dce-reactkit 3.11.3 → 3.12.1-beta-cross-server.1

package/src/helpers/dataSigner.ts

@@ -0,0 +1,232 @@
+// Import crypto
+import { createHash } from 'crypto';
+
+// Import jwt
+import jwt from 'jwt-simple';
+
+// Import shared helpers
+import { internalGetCrossServerCredentialCollection } from '../server/initServer';
+
+// Import shared types
+import ErrorWithCode from '../errors/ErrorWithCode';
+import ReactKitErrorCode from '../types/ReactKitErrorCode';
+import CrossServerCredential from '../types/CrossServerCredential';
+
+// Import shared constants
+import MINUTE_IN_MS from '../constants/MINUTE_IN_MS';
+
+/*------------------------------------------------------------------------*/
+/* ------------------------------ Encoding ------------------------------ */
+/*------------------------------------------------------------------------*/
+
+/**
+ * Validate a JWT token
+ * @author Gabe Abrams
+ * @param encodedSecret the encoded secret
+ * @return the secret
+ */
+const decodeCredentialSecret = (encodedSecret: string): string => {
+  // Get the credential encoding salt
+  const credentialEncodingSalt = process.env.REACTKIT_CRED_ENCODING_SALT;
+  if (!credentialEncodingSalt) {
+    throw new ErrorWithCode(
+      'Cannot decode a cross-server credential secret because the credential encoding salt was not found in env.',
+      ReactKitErrorCode.CrossServerNoCredentialEncodingSalt,
+    );
+  }
+
+  // Decode the secret
+  return jwt.decode(encodedSecret, credentialEncodingSalt);
+};
+
+/*------------------------------------------------------------------------*/
+/* ------------------------------- Signing ------------------------------ */
+/*------------------------------------------------------------------------*/
+
+/**
+ * Sign using sha 256
+ * @author Gabe Abrams
+ * @param opts object containing all arguments
+ * @param opts.pack the pack to sign
+ * @param opts.secret the reactkit secret to sign with
+ * @return the signed hash
+ */
+const genSignature = (
+  opts: {
+    pack: string,
+    secret: string,
+  },
+): string => {
+  // Generate signature
+  return (
+    createHash('sha256')
+      .update(JSON.stringify({ pack: opts.pack, secret: opts.secret }))
+      .digest('base64')
+  );
+};
+
+/**
+ * Sign data with a private reactkit key, package it into a signed data pack
+ * @author Gabe Abrams
+ * @param opts object containing all arguments
+ * @param opts.method the method to sign
+ * @param opts.path the http request path
+ * @param opts.params the data in the body to sign
+ * @param opts.key the reactkit key to sign with
+ * @param opts.secret the reactkit secret to sign with
+ * @return the signed data
+ */
+export const createSignedPack = (
+  opts: {
+    method: string,
+    path: string,
+    params: { [key: string]: any },
+    key: string,
+    secret: string,
+  },
+): string => {
+  // Create a timestamp
+  const timestamp = Date.now();
+
+  // Create the pack
+  const pack = JSON.stringify({
+    method: opts.method,
+    path: opts.path,
+    params: opts.params,
+    key: opts.key,
+    timestamp,
+  });
+
+  // Generate signature
+  const signature = genSignature({
+    pack,
+    secret: opts.secret,
+  });
+
+  // Create a signed pack
+  const signedPack = encodeURIComponent(JSON.stringify({
+    pack,
+    signature,
+  }));
+
+  // Return the signed pack
+  return signedPack;
+};
+
+/**
+ * Parse signed pack. Throws an error if invalid
+ * @author Gabe Abrams
+ * @param opts object containing all arguments
+ * @param opts.method the method of the data validate
+ * @param opts.path the http request path to validate
+ * @param opts.scope the name of the scope to validate
+ * @param opts.signedPack the signed data pack to validate
+ * @returns parsed and validated params
+ */
+export const parseSignedPack = async (
+  opts: {
+    method: string,
+    path: string,
+    scope: string,
+    signedPack: string,
+  },
+): Promise<{ [key: string]: any }> => {
+  // Extract signature
+  let pack: string;
+  let signature: string;
+  let method: string;
+  let path: string;
+  let key: string;
+  let timestamp: number;
+  let params: { [k: string]: any };
+  try {
+    ({
+      pack,
+      signature,
+    } = JSON.parse(decodeURIComponent(opts.signedPack)));
+
+    // Unpack
+    ({
+      method,
+      path,
+      params,
+      key,
+      timestamp,
+    } = JSON.parse(pack));
+  } catch (err) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the request could not be parsed.',
+      ReactKitErrorCode.PackUnparseable,
+    );
+  }
+
+  // Make sure the method and path match
+  if (method !== opts.method) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the method did not match.',
+      ReactKitErrorCode.PackInvalidMethod,
+    );
+  }
+  if (path !== opts.path) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the path did not match.',
+      ReactKitErrorCode.PackInvalidPath,
+    );
+  }
+
+  // Make sure the timestamp was recent enough
+  const elapsedMs = Math.abs(Date.now() - timestamp);
+  if (elapsedMs < MINUTE_IN_MS) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the request was too old.',
+      ReactKitErrorCode.PackInvalidTimestamp,
+    );
+  }
+
+  // Get the cross-server credential collection
+  const crossServerCredentialCollection = internalGetCrossServerCredentialCollection();
+  if (!crossServerCredentialCollection) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the cross-server credential collection was not ready in time.',
+      ReactKitErrorCode.PackInvalidCollection,
+    );
+  }
+
+  // Get the cross-server credential
+  const crossServerCredential: CrossServerCredential = await crossServerCredentialCollection.find({ key });
+  if (!crossServerCredential) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the credential was not found.',
+      ReactKitErrorCode.PackInvalidCredential,
+    );
+  }
+
+  // Make sure the scope is included
+  const allowedScopes = crossServerCredential.scopes;
+  if (!allowedScopes.includes(opts.scope)) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the scope was not included.',
+      ReactKitErrorCode.PackInvalidScope,
+    );
+  }
+
+  // Decode the secret
+  const secret = decodeCredentialSecret(crossServerCredential.encodedeSecret);
+
+  // Generate signature
+  const expectedSignature = genSignature({
+    pack,
+    secret,
+  });
+
+  // Make sure the signature matches
+  if (signature !== expectedSignature) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the signature did not match.',
+      ReactKitErrorCode.PackInvalidSignature,
+    );
+  }
+
+  // Return body
+  return params ?? {};
+};

package/src/helpers/genRouteHandler.ts

@@ -17,6 +17,7 @@ import genErrorPage from '../html/genErrorPage';
 import genInfoPage from '../html/genInfoPage';
 import parseUserAgent from './parseUserAgent';
 import getTimeInfoInET from './getTimeInfoInET';
+import { parseSignedPack } from './dataSigner';
 
 // Import shared types
 import LogFunction from '../types/LogFunction';
@@ -29,6 +30,7 @@ import LogSourceSpecificInfo from '../types/Log/LogSourceSpecificInfo';
 import LogBuiltInMetadata from '../types/LogBuiltInMetadata';
 import LogAction from '../types/LogAction';
 import LogLevel from '../types/LogLevel';
+import ErrorWithCode from '../errors/ErrorWithCode';
 
 /**
  * Generate an express API route handler
@@ -37,14 +39,15 @@ import LogLevel from '../types/LogLevel';
  * @param opts.paramTypes map containing the types for each parameter that is
  *   included in the request (map: param name => type)
  * @param opts.handler function that processes the request
- * @param [opts.skipSessionCheck] if true, skip the session check (allow users
- *   to not be logged in and launched via LTI)
- * @param [opts.allowedHosts] if included, only allow requests from these hosts
- *   (start a hostname with a "*" to only check the end of the hostname)
- *   you can include just one string instead of an array
- * @param [opts.bannedHosts] if included, do not allow requests from these hosts
- *   (start a hostname with a "*" to only check the end of the hostname)
- *   you can include just one string instead of an array
+ * @param [opts.crossServerScope] the scope associated with this endpoint.
+ *   If defined, this is a cross-server endpoint, which will never
+ *   have any launch data, will never check Canvas roles or launch status, and will
+ *   instead use scopes and reactkit credentials to sign and validate requests.
+ *   Never start the path with /api/ttm or /api/admin if the endpoint is a cross-server
+ *   endpoint because those roles will not be validated
+ * @param [opts.skipSessionCheck=true if crossServerScope defined] if true, skip
+ *   the session check (allow users to not be logged in and launched via LTI).
+ *   If crossServerScope is defined, this is always true
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -107,106 +110,67 @@ const genRouteHandler = (
         logServerEvent: LogFunction,
       },
     ) => any,
+    crossServerScope?: string,
     skipSessionCheck?: boolean,
-    allowedHosts?: string[] | string,
-    bannedHosts?: string[] | string,
     unhandledErrorMessagePrefix?: string,
   },
 ) => {
   // Return a route handler
   return async (req: any, res: any, next: () => void) => {
+    /*----------------------------------------*/
+    /* ------------- Preparation ------------ */
+    /*----------------------------------------*/
+
     // Output params
     const output: { [k in string]: any } = {};
 
-    /*----------------------------------------*/
-    /* ----------- Hostname Check ----------- */
-    /*----------------------------------------*/
+    // Determine cross server scopes
+    let crossServerScope: string | null = null;
+    if (opts.crossServerScope) {
+      crossServerScope = opts.crossServerScope ?? null;
+    }
 
-    // Get hostnames
-    const originURL = String(
-      req.get('origin')
-      || req.headers.origin
-      || req.headers.referer,
+    // Determine whether we're skipping the session check
+    const skipSessionCheck = !!(
+      opts.skipSessionCheck
+      || crossServerScope
     );
-    const originHostname = (
-      originURL
-        // Remove protocol
-        .replace(/(^\w+:|^)\/\//, '')
-        // Remove port
-        .replace(/:\d+$/, '')
-    );
-    const serverHostname = String(req.hostname);
-
-    // Check allowed
-    if (opts.allowedHosts) {
-      // Only accept requests from allowed hosts
-      const allowedArray = (
-        Array.isArray(opts.allowedHosts)
-          ? opts.allowedHosts
-          : [opts.allowedHosts]
-      );
 
-      // Check if server is localhost
-      if (serverHostname === 'localhost') {
-        // Allow localhost
-        allowedArray.push('localhost');
-      }
+    // Get body from everywhere it can come from
+    let requestBody: {
+      [k: string]: any,
+    } = {
+      ...req.body,
+      ...req.query,
+      ...req.params,
+    };
 
-      // Check if current host is allowed
-      const allowed = allowedArray.some((allowedHost) => {
-        if (allowedHost.startsWith('*')) {
-          // Check end of hostname
-          return originHostname.endsWith(allowedHost.substring(1));
-        }
+    /*----------------------------------------*/
+    /* ------- Cross-Server Validation ------ */
+    /*----------------------------------------*/
 
-        // Check full hostname
-        return originHostname.toLowerCase() === allowedHost.toLowerCase();
-      });
+    if (crossServerScope) {
+      // Get the signed pack
+      const { signedPack } = requestBody;
 
-      // If not allowed, return error
-      if (!allowed) {
-        return handleError(
-          res,
-          {
-            message: 'You are not allowed to access this endpoint.',
-            code: ReactKitErrorCode.HostNotAllowed,
-            status: 403,
-          },
+      // If no pack, throw error
+      if (!signedPack || typeof signedPack !== 'string') {
+        throw new ErrorWithCode(
+          'Could not process a cross server request because there was no valid signed pack.',
+          ReactKitErrorCode.CrossServerNoPack,
         );
       }
-    }
-
-    // Check banned
-    if (opts.bannedHosts) {
-      // Do not allow requests from banned hosts
-      const bannedArray = (
-        Array.isArray(opts.bannedHosts)
-          ? opts.bannedHosts
-          : [opts.bannedHosts]
-      );
-
-      // Check if current host is banned
-      const banned = bannedArray.some((bannedHost) => {
-        if (bannedHost.startsWith('*')) {
-          // Check end of hostname
-          return originHostname.endsWith(bannedHost.substring(1));
-        }
 
-        // Check full hostname
-        return originHostname.toLowerCase() === bannedHost.toLowerCase();
+      // Validate the request
+      const crossServerParams = await parseSignedPack({
+        method: req.method ?? 'GET',
+        path: req.path,
+        scope: crossServerScope,
+        signedPack,
       });
 
-      // If banned, return error
-      if (banned) {
-        return handleError(
-          res,
-          {
-            message: 'You are not allowed to access this endpoint.',
-            code: ReactKitErrorCode.HostBanned,
-            status: 403,
-          },
-        );
-      }
+      // Replace body with params from the pack
+      requestBody = crossServerParams ?? {};
     }
 
     /*----------------------------------------*/
@@ -219,11 +183,7 @@ const genRouteHandler = (
       const [name, type] = paramList[i];
 
       // Find the value as a string
-      const value = (
-        req.params[name]
-        || req.query[name]
-        || req.body[name]
-      );
+      const value = requestBody[name];
 
       // Parse
       if (type === ParamType.Boolean || type === ParamType.BooleanOptional) {
@@ -406,7 +366,7 @@ const genRouteHandler = (
       // Not launched
       (!launched || !launchInfo)
       // Not skipping the session check
-      && !opts.skipSessionCheck
+      && !skipSessionCheck
     ) {
       return handleError(
         res,
@@ -437,7 +397,7 @@ const genRouteHandler = (
         )
       )
       // Not skipping the session check
-      && !opts.skipSessionCheck
+      && !skipSessionCheck
     ) {
       return handleError(
         res,

package/src/helpers/visitEndpointOnAnotherServer/index.ts

@@ -1,71 +1,72 @@
-// Import custom error
-import ErrorWithCode from '../../errors/ErrorWithCode';
+// Import data signer
+import { createSignedPack } from '../dataSigner';
 
 // Import shared types
+import ErrorWithCode from '../../errors/ErrorWithCode';
 import ReactKitErrorCode from '../../types/ReactKitErrorCode';
-
-// Import other helpers
 import sendServerToServerRequest from './sendServerToServerRequest';
 
 /**
- * Send a server-to-server request from this sever to another server that uses
- *   dce-reactkit [for server only]
+ * Visit an endpoint on another server
  * @author Gabe Abrams
  * @param opts object containing all arguments
- * @param opts.host - the host of the other server
- * @param opts.path - the path of the other server's endpoint
- * @param [opts.method=GET] - the method of the endpoint
- * @param [opts.params] - query/body parameters to include
- * @param [opts.headers] - headers to include
- * @returns response from server
+ * @param opts.method the method of the endpoint
+ * @param opts.path the path of the other server's endpoint
+ * @param opts.host the host of the other server
+ * @param [opts.key=process.env.REACTKIT_CROSS_SERVER_CREDENTIAL_KEY] reactkit cross-server
+ *   credential key
+ * @param [opts.secret=process.env.REACTKIT_CROSS_SERVER_CREDENTIAL_SECRET reactkit cross-server
+ *   credential secret
+ * @param [opts.params={}] query/body parameters to include
+ * @param [opts.responseType=JSON] the response type from the other server
  */
 const visitEndpointOnAnotherServer = async (
   opts: {
-    host: string,
+    method: 'GET' | 'POST' | 'DELETE' | 'PUT',
     path: string,
-    method?: ('GET' | 'POST' | 'DELETE' | 'PUT'),
+    host: string,
+    key?: string,
+    secret?: string,
     params?: { [key in string]: any },
-    headers?: { [k in string]: any },
+    responseType?: 'JSON' | 'Text',
   },
 ): Promise<any> => {
-  // Remove properties with undefined values
-  let params: { [key in string]: any } | undefined;
-  if (opts.params) {
-    params = Object.fromEntries(
-      Object
-        .entries(opts.params)
-        .filter(([, value]) => {
-          return value !== undefined;
-        }),
-    );
-  }
+  // Get cross-server credentials
+  const key = opts.key ?? process.env.REACTKIT_CROSS_SERVER_KEY;
+  const secret = opts.secret ?? process.env.REACTKIT_CROSS_SERVER_SECRET;
 
-  // Automatically JSONify arrays and objects
-  if (params) {
-    params = Object.fromEntries(
-      Object
-        .entries(params)
-        .map(([key, value]) => {
-          if (Array.isArray(value) || typeof value === 'object') {
-            return [key, JSON.stringify(value)];
-          }
-          return [key, value];
-        }),
+  // Throw error if no credentials
+  if (!key || !secret) {
+    throw new ErrorWithCode(
+      'Cannot send cross-server signed request because either or both the key and secret were not included or found in env.',
+      ReactKitErrorCode.CrossServerNoCredentialsToSignWith,
     );
   }
 
+  // Create signed pack
+  const signedPack = createSignedPack({
+    method: opts.method,
+    path: opts.path,
+    params: opts.params ?? {},
+    key,
+    secret,
+  });
+
   // Send the request
   const response = await sendServerToServerRequest({
-    host: opts.host,
     path: opts.path,
-    method: opts.method ?? 'GET',
-    params,
+    host: opts.host,
+    method: opts.method,
+    params: {
+      signedPack,
+    },
+    responseType: opts.responseType,
   });
 
   // Check for failure
   if (!response || !response.body) {
     throw new ErrorWithCode(
-      'We didn\'t get a response from the server. Please check your internet connection.',
+      'We didn\'t get a response from the other server. Please check your internet connection.',
       ReactKitErrorCode.NoResponse,
     );
   }

package/src/helpers/visitEndpointOnAnotherServer/sendServerToServerRequest.ts

@@ -15,9 +15,6 @@ import ErrorWithCode from '../../errors/ErrorWithCode';
  * @param [opts.host] host to send request to
  * @param [opts.method=GET] http method to use
  * @param [opts.params] body/data to include in the request
- * @param [opts.headers] headers to include in the request
- * @param [opts.sendCrossDomainCredentials=true if in development mode] if true,
- *   send cross-domain credentials even if not in dev mode
  * @param [opts.responseType=JSON] expected response type
  * @returns { body, status, headers } on success
  */
@@ -27,7 +24,6 @@ const sendServerToServerRequest = async (
     host?: string,
     method?: ('GET' | 'POST' | 'PUT' | 'DELETE'),
     params?: { [k in string]: any },
-    headers?: { [k in string]: any },
     responseType?: 'Text' | 'JSON',
   },
 ): Promise<{
@@ -70,7 +66,9 @@ const sendServerToServerRequest = async (
   }
 
   // Update headers
-  const headers = opts.headers || {};
+  const headers: {
+    [k: string]: any,
+  } = {};
   let data: string | null | { [k: string]: any } | undefined = null;
   if (!headers['Content-Type']) {
     // Form encoded

package/src/index.ts

@@ -113,6 +113,7 @@ import LogMetadataType from './types/LogMetadataType';
 import LogFunction from './types/LogFunction';
 import IntelliTableColumn from './types/IntelliTableColumn';
 import DropdownItemType from './types/DropdownItemType';
+import CrossServerCredential from './types/CrossServerCredential';
 
 // Component-specific-types
 import PickableItem from './components/ItemPicker/types/PickableItem';
@@ -234,6 +235,7 @@ export {
   LogFunction,
   IntelliTableColumn,
   DropdownItemType,
+  CrossServerCredential,
   // Component-specific-types
   PickableItem,
   DBEntry,

package/src/server/initCrossServerCredentialCollection.ts

@@ -0,0 +1,16 @@
+/**
+ * Initialize a cross-server credential collection given the dce-mango Collection class
+ * @author Gabe Abrams
+ * @param Collection the Collection class from dce-mango
+ * @returns initialized logCollection
+ */
+const initCrossServerCredentialCollection = (Collection: any) => {
+  return new Collection(
+    'CrossServerCredential',
+    {
+      uniqueIndexKey: 'key',
+    },
+  );
+};
+
+export default initCrossServerCredentialCollection;

package/src/server/initServer.ts

@@ -27,6 +27,9 @@ let _cacclGetLaunchInfo: GetLaunchInfoFunction;
 // Stored copy of dce-mango log collection
 let _logCollection: any;
 
+// Stored copy of dce-mango cross-server credential collection
+let _crossServerCredentialCollection: any;
+
 /*------------------------------------------------------------------------*/
 /*                                 Helpers                                */
 /*------------------------------------------------------------------------*/
@@ -58,6 +61,16 @@ export const internalGetLogCollection = () => {
   return _logCollection ?? null;
 };
 
+/**
+ * Get cross-server credential collection
+ * @author Gabe Abrams
+ * @return cross-server credential collection if one was included during launch or null
+ *   if we don't have a cross-server credential collection (yet)
+ */
+export const internalGetCrossServerCredentialCollection = () => {
+  return _crossServerCredentialCollection ?? null;
+};
+
 /*------------------------------------------------------------------------*/
 /*                                  Main                                  */
 /*------------------------------------------------------------------------*/
@@ -78,6 +91,9 @@ export const internalGetLogCollection = () => {
  *   userIds are allowed to review logs. If a dce-mango collection, only
  *   Canvas admins with entries in that collection ({ userId, ...}) are allowed
  *   to review logs
+ * @param [opts.crossServerCredentialCollection] mongo collection from dce-mango to use for
+ *   storing cross-server credentials. If none is included, cross-server credentials
+ *   are not supported
  */
 const initServer = (
   opts: {
@@ -85,10 +101,12 @@ const initServer = (
     getLaunchInfo: GetLaunchInfoFunction,
     logCollection?: any,
     logReviewAdmins?: (number[] | any),
+    crossServerCredentialCollection?: any,
   },
 ) => {
   _cacclGetLaunchInfo = opts.getLaunchInfo;
   _logCollection = opts.logCollection;
+  _crossServerCredentialCollection = opts.crossServerCredentialCollection;
 
   /*----------------------------------------*/
   /*                Logging                 */