@things-factory/shell 10.1.79 → 10.1.106
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -59,7 +59,8 @@ async function domainMiddleware(context, next) {
|
|
|
59
59
|
});
|
|
60
60
|
context.state.unsafeIP = !safe;
|
|
61
61
|
if (!safe) {
|
|
62
|
-
|
|
62
|
+
/* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */
|
|
63
|
+
context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }));
|
|
63
64
|
}
|
|
64
65
|
}
|
|
65
66
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,
|
|
1
|
+
{"version":3,"file":"domain-middleware.js","sourceRoot":"","sources":["../../server/middlewares/domain-middleware.ts"],"names":[],"mappings":";;;AAqBA,4CAuDC;;AA5ED,oEAAkC;AAClC,0DAAyD;AAEzD;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,eAAe,GAAG,qBAAqB,CAAA;AAEpD,SAAS,eAAe,CAAC,OAAY;IACnC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,GAAG,CAAC,sBAAc,EAAE,uBAAe,CAAC,CAAA;AAC9C,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAY,EAAE,IAAS;IAC5D,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,MAAM,GAAG,MAAM,IAAA,gCAAgB,EAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,oBAAS,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,EAAE,SAAS,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;QAEnG,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,kBAAkB;YAClB,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBACxB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAClC,CAAC,CAAC,CAAA;YAEJ,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAA;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,iGAAiG;gBACjG,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IAE7B,OAAO,IAAI,EAAE,CAAA;AACf,CAAC","sourcesContent":["import requestIp from 'request-ip'\nimport { getDomainFromURL } from '../utils/get-domain.js'\n\n/**\n * The reason an address was refused, as a header the client can read.\n *\n * The domain's IP lists answer 403, and so does \"no domain chosen\" (domain-authenticate-middleware).\n * The client sent both to check-in; for a refused address check-in sends the person straight back,\n * so the screen stopped with nothing said (ADR README, plan 3). With this header the client can tell\n * the two apart and say what happened - the address is not let in, and check-in cannot change that.\n *\n * A header, not a body: it reaches the client whatever the request was (GraphQL, HTML, a file).\n */\nexport const REFUSAL_HEADER = 'x-refusal'\nexport const REFUSED_ADDRESS = 'address-not-allowed'\n\nfunction refuseByAddress(context: any) {\n context.status = 403\n context.set(REFUSAL_HEADER, REFUSED_ADDRESS)\n}\n\nexport async function domainMiddleware(context: any, next: any) {\n var { domain } = context.state\n if (!domain) {\n /*\n * The domainTypes should be checked only when signin and checkin.\n * For purposes such as API calls, the target domainTypes may be different from the system domainTypes.\n * So, we don't check domainTypes here.\n */\n domain = await getDomainFromURL(context)\n }\n\n if (domain) {\n const ip = requestIp.getClientIp(context.req)\n const { whitelist = [], blacklist = [], protectedlist = [], privileges = [] } = domain.iplist || {}\n\n if (Array.isArray(whitelist) && whitelist.length > 0) {\n /* whitelist 우선 */\n const whitelisted =\n Array.isArray(whitelist) &&\n whitelist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n if (!whitelisted) {\n return refuseByAddress(context)\n }\n } else {\n const blacklisted =\n Array.isArray(blacklist) &&\n blacklist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n if (blacklisted) {\n return refuseByAddress(context)\n }\n }\n\n if (Array.isArray(protectedlist) && protectedlist.length > 0) {\n const safe = protectedlist.some(item => {\n return new RegExp(item).test(ip)\n })\n\n context.state.unsafeIP = !safe\n\n if (!safe) {\n /* `by` tells the refusal it was the address - a role would not open it (ADR-0103 decision 1). */\n context.state.prohibitedPrivileges = (Array.isArray(privileges) ? privileges : []).map(item => ({ ...item, by: 'address' }))\n }\n }\n }\n\n context.state.domain = domain\n\n return next()\n}\n"]}
|
|
@@ -4,12 +4,12 @@ export * from './domain/domain.js';
|
|
|
4
4
|
export * from './domain/domain-types.js';
|
|
5
5
|
export * from './subscription-data/data-types.js';
|
|
6
6
|
export * from './env-var/env-var.js';
|
|
7
|
-
export declare const entities: (typeof import("./
|
|
7
|
+
export declare const entities: (typeof import("./env-var/env-var.js").EnvVar | typeof import("./domain/domain.js").Domain | typeof import("./attribute-set/attribute-set.js").AttributeSet)[];
|
|
8
8
|
export declare const schema: {
|
|
9
9
|
typeDefs: {
|
|
10
10
|
transactionDirectiveTypeDefs: import("graphql").DocumentNode;
|
|
11
11
|
};
|
|
12
|
-
resolverClasses: (typeof import("./
|
|
12
|
+
resolverClasses: (typeof import("./domain/domain-query.js").DomainQuery | typeof import("./domain/domain-mutation.js").DomainMutation | typeof import("./attribute-set/attribute-set-query.js").AttributeSetQuery | typeof import("./attribute-set/attribute-set-mutation.js").AttributeSetMutation | typeof import("./subscription-data/data-resolver.js").DataResolver | typeof import("./env-var/env-var-query.js").EnvVarQuery | typeof import("./env-var/env-var-mutation.js").EnvVarMutation)[];
|
|
13
13
|
directives: {
|
|
14
14
|
transaction: (schema: import("graphql").GraphQLSchema) => import("graphql").GraphQLSchema;
|
|
15
15
|
};
|