@opengis/fastify-table 1.2.21 → 1.2.23

package/index.js

@@ -78,5 +78,6 @@ async function plugin(fastify, opt) {
   propertiesRoutes(fastify, opt);
   tableRoutes(fastify, opt);
   utilRoutes(fastify, opt);
+  fastify.get('/api/test-proxy', {}, (req) => req.headers);
 }
 export default fp(plugin);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.2.21",
+  "version": "1.2.23",
   "type": "module",
   "description": "core-plugins",
   "keywords": [

package/server/plugins/policy/funcs/checkPolicy.js

@@ -70,15 +70,17 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 0. policy: unauthorized access from admin URL === */
-  if (!user?.uid && !config.auth?.disable && isAdmin && !policy.includes('public') && !skipCheckPolicyRoutes.filter((el) => el).find(el => req.url.includes(el))) {
+  const refererHost = headers?.referer?.match?.(/(https?:\/\/[^\/]+)/g)?.[0];
+  const validToken = headers?.token && refererHost && config.auth?.tokens?.[refererHost] === headers.token;
+  if (!validToken && !user?.uid && !config.auth?.disable && isAdmin && !policy.includes('public') && !skipCheckPolicyRoutes.filter((el) => el).find(el => req.url.includes(el))) {
     logger.file('policy/unauthorized', {
-      path, method, params, query, body, message: 'unauthorized',
+      path, method, params, query, body, referer: refererHost, token: headers?.token, headers, message: 'unauthorized',
     });
     return reply.status(401).send('unauthorized');
   }
 
   /* === 3. policy: user === */
-  if (!user && policy.includes('user')) {
+  if (!validToken && !user && policy.includes('user')) {
     logger.file('policy/user', {
       path, method, params, query, body, message: 'access restricted: 3',
     });
@@ -86,7 +88,7 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 4. policy: referer === */
-  if (!headers?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
+  if (!validToken && !headers?.referer?.includes?.(hostname) && policy.includes('referer') && !config.local && !config.debug) {
     logger.file('policy/referer', {
       path, method, params, query, body, message: 'access restricted: 4', uid: user?.uid,
     });
@@ -94,7 +96,7 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 5. policy: site auth === */
-  if (!policy.includes('site') && !isAdmin && !config.local && !config.debug && !unittest
+  if (!validToken && !policy.includes('site') && !isAdmin && !config.local && !config.debug && !unittest
     && !['/auth/redirect', '/logout', `${config.prefix || '/api'}/login`].find(el => path.includes(el))) {
     logger.file('policy/site', {
       path, method, params, query, body, message: 'access restricted: 5', uid: user?.uid,
@@ -103,7 +105,7 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 6. base policy: block api, except login  === */
-  if (isAdmin && !isUser && isServer && !config.local && !config.debug
+  if (!validToken && isAdmin && !isUser && isServer && !config.local && !config.debug
     && !path.startsWith(`${config.prefix || '/api'}/login`)) {
     logger.file('policy/api', {
       path, method, params, query, body, message: 'access restricted: 6', uid: user?.uid,
@@ -111,5 +113,6 @@ export default function checkPolicy(req, reply) {
     return reply.status(403).send('access restricted: 6');
   }
 
+  // console.log(headers);
   return null;
 }