node-server-engine 1.0.5

package/src/middleware/authAdmin/authAdmin.ts

@@ -0,0 +1,114 @@
+import { Request, Response, NextFunction } from 'express';
+import { TokenIssuer } from 'const';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { EngineError } from 'entities/EngineError';
+import { WebError } from 'entities/WebError';
+import { reportDebug, jwtVerify } from 'utils';
+import {} from './authAdmin.types';
+
+const namespace = 'engine:middleware:authAdmin';
+
+/** Generate a middleware to authenticate the client connection with a Admin api */
+export function authAdmin(
+  options: EndpointAuthParams<EndpointAuthType.ADMIN>
+): (request: Request, response: Response, next: NextFunction) => Promise<void> {
+  if (!options.permission)
+    throw new EngineError({
+      message: 'Endpoint using admin auth type must specify permission'
+    });
+  return async (
+    request: Request,
+    response: Response,
+    next: NextFunction
+  ): Promise<void> => {
+    const [scheme, credentials] =
+      request.headers?.authorization?.split(' ') ?? [];
+    // No bearer token has been sent
+    if (!credentials || scheme.toLowerCase() !== 'bearer') {
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: 'No bearer token found',
+        data: { authorization: request.headers?.authorization }
+      });
+    }
+    reportDebug({
+      namespace,
+      message: 'Performing JWT authentication',
+      data: { scheme, credentials }
+    });
+    // Verify token and extract its payload
+    const payload = await jwtVerify(credentials, TokenIssuer.ADMIN_API);
+    reportDebug({
+      namespace,
+      message: 'Extracted user data from JWT',
+      data: { payload, credentials }
+    });
+
+    if (!payload.per)
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: `User token does not contain any permission claim`
+      });
+
+    // User Permission
+    const permissions = payload.per;
+    const userPermissions =
+      permissions instanceof Array ? permissions : [permissions];
+
+    reportDebug({
+      namespace,
+      message: 'Performing Admin Permission check',
+      data: {
+        permissions,
+        endpointPermission: options.permission,
+        adminPermissions: userPermissions
+      }
+    });
+
+    if (!checkUserPermissions(userPermissions, options.permission)) {
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: `User does not have required permission "${options.permission}"`,
+        data: { userPermissions }
+      });
+    }
+
+    // The user object on the request is hydrated with data from the token
+    request.admin = {
+      ...request.admin,
+      email: payload.sub,
+      permissions: userPermissions
+    };
+
+    next();
+  };
+}
+
+/** */
+function checkUserPermissions(
+  userPermissions: Array<string>,
+  endpointPermission: string
+): boolean {
+  const endpointPermissionParts = endpointPermission.split(':');
+  userPermissionLoop: for (const permission of userPermissions) {
+    const permissionParts = permission.split(':');
+
+    // Ignore if both are not same length
+    if (permissionParts.length !== endpointPermissionParts.length)
+      continue userPermissionLoop;
+
+    for (let i = 0; i < permissionParts.length; i++) {
+      // Wildcards get automatic validation, otherwise it must match with the same part of the endpoint permission
+      if (
+        permissionParts[i] !== '*' &&
+        permissionParts[i] !== endpointPermissionParts[i]
+      )
+        continue userPermissionLoop;
+    }
+    return true;
+  }
+  return false;
+}

package/src/middleware/authAdmin/authAdmin.types.ts

@@ -0,0 +1,19 @@
+// Override the Express request object to add the files
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    /** Express request object */
+    interface Request {
+      /** User that identified using a JWT */
+      admin?: RequestAdminProps;
+    }
+  }
+}
+
+/** Admin auth properties of the request */
+export interface RequestAdminProps {
+  /** Email address of the user */
+  email: string;
+  /** List of permissions that the user has */
+  permissions: Array<string>;
+}

package/src/middleware/authAdmin/index.ts

@@ -0,0 +1,2 @@
+export * from './authAdmin';
+export * from './authAdmin.types';

package/src/middleware/authHmac/authHmac.test.ts

@@ -0,0 +1,86 @@
+import crypto from 'crypto';
+import express, { json, Request, Response, Application } from 'express';
+import { faker } from '@faker-js/faker';
+import request from 'supertest';
+import {
+  Endpoint,
+  EndpointAuthType,
+  EndpointMethod,
+  EndpointOptions
+} from 'entities/Endpoint';
+import { signPayload } from 'utils/hmac';
+
+describe('Middleware - authHmac', () => {
+  let app: Application;
+
+  const PATH = '/test';
+  const config: EndpointOptions<EndpointAuthType.HMAC> = {
+    path: PATH,
+    method: EndpointMethod.POST,
+    handler: (req: Request, res: Response) => {
+      res.sendStatus(200);
+    },
+    authType: EndpointAuthType.HMAC,
+    validator: {}
+  };
+
+  beforeEach(() => {
+    app = express();
+    app.use(json());
+    process.env.PAYLOAD_SIGNATURE_SECRET = faker.lorem.slug();
+  });
+
+  it('should allow properly signed requests', async () => {
+    const payload = signPayload({ test: 'test' });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload).expect(200);
+  });
+
+  it('should allow properly signed requests with a custom secret', async () => {
+    const secret = faker.lorem.word();
+    const payload = signPayload({ test: 'test' }, { secret });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC,
+      authParams: { secret }
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload);
+  });
+
+  it('should not allow wrongly signed requests', async () => {
+    const payload = signPayload({ test: 'test' }, { secret: 'hacker' });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload).expect(401);
+  });
+
+  it('should allow signed requests from Github', async () => {
+    const payload = {
+      z: faker.lorem.word(),
+      a: { z: faker.lorem.word(), a: faker.lorem.word() }
+    };
+    const signature = crypto
+      .createHmac('sha1', process.env.PAYLOAD_SIGNATURE_SECRET as string)
+      .update(JSON.stringify(payload))
+      .digest('hex');
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC,
+      authParams: { isGithub: true }
+    });
+    endpoint.register(app);
+    await request(app)
+      .post(PATH)
+      .send(payload)
+      .set({ 'X-Hub-Signature': `sha1=${signature}` })
+      .expect(200);
+  });
+});

package/src/middleware/authHmac/authHmac.ts

@@ -0,0 +1,56 @@
+import { BinaryToTextEncoding } from 'crypto';
+import { Request, Response, NextFunction } from 'express';
+import { HmacPayload } from './authHmac.types';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { WebError } from 'entities/WebError';
+import { verifySignature } from 'utils/hmac';
+import { reportDebug } from 'utils/report';
+
+const namespace = 'engine:middleware:authHmac';
+
+/** Generate an HMAC authentication middleware */
+export function authHmac(
+  options: EndpointAuthParams<EndpointAuthType.HMAC> = {}
+): (req: Request, res: Response, next: NextFunction) => void {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const payload = (
+      req.method === 'GET' ? req.query : req.body
+    ) as HmacPayload;
+    let signature: string | undefined;
+    let signatureSettings;
+    if (options.isGithub) {
+      // For GitHub, the signature is in the header and is has specific settings
+      signature =
+        req.headers['x-hub-signature'] &&
+        (req.headers['x-hub-signature'] as string).substr(5);
+      signatureSettings = {
+        algorithm: 'sha1',
+        sort: false,
+        encode: 'hex' as BinaryToTextEncoding
+      };
+    } else {
+      // In our standard authentication, the signature is included in the payload
+      signature = payload.signature;
+      delete payload.signature;
+    }
+    const settings = { secret: options.secret, ...signatureSettings };
+    if (!signature)
+      throw new WebError({
+        message: 'No signature was provided',
+        errorCode: 'unauthorized',
+        statusCode: 401
+      });
+    reportDebug({
+      namespace,
+      message: 'Performing HMAC authentication',
+      data: { payload, signature, settings }
+    });
+    if (!verifySignature(payload, signature, settings))
+      throw new WebError({
+        message: 'Signature does not match hmac of payload',
+        errorCode: 'unauthorized',
+        statusCode: 401
+      });
+    next();
+  };
+}

package/src/middleware/authHmac/authHmac.types.ts

@@ -0,0 +1,7 @@
+/** Options for HMAC auth */
+export interface HmacPayload {
+  /** Generic object payload */
+  [key: string]: unknown;
+  /** HMAC signature of the whole payload */
+  signature?: string;
+}

package/src/middleware/authHmac/index.ts

@@ -0,0 +1,2 @@
+export * from './authHmac';
+export * from './authHmac.types';

package/src/middleware/authJwt/authJwt.test.ts

@@ -0,0 +1,54 @@
+import { factory, getBearer } from 'backend-test-tools';
+import { expect } from 'chai';
+import { Request, Response } from 'express';
+import { faker } from '@faker-js/faker';
+import { fake } from 'sinon';
+import { authJwt } from './authJwt';
+
+describe('Middleware - Auth JWT', () => {
+  it('should authenticate with a JWT (auth-service)', async () => {
+    const user = factory.build('user');
+    const request = { headers: { authorization: getBearer(user.id) } };
+    const next = fake();
+
+    await authJwt()(request as Request, undefined as unknown as Response, next);
+
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should populate the user object in the request (auth-service)', async () => {
+    const user = factory.build('user');
+    const request = {
+      headers: { authorization: getBearer(user.id) }
+    } as Request;
+    const next = fake();
+
+    await authJwt()(request, undefined as unknown as Response, next);
+
+    expect(request.user).to.not.be.undefined;
+    expect(request.user?.id).to.equal(user.id);
+  });
+
+  it('should throw an error if there is no token', async () => {
+    const request = { headers: {} };
+    const next = fake();
+
+    await expect(
+      authJwt()(request as Request, undefined as unknown as Response, next)
+    ).to.eventually.rejected;
+  });
+
+  it('should throw an error if the audience is not valid', async () => {
+    const user = factory.build('user');
+    const request = {
+      headers: {
+        authorization: getBearer(user.id, { audience: faker.internet.url() })
+      }
+    };
+    const next = fake();
+
+    await expect(
+      authJwt()(request as Request, undefined as unknown as Response, next)
+    ).to.eventually.rejected;
+  });
+});

package/src/middleware/authJwt/authJwt.ts

@@ -0,0 +1,55 @@
+import { Request, Response, NextFunction } from 'express';
+import { TokenIssuer } from 'const';
+import { EngineError } from 'entities/EngineError';
+import { WebError } from 'entities/WebError';
+import { jwtVerify } from 'utils/jwt';
+import { reportDebug } from 'utils/report';
+import {} from './authJwt.types';
+
+const namespace = 'engine:middleware:authJwt';
+
+/** Generate a middleware to authenticate the client connection with a JWT */
+export function authJwt(): (
+  request: Request,
+  response: Response,
+  next: NextFunction
+) => Promise<void> {
+  if (!process.env.ACCESS_TOKEN_AUDIENCE)
+    throw new EngineError({
+      message: 'Env variable ACCESS_TOKEN_AUDIENCE is not defined'
+    });
+
+  return async (
+    request: Request,
+    response: Response,
+    next: NextFunction
+  ): Promise<void> => {
+    const [scheme, credentials] =
+      request.headers?.authorization?.split(' ') ?? [];
+    // No bearer token has been sent
+    if (!credentials || scheme.toLowerCase() !== 'bearer') {
+      throw new WebError({
+        message: 'No bearer token found',
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        data: { authorization: request.headers?.authorization }
+      });
+    }
+    reportDebug({
+      namespace,
+      message: 'Performing JWT authentication',
+      data: { scheme, credentials }
+    });
+    // Verify token and extract its payload
+    const payload = await jwtVerify(credentials, TokenIssuer.AUTH_SERVICE);
+    reportDebug({
+      namespace,
+      message: 'Extracted user data from JWT',
+      data: { payload, credentials }
+    });
+    // The user object on the request is hydrated with data from the token
+    request.user = payload.user;
+
+    next();
+  };
+}

package/src/middleware/authJwt/authJwt.types.ts

@@ -0,0 +1,25 @@
+// Override the Express request object to add the files
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    /** Express request object */
+    interface Request {
+      /** User that identified using a JWT */
+      user?: RequestUser;
+    }
+  }
+}
+
+/** User properties of the request object */
+export interface RequestUser {
+  /** ID of the user */
+  id: string;
+  /** ID of the token used to identify */
+  tokenId: string;
+  /** ID of the device used by the client to obtain the token */
+  deviceId: string;
+  /** Name of the user */
+  name: string;
+  /** Email of the user */
+  email: string;
+}

package/src/middleware/authJwt/index.ts

@@ -0,0 +1,2 @@
+export * from './authJwt';
+export * from './authJwt.types';

package/src/middleware/authStatic/authStatic.test.ts

@@ -0,0 +1,36 @@
+import { expect } from 'chai';
+import { Request, Response } from 'express';
+import { faker } from '@faker-js/faker';
+import { fake } from 'sinon';
+import { authStatic } from './authStatic';
+
+describe('Middleware - Auth Static', () => {
+  beforeEach(() => {
+    process.env.STATIC_TOKEN = faker.lorem.slug();
+  });
+
+  it('should authenticate with static token', () => {
+    const bearer = `Bearer ${process.env.STATIC_TOKEN as string}`;
+    const request = { headers: { authorization: bearer } };
+    const next = fake();
+    authStatic()(request as Request, undefined as unknown as Response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should throw an error if the token is invalid', () => {
+    const bearer = 'Bearer ' + faker.lorem.word();
+    const request = { headers: { authorization: bearer } };
+    const next = fake();
+    expect(() => {
+      authStatic()(request as Request, undefined as unknown as Response, next);
+    }).to.throw();
+  });
+
+  it('should throw an error if there is no token', () => {
+    const request = { headers: {} };
+    const next = fake();
+    expect(() => {
+      authStatic()(request as Request, undefined as unknown as Response, next);
+    }).to.throw();
+  });
+});

package/src/middleware/authStatic/authStatic.ts

@@ -0,0 +1,45 @@
+import { Request, Response, NextFunction } from 'express';
+import { WebError } from 'entities/WebError';
+import { assertEnvironment, envAssert, reportDebug } from 'utils';
+
+const namespace = 'engine:middleware:authStatic';
+
+/**
+ * Generate a middleware to authenticate the client connection with a static token
+ * @return {Function}
+ */
+export function authStatic(): (
+  req: Request,
+  res: Response,
+  next: NextFunction
+) => void {
+  assertEnvironment({ STATIC_TOKEN: envAssert.isString() });
+
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const [scheme, credentials] = req.headers?.authorization?.split(' ') ?? [];
+    // No bearer token has been sent
+    if (!credentials || scheme.toLowerCase() !== 'bearer') {
+      throw new WebError({
+        statusCode: 401,
+        errorCode: 'unauthorized',
+        message: 'No bearer token found',
+        data: { authorization: req.headers?.authorization }
+      });
+    }
+    reportDebug({
+      namespace,
+      message: 'Performing Static authentication',
+      data: { scheme, credentials }
+    });
+    // Verify token
+    if (credentials !== process.env.STATIC_TOKEN) {
+      throw new WebError({
+        statusCode: 401,
+        errorCode: 'unauthorized',
+        message: 'Invalid token supplied',
+        data: { credentials }
+      });
+    }
+    next();
+  };
+}

package/src/middleware/authStatic/index.ts

@@ -0,0 +1 @@
+export * from './authStatic';

package/src/middleware/authTls/authTls.test.ts

@@ -0,0 +1,138 @@
+import { expect } from 'chai';
+import { NextFunction, Request, Response } from 'express';
+import { faker } from '@faker-js/faker';
+import { fake } from 'sinon';
+import { authTlsMiddleware, loadEnv } from './authTls';
+
+describe('Middleware - Auth TLS', () => {
+  const response = {} as unknown as Response;
+  afterEach(() => {
+    delete process.env.ALLOWED_CLIENT_HOSTS;
+    loadEnv();
+  });
+
+  it('should reject unauthenticated requests', () => {
+    const request = { client: { authorized: false } } as unknown as Request;
+    const next = fake();
+    expect(() => {
+      authTlsMiddleware(request, response, next);
+    }).to.throw();
+    expect(next).to.not.have.been.called;
+  });
+
+  it('should accept properly authenticated requests', () => {
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() }
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should reject when not on whitelist', () => {
+    process.env.ALLOWED_CLIENT_HOSTS = faker.internet.domainName();
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() }
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    expect(() => {
+      authTlsMiddleware(request, response, next);
+    }).to.throw();
+    expect(next).to.not.have.been.called;
+  });
+
+  it('should accept when subject is in whitelist', () => {
+    const domain = faker.internet.domainName();
+    process.env.ALLOWED_CLIENT_HOSTS = domain;
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({ subject: { CN: domain } }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should accept when subject is in whitelist specific to this domain', () => {
+    const domain = faker.internet.domainName();
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({ subject: { CN: domain } }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next, { whitelist: [domain] });
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should accept when subject is in altnames as domain', () => {
+    const domain = faker.internet.domainName();
+    process.env.ALLOWED_CLIENT_HOSTS = domain;
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() },
+          subjectaltname: `DNS:${domain}, IP Address:${faker.internet.ip()}`
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  // it('should accept when subject is in altnames as ip', () => {
+  //   const ip = faker.internet.ip();
+  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
+  //   loadEnv();
+  //   const request = {
+  //     socket: {
+  //       getPeerCertificate: () => ({
+  //         subject: { CN: faker.internet.domainName() },
+  //         subjectaltname: `DNS:${faker.internet.domainName()}, IP Address:${ip}`
+  //       }),
+  //       authorized: true
+  //     }
+  //   } as unknown as Request;
+  //   const next = fake();
+  //   authTlsMiddleware(request, response, next);
+  //   expect(next).to.have.been.calledOnceWithExactly();
+  // });
+
+  // it('should pass down subjects', () => {
+  //   const host = faker.internet.domainName();
+  //   const altHost = faker.internet.domainName();
+  //   const ip = faker.internet.ip();
+  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
+  //   loadEnv();
+  //   const request = {
+  //     socket: {
+  //       getPeerCertificate: () => ({
+  //         subject: { CN: host },
+  //         subjectaltname: `DNS:${altHost}, IP Address:${ip}`
+  //       }),
+  //       authorized: true
+  //     }
+  //   } as unknown as Request;
+  //   authTlsMiddleware(request, response, fake() as unknown as NextFunction);
+  //   expect(request.hosts).to.have.members([host, altHost, ip]);
+  // });
+});