just-another-http-api 1.0.4 → 1.2.0

package/api.js

@@ -1,133 +1,262 @@
-const restify = require ( 'restify' );
-const restifyErrors = require ( 'restify-errors' );
-const corsPlugin = require ( 'restify-cors-middleware2' );
+const fastify = require ( 'fastify' );
 const recursiveRead = require ( 'recursive-readdir' );
 const packageJson = require ( './package.json' );
 const path = require ( 'path' );
-const multer = require ( 'multer' );
-const storage = multer.memoryStorage ();
 
-/**
- * See README for config setup.
- * 
- * @param {Object} config The config, see readme for example configurations
- * @param {Function} every An optional agrument that accepts a function ready to receive an object. The function will be called everytime a endpoint is requested (good for analytical usage)
- * @param {RestifyServer} _server Optionally override the restify instance in this API and use your own. Accepts a `restify.createServer()` instance.
- */
-module.exports = async ( config, every = null, _server = null ) => {
+const caching = require ( './src/cache' );
+const uploads = require ( './src/upload' );
+const auth = require ( './src/auth' );
+const cors = require ( './src/cors' );
 
-    if ( !config ) console.log ( 'JustAnother: WARNING: You\'ve initialised Just Another Http API without any config. This is not recommended.' );
+let app;
 
-    let upload;
-    let server = _server;
+module.exports = async ( config, _app = null ) => {
+    app = _app || await createServer ( config );
 
-    if ( _server ) console.debug ( 'JustAnother: Using restify override instance provided.' );
-    else {
-        server = restify.createServer ( {
-            name: packageJson.name,
-            version: packageJson.version
-        } );
+    const endpoints = await loadEndpoints ( config );
+    endpoints.forEach ( endpoint => registerEndpoint ( app, endpoint, config ) );
+
+    await app.listen ( { port: process.env.PORT || config?.port || 4001 } );
+
+    return app;
+};
+
+async function createServer ( config ) {
+    const app = fastify ( {
+        logger: config.logs || false,
+        name: config.name || packageJson.name,
+    } );
 
-        if ( config?.bodyParser ) server.use ( restify.plugins.queryParser () );
-        if ( config?.bodyParser ) server.use ( restify.plugins.bodyParser () );
-        if ( config?.uploads && config?.uploads.enabled ) upload = multer ( { storage: storage } );
+    try {
+        
+        if ( config.cors ) {
+            app.register ( require ( '@fastify/cors' ), ( instance ) => {
+                return ( req, callback ) => {
+                    const corsOptions = {
+                        // This is NOT recommended for production as it enables reflection exploits
+                        origin: true
+                    };
 
-        if ( config?.cors ){
-            const cors = corsPlugin ( config.cors );
-            server.pre ( cors.preflight );
-            server.use ( cors.actual );
+                    console.log ( 'hbawfjawhv' );
+                
+                    // // do not include CORS headers for requests from localhost
+                    // if ( /^localhost$/m.test ( req.headers.origin ) ) {
+                    //     corsOptions.origin = false;
+                    // }
+                
+                    // callback expects two parameters: error and options
+                    callback ( null, corsOptions );
+                };
+            } );
+        }
+        await uploads.initialiseUploads ( app, config );
+        await caching.initialiseCaching ( app, config );
+        await auth.initialiseAuth ( app, config );
+
+        if ( config.middleware && Array.isArray ( config.middleware ) ) {
+            for ( const func of config.middleware ) {
+                if ( typeof func === 'function' ) {
+                    await app.register ( func );
+                }
+            }
         }
     }
+    catch ( error ) {
+        console.error ( 'Error during server initialization:', error );
+        throw error; // Rethrow the error to handle it at a higher level, if necessary
+    }
 
-    server.on ( 'MethodNotAllowed', unknownMethodHandler );
+    return app;
+}
 
+async function loadEndpoints ( config ) {
     const files = await recursiveReadDir ( config?.docRoot || 'routes' );
-    const endpoints = files.map ( ( filePath ) => ( {
+
+    return files.map ( filePath => ( {
         handlers: require ( path.resolve ( filePath ) ),
         path: handlerPathToApiPath ( filePath, config?.docRoot || 'routes' )
     } ) );
+}
 
-    endpoints.forEach ( endpoint => {
-        Object.keys ( endpoint.handlers ).forEach ( method => {
-            const endpointArgs = [
-                endpoint.path,
-                method === 'post' && upload ? upload.single ( 'file' ) : null
-            ].filter ( Boolean );
+function registerEndpoint ( app, endpoint, globalConfig ) {
+    Object.keys ( endpoint.handlers ).filter ( method => method !== 'config' ).forEach ( method => {
+        const handlerConfig = endpoint.handlers.config?.[ method ] || {};
+        const requiresAuth = handlerConfig?.requiresAuth !== undefined ? handlerConfig.requiresAuth : !!globalConfig?.auth?.requiresAuth;
 
-            server[ method ] ( ...endpointArgs, async ( req, res ) => {
-                try {
-                    const response = await endpoint.handlers[ method ] ( req );
-                
-                    if ( every ) {
-                        every ( { path: endpoint.path, method, req } );
-                    }
-
-                    // If optional headers have been provided in the response add them here.
-                    if ( response.hasOwnProperty ( 'headers' ) ){
-                        res.set ( response.headers ); 
-                    }
-
-                    if ( response.hasOwnProperty ( 'redirect' ) ){
-                        res.redirect ( response.redirect.code, response.redirect.url, () => null );
-                    }
-
-                    if ( response.hasOwnProperty ( 'cache' ) ){
-                        res.cache ( response.cache.type, response.cache.options );
-                    }
-
-                    // If response.html is set, we want to send the HTML back as a raw string and set the content type.
-                    if ( response.hasOwnProperty ( 'html' ) ){
-                        res.sendRaw ( 200, response.html, { 'Content-Type': 'text/html' } );
-                    } //
-                    else if ( response.hasOwnProperty ( 'json' ) || response.hasOwnProperty ( 'body' ) || response.hasOwnProperty ( 'response' ) || typeof response === 'string' ){
-                        data = response?.json || response?.body || response?.response || response;
-                        res.setHeader ( 'Content-Type', 'application/json' );
-                        res.send ( method === 'post' ? 201 : 200, data );
-                    }
-                    else if ( response.hasOwnProperty ( 'error' ) ){
-                        console.error ( error );
-                        res.setHeader ( 'Content-Type', 'application/json' );
-                        res.send ( new restifyErrors.makeErrFromCode ( response?.error?.statusCode, response?.error?.message ) );
-                    }
-                    else if ( response.hasOwnProperty ( 'file' ) ){
-                        res.sendRaw ( response.file );
-                    }
-                    else if ( typeof response === 'object' ){
-                        res.send ( response ); //Try and send whatever it is
-                    }
-                    else if ( !response ){
-                        res.send ( 204 );
-                    }
-                    else {
-                        res.setHeader ( 'Content-Type', 'application/json' );
-                        res.send ( new restifyErrors.makeErrFromCode ( 500, `Just Another Http API did not understand the response provided for request: ${ method } to ${ endpoint.path }. Check your return value.` ) );
-                    }
-
-                    return;
-                }
-                catch ( error ){
-                    res.setHeader ( 'Content-Type', 'application/json' );
-                    if ( error instanceof Error ) {
-                        res.send ( new restifyErrors.InternalServerError ( { code: 500 }, error.stack.replace ( /\n/g, ' ' ) ) );
-                    }
-                    else {
-                        if ( error.code ) {
-                            res.send ( new restifyErrors.makeErrFromCode ( error.code, error.message ) );
-                        }
+        const preHandlers = [];
+        if ( requiresAuth ) {
+            preHandlers.push ( async ( req, reply ) => {
+                req.authConfig = handlerConfig.auth || globalConfig.auth;
+                await auth.checkAuth ( req, reply );
+            } );
+        }
+
+        if ( globalConfig?.uploads?.enabled && handlerConfig?.upload?.enabled ) {
+            preHandlers.push ( uploads.handleUpload ( handlerConfig, globalConfig ) );
+        }
+        if ( handlerConfig?.cors !== undefined ) {
+            preHandlers.push ( cors.addCustomCors ( handlerConfig, globalConfig ) );
+        }
+
+        const fastifyMethod = translateLegacyMethods ( method.toLowerCase () );
+        const handler = endpoint.handlers[ method ];
+        const wrappedHandler = fastifyHandlerWrapper ( handler, endpoint.handlers.config, globalConfig );
+
+        app[ fastifyMethod ] ( 
+            endpoint.path, 
+            { 
+                preHandler: preHandlers
+            },
+            wrappedHandler 
+        );
+    } );
+}
+
+function translateLegacyMethods ( method ) {
+    switch ( method ) {
+        case 'del':
+            return 'delete';
+        default: 
+            return method;
+    }
+}
+
+function fastifyHandlerWrapper ( handler, config, globalConfig ) {
+    return async ( req, reply ) => {
+        try {
+            let response = await caching.checkRequestCache ( app, req, reply, config, globalConfig );
+                       
+            if ( !response ){
+                response = await handler ( req );
+                await caching.setRequestCache ( app, req, response, config, globalConfig );
+            }
+
+            handleResponse ( reply, response, req.method, req.routeOptions.url );
+        }
+        catch ( error ) {
+            handleError ( reply, error );
+        }
+    };
+};
+
+function handleResponse ( reply, response, method, path ) {
     
-                        res.send ( new restifyErrors.InternalServerError ( { code: 500 }, JSON.stringify ( error, null, 2 ) ) );
-                    }
+    if ( !response ) {
+        reply.code ( 204 ).send ();
+        
+        return;
+    }
 
-                    return;
-                }
-            } );
+    if ( typeof response !== 'object' || response === null ) {
+        handleNonObjectResponse ( reply, response, method );
+        
+        return;
+    }
+
+    setResponseHeaders ( reply, response );
+    handleSpecialResponseTypes ( reply, response, method, path );
+}
+
+function setResponseHeaders ( reply, response ) {
+    if ( response.headers ) {
+        Object.entries ( response.headers ).forEach ( ( [ key, value ] ) => {
+            reply.header ( key, value );
         } );
+    }
+}
+
+function handleSpecialResponseTypes ( reply, response, method, path ) {
+    if ( response.redirect ) {
+        reply.redirect ( 301, response.redirect.url );
+        
+        return;
+    }
+
+    if ( response.html ) {
+        reply.code ( 200 ).type ( 'text/html' ).send ( response.html );
+        
+        return;
+    }
+
+    if ( response.text ) {
+        reply.code ( 200 ).type ( 'text/plain' ).send ( response.text );
+        
+        return;
+    }
+
+    if ( response.error ) {
+        handleErrorResponse ( reply, response.error );
+        
+        return;
+    }
+
+    if ( response.file ) {
+        reply.send ( response.file );
+        
+        return;
+    }
+
+    sendGenericResponse ( reply, response, method, path );
+}
+
+function sendGenericResponse ( reply, response, method, path ) {
+
+    const data = response.json ?? response.body ?? response.response ?? response;
+
+    if ( data !== undefined ) {
+        reply.type ( 'application/json' ).code ( method === 'post' ? 201 : 200 ).send ( data );
+    }
+    else {
+        handleUnknownResponseType ( reply, method, path );
+    }
+
+}
+
+function handleErrorResponse ( reply, error ) {
+    console.error ( error );
+    const statusCode = error?.statusCode ?? 500;
+    reply.code ( statusCode ).type ( 'application/json' ).send ( { error: error.message } );
+}
+
+function handleUnknownResponseType ( reply, method, path ) {
+    reply.type ( 'application/json' ).code ( 500 ).send ( {
+        error: `Unrecognized response type for ${method} ${path}`
     } );
-            
-    await server.listen ( process.env.PORT || config?.port || 4001 );
-    
-    return server;
-};
+}
+
+function handleNonObjectResponse ( reply, response, method ) {
+    reply.type ( 'text/plain' ).code ( method === 'post' ? 201 : 200 ).send ( response.toString () );
+}
+
+function handleError ( reply, error ) {
+    // Set content type for the error response
+    reply.header ( 'Content-Type', 'application/json' );
+
+    if ( error instanceof Error ) {
+        // Send internal server error with the error stack
+        reply.status ( 500 ).send ( { 
+            error: 'Internal Server Error', 
+            message: error.message, 
+            stack: error.stack 
+        } );
+    }
+    else {
+        // Check if error object contains a specific status code
+        if ( error.code && typeof error.code === 'number' ) {
+            reply.status ( error.code ).send ( { 
+                error: 'Error',
+                message: error.message 
+            } );
+        }
+        else {
+            // Send a generic internal server error response
+            reply.status ( 500 ).send ( { 
+                error: 'Internal Server Error', 
+                message: 'An unknown error occurred' 
+            } );
+        }
+    }
+}
 
 const handlerPathToApiPath = ( path, docRoot ) => {
 
@@ -152,28 +281,10 @@ const recursiveReadDir = async ( docRoot ) => {
     try {
         const files = await recursiveRead ( docRoot );
         
-        // Remove all falsy values and reverse the array.
         return files.filter ( filePath => filePath ? !filePath.includes ( 'DS_Store' ) : false ).reverse ();
     }
     catch ( e ){
         console.error ( 'JustAnother: Failed to load your routes directory for generating endpoints.' );
         throw e;
     }  
-};
-
-const unknownMethodHandler = ( req, res ) => {
-    if ( req.method.toLowerCase () === 'options' ) {
-        const allowHeaders = [ '*' ];
-
-        if ( res.methods.indexOf ( 'OPTIONS' ) === -1 ) res.methods.push ( 'OPTIONS' );
-
-        res.header ( 'Access-Control-Allow-Credentials', true );
-        res.header ( 'Access-Control-Allow-Headers', allowHeaders.join ( ', ' ) );
-        res.header ( 'Access-Control-Allow-Methods', res.methods.join ( ', ' ) );
-        res.header ( 'Access-Control-Allow-Origin', req.headers.origin );
-
-        return res.send ( 204 );
-    }
-
-    return res.send ( new restifyErrors.MethodNotAllowedError ( { code: 405 }, `${ req.method } method is not available on this endpoint` ) );
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "just-another-http-api",
-  "version": "1.0.4",
-  "description": "A framework built on top of restify aimed at removing the need for any network or server configuration. ",
+  "version": "1.2.0",
+  "description": "A framework built on top of fastify aimed at removing the need for any network or server configuration. ",
   "homepage": "https://github.com/OllieEdge/just-another-http-api#readme",
   "repository": {
     "type": "git",
@@ -16,7 +16,7 @@
     "restapi",
     "restful",
     "rest",
-    "restify",
+    "fastify",
     "http",
     "server",
     "just another",
@@ -25,15 +25,21 @@
   "author": "Oliver Edgington <oliver@edgington.com> (https://github.com/OllieEdge)",
   "license": "MIT",
   "dependencies": {
-    "multer": "^1.4.2",
-    "recursive-readdir": "^2.2.3",
-    "restify": "^10.0.0",
-    "restify-cors-middleware2": "^2.2.0",
-    "restify-errors": "^8.0.0"
+    "@aws-sdk/lib-storage": "^3.454.0",
+    "@fastify/caching": "^8.3.0",
+    "@fastify/cors": "^8.4.1",
+    "@fastify/jwt": "^7.2.3",
+    "@fastify/redis": "^6.1.1",
+    "abstract-cache": "^1.0.1",
+    "abstract-cache-redis": "^2.0.0",
+    "fastify": "^4.24.3",
+    "fastify-multer": "^2.0.3",
+    "recursive-readdir": "^2.2.3"
   },
   "devDependencies": {
-    "chai": "^4.3.7",
+    "chai": "^4.3.10",
     "chai-as-promised": "^7.1.1",
+    "eip-cloud-services": "^1.1.0",
     "mocha": "^10.2.0"
   }
 }

package/src/auth.js

@@ -0,0 +1,140 @@
+let config;
+
+exports.initialiseAuth = async ( app, _config ) => {
+    config = _config;
+
+    const authType = config?.auth?.type;
+
+    switch ( authType ) {
+        case 'jwt':
+
+            checkJwtIsAvailable ( config );
+
+            app.register ( require ( '@fastify/jwt' ), {
+                secret: config.auth.jwtSecret,
+            } );
+
+            app.decorate ( 'authenticate', async function ( request, reply ) {
+                try {
+                    await request.jwtVerify ();
+                }
+                catch ( err ) {
+                    if ( err.name === 'JsonWebTokenError' ) {
+                        reply.status ( 400 ).send ( { error: 'Invalid Token' } );
+                    }
+                    else if ( err.name === 'TokenExpiredError' ) {
+                        reply.status ( 401 ).send ( { error: 'Token Expired' } );
+                    }
+                    else {
+                        reply.send ( err );
+                    }
+                }
+            } );
+
+            app.post ( config?.auth?.tokenEndpoint || '/auth/login', async ( req, reply ) => {
+
+                const jwtToTokenise = await config.auth.jwtLoginHandle ( req.body );
+
+                if ( !jwtToTokenise ) {
+                    reply.status ( 401 );
+                    reply.send ( { error: 'Invalid credentials' } );
+                    
+                    return;
+                }
+
+                const accessToken = app.jwt.sign ( { username: jwtToTokenise }, { expiresIn: config.auth.jwtExpiresIn } );
+                const refreshToken = config.auth.jwtEnabledRefreshTokens && checkJwtRefreshIsAvailable ( config )  ? app.jwt.sign ( { username: jwtToTokenise }, { expiresIn: config.auth.jwtRefreshExpiresIn } ) : null;
+                const expires = config.auth.jwtExpiresIn;
+
+                await config.auth.jwtStoreRefreshToken ( jwtToTokenise, refreshToken );
+
+                reply.send ( { user: jwtToTokenise, accessToken, refreshToken, expires } );
+
+                return;
+
+            } );
+
+            if ( config.auth.jwtEnabledRefreshTokens && checkJwtRefreshIsAvailable ( config ) ){
+                app.post ( config?.auth?.refreshTokenEndpoint || '/auth/refresh', async ( req, reply ) => {
+
+                    const { user, refreshToken } = req.body;
+
+                    const isValid = await config.auth.jwtRetrieveRefreshToken ( user, refreshToken );
+                    if ( !isValid ) {
+                        reply.status ( 401 ).send ( { error: 'Invalid refresh token' } );
+                        
+                        return;
+                    }
+
+                    const accessToken = app.jwt.sign ( { username: user }, { expiresIn: config.auth.jwtExpiresIn } );
+                    const newRefreshToken = config.auth.jwtEnabledRefreshTokens && checkJwtRefreshIsAvailable ( config )  ? app.jwt.sign ( { username: user }, { expiresIn: config.auth.jwtRefreshExpiresIn } ) : null;
+                    const expires = config.auth.jwtExpiresIn;
+
+                    await config.auth.jwtStoreRefreshToken ( user, newRefreshToken );
+
+                    reply.send ( { user, accessToken, refreshToken: newRefreshToken, expires } );
+
+                    return;
+
+                } );
+            }
+
+            break;
+        default: 
+            return;
+    }
+
+};
+
+exports.checkAuth = async ( req, reply ) => {
+    const authType = config.auth.type; // authConfig is set in each route
+
+    try {
+        switch ( authType ) {
+            case 'jwt':
+                await req.jwtVerify ();
+                break;
+            case 'basic':
+                // Basic auth logic
+                break;
+            case 'oauth2':
+                // OAuth2 auth logic
+                break;
+            case 'token':
+                // Token-based auth logic
+                break;
+            default:
+                throw new Error ( 'Unsupported authentication type' );
+        }
+
+        return;
+    }
+    catch ( err ) {
+        reply.send ( err );
+    }
+};
+
+const checkJwtIsAvailable = ( config ) => {
+    if ( !config?.auth?.jwtLoginHandle || typeof config.auth.jwtLoginHandle !== 'function' ){
+        throw new Error ( '`auth.type` is set to "jwt", but `auth.jwtLoginHandle` is not a function or is not defined.' );
+    }
+    if ( !config?.auth?.jwtExpiresIn || typeof config.auth.jwtExpiresIn !== 'number' ){
+        throw new Error ( '`auth.jwtEnabledRefreshTokens` is set to true, but `auth.jwtExpiresIn` is not a number or is not defined.' );
+    }
+
+    return true;
+};
+
+const checkJwtRefreshIsAvailable = ( config ) => {
+    if ( !config?.auth?.jwtStoreRefreshToken || typeof config.auth.jwtStoreRefreshToken !== 'function' ){
+        throw new Error ( '`auth.jwtEnabledRefreshTokens` is set to true, but `auth.jwtStoreRefreshToken` is not a function or is not defined.' );
+    }
+    if ( !config?.auth?.jwtRetrieveRefreshToken || typeof config.auth.jwtRetrieveRefreshToken !== 'function' ){
+        throw new Error ( '`auth.jwtEnabledRefreshTokens` is set to true, but `auth.jwtRetrieveRefreshToken` is not a function or is not defined.' );
+    }
+    if ( !config?.auth?.jwtRefreshExpiresIn || typeof config.auth.jwtRefreshExpiresIn !== 'number' ){
+        throw new Error ( '`auth.jwtEnabledRefreshTokens` is set to true, but `auth.jwtRefreshExpiresIn` is not a number or is not defined.' );
+    }
+
+    return true;
+};

package/src/cache.js

@@ -0,0 +1,69 @@
+const getCacheKey = ( config, req ) => `${config?.cache?.redisPrefix || ''}:${req.method.toLowerCase ()}:${req.routeOptions.url}:${JSON.stringify ( req.query )}`;
+
+exports.initialiseCaching = async ( app, config ) => {
+
+    if ( config.cache && config.cache.enabled && config.cache.redisClient ) {
+
+        await app.register ( require ( '@fastify/redis' ), { client: config.cache.redisClient } );
+        await app.register ( require ( '@fastify/caching' ), require ( 'abstract-cache' ) ( {
+            useAwait: true,
+            driver: {
+                name: 'abstract-cache-redis',
+                options: { client: config.cache.redisClient }
+            }
+        } ) );
+
+    }
+
+    return;
+};
+
+exports.checkRequestCache = async ( app, req, reply, handleConfig, globalConfig ) => {
+
+    if ( globalConfig?.cache?.enabled && handleConfig?.[ req.method.toLowerCase () ]?.cache ) {
+        
+        const cacheKey = getCacheKey ( globalConfig, req );
+        const script = `
+        local value = redis.call('GET', KEYS[1])
+        local ttl = redis.call('TTL', KEYS[1])
+                return {value, ttl}
+            `;
+        const result = await app.redis.eval ( script, 1, cacheKey );
+    
+        if ( result[ 0 ] ) {
+            const cachedResponse = JSON.parse ( result[ 0 ] );
+            const ttl = result[ 1 ];
+            const maxAge = handleConfig?.[ req.method.toLowerCase () ]?.expires || globalConfig?.cache?.expires || 60;
+            const ageInSeconds = maxAge - ttl; // Calculate the age based on TTL and maxAge
+    
+            if ( globalConfig?.cache?.addCacheHeaders ){
+                cachedResponse.headers ??= {};
+                cachedResponse.headers[ 'X-Cache' ] = 'HIT';
+                cachedResponse.headers[ 'X-Cache-Age' ] = ageInSeconds;
+                cachedResponse.headers[ 'X-Cache-Expires' ] = maxAge;
+            }
+            
+            return cachedResponse;
+        }
+            
+    }
+    
+    return null;
+};
+
+exports.setRequestCache = async ( app, req, response, handleConfig, globalConfig ) => {
+
+    if ( globalConfig?.cache?.enabled && handleConfig?.[ req.method.toLowerCase () ]?.cache ){
+        const cacheKey = getCacheKey ( globalConfig, req );
+
+        await app.redis.set ( cacheKey, JSON.stringify ( response ), 'EX', handleConfig?.[ req.method.toLowerCase () ]?.expires || globalConfig?.cache?.expires || 60 );
+
+        if ( globalConfig?.cache?.addCacheHeaders ){
+            response.headers ??= {};
+            response.headers[ 'X-Cache' ] = 'MISS';
+            response.headers[ 'X-Cache-Age' ] = 0;
+            response.headers[ 'X-Cache-Expires' ] = handleConfig?.[ req.method.toLowerCase () ]?.expires || globalConfig?.cache?.expires || 60;
+        }
+
+    }
+};

package/src/cors.js

@@ -0,0 +1,9 @@
+exports.addCustomCors = ( handlerConfig ) => ( req, reply, done ) => {
+
+    Object.entries ( handlerConfig.cors ).forEach ( ( [ key, value ] ) => {
+        reply.header ( key, value );
+    } );
+
+    done ();
+
+};