@universis/janitor 1.10.0 → 1.12.0

package/dist/index.js

@@ -13,6 +13,8 @@ require('@themost/promise-sequence');
 var url = require('url');
 var superagent = require('superagent');
 var jwt = require('jsonwebtoken');
+var BearerStrategy = require('passport-http-bearer');
+var passport = require('passport');
 
 class RateLimitService extends common.ApplicationService {
   /**
@@ -531,12 +533,21 @@ class RedisClientStore extends rateLimitRedis.RedisStore {
    * @param {{windowMs: number}} options
    */
   constructor(service, options) {
+    // IMPORTANT NOTE: call super with a dummy sendCommand()
+    // for implementing a custom sendCommand method
+    // which binds sendCommand to this instance
     super({
-      /**
+      sendCommand: function () {}
+    });
+    // create a custom sendCommand method
+    // noinspection JSCommentMatchesSignature,JSCheckFunctionSignatures
+    /**
+     * @type {import('redis').RedisClientType}
+     */_defineProperty(this, "client", void 0);const opts = { /**
        * @param {...string} args
        * @returns {Promise<*>}
-       */
-      sendCommand: function () {
+       */sendCommand: function () {
+
         const args = Array.from(arguments);
         const [command] = args.splice(0, 1);
         const self = this;
@@ -577,7 +588,7 @@ class RedisClientStore extends rateLimitRedis.RedisStore {
         // send load script commands once
         return (() => {
           if (self.incrementScriptSha == null) {
-            return this.postInit();
+            return self.postInit();
           }
           return Promise.resolve();
         })().then(() => {
@@ -591,9 +602,13 @@ class RedisClientStore extends rateLimitRedis.RedisStore {
           });
         });
       }
-    }); /**
-     * @type {import('redis').RedisClientType}
-     */_defineProperty(this, "client", void 0);this.init(options);common.TraceUtils.debug('RedisClientStore: Starting up and loading increment and get scripts.');
+    };
+    // bind sendCommand to this instance, applying command array as arguments
+    // like rate-limit-redis expects
+    // noinspection JSCheckFunctionSignatures
+    this.sendCommand = async ({ command }) => opts.sendCommand.bind(this)(...command);
+    this.init(options);
+    common.TraceUtils.debug('RedisClientStore: Starting up and loading increment and get scripts.');
     void this.postInit().then(() => {
       common.TraceUtils.debug('RedisClientStore: Successfully loaded increment and get scripts.');
     }).catch((err) => {
@@ -1184,13 +1199,164 @@ class AppSpeedLimitService extends SpeedLimitService {
   }
 }
 
+class HttpBearerTokenRequired extends common.HttpError {
+  constructor() {
+    super(499, 'A token is required to fulfill the request.');
+    this.code = 'E_TOKEN_REQUIRED';
+    this.title = 'Token Required';
+  }
+}
+
+class HttpBearerTokenNotFound extends common.HttpError {
+  constructor() {
+    super(498, 'Token was not found.');
+    this.code = 'E_TOKEN_NOT_FOUND';
+    this.title = 'Invalid token';
+  }
+}
+
+class HttpBearerTokenExpired extends common.HttpError {
+  constructor() {
+    super(498, 'Token was expired or is in invalid state.');
+    this.code = 'E_TOKEN_EXPIRED';
+    this.title = 'Invalid token';
+  }
+}
+
+class HttpAccountDisabled extends common.HttpForbiddenError {
+  constructor() {
+    super('Access is denied. User account is disabled.');
+    this.code = 'E_ACCOUNT_DISABLED';
+    this.statusCode = 403.2;
+    this.title = 'Disabled account';
+  }
+}
+
+class HttpBearerStrategy extends BearerStrategy {
+  constructor() {
+    super({
+      passReqToCallback: true
+    },
+    /**
+     * @param {Request} req
+     * @param {string} token
+     * @param {Function} done
+     */
+    function (req, token, done) {
+      /**
+       * Gets OAuth2 client services
+       * @type {import('./OAuth2ClientService').OAuth2ClientService}
+       */
+      let client = req.context.getApplication().getStrategy(function OAuth2ClientService() {});
+      // if client cannot be found
+      if (client == null) {
+        // throw configuration error
+        return done(new Error('Invalid application configuration. OAuth2 client service cannot be found.'));
+      }
+      if (token == null) {
+        // throw 499 Token Required error
+        return done(new HttpBearerTokenRequired());
+      }
+      // get token info
+      client.getTokenInfo(req.context, token).then((info) => {
+        if (info == null) {
+          // the specified token cannot be found - 498 invalid token with specific code
+          return done(new HttpBearerTokenNotFound());
+        }
+        // if the given token is not active throw token expired - 498 invalid token with specific code
+        if (!info.active) {
+          return done(new HttpBearerTokenExpired());
+        }
+        // find user from token info
+        return function () {
+          /**
+           * @type {import('./services/user-provisioning-mapper-service').UserProvisioningMapperService}
+           */
+          const mapper = req.context.getApplication().getService(function UserProvisioningMapperService() {});
+          if (mapper == null) {
+            return req.context.model('User').where('name').equal(info.username).silent().getItem();
+          }
+          return mapper.getUser(req.context, info);
+        }().then((user) => {
+          // check if userProvisioning service is installed and try to find related user only if user not found
+          if (user == null) {
+            /**
+             * @type {import('./services/user-provisioning-service').UserProvisioningService}
+             */
+            const service = req.context.getApplication().getService(function UserProvisioningService() {});
+            if (service == null) {
+              return user;
+            }
+            return service.validateUser(req.context, info);
+          }
+          return user;
+        }).then((user) => {
+          // user cannot be found and of course cannot be authenticated (throw forbidden error)
+          if (user == null) {
+            // write access log for forbidden
+            return done(new common.HttpForbiddenError());
+          }
+          // check if user has enabled attribute
+          if (Object.prototype.hasOwnProperty.call(user, 'enabled') && !user.enabled) {
+            //if user.enabled is off throw forbidden error
+            return done(new HttpAccountDisabled('Access is denied. User account is disabled.'));
+          }
+          // otherwise return user data
+          return done(null, {
+            'name': user.name,
+            'authenticationProviderKey': user.id,
+            'authenticationType': 'Bearer',
+            'authenticationToken': token,
+            'authenticationScope': info.scope
+          });
+        });
+      }).catch((err) => {
+        // end log token info request with error
+        if (err && err.statusCode === 404) {
+          // revert 404 not found returned by auth server to 498 invalid token
+          return done(new HttpBearerTokenNotFound());
+        }
+        // otherwise continue with error
+        return done(err);
+      });
+    });
+  }
+}
+
+class PassportService extends common.ApplicationService {
+  constructor(app) {
+    super(app);
+    const authenticator = new passport.Authenticator();
+    Object.defineProperty(this, 'authenticator', {
+      configurable: true,
+      enumerable: false,
+      writable: false,
+      value: authenticator
+    });
+  }
+
+  /**
+   * @returns {import('passport').Authenticator}
+   */
+  getInstance() {
+    return this.authenticator;
+  }
+
+}
+
 exports.AppRateLimitService = AppRateLimitService;
 exports.AppSpeedLimitService = AppSpeedLimitService;
 exports.DefaultScopeAccessConfiguration = DefaultScopeAccessConfiguration;
 exports.EnableScopeAccessConfiguration = EnableScopeAccessConfiguration;
 exports.ExtendScopeAccessConfiguration = ExtendScopeAccessConfiguration;
+exports.HttpAccountDisabled = HttpAccountDisabled;
+exports.HttpBearerStrategy = HttpBearerStrategy;
+exports.HttpBearerTokenExpired = HttpBearerTokenExpired;
+exports.HttpBearerTokenNotFound = HttpBearerTokenNotFound;
+exports.HttpBearerTokenRequired = HttpBearerTokenRequired;
 exports.HttpRemoteAddrForbiddenError = HttpRemoteAddrForbiddenError;
 exports.OAuth2ClientService = OAuth2ClientService;
+exports.PassportService = PassportService;
 exports.RateLimitService = RateLimitService;
 exports.RedisClientStore = RedisClientStore;
 exports.RemoteAddressValidator = RemoteAddressValidator;