@nattyjs/core 0.0.1-beta.37 → 0.0.1-beta.39

package/dist/index.cjs

@@ -27,6 +27,12 @@ function route(path) {
 const CONTROLLER = "controller";
 const INVALID_VALUE = "INVALID_VALUE";
 const BLANK = "";
+const DENY_BY_DEFAULT = {
+  type: "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html#deny-by-default",
+  title: "Deny-by-default",
+  description: `Zero Trust Architecture (NIST SP 800-207) \u2014 Core principle is "never trust, always verify," which translates to deny-by-default behavior. OWASP Secure Defaults Principle \u2014 \u201CSecurity should be a default setting, and everything should be locked down unless explicitly permitted.\u201D`,
+  solution: `Please implement proper authentication and authorization checks. If this API needs to be accessed anonymously, add the @anonymous() decorator above the HTTP action.`
+};
 
 function get(path) {
   return function(target, propertyKey, descriptor) {
@@ -863,6 +869,8 @@ class ModelBindingContext extends ParameterTypeConverter {
     else
       this.data = body;
     this.instance = this.convertToInstance(this.type, this.data);
+    if (!this.isValid)
+      throw new HttpBadRequestException(CreateProblemDetail(this.type, this.errors));
   }
   get isValid() {
     const errors = runValidators(this.type, this.instance);
@@ -879,6 +887,9 @@ class ActionExecutedContext extends AbstractExecutionContext {
     super(httpContext, routeInfo);
     this.content = content;
   }
+  get response() {
+    return this.context.response;
+  }
 }
 
 class AuthorizationContext extends AbstractExecutionContext {
@@ -919,6 +930,8 @@ class RequestProcessor extends RouteParser {
     const authentication = this.getAuthenticationClass();
     const authenticationFilter = authentication ? this.resolveFilter(authentication) : void 0;
     const anonymousInfo = decoratorStateContainer.getInfo(this.routeInfo.controller.name, this.routeInfo.methodInfo.name, DecoratorType.anonymous);
+    if (!anonymousInfo && !authenticationFilter)
+      throw new UnauthorizedAccessException(DENY_BY_DEFAULT);
     if (authenticationFilter) {
       const result = await authenticationFilter.onAuthentication(this.httpContext);
       this.httpContext.user = result;
@@ -943,8 +956,19 @@ class RequestProcessor extends RouteParser {
         throw new ForbiddenAccessException(authorizationFilter.onFailedAuthorization());
     }
   }
-  async onActionExecuting(methodParameters) {
-    await this.onAuthorization(methodParameters);
+  async onModelBinding(methodParameters) {
+    const { actionExecutingContext, actionFilters } = this.getExecutingContext(methodParameters);
+    for (const actionFilter of actionFilters) {
+      const filter = this.resolveFilter(actionFilter);
+      this.actionFilterInstances.push(filter);
+      await filter.onActionExecuting(actionExecutingContext);
+      if (actionExecutingContext.result) {
+        return actionExecutingContext.result;
+      }
+    }
+    return null;
+  }
+  getExecutingContext(methodParameters) {
     let actionFilters = common.commonContainer.globalConfig.actionFilters || [];
     const actionFiltersConfig = decoratorStateContainer.getInfo(this.routeInfo.controller.name, this.routeInfo.methodInfo.name, DecoratorType.useFilter);
     actionFilters = [...actionFilters, ...actionFiltersConfig.controllerConfig?.actionFilters || [], ...actionFiltersConfig.methodConfig?.actionFilters || []];
@@ -953,6 +977,11 @@ class RequestProcessor extends RouteParser {
       this.httpContext,
       this.routeInfo
     );
+    return { actionFilters, actionExecutingContext };
+  }
+  async onActionExecuting(methodParameters) {
+    await this.onAuthorization(methodParameters);
+    const { actionExecutingContext, actionFilters } = this.getExecutingContext(methodParameters);
     for (const actionFilter of actionFilters) {
       const filter = this.resolveFilter(actionFilter);
       this.actionFilterInstances.push(filter);

package/dist/index.mjs

@@ -25,6 +25,12 @@ function route(path) {
 const CONTROLLER = "controller";
 const INVALID_VALUE = "INVALID_VALUE";
 const BLANK = "";
+const DENY_BY_DEFAULT = {
+  type: "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html#deny-by-default",
+  title: "Deny-by-default",
+  description: `Zero Trust Architecture (NIST SP 800-207) \u2014 Core principle is "never trust, always verify," which translates to deny-by-default behavior. OWASP Secure Defaults Principle \u2014 \u201CSecurity should be a default setting, and everything should be locked down unless explicitly permitted.\u201D`,
+  solution: `Please implement proper authentication and authorization checks. If this API needs to be accessed anonymously, add the @anonymous() decorator above the HTTP action.`
+};
 
 function get(path) {
   return function(target, propertyKey, descriptor) {
@@ -861,6 +867,8 @@ class ModelBindingContext extends ParameterTypeConverter {
     else
       this.data = body;
     this.instance = this.convertToInstance(this.type, this.data);
+    if (!this.isValid)
+      throw new HttpBadRequestException(CreateProblemDetail(this.type, this.errors));
   }
   get isValid() {
     const errors = runValidators(this.type, this.instance);
@@ -877,6 +885,9 @@ class ActionExecutedContext extends AbstractExecutionContext {
     super(httpContext, routeInfo);
     this.content = content;
   }
+  get response() {
+    return this.context.response;
+  }
 }
 
 class AuthorizationContext extends AbstractExecutionContext {
@@ -917,6 +928,8 @@ class RequestProcessor extends RouteParser {
     const authentication = this.getAuthenticationClass();
     const authenticationFilter = authentication ? this.resolveFilter(authentication) : void 0;
     const anonymousInfo = decoratorStateContainer.getInfo(this.routeInfo.controller.name, this.routeInfo.methodInfo.name, DecoratorType.anonymous);
+    if (!anonymousInfo && !authenticationFilter)
+      throw new UnauthorizedAccessException(DENY_BY_DEFAULT);
     if (authenticationFilter) {
       const result = await authenticationFilter.onAuthentication(this.httpContext);
       this.httpContext.user = result;
@@ -941,8 +954,19 @@ class RequestProcessor extends RouteParser {
         throw new ForbiddenAccessException(authorizationFilter.onFailedAuthorization());
     }
   }
-  async onActionExecuting(methodParameters) {
-    await this.onAuthorization(methodParameters);
+  async onModelBinding(methodParameters) {
+    const { actionExecutingContext, actionFilters } = this.getExecutingContext(methodParameters);
+    for (const actionFilter of actionFilters) {
+      const filter = this.resolveFilter(actionFilter);
+      this.actionFilterInstances.push(filter);
+      await filter.onActionExecuting(actionExecutingContext);
+      if (actionExecutingContext.result) {
+        return actionExecutingContext.result;
+      }
+    }
+    return null;
+  }
+  getExecutingContext(methodParameters) {
     let actionFilters = commonContainer.globalConfig.actionFilters || [];
     const actionFiltersConfig = decoratorStateContainer.getInfo(this.routeInfo.controller.name, this.routeInfo.methodInfo.name, DecoratorType.useFilter);
     actionFilters = [...actionFilters, ...actionFiltersConfig.controllerConfig?.actionFilters || [], ...actionFiltersConfig.methodConfig?.actionFilters || []];
@@ -951,6 +975,11 @@ class RequestProcessor extends RouteParser {
       this.httpContext,
       this.routeInfo
     );
+    return { actionFilters, actionExecutingContext };
+  }
+  async onActionExecuting(methodParameters) {
+    await this.onAuthorization(methodParameters);
+    const { actionExecutingContext, actionFilters } = this.getExecutingContext(methodParameters);
     for (const actionFilter of actionFilters) {
       const filter = this.resolveFilter(actionFilter);
       this.actionFilterInstances.push(filter);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nattyjs/core",
-  "version": "0.0.1-beta.37",
+  "version": "0.0.1-beta.39",
   "description": "",
   "keywords": [],
   "author": "ajayojha",
@@ -18,7 +18,7 @@
     "reflect-metadata": "0.2.2",
     "tsyringe": "^4.7.0",
     "path-to-regexp": "6.2.1",
-    "@nattyjs/common": "0.0.1-beta.37"
+    "@nattyjs/common": "0.0.1-beta.39"
   },
   "devDependencies": {
     "unbuild": "1.2.1"