dce-reactkit 3.9.2 → 3.9.3

package/dist/esm/types/helpers/genRouteHandler.d.ts

@@ -9,6 +9,12 @@ import LogFunction from '../types/LogFunction';
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -63,6 +69,8 @@ declare const genRouteHandler: (opts: {
         logServerEvent: LogFunction;
     }) => any;
     skipSessionCheck?: boolean | undefined;
+    allowedHosts?: string | string[] | undefined;
+    bannedHosts?: string | string[] | undefined;
     unhandledErrorMessagePrefix?: string | undefined;
 }) => (req: any, res: any, next: () => void) => Promise<undefined>;
 export default genRouteHandler;

package/dist/esm/types/types/ReactKitErrorCode.d.ts

@@ -8,6 +8,8 @@ declare enum ReactKitErrorCode {
     SessionExpired = "DRK3",
     MissingParameter = "DRK4",
     InvalidParameter = "DRK5",
+    HostNotAllowed = "DRK17",
+    HostBanned = "DRK18",
     WrongCourse = "DRK6",
     NoCACCLSendRequestFunction = "DRK7",
     NoCACCLGetLaunchInfoFunction = "DRK8",

package/dist/index.d.ts

@@ -1044,6 +1044,12 @@ type LogFunction = (opts: ({
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -1098,6 +1104,8 @@ declare const genRouteHandler: (opts: {
         logServerEvent: LogFunction;
     }) => any;
     skipSessionCheck?: boolean | undefined;
+    allowedHosts?: string | string[] | undefined;
+    bannedHosts?: string | string[] | undefined;
     unhandledErrorMessagePrefix?: string | undefined;
 }) => (req: any, res: any, next: () => void) => Promise<undefined>;
 
@@ -1637,6 +1645,8 @@ declare enum ReactKitErrorCode {
     SessionExpired = "DRK3",
     MissingParameter = "DRK4",
     InvalidParameter = "DRK5",
+    HostNotAllowed = "DRK17",
+    HostBanned = "DRK18",
     WrongCourse = "DRK6",
     NoCACCLSendRequestFunction = "DRK7",
     NoCACCLGetLaunchInfoFunction = "DRK8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dce-reactkit",
-  "version": "3.9.2",
+  "version": "3.9.3",
   "description": "Shared components for Harvard DCE apps",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/helpers/genRouteHandler.ts

@@ -39,6 +39,12 @@ import LogLevel from '../types/LogLevel';
  * @param opts.handler function that processes the request
  * @param [opts.skipSessionCheck] if true, skip the session check (allow users
  *   to not be logged in and launched via LTI)
+ * @param [opts.allowedHosts] if included, only allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
+ * @param [opts.bannedHosts] if included, do not allow requests from these hosts
+ *   (start a hostname with a "*" to only check the end of the hostname)
+ *   you can include just one string instead of an array
  * @param [opts.unhandledErrorMessagePrefix] if included, when an error that
  *   is not of type ErrorWithCode is thrown, the client will receive an error
  *   where the error message is prefixed with this string. For example,
@@ -102,6 +108,8 @@ const genRouteHandler = (
       },
     ) => any,
     skipSessionCheck?: boolean,
+    allowedHosts?: string[] | string,
+    bannedHosts?: string[] | string,
     unhandledErrorMessagePrefix?: string,
   },
 ) => {
@@ -110,6 +118,97 @@ const genRouteHandler = (
     // Output params
     const output: { [k in string]: any } = {};
 
+    /*----------------------------------------*/
+    /* ----------- Hostname Check ----------- */
+    /*----------------------------------------*/
+
+    // Get hostnames
+    const originURL = String(
+      req.get('origin')
+      || req.headers.origin
+      || req.headers.referer
+    );
+    const originHostname = (
+      originURL
+        // Remove protocol
+        .replace(/(^\w+:|^)\/\//, '')
+        // Remove port
+        .replace(/:\d+$/, '')
+    );
+    const serverHostname = String(req.hostname);
+
+    // Check allowed
+    if (opts.allowedHosts) {
+      // Only accept requests from allowed hosts
+      const allowedArray = (
+        Array.isArray(opts.allowedHosts)
+          ? opts.allowedHosts
+          : [opts.allowedHosts]
+      );
+
+      // Check if server is localhost
+      if (serverHostname === 'localhost') {
+        // Allow localhost
+        allowedArray.push('localhost');
+      }
+
+      // Check if current host is allowed
+      const allowed = allowedArray.some((allowedHost) => {
+        if (allowedHost.startsWith('*')) {
+          // Check end of hostname
+          return originHostname.endsWith(allowedHost.substring(1));
+        }
+
+        // Check full hostname
+        return originHostname.toLowerCase() === allowedHost.toLowerCase();
+      });
+
+      // If not allowed, return error
+      if (!allowed) {
+        return handleError(
+          res,
+          {
+            message: 'You are not allowed to access this endpoint.',
+            code: ReactKitErrorCode.HostNotAllowed,
+            status: 403,
+          },
+        );
+      }
+    }
+
+    // Check banned
+    if (opts.bannedHosts) {
+      // Do not allow requests from banned hosts
+      const bannedArray = (
+        Array.isArray(opts.bannedHosts)
+          ? opts.bannedHosts
+          : [opts.bannedHosts]
+      );
+
+      // Check if current host is banned
+      const banned = bannedArray.some((bannedHost) => {
+        if (bannedHost.startsWith('*')) {
+          // Check end of hostname
+          return originHostname.endsWith(bannedHost.substring(1));
+        }
+
+        // Check full hostname
+        return originHostname.toLowerCase() === bannedHost.toLowerCase();
+      });
+
+      // If banned, return error
+      if (banned) {
+        return handleError(
+          res,
+          {
+            message: 'You are not allowed to access this endpoint.',
+            code: ReactKitErrorCode.HostBanned,
+            status: 403,
+          },
+        );
+      }
+    }
+
     /*----------------------------------------*/
     /* ------------ Parse Params ------------ */
     /*----------------------------------------*/

package/src/types/ReactKitErrorCode.tsx

@@ -1,4 +1,4 @@
-// Highest error code = DRK16
+// Highest error code = DRK18
 
 /**
  * List of error codes built into the react kit
@@ -10,6 +10,8 @@ enum ReactKitErrorCode {
   SessionExpired = 'DRK3',
   MissingParameter = 'DRK4',
   InvalidParameter = 'DRK5',
+  HostNotAllowed = 'DRK17',
+  HostBanned = 'DRK18',
   WrongCourse = 'DRK6',
   NoCACCLSendRequestFunction = 'DRK7',
   NoCACCLGetLaunchInfoFunction = 'DRK8',