corebasic 1.0.172 → 1.0.174

package/libs/features.js

@@ -16,12 +16,14 @@ const getFeature = name => features[name]
 const DEPLOY_TOKEN_SECRET = process.env.DEPLOY_TOKEN_SECRET || "MY_SECRET_DEPLOY_TOKEN"
 const SERVICE_ACCESS_TOKEN = jwt.sign({app: process.env.APP_DEPLOYMENT_NAME}, DEPLOY_TOKEN_SECRET, { expiresIn: '365d' });
 
+const NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN = await (async _ => { if(process.env.NDCURVE_DEVELOPER_SERVICE)try{ return (await Utils.fileToJson('file://', '/.ndcurve/developer.license.json')).accessToken?.trim() }catch{}})();
+
 async function loadLocalFeatures() {  // For Local Testing
     let data = {}
     if (process.env.LOAD_LOCAL_FEATURES) {
         try {
             let url = process.env.LOAD_LOCAL_FEATURES_URL ? `${process.env.LOAD_LOCAL_FEATURES_URL}/features` : 'https://slyp.app/slyp-dev/api/v1/features'
-            let result = (await axios.get(url, { data: {}, headers: {jwt: SERVICE_ACCESS_TOKEN, service: true}, timeout: 3000 })).data
+            let result = (await axios.get(url, { data: {}, headers: {jwt: SERVICE_ACCESS_TOKEN, service: true, NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN}, timeout: 3000 })).data
             await Utils.stringToFile('/slyp.local.features.json', JSON.stringify(result.data, null, '\t'))
         } catch {
             console.log('Error Fetching Remote Features')
@@ -78,7 +80,7 @@ export const send = async (meta, feature, data, params) => {
     return (await axios({
         method,
         url: `${service}${url}`,
-        headers: { jwt: SERVICE_ACCESS_TOKEN, service: true },
+        headers: { jwt: SERVICE_ACCESS_TOKEN, service: true, NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN },
         data: payload,
         timeout: 30000 // 30 secs
       })).data;
@@ -179,7 +181,7 @@ export const start = async (app, url, file) => {
             exp_features[key] = {api, service: `${SERVICE_ADDRESS}`}
         if (process.env.LOAD_LOCAL_FEATURES) {
             for (let key in SLYP_FEATURES_LIST)
-                SLYP_FEATURES_LIST[key].headers = {JWT: SERVICE_ACCESS_TOKEN, service: true}
+                SLYP_FEATURES_LIST[key].headers = {JWT: SERVICE_ACCESS_TOKEN, service: true, NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN}
         }
         res.json({ data: { ...SLYP_FEATURES_LIST, ...exp_features } })
     })

package/libs/session.js

@@ -11,6 +11,8 @@ const REFRESH_TOKEN_SECRET = process.env.JWT_REFRESH_TOKEN_SECRET || "MY_SECRET_
 
 const DEPLOY_TOKEN_SECRET = process.env.DEPLOY_TOKEN_SECRET || "MY_SECRET_DEPLOY_TOKEN"
 
+const NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN_SECRET = process.env.NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN_PUBLIC_KEY
+
 let urlsAllowed = []
 export var ALLOWED_URLS = []
 
@@ -40,9 +42,30 @@ export const start = (expressApp, allowedUrls) => {
         try {
             const token = req.header('JWT');    //  'Authorization' for Spring Boot, 'x-access-token' for Node.js Express back-end
             const service = req.header('SERVICE');  // Case insensitive search
-            if (service && jwt.verify(token, DEPLOY_TOKEN_SECRET))
+            const additionalValidation = async _ => (process.env.GRANT_FULL_ACCESS || allowedDefaults || await checkPrivilege(req))
+
+            async function verifyDeveloperAccess() {
+                const NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN = req.header('NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN')
+                const isDeveloper = NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN && NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN_SECRET
+                if (!isDeveloper)
+                    return false
+                const verify =  _ => jwt.verify(NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN, NDCURVE_DEVELOPER_LICENSE_ACCESS_TOKEN_SECRET, { algorithms: ['RS512'] })
+                try {
+                    if (service && verify())
+                        return true
+                    else if (verify() && await additionalValidation())
+                        return true
+                } catch (error) {
+
+                }
+                return false
+            }
+
+            if (await verifyDeveloperAccess())
+                return next()
+            else if (service && jwt.verify(token, DEPLOY_TOKEN_SECRET))
                 return next()
-            else if (jwt.verify(token, ACCESS_TOKEN_SECRET) && (process.env.GRANT_FULL_ACCESS || allowedDefaults || await checkPrivilege(req)))
+            else if (jwt.verify(token, ACCESS_TOKEN_SECRET) && await additionalValidation())
                 return next()
             throw null;
         } catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "corebasic",
   "type": "module",
-  "version": "1.0.172",
+  "version": "1.0.174",
   "description": "",
   "main": "index.js",
   "scripts": {