@r2d2bzh/moleculer-authz-helpers 0.0.1 → 1.0.1

package/README.adoc

@@ -20,9 +20,9 @@ Currently, this library provides the following helpers:
 == `addPreflightMixin`
 
 This helper adds a service mixin used to generate preflight actions for actions exposed through rest.
-It takes a Moleculer service schema as a parameter and return the same service schema with the mixin added.
+It takes a Moleculer service schema as a parameter and returns the same service schema with the mixin added.
 
-NOTE: A preflight action takes the same parameters as its action.
+NOTE: A preflight action takes the same parameters as the original action.
 
 To define a preflight handler, you must add a preflight attribute to an action:
 
@@ -38,24 +38,34 @@ To define a preflight handler, you must add a preflight attribute to an action:
         handler: (ctx) => {
           // do preflight checks
           // possibly request for some authorizations through Moleculer events
-        }
-      }
+        },
+      },
+    },
+    'my-other-action': {
+      handler: myOtherActionHandler(),
+      rest: {},
+      preflight: (ctx) => {},
     },
   },
 }
 ----
 
-[NOTE]
+[IMPORTANT]
 ====
-A preflight action declaration can be skipped:
+Only actions where authorization is disabled do not enforce a preflight:
 
 [source,javascript]
 ----
-preflight: {
-  skip: true,
-},
+{
+  'my-action': {
+    handler: myActionHandler(),
+    rest: {
+      authorization: false,
+    },
+  },
+}
 ----
-====
+==== 
 
 == `isAuthorized`
 
@@ -73,6 +83,19 @@ It implements the following rules:
 * if any answer is `false`, the whole authorization process fails
 * if no answer was provided, the whole authorization process fails
 
+The signature of `isAuthorized` is `(logger) => (answer) => true | false`:
+
+. the `logger` curried argument must provide a `warn` method used to issue warnings (default: `console`)
+. the `answer` curried argument is the authorization answer(s) to one or many authorization requests
+
+`isAuthorized` will raise a warning in the following cases:
+
+* an odd authorization answer was provided, known answers are:
+** `true`:: the request is authorized
+** `false`:: the request is denied
+** `undefined`:: the responder is not able to answer
+* multiple `true` or `false` answers were provided to the same authorization request
+
 == `requestAuthorizations`
 
 This helper operates multiple authorization requests at once and returns a promise which result can be handled by `isAuthorized`.

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@r2d2bzh/moleculer-authz-helpers",
-  "version": "0.0.1",
+  "version": "1.0.1",
   "description": "Moleculer mixin to implement preflight runner",
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "test": "c8 ava -v"
+    "pretest": "npm run lint",
+    "test": "c8 ava -v",
+    "lint": "eslint ."
   },
   "keywords": [],
   "author": "",
@@ -17,6 +19,7 @@
     "@r2d2bzh/js-rules": "^0.7.1",
     "ava": "^3.15.0",
     "c8": "^7.10.0",
+    "eslint": "^7.32.0",
     "moleculer": "^0.14.18",
     "uuid": "^8.3.2"
   },
@@ -33,7 +36,7 @@
     ]
   },
   "engines": {
-    "node": ">=10.0.0"
+    "node": ">=12.0.0"
   },
   "peerDependencies": {
     "lodash": "^4.17.21",

package/src/add-preflight-mixin.js

@@ -1,33 +1,22 @@
 import cloneDeep from 'lodash/cloneDeep.js';
 import moleculer from 'moleculer';
+
 const {
-  Service,
   Errors: { MoleculerError },
 } = moleculer;
 
-export default (serviceSchema) => {
-  const { actions } = serviceSchema;
-  const actionsWithPreflight = Object.entries(actions).filter(
-    ([, actionSpecification]) => actionSpecification?.rest && !actionSpecification?.preflight?.skip
+export const unsafeAddPreflightMixin = (serviceSchema) => {
+  const actionsWithPreflight = Object.entries(serviceSchema.actions || {}).filter(
+    ([, actionSpecification]) => actionSpecification?.preflight
   );
 
-  const missingPreflight = actionsWithPreflight
-    .filter(([, actionSpecification]) => !actionSpecification?.preflight?.handler)
-    .map(([actionName]) => actionName);
-
-  if (missingPreflight.length) {
-    throw new MoleculerError('missing preflight handler', 500, 'MISSING_PREFLIGHT', { missingPreflight });
-  }
-
-  const preflightActions = actionsWithPreflight.map(([actionName, { params, preflight } = {}]) => {
-    return [
-      `${actionName}-preflight`,
-      {
-        handler: preflight.handler,
-        ...(params ? { params } : {}),
-      },
-    ];
-  });
+  const preflightActions = actionsWithPreflight.map(([actionName, { params, preflight } = {}]) => [
+    `${actionName}-preflight`,
+    {
+      handler: preflight instanceof Function ? preflight : preflight.handler,
+      ...(params ? { params } : {}),
+    },
+  ]);
 
   const schema = cloneDeep(serviceSchema);
 
@@ -38,8 +27,20 @@ export default (serviceSchema) => {
     ...(serviceSchema.mixins || []),
     {
       actions: Object.fromEntries(preflightActions),
-    }
+    },
   ];
 
   return schema;
 };
+
+export default (serviceSchema) => {
+  Object.entries(serviceSchema.actions || {})
+    .filter(([, actionSpecification]) => actionSpecification?.rest && actionSpecification.rest?.authorization !== false)
+    .forEach(([actionName, actionSpecification]) => {
+      if (!(actionSpecification?.preflight instanceof Function || actionSpecification?.preflight?.handler)) {
+        throw new MoleculerError('missing preflight handler', 500, 'MISSING_PREFLIGHT', { actionName });
+      }
+    });
+
+  return unsafeAddPreflightMixin(serviceSchema);
+};

package/src/is-authorized.js

@@ -1,6 +1,62 @@
-const ensureBoolArray = (something) =>
-  (Array.isArray(something) ? something : [something]).flat(Infinity).filter((response) => response !== undefined);
+const removeUnanswered = (authzAnswers) => authzAnswers.filter((answer) => answer !== undefined);
 
-const someRequestsFailed = (booleanArray) => !booleanArray.length || booleanArray.includes(false);
+const reduceAnswers = (answers, reducer) =>
+  answers.length
+    ? answers.reduce(
+        ([authorizationStatus, authorizationsCount], answer) =>
+          reducer(answer, authorizationStatus, authorizationsCount),
+        [true, 0]
+      )
+    : [false, 0];
 
-export default (something) => !someRequestsFailed(ensureBoolArray(something));
+const onMultipleAuthorizations =
+  (handle) =>
+  ([answersAuthorization, authorizationsCount]) => {
+    if (authorizationsCount > 1) {
+      handle(authorizationsCount);
+    }
+    return answersAuthorization;
+  };
+
+const processAndCountManyAnswers = (warn) => {
+  const warnOnMultipleAuthorizations = onMultipleAuthorizations((authorizationsCount) =>
+    warn(`multiple answers to the same authorization request (${authorizationsCount})`)
+  );
+  return (answers, authorizationStatus) => {
+    const newRequestIsAuthorized = warnOnMultipleAuthorizations(
+      reduceAnswers(removeUnanswered(answers), processAndCountAnswer(warn))
+    );
+    return authorizationStatus && newRequestIsAuthorized;
+  };
+};
+
+const processAndCountAnswer = (warn) => {
+  const doAnswersAuthorize = processAndCountManyAnswers(warn);
+  return function (answer, authorizationStatus = true, authorizationsCount = 0) {
+    switch (Object.prototype.toString.call(answer)) {
+      case '[object Boolean]':
+        return [authorizationStatus && answer, authorizationsCount + 1];
+      case '[object Array]':
+        // A new array means a new authorization request with its own
+        // answers count that does not reflect on the current one
+        return [doAnswersAuthorize(answer, authorizationStatus), authorizationsCount];
+      case '[object Undefined]':
+        return [false, authorizationsCount];
+      default:
+        warn(`odd authorization answer (${answer})`);
+        return [false, authorizationsCount];
+    }
+  };
+};
+
+export default (logger) => {
+  try {
+    const doesAnswerAuthorizeAndWarn = processAndCountAnswer(logger.warn.bind(logger));
+    return function (answer) {
+      const [authorize] = doesAnswerAuthorizeAndWarn(answer);
+      return authorize;
+    };
+  } catch (e) {
+    throw new Error(`logger.warn must be a function`);
+  }
+};