@nymphjs/server 1.0.0-beta.12 → 1.0.0-beta.120

package/src/createServer.ts

@@ -18,24 +18,32 @@ import {
 } from '@nymphjs/nymph';
 import { EntityInvalidDataError } from '@nymphjs/nymph';
 
-import { statusDescriptions } from './statusDescriptions';
+import { statusDescriptions } from './statusDescriptions.js';
 
 type NymphResponse = Response<any, { nymph: Nymph }>;
 
 const NOT_FOUND_ERROR = 'Entity is not found.';
 
+export class ForbiddenClassError extends Error {
+  constructor(message: string) {
+    super(message);
+
+    this.name = 'ForbiddenClassError';
+  }
+}
+
 /**
  * A REST server middleware creator for Nymph.
  *
  * Written by Hunter Perrin for SciActive.
  *
- * @author Hunter Perrin <hperrin@gmail.com>
+ * @author Hunter Perrin <hperrin@port87.com>
  * @copyright SciActive Inc
  * @see http://nymph.io/
  */
 export function createServer(
   nymph: Nymph,
-  { jsonOptions = {} }: { jsonOptions?: OptionsJson } = {}
+  { jsonOptions = {} }: { jsonOptions?: OptionsJson } = {},
 ) {
   const rest = express();
   rest.use(cookieParser());
@@ -44,22 +52,25 @@ export function createServer(
   function instantiateNymph(
     _request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     response.locals.nymph = nymph.clone();
     next();
   }
 
-  function authenticateTilmeld(
+  async function authenticateTilmeld(
     request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     if (response.locals.nymph.tilmeld) {
       response.locals.nymph.tilmeld.request = request;
       response.locals.nymph.tilmeld.response = response;
       try {
-        response.locals.nymph.tilmeld.authenticate();
+        await response.locals.nymph.tilmeld.authenticate(
+          false,
+          request.header('x-tilmeld-token-renewal') === 'off',
+        );
       } catch (e: any) {
         httpError(response, 500, e);
         return;
@@ -71,7 +82,7 @@ export function createServer(
   function unauthenticateTilmeld(
     _request: Request,
     response: NymphResponse,
-    next: NextFunction
+    next: NextFunction,
   ) {
     if (response.locals.nymph.tilmeld) {
       response.locals.nymph.tilmeld.request = null;
@@ -140,6 +151,10 @@ export function createServer(
         let EntityClass;
         try {
           EntityClass = response.locals.nymph.getEntityClass(data[0].class);
+          if (!EntityClass.restEnabled) {
+            httpError(response, 403);
+            return;
+          }
         } catch (e: any) {
           httpError(response, 400, e);
           return;
@@ -147,10 +162,24 @@ export function createServer(
         options.class = EntityClass;
         options.source = 'client';
         options.skipAc = false;
-        selectors = classNamesToEntityConstructors(
-          response.locals.nymph,
-          selectors
-        );
+        if (options.return === 'object') {
+          options.return = 'entity';
+        }
+        try {
+          selectors = classNamesToEntityConstructors(
+            response.locals.nymph,
+            selectors,
+            true,
+          );
+        } catch (e: any) {
+          if (e?.message === 'Not accessible.') {
+            httpError(response, 403);
+            return;
+          } else {
+            httpError(response, 500, e);
+            return;
+          }
+        }
         let result:
           | EntityInterface
           | EntityInterface[]
@@ -162,12 +191,12 @@ export function createServer(
           if (action === 'entity') {
             result = await response.locals.nymph.getEntity(
               options,
-              ...selectors
+              ...selectors,
             );
           } else {
             result = await response.locals.nymph.getEntities(
               options,
-              ...selectors
+              ...selectors,
             );
           }
         } catch (e: any) {
@@ -192,10 +221,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.READ_ACCESS
-            )
+              TilmeldAccessLevels.READ_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -241,6 +270,7 @@ export function createServer(
         let invalidRequest = false;
         let conflict = false;
         let notfound = false;
+        let forbidden = false;
         let lastException = null;
         for (let entData of data) {
           if (entData.guid) {
@@ -254,6 +284,8 @@ export function createServer(
           } catch (e: any) {
             if (e instanceof EntityConflictError) {
               conflict = true;
+            } else if (e instanceof ForbiddenClassError) {
+              forbidden = true;
             } else if (e.message === NOT_FOUND_ERROR) {
               notfound = true;
             } else if (e instanceof InvalidParametersError) {
@@ -293,6 +325,9 @@ export function createServer(
           } else if (conflict) {
             httpError(response, 409);
             return;
+          } else if (forbidden) {
+            httpError(response, 403);
+            return;
           } else if (notfound) {
             httpError(response, 404);
             return;
@@ -313,92 +348,158 @@ export function createServer(
           httpError(response, 400);
           return;
         }
-        const params = referencesToEntities(
-          [...data.params],
-          response.locals.nymph
-        );
-        if (data.static) {
-          let EntityClass: EntityConstructor;
-          try {
-            EntityClass = response.locals.nymph.getEntityClass(data.class);
-          } catch (e: any) {
-            httpError(response, 400);
-            return;
-          }
-          if (
-            EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1
-          ) {
-            httpError(response, 403);
-            return;
-          }
-          if (!(data.method in EntityClass)) {
-            httpError(response, 400);
-            return;
-          }
-          // @ts-ignore Dynamic methods make TypeScript sad.
-          const method: Function = EntityClass[data.method];
-          if (typeof method !== 'function') {
-            httpError(response, 400);
-            return;
-          }
-          try {
-            const result = method.call(EntityClass, ...params);
-            let ret = result;
-            if (result instanceof Promise) {
-              ret = await result;
+        try {
+          const params = referencesToEntities(
+            [...data.params],
+            response.locals.nymph,
+          );
+          if (data.static) {
+            let EntityClass: EntityConstructor;
+            try {
+              EntityClass = response.locals.nymph.getEntityClass(data.class);
+              if (!EntityClass.restEnabled) {
+                httpError(response, 403);
+                return;
+              }
+            } catch (e: any) {
+              httpError(response, 400);
+              return;
             }
-            response.status(200);
-            response.setHeader('Content-Type', 'application/json');
-            response.send({ return: ret });
-          } catch (e: any) {
-            httpError(response, 500, e);
-            return;
-          }
-        } else {
-          let entity: EntityInterface;
-          try {
-            entity = await loadEntity(data.entity, response.locals.nymph);
-          } catch (e: any) {
-            if (e instanceof EntityConflictError) {
-              httpError(response, 409);
-            } else if (e.message === NOT_FOUND_ERROR) {
-              httpError(response, 404, e);
-            } else if (e instanceof InvalidParametersError) {
-              httpError(response, 400, e);
+            if (
+              EntityClass.clientEnabledStaticMethods.indexOf(data.method) === -1
+            ) {
+              httpError(response, 403);
+              return;
+            }
+            if (!(data.method in EntityClass)) {
+              httpError(response, 400);
+              return;
+            }
+            // @ts-ignore Dynamic methods make TypeScript sad.
+            const method: Function = EntityClass[data.method];
+            if (typeof method !== 'function') {
+              httpError(response, 400);
+              return;
+            }
+            if (data.iterator) {
+              // Ping every 15 seconds to keep connection alive.
+              const interval = setInterval(() => {
+                if (response.headersSent) {
+                  response.write('event: ping\n');
+                  response.write(`data: ${new Date().toISOString()}\n\n`);
+                }
+              }, 15000);
+
+              try {
+                response.set({
+                  'Cache-Control': 'no-cache',
+                  'Content-Type': 'text/event-stream',
+                  Connection: 'keep-alive',
+                });
+                response.flushHeaders();
+
+                const result:
+                  | Iterator<any, any, boolean>
+                  | AsyncIterator<any, any, boolean> = method.call(
+                  EntityClass,
+                  ...params,
+                );
+                let sequence = result;
+                if (result instanceof Promise) {
+                  sequence = await result;
+                }
+
+                let { value, done } = await sequence.next(response.destroyed);
+                while (!done) {
+                  response.write('event: next\n');
+                  response.write(`data: ${JSON.stringify(value)}\n\n`);
+                  // Wait for an event loop each iteration, to allow data to flush.
+                  await new Promise((resolve) => setImmediate(resolve));
+
+                  ({ value, done } = await sequence.next(response.destroyed));
+                }
+
+                clearInterval(interval);
+
+                response.write('event: finished\n');
+                response.write('data: \n\n');
+                response.end();
+              } catch (e: any) {
+                clearInterval(interval);
+                eventStreamError(response, 500, e);
+                return;
+              }
             } else {
+              try {
+                const result = method.call(EntityClass, ...params);
+                let ret = result;
+                if (result instanceof Promise) {
+                  ret = await result;
+                }
+                response.status(200);
+                response.setHeader('Content-Type', 'application/json');
+                response.send({ return: ret });
+              } catch (e: any) {
+                httpError(response, 500, e);
+                return;
+              }
+            }
+          } else {
+            let entity: EntityInterface;
+            try {
+              entity = await loadEntity(data.entity, response.locals.nymph);
+            } catch (e: any) {
+              if (e instanceof EntityConflictError) {
+                httpError(response, 409);
+              } else if (e instanceof ForbiddenClassError) {
+                httpError(response, 403);
+              } else if (e.message === NOT_FOUND_ERROR) {
+                httpError(response, 404, e);
+              } else if (e instanceof InvalidParametersError) {
+                httpError(response, 400, e);
+              } else {
+                httpError(response, 500, e);
+              }
+              return;
+            }
+            if (data.entity.guid && !entity.guid) {
+              httpError(response, 400);
+              return;
+            }
+            if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
+              httpError(response, 403);
+              return;
+            }
+            if (
+              !(data.method in entity) ||
+              typeof entity[data.method] !== 'function'
+            ) {
+              httpError(response, 400);
+              return;
+            }
+            try {
+              const result = entity[data.method](...params);
+              let ret = result;
+              if (result instanceof Promise) {
+                ret = await result;
+              }
+              response.status(200);
+              response.setHeader('Content-Type', 'application/json');
+              if (data.stateless) {
+                response.send({ return: ret });
+              } else {
+                response.send({ entity: entity, return: ret });
+              }
+            } catch (e: any) {
               httpError(response, 500, e);
+              return;
             }
-            return;
           }
-          if (data.entity.guid && !entity.guid) {
-            httpError(response, 400);
-            return;
-          }
-          if (entity.$getClientEnabledMethods().indexOf(data.method) === -1) {
+        } catch (e: any) {
+          if (e instanceof ForbiddenClassError) {
             httpError(response, 403);
             return;
-          }
-          if (
-            !(data.method in entity) ||
-            typeof entity[data.method] !== 'function'
-          ) {
-            httpError(response, 400);
-            return;
-          }
-          try {
-            const result = entity[data.method](...params);
-            let ret = result;
-            if (result instanceof Promise) {
-              ret = await result;
-            }
-            response.status(200);
-            response.setHeader('Content-Type', 'application/json');
-            if (data.stateless) {
-              response.send({ return: ret });
-            } else {
-              response.send({ entity: entity, return: ret });
-            }
-          } catch (e: any) {
+          } else {
             httpError(response, 500, e);
             return;
           }
@@ -410,10 +511,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.WRITE_ACCESS
-            )
+              TilmeldAccessLevels.WRITE_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -472,7 +573,7 @@ export function createServer(
     response: NymphResponse,
     action: string,
     data: any,
-    patch: boolean
+    patch: boolean,
   ) {
     if (action === 'uid') {
       if (typeof data.name !== 'string' || typeof data.value !== 'number') {
@@ -481,10 +582,10 @@ export function createServer(
       }
       if (response.locals.nymph.tilmeld) {
         if (
-          !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+          !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
             data.name,
-            TilmeldAccessLevels.FULL_ACCESS
-          )
+            TilmeldAccessLevels.FULL_ACCESS,
+          ))
         ) {
           httpError(response, 403);
           return;
@@ -512,6 +613,7 @@ export function createServer(
       let hadSuccess = false;
       let invalidRequest = false;
       let conflict = false;
+      let forbidden = false;
       let notfound = false;
       let lastException = null;
       for (let entData of data) {
@@ -526,6 +628,8 @@ export function createServer(
         } catch (e: any) {
           if (e instanceof EntityConflictError) {
             conflict = true;
+          } else if (e instanceof ForbiddenClassError) {
+            forbidden = true;
           } else if (e.message === NOT_FOUND_ERROR) {
             notfound = true;
           } else if (e instanceof InvalidParametersError) {
@@ -561,6 +665,8 @@ export function createServer(
       if (!hadSuccess) {
         if (invalidRequest) {
           httpError(response, 400, lastException);
+        } else if (forbidden) {
+          httpError(response, 403);
         } else if (conflict) {
           httpError(response, 409);
         } else if (notfound) {
@@ -605,6 +711,10 @@ export function createServer(
           let EntityClass: EntityConstructor;
           try {
             EntityClass = response.locals.nymph.getEntityClass(entData.class);
+            if (!EntityClass.restEnabled) {
+              httpError(response, 403);
+              return;
+            }
           } catch (e: any) {
             invalidRequest = true;
             failures = true;
@@ -614,7 +724,7 @@ export function createServer(
           try {
             entity = await response.locals.nymph.getEntity(
               { class: EntityClass },
-              { type: '&', guid: entData.guid }
+              { type: '&', guid: entData.guid },
             );
           } catch (e: any) {
             lastException = e;
@@ -661,10 +771,10 @@ export function createServer(
         }
         if (response.locals.nymph.tilmeld) {
           if (
-            !response.locals.nymph.tilmeld.checkClientUIDPermissions(
+            !(await response.locals.nymph.tilmeld.checkClientUIDPermissions(
               data,
-              TilmeldAccessLevels.FULL_ACCESS
-            )
+              TilmeldAccessLevels.FULL_ACCESS,
+            ))
           ) {
             httpError(response, 403);
             return;
@@ -698,15 +808,18 @@ export function createServer(
     entityData: EntityJson | EntityPatch,
     nymph: Nymph,
     patch = false,
-    allowConflict = false
+    allowConflict = false,
   ): Promise<EntityInterface> {
     if (entityData.class === 'Entity') {
       // Don't let clients use the `Entity` class, since it has no validity/AC checks.
       throw new InvalidParametersError(
-        "Can't use Entity class directly from the front end."
+        "Can't use Entity class directly from the front end.",
       );
     }
     let EntityClass = nymph.getEntityClass(entityData.class);
+    if (!EntityClass.restEnabled) {
+      throw new ForbiddenClassError('Not accessible.');
+    }
     let entity: EntityInterface | null;
     if (entityData.guid) {
       entity = await nymph.getEntity(
@@ -714,7 +827,7 @@ export function createServer(
         {
           type: '&',
           guid: `${entityData['guid']}`,
-        }
+        },
       );
       if (entity === null) {
         throw new Error(NOT_FOUND_ERROR);
@@ -739,10 +852,15 @@ export function createServer(
    * @returns The item, converted.
    */
   function referencesToEntities(item: any, nymph: Nymph): any {
-    if (Array.isArray(item)) {
+    if (item == null) {
+      return item;
+    } else if (Array.isArray(item)) {
       if (item.length === 3 && item[0] === 'nymph_entity_reference') {
         try {
-          const EntityClass = nymph.getEntityClass(item[1]);
+          const EntityClass = nymph.getEntityClass(item[2]);
+          if (!EntityClass.restEnabled) {
+            throw new ForbiddenClassError('Not accessible.');
+          }
           return EntityClass.factoryReference(item as EntityReference);
         } catch (e: any) {
           return item;
@@ -770,7 +888,7 @@ export function createServer(
   function httpError(
     res: NymphResponse,
     defaultStatusCode: number,
-    error?: Error & { status?: number; statusText?: string }
+    error?: Error & { status?: number; statusText?: string },
   ) {
     const status = error?.status || defaultStatusCode;
     const statusText =
@@ -780,26 +898,82 @@ export function createServer(
         : error.status in statusDescriptions &&
           statusDescriptions[error.status]) ||
       'Internal Server Error';
+
+    const errorResponse = error
+      ? {
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: error.message,
+          error,
+          ...(process.env.NODE_ENV !== 'production'
+            ? { stack: error.stack }
+            : {}),
+        }
+      : {
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: statusText,
+        };
+
     if (!res.headersSent) {
       res.status(status);
       res.setHeader('Content-Type', 'application/json');
     }
-    if (error) {
-      res.send({
-        textStatus: `${status} ${statusText}`,
-        statusText,
-        message: error.message,
-        error,
-        ...(process.env.NODE_ENV !== 'production'
-          ? { stack: error.stack }
-          : {}),
-      });
+
+    res.send(errorResponse);
+  }
+
+  /**
+   * End the event stream with an HTTP error response.
+   *
+   * @param res The server response object.
+   * @param defaultStatusCode The HTTP status code to use if none is given in the error object.
+   * @param error An optional error object to report.
+   */
+  function eventStreamError(
+    res: NymphResponse,
+    defaultStatusCode: number,
+    error?: Error & { status?: number; statusText?: string },
+  ) {
+    const status = error?.status || defaultStatusCode;
+    const statusText =
+      error?.statusText ||
+      (error?.status == null
+        ? statusDescriptions[defaultStatusCode]
+        : error.status in statusDescriptions &&
+          statusDescriptions[error.status]) ||
+      'Internal Server Error';
+
+    const errorResponse = error
+      ? {
+          status,
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: error.message,
+          error,
+          ...(process.env.NODE_ENV !== 'production'
+            ? { stack: error.stack }
+            : {}),
+        }
+      : {
+          status,
+          textStatus: `${status} ${statusText}`,
+          statusText,
+          message: statusText,
+        };
+
+    if (!res.headersSent) {
+      res.status(status);
+      res.setHeader('Content-Type', 'application/json');
+
+      res.send(errorResponse);
     } else {
-      res.send({
-        textStatus: `${status} ${statusText}`,
-        statusText,
-        message: statusText,
-      });
+      res.write('event: error\n');
+      res.write(`data: ${JSON.stringify(errorResponse)}\n\n`);
+
+      res.write('event: finished\n');
+      res.write('data: \n\n');
+      res.end();
     }
   }