@universis/janitor 2.1.1 → 2.4.0

package/src/NetworkRestrictAccess.d.ts

@@ -0,0 +1,16 @@
+import {ApplicationBase, ApplicationService} from '@themost/common';
+import {Handler} from 'express';
+
+export declare class NetworkRestrictAccess extends ApplicationService {
+    constructor(app: ApplicationBase);
+}
+
+export declare class EnableNetworkRestrictAccess extends NetworkRestrictAccess {
+    constructor(app: ApplicationBase);
+}
+
+export declare class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
+    constructor(app: ApplicationBase);
+}
+
+export declare function validateNetworkAccess(): Handler;

package/src/NetworkRestrictAccess.js

@@ -0,0 +1,181 @@
+import {ApplicationService, HttpForbiddenError, TraceUtils} from '@themost/common';
+import {SchemaLoaderStrategy} from '@themost/data';
+import ipRangeCheck from 'ip-range-check';
+import express from 'express';
+import { take } from 'rxjs/operators';
+import { AccountNetworkAddress } from './config/models/AccountNetworkAddress';
+import path from 'path';
+
+class HttpNetworkAccessForbiddenError extends HttpForbiddenError {
+    constructor() {
+        super('Access is denied due to network address conflict.');
+        this.statusCode = 403.6;
+    }
+
+}
+
+class NetworkRestrictAccess extends ApplicationService {
+    constructor(app) {
+        super(app);
+        Object.defineProperty(this, 'proxyAddressForwarding', {
+            configurable: true,
+            enumerable: false,
+            value: !!app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding'),
+            writable: false
+        })
+        this.apply();
+    }
+
+    apply() {
+        // get schema loader
+        const schemaLoader = this.getApplication()
+            .getConfiguration()
+            .getStrategy(SchemaLoaderStrategy);
+        const accountNetworkAddressModel = schemaLoader.getModelDefinition('AccountNetworkAddress');
+        if (accountNetworkAddressModel == null) {
+            schemaLoader.setModelDefinition(AccountNetworkAddress);
+        }
+        // get model definition
+        const model = schemaLoader.getModelDefinition('Account');
+        if (model == null) {
+            TraceUtils.warn('NetworkRestrictAccess: Account model definition not found.');
+            return;
+        }
+        const found = model.fields.find((field) => {
+            return field.name === 'networkAddress';
+        });
+        if (!found) {
+            model.fields.push({
+                "name": "networkAddress",
+                "type": "Text",
+                "many": true,
+                "mapping": {
+                    "parentModel": "Account",
+                    "parentField": "id",
+                    "associationType": "junction",
+                    "associationAdapter": "AccountNetworkAddress",
+                    "cascade": "delete",
+                    "associationObjectField": "account",
+                    "associationValueField": "value"
+                }
+            });
+        }
+        model.eventListeners = model.eventListeners || [];
+        let index = model.eventListeners.findIndex((listener) => {
+            return listener.type === '@themost/data/previous-state-listener';
+        });
+        if (index < 0) {
+            model.eventListeners.push({
+                type: '@themost/data/previous-state-listener'
+            });
+            index = model.eventListeners.length - 1;
+        }
+        let otherIndex = model.eventListeners.findIndex((listener) => {
+            return listener.type === path.resolve(__dirname, './OnAccountUpdate');
+        });
+        if (otherIndex < 0) {
+            model.eventListeners.splice(index, 0, {
+                type: path.resolve(__dirname, './OnAccountUpdate')
+            });
+        }
+        schemaLoader.setModelDefinition(model);
+    }
+
+    /**
+     * Gets remote address from request
+     * @param {import('express').Request} req
+     * @returns
+     */
+    getRemoteAddress(req) {
+        let remoteAddress;
+        if (this.proxyAddressForwarding) {
+            // get proxy headers or remote address
+            // noinspection JSDeprecatedSymbols
+            remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);
+        } else {
+            // noinspection JSDeprecatedSymbols
+            remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;
+        }
+        return remoteAddress;
+    }
+}
+
+
+
+/**
+ * Validate network address for the current request against the assigned network addresses for the user account.
+ * @returns {import('express').Handler}
+ */
+function validateNetworkAddress() {
+    /**
+     * @param {import('express').Request} req
+     * @param {import('express').Response} res
+     * @param {import('express').NextFunction} next
+     */
+    return function(req, res, next) {
+        try {
+            const service = req.context.getApplication().getService(NetworkRestrictAccess);
+            if (service == null) {
+                return next();
+            }
+            req.context.user$.pipe(
+                take(1)
+            ).subscribe({
+                next: (user) => {
+                    if (user == null) {
+                        return next();
+                    }
+                    if (Array.isArray(user.networkAddress)) {
+                        if (user.networkAddress.length > 0) {
+                            // get remote address
+                            const remoteAddress = service.getRemoteAddress(req);
+                            const result = ipRangeCheck(remoteAddress, user.networkAddress);
+                            if (result !== true) {
+                                return next(new HttpNetworkAccessForbiddenError());
+                            }
+                        }
+                    }
+                    return next();
+                },
+                error: (err) => {
+                    return next(err);
+                }
+            });
+        } catch (err) {
+            return next(err);
+        }
+
+    }
+}
+
+class EnableNetworkRestrictAccess extends NetworkRestrictAccess {
+    constructor(app) {
+        super(app);
+        if (app && app.serviceRouter) {
+            app.serviceRouter.subscribe((serviceRouter) => {
+                if (serviceRouter == null) {
+                    return;
+                }
+                const addRouter = express.Router();
+                addRouter.use(validateNetworkAddress());
+                // insert router at the beginning of serviceRouter.stack
+                serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);
+            });
+        }
+    }
+}
+
+class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
+    constructor(app) {
+        super(app);
+    }
+}
+
+export {
+    NetworkRestrictAccess,
+    EnableNetworkRestrictAccess,
+    DisableNetworkRestrictAccess,
+    HttpNetworkAccessForbiddenError,
+    validateNetworkAddress
+}
+

package/src/OnAccountUpdate.js

@@ -0,0 +1,55 @@
+import {TraceUtils} from '@themost/common';
+
+/**
+ *
+ * @param {import('@themost/data').DataEventArgs} event
+ * @param {Function} callback
+ */
+export function afterChange(event, callback) {
+    try {
+        if (event.previous == null) {
+            return callback();
+        }
+        const { context } = event.model;
+        const { name, additionalType } = event.previous;
+        /**
+         * @type {import('@themost/data').DataCacheStrategy}
+         */
+        const service = context.getConfiguration().getStrategy(function DataCacheStrategy() {});
+        if (service) {
+            return service.remove(`/${additionalType}/${name}`).then(() => {
+                return callback();
+            }).catch((err) => {
+                TraceUtils.warn(`Unable to remove ${name} from cache`);
+                TraceUtils.error(err);
+                return callback();
+            });
+        }
+        return callback();
+    } catch (err) {
+        return callback();
+    }
+}
+
+/**
+ *
+ * @param {import('@themost/data').DataEventArgs} event
+ * @param {Function} callback
+ */
+function afterSave(event, callback) {
+    return afterChange(event, callback);
+}
+
+/**
+ *
+ * @param {import('@themost/data').DataEventArgs} event
+ * @param {Function} callback
+ */
+function afterRemove(event, callback) {
+    return afterChange(event, callback);
+}
+
+export {
+    afterSave,
+    afterRemove
+}

package/src/OutputCachingService.d.ts

@@ -0,0 +1,7 @@
+import {ApplicationService} from '@themost/common';
+import {OutputCachingElement, OutputCachingProfile} from './outputCacheRouter';
+
+export declare class OutputCachingService extends ApplicationService{
+    profiles: Map<string, OutputCachingProfile>;
+    elements: OutputCachingElement[];
+}

package/src/OutputCachingService.js

@@ -0,0 +1,47 @@
+import { ApplicationService } from '@themost/common';
+import { outputCache } from './outputCacheRouter';
+import path from 'path';
+class OutputCachingService extends ApplicationService {
+    constructor(app) {
+        super(app);
+        let options = app.getConfiguration().getSourceAt('settings/universis/outputCaching') || {
+            profiles: [],
+            elements: []
+        };
+        if (typeof options.extends === 'string') {
+            const configurationDir = this.getApplication().getConfiguration().getConfigurationPath();
+            const parentOptions = require(path.resolve(configurationDir, options.extends));
+            options = Object.assign({}, parentOptions, options);
+        }
+        /**
+         * @type {Map<string, OutputCachingProfile>}
+         */
+        this.profiles = new Map(options.profiles || []);
+        /**
+         * @type {OutputCachingElement[]}
+         */
+        this.elements = options.elements || [];
+        if (app && app.container) {
+            app.container.subscribe((container) => {
+                if (container == null) {
+                    return;
+                }
+                container.use(outputCache({
+                    profiles: this.profiles,
+                    elements: this.elements
+                }));
+                const stack = container._router && container._router.stack;
+                if (Array.isArray(stack)) {
+                    let index = stack.findIndex((item) => item.name === 'dataContextMiddleware' );
+                    if (index > -1) {
+                        stack.splice(index, 0, stack.pop());
+                    }
+                }
+            });
+        }
+    }
+}
+
+export {
+    OutputCachingService
+}

package/src/RemoteAddressValidator.d.ts

@@ -1,10 +1,14 @@
-import { ApplicationService } from '@themost/common';
+import {ApplicationService, HttpForbiddenError} from '@themost/common';
 import { Request } from 'express';
 
 export declare class RemoteAddressValidator extends ApplicationService {
-    
+
     constructor(app: ApplicationService);
     validateRemoteAddress(request: Request): Promise<boolean>;
     getRemoteAddress(request: Request): string;
 
+}
+
+export declare class HttpRemoteAddrForbiddenError extends HttpForbiddenError {
+    constructor();
 }

package/src/UserWithNetworkAddress.d.ts

@@ -0,0 +1,9 @@
+import {DataContext, UserService} from '@themost/data';
+import {ApplicationBase} from '@themost/common';
+
+export declare class UserWithNetworkAddress extends UserService {
+    constructor(app: ApplicationBase);
+
+    protected queryUser(context: DataContext, username: string): Promise<any>;
+    protected queryGroup(context: DataContext, username: string): Promise<any>;
+}

package/src/UserWithNetworkAddress.js

@@ -0,0 +1,94 @@
+import {UserService} from '@themost/data';
+
+class UserWithNetworkAddress extends UserService {
+    constructor(app) {
+        super(app);
+    }
+
+    /**
+     * @protected
+     * @param {import('@themost/data').DataContext} context
+     * @param {string} name
+     * @return {import('@themost/data').DataQueryable}
+     */
+    queryUser(context, name) {
+        return context.model('User').asQueryable().expand('groups', 'networkAddress')
+            .where('name').equal(name);
+    }
+
+    /**
+     * @protected
+     * @param {import('@themost/data').DataContext} context
+     * @param {string} name
+     * @return {import('@themost/data').DataQueryable}
+     */
+    queryGroup(context, name) {
+        return context.model('Group').asQueryable().expand('groups', 'networkAddress')
+            .where('name').equal(name);
+    }
+
+    /**
+     * Gets user by name
+     * @param context
+     * @param name
+     * @returns {Promise<any>}
+     */
+    getUser(context, name) {
+        // noinspection JSCheckFunctionSignatures
+        /**
+         * @type {import('./data-cache').DataCacheStrategy}
+         */
+            // noinspection JSCheckFunctionSignatures
+        const cache = context.getConfiguration().getStrategy(function DataCacheStrategy() {});
+        if (cache) {
+            return cache.getOrDefault(`/User/${name}`, () => {
+                return this.queryUser(context, name).silent().getItem().then((user) => {
+                    return user;
+                });
+            });
+        }
+        return this.queryUser(context, name).silent().getItem().then((user) => {
+            return user;
+        });
+    }
+
+    /**
+     * Gets group by name
+     * @param context
+     * @param name
+     * @returns {Promise<any>}
+     */
+    getGroup(context, name) {
+        // noinspection JSCheckFunctionSignatures
+        /**
+         * @type {import('./data-cache').DataCacheStrategy}
+         */
+            // noinspection JSCheckFunctionSignatures
+        const cache = context.getConfiguration().getStrategy(function DataCacheStrategy() {});
+        if (cache) {
+            return cache.getOrDefault(`/Group/${name}`, () => {
+                return this.queryGroup(context, name).silent().getItem().then((group) => {
+                    return group;
+                });
+            });
+        }
+        return this.queryGroup(context, name).silent().getItem().then((group) => {
+            return group;
+        });
+    }
+
+    /**
+     * Gets anonymous user
+     * @param context
+     * @returns {Promise<any>}
+     */
+    getAnonymousUser(context) {
+        return this.getUser(context, 'anonymous');
+    }
+
+}
+
+export {
+    UserWithNetworkAddress
+}
+

package/src/VerifyUserClientScope.d.ts

@@ -0,0 +1,15 @@
+import {ApplicationBase, ApplicationService, HttpForbiddenError} from '@themost/common';
+import {DataContext} from '@themost/data';
+
+export declare class InvalidClientScopeError extends HttpForbiddenError {
+    constructor();
+}
+
+export declare class VerifyUserClientScope extends ApplicationService {
+    constructor(app: ApplicationBase);
+    options: { whitelist: string[] };
+    verify(context: DataContext): Promise<boolean>;
+}
+
+export declare class DisableUserClientScopeVerification extends VerifyUserClientScope {
+}

package/src/VerifyUserClientScope.js

@@ -0,0 +1,87 @@
+import {ApplicationService, HttpForbiddenError, TraceUtils} from '@themost/common';
+import { ScopeString } from '@universis/janitor';
+import express from 'express';
+import {ExpressDataContext} from '@themost/express';
+import {combineLatest} from 'rxjs';
+
+class InvalidClientScopeError extends HttpForbiddenError {
+    constructor() {
+        super('Access denied due to invalid client scopes.');
+    }
+}
+
+class VerifyUserClientScope extends ApplicationService {
+
+    constructor(app) {
+        super(app);
+        // Sets the pre-defined OpenID Connect client scopes that are whitelisted and should be omitted during validation
+        this.options = {
+            whitelist: [
+                'profile',
+                'email',
+                'openid'
+            ]
+        };
+    }
+
+    /**
+     * Verify user scope access against its assigned groups,
+     * following the client scopes that are available for the user groups.
+     * @param {ExpressDataContext} context
+     * @param {boolean=} throwError
+     * @returns {Promise<boolean>}
+     */
+    async verify(context, throwError) {
+        // noinspection JSUnresolvedReference
+        const user = await context.getUser();
+        if (user == null) {
+            return false;
+        }
+        const groups = user.groups.map((group) => group.id);
+        /**
+         * @type {import('@themost/data').DataModel}
+         */
+        const ClientScopes = context.model('Group').convert({}).property('scopes').getBaseModel();
+        // set conditional caching
+        ClientScopes.caching = 'conditional';
+        /**
+         * get client scopes assigned to user groups
+         * @type {Array<{ scope: string }>}
+         */
+        const items = await ClientScopes.where('group').equal(groups).select('scope').cache(true).take(-1).silent().getItems();
+        /**
+         * @type {string[]}
+         */
+        const assignedScopes = items.map((item) => item.scope);
+        const contextScopes = new ScopeString(context.user.authenticationScope).split().filter((scope) => {
+            return this.options.whitelist.includes(scope) === false;
+        });
+
+        const unassigned = contextScopes.filter((scope) => {
+            return !assignedScopes.includes(scope);
+        });
+        if (unassigned.length) {
+            if (!!throwError) {
+                TraceUtils.error(`Access denied for user "${context.user.name}" due to invalid client scope(s) "${unassigned.join(',')}"`);
+                throw new InvalidClientScopeError();
+            }
+            return false;
+        }
+        return true;
+    }
+}
+
+class DisableUserClientScopeVerification extends VerifyUserClientScope {
+    constructor(app) {
+        super(app);
+    }
+    async verify(context, throwError) {
+        return true;
+    }
+}
+
+export {
+    InvalidClientScopeError,
+    VerifyUserClientScope,
+    DisableUserClientScopeVerification
+}

package/src/config/models/AccountNetworkAddress.js

@@ -0,0 +1,56 @@
+const AccountNetworkAddress = {
+  "$schema": "https://themost-framework.github.io/themost/models/2018/2/schema.json",
+  "@id": "https://universis.io/schemas/AccountNetworkAddress",
+  "name": "AccountNetworkAddress",
+  "hidden": true,
+  "source": "AccountNetworkAddress",
+  "view": "AccountNetworkAddress",
+  "version": "1.0.0",
+  "fields": [
+    {
+      "name": "id",
+      "type": "Counter",
+      "nullable": false,
+      "primary": true,
+      "many": false
+    },
+    {
+      "name": "account",
+      "type": "Account",
+      "nullable": false,
+      "many": false,
+      "indexed": true
+    },
+    {
+      "name": "value",
+      "type": "Text",
+      "nullable": false,
+      "many": false,
+      "indexed": false
+    }
+  ],
+  "constraints": [
+    {
+      "type": "unique",
+      "fields": [
+        "account",
+        "value"
+      ]
+    }
+  ],
+  "privileges": [
+    {
+      "mask": 15,
+      "type": "global"
+    },
+    {
+      "mask": 15,
+      "type": "global",
+      "account": "Administrators"
+    }
+  ]
+}
+
+export {
+  AccountNetworkAddress
+}

package/src/index.d.ts

@@ -7,5 +7,10 @@ export * from './OAuth2ClientService';
 export * from './RemoteAddressValidator';
 export * from './AppRateLimitService';
 export * from './AppSpeedLimitService';
-export * from './HttpBearerStategy';
-export * from './PassportService';
+export * from './HttpBearerStrategy';
+export * from './PassportService';
+export * from './outputCacheRouter';
+export * from './OutputCachingService';
+export * from './VerifyUserClientScope';
+export * from './UserWithNetworkAddress';
+export * from './NetworkRestrictAccess';

package/src/index.js

@@ -10,3 +10,8 @@ export * from './AppRateLimitService';
 export * from './AppSpeedLimitService';
 export * from './HttpBearerStategy';
 export * from './PassportService';
+export * from './outputCacheRouter';
+export * from './OutputCachingService';
+export * from './VerifyUserClientScope';
+export * from './UserWithNetworkAddress';
+export * from './NetworkRestrictAccess';

package/src/outputCacheRouter.d.ts

@@ -0,0 +1,55 @@
+import {Router} from 'express';
+
+export declare interface OutputCachingProfile {
+    /**
+     * Defines the location where the output cache will be stored. Possible values are: client, server, clientServer, none. The default value is client.
+     */
+    location: 'any' | 'none' | 'server' | 'client' | 'serverAndClient';
+    /**
+     * Defines the duration in seconds for which the output cache will be stored. The default value is 60 seconds.
+     */
+    duration?: number;
+    /**
+     * Defines the content encoding that will be used to vary the output cache. The default value is null, which means that the output cache will not be varied by content encoding.
+     */
+    varyByContentEncoding?: string;
+    /**
+     * Defines the headers that will be used to vary the output cache. The default value is an empty array.
+     */
+    varyByHeader?: string[];
+    /**
+     * Defines the query string parameters that will be used to vary the output cache. The default value is a "*" character, which means that the output cache will be varied by all query string parameters.
+     */
+    varyByParam?: string[];
+    /**
+     * Defines the custom expression that will be used to vary the output cache. The default value is null.
+     * An example of a custom expression is: { "$md5": { "$user": 1 } } where the output cache will be varied by the MD5 hash of the user ID.
+     */
+    varyByExpr?: any;
+}
+
+declare module 'express' {
+    interface Request {
+        outputCaching?: OutputCachingProfile
+    }
+}
+
+export declare interface OutputCachingElement {
+    /**
+     * Defines the URL pattern for which the output caching profile will be applied. The URL pattern can include wildcards, such as /api/*, which means that the output caching profile will be applied to all URLs that start with /api/.
+     */
+    resource: string;
+    /**
+     * Defines the regular expression that will be used to match the URL pattern. The regular expression should be defined as a string and will be converted to a RegExp object internally. If the regular expression is not defined, the URL pattern will be used as a simple string match.
+     */
+    expr?: RegExp;
+    /**
+     * Defines the output caching profile that will be applied to the URL pattern. The output caching profile can be defined as an object of type OutputCachingProfile or as a string that references a predefined output caching profile.
+     */
+    profile: (OutputCachingProfile | string);
+}
+
+export declare function outputCache(options: {
+    profiles: Map<string, OutputCachingProfile>,
+    elements: OutputCachingElement[]
+}): Router;