dce-reactkit 3.12.1-beta-cross-server.2 → 3.12.1-beta-cross-server.4

package/src/helpers/dataSigner.ts

@@ -1,10 +1,8 @@
-// Import crypto
-import { createHash } from 'crypto';
-
-// Import jwt
-import jwt from 'jwt-simple';
+// Import cryptography lib
+import Cryptr from 'cryptr';
 
 // Import shared helpers
+// eslint-disable-next-line import/no-cycle
 import { internalGetCrossServerCredentialCollection } from '../server/initServer';
 
 // Import shared types
@@ -16,57 +14,120 @@ import CrossServerCredential from '../types/CrossServerCredential';
 import MINUTE_IN_MS from '../constants/MINUTE_IN_MS';
 
 /*------------------------------------------------------------------------*/
-/* ------------------------------ Encoding ------------------------------ */
+/* --------------------------- Dynamic Imports -------------------------- */
 /*------------------------------------------------------------------------*/
 
 /**
- * Validate a JWT token
+ * Get a copy of the oauth lib
  * @author Gabe Abrams
- * @param encodedSecret the encoded secret
- * @return the secret
+ * @return the oauth lib
  */
-const decodeCredentialSecret = (encodedSecret: string): string => {
-  // Get the credential encoding salt
-  const credentialEncodingSalt = process.env.REACTKIT_CRED_ENCODING_SALT;
-  if (!credentialEncodingSalt) {
+const getOauthLib = async () => {
+  // Get the oauth signing library (included with caccl)
+  // Ignore because this is assumed to be included with caccl
+  try {
+    // @ts-ignore
+    // eslint-disable-next-line import/no-extraneous-dependencies
+    const oauth = await import('oauth-signature');
+    return oauth;
+  } catch (err) {
     throw new ErrorWithCode(
-      'Cannot decode a cross-server credential secret because the credential encoding salt was not found in env.',
-      ReactKitErrorCode.CrossServerNoCredentialEncodingSalt,
+      'Could not sign a cross-server request because we could not load the oauth library. Please make sure this app has caccl as one of its dependencies.',
+      ReactKitErrorCode.NoOauthLib,
     );
   }
-
-  // Decode the secret
-  return jwt.decode(encodedSecret, credentialEncodingSalt);
 };
 
 /*------------------------------------------------------------------------*/
-/* ------------------------------- Signing ------------------------------ */
+/* ------------------------------- Helpers ------------------------------ */
 /*------------------------------------------------------------------------*/
 
 /**
- * Sign using sha 256
+ * Generate an oauth signature
  * @author Gabe Abrams
  * @param opts object containing all arguments
- * @param opts.pack the pack to sign
- * @param opts.secret the reactkit secret to sign with
- * @return the signed hash
+ * @param opts.method the http method
+ * @param opts.path the http request path
+ * @param opts.params the data in the body to sign
+ * @param opts.secret the secret to sign with
+ * @return the signature
  */
-const genSignature = (
+const genSignature = async (
   opts: {
-    pack: string,
+    method?: string,
+    path?: string,
+    params?: { [key: string]: any },
     secret: string,
   },
-): string => {
-  // Generate signature
-  return (
-    createHash('sha256')
-      .update(JSON.stringify({ pack: opts.pack, secret: opts.secret }))
-      .digest('base64')
-  );
+): Promise<string> => {
+  // Destructure opts
+  const {
+    method,
+    path,
+    params,
+    secret,
+  } = opts;
+
+  // Get the oauth library
+  const oauth = await getOauthLib();
+
+  // Order the params alphabetically by key
+  const keys = Object.keys(params ?? {});
+  keys.sort();
+  const orderedParams: {
+    [key: string]: any,
+  } = {};
+  keys.forEach((key) => {
+    // Skip oauth_signature
+    if (key === 'oauth_signature') {
+      return;
+    }
+
+    // Add the param
+    orderedParams[key] = (params ?? {})[key];
+  });
+
+  // Generate the signature
+  return decodeURIComponent(oauth.generate(
+    method ?? 'GET',
+    path ?? 'no-path',
+    orderedParams,
+    secret,
+  ));
 };
 
 /**
- * Sign data with a private reactkit key, package it into a signed data pack
+ * Decrypt an encrypted string using a secret
+ * @author Gabe Abrams
+ * @param str the encrypted string
+ * @return the decrypted string
+ */
+const decrypt = async (
+  encryptedPack: string,
+): Promise<string> => {
+  // Get the encryption secret
+  const { REACTKIT_CRED_ENCODING_SALT } = process.env;
+  if (!REACTKIT_CRED_ENCODING_SALT) {
+    throw new ErrorWithCode(
+      'Could not decrypt a string because the encryption salt was not set.',
+      ReactKitErrorCode.CrossServerNoCredentialEncodingSalt,
+    );
+  }
+
+  // Decrypt the string
+  const cryptr = new Cryptr(REACTKIT_CRED_ENCODING_SALT);
+  const str = cryptr.decrypt(encryptedPack);
+
+  // Return the decrypted string
+  return str;
+};
+
+/*------------------------------------------------------------------------*/
+/* ------------------------------- Signing ------------------------------ */
+/*------------------------------------------------------------------------*/
+
+/**
+ * Sign a request and get the new request params
  * @author Gabe Abrams
  * @param opts object containing all arguments
  * @param opts.method the method to sign
@@ -74,9 +135,9 @@ const genSignature = (
  * @param opts.params the data in the body to sign
  * @param opts.key the reactkit key to sign with
  * @param opts.secret the reactkit secret to sign with
- * @return the signed data
+ * @return augmented params for the request, including a signature, timestamp, and key
  */
-export const createSignedPack = (
+export const signRequest = async (
   opts: {
     method: string,
     path: string,
@@ -84,111 +145,108 @@ export const createSignedPack = (
     key: string,
     secret: string,
   },
-): string => {
-  // Create a timestamp
-  const timestamp = Date.now();
-
-  // Create the pack
-  const pack = JSON.stringify({
-    method: opts.method,
-    path: opts.path,
-    params: opts.params,
-    key: opts.key,
-    timestamp,
-  });
+): Promise<{ [key: string]: any }> => {
+  // Destructure opts
+  const method = opts.method.toUpperCase();
+  const {
+    path,
+    params,
+    key,
+    secret,
+  } = opts;
+
+  // Augment the params
+  const augmentedParams: {
+    [key: string]: any,
+  } = {
+    ...params,
+    oauth_consumer_key: key,
+    oauth_nonce: Math.random().toString(36),
+    oauth_timestamp: Date.now(),
+  };
 
-  // Generate signature
-  const signature = genSignature({
-    pack,
-    secret: opts.secret,
+  // Generate a signature
+  const signature = await genSignature({
+    method,
+    path,
+    params,
+    secret,
   });
 
-  // Create a signed pack
-  const signedPack = encodeURIComponent(JSON.stringify({
-    pack,
-    signature,
-  }));
+  // Add signature to the augmented params
+  augmentedParams.oauth_signature = signature;
 
-  // Return the signed pack
-  return signedPack;
+  // Return the augmented params
+  return augmentedParams;
 };
 
 /**
- * Parse signed pack. Throws an error if invalid
+ * Validate a signed request. Throws an error if invalid
  * @author Gabe Abrams
  * @param opts object containing all arguments
  * @param opts.method the method of the data validate
  * @param opts.path the http request path to validate
  * @param opts.scope the name of the scope to validate
- * @param opts.signedPack the signed data pack to validate
+ * @param opts.params the request data to validate
  * @returns parsed and validated params
  */
-export const parseSignedPack = async (
+export const validateSignedRequest = async (
   opts: {
     method: string,
     path: string,
     scope: string,
-    signedPack: string,
+    params: { [key: string]: any },
   },
-): Promise<{ [key: string]: any }> => {
-  // Extract signature
-  let pack: string;
-  let signature: string;
-  let method: string;
-  let path: string;
-  let key: string;
-  let timestamp: number;
-  let params: { [k: string]: any };
-  try {
-    ({
-      pack,
-      signature,
-    } = JSON.parse(decodeURIComponent(opts.signedPack)));
-
-    // Unpack
-    ({
-      method,
-      path,
-      params,
-      key,
-      timestamp,
-    } = JSON.parse(pack));
-  } catch (err) {
-    throw new ErrorWithCode(
-      'Could not validate a cross-server request because the request could not be parsed.',
-      ReactKitErrorCode.PackUnparseable,
-    );
-  }
+) => {
+  /* ---------- Collect Info ---------- */
 
-  // Make sure the method and path match
-  if (method !== opts.method) {
+  // Get the signature
+  if (!opts.params.oauth_signature) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the method did not match.',
-      ReactKitErrorCode.PackInvalidMethod,
+      'Could not validate a cross-server request there was no oauth signature.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
-  if (path !== opts.path) {
+  const signature = opts.params.oauth_signature;
+
+  // Get the timestamp
+  if (
+    // No timestamp
+    !opts.params.oauth_timestamp
+    // Invalid timestamp
+    || Number.isNaN(Number.parseInt(opts.params.oauth_timestamp, 10))
+  ) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the path did not match.',
-      ReactKitErrorCode.PackInvalidPath,
+      'Could not validate a cross-server request there was no valid oauth timestamp.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
+  const timestamp = Number.parseInt(opts.params.oauth_timestamp, 10);
 
-  // Make sure the timestamp was recent enough
-  const elapsedMs = Math.abs(Date.now() - timestamp);
-  if (elapsedMs < MINUTE_IN_MS) {
+  // Get the key
+  if (!opts.params.oauth_consumer_key) {
     throw new ErrorWithCode(
-      'Could not validate a cross-server request because the request was too old.',
-      ReactKitErrorCode.PackInvalidTimestamp,
+      'Could not validate a cross-server request there was no oauth consumer key.',
+      ReactKitErrorCode.CrossServerMissingSignedRequestInfo,
     );
   }
+  const key = opts.params.oauth_consumer_key;
+
+  // Get the rest of the info
+  const {
+    method,
+    path,
+    params,
+  } = opts;
+
+  /* ------- Look Up Credential ------- */
 
   // Get the cross-server credential collection
   const crossServerCredentialCollection = internalGetCrossServerCredentialCollection();
   if (!crossServerCredentialCollection) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the cross-server credential collection was not ready in time.',
-      ReactKitErrorCode.PackInvalidCollection,
+      ReactKitErrorCode.SignedRequestInvalidCollection,
     );
   }
 
@@ -197,7 +255,7 @@ export const parseSignedPack = async (
   if (!crossServerCredential) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the credential was not found.',
-      ReactKitErrorCode.PackInvalidCredential,
+      ReactKitErrorCode.SignedRequestInvalidCredential,
     );
   }
 
@@ -206,27 +264,37 @@ export const parseSignedPack = async (
   if (!allowedScopes.includes(opts.scope)) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the scope was not included.',
-      ReactKitErrorCode.PackInvalidScope,
+      ReactKitErrorCode.SignedRequestInvalidScope,
     );
   }
 
   // Decode the secret
-  const secret = decodeCredentialSecret(crossServerCredential.encodedeSecret);
+  const secret = await decrypt(crossServerCredential.encodedeSecret);
+
+  /* -------- Verify Signature -------- */
 
-  // Generate signature
-  const expectedSignature = genSignature({
-    pack,
+  // Generate a new signature to compare
+  const expectedSignature = await genSignature({
+    method,
+    path,
+    params,
     secret,
   });
 
-  // Make sure the signature matches
+  // Make sure the signatures match
   if (signature !== expectedSignature) {
     throw new ErrorWithCode(
       'Could not validate a cross-server request because the signature did not match.',
-      ReactKitErrorCode.PackInvalidSignature,
+      ReactKitErrorCode.SignedRequestInvalidSignature,
     );
   }
 
-  // Return body
-  return params ?? {};
+  // Make sure the timestamp was recent enough
+  const elapsedMs = Math.abs(Date.now() - timestamp);
+  if (elapsedMs < MINUTE_IN_MS) {
+    throw new ErrorWithCode(
+      'Could not validate a cross-server request because the request was too old.',
+      ReactKitErrorCode.SignedRequestInvalidTimestamp,
+    );
+  }
 };

package/src/helpers/genRouteHandler.ts

@@ -17,7 +17,7 @@ import genErrorPage from '../html/genErrorPage';
 import genInfoPage from '../html/genInfoPage';
 import parseUserAgent from './parseUserAgent';
 import getTimeInfoInET from './getTimeInfoInET';
-import { parseSignedPack } from './dataSigner';
+import { validateSignedRequest } from './dataSigner';
 
 // Import shared types
 import LogFunction from '../types/LogFunction';
@@ -30,7 +30,6 @@ import LogSourceSpecificInfo from '../types/Log/LogSourceSpecificInfo';
 import LogBuiltInMetadata from '../types/LogBuiltInMetadata';
 import LogAction from '../types/LogAction';
 import LogLevel from '../types/LogLevel';
-import ErrorWithCode from '../errors/ErrorWithCode';
 
 /**
  * Generate an express API route handler
@@ -137,7 +136,7 @@ const genRouteHandler = (
     );
 
     // Get body from everywhere it can come from
-    let requestBody: {
+    const requestBody: {
       [k: string]: any,
     } = {
       ...req.body,
@@ -150,27 +149,31 @@ const genRouteHandler = (
     /*----------------------------------------*/
 
     if (crossServerScope) {
-      // Get the signed pack
-      const { signedPack } = requestBody;
-
-      // If no pack, throw error
-      if (!signedPack || typeof signedPack !== 'string') {
-        throw new ErrorWithCode(
-          'Could not process a cross server request because there was no valid signed pack.',
-          ReactKitErrorCode.CrossServerNoPack,
+      try {
+        // Validate the request body
+        await validateSignedRequest({
+          method: req.method ?? 'GET',
+          path: req.path,
+          scope: crossServerScope,
+          params: requestBody,
+        });
+
+        // Valid! Remove oauth values
+        Object.keys(requestBody).forEach((key) => {
+          if (key.startsWith('oauth_')) {
+            delete requestBody[key];
+          }
+        });
+      } catch (err) {
+        return handleError(
+          res,
+          {
+            message: `The authenticity of a cross-server request could not be validated because an error occurred: ${(err as any).message ?? 'unknown error'}`,
+            code: ((err as any).code ?? ReactKitErrorCode.UnknownCrossServerError),
+            status: 401,
+          },
         );
       }
-
-      // Validate the request
-      const crossServerParams = await parseSignedPack({
-        method: req.method ?? 'GET',
-        path: req.path,
-        scope: crossServerScope,
-        signedPack,
-      });
-
-      // Replace body with params from the pack
-      requestBody = crossServerParams ?? {};
     }
 
     /*----------------------------------------*/
@@ -586,14 +589,14 @@ const genRouteHandler = (
         // Main log info
         const mainLogInfo: LogMainInfo = {
           id: `${launchInfo ? launchInfo.userId : 'unknown'}-${Date.now()}-${Math.floor(Math.random() * 100000)}-${Math.floor(Math.random() * 100000)}`,
-          userFirstName: (launchInfo ? launchInfo.userFirstName: 'unknown'),
+          userFirstName: (launchInfo ? launchInfo.userFirstName : 'unknown'),
           userLastName: (launchInfo ? launchInfo.userLastName : 'unknown'),
           userEmail: (launchInfo ? launchInfo.userEmail : 'unknown'),
           userId: (launchInfo ? launchInfo.userId : 'unknown'),
           isLearner: (launchInfo && !!launchInfo.isLearner),
           isAdmin: (launchInfo && !!launchInfo.isAdmin),
           isTTM: (launchInfo && !!launchInfo.isTTM),
-          courseId: (launchInfo ? launchInfo.courseId : 'unknown' ),
+          courseId: (launchInfo ? launchInfo.courseId : 'unknown'),
           courseName: (launchInfo ? launchInfo.contextLabel : 'unknown'),
           browser,
           device,

package/src/helpers/visitEndpointOnAnotherServer/index.ts

@@ -1,11 +1,86 @@
 // Import data signer
-import { createSignedPack } from '../dataSigner';
+import { signRequest } from '../dataSigner';
 
 // Import shared types
 import ErrorWithCode from '../../errors/ErrorWithCode';
 import ReactKitErrorCode from '../../types/ReactKitErrorCode';
 import sendServerToServerRequest from './sendServerToServerRequest';
 
+/*------------------------------------------------------------------------*/
+/* ----------------------------- Credentials ---------------------------- */
+/*------------------------------------------------------------------------*/
+
+/*
+REACTKIT_CROSS_SERVER_CREDENTIALS format:
+|host:key:secret||host:key:secret|...
+*/
+
+const credentials: {
+  host: string,
+  key: string,
+  secret: string,
+}[] = (
+  (process.env.REACTKIT_CROSS_SERVER_CREDENTIALS ?? '')
+    // Replace multiple | with a single one
+    .replace(/\|+/g, '|')
+    // Split by |
+    .split('|')
+    // Remove empty strings
+    .filter((str) => {
+      return str.trim().length > 0;
+    })
+    // Process each credential
+    .map((str) => {
+      // Split by :
+      const parts = str.split(':');
+
+      // Check for errors
+      if (parts.length !== 3) {
+        throw new ErrorWithCode(
+          'Invalid REACTKIT_CROSS_SERVER_CREDENTIALS format. Each credential must be in the format |host:key:secret|',
+          ReactKitErrorCode.InvalidCrossServerCredentialsFormat,
+        );
+      }
+
+      // Return the credential
+      return {
+        host: parts[0].trim(),
+        key: parts[1].trim(),
+        secret: parts[2].trim(),
+      };
+    })
+);
+
+/*------------------------------------------------------------------------*/
+/* ------------------------------- Helpers ------------------------------ */
+/*------------------------------------------------------------------------*/
+
+/**
+ * Get the credential to use for the request to another server
+ * @author Gabe Abrams
+ * @param host the host of the other server
+ * @return the credential to use
+ */
+const getCrossServerCredential = (host: string) => {
+  // Find the credential
+  const credential = credentials.find((cred) => {
+    return cred.host.toLowerCase() === host.toLowerCase();
+  });
+  if (!credential) {
+    throw new ErrorWithCode(
+      'Cannot send cross-server signed request there was no credential that matched the host that the request is being sent to.',
+      ReactKitErrorCode.CrossServerNoCredentialsToSignWith,
+    );
+  }
+
+  // Return credential
+  return credential;
+};
+
+/*------------------------------------------------------------------------*/
+/* -------------------------------- Main -------------------------------- */
+/*------------------------------------------------------------------------*/
+
 /**
  * Visit an endpoint on another server
  * @author Gabe Abrams
@@ -13,10 +88,6 @@ import sendServerToServerRequest from './sendServerToServerRequest';
  * @param opts.method the method of the endpoint
  * @param opts.path the path of the other server's endpoint
  * @param opts.host the host of the other server
- * @param [opts.key=process.env.REACTKIT_CROSS_SERVER_CREDENTIAL_KEY] reactkit cross-server
- *   credential key
- * @param [opts.secret=process.env.REACTKIT_CROSS_SERVER_CREDENTIAL_SECRET reactkit cross-server
- *   credential secret
  * @param [opts.params={}] query/body parameters to include
  * @param [opts.responseType=JSON] the response type from the other server
  */
@@ -25,31 +96,20 @@ const visitEndpointOnAnotherServer = async (
     method: 'GET' | 'POST' | 'DELETE' | 'PUT',
     path: string,
     host: string,
-    key?: string,
-    secret?: string,
     params?: { [key in string]: any },
     responseType?: 'JSON' | 'Text',
   },
 ): Promise<any> => {
-  // Get cross-server credentials
-  const key = opts.key ?? process.env.REACTKIT_CROSS_SERVER_KEY;
-  const secret = opts.secret ?? process.env.REACTKIT_CROSS_SERVER_SECRET;
-
-  // Throw error if no credentials
-  if (!key || !secret) {
-    throw new ErrorWithCode(
-      'Cannot send cross-server signed request because either or both the key and secret were not included or found in env.',
-      ReactKitErrorCode.CrossServerNoCredentialsToSignWith,
-    );
-  }
+  // Get cross-server credential
+  const credential = getCrossServerCredential(opts.host);
 
-  // Create signed pack
-  const signedPack = createSignedPack({
+  // Sign the request, get new params
+  const augmentedParams = await signRequest({
     method: opts.method,
     path: opts.path,
     params: opts.params ?? {},
-    key,
-    secret,
+    key: credential.key,
+    secret: credential.secret,
   });
 
   // Send the request
@@ -57,16 +117,14 @@ const visitEndpointOnAnotherServer = async (
     path: opts.path,
     host: opts.host,
     method: opts.method,
-    params: {
-      signedPack,
-    },
+    params: augmentedParams,
     responseType: opts.responseType,
   });
 
   // Check for failure
   if (!response || !response.body) {
     throw new ErrorWithCode(
-      'We didn\'t get a response from the other server. Please check your internet connection.',
+      'We didn\'t get a response from the other server. Please check the network between the two connection.',
       ReactKitErrorCode.NoResponse,
     );
   }