k2hr3-api 1.0.42 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/config/k2hr3-init.sh.templ +4 -4
- package/dist/.gitkeep +0 -0
- package/dist/src/app.js +262 -0
- package/{bin → dist/src/bin}/run.sh +1 -1
- package/dist/src/bin/watcher.js +113 -0
- package/dist/src/bin/www.js +217 -0
- package/dist/src/lib/basicipcheck.js +392 -0
- package/dist/src/lib/cacerts.js +106 -0
- package/dist/src/lib/dbglogging.js +190 -0
- package/dist/src/lib/dummyuserapi.js +719 -0
- package/dist/src/lib/ipwatch.js +354 -0
- package/dist/src/lib/k2hr3acrutil.js +532 -0
- package/dist/src/lib/k2hr3apiutil.js +1444 -0
- package/dist/src/lib/k2hr3cliutil.js +183 -0
- package/dist/src/lib/k2hr3config.js +832 -0
- package/dist/src/lib/k2hr3cryptutil.js +258 -0
- package/dist/src/lib/k2hr3dkc.js +12121 -0
- package/dist/src/lib/k2hr3extdata.js +198 -0
- package/dist/src/lib/k2hr3keys.js +207 -0
- package/dist/src/lib/k2hr3resutil.js +111 -0
- package/dist/src/lib/k2hr3template.js +6546 -0
- package/dist/src/lib/k2hr3tokens.js +2643 -0
- package/dist/src/lib/k2hr3userdata.js +296 -0
- package/dist/src/lib/k8soidc.js +1000 -0
- package/dist/src/lib/openstackapiv2.js +695 -0
- package/dist/src/lib/openstackapiv3.js +932 -0
- package/dist/src/lib/openstackep.js +667 -0
- package/{tests/auto_common.js → dist/src/lib/types.js} +4 -38
- package/dist/src/routes/acr.js +704 -0
- package/dist/src/routes/debugVerify.js +294 -0
- package/dist/src/routes/extdata.js +219 -0
- package/dist/src/routes/list.js +264 -0
- package/dist/src/routes/policy.js +840 -0
- package/dist/src/routes/resource.js +1489 -0
- package/dist/src/routes/role.js +2627 -0
- package/dist/src/routes/service.js +908 -0
- package/dist/src/routes/tenant.js +1141 -0
- package/dist/src/routes/userTokens.js +482 -0
- package/dist/src/routes/userdata.js +212 -0
- package/dist/src/routes/version.js +103 -0
- package/package.json +152 -121
- package/ChangeLog +0 -378
- package/app.js +0 -292
- package/bin/watcher +0 -122
- package/bin/www +0 -180
- package/eslint.config.mjs +0 -68
- package/lib/basicipcheck.js +0 -376
- package/lib/cacerts.js +0 -71
- package/lib/dbglogging.js +0 -151
- package/lib/dummyuserapi.js +0 -766
- package/lib/ipwatch.js +0 -379
- package/lib/k2hr3acrutil.js +0 -516
- package/lib/k2hr3apiutil.js +0 -1494
- package/lib/k2hr3cliutil.js +0 -191
- package/lib/k2hr3config.js +0 -826
- package/lib/k2hr3cryptutil.js +0 -254
- package/lib/k2hr3dkc.js +0 -12632
- package/lib/k2hr3extdata.js +0 -198
- package/lib/k2hr3keys.js +0 -234
- package/lib/k2hr3resutil.js +0 -100
- package/lib/k2hr3template.js +0 -6925
- package/lib/k2hr3tokens.js +0 -2799
- package/lib/k2hr3userdata.js +0 -312
- package/lib/k8soidc.js +0 -1012
- package/lib/openstackapiv2.js +0 -764
- package/lib/openstackapiv3.js +0 -1032
- package/lib/openstackep.js +0 -553
- package/routes/acr.js +0 -738
- package/routes/debugVerify.js +0 -263
- package/routes/extdata.js +0 -232
- package/routes/list.js +0 -270
- package/routes/policy.js +0 -869
- package/routes/resource.js +0 -1441
- package/routes/role.js +0 -2664
- package/routes/service.js +0 -894
- package/routes/tenant.js +0 -1095
- package/routes/userTokens.js +0 -511
- package/routes/userdata.js +0 -218
- package/routes/version.js +0 -108
- package/templ/Dockerfile.templ +0 -71
- package/tests/auto_acr.js +0 -1101
- package/tests/auto_acr_spec.js +0 -79
- package/tests/auto_all_spec.js +0 -142
- package/tests/auto_control_subprocess.sh +0 -243
- package/tests/auto_extdata.js +0 -220
- package/tests/auto_extdata_spec.js +0 -79
- package/tests/auto_init_config_json.sh +0 -275
- package/tests/auto_k2hdkc_server.ini +0 -109
- package/tests/auto_k2hdkc_slave.ini +0 -83
- package/tests/auto_list.js +0 -439
- package/tests/auto_list_spec.js +0 -79
- package/tests/auto_policy.js +0 -1579
- package/tests/auto_policy_spec.js +0 -79
- package/tests/auto_resource.js +0 -10956
- package/tests/auto_resource_spec.js +0 -79
- package/tests/auto_role.js +0 -6150
- package/tests/auto_role_spec.js +0 -79
- package/tests/auto_service.js +0 -770
- package/tests/auto_service_spec.js +0 -79
- package/tests/auto_subprocesses.js +0 -114
- package/tests/auto_template.sh +0 -126
- package/tests/auto_tenant.js +0 -1100
- package/tests/auto_tenant_spec.js +0 -79
- package/tests/auto_token_util.js +0 -219
- package/tests/auto_userdata.js +0 -292
- package/tests/auto_userdata_spec.js +0 -79
- package/tests/auto_usertokens.js +0 -565
- package/tests/auto_usertokens_spec.js +0 -79
- package/tests/auto_version.js +0 -127
- package/tests/auto_version_spec.js +0 -79
- package/tests/auto_watcher.js +0 -157
- package/tests/auto_watcher_spec.js +0 -79
- package/tests/k2hdkc_test.data +0 -986
- package/tests/k2hdkc_test_load.sh +0 -255
- package/tests/k2hr3template_test.js +0 -187
- package/tests/k2hr3template_test.sh +0 -339
- package/tests/k2hr3template_test_async.js +0 -216
- package/tests/k2hr3template_test_template.result +0 -7117
- package/tests/k2hr3template_test_template.txt +0 -3608
- package/tests/k2hr3template_test_vars.js +0 -194
- package/tests/manual_acr_delete.js +0 -143
- package/tests/manual_acr_get.js +0 -297
- package/tests/manual_acr_postput.js +0 -215
- package/tests/manual_allusertenant_get.js +0 -113
- package/tests/manual_extdata_get.js +0 -191
- package/tests/manual_k2hr3keys_get.js +0 -84
- package/tests/manual_list_gethead.js +0 -230
- package/tests/manual_policy_delete.js +0 -132
- package/tests/manual_policy_gethead.js +0 -275
- package/tests/manual_policy_postput.js +0 -297
- package/tests/manual_resource_delete.js +0 -433
- package/tests/manual_resource_gethead.js +0 -423
- package/tests/manual_resource_postput.js +0 -487
- package/tests/manual_role_delete.js +0 -404
- package/tests/manual_role_gethead.js +0 -547
- package/tests/manual_role_postput.js +0 -544
- package/tests/manual_service_delete.js +0 -153
- package/tests/manual_service_gethead.js +0 -178
- package/tests/manual_service_postput.js +0 -348
- package/tests/manual_tenant_delete.js +0 -186
- package/tests/manual_tenant_gethead.js +0 -268
- package/tests/manual_tenant_postput.js +0 -293
- package/tests/manual_test.sh +0 -352
- package/tests/manual_userdata_get.js +0 -173
- package/tests/manual_usertoken_gethead.js +0 -136
- package/tests/manual_usertoken_postput.js +0 -310
- package/tests/manual_version_get.js +0 -127
- package/tests/run_local_test_k2hdkc.sh +0 -174
- package/tests/test.sh +0 -333
package/routes/acr.js
DELETED
|
@@ -1,738 +0,0 @@
|
|
|
1
|
-
/*
|
|
2
|
-
* K2HR3 REST API
|
|
3
|
-
*
|
|
4
|
-
* Copyright 2017 Yahoo Japan Corporation.
|
|
5
|
-
*
|
|
6
|
-
* K2HR3 is K2hdkc based Resource and Roles and policy Rules, gathers
|
|
7
|
-
* common management information for the cloud.
|
|
8
|
-
* K2HR3 can dynamically manage information as "who", "what", "operate".
|
|
9
|
-
* These are stored as roles, resources, policies in K2hdkc, and the
|
|
10
|
-
* client system can dynamically read and modify these information.
|
|
11
|
-
*
|
|
12
|
-
* For the full copyright and license information, please view
|
|
13
|
-
* the license file that was distributed with this source code.
|
|
14
|
-
*
|
|
15
|
-
* AUTHOR: Takeshi Nakatani
|
|
16
|
-
* CREATE: Thu Nov 2 2017
|
|
17
|
-
* REVISION:
|
|
18
|
-
*
|
|
19
|
-
*/
|
|
20
|
-
|
|
21
|
-
'use strict';
|
|
22
|
-
|
|
23
|
-
var express = require('express');
|
|
24
|
-
var router = express.Router();
|
|
25
|
-
|
|
26
|
-
var r3token = require('../lib/k2hr3tokens');
|
|
27
|
-
var apiutil = require('../lib/k2hr3apiutil');
|
|
28
|
-
var resutil = require('../lib/k2hr3resutil');
|
|
29
|
-
var k2hr3 = require('../lib/k2hr3dkc');
|
|
30
|
-
|
|
31
|
-
// Debug logging objects
|
|
32
|
-
var r3logger = require('../lib/dbglogging');
|
|
33
|
-
|
|
34
|
-
//
|
|
35
|
-
// Common utility function
|
|
36
|
-
//
|
|
37
|
-
// Create or update service
|
|
38
|
-
//
|
|
39
|
-
// Result null(succeed) or error message(failed)
|
|
40
|
-
//
|
|
41
|
-
function rawCreateServiceTenant(token_info, token, tenantname, servicename, callback)
|
|
42
|
-
{
|
|
43
|
-
var error = null;
|
|
44
|
-
if(!apiutil.isSafeEntity(callback) || 'function' !== typeof callback){
|
|
45
|
-
error = new Error('callback parameter is wrong : callback=' + JSON.stringify(callback));
|
|
46
|
-
r3logger.elog(error.message);
|
|
47
|
-
return;
|
|
48
|
-
}
|
|
49
|
-
|
|
50
|
-
//
|
|
51
|
-
// Check service name
|
|
52
|
-
//
|
|
53
|
-
if(!apiutil.isSafeString(servicename)){
|
|
54
|
-
error = new Error('service name is wrong.');
|
|
55
|
-
r3logger.elog(error.message);
|
|
56
|
-
callback(error, false);
|
|
57
|
-
return;
|
|
58
|
-
}
|
|
59
|
-
|
|
60
|
-
//
|
|
61
|
-
// Check token
|
|
62
|
-
//
|
|
63
|
-
if( !apiutil.isSafeString(token) ||
|
|
64
|
-
!apiutil.isSafeEntity(token_info) ||
|
|
65
|
-
!apiutil.isSafeEntity(token_info.scoped) ||
|
|
66
|
-
'boolean' !== typeof token_info.scoped ||
|
|
67
|
-
!apiutil.isSafeString(token_info.user) )
|
|
68
|
-
{
|
|
69
|
-
error = new Error('specified wrong token or it is not scoped or no tenant.');
|
|
70
|
-
r3logger.elog(error.message);
|
|
71
|
-
callback(error, false);
|
|
72
|
-
return;
|
|
73
|
-
}
|
|
74
|
-
var user = apiutil.isSafeString(token_info.user) ? token_info.user : null;
|
|
75
|
-
|
|
76
|
-
//
|
|
77
|
-
// Create service + tenant
|
|
78
|
-
//
|
|
79
|
-
if(token_info.scoped){
|
|
80
|
-
// [NOTE]
|
|
81
|
-
// The token is scoped to tenant, but if the user exists, we use this token as unscoped.
|
|
82
|
-
// By using as an unscoped token, the following function creates a scoped token inside it.
|
|
83
|
-
// Then this logic will not be affected by deletion (one time) of token.
|
|
84
|
-
//
|
|
85
|
-
k2hr3.createServiceTenantByScopedToken(tenantname, servicename, token, callback);
|
|
86
|
-
}else{
|
|
87
|
-
k2hr3.createServiceTenantByUnscopedToken(tenantname, servicename, token, user, callback);
|
|
88
|
-
}
|
|
89
|
-
return;
|
|
90
|
-
}
|
|
91
|
-
|
|
92
|
-
//
|
|
93
|
-
// Mountpath : '/v1/acr'
|
|
94
|
-
//
|
|
95
|
-
// POST '/v1/acr/<service>' : post service/tenant on version 1
|
|
96
|
-
// HEADER : X-Auth-Token => Unscoped/Scoped User token or Role Token
|
|
97
|
-
// body : {
|
|
98
|
-
// tenant: => tenant name(when unscoped user token)
|
|
99
|
-
// }
|
|
100
|
-
// response body : result => true/false
|
|
101
|
-
// message => messages
|
|
102
|
-
//
|
|
103
|
-
router.post('/', function(req, res, next) // eslint-disable-line no-unused-vars
|
|
104
|
-
{
|
|
105
|
-
r3logger.dlog('CALL:', req.method, req.url);
|
|
106
|
-
|
|
107
|
-
res.type('application/json; charset=utf-8');
|
|
108
|
-
|
|
109
|
-
var result = { result: true, message: null };
|
|
110
|
-
if( !apiutil.isSafeEntity(req) ||
|
|
111
|
-
!apiutil.isSafeEntity(req.baseUrl) )
|
|
112
|
-
{
|
|
113
|
-
result = {
|
|
114
|
-
result: false,
|
|
115
|
-
message: 'POST request is wrong'
|
|
116
|
-
};
|
|
117
|
-
|
|
118
|
-
r3logger.elog(result.message);
|
|
119
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
120
|
-
return;
|
|
121
|
-
}
|
|
122
|
-
|
|
123
|
-
//------------------------------
|
|
124
|
-
// check token
|
|
125
|
-
//------------------------------
|
|
126
|
-
var token_result = r3token.checkToken(req, false, true); // (un)scoped user token
|
|
127
|
-
if(!token_result.result){
|
|
128
|
-
r3logger.elog(token_result.message);
|
|
129
|
-
var _status = token_result.status;
|
|
130
|
-
delete token_result.status;
|
|
131
|
-
resutil.errResponse(req, res, _status, token_result);
|
|
132
|
-
return;
|
|
133
|
-
}
|
|
134
|
-
var token_info = token_result.token_info;
|
|
135
|
-
var tenantname = null;
|
|
136
|
-
|
|
137
|
-
if(false === token_info.scoped){
|
|
138
|
-
//
|
|
139
|
-
// Unscoped user token : need tenant parameter
|
|
140
|
-
//
|
|
141
|
-
if( !apiutil.isSafeEntity(req.body) ||
|
|
142
|
-
!apiutil.isSafeString(req.body.tenant) )
|
|
143
|
-
{
|
|
144
|
-
result = {
|
|
145
|
-
result: false,
|
|
146
|
-
message: 'Specified unscoped user token, but there is not tenant in body data.'
|
|
147
|
-
};
|
|
148
|
-
r3logger.elog(result.message);
|
|
149
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
150
|
-
return;
|
|
151
|
-
}
|
|
152
|
-
|
|
153
|
-
// get user's tenant list
|
|
154
|
-
var tenant_list = r3token.getTenantList(token_info.user);
|
|
155
|
-
if(null === tenant_list || apiutil.isEmptyArray(tenant_list)){
|
|
156
|
-
result = {
|
|
157
|
-
result: false,
|
|
158
|
-
message: 'token(' + token_result.token + ') for user (' + token_info.user + ') does not have any tenant.'
|
|
159
|
-
};
|
|
160
|
-
r3logger.elog(result.message);
|
|
161
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
162
|
-
return;
|
|
163
|
-
}
|
|
164
|
-
|
|
165
|
-
// check tenant
|
|
166
|
-
if(!r3token.checkTenantInTenantList(tenant_list, req.body.tenant.toLowerCase())){
|
|
167
|
-
result = {
|
|
168
|
-
result: false,
|
|
169
|
-
message: 'user (' + token_info.user + ') is not member of tenant(' + req.body.tenant + ').'
|
|
170
|
-
};
|
|
171
|
-
r3logger.elog(result.message);
|
|
172
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
173
|
-
return;
|
|
174
|
-
}
|
|
175
|
-
tenantname = req.body.tenant.toLowerCase();
|
|
176
|
-
|
|
177
|
-
}else{
|
|
178
|
-
//
|
|
179
|
-
// Scoped user token : not need tenant parameter
|
|
180
|
-
//
|
|
181
|
-
if( apiutil.isSafeEntity(req.body) &&
|
|
182
|
-
apiutil.isSafeString(req.body.tenant) )
|
|
183
|
-
{
|
|
184
|
-
if(!apiutil.compareCaseString(token_info.tenant, req.body.tenant)){
|
|
185
|
-
result = {
|
|
186
|
-
result: false,
|
|
187
|
-
message: 'Specified scoped user token and tenant in body data, but these are not same tenant name.'
|
|
188
|
-
};
|
|
189
|
-
r3logger.elog(result.message);
|
|
190
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
191
|
-
return;
|
|
192
|
-
}
|
|
193
|
-
}
|
|
194
|
-
tenantname = token_info.tenant;
|
|
195
|
-
}
|
|
196
|
-
|
|
197
|
-
//------------------------------
|
|
198
|
-
// check service path in url
|
|
199
|
-
//------------------------------
|
|
200
|
-
var requestptn = new RegExp('^/v1/acr/(.*)'); // regex = /^\/v1\/acr\/(.*)/
|
|
201
|
-
var reqmatchs = decodeURI(req.baseUrl).match(requestptn);
|
|
202
|
-
if(apiutil.isEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === apiutil.getSafeString(reqmatchs[1])){
|
|
203
|
-
result = {
|
|
204
|
-
result: false,
|
|
205
|
-
message: 'POST request url does not have service name'
|
|
206
|
-
};
|
|
207
|
-
|
|
208
|
-
r3logger.elog(result.message);
|
|
209
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
210
|
-
return;
|
|
211
|
-
}
|
|
212
|
-
var servicename = reqmatchs[1].toLowerCase();
|
|
213
|
-
|
|
214
|
-
//------------------------------
|
|
215
|
-
// create service + tenant
|
|
216
|
-
//------------------------------
|
|
217
|
-
rawCreateServiceTenant(token_info, token_result.token, tenantname, servicename, function(error)
|
|
218
|
-
{
|
|
219
|
-
var resobj = { result: true, message: null };
|
|
220
|
-
if(null !== error){
|
|
221
|
-
resobj = {
|
|
222
|
-
result: false,
|
|
223
|
-
message: error.message
|
|
224
|
-
};
|
|
225
|
-
r3logger.elog(resobj.message);
|
|
226
|
-
resutil.errResponse(req, res, 403, resobj); // 403: Forbidden(is this status OK?)
|
|
227
|
-
return;
|
|
228
|
-
}
|
|
229
|
-
res.status(201); // 201: Created
|
|
230
|
-
res.send(JSON.stringify(resobj));
|
|
231
|
-
});
|
|
232
|
-
});
|
|
233
|
-
|
|
234
|
-
//
|
|
235
|
-
// Mountpath : '/v1/acr'
|
|
236
|
-
//
|
|
237
|
-
// PUT '/v1/acr/<service>' : post service/tenant on version 1
|
|
238
|
-
// HEADER : X-Auth-Token => Unscoped/Scoped User token or Role Token
|
|
239
|
-
// URL arguments : tenant => tenant name(when unscoped user token)
|
|
240
|
-
// response body : result => true/false
|
|
241
|
-
// message => messages
|
|
242
|
-
//
|
|
243
|
-
router.put('/', function(req, res, next) // eslint-disable-line no-unused-vars
|
|
244
|
-
{
|
|
245
|
-
r3logger.dlog('CALL:', req.method, req.url);
|
|
246
|
-
|
|
247
|
-
res.type('application/json; charset=utf-8');
|
|
248
|
-
|
|
249
|
-
var result = { result: true, message: null };
|
|
250
|
-
if( !apiutil.isSafeEntity(req) ||
|
|
251
|
-
!apiutil.isSafeEntity(req.baseUrl) )
|
|
252
|
-
{
|
|
253
|
-
result = {
|
|
254
|
-
result: false,
|
|
255
|
-
message: 'PUT request is wrong'
|
|
256
|
-
};
|
|
257
|
-
|
|
258
|
-
r3logger.elog(result.message);
|
|
259
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
260
|
-
return;
|
|
261
|
-
}
|
|
262
|
-
|
|
263
|
-
//------------------------------
|
|
264
|
-
// check token
|
|
265
|
-
//------------------------------
|
|
266
|
-
var token_result = r3token.checkToken(req, false, true); // (un)scoped user token
|
|
267
|
-
if(!token_result.result){
|
|
268
|
-
r3logger.elog(token_result.message);
|
|
269
|
-
var _status = token_result.status;
|
|
270
|
-
delete token_result.status;
|
|
271
|
-
resutil.errResponse(req, res, _status, token_result);
|
|
272
|
-
return;
|
|
273
|
-
}
|
|
274
|
-
var token_info = token_result.token_info;
|
|
275
|
-
var tenantname = null;
|
|
276
|
-
|
|
277
|
-
if(false === token_info.scoped){
|
|
278
|
-
//
|
|
279
|
-
// Unscoped user token : need tenant parameter
|
|
280
|
-
//
|
|
281
|
-
if( !apiutil.isSafeEntity(req.query) ||
|
|
282
|
-
!apiutil.isSafeString(req.query.tenant) )
|
|
283
|
-
{
|
|
284
|
-
result = {
|
|
285
|
-
result: false,
|
|
286
|
-
message: 'Specified unscoped user token, but there is not tenant in argument.'
|
|
287
|
-
};
|
|
288
|
-
r3logger.elog(result.message);
|
|
289
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
290
|
-
return;
|
|
291
|
-
}
|
|
292
|
-
|
|
293
|
-
// get user's tenant list
|
|
294
|
-
var tenant_list = r3token.getTenantList(token_info.user);
|
|
295
|
-
if(null === tenant_list || apiutil.isEmptyArray(tenant_list)){
|
|
296
|
-
result = {
|
|
297
|
-
result: false,
|
|
298
|
-
message: 'token(' + token_result.token + ') for user (' + token_info.user + ') does not have any tenant.'
|
|
299
|
-
};
|
|
300
|
-
r3logger.elog(result.message);
|
|
301
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
302
|
-
return;
|
|
303
|
-
}
|
|
304
|
-
|
|
305
|
-
// check tenant
|
|
306
|
-
if(!r3token.checkTenantInTenantList(tenant_list, req.query.tenant.toLowerCase())){
|
|
307
|
-
result = {
|
|
308
|
-
result: false,
|
|
309
|
-
message: 'user (' + token_info.user + ') is not member of tenant(' + req.query.tenant + ').'
|
|
310
|
-
};
|
|
311
|
-
r3logger.elog(result.message);
|
|
312
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
313
|
-
return;
|
|
314
|
-
}
|
|
315
|
-
tenantname = req.query.tenant.toLowerCase();
|
|
316
|
-
|
|
317
|
-
}else{
|
|
318
|
-
//
|
|
319
|
-
// Scoped user token : not need tenant parameter
|
|
320
|
-
//
|
|
321
|
-
if( apiutil.isSafeEntity(req.body) &&
|
|
322
|
-
apiutil.isSafeString(req.body.tenant) )
|
|
323
|
-
{
|
|
324
|
-
if(!apiutil.compareCaseString(token_info.tenant, req.body.tenant)){
|
|
325
|
-
result = {
|
|
326
|
-
result: false,
|
|
327
|
-
message: 'Specified scoped user token and tenant in body data, but these are not same tenant name.'
|
|
328
|
-
};
|
|
329
|
-
r3logger.elog(result.message);
|
|
330
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
331
|
-
return;
|
|
332
|
-
}
|
|
333
|
-
}
|
|
334
|
-
tenantname = token_info.tenant;
|
|
335
|
-
}
|
|
336
|
-
|
|
337
|
-
//------------------------------
|
|
338
|
-
// check service path in url
|
|
339
|
-
//------------------------------
|
|
340
|
-
var requestptn = new RegExp('^/v1/acr/(.*)'); // regex = /^\/v1\/acr\/(.*)/
|
|
341
|
-
var reqmatchs = decodeURI(req.baseUrl).match(requestptn);
|
|
342
|
-
if(apiutil.isEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === apiutil.getSafeString(reqmatchs[1])){
|
|
343
|
-
result = {
|
|
344
|
-
result: false,
|
|
345
|
-
message: 'PUT request url does not have service name'
|
|
346
|
-
};
|
|
347
|
-
|
|
348
|
-
r3logger.elog(result.message);
|
|
349
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
350
|
-
return;
|
|
351
|
-
}
|
|
352
|
-
var servicename = reqmatchs[1].toLowerCase();
|
|
353
|
-
|
|
354
|
-
//------------------------------
|
|
355
|
-
// create service + tenant
|
|
356
|
-
//------------------------------
|
|
357
|
-
rawCreateServiceTenant(token_info, token_result.token, tenantname, servicename, function(error)
|
|
358
|
-
{
|
|
359
|
-
var resobj = { result: true, message: null };
|
|
360
|
-
if(null !== error){
|
|
361
|
-
resobj = {
|
|
362
|
-
result: false,
|
|
363
|
-
message: error.message
|
|
364
|
-
};
|
|
365
|
-
r3logger.elog(resobj.message);
|
|
366
|
-
resutil.errResponse(req, res, 403, resobj); // 403: Forbidden(is this status OK?)
|
|
367
|
-
return;
|
|
368
|
-
}
|
|
369
|
-
res.status(201); // 201: Created
|
|
370
|
-
res.send(JSON.stringify(resobj));
|
|
371
|
-
});
|
|
372
|
-
});
|
|
373
|
-
|
|
374
|
-
//
|
|
375
|
-
// Utility function for getting Service/Tenant Names
|
|
376
|
-
//
|
|
377
|
-
function rawGetServiceTenantNames(req, res)
|
|
378
|
-
{
|
|
379
|
-
var result;
|
|
380
|
-
if( !apiutil.isSafeEntity(req) ||
|
|
381
|
-
!apiutil.isSafeEntity(req.baseUrl) )
|
|
382
|
-
{
|
|
383
|
-
result = {
|
|
384
|
-
result: false,
|
|
385
|
-
message: 'GET request or url is wrong'
|
|
386
|
-
};
|
|
387
|
-
|
|
388
|
-
r3logger.elog(result.message);
|
|
389
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
390
|
-
return;
|
|
391
|
-
}
|
|
392
|
-
|
|
393
|
-
//------------------------------
|
|
394
|
-
// check token
|
|
395
|
-
//------------------------------
|
|
396
|
-
var token_result = r3token.checkToken(req, true, true); // scoped user token
|
|
397
|
-
if(!token_result.result){
|
|
398
|
-
r3logger.elog(token_result.message);
|
|
399
|
-
var _status = token_result.status;
|
|
400
|
-
delete token_result.status;
|
|
401
|
-
resutil.errResponse(req, res, _status, token_result);
|
|
402
|
-
return;
|
|
403
|
-
}
|
|
404
|
-
var token_info = token_result.token_info;
|
|
405
|
-
|
|
406
|
-
//
|
|
407
|
-
// force remove user token(this is one shot!)
|
|
408
|
-
//
|
|
409
|
-
r3token.removeScopedUserToken(token_result.token);
|
|
410
|
-
|
|
411
|
-
//------------------------------
|
|
412
|
-
// check service path in url
|
|
413
|
-
//------------------------------
|
|
414
|
-
var requestptn = new RegExp('^/v1/acr/(.*)'); // regex = /^\/v1\/acr\/(.*)/
|
|
415
|
-
var reqmatchs = decodeURI(req.baseUrl).match(requestptn);
|
|
416
|
-
if(apiutil.isEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === apiutil.getSafeString(reqmatchs[1])){
|
|
417
|
-
result = {
|
|
418
|
-
result: false,
|
|
419
|
-
message: 'PUT request url does not have service name'
|
|
420
|
-
};
|
|
421
|
-
|
|
422
|
-
r3logger.elog(result.message);
|
|
423
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
424
|
-
return;
|
|
425
|
-
}
|
|
426
|
-
var servicename = reqmatchs[1].toLowerCase();
|
|
427
|
-
|
|
428
|
-
//------------------------------
|
|
429
|
-
// check tenant in service's tenant list
|
|
430
|
-
//------------------------------
|
|
431
|
-
result = k2hr3.checkTenantInService(servicename, token_info.tenant);
|
|
432
|
-
if(!apiutil.isSafeEntity(result) || !apiutil.isSafeEntity(result.result) || false === result.result){
|
|
433
|
-
if(!apiutil.isSafeEntity(result)){
|
|
434
|
-
result = {
|
|
435
|
-
result: false,
|
|
436
|
-
message: 'Could not get service data from checkTenantInService'
|
|
437
|
-
};
|
|
438
|
-
}else{
|
|
439
|
-
if(!apiutil.isSafeEntity(result.result)){
|
|
440
|
-
result.result = false;
|
|
441
|
-
}
|
|
442
|
-
if(!apiutil.isSafeEntity(result.message)){
|
|
443
|
-
result.message = 'Could not get error message in response from checkTenantInService';
|
|
444
|
-
}
|
|
445
|
-
}
|
|
446
|
-
r3logger.elog(result.message);
|
|
447
|
-
resutil.errResponse(req, res, 403, result); // 403: Forbidden(is this status OK?)
|
|
448
|
-
return;
|
|
449
|
-
}
|
|
450
|
-
|
|
451
|
-
//------------------------------
|
|
452
|
-
// make result
|
|
453
|
-
//------------------------------
|
|
454
|
-
var tokeninfo = {
|
|
455
|
-
user: token_info.user,
|
|
456
|
-
tenant: token_info.tenant,
|
|
457
|
-
service: servicename
|
|
458
|
-
};
|
|
459
|
-
result = {
|
|
460
|
-
result: true,
|
|
461
|
-
message: null,
|
|
462
|
-
tokeninfo: tokeninfo
|
|
463
|
-
};
|
|
464
|
-
|
|
465
|
-
r3logger.dlog('succeed');
|
|
466
|
-
res.status(200); // 200: OK
|
|
467
|
-
res.send(JSON.stringify(result));
|
|
468
|
-
}
|
|
469
|
-
|
|
470
|
-
//
|
|
471
|
-
// Utility function for getting Service/Tenant Resources
|
|
472
|
-
//
|
|
473
|
-
function rawGetServiceTenantResources(req, res)
|
|
474
|
-
{
|
|
475
|
-
var result;
|
|
476
|
-
|
|
477
|
-
//------------------------------
|
|
478
|
-
// check request
|
|
479
|
-
//------------------------------
|
|
480
|
-
var sip = apiutil.getClientIpAddress(req);
|
|
481
|
-
if( !apiutil.isSafeEntity(req) ||
|
|
482
|
-
!apiutil.isSafeString(req.baseUrl) ||
|
|
483
|
-
!apiutil.isSafeEntity(req.query) ||
|
|
484
|
-
!apiutil.isSafeString(req.query.cip) ||
|
|
485
|
-
!apiutil.isSafeString(sip) ||
|
|
486
|
-
!apiutil.isSafeString(req.query.crole) ||
|
|
487
|
-
!apiutil.isSafeString(req.query.srole) )
|
|
488
|
-
{
|
|
489
|
-
result = {
|
|
490
|
-
result: false,
|
|
491
|
-
message: 'GET request or parameters are wrong'
|
|
492
|
-
};
|
|
493
|
-
|
|
494
|
-
r3logger.elog(result.message);
|
|
495
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
496
|
-
return;
|
|
497
|
-
}
|
|
498
|
-
|
|
499
|
-
//------------------------------
|
|
500
|
-
// port parameters
|
|
501
|
-
//------------------------------
|
|
502
|
-
var cport = apiutil.isSafeEntity(req.query.cport) ? apiutil.isSafeString(req.query.cport) ? !isNaN(req.query.cport) ? parseInt(req.query.cport) : req.query.cport : req.query.cport : null;
|
|
503
|
-
var sport = apiutil.isSafeEntity(req.query.sport) ? apiutil.isSafeString(req.query.sport) ? !isNaN(req.query.sport) ? parseInt(req.query.sport) : req.query.sport : req.query.sport : null;
|
|
504
|
-
|
|
505
|
-
//------------------------------
|
|
506
|
-
// cuk parameters
|
|
507
|
-
//------------------------------
|
|
508
|
-
var ccuk = apiutil.isSafeEntity(req.query.ccuk) ? req.query.ccuk : null;
|
|
509
|
-
var scuk = apiutil.isSafeEntity(req.query.scuk) ? req.query.scuk : null;
|
|
510
|
-
|
|
511
|
-
//------------------------------
|
|
512
|
-
// check service path in url
|
|
513
|
-
//------------------------------
|
|
514
|
-
var requestptn = new RegExp('^/v1/acr/(.*)'); // regex = /^\/v1\/acr\/(.*)/
|
|
515
|
-
var reqmatchs = decodeURI(req.baseUrl).match(requestptn);
|
|
516
|
-
if(apiutil.isEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === apiutil.getSafeString(reqmatchs[1])){
|
|
517
|
-
result = {
|
|
518
|
-
result: false,
|
|
519
|
-
message: 'PUT request url does not have service name'
|
|
520
|
-
};
|
|
521
|
-
|
|
522
|
-
r3logger.elog(result.message);
|
|
523
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
524
|
-
return;
|
|
525
|
-
}
|
|
526
|
-
var servicename = reqmatchs[1].toLowerCase();
|
|
527
|
-
|
|
528
|
-
//------------------------------
|
|
529
|
-
// Get ACR resources
|
|
530
|
-
//------------------------------
|
|
531
|
-
result = k2hr3.getServiceTenantResources(servicename, sip, sport, scuk, req.query.srole, req.query.cip, cport, ccuk, req.query.crole);
|
|
532
|
-
if(!apiutil.isSafeEntity(result) || !apiutil.isSafeEntity(result.result) || false === result.result){
|
|
533
|
-
if(!apiutil.isSafeEntity(result)){
|
|
534
|
-
result = {
|
|
535
|
-
result: false,
|
|
536
|
-
message: 'Could not get ACR resources from getServiceTenantResources'
|
|
537
|
-
};
|
|
538
|
-
}else{
|
|
539
|
-
if(!apiutil.isSafeEntity(result.result)){
|
|
540
|
-
result.result = false;
|
|
541
|
-
}
|
|
542
|
-
if(!apiutil.isSafeEntity(result.message)){
|
|
543
|
-
result.message = 'Could not get error message in response from getServiceTenantResources';
|
|
544
|
-
}
|
|
545
|
-
}
|
|
546
|
-
r3logger.elog(result.message);
|
|
547
|
-
resutil.errResponse(req, res, 403, result); // 403: Forbidden(is this status OK?)
|
|
548
|
-
return;
|
|
549
|
-
}
|
|
550
|
-
|
|
551
|
-
r3logger.dlog('succeed : ' + JSON.stringify(result));
|
|
552
|
-
res.status(200); // 200: OK
|
|
553
|
-
res.send(JSON.stringify(result));
|
|
554
|
-
}
|
|
555
|
-
|
|
556
|
-
//
|
|
557
|
-
// Mountpath : '/v1/acr'
|
|
558
|
-
//
|
|
559
|
-
// GET '/v1/acr/<service>' : get service/tenant names on version 1
|
|
560
|
-
// HEADER : X-Auth-Token => Scoped User token
|
|
561
|
-
// response body : result => true/false
|
|
562
|
-
// message => messages
|
|
563
|
-
// tokeninfo => user/tenant information for verify
|
|
564
|
-
//
|
|
565
|
-
// tokeninfo = {
|
|
566
|
-
// user: : <user name> => user name string
|
|
567
|
-
// tenant: : <tenant name> => tenant name string
|
|
568
|
-
// service: : <service name> => service name string
|
|
569
|
-
// }
|
|
570
|
-
//
|
|
571
|
-
//
|
|
572
|
-
// GET '/v1/acr/<service>' : get resource proxying service on version 1
|
|
573
|
-
// URL argument :
|
|
574
|
-
// "cip" : <IP address> => client IP address(client peer address to service) gave by service
|
|
575
|
-
// "cport" : <port> => client port number specified by client(proxied by service)
|
|
576
|
-
// this value is optional
|
|
577
|
-
// "ccuk" : <cuk string> => client container unique key
|
|
578
|
-
// this value is optional
|
|
579
|
-
// "sport" : <port> => service port number specified by service
|
|
580
|
-
// this value is optional
|
|
581
|
-
// "scuk" : <cuk string> => service container unique key
|
|
582
|
-
// this value is optional
|
|
583
|
-
// "crole" : <role yrn> => client role full yrn specified by client(proxied by service)
|
|
584
|
-
// "srole" : <role yrn> => service role full yrn
|
|
585
|
-
//
|
|
586
|
-
// response body : result => true/false
|
|
587
|
-
// message => messages
|
|
588
|
-
// resource => following format
|
|
589
|
-
//
|
|
590
|
-
// response = [ => allowed null/undefined, this object is the result of verify from service at creating service/tenant
|
|
591
|
-
// {
|
|
592
|
-
// name : <resource name> => resource name which is key name(path) for resource
|
|
593
|
-
// expire : <expire> => undefined/null or integer
|
|
594
|
-
// type : <resource type> => resource data type(string or object), if date is null or '', this value must be string.
|
|
595
|
-
// data : <resource data> => resource data which must be string or object or null/undefined.
|
|
596
|
-
// keys = { : <resource keys> => resource has keys(associative array), or null/undefined.
|
|
597
|
-
// 'foo': bar,: => any value is allowed
|
|
598
|
-
// ...
|
|
599
|
-
// }
|
|
600
|
-
// },
|
|
601
|
-
// ...
|
|
602
|
-
// ]
|
|
603
|
-
//
|
|
604
|
-
router.get('/', function(req, res, next)
|
|
605
|
-
{
|
|
606
|
-
r3logger.dlog('CALL:', req.method, req.url);
|
|
607
|
-
|
|
608
|
-
if('GET' !== req.method){
|
|
609
|
-
// HEAD request comes here, so it should be routed to head function.
|
|
610
|
-
next();
|
|
611
|
-
return;
|
|
612
|
-
}
|
|
613
|
-
res.type('application/json; charset=utf-8');
|
|
614
|
-
|
|
615
|
-
//------------------------------
|
|
616
|
-
// check request type
|
|
617
|
-
//------------------------------
|
|
618
|
-
if(r3token.hasAuthTokenHeader(req)){
|
|
619
|
-
//
|
|
620
|
-
// Get service/tenant name
|
|
621
|
-
//
|
|
622
|
-
rawGetServiceTenantNames(req, res);
|
|
623
|
-
}else{
|
|
624
|
-
//
|
|
625
|
-
// Get resources for service/tenant
|
|
626
|
-
//
|
|
627
|
-
rawGetServiceTenantResources(req, res);
|
|
628
|
-
}
|
|
629
|
-
});
|
|
630
|
-
|
|
631
|
-
//
|
|
632
|
-
// Mountpath : '/v1/acr/*'
|
|
633
|
-
//
|
|
634
|
-
// DELETE '/v1/acr/<service>' : delete service tenant on version 1
|
|
635
|
-
// HEADER : X-Auth-Token => Scoped User token
|
|
636
|
-
// response body : result => true/false
|
|
637
|
-
//
|
|
638
|
-
router.delete('/', function(req, res, next) // eslint-disable-line no-unused-vars
|
|
639
|
-
{
|
|
640
|
-
r3logger.dlog('CALL:', req.method, req.url);
|
|
641
|
-
|
|
642
|
-
res.type('application/json; charset=utf-8');
|
|
643
|
-
|
|
644
|
-
var result;
|
|
645
|
-
if( !apiutil.isSafeEntity(req) ||
|
|
646
|
-
!apiutil.isSafeEntity(req.baseUrl) )
|
|
647
|
-
{
|
|
648
|
-
result = {
|
|
649
|
-
result: false,
|
|
650
|
-
message: 'DELETE request or url is wrong'
|
|
651
|
-
};
|
|
652
|
-
|
|
653
|
-
r3logger.elog(result.message);
|
|
654
|
-
resutil.errResponse(req, res, 400); // 400: Bad Request
|
|
655
|
-
return;
|
|
656
|
-
}
|
|
657
|
-
|
|
658
|
-
//------------------------------
|
|
659
|
-
// check token
|
|
660
|
-
//------------------------------
|
|
661
|
-
var token_result = r3token.checkToken(req, true, true); // scoped user token
|
|
662
|
-
if(!token_result.result){
|
|
663
|
-
r3logger.elog(token_result.message);
|
|
664
|
-
var _status = token_result.status;
|
|
665
|
-
delete token_result.status;
|
|
666
|
-
resutil.errResponse(req, res, _status, token_result);
|
|
667
|
-
return;
|
|
668
|
-
}
|
|
669
|
-
// Check token
|
|
670
|
-
if( !apiutil.isSafeString(token_result.token_info.tenant) ||
|
|
671
|
-
!apiutil.isSafeString(token_result.token_info.user) )
|
|
672
|
-
{
|
|
673
|
-
result = {
|
|
674
|
-
result: false,
|
|
675
|
-
message: 'specified wrong token or it is not scoped user token'
|
|
676
|
-
};
|
|
677
|
-
|
|
678
|
-
r3logger.elog(result.message);
|
|
679
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
680
|
-
return;
|
|
681
|
-
}
|
|
682
|
-
var tenantname = token_result.token_info.tenant;
|
|
683
|
-
var user = token_result.token_info.user;
|
|
684
|
-
|
|
685
|
-
//------------------------------
|
|
686
|
-
// check service path in url
|
|
687
|
-
//------------------------------
|
|
688
|
-
var requestptn = new RegExp('^/v1/acr/(.*)'); // regex = /^\/v1\/acr\/(.*)/
|
|
689
|
-
var reqmatchs = decodeURI(req.baseUrl).match(requestptn);
|
|
690
|
-
if(apiutil.isEmptyArray(reqmatchs) || reqmatchs.length < 2 || '' === apiutil.getSafeString(reqmatchs[1])){
|
|
691
|
-
result = {
|
|
692
|
-
result: false,
|
|
693
|
-
message: 'DELETE request url does not have service name'
|
|
694
|
-
};
|
|
695
|
-
|
|
696
|
-
r3logger.elog(result.message);
|
|
697
|
-
resutil.errResponse(req, res, 400, result); // 400: Bad Request
|
|
698
|
-
return;
|
|
699
|
-
}
|
|
700
|
-
var servicename = reqmatchs[1].toLowerCase();
|
|
701
|
-
|
|
702
|
-
//------------------------------
|
|
703
|
-
// remove service + tenant
|
|
704
|
-
//------------------------------
|
|
705
|
-
result = k2hr3.removeServiceTenant(user, tenantname, servicename);
|
|
706
|
-
if(!apiutil.isSafeEntity(result) || !apiutil.isSafeEntity(result.result) || false === result.result){
|
|
707
|
-
if(!apiutil.isSafeEntity(result)){
|
|
708
|
-
result = {
|
|
709
|
-
result: false,
|
|
710
|
-
message: 'Could not get response from removeServiceTenant'
|
|
711
|
-
};
|
|
712
|
-
}else{
|
|
713
|
-
if(!apiutil.isSafeEntity(result.result)){
|
|
714
|
-
result.result = false;
|
|
715
|
-
}
|
|
716
|
-
if(!apiutil.isSafeEntity(result.message)){
|
|
717
|
-
result.message = 'Could not get error message in response from removeServiceTenant';
|
|
718
|
-
}
|
|
719
|
-
}
|
|
720
|
-
r3logger.elog(result.message);
|
|
721
|
-
resutil.errResponse(req, res, 403); // 403: Forbidden(is this status OK?)
|
|
722
|
-
return;
|
|
723
|
-
}
|
|
724
|
-
r3logger.dlog('succeed : ' + result.message);
|
|
725
|
-
res.status(204); // 204: No Content
|
|
726
|
-
res.send();
|
|
727
|
-
});
|
|
728
|
-
|
|
729
|
-
module.exports = router;
|
|
730
|
-
|
|
731
|
-
/*
|
|
732
|
-
* Local variables:
|
|
733
|
-
* tab-width: 4
|
|
734
|
-
* c-basic-offset: 4
|
|
735
|
-
* End:
|
|
736
|
-
* vim600: noexpandtab sw=4 ts=4 fdm=marker
|
|
737
|
-
* vim<600: noexpandtab sw=4 ts=4
|
|
738
|
-
*/
|