@nitra/cf-security 2.0.50 → 3.1.1

package/README.md

@@ -1,12 +1,14 @@
 # cf-security
 
+[![GitHub Super-Linter](https://github.com/nitra/cf-security/workflows/npm-publish/badge.svg)](https://github.com/marketplace/actions/super-linter)
+
 Check security header in Cloud Functions
 
-```
+```HTTP
 X_NITRA_CF_KEY: secret
 ```
 
-```
+```JavaScript
 const { cfSecurity } = require('@nitra/cf-security')
 
 exports.function = async (req, res) => {
@@ -15,3 +17,17 @@ exports.function = async (req, res) => {
     return
   }
 ```
+
+```HTTP
+ALLOWED_ROLES: role1,role2
+```
+
+```JavaScript
+import runSecurity from '@nitra/cf-security'
+
+exports.function = async (req, res) => {
+  if (!runSecurity(req)) {
+    res.send(`Nitra security not passed`)
+    return
+  }
+```

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "@nitra/cf-security",
-  "version": "2.0.50",
+  "version": "3.1.1",
   "description": "check header in cloud functions",
-  "main": "src/index.js",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.js",
+    "./jwt": "./src/jwt.js"
+  },
   "scripts": {
-    "fix": "npx standard --fix && npx prettier --write ."
+    "fix": "npx eslint --fix . && npx prettier --write . ",
+    "test": "env $(cat ./test/.env) npx coverage-node test/index.js"
   },
   "repository": {
     "type": "git",
@@ -16,12 +21,28 @@
     "url": "https://github.com/nitra/cf-security/issues"
   },
   "homepage": "https://github.com/nitra/cf-security#readme",
-  "prettier": "prettier-config-standard",
+  "prettier": "@nitra/prettier-config",
+  "eslintConfig": {
+    "extends": [
+      "@nitra/eslint-config/node"
+    ],
+    "root": true
+  },
   "devDependencies": {
-    "prettier-config-standard": "^1.0.1"
+    "@nitra/eslint-config": "^1.0.9",
+    "@nitra/prettier-config": "^1.0.1",
+    "test-director": "^7.0.0"
   },
   "dependencies": {
-    "@47ng/check-env": "^2.0.1",
-    "consola": "^2.15.3"
+    "@nitra/bunyan": "^1.1.1",
+    "@nitra/check-env": "^2.0.1",
+    "@nitra/isenv": "^2.0.1",
+    "@nitra/jwt": "^3.1.2"
+  },
+  "files": [
+    "src"
+  ],
+  "engines": {
+    "node": ">=16.0.0"
   }
 }

package/src/index.js

@@ -1,18 +1,6 @@
-/**
- * CF Security module
- *
- * @module @nitra/cf-security
- */
-
-const consola = require('consola')
-
-/**
- * @const {Function}
- */
-const checkEnv = require('@47ng/check-env').default
-checkEnv({ required: ['X_NITRA_CF_KEY'] })
-
-consola.debug('cfSecurity in DEBUG MODE')
+import getLogger from '@nitra/bunyan/trace'
+import checkEnv from '@nitra/check-env'
+checkEnv(['X_NITRA_CF_KEY'])
 
 /**
  * Check request for Nitra security rules
@@ -20,25 +8,26 @@ consola.debug('cfSecurity in DEBUG MODE')
  * @param {object} req - ApolloServer or Express Request for check
  * @return {boolean} if check passed
  */
+export const cfSecurity = req => {
+  const log = getLogger(req)
 
-exports.cfSecurity = function (req) {
   if (typeof req.headers === 'undefined') {
-    consola.debug('Request without headers')
+    log.info('Request without headers')
     return false
   }
 
   if (typeof req.headers['x-nitra-cf-key'] === 'undefined') {
-    consola.debug('Nitra key not exist in request')
+    log.info('Nitra key not exist in request')
     return false
   }
 
   if (req.headers['x-nitra-cf-key'] === 0) {
-    consola.debug('Empty Nitra key in headers request')
+    log.info('Empty Nitra key in headers request')
     return false
   }
 
   if (req.headers['x-nitra-cf-key'] !== process.env.X_NITRA_CF_KEY) {
-    consola.debug('Not equal Nitra key')
+    log.info('Not equal Nitra key')
     return false
   }
 

package/src/jwt.js

@@ -0,0 +1,54 @@
+import getLogger from '@nitra/bunyan/trace'
+import checkEnv from '@nitra/check-env'
+import verify from '@nitra/jwt/verify'
+import { isDev } from '@nitra/isenv'
+
+checkEnv(['ALLOWED_ROLES'])
+
+/**
+ * Check request for Nitra security rules WI
+ *
+ * @param {object} req - Fastify  Request for check
+ * @return {string} token if check passed
+ */
+export default async req => {
+  if (isDev) {
+    const token = {}
+    token['https://hasura.io/jwt/claims']['x-hasura-allowed-roles'] = process.env.ALLOWED_ROLES.split(',')
+    return token
+  }
+
+  const log = getLogger(req)
+
+  // Перевіряємо токен тільки
+  if (!req.headers?.authorization) {
+    log.info('[verification] no authorization data')
+    return false
+  }
+
+  const authHeaders = req.headers.authorization.split(' ')
+  const token = await verify(authHeaders[1])
+
+  if (!token) {
+    log.info('[verification] invalid token')
+    return false
+  }
+
+  const roleArray = token.body['https://hasura.io/jwt/claims']['x-hasura-allowed-roles']
+
+  const allowedRoles = process.env.ALLOWED_ROLES.split(',')
+
+  const intersectRoles = intersection(roleArray, allowedRoles)
+
+  if (intersectRoles.length === 0) {
+    log.info('[verification] invalid all roles')
+    return false
+  }
+
+  return token.body
+}
+
+function intersection(a, b) {
+  const setA = new Set(a)
+  return b.filter(value => setA.has(value))
+}

package/.github/workflows/npm-publish.yml

@@ -1,41 +0,0 @@
-name: Node.js Package
-
-on:
-  push:
-    tags:
-      - 'v*.*.*'
-
-jobs:
-  publish-npm:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          # Full git history is needed to get a proper list of changed files within `super-linter` and for Changelog
-          fetch-depth: 0
-
-      ################################
-      # Run Linter against code base #
-      ################################
-      - name: Lint Code Base
-        uses: docker://ghcr.io/github/super-linter:slim-v4
-        env:
-          VALIDATE_ALL_CODEBASE: false
-          DEFAULT_BRANCH: master
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: JS-DevTools/npm-publish@v1
-        with:
-          token: ${{ secrets.NPM_TOKEN }}
-          access: public
-
-      - uses: scottbrenner/generate-changelog-action@master
-        id: Changelog
-
-      - name: Create Release
-        uses: softprops/action-gh-release@v1
-        with:
-          body: |
-            ${{ steps.Changelog.outputs.changelog }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}