@universis/janitor 1.4.1 → 1.6.0

package/dist/RemoteAddressValidator.js

@@ -0,0 +1,88 @@
+"use strict";Object.defineProperty(exports, "__esModule", { value: true });exports.RemoteAddressValidator = exports.HttpRemoteAddrForbiddenError = void 0;var _common = require("@themost/common");
+var _express = _interopRequireDefault(require("express"));
+var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));function _interopRequireDefault(obj) {return obj && obj.__esModule ? obj : { default: obj };}
+
+class HttpRemoteAddrForbiddenError extends _common.HttpForbiddenError {
+  constructor() {
+    super('Access is denied due to remote address conflict. The client network has been changed or cannot be determined.');
+    this.statusCode = 403.6;
+  }
+
+}exports.HttpRemoteAddrForbiddenError = HttpRemoteAddrForbiddenError;
+
+class RemoteAddressValidator extends _common.ApplicationService {
+  constructor(app) {
+    super(app);
+
+    // get proxy address forwarding option
+    this.proxyAddressForwarding = app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding');
+    if (typeof proxyAddressForwarding !== 'boolean') {
+      this.proxyAddressForwarding = false;
+    }
+    // get token claim name
+    this.claim = app.getConfiguration().getSourceAt('settings/universis/janitor/remoteAddress/claim') || 'remoteAddress';
+
+    app.serviceRouter.subscribe((serviceRouter) => {
+      if (serviceRouter == null) {
+        return;
+      }
+      const addRouter = _express.default.Router();
+      addRouter.use((req, res, next) => {
+        void this.validateRemoteAddress(req).then((value) => {
+          if (value === false) {
+            return next(new HttpRemoteAddrForbiddenError());
+          }
+          return next();
+        }).catch((err) => {
+          return next(err);
+        });
+      });
+      // insert router at the beginning of serviceRouter.stack
+      serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);
+    });
+  }
+
+  /**
+   * Gets remote address from request
+   * @param {import('express').Request} req 
+   * @returns 
+   */
+  getRemoteAddress(req) {
+    let remoteAddress;
+    if (this.proxyAddressForwarding) {
+      // get proxy headers or remote address
+      remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);
+    } else {
+      remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;
+    }
+    return remoteAddress;
+  }
+
+  /**
+   * Validates token remote address with request remote address
+   * @param {import('express').Request} req 
+   * @returns {Promise<boolean>}
+   */
+  async validateRemoteAddress(req) {var _req$context, _req$context$user;
+    const authenticationToken = (_req$context = req.context) === null || _req$context === void 0 ? void 0 : (_req$context$user = _req$context.user) === null || _req$context$user === void 0 ? void 0 : _req$context$user.authenticationToken;
+    if (authenticationToken != null) {
+      const access_token = _jsonwebtoken.default.decode(authenticationToken);
+      const remoteAddress = access_token[this.claim];
+      if (remoteAddress == null) {
+        _common.TraceUtils.warn(`Remote address validation failed. Expected a valid remote address claimed by using "${this.claim}" attribute but got none.`);
+        return false;
+      }
+      // get context remote address
+      const requestRemoteAddress = this.getRemoteAddress(req);
+      if (remoteAddress !== requestRemoteAddress) {
+        _common.TraceUtils.warn(`Remote address validation failed. Expected remote address is ${remoteAddress || 'Uknown'} but request remote address is ${requestRemoteAddress}`);
+        return false;
+      }
+      return true;
+    }
+    _common.TraceUtils.warn('Remote address validation cannot be completed because authentication token is not available.');
+    return false;
+  }
+
+}exports.RemoteAddressValidator = RemoteAddressValidator;
+//# sourceMappingURL=RemoteAddressValidator.js.map

package/dist/RemoteAddressValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoteAddressValidator.js","names":["_common","require","_express","_interopRequireDefault","_jsonwebtoken","obj","__esModule","default","HttpRemoteAddrForbiddenError","HttpForbiddenError","constructor","statusCode","exports","RemoteAddressValidator","ApplicationService","app","proxyAddressForwarding","getConfiguration","getSourceAt","claim","serviceRouter","subscribe","addRouter","express","Router","use","req","res","next","validateRemoteAddress","then","value","catch","err","stack","unshift","apply","getRemoteAddress","remoteAddress","headers","connection","socket","_req$context","_req$context$user","authenticationToken","context","user","access_token","jwt","decode","TraceUtils","warn","requestRemoteAddress"],"sources":["../src/RemoteAddressValidator.js"],"sourcesContent":["import { ApplicationService, HttpForbiddenError, TraceUtils } from '@themost/common';\nimport express from 'express';\nimport jwt from 'jsonwebtoken';\n\nclass HttpRemoteAddrForbiddenError extends HttpForbiddenError {\n    constructor() {\n        super('Access is denied due to remote address conflict. The client network has been changed or cannot be determined.');\n        this.statusCode = 403.6;\n    }\n    \n}\n\nclass RemoteAddressValidator extends ApplicationService {\n  constructor(app) {\n    super(app);\n\n    // get proxy address forwarding option\n    this.proxyAddressForwarding = app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding');\n    if (typeof proxyAddressForwarding !== 'boolean') {\n        this.proxyAddressForwarding = false;\n    }\n    // get token claim name\n    this.claim = app.getConfiguration().getSourceAt('settings/universis/janitor/remoteAddress/claim') || 'remoteAddress';\n\n    app.serviceRouter.subscribe((serviceRouter) => {\n        if (serviceRouter == null) {\n            return;\n        }\n        const addRouter = express.Router();\n        addRouter.use((req, res, next) => {\n            void this.validateRemoteAddress(req).then((value) => {\n                if (value === false) {\n                    return next(new HttpRemoteAddrForbiddenError());\n                }\n                return next();\n            }).catch((err) => {\n                return next(err);\n            });\n        });\n        // insert router at the beginning of serviceRouter.stack\n        serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);\n    });\n  }\n\n  /**\n   * Gets remote address from request\n   * @param {import('express').Request} req \n   * @returns \n   */\n  getRemoteAddress(req) {\n    let remoteAddress;\n    if (this.proxyAddressForwarding) {\n        // get proxy headers or remote address\n        remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);\n    } else {\n        remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;\n    }\n    return remoteAddress;\n  }\n\n  /**\n   * Validates token remote address with request remote address\n   * @param {import('express').Request} req \n   * @returns {Promise<boolean>}\n   */\n  async validateRemoteAddress(req) {\n    const authenticationToken = req.context?.user?.authenticationToken;\n    if (authenticationToken != null) {\n        const access_token = jwt.decode(authenticationToken);\n        const remoteAddress = access_token[this.claim];\n        if (remoteAddress == null) {\n            TraceUtils.warn(`Remote address validation failed. Expected a valid remote address claimed by using \"${this.claim}\" attribute but got none.`);\n            return false;\n        }\n        // get context remote address\n        const requestRemoteAddress = this.getRemoteAddress(req);\n        if (remoteAddress !== requestRemoteAddress) {\n            TraceUtils.warn(`Remote address validation failed. Expected remote address is ${remoteAddress || 'Uknown'} but request remote address is ${requestRemoteAddress}`);\n            return false;\n        }\n        return true;\n    }\n    TraceUtils.warn('Remote address validation cannot be completed because authentication token is not available.');\n    return false;\n  }\n\n}\n\nexport {\n    HttpRemoteAddrForbiddenError,\n    RemoteAddressValidator\n}\n"],"mappings":"0JAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAC,sBAAA,CAAAF,OAAA;AACA,IAAAG,aAAA,GAAAD,sBAAA,CAAAF,OAAA,kBAA+B,SAAAE,uBAAAE,GAAA,UAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;;AAE/B,MAAMG,4BAA4B,SAASC,0BAAkB,CAAC;EAC1DC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC,+GAA+G,CAAC;IACtH,IAAI,CAACC,UAAU,GAAG,KAAK;EAC3B;;AAEJ,CAACC,OAAA,CAAAJ,4BAAA,GAAAA,4BAAA;;AAED,MAAMK,sBAAsB,SAASC,0BAAkB,CAAC;EACtDJ,WAAWA,CAACK,GAAG,EAAE;IACf,KAAK,CAACA,GAAG,CAAC;;IAEV;IACA,IAAI,CAACC,sBAAsB,GAAGD,GAAG,CAACE,gBAAgB,EAAE,CAACC,WAAW,CAAC,+CAA+C,CAAC;IACjH,IAAI,OAAOF,sBAAsB,KAAK,SAAS,EAAE;MAC7C,IAAI,CAACA,sBAAsB,GAAG,KAAK;IACvC;IACA;IACA,IAAI,CAACG,KAAK,GAAGJ,GAAG,CAACE,gBAAgB,EAAE,CAACC,WAAW,CAAC,gDAAgD,CAAC,IAAI,eAAe;;IAEpHH,GAAG,CAACK,aAAa,CAACC,SAAS,CAAC,CAACD,aAAa,KAAK;MAC3C,IAAIA,aAAa,IAAI,IAAI,EAAE;QACvB;MACJ;MACA,MAAME,SAAS,GAAGC,gBAAO,CAACC,MAAM,EAAE;MAClCF,SAAS,CAACG,GAAG,CAAC,CAACC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;QAC9B,KAAK,IAAI,CAACC,qBAAqB,CAACH,GAAG,CAAC,CAACI,IAAI,CAAC,CAACC,KAAK,KAAK;UACjD,IAAIA,KAAK,KAAK,KAAK,EAAE;YACjB,OAAOH,IAAI,CAAC,IAAIpB,4BAA4B,EAAE,CAAC;UACnD;UACA,OAAOoB,IAAI,EAAE;QACjB,CAAC,CAAC,CAACI,KAAK,CAAC,CAACC,GAAG,KAAK;UACd,OAAOL,IAAI,CAACK,GAAG,CAAC;QACpB,CAAC,CAAC;MACN,CAAC,CAAC;MACF;MACAb,aAAa,CAACc,KAAK,CAACC,OAAO,CAACC,KAAK,CAAChB,aAAa,CAACc,KAAK,EAAEZ,SAAS,CAACY,KAAK,CAAC;IAC3E,CAAC,CAAC;EACJ;;EAEA;AACF;AACA;AACA;AACA;EACEG,gBAAgBA,CAACX,GAAG,EAAE;IACpB,IAAIY,aAAa;IACjB,IAAI,IAAI,CAACtB,sBAAsB,EAAE;MAC7B;MACAsB,aAAa,GAAGZ,GAAG,CAACa,OAAO,CAAC,WAAW,CAAC,IAAIb,GAAG,CAACa,OAAO,CAAC,iBAAiB,CAAC,KAAKb,GAAG,CAACc,UAAU,GAAGd,GAAG,CAACc,UAAU,CAACF,aAAa,GAAGZ,GAAG,CAACe,MAAM,CAACH,aAAa,CAAC;IAC5J,CAAC,MAAM;MACHA,aAAa,GAAGZ,GAAG,CAACc,UAAU,GAAGd,GAAG,CAACc,UAAU,CAACF,aAAa,GAAGZ,GAAG,CAACe,MAAM,CAACH,aAAa;IAC5F;IACA,OAAOA,aAAa;EACtB;;EAEA;AACF;AACA;AACA;AACA;EACE,MAAMT,qBAAqBA,CAACH,GAAG,EAAE,KAAAgB,YAAA,EAAAC,iBAAA;IAC/B,MAAMC,mBAAmB,IAAAF,YAAA,GAAGhB,GAAG,CAACmB,OAAO,cAAAH,YAAA,wBAAAC,iBAAA,GAAXD,YAAA,CAAaI,IAAI,cAAAH,iBAAA,uBAAjBA,iBAAA,CAAmBC,mBAAmB;IAClE,IAAIA,mBAAmB,IAAI,IAAI,EAAE;MAC7B,MAAMG,YAAY,GAAGC,qBAAG,CAACC,MAAM,CAACL,mBAAmB,CAAC;MACpD,MAAMN,aAAa,GAAGS,YAAY,CAAC,IAAI,CAAC5B,KAAK,CAAC;MAC9C,IAAImB,aAAa,IAAI,IAAI,EAAE;QACvBY,kBAAU,CAACC,IAAI,CAAE,uFAAsF,IAAI,CAAChC,KAAM,2BAA0B,CAAC;QAC7I,OAAO,KAAK;MAChB;MACA;MACA,MAAMiC,oBAAoB,GAAG,IAAI,CAACf,gBAAgB,CAACX,GAAG,CAAC;MACvD,IAAIY,aAAa,KAAKc,oBAAoB,EAAE;QACxCF,kBAAU,CAACC,IAAI,CAAE,gEAA+Db,aAAa,IAAI,QAAS,kCAAiCc,oBAAqB,EAAC,CAAC;QAClK,OAAO,KAAK;MAChB;MACA,OAAO,IAAI;IACf;IACAF,kBAAU,CAACC,IAAI,CAAC,8FAA8F,CAAC;IAC/G,OAAO,KAAK;EACd;;AAEF,CAACvC,OAAA,CAAAC,sBAAA,GAAAA,sBAAA"}

package/dist/index.d.ts

@@ -3,3 +3,5 @@ export * from './SpeedLimitService';
 export * from './RedisClientStore';
 export * from './ScopeAccessConfiguration';
 export * from './validateScope';
+export * from './OAuth2ClientService';
+export * from './RemoteAddressValidator';

package/dist/index.js

@@ -4,4 +4,6 @@ var _SpeedLimitService = require("./SpeedLimitService");Object.keys(_SpeedLimitS
 var _RedisClientStore = require("./RedisClientStore");Object.keys(_RedisClientStore).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _RedisClientStore[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _RedisClientStore[key];} });});
 var _ScopeAccessConfiguration = require("./ScopeAccessConfiguration");Object.keys(_ScopeAccessConfiguration).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _ScopeAccessConfiguration[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _ScopeAccessConfiguration[key];} });});
 var _validateScope = require("./validateScope");Object.keys(_validateScope).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _validateScope[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _validateScope[key];} });});
+var _OAuth2ClientService = require("./OAuth2ClientService");Object.keys(_OAuth2ClientService).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _OAuth2ClientService[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _OAuth2ClientService[key];} });});
+var _RemoteAddressValidator = require("./RemoteAddressValidator");Object.keys(_RemoteAddressValidator).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _RemoteAddressValidator[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _RemoteAddressValidator[key];} });});
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["require","_RateLimitService","Object","keys","forEach","key","exports","defineProperty","enumerable","get","_SpeedLimitService","_RedisClientStore","_ScopeAccessConfiguration","_validateScope"],"sources":["../src/index.js"],"sourcesContent":["import './polyfills';\nexport * from './RateLimitService';\nexport * from './SpeedLimitService';\nexport * from './RedisClientStore';\nexport * from './ScopeAccessConfiguration';\nexport * from './validateScope';\n"],"mappings":"2EAAAA,OAAA;AACA,IAAAC,iBAAA,GAAAD,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAF,iBAAA,EAAAG,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAJ,iBAAA,CAAAI,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAR,iBAAA,CAAAI,GAAA;AACA,IAAAK,kBAAA,GAAAV,OAAA,wBAAAE,MAAA,CAAAC,IAAA,CAAAO,kBAAA,EAAAN,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAK,kBAAA,CAAAL,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAC,kBAAA,CAAAL,GAAA;AACA,IAAAM,iBAAA,GAAAX,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAQ,iBAAA,EAAAP,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAM,iBAAA,CAAAN,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAE,iBAAA,CAAAN,GAAA;AACA,IAAAO,yBAAA,GAAAZ,OAAA,+BAAAE,MAAA,CAAAC,IAAA,CAAAS,yBAAA,EAAAR,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAO,yBAAA,CAAAP,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAG,yBAAA,CAAAP,GAAA;AACA,IAAAQ,cAAA,GAAAb,OAAA,oBAAAE,MAAA,CAAAC,IAAA,CAAAU,cAAA,EAAAT,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAQ,cAAA,CAAAR,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAI,cAAA,CAAAR,GAAA"}
+{"version":3,"file":"index.js","names":["require","_RateLimitService","Object","keys","forEach","key","exports","defineProperty","enumerable","get","_SpeedLimitService","_RedisClientStore","_ScopeAccessConfiguration","_validateScope","_OAuth2ClientService","_RemoteAddressValidator"],"sources":["../src/index.js"],"sourcesContent":["import './polyfills';\nexport * from './RateLimitService';\nexport * from './SpeedLimitService';\nexport * from './RedisClientStore';\nexport * from './ScopeAccessConfiguration';\nexport * from './validateScope';\nexport * from './OAuth2ClientService';\nexport * from './RemoteAddressValidator';\n"],"mappings":"2EAAAA,OAAA;AACA,IAAAC,iBAAA,GAAAD,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAF,iBAAA,EAAAG,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAJ,iBAAA,CAAAI,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAR,iBAAA,CAAAI,GAAA;AACA,IAAAK,kBAAA,GAAAV,OAAA,wBAAAE,MAAA,CAAAC,IAAA,CAAAO,kBAAA,EAAAN,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAK,kBAAA,CAAAL,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAC,kBAAA,CAAAL,GAAA;AACA,IAAAM,iBAAA,GAAAX,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAQ,iBAAA,EAAAP,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAM,iBAAA,CAAAN,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAE,iBAAA,CAAAN,GAAA;AACA,IAAAO,yBAAA,GAAAZ,OAAA,+BAAAE,MAAA,CAAAC,IAAA,CAAAS,yBAAA,EAAAR,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAO,yBAAA,CAAAP,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAG,yBAAA,CAAAP,GAAA;AACA,IAAAQ,cAAA,GAAAb,OAAA,oBAAAE,MAAA,CAAAC,IAAA,CAAAU,cAAA,EAAAT,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAQ,cAAA,CAAAR,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAI,cAAA,CAAAR,GAAA;AACA,IAAAS,oBAAA,GAAAd,OAAA,0BAAAE,MAAA,CAAAC,IAAA,CAAAW,oBAAA,EAAAV,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAS,oBAAA,CAAAT,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAK,oBAAA,CAAAT,GAAA;AACA,IAAAU,uBAAA,GAAAf,OAAA,6BAAAE,MAAA,CAAAC,IAAA,CAAAY,uBAAA,EAAAX,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAU,uBAAA,CAAAV,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAM,uBAAA,CAAAV,GAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universis/janitor",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "Universis api plugin for rate limiting requests",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,8 +31,10 @@
   "dependencies": {
     "express-rate-limit": "^7.1.1",
     "express-slow-down": "^1.6.0",
+    "ioredis": "^5.3.2",
+    "jsonwebtoken": "^9.0.2",
     "rate-limit-redis": "^4.2.0",
-    "redis": "^4.6.10"
+    "superagent": "^8.1.2"
   },
   "peerDependencies": {
     "@themost/common": "^2",
@@ -50,6 +52,7 @@
     "@babel/register": "^7.21.0",
     "@rollup/plugin-babel": "^6.0.3",
     "@types/express": "^4.17.6",
+    "@types/ioredis": "^5.0.0",
     "@types/jasmine": "^3.5.10",
     "dotenv": "^8.2.0",
     "eslint": "^8.39.0",

package/src/OAuth2ClientService.d.ts

@@ -0,0 +1,98 @@
+import { ApplicationService, ApplicationBase } from '@themost/common';
+import { DataContext } from '@themost/data';
+
+export declare interface OAuth2MethodOptions {
+    access_token: string;
+}
+
+export declare interface OAuth2AuthorizeUser {
+    client_id?: string;
+    client_secret?: string;
+    username: string;
+    password: string;
+    grant_type: string;
+    scope?: string;
+}
+
+export declare interface OAuth2ServiceSettings {
+    unattendedExecutionAccount?: string;
+    client_id: string;
+    client_secret?: string;
+    server_uri: string;
+    userinfo_uri?: string;
+    introspect_uri?: string;
+    admin_uri?: string;
+    well_known_configuration_uri?: string;
+    adminAccount: {
+        username: string;
+        password: string;
+        client_id: string;
+        client_secret?: string;
+        scope?: string;
+    }
+}
+
+export declare interface OAuth2UserProfile {
+    sub: string;
+    name: string;
+    preferred_username: string;
+    given_name: string;
+    family_name: string;
+    email: string;
+}
+
+export declare interface GenericUser {
+     id?: any; 
+     additionalType?: string; 
+     alternateName?: string; 
+     description?: string; 
+     givenName?: string; 
+     familyName?: string; 
+     image?: string; 
+     name?: string; 
+     url?: string; 
+     dateCreated?: Date; 
+     dateModified?: Date; 
+     createdBy?: any; 
+     modifiedBy?: any; 
+     lockoutTime?: Date; 
+     logonCount?: number; 
+     enabled?: boolean; 
+     lastLogon?: Date; 
+     userCredentials?: {
+         userPassword?: string;
+         userActivated?: boolean;
+         temporary?: boolean;
+     }
+}
+
+export declare interface OAuth2User {
+    id?: any; 
+    username?: string; 
+    email?: string; 
+    enabled?: boolean;
+    emailVerified?: boolean;
+    firstName?: string; 
+    lastName?: string; 
+    credentials?: {
+        algorithm?: string,
+        temporary?: boolean,
+        type?: string,
+        value?: string
+    }
+}
+
+export declare class OAuth2ClientService extends ApplicationService {
+    get settings(): OAuth2ServiceSettings;
+    constructor(app: ApplicationBase)
+    getUserInfo(context: DataContext, token: string): Promise<OAuth2UserProfile>;
+    getTokenInfo(context: DataContext, token: string): Promise<any>;
+    getContextTokenInfo(context: DataContext): Promise<any>;
+    authorize(authorizeUser: OAuth2AuthorizeUser): Promise<{ access_token?: string, refresh_token?: string}>;
+    getUser(username: string, options: OAuth2MethodOptions): Promise<any>;
+    getUserById(user_id: any, options: OAuth2MethodOptions): Promise<any>;
+    getUserByEmail(email: string, options: OAuth2MethodOptions): Promise<any>;
+    updateUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    createUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    deleteUser(user: { id: any }, options: OAuth2MethodOptions): Promise<any>; 
+}

package/src/OAuth2ClientService.js

@@ -0,0 +1,255 @@
+import {Request} from 'superagent'
+import {URL} from 'url';
+import {ApplicationService, DataError, HttpError} from '@themost/common';
+
+function responseHander(resolve, reject) {
+    return function (err, response) {
+        if (err) {
+            /**
+             * @type {import('superagent').Response}
+             */
+            const response = err.response
+            if (response && response.headers['content-type'] === 'application/json') {
+                // get body
+                const clientError = response.body;
+                const error = new HttpError(response.status);
+                return reject(Object.assign(error, {
+                    clientError
+                }));
+            }
+            return reject(err);
+        }
+        if (response.status === 204 && response.headers['content-type'] === 'application/json') {
+            return resolve(null);
+        }
+        return resolve(response.body);
+    };
+}
+
+/**
+ * @class
+ */
+class OAuth2ClientService extends ApplicationService {
+    /**
+     * @param {import('@themost/express').ExpressDataApplication} app
+     */
+    constructor(app) {
+        super(app);
+        /**
+         * @name OAuth2ClientService#settings
+         * @type {{server_uri:string,token_uri?:string}}
+         */
+         Object.defineProperty(this, 'settings', {
+            writable: false,
+            value: app.getConfiguration().getSourceAt('settings/auth'),
+            enumerable: false,
+            configurable: false
+        });
+    }
+
+    /**
+     * Gets keycloak server root
+     * @returns {string}
+     */
+     getServer() {
+        return this.settings.server_uri;
+    }
+
+    /**
+     * Gets keycloak server root
+     * @returns {string}
+     */
+     getAdminRoot() {
+        return this.settings.admin_uri;
+    }
+
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Gets user's profile by calling OAuth2 server profile endpoint
+     * @param {ExpressDataContext} context
+     * @param {string} token
+     */
+    getUserInfo(token) {
+        return new Promise((resolve, reject) => {
+            const userinfo_uri = this.settings.userinfo_uri ? new URL(this.settings.userinfo_uri, this.getServer()) : new URL('me', this.getServer());
+            return new Request('GET', userinfo_uri)
+                .set({
+                    'Authorization': `Bearer ${token}`,
+                    'Accept': 'application/json'
+                })
+                .query({
+                    'access_token':token
+                }).end(responseHander(resolve, reject));
+        });
+    }
+
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Gets the token info of the current context
+     * @param {ExpressDataContext} context
+     */
+    getContextTokenInfo(context) {
+        if (context.user == null) {
+            return Promise.reject(new Error('Context user may not be null'));
+        }
+        if (context.user.authenticationType !== 'Bearer') {
+            return Promise.reject(new Error('Invalid context authentication type'));
+        }
+        if (context.user.authenticationToken == null) {
+            return Promise.reject(new Error('Context authentication data may not be null'));
+        }
+        return this.getTokenInfo(context, context.user.authenticationToken);
+    }
+    /**
+     * Gets token info by calling OAuth2 server endpoint
+     * @param {ExpressDataContext} _context
+     * @param {string} token
+     */
+    getTokenInfo(_context, token) {
+        return new Promise((resolve, reject) => {
+            const introspection_uri = this.settings.introspection_uri ? new URL(this.settings.introspection_uri, this.getServer()) : new URL('tokeninfo', this.getServer());
+            return new Request('POST', introspection_uri)
+                .auth(this.settings.client_id, this.settings.client_secret)
+                .set('Accept', 'application/json')
+                .type('form')
+                .send({
+                    'token_type_hint': 'access_token',
+                    'token': token,
+                }).end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * @param {AuthorizeUser} authorizeUser
+     */
+     authorize(authorizeUser) {
+        const tokenURL = this.settings.token_uri ? new URL(this.settings.token_uri) : new URL('authorize', this.getServer());
+        return new Promise((resolve, reject)=> {
+            return new Request('POST', tokenURL)
+                .type('form')
+                .send(authorizeUser).end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by name
+     * @param {*} user_id 
+     * @param {AdminMethodOptions} options 
+     */
+     getUserById(user_id, options) {
+        return new Promise((resolve, reject) => {
+            return new Request('GET', new URL(`users/${user_id}`, this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by name
+     * @param {string} username 
+     * @param {AdminMethodOptions} options 
+     */
+    getUser(username, options) {
+        return new Promise((resolve, reject)=> {
+            return new Request('GET', new URL('users', this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .query({
+                    '$filter': `name eq '${username}'`
+                })
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by email address
+     * @param {string} email 
+     * @param {AdminMethodOptions} options 
+     */
+     getUserByEmail(email, options) {
+        return new Promise((resolve, reject)=> {
+            return new Request('GET', new URL('users', this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .query({
+                    '$filter': `alternateName eq '${email}'`
+                })
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Updates an existing user
+     * @param {*} user 
+     * @param {AdminMethodOptions} options 
+     */
+     updateUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            if (user.id == null) {
+                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+            }
+            const request = new Request('PUT', new URL(`users/${user.id}`, this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .set('Content-Type', 'application/json')
+                .send(user)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Creates a new user
+     * @param {*} user 
+     * @param {AdminMethodOptions} options 
+     */
+     createUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            const request = new Request('POST', new URL('users', this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .set('Content-Type', 'application/json')
+                .send(Object.assign({}, user, {
+                    $state: 1 // for create
+                }))
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Deletes a user
+     * @param {{id: any}} user 
+     * @param {AdminMethodOptions} options 
+     */
+     deleteUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            if (user.id == null) {
+                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+            }
+            const request = new Request('DELETE', new URL(`users/${user.id}`, this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * @param {boolean=} force 
+     * @returns {*}
+     */
+    getWellKnownConfiguration(force) {
+        if (force) {
+            this.well_known_configuration = null;
+        }
+        if (this.well_known_configuration) {
+            return Promise.resolve(this.well_known_configuration);
+        }
+        return new Promise((resolve, reject) => {
+            const well_known_configuration_uri = this.settings.well_known_configuration_uri ? new URL(this.settings.well_known_configuration_uri, this.getServer()) : new URL('.well-known/openid-configuration', this.getServer());
+            return new Request('GET', well_known_configuration_uri)
+                .end(responseHander(resolve, reject));
+        }).then((configuration) => {
+            this.well_known_configuration = configuration;
+            return configuration;
+        });
+    }
+}
+
+export {
+    OAuth2ClientService
+}
+

package/src/RedisClientStore.js

@@ -1,6 +1,6 @@
 import { TraceUtils } from '@themost/common';
 import RedisStore from 'rate-limit-redis';
-import { createClient } from 'redis';
+import { Redis } from 'ioredis';
 import '@themost/promise-sequence';
 
 let superLoadIncrementScript;
@@ -46,16 +46,15 @@ class RedisClientStore extends RedisStore {
              */
             sendCommand: function () {
                 const args = Array.from(arguments);
+                const [command] = args.splice(0, 1);
                 const self = this;
-                if (args[0] === 'SCRIPT') {
+                if (command === 'SCRIPT') {
                     const connectOptions = service.getApplication().getConfiguration().getSourceAt('settings/redis/options') || {
                         host: '127.0.0.1',
                         port: 6379
                     };
-                    const client = createClient(connectOptions);
-                    return client.connect().then(() => {
-                        return client.sendCommand(args);
-                    }).catch((error) => {
+                    const client = new Redis(connectOptions);
+                    return client.call(command, args).catch((error) => {
                         if (error instanceof TypeError && error.message === 'Invalid argument type') {
                             TraceUtils.warn('RedisClientStore: Invalid argument type: ' + JSON.stringify(args));
                         }
@@ -73,45 +72,30 @@ class RedisClientStore extends RedisStore {
                         host: '127.0.0.1',
                         port: 6379
                     };
-                    self.client = createClient(connectOptions);
-                    // handle socket close error
-                    self.client.on('error', (err) => {
-                        TraceUtils.error('An error occurred while using redis client as speed limit service client store.');
-                        TraceUtils.error(err);
-                        // handle socket close error
-                        if (err.message === 'Socket closed unexpectedly') {
-                            TraceUtils.info('Socket closed unexpectedly. Disconnecting...');
-                            // delete increment script sha
-                            self.incrementScriptSha = null;
-                            // quit client
-                            self.client.disconnect();
-                        }
-                    });
+                    self.client = new Redis(connectOptions);
                 }
                 if (self.client.isOpen) {
-                    return self.client.sendCommand(args).catch((error) => {
+                    return self.client.call(command, args).catch((error) => {
                         if (error instanceof TypeError && error.message === 'Invalid argument type') {
                             TraceUtils.warn('RedisClientStore: Invalid argument type: ' + JSON.stringify(args));
                         }
                         return Promise.reject(error);
                     });
                 }
-                return self.client.connect().then(() => {
-                    // send load script commands once
-                    return (() => {
-                        if (self.incrementScriptSha == null) {
-                            return this.postInit();
+                // send load script commands once
+                return (() => {
+                    if (self.incrementScriptSha == null) {
+                        return this.postInit();
+                    }
+                    return Promise.resolve();
+                })().then(() => {
+                    // send command 
+                    args[0] = self.incrementScriptSha;
+                    return self.client.call(command, args).catch((error) => {
+                        if (error instanceof TypeError && error.message === 'Invalid argument type') {
+                            TraceUtils.warn('RedisClientStore: Invalid argument type: ' + JSON.stringify(args));
                         }
-                        return Promise.resolve();
-                    })().then(() => {
-                        // send command 
-                        args[1] = self.incrementScriptSha;
-                        return self.client.sendCommand(args).catch((error) => {
-                            if (error instanceof TypeError && error.message === 'Invalid argument type') {
-                                TraceUtils.warn('RedisClientStore: Invalid argument type: ' + JSON.stringify(args));
-                            }
-                            return Promise.reject(error);
-                        });
+                        return Promise.reject(error);
                     });
                 });
             }

package/src/RemoteAddressValidator.d.ts

@@ -0,0 +1,10 @@
+import { ApplicationService } from '@themost/common';
+import { Request } from 'express';
+
+export declare class RemoteAddressValidator extends ApplicationService {
+    
+    constructor(app: ApplicationService);
+    validateRemoteAddress(request: Request): Promise<boolean>;
+    getRemoteAddress(request: Request): string;
+
+}