@samanbayaka/core-gtwy 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,58 @@
+# demo
+
+## 0.0.2
+
+### Patch Changes
+
+- chore: pkg sanitize
+- Updated dependencies
+  - @samanbayaka/core@0.0.11
+
+## 0.0.2
+
+### Patch Changes
+
+- chore: update workspace lockfile
+- Updated dependencies
+  - @samanbayaka/core@0.0.11
+
+## 0.0.3
+
+### Patch Changes
+
+- chore: update workspac
+- Updated dependencies
+  - @samanbayaka/core@0.0.11
+
+## 0.0.2
+
+### Patch Changes
+
+- 314257a: new
+- Updated dependencies [314257a]
+  - @samanbayaka/core@0.0.11
+
+## 0.0.2
+
+### Patch Changes
+
+- fixed
+- Updated dependencies
+  - @samanbayaka/core@0.0.11
+
+## 0.1.0
+
+### Minor Changes
+
+- dfc8940: fixed
+
+### Patch Changes
+
+- fixed
+- 65fb2ca: fixed
+- b845d66: fixed
+- Updated dependencies
+- Updated dependencies [65fb2ca]
+- Updated dependencies [b845d66]
+- Updated dependencies [dfc8940]
+  - @samanbayaka/core@0.1.0

package/index.mjs

@@ -0,0 +1,207 @@
+import ApiGateway from "moleculer-web"
+import cookieParser from "cookie-parser"
+import bodyParser from "body-parser"
+import helmet from "helmet"
+import compression from "compression"
+
+import core from "@samanbayaka/core"
+import * as tokenValidator from './src/access-token-validator.mjs'
+
+/**
+ * Regx pattern to allow cors sutes and cors origins
+ * @type {String}
+ */
+const patternTxt = (await core.getConfigs(`/config/sbk/edge/CORS`)) || undefined
+const reqOriginRegex = patternTxt ? new RegExp(patternTxt, "i") : undefined
+
+const gtwySchema = {
+  name: "gtwy",
+  mixins: [
+    ApiGateway,
+  ],
+
+  settings: {
+    port: 3000,
+
+    /**
+     * Middleware mode (for ExpressJS)
+     */
+    middleware: false,
+
+    /**
+     * Exposed global path prefix
+     */
+    // path: "/sbk",
+
+    /**
+     * Global middlewares. Applied to all routes.
+     */
+    use: [
+      compression(),
+      cookieParser(),
+      bodyParser.raw({
+        type: [
+          "application/octet-stream",
+          "multipart/form-data",
+        ],
+        limit: "50mb"
+      }),
+      helmet(),
+    ],
+
+    cors: reqOriginRegex ? {
+      origin: (reqOrigin) => {
+        if (!reqOrigin) return true
+        const { hostname } = new URL(reqOrigin)
+        return reqOriginRegex.test(hostname)
+      },
+
+      credentials: true
+    } : undefined,
+
+    routes: [
+      // // Public routes
+      // {
+      //   path: "",
+      //   authorization: false,
+
+      //   onBeforeCall(ctx, route, req, res) {
+      //     ctx.meta.method = req?.method
+      //     ctx.meta.headers = req?.headers
+      //     ctx.meta.cookies = req?.cookies
+      //   },
+
+      //   whitelist: [
+      //     "gateway.apiDesc",
+      //     "gateway.apiVer",
+      //     /**
+      //      * Access any actions in 'system' service
+      //      */
+      //     /^auth\.(?!listAliases$)\w+(?:\.\w+)*$/
+      //   ],
+
+
+      //   aliases: {
+      //     "GET /sbk/version": "gateway.apiVer",
+      //     "GET /sbk/description": "gateway.apiDesc",
+      //   },
+
+      //   autoAliases: true,
+      //   mergeParams: false,
+      //   logging: false,
+
+      // },
+
+      /**
+       * Protected API routes
+       */
+      {
+        path: "/sbk/api",
+        authentication: true,
+        authorization: true,
+        onBeforeCall(ctx, route, req, res) {
+          ctx.meta.method = req?.method
+          ctx.meta.headers = req?.headers
+          ctx.meta.cookies = req?.cookies
+        },
+        whitelist: [
+          /**
+           * Access any actions except 'gateway', 'system', 'oidc', and 'auth' service
+           */
+          /^(?!(gateway|system|core.auth|auth|oidc|asset|dbs.pg)\.)\w+(?:\.\w+)*$/
+        ],
+
+        autoAliases: true,
+        mergeParams: false,
+        mappingPolicy: "restrict",
+        logging: true,
+
+        /**
+         * Use bodyparser module
+         */
+        bodyParsers: {
+          json: true,
+          urlencoded: { extended: true },
+          text: {
+            type: [
+              "text/plain",
+              "application/xml",
+              "application/yaml",
+              "text/xml",
+            ]
+          }
+        },
+      },
+    ],
+
+
+    // /**
+    //  * Logging request parameters with 'info' level
+    //  */
+    logRequestParams: null,
+
+    
+    // /**
+    //  * Logging response data with 'debug' level
+    //  */
+    logResponseData: false,
+
+
+    /**
+     * Global error handler
+     */
+    onError(req, res, err) {
+      
+      core.httpErrorFormatter(req, res, err)
+
+      /**
+       * Custom logging
+       */
+      this.logResponse(req, res)
+    }
+  
+  },
+
+
+  // actions: {
+  //   apiDesc:{
+  //     openapi: {
+  //       summary: "API Description",
+  //       description: "Returns a textual description of the API."
+  //     },
+  //     handler: (ctx) => {
+  //       return ctx.call("system.info.apiDesc")
+  //     }
+  //   },
+
+  //   apiVer: {
+  //     openapi: {
+  //       summary: "API Version",
+  //       description: "Returns the current version of the API."
+  //     },
+  //     handler: (ctx) => {
+  //       return ctx.call("system.info.apiVer")
+  //     },
+  //   }, 
+  // },
+
+
+  methods: {
+    /**
+     * This overrides the errorHandler method found in the official file
+     */
+    errorHandler(req, res, err) {
+      // // don't log client side errors unless it's configured
+      // if (this.settings.log4XXResponses || (err && !_.inRange(err.code, 400, 500))) {
+      //   this.logger.error("   Request error!", err.name, ":", err.message, "\n", err.stack, "\nData:", err.data);
+      // }
+      this.sendError(req, res, err)
+    },
+    authenticate: tokenValidator.authenticate,
+    authorize: tokenValidator.authorize,
+  },
+}
+export default {
+	...core,
+	schema: gtwySchema,
+}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@samanbayaka/core-gtwy",
+  "version": "0.0.1",
+  "description": "",
+  "main": "index.mjs",
+  "type": "module",
+  "exports": {
+    ".": "./index.mjs"
+  },
+  "files": [
+    "index.mjs",
+    "src/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "body-parser": "^2.3.0",
+    "compression": "^1.8.1",
+    "cookie-parser": "^1.4.7",
+    "helmet": "^8.2.0",
+    "jsonwebtoken": "^9.0.3",
+    "jwks-rsa": "^4.0.1",
+    "moleculer-web": "^0.11.0",
+    "@samanbayaka/core": "0.0.10"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  }
+}

package/src/access-token-validator.mjs

@@ -0,0 +1,249 @@
+import { Errors } from "moleculer"
+import ApiGateway from "moleculer-web"
+import jwt from "jsonwebtoken"
+import jwksClient from "jwks-rsa"
+
+import core from "@samanbayaka/core"
+
+const ACCESS_ROLES = await core.getConfigs('/config/sbk/edge/yaml/roles')
+const OPENID_CONFIG = await core.getConfigs('/config/sbk/edge/yaml/auth')
+export const {clientId} = OPENID_CONFIG
+
+/**
+ * Initializes OpenID Connect configuration and JWKS client.
+ *
+ * Fetches the OpenID configuration document from the configured
+ * issuer endpoint and creates a cached JWKS client for JWT
+ * signature verification.
+ *
+ * The JWKS client supports:
+ * - Automatic key retrieval
+ * - In-memory caching
+ * - Request rate limiting
+ *
+ * @async
+ * @function getOpenidConfigs
+ *
+ * @throws {Error} Throws if the OpenID configuration request fails
+ * or the response cannot be parsed.
+ *
+ * @returns {Promise<void>}
+ */
+const getOpenidConfigs = async () => {
+
+  const response = await fetch(OPENID_CONFIG.url)
+
+  if ( !response.ok ) {
+    throw new Error(
+      `OpenID configuration endpoint failed with status "${response.status}"`
+    )
+  }
+
+  return await response.json()
+}
+
+export const {
+  issuer,
+  jwks_uri: jwksUri,
+  authorization_endpoint: authorizationEndpoint,
+  token_endpoint: tokenEndpoint,
+  end_session_endpoint: endSessionEndpoint,
+} = await getOpenidConfigs()
+
+const client = jwksClient({
+  ...OPENID_CONFIG.jwksClient,
+  jwksUri: jwksUri,
+})
+
+const issuers = ((iss) => {
+  const httpUrl = new URL(iss)
+  httpUrl.protocol = "http:"
+  httpUrl.port = String(OPENID_CONFIG.kcPort)
+  return [
+    iss,
+    httpUrl.toString(),
+  ]
+})(issuer)
+
+
+/**
+ * Retrieves the public signing key corresponding to a JWT `kid`.
+ *
+ * Used by JWT verification libraries (such as `jsonwebtoken`)
+ * to dynamically resolve signing keys from a JWKS endpoint.
+ *
+ * @param {Object} header - Decoded JWT header.
+ * @param {string} header.kid - Key ID used to identify the signing key.
+ * @param {Function} callback - Callback function invoked after key retrieval.
+ * @param {Error|null} callback.err - Error object if key retrieval fails.
+ * @param {string|null} callback.key - PEM formatted public key.
+ *
+ * @returns {void}
+ */
+const getKey = (header, callback) => {
+
+  client.getSigningKey(
+    header.kid,
+    (err, key) => {
+
+      if (err) {
+        callback(err)
+        return
+      }
+
+      callback(
+        null,
+        key.publicKey || key.rsaPublicKey
+      )
+    }
+  )
+
+}
+
+
+
+/**
+ * Authenticates the requester by verifying the access token.
+ * The token can be provided either in the Bearer Authorization header
+ * or in cookies.
+ *
+ * @param {Context} ctx - Moleculer service context
+ * @param {Object} route - REST route configuration object
+ * @param {HTTP request<Object>} req - HTTP request object
+ * @returns {Promise<Object>} Authenticated user / authorization result
+ */
+export const authenticate = async (ctx, route, req, res) => {
+
+  let token = null
+
+  const auth =
+    req.headers.authorization
+
+  if (auth?.startsWith("Bearer ")) {
+    token = auth.replace(/^Bearer\s+/i, "")
+  }
+
+
+  if (
+    !token &&
+    req.cookies?.WbsedclAccessToken
+  ) {
+    token = req.cookies?.WbsedclAccessToken
+  }
+
+
+  if (!token) {
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_NO_TOKEN
+    )
+  }
+
+  try {
+    const decoded =
+      await new Promise((resolve, reject) => {
+
+        jwt.verify(
+          token,
+          getKey,
+          {
+            algorithms: OPENID_CONFIG.jwtVerifyAlgo,
+            issuers,
+            // audience: OPENID_CONFIG.audience,
+          },
+
+          (err, dec) => {
+
+            if (err) {
+              reject(err)
+              return
+            }
+
+            resolve(dec)
+          }
+        )
+      })
+
+    ctx.broker.logger.debug({tag: "SBK", message: "Decoded Token Object", token: decoded, OPENID_CONFIG, issuers})
+    // ctx.meta.user = {
+    //   sessionId: decoded?.sid,
+    //   id: decoded?.sub,
+    //   userId: (decoded?.sub).split(":").at(-1),
+    //   username: decoded?.preferred_username,
+    //   firstName: decoded?.given_name,
+    //   lastName: decoded?.family_name,
+    //   fullName: [...new Set(decoded?.name.split(/\s+/))].join(" "),
+    //   emailIds: decoded?.email,
+    //   mobileNos: decoded?.mobile_no,
+    //   userRoles: decoded?.user_role,
+    // }
+    return decoded
+
+  } catch (err) {
+    ctx.broker.logger.debug({tag: "SBK", OPENID_CONFIG})
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_INVALID_TOKEN
+    )
+  }
+}
+
+/**
+ * Verifies the user's roles and access grants before authorizing
+ * access to the requested resource.
+ * @param  {object} ctx   [description]
+ * @param  {object} route [description]
+ * @param  {object} req   [description]
+ * @param  {object} res   [description]
+ * @return {object}       [description]
+ */
+export const authorize = async(ctx, route, req, res) => {
+
+  ctx.broker.logger.debug({tag: "SBK", message: "User Profile"}, ctx.meta.user, route?.path)
+
+  if( ctx.meta?.user?.preferred_username === undefined ){
+    throw new ApiGateway.Errors.UnAuthorizedError(
+      ApiGateway.Errors.ERR_INVALID_TOKEN
+    )
+  }
+
+  ctx.broker.logger.debug({tag: "SBK", message: "ACCESS_ROLES", ACCESS_ROLES, resource_access: ctx.meta.user.resource_access})
+
+  // resource_access
+
+  // const aa = new RegExp("^/system/oidc(?:/.*)?$", "i")
+  // if()
+
+  // if( req.url.startsWith("/system" ){
+
+  // }
+
+
+  // /**
+  //  * Resticed accessor can't access all resources
+  //  */
+  // if( ctx.meta?.user?.preferred_username == OPENID_CONFIG.rAccessor ){
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  // if( ctx.meta.user?.azp == clientId && req.url.startsWith(OPENID_CONFIG.rRoute)) {
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  // if( ctx.meta.user?.azp == OPENID_CONFIG.rAccessor && !req.url.startsWith(OPENID_CONFIG.rRoute)) {
+  //   throw new Errors.MoleculerError(
+  //     "You are not authorized to access this resource",
+  //     403,
+  //     "FORBIDDEN"
+  //   )
+  // }
+
+  return Promise.resolve(ctx)
+}
+