@r2d2bzh/moleculer-authz-helpers 0.0.2 → 2.0.0

package/README.adoc

@@ -83,6 +83,19 @@ It implements the following rules:
 * if any answer is `false`, the whole authorization process fails
 * if no answer was provided, the whole authorization process fails
 
+The signature of `isAuthorized` is `(logger) => (answer) => true | false`:
+
+. the `logger` curried argument must provide a `warn` method used to issue warnings (default: `console`)
+. the `answer` curried argument is the authorization answer(s) to one or many authorization requests
+
+`isAuthorized` will raise a warning in the following cases:
+
+* an odd authorization answer was provided, known answers are:
+** `true`:: the request is authorized
+** `false`:: the request is denied
+** `undefined`:: the responder is not able to answer
+* multiple `true` or `false` answers were provided to the same authorization request
+
 == `requestAuthorizations`
 
 This helper operates multiple authorization requests at once and returns a promise which result can be handled by `isAuthorized`.

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@r2d2bzh/moleculer-authz-helpers",
-  "version": "0.0.2",
+  "version": "2.0.0",
   "description": "Moleculer mixin to implement preflight runner",
   "main": "index.js",
   "type": "module",
   "scripts": {
-    "test": "c8 ava -v"
+    "pretest": "npm run lint",
+    "test": "c8 ava -v",
+    "lint": "eslint ."
   },
   "keywords": [],
   "author": "",
@@ -17,6 +19,7 @@
     "@r2d2bzh/js-rules": "^0.7.1",
     "ava": "^3.15.0",
     "c8": "^7.10.0",
+    "eslint": "^7.32.0",
     "moleculer": "^0.14.18",
     "uuid": "^8.3.2"
   },
@@ -33,7 +36,7 @@
     ]
   },
   "engines": {
-    "node": ">=10.0.0"
+    "node": ">=12.0.0"
   },
   "peerDependencies": {
     "lodash": "^4.17.21",

package/src/add-preflight-mixin.js

@@ -1,7 +1,7 @@
 import cloneDeep from 'lodash/cloneDeep.js';
 import moleculer from 'moleculer';
+
 const {
-  Service,
   Errors: { MoleculerError },
 } = moleculer;
 
@@ -10,14 +10,13 @@ export const unsafeAddPreflightMixin = (serviceSchema) => {
     ([, actionSpecification]) => actionSpecification?.preflight
   );
 
-  const preflightActions = actionsWithPreflight.map(([actionName, { params, preflight } = {}]) => ([
-      `${actionName}-preflight`,
-      {
-        handler: preflight instanceof Function ? preflight : preflight.handler,
-        ...(params ? { params } : {}),
-      },
-    ])
-  );
+  const preflightActions = actionsWithPreflight.map(([actionName, { params, preflight } = {}]) => [
+    `${actionName}-preflight`,
+    {
+      handler: preflight instanceof Function ? preflight : preflight.handler,
+      ...(params ? { params } : {}),
+    },
+  ]);
 
   const schema = cloneDeep(serviceSchema);
 
@@ -28,20 +27,20 @@ export const unsafeAddPreflightMixin = (serviceSchema) => {
     ...(serviceSchema.mixins || []),
     {
       actions: Object.fromEntries(preflightActions),
-    }
+    },
   ];
 
   return schema;
 };
 
 export default (serviceSchema) => {
-  Object.entries(serviceSchema.actions || {}).filter(
-    ([, actionSpecification]) => (actionSpecification?.rest?.authorization !== false)
-  ).forEach(([actionName, actionSpecification]) => {
-    if (!((actionSpecification?.preflight instanceof Function) || actionSpecification?.preflight?.handler)) {
-      throw new MoleculerError('missing preflight handler', 500, 'MISSING_PREFLIGHT', { actionName }); 
-    }
-  });
+  Object.entries(serviceSchema.actions || {})
+    .filter(([, actionSpecification]) => actionSpecification?.rest && actionSpecification.rest?.authorization !== false)
+    .forEach(([actionName, actionSpecification]) => {
+      if (!(actionSpecification?.preflight instanceof Function || actionSpecification?.preflight?.handler)) {
+        throw new MoleculerError('missing preflight handler', 500, 'MISSING_PREFLIGHT', { actionName });
+      }
+    });
 
   return unsafeAddPreflightMixin(serviceSchema);
-};
+};

package/src/is-authorized.js

@@ -1,6 +1,62 @@
-const ensureBoolArray = (something) =>
-  (Array.isArray(something) ? something : [something]).flat(Infinity).filter((response) => response !== undefined);
+const removeUnanswered = (authzAnswers) => authzAnswers.filter((answer) => answer !== undefined);
 
-const someRequestsFailed = (booleanArray) => !booleanArray.length || booleanArray.includes(false);
+const reduceAnswers = (answers, reducer) =>
+  answers.length
+    ? answers.reduce(
+        ([authorizationStatus, authorizationsCount], answer) =>
+          reducer(answer, authorizationStatus, authorizationsCount),
+        [true, 0]
+      )
+    : [false, 0];
 
-export default (something) => !someRequestsFailed(ensureBoolArray(something));
+const onMultipleAuthorizations =
+  (handle) =>
+  ([answersAuthorization, authorizationsCount]) => {
+    if (authorizationsCount > 1) {
+      handle(authorizationsCount);
+    }
+    return answersAuthorization;
+  };
+
+const processAndCountManyAnswers = (warn) => {
+  const warnOnMultipleAuthorizations = onMultipleAuthorizations((authorizationsCount) =>
+    warn(`multiple answers to the same authorization request (${authorizationsCount})`)
+  );
+  return (answers, authorizationStatus) => {
+    const newRequestIsAuthorized = warnOnMultipleAuthorizations(
+      reduceAnswers(removeUnanswered(answers), processAndCountAnswer(warn))
+    );
+    return authorizationStatus && newRequestIsAuthorized;
+  };
+};
+
+const processAndCountAnswer = (warn) => {
+  const doAnswersAuthorize = processAndCountManyAnswers(warn);
+  return function (answer, authorizationStatus = true, authorizationsCount = 0) {
+    switch (Object.prototype.toString.call(answer)) {
+      case '[object Boolean]':
+        return [authorizationStatus && answer, authorizationsCount + 1];
+      case '[object Array]':
+        // A new array means a new authorization request with its own
+        // answers count that does not reflect on the current one
+        return [doAnswersAuthorize(answer, authorizationStatus), authorizationsCount];
+      case '[object Undefined]':
+        return [false, authorizationsCount];
+      default:
+        warn(`odd authorization answer (${answer})`);
+        return [false, authorizationsCount];
+    }
+  };
+};
+
+export default (logger) => {
+  try {
+    const doesAnswerAuthorizeAndWarn = processAndCountAnswer(logger.warn.bind(logger));
+    return function (answer) {
+      const [authorize] = doesAnswerAuthorizeAndWarn(answer);
+      return authorize;
+    };
+  } catch (e) {
+    throw new Error(`logger.warn must be a function`);
+  }
+};