dce-reactkit 3.9.2 → 3.9.3

package/dist/cjs/types/helpers/genRouteHandler.d.ts

@@ -9,6 +9,12 @@ import LogFunction from '../types/LogFunction';
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -63,6 +69,8 @@ declare const genRouteHandler: (opts: {
         logServerEvent: LogFunction;
     }) => any;
     skipSessionCheck?: boolean | undefined;
+    allowedHosts?: string | string[] | undefined;
+    bannedHosts?: string | string[] | undefined;
     unhandledErrorMessagePrefix?: string | undefined;
 }) => (req: any, res: any, next: () => void) => Promise<undefined>;
 export default genRouteHandler;

package/dist/cjs/types/types/ReactKitErrorCode.d.ts

@@ -8,6 +8,8 @@ declare enum ReactKitErrorCode {
     SessionExpired = "DRK3",
     MissingParameter = "DRK4",
     InvalidParameter = "DRK5",
+    HostNotAllowed = "DRK17",
+    HostBanned = "DRK18",
     WrongCourse = "DRK6",
     NoCACCLSendRequestFunction = "DRK7",
     NoCACCLGetLaunchInfoFunction = "DRK8",

package/dist/esm/index.js

@@ -31,7 +31,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
     });
 }
 
-// Highest error code = DRK16
+// Highest error code = DRK18
 /**
  * List of error codes built into the react kit
  * @author Gabe Abrams
@@ -43,6 +43,8 @@ var ReactKitErrorCode;
     ReactKitErrorCode["SessionExpired"] = "DRK3";
     ReactKitErrorCode["MissingParameter"] = "DRK4";
     ReactKitErrorCode["InvalidParameter"] = "DRK5";
+    ReactKitErrorCode["HostNotAllowed"] = "DRK17";
+    ReactKitErrorCode["HostBanned"] = "DRK18";
     ReactKitErrorCode["WrongCourse"] = "DRK6";
     ReactKitErrorCode["NoCACCLSendRequestFunction"] = "DRK7";
     ReactKitErrorCode["NoCACCLGetLaunchInfoFunction"] = "DRK8";
@@ -14441,6 +14443,12 @@ const parseUserAgent = (userAgent) => {
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -14472,6 +14480,72 @@ const genRouteHandler = (opts) => {
         // Output params
         const output = {};
         /*----------------------------------------*/
+        /* ----------- Hostname Check ----------- */
+        /*----------------------------------------*/
+        // Get hostnames
+        const originURL = String(req.get('origin')
+            || req.headers.origin
+            || req.headers.referer);
+        const originHostname = (originURL
+            // Remove protocol
+            .replace(/(^\w+:|^)\/\//, '')
+            // Remove port
+            .replace(/:\d+$/, ''));
+        const serverHostname = String(req.hostname);
+        // Check allowed
+        if (opts.allowedHosts) {
+            // Only accept requests from allowed hosts
+            const allowedArray = (Array.isArray(opts.allowedHosts)
+                ? opts.allowedHosts
+                : [opts.allowedHosts]);
+            // Check if server is localhost
+            if (serverHostname === 'localhost') {
+                // Allow localhost
+                allowedArray.push('localhost');
+            }
+            // Check if current host is allowed
+            const allowed = allowedArray.some((allowedHost) => {
+                if (allowedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(allowedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === allowedHost.toLowerCase();
+            });
+            // If not allowed, return error
+            if (!allowed) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostNotAllowed,
+                    status: 403,
+                });
+            }
+        }
+        // Check banned
+        if (opts.bannedHosts) {
+            // Do not allow requests from banned hosts
+            const bannedArray = (Array.isArray(opts.bannedHosts)
+                ? opts.bannedHosts
+                : [opts.bannedHosts]);
+            // Check if current host is banned
+            const banned = bannedArray.some((bannedHost) => {
+                if (bannedHost.startsWith('*')) {
+                    // Check end of hostname
+                    return originHostname.endsWith(bannedHost.substring(1));
+                }
+                // Check full hostname
+                return originHostname.toLowerCase() === bannedHost.toLowerCase();
+            });
+            // If banned, return error
+            if (banned) {
+                return handleError(res, {
+                    message: 'You are not allowed to access this endpoint.',
+                    code: ReactKitErrorCode$1.HostBanned,
+                    status: 403,
+                });
+            }
+        }
+        /*----------------------------------------*/
         /* ------------ Parse Params ------------ */
         /*----------------------------------------*/
         // Process items one by one