dce-reactkit 3.9.2 → 3.9.3

package/dist/cjs/index.js

@@ -59,7 +59,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
     });
 }
 
-// Highest error code = DRK16
+// Highest error code = DRK18
 /**
  * List of error codes built into the react kit
  * @author Gabe Abrams
@@ -71,6 +71,8 @@ var ReactKitErrorCode;
     ReactKitErrorCode["SessionExpired"] = "DRK3";
     ReactKitErrorCode["MissingParameter"] = "DRK4";
     ReactKitErrorCode["InvalidParameter"] = "DRK5";
+    ReactKitErrorCode["HostNotAllowed"] = "DRK17";
+    ReactKitErrorCode["HostBanned"] = "DRK18";
     ReactKitErrorCode["WrongCourse"] = "DRK6";
     ReactKitErrorCode["NoCACCLSendRequestFunction"] = "DRK7";
     ReactKitErrorCode["NoCACCLGetLaunchInfoFunction"] = "DRK8";
@@ -14469,6 +14471,12 @@ const parseUserAgent = (userAgent) => {
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -14500,6 +14508,72 @@ const genRouteHandler = (opts) => {
         // Output params
         const output = {};
         /*----------------------------------------*/
+        /* ----------- Hostname Check ----------- */
+        /*----------------------------------------*/
+        // Get hostnames
+        const originURL = String(req.get('origin')
+            || req.headers.origin
+            || req.headers.referer);
+        const originHostname = (originURL
+            // Remove protocol
+            .replace(/(^\w+:|^)\/\//, '')
+            // Remove port
+            .replace(/:\d+$/, ''));
+        const serverHostname = String(req.hostname);
+        // Check allowed
+        if (opts.allowedHosts) {
+            // Only accept requests from allowed hosts
+            const allowedArray = (Array.isArray(opts.allowedHosts)
+                ? opts.allowedHosts
+                : [opts.allowedHosts]);
+            // Check if server is localhost
+            if (serverHostname === 'localhost') {
+                // Allow localhost
+                allowedArray.push('localhost');
+            }
+            // Check if current host is allowed
+            const allowed = allowedArray.some((allowedHost) => {
+                if (allowedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(allowedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === allowedHost.toLowerCase();
+            });
+            // If not allowed, return error
+            if (!allowed) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostNotAllowed,
+                    status: 403,
+                });
+            }
+        }
+        // Check banned
+        if (opts.bannedHosts) {
+            // Do not allow requests from banned hosts
+            const bannedArray = (Array.isArray(opts.bannedHosts)
+                ? opts.bannedHosts
+                : [opts.bannedHosts]);
+            // Check if current host is banned
+            const banned = bannedArray.some((bannedHost) => {
+                if (bannedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(bannedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === bannedHost.toLowerCase();
+            });
+            // If banned, return error
+            if (banned) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostBanned,
+                    status: 403,
+                });
+            }
+        }
+        /*----------------------------------------*/
         /* ------------ Parse Params ------------ */
         /*----------------------------------------*/
         // Process items one by one