@naturalcycles/backend-lib 9.80.0 → 9.81.0

package/dist/express/createDefaultApp.d.ts

@@ -32,4 +32,27 @@ export interface DefaultAppCfg {
     bodyParserRawOptions?: Options;
     corsOptions?: CorsOptions;
     genericErrorMwCfg?: GenericErrorMiddlewareCfg;
+    /**
+     * Value for Express `trust proxy` setting, which defines how `req.ip`, `req.ips`,
+     * `req.protocol` and `req.hostname` are resolved from `X-Forwarded-*` headers.
+     *
+     * Defaults to `2` - trust exactly 2 hops: the socket peer (Google Front End) and the
+     * rightmost `X-Forwarded-For` entry (appended by the Google Cloud Load Balancer).
+     * This is the setup of Cloud Run behind a Load Balancer.
+     * Any further entries to the left could be injected by the client, so they are not trusted,
+     * which prevents IP address spoofing via `X-Forwarded-For` header.
+     *
+     * Do NOT set it to `true` in production - it trusts the leftmost `X-Forwarded-For` entry,
+     * which is fully client-controlled.
+     *
+     * Adjust it to match the hosting environment (number of proxies in front of the app).
+     *
+     * @default 2
+     */
+    trustProxy?: TrustProxy;
 }
+/**
+ * Accepted values of Express `trust proxy` setting.
+ * See https://expressjs.com/en/guide/behind-proxies.html
+ */
+export type TrustProxy = boolean | number | string | string[] | ((ip: string | undefined, hopIndex: number) => boolean);

package/dist/express/createDefaultApp.js

@@ -5,6 +5,7 @@ import { logMiddleware } from '../server/logMiddleware.js';
 import { notFoundMiddleware } from '../server/notFoundMiddleware.js';
 import { requestTimeoutMiddleware } from '../server/requestTimeoutMiddleware.js';
 import { simpleRequestLoggerMiddleware } from '../server/simpleRequestLoggerMiddleware.js';
+import { isCloudRun } from '../util.js';
 const isTest = process.env['APP_ENV'] === 'test';
 const isDev = process.env['APP_ENV'] === 'dev';
 const isGAE = !!process.env['GAE_INSTANCE'];
@@ -16,7 +17,7 @@ export async function createDefaultApp(cfg) {
     const app = express();
     app.disable('etag');
     app.disable('x-powered-by');
-    app.set('trust proxy', true);
+    app.set('trust proxy', cfg.trustProxy ?? 2);
     // preHandlers
     useHandlers(app, cfg.preHandlers);
     app.use(logMiddleware());
@@ -43,8 +44,9 @@ export async function createDefaultApp(cfg) {
         maxAge: 86400,
         ...cfg.corsOptions,
     }));
-    if (!isGAE && isTest) {
+    if (!isGAE && (isTest || isCloudRun())) {
         // compression is not used in AppEngine, because AppEngine provides it by default
+        // Cloud Run doesn't compress responses, so we do it ourselves
         app.use(compressionMiddleware());
     }
     // app.use(safeJsonMiddleware()) // optional

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.80.0",
+  "version": "9.81.0",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",

package/src/admin/login.html

@@ -6,38 +6,59 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />
 
-    <!-- CSS only -->
-    <link
-      href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.2/dist/css/bootstrap.min.css"
-      rel="stylesheet"
-      crossorigin="anonymous"
-    />
+    <style>
+      body {
+        max-width: 45rem;
+        margin: 0 auto;
+        padding: 40px 1rem;
+        font-family: system-ui, sans-serif;
+        font-size: 1.15rem;
+        line-height: 1.5;
+      }
+      pre {
+        padding: 1rem 1.4rem;
+        overflow-x: auto;
+        background: #f5f7ff;
+        border: 1px solid #ccc;
+        border-radius: 5px;
+      }
+      button {
+        padding: 1rem 1.4rem;
+        font-size: 1.5rem;
+        color: #fff;
+        cursor: pointer;
+        background: #0d47a1;
+        border: none;
+        border-radius: 5px;
+      }
+      button:hover {
+        opacity: 0.8;
+      }
+    </style>
   </head>
   <body>
-    <div id="app" style="padding: 40px 50px">
-      <pre v-if="loading">Checking login...</pre>
-      <div v-else>
-        <div v-if="user">
-          <p>Logged in as:</p>
-          <pre><mark>{{ user.email }}</mark></pre>
-          <pre><mark>{{ user.token }}</mark></pre>
-          <button class="btn btn-primary btn-lg" @click="logout">Logout</button>
-        </div>
-        <div v-else>
-          <button class="btn btn-primary btn-lg" @click="login" id="loginBtn">Login</button>
-        </div>
-      </div>
+    <pre id="loading">Checking login...</pre>
+
+    <div id="loggedIn" hidden>
+      <p>Logged in as:</p>
+      <pre><code id="email"></code></pre>
+      <pre><code id="token"></code></pre>
+      <button id="logoutButton">Logout</button>
+    </div>
+
+    <div id="loggedOut" hidden>
+      <button id="loginBtn">Login</button>
     </div>
 
     <script type="module">
-      import { createApp } from 'https://cdn.jsdelivr.net/npm/vue@3.2.20/dist/vue.esm-browser.prod.js'
-      import { initializeApp } from 'https://www.gstatic.com/firebasejs/9.1.2/firebase-app.js'
+      import { initializeApp } from 'https://www.gstatic.com/firebasejs/13.1.0/firebase-app.js'
       import {
         getAuth,
         GoogleAuthProvider,
         onAuthStateChanged,
         signInWithRedirect,
-      } from 'https://www.gstatic.com/firebasejs/9.1.2/firebase-auth.js'
+        signOut,
+      } from 'https://www.gstatic.com/firebasejs/13.1.0/firebase-auth.js'
 
       const apiKey = '<%= firebaseApiKey %>'
       const authDomain = '<%= firebaseAuthDomain %>'
@@ -47,84 +68,59 @@
         alert(`Error: 'apiKey' or 'authDomain' is missing!`)
       }
 
-      // Initialize Firebase
-      initializeApp({
-        apiKey,
-        authDomain,
-      })
-
-      const auth = getAuth()
-      const provider = new GoogleAuthProvider()
-
-      onAuthStateChanged(auth, user => {
-        // console.log('onAuthStateChanged, user: ', JSON.stringify(user, null, 2))
-        // console.log('onAuthStateChanged, user: ', user)
-        onUser(user)
-      })
-
       const qs = Object.fromEntries(new URLSearchParams(location.search))
-      const { autoLogin, logout, adminTokenKey = 'admin_token' } = qs
+      const { autoLogin, adminTokenKey = 'admin_token' } = qs
       const returnUrl = toSafeReturnUrl(qs.returnUrl)
       // console.log(qs)
 
-      const app = createApp({
-        data() {
-          return {
-            loading: 'Loading...',
-            user: undefined,
-          }
-        },
-        methods: {
-          login: async function () {
-            try {
-              await signInWithRedirect(auth, provider)
-            } catch (err) {
-              logError(err)
-            }
-          },
+      // Initialize Firebase
+      const auth = getAuth(
+        initializeApp({
+          apiKey,
+          authDomain,
+        }),
+      )
+      const provider = new GoogleAuthProvider()
 
-          logout: async function () {
-            try {
-              await auth.signOut()
+      const el = {
+        loading: document.getElementById('loading'),
+        loggedIn: document.getElementById('loggedIn'),
+        loggedOut: document.getElementById('loggedOut'),
+        email: document.getElementById('email'),
+        token: document.getElementById('token'),
+      }
 
-              await postToken('logout') // magic string
+      document.getElementById('loginBtn').addEventListener('click', login)
+      document.getElementById('logoutButton').addEventListener('click', logout)
 
-              if (logout && returnUrl) {
-                alert('Logged out, redurecting back...')
-                location.href = returnUrl
-              }
-            } catch (err) {
-              logError(err)
-            }
-          },
-        },
-      }).mount('#app')
+      onAuthStateChanged(auth, user => {
+        // console.log('onAuthStateChanged, user: ', JSON.stringify(user, null, 2))
+        // console.log('onAuthStateChanged, user: ', user)
+        void onUser(user)
+      })
 
-      if (logout) app.logout()
+      if (qs.logout) void logout()
 
       ////
 
       async function onUser(user) {
         try {
           // alert('onUser')
-          app.user = user
-          app.loading = false
+          render(user)
           if (!user) {
-            if (autoLogin) app.login()
+            if (autoLogin) void login()
           } else {
-            const token = await auth.currentUser.getIdToken()
+            const token = await user.getIdToken()
 
             // alert('idToken')
             // console.log(idToken)
-            app.user = Object.assign({}, app.user, {
-              token,
-            })
+            render(user, token)
 
             await postToken(token)
 
             // Redirect if needed
             if (returnUrl) {
-              // alert(`Logged in as ${app.user.email}, redirecting back...`)
+              // alert(`Logged in as ${user.email}, redirecting back...`)
               location.href = returnUrl
             }
           }
@@ -133,6 +129,37 @@
         }
       }
 
+      function render(user, token = '') {
+        el.loading.hidden = true
+        el.loggedIn.hidden = !user
+        el.loggedOut.hidden = !!user
+        el.email.textContent = user?.email || ''
+        el.token.textContent = token
+      }
+
+      async function login() {
+        try {
+          await signInWithRedirect(auth, provider)
+        } catch (err) {
+          logError(err)
+        }
+      }
+
+      async function logout() {
+        try {
+          await signOut(auth)
+
+          await postToken('logout') // magic string
+
+          if (qs.logout && returnUrl) {
+            alert('Logged out, redirecting back...')
+            location.href = returnUrl
+          }
+        } catch (err) {
+          logError(err)
+        }
+      }
+
       function logError(err) {
         console.error(err)
         alert('Error\n ' + JSON.stringify(err, null, 2))

package/src/express/createDefaultApp.ts

@@ -14,6 +14,7 @@ import type {
   BackendRequestHandler,
 } from '../server/server.model.js'
 import { simpleRequestLoggerMiddleware } from '../server/simpleRequestLoggerMiddleware.js'
+import { isCloudRun } from '../util.js'
 
 const isTest = process.env['APP_ENV'] === 'test'
 const isDev = process.env['APP_ENV'] === 'dev'
@@ -30,7 +31,7 @@ export async function createDefaultApp(cfg: DefaultAppCfg): Promise<BackendAppli
 
   app.disable('etag')
   app.disable('x-powered-by')
-  app.set('trust proxy', true)
+  app.set('trust proxy', cfg.trustProxy ?? 2)
 
   // preHandlers
   useHandlers(app, cfg.preHandlers)
@@ -69,8 +70,9 @@ export async function createDefaultApp(cfg: DefaultAppCfg): Promise<BackendAppli
     }),
   )
 
-  if (!isGAE && isTest) {
+  if (!isGAE && (isTest || isCloudRun())) {
     // compression is not used in AppEngine, because AppEngine provides it by default
+    // Cloud Run doesn't compress responses, so we do it ourselves
     app.use(compressionMiddleware())
   }
 
@@ -195,4 +197,34 @@ export interface DefaultAppCfg {
   corsOptions?: CorsOptions
 
   genericErrorMwCfg?: GenericErrorMiddlewareCfg
+
+  /**
+   * Value for Express `trust proxy` setting, which defines how `req.ip`, `req.ips`,
+   * `req.protocol` and `req.hostname` are resolved from `X-Forwarded-*` headers.
+   *
+   * Defaults to `2` - trust exactly 2 hops: the socket peer (Google Front End) and the
+   * rightmost `X-Forwarded-For` entry (appended by the Google Cloud Load Balancer).
+   * This is the setup of Cloud Run behind a Load Balancer.
+   * Any further entries to the left could be injected by the client, so they are not trusted,
+   * which prevents IP address spoofing via `X-Forwarded-For` header.
+   *
+   * Do NOT set it to `true` in production - it trusts the leftmost `X-Forwarded-For` entry,
+   * which is fully client-controlled.
+   *
+   * Adjust it to match the hosting environment (number of proxies in front of the app).
+   *
+   * @default 2
+   */
+  trustProxy?: TrustProxy
 }
+
+/**
+ * Accepted values of Express `trust proxy` setting.
+ * See https://expressjs.com/en/guide/behind-proxies.html
+ */
+export type TrustProxy =
+  | boolean
+  | number
+  | string
+  | string[]
+  | ((ip: string | undefined, hopIndex: number) => boolean)