@tiledesk/tiledesk-server 2.22.7 → 2.23.0

package/CHANGELOG.md

@@ -5,7 +5,12 @@
 🚀        IN PRODUCTION                        🚀
 (https://www.npmjs.com/package/@tiledesk/tiledesk-server/v/2.3.77) 
 
-# 2.22.0
+# 2.23.1
+- Deprecated JWT helper routes (`/jwt/decode`, `/jwt/generatetestjwt`); they now return 410
+- Restricted bot and subscription tokens to their own project (cross-project access denied)
+- Improved error response sanitization for integration routes
+
+# 2.22.7
 - Addressed and resolved a security vulnerability
 - Updated tybot-connector to 2.1.11
 

package/app.js

@@ -622,7 +622,7 @@ app.use('/:projectid/publicanalytics', publicAnalytics);
 
 app.use('/:projectid/keys', [passport.authenticate(['basic', 'jwt'], { session: false }), validtoken, roleChecker.hasRole('agent')], key);
 
-//TODO deprecated?
+// Deprecated helper routes (/jwt/decode, /jwt/generatetestjwt) — respond with 410.
 app.use('/:projectid/jwt', jwtroute);
 
 

package/middleware/has-role.js

@@ -36,14 +36,32 @@ class RoleChecker {
 
 
 
-      isTypeAsFunction(type, user) {                 
+      /**
+       * Bot and subscription tokens must only authorize the project they belong to.
+       * Fail closed if id_project is missing.
+       */
+      belongsToProject(user, projectid) {
+        if (!user || user.id_project == null || projectid == null) {
+          return false;
+        }
+        return String(user.id_project) === String(projectid);
+      }
+
+      isTypeAsFunction(type, user, projectid) {
             winston.debug("isType:"+type);
             winston.debug("user", user);
-           //TODO Check if belongs to project
             if (type=='subscription' && user instanceof Subscription){
+              if (!this.belongsToProject(user, projectid)) {
+                winston.warn("Subscription " + (user && user._id) + " denied cross-project access to " + projectid);
+                return false;
+              }
               winston.debug("isTypeAsFunction is subscription");
               return true
             } else if (type=='bot' && user instanceof Faq_kb){
+              if (!this.belongsToProject(user, projectid)) {
+                winston.warn("Bot " + (user && user._id) + " denied cross-project access to " + projectid);
+                return false;
+              }
               winston.debug("isTypeAsFunction is bot");
               return true
             } else {
@@ -51,7 +69,7 @@ class RoleChecker {
 
               var adminEmail = process.env.ADMIN_EMAIL || "admin@tiledesk.com";
 
-              if (user && user.email && user.email === adminEmail) { //skip has role check 
+              if (user && user.email && user.email === adminEmail) { //skip has role check
                 return true;
               }
               return false;
@@ -59,7 +77,7 @@ class RoleChecker {
        }
 
 
-      isTypesAsFunction(types, user) {                 
+      isTypesAsFunction(types, user, projectid) {
         winston.debug("isTypes:"+types);
         winston.debug("user", user);
         var isType = false;
@@ -69,7 +87,7 @@ class RoleChecker {
           try {
             types.forEach(type => {
               winston.debug("type:"+type);
-              isType = this.isTypeAsFunction(type, user);
+              isType = this.isTypeAsFunction(type, user, projectid);
               winston.debug("isType:"+ isType);
               if (isType==true) {
                 throw BreakException; //https://stackoverflow.com/questions/2641347/short-circuit-array-foreach-like-calling-break
@@ -191,12 +209,12 @@ class RoleChecker {
           // console.log("QUIIIIIIIIIIIIIIIIIIIIIII",type);
           if (types && types.length>0) {
             // console.log("QUIIIIIIIIIIIIIIIIIIIIIII");
-            var checkRes = that.isTypesAsFunction(types, req.user);
+            var checkRes = that.isTypesAsFunction(types, req.user, projectid);
             winston.debug("checkRes: " + checkRes);
 
             if (checkRes) {
              return next();
-            }            
+            }
             // return that.isType(type)(req,res,next);
             // console.log("typers",typers);
           }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tiledesk/tiledesk-server",
   "description": "The Tiledesk server module",
-  "version": "2.22.7",
+  "version": "2.23.0",
   "scripts": {
     "start": "node ./bin/www",
     "pretest": "mongodb-runner start",

package/routes/integration.js

@@ -52,7 +52,7 @@ router.get('/:integration_id', async (req, res) => {
     Integration.findOne({ _id: integration_id, id_project: id_project }, (err, integration) => {
         if (err) {
             winston.error("Error find integration by id: ", err);
-            return res.status(404).send({ success: false, err: err });
+            return res.status(500).send({ success: false, message: "Error getting integration" });
         }
         if (!integration) {
             return res.status(404).send({ success: false, message: "Integration not found" });
@@ -73,7 +73,7 @@ router.get('/name/:integration_name', async (req, res) => {
     Integration.findOne({ id_project: id_project, name: integration_name }, (err, integration) => {
         if (err) {
             winston.error("Error find integration by name: ", err);
-            return res.status(404).send({ success: false, err: err });
+            return res.status(500).send({ success: false, message: "Error getting integration" });
         }
 
         if (!integration) {
@@ -96,7 +96,7 @@ router.post('/', async (req, res) => {
         existingIntegration = await Integration.findOne({ id_project: id_project, name: req.body.name });
     } catch (err) {
         winston.error("Error finding existing integration ", err);
-        return res.status(500).send({ success: false, err: err });
+        return res.status(500).send({ success: false, message: "Error creating integration" });
     }
 
     let newIntegration = {
@@ -112,7 +112,7 @@ router.post('/', async (req, res) => {
     Integration.findOneAndUpdate({ id_project: id_project, name: req.body.name },  newIntegration, { new: true, upsert: true, setDefaultsOnInsert: false}, (err, savedIntegration) => {
         if (err) {
             winston.error("Error creating new integration ", err);
-            return res.status(404).send({ success: false, err: err })
+            return res.status(500).send({ success: false, message: "Error creating integration" });
         }
 
         winston.debug("New integration created: ", savedIntegration);
@@ -168,7 +168,7 @@ router.put('/:integration_id', async (req, res) => {
         existingIntegration = await Integration.findOne({ _id: integration_id, id_project: id_project });
     } catch (err) {
         winston.error("Error finding integration to update ", err);
-        return res.status(500).send({ success: false, error: err });
+        return res.status(500).send({ success: false, message: "Error updating integration" });
     }
     if (!existingIntegration) {
         return res.status(404).send({ success: false, message: "Integration not found" });
@@ -187,7 +187,7 @@ router.put('/:integration_id', async (req, res) => {
     Integration.findOneAndUpdate({ _id: integration_id, id_project: id_project }, update, { new: true }, (err, savedIntegration) => {
         if (err) {
             winston.error("Error find by id and update integration: ", err);
-            return res.status(500).send({ success: false, error: err })
+            return res.status(500).send({ success: false, message: "Error updating integration" });
         }
         if (!savedIntegration) {
             return res.status(404).send({ success: false, message: "Integration not found" });
@@ -213,7 +213,7 @@ router.delete('/:integration_id', async (req, res) => {
     Integration.findOneAndDelete({ _id: integration_id, id_project: id_project }, (err, result) => {
         if (err) {
             winston.error("Error find by id and delete integration: ", err);
-            return res.status(500).send({ success: false, error: err })
+            return res.status(500).send({ success: false, message: "Error deleting integration" });
         }
         if (!result) {
             return res.status(404).send({ success: false, message: "Integration not found" });

package/routes/jwt.js

@@ -4,32 +4,35 @@
 // Modules imports
 const express = require('express');
 var router = express.Router();
-var config = require('../config/database'); 
+
+// Deprecated test/helper endpoints. Kept mounted so callers get an explicit
+// deprecation response instead of a silent 404. Do not re-enable without
+// proper authentication (passport + role checks).
+function deprecated(req, res) {
+  return res.status(410).send({
+    success: false,
+    msg: 'deprecated'
+  });
+}
+
+router.post('/decode', deprecated);
+router.post('/generatetestjwt', deprecated);
+
+/*
+var config = require('../config/database');
 var jwt = require('jsonwebtoken');
 var validtoken = require('../middleware/valid-token');
 var requestUtil = require('../utils/requestUtil');
 var Project = require('../models/project');
 var winston = require('../config/winston');
 
-// deprecated??
 router.post('/decode', validtoken, function (req, res) {
-
-    // var project_id = req.query.project_id;
-
-    // winston.debug("project_id", project_id);
-
-    // if (!project_id) {
-    //     winston.error("project_id parameter is required");
-    //     res.status(400).send({ success: false, msg: "project_id parameter is required" });
-    // }
-
-
-    return  Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
+    return Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
       if (err) {
         winston.error('Error finding project', err);
         return res.status(500).send({ success: false, msg: 'Error finding project.' });
      }
-    
+
       winston.debug('project', project);
 
       if (!project) {
@@ -40,74 +43,60 @@ router.post('/decode', validtoken, function (req, res) {
         return res.status(404).send({ success: false, msg: 'Project hasnt  a jwtSecret' });
       }
 
-
         try {
           winston.debug("requestUtil", requestUtil);
             var token = requestUtil.getToken(req.headers);
 
-
             winston.debug("token", token);
-            // verify a token symmetric - synchronous
             var decoded = jwt.verify(token, project.jwtSecret);
-            
+
             winston.debug("decoded", decoded);
-      
 
-            if(!decoded.iat ) {                  
+            if(!decoded.iat ) {
                 winston.debug("token.iat is required");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. Token iat is required'});
             }
-            if(!decoded.exp ) {                  
+            if(!decoded.exp ) {
                 winston.debug("token.exp is required");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. Token exp is required'});
             }
-            if(decoded.exp - decoded.iat  > 600  ) {                  
+            if(decoded.exp - decoded.iat  > 600  ) {
                 winston.debug("The value of exp is permitted to be up to a maximum of 10 minutes from the iat value");
                 return res.status(401).send({ success: false, msg: 'Authentication failed. The value of exp is permitted to be up to a maximum of 10 minutes from the iat value'});
             }
 
-
             return res.json({decoded: decoded});
-          
-    
+
         } catch(err) {
             winston.error("Authentication failed", err);
             return res.status(401).send({ success: false, msg: 'Authentication failed', err: err });
-        }  
+        }
 
     });
-    
-  
   });
 
   router.post('/generatetestjwt', validtoken, function (req, res) {
-    
     winston.debug("req.body", req.body);
-    return  Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {    
+    return Project.findOne({_id: req.projectid, status: 100}, '+jwtSecret',function(err, project) {
         if (err) {
           winston.error('Error finding project', err);
           return res.status(500).send({ success: false, msg: 'Error finding project.' });
        }
-      
+
         winston.debug('project', project);
-  
+
         if (!project) {
             return res.status(404).send({ success: false, msg: 'Project not found' });
         }
-  
+
         if (!project.jwtSecret) {
           return res.status(404).send({ success: false, msg: 'Project hasnt  a jwtSecret' });
         }
 
         var token = jwt.sign(req.body, project.jwtSecret,{ expiresIn: 300 });
-        // var token = jwt.sign(req.body, project.jwtSecret);
-
-
-     
         res.json({ success: true, token: 'JWT ' + token });
     });
-
   });
+*/
 
-
-  module.exports = router;
+module.exports = router;

package/test/authenticationJwt.js

@@ -401,7 +401,41 @@ describe('AuthenticationJWT', () => {
                 });
             });
         });
-    }); 
+    });
+
+    it('botJwt-denied-cross-project', (done) => {
+
+        var email = "test-signup-" + Date.now() + "@email.com";
+        var pwd = "pwd";
+
+        userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
+            projectService.create("test-bot-project-a", savedUser._id).then(function (projectA) {
+                projectService.create("test-bot-project-b", savedUser._id).then(function (projectB) {
+                    faqService.create(projectA._id, savedUser._id, { name: "testbot-cross" }).then(function (savedBot) {
+
+                        var savedBotObj = savedBot.toObject();
+                        var signOptions = {
+                            subject: 'bot',
+                            audience: 'https://tiledesk.com/bots/' + savedBot._id,
+                        };
+                        var jwtToken = jwt.sign(savedBotObj, savedBot.secret, signOptions);
+
+                        chai.request(server)
+                            .get('/' + projectB._id + '/authtestWithRoleCheck/bot')
+                            .set('Authorization', 'JWT ' + jwtToken)
+                            .send()
+                            .end((err, res) => {
+                                if (err) { console.error("err: ", err); }
+                                if (log) { console.log("res.body", res.body); }
+
+                                res.should.have.status(403);
+                                done();
+                            });
+                    });
+                });
+            });
+        });
+    });
 
 });
 

package/test/jwtRoute.js

@@ -1,7 +1,6 @@
 //During the test the env variable is set to test
 process.env.NODE_ENV = 'test';
 
-var User = require('../models/user');
 var projectService = require('../services/projectService');
 var userService = require('../services/userService');
 
@@ -10,158 +9,60 @@ let chai = require('chai');
 let chaiHttp = require('chai-http');
 let server = require('../app');
 let should = chai.should();
-var jwt = require('jsonwebtoken');
 
 let log = false;
 
-// chai.config.includeStack = true;
-
 var expect = chai.expect;
-var assert = chai.assert;
 
 chai.use(chaiHttp);
 
 describe('JWTRoute', () => {
 
-  describe('/decode', () => {
-
-    it('decodeWithIatExp', (done) => {
+  describe('deprecated endpoints', () => {
 
+    it('generatetestjwt returns deprecated', (done) => {
       var email = "test-signup-" + Date.now() + "@email.com";
       var pwd = "pwd";
 
       userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
+        projectService.create("test-jwt-deprecated", savedUser._id).then(function (savedProject) {
           chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
+            .post('/' + savedProject._id + '/jwt/generatetestjwt')
             .auth(email, pwd)
-            .send()
+            .send({ "name": "andrea", "surname": "leo" })
             .end((err, res) => {
-
               if (err) { console.error("err: ", err); }
               if (log) { console.log("res.body", res.body); }
 
-              res.should.have.status(200);
+              res.should.have.status(410);
               res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/generatetestjwt')
-                .auth(email, pwd)
-                .send({ "name": "andrea", "surname": "leo" })
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(200);
-                  res.body.should.be.a('object');
-                  expect(res.body.token).to.not.equal(null);
-
-                  var jwtToken = res.body.token;
-                  if (log) { console.log("jwtToken", jwtToken); }
-                  
-                  chai.request(server)
-                    .post('/' + savedProject._id + '/jwt/decode')
-                    .set('Authorization', jwtToken)
-                    .send()
-                    .end((err, res) => {
-
-                      res.should.have.status(200);
-                      res.body.should.be.a('object');
-                      
-                      expect(res.body.name).to.not.equal("andrea");
-                      expect(res.body.surname).to.not.equal("leo");
-                      expect(res.body.iat).to.not.equal(null);
-                      expect(res.body.exp).to.not.equal(null);
-
-                      done();
-                    });
-                });
+              expect(res.body.success).to.equal(false);
+              expect(res.body.msg).to.equal('deprecated');
+              done();
             });
         });
       });
     }).timeout(20000);
 
-
-    it('decodeWithIatNoExp', (done) => {
-
+    it('decode returns deprecated', (done) => {
       var email = "test-signup-" + Date.now() + "@email.com";
       var pwd = "pwd";
 
       userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
+        projectService.create("test-jwt-deprecated-decode", savedUser._id).then(function (savedProject) {
           chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
+            .post('/' + savedProject._id + '/jwt/decode')
             .auth(email, pwd)
             .send()
             .end((err, res) => {
-
               if (err) { console.error("err: ", err); }
               if (log) { console.log("res.body", res.body); }
 
-              res.should.have.status(200);
+              res.should.have.status(410);
               res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              var jwtToken = jwt.sign({ "name": "andrea", "surname": "leo" }, res.body.jwtSecret);
-              if (log) { console.log("jwtToken", jwtToken); }
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/decode')
-                .set('Authorization', 'JWT ' + jwtToken)
-                .send()
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(401);
-
-                  done();
-                });
-            });
-        });
-      });
-    }).timeout(20000);
-
-
-    it('decodeWithIatTooHightExp', (done) => {
-
-      var email = "test-signup-" + Date.now() + "@email.com";
-      var pwd = "pwd";
-
-      userService.signup(email, pwd, "Test Firstname", "Test lastname").then(function (savedUser) {
-        projectService.create("test-join-member", savedUser._id).then(function (savedProject) {
-          chai.request(server)
-            .post('/' + savedProject._id + '/keys/generate')
-            .auth(email, pwd)
-            .send()
-            .end((err, res) => {
-
-              if (err) { console.error("err: ", err); }
-              if (log) { console.log("res.body", res.body); }
-
-              res.should.have.status(200);
-              res.body.should.be.a('object');
-              expect(res.body.jwtSecret).to.not.equal(null);
-
-              var jwtToken = jwt.sign({ "name": "andrea", "surname": "leo" }, res.body.jwtSecret, { expiresIn: 800 });
-              if (log) { console.log("jwtToken", jwtToken); }
-
-              chai.request(server)
-                .post('/' + savedProject._id + '/jwt/decode')
-                .set('Authorization', 'JWT ' + jwtToken)
-                .send()
-                .end((err, res) => {
-
-                  if (err) { console.error("err: ", err); }
-                  if (log) { console.log("res.body", res.body); }
-
-                  res.should.have.status(401);
-
-                  done();
-                });
+              expect(res.body.success).to.equal(false);
+              expect(res.body.msg).to.equal('deprecated');
+              done();
             });
         });
       });
@@ -170,5 +71,3 @@ describe('JWTRoute', () => {
   });
 
 });
-
-