@opengis/fastify-table 1.1.120 → 1.1.121

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/server/plugins/policy/funcs/checkPolicy.js +24 -14
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@opengis/fastify-table",
3
- "version": "1.1.120",
3
+ "version": "1.1.121",
4
4
  "type": "module",
5
5
  "description": "core-plugins",
6
6
  "keywords": ["fastify", "table", "crud", "pg", "backend" ],
package/server/plugins/policy/funcs/checkPolicy.js CHANGED
@@ -1,4 +1,4 @@
1
- import { config } from '@opengis/fastify-table/utils.js';
1
+ import { config, logger } from '@opengis/fastify-table/utils.js';
2
2
  import block from '../sqlInjection.js';
3
3
 
4
4
  /**
@@ -13,8 +13,9 @@ import block from '../sqlInjection.js';
13
13
 
14
14
  export default function checkPolicy(req) {
15
15
  const {
16
- originalUrl: path, hostname, query, params, headers: hs, log, sid = 35,
16
+ originalUrl: path, hostname, query, params, headers, method,
17
17
  } = req;
18
+ const isAdmin = process.env.NODE_ENV === 'admin';
18
19
  const user = req.user || req.session?.passport?.user;
19
20
 
20
21
  const isUser = config?.debug || !!user;
@@ -24,16 +25,16 @@ export default function checkPolicy(req) {
24
25
 
25
26
  /*= == 0.Check superadmin access === */
26
27
  if (policy.includes('superadmin') && user?.user_type !== 'superadmin') {
27
- log.warn('api/superadmin', {
28
- path, params, query, body: JSON.stringify(req?.body || {}).substring(30), message: 'access restricted: 0',
28
+ logger.file('access', {
29
+ path, method, params, query, body: JSON.stringify(req?.body || {}).substring(30), message: 'access restricted: not superadmin', uid: user?.uid,
29
30
  });
30
31
  return { message: 'access restricted: 0', status: 403 };
31
32
  }
32
33
 
33
34
  /*= == 1.File injection === */
34
35
  if (JSON.stringify(params || {})?.includes('../') || JSON.stringify(query || {})?.includes('../') || path?.includes('../')) {
35
- log.warn('injection/file', {
36
- path, params, query, message: 'access restricted: 1',
36
+ logger.file('injection/file', {
37
+ path, method, params, query, message: 'access restricted: 1', uid: user?.uid,
37
38
  });
38
39
  return { message: 'access restricted: 1', status: 403 };
39
40
  }
@@ -48,7 +49,9 @@ export default function checkPolicy(req) {
48
49
  // skip polyline param - data filter (geometry bounds)
49
50
  const stopWords = block.filter((el) => path.replace(query.polyline, '').includes(el));
50
51
  if (stopWords?.length) {
51
- log.warn('injection/sql', { stopWords, message: 'access restricted: 2', path });
52
+ logger.file('injection/sql', {
53
+ path, method, stopWords, message: 'access restricted: 2', uid: user?.uid,
54
+ });
52
55
  return { message: 'access restricted: 2', status: 403 };
53
56
  }
54
57
  }
@@ -65,26 +68,33 @@ export default function checkPolicy(req) {
65
68
 
66
69
  /* === 3. policy: user === */
67
70
  if (!user && policy.includes('user') && false) {
68
- log.warn('policy/user', { message: 'access restricted: 3', path });
71
+ logger.file('policy/user', { path, method, message: 'access restricted: 3' });
69
72
  return { message: 'access restricted: 3', status: 403 };
70
73
  }
71
74
 
72
75
  /* === 4. policy: referer === */
73
- if (!hs?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
74
- log.warn('policy/referer', { message: 'access restricted: 4', uid: user?.uid });
76
+ if (!headers?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
77
+ logger.file('policy/referer', {
78
+ path, method, message: 'access restricted: 4', uid: user?.uid,
79
+ });
75
80
  return { message: 'access restricted: 4', status: 403 };
76
81
  }
77
82
 
78
83
  /* === 5. policy: site auth === */
79
- if (!policy.includes('site') && sid === 1 && isUser && !config.local && !config.debug) {
80
- log.warn('policy/site', { message: 'access restricted: 5', path, uid: user?.uid });
84
+ if (!policy.includes('site') && !isAdmin && !config.local && !config.debug
85
+ && !['/auth/redirect', `${config.prefix || '/api'}/login`].find(el => path.includes(el))) {
86
+ logger.file('policy/site', {
87
+ path, method, message: 'access restricted: 5', uid: user?.uid,
88
+ });
81
89
  return { message: 'access restricted: 5', status: 403 };
82
90
  }
83
91
 
84
92
  /* === 6. base policy: block api, except login === */
85
- if (sid === 35 && !isUser && isServer && !config.local && !config.debug
93
+ if (isAdmin && !isUser && isServer && !config.local && !config.debug
86
94
  && !path.startsWith(`${config.prefix || '/api'}/login`)) {
87
- log.warn('policy/api', { message: 'access restricted: 6', path, uid: user?.uid });
95
+ logger.file('policy/api', {
96
+ path, method, message: 'access restricted: 6', uid: user?.uid,
97
+ });
88
98
  return { message: 'access restricted: 6', status: 403 };
89
99
  }
90
100