node-server-engine 1.4.8 → 1.5.0

package/src/middleware/authJwt/authJwt.ts

@@ -1,55 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-import { TokenIssuer } from 'const';
-import { EngineError } from 'entities/EngineError';
-import { WebError } from 'entities/WebError';
-import { jwtVerify } from 'utils/jwt';
-import { reportDebug } from 'utils/report';
-import {} from './authJwt.types';
-
-const namespace = 'engine:middleware:authJwt';
-
-/** Generate a middleware to authenticate the client connection with a JWT */
-export function authJwt(): (
-  request: Request,
-  response: Response,
-  next: NextFunction
-) => Promise<void> {
-  if (!process.env.ACCESS_TOKEN_AUDIENCE)
-    throw new EngineError({
-      message: 'Env variable ACCESS_TOKEN_AUDIENCE is not defined'
-    });
-
-  return async (
-    request: Request,
-    response: Response,
-    next: NextFunction
-  ): Promise<void> => {
-    const [scheme, credentials] =
-      request.headers?.authorization?.split(' ') ?? [];
-    // No bearer token has been sent
-    if (!credentials || scheme.toLowerCase() !== 'bearer') {
-      throw new WebError({
-        message: 'No bearer token found',
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        data: { authorization: request.headers?.authorization }
-      });
-    }
-    reportDebug({
-      namespace,
-      message: 'Performing JWT authentication',
-      data: { scheme, credentials }
-    });
-    // Verify token and extract its payload
-    const payload = await jwtVerify(credentials, TokenIssuer.AUTH_SERVICE);
-    reportDebug({
-      namespace,
-      message: 'Extracted user data from JWT',
-      data: { payload, credentials }
-    });
-    // The user object on the request is hydrated with data from the token
-    request.user = payload.user;
-
-    next();
-  };
-}

package/src/middleware/authJwt/authJwt.types.ts

@@ -1,14 +0,0 @@
-export {};
-
-// Override the Express request object to add the files
-declare global {
-  // eslint-disable-next-line @typescript-eslint/no-namespace
-  namespace Express {
-    /** Express request object */
-    interface Request {
-      /** User that identified using a JWT */
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      user?: Record<string, any>;
-    }
-  }
-}

package/src/middleware/authJwt/index.ts

@@ -1,2 +0,0 @@
-export * from './authJwt';
-export * from './authJwt.types';

package/src/middleware/authStatic/authStatic.test.ts

@@ -1,36 +0,0 @@
-import { expect } from 'chai';
-import { Request, Response } from 'express';
-import { faker } from '@faker-js/faker';
-import { fake } from 'sinon';
-import { authStatic } from './authStatic';
-
-describe('Middleware - Auth Static', () => {
-  beforeEach(() => {
-    process.env.STATIC_TOKEN = faker.lorem.slug();
-  });
-
-  it('should authenticate with static token', () => {
-    const bearer = `Bearer ${process.env.STATIC_TOKEN as string}`;
-    const request = { headers: { authorization: bearer } };
-    const next = fake();
-    authStatic()(request as Request, undefined as unknown as Response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should throw an error if the token is invalid', () => {
-    const bearer = 'Bearer ' + faker.lorem.word();
-    const request = { headers: { authorization: bearer } };
-    const next = fake();
-    expect(() => {
-      authStatic()(request as Request, undefined as unknown as Response, next);
-    }).to.throw();
-  });
-
-  it('should throw an error if there is no token', () => {
-    const request = { headers: {} };
-    const next = fake();
-    expect(() => {
-      authStatic()(request as Request, undefined as unknown as Response, next);
-    }).to.throw();
-  });
-});

package/src/middleware/authStatic/authStatic.ts

@@ -1,45 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-import { WebError } from 'entities/WebError';
-import { assertEnvironment, envAssert, reportDebug } from 'utils';
-
-const namespace = 'engine:middleware:authStatic';
-
-/**
- * Generate a middleware to authenticate the client connection with a static token
- * @return {Function}
- */
-export function authStatic(): (
-  req: Request,
-  res: Response,
-  next: NextFunction
-) => void {
-  assertEnvironment({ STATIC_TOKEN: envAssert.isString() });
-
-  return (req: Request, res: Response, next: NextFunction): void => {
-    const [scheme, credentials] = req.headers?.authorization?.split(' ') ?? [];
-    // No bearer token has been sent
-    if (!credentials || scheme.toLowerCase() !== 'bearer') {
-      throw new WebError({
-        statusCode: 401,
-        errorCode: 'unauthorized',
-        message: 'No bearer token found',
-        data: { authorization: req.headers?.authorization }
-      });
-    }
-    reportDebug({
-      namespace,
-      message: 'Performing Static authentication',
-      data: { scheme, credentials }
-    });
-    // Verify token
-    if (credentials !== process.env.STATIC_TOKEN) {
-      throw new WebError({
-        statusCode: 401,
-        errorCode: 'unauthorized',
-        message: 'Invalid token supplied',
-        data: { credentials }
-      });
-    }
-    next();
-  };
-}

package/src/middleware/authStatic/index.ts

@@ -1 +0,0 @@
-export * from './authStatic';

package/src/middleware/authTls/authTls.test.ts

@@ -1,138 +0,0 @@
-import { expect } from 'chai';
-import { NextFunction, Request, Response } from 'express';
-import { faker } from '@faker-js/faker';
-import { fake } from 'sinon';
-import { authTlsMiddleware, loadEnv } from './authTls';
-
-describe('Middleware - Auth TLS', () => {
-  const response = {} as unknown as Response;
-  afterEach(() => {
-    delete process.env.ALLOWED_CLIENT_HOSTS;
-    loadEnv();
-  });
-
-  it('should reject unauthenticated requests', () => {
-    const request = { client: { authorized: false } } as unknown as Request;
-    const next = fake();
-    expect(() => {
-      authTlsMiddleware(request, response, next);
-    }).to.throw();
-    expect(next).to.not.have.been.called;
-  });
-
-  it('should accept properly authenticated requests', () => {
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() }
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should reject when not on whitelist', () => {
-    process.env.ALLOWED_CLIENT_HOSTS = faker.internet.domainName();
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() }
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    expect(() => {
-      authTlsMiddleware(request, response, next);
-    }).to.throw();
-    expect(next).to.not.have.been.called;
-  });
-
-  it('should accept when subject is in whitelist', () => {
-    const domain = faker.internet.domainName();
-    process.env.ALLOWED_CLIENT_HOSTS = domain;
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({ subject: { CN: domain } }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should accept when subject is in whitelist specific to this domain', () => {
-    const domain = faker.internet.domainName();
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({ subject: { CN: domain } }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next, { whitelist: [domain] });
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  it('should accept when subject is in altnames as domain', () => {
-    const domain = faker.internet.domainName();
-    process.env.ALLOWED_CLIENT_HOSTS = domain;
-    loadEnv();
-    const request = {
-      socket: {
-        getPeerCertificate: () => ({
-          subject: { CN: faker.internet.domainName() },
-          subjectaltname: `DNS:${domain}, IP Address:${faker.internet.ip()}`
-        }),
-        authorized: true
-      }
-    } as unknown as Request;
-    const next = fake();
-    authTlsMiddleware(request, response, next);
-    expect(next).to.have.been.calledOnceWithExactly();
-  });
-
-  // it('should accept when subject is in altnames as ip', () => {
-  //   const ip = faker.internet.ip();
-  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
-  //   loadEnv();
-  //   const request = {
-  //     socket: {
-  //       getPeerCertificate: () => ({
-  //         subject: { CN: faker.internet.domainName() },
-  //         subjectaltname: `DNS:${faker.internet.domainName()}, IP Address:${ip}`
-  //       }),
-  //       authorized: true
-  //     }
-  //   } as unknown as Request;
-  //   const next = fake();
-  //   authTlsMiddleware(request, response, next);
-  //   expect(next).to.have.been.calledOnceWithExactly();
-  // });
-
-  // it('should pass down subjects', () => {
-  //   const host = faker.internet.domainName();
-  //   const altHost = faker.internet.domainName();
-  //   const ip = faker.internet.ip();
-  //   process.env.ALLOWED_CLIENT_HOSTS = ip;
-  //   loadEnv();
-  //   const request = {
-  //     socket: {
-  //       getPeerCertificate: () => ({
-  //         subject: { CN: host },
-  //         subjectaltname: `DNS:${altHost}, IP Address:${ip}`
-  //       }),
-  //       authorized: true
-  //     }
-  //   } as unknown as Request;
-  //   authTlsMiddleware(request, response, fake() as unknown as NextFunction);
-  //   expect(request.hosts).to.have.members([host, altHost, ip]);
-  // });
-});

package/src/middleware/authTls/authTls.ts

@@ -1,119 +0,0 @@
-import { TLSSocket } from 'tls';
-import { Request, Response, NextFunction } from 'express';
-import { EndpointAuthParams, EndpointAuthType } from 'entities/Endpoint';
-import { WebError } from 'entities/WebError';
-import { assertEnvironment } from 'utils/checkEnvironment';
-import { envAssert } from 'utils/envAssert';
-import { reportDebug } from 'utils/report';
-import {} from './authTls.types';
-
-const namespace = 'engine:middleware:authTls';
-
-/**
- * Returns a middleware for TLS authentication
- * Both client and server must have a certificate signed by the same CA
- * Host name of the client is added to the express request object under 'request.user.host'
- * A limited number of hosts can be specified with the environment variable ALLOWED_CLIENT_HOSTS
- * @param {Object} options
- * @param {Array<String>} options.whitelist - List of certificate Common Name or Alt Name that are permitted to make requests to this endpoint
- * @return {Function}
- */
-export function authTls(
-  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
-): (request: Request, response: Response, next: NextFunction) => void {
-  assertEnvironment({
-    TLS_SERVER_KEY: envAssert.isPath(),
-    TLS_SERVER_CERT: envAssert.isPath()
-  });
-
-  return (request: Request, response: Response, next: NextFunction): void => {
-    authTlsMiddleware(request, response, next, options);
-  };
-}
-
-let allowedClientHosts: Array<string> = [];
-
-/** Load TLS auth related environment variables */
-export function loadEnv(): void {
-  if (process.env.ALLOWED_CLIENT_HOSTS) {
-    assertEnvironment({ ALLOWED_CLIENT_HOSTS: envAssert.isHostList() });
-    allowedClientHosts = process.env.ALLOWED_CLIENT_HOSTS.split(',').map(
-      (value) => value.trim()
-    );
-  } else {
-    allowedClientHosts = [];
-  }
-}
-
-loadEnv();
-
-/** Middleware that handles mTLS based authentication */
-export function authTlsMiddleware(
-  request: Request,
-  response: Response,
-  next: NextFunction,
-  options: EndpointAuthParams<EndpointAuthType.TLS> = {}
-): void {
-  const socket = request.socket as TLSSocket;
-
-  reportDebug({
-    namespace,
-    message: 'TLS socket auth state',
-    data: {
-      authorized: socket?.authorized,
-      authorizationError: (
-        socket as TLSSocket & { authorizationError?: string }
-      )?.authorizationError,
-      peerCert: socket?.getPeerCertificate?.()
-    }
-  });
-
-  // Check if the client's tls certificate is valid
-  if (!socket?.authorized) {
-    throw new WebError({
-      errorCode: 'unauthorized',
-      statusCode: 401,
-      message: 'TLS certificate could not be validated'
-    });
-  }
-
-  // Extract the subjects for the client certificate
-  const clientCertificate = socket.getPeerCertificate();
-  const subjects = [];
-  if (clientCertificate.subject.CN) subjects.push(clientCertificate.subject.CN);
-  if (clientCertificate.subjectaltname?.length) {
-    const altNames = clientCertificate.subjectaltname
-      .split(',')
-      .map((subject) => subject.trim())
-      .map((value) => value.split(':')[1]);
-    subjects.push(...altNames);
-  }
-
-  const whitelist = options.whitelist ?? allowedClientHosts;
-  reportDebug({
-    namespace,
-    message: 'Performing TLS authentication',
-    data: { certificate: clientCertificate, whitelist, subjects }
-  });
-  // Check that the subject is authorized
-  if (whitelist?.length) {
-    let allowed = false;
-    for (const subject of subjects) {
-      if (whitelist.includes(subject)) {
-        allowed = true;
-        break;
-      }
-    }
-    // Throw error if there is no subject in the whitelist
-    if (!allowed)
-      throw new WebError({
-        errorCode: 'unauthorized',
-        statusCode: 401,
-        message: 'Client host is not in the whitelist',
-        data: { subjects }
-      });
-  }
-  // Pas subjects down
-  request.hosts = subjects;
-  next();
-}

package/src/middleware/authTls/authTls.types.ts

@@ -1,13 +0,0 @@
-// Override the Express request object to add the files
-declare global {
-  // eslint-disable-next-line @typescript-eslint/no-namespace
-  namespace Express {
-    /** Express HTTP request */
-    interface Request {
-      /** Host names provided by the mTLS authenticated client */
-      hosts?: Array<string>;
-    }
-  }
-}
-
-export {};

package/src/middleware/authTls/index.ts

@@ -1,2 +0,0 @@
-export * from './authTls';
-export {} from './authTls.types';

package/src/middleware/checkPermission/checkPermission.ts

@@ -1,33 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-
-/** Middleware to check if the user has at least one of the required permissions (case-insensitive). */
-function checkPermission(requiredActions: string | string[]) {
-  return function (req: Request, res: Response, next: NextFunction) {
-    const user = req.user;
-
-    if (!user || !user.permissions) {
-      return res.status(403).json({ message: 'User does not have permissions' });
-    }
-
-    // Normalize input to an array of strings
-    const requiredActionsArray = Array.isArray(requiredActions)
-      ? requiredActions
-      : [requiredActions];
-
-    // Normalize required actions to lowercase
-    const requiredActionsLower = requiredActionsArray.map(action => action.toLowerCase());
-
-    // Check if the user has any of the required permissions (case-insensitive)
-    const hasPermission = user.permissions.some((permission: string) =>
-      requiredActionsLower.includes(permission.toLowerCase())
-    );
-
-    if (!hasPermission) {
-      return res.status(403).json({ message: 'Permission denied' });
-    }
-
-    next();
-  };
-}
-
-export { checkPermission };

package/src/middleware/checkPermission/index.ts

@@ -1 +0,0 @@
-export * from './checkPermission';

package/src/middleware/error/error.test.ts

@@ -1,60 +0,0 @@
-import express, { Application } from 'express';
-import { faker } from '@faker-js/faker';
-import request from 'supertest';
-import { error } from './error';
-import { WebError } from 'entities/WebError';
-
-const PATH = '/test';
-let app: Application;
-
-describe('Middleware - error', () => {
-  beforeEach(() => {
-    app = express();
-  });
-
-  it('should handle WebError', async () => {
-    const errorCode = faker.lorem.word();
-    const message = faker.lorem.sentence();
-    const hint = faker.lorem.sentence();
-    const statusCode = 505;
-    app.get(PATH, () => {
-      throw new WebError({ statusCode, errorCode, message, hint });
-    });
-    app.use(error);
-    await request(app).get(PATH).expect(statusCode, { errorCode, hint });
-  });
-
-  it('should not return hint if none is specified', async () => {
-    const errorCode = faker.lorem.word();
-    const message = faker.lorem.sentence();
-    const statusCode = 505;
-    app.get(PATH, () => {
-      throw new WebError({ statusCode, errorCode, message });
-    });
-    app.use(error);
-    await request(app).get(PATH).expect(statusCode, { errorCode });
-  });
-
-  it('should return server error 500 for unknown error', async () => {
-    app.get(PATH, () => {
-      throw new Error();
-    });
-    app.use(error);
-    await request(app).get(PATH).expect(500, { errorCode: 'server-error' });
-  });
-
-  it('should not trigger if no errors', async () => {
-    app.get(PATH, (req: any, res: any) => res.sendStatus(200));
-    app.use(error);
-    await request(app).get(PATH).expect(200);
-  });
-
-  it('should pass to next if no error to handle', async () => {
-    app.get(PATH, (req, res, next) => {
-      next();
-    });
-    app.use(error);
-    app.get(PATH, (req: any, res: any) => res.sendStatus(200));
-    await request(app).get(PATH).expect(200);
-  });
-});

package/src/middleware/error/error.ts

@@ -1,25 +0,0 @@
-import { Request, Response, NextFunction } from 'express';
-import { WebError } from 'entities/WebError';
-import { reportError, reportDebug } from 'utils/report';
-
-const namespace = 'engine:middleware:error';
-
-/** Handle errors globally */
-export function error(
-  error: Error,
-  request: Request,
-  response: Response,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  next: NextFunction
-): void {
-  reportDebug({ namespace, message: 'Received error', data: { error } });
-  reportError(error, request);
-  if (error instanceof WebError) {
-    response.status(error.statusCode).json({
-      errorCode: error.errorCode,
-      hint: error.hint
-    });
-    return;
-  }
-  response.status(500).json({ errorCode: 'server-error' });
-}

package/src/middleware/error/index.ts

@@ -1 +0,0 @@
-export * from './error';