node-server-engine 1.0.5

package/src/middleware/authTls/authTls.ts

@@ -0,0 +1,106 @@
+import { TLSSocket } from 'tls';
+import { Request, Response, NextFunction } from 'express';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { WebError } from 'entities/WebError';
+import { assertEnvironment } from 'utils/checkEnvironment';
+import { envAssert } from 'utils/envAssert';
+import { reportDebug } from 'utils/report';
+import {} from './authTls.types';
+
+const namespace = 'engine:middleware:authTls';
+
+/**
+ * Returns a middleware for TLS authentication
+ * Both client and server must have a certificate signed by the same CA
+ * Host name of the client is added to the express request object under 'request.user.host'
+ * A limited number of hosts can be specified with the environment variable ALLOWED_CLIENT_HOSTS
+ * @param {Object} options
+ * @param {Array<String>} options.whitelist - List of certificate Common Name or Alt Name that are permitted to make requests to this endpoint
+ * @return {Function}
+ */
+export function authTls(
+  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
+): (request: Request, response: Response, next: NextFunction) => void {
+  assertEnvironment({
+    TLS_SERVER_KEY: envAssert.isPath(),
+    TLS_SERVER_CERT: envAssert.isPath()
+  });
+
+  return (request: Request, response: Response, next: NextFunction): void => {
+    authTlsMiddleware(request, response, next, options);
+  };
+}
+
+let allowedClientHosts: Array<string> = [];
+
+/** Load TLS auth related environment variables */
+export function loadEnv(): void {
+  if (process.env.ALLOWED_CLIENT_HOSTS) {
+    assertEnvironment({ ALLOWED_CLIENT_HOSTS: envAssert.isHostList() });
+    allowedClientHosts = process.env.ALLOWED_CLIENT_HOSTS.split(',').map(
+      (value) => value.trim()
+    );
+  } else {
+    allowedClientHosts = [];
+  }
+}
+
+loadEnv();
+
+/** Middleware that handles mTLS based authentication */
+export function authTlsMiddleware(
+  request: Request,
+  response: Response,
+  next: NextFunction,
+  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
+): void {
+  const socket = request.socket as TLSSocket;
+  // Check if the client's tls certificate is valid
+  if (!socket?.authorized) {
+    throw new WebError({
+      errorCode: 'unauthorized',
+      statusCode: 401,
+      message: 'TLS certificate could not be validated'
+    });
+  }
+
+  // Extract the subjects for the client certificate
+  const clientCertificate = socket.getPeerCertificate();
+  const subjects = [];
+  if (clientCertificate.subject.CN) subjects.push(clientCertificate.subject.CN);
+  if (clientCertificate.subjectaltname?.length) {
+    const altNames = clientCertificate.subjectaltname
+      .split(',')
+      .map((subject) => subject.trim())
+      .map((value) => value.split(':')[1]);
+    subjects.push(...altNames);
+  }
+
+  const whitelist = options.whitelist ?? allowedClientHosts;
+  reportDebug({
+    namespace,
+    message: 'Performing TLS authentication',
+    data: { certificate: clientCertificate, whitelist, subjects }
+  });
+  // Check that the subject is authorized
+  if (whitelist?.length) {
+    let allowed = false;
+    for (const subject of subjects) {
+      if (whitelist.includes(subject)) {
+        allowed = true;
+        break;
+      }
+    }
+    // Throw error if there is no subject in the whitelist
+    if (!allowed)
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: 'Client host is not in the whitelist',
+        data: { subjects }
+      });
+  }
+  // Pas subjects down
+  request.hosts = subjects;
+  next();
+}

package/src/middleware/authTls/authTls.types.ts

@@ -0,0 +1,13 @@
+// Override the Express request object to add the files
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    /** Express HTTP request */
+    interface Request {
+      /** Host names provided by the mTLS authenticated client */
+      hosts?: Array<string>;
+    }
+  }
+}
+
+export {};

package/src/middleware/authTls/index.ts

@@ -0,0 +1,2 @@
+export * from './authTls';
+export {} from './authTls.types';

package/src/middleware/error/error.test.ts

@@ -0,0 +1,60 @@
+import express, { Application } from 'express';
+import { faker } from '@faker-js/faker';
+import request from 'supertest';
+import { error } from './error';
+import { WebError } from 'entities/WebError';
+
+const PATH = '/test';
+let app: Application;
+
+describe('Middleware - error', () => {
+  beforeEach(() => {
+    app = express();
+  });
+
+  it('should handle WebError', async () => {
+    const errorCode = faker.lorem.word();
+    const message = faker.lorem.sentence();
+    const hint = faker.lorem.sentence();
+    const statusCode = 505;
+    app.get(PATH, () => {
+      throw new WebError({ statusCode, errorCode, message, hint });
+    });
+    app.use(error);
+    await request(app).get(PATH).expect(statusCode, { errorCode, hint });
+  });
+
+  it('should not return hint if none is specified', async () => {
+    const errorCode = faker.lorem.word();
+    const message = faker.lorem.sentence();
+    const statusCode = 505;
+    app.get(PATH, () => {
+      throw new WebError({ statusCode, errorCode, message });
+    });
+    app.use(error);
+    await request(app).get(PATH).expect(statusCode, { errorCode });
+  });
+
+  it('should return server error 500 for unknown error', async () => {
+    app.get(PATH, () => {
+      throw new Error();
+    });
+    app.use(error);
+    await request(app).get(PATH).expect(500, { errorCode: 'server-error' });
+  });
+
+  it('should not trigger if no errors', async () => {
+    app.get(PATH, (req: any, res: any) => res.sendStatus(200));
+    app.use(error);
+    await request(app).get(PATH).expect(200);
+  });
+
+  it('should pass to next if no error to handle', async () => {
+    app.get(PATH, (req, res, next) => {
+      next();
+    });
+    app.use(error);
+    app.get(PATH, (req: any, res: any) => res.sendStatus(200));
+    await request(app).get(PATH).expect(200);
+  });
+});

package/src/middleware/error/error.ts

@@ -0,0 +1,25 @@
+import { Request, Response, NextFunction } from 'express';
+import { WebError } from 'entities/WebError';
+import { reportError, reportDebug } from 'utils/report';
+
+const namespace = 'engine:middleware:error';
+
+/** Handle errors globally */
+export function error(
+  error: Error,
+  request: Request,
+  response: Response,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  next: NextFunction
+): void {
+  reportDebug({ namespace, message: 'Received error', data: { error } });
+  reportError(error, request);
+  if (error instanceof WebError) {
+    response.status(error.statusCode).json({
+      errorCode: error.errorCode,
+      hint: error.hint
+    });
+    return;
+  }
+  response.status(500).json({ errorCode: 'server-error' });
+}

package/src/middleware/error/index.ts

@@ -0,0 +1 @@
+export * from './error';

package/src/middleware/fileUploader/compressAvatar/compressAvatar.ts

@@ -0,0 +1,25 @@
+import { Readable } from 'stream';
+import sharp from 'sharp';
+import { CompressionOptions } from './compressAvatar.types';
+
+/**
+ * Compress the user's avatar before uploading
+ */
+export function compressAvatar(
+  fileStream: Readable,
+  options: CompressionOptions
+): Readable {
+  const {
+    resize: { height, width },
+    quality
+  } = options;
+  const transform = sharp()
+    .resize(width, height, {
+      fit: 'cover'
+    })
+    .toFormat('jpeg', {
+      quality: quality
+    });
+  fileStream.pipe(transform);
+  return fileStream;
+}

package/src/middleware/fileUploader/compressAvatar/compressAvatar.types.ts

@@ -0,0 +1,12 @@
+/** Options to compress image */
+export interface CompressionOptions {
+  /** Set dimensions in which the image will be resized */
+  resize: {
+    /** Height of the resized image */
+    height: number;
+    /** Width of the resized image */
+    width: number;
+  };
+  /** JPG quality factor to apply when compressing */
+  quality: number;
+}

package/src/middleware/fileUploader/compressAvatar/index.ts

@@ -0,0 +1,2 @@
+export * from './compressAvatar';
+export * from './compressAvatar.types';

package/src/middleware/fileUploader/fileUploader.test.ts

@@ -0,0 +1,310 @@
+import { randomUUID } from 'crypto';
+import { Readable } from 'stream';
+import { setTimeout as setTimeoutAsync } from 'timers/promises';
+import axios from 'axios';
+import { expect } from 'chai';
+import { faker } from '@faker-js/faker';
+import FormData from 'form-data';
+import { Sequelize } from 'sequelize';
+import { stub, SinonStub } from 'sinon';
+import request from 'supertest';
+import { EndpointAuthType, EndpointMethod, Endpoint } from 'entities/Endpoint';
+import { Server } from 'entities/Server';
+import { stubPubSub, stubStorage, createTestApp } from 'test';
+
+const PATH = '/test';
+const buffer = Buffer.from(faker.lorem.paragraphs());
+let uploadStub: SinonStub;
+let deleteStub: SinonStub;
+let bucket: string;
+
+describe('Middleware - File Uploader', () => {
+  beforeEach(() => {
+    const { upload, remove } = stubStorage();
+    uploadStub = upload;
+    deleteStub = remove;
+    stub(Sequelize.prototype, 'close');
+    stubPubSub();
+    bucket = faker.lorem.slug();
+  });
+
+  it('should throw an error for multipart requests', async () => {
+    const key = faker.lorem.word();
+    const app = createTestApp({ path: PATH, file: { bucket, key } });
+    await request(app)
+      .post(PATH)
+      .set('Content-Type', 'application/json')
+      .expect(415, { errorCode: 'invalid-content-type' });
+    expect(uploadStub).to.not.have.been.called;
+  });
+
+  // it('should throw an error for unknown file fields', async () => {
+  //   const key = faker.lorem.words();
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     file: { bucket, key: faker.lorem.word() }
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key, buffer, faker.system.fileName())
+  //     .expect(400, { errorCode: 'invalid-file-field', hint: { field: key } });
+  //   expect(uploadStub).to.not.have.been.called;
+  // });
+
+  // it('should throw an error for a file with an unexpected mime type', async () => {
+  //   const key = faker.lorem.word();
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     file: { bucket, key, mimeTypes: [faker.lorem.word()] }
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key, buffer, faker.system.fileName())
+  //     .expect(415, { errorCode: 'invalid-mime-type', hint: { field: key } });
+  //   expect(uploadStub).to.not.have.been.called;
+  // });
+
+  // it('should upload a single file', async () => {
+  //   const key = faker.lorem.word();
+  //   const app = createTestApp({ path: PATH, file: { bucket, key } });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key, buffer, faker.system.fileName())
+  //     .expect(200);
+  //   expect(uploadStub).to.have.been.calledOnce;
+  // });
+
+  // it('should upload multiple files', async () => {
+  //   const key1 = faker.lorem.word();
+  //   const key2 = faker.lorem.word();
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     files: [
+  //       { bucket, key: key1 },
+  //       { bucket, key: key2 }
+  //     ]
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key1, buffer, faker.system.fileName())
+  //     .attach(key2, buffer, faker.system.fileName())
+  //     .expect(200);
+  //   expect(uploadStub).to.have.been.calledTwice;
+  // });
+
+  // it('should handle file error after one has already been uploaded', async () => {
+  //   uploadStub.onSecondCall().rejects(new Error('Fake error'));
+  //   const key1 = faker.lorem.word();
+  //   const key2 = faker.lorem.word();
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     files: [
+  //       { bucket, key: key1, path: '/test' },
+  //       { bucket, key: key2 }
+  //     ]
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key1, buffer, faker.system.fileName())
+  //     .attach(key2, buffer, faker.system.fileName())
+  //     .expect(500, { errorCode: 'server-error' });
+  //   expect(uploadStub).to.have.been.calledTwice;
+  //   expect(deleteStub).to.have.been.calledOnce;
+  // });
+
+  // it('should throw an error if some files are missing', async () => {
+  //   uploadStub.onSecondCall().rejects(new Error('Fake error'));
+  //   const key1 = faker.lorem.word();
+  //   const key2 = faker.lorem.word();
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     files: [
+  //       { bucket, key: key1, path: '/test' },
+  //       { bucket, key: key2, required: true }
+  //     ]
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key1, buffer, faker.system.fileName())
+  //     .expect(400, { errorCode: 'missing-field' });
+  //   expect(uploadStub).to.have.been.calledOnce;
+  //   expect(deleteStub).to.have.been.calledOnce;
+  // });
+
+  // it('should not throw an error when there is no files and all are optional', async () => {
+  //   const key = faker.lorem.word();
+  //   const app = createTestApp({ path: PATH, file: { bucket, key } });
+  //   await request(app).post(PATH).field('id', randomUUID()).expect(200);
+  // });
+
+  // it('should handle additional fields', async () => {
+  //   uploadStub.onSecondCall().rejects(new Error('Fake error'));
+  //   const key1 = randomUUID();
+  //   const key2 = randomUUID();
+  //   const value2 = randomUUID();
+  //   const key3 = randomUUID();
+  //   const value3 = false;
+  //   const key4 = randomUUID();
+  //   const value4 = [randomUUID(), randomUUID()];
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     files: [{ bucket, key: key1, path: '/test' }],
+  //     handler: (req, res) => {
+  //       res.json(req.body);
+  //     },
+  //     validator: {
+  //       [key2]: {
+  //         in: ['body'],
+  //         isArray: { options: { min: 1, max: 1 } },
+  //         customSanitizer: { options: (value: Array<unknown>) => value[0] }
+  //       },
+  //       [`${key2}.*`]: {
+  //         isUUID: { options: 4 }
+  //       },
+  //       [key3]: {
+  //         in: ['body'],
+  //         isArray: { options: { min: 1, max: 1 } },
+  //         customSanitizer: {
+  //           options: (value: Array<unknown>) => value[0] === 'true'
+  //         }
+  //       },
+  //       [`${key3}.*`]: {
+  //         isBoolean: true
+  //       },
+  //       [key4]: {
+  //         in: ['body'],
+  //         isArray: { options: { min: 2, max: 2 } }
+  //       },
+  //       [`${key4}.*`]: {
+  //         isUUID: { options: 4 }
+  //       }
+  //     }
+  //   });
+  //   const { body } = <
+  //     {
+  //       /** */
+  //       body: { [name: string]: string };
+  //     }
+  //   >await request(app).post(PATH).attach(key1, buffer, faker.system.fileName()).field(key2, value2).field(key3, value3).field(key4, value4).expect(200);
+  //   expect(uploadStub).to.have.been.calledOnce;
+  //   expect(deleteStub).to.not.have.been.calledOnce;
+  //   expect(body[key2]).to.equal(value2);
+  //   expect(body[key3]).to.equal(value3);
+  //   expect(body[key4]).to.deep.equal(value4);
+  // });
+
+  // it('should handle field validation error', async () => {
+  //   uploadStub.onSecondCall().rejects(new Error('Fake error'));
+  //   const key1 = faker.lorem.word();
+  //   const key2 = faker.lorem.word();
+  //   const value2 = randomUUID();
+  //   const key3 = faker.lorem.word();
+  //   const value3 = [randomUUID(), randomUUID()];
+  //   const app = createTestApp({
+  //     path: PATH,
+  //     files: [{ bucket, key: key1, path: '/test' }],
+  //     handler: (req, res) => {
+  //       res.json(req.body);
+  //     },
+  //     validator: {
+  //       [`${key2}.*`]: {
+  //         isLength: { options: { max: 1 } }
+  //       },
+  //       [key2]: {
+  //         in: ['body'],
+  //         isArray: { options: { min: 1, max: 1 } },
+  //         customSanitizer: { options: (value: Array<unknown>) => value[0] }
+  //       },
+  //       [key3]: {
+  //         in: ['body'],
+  //         isArray: { options: { min: 1, max: 1 } }
+  //       }
+  //     }
+  //   });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key1, buffer, faker.system.fileName())
+  //     .field(key2, value2)
+  //     .field(key3, value3)
+  //     .expect(400, {
+  //       errorCode: 'invalid-request',
+  //       hint: { [`${key2}[0]`]: 'Invalid value', [key3]: 'Invalid value' }
+  //     });
+  // });
+
+  // it('should delete already uploaded files on cancel request', async () => {
+  //   const key1 = faker.lorem.word();
+  //   const key2 = faker.lorem.word();
+  //   const key3 = faker.lorem.word();
+  //   process.env.PORT = '3000';
+  //   process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+
+  //   const server = new Server({
+  //     endpoints: [
+  //       new Endpoint({
+  //         method: EndpointMethod.POST,
+  //         authType: EndpointAuthType.NONE,
+  //         handler: (req, res): void => {
+  //           res.json({ message: 'success' });
+  //         },
+  //         files: [
+  //           { bucket, key: key1 },
+  //           { bucket, key: key2 },
+  //           { bucket, key: key3 }
+  //         ],
+  //         path: PATH,
+  //         validator: {}
+  //       })
+  //     ]
+  //   });
+
+  //   await server.init();
+
+  //   const form = new FormData();
+  //   form.append(key1, buffer);
+  //   form.append(key2, buffer);
+  //   form.append(key3, buffer);
+
+  //   const requestConfig = {
+  //     headers: {
+  //       ...form.getHeaders()
+  //     }
+  //   };
+
+  //   // eslint-disable-next-line import/no-named-as-default-member
+  //   const abort = axios.CancelToken.source();
+
+  //   setTimeout(() => {
+  //     abort.cancel(`Request Cancelled`);
+  //   }, 50);
+
+  //   uploadStub.callsFake(async (file: Readable, bucket: string) => {
+  //     file.resume();
+  //     await setTimeoutAsync(1);
+  //     return { bucket };
+  //   });
+
+  //   await axios
+  //     .post(`https://localhost:3000` + PATH, form, {
+  //       ...requestConfig,
+  //       cancelToken: abort.token
+  //     })
+  //     .catch((err: Error) => {
+  //       expect(err.message).to.equal('Request Cancelled');
+  //     });
+
+  //   expect(uploadStub).to.have.been.calledThrice;
+  //   await server.shutdown();
+  //   process.env.PORT = '8080';
+  // });
+
+  // it('should compress avatar before uploading', async () => {
+  //   const key = 'avatar';
+  //   const app = createTestApp({ path: PATH, file: { bucket, key } });
+  //   await request(app)
+  //     .post(PATH)
+  //     .attach(key, buffer, faker.system.fileName())
+  //     .expect(200);
+  //   expect(uploadStub).to.have.been.calledOnce;
+  // });
+});