@signal24/dk-server-foundation 26.213.615

package/src/helpers/redis/redis.ts

@@ -0,0 +1,60 @@
+import RedisClient, { RedisOptions } from 'ioredis';
+
+import { getAppConfig } from '../../app/resolver';
+import { getPackageName } from '../io/package';
+
+export function createRedisOptions(configPrefix?: string): { options: RedisOptions; prefix: string } {
+    const config = { ...getAppConfig() };
+
+    if (configPrefix) {
+        for (const key in config) {
+            if (key.startsWith(`${configPrefix}_REDIS_`)) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                (config as any)[key.substring(configPrefix.length + 1)] = (config as any)[key];
+            }
+        }
+    }
+
+    const prefix = config.REDIS_PREFIX ?? getPackageName() ?? 'app';
+
+    if (config.REDIS_SENTINEL_HOST) {
+        const options: RedisOptions = {
+            sentinels: [
+                {
+                    host: config.REDIS_SENTINEL_HOST,
+                    port: config.REDIS_SENTINEL_PORT
+                }
+            ],
+            name: config.REDIS_SENTINEL_NAME
+        };
+        return { options, prefix };
+    }
+
+    if (config.REDIS_HOST) {
+        const options: RedisOptions = { host: config.REDIS_HOST, port: config.REDIS_PORT };
+        return { options, prefix };
+    }
+
+    throw new Error('REDIS_HOST or REDIS_SENTINEL_HOST must be configured');
+}
+
+const allClients = new Set<RedisClient>();
+
+export function createRedis(configPrefix?: string): {
+    client: RedisClient;
+    prefix: string;
+} {
+    const { options, prefix } = createRedisOptions(configPrefix);
+    const client = new RedisClient(options);
+    allClients.add(client);
+    client.on('end', () => allClients.delete(client));
+    return { client, prefix };
+}
+
+export async function disconnectAllRedis(): Promise<void> {
+    const clients = [...allClients];
+    allClients.clear();
+    await Promise.all(clients.map(c => c.quit().catch(() => {})));
+}
+
+// todo: register Redis instances with healthcheck controller

package/src/helpers/security/crypto.ts

@@ -0,0 +1,133 @@
+import { randomBytes as nativeRandomBytes } from 'crypto';
+import * as crypto from 'crypto';
+import { promisify } from 'util';
+
+import { getAppConfig } from '../../app/resolver';
+
+const nativeAsyncRandomBytes = promisify(nativeRandomBytes);
+
+// TODO: slice long requests into multiple async requests as not to block the thread for too long
+
+export async function randomBytes(length: number, shouldReturnHex?: never): Promise<Buffer>;
+export async function randomBytes(length: number, shouldReturnHex: true): Promise<string>;
+export async function randomBytes(length: number, shouldReturnHex?: true | never): Promise<Buffer | string> {
+    const bytes = await nativeAsyncRandomBytes(length);
+    return shouldReturnHex ? bytes.toString('hex') : bytes;
+}
+
+export function randomBytesSync(length: number, shouldReturnHex?: never): Buffer;
+export function randomBytesSync(length: number, shouldReturnHex: true): string;
+export function randomBytesSync(length: number, shouldReturnHex?: true | never): Buffer | string {
+    const bytes = nativeRandomBytes(length);
+    return shouldReturnHex ? bytes.toString('hex') : bytes;
+}
+
+export const PrintableCharacters = Array.from({ length: 127 - 32 }, (_, i) => String.fromCharCode(i + 32)).join('');
+export const AlphanumericCharacters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+export const UpperCaseAlphanumericCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+export const NumericCharacters = '0123456789';
+export async function randomString(length: number, source: string = PrintableCharacters): Promise<string> {
+    const reference = await randomBytes(length);
+    const result = Array.from({ length });
+    for (let i = 0; i < length; i++) {
+        result[i] = source[reference[i] % source.length];
+    }
+    return result.join('');
+}
+export function randomStringSync(length: number, source: string = PrintableCharacters): string {
+    const reference = randomBytesSync(length);
+    const result = Array.from({ length });
+    for (let i = 0; i < length; i++) {
+        result[i] = source[reference[i] % source.length];
+    }
+    return result.join('');
+}
+
+export class Crypto {
+    static encrypt(data: string): string;
+    static encrypt(data: Buffer): Buffer;
+    static encrypt(data: string | Buffer): string | Buffer {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return this.getInstance().encrypt(data as any);
+    }
+
+    static decrypt(data: string): string;
+    static decrypt(data: Buffer): Buffer;
+    static decrypt(data: string | Buffer): string | Buffer {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return this.getInstance().decrypt(data as any);
+    }
+
+    private static instance: Crypto;
+    private static getInstance() {
+        if (!this.instance) {
+            this.instance = new Crypto();
+        }
+        return this.instance;
+    }
+
+    private key: Buffer;
+    private ivLength: number;
+    constructor() {
+        const appConfig = getAppConfig();
+        if (!appConfig.CRYPTO_SECRET) {
+            throw new Error('CRYPTO_SECRET is not set in application configuration');
+        }
+        if (appConfig.CRYPTO_SECRET.length === 64 && /^[0-9a-f]+$/i.test(appConfig.CRYPTO_SECRET)) {
+            this.key = Buffer.from(appConfig.CRYPTO_SECRET, 'hex');
+        } else if (appConfig.CRYPTO_SECRET.length !== 32) {
+            throw new Error('CRYPTO_SECRET must be 32 bytes (or 64 hex characters)');
+        } else {
+            this.key = Buffer.from(appConfig.CRYPTO_SECRET);
+        }
+        this.ivLength = appConfig.CRYPTO_IV_LENGTH;
+    }
+
+    encrypt(data: string): string;
+    encrypt(data: Buffer): Buffer;
+    encrypt(data: string | Buffer): string | Buffer {
+        // Check if the input is a Buffer
+        const isBuffer = Buffer.isBuffer(data);
+
+        // Convert to a buffer if it's a string
+        if (!isBuffer) {
+            data = Buffer.from(data as string);
+        }
+
+        // Generate a random initialization vector
+        const iv = crypto.randomBytes(this.ivLength);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.key, iv);
+
+        // Encrypt the data
+        const encryptedData = Buffer.concat([cipher.update(data), cipher.final()]);
+
+        // Concatenate iv, encrypted data, and authentication tag into a single Buffer
+        const outputData = Buffer.concat([iv, encryptedData, cipher.getAuthTag()]);
+
+        // Return the data encoded as base64 if input was a string, else return as Buffer
+        return isBuffer ? outputData : outputData.toString('base64');
+    }
+
+    decrypt(data: string): string;
+    decrypt(data: Buffer): Buffer;
+    decrypt(data: string | Buffer): string | Buffer {
+        // Check if the input is a Buffer
+        const isBuffer = Buffer.isBuffer(data);
+
+        // Convert to Buffer if it's a string
+        const dataBuf = isBuffer ? data : Buffer.from(data, 'base64');
+
+        // Split the input into iv, encrypted data, and authentication tag
+        const iv = dataBuf.subarray(0, this.ivLength);
+        const authTag = dataBuf.subarray(dataBuf.length - 16);
+        const encryptedData = dataBuf.subarray(this.ivLength, dataBuf.length - 16);
+
+        // Decrypt the data
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.key, iv);
+        decipher.setAuthTag(authTag);
+        const decryptedData = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+
+        // Return the decrypted data as a string if the input was a string, else return as Buffer
+        return isBuffer ? decryptedData : decryptedData.toString('utf8');
+    }
+}

package/src/helpers/security/validation.ts

@@ -0,0 +1,16 @@
+import { HttpBadRequestError } from '@deepkit/http';
+import { ReceiveType, validate, ValidationError } from '@deepkit/type';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function validateOrThrow<T>(data: any, type?: ReceiveType<T>): data is T {
+    const errors = validate<T>(data, type);
+    if (errors.length) throw new ValidationError(errors);
+    return true;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function assertInput(value: any, field?: string): asserts value {
+    if (value === undefined || value === null) {
+        throw new HttpBadRequestError(field ? `${field} is required` : 'missing parameters');
+    }
+}

package/src/helpers/utils/date.ts

@@ -0,0 +1,13 @@
+import { format } from 'date-fns';
+
+export function extractDate(date: Date): string {
+    return format(date, 'yyyy-MM-dd');
+}
+
+export function sleepMs(ms: number) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+export function sleepSecs(secs: number) {
+    return sleepMs(secs * 1000);
+}

package/src/helpers/utils/error.ts

@@ -0,0 +1,155 @@
+import { LoggerLevel } from '@deepkit/logger';
+import * as Sentry from '@sentry/node';
+import { compact, omit, pick } from 'lodash';
+import { isNativeError } from 'util/types';
+
+import { getAppConfig } from '../../app/resolver';
+import { getTraceContext } from '../../telemetry';
+import { isSentryInstalled } from '../../telemetry/sentry';
+import { ArrowFunctionNoArgs, VoidFunction } from '../../types';
+
+export const SentryLiftKeysToTagsFromLoggerContext = [];
+
+export interface DecoratedError extends Error {
+    cause?: Error;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    context?: Record<string, any>;
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function isError(e: any): e is Error {
+    return e instanceof Error || isNativeError(e);
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function getErrorMessage(e: any): string {
+    return isError(e) ? e.message : String(e);
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function toError(e: any, cause?: any): Error {
+    const baseError = isError(e) ? e : new Error(String(e));
+    if (cause) {
+        (baseError as DecoratedError).cause = toError(cause);
+    }
+    return baseError;
+}
+
+export function tryOrErrorSync<T extends ArrowFunctionNoArgs>(fn: T): ReturnType<T> | Error {
+    try {
+        return fn();
+    } catch (e) {
+        return toError(e);
+    }
+}
+
+export async function tryOrError<T extends ArrowFunctionNoArgs>(fn: T): Promise<ReturnType<T> | Error> {
+    try {
+        return await fn();
+    } catch (e) {
+        return toError(e);
+    }
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function tryWithReject<T extends (reject: VoidFunction) => Promise<any>>(fn: T): Promise<ReturnType<T>> {
+    // eslint-disable-next-line no-async-promise-executor
+    return new Promise(async (resolve, reject) => {
+        try {
+            resolve(await fn(reject));
+        } catch (e) {
+            reject(e);
+        }
+    });
+}
+
+export interface IErrorContext {
+    scope?: string;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    scopeData?: Record<string, any>;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    loggerContext?: Record<string, any>;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    data?: Record<string, any>;
+}
+const errorHandlerState: { reporter?: (level: LoggerLevel, err: Error, context: IErrorContext) => void } = {};
+export function setGlobalErrorReporter(reporter: (label: LoggerLevel, err: Error, context: IErrorContext) => void) {
+    errorHandlerState.reporter = reporter;
+}
+export function reportError(level: LoggerLevel, err: Error, context: IErrorContext) {
+    if (errorHandlerState.reporter) {
+        errorHandlerState.reporter(level, err, context);
+    }
+    if (isSentryInstalled()) {
+        const tags = context.loggerContext ? pick(context.loggerContext, SentryLiftKeysToTagsFromLoggerContext) : {};
+        const Details = {
+            ...context,
+            loggerContext: omit(context.loggerContext, SentryLiftKeysToTagsFromLoggerContext)
+        };
+        Sentry.captureException(err, {
+            tags,
+            extra: { Details },
+            level: level === LoggerLevel.alert ? 'fatal' : level === LoggerLevel.warning ? 'warning' : 'error'
+        });
+    }
+    if (level === LoggerLevel.alert) {
+        sendSlackAlertNotification(err, context);
+    }
+}
+
+async function sendSlackAlertNotification(err: DecoratedError, context: IErrorContext) {
+    try {
+        const traceContext = getTraceContext();
+        const url = getAppConfig().ALERTS_SLACK_WEBHOOK_URL;
+        if (!url) return;
+
+        await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                text: compact([`:rotating_light: *${err.message}*`, err.cause && `cause: ${err.cause.message}`]).join('\n'),
+                attachments: [
+                    {
+                        color: 'danger',
+                        fields: compact([
+                            context.scope && {
+                                title: 'Scope',
+                                value: context.scope,
+                                short: true
+                            },
+                            traceContext && {
+                                title: 'Trace ID',
+                                value: traceContext.traceId,
+                                short: true
+                            },
+                            context.data && {
+                                title: 'Alert Data',
+                                value: JSON.stringify(context.data, null, 2),
+                                short: false
+                            },
+                            err.context && {
+                                title: 'Error Context',
+                                value: JSON.stringify(err.context, null, 2),
+                                short: false
+                            },
+                            context.scopeData && {
+                                title: 'Scope Data',
+                                value: JSON.stringify(context.scopeData, null, 2),
+                                short: false
+                            },
+                            context.loggerContext && {
+                                title: 'Logger Context',
+                                value: JSON.stringify(context.loggerContext, null, 2),
+                                short: false
+                            }
+                        ])
+                    }
+                ]
+            })
+        });
+    } catch (err) {
+        console.error('Failed to send slack alert notification', err);
+    }
+}

package/src/helpers/utils/jsx.ts

@@ -0,0 +1,8 @@
+import { InjectorContext } from '@deepkit/injector';
+import { ElementStruct, render } from '@deepkit/template';
+
+import { resolve } from '../../app/resolver';
+
+export async function jsxToHtml(jsx: ElementStruct) {
+    return render(resolve(InjectorContext).getRootInjector(), jsx) as Promise<string>;
+}

package/src/helpers/utils/uuid.ts

@@ -0,0 +1,8 @@
+import { uuidv7, V7Generator } from 'uuidv7';
+
+export const uuid7 = uuidv7;
+
+const v7Generator = new V7Generator();
+export const uuid7FromDate = (date: Date) => {
+    return v7Generator.generateOrResetCore(date.getTime(), 10_000).toString();
+};

package/src/http/auth.ts

@@ -0,0 +1,156 @@
+import { timingSafeEqual } from 'crypto';
+import { HttpRequest, HttpUnauthorizedError, RouteParameterResolver, RouteParameterResolverContext } from '@deepkit/http';
+import { ScopedLogger } from '@deepkit/logger';
+import { ActiveRecordClassType } from '@deepkit/orm';
+
+// can't import app here or bad things happen!!
+import type { BaseAppConfig } from '../app';
+import { JWT, ParsedJwt } from '../auth';
+import { getEntity, getEntityOrUndefined } from '../database';
+import { HttpMiddleware } from './middleware';
+import { createCachingParameterResolver, getCompositeCacheKey, getOrCacheValue } from './store';
+
+/**
+ * base request JWT lookup
+ */
+export async function getJwtFromRequest(request: HttpRequest): Promise<ParsedJwt | undefined> {
+    return getOrCacheValue(request, ParsedJwt, _getJwtFromRequest);
+}
+
+async function _getJwtFromRequest(request: HttpRequest): Promise<ParsedJwt | undefined> {
+    const jwt = await JWT.processWithRequest(request);
+    if (!jwt) return undefined;
+    if (!jwt.isValid) {
+        if (!jwt.isSignatureValid) throw new HttpUnauthorizedError('Invalid JWT signature');
+        if (!jwt.isNotExpired) throw new HttpUnauthorizedError('Expired JWT');
+        throw new HttpUnauthorizedError('Invalid JWT');
+    }
+    return jwt;
+}
+
+export class ParsedJwtResolver implements RouteParameterResolver {
+    async resolve(context: RouteParameterResolverContext): Promise<ParsedJwt | undefined> {
+        const jwt = await getJwtFromRequest(context.request);
+        if (!jwt && !context.type.isOptional()) {
+            throw new HttpUnauthorizedError('Request does not contain required JWT');
+        }
+        return jwt;
+    }
+}
+
+/**
+ * base request JWT user ID lookup
+ */
+const EntityIdSymbol = Symbol('EntityId');
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function getEntityIdFromRequestJwt(request: HttpRequest): Promise<any> {
+    const jwt = await getJwtFromRequest(request);
+    return jwt?.subject;
+}
+
+/**
+ * request JWT user ID to user object
+ */
+export async function getEntityFromRequestJwt<T extends ActiveRecordClassType>(
+    request: HttpRequest,
+    EntityClass: T
+): Promise<InstanceType<T> | undefined> {
+    const entityId = await getEntityIdFromRequestJwt(request);
+    return entityId ? getEntity(EntityClass, entityId) : undefined;
+}
+
+/**
+ * auth middleware generator
+ */
+interface EntityValidator<T extends ActiveRecordClassType> {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    getEntityIdFromRequest(request: HttpRequest): Promise<any>;
+    validateEntity?(request: HttpRequest, entity: InstanceType<T>): Promise<void>;
+}
+export function createAuthMiddleware<T extends ActiveRecordClassType>(EntityClass: T) {
+    return class extends HttpMiddleware implements EntityValidator<T> {
+        async handle(request: HttpRequest) {
+            const entityId = await getOrCacheValue(
+                request,
+                getCompositeCacheKey(EntityClass, EntityIdSymbol),
+                this.getEntityIdFromRequest.bind(this)
+            );
+            await this.loadAndValidateEntity(request, entityId);
+        }
+
+        async getEntityIdFromRequest(request: HttpRequest) {
+            const id = await getEntityIdFromRequestJwt(request);
+            if (!id) throw new HttpUnauthorizedError();
+            return id;
+        }
+
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        async loadAndValidateEntity(request: HttpRequest, id: any) {
+            const validateFn = (this as EntityValidator<T>).validateEntity;
+            if (validateFn) {
+                const entity = await getOrCacheValue(request, EntityClass, () => getEntityOrUndefined(EntityClass, id));
+                if (!entity) throw new HttpUnauthorizedError();
+                await validateFn(request, entity);
+            }
+        }
+    };
+}
+
+/**
+ * HTTP basic auth middleware
+ */
+export function createBasicAuthMiddleware(expectedUsername?: string) {
+    return class extends HttpMiddleware {
+        public config: BaseAppConfig;
+
+        constructor(public logger: ScopedLogger) {
+            super();
+
+            // todo:figure this out
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            this.config = require('../app').getAppConfig();
+            if (!this.config.AUTH_BASIC_SECRET) {
+                this.logger.error('No AUTH_BASIC_SECRET provided');
+            }
+        }
+
+        async handle(request: HttpRequest) {
+            const authHeader = request.headers['authorization'];
+            if (!authHeader) {
+                throw new HttpUnauthorizedError();
+            }
+
+            const [scheme, credentials] = authHeader.split(' ');
+            if (scheme.toLowerCase() !== 'basic') {
+                throw new HttpUnauthorizedError('Invalid authorization scheme');
+            }
+
+            const [username, password] = Buffer.from(credentials, 'base64').toString().split(':');
+            const secret = this.config.AUTH_BASIC_SECRET ?? '';
+            const usernameInvalid = expectedUsername && expectedUsername !== username;
+            const passwordBuf = Buffer.from(password);
+            const secretBuf = Buffer.from(secret);
+            const passwordInvalid = passwordBuf.length !== secretBuf.length || !timingSafeEqual(passwordBuf, secretBuf);
+            if (usernameInvalid || passwordInvalid) {
+                throw new HttpUnauthorizedError('Invalid credentials');
+            }
+        }
+    };
+}
+
+/**
+ * standard authed entity resolver
+ */
+export async function resolveEntityFromRequestJwt<T extends ActiveRecordClassType>(context: RouteParameterResolverContext, EntityClass: T) {
+    const ent = await getEntityFromRequestJwt(context.request, EntityClass);
+    if (!ent && !context.type.isOptional()) {
+        throw new HttpUnauthorizedError();
+    }
+    return ent;
+}
+
+export function createEntityFromRequestJwtParameterResolver<T extends ActiveRecordClassType>(EntityClass: T) {
+    return createCachingParameterResolver(EntityClass, async (context: RouteParameterResolverContext) => {
+        return resolveEntityFromRequestJwt(context, EntityClass);
+    });
+}

package/src/http/context.ts

@@ -0,0 +1,15 @@
+import { HttpRequest } from '@deepkit/http';
+import { uuid } from '@deepkit/type';
+
+export const DefaultHttpContextProvider: (request: HttpRequest) => Record<string, string> = () => ({
+    reqId: uuid()
+});
+
+let httpContextProvider: (request: HttpRequest) => Record<string, string> = DefaultHttpContextProvider;
+export function setHttpContextResolver(provider: (request: HttpRequest) => Record<string, string>) {
+    httpContextProvider = provider;
+}
+
+export function getHttpContextResolver() {
+    return httpContextProvider;
+}