exframe-middleware 1.3.0 → 1.4.1

package/.eslintrc.json

@@ -1,33 +1,3 @@
 {
-  "env": {
-    "es6": true,
-    "node": true
-  },
-  "extends": "airbnb-base",
-  "parserOptions": {
-    "ecmaVersion": 2018
-  },
-  "rules": {
-    "comma-dangle": [2, "never"],
-    "no-underscore-dangle": "off",
-    "consistent-return": "off",
-    "import/no-unresolved": [2, { "commonjs": true }],
-    "max-len": [1, { "code": 250 }],
-    "linebreak-style": "off",
-    "strict": [0, "global"],
-    "no-restricted-syntax": "off",
-    "global-require": "off",
-    "no-nested-ternary": "off",
-    "no-confusing-arrow": "off",
-    "arrow-body-style": "off",
-    "arrow-parens": "off",
-    "brace-style": "off",
-    "nonblock-statement-body-position": "off",
-    "curly": "off",
-    "no-use-before-define": "off",
-    "no-plusplus": "off",
-    "func-names": "off",
-    "no-continue": "off",
-    "array-bracket-spacing": [1, "always"]
-  }
-}
+  "extends": "exzeo/base"
+}

package/index.js

@@ -7,10 +7,7 @@ const authorizeUser = require('./lib/authorizeUser');
 const buildCspFromHeader = require('./lib/buildCspFromHeaders');
 
 module.exports = {
-  /**
-   * @param {Object} config the configuration object
-   */
-  handleErrors: (config = {}) => ({ // eslint-disable-line no-unused-vars
+  handleErrors: () => ({
     mq: async (error, context, message) => handleErrors(context, error, message),
     express: (error, request, response, next) => {
       if (!error) return next();
@@ -33,20 +30,15 @@ module.exports = {
   authorizeUser: {
     mq: authorizeUser,
     express: (req, res, next) => {
-      authorizeUser(req);
+      const user = req?.user || req?.context?.user;
+      authorizeUser({ user });
       next();
     }
   },
-
-  /**
-   * @param {Object} config
-   * @param {Boolean} [config.cspIsRequired] should throw error when csp parts do not exist -- default true
-   */
-  buildCsp: (config = {}) => ({ // eslint-disable-line no-unused-vars
-    // eslint-disable-next-line no-param-reassign
+  buildCsp: () => ({
     mq: context => { context.csp = context.csp || {}; },
     express: (req, res, next) => {
-      buildCspFromHeader(req, config);
+      buildCspFromHeader(req, {});
       next();
     }
   }),

package/lib/authorizeUser.js

@@ -2,7 +2,10 @@
 
 const errors = require('exframe-errors');
 
-module.exports = context => {
-  if (!context.user)
-    throw new errors.Unauthorized('Could not authorize user');
+/**
+ * @param {Object} context
+ * @param {Object} context.user
+ */
+module.exports = ({ user }) => {
+  if (!user) { throw new errors.Unauthorized('Could not authorize user'); }
 };

package/lib/buildCspFromHeaders.js

@@ -1,15 +1,14 @@
 'use strict';
 
-/* eslint-disable no-param-reassign */
-
 const errors = require('exframe-errors');
 
 module.exports = (req, { cspIsRequired = true }) => {
   const csp = req.headers['harmony-csp'] || '';
-  if (cspIsRequired && !/^[A-Z]+:[A-Z]{2}:[A-Z\d]+$/.test(csp))
+  if (cspIsRequired && csp && !/^[A-Z]+:[A-Z]{2}:[A-Z\d]+$/.test(csp)) {
     throw new errors.Forbidden('CSP is required');
+  }
 
-  const [ companyCode, state, product ] = csp.split(/:/g);
+  const [companyCode, state, product] = csp.split(/:/g);
   req.csp = {
     // in instance of csp === '', only companyCode will not default to ''
     companyCode: companyCode || undefined,

package/lib/handleErrors.js

@@ -13,8 +13,11 @@ module.exports = (context, rawError, optionalIncomingMessage) => {
   // not complete errors and represent each schema validation error from a single request. These objects will not
   // have a "statusCode" property and is the reason for the check here to keep them out of the workflow error logic.
   if (Array.isArray(rawError.errors) && rawError.errors.length > 0 && rawError.errors[0].statusCode !== undefined) {
-    if (rawError.errors.length > 1) error = rawError.errors;
-    else error = rawError.errors[0] || rawError;
+    if (rawError.errors.length > 1) {
+      error = rawError.errors;
+    } else {
+      error = rawError.errors[0] || rawError;
+    }
   }
 
   const { errorCode } = error;
@@ -25,39 +28,45 @@ module.exports = (context, rawError, optionalIncomingMessage) => {
   // uses statusCode hierarchy of buckets a, else b, else c
   if (Array.isArray(error) && error.length !== 0) {
     message = `multiple errors occured: [${error.map(v => v.message).join(', ')}]`;
+    const errorsToCheck = error.filter(({ statusCode }) => statusCode >= 400);
 
     const a = new Set(); // 401 or 403
     const b = new Set(); // 500
     const c = new Set(); // other 400s
 
-    for (const { statusCode } of error) {
-      if (statusCode < 400) continue;
-      if (statusCode === 401 || statusCode === 403)
+    for (const { statusCode } of errorsToCheck) {
+      if (statusCode === 401 || statusCode === 403) {
         a.add(statusCode);
-      else if (statusCode > 499)
+      } else if (statusCode > 499) {
         b.add(statusCode);
-      else c.add(statusCode);
+      } else {
+        c.add(statusCode);
+      }
     }
 
-    if (a.size) status = a.has(403) ? 403 : 401;
-    else if (b.size) {
-      if (b.size === 1)
+    if (a.size) {
+      status = a.has(403) ? 403 : 401;
+    } else if (b.size) {
+      if (b.size === 1) {
         status = b.values().next().value;
-      else status = 500;
-    }
-    else { // eslint-disable-next-line no-lonely-if
-      if (c.size === 1)
-        status = c.values().next().value;
-      else status = 400;
+      } else {
+        status = 500;
+      }
+    } else if (c.size === 1) {
+      status = c.values().next().value;
+    } else {
+      status = 400;
     }
+  } else {
+    status = error.statusCode || error.status || 500;
   }
-  else status = error.statusCode || error.status || 500;
 
   if (status === 500) {
     context.log.error('An error occurred', { errorDetails: error });
     message = error.message || 'Internal Server Error';
+  } else {
+    context.log.warn('There was an issue with the client request', { message: optionalIncomingMessage || error.message, errorDetails: error });
   }
-  else context.log.warn('There was an issue with the client request', { message: optionalIncomingMessage || error.message, errorDetails: error });
 
   return { status, message, errorCode };
 };

package/lib/standardRouteResponse.js

@@ -13,14 +13,12 @@ module.exports = (result, isSingleItemResponse = true) => {
       status = 404;
       message = 'not found';
       result = undefined; // eslint-disable-line no-param-reassign
-    }
-    else {
+    } else {
       status = 200;
       message = 'ok';
       result = []; // eslint-disable-line no-param-reassign
     }
-  }
-  else {
+  } else {
     status = 200;
     message = 'ok';
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "exframe-middleware",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "",
   "main": "index.js",
   "config": {
@@ -23,8 +23,8 @@
   "devDependencies": {
     "chai": "*",
     "eslint": "*",
-    "eslint-config-airbnb-base": "*",
-    "eslint-plugin-import": "^2.22.0",
+    "eslint-config-exzeo": "*",
+    "eslint-plugin-import": "*",
     "mocha": "*",
     "mocha-exzeo-reporter": "*",
     "nyc": "*",
@@ -33,5 +33,8 @@
   "dependencies": {
     "exframe-errors": "^1.2.0"
   },
-  "gitHead": "1959247957f1a308c44d4c5210712125ab6e5573"
+  "engines": {
+    "node": ">=14.0.0"
+  },
+  "gitHead": "ef87c842aa08c54cbcb03ee075db8463ebc8fd43"
 }

package/test/.eslintrc.json

@@ -1,5 +1,3 @@
 {
-  "env": {
-    "mocha": true
-  }
-}
+  "extends": "exzeo/mocha"
+}

package/test/authorizeUser.test.js

@@ -6,26 +6,61 @@ const errors = require('exframe-errors');
 const { authorizeUser } = require('../index');
 
 context('authorizeUser', () => {
-  it('throws unauthorized error when no user', () => {
-    try { authorizeUser.mq({}); }
-    catch (e) {
-      expect(e).to.be.an.instanceOf(errors.Unauthorized);
-      return;
-    }
-
-    expect.fail('authorizeUser should have thrown an Unauthorized error');
-  });
+  describe('mq', () => {
+    it('throws unauthorized error when no user', () => {
+      try { authorizeUser.mq({}); }
+      catch (e) {
+        expect(e).to.be.an.instanceOf(errors.Unauthorized);
+        return;
+      }
+
+      expect.fail('authorizeUser should have thrown an Unauthorized error');
+    });
 
-  it('does not throw an error when there is a user', () => {
-    try { authorizeUser.mq({ user: 'something' }); }
-    catch (e) { expect.fail('authorizeUser should not have thrown an error'); }
+    it('does not throw an error when there is a user', () => {
+      try { authorizeUser.mq({ user: 'something' }); }
+      catch (e) { expect.fail('authorizeUser should not have thrown an error'); }
+    });
   });
 
-  it('works when there is a user and calls next when using express version', () => {
-    let called = 0;
-    const next = () => ++called;
-    authorizeUser.express({ user: {} }, {}, next);
+  describe('express - user exists directly on the request object', () => {
+    it('calls the next function when there is a user', () => {
+      let called = 0;
+      const next = () => ++called;
+      authorizeUser.express({ user: {} }, {}, next);
+
+      expect(called).to.equal(1);
+    });
+    it('throws unauthorized error when there is no user', () => {
+      let called = 0;
+      const next = () => ++called;
+      try { authorizeUser.express({ }, {}, next); }
+      catch (e) {
+        expect(e).to.be.an.instanceOf(errors.Unauthorized);
+        return;
+      }
+      expect.fail('authorizeUser should have thrown an Unauthorized error');
+      expect(called).to.equal(0);
+    });
+  });
 
-    expect(called).to.equal(1);
+  describe('express - user exists within the context on the request object', () => {
+    it('calls the next function when there is a user', () => {
+      let called = 0;
+      const next = () => ++called;
+      authorizeUser.express({ context: { user: {} } }, {}, next);
+      expect(called).to.equal(1);
+    });
+    it('throws unauthorized error when there is no user', () => {
+      let called = 0;
+      const next = () => ++called;
+      try { authorizeUser.express({ context: {} }, {}, next); }
+      catch (e) {
+        expect(e).to.be.an.instanceOf(errors.Unauthorized);
+        return;
+      }
+      expect.fail('authorizeUser should have thrown an Unauthorized error');
+      expect(called).to.equal(0);
+    });
   });
 });