@napp/dti-server 4.4.5 → 4.5.2

package/action.d.ts

@@ -1,5 +1,7 @@
-import { DtiAction } from "@napp/dti-core";
-import { IContext } from "./common";
+import type { DtiAction } from "@napp/dti-core";
+import type { IContext } from "./common";
+import type { DtiServer } from "./server";
+import type { Request } from "express";
 export interface ODtiServerAction<RESULT, PARAM> {
     action: (param: PARAM, ctx: IContext) => Promise<RESULT>;
 }
@@ -8,6 +10,6 @@ export declare class DtiServerAction<RESULT, PARAM> {
     private opt;
     private constructor();
     action(param: PARAM, ctx: IContext): Promise<RESULT>;
-    validation(param: PARAM): void;
+    validation(server: DtiServer, param: PARAM, req: Request, isBundler?: boolean): Promise<void>;
     static factory<RESULT, PARAM>(meta: DtiAction<RESULT, PARAM>, opt: ODtiServerAction<RESULT, PARAM>): DtiServerAction<RESULT, PARAM>;
 }

package/action.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DtiServerAction = void 0;
+const node_crypto_1 = require("node:crypto");
+function createHmacString(secret, data) {
+    const expected = (0, node_crypto_1.createHmac)("sha256", secret)
+        .update(data, "utf8")
+        .digest("base64");
+    return expected;
+}
 class DtiServerAction {
+    meta;
+    opt;
     constructor(meta, opt) {
         this.meta = meta;
         this.opt = opt;
@@ -9,8 +18,36 @@ class DtiServerAction {
     action(param, ctx) {
         return this.opt.action(param, ctx);
     }
-    validation(param) {
+    async validation(server, param, req, isBundler = false) {
         this.meta.validate(param);
+        if (server.signatureSecret && isBundler === false) {
+            const data = this.meta.sign(param);
+            if (data) {
+                const timestamp = req.get('X-DTI-Timestamp') ?? '';
+                const nonce = req.get('X-DTI-Nonce') ?? '';
+                const signature = req.get('X-DTI-Signature') ?? '';
+                if (!(timestamp && nonce && signature)) {
+                    throw new Error('requared signature');
+                }
+                const secret = await server.signatureSecret();
+                const expected = createHmacString(secret, `${timestamp}.${nonce}.${data}`);
+                // console.log('--------method', req.method, this.meta.getFullname() )
+                // console.log('secret', secret)
+                // console.log('timestamp', timestamp)
+                // console.log('nonce', nonce)
+                // console.log('signature', signature)
+                // console.log('expected', expected)
+                const a = Buffer.from(expected, "base64");
+                const b = Buffer.from(signature, 'base64');
+                if (a.length !== b.length) {
+                    throw new Error("invalid signature");
+                }
+                const valid = (0, node_crypto_1.timingSafeEqual)(new Uint8Array(a), new Uint8Array(b));
+                if (valid === false) {
+                    throw new Error("invalid signature");
+                }
+            }
+        }
     }
     static factory(meta, opt) {
         return new DtiServerAction(meta, opt);

package/bundler.js

@@ -1,58 +1,47 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BundlerServer = void 0;
 const dti_core_1 = require("@napp/dti-core");
 class BundlerServer {
+    server;
+    base62 = new dti_core_1.Base62();
     constructor(server) {
         this.server = server;
-        this.base62 = new dti_core_1.Base62();
     }
-    action(meta, ctx) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let actions = [];
-            for (let it of meta) {
-                let action = this.server.getActionByName(it.name);
-                if (action) {
-                    action.validation(it.param);
-                    // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
-                    actions.push(() => __awaiter(this, void 0, void 0, function* () { return yield (action === null || action === void 0 ? void 0 : action.action(it.param, ctx)); }));
-                }
-                else {
-                    throw new Error('not defined action. name=' + it.name);
-                }
+    async action(meta, ctx) {
+        let actions = [];
+        for (let it of meta) {
+            let action = this.server.getActionByName(it.name);
+            if (action) {
+                await action.validation(this.server, it.param, ctx.req, true);
+                // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
+                actions.push(async () => await action?.action(it.param, ctx));
             }
-            return yield Promise.all(actions.map(it => it()));
-        });
+            else {
+                throw new Error('not defined action. name=' + it.name);
+            }
+        }
+        return await Promise.all(actions.map(it => it()));
     }
     setup(expressRoute, setuper) {
         if (setuper.factoryBodyparseJson) {
-            expressRoute.post('/__bundler_post__', setuper.factoryBodyparseJson(), (req, res, next) => __awaiter(this, void 0, void 0, function* () {
+            expressRoute.post('/__bundler_post__', setuper.factoryBodyparseJson(), async (req, res, next) => {
                 try {
                     let meta = req.body || [];
-                    let result = yield this.action(meta, { req, res });
+                    let result = await this.action(meta, { req, res });
                     res.json(result);
                 }
                 catch (error) {
                     next(error);
                 }
-            }));
-            expressRoute.get('/__bundler_get__', (req, res, next) => __awaiter(this, void 0, void 0, function* () {
-                var _a;
+            });
+            expressRoute.get('/__bundler_get__', async (req, res, next) => {
                 try {
-                    let p = (_a = req.query) === null || _a === void 0 ? void 0 : _a.p;
+                    let p = req.query?.p;
                     if (p) {
                         let json = this.base62.decode(p);
                         let meta = JSON.parse(json);
-                        let result = yield this.action(meta, { req, res });
+                        let result = await this.action(meta, { req, res });
                         res.json(result);
                     }
                     else {
@@ -62,7 +51,7 @@ class BundlerServer {
                 catch (error) {
                     next(error);
                 }
-            }));
+            });
         }
         else {
             throw new Error('not defined server.factoryBodyparseJson');

package/common.d.ts

@@ -19,4 +19,7 @@ export interface OSetupParam {
     factoryBodyparseJson?: () => IMiddleware;
     factoryBodyparseUrlencode?: () => IMiddleware;
     errorHandle?: IErrorHandle;
+    signatureSecret?: {
+        (): Promise<string>;
+    };
 }

package/esm/action.d.ts

@@ -1,5 +1,7 @@
-import { DtiAction } from "@napp/dti-core";
-import { IContext } from "./common";
+import type { DtiAction } from "@napp/dti-core";
+import type { IContext } from "./common";
+import type { DtiServer } from "./server";
+import type { Request } from "express";
 export interface ODtiServerAction<RESULT, PARAM> {
     action: (param: PARAM, ctx: IContext) => Promise<RESULT>;
 }
@@ -8,6 +10,6 @@ export declare class DtiServerAction<RESULT, PARAM> {
     private opt;
     private constructor();
     action(param: PARAM, ctx: IContext): Promise<RESULT>;
-    validation(param: PARAM): void;
+    validation(server: DtiServer, param: PARAM, req: Request, isBundler?: boolean): Promise<void>;
     static factory<RESULT, PARAM>(meta: DtiAction<RESULT, PARAM>, opt: ODtiServerAction<RESULT, PARAM>): DtiServerAction<RESULT, PARAM>;
 }

package/esm/action.js

@@ -1,4 +1,13 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+function createHmacString(secret, data) {
+    const expected = createHmac("sha256", secret)
+        .update(data, "utf8")
+        .digest("base64");
+    return expected;
+}
 export class DtiServerAction {
+    meta;
+    opt;
     constructor(meta, opt) {
         this.meta = meta;
         this.opt = opt;
@@ -6,8 +15,36 @@ export class DtiServerAction {
     action(param, ctx) {
         return this.opt.action(param, ctx);
     }
-    validation(param) {
+    async validation(server, param, req, isBundler = false) {
         this.meta.validate(param);
+        if (server.signatureSecret && isBundler === false) {
+            const data = this.meta.sign(param);
+            if (data) {
+                const timestamp = req.get('X-DTI-Timestamp') ?? '';
+                const nonce = req.get('X-DTI-Nonce') ?? '';
+                const signature = req.get('X-DTI-Signature') ?? '';
+                if (!(timestamp && nonce && signature)) {
+                    throw new Error('requared signature');
+                }
+                const secret = await server.signatureSecret();
+                const expected = createHmacString(secret, `${timestamp}.${nonce}.${data}`);
+                // console.log('--------method', req.method, this.meta.getFullname() )
+                // console.log('secret', secret)
+                // console.log('timestamp', timestamp)
+                // console.log('nonce', nonce)
+                // console.log('signature', signature)
+                // console.log('expected', expected)
+                const a = Buffer.from(expected, "base64");
+                const b = Buffer.from(signature, 'base64');
+                if (a.length !== b.length) {
+                    throw new Error("invalid signature");
+                }
+                const valid = timingSafeEqual(new Uint8Array(a), new Uint8Array(b));
+                if (valid === false) {
+                    throw new Error("invalid signature");
+                }
+            }
+        }
     }
     static factory(meta, opt) {
         return new DtiServerAction(meta, opt);

package/esm/bundler.js

@@ -1,15 +1,16 @@
 import { Base62 } from "@napp/dti-core";
 export class BundlerServer {
+    server;
+    base62 = new Base62();
     constructor(server) {
         this.server = server;
-        this.base62 = new Base62();
     }
     async action(meta, ctx) {
         let actions = [];
         for (let it of meta) {
             let action = this.server.getActionByName(it.name);
             if (action) {
-                action.validation(it.param);
+                await action.validation(this.server, it.param, ctx.req, true);
                 // console.log('call', it.name, it.param, await action?.action(it.param, ctx))
                 actions.push(async () => await action?.action(it.param, ctx));
             }

package/esm/common.d.ts

@@ -19,4 +19,7 @@ export interface OSetupParam {
     factoryBodyparseJson?: () => IMiddleware;
     factoryBodyparseUrlencode?: () => IMiddleware;
     errorHandle?: IErrorHandle;
+    signatureSecret?: {
+        (): Promise<string>;
+    };
 }

package/esm/route.js

@@ -1,9 +1,11 @@
 import { DtiMode, Base62, DtiRawResponse } from "@napp/dti-core";
 export class DtiServerRoute {
+    meta;
+    server;
+    base62 = new Base62();
     constructor(meta, server) {
         this.meta = meta;
         this.server = server;
-        this.base62 = new Base62();
     }
     param(action, req) {
         let mode = action.meta.getMode();
@@ -27,10 +29,10 @@ export class DtiServerRoute {
         }
         throw new Error('not supported mode');
     }
-    callAction(sa, req, res, next) {
+    async callAction(sa, req, res, next) {
         try {
             let param = this.param(sa, req);
-            sa.validation(param);
+            await sa.validation(this.server, param, req);
             return sa.action(param, { req, res })
                 .then(rsu => {
                 if (DtiRawResponse.is(rsu) === false) {
@@ -46,8 +48,8 @@ export class DtiServerRoute {
     setupAction(expressRoute, action, setuper) {
         let mode = action.meta.getMode();
         let path = action.meta.getPath();
-        let endpoint = (req, res, next) => {
-            this.callAction(action, req, res, next);
+        let endpoint = async (req, res, next) => {
+            await this.callAction(action, req, res, next);
         };
         if (mode === DtiMode.QString || mode === DtiMode.QJson) {
             expressRoute.get(path, endpoint);

package/esm/server.d.ts

@@ -4,14 +4,19 @@ import { OSetupParam } from "./common";
 export interface IRawActionBuilder {
     (expressRoute: any): void;
 }
+export interface ISignatureVerify {
+    (data: string): Promise<string>;
+}
 export declare class DtiServer {
     private root;
     constructor(root: DtiRoute);
     private _actions;
     private _raws;
+    private _signatureSecret;
     register(...actions: DtiServerAction<any, any>[]): this;
     rawRegister(route: DtiRoute, ...handlers: IRawActionBuilder[]): this;
     getActionByName(name: string): DtiServerAction<any, any> | undefined;
     getRawByName(name: string): IRawActionBuilder[] | undefined;
+    get signatureSecret(): (() => Promise<string>) | undefined;
     static setup(server: DtiServer, setuper: OSetupParam): any;
 }

package/esm/server.js

@@ -1,11 +1,13 @@
 import { DtiServerRoute } from "./route";
 import { BundlerServer } from "./bundler";
 export class DtiServer {
+    root;
     constructor(root) {
         this.root = root;
-        this._actions = new Map();
-        this._raws = new Map();
     }
+    _actions = new Map();
+    _raws = new Map();
+    _signatureSecret = undefined;
     register(...actions) {
         for (let action of actions) {
             let name = action.meta.getFullname();
@@ -33,6 +35,9 @@ export class DtiServer {
     getRawByName(name) {
         return this._raws.get(name);
     }
+    get signatureSecret() {
+        return this._signatureSecret;
+    }
     static setup(server, setuper) {
         let route = setuper.factoryExpressRouter(server.root);
         new BundlerServer(server).setup(route, setuper);
@@ -40,6 +45,7 @@ export class DtiServer {
         if (setuper.errorHandle) {
             route.use(setuper.errorHandle);
         }
+        server._signatureSecret = setuper.signatureSecret;
         return route;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@napp/dti-server",
-    "version": "4.4.5",
+    "version": "4.5.2",
     "description": "data transaction interface server library",
     "repository": {
         "type": "git",
@@ -27,6 +27,6 @@
         "@napp/exception": "^9.1.4"
     },
     "dependencies": {
-        "@napp/dti-core": "4.4.5"
+        "@napp/dti-core": "4.5.2"
     }
 }

package/route.js

@@ -3,20 +3,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DtiServerRoute = void 0;
 const dti_core_1 = require("@napp/dti-core");
 class DtiServerRoute {
+    meta;
+    server;
+    base62 = new dti_core_1.Base62();
     constructor(meta, server) {
         this.meta = meta;
         this.server = server;
-        this.base62 = new dti_core_1.Base62();
     }
     param(action, req) {
-        var _a;
         let mode = action.meta.getMode();
         if (mode === dti_core_1.DtiMode.QString) {
             return req.query;
         }
         else if (mode === dti_core_1.DtiMode.QJson) {
             try {
-                let p = (_a = req.query) === null || _a === void 0 ? void 0 : _a.p;
+                let p = req.query?.p;
                 if (p) {
                     let json = this.base62.decode(p);
                     return JSON.parse(json);
@@ -31,10 +32,10 @@ class DtiServerRoute {
         }
         throw new Error('not supported mode');
     }
-    callAction(sa, req, res, next) {
+    async callAction(sa, req, res, next) {
         try {
             let param = this.param(sa, req);
-            sa.validation(param);
+            await sa.validation(this.server, param, req);
             return sa.action(param, { req, res })
                 .then(rsu => {
                 if (dti_core_1.DtiRawResponse.is(rsu) === false) {
@@ -50,8 +51,8 @@ class DtiServerRoute {
     setupAction(expressRoute, action, setuper) {
         let mode = action.meta.getMode();
         let path = action.meta.getPath();
-        let endpoint = (req, res, next) => {
-            this.callAction(action, req, res, next);
+        let endpoint = async (req, res, next) => {
+            await this.callAction(action, req, res, next);
         };
         if (mode === dti_core_1.DtiMode.QString || mode === dti_core_1.DtiMode.QJson) {
             expressRoute.get(path, endpoint);

package/server.d.ts

@@ -4,14 +4,19 @@ import { OSetupParam } from "./common";
 export interface IRawActionBuilder {
     (expressRoute: any): void;
 }
+export interface ISignatureVerify {
+    (data: string): Promise<string>;
+}
 export declare class DtiServer {
     private root;
     constructor(root: DtiRoute);
     private _actions;
     private _raws;
+    private _signatureSecret;
     register(...actions: DtiServerAction<any, any>[]): this;
     rawRegister(route: DtiRoute, ...handlers: IRawActionBuilder[]): this;
     getActionByName(name: string): DtiServerAction<any, any> | undefined;
     getRawByName(name: string): IRawActionBuilder[] | undefined;
+    get signatureSecret(): (() => Promise<string>) | undefined;
     static setup(server: DtiServer, setuper: OSetupParam): any;
 }

package/server.js

@@ -4,11 +4,13 @@ exports.DtiServer = void 0;
 const route_1 = require("./route");
 const bundler_1 = require("./bundler");
 class DtiServer {
+    root;
     constructor(root) {
         this.root = root;
-        this._actions = new Map();
-        this._raws = new Map();
     }
+    _actions = new Map();
+    _raws = new Map();
+    _signatureSecret = undefined;
     register(...actions) {
         for (let action of actions) {
             let name = action.meta.getFullname();
@@ -36,6 +38,9 @@ class DtiServer {
     getRawByName(name) {
         return this._raws.get(name);
     }
+    get signatureSecret() {
+        return this._signatureSecret;
+    }
     static setup(server, setuper) {
         let route = setuper.factoryExpressRouter(server.root);
         new bundler_1.BundlerServer(server).setup(route, setuper);
@@ -43,6 +48,7 @@ class DtiServer {
         if (setuper.errorHandle) {
             route.use(setuper.errorHandle);
         }
+        server._signatureSecret = setuper.signatureSecret;
         return route;
     }
 }