node-server-engine 1.1.2 → 1.1.3

package/src/middleware/authAdmin/authAdmin.ts

@@ -1,114 +1,114 @@
-import { Request, Response, NextFunction } from 'express';
-import { TokenIssuer } from 'const';
-import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
-import { EngineError } from 'entities/EngineError';
-import { WebError } from 'entities/WebError';
-import { reportDebug, jwtVerify } from 'utils';
-import {} from './authAdmin.types';
-
-const namespace = 'engine:middleware:authAdmin';
-
-/** Generate a middleware to authenticate the client connection with a Admin api */
-export function authAdmin(
-  options: EndpointAuthParams<EndpointAuthType.ADMIN>
-): (request: Request, response: Response, next: NextFunction) => Promise<void> {
-  if (!options.permission)
-    throw new EngineError({
-      message: 'Endpoint using admin auth type must specify permission'
-    });
-  return async (
-    request: Request,
-    response: Response,
-    next: NextFunction
-  ): Promise<void> => {
-    const [scheme, credentials] =
-      request.headers?.authorization?.split(' ') ?? [];
-    // No bearer token has been sent
-    if (!credentials || scheme.toLowerCase() !== 'bearer') {
-      throw new WebError({
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        message: 'No bearer token found',
-        data: { authorization: request.headers?.authorization }
-      });
-    }
-    reportDebug({
-      namespace,
-      message: 'Performing JWT authentication',
-      data: { scheme, credentials }
-    });
-    // Verify token and extract its payload
-    const payload = await jwtVerify(credentials, TokenIssuer.ADMIN_API);
-    reportDebug({
-      namespace,
-      message: 'Extracted user data from JWT',
-      data: { payload, credentials }
-    });
-
-    if (!payload.per)
-      throw new WebError({
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        message: `User token does not contain any permission claim`
-      });
-
-    // User Permission
-    const permissions = payload.per;
-    const userPermissions =
-      permissions instanceof Array ? permissions : [permissions];
-
-    reportDebug({
-      namespace,
-      message: 'Performing Admin Permission check',
-      data: {
-        permissions,
-        endpointPermission: options.permission,
-        adminPermissions: userPermissions
-      }
-    });
-
-    if (!checkUserPermissions(userPermissions, options.permission)) {
-      throw new WebError({
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        message: `User does not have required permission "${options.permission}"`,
-        data: { userPermissions }
-      });
-    }
-
-    // The user object on the request is hydrated with data from the token
-    request.admin = {
-      ...request.admin,
-      email: payload.sub,
-      permissions: userPermissions
-    };
-
-    next();
-  };
-}
-
-/** */
-function checkUserPermissions(
-  userPermissions: Array<string>,
-  endpointPermission: string
-): boolean {
-  const endpointPermissionParts = endpointPermission.split(':');
-  userPermissionLoop: for (const permission of userPermissions) {
-    const permissionParts = permission.split(':');
-
-    // Ignore if both are not same length
-    if (permissionParts.length !== endpointPermissionParts.length)
-      continue userPermissionLoop;
-
-    for (let i = 0; i < permissionParts.length; i++) {
-      // Wildcards get automatic validation, otherwise it must match with the same part of the endpoint permission
-      if (
-        permissionParts[i] !== '*' &&
-        permissionParts[i] !== endpointPermissionParts[i]
-      )
-        continue userPermissionLoop;
-    }
-    return true;
-  }
-  return false;
-}
+import { Request, Response, NextFunction } from 'express';
+import { TokenIssuer } from 'const';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { EngineError } from 'entities/EngineError';
+import { WebError } from 'entities/WebError';
+import { reportDebug, jwtVerify } from 'utils';
+import {} from './authAdmin.types';
+
+const namespace = 'engine:middleware:authAdmin';
+
+/** Generate a middleware to authenticate the client connection with a Admin api */
+export function authAdmin(
+  options: EndpointAuthParams<EndpointAuthType.ADMIN>
+): (request: Request, response: Response, next: NextFunction) => Promise<void> {
+  if (!options.permission)
+    throw new EngineError({
+      message: 'Endpoint using admin auth type must specify permission'
+    });
+  return async (
+    request: Request,
+    response: Response,
+    next: NextFunction
+  ): Promise<void> => {
+    const [scheme, credentials] =
+      request.headers?.authorization?.split(' ') ?? [];
+    // No bearer token has been sent
+    if (!credentials || scheme.toLowerCase() !== 'bearer') {
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: 'No bearer token found',
+        data: { authorization: request.headers?.authorization }
+      });
+    }
+    reportDebug({
+      namespace,
+      message: 'Performing JWT authentication',
+      data: { scheme, credentials }
+    });
+    // Verify token and extract its payload
+    const payload = await jwtVerify(credentials, TokenIssuer.ADMIN_API);
+    reportDebug({
+      namespace,
+      message: 'Extracted user data from JWT',
+      data: { payload, credentials }
+    });
+
+    if (!payload.per)
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: `User token does not contain any permission claim`
+      });
+
+    // User Permission
+    const permissions = payload.per;
+    const userPermissions =
+      permissions instanceof Array ? permissions : [permissions];
+
+    reportDebug({
+      namespace,
+      message: 'Performing Admin Permission check',
+      data: {
+        permissions,
+        endpointPermission: options.permission,
+        adminPermissions: userPermissions
+      }
+    });
+
+    if (!checkUserPermissions(userPermissions, options.permission)) {
+      throw new WebError({
+        errorCode: 'unauthorized',
+        statusCode: 401,
+        message: `User does not have required permission "${options.permission}"`,
+        data: { userPermissions }
+      });
+    }
+
+    // The user object on the request is hydrated with data from the token
+    request.admin = {
+      ...request.admin,
+      email: payload.sub,
+      permissions: userPermissions
+    };
+
+    next();
+  };
+}
+
+/** */
+function checkUserPermissions(
+  userPermissions: Array<string>,
+  endpointPermission: string
+): boolean {
+  const endpointPermissionParts = endpointPermission.split(':');
+  userPermissionLoop: for (const permission of userPermissions) {
+    const permissionParts = permission.split(':');
+
+    // Ignore if both are not same length
+    if (permissionParts.length !== endpointPermissionParts.length)
+      continue userPermissionLoop;
+
+    for (let i = 0; i < permissionParts.length; i++) {
+      // Wildcards get automatic validation, otherwise it must match with the same part of the endpoint permission
+      if (
+        permissionParts[i] !== '*' &&
+        permissionParts[i] !== endpointPermissionParts[i]
+      )
+        continue userPermissionLoop;
+    }
+    return true;
+  }
+  return false;
+}

package/src/middleware/authAdmin/authAdmin.types.ts

@@ -1,19 +1,19 @@
-// Override the Express request object to add the files
-declare global {
-  // eslint-disable-next-line @typescript-eslint/no-namespace
-  namespace Express {
-    /** Express request object */
-    interface Request {
-      /** User that identified using a JWT */
-      admin?: RequestAdminProps;
-    }
-  }
-}
-
-/** Admin auth properties of the request */
-export interface RequestAdminProps {
-  /** Email address of the user */
-  email: string;
-  /** List of permissions that the user has */
-  permissions: Array<string>;
-}
+// Override the Express request object to add the files
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    /** Express request object */
+    interface Request {
+      /** User that identified using a JWT */
+      admin?: RequestAdminProps;
+    }
+  }
+}
+
+/** Admin auth properties of the request */
+export interface RequestAdminProps {
+  /** Email address of the user */
+  email: string;
+  /** List of permissions that the user has */
+  permissions: Array<string>;
+}

package/src/middleware/authAdmin/index.ts

@@ -1,2 +1,2 @@
-export * from './authAdmin';
-export * from './authAdmin.types';
+export * from './authAdmin';
+export * from './authAdmin.types';

package/src/middleware/authHmac/authHmac.test.ts

@@ -1,86 +1,86 @@
-import crypto from 'crypto';
-import express, { json, Request, Response, Application } from 'express';
-import { faker } from '@faker-js/faker';
-import request from 'supertest';
-import {
-  Endpoint,
-  EndpointAuthType,
-  EndpointMethod,
-  EndpointOptions
-} from 'entities/Endpoint';
-import { signPayload } from 'utils/hmac';
-
-describe('Middleware - authHmac', () => {
-  let app: Application;
-
-  const PATH = '/test';
-  const config: EndpointOptions<EndpointAuthType.HMAC> = {
-    path: PATH,
-    method: EndpointMethod.POST,
-    handler: (req: Request, res: Response) => {
-      res.sendStatus(200);
-    },
-    authType: EndpointAuthType.HMAC,
-    validator: {}
-  };
-
-  beforeEach(() => {
-    app = express();
-    app.use(json());
-    process.env.PAYLOAD_SIGNATURE_SECRET = faker.lorem.slug();
-  });
-
-  it('should allow properly signed requests', async () => {
-    const payload = signPayload({ test: 'test' });
-    const endpoint = new Endpoint({
-      ...config,
-      authType: EndpointAuthType.HMAC
-    });
-    endpoint.register(app);
-    await request(app).post(PATH).send(payload).expect(200);
-  });
-
-  it('should allow properly signed requests with a custom secret', async () => {
-    const secret = faker.lorem.word();
-    const payload = signPayload({ test: 'test' }, { secret });
-    const endpoint = new Endpoint({
-      ...config,
-      authType: EndpointAuthType.HMAC,
-      authParams: { secret }
-    });
-    endpoint.register(app);
-    await request(app).post(PATH).send(payload);
-  });
-
-  it('should not allow wrongly signed requests', async () => {
-    const payload = signPayload({ test: 'test' }, { secret: 'hacker' });
-    const endpoint = new Endpoint({
-      ...config,
-      authType: EndpointAuthType.HMAC
-    });
-    endpoint.register(app);
-    await request(app).post(PATH).send(payload).expect(401);
-  });
-
-  it('should allow signed requests from Github', async () => {
-    const payload = {
-      z: faker.lorem.word(),
-      a: { z: faker.lorem.word(), a: faker.lorem.word() }
-    };
-    const signature = crypto
-      .createHmac('sha1', process.env.PAYLOAD_SIGNATURE_SECRET as string)
-      .update(JSON.stringify(payload))
-      .digest('hex');
-    const endpoint = new Endpoint({
-      ...config,
-      authType: EndpointAuthType.HMAC,
-      authParams: { isGithub: true }
-    });
-    endpoint.register(app);
-    await request(app)
-      .post(PATH)
-      .send(payload)
-      .set({ 'X-Hub-Signature': `sha1=${signature}` })
-      .expect(200);
-  });
-});
+import crypto from 'crypto';
+import express, { json, Request, Response, Application } from 'express';
+import { faker } from '@faker-js/faker';
+import request from 'supertest';
+import {
+  Endpoint,
+  EndpointAuthType,
+  EndpointMethod,
+  EndpointOptions
+} from 'entities/Endpoint';
+import { signPayload } from 'utils/hmac';
+
+describe('Middleware - authHmac', () => {
+  let app: Application;
+
+  const PATH = '/test';
+  const config: EndpointOptions<EndpointAuthType.HMAC> = {
+    path: PATH,
+    method: EndpointMethod.POST,
+    handler: (req: Request, res: Response) => {
+      res.sendStatus(200);
+    },
+    authType: EndpointAuthType.HMAC,
+    validator: {}
+  };
+
+  beforeEach(() => {
+    app = express();
+    app.use(json());
+    process.env.PAYLOAD_SIGNATURE_SECRET = faker.lorem.slug();
+  });
+
+  it('should allow properly signed requests', async () => {
+    const payload = signPayload({ test: 'test' });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload).expect(200);
+  });
+
+  it('should allow properly signed requests with a custom secret', async () => {
+    const secret = faker.lorem.word();
+    const payload = signPayload({ test: 'test' }, { secret });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC,
+      authParams: { secret }
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload);
+  });
+
+  it('should not allow wrongly signed requests', async () => {
+    const payload = signPayload({ test: 'test' }, { secret: 'hacker' });
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC
+    });
+    endpoint.register(app);
+    await request(app).post(PATH).send(payload).expect(401);
+  });
+
+  it('should allow signed requests from Github', async () => {
+    const payload = {
+      z: faker.lorem.word(),
+      a: { z: faker.lorem.word(), a: faker.lorem.word() }
+    };
+    const signature = crypto
+      .createHmac('sha1', process.env.PAYLOAD_SIGNATURE_SECRET as string)
+      .update(JSON.stringify(payload))
+      .digest('hex');
+    const endpoint = new Endpoint({
+      ...config,
+      authType: EndpointAuthType.HMAC,
+      authParams: { isGithub: true }
+    });
+    endpoint.register(app);
+    await request(app)
+      .post(PATH)
+      .send(payload)
+      .set({ 'X-Hub-Signature': `sha1=${signature}` })
+      .expect(200);
+  });
+});

package/src/middleware/authHmac/authHmac.ts

@@ -1,56 +1,56 @@
-import { BinaryToTextEncoding } from 'crypto';
-import { Request, Response, NextFunction } from 'express';
-import { HmacPayload } from './authHmac.types';
-import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
-import { WebError } from 'entities/WebError';
-import { verifySignature } from 'utils/hmac';
-import { reportDebug } from 'utils/report';
-
-const namespace = 'engine:middleware:authHmac';
-
-/** Generate an HMAC authentication middleware */
-export function authHmac(
-  options: EndpointAuthParams<EndpointAuthType.HMAC> = {}
-): (req: Request, res: Response, next: NextFunction) => void {
-  return (req: Request, res: Response, next: NextFunction): void => {
-    const payload = (
-      req.method === 'GET' ? req.query : req.body
-    ) as HmacPayload;
-    let signature: string | undefined;
-    let signatureSettings;
-    if (options.isGithub) {
-      // For GitHub, the signature is in the header and is has specific settings
-      signature =
-        req.headers['x-hub-signature'] &&
-        (req.headers['x-hub-signature'] as string).substr(5);
-      signatureSettings = {
-        algorithm: 'sha1',
-        sort: false,
-        encode: 'hex' as BinaryToTextEncoding
-      };
-    } else {
-      // In our standard authentication, the signature is included in the payload
-      signature = payload.signature;
-      delete payload.signature;
-    }
-    const settings = { secret: options.secret, ...signatureSettings };
-    if (!signature)
-      throw new WebError({
-        message: 'No signature was provided',
-        errorCode: 'unauthorized',
-        statusCode: 401
-      });
-    reportDebug({
-      namespace,
-      message: 'Performing HMAC authentication',
-      data: { payload, signature, settings }
-    });
-    if (!verifySignature(payload, signature, settings))
-      throw new WebError({
-        message: 'Signature does not match hmac of payload',
-        errorCode: 'unauthorized',
-        statusCode: 401
-      });
-    next();
-  };
-}
+import { BinaryToTextEncoding } from 'crypto';
+import { Request, Response, NextFunction } from 'express';
+import { HmacPayload } from './authHmac.types';
+import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
+import { WebError } from 'entities/WebError';
+import { verifySignature } from 'utils/hmac';
+import { reportDebug } from 'utils/report';
+
+const namespace = 'engine:middleware:authHmac';
+
+/** Generate an HMAC authentication middleware */
+export function authHmac(
+  options: EndpointAuthParams<EndpointAuthType.HMAC> = {}
+): (req: Request, res: Response, next: NextFunction) => void {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const payload = (
+      req.method === 'GET' ? req.query : req.body
+    ) as HmacPayload;
+    let signature: string | undefined;
+    let signatureSettings;
+    if (options.isGithub) {
+      // For GitHub, the signature is in the header and is has specific settings
+      signature =
+        req.headers['x-hub-signature'] &&
+        (req.headers['x-hub-signature'] as string).substr(5);
+      signatureSettings = {
+        algorithm: 'sha1',
+        sort: false,
+        encode: 'hex' as BinaryToTextEncoding
+      };
+    } else {
+      // In our standard authentication, the signature is included in the payload
+      signature = payload.signature;
+      delete payload.signature;
+    }
+    const settings = { secret: options.secret, ...signatureSettings };
+    if (!signature)
+      throw new WebError({
+        message: 'No signature was provided',
+        errorCode: 'unauthorized',
+        statusCode: 401
+      });
+    reportDebug({
+      namespace,
+      message: 'Performing HMAC authentication',
+      data: { payload, signature, settings }
+    });
+    if (!verifySignature(payload, signature, settings))
+      throw new WebError({
+        message: 'Signature does not match hmac of payload',
+        errorCode: 'unauthorized',
+        statusCode: 401
+      });
+    next();
+  };
+}

package/src/middleware/authHmac/authHmac.types.ts

@@ -1,7 +1,7 @@
-/** Options for HMAC auth */
-export interface HmacPayload {
-  /** Generic object payload */
-  [key: string]: unknown;
-  /** HMAC signature of the whole payload */
-  signature?: string;
-}
+/** Options for HMAC auth */
+export interface HmacPayload {
+  /** Generic object payload */
+  [key: string]: unknown;
+  /** HMAC signature of the whole payload */
+  signature?: string;
+}

package/src/middleware/authHmac/index.ts

@@ -1,2 +1,2 @@
-export * from './authHmac';
-export * from './authHmac.types';
+export * from './authHmac';
+export * from './authHmac.types';