dce-reactkit 3.12.1-beta-cross-server.2 → 3.12.1-beta-cross-server.3

package/src/helpers/dataSigner.ts

@@ -1,10 +1,5 @@
-// Import crypto
-import { createHash } from 'crypto';
-
-// Import jwt
-import jwt from 'jwt-simple';
-
 // Import shared helpers
+// eslint-disable-next-line import/no-cycle
 import { internalGetCrossServerCredentialCollection } from '../server/initServer';
 
 // Import shared types
@@ -16,57 +11,163 @@ import CrossServerCredential from '../types/CrossServerCredential';
 import MINUTE_IN_MS from '../constants/MINUTE_IN_MS';
 
 /*------------------------------------------------------------------------*/
-/* ------------------------------ Encoding ------------------------------ */
+/* --------------------------- Dynamic Imports -------------------------- */
 /*------------------------------------------------------------------------*/
 
 /**
- * Validate a JWT token
+ * Get a copy of the oauth lib
  * @author Gabe Abrams
- * @param encodedSecret the encoded secret
- * @return the secret
+ * @return the oauth lib
  */
-const decodeCredentialSecret = (encodedSecret: string): string => {
-  // Get the credential encoding salt
-  const credentialEncodingSalt = process.env.REACTKIT_CRED_ENCODING_SALT;
-  if (!credentialEncodingSalt) {
+const getOauthLib = async () => {
+  // Get the oauth signing library (included with caccl)
+  // Ignore because this is assumed to be included with caccl
+  try {
+    // @ts-ignore
+    // eslint-disable-next-line import/no-extraneous-dependencies
+    const oauth = await import('oauth-signature');
+    return oauth;
+  } catch (err) {
     throw new ErrorWithCode(
-      'Cannot decode a cross-server credential secret because the credential encoding salt was not found in env.',
-      ReactKitErrorCode.CrossServerNoCredentialEncodingSalt,
+      'Could not sign a cross-server request because we could not load the oauth library. Please make sure this app has caccl as one of its dependencies.',
+      ReactKitErrorCode.NoOauthLib,
     );
   }
+};
 
-  // Decode the secret
-  return jwt.decode(encodedSecret, credentialEncodingSalt);
+/**
+ * Get a copy of the crypto lib
+ * @author Gabe Abrams
+ * @return the crypto lib
+ */
+const getCryptoLib = async () => {
+  // Get the crypto library (included on the server)
+  // Ignore because this is assumed to be included with typescript
+  // @ts-ignore
+  try {
+    const crypto = await import('crypto');
+    return crypto;
+  } catch (err) {
+    throw new ErrorWithCode(
+      'Could not sign a cross-server request because we could not load the crypto library. Please make sure this operation is running on the server.',
+      ReactKitErrorCode.NoCryptoLib,
+    );
+  }
 };
 
 /*------------------------------------------------------------------------*/
-/* ------------------------------- Signing ------------------------------ */
+/* ------------------------------- Helpers ------------------------------ */
 /*------------------------------------------------------------------------*/
 
 /**
- * Sign using sha 256
+ * Generate an oauth signature
  * @author Gabe Abrams
  * @param opts object containing all arguments
- * @param opts.pack the pack to sign
- * @param opts.secret the reactkit secret to sign with
- * @return the signed hash
+ * @param opts.method the http method
+ * @param opts.path the http request path
+ * @param opts.params the data in the body to sign
+ * @param opts.secret the secret to sign with
+ * @return the signature
  */
-const genSignature = (
+const genSignature = async (
   opts: {
-    pack: string,
+    method?: string,
+    path?: string,
+    params?: { [key: string]: any },
     secret: string,
   },
-): string => {
-  // Generate signature
-  return (
-    createHash('sha256')
-      .update(JSON.stringify({ pack: opts.pack, secret: opts.secret }))
-      .digest('base64')
+): Promise<string> => {
+  // Destructure opts
+  const {
+    method,
+    path,
+    params,
+    secret,
+  } = opts;
+
+  // Get the oauth library
+  const oauth = await getOauthLib();
+
+  // Order the params alphabetically by key
+  const keys = Object.keys(params ?? {});
+  keys.sort();
+  const orderedParams: {
+    [key: string]: any,
+  } = {};
+  keys.forEach((key) => {
+    // Skip oauth_signature
+    if (key === 'oauth_signature') {
+      return;
+    }
+
+    // Add the param
+    orderedParams[key] = (params ?? {})[key];
+  });
+
+  // Generate the signature
+  return decodeURIComponent(oauth.generate(
+    method ?? 'GET',
+    path ?? 'no-path',
+    orderedParams,
+    secret,
+  ));
+};
+
+/**
+ * Decrypt an encrypted string using a secret
+ * @author Gabe Abrams
+ * @param str the encrypted string
+ * @return the decrypted string
+ */
+const decrypt = async (
+  encryptedPack: string,
+): Promise<string> => {
+  // Decryption process based on:
+  // https://medium.com/@tony.infisical/guide-to-nodes-crypto-module-for-encryption-decryption-65c077176980
+
+  // Get the encryption secret
+  const { REACTKIT_CRED_ENCODING_SALT } = process.env;
+  if (!REACTKIT_CRED_ENCODING_SALT) {
+    throw new ErrorWithCode(
+      'Could not decrypt a string because the encryption salt was not set.',
+      ReactKitErrorCode.CrossServerNoCredentialEncodingSalt,
+    );
+  }
+
+  // Get the crypto library
+  const crypto = await getCryptoLib();
+
+  // Separate encrypted pack
+  const {
+    ciphertext,
+    iv,
+    tag,
+  } = JSON.parse(decodeURIComponent(encryptedPack));
+
+  // Parse the encrypted data
+  const decipher = crypto.createDecipheriv(
+    'aes-256-gcm',
+    Buffer.from(REACTKIT_CRED_ENCODING_SALT, 'base64'),
+    Buffer.from(iv, 'base64'),
   );
+
+  // Set the authentication tag
+  decipher.setAuthTag(Buffer.from(tag, 'base64'));
+
+  // Decrypt the string
+  let str = decipher.update(ciphertext, 'base64', 'utf8');
+  str += decipher.final('utf8');
+
+  // Return the decrypted string
+  return str;
 };
 
+/*------------------------------------------------------------------------*/
+/* ------------------------------- Signing ------------------------------ */
+/*------------------------------------------------------------------------*/
+
 /**
- * Sign data with a private reactkit key, package it into a signed data pack
+ * Sign a request and get the new request params
  * @author Gabe Abrams
  * @param opts object containing all arguments
  * @param opts.method the method to sign
@@ -74,9 +175,9 @@ const genSignature = (
  * @param opts.params the data in the body to sign
  * @param opts.key the reactkit key to sign with
  * @param opts.secret the reactkit secret to sign with
- * @return the signed data
+ * @return augmented params for the request, including a signature, timestamp, and key
  */
-export const createSignedPack = (
+export const signRequest = async (
   opts: {
     method: string,
     path: string,
@@ -84,111 +185,108 @@ export const createSignedPack = (
     key: string,
     secret: string,
   },
-): string => {
-  // Create a timestamp
-  const timestamp = Date.now();
-
-  // Create the pack
-  const pack = JSON.stringify({
-    method: opts.method,
-    path: opts.path,
-    params: opts.params,
-    key: opts.key,
-    timestamp,
-  });
+): Promise<{ [key: string]: any }> => {
+  // Destructure opts
+  const method = opts.method.toUpperCase();
+  const {
+    path,
+    params,
+    key,
+    secret,
+  } = opts;
 
-  // Generate signature
-  const signature = genSignature({
-    pack,
-    secret: opts.secret,
+  // Augment the params
+  const augmentedParams: {
+    [key: string]: any,
+  } = {
+    ...params,
+    oauth_consumer_key: key,
+    oauth_nonce: Math.random().toString(36),
+    oauth_timestamp: Date.now(),
+  };
+
+  // Generate a signature
+  const signature = await genSignature({
+    method,
+    path,
+    params,
+    secret,
   });
 
-  // Create a signed pack
-  const signedPack = encodeURIComponent(JSON.stringify({
-    pack,
-    signature,
-  }));
+  // Add signature to the augmented params
+  augmentedParams.oauth_signature = signature;
 
-  // Return the signed pack
-  return signedPack;
+  // Return the augmented params
+  return augmentedParams;
 };
 
 /**
- * Parse signed pack. Throws an error if invalid
+ * Validate a signed request. Throws an error if invalid
  * @author Gabe Abrams
  * @param opts object containing all arguments
  * @param opts.method the method of the data validate
  * @param opts.path the http request path to validate
  * @param opts.scope the name of the scope to validate
- * @param opts.signedPack the signed data pack to validate
+ * @param opts.params the request data to validate
  * @returns parsed and validated params
  */
-export const parseSignedPack = async (
+export const validateSignedRequest = async (
   opts: {
     method: string,
     path: string,
     scope: string,
-    signedPack: string,
+    params: { [key: string]: any },
   },
-): Promise<{ [key: string]: any }> => {
-  // Extract signature
-  let pack: string;
-  let signature: string;
-  let method: string;
-  let path: string;
-  let key: string;
-  let timestamp: number;
-  let params: { [k: string]: any };
-  try {
-    ({
-      pack,
-      signature,
-    } = JSON.parse(decodeURIComponent(opts.signedPack)));
-
-    // Unpack
-    ({
-      method,
-      path,
-      params,
-      key,
-      timestamp,
-    } = JSON.parse(pack));
-  } catch (err) {
-    throw new ErrorWithCode(
-      'Could not validate a cross-server request because the request could not be parsed.',
-      ReactKitErrorCode.PackUnparseable,
-    );
-  }
+) => {
+  /* ---------- Collect Info ---------- */
 
-  // Make sure the method and path match
-  if (method !== opts.method) {
+  // Get the signature
+  if (!opts.params.oauth_signature) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the method did not match.',
-      ReactKitErrorCode.PackInvalidMethod,
+      'Could not validate a cross-server request there was no oauth signature.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
-  if (path !== opts.path) {
+  const signature = opts.params.oauth_signature;
+
+  // Get the timestamp
+  if (
+    // No timestamp
+    !opts.params.oauth_timestamp
+    // Invalid timestamp
+    || Number.isNaN(Number.parseInt(opts.params.oauth_timestamp, 10))
+  ) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the path did not match.',
-      ReactKitErrorCode.PackInvalidPath,
+      'Could not validate a cross-server request there was no valid oauth timestamp.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
+  const timestamp = Number.parseInt(opts.params.oauth_timestamp, 10);
 
-  // Make sure the timestamp was recent enough
-  const elapsedMs = Math.abs(Date.now() - timestamp);
-  if (elapsedMs < MINUTE_IN_MS) {
+  // Get the key
+  if (!opts.params.oauth_consumer_key) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the request was too old.',
-      ReactKitErrorCode.PackInvalidTimestamp,
+      'Could not validate a cross-server request there was no oauth consumer key.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
+  const key = opts.params.oauth_consumer_key;
+
+  // Get the rest of the info
+  const {
+    method,
+    path,
+    params,
+  } = opts;
+
+  /* ------- Look Up Credential ------- */
 
   // Get the cross-server credential collection
   const crossServerCredentialCollection = internalGetCrossServerCredentialCollection();
   if (!crossServerCredentialCollection) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the cross-server credential collection was not ready in time.',
-      ReactKitErrorCode.PackInvalidCollection,
+      ReactKitErrorCode.SignedRequestInvalidCollection,
     );
   }
 
@@ -197,7 +295,7 @@ export const parseSignedPack = async (
   if (!crossServerCredential) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the credential was not found.',
-      ReactKitErrorCode.PackInvalidCredential,
+      ReactKitErrorCode.SignedRequestInvalidCredential,
     );
   }
 
@@ -206,27 +304,37 @@ export const parseSignedPack = async (
   if (!allowedScopes.includes(opts.scope)) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the scope was not included.',
-      ReactKitErrorCode.PackInvalidScope,
+      ReactKitErrorCode.SignedRequestInvalidScope,
     );
   }
 
   // Decode the secret
-  const secret = decodeCredentialSecret(crossServerCredential.encodedeSecret);
+  const secret = await decrypt(crossServerCredential.encodedeSecret);
+
+  /* -------- Verify Signature -------- */
 
-  // Generate signature
-  const expectedSignature = genSignature({
-    pack,
+  // Generate a new signature to compare
+  const expectedSignature = await genSignature({
+    method,
+    path,
+    params,
     secret,
   });
 
-  // Make sure the signature matches
+  // Make sure the signatures match
   if (signature !== expectedSignature) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the signature did not match.',
-      ReactKitErrorCode.PackInvalidSignature,
+      ReactKitErrorCode.SignedRequestInvalidSignature,
     );
   }
 
-  // Return body
-  return params ?? {};
+  // Make sure the timestamp was recent enough
+  const elapsedMs = Math.abs(Date.now() - timestamp);
+  if (elapsedMs < MINUTE_IN_MS) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the request was too old.',
+      ReactKitErrorCode.SignedRequestInvalidTimestamp,
+    );
+  }
 };

package/src/helpers/genRouteHandler.ts

@@ -17,7 +17,7 @@ import genErrorPage from '../html/genErrorPage';
 import genInfoPage from '../html/genInfoPage';
 import parseUserAgent from './parseUserAgent';
 import getTimeInfoInET from './getTimeInfoInET';
-import { parseSignedPack } from './dataSigner';
+import { validateSignedRequest } from './dataSigner';
 
 // Import shared types
 import LogFunction from '../types/LogFunction';
@@ -30,7 +30,6 @@ import LogSourceSpecificInfo from '../types/Log/LogSourceSpecificInfo';
 import LogBuiltInMetadata from '../types/LogBuiltInMetadata';
 import LogAction from '../types/LogAction';
 import LogLevel from '../types/LogLevel';
-import ErrorWithCode from '../errors/ErrorWithCode';
 
 /**
  * Generate an express API route handler
@@ -137,7 +136,7 @@ const genRouteHandler = (
     );
 
     // Get body from everywhere it can come from
-    let requestBody: {
+    const requestBody: {
       [k: string]: any,
     } = {
       ...req.body,
@@ -150,27 +149,31 @@ const genRouteHandler = (
     /*----------------------------------------*/
 
     if (crossServerScope) {
-      // Get the signed pack
-      const { signedPack } = requestBody;
-
-      // If no pack, throw error
-      if (!signedPack || typeof signedPack !== 'string') {
-        throw new ErrorWithCode(
-          'Could not process a cross server request because there was no valid signed pack.',
-          ReactKitErrorCode.CrossServerNoPack,
+      try {
+        // Validate the request body
+        await validateSignedRequest({
+          method: req.method ?? 'GET',
+          path: req.path,
+          scope: crossServerScope,
+          params: requestBody,
+        });
+
+        // Valid! Remove oauth values
+        Object.keys(requestBody).forEach((key) => {
+          if (key.startsWith('oauth_')) {
+            delete requestBody[key];
+          }
+        });
+      } catch (err) {
+        return handleError(
+          res,
+          {
+            message: `The authenticity of a cross-server request could not be validated because an error occurred: ${(err as any).message ?? 'unknown error'}`,
+            code: ((err as any).code ?? ReactKitErrorCode.UnknownCrossServerError),
+            status: 401,
+          },
         );
       }
-
-      // Validate the request
-      const crossServerParams = await parseSignedPack({
-        method: req.method ?? 'GET',
-        path: req.path,
-        scope: crossServerScope,
-        signedPack,
-      });
-
-      // Replace body with params from the pack
-      requestBody = crossServerParams ?? {};
     }
 
     /*----------------------------------------*/
@@ -586,14 +589,14 @@ const genRouteHandler = (
         // Main log info
         const mainLogInfo: LogMainInfo = {
           id: `${launchInfo ? launchInfo.userId : 'unknown'}-${Date.now()}-${Math.floor(Math.random() * 100000)}-${Math.floor(Math.random() * 100000)}`,
-          userFirstName: (launchInfo ? launchInfo.userFirstName: 'unknown'),
+          userFirstName: (launchInfo ? launchInfo.userFirstName : 'unknown'),
           userLastName: (launchInfo ? launchInfo.userLastName : 'unknown'),
           userEmail: (launchInfo ? launchInfo.userEmail : 'unknown'),
           userId: (launchInfo ? launchInfo.userId : 'unknown'),
           isLearner: (launchInfo && !!launchInfo.isLearner),
           isAdmin: (launchInfo && !!launchInfo.isAdmin),
           isTTM: (launchInfo && !!launchInfo.isTTM),
-          courseId: (launchInfo ? launchInfo.courseId : 'unknown' ),
+          courseId: (launchInfo ? launchInfo.courseId : 'unknown'),
           courseName: (launchInfo ? launchInfo.contextLabel : 'unknown'),
           browser,
           device,