@opengis/fastify-table 1.2.55 → 1.2.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/fastify-table",
-  "version": "1.2.55",
+  "version": "1.2.57",
   "type": "module",
   "description": "core-plugins",
   "keywords": [
@@ -16,7 +16,8 @@
     "index.js",
     "utils.js",
     "config.js",
-    "dblist.js"
+    "dblist.js",
+    "redactionList.js"
   ],
   "scripts": {
     "lint": "eslint . --ext .vue,.js,.jsx,.cjs,.mjs,.ts,.tsx,.cts,.mts --fix --ignore-path .gitignore",

package/redactionList.js

@@ -0,0 +1,7 @@
+import fs from 'node:fs';
+
+const redactionList = ['clientSecret', 'clientId'];
+
+const customRedactionList = fs.existsSync('redactionList.json') ? JSON.parse(fs.readFileSync('redactionList.json')) : [];
+
+export default redactionList.concat(customRedactionList);

package/server/plugins/logger/getLogger.js

@@ -1,7 +1,7 @@
 import pino from 'pino';
 // import path from 'node:path';
 
-import { config, getRedis } from '../../../utils.js';
+import { config, getRedis, redactionList } from '../../../utils.js';
 
 // utils
 import getHooks from './getHooks.js';
@@ -31,11 +31,19 @@ const options = {
     },
     ],
   },
+  redact: redactionList,
 };
 const logger = pino(options);
+
 logger.file = function userFile(logfolder, msg, req) {
   logger.info({ logfolder, ...(typeof msg === 'string' ? { msg } : msg) }, req);
 };
+
+if (config.debug) {
+  logger.file('test/redaction', { clientId: 'should be redacted', clientSecret: 'should be redacted' });
+}
+
+
 logger.metrics = function metrics(key, val, dbName) {
   const dbname = dbName || config.pg?.database;
   if (!dbname && !isServer) return;

package/server/plugins/policy/funcs/checkPolicy.js

@@ -2,6 +2,8 @@ import { config, logger } from '../../../../utils.js';
 import block from '../sqlInjection.js';
 
 const { skipCheckPolicyRoutes = [] } = config;
+
+const skipCheckPolicy = (path) => skipCheckPolicyRoutes.find(el => path.includes(el));
 /**
  * Middleware func
  *
@@ -74,12 +76,12 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === policy: public === */
-  if (policy.includes('public')) {
+  if (policy.includes('public') || skipCheckPolicy(path)) {
     return null;
   }
 
   /* === 0. policy: unauthorized access from admin URL === */
-  if (!validToken && !user?.uid && !config.auth?.disable && isAdmin && !policy.includes('public') && !skipCheckPolicyRoutes.filter((el) => el).find(el => req.url.includes(el))) {
+  if (!validToken && !user?.uid && !config.auth?.disable && isAdmin && !policy.includes('public')) {
     logger.file('policy/unauthorized', {
       path, method, params, query, body, token: headers?.token, userId: headers?.uid, ip: req.ip, headers, message: 'unauthorized',
     });
@@ -87,7 +89,7 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 3. policy: user === */
-  if (!validToken && !user && policy.includes('user')) {
+  if (!validToken && !user && policy.includes('user') && !skipCheckPolicy(path)) {
     logger.file('policy/user', {
       path, method, params, query, body, message: 'access restricted: 3',
     });
@@ -103,17 +105,15 @@ export default function checkPolicy(req, reply) {
   }
 
   /* === 5. policy: site auth === */
-  if (!validToken && !policy.includes('site') && !isAdmin && !config.local && !config.debug && !unittest
-    && !['/auth/redirect', '/logout', `${config.prefix || '/api'}/login`].find(el => path.includes(el))) {
+  if (!validToken && !policy.includes('site') && !isAdmin && !config.local && !config.debug && !unittest) {
     logger.file('policy/site', {
       path, method, params, query, body, message: 'access restricted: 5', uid: user?.uid,
     });
     return reply.status(403).send('access restricted: 5');
   }
 
-  /* === 6. base policy: block api, except login  === */
-  if (!validToken && isAdmin && !isUser && isServer && !config.local && !config.debug
-    && !path.startsWith(`${config.prefix || '/api'}/login`)) {
+  /* === 6. base policy: block non-public api w/ out authorization  === */
+  if (!validToken && isAdmin && !isUser && isServer && !config.local && !config.debug) {
     logger.file('policy/api', {
       path, method, params, query, body, message: 'access restricted: 6', uid: user?.uid,
     });

package/utils.js

@@ -64,6 +64,7 @@ import logger from './server/plugins/logger/getLogger.js';
 // utils
 import config from './config.js';
 import dblist from './dblist.js';
+import redactionList from './redactionList.js';
 import eventStream from './server/plugins/util/funcs/eventStream.js';
 import isFileExists from './server/plugins/crud/funcs/isFileExists.js';
 import getFolder from './server/plugins/crud/funcs/utils/getFolder.js';
@@ -77,6 +78,7 @@ export default null;
 export {
   config,
   dblist,
+  redactionList,
   getFolder,
   handlebars,
   handlebarsSync,