@ti-engine/core 1.0.10 → 1.0.11

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+##Version 1.0.11
+* feat(message exchange): implement message tampering and insertion protection
+* feat(config): provide option to turn on/off the message tampering and insertion protection
+* feat(config): provide option to turn on/off message tracing
+* feat: upgrade all used packages to their latest versions
+* refactor(config)!: rename all environment variables that set configuration settings to match their related setting
+* docs: add a change log

package/README.md

@@ -95,7 +95,7 @@ The architectural approach for the **ti-engine** is done in _tiers_ with lower t
 
 There are three general tiers in the **ti-engine**:
 1. message exchange
-2. service interface
+2. service domains
 3. solution implementation
 
 See the following sections for more information on each of them.

package/bin/settings.json

@@ -20,6 +20,8 @@
   "messageExchange": {
     "messageQueuePrefix": "ti:messages:",
     "messageStore": "ti:messages:store",
+    "securityHashEnabled": true,
+    "securityHashKey": "23e7bdc7-a793-41f9-856e-6760332f0c73",
     "traceLogEnabled": true
   },
   "serviceConfig": {

package/components/exchange/default/default-message-receiver.js

@@ -74,7 +74,7 @@ class DefaultMessageReceiver extends MessageReceiver {
     onReceive() {
         return new Promise( ( resolve, reject ) => {
             this.#memoryCache.receiveMessage( this.receiveQueue ).then( ( lightweightMessage ) => {
-                return this.#memoryCache.retrieveMessagePayload( lightweightMessage, config.getSetting( config.setting.MESSAGE_EXCHANGE_STORE ) );
+                return this.#memoryCache.retrieveMessagePayload( lightweightMessage, config.getSetting( config.setting.MESSAGE_EXCHANGE_MESSAGE_STORE ) );
             } ).then( ( message ) => {
                 resolve( message );
             } ).catch( ( error ) => {

package/components/exchange/default/default-message-sender.js

@@ -42,7 +42,7 @@ class DefaultMessageSender extends MessageSender {
      */
     onSend( message, queue ) {
         return new Promise( ( resolve, reject ) => {
-            this.#memoryCache.storeMessagePayload( message.payload, config.getSetting( config.setting.MESSAGE_EXCHANGE_STORE ) ).then( ( storeID ) => {
+            this.#memoryCache.storeMessagePayload( message.payload, config.getSetting( config.setting.MESSAGE_EXCHANGE_MESSAGE_STORE ) ).then( ( storeID ) => {
                 let lightweightMessage = _.cloneDeep( message );
                 lightweightMessage.payload = storeID;
                 return this.#memoryCache.sendMessage( lightweightMessage, queue );

package/components/exchange/message-exchange.js

@@ -25,8 +25,9 @@ const messageTracer = require( "#message-tracer" );
  * @property {string} chainID Unique identifier of the message chain if the message is part of one.
  * @property {number} chainLevel The node level of this message in the message chain tree.
  * @property {MessageDestination} destination The destination of the message.
+ * @property {string} [hash] Security hash for the message if the mechanism is enabled.
  * @property {string} messageID Unique message identifier.
- * @property {Object|string|undefined} payload The message contents to be processed in destination. If string, it is ID of the payload in the memory cache instead.
+ * @property {Object|string|undefined} payload The message contents to be processed in destination. If string it is ID of the payload in the memory cache instead.
  * Note that if this is not an Object or a string, there is no guarantee that it will be delivered in the same/proper format!
  * @property {MessageSource} source The source of the message.
  */

package/components/exchange/message-handler.js

@@ -5,8 +5,11 @@
 
 const ConnectionObserver = require( "#connection-observer" );
 const _ = require( "lodash" );
+const blake2 = require( "blake2" );
 const exceptions = require( "#exceptions" );
 const logger = require( "#logger" );
+const tools = require( "#tools" );
+const config = require( "#config" );
 
 /**
  * An abstract class that defines a basic message handler behavior.
@@ -98,6 +101,21 @@ class MessageHandler extends ConnectionObserver {
         return Promise.reject( exceptions.raise( exceptions.exceptionCode.E_GEN_ABSTRACT_METHOD_CALL, { name: this.constructor.name + "." + this.disable.name } ) );
     }
 
+    /**
+     * Used to create a security hash from the message.
+     *
+     * @method
+     * @param {Message} message
+     * @returns {string}
+     * @public
+     */
+    createMessageHash( message ) {
+        let transformed = tools.decomposeJSON( tools.decycle( message ) );
+        let hash = blake2.createKeyedHash( "blake2b", Buffer.from( config.getSetting( config.setting.MESSAGE_EXCHANGE_SECURITY_HASH_KEY ) ) );
+        hash.update( Buffer.from( transformed ) );
+        return hash.digest( "hex" );
+    }
+
     /**
      * Used to register a new {@link MessageObserver} for events related to the messages passing through this handler.
      *

package/components/exchange/message-receiver.js

@@ -6,6 +6,7 @@
 const MessageHandler = require( "#message-handler" );
 const logger = require( "#logger" );
 const exceptions = require( "#exceptions" );
+const config = require( "#config" );
 
 /**
  * An abstract class that defines a basic message receiver behavior.
@@ -84,6 +85,8 @@ class MessageReceiver extends MessageHandler {
      */
     receive() {
         this.onReceive().then( ( message ) => {
+            return this.#postReceive( message );
+        } ).then( ( message ) => {
             this.onMessage( message );
         } ).catch( ( error ) => {
             logger.log( `Error while trying to receive the next pending message from memory cache in receiver '${ this.connectionIdentifier }'! Resuming operation...`, logger.logSeverity.ERROR, error );
@@ -108,6 +111,37 @@ class MessageReceiver extends MessageHandler {
         return Promise.reject( exceptions.raise( exceptions.exceptionCode.E_GEN_ABSTRACT_METHOD_CALL, { name: this.constructor.name + "." + this.onReceive.name } ) );
     }
 
+    /* Private interface */
+
+    /**
+     * Used to process the received message before providing it to any {@link MessageObserver}.
+     *
+     * @method
+     * @param {Message} message
+     * @returns {Promise<Message>}
+     * @private
+     */
+    #postReceive( message ) {
+        return new Promise( ( resolve, reject ) => {
+            if ( config.getSetting( config.setting.MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED ) === true ) {
+                let receivedHash = message.hash;
+                delete message.hash;
+                let currentHash = this.createMessageHash( message );
+                if ( receivedHash && receivedHash === currentHash ) {
+                    resolve( message );
+                } else {
+                    reject( exceptions.raise( exceptions.exceptionCode.E_SEC_MESSAGE_TAMPERING_DETECTED, {
+                        messageID: message.messageID,
+                        receivedHash: receivedHash,
+                        currentHash: currentHash
+                    } ) );
+                }
+            } else {
+                resolve( message );
+            }
+        } );
+    }
+
 }
 
 module.exports = MessageReceiver;

package/components/exchange/message-sender.js

@@ -5,6 +5,7 @@
 
 const MessageHandler = require( "#message-handler" );
 const exceptions = require( "#exceptions" );
+const config = require( "#config" );
 
 /**
  * An abstract class that defines a basic message sender behavior.
@@ -70,7 +71,7 @@ class MessageSender extends MessageHandler {
      */
     send( message, queue ) {
         return new Promise( ( resolve, reject ) => {
-            this.#preSend().then( () => {
+            this.#preSend( message ).then( ( message ) => {
                 return this.onSend( message, queue );
             } ).then( () => {
                 return this.#postSend();
@@ -106,12 +107,17 @@ class MessageSender extends MessageHandler {
      * Used to do pre-send verifications and checks.
      *
      * @method
-     * @returns {Promise}
+     * @param {Message} message
+     * @returns {Promise<Message>}
      * @private
      */
-    #preSend() {
+    #preSend( message ) {
         if ( this.isAvailable === true ) {
-            return Promise.resolve();
+            if ( config.getSetting( config.setting.MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED ) === true ) {
+                message.hash = this.createMessageHash( message );
+            }
+
+            return Promise.resolve( message );
         } else {
             return Promise.reject( exceptions.raise( exceptions.exceptionCode.E_COM_MESSAGE_SENDER_UNAVAILABLE ) );
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ti-engine/core",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "The ti-engine is an open source, free to use - both for personal and commercial projects - framework for the creation of microservice-based solutions using node.js.",
   "author": "Boris Kostadinov <kostadinov.boris@gmail.com>",
   "license": "ISC",
@@ -41,12 +41,12 @@
     "#tools": "./utils/tools.js"
   },
   "dependencies": {
-    "blake2": "^4.0.2",
-    "dotenv": "^10.0.0",
+    "blake2": "^4.1.0",
+    "dotenv": "^14.1.0",
     "fs-extra": "^10.0.0",
     "lodash": "^4.17.21",
     "node-schedule": "^2.1.0",
-    "ioredis": "^4.28.2"
+    "ioredis": "^4.28.3"
   },
   "optionalDependencies": {
     "@google-cloud/error-reporting": "^2.0.4"

package/utils/config.js

@@ -20,13 +20,16 @@ const tools = require( "#tools" );
  * @property {EnvironmentVariable} env.TI_INSTANCE_CONFIG
  * @property {EnvironmentVariable} env.TI_INSTANCE_ID
  * @property {EnvironmentVariable} env.TI_INSTANCE_NAME
- * @property {EnvironmentVariable} env.TI_LOG_CONSOLE_ENABLED
- * @property {EnvironmentVariable} env.TI_LOG_MIN_LEVEL
- * @property {EnvironmentVariable} env.TI_LOG_USED_JSON
+ * @property {EnvironmentVariable} env.TI_AUDITING_LOG_CONSOLE_ENABLED
+ * @property {EnvironmentVariable} env.TI_AUDITING_LOG_MIN_LEVEL
+ * @property {EnvironmentVariable} env.TI_AUDITING_LOG_USES_JSON
  * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_AUTH_KEY
- * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_DB
- * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_HOST
- * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_PORT
+ * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_REDIS_DB
+ * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_REDIS_HOST
+ * @property {EnvironmentVariable} env.TI_MEMORY_CACHE_REDIS_PORT
+ * @property {EnvironmentVariable} env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED
+ * @property {EnvironmentVariable} env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_KEY
+ * @property {EnvironmentVariable} env.TI_MESSAGE_EXCHANGE_TRACE_LOG_ENABLED
  * @property {EnvironmentVariable} env.TI_OPERATION_MODE
  */
 
@@ -70,6 +73,8 @@ const tools = require( "#tools" );
  * @typedef {Object} SettingsMessageExchange
  * @property {string} messageQueuePrefix
  * @property {string} messageStore
+ * @property {boolean} securityHashEnabled
+ * @property {string} securityHashKey
  * @property {boolean} traceLogEnabled
  */
 
@@ -100,7 +105,9 @@ let settingsEnum = tools.enum( {
     MEMORY_CACHE_REDIS_HOST: [ "memoryCache.redisHost", "redisHost", "" ],
     MEMORY_CACHE_REDIS_PORT: [ "memoryCache.redisPort", "redisPort", "" ],
     MESSAGE_EXCHANGE_QUEUE_PREFIX: [ "messageExchange.messageQueuePrefix", "messageQueuePrefix", "" ],
-    MESSAGE_EXCHANGE_STORE: [ "messageExchange.messageStore", "messageStore", "" ],
+    MESSAGE_EXCHANGE_MESSAGE_STORE: [ "messageExchange.messageStore", "messageStore", "" ],
+    MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED: [ "messageExchange.securityHashEnabled", "securityHashEnabled", "" ],
+    MESSAGE_EXCHANGE_SECURITY_HASH_KEY: [ "messageExchange.securityHashKey", "securityHashKey", "" ],
     MESSAGE_EXCHANGE_TRACE_LOG_ENABLED: [ "messageExchange.traceLogEnabled", "traceLogEnabled", "" ],
     SERVICE_EXECUTION_TIMEOUT: [ "serviceConfig.executionTimeout", "executionTimeout", "" ],
     SERVICE_HEALTH_CHECK_ADDRESS: [ "serviceConfig.healthCheckAddress", "healthCheckAddress", "" ],
@@ -120,18 +127,23 @@ const settings = require( "#settings" );
 
 // override remaining settings with ENV variables (if provided):
 if ( settings.auditing ) {
-    settings.auditing.logMinLevel = ( process.env.TI_LOG_MIN_LEVEL !== undefined ) ? process.env.TI_LOG_MIN_LEVEL : settings.auditing.logMinLevel;
-    settings.auditing.logConsoleEnabled = ( process.env.TI_LOG_CONSOLE_ENABLED !== undefined ) ? tools.toBool( process.env.TI_LOG_CONSOLE_ENABLED ) : settings.auditing.logConsoleEnabled;
-    settings.auditing.logUsesJSON = ( process.env.TI_LOG_USED_JSON !== undefined ) ? tools.toBool( process.env.TI_LOG_USED_JSON ) : settings.auditing.logUsesJSON;
+    settings.auditing.logMinLevel = ( process.env.TI_AUDITING_LOG_MIN_LEVEL !== undefined ) ? process.env.TI_AUDITING_LOG_MIN_LEVEL : settings.auditing.logMinLevel;
+    settings.auditing.logConsoleEnabled = ( process.env.TI_AUDITING_LOG_CONSOLE_ENABLED !== undefined ) ? tools.toBool( process.env.TI_AUDITING_LOG_CONSOLE_ENABLED ) : settings.auditing.logConsoleEnabled;
+    settings.auditing.logUsesJSON = ( process.env.TI_AUDITING_LOG_USES_JSON !== undefined ) ? tools.toBool( process.env.TI_AUDITING_LOG_USES_JSON ) : settings.auditing.logUsesJSON;
 }
 if ( settings.memoryCache ) {
     settings.memoryCache.authKey = ( process.env.TI_MEMORY_CACHE_AUTH_KEY !== undefined ) ? process.env.TI_MEMORY_CACHE_AUTH_KEY : settings.memoryCache.authKey;
-    settings.memoryCache.redisDB = ( process.env.TI_MEMORY_CACHE_DB !== undefined ) ? process.env.TI_MEMORY_CACHE_DB : settings.memoryCache.redisDB;
-    settings.memoryCache.redisHost = ( process.env.TI_MEMORY_CACHE_HOST !== undefined ) ? process.env.TI_MEMORY_CACHE_HOST : settings.memoryCache.redisHost;
-    settings.memoryCache.redisPort = ( process.env.TI_MEMORY_CACHE_PORT !== undefined ) ? process.env.TI_MEMORY_CACHE_PORT : settings.memoryCache.redisPort;
+    settings.memoryCache.redisDB = ( process.env.TI_MEMORY_CACHE_REDIS_DB !== undefined ) ? process.env.TI_MEMORY_CACHE_REDIS_DB : settings.memoryCache.redisDB;
+    settings.memoryCache.redisHost = ( process.env.TI_MEMORY_CACHE_REDIS_HOST !== undefined ) ? process.env.TI_MEMORY_CACHE_REDIS_HOST : settings.memoryCache.redisHost;
+    settings.memoryCache.redisPort = ( process.env.TI_MEMORY_CACHE_REDIS_PORT !== undefined ) ? process.env.TI_MEMORY_CACHE_REDIS_PORT : settings.memoryCache.redisPort;
+}
+if ( settings.messageExchange ) {
+    settings.messageExchange.securityHashEnabled = ( process.env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED !== undefined ) ? tools.toBool( process.env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_ENABLED ) : settings.messageExchange.securityHashEnabled;
+    settings.messageExchange.securityHashKey = ( process.env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_KEY !== undefined ) ? process.env.TI_MESSAGE_EXCHANGE_SECURITY_HASH_KEY : settings.messageExchange.securityHashKey;
+    settings.messageExchange.traceLogEnabled = ( process.env.TI_MESSAGE_EXCHANGE_TRACE_LOG_ENABLED !== undefined ) ? tools.toBool( process.env.TI_MESSAGE_EXCHANGE_TRACE_LOG_ENABLED ) : settings.messageExchange.traceLogEnabled;
 }
 
-// make sure GCloud is enabled before trying to setup it:
+// make sure GCloud is enabled before trying to set it up:
 if ( process.env.TI_GCLOUD_ENABLED === true && settings.gcloudIntegration ) {
     settings.gcloudIntegration.apiKey = ( process.env.TI_GCLOUD_API_KEY !== undefined ) ? process.env.TI_GCLOUD_API_KEY : settings.gcloudIntegration.apiKey;
     settings.gcloudIntegration.projectID = ( process.env.TI_GCLOUD_PROJECT_ID !== undefined ) ? process.env.TI_GCLOUD_PROJECT_ID : settings.gcloudIntegration.projectID;

package/utils/exceptions.js

@@ -25,6 +25,7 @@ let exceptionCodeEnum = tools.enum( {
     E_SEC_INVALID_AUTH_TOKEN: [ 2000, "invalid auth token", "Invalid authorization token provided." ],
     E_SEC_INVALID_EXPIRED_SESSION: [ 2001, "invalid or expired session", "Invalid or expired session encountered." ],
     E_SEC_UNAUTHORIZED_ACCESS: [ 2002, "unauthorized access", "Attempt for unauthorized access detected." ],
+    E_SEC_MESSAGE_TAMPERING_DETECTED: [ 2003, "message tampering detected", "The system detected tampering with the message received via message exchange." ],
     /** Cross-Application Communication exceptions - codes under 3xxx */
     E_COM_GENERAL_ERROR: [ 3000, "general communication error", "General error during cross-application communication." ],
     E_COM_MESSAGE_SENDER_UNAVAILABLE: [ 3001, "message sender unavailable", "The message sender instance is currently unavailable." ],