intermediate-component-sa 1.0.4 → 1.1.0

package/src/server/shared/http.shared.ts

@@ -0,0 +1,49 @@
+import * as express from 'express';
+import * as url from 'url';
+import * as jwt from 'jsonwebtoken';
+import * as log4js from 'log4js';
+
+// Importo configuracion de JWT
+import { JWT_SECRET } from '../config/jwt.config';
+
+// Obtengo logger
+let logger = log4js.getLogger('ServerScripts');
+
+export function GetDomainFromRequestHost(requestHost: string): string {
+
+	// Acomodo el host para que tenga forma de url
+	let host: string = requestHost || '';
+	if (host.match(/^http:\/\//)) host = host.substring(7);
+	if (host.match(/^https:\/\//)) host = host.substring(8);
+	if (host.match(/^www\./)) host = host.substring(4);
+	if (!/http:/.test(host) && !/https:/.test(host)) host = 'http://' + host;
+
+	// Obtengo el dominio asociado al request
+	let requestDomain: string = url.parse(host).hostname;
+
+	// Devuelvo el dominio obtenido
+	return requestDomain;
+}
+
+export function GetRequestUser(authorizationHeader: string): string {
+
+	// Verifico que el input no sea nulo
+	let session: string = authorizationHeader || '';
+	let userId: string;
+
+	try {
+		// Decodifico el token recibido
+		session = session.replace(/^Bearer /i, '');
+		// Si no hay sesion no sigo
+		if (session) {
+			let decoded: any = jwt.verify(session, JWT_SECRET);
+			if (decoded.userId) userId = decoded.userId;
+		}
+	} catch (err) {
+		// Obtengo el mensaje de error, que es lo que se va a enviar hacia atras
+		let errMsg: string = (typeof err === 'string' ? err : err.message || err.description || '');
+		logger.error('Error al decodificar datos de la sesion: ' + errMsg);
+	}
+	// Devuelvo el dato obtenido
+	return userId;
+}

package/src/server/shared/promises.shared.ts

@@ -0,0 +1,13 @@
+export function DummyPromise(): Promise<boolean> {
+    // Devuelvo promesa dummy que siempre resuelve true
+    return new Promise(function(resolve, reject) {
+        resolve(true);
+    });
+}
+
+export function SleepPromise(secondTime: number): Promise<boolean> {
+    // Devuelvo promesa dummy que siempre resuelve true
+    return new Promise(function(resolve, reject) {
+        setTimeout(resolve,(1000 * secondTime));
+    });
+}

package/src/server/shared/security.shared.ts

@@ -0,0 +1,90 @@
+import * as express from 'express';
+import * as cors from 'cors';
+
+export function InitHeaders(app: express.Application) {
+
+    // Aplico los handelrs para setear los headers de seguridad
+    app.use(FrameGuard);
+    app.use(HidePoweredBy);
+    app.use(XssFilter);
+    app.use(IeNoOpen);
+
+    // Configuración para CORS
+    let corsOptions: cors.CorsOptions = {
+        // Header Access-Control-Allow-Origin con el origen del request (sin esto no puedo setear cookies)
+        origin: true,
+        // Header Access-Control-Allow-Credentials
+        credentials: true,
+        // Header Access-Control-Allow-Methods
+        methods: ['GET', 'POST']
+    };
+
+    // Activo CORS para las URL necesarias
+    app.all('/api|auth|public|popup|builder|payments|distributed|static|template|assets|favicon/*', cors(corsOptions));
+}
+
+export function FrameGuard(req: express.Request, res: express.Response, next: any) {
+
+    // El header se aplica solo para URLs que no sean embebibles
+    if (req.url.match('^\/(builder|payments|popup)\/') || req.url.startsWith('/public/tracking/frame.html') || req.url.startsWith('/public/preview_template_edit/')) return next();
+
+    // Aplico el X-Frame-Options para indicar que la página solo se puede meter dentro de un iframe en el mismo origen (evitar clickjacking)
+    res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+
+    // Sigo procesando
+    return next();
+}
+
+export function HidePoweredBy(req: express.Request, res: express.Response, next: any) {
+
+    // Escondo el X-Powered-By: Express para no dar información a atacantes
+    res.removeHeader('X-Powered-By');
+
+    // Sigo procesando
+    return next();
+}
+
+export function XssFilter(req: express.Request, res: express.Response, next: any) {
+
+    // Verifico si estoy en un browser IE viejo (el header no se usa en estos casos)
+    let matches: RegExpExecArray = /msie\s*(\d+)/i.exec(req.headers['user-agent']);
+
+    // Valor del header
+    let value: string;
+
+    // Segun el caso habilito el header o no el X-XSS-Protection
+    if (!matches || (parseFloat(matches[1]) >= 9))
+        value = '1; mode=block';
+    else
+        value = '0';
+
+    // Agrego el X-XSS-Protection para vitar reflected XSS (ejecucion de scripts injectados en el querystring de la página)
+    res.setHeader('X-XSS-Protection', value);
+
+    // Sigo procesando
+    return next();
+}
+
+export function IeNoOpen(req: express.Request, res: express.Response, next: any) {
+
+    // Agrego el X-Download-Options para evitar descargas inseguras en explorer
+    res.setHeader('X-Download-Options', 'noopen');
+
+    // Sigo procesando
+    return next();
+}
+
+export function HstsGuard(req: express.Request, res: express.Response, next: any) {
+
+    // Por defecto empezo con maxage 0, lo cual deshabilita el HSTS
+    let maxAge: string = '0';
+
+    // Si estoy en un dominio que tiene habilitado HTTPS seteo un año de HSTS
+    if (res.locals && res.locals.domain && res.locals.domain.hasHttps) maxAge = '31536000';
+
+    // Aplico el X-Frame-Options para indicar que la página solo se puede meter dentro de un iframe en el mismo origen (evitar clickjacking)
+    res.setHeader('Strict-Transport-Security', 'max-age=' + maxAge);
+
+    // Sigo procesando
+    return next();
+}

package/src/server/ssl/star_inconcertcc_com.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDU+0V/p+RZFcXs
+oev5nfRMEuo4B2LlWtDpiQqL3HVHSXZPyjNu5EVF5Nfid8elLjXOA6DAyPshdcSn
+Uj1qWPDBCPNT3GL/qeJhHVe3SmIv2nDdVJ6UZvWv3+kZGaLXNsrkFA6zcj1i9Ac3
+lGwcs2bNN5MUXGGggZVDRwdWam9f/uJZxuZptr5umyAO/FX1N0CZVIW3XN0PCPo/
+b5JdYTS4Hrd0EK5nhbUPISOZc5+9PbX6LQd3i5aPPNxnraL4+p76l1Vy8jaD8Fl3
+F8/1UB2V1UMqt6QqbumY61why9KNS44mzvSYnPgh/QV5Jsh7fSlZi4tzT11np5ed
+u4bh5rHxAgMBAAECggEBALgEIhgZx4Hw/gFmJayWfOz9qsCeISRpQveEIEiXQf1F
+y6NE4Qt+zxuEjcJuG2DsfDBzkgD/pXtTdYXb2JR6JAmk4hgi4qZi8eVWpOMIsa0G
+311cL2epTb2XiJ7XN4sbHFHTwp/opIFKtrGe24owtzG4Qqvk5bT4QS7Pv9c6PuCA
+lTHUNc8Lc+mxswlERL6NEx2LwfJe0Pwu/OBNGkr1DsKtkIo9cGdWUNIjfGpFCK2v
+IPUosZB5Xw0VzTDinEAybWoXGCLwu6+XXuYv6Mv8WxzC7oFA5OOM7DYNrU/QXGzB
+IC71fbeCTcgX3ryvMKwQ9uxwxsCcbJqf5jm0NuCuzsECgYEA6YtLucK8xKeLIO6L
+HQ36tzacpi4y4LjZ5DR2rmn7bZy8x+N3sQCirEaCZcxJxSm9JVv4sr4ZIgnpPdCo
+8usePGLhmB7tvVleuTZHwKM/4jB29jYe0Ew2t63IjxQGEqhuMFZJc98L49VkNv9G
+AYBd6CyUrwDuniZPdNB1libsUs8CgYEA6XXTdpDV8Ec3y+9daTYl0LvqJkonumNZ
+bzzEZfnWps9NBBK9ndLIcyclE9HuYS7GKLkR8MkqxYJEPNUoEsf9TyZWdj+BjMSh
+6JndX9mZbEEi7viUBo5Z+jSoZFJJM9zrMlb4UP8CjUWN/1rtYDY2wCN0D8y2VYoO
+/+RfsIuk3z8CgYAzGBiPIX2vAIC9ybKBvsc1QitvZ/gVlhuFg7zbV7B8QKhEiw1q
+mhr82cg5gUI6cnFBNSfp4xEYk1aGAZqU2r+YsoFsiIe2v1Cr8KYuDQky8St1nk2L
+gMEP2mNgeh8CAftpc9dKFGhDhjIQnjSwq2bgHrDAwNFzpCoKAnlXSli1nQKBgGfW
+JTi+ELmvI20MSNLL56PggLOJFgR7vcKRF5V3uvY0i7+9CiNRJiC5j28yV0FYSYDB
+V+5tux1f5DPeZtV7p/n1Rk2Pz3Ip3w2SqfjA0tFoYz5Ax63m0LRNiXwdcTulDeM0
+9XspARyOjCrAaYX6dv2chzmjxpFjN2qvS7Q9WBaHAoGBAOF/78FN2FQ130xWL/xM
+JfCSC2Ks2c7wdypxYyMf2rKmTG4/hwPSu+lbGRQggwiszBYHSgvYOsKJaoI3R0zO
+O3LkbAphkrG7pr7jpv/vsyO06/SAEL6rnewlpb0aTTg1WMxK1tOy+nDhNtshEqPh
+0s0xAWLxb54b7Jb2J0+Us/kG
+-----END PRIVATE KEY-----

package/src/server/ssl/star_inconcertcc_com.pem

@@ -0,0 +1,62 @@
+-----BEGIN CERTIFICATE-----
+MIIGIDCCBQigAwIBAgIQAk7pfq6PPfJcjk3VbUj1PDANBgkqhkiG9w0BAQsFADBN
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
+aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgxMDE4MDAwMDAwWhcN
+MTkxMjE4MTIwMDAwWjBWMQswCQYDVQQGEwJVWTETMBEGA1UEBxMKTW9udGV2aWRl
+bzEWMBQGA1UEChMNVGVjbm9saW5rIFMuQTEaMBgGA1UEAwwRKi5pbmNvbmNlcnRj
+Yy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDU+0V/p+RZFcXs
+oev5nfRMEuo4B2LlWtDpiQqL3HVHSXZPyjNu5EVF5Nfid8elLjXOA6DAyPshdcSn
+Uj1qWPDBCPNT3GL/qeJhHVe3SmIv2nDdVJ6UZvWv3+kZGaLXNsrkFA6zcj1i9Ac3
+lGwcs2bNN5MUXGGggZVDRwdWam9f/uJZxuZptr5umyAO/FX1N0CZVIW3XN0PCPo/
+b5JdYTS4Hrd0EK5nhbUPISOZc5+9PbX6LQd3i5aPPNxnraL4+p76l1Vy8jaD8Fl3
+F8/1UB2V1UMqt6QqbumY61why9KNS44mzvSYnPgh/QV5Jsh7fSlZi4tzT11np5ed
+u4bh5rHxAgMBAAGjggLxMIIC7TAfBgNVHSMEGDAWgBQPgGEcgjFh1S8o541GOLQs
+4cbZ4jAdBgNVHQ4EFgQU2CMQ0orM9d9s4mO93ea0Blw5lPEwLQYDVR0RBCYwJIIR
+Ki5pbmNvbmNlcnRjYy5jb22CD2luY29uY2VydGNjLmNvbTAOBgNVHQ8BAf8EBAMC
+BaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRkMGIwL6At
+oCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzYuY3JsMC+g
+LaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc2LmNybDBM
+BgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3
+dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAjB8BggrBgEFBQcBAQRwMG4wJAYI
+KwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBGBggrBgEFBQcwAoY6
+aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMlNlY3VyZVNl
+cnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDw
+AHYAu9nfvB+KcbWTlCOXqpJ7RzhXlQqrUugakJZkNo4e0YUAAAFmhZsJTAAABAMA
+RzBFAiBugjf2/aPKsj9zjj5FKyilRuA26KfK09WuIGs666CItgIhAMLMMrsKyRjN
+cuFVENQ+ClgiDytx4sziX76N8AGhMl7fAHYAh3W/51l8+IxDmV+9827/Vo1HVjb/
+SrVgwbTq/16ggw8AAAFmhZsJTwAABAMARzBFAiEA8/65DlLI1OufHMKvTMiRZsxr
+v+Uh67qjjMwF/o3iq3QCIB3QhkUT3jEUlsM6t+Bt/cjbuJMgsK++jzf5WP261uPw
+MA0GCSqGSIb3DQEBCwUAA4IBAQBTDGp5lureeHX3lijjKUBpfnrYvbeQy2HAxxMj
+kuFqNEZNV1IBKKID/73aNoArhh9LBpWKjb9/x33/uFJpYORmlLWiROucNtwCXG7a
+W5Sl+vUMk1X8yjgRmUaL9rui36Uhr3AAusdwahZtHK/Whs9ADP3ckuJ95PZLee2f
+Ko+JzfN4cDzspReDyMitF9HNlN8U0+Xqv71jIqn/DbaFpwll3UsgeRw2/3vMnF4h
+NB7+ASXqubWzO23fS3Fwv2qOnr6e/3ZktAWyYH0pujwu92ZnatWlGGWkAIlfzRbp
+xNveJht5bI1TZfNrH5KUmqznpU5o5xGq7SrqLmzzRzuDgtME
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
+U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
+nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
+KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
+/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
+kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
+/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY
+aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6
+Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1
+oDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD
+QS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v
+d3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh
+xtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB
+CwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl
+5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA
+8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC
+2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit
+c+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0
+j6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz
+-----END CERTIFICATE-----

package/src/server/tsconfig.json

@@ -0,0 +1,38 @@
+{
+  "compilerOptions": {
+    "target": "es5",
+    "module": "commonjs",
+    "declaration": false,
+    "removeComments": true,
+    "noLib": false,
+    "lib": ["es2016", "dom"],
+    "emitDecoratorMetadata": true,
+    "experimentalDecorators": true,
+    "sourceMap": true,
+    "pretty": true,
+    "allowUnreachableCode": false,
+    "allowUnusedLabels": false,
+    "noImplicitAny": false,
+    "noImplicitReturns": true,
+    "noImplicitUseStrict": false,
+    "noFallthroughCasesInSwitch": true,
+    "allowSyntheticDefaultImports": true,
+    "typeRoots": [
+      "../../node_modules/@types",
+      "../../node_modules"
+    ],
+    "types": [
+      "core-js",
+      "node",
+      "express",
+      "jasmine",
+      "systemjs"
+    ]
+  },
+  "exclude": [
+    "node_modules",
+    "dist",
+    "src"
+  ],
+  "compileOnSave": false
+}

package/tools/build.js.prod.ts

@@ -0,0 +1,40 @@
+import * as gulp from 'gulp';
+import * as gulpLoadPlugins from 'gulp-load-plugins';
+import { join } from 'path';
+
+import { APP_CLIENT_SRC, TMP_CLIENT_DIR, TOOLS_DIR, BOOTSTRAP_MODULE_AOT, TEMPLATE_CONFIG } from '../config';
+import { makeTsProject, TemplateLocalsBuilder } from '../utils';
+
+const plugins = <any>gulpLoadPlugins();
+
+const INLINE_OPTIONS = {
+  base: TMP_CLIENT_DIR,
+  useRelativePaths: true,
+  removeLineBreaks: true
+};
+
+/**
+ * Executes the build process, transpiling the TypeScript files for the production environment.
+ */
+export = () => {
+
+  let tsProject = makeTsProject({}, APP_CLIENT_SRC);
+
+  let src = [
+    TOOLS_DIR + '/manual_typings/**/*.d.ts',
+    join(TMP_CLIENT_DIR, '**/*.ts'),
+    '!' + join(TMP_CLIENT_DIR, '/' + BOOTSTRAP_MODULE_AOT + '.ts'),
+  ];
+
+  let result = gulp.src(src)
+    .pipe(plugins.plumber())
+    .pipe(plugins.inlineNg2Template(INLINE_OPTIONS))
+    .pipe(tsProject())
+    .once('error', function () {
+      this.once('finish', () => process.exit(1));
+    });
+
+  return result.js
+    .pipe(plugins.template(new TemplateLocalsBuilder().withStringifiedSystemConfigDev().build(), TEMPLATE_CONFIG))
+    .pipe(gulp.dest(TMP_CLIENT_DIR));
+};