@universis/janitor 2.2.0 → 2.4.1

package/dist/index.js

@@ -11,10 +11,17 @@ var rateLimitRedis = require('rate-limit-redis');
 var ioredis = require('ioredis');
 require('@themost/promise-sequence');
 var url = require('url');
+var janitor = require('@universis/janitor');
+require('@themost/express');
 var superagent = require('superagent');
 var jwt = require('jsonwebtoken');
 var BearerStrategy = require('passport-http-bearer');
 var passport = require('passport');
+var cloneDeep = require('lodash/cloneDeep');
+var MD5 = require('crypto-js/md5');
+var data = require('@themost/data');
+var ipRangeCheck = require('ip-range-check');
+var operators = require('rxjs/operators');
 
 class RateLimitService extends common.ApplicationService {
   /**
@@ -804,22 +811,125 @@ class ExtendScopeAccessConfiguration extends common.ApplicationService {
   }
 }
 
-function validateScope() {
-  return (req, res, next) => {
+class InvalidClientScopeError extends common.HttpForbiddenError {
+  constructor() {
+    super('Access denied due to invalid client scopes.');
+  }
+}
+
+class VerifyUserClientScope extends common.ApplicationService {
+
+  constructor(app) {
+    super(app);
+    // Sets the pre-defined OpenID Connect client scopes that are whitelisted and should be omitted during validation
+    this.options = {
+      whitelist: [
+      'profile',
+      'email',
+      'openid']
+
+    };
+  }
+
+  /**
+   * Verify user scope access against its assigned groups,
+   * following the client scopes that are available for the user groups.
+   * @param {ExpressDataContext} context
+   * @param {boolean=} throwError
+   * @returns {Promise<boolean>}
+   */
+  async verify(context, throwError) {
+    // noinspection JSUnresolvedReference
+    const user = await context.getUser();
+    if (user == null) {
+      return false;
+    }
+    const groups = user.groups.map((group) => group.id);
+    /**
+     * @type {import('@themost/data').DataModel}
+     */
+    const ClientScopes = context.model('Group').convert({}).property('scopes').getBaseModel();
+    // set conditional caching
+    ClientScopes.caching = 'conditional';
+    /**
+     * get client scopes assigned to user groups
+     * @type {Array<{ scope: string }>}
+     */
+    const items = await ClientScopes.where('group').equal(groups).select('scope').cache(true).take(-1).silent().getItems();
     /**
-     * @type {ScopeAccessConfiguration}
+     * @type {string[]}
      */
-    let scopeAccessConfiguration = req.context.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
-    if (typeof scopeAccessConfiguration === 'undefined') {
-      return next(new Error('Invalid application configuration. Scope access configuration strategy is missing or is in accessible.'));
+    const assignedScopes = items.map((item) => item.scope);
+    const contextScopes = new janitor.ScopeString(context.user.authenticationScope).split().filter((scope) => {
+      return this.options.whitelist.includes(scope) === false;
+    });
+
+    const unassigned = contextScopes.filter((scope) => {
+      return !assignedScopes.includes(scope);
+    });
+    if (unassigned.length) {
+      if (!!throwError) {
+        common.TraceUtils.error(`Access denied for user "${context.user.name}" due to invalid client scope(s) "${unassigned.join(',')}"`);
+        throw new InvalidClientScopeError();
+      }
+      return false;
     }
-    scopeAccessConfiguration.verify(req).then((value) => {
-      if (value) {
+    return true;
+  }
+}
+
+class DisableUserClientScopeVerification extends VerifyUserClientScope {
+  constructor(app) {
+    super(app);
+  }
+  async verify(context, throwError) {
+    return true;
+  }
+}
+
+function validateClientScope() {
+  return function (req, res, next) {
+    try {
+      /**
+       * @type {VerifyUserClientScope}
+       */
+      const service = req.context.getApplication().getService(VerifyUserClientScope);
+      if (service == null) {
+        return next();
+      }
+      void service.verify(req).then(() => {
         return next();
+      }).catch((reason) => {
+        return next(reason);
+      });
+    } catch (err) {
+      return next(err);
+    }
+  };
+}
+
+function validateScope() {
+  return (req, res, next) => {
+    const validateClientScopeHandler = validateClientScope();
+    return validateClientScopeHandler(req, res, (err) => {
+      if (err) {
+        return next(err);
+      }
+      /**
+       * @type {ScopeAccessConfiguration}
+       */
+      let scopeAccessConfiguration = req.context.getApplication().getConfiguration().getStrategy(ScopeAccessConfiguration);
+      if (typeof scopeAccessConfiguration === 'undefined') {
+        return next(new Error('Invalid application configuration. Scope access configuration strategy is missing or is in accessible.'));
       }
-      return next(new common.HttpForbiddenError('Access denied due to authorization scopes.'));
-    }).catch((reason) => {
-      return next(reason);
+      scopeAccessConfiguration.verify(req).then((value) => {
+        if (value) {
+          return next();
+        }
+        return next(new common.HttpForbiddenError('Access denied due to authorization scopes.'));
+      }).catch((reason) => {
+        return next(reason);
+      });
     });
   };
 }
@@ -1337,9 +1447,496 @@ class PassportService extends common.ApplicationService {
 
 }
 
+/**
+ *
+ * @param {{profiles:Map<string, import('./outputCacheRouter').OutputCachingProfile>,elements: import('./outputCacheRouter').OutputCachingElement[]}} options
+ * @returns {import('express').Router}
+ */
+function outputCache({ profiles, elements }) {
+  const router = new express.Router();
+  // prepare regular expressions
+  const outputCacheElements = Array.isArray(elements) ? elements : [];
+  outputCacheElements.forEach((element) => {
+    if (!(element.expr instanceof RegExp)) {
+      element.expr = new RegExp('^' + element.resource, 'g');
+    }
+  });
+  router.use((req, res, next) => {
+    // only GET requests are cacheable
+    if (req.method !== 'GET') {
+      return next();
+    }
+    // if cache-control header is set to no-cache then skip caching
+    const cacheControl = req.headers['cache-control'];
+    if (cacheControl && cacheControl.includes('no-cache')) {
+      return next();
+    }
+    for (let element of outputCacheElements) {
+      if (element.expr.test(req.path)) {
+        let profile;
+        if (typeof element.profile === 'string') {
+          profile = profiles.get(element.profile);
+        } else if (typeof element.profile === 'object') {
+          profile = element.profile;
+        }
+        if (profile) {
+          // clone profile to avoid mutation
+          Object.assign(req, {
+            outputCaching: cloneDeep(profile)
+          });
+        }
+        return next();
+      }
+    }
+    return next();
+  });
+  router.use((req, res, next) => {
+    try {
+      const shouldCached = req.outputCaching && (req.outputCaching.location === 'any' || req.outputCaching.location === 'client');
+      if (!shouldCached) {
+        return next();
+      }
+      // determine cache location
+      let cacheLocation = req.outputCaching.location === 'any' ? 'public' : 'private';
+      if (req.headers.authorization && req.headers.authorization.length > 0) {
+        // if authorization header is present, we should not cache the response publicly
+        cacheLocation = 'private';
+      }
+      if (req.outputCaching.duration) {
+        res.setHeader('Cache-Control', `${cacheLocation}, max-age=${req.outputCaching.duration}`);
+      } else {
+        res.setHeader('Cache-Control', cacheLocation);
+      }
+      const { varyByContentEncoding, varyByHeader, varyByParam, location, duration } = req.outputCaching;
+      if (varyByContentEncoding) {
+        res.setHeader('Vary', 'Accept-Encoding');
+      }
+      const varyByReqHeader = varyByHeader || [];
+      if (varyByReqHeader.length) {
+        res.setHeader('Vary', varyByReqHeader.join(', '));
+      }
+      let varyByQueryParam = varyByParam || [];
+      if (varyByQueryParam.length === 1 && varyByQueryParam[0] === '*') {
+        varyByQueryParam = Object.keys(req.query).sort((a, b) => {
+          if (a < b) {
+            return -1;
+          }
+          if (a > b) {
+            return 1;
+          }
+          return 0;
+        });
+      }
+
+      const headers = varyByReqHeader.reduce((acc, val) => {
+        acc[val] = req.get(val);
+        return acc;
+      }, {});
+
+      const params = varyByQueryParam.reduce((acc, val) => {
+        if (req.query[val]) {
+          acc[val] = req.query[val];
+        }
+        return acc;
+      }, {});
+
+      // vary by query parameters is not supported by HTTP caching, but we can use it to create a cache key
+      const entry = {
+        path: req.path,
+        location: location,
+        contentEncoding: varyByContentEncoding,
+        headers,
+        params,
+        customParams: null,
+        duration: duration
+      };
+
+      (async () => {
+        const { varyByExpr } = req.outputCaching;
+        if (varyByExpr && typeof varyByExpr === 'object') {
+          // noinspection JSCheckFunctionSignatures
+          const formatter = new data.ValueFormatter(req.context, null, req);
+          entry.customParams = await formatter.format(varyByExpr);
+        }
+        return `W/"${MD5(JSON.stringify({
+          path: entry.path,
+          location: entry.location,
+          contentEncoding: entry.contentEncoding,
+          headers: entry.headers,
+          params: entry.params,
+          customParams: entry.customParams,
+          duration: entry.duration
+        })).toString()}"`;
+      })().then((entityTag) => {
+        if (req.headers['if-none-match'] === entityTag) {
+          return res.status(304).end();
+        }
+        res.setHeader('ETag', entityTag);
+        res.setHeader('Date', new Date().toUTCString());
+        return next();
+      }).catch((err) => {
+        return next(err);
+      });
+    } catch (err) {
+      return next(err);
+    }
+  });
+  return router;
+}
+
+class OutputCachingService extends common.ApplicationService {
+  constructor(app) {
+    super(app);
+    let options = app.getConfiguration().getSourceAt('settings/universis/outputCaching') || {
+      profiles: [],
+      elements: []
+    };
+    if (typeof options.extends === 'string') {
+      const configurationDir = this.getApplication().getConfiguration().getConfigurationPath();
+      const parentOptions = require(path.resolve(configurationDir, options.extends));
+      options = Object.assign({}, parentOptions, options);
+    }
+    /**
+     * @type {Map<string, OutputCachingProfile>}
+     */
+    this.profiles = new Map(options.profiles || []);
+    /**
+     * @type {OutputCachingElement[]}
+     */
+    this.elements = options.elements || [];
+    if (app && app.container) {
+      app.container.subscribe((container) => {
+        if (container == null) {
+          return;
+        }
+        container.use(outputCache({
+          profiles: this.profiles,
+          elements: this.elements
+        }));
+        const stack = container._router && container._router.stack;
+        if (Array.isArray(stack)) {
+          let index = stack.findIndex((item) => item.name === 'dataContextMiddleware');
+          if (index > -1) {
+            stack.splice(index, 0, stack.pop());
+          }
+        }
+      });
+    }
+  }
+}
+
+class UserWithNetworkAddress extends data.UserService {
+  constructor(app) {
+    super(app);
+  }
+
+  /**
+   * @protected
+   * @param {import('@themost/data').DataContext} context
+   * @param {string} name
+   * @return {import('@themost/data').DataQueryable}
+   */
+  queryUser(context, name) {
+    return context.model('User').asQueryable().expand('groups', 'networkAddress').
+    where('name').equal(name);
+  }
+
+  /**
+   * @protected
+   * @param {import('@themost/data').DataContext} context
+   * @param {string} name
+   * @return {import('@themost/data').DataQueryable}
+   */
+  queryGroup(context, name) {
+    return context.model('Group').asQueryable().expand('groups', 'networkAddress').
+    where('name').equal(name);
+  }
+
+  /**
+   * Gets user by name
+   * @param context
+   * @param name
+   * @returns {Promise<any>}
+   */
+  getUser(context, name) {
+    // noinspection JSCheckFunctionSignatures
+    /**
+     * @type {import('./data-cache').DataCacheStrategy}
+     */
+    // noinspection JSCheckFunctionSignatures
+    const cache = context.getConfiguration().getStrategy(function DataCacheStrategy() {});
+    if (cache) {
+      return cache.getOrDefault(`/User/${name}`, () => {
+        return this.queryUser(context, name).silent().getItem().then((user) => {
+          return user;
+        });
+      });
+    }
+    return this.queryUser(context, name).silent().getItem().then((user) => {
+      return user;
+    });
+  }
+
+  /**
+   * Gets group by name
+   * @param context
+   * @param name
+   * @returns {Promise<any>}
+   */
+  getGroup(context, name) {
+    // noinspection JSCheckFunctionSignatures
+    /**
+     * @type {import('./data-cache').DataCacheStrategy}
+     */
+    // noinspection JSCheckFunctionSignatures
+    const cache = context.getConfiguration().getStrategy(function DataCacheStrategy() {});
+    if (cache) {
+      return cache.getOrDefault(`/Group/${name}`, () => {
+        return this.queryGroup(context, name).silent().getItem().then((group) => {
+          return group;
+        });
+      });
+    }
+    return this.queryGroup(context, name).silent().getItem().then((group) => {
+      return group;
+    });
+  }
+
+  /**
+   * Gets anonymous user
+   * @param context
+   * @returns {Promise<any>}
+   */
+  getAnonymousUser(context) {
+    return this.getUser(context, 'anonymous');
+  }
+
+}
+
+const AccountNetworkAddress = {
+  "$schema": "https://themost-framework.github.io/themost/models/2018/2/schema.json",
+  "@id": "https://universis.io/schemas/AccountNetworkAddress",
+  "name": "AccountNetworkAddress",
+  "hidden": true,
+  "source": "AccountNetworkAddress",
+  "view": "AccountNetworkAddress",
+  "version": "1.0.0",
+  "fields": [
+  {
+    "name": "id",
+    "type": "Counter",
+    "nullable": false,
+    "primary": true,
+    "many": false
+  },
+  {
+    "name": "account",
+    "type": "Account",
+    "nullable": false,
+    "many": false,
+    "indexed": true
+  },
+  {
+    "name": "value",
+    "type": "Text",
+    "nullable": false,
+    "many": false,
+    "indexed": false
+  }],
+
+  "constraints": [
+  {
+    "type": "unique",
+    "fields": [
+    "account",
+    "value"]
+
+  }],
+
+  "privileges": [
+  {
+    "mask": 15,
+    "type": "global"
+  },
+  {
+    "mask": 15,
+    "type": "global",
+    "account": "Administrators"
+  }]
+
+};
+
+class HttpNetworkAccessForbiddenError extends common.HttpForbiddenError {
+  constructor() {
+    super('Access is denied due to network address conflict.');
+    this.statusCode = 403.6;
+  }
+
+}
+
+class NetworkRestrictAccess extends common.ApplicationService {
+  constructor(app) {
+    super(app);
+    Object.defineProperty(this, 'proxyAddressForwarding', {
+      configurable: true,
+      enumerable: false,
+      value: !!app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding'),
+      writable: false
+    });
+    this.apply();
+  }
+
+  apply() {
+    // get schema loader
+    const schemaLoader = this.getApplication().
+    getConfiguration().
+    getStrategy(data.SchemaLoaderStrategy);
+    const accountNetworkAddressModel = schemaLoader.getModelDefinition('AccountNetworkAddress');
+    if (accountNetworkAddressModel == null) {
+      schemaLoader.setModelDefinition(AccountNetworkAddress);
+    }
+    // get model definition
+    const model = schemaLoader.getModelDefinition('Account');
+    if (model == null) {
+      common.TraceUtils.warn('NetworkRestrictAccess: Account model definition not found.');
+      return;
+    }
+    const found = model.fields.find((field) => {
+      return field.name === 'networkAddress';
+    });
+    if (!found) {
+      model.fields.push({
+        "name": "networkAddress",
+        "type": "Text",
+        "many": true,
+        "mapping": {
+          "parentModel": "Account",
+          "parentField": "id",
+          "associationType": "junction",
+          "associationAdapter": "AccountNetworkAddress",
+          "cascade": "delete",
+          "associationObjectField": "account",
+          "associationValueField": "value"
+        }
+      });
+    }
+    model.eventListeners = model.eventListeners || [];
+    let index = model.eventListeners.findIndex((listener) => {
+      return listener.type === '@themost/data/previous-state-listener';
+    });
+    if (index < 0) {
+      model.eventListeners.push({
+        type: '@themost/data/previous-state-listener'
+      });
+      index = model.eventListeners.length - 1;
+    }
+    let otherIndex = model.eventListeners.findIndex((listener) => {
+      return listener.type === path.resolve(__dirname, './OnAccountUpdate');
+    });
+    if (otherIndex < 0) {
+      model.eventListeners.splice(index, 0, {
+        type: path.resolve(__dirname, './OnAccountUpdate')
+      });
+    }
+    schemaLoader.setModelDefinition(model);
+  }
+
+  /**
+   * Gets remote address from request
+   * @param {import('express').Request} req
+   * @returns
+   */
+  getRemoteAddress(req) {
+    let remoteAddress;
+    if (this.proxyAddressForwarding) {
+      // get proxy headers or remote address
+      // noinspection JSDeprecatedSymbols
+      remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);
+    } else {
+      // noinspection JSDeprecatedSymbols
+      remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;
+    }
+    return remoteAddress;
+  }
+}
+
+
+
+/**
+ * Validate network address for the current request against the assigned network addresses for the user account.
+ * @returns {import('express').Handler}
+ */
+function validateNetworkAddress() {
+  /**
+   * @param {import('express').Request} req
+   * @param {import('express').Response} res
+   * @param {import('express').NextFunction} next
+   */
+  return function (req, res, next) {
+    try {
+      const service = req.context.getApplication().getService(NetworkRestrictAccess);
+      if (service == null) {
+        return next();
+      }
+      req.context.user$.pipe(
+        operators.take(1)
+      ).subscribe({
+        next: (user) => {
+          if (user == null) {
+            return next();
+          }
+          if (Array.isArray(user.networkAddress)) {
+            if (user.networkAddress.length > 0) {
+              // get remote address
+              const remoteAddress = service.getRemoteAddress(req);
+              const result = ipRangeCheck(remoteAddress, user.networkAddress);
+              if (result !== true) {
+                return next(new HttpNetworkAccessForbiddenError());
+              }
+            }
+          }
+          return next();
+        },
+        error: (err) => {
+          return next(err);
+        }
+      });
+    } catch (err) {
+      return next(err);
+    }
+
+  };
+}
+
+class EnableNetworkRestrictAccess extends NetworkRestrictAccess {
+  constructor(app) {
+    super(app);
+    if (app && app.serviceRouter) {
+      app.serviceRouter.subscribe((serviceRouter) => {
+        if (serviceRouter == null) {
+          return;
+        }
+        const addRouter = express.Router();
+        addRouter.use(validateNetworkAddress());
+        // insert router at the beginning of serviceRouter.stack
+        serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);
+      });
+    }
+  }
+}
+
+class DisableNetworkRestrictAccess extends NetworkRestrictAccess {
+  constructor(app) {
+    super(app);
+  }
+}
+
 exports.AppRateLimitService = AppRateLimitService;
 exports.AppSpeedLimitService = AppSpeedLimitService;
 exports.DefaultScopeAccessConfiguration = DefaultScopeAccessConfiguration;
+exports.DisableNetworkRestrictAccess = DisableNetworkRestrictAccess;
+exports.DisableUserClientScopeVerification = DisableUserClientScopeVerification;
+exports.EnableNetworkRestrictAccess = EnableNetworkRestrictAccess;
 exports.EnableScopeAccessConfiguration = EnableScopeAccessConfiguration;
 exports.ExtendScopeAccessConfiguration = ExtendScopeAccessConfiguration;
 exports.HttpAccountDisabled = HttpAccountDisabled;
@@ -1347,8 +1944,12 @@ exports.HttpBearerStrategy = HttpBearerStrategy;
 exports.HttpBearerTokenExpired = HttpBearerTokenExpired;
 exports.HttpBearerTokenNotFound = HttpBearerTokenNotFound;
 exports.HttpBearerTokenRequired = HttpBearerTokenRequired;
+exports.HttpNetworkAccessForbiddenError = HttpNetworkAccessForbiddenError;
 exports.HttpRemoteAddrForbiddenError = HttpRemoteAddrForbiddenError;
+exports.InvalidClientScopeError = InvalidClientScopeError;
+exports.NetworkRestrictAccess = NetworkRestrictAccess;
 exports.OAuth2ClientService = OAuth2ClientService;
+exports.OutputCachingService = OutputCachingService;
 exports.PassportService = PassportService;
 exports.RateLimitService = RateLimitService;
 exports.RedisClientStore = RedisClientStore;
@@ -1356,5 +1957,10 @@ exports.RemoteAddressValidator = RemoteAddressValidator;
 exports.ScopeAccessConfiguration = ScopeAccessConfiguration;
 exports.ScopeString = ScopeString;
 exports.SpeedLimitService = SpeedLimitService;
+exports.UserWithNetworkAddress = UserWithNetworkAddress;
+exports.VerifyUserClientScope = VerifyUserClientScope;
+exports.outputCache = outputCache;
+exports.validateClientScope = validateClientScope;
+exports.validateNetworkAddress = validateNetworkAddress;
 exports.validateScope = validateScope;
 //# sourceMappingURL=index.js.map