node-server-engine 1.1.1 → 1.1.3

package/src/middleware/authTls/authTls.test.ts

@@ -1,138 +1,138 @@
-import { expect } from 'chai';
-import { NextFunction, Request, Response } from 'express';
-import { faker } from '@faker-js/faker';
-import { fake } from 'sinon';
-import { authTlsMiddleware, loadEnv } from './authTls';
-
-describe('Middleware - Auth TLS', () => {
-  const response = {} as unknown as Response;
-  afterEach(() => {
-    delete process.env.ALLOWED_CLIENT_HOSTS;
-    loadEnv();
-  });
-
-  it('should reject unauthenticated requests', () => {
-    const request = { client: { authorized: false } } as unknown as Request;
-    const next = fake();
-    expect(() => {
-      authTlsMiddleware(request, response, next);
-    }).to.throw();
-    expect(next).to.not.have.been.called;
-  });
-
-  it('should accept properly authenticated requests', () => {
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() }
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should reject when not on whitelist', () => {
-    process.env.ALLOWED_CLIENT_HOSTS = faker.internet.domainName();
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() }
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    expect(() => {
-      authTlsMiddleware(request, response, next);
-    }).to.throw();
-    expect(next).to.not.have.been.called;
-  });
-
-  it('should accept when subject is in whitelist', () => {
-    const domain = faker.internet.domainName();
-    process.env.ALLOWED_CLIENT_HOSTS = domain;
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({ subject: { CN: domain } }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should accept when subject is in whitelist specific to this domain', () => {
-    const domain = faker.internet.domainName();
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({ subject: { CN: domain } }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next, { whitelist: [domain] });
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should accept when subject is in altnames as domain', () => {
-    const domain = faker.internet.domainName();
-    process.env.ALLOWED_CLIENT_HOSTS = domain;
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() },
-          subjectaltname: `DNS:${domain}, IP Address:${faker.internet.ip()}`
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  // it('should accept when subject is in altnames as ip', () => {
-  //   const ip = faker.internet.ip();
-  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
-  //   loadEnv();
-  //   const request = {
-  //     socket: {
-  //       getPeerCertificate: () => ({
-  //         subject: { CN: faker.internet.domainName() },
-  //         subjectaltname: `DNS:${faker.internet.domainName()}, IP Address:${ip}`
-  //       }),
-  //       authorized: true
-  //     }
-  //   } as unknown as Request;
-  //   const next = fake();
-  //   authTlsMiddleware(request, response, next);
-  //   expect(next).to.have.been.calledOnceWithExactly();
-  // });
-
-  // it('should pass down subjects', () => {
-  //   const host = faker.internet.domainName();
-  //   const altHost = faker.internet.domainName();
-  //   const ip = faker.internet.ip();
-  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
-  //   loadEnv();
-  //   const request = {
-  //     socket: {
-  //       getPeerCertificate: () => ({
-  //         subject: { CN: host },
-  //         subjectaltname: `DNS:${altHost}, IP Address:${ip}`
-  //       }),
-  //       authorized: true
-  //     }
-  //   } as unknown as Request;
-  //   authTlsMiddleware(request, response, fake() as unknown as NextFunction);
-  //   expect(request.hosts).to.have.members([host, altHost, ip]);
-  // });
-});
+import { expect } from 'chai';
+import { NextFunction, Request, Response } from 'express';
+import { faker } from '@faker-js/faker';
+import { fake } from 'sinon';
+import { authTlsMiddleware, loadEnv } from './authTls';
+
+describe('Middleware - Auth TLS', () => {
+  const response = {} as unknown as Response;
+  afterEach(() => {
+    delete process.env.ALLOWED_CLIENT_HOSTS;
+    loadEnv();
+  });
+
+  it('should reject unauthenticated requests', () => {
+    const request = { client: { authorized: false } } as unknown as Request;
+    const next = fake();
+    expect(() => {
+      authTlsMiddleware(request, response, next);
+    }).to.throw();
+    expect(next).to.not.have.been.called;
+  });
+
+  it('should accept properly authenticated requests', () => {
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() }
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should reject when not on whitelist', () => {
+    process.env.ALLOWED_CLIENT_HOSTS = faker.internet.domainName();
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() }
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    expect(() => {
+      authTlsMiddleware(request, response, next);
+    }).to.throw();
+    expect(next).to.not.have.been.called;
+  });
+
+  it('should accept when subject is in whitelist', () => {
+    const domain = faker.internet.domainName();
+    process.env.ALLOWED_CLIENT_HOSTS = domain;
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({ subject: { CN: domain } }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should accept when subject is in whitelist specific to this domain', () => {
+    const domain = faker.internet.domainName();
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({ subject: { CN: domain } }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next, { whitelist: [domain] });
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  it('should accept when subject is in altnames as domain', () => {
+    const domain = faker.internet.domainName();
+    process.env.ALLOWED_CLIENT_HOSTS = domain;
+    loadEnv();
+    const request = {
+      socket: {
+        getPeerCertificate: () => ({
+          subject: { CN: faker.internet.domainName() },
+          subjectaltname: `DNS:${domain}, IP Address:${faker.internet.ip()}`
+        }),
+        authorized: true
+      }
+    } as unknown as Request;
+    const next = fake();
+    authTlsMiddleware(request, response, next);
+    expect(next).to.have.been.calledOnceWithExactly();
+  });
+
+  // it('should accept when subject is in altnames as ip', () => {
+  //   const ip = faker.internet.ip();
+  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
+  //   loadEnv();
+  //   const request = {
+  //     socket: {
+  //       getPeerCertificate: () => ({
+  //         subject: { CN: faker.internet.domainName() },
+  //         subjectaltname: `DNS:${faker.internet.domainName()}, IP Address:${ip}`
+  //       }),
+  //       authorized: true
+  //     }
+  //   } as unknown as Request;
+  //   const next = fake();
+  //   authTlsMiddleware(request, response, next);
+  //   expect(next).to.have.been.calledOnceWithExactly();
+  // });
+
+  // it('should pass down subjects', () => {
+  //   const host = faker.internet.domainName();
+  //   const altHost = faker.internet.domainName();
+  //   const ip = faker.internet.ip();
+  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
+  //   loadEnv();
+  //   const request = {
+  //     socket: {
+  //       getPeerCertificate: () => ({
+  //         subject: { CN: host },
+  //         subjectaltname: `DNS:${altHost}, IP Address:${ip}`
+  //       }),
+  //       authorized: true
+  //     }
+  //   } as unknown as Request;
+  //   authTlsMiddleware(request, response, fake() as unknown as NextFunction);
+  //   expect(request.hosts).to.have.members([host, altHost, ip]);
+  // });
+});

package/src/middleware/authTls/authTls.ts

@@ -1,106 +1,106 @@
-import { TLSSocket } from 'tls';
-import { Request, Response, NextFunction } from 'express';
-import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
-import { WebError } from 'entities/WebError';
-import { assertEnvironment } from 'utils/checkEnvironment';
-import { envAssert } from 'utils/envAssert';
-import { reportDebug } from 'utils/report';
-import {} from './authTls.types';
-
-const namespace = 'engine:middleware:authTls';
-
-/**
- * Returns a middleware for TLS authentication
- * Both client and server must have a certificate signed by the same CA
- * Host name of the client is added to the express request object under 'request.user.host'
- * A limited number of hosts can be specified with the environment variable ALLOWED_CLIENT_HOSTS
- * @param {Object} options
- * @param {Array<String>} options.whitelist - List of certificate Common Name or Alt Name that are permitted to make requests to this endpoint
- * @return {Function}
- */
-export function authTls(
-  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
-): (request: Request, response: Response, next: NextFunction) => void {
-  assertEnvironment({
-    TLS_SERVER_KEY: envAssert.isPath(),
-    TLS_SERVER_CERT: envAssert.isPath()
-  });
-
-  return (request: Request, response: Response, next: NextFunction): void => {
-    authTlsMiddleware(request, response, next, options);
-  };
-}
-
-let allowedClientHosts: Array<string> = [];
-
-/** Load TLS auth related environment variables */
-export function loadEnv(): void {
-  if (process.env.ALLOWED_CLIENT_HOSTS) {
-    assertEnvironment({ ALLOWED_CLIENT_HOSTS: envAssert.isHostList() });
-    allowedClientHosts = process.env.ALLOWED_CLIENT_HOSTS.split(',').map(
-      (value) => value.trim()
-    );
-  } else {
-    allowedClientHosts = [];
-  }
-}
-
-loadEnv();
-
-/** Middleware that handles mTLS based authentication */
-export function authTlsMiddleware(
-  request: Request,
-  response: Response,
-  next: NextFunction,
-  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
-): void {
-  const socket = request.socket as TLSSocket;
-  // Check if the client's tls certificate is valid
-  if (!socket?.authorized) {
-    throw new WebError({
-      errorCode: 'unauthorized',
-      statusCode: 401,
-      message: 'TLS certificate could not be validated'
-    });
-  }
-
-  // Extract the subjects for the client certificate
-  const clientCertificate = socket.getPeerCertificate();
-  const subjects = [];
-  if (clientCertificate.subject.CN) subjects.push(clientCertificate.subject.CN);
-  if (clientCertificate.subjectaltname?.length) {
-    const altNames = clientCertificate.subjectaltname
-      .split(',')
-      .map((subject) => subject.trim())
-      .map((value) => value.split(':')[1]);
-    subjects.push(...altNames);
-  }
-
-  const whitelist = options.whitelist ?? allowedClientHosts;
-  reportDebug({
-    namespace,
-    message: 'Performing TLS authentication',
-    data: { certificate: clientCertificate, whitelist, subjects }
-  });
-  // Check that the subject is authorized
-  if (whitelist?.length) {
-    let allowed = false;
-    for (const subject of subjects) {
-      if (whitelist.includes(subject)) {
-        allowed = true;
-        break;
-      }
-    }
-    // Throw error if there is no subject in the whitelist
-    if (!allowed)
-      throw new WebError({
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        message: 'Client host is not in the whitelist',
-        data: { subjects }
-      });
-  }
-  // Pas subjects down
-  request.hosts = subjects;
-  next();
-}
+import { TLSSocket } from 'tls';
+import { Request, Response, NextFunction } from 'express';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { WebError } from 'entities/WebError';
+import { assertEnvironment } from 'utils/checkEnvironment';
+import { envAssert } from 'utils/envAssert';
+import { reportDebug } from 'utils/report';
+import {} from './authTls.types';
+
+const namespace = 'engine:middleware:authTls';
+
+/**
+ * Returns a middleware for TLS authentication
+ * Both client and server must have a certificate signed by the same CA
+ * Host name of the client is added to the express request object under 'request.user.host'
+ * A limited number of hosts can be specified with the environment variable ALLOWED_CLIENT_HOSTS
+ * @param {Object} options
+ * @param {Array<String>} options.whitelist - List of certificate Common Name or Alt Name that are permitted to make requests to this endpoint
+ * @return {Function}
+ */
+export function authTls(
+  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
+): (request: Request, response: Response, next: NextFunction) => void {
+  assertEnvironment({
+    TLS_SERVER_KEY: envAssert.isPath(),
+    TLS_SERVER_CERT: envAssert.isPath()
+  });
+
+  return (request: Request, response: Response, next: NextFunction): void => {
+    authTlsMiddleware(request, response, next, options);
+  };
+}
+
+let allowedClientHosts: Array<string> = [];
+
+/** Load TLS auth related environment variables */
+export function loadEnv(): void {
+  if (process.env.ALLOWED_CLIENT_HOSTS) {
+    assertEnvironment({ ALLOWED_CLIENT_HOSTS: envAssert.isHostList() });
+    allowedClientHosts = process.env.ALLOWED_CLIENT_HOSTS.split(',').map(
+      (value) => value.trim()
+    );
+  } else {
+    allowedClientHosts = [];
+  }
+}
+
+loadEnv();
+
+/** Middleware that handles mTLS based authentication */
+export function authTlsMiddleware(
+  request: Request,
+  response: Response,
+  next: NextFunction,
+  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
+): void {
+  const socket = request.socket as TLSSocket;
+  // Check if the client's tls certificate is valid
+  if (!socket?.authorized) {
+    throw new WebError({
+      errorCode: 'unauthorized',
+      statusCode: 401,
+      message: 'TLS certificate could not be validated'
+    });
+  }
+
+  // Extract the subjects for the client certificate
+  const clientCertificate = socket.getPeerCertificate();
+  const subjects = [];
+  if (clientCertificate.subject.CN) subjects.push(clientCertificate.subject.CN);
+  if (clientCertificate.subjectaltname?.length) {
+    const altNames = clientCertificate.subjectaltname
+      .split(',')
+      .map((subject) => subject.trim())
+      .map((value) => value.split(':')[1]);
+    subjects.push(...altNames);
+  }
+
+  const whitelist = options.whitelist ?? allowedClientHosts;
+  reportDebug({
+    namespace,
+    message: 'Performing TLS authentication',
+    data: { certificate: clientCertificate, whitelist, subjects }
+  });
+  // Check that the subject is authorized
+  if (whitelist?.length) {
+    let allowed = false;
+    for (const subject of subjects) {
+      if (whitelist.includes(subject)) {
+        allowed = true;
+        break;
+      }
+    }
+    // Throw error if there is no subject in the whitelist
+    if (!allowed)
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: 'Client host is not in the whitelist',
+        data: { subjects }
+      });
+  }
+  // Pas subjects down
+  request.hosts = subjects;
+  next();
+}

package/src/middleware/authTls/authTls.types.ts

@@ -1,13 +1,13 @@
-// Override the Express request object to add the files
-declare global {
-  // eslint-disable-next-line @typescript-eslint/no-namespace
-  namespace Express {
-    /** Express HTTP request */
-    interface Request {
-      /** Host names provided by the mTLS authenticated client */
-      hosts?: Array<string>;
-    }
-  }
-}
-
-export {};
+// Override the Express request object to add the files
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    /** Express HTTP request */
+    interface Request {
+      /** Host names provided by the mTLS authenticated client */
+      hosts?: Array<string>;
+    }
+  }
+}
+
+export {};

package/src/middleware/authTls/index.ts

@@ -1,2 +1,2 @@
-export * from './authTls';
-export {} from './authTls.types';
+export * from './authTls';
+export {} from './authTls.types';

package/src/middleware/checkPermission/checkPermission.ts

@@ -1,35 +1,33 @@
-import { Request, Response, NextFunction } from 'express';
-
-// Middleware to check if the user has at least one of the required permissions (case-insensitive)
-export function checkPermission(requiredActions: string | string[]) {
-  return (req: Request, res: Response, next: NextFunction) => {
-    const user = req.user;
-
-    if (!user || !user.permissions) {
-      return res
-        .status(403)
-        .json({ message: 'User does not have permissions' });
-    }
-
-    // Normalize input to an array of strings
-    const requiredActionsArray = Array.isArray(requiredActions)
-      ? requiredActions
-      : [requiredActions];
-
-    // Normalize required actions to lowercase
-    const requiredActionsLower = requiredActionsArray.map((action) =>
-      action.toLowerCase()
-    );
-
-    // Check if the user has any of the required permissions (case-insensitive)
-    const hasPermission = user.permissions.some((permission: string) =>
-      requiredActionsLower.includes(permission.toLowerCase())
-    );
-
-    if (!hasPermission) {
-      return res.status(403).json({ message: 'Permission denied' });
-    }
-
-    next();
-  };
-}
+import { Request, Response, NextFunction } from 'express';
+
+/** Middleware to check if the user has at least one of the required permissions (case-insensitive). */
+function checkPermission(requiredActions: string | string[]) {
+  return function (req: Request, res: Response, next: NextFunction) {
+    const user = req.user;
+
+    if (!user || !user.permissions) {
+      return res.status(403).json({ message: 'User does not have permissions' });
+    }
+
+    // Normalize input to an array of strings
+    const requiredActionsArray = Array.isArray(requiredActions)
+      ? requiredActions
+      : [requiredActions];
+
+    // Normalize required actions to lowercase
+    const requiredActionsLower = requiredActionsArray.map(action => action.toLowerCase());
+
+    // Check if the user has any of the required permissions (case-insensitive)
+    const hasPermission = user.permissions.some((permission: string) =>
+      requiredActionsLower.includes(permission.toLowerCase())
+    );
+
+    if (!hasPermission) {
+      return res.status(403).json({ message: 'Permission denied' });
+    }
+
+    next();
+  };
+}
+
+export { checkPermission };