.factoryBodyparseJson(), async (req, res, next) => {
                 try {
                     let meta = req.body || [];
-                    let result = yield this.action(meta, { req, res });
+                    let result = await this.action(meta, { req, res });
                     res.json(result);
                 }
                 catch (error) {
                     next(error);
                 }
-            }));
-            expressRoute.get('/__bundler_get__', (req, res, next) => __awaiter(this, void 0, void 0, function* () {
-                var _a;
+            });
+            expressRoute.get('/__bundler_get__', async (req, res, next) => {
                 try {
-                    let p = (_a = req.query) === null || _a === void 0 ? void 0 : _a.p;
+                    let p = req.query?.p;
                     if (p) {
                         let json = this.base62.decode(p);
                         let meta = JSON.parse(json);
-                        let result = yield this.action(meta, { req, res });
+                        let result = await this.action(meta, { req, res });
                         res.json(result);
                     }
                     else {
@@ -62,7 +51,7 @@ class BundlerServer {
                 catch (error) {
                     next(error);
                 }
-            }));
+            });
         }
         else {
             throw new Error('not defined server.factoryBodyparseJson');

package/common.d.ts

@@ -19,4 +19,7 @@ export interface OSetupParam {
     factoryBodyparseJson?: () => IMiddleware;
     factoryBodyparseUrlencode?: () => IMiddleware;
     errorHandle?: IErrorHandle;
+    signatureSecret?: {
+        (): Promise<string>;
+    };
 }

package/esm/action.d.ts

@@ -0,0 +1,15 @@
+import type { DtiAction } from "@napp/dti-core";
+import type { IContext } from "./common";
+import type { DtiServer } from "./server";
+import type { Request } from "express";
+export interface ODtiServerAction<RESULT, PARAM> {
+    action: (param: PARAM, ctx: IContext) => Promise<RESULT>;
+}
+export declare class DtiServerAction<RESULT, PARAM> {
+    meta: DtiAction<RESULT, PARAM>;
+    private opt;
+    private constructor();
+    action(param: PARAM, ctx: IContext): Promise<RESULT>;
+    validation(server: DtiServer, param: PARAM, req: Request, isBundler?: boolean): Promise<void>;
+    static factory<RESULT, PARAM>(meta: DtiAction<RESULT, PARAM>, opt: ODtiServerAction<RESULT, PARAM>): DtiServerAction<RESULT, PARAM>;
+}

package/esm/action.js

@@ -0,0 +1,52 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+function createHmacString(secret, data) {
+    const expected = createHmac("sha256", secret)
+        .update(data, "utf8")
+        .digest("base64");
+    return expected;
+}
+export class DtiServerAction {
+    meta;
+    opt;
+    constructor(meta, opt) {
+        this.meta = meta;
+        this.opt = opt;
+    }
+    action(param, ctx) {
+        return this.opt.action(param, ctx);
+    }
+    async validation(server, param, req, isBundler = false) {
+        this.meta.validate(param);
+        if (server.signatureSecret && isBundler === false) {
+            const data = this.meta.sign(param);
+            if (data) {
+                const timestamp = req.get('X-DTI-Timestamp') ?? '';
+                const nonce = req.get('X-DTI-Nonce') ?? '';
+                const signature = req.get('X-DTI-Signature') ?? '';
+                if (!(timestamp && nonce && signature)) {
+                    throw new Error('requared signature');
+                }
+                const secret = await server.signatureSecret();
+                const expected = createHmacString(secret, `${timestamp}.${nonce}.${data}`);
+                // console.log('--------method', req.method, this.meta.getFullname() )
+                // console.log('secret', secret)
+                // console.log('timestamp', timestamp)
+                // console.log('nonce', nonce)
+                // console.log('signature', signature)
+                // console.log('expected', expected)
+                const a = Buffer.from(expected, "base64");
+                const b = Buffer.from(signature, 'base64');
+                if (a.length !== b.length) {
+                    throw new Error("invalid signature");
+                }
+                const valid = timingSafeEqual(new Uint8Array(a), new Uint8Array(b));
+                if (valid === false) {
+                    throw new Error("invalid signature");
+                }
+            }
+        }
+    }
+    static factory(meta, opt) {
+        return new DtiServerAction(meta, opt);
+    }
+}

package/esm/bundler.d.ts

@@ -0,0 +1,14 @@
+import { IContext, OSetupParam } from "./common";
+import { DtiServer } from "./server";
+interface IMeteParam {
+    name: string;
+    param: any;
+}
+export declare class BundlerServer {
+    private server;
+    private base62;
+    constructor(server: DtiServer);
+    action(meta: Array<IMeteParam>, ctx: IContext): Promise<any[]>;
+    setup(expressRoute: any, setuper: OSetupParam): void;
+}
+export {};

package/esm/bundler.js

@@ -0,0 +1,57 @@
+import { Base62 } from "@napp/dti-core";
+export class BundlerServer {
+    server;
+    base62 = new Base62();
+    constructor(server) {
+        this.server = server;
+    }
+    async action(meta, ctx) {
+        let actions = [];
+        for (let it of meta) {
+            let action = this.server.getActionByName(it.name);
+            if (action) {
+                await action.validation(this.server, it.param, ctx.req, true);
+                // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
+                actions.push(async () => await action?.action(it.param, ctx));
+            }
+            else {
+                throw new Error('not defined action. name=' + it.name);
+            }
+        }
+        return await Promise.all(actions.map(it => it()));
+    }
+    setup(expressRoute, setuper) {
+        if (setuper.factoryBodyparseJson) {
+            expressRoute.post('/__bundler_post__', setuper.factoryBodyparseJson(), async (req, res, next) => {
+                try {
+                    let meta = req.body || [];
+                    let result = await this.action(meta, { req, res });
+                    res.json(result);
+                }
+                catch (error) {
+                    next(error);
+                }
+            });
+            expressRoute.get('/__bundler_get__', async (req, res, next) => {
+                try {
+                    let p = req.query?.p;
+                    if (p) {
+                        let json = this.base62.decode(p);
+                        let meta = JSON.parse(json);
+                        let result = await this.action(meta, { req, res });
+                        res.json(result);
+                    }
+                    else {
+                        res.json([]);
+                    }
+                }
+                catch (error) {
+                    next(error);
+                }
+            });
+        }
+        else {
+            throw new Error('not defined server.factoryBodyparseJson');
+        }
+    }
+}

package/esm/common.d.ts

@@ -0,0 +1,25 @@
+import { DtiRoute } from "@napp/dti-core";
+export interface IContext {
+    req: any;
+    res: any;
+}
+export interface IMiddleware {
+    (req: any, res: any, next: any): void;
+}
+export interface IErrorHandle {
+    (req: any, res: any, next: any): void;
+}
+export interface IExpressRoute {
+    get(path: string, handlers: IMiddleware[]): void;
+    post(path: string, handlers: IMiddleware[]): void;
+    use(path: string, route: IExpressRoute): void;
+}
+export interface OSetupParam {
+    factoryExpressRouter(dtiRouter: DtiRoute): any;
+    factoryBodyparseJson?: () => IMiddleware;
+    factoryBodyparseUrlencode?: () => IMiddleware;
+    errorHandle?: IErrorHandle;
+    signatureSecret?: {
+        (): Promise<string>;
+    };
+}

package/esm/common.js

@@ -0,0 +1 @@
+export {};

package/esm/index.d.ts

@@ -0,0 +1,4 @@
+export * from './action';
+export * from './common';
+export * from './route';
+export * from './server';

package/esm/index.js

@@ -0,0 +1,4 @@
+export * from './action';
+export * from './common';
+export * from './route';
+export * from './server';

package/esm/route.d.ts

@@ -0,0 +1,15 @@
+import { DtiRoute } from "@napp/dti-core";
+import { OSetupParam } from "./common";
+import { DtiServer } from "./server";
+export declare class DtiServerRoute {
+    private meta;
+    private server;
+    private base62;
+    constructor(meta: DtiRoute, server: DtiServer);
+    private param;
+    private callAction;
+    private setupAction;
+    private setupActions;
+    private setupRaws;
+    setup(setuper: OSetupParam): any;
+}

package/esm/route.js

@@ -0,0 +1,109 @@
+import { DtiMode, Base62, DtiRawResponse } from "@napp/dti-core";
+export class DtiServerRoute {
+    meta;
+    server;
+    base62 = new Base62();
+    constructor(meta, server) {
+        this.meta = meta;
+        this.server = server;
+    }
+    param(action, req) {
+        let mode = action.meta.getMode();
+        if (mode === DtiMode.QString) {
+            return req.query;
+        }
+        else if (mode === DtiMode.QJson) {
+            try {
+                let p = req.query?.p;
+                if (p) {
+                    let json = this.base62.decode(p);
+                    return JSON.parse(json);
+                }
+            }
+            catch (error) {
+            }
+            return {};
+        }
+        else if (mode === DtiMode.BJson || mode === DtiMode.BFrom) {
+            return req.body;
+        }
+        throw new Error('not supported mode');
+    }
+    async callAction(sa, req, res, next) {
+        try {
+            let param = this.param(sa, req);
+            await sa.validation(this.server, param, req);
+            return sa.action(param, { req, res })
+                .then(rsu => {
+                if (DtiRawResponse.is(rsu) === false) {
+                    return res.json(rsu);
+                }
+            })
+                .catch(err => next(err));
+        }
+        catch (error) {
+            return next(error);
+        }
+    }
+    setupAction(expressRoute, action, setuper) {
+        let mode = action.meta.getMode();
+        let path = action.meta.getPath();
+        let endpoint = async (req, res, next) => {
+            await this.callAction(action, req, res, next);
+        };
+        if (mode === DtiMode.QString || mode === DtiMode.QJson) {
+            expressRoute.get(path, endpoint);
+        }
+        else if (mode === DtiMode.BJson) {
+            if (setuper.factoryBodyparseJson) {
+                expressRoute.post(path, [setuper.factoryBodyparseJson(), endpoint]);
+            }
+            else {
+                throw new Error('not define server.factoryBodyparseJson');
+            }
+        }
+        else if (mode === DtiMode.BFrom) {
+            if (setuper.factoryBodyparseUrlencode) {
+                expressRoute.post(path, [setuper.factoryBodyparseUrlencode(), endpoint]);
+            }
+            else {
+                throw new Error('not define server.factoryBodyparseUrlencode');
+            }
+        }
+        else {
+            throw new Error("not support methid. logic error");
+        }
+    }
+    setupActions(expressRoute, setuper) {
+        let actions = this.meta.getActions();
+        for (let a of actions) {
+            let name = a.getFullname();
+            let action = this.server.getActionByName(name);
+            if (action) {
+                this.setupAction(expressRoute, action, setuper);
+            }
+            else {
+                console.warn(`not registered server action. action(${name})`);
+            }
+        }
+    }
+    setupRaws(expressRoute, setuper) {
+        let name = this.meta.getFullname();
+        let handles = this.server.getRawByName(name);
+        if (Array.isArray(handles)) {
+            for (let handle of handles) {
+                handle(expressRoute);
+            }
+        }
+    }
+    setup(setuper) {
+        let pRoute = setuper.factoryExpressRouter(this.meta);
+        this.setupActions(pRoute, setuper);
+        this.setupRaws(pRoute, setuper);
+        for (let dtiRoute of this.meta.getChildroutes()) {
+            let lRoute = new DtiServerRoute(dtiRoute, this.server).setup(setuper);
+            pRoute.use(dtiRoute.getLocalPath(), lRoute);
+        }
+        return pRoute;
+    }
+}

package/esm/server.d.ts

@@ -0,0 +1,22 @@
+import { DtiRoute } from "@napp/dti-core";
+import { DtiServerAction } from "./action";
+import { OSetupParam } from "./common";
+export interface IRawActionBuilder {
+    (expressRoute: any): void;
+}
+export interface ISignatureVerify {
+    (data: string): Promise<string>;
+}
+export declare class DtiServer {
+    private root;
+    constructor(root: DtiRoute);
+    private _actions;
+    private _raws;
+    private _signatureSecret;
+    register(...actions: DtiServerAction<any, any>[]): this;
+    rawRegister(route: DtiRoute, ...handlers: IRawActionBuilder[]): this;
+    getActionByName(name: string): DtiServerAction<any, any> | undefined;
+    getRawByName(name: string): IRawActionBuilder[] | undefined;
+    get signatureSecret(): (() => Promise<string>) | undefined;
+    static setup(server: DtiServer, setuper: OSetupParam): any;
+}

package/esm/server.js

@@ -0,0 +1,51 @@
+import { DtiServerRoute } from "./route";
+import { BundlerServer } from "./bundler";
+export class DtiServer {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    _actions = new Map();
+    _raws = new Map();
+    _signatureSecret = undefined;
+    register(...actions) {
+        for (let action of actions) {
+            let name = action.meta.getFullname();
+            if (this._actions.has(name)) {
+                throw new Error(`already registed(${name})`);
+            }
+            this._actions.set(name, action);
+        }
+        return this;
+    }
+    rawRegister(route, ...handlers) {
+        let name = route.getFullname();
+        if (this._raws.has(name)) {
+            let olds = this._raws.get(name) || [];
+            this._raws.set(name, [...olds, ...handlers]);
+        }
+        else {
+            this._raws.set(name, [...handlers]);
+        }
+        return this;
+    }
+    getActionByName(name) {
+        return this._actions.get(name);
+    }
+    getRawByName(name) {
+        return this._raws.get(name);
+    }
+    get signatureSecret() {
+        return this._signatureSecret;
+    }
+    static setup(server, setuper) {
+        let route = setuper.factoryExpressRouter(server.root);
+        new BundlerServer(server).setup(route, setuper);
+        route.use(server.root.getLocalPath(), new DtiServerRoute(server.root, server).setup(setuper));
+        if (setuper.errorHandle) {
+            route.use(setuper.errorHandle);
+        }
+        server._signatureSecret = setuper.signatureSecret;
+        return route;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@napp/dti-server",
-    "version": "4.4.4",
+    "version": "4.5.2",
     "description": "data transaction interface server library",
     "repository": {
         "type": "git",
@@ -8,6 +8,14 @@
     },
     "types": "index.d.ts",
     "main": "index.js",
+    "module": "esm/index.js",
+    "exports": {
+        ".": {
+            "require": "./index.js",
+            "import": "./esm/index.js",
+            "types": "./index.d.ts"
+        }
+    },
     "keywords": [
         "napp",
         "Rest API",
@@ -19,6 +27,6 @@
         "@napp/exception": "^9.1.4"
     },
     "dependencies": {
-        "@napp/dti-core": "4.4.4"
+        "@napp/dti-core": "4.5.2"
     }
 }

package/route.js

@@ -3,20 +3,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DtiServerRoute = void 0;
 const dti_core_1 = require("@napp/dti-core");
 class DtiServerRoute {
+    meta;
+    server;
+    base62 = new dti_core_1.Base62();
     constructor(meta, server) {
         this.meta = meta;
         this.server = server;
-        this.base62 = new dti_core_1.Base62();
     }
     param(action, req) {
-        var _a;
         let mode = action.meta.getMode();
         if (mode === dti_core_1.DtiMode.QString) {
             return req.query;
         }
         else if (mode === dti_core_1.DtiMode.QJson) {
             try {
-                let p = (_a = req.query) === null || _a === void 0 ? void 0 : _a.p;
+                let p = req.query?.p;
                 if (p) {
                     let json = this.base62.decode(p);
                     return JSON.parse(json);
@@ -31,10 +32,10 @@ class DtiServerRoute {
         }
         throw new Error('not supported mode');
     }
-    callAction(sa, req, res, next) {
+    async callAction(sa, req, res, next) {
         try {
             let param = this.param(sa, req);
-            sa.validation(param);
+            await sa.validation(this.server, param, req);
             return sa.action(param, { req, res })
                 .then(rsu => {
                 if (dti_core_1.DtiRawResponse.is(rsu) === false) {
@@ -50,8 +51,8 @@ class DtiServerRoute {
     setupAction(expressRoute, action, setuper) {
         let mode = action.meta.getMode();
         let path = action.meta.getPath();
-        let endpoint = (req, res, next) => {
-            this.callAction(action, req, res, next);
+        let endpoint = async (req, res, next) => {
+            await this.callAction(action, req, res, next);
         };
         if (mode === dti_core_1.DtiMode.QString || mode === dti_core_1.DtiMode.QJson) {
             expressRoute.get(path, endpoint);

package/server.d.ts

@@ -4,14 +4,19 @@ import { OSetupParam } from "./common";
 export interface IRawActionBuilder {
     (expressRoute: any): void;
 }
+export interface ISignatureVerify {
+    (data: string): Promise<string>;
+}
 export declare class DtiServer {
     private root;
     constructor(root: DtiRoute);
     private _actions;
     private _raws;
+    private _signatureSecret;
     register(...actions: DtiServerAction<any, any>[]): this;
     rawRegister(route: DtiRoute, ...handlers: IRawActionBuilder[]): this;
     getActionByName(name: string): DtiServerAction<any, any> | undefined;
     getRawByName(name: string): IRawActionBuilder[] | undefined;
+    get signatureSecret(): (() => Promise<string>) | undefined;
     static setup(server: DtiServer, setuper: OSetupParam): any;
 }

package/server.js

@@ -4,11 +4,13 @@ exports.DtiServer = void 0;
 const route_1 = require("./route");
 const bundler_1 = require("./bundler");
 class DtiServer {
+    root;
     constructor(root) {
         this.root = root;
-        this._actions = new Map();
-        this._raws = new Map();
     }
+    _actions = new Map();
+    _raws = new Map();
+    _signatureSecret = undefined;
     register(...actions) {
         for (let action of actions) {
             let name = action.meta.getFullname();
@@ -36,6 +38,9 @@ class DtiServer {
     getRawByName(name) {
         return this._raws.get(name);
     }
+    get signatureSecret() {
+        return this._signatureSecret;
+    }
     static setup(server, setuper) {
         let route = setuper.factoryExpressRouter(server.root);
         new bundler_1.BundlerServer(server).setup(route, setuper);
@@ -43,6 +48,7 @@ class DtiServer {
         if (setuper.errorHandle) {
             route.use(setuper.errorHandle);
         }
+        server._signatureSecret = setuper.signatureSecret;
         return route;
     }
 }