@nitra/cf-security 3.1.1 → 3.1.5

package/README.md

@@ -18,15 +18,10 @@ exports.function = async (req, res) => {
   }
 ```
 
-```HTTP
-ALLOWED_ROLES: role1,role2
-```
-
 ```JavaScript
 import runSecurity from '@nitra/cf-security'
 
-exports.function = async (req, res) => {
-  if (!runSecurity(req)) {
+  if (!runSecurity(req, ["role1","role2"])) {
     res.send(`Nitra security not passed`)
     return
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitra/cf-security",
-  "version": "3.1.1",
+  "version": "3.1.5",
   "description": "check header in cloud functions",
   "type": "module",
   "exports": {

package/src/jwt.js

@@ -1,48 +1,34 @@
-import getLogger from '@nitra/bunyan/trace'
-import checkEnv from '@nitra/check-env'
 import verify from '@nitra/jwt/verify'
 import { isDev } from '@nitra/isenv'
 
-checkEnv(['ALLOWED_ROLES'])
-
 /**
  * Check request for Nitra security rules WI
  *
  * @param {object} req - Fastify  Request for check
  * @return {string} token if check passed
  */
-export default async req => {
+export default async (req, allowedRoles) => {
   if (isDev) {
-    const token = {}
-    token['https://hasura.io/jwt/claims']['x-hasura-allowed-roles'] = process.env.ALLOWED_ROLES.split(',')
-    return token
+    return { name: 'dev', 'https://hasura.io/jwt/claims': { 'x-hasura-allowed-roles': allowedRoles } }
   }
 
-  const log = getLogger(req)
-
   // Перевіряємо токен тільки
   if (!req.headers?.authorization) {
-    log.info('[verification] no authorization data')
-    return false
+    throw new Error('[verification] no authorization header')
   }
 
   const authHeaders = req.headers.authorization.split(' ')
   const token = await verify(authHeaders[1])
 
   if (!token) {
-    log.info('[verification] invalid token')
-    return false
+    throw new Error('[verification] invalid token')
   }
 
   const roleArray = token.body['https://hasura.io/jwt/claims']['x-hasura-allowed-roles']
-
-  const allowedRoles = process.env.ALLOWED_ROLES.split(',')
-
   const intersectRoles = intersection(roleArray, allowedRoles)
 
   if (intersectRoles.length === 0) {
-    log.info('[verification] invalid all roles')
-    return false
+    throw new Error(`[verification] unallowed roles ${roleArray}`)
   }
 
   return token.body