@uphold/fastify-openapi-router-plugin 0.1.0

package/src/utils/schema.js

@@ -0,0 +1,29 @@
+export const addPropertyToSchema = (schema, properties, required) => {
+  for (const key in properties) {
+    const property = properties[key];
+
+    // Respect the previous definition of the property.
+    if (!schema.properties[key]) {
+      schema.properties[key] = property;
+    }
+
+    // Make the property required.
+    if (required && !schema.required.includes(key)) {
+      schema.required.push(key);
+    }
+  }
+};
+
+export const removeAttributesFromSchema = (schema, attributes) => {
+  if (!attributes || !Array.isArray(attributes)) {
+    return;
+  }
+
+  for (const prop in schema) {
+    if (attributes.includes(prop)) {
+      delete schema[prop];
+    } else if (typeof schema[prop] === 'object') {
+      removeAttributesFromSchema(schema[prop], attributes);
+    }
+  }
+};

package/src/utils/schema.test.js

@@ -0,0 +1,135 @@
+import { addPropertyToSchema, removeAttributesFromSchema } from './schema.js';
+import { describe, expect, it } from 'vitest';
+
+describe('addPropertyToSchema()', () => {
+  it('should add a property as required to a schema', async () => {
+    const schema = {
+      properties: {
+        foo: { type: 'string' }
+      },
+      required: []
+    };
+
+    addPropertyToSchema(schema, { bar: { type: 'string' } }, true);
+
+    expect(schema).toStrictEqual({
+      properties: {
+        bar: { type: 'string' },
+        foo: { type: 'string' }
+      },
+      required: ['bar']
+    });
+  });
+
+  it('should add a property as optional to a schema', async () => {
+    const schema = {
+      properties: {
+        foo: { type: 'string' }
+      },
+      required: ['foo']
+    };
+
+    addPropertyToSchema(schema, { bar: { type: 'string' } }, false);
+
+    expect(schema).toStrictEqual({
+      properties: {
+        bar: { type: 'string' },
+        foo: { type: 'string' }
+      },
+      required: ['foo']
+    });
+  });
+
+  it('should not override a property that already exists', async () => {
+    const schema = {
+      properties: {
+        bar: { type: 'object' },
+        foo: { type: 'string' }
+      },
+      required: ['foo']
+    };
+
+    addPropertyToSchema(schema, { foo: { type: 'object' } }, false);
+
+    expect(schema).toStrictEqual({
+      properties: {
+        bar: { type: 'object' },
+        foo: { type: 'string' }
+      },
+      required: ['foo']
+    });
+  });
+
+  it('should add multiple properties', async () => {
+    const schema = {
+      properties: {},
+      required: []
+    };
+
+    addPropertyToSchema(schema, { bar: { type: 'string' }, foo: { type: 'object' } }, false);
+
+    expect(schema).toStrictEqual({
+      properties: {
+        bar: { type: 'string' },
+        foo: { type: 'object' }
+      },
+      required: []
+    });
+  });
+});
+
+describe('removeAttributesFromSchema()', () => {
+  it('should not throw error with invalid arguments', async () => {
+    const t = () => {
+      removeAttributesFromSchema();
+      removeAttributesFromSchema(undefined, []);
+      removeAttributesFromSchema({}, {});
+      removeAttributesFromSchema({}, ['foo']);
+      removeAttributesFromSchema({ foo: {} });
+    };
+
+    expect(t).not.toThrow();
+  });
+
+  it('should recursively remove unwanted attributes from a schema', async () => {
+    const schema = {
+      example: null,
+      properties: {
+        bar: {
+          example: 'pending',
+          type: 'string'
+        },
+        baz: {
+          example: undefined,
+          type: 'string',
+          xml: {
+            name: 'xml-title'
+          }
+        },
+        foo: {
+          example: 'approved',
+          type: 'string'
+        }
+      },
+      type: 'object',
+      xml: { name: 'xml-schema' }
+    };
+
+    removeAttributesFromSchema(schema, ['xml', 'example']);
+
+    expect(schema).toStrictEqual({
+      properties: {
+        bar: {
+          type: 'string'
+        },
+        baz: {
+          type: 'string'
+        },
+        foo: {
+          type: 'string'
+        }
+      },
+      type: 'object'
+    });
+  });
+});

package/src/utils/security.js

@@ -0,0 +1,80 @@
+import { createScopesMismatchError } from '../errors/index.js';
+
+const getValueForHttpSchemeType = (request, securityScheme) => {
+  if (securityScheme.scheme === 'bearer') {
+    const [, bearer] = request.headers.authorization?.match(/^Bearer (.+)$/i) ?? [];
+
+    return bearer;
+  }
+
+  if (securityScheme.scheme === 'basic') {
+    const [, basic] = request.headers.authorization?.match(/^Basic (.+)$/i) ?? [];
+
+    if (!basic) {
+      return;
+    }
+
+    const basicDecoded = Buffer.from(basic, 'base64').toString();
+    const [, username, password] = basicDecoded.match(/^([^:]*):(.*)$/) ?? [];
+
+    if (!username || !password) {
+      return;
+    }
+
+    return { password, username };
+  }
+};
+
+const getValueForApiKeySchemeType = (request, securityScheme) => {
+  let source;
+
+  if (securityScheme.in === 'cookie') {
+    source = request.cookies;
+  } else if (securityScheme.in === 'header') {
+    source = request.headers;
+  } else if (securityScheme.in === 'query') {
+    source = request.query;
+  }
+
+  return source?.[securityScheme.name];
+};
+
+const getValueForOAuthOrOpenIdConnectSchemeType = request => {
+  const [, bearer] = request.headers.authorization?.match(/^Bearer (.+)$/i) ?? [];
+
+  return bearer;
+};
+
+export const extractSecuritySchemeValueFromRequest = (request, securityScheme) => {
+  if (securityScheme.type === 'oauth2' || securityScheme.type === 'openIdConnect') {
+    return getValueForOAuthOrOpenIdConnectSchemeType(request);
+  }
+
+  if (securityScheme.type === 'apiKey') {
+    return getValueForApiKeySchemeType(request, securityScheme);
+  }
+
+  if (securityScheme.type === 'http') {
+    return getValueForHttpSchemeType(request, securityScheme);
+  }
+};
+
+export const verifyScopes = (providedScopes, requiredScopes) => {
+  const missingScopes = requiredScopes.filter(requiredScope => {
+    const hasMatchingScope = providedScopes.some(providedScope => {
+      if (providedScope.endsWith('*')) {
+        const prefixScope = providedScope.match(/(.*)\*$/)[1];
+
+        return requiredScope.startsWith(prefixScope);
+      }
+
+      return providedScope === requiredScope;
+    });
+
+    return !hasMatchingScope;
+  });
+
+  if (missingScopes.length > 0) {
+    throw createScopesMismatchError(providedScopes, requiredScopes, missingScopes);
+  }
+};

package/src/utils/security.test.js

@@ -0,0 +1,241 @@
+import { describe, expect, it } from 'vitest';
+import { errors } from '../errors/index';
+import { extractSecuritySchemeValueFromRequest, verifyScopes } from './security';
+import _ from 'lodash-es';
+
+describe('verifyScopes()', () => {
+  const runTest = ({ missing, provided, required }) => {
+    try {
+      verifyScopes(provided, required);
+
+      if (missing.length > 0) {
+        throw new Error('Expected an error to be thrown');
+      }
+    } catch (err) {
+      expect(err).toBeInstanceOf(errors.ScopesMismatchError);
+      expect(err).toMatchObject({
+        scopes: {
+          missing: missing,
+          provided: provided,
+          required: required
+        }
+      });
+    }
+  };
+
+  it('should verify regular scopes correctly against required scopes', async () => {
+    const provided = ['read', 'write'];
+
+    runTest({ missing: [], provided, required: [] });
+    runTest({ missing: [], provided, required: ['read', 'write'] });
+    runTest({ missing: [], provided, required: ['read'] });
+    runTest({ missing: ['remove'], provided, required: ['read', 'write', 'remove'] });
+    runTest({ missing: ['remove'], provided: ['read'], required: ['remove'] });
+    runTest({ missing: [''], provided, required: [''] });
+    runTest({ missing: ['read', 'write'], provided: [], required: ['read', 'write'] });
+  });
+
+  it('should verify regular scopes correctly against *', async () => {
+    const provided = ['*'];
+
+    runTest({ missing: [], provided, required: ['user'] });
+    runTest({ missing: [], provided, required: ['user:'] });
+    runTest({ missing: [], provided, required: ['user:foo'] });
+    runTest({ missing: [], provided, required: ['user:foo:'] });
+    runTest({ missing: [], provided, required: ['user:foo:bar'] });
+    runTest({ missing: [], provided, required: ['user:foo:bar:'] });
+    runTest({ missing: [], provided, required: [''] });
+    runTest({ missing: [], provided, required: [] });
+  });
+
+  it('should verify regular scopes correctly against * suffix', async () => {
+    let provided = ['user:*', 'transaction:foo:*'];
+
+    runTest({ missing: [], provided, required: ['user:foo'] });
+    runTest({ missing: [], provided, required: ['user:foo:bar'] });
+    runTest({ missing: [], provided, required: ['user:'] });
+    runTest({ missing: [], provided, required: ['transaction:foo:bar'] });
+    runTest({ missing: [], provided, required: ['transaction:foo:'] });
+    runTest({ missing: ['user'], provided, required: ['user'] });
+    runTest({ missing: ['transaction:foo'], provided, required: ['transaction:foo'] });
+    runTest({ missing: ['transaction::'], provided, required: ['transaction::'] });
+    runTest({ missing: [''], provided, required: [''] });
+
+    provided = ['user.*', 'transaction.foo.*'];
+
+    runTest({ missing: [], provided, required: ['user.foo'] });
+    runTest({ missing: [], provided, required: ['user.foo.bar'] });
+    runTest({ missing: [], provided, required: ['user.'] });
+    runTest({ missing: [], provided, required: ['transaction.foo.bar'] });
+    runTest({ missing: [], provided, required: ['transaction.foo.'] });
+    runTest({ missing: ['user'], provided, required: ['user'] });
+    runTest({ missing: ['transaction.foo'], provided, required: ['transaction.foo'] });
+    runTest({ missing: ['transaction..'], provided, required: ['transaction..'] });
+    runTest({ missing: [''], provided, required: [''] });
+
+    provided = ['user*', 'transaction:foo*'];
+
+    runTest({ missing: [], provided, required: ['userfoo'] });
+    runTest({ missing: [], provided, required: ['user'] });
+    runTest({ missing: [], provided, required: ['transaction:foo'] });
+    runTest({ missing: [], provided, required: ['transaction:foobar'] });
+    runTest({ missing: ['use'], provided, required: ['use'] });
+    runTest({ missing: ['transaction:foz'], provided, required: ['transaction:foz'] });
+    runTest({ missing: [''], provided, required: [''] });
+  });
+});
+
+describe('extractSecuritySchemeValueFromRequest()', () => {
+  describe('oauth2', () => {
+    const securityScheme = { type: 'oauth2' };
+
+    it('should extract the bearer token from the authorization header', async () => {
+      const request1 = _.set({}, 'headers.authorization', 'Bearer foo bar');
+      const request2 = _.set({}, 'headers.authorization', 'bearer foo bar');
+
+      expect(extractSecuritySchemeValueFromRequest(request1, securityScheme)).toBe('foo bar');
+      expect(extractSecuritySchemeValueFromRequest(request2, securityScheme)).toBe('foo bar');
+    });
+
+    it('should return undefined if the authorization header is malformed', async () => {
+      const request = _.set({}, 'headers.authorization', 'foo bar');
+
+      expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+    });
+
+    it('should return undefined if the authorization header is missing', async () => {
+      const request = _.set({}, 'headers', {});
+
+      expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+    });
+  });
+
+  describe('apiKey', () => {
+    describe('in: cookie', () => {
+      const securityScheme = { in: 'cookie', name: 'foo', type: 'apiKey' };
+
+      it('should extract the value from the cookie', async () => {
+        const request = _.set({}, 'cookies.foo', 'bar');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBe('bar');
+      });
+
+      it('should return undefined if the cookie is missing', async () => {
+        const request = _.set({}, 'cookies', {});
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the are no cookies', async () => {
+        const request = {};
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+    });
+
+    describe('in: header', () => {
+      const securityScheme = { in: 'header', name: 'foo', type: 'apiKey' };
+
+      it('should extract the value from the header', async () => {
+        const request = _.set({}, 'headers.foo', 'bar');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBe('bar');
+      });
+
+      it('should return undefined if the header is missing', async () => {
+        const request = _.set({}, 'headers', {});
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the are no headers', async () => {
+        const request = {};
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+    });
+
+    describe('in: query', () => {
+      const securityScheme = { in: 'query', name: 'foo', type: 'apiKey' };
+
+      it('should extract the value from the query', async () => {
+        const request = _.set({}, 'query.foo', 'bar');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBe('bar');
+      });
+
+      it('should return undefined if the query is missing', async () => {
+        const request = _.set({}, 'query', {});
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the are no queries', async () => {
+        const request = {};
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+    });
+  });
+
+  describe('http', () => {
+    describe('scheme: bearer', () => {
+      const securityScheme = { scheme: 'bearer', type: 'http' };
+
+      it('should extract the bearer token from the authorization header', async () => {
+        const request1 = _.set({}, 'headers.authorization', 'Bearer foo bar');
+        const request2 = _.set({}, 'headers.authorization', 'bearer foo bar');
+
+        expect(extractSecuritySchemeValueFromRequest(request1, securityScheme)).toBe('foo bar');
+        expect(extractSecuritySchemeValueFromRequest(request2, securityScheme)).toBe('foo bar');
+      });
+
+      it('should return undefined if the authorization header is malformed', async () => {
+        const request = _.set({}, 'headers.authorization', 'foo bar');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the authorization header is missing', async () => {
+        const request = _.set({}, 'headers', {});
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+    });
+
+    describe('scheme: basic', () => {
+      const securityScheme = { scheme: 'basic', type: 'http' };
+
+      it('should extract the username and password from the authorization header', async () => {
+        const request = _.set({}, 'headers.authorization', 'Basic Zm9vOmJhcg==');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toStrictEqual({
+          password: 'bar',
+          username: 'foo'
+        });
+      });
+
+      it('should return undefined if the authorization header is malformed', async () => {
+        const request1 = _.set({}, 'headers.authorization', 'foo');
+        const request2 = _.set({}, 'headers.authorization', 'Basic foo');
+        const request3 = _.set({}, 'headers.authorization', 'Basic _~#');
+
+        expect(extractSecuritySchemeValueFromRequest(request1, securityScheme)).toBeUndefined();
+        expect(extractSecuritySchemeValueFromRequest(request2, securityScheme)).toBeUndefined();
+        expect(extractSecuritySchemeValueFromRequest(request3, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the authorization header is missing', async () => {
+        const request = _.set({}, 'headers', {});
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+
+      it('should return undefined if the username or password is missing', async () => {
+        const request = _.set({}, 'headers.authorization', 'Basic Zm9v');
+
+        expect(extractSecuritySchemeValueFromRequest(request, securityScheme)).toBeUndefined();
+      });
+    });
+  });
+});