k2hr3-api 1.0.42 → 2.0.1

package/dist/src/routes/role.js

@@ -0,0 +1,2627 @@
+"use strict";
+/*
+ * K2HR3 REST API
+ *
+ * Copyright 2017 Yahoo Japan Corporation.
+ *
+ * K2HR3 is K2hdkc based Resource and Roles and policy Rules, gathers
+ * common management information for the cloud.
+ * K2HR3 can dynamically manage information as "who", "what", "operate".
+ * These are stored as roles, resources, policies in K2hdkc, and the
+ * client system can dynamically read and modify these information.
+ *
+ * For the full copyright and license information, please view
+ * the license file that was distributed with this source code.
+ *
+ * AUTHOR:   Takeshi Nakatani
+ * CREATE:   Wed Jun 8 2017
+ * REVISION:
+ *
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const k2hr3apiutil_1 = __importDefault(require("../lib/k2hr3apiutil"));
+const k2hr3resutil_1 = __importDefault(require("../lib/k2hr3resutil"));
+const k2hr3tokens_1 = __importDefault(require("../lib/k2hr3tokens"));
+const k2hr3userdata_1 = __importDefault(require("../lib/k2hr3userdata"));
+const k2hr3dkc_1 = __importDefault(require("../lib/k2hr3dkc"));
+const dbglogging_1 = __importDefault(require("../lib/dbglogging"));
+const express_1 = __importDefault(require("express"));
+const k2hr3config_1 = require("../lib/k2hr3config");
+const k2hr3keys_1 = require("../lib/k2hr3keys");
+const apiConf = new k2hr3config_1.r3ApiConfig();
+const r3keys = k2hr3keys_1.getK2hr3Keys;
+const router = express_1.default.Router();
+//
+// check typs
+//
+const rawIsValTypeQueryRoleHostBaseValue = (val) => {
+    if (!k2hr3apiutil_1.default.isPlainObject(val)) {
+        return false;
+    }
+    const _obj = val;
+    const _isStringOrNull = (key) => (null === _obj[key] || k2hr3apiutil_1.default.isString(_obj[key]));
+    const _isStringOrNullOrUndef = (key) => (undefined === _obj[key] || null === _obj[key] || k2hr3apiutil_1.default.isString(_obj[key]));
+    const _isStrNumOrNullOrUndef = (key) => (undefined === _obj[key] || null === _obj[key] || k2hr3apiutil_1.default.isString(_obj[key]) || k2hr3apiutil_1.default.isSafeNumber(_obj[key]));
+    return (_isStringOrNull('host') &&
+        _isStrNumOrNullOrUndef('port') &&
+        _isStringOrNullOrUndef('cuk') &&
+        _isStringOrNullOrUndef('extra') &&
+        _isStringOrNullOrUndef('tag') &&
+        _isStringOrNullOrUndef('inboundip') &&
+        _isStringOrNullOrUndef('outboundip'));
+};
+const rawIsValTypeQueryRoleHostBaseValueArray = (arr) => {
+    return (Array.isArray(arr) && arr.every((element) => rawIsValTypeQueryRoleHostBaseValue(element)));
+};
+//---------------------------------------------------------
+// Configuration
+//	* Get role full path which is allowed to remove ip address
+//	* Get expiration for role tokens
+//---------------------------------------------------------
+let delhost_role_yrn = null;
+let expire_rtoken = 0;
+let expire_reg_rtoken = 0;
+(() => {
+    const admincfgobj = apiConf.getK2hr3AdminConfig();
+    if (k2hr3apiutil_1.default.isPlainObject(admincfgobj) && k2hr3apiutil_1.default.isSafeString(admincfgobj.tenant) && k2hr3apiutil_1.default.isSafeString(admincfgobj.delhostrole)) {
+        const keys = r3keys(null, admincfgobj.tenant.trim());
+        delhost_role_yrn = keys.ROLE_TOP_KEY + ':' + admincfgobj.delhostrole.trim();
+    }
+    else {
+        dbglogging_1.default.elog('Could not find tenant/role in configuration for deleting host by cuk.');
+        delhost_role_yrn = null;
+    }
+    expire_rtoken = apiConf.getExpireTimeRoleToken();
+    expire_reg_rtoken = apiConf.getExpireTimeRegRoleToken();
+})();
+//---------------------------------------------------------
+// Router POST
+//---------------------------------------------------------
+//
+// Mountpath						: '/v1/role'
+// POST '/v1/role{/<role{/...}>}'	: post role on version 1
+// HEADER							: X-Auth-Token	=> User token or Role token
+// response body					: result		=> true/false
+//									  message		=> messages
+//
+// This mount point is for creating(update) role or creating(update) host in role.
+//
+router.post('/', (req, res, next) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        const result = {
+            result: false,
+            message: 'POST request or url or query is wrong'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    // check api type
+    if ('/v1/role' === decodeURI(req.baseUrl)) {
+        //------------------------------
+        // create role type
+        //------------------------------
+        postRole(req, res, next);
+    }
+    else {
+        // check host api
+        const keys = r3keys();
+        const requestptn = new RegExp(keys.MATCH_URI_GET_ROLE_DATA); // regex = /^\/v1\/role\/(.*)/
+        const reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+        if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+            const result = {
+                result: false,
+                message: 'POST request url does not have role name'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // role name
+        const name = reqmatchs[1].toLowerCase();
+        //------------------------------
+        // create host type
+        //------------------------------
+        postRoleHost(name, req, res, next);
+    }
+});
+//---------------------------------------------------------
+// Router PUT
+//---------------------------------------------------------
+// Mountpath					: '/v1/role'
+// PUT '/v1/role{/<role{/...}>}': put role on version 1
+// HEADER						: X-Auth-Token	=> User token or Role token
+// response body				: result		=> true/false
+//								  message		=> messages
+//
+// This mount point is for creating(update) role and creating(update) host in role.
+//
+router.put('/', (req, res, next) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        const result = {
+            result: false,
+            message: 'PUT request or url or query is wrong'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    // check api type
+    if ('/v1/role' === decodeURI(req.baseUrl)) {
+        //------------------------------
+        // create role type
+        //------------------------------
+        putRole(req, res, next);
+    }
+    else {
+        // check host api
+        const keys = r3keys();
+        const requestptn = new RegExp(keys.MATCH_URI_GET_ROLE_DATA); // regex = /^\/v1\/role\/(.*)/
+        const reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+        if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+            const result = {
+                result: false,
+                message: 'POST request url does not have role name'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // role name
+        const name = reqmatchs[1].toLowerCase();
+        //------------------------------
+        // create host type
+        //------------------------------
+        putRoleHost(name, req, res, next);
+    }
+});
+//
+// Sub router function for POST CREATE ROLE
+//
+// Mountpath				: '/v1/role'
+// POST '/v1/role'			: post role on version 1
+// HEADER					: X-Auth-Token	=> User token
+// response body			: result		=> true/false
+//							  message		=> messages
+// body						: 
+//	{
+//		"role":	{
+//			"name":			<role name>						=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>"
+//																<role> can include '/' for hierarchical path
+//			"policies":		[<policy yrn full path>, ...]	=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/policies"
+//																specify policy as "yrn:yahoo:<service>::<tenant>:policy:<policy>"
+//																if null or undefined is specified, not update this member in role when this role exists.
+//																if '' or zero array, this member in role is set empty array.
+//			"alias":		[<role yrn full path>, ...]		=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/@"
+//																specify another role as "yrn:yahoo:<service>::<tenant>:role:<role>"
+//																if null or undefined is specified, not update this member in role when this role exists.
+//																if '' or zero array, this member in role is set empty array.
+//		}
+//	}
+//
+// [NOTE]
+// This API does not set host into roles as initial. You can add host to role
+// by another API which is an API dedicated to adding host.
+//
+const postRole = (req, res, _) => {
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.body) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.body.role)) {
+        const result = {
+            result: false,
+            message: 'POST body does not have role data'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token
+    //------------------------------
+    const token_result = k2hr3tokens_1.default.checkToken(req, true, true); // scoped, user token
+    if (!token_result.result) {
+        const result = {
+            result: token_result.result,
+            message: k2hr3apiutil_1.default.getSafeString(token_result.message),
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, token_result.status, result);
+        return;
+    }
+    const token_info = token_result.token_info;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info)) {
+        const result = {
+            result: false,
+            message: 'specified wrong token or it is not scoped user token'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check arguments
+    //------------------------------
+    // name
+    if (!k2hr3apiutil_1.default.isSafeString(req.body.role.name)) {
+        const result = {
+            result: false,
+            message: 'role:name field is wrong : ' + JSON.stringify(req.body.role.name)
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const keys = r3keys(token_info.user, token_info.tenant);
+    let name = k2hr3apiutil_1.default.getSafeString(req.body.role.name).toLowerCase();
+    // role name is only name or full yrn path
+    let nameptn = new RegExp('^' + keys.ROLE_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:role:(.*)/
+    const namematchs = name.match(nameptn);
+    if (k2hr3apiutil_1.default.isStringArray(namematchs) && k2hr3apiutil_1.default.isNotEmptyArray(namematchs) && 2 <= namematchs.length) {
+        name = namematchs[1];
+    }
+    // check name which is not full yrn
+    nameptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+    if (name.match(nameptn)) {
+        const result = {
+            result: false,
+            message: 'POST request query has wrong yrn full path to role'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    // policies
+    const policiesptn = new RegExp('^' + keys.POLICY_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:policy:(.*)/
+    const policiespram = k2hr3apiutil_1.default.getNormalizeParameter(req.body.role.policies, policiesptn, null);
+    if (false === policiespram.result) {
+        const result = {
+            result: false,
+            message: 'role:policies field is wrong : ' + JSON.stringify(req.body.role.policies)
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const policies = policiespram.parameter;
+    // alias
+    const aliasptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+    const aliaspram = k2hr3apiutil_1.default.getNormalizeParameter(req.body.role.alias, aliasptn, null);
+    if (false === aliaspram.result) {
+        const result = {
+            result: false,
+            message: 'role:alias field is wrong : ' + JSON.stringify(req.body.role.alias)
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const aliases = aliaspram.parameter;
+    //------------------------------
+    // set all field to role
+    //------------------------------
+    const role_result = k2hr3dkc_1.default.setRoleAll(token_info.user, token_info.tenant, name, policies, aliases, null, false, null, false);
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        if (!k2hr3apiutil_1.default.isPlainObject(role_result)) {
+            const result = {
+                result: false,
+                message: 'Could not get response from setRoleAll'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        else {
+            const result = {
+                result: k2hr3apiutil_1.default.isBoolean(role_result.result) ? role_result.result : false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : 'Could not get error message in response from setRoleAll'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        return;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(201); // 201: Created
+    res.send(JSON.stringify(role_result));
+};
+//
+// Sub router function for PUT CREATE ROLE
+//
+// Mountpath						: '/v1/role'
+// PUT '/v1/role{/<role{/...}>}'	: put role on version 1
+// HEADER							: X-Auth-Token	=> User token
+// response body					: result		=> true/false
+//									  message		=> messages
+// url argument
+//	"name":			<role name>						=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>"
+//														<role> can include '/' for hierarchical path
+//	"policies":		[<policy yrn full path>, ...]	=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/policies"
+//														specify policy as "yrn:yahoo:<service>::<tenant>:policy:<policy>", it is formatted by JSON.
+//														if null or undefined is specified, not update this member in role when this role exists.
+//														if '' or zero array, this member in role is set empty array.
+//	"alias":		[<role yrn full path>, ...]		=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/@"
+//														specify another role as "yrn:yahoo:<service>::<tenant>:role:<role>", it is formatted by JSON.
+//														if null or undefined is specified, not update this member in role when this role exists.
+//														if '' or zero array, this member in role is set empty array.
+//
+// [NOTE]
+// This API does not set host into roles as initial. You can add host to role
+// by another API which is an API dedicated to adding host.
+//
+const putRole = (req, res, _) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.query)) {
+        const result = {
+            result: false,
+            message: 'PUT argument does not have any data'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token
+    //------------------------------
+    const token_result = k2hr3tokens_1.default.checkToken(req, true, true); // scoped, user token
+    if (!token_result.result) {
+        const result = {
+            result: token_result.result,
+            message: k2hr3apiutil_1.default.getSafeString(token_result.message),
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, token_result.status, result);
+        return;
+    }
+    const token_info = token_result.token_info;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info)) {
+        const result = {
+            result: false,
+            message: 'specified wrong token or it is not scoped user token'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check arguments
+    //------------------------------
+    // name
+    if (!k2hr3apiutil_1.default.isSafeString(req.query.name)) {
+        const result = {
+            result: false,
+            message: 'role:name field is wrong : ' + JSON.stringify(req.query.name)
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const keys = r3keys(token_info.user, token_info.tenant);
+    let name = k2hr3apiutil_1.default.getSafeString(req.query.name).toLowerCase();
+    // role name is only name or full yrn path
+    let nameptn = new RegExp('^' + keys.ROLE_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:role:(.*)/
+    const namematchs = name.match(nameptn);
+    if (k2hr3apiutil_1.default.isStringArray(namematchs) && k2hr3apiutil_1.default.isNotEmptyArray(namematchs) && 2 <= namematchs.length) {
+        name = namematchs[1];
+    }
+    // check name which is not full yrn
+    nameptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+    if (name.match(nameptn)) {
+        const result = {
+            result: false,
+            message: 'PUT request query has wrong yrn full path to role'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    // policies
+    let policies = null;
+    if (!k2hr3apiutil_1.default.isString(req.query.policies)) {
+        policies = null;
+    }
+    else if ('' === req.query.policies) {
+        policies = '';
+    }
+    else if (k2hr3apiutil_1.default.isSafeString(req.query.policies)) {
+        // policies is encoded by JSON, this value is array.
+        //
+        let tmp_pol = k2hr3apiutil_1.default.getSafeString(req.query.policies);
+        if (k2hr3apiutil_1.default.checkSimpleJSON(tmp_pol)) {
+            tmp_pol = JSON.parse(tmp_pol);
+        }
+        const policiesptn = new RegExp('^' + keys.POLICY_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:policy:(.*)/
+        const policiespram = k2hr3apiutil_1.default.getNormalizeParameter(tmp_pol, policiesptn, null);
+        if (false === policiespram.result) {
+            const result = {
+                result: false,
+                message: 'role:policies field is wrong : ' + req.query.policies
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        policies = policiespram.parameter ?? null;
+    }
+    // alias
+    let aliases = null;
+    if (!k2hr3apiutil_1.default.isString(req.query.alias)) {
+        aliases = null;
+    }
+    else if ('' === req.query.alias) {
+        aliases = '';
+    }
+    else if (k2hr3apiutil_1.default.isSafeString(req.query.alias)) {
+        // alias is encoded by JSON, this value is array.
+        //
+        let tmp_aliases = k2hr3apiutil_1.default.getSafeString(req.query.alias);
+        if (k2hr3apiutil_1.default.checkSimpleJSON(tmp_aliases)) {
+            tmp_aliases = JSON.parse(tmp_aliases);
+        }
+        const aliasptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+        const aliaspram = k2hr3apiutil_1.default.getNormalizeParameter(tmp_aliases, aliasptn, null);
+        if (false === aliaspram.result) {
+            const result = {
+                result: false,
+                message: 'role:alias field is wrong : ' + req.query.alias
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        aliases = aliaspram.parameter ?? null;
+    }
+    //------------------------------
+    // set all field to role
+    //------------------------------
+    const role_result = k2hr3dkc_1.default.setRoleAll(token_info.user, token_info.tenant, name, policies, aliases, null, false, null, false);
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        if (!k2hr3apiutil_1.default.isPlainObject(role_result)) {
+            const result = {
+                result: false,
+                message: 'Could not get response from setRoleAll'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        else {
+            const result = {
+                result: k2hr3apiutil_1.default.isBoolean(role_result.result) ? role_result.result : false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : 'Could not get error message in response from setRoleAll'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        return;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(201); // 201: Created
+    res.send(JSON.stringify(role_result));
+};
+//
+// Sub router function for POST CREATE HOST
+//
+// Mountpath					: '/v1/role'
+// POST '/v1/role/<role{/...}>'	: post role on version 1
+// HEADER						: X-Auth-Token	=> User token or Role token
+// response body				: result		=> true/false
+//								  message		=> messages
+//
+// [UserToken] body				: 
+//	{
+//		"host":	{											=>	specified single host
+//			"host":			<hostname / ip address>			=>	key is for "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/{name, ip}/<hostname port cuk>"
+//			"port":			<port number>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//																this value is number string(0-), allowed null and '' for  this value.
+//																if this value is '0', it means any port.
+//			"cuk":			<container unique key>			=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//																this value is string. if this value is undefined/null/empty string, it means any.
+//			"extra":		<extra string data>				=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																extra is any string including Control code, allowed null and '' for  this value.
+//			"tag":			<string data>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																tag is any string including Control code, allowed null and '' for  this value.
+//			"inboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																inboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//			"outboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																outboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//		}
+//		"clear_hostname":	<true/false>
+//		"clear_ips":		<true/false>
+//	}
+//	or
+//	{
+//		"host":	[											=>	specified host as Array(only POST request has this type)
+//			{
+//				"host":			<hostname / ip address>
+//				"port":			<port number>
+//				"cuk":			<container unique key>
+//				"extra":		<extra string data>
+//				"tag":			<string data>
+//				"inboundip":	<ip address>
+//				"outboundip":	<ip address>
+//			}
+//			...
+//		]
+//		"clear_hostname":	<true/false>
+//		"clear_ips":		<true/false>
+//	}
+//
+// [RoleToken] body				:
+//	{
+//		"host":	{
+//			"port":			<port number>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/ip/<ip port cuk>"
+//																this value is number string(0-), allowed null and '' for  this value.
+//																if this value is '0', it means any port.
+//			"cuk":			<container unique key>			=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//																this value is string. if this value is undefined/null/empty string, it means any.
+//			"extra":		<extra string data>				=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																extra is any string including Control code, allowed null and '' for  this value.
+//			"tag":			<string data>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																tag is any string including Control code, allowed null and '' for  this value.
+//			"inboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																inboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//			"outboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//																outboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//		}
+//	}
+//
+// [NOTE]
+// This API only set(add/create) host into role. The host is specified hostname.
+// The hostname is any string as like hostname.(ex. "x.yahoo.co.jp", "x[0-9].yahoo.co.jp", "*.yahoo.co.jp", "*", "(.*)", etc)
+// If port number is 0, it means any port.
+// If cuk is undefined/null/empty string, it means any.
+// Extra data can include control-code(CR, etc).
+//
+const postRoleHost = (role, req, res, _) => {
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.body) ||
+        (!k2hr3apiutil_1.default.isArray(req.body.host) && !k2hr3apiutil_1.default.isPlainObject(req.body.host))) {
+        const result = {
+            result: false,
+            message: 'POST body does not have host data'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token
+    //------------------------------
+    const token_result = k2hr3tokens_1.default.checkToken(req, true); // scoped, both token
+    if (!token_result.result) {
+        const result = {
+            result: token_result.result,
+            message: k2hr3apiutil_1.default.getSafeString(token_result.message),
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, token_result.status, result);
+        return;
+    }
+    const token_info = token_result.token_info;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info)) {
+        const result = {
+            result: false,
+            message: 'specified wrong token or it is not scoped user token'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const is_host_req = (!k2hr3apiutil_1.default.isArray(req.body.host) && (!k2hr3apiutil_1.default.isPlainObject(req.body.host) || !k2hr3apiutil_1.default.isSafeString(req.body.host.host)));
+    const keys = r3keys(token_info.user, token_info.tenant);
+    //------------------------------
+    // check arguments
+    //------------------------------
+    // role name check
+    let name = k2hr3apiutil_1.default.getSafeString(role).toLowerCase();
+    let nameptn = new RegExp('^' + keys.ROLE_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:role:(.*)/
+    const namematchs = name.match(nameptn);
+    if (k2hr3apiutil_1.default.isStringArray(namematchs) && k2hr3apiutil_1.default.isNotEmptyArray(namematchs) && 2 <= namematchs.length) {
+        // name is full yrn, then reset only name.
+        name = namematchs[1];
+    }
+    else {
+        // role name is not full yrn, then check other yrn path
+        nameptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+        if (name.match(nameptn)) {
+            const result = {
+                result: false,
+                message: 'POST request url has wrong yrn full path to role'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    //------------------------------
+    // build parameters
+    //------------------------------
+    let role_result;
+    if (!is_host_req) {
+        //
+        // request from user token
+        //
+        let hostArray = [];
+        if (rawIsValTypeQueryRoleHostBaseValueArray(req.body.host)) {
+            hostArray = req.body.host;
+        }
+        else if (rawIsValTypeQueryRoleHostBaseValue(req.body.host)) {
+            hostArray = [req.body.host];
+        }
+        // check array and make ip array
+        let hostnameArray = [];
+        let ipArray = [];
+        for (let cnt = 0; cnt < hostArray.length; ++cnt) {
+            if (!k2hr3apiutil_1.default.isSafeString(hostArray[cnt].host)) {
+                const result = {
+                    result: false,
+                    message: 'host is not specified.'
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            // hostname or ip address
+            const tmp_host = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].host);
+            let tg_host = null;
+            let tg_ip = null;
+            if (k2hr3apiutil_1.default.isIpAddressString(tmp_host)) {
+                tg_ip = tmp_host.toLowerCase();
+                tg_host = null;
+            }
+            else if (k2hr3apiutil_1.default.isSafeString(tmp_host)) {
+                tg_host = tmp_host.toLowerCase();
+                tg_ip = null;
+            }
+            // port
+            let port = 0;
+            if (k2hr3apiutil_1.default.isSafeNumeric(hostArray[cnt].port)) {
+                const port_tmp = k2hr3apiutil_1.default.cvtToNumber(hostArray[cnt].port);
+                if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                    const result = {
+                        result: false,
+                        message: 'POST request has port which is not number: ' + JSON.stringify(hostArray[cnt].port)
+                    };
+                    dbglogging_1.default.elog(result.message);
+                    k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                    return;
+                }
+                port = port_tmp;
+            }
+            // cuk
+            const tmp_cuk = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].cuk).trim();
+            let cuk = null;
+            if (k2hr3apiutil_1.default.isSafeString(tmp_cuk)) {
+                cuk = tmp_cuk;
+            }
+            // extra
+            const tmp_extra = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].extra);
+            let extra = null;
+            if (k2hr3apiutil_1.default.isSafeString(tmp_extra)) {
+                extra = tmp_extra;
+            }
+            // tag
+            const tmp_tag = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].tag);
+            let tag = null;
+            if (k2hr3apiutil_1.default.isSafeString(tmp_tag)) {
+                tag = tmp_tag;
+            }
+            // set base host information
+            const host_info = {
+                hostname: tg_host,
+                ip: tg_ip,
+                port: port,
+                cuk: cuk,
+                extra: extra,
+                tag: tag,
+                inboundip: null,
+                outboundip: null
+            };
+            // set optional keys
+            if (k2hr3apiutil_1.default.isSafeString(hostArray[cnt].inboundip)) {
+                if (!k2hr3apiutil_1.default.isIpAddressString(hostArray[cnt].inboundip)) {
+                    const result = {
+                        result: false,
+                        message: 'POST request has inbound ip address which is not ignore ip address string: ' + JSON.stringify(hostArray[cnt].inboundip)
+                    };
+                    dbglogging_1.default.elog(result.message);
+                    k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                    return;
+                }
+                host_info.inboundip = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].inboundip);
+            }
+            if (k2hr3apiutil_1.default.isSafeString(hostArray[cnt].outboundip)) {
+                if (!k2hr3apiutil_1.default.isIpAddressString(hostArray[cnt].outboundip)) {
+                    const result = {
+                        result: false,
+                        message: 'POST request has outbound ip address which is not ignore ip address string: ' + JSON.stringify(hostArray[cnt].outboundip)
+                    };
+                    dbglogging_1.default.elog(result.message);
+                    k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                    return;
+                }
+                host_info.outboundip = k2hr3apiutil_1.default.getSafeString(hostArray[cnt].outboundip);
+            }
+            // push array
+            if (null !== tg_host) {
+                hostnameArray.push(host_info);
+            }
+            if (null !== tg_ip) {
+                ipArray.push(host_info);
+            }
+        }
+        if (!k2hr3apiutil_1.default.isNotEmptyArray(hostnameArray)) {
+            hostnameArray = null;
+        }
+        if (!k2hr3apiutil_1.default.isNotEmptyArray(ipArray)) {
+            ipArray = null;
+        }
+        // flags
+        let clear_hostname = false;
+        let clear_ips = false;
+        if (k2hr3apiutil_1.default.isBoolean(req.body.clear_hostname)) {
+            clear_hostname = req.body.clear_hostname;
+        }
+        if (k2hr3apiutil_1.default.isBoolean(req.body.clear_ips)) {
+            clear_ips = req.body.clear_ips;
+        }
+        //
+        // Add hostnames and ips ---> Need User Token
+        //
+        role_result = k2hr3dkc_1.default.updateRoleHosts(token_info.user, token_info.tenant, name, hostnameArray, clear_hostname, ipArray, clear_ips);
+    }
+    else {
+        //
+        // request from host(token)
+        //
+        // get ip address
+        const ip = k2hr3apiutil_1.default.getClientIpAddress(req);
+        if (!k2hr3apiutil_1.default.isSafeString(ip)) {
+            const result = {
+                result: false,
+                message: 'Could not get ip address from request.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // port
+        let port = 0;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeNumeric(req.body.host.port)) {
+            const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.body.host.port);
+            if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                const result = {
+                    result: false,
+                    message: 'POST request has port which is not number: ' + JSON.stringify(req.body.host.port)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            port = port_tmp;
+        }
+        // cuk
+        let cuk = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeString(req.body.host.cuk) && k2hr3apiutil_1.default.isSafeString(req.body.host.cuk.trim())) {
+            cuk = k2hr3apiutil_1.default.getSafeString(req.body.host.cuk).trim();
+        }
+        // extra
+        let extra = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeString(req.body.host.extra)) {
+            const extra_tmp = k2hr3apiutil_1.default.getSafeString(req.body.host.extra);
+            if (k2hr3apiutil_1.default.checkSimpleJSON(extra_tmp)) {
+                const extra_parsed_tmp = JSON.parse(extra_tmp);
+                if (!k2hr3apiutil_1.default.isSafeString(extra_parsed_tmp)) {
+                    const result = {
+                        result: false,
+                        message: 'POST request has extra which is not string: ' + JSON.stringify(req.body.host.extra)
+                    };
+                    dbglogging_1.default.elog(result.message);
+                    k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                    return;
+                }
+                extra = extra_parsed_tmp;
+            }
+            else {
+                extra = extra_tmp;
+            }
+        }
+        // tag
+        let tag = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeString(req.body.host.tag)) {
+            const tag_tmp = k2hr3apiutil_1.default.getSafeString(req.body.host.tag);
+            if (k2hr3apiutil_1.default.checkSimpleJSON(tag_tmp)) {
+                const tag_parsed_tmp = JSON.parse(tag_tmp);
+                if (!k2hr3apiutil_1.default.isSafeString(tag_parsed_tmp)) {
+                    const result = {
+                        result: false,
+                        message: 'POST request has tag which is not string: ' + JSON.stringify(req.body.host.tag)
+                    };
+                    dbglogging_1.default.elog(result.message);
+                    k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                    return;
+                }
+                tag = tag_parsed_tmp;
+            }
+            else {
+                tag = tag_tmp;
+            }
+        }
+        // inboundip(optional)
+        let inboundip = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeString(req.body.host.inboundip)) {
+            if (!k2hr3apiutil_1.default.isIpAddressString(req.body.host.inboundip)) {
+                const result = {
+                    result: false,
+                    message: 'POST request has inbound ip address which is not ignore ip address string: ' + JSON.stringify(req.body.host.inboundip)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            inboundip = k2hr3apiutil_1.default.getSafeString(req.body.host.inboundip);
+        }
+        // outboundip(optional)
+        let outboundip = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.body.host) && k2hr3apiutil_1.default.isSafeString(req.body.host.outboundip)) {
+            if (!k2hr3apiutil_1.default.isIpAddressString(req.body.host.outboundip)) {
+                const result = {
+                    result: false,
+                    message: 'POST request has outbound ip address which is not ignore ip address string: ' + JSON.stringify(req.body.host.outboundip)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            outboundip = k2hr3apiutil_1.default.getSafeString(req.body.host.outboundip);
+        }
+        //
+        // Add ip address ---> Role Token or User Token
+        //
+        role_result = k2hr3dkc_1.default.addHost(token_info.tenant, name, null, ip, port, cuk, extra, tag, inboundip, outboundip);
+    }
+    //------------------------------
+    // check result
+    //------------------------------
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        const mode_type = (is_host_req ? 'addHost' : 'updateRoleHosts');
+        if (!k2hr3apiutil_1.default.isPlainObject(role_result)) {
+            const result = {
+                result: false,
+                message: ('Could not get response from ' + mode_type)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        else {
+            const result = {
+                result: false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : ('Could not get error message in response from ' + mode_type)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        return;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(201); // 201: Created
+    res.send(JSON.stringify(role_result));
+};
+//
+// Sub router function for PUT CREATE HOST
+//
+// Mountpath						: '/v1/role'
+// PUT '/v1/role/<role{/...}>'		: put role on version 1
+// HEADER							: X-Auth-Token	=> User token or Role token
+// response body					: result		=> true/false
+//									  message		=> messages
+//
+// [UserToken] url argument
+//	"host":			<hostname or ip address>		=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/{name, ip}/<hostname port cuk>"
+//	"port":			<port number>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//														this value is number string(0-), allowed null and '' for  this value.
+//														if this value is '0', it means any port.
+//	"cuk":			<container unique key>			=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//														this value is string. if this value is undefined/null/empty string, it means any.
+//	"extra":		<extra string data>				=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														This value must be encoded by JSON.
+//														extra is any string including Control code, allowed null and '' for  this value.
+//	"tag":			<string data>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														This value must be encoded by JSON.
+//														tag is any string including Control code, allowed null and '' for  this value.
+//	"inboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														inboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//	"outboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														outboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//
+// [RoleToken] url argument
+//	"port":			<port number>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/ip/<ip port cuk>"
+//														this value is number string(0-), allowed null and '' for  this value.
+//														if this value is '0', it means any port.
+//	"cuk":			<container unique key>			=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/name/<hostname port cuk>"
+//														this value is string. if this value is undefined/null/empty string, it means any.
+//	"extra":		<extra string data>				=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														This value must be encoded by JSON.
+//														extra is any string including Control code, allowed null and '' for  this value.
+//	"tag":			<string data>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														This value must be encoded by JSON.
+//														tag is any string including Control code, allowed null and '' for  this value.
+//	"inboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														inboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//	"outboundip":	<ip address>					=>	key is "yrn:yahoo:<service>::<tenant>:role:<role>/hosts/..."
+//														outboundip is set ip address string. if you do not use proxy/gateway/bridge/etc, you do not need to set this key.
+//
+// [NOTE]
+// This API only set(add/create) host into role. Ether hostname or ip address must be specified.
+// If port number is 0, it means any port.
+// If cuk is undefined/null/empty string, it means any.
+// Extra data can include control-code(CR, etc).
+//
+const putRoleHost = (role, req, res, _) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.query)) {
+        const result = {
+            result: false,
+            message: 'PUT argument does not have any data'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token
+    //------------------------------
+    const token_result = k2hr3tokens_1.default.checkToken(req, true); // scoped, both token
+    if (!token_result.result) {
+        const result = {
+            result: token_result.result,
+            message: k2hr3apiutil_1.default.getSafeString(token_result.message),
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, token_result.status, result);
+        return;
+    }
+    const token_info = token_result.token_info;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info)) {
+        const result = {
+            result: false,
+            message: 'specified wrong token or it is not scoped user token'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    const is_host_req = !k2hr3apiutil_1.default.isSafeString(req.query.host);
+    const keys = r3keys(token_info.user, token_info.tenant);
+    //------------------------------
+    // check arguments
+    //------------------------------
+    // role name check
+    let name = k2hr3apiutil_1.default.getSafeString(role).toLowerCase();
+    let nameptn = new RegExp('^' + keys.ROLE_TOP_KEY + ':(.*)'); // regex = /^yrn:yahoo:<service>::<tenant>:role:(.*)/
+    const namematchs = name.match(nameptn);
+    if (k2hr3apiutil_1.default.isStringArray(namematchs) && k2hr3apiutil_1.default.isNotEmptyArray(namematchs) && 2 <= namematchs.length) {
+        // name is full yrn, then reset only name.
+        name = namematchs[1];
+    }
+    else {
+        // role name is not full yrn, then check other yrn path
+        nameptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+        if (name.match(nameptn)) {
+            const result = {
+                result: false,
+                message: 'POST request url has wrong yrn full path to role'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    // hostname
+    let hostname = null;
+    let ip = null;
+    if (!is_host_req) {
+        if (!k2hr3apiutil_1.default.isSafeString(req.query.host)) {
+            const result = {
+                result: false,
+                message: 'host is not specified.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        const tg_host = k2hr3apiutil_1.default.getSafeString(req.query.host);
+        if (k2hr3apiutil_1.default.isIpAddressString(tg_host)) {
+            ip = tg_host.toLowerCase();
+        }
+        else {
+            hostname = tg_host.toLowerCase();
+        }
+    }
+    else {
+        // get ip address
+        ip = k2hr3apiutil_1.default.getClientIpAddress(req);
+        if (!k2hr3apiutil_1.default.isSafeString(ip)) {
+            const result = {
+                result: false,
+                message: 'Could not get ip address from request.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    // port
+    let port;
+    if (k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+        const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+        if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+            const result = {
+                result: false,
+                message: 'PUT request has port which is not number: ' + JSON.stringify(req.query.port)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        port = port_tmp;
+    }
+    else {
+        port = 0; // default any
+    }
+    // cuk
+    let cuk = null;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.cuk) && k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+        cuk = k2hr3apiutil_1.default.getSafeString(req.query.cuk).trim();
+    }
+    // extra
+    let extra = null;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.extra)) {
+        const extra_tmp = k2hr3apiutil_1.default.getSafeString(req.query.extra);
+        if (k2hr3apiutil_1.default.checkSimpleJSON(extra_tmp)) {
+            const extra_parsed_tmp = JSON.parse(extra_tmp); // extra encoded JSON
+            if (!k2hr3apiutil_1.default.isSafeString(extra_parsed_tmp)) {
+                const result = {
+                    result: false,
+                    message: 'PUT request has extra which is not string: ' + JSON.stringify(req.query.extra)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            extra = extra_parsed_tmp;
+        }
+        else {
+            extra = extra_tmp;
+        }
+    }
+    // tag
+    let tag = null;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.tag)) {
+        const tag_tmp = k2hr3apiutil_1.default.getSafeString(req.query.tag);
+        if (k2hr3apiutil_1.default.checkSimpleJSON(tag_tmp)) {
+            const tag_parsed_tmp = JSON.parse(tag_tmp); // tag encoded JSON
+            if (!k2hr3apiutil_1.default.isSafeString(tag_parsed_tmp)) {
+                const result = {
+                    result: false,
+                    message: 'PUT request has tag which is not string: ' + JSON.stringify(req.body.host.tag)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            tag = tag_parsed_tmp;
+        }
+        else {
+            tag = tag_tmp;
+        }
+    }
+    // make base host information
+    const host_info = {
+        hostname: hostname,
+        ip: ip,
+        port: port,
+        cuk: cuk,
+        extra: extra,
+        tag: tag,
+        inboundip: null,
+        outboundip: null
+    };
+    // set inboundip(optional)
+    let inboundip = null;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.inboundip)) {
+        if (!k2hr3apiutil_1.default.isIpAddressString(req.query.inboundip)) {
+            const result = {
+                result: false,
+                message: 'PUT request has inbound ip address which is not ignore ip address string: ' + JSON.stringify(req.query.inboundip)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        inboundip = k2hr3apiutil_1.default.getSafeString(req.query.inboundip);
+        host_info.inboundip = inboundip;
+    }
+    // set outboundip(optional)
+    let outboundip = null;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.outboundip)) {
+        if (!k2hr3apiutil_1.default.isIpAddressString(req.query.outboundip)) {
+            const result = {
+                result: false,
+                message: 'PUT request has outbound ip address which is not ignore ip address string: ' + JSON.stringify(req.query.outboundip)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        outboundip = k2hr3apiutil_1.default.getSafeString(req.query.outboundip);
+        host_info.outboundip = outboundip;
+    }
+    //------------------------------
+    // add host to role
+    //------------------------------
+    let role_result;
+    if (!is_host_req) {
+        // Add hostname ---> Need User Token
+        if (null === ip) {
+            role_result = k2hr3dkc_1.default.updateRoleHosts(token_info.user, token_info.tenant, name, host_info);
+        }
+        else {
+            role_result = k2hr3dkc_1.default.updateRoleHosts(token_info.user, token_info.tenant, name, null, false, host_info);
+        }
+    }
+    else {
+        // Add ip address ---> Role Token or User Token
+        role_result = k2hr3dkc_1.default.addHost(token_info.tenant, name, null, ip, port, cuk, extra, tag, inboundip, outboundip);
+    }
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        const mode_type = (is_host_req ? 'addHost' : 'updateRoleHosts');
+        if (!k2hr3apiutil_1.default.isSafeEntity(role_result)) {
+            const result = {
+                result: false,
+                message: ('Could not get response from ' + mode_type)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        else {
+            const result = {
+                result: false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : ('Could not get error message in response from ' + mode_type)
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        }
+        return;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(201); // 201: Created
+    res.send(JSON.stringify(role_result));
+};
+//---------------------------------------------------------
+// Router GET
+//---------------------------------------------------------
+//
+// Mountpath							: '/v1/role/<role{/...}>'
+//
+// GET '/v1/role/<role{/...}>'			: get role on version 1
+// HEADER								: X-Auth-Token	=> User token
+// URL arguments						: expand		=> "true"(default) or "false"
+// response								:	{
+//												"result":	true or false
+//												"message":	error message
+//												"role":	{
+//													policies:	array,
+//													aliases:	array					<--- only not expand
+//													hosts: {							<--- only not expand
+//														'hostnames': [					hostname array or empty array
+//															<hostname> <port> <cuk> <extra> <tag>,	(if any port, port is *)
+//															...
+//														],
+//														'ips': [						ip address array or empty array
+//															<ip address> <port> <cuk> <extra> <tag>,(if any port, port is *)
+//															...
+//														]
+//													}
+//												}
+//											}
+//
+// GET '/v1/role/token/<role{/...}>'	: get role token on version 1
+// HEADER								: X-Auth-Token	=> User token or Role token
+// URL arguments						: expire	=> "expire time(unix time value)" or undefined(default 24H)
+// response								:	{
+//												"result":		true or false
+//												"message":		error message
+//												"token":		"role token"
+//												"registerpath":	"path for registering"
+//											}
+//
+// GET '/v1/role/token/list/<role{/...}>': get list of role tokens on version 1
+// HEADER								: X-Auth-Token	=> User token
+// URL arguments						: expand		=> "true"(default) or "false"
+// response								:	{
+//												result:		true/false
+//												message:	null or error message string
+//												tokens:	{
+//													"token": {
+//														date:		create date(UTC ISO 8601)
+//														expire:		expire date(UTC ISO 8601)
+//														user:		user name if user created this token
+//														hostname:	hostname if this token was created by host(name)
+//														ip:			ip address if this token was created by ip
+//														port:		port number, if specified port when created token
+//														cuk:		cuk, if specified cuk when created token
+//													},
+//													...
+//												}
+// 											}
+//											or
+//											{
+//												result:		true/false
+//												message:	null or error message string
+//												tokens: [
+//													"role token",
+//													....
+//												]
+// 											}
+//
+// This mount point is for creating(update) role or creating(update) host in role.
+// And get role token by host(ip address) or user(user token), update role token by
+// role token.
+//
+router.get('/', (req, res, next) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    if ('GET' !== req.method) {
+        // HEAD request comes here, so it should be routed to head function.
+        next();
+        return;
+    }
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        const result = {
+            result: false,
+            message: 'GET request or url is wrong'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token for API mode
+    //------------------------------
+    let token_str = null;
+    let token_type = null;
+    let token_info = null;
+    let keys = r3keys();
+    if (k2hr3tokens_1.default.hasAuthTokenHeader(req)) {
+        const token_result = k2hr3tokens_1.default.checkToken(req, true); // scoped, both token
+        if (!token_result.result) {
+            const result = {
+                result: token_result.result,
+                message: k2hr3apiutil_1.default.getSafeString(token_result.message),
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, token_result.status, result);
+            return;
+        }
+        if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_result.token_info)) {
+            const result = {
+                result: false,
+                message: 'specified wrong token or it is not scoped user token'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        token_info = token_result.token_info;
+        token_str = token_result.token ?? null;
+        token_type = token_result.token_type ?? null;
+        keys = r3keys(token_info.user, token_info.tenant);
+    }
+    //------------------------------
+    // get role name
+    //------------------------------
+    // check get token type and parse role name
+    let is_get_token = false;
+    let is_get_list = false;
+    let requestptn = new RegExp(keys.MATCH_URI_GET_RTOKEN_LIST); // regex = /^\/v1\/role\/token\/list\/(.*)/
+    let reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+    if (k2hr3apiutil_1.default.isStringArray(reqmatchs) && k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) && 2 <= reqmatchs.length && '' !== k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+        // get list of tokens
+        is_get_list = true;
+    }
+    else {
+        // recheck
+        requestptn = new RegExp(keys.MATCH_URI_GET_RTOKEN); // regex = /^\/v1\/role\/token\/(.*)/
+        reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+        if (k2hr3apiutil_1.default.isStringArray(reqmatchs) && k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) && 2 <= reqmatchs.length && '' !== k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+            // get token
+            is_get_token = true;
+        }
+        else {
+            // retry parse role name
+            requestptn = new RegExp(keys.MATCH_URI_GET_ROLE_DATA); // regex = /^\/v1\/role\/(.*)/
+            reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+            if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+                const result = {
+                    result: false,
+                    message: 'GET request url does not have role name'
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+        }
+    }
+    // check role name is only name or full yrn path
+    let name = reqmatchs[1].toLowerCase();
+    let nameptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+    const namematchs = name.match(nameptn);
+    if (!k2hr3apiutil_1.default.isStringArray(namematchs) || !k2hr3apiutil_1.default.isNotEmptyArray(namematchs) || namematchs.length < 4) {
+        //
+        // name is not full yrn to role, then check wrong role name
+        //
+        nameptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+        if (name.match(nameptn)) {
+            const result = {
+                result: false,
+                message: 'GET request query has wrong yrn full path to role'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // role name is not full yrn, we need tenant name
+        if (!k2hr3apiutil_1.default.isSafeString(keys.ROLE_TOP_KEY)) {
+            const result = {
+                result: false,
+                message: 'GET request role name which is not full yrn, and not token. role name must be full yrn, if token is not specified.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // make full yrn for role name
+        name = keys.ROLE_TOP_KEY + ':' + name;
+    }
+    else {
+        //
+        // name is full yrn to role.
+        // need to check tenant name when token is specified.
+        //
+        if (k2hr3apiutil_1.default.isSafeString(token_type) && (!k2hr3apiutil_1.default.isPlainObject(token_info) || !k2hr3apiutil_1.default.isSafeString(token_info.tenant) || !k2hr3apiutil_1.default.compareCaseString(namematchs[2], token_info.tenant))) {
+            const result = {
+                result: false,
+                message: 'GET request query has wrong tenant yrn full path(tenant=' + namematchs[2] + ') or not specify tenant.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    // Run
+    if (is_get_token) {
+        //------------------------------
+        // GET ROLE TOKEN
+        //------------------------------
+        // token_info:	null(undefined)	=> not specify token, put token by host ip address
+        //				user token		=> put token by user
+        //				role token		=> update token by role
+        //
+        getRoleToken(name, token_info, token_type, token_str, req, res);
+    }
+    else if (is_get_list) {
+        //------------------------------
+        // GET LIST OF ROLE TOKENS
+        //------------------------------
+        if ('user' === k2hr3apiutil_1.default.getSafeString(token_type)) {
+            getListRoleTokens(name, token_info, req, res);
+        }
+        else {
+            const result = {
+                result: false,
+                message: 'GET request without UserToken for getting list of role(' + name + ') tokens, need User Token.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    else {
+        //------------------------------
+        // GET ROLE DATA
+        //------------------------------
+        if ('user' === k2hr3apiutil_1.default.getSafeString(token_type) && k2hr3apiutil_1.default.isPlainObject(token_info)) {
+            getRole(name, token_info, req, res);
+        }
+        else {
+            const result = {
+                result: false,
+                message: 'GET request without UserToken for getting role(' + name + '), need User Token.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+});
+//
+// Sub router function for GET ROLE DATA
+//
+// Mountpath						:	'/v1/role/<role{/...}>'
+//
+// GET '/v1/role/<role{/...}>'		:	get role on version 1
+// HEADER							:	X-Auth-Token	=> User token
+// URL arguments					:	expand			=> "true"(default) or "false"
+// response							:	{
+//											"result":	true or false
+//											"message":	error message
+//											"role":	{
+//												policies:	array,
+//												aliases:	array								<--- only not expand
+//												hosts: {										<--- only not expand
+//													'hostnames': [								hostname array or empty array
+//														<hostname> <port> <cuk> <extra> <tag>,	(if any port, port is *)
+//														...
+//													],
+//													'ips': [									ip address array or empty array
+//														<ip address> <port> <cuk> <extra> <tag>,(if any port, port is *)
+//														...
+//													]
+//												}
+//											}
+//										}
+//
+// This mount point is for creating(update) role or creating(update) host in role.
+//
+const getRole = (role, token_info, req, res) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.query)) {
+        const result = {
+            result: false,
+            message: 'GET request query is wrong'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    if (!k2hr3apiutil_1.default.isSafeString(role) ||
+        !k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info) ||
+        !k2hr3apiutil_1.default.isSafeString(token_info.user) ||
+        !k2hr3apiutil_1.default.isSafeString(token_info.tenant)) {
+        const result = {
+            result: false,
+            message: 'GET request is failure by internal error.'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 500, result); // 500: Internal Error
+        return;
+    }
+    //------------------------------
+    // check arguments
+    //------------------------------
+    const keys = r3keys(token_info.user, token_info.tenant);
+    // expand type
+    let is_expand = true;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.expand)) {
+        if (k2hr3apiutil_1.default.compareCaseString(keys.VALUE_TRUE, req.query.expand)) {
+            is_expand = true;
+        }
+        else if (k2hr3apiutil_1.default.compareCaseString(keys.VALUE_FALSE, req.query.expand)) {
+            is_expand = false;
+        }
+        else {
+            const result = {
+                result: false,
+                message: 'GET expand url argument parameter(' + JSON.stringify(req.query.expand) + ') is wrong, it must be ' + keys.VALUE_TRUE + ' or ' + keys.VALUE_FALSE + '.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    //------------------------------
+    // get role
+    //------------------------------
+    const role_result = k2hr3dkc_1.default.getRole(role, is_expand);
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        if (!k2hr3apiutil_1.default.isPlainObject(role_result)) {
+            const result = {
+                result: false,
+                message: 'Could not get response from getRole'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        else {
+            const result = {
+                result: false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : 'Could not get error message in response from getRole'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        return;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(200); // 200: OK
+    res.send(JSON.stringify(role_result));
+};
+//
+// Sub router function for GET ROLE TOKEN
+//
+// Mountpath							: '/v1/role/<role{/...}>'
+//
+// GET '/v1/role/token/<role{/...}>'	: get role on version 1
+// HEADER								: X-Auth-Token	=> undefined User token or Role token
+// URL arguments						: expire	=> "expire time(unix time value)" or undefined(default 24H)
+//														if 0 is specified, no expire.
+// response								:	{
+//												"result":		true or false
+//												"message":		error message
+//												"token":		"role token"
+//												"registerpath":	"path for registering"
+//											}
+//
+// This mount point is for creating(update) role or creating(update) host in role.
+//
+const getRoleToken = (role, token_info, token_type, token_str, req, res) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isSafeString(role)) {
+        const result = {
+            result: false,
+            message: 'GET request is failure by internal error.'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 500, result); // 500: Internal Error
+        return;
+    }
+    //------------------------------
+    // tenant/role name/client ip
+    //------------------------------
+    let tenant;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info) || !k2hr3apiutil_1.default.isSafeString(token_info.tenant)) {
+        // parse role yrn path to tenant and role name
+        const keys = r3keys();
+        const nameptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+        const namematchs = role.match(nameptn);
+        if (!k2hr3apiutil_1.default.isStringArray(namematchs) || !k2hr3apiutil_1.default.isNotEmptyArray(namematchs) || namematchs.length < 4) {
+            // role is not full yrn
+            const result = {
+                result: false,
+                message: 'GET request is failure by internal error(role yrn path is broken).'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 500, result); // 500: Internal Error
+            return;
+        }
+        tenant = namematchs[2];
+    }
+    else {
+        tenant = token_info.tenant;
+    }
+    // client ip
+    const clientip = k2hr3apiutil_1.default.getClientIpAddress(req);
+    if (!k2hr3apiutil_1.default.isSafeString(clientip)) {
+        const result = {
+            result: false,
+            message: 'GET request does not have ip address for client.'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    // date/expire
+    let token_date = '';
+    if (k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info) && k2hr3apiutil_1.default.isSafeString(token_info.date)) {
+        token_date = token_info.date;
+    }
+    let token_expire = '';
+    if (k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info) && k2hr3apiutil_1.default.isSafeString(token_info.expire)) {
+        token_expire = token_info.expire;
+    }
+    //------------------------------
+    // get role token
+    //------------------------------
+    let rtoken_result;
+    if (!k2hr3apiutil_1.default.isSafeString(token_type)) {
+        // no token
+        let port = 0;
+        if (k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+            const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+            if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                const result = {
+                    result: false,
+                    message: 'GET request has port which is not number: ' + JSON.stringify(req.query.port)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            port = port_tmp;
+        }
+        // check cuk parameter
+        let cuk = null;
+        if (k2hr3apiutil_1.default.isSafeString(req.query.cuk) && k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+            cuk = k2hr3apiutil_1.default.getSafeString(req.query.cuk).trim();
+        }
+        rtoken_result = k2hr3tokens_1.default.getRoleTokenByIP(clientip, port, cuk, tenant, role, expire_rtoken); // strict checking port/cuk
+    }
+    else if ('role' === k2hr3apiutil_1.default.getSafeString(token_type)) {
+        // role token
+        if (!k2hr3apiutil_1.default.compareRequestIpAddress(req, (null !== token_info ? k2hr3apiutil_1.default.getSafeString(token_info.ip) : ''))) {
+            // wrong ip address in token
+            const result = {
+                result: false,
+                message: 'GET request ip address and role token are not same.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+        // set expire time as same as old token
+        let expire = k2hr3apiutil_1.default.getExpireUnixtimeFromISOStrings(token_date, token_expire);
+        if (0 >= expire) {
+            expire = expire_rtoken;
+        }
+        // using port/cuk from token inforamtion
+        rtoken_result = k2hr3tokens_1.default.getRoleTokenByIP(clientip, (null !== token_info ? token_info.port : null), (null !== token_info ? token_info.cuk : null), tenant, role, expire); // strict checking port/cuk
+        // if succeed to get new role token, remove old token
+        if (k2hr3apiutil_1.default.isPlainObject(rtoken_result) && k2hr3apiutil_1.default.isBoolean(rtoken_result.result) && rtoken_result.result) {
+            const rm_result = k2hr3tokens_1.default.removeRoleTokenByIP(token_str, clientip, (null !== token_info ? token_info.port : null), (null !== token_info ? token_info.cuk : null));
+            if (!k2hr3apiutil_1.default.isPlainObject(rm_result) || !k2hr3apiutil_1.default.isBoolean(rm_result.result) || false === rm_result.result) {
+                dbglogging_1.default.wlog('could not remove old role token(' + token_str + '), but continue...');
+            }
+        }
+    }
+    else if ('user' === k2hr3apiutil_1.default.getSafeString(token_type)) {
+        // user token
+        // expire
+        let expire = expire_rtoken; // expire default is 24H
+        if (k2hr3apiutil_1.default.isSafeNumeric(req.query.expire)) {
+            const tmpExp = k2hr3apiutil_1.default.cvtToNumber(req.query.expire);
+            if (!k2hr3apiutil_1.default.isSafeNumber(tmpExp)) {
+                const result = {
+                    result: false,
+                    message: 'GET request has expire which is not number: ' + JSON.stringify(req.query.expire)
+                };
+                dbglogging_1.default.elog(result.message);
+                k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+                return;
+            }
+            if (0 == tmpExp) {
+                expire = expire_reg_rtoken; // If 0 is specified, it means no expire
+            }
+            else {
+                expire = tmpExp;
+            }
+        }
+        rtoken_result = k2hr3tokens_1.default.getRoleTokenByUser((null !== token_info ? token_info.user : null), tenant, role, expire);
+    }
+    else {
+        // broken token
+        const result = {
+            result: false,
+            message: 'GET request is failure by internal error(token data broken).'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 500, result); // 500: Internal Error
+        return;
+    }
+    // check result
+    if (!k2hr3apiutil_1.default.isPlainObject(rtoken_result) || !k2hr3apiutil_1.default.isBoolean(rtoken_result.result) || false === rtoken_result.result) {
+        if (!k2hr3apiutil_1.default.isPlainObject(rtoken_result)) {
+            const result = {
+                result: false,
+                message: 'Could not get role token.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        else {
+            const result = {
+                result: false,
+                message: k2hr3apiutil_1.default.isString(rtoken_result.message) ? rtoken_result.message : 'Could not get error message in response from get role token'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        return;
+    }
+    // create url parameter(path) for registering role member
+    //
+    const regparamobj = {
+        role: role,
+        token: rtoken_result.token
+    };
+    const udproc = new k2hr3userdata_1.default();
+    const regparamstr = udproc.encryptRoleInfo(regparamobj);
+    if (!k2hr3apiutil_1.default.isSafeString(regparamstr)) {
+        const result = {
+            result: false,
+            message: 'Could not create register url parameter with role token.'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        return;
+    }
+    const res_result = {
+        result: rtoken_result.result,
+        message: rtoken_result.message,
+        token: rtoken_result.token,
+        registerpath: regparamstr
+    };
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(res_result.message));
+    res.status(200); // 200: OK
+    res.send(JSON.stringify(res_result));
+};
+//
+// Sub router function for GET LIST OF ROLE TOKENS
+//
+// Mountpath								: '/v1/role/list/token/<role{/...}>'
+//
+// GET '/v1/role/token/list/<role{/...}>'	: get list of role tokens on version 1
+// HEADER									: X-Auth-Token	=> User token
+// URL arguments							: expand		=> "true"(default) or "false"
+//
+// response									:	{
+//													result:		true/false
+//													message:	null or error message string
+//													tokens:	{
+//														"token": {
+//															date:			create date(UTC ISO 8601)
+//															expire:			expire date(UTC ISO 8601)
+//															user:			user name if user created this token
+//															hostname:		hostname if this token was created by host(name)
+//															ip:				ip address if this token was created by ip
+//															port:			port number, if specified port when created token
+//															cuk:			cuk, if specified cuk when created token
+//															registerpath:	register path in user data script
+//														},
+//														...
+//													}
+// 												}
+//												or
+//												{
+//													result:		true/false
+//													message:	null or error message string
+//													tokens: [
+//														"role token",
+//														....
+//													]
+// 												}
+//
+// This mount point is for listing of all role tokens in role.
+//
+const getListRoleTokens = (role, token_info, req, res) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isPlainObject(req.query)) {
+        const result = {
+            result: false,
+            message: 'GET request query is wrong'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check arguments
+    //------------------------------
+    const keys = r3keys();
+    let expand = true;
+    if (k2hr3apiutil_1.default.isSafeString(req.query.expand)) {
+        if (k2hr3apiutil_1.default.compareCaseString(keys.VALUE_TRUE, req.query.expand)) {
+            expand = true;
+        }
+        else if (k2hr3apiutil_1.default.compareCaseString(keys.VALUE_FALSE, req.query.expand)) {
+            expand = false;
+        }
+        else {
+            const result = {
+                result: false,
+                message: 'GET expand url argument parameter(' + JSON.stringify(req.query.expand) + ') is wrong, it must be ' + keys.VALUE_TRUE + ' or ' + keys.VALUE_FALSE + '.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 400, result); // 400: Bad Request
+            return;
+        }
+    }
+    // check token
+    if (!k2hr3apiutil_1.default.isSafeString(role) ||
+        !k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info) ||
+        !k2hr3apiutil_1.default.isSafeString(token_info.user) ||
+        !k2hr3apiutil_1.default.isSafeString(token_info.tenant)) {
+        const result = {
+            result: false,
+            message: 'GET request is failure by internal error.'
+        };
+        dbglogging_1.default.elog(result.message);
+        k2hr3resutil_1.default.errResponse(req, res, 500, result); // 500: Internal Error
+        return;
+    }
+    //------------------------------
+    // get list of role tokens
+    //------------------------------
+    const role_result = k2hr3tokens_1.default.getListRoleTokens(role, token_info.tenant, expand);
+    // check result
+    if (!k2hr3apiutil_1.default.isPlainObject(role_result) || !k2hr3apiutil_1.default.isBoolean(role_result.result) || false === role_result.result) {
+        if (!k2hr3apiutil_1.default.isPlainObject(role_result)) {
+            const result = {
+                result: false,
+                message: 'Could not get role token list.'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        else {
+            const result = {
+                result: false,
+                message: k2hr3apiutil_1.default.isString(role_result.message) ? role_result.message : 'Could not get error message in response from get role token list'
+            };
+            dbglogging_1.default.elog(result.message);
+            k2hr3resutil_1.default.errResponse(req, res, 404, result); // 404: Not Found
+        }
+        return;
+    }
+    // add register path into each role token elements
+    if (expand && k2hr3tokens_1.default.isResTypeObjRoleTokens(role_result.tokens)) {
+        Object.keys(role_result.tokens).forEach((oneToken) => {
+            const regparamobj = {
+                role: role,
+                token: oneToken
+            };
+            const udproc = new k2hr3userdata_1.default();
+            const regparamstr = udproc.encryptRoleInfo(regparamobj);
+            if (!k2hr3apiutil_1.default.isSafeString(regparamstr) || !k2hr3tokens_1.default.isResTypeObjRoleTokens(role_result.tokens)) { // need to check type again(because scope is not same)
+                dbglogging_1.default.elog('Could not create register url parameter with role token(' + JSON.stringify(oneToken) + '), but continue...');
+            }
+            else {
+                role_result.tokens[oneToken].registerpath = regparamstr;
+            }
+        });
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(role_result.message));
+    res.status(200); // 200: OK
+    res.send(JSON.stringify(role_result));
+};
+//---------------------------------------------------------
+// Router HEAD
+//---------------------------------------------------------
+//
+// Mountpath							: '/v1/role/<role{/...}>'
+//
+// HEAD '/v1/role/<role{/...}>'			: head role on version 1
+// HEADER								: X-Auth-Token	=> User token or Role token or undefined
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// This mount point is for checking role existing or validation for role token/host ip address in role.
+//
+router.head('/', (req, res, next) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    if ('HEAD' !== req.method) {
+        // If other method request comes here, so it should be routed another function.
+        next();
+        return;
+    }
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        dbglogging_1.default.elog('HEAD request or url or query is wrong');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return;
+    }
+    //------------------------------
+    // check token for API mode
+    //------------------------------
+    let token_str = null;
+    let token_type = null;
+    let token_info = null;
+    let keys = r3keys();
+    if (k2hr3tokens_1.default.hasAuthTokenHeader(req)) {
+        const token_result = k2hr3tokens_1.default.checkToken(req, true); // scoped, both token
+        if (!token_result.result) {
+            dbglogging_1.default.elog(token_result.message);
+            k2hr3resutil_1.default.errResponse(req, res, token_result.status);
+            return;
+        }
+        if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_result.token_info)) {
+            dbglogging_1.default.elog('specified wrong token or it is not scoped user token');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return;
+        }
+        token_info = token_result.token_info;
+        token_str = token_result.token ?? null;
+        token_type = token_result.token_type ?? null;
+        keys = r3keys(token_info.user, token_info.tenant);
+    }
+    //------------------------------
+    // get role name
+    //------------------------------
+    // check get token type and parse role name
+    const requestptn = new RegExp(keys.MATCH_URI_GET_ROLE_DATA); // regex = /^\/v1\/role\/(.*)/
+    const reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+    if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+        dbglogging_1.default.elog('HEAD request url does not have role name');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return;
+    }
+    // check role name is only name or full yrn path and tenant name
+    let tenantname;
+    let rolename;
+    let roleyrn = reqmatchs[1].toLowerCase();
+    let roleyrnptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+    const roleyrnmatchs = roleyrn.match(roleyrnptn);
+    if (!k2hr3apiutil_1.default.isStringArray(roleyrnmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(roleyrnmatchs) || roleyrnmatchs.length < 4) {
+        //
+        // roleyrn is not full yrn to role, then check wrong role name
+        //
+        roleyrnptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+        if (roleyrn.match(roleyrnptn)) {
+            dbglogging_1.default.elog('HEAD request query has wrong yrn full path to role');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return;
+        }
+        // roleyrn is not full yrn, we need tenant name
+        if (!k2hr3apiutil_1.default.isSafeString(keys.ROLE_TOP_KEY)) {
+            dbglogging_1.default.elog('HEAD request role name which is not full yrn, and not token. role name must be full yrn, if token is not specified.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return;
+        }
+        // make full yrn for role, and set tenant name/role name.
+        tenantname = (k2hr3apiutil_1.default.isPlainObject(token_info) && k2hr3apiutil_1.default.isSafeString(token_info.tenant)) ? token_info.tenant : null;
+        rolename = roleyrn;
+        roleyrn = keys.ROLE_TOP_KEY + ':' + roleyrn;
+    }
+    else {
+        //
+        // roleyrn is full yrn to role.
+        // need to check tenant name when token is specified.
+        //
+        if (null !== token_type && (!k2hr3apiutil_1.default.isPlainObject(token_info) || !k2hr3apiutil_1.default.isSafeString(token_info.tenant) || !k2hr3apiutil_1.default.compareCaseString(roleyrnmatchs[2], token_info.tenant))) {
+            dbglogging_1.default.elog('HEAD request query has wrong tenant yrn full path(tenant=' + roleyrnmatchs[2] + ') or not specify tenant.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return;
+        }
+        // set tenant name/role name.
+        tenantname = roleyrnmatchs[2];
+        rolename = roleyrnmatchs[3];
+    }
+    //------------------------------
+    // Run
+    //------------------------------
+    if (!k2hr3apiutil_1.default.isSafeString(token_type)) {
+        // check host ip address in role
+        const clientip = k2hr3apiutil_1.default.getClientIpAddress(req);
+        if (!k2hr3apiutil_1.default.isSafeString(clientip)) {
+            dbglogging_1.default.elog('HEAD request does not have ip address for client.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return;
+        }
+        // port
+        let tg_port = 0;
+        if (k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+            const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+            if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                dbglogging_1.default.elog('HEAD request has port which is not number: ' + JSON.stringify(req.query.port));
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return;
+            }
+            tg_port = port_tmp;
+        }
+        // cuk
+        let tg_cuk = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.query) && k2hr3apiutil_1.default.isSafeString(req.query.cuk) && k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+            tg_cuk = req.query.cuk.trim();
+        }
+        // find host
+        const find_result = k2hr3dkc_1.default.findHost(tenantname, rolename, null, clientip, tg_port, tg_cuk, false); // not strictly checking
+        // result
+        if (!find_result.result) {
+            dbglogging_1.default.elog('HEAD request failure - check host ip(' + clientip + ') address in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+            k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+            return;
+        }
+        else {
+            dbglogging_1.default.dlog('HEAD request succeed - check host ip(' + clientip + ') address in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+            res.status(204); // 204: No Content
+        }
+    }
+    else if ('role' === k2hr3apiutil_1.default.getSafeString(token_type)) {
+        // check role token
+        const check_result = k2hr3tokens_1.default.checkToken(req, true, false); // recheck - scoped, both token
+        // result
+        if (!check_result.result) {
+            dbglogging_1.default.elog('HEAD request failure - check role token(' + JSON.stringify(token_str) + ') : ' + k2hr3apiutil_1.default.getSafeString(check_result.message));
+            k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+            return;
+        }
+        else {
+            dbglogging_1.default.dlog('HEAD request succeed - check role token(' + JSON.stringify(token_str) + ')');
+            res.status(204); // 204: No Content
+        }
+    }
+    else if ('user' === k2hr3apiutil_1.default.getSafeString(token_type)) {
+        // check role exist
+        const role_result = k2hr3dkc_1.default.getRole(roleyrn, true);
+        // result
+        if (!role_result.result) {
+            dbglogging_1.default.elog('HEAD request failure - check role(' + roleyrn + ') exist');
+            k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+            return;
+        }
+        else {
+            dbglogging_1.default.dlog('HEAD request succeed - check role(' + roleyrn + ') exists');
+            res.status(204); // 204: No Content
+        }
+    }
+    else {
+        // broken token
+        dbglogging_1.default.elog('HEAD request is failure by internal error(token data broken).');
+        k2hr3resutil_1.default.errResponse(req, res, 500); // 500: Internal Error
+        return;
+    }
+    res.send();
+});
+//---------------------------------------------------------
+// Router DELETE
+//---------------------------------------------------------
+//
+// Mountpath							: '/v1/role/<role{/...}>'
+//
+// DELETE '/v1/role/<role{/...}>'		: delete role member host on version 1
+// HEADER								: X-Auth-Token	=> undefined
+// URL arguments
+//	"port":	<port number>				: this value is number string(0-), allowed null and '' for  this value.
+//	"cuk":	<container unique key>		: this value is string. if this value is undefined/null/empty string, it means any.
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// The role's host member removes itself from the role without any token.
+// Whether a role member is a host is automatically determined by client ip, port, and cuk.
+//
+//
+// DELETE '/v1/role/<role{/...}>'		: delete role token on version 1
+// HEADER								: X-Auth-Token	=> Role token
+// URL arguments						: n/a
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// Delete the role token by role token.
+//
+//
+// DELETE '/v1/role/<role{/...}>'		: delete role member hosts or ip addresses on version 1
+// HEADER								: X-Auth-Token	=> User Scoped token
+// URL arguments
+//	"host":	<string, JSON string array>	: this value is string for one IP address, or string array encoded JSON string
+//										  for IP addresses.
+//	"port":	<port number>				: this value is number string(0-), allowed null and '' for  this value.
+//	"cuk":	<container unique key>		: this value is string. if this value is undefined/null/empty string, it means any.
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// Delete the role host(ip address)s member.
+//
+//
+// DELETE '/v1/role/<role{/...}>'		: delete role member hosts or ip addresses on version 1
+// HEADER								: X-Auth-Token	=> User Scoped token
+// URL arguments						: n/a
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// Delete the role.
+//
+//---------------------------------------------------------
+//
+// Mountpath							: '/v1/role/token/<role token>'
+//
+// DELETE '/v1/role/token/<role token>'	: delete role token on version 1
+// HEADER								: X-Auth-Token	=> User Scoped token
+// URL arguments						: undefined
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+// Delete the role token by user.
+//
+//---------------------------------------------------------
+//
+// Mountpath							: '/v1/role'
+//
+// DELETE '/v1/role'					: delete role member by cuk on version 1
+// URL arguments
+//	"cuk":	<container unique key>		: this value is string.
+//										  Specify the Container Unique Id to be deleted.
+//										  Role members associated with this Id will be deleted.
+//	"host":	<string, JSON string array>	: this value is string for one IP address, or string array encoded JSON string
+//										  for IP addresses.
+// response								: nothing
+// response status code					: 204 or 4xx/5xx
+//
+//
+// This mount point is for deleting ip addresses from roles by container unique key which includes ip addresses.
+// The requester must be role member which is allowed to access this mount point for removing IP address by cuk.
+//
+router.delete('/', (req, res, _) => {
+    dbglogging_1.default.dlog('CALL:', req.method, req.url, req.baseUrl);
+    res.type('application/json; charset=utf-8');
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        dbglogging_1.default.elog('DELETE request or url or query is wrong');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return;
+    }
+    //
+    // Check Path type and branch
+    //
+    const keys = r3keys();
+    let is_delete_token = false;
+    let is_delete_ip = false;
+    const urlpath = decodeURI(req.baseUrl);
+    const requestptn = new RegExp(keys.MATCH_URI_GET_RTOKEN); // regex = /^\/v1\/role\/token\/(.*)/
+    const reqmatchs = urlpath.match(requestptn);
+    if (k2hr3apiutil_1.default.isStringArray(reqmatchs) && k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) && 2 <= reqmatchs.length && '' !== k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+        // get token
+        is_delete_token = true;
+    }
+    else {
+        // recheck simply
+        if (k2hr3apiutil_1.default.isSafeString(urlpath) && (urlpath == '/v1/role' || urlpath == '/v1/role/')) {
+            // urlpath is /v1/role, this is to delete ip address by cuk
+            is_delete_ip = true;
+        }
+        else {
+            // urlpath is not /v1/role, expected /v1/role/<role>, this is to delete role.
+        }
+    }
+    // Run
+    if (is_delete_token) {
+        // delete role token.
+        if (!rawDeleteRoleToken(req, res)) {
+            dbglogging_1.default.elog('failed to delete role token.');
+        }
+    }
+    else if (is_delete_ip) {
+        // delete ip address by cuk
+        if (!rawDeleteIpsByCuk(req, res)) {
+            dbglogging_1.default.elog('failed to delete ip address by cuk.');
+        }
+    }
+    else {
+        // delete role / role token.
+        if (!rawDeleteRoleByPath(req, res)) {
+            dbglogging_1.default.elog('failed to delete role.');
+        }
+    }
+    res.send();
+});
+//
+// Utility for deleting role / role token
+//
+const rawDeleteRoleByPath = (req, res) => {
+    //------------------------------
+    // check token for API mode
+    //------------------------------
+    let token_str = null;
+    let token_type = null;
+    let token_info = null;
+    let keys = r3keys();
+    if (k2hr3tokens_1.default.hasAuthTokenHeader(req)) {
+        const token_result = k2hr3tokens_1.default.checkToken(req, true); // scoped, both token
+        if (!token_result.result) {
+            dbglogging_1.default.elog(token_result.message);
+            k2hr3resutil_1.default.errResponse(req, res, token_result.status);
+            return false;
+        }
+        if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_result.token_info)) {
+            dbglogging_1.default.elog('specified wrong token or it is not scoped user token');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        token_info = token_result.token_info;
+        token_str = token_result.token ?? null;
+        token_type = token_result.token_type ?? null;
+        keys = r3keys(token_info.user, token_info.tenant);
+    }
+    //------------------------------
+    // get role name
+    //------------------------------
+    // check get token type and parse role name
+    const requestptn = new RegExp(keys.MATCH_URI_GET_ROLE_DATA); // regex = /^\/v1\/role\/(.*)/
+    const reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+    if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+        dbglogging_1.default.elog('DELETE request url does not have role name');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    // check role name is only name or full yrn path and tenant name
+    let tenantname;
+    let rolename;
+    let roleyrn = reqmatchs[1].toLowerCase();
+    let roleyrnptn = new RegExp('^' + keys.MATCH_ANY_TENANT_ROLE); // regex = /^yrn:yahoo:(.*)::(.*):role:(.*)/
+    const roleyrnmatchs = roleyrn.match(roleyrnptn);
+    if (!k2hr3apiutil_1.default.isStringArray(roleyrnmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(roleyrnmatchs) || roleyrnmatchs.length < 4) {
+        //
+        // roleyrn is not full yrn to role, then check wrong role name
+        //
+        roleyrnptn = new RegExp('^' + keys.NO_TENANT_KEY); // regex = /^yrn:yahoo:/
+        if (roleyrn.match(roleyrnptn)) {
+            dbglogging_1.default.elog('DELETE request query has wrong yrn full path to role');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // roleyrn is not full yrn, we need tenant name
+        if (!k2hr3apiutil_1.default.isSafeString(keys.ROLE_TOP_KEY)) {
+            dbglogging_1.default.elog('DELETE request role name which is not full yrn, and not token. role name must be full yrn, if token is not specified.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // make full yrn for role, and set tenant name/role name.
+        tenantname = (k2hr3apiutil_1.default.isPlainObject(token_info) && k2hr3apiutil_1.default.isSafeString(token_info.tenant)) ? token_info.tenant : null;
+        rolename = roleyrn;
+        roleyrn = keys.ROLE_TOP_KEY + ':' + roleyrn;
+    }
+    else {
+        //
+        // roleyrn is full yrn to role.
+        // need to check tenant name when token is specified.
+        //
+        if (null !== token_type && (!k2hr3apiutil_1.default.isPlainObject(token_info) || !k2hr3apiutil_1.default.isSafeString(token_info.tenant) || !k2hr3apiutil_1.default.compareCaseString(roleyrnmatchs[2], token_info.tenant))) {
+            dbglogging_1.default.elog('DELETE request query has wrong tenant yrn full path(tenant=' + roleyrnmatchs[2] + ') or not specify tenant.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // set tenant name/role name.
+        tenantname = roleyrnmatchs[2];
+        rolename = roleyrnmatchs[3];
+    }
+    //------------------------------
+    // Run
+    //------------------------------
+    if (!k2hr3apiutil_1.default.isSafeString(token_type)) {
+        // remove host ip address in role
+        const clientip = k2hr3apiutil_1.default.getClientIpAddress(req);
+        if (!k2hr3apiutil_1.default.isSafeString(clientip)) {
+            dbglogging_1.default.elog('DELETE request does not have ip address for client.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // check port
+        let port = 0;
+        if (k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+            const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+            if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                dbglogging_1.default.elog('DELETE request has port which is not number: ' + JSON.stringify(req.query.port));
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return false;
+            }
+            port = port_tmp;
+        }
+        // check cuk parameter
+        let cuk = null;
+        if (k2hr3apiutil_1.default.isPlainObject(req.query) && k2hr3apiutil_1.default.isSafeString(req.query.cuk) && k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+            cuk = k2hr3apiutil_1.default.getSafeString(req.query.cuk).trim();
+        }
+        // remove host(check requester and requester is target)
+        const rm_result = k2hr3dkc_1.default.removeHost(tenantname, rolename, clientip, port, cuk, clientip, port, cuk);
+        // result
+        if (!rm_result.result) {
+            dbglogging_1.default.elog('DELETE request failure - remove host by ip(' + clientip + ':' + String(port) + ') address, cuk(' + JSON.stringify(cuk) + ') in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+            k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+            return false;
+        }
+        else {
+            dbglogging_1.default.dlog('DELETE request succeed - remove host by ip(' + clientip + ':' + String(port) + ') address, cuk(' + JSON.stringify(cuk) + ') in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+            res.status(204); // 204: No Content
+        }
+    }
+    else if ('role' === k2hr3apiutil_1.default.getSafeString(token_type) && k2hr3apiutil_1.default.isPlainObject(token_info)) {
+        // remove role token
+        const clientip = k2hr3apiutil_1.default.getClientIpAddress(req);
+        if (!k2hr3apiutil_1.default.isSafeString(clientip)) {
+            dbglogging_1.default.elog('DELETE request does not have ip address for client.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // check full role yrn path in token and path
+        if (!k2hr3apiutil_1.default.isSafeString(token_info.role) || token_info.role != roleyrn) {
+            dbglogging_1.default.elog('DELETE request is something wrong, the role token(' + JSON.stringify(token_info.role) + ') and role path(' + JSON.stringify(roleyrn) + ') do not match.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+        // check for k8s cuk/port
+        let port = 0;
+        let cuk;
+        if (k2hr3apiutil_1.default.isSafeString(token_info.extra) && token_info.extra === keys.VALUE_K8S_V1) {
+            // cuk
+            if (!k2hr3apiutil_1.default.isPlainObject(req.query) || !k2hr3apiutil_1.default.isSafeString(req.query.cuk) || !k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+                dbglogging_1.default.elog('DELETE request need cuk parameter for deleting role token which is made for k8s.');
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return false;
+            }
+            cuk = k2hr3apiutil_1.default.getSafeString(req.query.cuk).trim();
+            if (!k2hr3apiutil_1.default.isSafeString(token_info.cuk) || token_info.cuk != cuk) {
+                dbglogging_1.default.elog('DELETE request cuk(' + JSON.stringify(cuk) + ') parameter is invalid.');
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return false;
+            }
+            // port
+            if (k2hr3apiutil_1.default.isPlainObject(req.query) && k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+                const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+                if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                    dbglogging_1.default.elog('DELETE request has port which is not number: ' + JSON.stringify(req.query.port));
+                    k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                    return false;
+                }
+                port = port_tmp;
+            }
+            if (!k2hr3apiutil_1.default.isSafeNumber(token_info.port) || token_info.port != port) {
+                dbglogging_1.default.elog('DELETE request port(' + JSON.stringify(port) + ') parameter is invalid.');
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return false;
+            }
+        }
+        // remove role token
+        const rm_result = k2hr3tokens_1.default.removeRoleTokenByIP(token_str, clientip, token_info.port, token_info.cuk);
+        // result
+        if (!rm_result.result) {
+            dbglogging_1.default.elog('DELETE request failure - remove role token(' + JSON.stringify(token_str) + ')');
+            k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+            return false;
+        }
+        else {
+            dbglogging_1.default.dlog('DELETE request succeed - remove role token(' + JSON.stringify(token_str) + ')');
+            res.status(204); // 204: No Content
+        }
+    }
+    else if ('user' === k2hr3apiutil_1.default.getSafeString(token_type) && k2hr3apiutil_1.default.isPlainObject(token_info)) {
+        if (k2hr3apiutil_1.default.isPlainObject(req.query) && k2hr3apiutil_1.default.isSafeString(req.query.host)) {
+            // remove host(hostname or ip address) in role
+            let tg_host;
+            const tmp_str_host = k2hr3apiutil_1.default.getSafeString(req.query.host);
+            const tmp_arr_host = k2hr3apiutil_1.default.parseJSON(req.query.host);
+            if (k2hr3apiutil_1.default.isStringArray(tmp_arr_host) && k2hr3apiutil_1.default.isNotEmptyArray(tmp_arr_host)) {
+                tg_host = tmp_arr_host;
+            }
+            else {
+                tg_host = [tmp_str_host];
+            }
+            // check port
+            let port = 0;
+            if (k2hr3apiutil_1.default.isSafeNumeric(req.query.port)) {
+                const port_tmp = k2hr3apiutil_1.default.cvtToNumber(req.query.port);
+                if (!k2hr3apiutil_1.default.isSafeNumber(port_tmp)) {
+                    dbglogging_1.default.elog('GET request has port which is not number: ' + JSON.stringify(req.query.port));
+                    k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                    return false;
+                }
+                port = port_tmp;
+            }
+            // check cuk parameter
+            let cuk = null;
+            if (k2hr3apiutil_1.default.isSafeString(req.query.cuk) && k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+                cuk = k2hr3apiutil_1.default.getSafeString(req.query.cuk).trim();
+            }
+            // remove host(not check requester)
+            const rm_result = k2hr3dkc_1.default.removeHost(tenantname, rolename, tg_host, port, cuk);
+            // result
+            if (!rm_result.result) {
+                dbglogging_1.default.elog('DELETE request failure - remove host(' + k2hr3apiutil_1.default.getSafeString(tg_host) + ':' + String(port) + ') address, cuk(' + JSON.stringify(cuk) + ') in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+                k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+                return false;
+            }
+            else {
+                dbglogging_1.default.dlog('DELETE request succeed - remove host(' + k2hr3apiutil_1.default.getSafeString(tg_host) + ':' + String(port) + ') address, cuk(' + JSON.stringify(cuk) + ') in role(tenant=' + tenantname + ', role=' + rolename + ') host');
+                res.status(204); // 204: No Content
+            }
+        }
+        else {
+            // remove role
+            const rm_result = k2hr3dkc_1.default.removeRole(token_info.user, tenantname, rolename);
+            // result
+            if (!rm_result.result) {
+                dbglogging_1.default.elog('DELETE request failure - remove role(' + rolename + ') exist');
+                k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+                return false;
+            }
+            else {
+                dbglogging_1.default.dlog('DELETE request succeed - remove role(' + rolename + ') exists');
+                res.status(204); // 204: No Content
+            }
+        }
+    }
+    else {
+        // broken token
+        dbglogging_1.default.elog('DELETE request is failure by internal error(token data broken).');
+        k2hr3resutil_1.default.errResponse(req, res, 500); // 500: Internal Error
+        return false;
+    }
+    return true;
+};
+//
+// Utility for deleting ip address by cuk
+//
+const rawDeleteIpsByCuk = (req, res) => {
+    const keys = r3keys();
+    const clientip = k2hr3apiutil_1.default.getClientIpAddress(req);
+    if (!k2hr3apiutil_1.default.isSafeString(clientip)) {
+        dbglogging_1.default.elog('DELETE request does not have ip address for client');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    //------------------------------
+    // check arguments
+    //------------------------------
+    if (!k2hr3apiutil_1.default.isPlainObject(req.query)) {
+        dbglogging_1.default.elog('DELETE request has no query parameter');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    let tg_host = [];
+    if (k2hr3apiutil_1.default.isSafeEntity(req.query.host)) {
+        const tmp_str_host = k2hr3apiutil_1.default.getSafeString(req.query.host).trim();
+        const tmp_arr_host = k2hr3apiutil_1.default.parseJSON(tmp_str_host);
+        if (k2hr3apiutil_1.default.isStringArray(tmp_arr_host) && k2hr3apiutil_1.default.isNotEmptyArray(tmp_arr_host)) {
+            tg_host = tmp_arr_host.slice(0, tmp_arr_host.length);
+        }
+        else if (k2hr3apiutil_1.default.isSafeString(tmp_str_host)) {
+            tg_host.push(tmp_str_host);
+        }
+        else {
+            dbglogging_1.default.dlog('DELETE request has no host parameter, it means removing all host in cuk: ' + JSON.stringify(req.query.cuk));
+        }
+    }
+    // cuk parameter
+    if (!k2hr3apiutil_1.default.isSafeString(req.query.cuk) || !k2hr3apiutil_1.default.isSafeString(req.query.cuk.trim())) {
+        dbglogging_1.default.elog('DELETE request has invalid cuk parameter: ' + JSON.stringify(req.query.cuk));
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    const tg_cuk = req.query.cuk.trim();
+    const tg_extra = k2hr3dkc_1.default.getExtraFromCuk(tg_cuk);
+    // Check client ip address
+    if (tg_extra == keys.VALUE_K8S_V1) {
+        // for kubernetes
+        // check client ip address is the host itself to be removed
+        // 
+        // [NOTE]
+        // if result is true, it means client ip address is cuk's node ip address.
+        // after that, the comparison between the cuk object data contents and the cuk data
+        // in k2hdkc linked to the this ip address is done in removeIpsByCuk() function.
+        //
+        if (!k2hr3dkc_1.default.compareIpAndKubernetesCuk(clientip, tg_cuk)) {
+            // client ip is not as same as cuk's node ip address, 
+            // then retry to compare delhost ip in config and it.
+            const adminips = k2hr3dkc_1.default.findRoleHost(null, delhost_role_yrn, null, clientip, 0, null); // not strict checking for admin delhost host
+            if (!k2hr3apiutil_1.default.isArray(adminips)) {
+                dbglogging_1.default.elog('DELETE request from ip address(' + JSON.stringify(clientip) + ') is not role(' + JSON.stringify(delhost_role_yrn) + ') member.');
+                k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+                return false;
+            }
+        }
+    }
+    else if (tg_extra == keys.VALUE_OPENSTACK_V1) {
+        // for openstack
+        // In case of openstack, when deleting without token, it can be deleted only from
+        // the IP address registered as delhost ip in config.
+        //
+        // Check client ip address is in role admin member ip address.
+        const adminips = k2hr3dkc_1.default.findRoleHost(null, delhost_role_yrn, null, clientip, 0, null); // not strict checking for admin delhost host
+        if (!k2hr3apiutil_1.default.isArray(adminips)) {
+            dbglogging_1.default.elog('DELETE request from ip address(' + JSON.stringify(clientip) + ') is not role(' + JSON.stringify(delhost_role_yrn) + ') member.');
+            k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+            return false;
+        }
+    }
+    else {
+        // Currently supports only openstack and kubernetes
+        dbglogging_1.default.elog('DELETE request has unknown extra type in cuk parameter: ' + JSON.stringify(req.query.cuk));
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    //------------------------------
+    // Run
+    //------------------------------
+    const resobj = k2hr3dkc_1.default.removeIpsByCuk(tg_cuk, tg_host, true);
+    if (!k2hr3apiutil_1.default.isPlainObject(resobj) || !k2hr3apiutil_1.default.isBoolean(resobj.result) || false === resobj.result) {
+        if (k2hr3apiutil_1.default.isPlainObject(resobj) && k2hr3apiutil_1.default.isString(resobj.message)) {
+            dbglogging_1.default.elog('DELETE request failed by ' + resobj.message);
+        }
+        else {
+            dbglogging_1.default.elog('DELETE request failed by unknown reason.');
+        }
+        k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden(is this status OK?)
+        return false;
+    }
+    dbglogging_1.default.dlog('succeed : ' + k2hr3apiutil_1.default.getSafeString(resobj.message));
+    res.status(204); // 204: No Content
+    return true;
+};
+//
+// Utility for deleting role token
+//
+const rawDeleteRoleToken = (req, res) => {
+    if (!k2hr3apiutil_1.default.isPlainObject(req) ||
+        !k2hr3apiutil_1.default.isSafeString(req.baseUrl)) {
+        dbglogging_1.default.elog('DELETE request or url or query is wrong');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    //------------------------------
+    // check token
+    //------------------------------
+    if (!k2hr3tokens_1.default.hasAuthTokenHeader(req)) {
+        dbglogging_1.default.elog('DELETE request does not have any auth token.');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    const token_result = k2hr3tokens_1.default.checkToken(req, true, true); // scoped, user token
+    if (!token_result.result) {
+        dbglogging_1.default.elog(token_result.message);
+        k2hr3resutil_1.default.errResponse(req, res, token_result.status);
+        return false;
+    }
+    const token_info = token_result.token_info;
+    if (!k2hr3tokens_1.default.isResTypeCheckRoleToken(token_info)) {
+        dbglogging_1.default.elog('specified wrong token or it is not scoped user token');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    const keys = r3keys(token_info.user, token_info.tenant);
+    //------------------------------
+    // get role token from uri
+    //------------------------------
+    // check get token type and parse role name
+    const requestptn = new RegExp(keys.MATCH_URI_GET_RTOKEN); // regex = /^\/v1\/role\/token\/(.*)/
+    const reqmatchs = decodeURI(req.baseUrl).match(requestptn);
+    if (!k2hr3apiutil_1.default.isStringArray(reqmatchs) || !k2hr3apiutil_1.default.isNotEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === k2hr3apiutil_1.default.getSafeString(reqmatchs[1])) {
+        dbglogging_1.default.elog('DELETE request url does not have token string nor yrn path');
+        k2hr3resutil_1.default.errResponse(req, res, 400); // 400: Bad Request
+        return false;
+    }
+    const token_string = k2hr3apiutil_1.default.getSafeString(reqmatchs[1]);
+    //------------------------------
+    // Run
+    //------------------------------
+    if (!k2hr3tokens_1.default.removeRoleTokenByPath(token_string, (k2hr3apiutil_1.default.isSafeString(token_info.tenant) ? token_info.tenant : null))) {
+        dbglogging_1.default.elog('DELETE request failure - remove role token(' + token_string + ')');
+        k2hr3resutil_1.default.errResponse(req, res, 403); // 403: Forbidden
+        return false;
+    }
+    else {
+        dbglogging_1.default.dlog('DELETE request succeed - remove role token(' + token_string + ')');
+        res.status(204); // 204: No Content
+    }
+    return true;
+};
+//---------------------------------------------------------
+// Exports
+//---------------------------------------------------------
+//
+// Functions
+//
+exports.default = router;
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noexpandtab sw=4 ts=4 fdm=marker
+ * vim<600: noexpandtab sw=4 ts=4
+ */