@things-factory/shell 10.1.44 → 10.1.47

package/dist-server/middlewares/domain-middleware.d.ts

@@ -1 +1,13 @@
+/**
+ * The reason an address was refused, as a header the client can read.
+ *
+ * The domain's IP lists answer 403, and so does "no domain chosen" (domain-authenticate-middleware).
+ * The client sent both to check-in; for a refused address check-in sends the person straight back,
+ * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell
+ * the two apart and say what happened - the address is not let in, and check-in cannot change that.
+ *
+ * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).
+ */
+export declare const REFUSAL_HEADER = "x-refusal";
+export declare const REFUSED_ADDRESS = "address-not-allowed";
 export declare function domainMiddleware(context: any, next: any): Promise<any>;

package/dist-server/middlewares/domain-middleware.js

@@ -1,9 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSED_ADDRESS = exports.REFUSAL_HEADER = void 0;
 exports.domainMiddleware = domainMiddleware;
 const tslib_1 = require("tslib");
 const request_ip_1 = tslib_1.__importDefault(require("request-ip"));
 const get_domain_js_1 = require("../utils/get-domain.js");
+/**
+ * The reason an address was refused, as a header the client can read.
+ *
+ * The domain's IP lists answer 403, and so does "no domain chosen" (domain-authenticate-middleware).
+ * The client sent both to check-in; for a refused address check-in sends the person straight back,
+ * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell
+ * the two apart and say what happened - the address is not let in, and check-in cannot change that.
+ *
+ * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).
+ */
+exports.REFUSAL_HEADER = 'x-refusal';
+exports.REFUSED_ADDRESS = 'address-not-allowed';
+function refuseByAddress(context) {
+    context.status = 403;
+    context.set(exports.REFUSAL_HEADER, exports.REFUSED_ADDRESS);
+}
 async function domainMiddleware(context, next) {
     var { domain } = context.state;
     if (!domain) {
@@ -24,8 +41,7 @@ async function domainMiddleware(context, next) {
                     return new RegExp(item).test(ip);
                 });
             if (!whitelisted) {
-                context.status = 403;
-                return;
+                return refuseByAddress(context);
             }
         }
         else {
@@ -34,8 +50,7 @@ async function domainMiddleware(context, next) {
                     return new RegExp(item).test(ip);
                 });
             if (blacklisted) {
-                context.status = 403;
-                return;
+                return refuseByAddress(context);
             }
         }
         if (Array.isArray(protectedlist) && protectedlist.length > 0) {

package/dist-server/middlewares/domain-middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;AAGA,4CAwDC;;AA3DD,oEAAkC;AAClC,0DAAyD;AAElD,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;gBACpB,OAAM;YACR,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;gBACpB,OAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,UAAU,CAAA;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\n\nexport async function domainMiddleware(context: any, next: any) {\n  var { domain } = context.state\n  if (!domain) {\n    /*\n     * The domainTypes should be checked only when signin and checkin.\n     * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n     * So, we don't check domainTypes here.\n     */\n    domain = await getDomainFromURL(context)\n  }\n\n  if (domain) {\n    const ip = requestIp.getClientIp(context.req)\n    const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n    if (Array.isArray(whitelist) && whitelist.length > 0) {\n      /* whitelist 우선 */\n      const whitelisted =\n        Array.isArray(whitelist) &&\n        whitelist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (!whitelisted) {\n        context.status = 403\n        return\n      }\n    } else {\n      const blacklisted =\n        Array.isArray(blacklist) &&\n        blacklist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (blacklisted) {\n        context.status = 403\n        return\n      }\n    }\n\n    if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n      const safe = protectedlist.some(item => {\n        return new RegExp(item).test(ip)\n      })\n\n      context.state.unsafeIP = !safe\n\n      if (!safe) {\n        context.state.prohibitedPrivileges = privileges\n      }\n    }\n  }\n\n  context.state.domain = domain\n\n  return next()\n}\n"]}
+{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,4CAsDC;;AA3ED,oEAAkC;AAClC,0DAAyD;AAEzD;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,eAAe,GAAG,qBAAqB,CAAA;AAEpD,SAAS,eAAe,CAAC,OAAY;IACnC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,UAAU,CAAA;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\n\n/**\n * The reason an address was refused, as a header the client can read.\n *\n * The domain's IP lists answer 403, and so does \"no domain chosen\" (domain-authenticate-middleware).\n * The client sent both to check-in; for a refused address check-in sends the person straight back,\n * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell\n * the two apart and say what happened - the address is not let in, and check-in cannot change that.\n *\n * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).\n */\nexport const REFUSAL_HEADER = 'x-refusal'\nexport const REFUSED_ADDRESS = 'address-not-allowed'\n\nfunction refuseByAddress(context: any) {\n  context.status = 403\n  context.set(REFUSAL_HEADER, REFUSED_ADDRESS)\n}\n\nexport async function domainMiddleware(context: any, next: any) {\n  var { domain } = context.state\n  if (!domain) {\n    /*\n     * The domainTypes should be checked only when signin and checkin.\n     * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n     * So, we don't check domainTypes here.\n     */\n    domain = await getDomainFromURL(context)\n  }\n\n  if (domain) {\n    const ip = requestIp.getClientIp(context.req)\n    const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n    if (Array.isArray(whitelist) && whitelist.length > 0) {\n      /* whitelist 우선 */\n      const whitelisted =\n        Array.isArray(whitelist) &&\n        whitelist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (!whitelisted) {\n        return refuseByAddress(context)\n      }\n    } else {\n      const blacklisted =\n        Array.isArray(blacklist) &&\n        blacklist.some(item => {\n          return new RegExp(item).test(ip)\n        })\n\n      if (blacklisted) {\n        return refuseByAddress(context)\n      }\n    }\n\n    if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n      const safe = protectedlist.some(item => {\n        return new RegExp(item).test(ip)\n      })\n\n      context.state.unsafeIP = !safe\n\n      if (!safe) {\n        context.state.prohibitedPrivileges = privileges\n      }\n    }\n  }\n\n  context.state.domain = domain\n\n  return next()\n}\n"]}