@soundworks/core 4.0.0-alpha.4 → 4.0.0-alpha.6

package/src/server/Server.js

@@ -5,10 +5,11 @@ import path from 'node:path';
 import os from 'node:os';
 import { X509Certificate, createPrivateKey } from 'node:crypto';
 
+import { getTime } from '@ircam/sc-gettime';
+import { isPlainObject, idGenerator } from '@ircam/sc-utils';
 import chalk from 'chalk';
 import compression from 'compression';
 import express from 'express';
-import isPlainObject from 'is-plain-obj';
 import Keyv from 'keyv';
 import { KeyvFile } from 'keyv-file';
 import merge from 'lodash.merge';
@@ -16,6 +17,7 @@ import pem from 'pem';
 import compile from 'template-literal';
 
 import auditSchema from './audit-schema.js';
+import { encryptData, decryptData } from './crypto.js';
 import Client from './Client.js';
 import ContextManager from './ContextManager.js';
 import PluginManager from './PluginManager.js';
@@ -29,6 +31,7 @@ import {
   AUDIT_STATE_NAME,
 } from '../common/constants.js';
 
+
 let _dbNamespaces = new Set();
 
 /**
@@ -73,6 +76,8 @@ const DEFAULT_CONFIG = {
   },
 };
 
+const TOKEN_VALID_DURATION = 20; // sec
+
 // set terminal title
 /** @private */
 function setTerminalTitle(server) {
@@ -156,8 +161,8 @@ class Server {
       throw new Error(`[soundworks:Server] Invalid argument for Server constructor, config should be an object`);
     }
     /**
-     * Given config object merged with the following defaults:
-     * ```
+     * @description Given config object merged with the following defaults:
+     * @example
      * {
      *   env: {
      *     type: 'development',
@@ -178,7 +183,6 @@ class Server {
      *     clients: {},
      *   }
      * }
-     * ```
      */
     this.config = merge({}, DEFAULT_CONFIG, config);
 
@@ -236,8 +240,10 @@ class Server {
      * // expose assets located in the `soundfiles` directory on the network
      * server.router.use('/soundfiles', express.static('soundfiles')));
      */
+    // @note: we use express() instead of express.Router() because all 404 and
+    // error stuff is handled by default
     this.router = express();
-    // compression (must be set before serve-static)
+    // compression (must be set before express.static())
     this.router.use(compression());
 
     /**
@@ -313,6 +319,10 @@ class Server {
     this._onStatusChangeCallbacks = new Set();
     /** @private */
     this._auditState = null;
+    /** @private */
+    this._pendingConnectionTokens = new Set();
+    /** @private */
+    this._trustedClients = new Set();
 
     // register audit state schema
     this.stateManager.registerSchema(AUDIT_STATE_NAME, auditSchema);
@@ -357,11 +367,24 @@ class Server {
 
     // basic http authentication
     if (this.config.env.auth) {
-      this.router.use((req, res, next) => {
+      const ids = idGenerator();
 
-        const isProtected  = this.config.env.auth.clients
-          .map(type => req.path.endsWith(`/${type}`))
-          .reduce((acc, value) => acc || value, false);
+      const soundworksAuth = (req, res, next) => {
+        let role = null;
+
+        for (let [_role, config] of Object.entries(this.config.app.clients)) {
+          if (req.path === config.route) {
+            role = _role;
+          }
+        }
+
+        // route that are not client entry points just pass through the middleware
+        if (role === null) {
+          next();
+          return;
+        }
+
+        const isProtected  = this.isProtected(role);
 
         if (isProtected) {
           // authentication middleware
@@ -373,20 +396,39 @@ class Server {
           // verify login and password are set and correct
           if (login && password && login === auth.login && password === auth.password) {
             // -> access granted...
+            // generate token for web socket to check connections
+            const id = ids.next().value;
+            const ip = req.ip;
+            const time = getTime();
+            const token = { id, ip, time };
+            const encryptedToken = encryptData(token);
+
+            this._pendingConnectionTokens.add(encryptedToken);
+
+            setTimeout(() => {
+              this._pendingConnectionTokens.delete(encryptedToken);
+            }, TOKEN_VALID_DURATION * 1000);
+
+            // pass to the response object to be send to the client
+            res.swToken = encryptedToken;
+
             return next();
           }
 
-          // -> access denied...
+          // show login / password modal
           res.writeHead(401, {
             'WWW-Authenticate':'Basic',
             'Content-Type':'text/plain',
           });
+
           res.end('Authentication required.');
         } else {
-          // route not protected
+          // route is not protected
           return next();
         }
-      });
+      };
+
+      this.router.use(soundworksAuth);
     }
 
     // start http server
@@ -411,7 +453,7 @@ class Server {
           // this fails with self-signed certificates for whatever reason...
           try {
             x509 = new X509Certificate(cert);
-          } catch(err) {
+          } catch (err) {
             this._dispatchStatus('errored');
             throw new Error(`[soundworks:Server] Invalid https cert file`);
           }
@@ -423,7 +465,7 @@ class Server {
               this._dispatchStatus('errored');
               throw new Error(`[soundworks:Server] Invalid https key file`);
             }
-          } catch(err) {
+          } catch (err) {
             this._dispatchStatus('errored');
             throw new Error(`[soundworks:Server] Invalid https key file`);
           }
@@ -447,7 +489,7 @@ class Server {
           };
 
           this.httpServer = https.createServer({ key, cert }, this.router);
-        } catch(err) {
+        } catch (err) {
           logger.error(`
 Invalid certificate files, please check your:
 - key file: ${httpsInfos.key}
@@ -591,7 +633,7 @@ Invalid certificate files, please check your:
     await this.sockets.start(
       this,
       this.config.env.websockets,
-      (role, socket) => this._onSocketConnection(role, socket),
+      (...args) => this._onSocketConnection(...args),
     );
 
     // ------------------------------------------------------------
@@ -710,6 +752,8 @@ Invalid certificate files, please check your:
       route += `${role}`;
     }
 
+    this.config.app.clients[role].route = route;
+
     // define template filename: `${role}.html` or `default.html`
     const {
       templatePath,
@@ -726,7 +770,7 @@ Invalid certificate files, please check your:
     try {
       const stats = fs.statSync(clientTmpl);
       template = stats.isFile() ? clientTmpl : defaultTmpl;
-    } catch(err) {
+    } catch (err) {
       template = defaultTmpl;
     }
 
@@ -734,15 +778,21 @@ Invalid certificate files, please check your:
 
     try {
       tmplString = fs.readFileSync(template, 'utf8');
-    } catch(err) {
+    } catch (err) {
       throw new Error(`[soundworks:Server] html template file "${template}" not found`);
     }
 
     const tmpl = templateEngine.compile(tmplString);
-    // http request
-    router.get(route, (req, res) => {
+
+    const soundworksClientHandler = (req, res) => {
       const data = clientConfigFunction(role, this.config, req);
 
+      // if the client has gone through the connection middleware (add succedeed),
+      // add the token to the data object
+      if (res.swToken) {
+        data.token = res.swToken;
+      }
+
       // CORS / COOP / COEP headers for `crossOriginIsolated pages,
       // enables `sharedArrayBuffers` and high precision timers
       // cf. https://web.dev/why-coop-coep/
@@ -756,7 +806,10 @@ Invalid certificate files, please check your:
 
       const appIndex = tmpl(data);
       res.end(appIndex);
-    });
+    };
+
+    // http request
+    router.get(route, soundworksClientHandler);
 
     // return route infos for logging on server start
     return route;
@@ -766,18 +819,38 @@ Invalid certificate files, please check your:
    * Socket connection callback.
    * @private
    */
-  _onSocketConnection(role, socket) {
+  _onSocketConnection(role, socket, connectionToken) {
     const client = new Client(role, socket);
     const roles = Object.keys(this.config.app.clients);
 
+    // this has been validated
+    if (this.isProtected(role) && this.isValidConnectionToken(connectionToken)) {
+      const { ip } = decryptData(connectionToken);
+      const newData = {
+        ip: ip,
+        id: client.id,
+      };
+
+      const newToken = encryptData(newData);
+
+      client.token = newToken;
+
+      this._pendingConnectionTokens.delete(connectionToken);
+      this._trustedClients.add(client);
+    }
+
     socket.addListener('close', async () => {
-      // do nothin if client type was invalid
+      // do nothing if client role is invalid
       if (roles.includes(role)) {
         // decrement audit state counter
         const numClients = this._auditState.get('numClients');
         numClients[role] -= 1;
         this._auditState.set({ numClients });
 
+        // delete token
+        if (this._trustedClients.has(client)) {
+          this._trustedClients.delete(client);
+        }
         // clean context manager, await before cleaning state manager
         await this.contextManager.removeClient(client);
         // remove client from pluginManager
@@ -805,7 +878,7 @@ Invalid certificate files, please check your:
 
       try {
         this.pluginManager.checkRegisteredPlugins(registeredPlugins);
-      } catch(err) {
+      } catch (err) {
         socket.send(CLIENT_HANDSHAKE_ERROR, {
           type: 'invalid-plugin-list',
           message: err.message,
@@ -830,8 +903,8 @@ Invalid certificate files, please check your:
       // add client to context manager
       await this.contextManager.addClient(client);
 
-      const { id, uuid } = client;
-      socket.send(CLIENT_HANDSHAKE_RESPONSE, { id, uuid });
+      const { id, uuid, token } = client;
+      socket.send(CLIENT_HANDSHAKE_RESPONSE, { id, uuid, token });
     });
   }
 
@@ -908,6 +981,27 @@ Invalid certificate files, please check your:
    * you should rely on these defaults._
    */
   useDefaultApplicationTemplate() {
+    const buildDirectory = path.join('.build', 'public');
+
+    const useMinifiedFile = {};
+    const roles = Object.keys(this.config.app.clients);
+
+    roles.forEach(role => {
+      if (this.config.env.type === 'production') {
+        // check if minified file exists
+        const minifiedFilePath = path.join(buildDirectory, `${role}.min.js`);
+
+        if (fs.existsSync(minifiedFilePath)) {
+          useMinifiedFile[role] = true;
+        } else {
+          console.log(chalk.yellow(`    > Minified file not found for client "${role}", falling back to normal build file (use \`npm run build:production && npm start\` to use minified files)`));
+          useMinifiedFile[role] = false;
+        }
+      } else {
+        useMinifiedFile[role] = false;
+      }
+    });
+
     this._applicationTemplateOptions = {
       templateEngine: { compile },
       templatePath: path.join('.build', 'server', 'tmpl'),
@@ -922,13 +1016,14 @@ Invalid certificate files, please check your:
             type: config.env.type,
             websockets: config.env.websockets,
             subpath: config.env.subpath,
+            useMinifiedFile: useMinifiedFile[role],
           },
         };
       },
     };
 
     this.router.use(express.static('public'));
-    this.router.use('/build', express.static(path.join('.build', 'public')));
+    this.router.use('/build', express.static(buildDirectory));
   }
 
   /**
@@ -964,6 +1059,81 @@ Invalid certificate files, please check your:
 
     return this._auditState;
   }
+
+  /** @private */
+  isProtected(role) {
+    if (this.config.env.auth && Array.isArray(this.config.env.auth.clients)) {
+      return this.config.env.auth.clients.includes(role);
+    }
+
+    return false;
+  }
+
+  /** @private */
+  isValidConnectionToken(token) {
+    // token should be in pending token list
+    if (!this._pendingConnectionTokens.has(token)) {
+      return false;
+    }
+
+    // check the token is not too old
+    const data = decryptData(token);
+    const now = getTime();
+
+    // token is valid only for 30 seconds (this is arbitrary)
+    if (now > data.time + TOKEN_VALID_DURATION) {
+      // delete the token, is too old
+      this._pendingConnectionTokens.delete(token);
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  /**
+   * Check if the given client is trusted, i.e. config.env.type == 'production'
+   * and the client is protected behind a password.
+   *
+   * @param {server.Client} client - Client to be tested
+   * @returns {Boolean}
+   */
+  isTrustedClient(client) {
+    if (this.config.env.type !== 'production') {
+      return true;
+    } else {
+      return this._trustedClients.has(client);
+    }
+  }
+
+  /**
+   * Check if the token from a client is trusted, i.e. config.env.type == 'production'
+   * and the client is protected behind a password.
+   *
+   * @param {Number} clientId - Id of the client
+   * @param {Number} clientIp - Ip of the client
+   * @param {String} token - Token to be tested
+   * @returns {Boolean}
+   */
+  // for stateless interactions, e.g. POST files
+  isTrustedToken(clientId, clientIp, token) {
+    if (this.config.env.type !== 'production') {
+      return true;
+    } else {
+      for (let client of this._trustedClients) {
+        if (client.id === clientId && client.token === token) {
+          // check that given token is consistent with client ip and id
+          const { id, ip } = decryptData(client.token);
+
+          if (clientId === id && clientIp === ip) {
+            return true;
+          }
+        }
+
+      }
+
+      return false;
+    }
+  }
 }
 
 export default Server;

package/src/server/SharedState.js

@@ -18,7 +18,6 @@ import BaseSharedState from '../common/BaseSharedState.js';
  * @callback server.SharedState~deleteOnUpdateCallback
  */
 
-
 /**
  * The `SharedState` is one of the most important and versatile abstraction provided
  * by `soundworks`. It represents a set of parameters that are synchronized accross

package/src/server/SharedStateCollection.js

@@ -0,0 +1,36 @@
+import BaseSharedStateCollection from '../common/BaseSharedStateCollection.js';
+
+// this file exists only for documentation purposesSharedStateCollection.js
+
+/**
+ * @callback server.SharedStateCollection~onUpdateCallback
+ * @param {server.SharedState} state - State that triggered the update.
+ * @param {Object} newValues - Key / value pairs of the updates that have been
+ *  applied to the state.
+ * @param {Object} oldValues - Key / value pairs of the updated params before
+ *  the updates has been applied to the state.
+ * @param {Mixed} [context=null] - Optionnal context object that has been passed
+ *  with the values updates in the `set` call.
+ */
+
+/**
+ * The `SharedStateCollection` interface represent a collection of all states
+ * created from a given schema name on the network, at the execption of the ones
+ * created by the current node.
+ *
+ * ```
+ * const collection = await server.stateManager.getCollection('my-schema');
+ * const allValues = collection.getValues();
+ * collection.onUpdate((state, newValues, oldValues, context) => {
+ *   // do something
+ * });
+ * ```
+ * @memberof server
+ * @extends BaseSharedStateCollection
+ * @inheritdoc
+ * @hideconstructor
+ */
+class SharedStateCollection extends BaseSharedStateCollection {}
+
+export default SharedStateCollection;
+

package/src/server/Sockets.js

@@ -2,9 +2,9 @@ import { Worker } from 'node:worker_threads';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import querystring from 'querystring';
 import { WebSocketServer } from 'ws';
 import WebSocket from 'ws';
-import querystring from 'querystring';
 
 import Socket from './Socket.js';
 
@@ -69,13 +69,13 @@ class Sockets {
 
     // init ws server
     this._wss = new WebSocketServer({
-      server: server.httpServer,
+      noServer: true,
       path: `/${config.path}`, // @note - update according to existing config files (aka cosima-apps)
     });
 
     this._wss.on('connection', (ws, req) => {
       const queryString = querystring.decode(req.url.split('?')[1]);
-      const { role, key } = queryString;
+      const { role, key, token } = queryString;
       const binary = !!(parseInt(queryString.binary));
 
       if (binary) {
@@ -96,8 +96,29 @@ class Sockets {
         socket.addToRoom('*');
         socket.addToRoom(role);
 
-        onConnectionCallback(role, socket);
+        onConnectionCallback(role, socket, token);
+      }
+    });
+
+    // check if client can connect
+    server.httpServer.on('upgrade', async (req, socket, head) => {
+      const queryString = querystring.decode(req.url.split('?')[1]);
+
+      const { role, token } = queryString;
+
+      if (server.isProtected(role)) {
+        // we don't have any ip in the upgrade request, so we just check the
+        // connection token is pending
+        const allowed = server.isValidConnectionToken(token);
+
+        if (!allowed) {
+          socket.destroy('not allowed');
+        }
       }
+
+      this._wss.handleUpgrade(req, socket, head, (ws) => {
+        this._wss.emit('connection', ws, req);
+      });
     });
   }
 

package/src/server/StateManager.js

@@ -1,11 +1,11 @@
 import EventEmitter from 'node:events';
 
+import { idGenerator, isString, isPlainObject } from '@ircam/sc-utils';
 import clonedeep from 'lodash.clonedeep';
 
 import BaseStateManager from '../common/BaseStateManager.js';
 import ParameterBag from '../common/ParameterBag.js';
 import SharedStatePrivate from '../common/SharedStatePrivate.js';
-import { isString, isPlainObject } from '../common/utils.js';
 import {
   SERVER_ID,
   CREATE_REQUEST,
@@ -22,7 +22,7 @@ import {
   DELETE_SCHEMA,
   PRIVATE_STATES,
 } from '../common/constants.js';
-import { idGenerator } from '../common/utils.js';
+
 
 const generateStateId = idGenerator();
 const generateRemoteId = idGenerator();
@@ -359,9 +359,11 @@ class StateManager extends BaseStateManager {
           client.transport.emit(CREATE_RESPONSE, reqId, stateId, remoteId, schemaName, sendedSchema, currentValues);
 
           this._observers.forEach(observer => {
-            observer.transport.emit(OBSERVE_NOTIFICATION, [schemaName, stateId, nodeId]);
+            if (observer.id !== nodeId) {
+              observer.transport.emit(OBSERVE_NOTIFICATION, schemaName, stateId, nodeId);
+            }
           });
-        } catch(err) {
+        } catch (err) {
           client.transport.emit(CREATE_ERROR, reqId, err.message);
           console.error(err.message);
         }
@@ -428,7 +430,7 @@ class StateManager extends BaseStateManager {
         const { schemaName, id, _creatorId } = state;
         // only track application states
         // (e.g. do not propagate infos about audit state)
-        if (!PRIVATE_STATES.includes(schemaName)) {
+        if (!PRIVATE_STATES.includes(schemaName) && _creatorId !== client.id) {
           statesInfos.push([schemaName, id, _creatorId]);
         }
       });

package/src/server/crypto.js

@@ -0,0 +1,38 @@
+import crypto from 'node:crypto';
+import { v4 as uuidv4 } from 'uuid';
+
+// adapted from https://dev.to/jobizil/encrypt-and-decrypt-data-in-nodejs-using-aes-256-cbc-2l6d
+// generate a new key and init vector each time the server restart, we don't need
+// any persistency here
+const secretKey = uuidv4();
+const secretIv = uuidv4();
+const encryptionMethod = 'aes-256-cbc';
+
+const key = crypto
+  .createHash('sha512')
+  .update(secretKey)
+  .digest('hex')
+  .substring(0, 32);
+
+const encryptionIV = crypto
+  .createHash('sha512')
+  .update(secretIv)
+  .digest('hex')
+  .substring(0, 16);
+
+
+export function encryptData(obj) {
+  const data = JSON.stringify(obj);
+  const cipher = crypto.createCipheriv(encryptionMethod, key, encryptionIV)
+  return Buffer.from(
+    cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
+  ).toString('base64')
+}
+
+export function decryptData(encryptedData) {
+  const buff = Buffer.from(encryptedData, 'base64')
+  const decipher = crypto.createDecipheriv(encryptionMethod, key, encryptionIV)
+
+  const decrypted = `${decipher.update(buff.toString('utf8'), 'hex', 'utf8')}${decipher.final('utf8')}`
+  return JSON.parse(decrypted);
+}

package/src/common/utils.js

@@ -1,28 +0,0 @@
-import isPlainObj from 'is-plain-obj';
-
-// https://stackoverflow.com/questions/17575790/environment-detection-node-js-or-browser
-export const isBrowser = new Function('try {return this===window;}catch(e){ return false;}');
-
-export function* idGenerator() {
-  for (let i = 0; true; i++) {
-    if (i === Number.MAX_SAFE_INTEGER) {
-      i = 0;
-    }
-
-    yield i;
-  }
-}
-
-export function isString(val) {
-  return (typeof val === 'string' || val instanceof String);
-}
-
-export function isFunction(func) {
-  return Object.prototype.toString.call(func) == '[object Function]' ||
-    Object.prototype.toString.call(func) == '[object AsyncFunction]';
-}
-
-export function isPlainObject(obj) {
-  return isPlainObj(obj);
-}
-