dce-reactkit 3.9.1 → 3.9.3

package/dist/cjs/types/helpers/genRouteHandler.d.ts

@@ -9,6 +9,12 @@ import LogFunction from '../types/LogFunction';
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -63,6 +69,8 @@ declare const genRouteHandler: (opts: {
         logServerEvent: LogFunction;
     }) => any;
     skipSessionCheck?: boolean | undefined;
+    allowedHosts?: string | string[] | undefined;
+    bannedHosts?: string | string[] | undefined;
     unhandledErrorMessagePrefix?: string | undefined;
 }) => (req: any, res: any, next: () => void) => Promise<undefined>;
 export default genRouteHandler;

package/dist/cjs/types/types/ReactKitErrorCode.d.ts

@@ -8,6 +8,8 @@ declare enum ReactKitErrorCode {
     SessionExpired = "DRK3",
     MissingParameter = "DRK4",
     InvalidParameter = "DRK5",
+    HostNotAllowed = "DRK17",
+    HostBanned = "DRK18",
     WrongCourse = "DRK6",
     NoCACCLSendRequestFunction = "DRK7",
     NoCACCLGetLaunchInfoFunction = "DRK8",

package/dist/esm/index.js

@@ -31,7 +31,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
     });
 }
 
-// Highest error code = DRK16
+// Highest error code = DRK18
 /**
  * List of error codes built into the react kit
  * @author Gabe Abrams
@@ -43,6 +43,8 @@ var ReactKitErrorCode;
     ReactKitErrorCode["SessionExpired"] = "DRK3";
     ReactKitErrorCode["MissingParameter"] = "DRK4";
     ReactKitErrorCode["InvalidParameter"] = "DRK5";
+    ReactKitErrorCode["HostNotAllowed"] = "DRK17";
+    ReactKitErrorCode["HostBanned"] = "DRK18";
     ReactKitErrorCode["WrongCourse"] = "DRK6";
     ReactKitErrorCode["NoCACCLSendRequestFunction"] = "DRK7";
     ReactKitErrorCode["NoCACCLGetLaunchInfoFunction"] = "DRK8";
@@ -14441,6 +14443,12 @@ const parseUserAgent = (userAgent) => {
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -14468,10 +14476,76 @@ const parseUserAgent = (userAgent) => {
 const genRouteHandler = (opts) => {
     // Return a route handler
     return (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
         // Output params
         const output = {};
         /*----------------------------------------*/
+        /* ----------- Hostname Check ----------- */
+        /*----------------------------------------*/
+        // Get hostnames
+        const originURL = String(req.get('origin')
+            || req.headers.origin
+            || req.headers.referer);
+        const originHostname = (originURL
+            // Remove protocol
+            .replace(/(^\w+:|^)\/\//, '')
+            // Remove port
+            .replace(/:\d+$/, ''));
+        const serverHostname = String(req.hostname);
+        // Check allowed
+        if (opts.allowedHosts) {
+            // Only accept requests from allowed hosts
+            const allowedArray = (Array.isArray(opts.allowedHosts)
+                ? opts.allowedHosts
+                : [opts.allowedHosts]);
+            // Check if server is localhost
+            if (serverHostname === 'localhost') {
+                // Allow localhost
+                allowedArray.push('localhost');
+            }
+            // Check if current host is allowed
+            const allowed = allowedArray.some((allowedHost) => {
+                if (allowedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(allowedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === allowedHost.toLowerCase();
+            });
+            // If not allowed, return error
+            if (!allowed) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostNotAllowed,
+                    status: 403,
+                });
+            }
+        }
+        // Check banned
+        if (opts.bannedHosts) {
+            // Do not allow requests from banned hosts
+            const bannedArray = (Array.isArray(opts.bannedHosts)
+                ? opts.bannedHosts
+                : [opts.bannedHosts]);
+            // Check if current host is banned
+            const banned = bannedArray.some((bannedHost) => {
+                if (bannedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(bannedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === bannedHost.toLowerCase();
+            });
+            // If banned, return error
+            if (banned) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostBanned,
+                    status: 403,
+                });
+            }
+        }
+        /*----------------------------------------*/
         /* ------------ Parse Params ------------ */
         /*----------------------------------------*/
         // Process items one by one
@@ -14669,34 +14743,34 @@ const genRouteHandler = (opts) => {
         // Add launch info to output
         output.userId = (launchInfo
             ? launchInfo.userId
-            : undefined);
+            : ((_b = output.userId) !== null && _b !== void 0 ? _b : undefined));
         output.userFirstName = (launchInfo
             ? launchInfo.userFirstName
-            : undefined);
+            : ((_c = output.userFirstName) !== null && _c !== void 0 ? _c : undefined));
         output.userLastName = (launchInfo
             ? launchInfo.userLastName
-            : undefined);
+            : ((_d = output.userLastName) !== null && _d !== void 0 ? _d : undefined));
         output.userEmail = (launchInfo
             ? launchInfo.userEmail
-            : undefined);
+            : ((_e = output.userEmail) !== null && _e !== void 0 ? _e : undefined));
         output.userAvatarURL = (launchInfo
-            ? ((_b = launchInfo.userImage) !== null && _b !== void 0 ? _b : 'http://www.gravatar.com/avatar/?d=identicon')
-            : undefined);
+            ? ((_f = launchInfo.userImage) !== null && _f !== void 0 ? _f : 'http://www.gravatar.com/avatar/?d=identicon')
+            : ((_g = output.userAvatarURL) !== null && _g !== void 0 ? _g : undefined));
         output.isLearner = (launchInfo
             ? !!launchInfo.isLearner
-            : undefined);
+            : ((_h = output.isLearner) !== null && _h !== void 0 ? _h : undefined));
         output.isTTM = (launchInfo
             ? !!launchInfo.isTTM
-            : undefined);
+            : ((_j = output.isTTM) !== null && _j !== void 0 ? _j : undefined));
         output.isAdmin = (launchInfo
             ? !!launchInfo.isAdmin
-            : undefined);
+            : ((_k = output.isAdmin) !== null && _k !== void 0 ? _k : undefined));
         output.courseId = (launchInfo
-            ? ((_c = output.courseId) !== null && _c !== void 0 ? _c : launchInfo.courseId)
-            : undefined);
+            ? ((_l = output.courseId) !== null && _l !== void 0 ? _l : launchInfo.courseId)
+            : ((_m = output.courseId) !== null && _m !== void 0 ? _m : undefined));
         output.courseName = (launchInfo
             ? launchInfo.contextLabel
-            : undefined);
+            : ((_o = output.courseName) !== null && _o !== void 0 ? _o : undefined));
         // Add other session variables
         Object.keys(req.session).forEach((propName) => {
             // Skip if prop already in output
@@ -14770,7 +14844,7 @@ const genRouteHandler = (opts) => {
          * @author Gabe Abrams
          */
         const logServerEvent = (logOpts) => __awaiter(void 0, void 0, void 0, function* () {
-            var _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r;
+            var _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1;
             // NOTE: internally, we slip through an opts.overrideAsClientEvent boolean
             // that indicates that this is actually a client event, but we don't
             // include that in the LogFunction type because this is internal and
@@ -14802,24 +14876,24 @@ const genRouteHandler = (opts) => {
                     timestamp,
                     context: (typeof logOpts.context === 'string'
                         ? logOpts.context
-                        : ((_e = ((_d = logOpts.context) !== null && _d !== void 0 ? _d : {})._) !== null && _e !== void 0 ? _e : LogBuiltInMetadata.Context.Uncategorized)),
-                    subcontext: ((_f = logOpts.subcontext) !== null && _f !== void 0 ? _f : LogBuiltInMetadata.Context.Uncategorized),
-                    tags: ((_g = logOpts.tags) !== null && _g !== void 0 ? _g : []),
-                    level: ((_h = logOpts.level) !== null && _h !== void 0 ? _h : LogLevel$1.Info),
-                    metadata: ((_j = logOpts.metadata) !== null && _j !== void 0 ? _j : {}),
+                        : ((_q = ((_p = logOpts.context) !== null && _p !== void 0 ? _p : {})._) !== null && _q !== void 0 ? _q : LogBuiltInMetadata.Context.Uncategorized)),
+                    subcontext: ((_r = logOpts.subcontext) !== null && _r !== void 0 ? _r : LogBuiltInMetadata.Context.Uncategorized),
+                    tags: ((_s = logOpts.tags) !== null && _s !== void 0 ? _s : []),
+                    level: ((_t = logOpts.level) !== null && _t !== void 0 ? _t : LogLevel$1.Info),
+                    metadata: ((_u = logOpts.metadata) !== null && _u !== void 0 ? _u : {}),
                 };
                 // Type-specific info
                 const typeSpecificInfo = (('error' in opts && opts.error)
                     ? {
                         type: LogType$1.Error,
-                        errorMessage: (_k = logOpts.error.message) !== null && _k !== void 0 ? _k : 'Unknown message',
-                        errorCode: (_l = logOpts.error.code) !== null && _l !== void 0 ? _l : ReactKitErrorCode$1.NoCode,
-                        errorStack: (_m = logOpts.error.stack) !== null && _m !== void 0 ? _m : 'No stack',
+                        errorMessage: (_v = logOpts.error.message) !== null && _v !== void 0 ? _v : 'Unknown message',
+                        errorCode: (_w = logOpts.error.code) !== null && _w !== void 0 ? _w : ReactKitErrorCode$1.NoCode,
+                        errorStack: (_x = logOpts.error.stack) !== null && _x !== void 0 ? _x : 'No stack',
                     }
                     : {
                         type: LogType$1.Action,
-                        target: ((_o = logOpts.target) !== null && _o !== void 0 ? _o : LogBuiltInMetadata.Target.NoTarget),
-                        action: ((_p = logOpts.action) !== null && _p !== void 0 ? _p : LogAction$1.Unknown),
+                        target: ((_y = logOpts.target) !== null && _y !== void 0 ? _y : LogBuiltInMetadata.Target.NoTarget),
+                        action: ((_z = logOpts.action) !== null && _z !== void 0 ? _z : LogAction$1.Unknown),
                     });
                 // Source-specific info
                 const sourceSpecificInfo = (logOpts.overrideAsClientEvent
@@ -14854,7 +14928,7 @@ const genRouteHandler = (opts) => {
             catch (err) {
                 // Print because we cannot store the error
                 // eslint-disable-next-line no-console
-                console.error('Could not log the following:', logOpts, 'due to this error:', ((_q = err) !== null && _q !== void 0 ? _q : {}).message, ((_r = err) !== null && _r !== void 0 ? _r : {}).stack);
+                console.error('Could not log the following:', logOpts, 'due to this error:', ((_0 = err) !== null && _0 !== void 0 ? _0 : {}).message, ((_1 = err) !== null && _1 !== void 0 ? _1 : {}).stack);
                 // Create a dummy log to return
                 const dummyMainInfo = {
                     id: '-1',