node-server-engine 1.4.8 → 1.5.0

package/src/utils/jwt/jwt.ts

@@ -1,182 +0,0 @@
-import {
-  verify,
-  JwtHeader,
-  SigningKeyCallback,
-  Algorithm,
-  VerifyOptions,
-  sign
-} from 'jsonwebtoken';
-import { UserTokenPayload } from './jwt.types';
-import { TokenIssuer } from 'const';
-import { EngineError } from 'entities/EngineError';
-import { KeySet } from 'entities/KeySet';
-import { WebError } from 'entities/WebError';
-import { assertEnvironment } from 'utils/checkEnvironment';
-import { envAssert } from 'utils/envAssert';
-import { reportDebug } from 'utils/report';
-import { getSecretOrFile } from 'utils';
-
-export let keySet: KeySet | undefined;
-
-const namespace = 'engine:utils:jwt';
-
-/** Initiate key fetching mechanism */
-export async function initKeySets(): Promise<void> {
-  // Create the KeySet instance
-  // The auth-service fetches its key from its disk and not from a network request
-  // This prevents fetch failures the first time the auth-service is started
-  if (process.env.CHART === 'auth-service') {
-    if (!process.env.ECDSA_PUBLIC_KEY)
-      throw new EngineError({
-        message: 'Environment variable "ECDSA_PUBLIC_KEY" is not defined'
-      });
-    keySet = new KeySet(process.env.ECDSA_PUBLIC_KEY, { file: true });
-  } else {
-    if (process.env.AUTH_SERVICE_URL)
-      keySet = new KeySet(
-        `${process.env.AUTH_SERVICE_URL}/.well-known/jwks.json`,
-        { internal: true }
-      );
-    else
-      keySet = new KeySet(`./keys/jwks.json`, { internal: true, file: true });
-
-    if (!keySet)
-      throw new EngineError({
-        message:
-          'Environment variable "AUTH_SERVICE_URL" is not defined or JWKS not found'
-      });
-  }
-  const promise = [keySet.init.bind(keySet)()];
-
-  await Promise.all(promise);
-}
-
-/** Stop fetching keys regularly */
-export function shutdownKeySets(): void {
-  if (keySet) keySet.shutdown.bind(keySet)();
-}
-
-/** Get the JWT public key */
-function jwtGetKey(header: JwtHeader, callback: SigningKeyCallback): void {
-  // In test environment we return the symmetric signature secret
-  if (process.env.NODE_ENV === 'test') {
-    callback(null, process.env.JWT_SECRET);
-    return;
-  }
-  // Check that KeySet has been initialized
-  if (!keySet) {
-    callback(new EngineError({ message: 'KeySet has not been initialized' }));
-    return;
-  }
-  // Check that the token has a key ID
-  if (!header.kid) {
-    callback(
-      new EngineError({
-        message:
-          'Token has not key ID in header, impossible to match with known key',
-        data: header
-      })
-    );
-    return;
-  }
-
-  // In test environment we use a symmetrical secret bases signature
-  if (process.env.NODE_ENV === 'test') {
-    callback(null, process.env.JWT_SECRET);
-    return;
-  }
-  reportDebug({
-    namespace,
-    message: `Looking for key with ID "${header.kid}"`
-  });
-  // Go through each key set to check if the token's key is in one of them
-  let key;
-  try {
-    key = keySet.getKey(header.kid);
-  } catch (error: Error | null | unknown) {
-    callback(error instanceof Error ? error : null);
-    return;
-  }
-
-  if (key) {
-    reportDebug({ namespace, message: `Found key with ID "${header.kid}"` });
-    callback(null, key);
-    return;
-  }
-  callback(
-    new WebError({
-      statusCode: 401,
-      errorCode: 'unauthorized',
-      message: 'Could not find the tokens key in any key set',
-      data: { kid: header.kid }
-    })
-  );
-}
-
-/** Verify an user Json Web Token */
-export async function jwtVerify(
-  token: string,
-  issuer: TokenIssuer = TokenIssuer.AUTH_SERVICE
-): Promise<UserTokenPayload> {
-  let algorithms = ['ES256' as Algorithm];
-  if (process.env.NODE_ENV === 'test') {
-    assertEnvironment({ JWT_SECRET: envAssert.isString() });
-    algorithms = ['HS256' as Algorithm];
-  }
-  assertEnvironment({
-    ACCESS_TOKEN_AUDIENCE: envAssert.isString(),
-    ACCESS_TOKEN_ISSUER: envAssert.isString(),
-    ACCESS_TOKEN_EXPIRATION_TIME: envAssert.isString()
-  });
-  let options: VerifyOptions | undefined;
-
-  switch (issuer) {
-    case TokenIssuer.AUTH_SERVICE:
-      options = {
-        audience: [process.env.ACCESS_TOKEN_AUDIENCE as string],
-        issuer: [process.env.ACCESS_TOKEN_ISSUER as string],
-        algorithms
-      };
-      break;
-    default:
-      throw new EngineError({
-        message: `Invalid token issuer specified "${issuer as string}"`
-      });
-  }
-
-  return new Promise<UserTokenPayload>((resolve, reject) => {
-    verify(token, jwtGetKey, options, (error, result) => {
-      if (error) {
-        reject(
-          new WebError({
-            errorCode: 'unauthorized',
-            statusCode: 401,
-            message: 'Invalid token supplied',
-            data: { token },
-            error: error instanceof Error ? error : undefined
-          })
-        );
-        return;
-      }
-      resolve(result as UserTokenPayload);
-    });
-  });
-}
-
-export function generateJwtToken(user: unknown) {
-  const signOptions = {
-    algorithm: 'ES256' as const, // or 'ES256' as Algorithm
-    expiresIn: process.env.ACCESS_TOKEN_EXPIRATION_TIME
-      ? parseInt(process.env.ACCESS_TOKEN_EXPIRATION_TIME, 10)
-      : undefined,
-    issuer: process.env.ACCESS_TOKEN_ISSUER,
-    audience: process.env.ACCESS_TOKEN_AUDIENCE,
-    keyid: Object.keys(keySet?.getKeys() ?? {})[0]
-  };
-
-  const privateKey = getSecretOrFile('PRIVATE_KEY_PATH');
-
-  const token = sign({ user }, privateKey, signOptions);
-
-  return token;
-}

package/src/utils/jwt/jwt.types.ts

@@ -1,21 +0,0 @@
-
-/** Content of the payload of user authentication tokens */
-export interface UserTokenPayload {
-  /** ID of the user */
-  sub: string;
-  /** URL of the service that issued the token */
-  iss: string;
-  /** URL of the services that can consume the token */
-  aud: Array<string> | string;
-  /** Unique ID of the token */
-  jti: string;
-  /** ID of the device the token was issued to */
-  dev: string;
-  /** Timestamp at which the token will expire */
-  exp: number;
-  /** List of permissions that the user has (only on the admin API) */
-  per?: Array<string> | string;
-  /** User */
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  user: Record<string, any> | undefined;
-}

package/src/utils/report/index.ts

@@ -1,3 +0,0 @@
-export * from './report';
-export * from './output.types';
-export * from './report.types';

package/src/utils/report/output.ts

@@ -1,45 +0,0 @@
-import { randomUUID } from 'crypto';
-import callsite from 'callsite';
-import stringify from 'json-stringify-safe';
-import { LogEntry, FullLogEntry } from './output.types';
-
-// NOTE: Server instance id (helpful for distributed logs)
-export const INSTANCE_ID = randomUUID();
-
-/** Add metadata to the log entry and print it */
-export function output(data: LogEntry): FullLogEntry {
-  // Gather useful information about where the logger was called from
-  const call = callsite()[2];
-
-  // Append additional metadata to the log entry
-  const fullEntry: FullLogEntry = {
-    ...data,
-    lineNumber: call.getLineNumber(),
-    fileName: call
-      .getFileName()
-      .replace(/.*node_modules\//, '')
-      .replace(/.*src\//, 'src/'),
-    serviceContext: {
-      service: process.env.CHART ?? process.env.HOSTNAME,
-      version: process.env.BUILD_ID,
-      environment: process.env.NODE_ENV,
-      instance: process.env.KUBERNETES_POD_NAME ?? INSTANCE_ID
-    }
-  };
-
-  const entry = stringify(fullEntry);
-  // Ignore when silenced
-  if (process.env.SILENCE_REPORT) return fullEntry;
-
-  if (process.env.NODE_ENV === 'test') {
-    // In test mode pretty print
-    console.dir(fullEntry, { depth: 5 });
-  } else if (data.statusCode && data.statusCode >= 500) {
-    // Log to stderr when it is a 500+ error
-    console.error(entry);
-  } else {
-    // Default to regular logging
-    console.log(entry);
-  }
-  return fullEntry;
-}

package/src/utils/report/output.types.ts

@@ -1,70 +0,0 @@
-import { LogSeverity } from 'const';
-
-/** Structure of the request reporting in log entries */
-interface LogEntryRequest {
-  /** Requested URL */
-  url: string;
-  /** HTTP method used */
-  method: string;
-  /** Referer website */
-  referrer?: string;
-  /** User-Agent of the connected client */
-  userAgent?: string;
-  /** IP address of the client */
-  remoteIp: string | undefined;
-  /** HTTP status code returned to the client */
-  responseStatusCode?: number;
-}
-
-/** Structure of the context entry in log entries */
-interface LogEntryContext {
-  /** User that made a request */
-  user?: string;
-  /** Info on the processed HTTP request */
-  httpRequest?: LogEntryRequest;
-}
-
-/** Structure of a log entry */
-export interface LogEntry {
-  /** Severity level at which the entry should be logged */
-  severity: LogSeverity;
-  /** Type of error */
-  errorType?: string;
-  /** Human readable error message that will be logged */
-  message: string;
-  /** Stack-trace of the error */
-
-  stack_trace?: string;
-  /** Additional data that accompanies the error in the logs */
-  data?: unknown;
-  /** Machine readable error code that is returned to the client */
-  errorCode?: string;
-  /** HTTP status code that is returned to the client */
-  statusCode?: number;
-  /** GCP error type */
-  '@type'?: string;
-  /** Error context */
-  context?: LogEntryContext;
-}
-
-/** Stricture of a log entry context entry */
-interface LogEntryServiceContext {
-  /** Name of the service in which the error ocurred */
-  service?: string;
-  /** Version of the service in which the error ocurred */
-  version?: string;
-  /** Environment in which the error ocurred (dev/staging/prod) */
-  environment?: string;
-  /** ID of the instance that got the error */
-  instance?: string;
-}
-
-/** Complete log entry with call-stack */
-export interface FullLogEntry extends LogEntry {
-  /** Line at which the error was thrown */
-  lineNumber: number;
-  /** Name of the file in which the error was thrown */
-  fileName: string;
-  /** Context of the error */
-  serviceContext: LogEntryServiceContext;
-}

package/src/utils/report/report.test.ts

@@ -1,133 +0,0 @@
-import { expect } from 'chai';
-import { faker } from '@faker-js/faker';
-import { describe, it, beforeEach } from 'mocha';
-import { stub, match } from 'sinon';
-import * as output from './output';
-import { reportInfo, reportDebug, resetNamespaceSelector } from './report';
-import { InfoLogEntry } from './report.types';
-
-describe('Utils - Report', () => {
-  it('should collect filename and line number', () => {
-    let result = reportInfo('example');
-    expect(result.fileName).to.equal(
-      `${__dirname}/report.test.ts`.replace(/.*src\//, 'src/')
-    );
-    expect(result.severity).to.equal('INFO');
-    expect(result.message).to.equal('example');
-
-    const data: InfoLogEntry = { message: 'world' };
-    result = reportInfo(data);
-    expect(result.message).to.equal('world');
-    expect(result.fileName).to.equal(
-      `${__dirname}/report.test.ts`.replace(/.*src\//, 'src/')
-    );
-  });
-
-  describe('Report Debug', () => {
-    let globalNamespace: string;
-
-    beforeEach(() => {
-      resetNamespaceSelector();
-
-      globalNamespace = faker.lorem.slug();
-      reportDebug.setNameSpace(globalNamespace);
-    });
-
-    afterEach(() => {
-      reportDebug.clearNamespace();
-    });
-
-    it('should report when the namespace is specified', () => {
-      const namespace = faker.lorem.word();
-      process.env.DEBUG = globalNamespace + ':' + namespace;
-      const outputStub = stub(output, 'output');
-      const message = faker.lorem.sentence();
-      reportDebug({ message, namespace });
-      expect(outputStub).to.have.been.calledOnceWithExactly(
-        match({
-          message: `[${namespace}] ${message}`,
-          severity: 'DEBUG',
-          namespace: namespace
-        })
-      );
-    });
-
-    it('should report when the namespace is specified with a wildcard', () => {
-      const namespace = faker.lorem.word();
-      process.env.DEBUG = globalNamespace + ':' + `${namespace}:*`;
-      const outputStub = stub(output, 'output');
-      const message = faker.lorem.sentence();
-      const prefix = faker.lorem.word();
-      const actualNamespace = `${namespace}:${prefix}`;
-      reportDebug({ message, namespace: actualNamespace });
-      expect(outputStub).to.have.been.calledOnceWithExactly(
-        match({
-          message: `[${prefix}] ${message}`,
-          severity: 'DEBUG',
-          namespace: actualNamespace
-        })
-      );
-    });
-
-    it('should report when multiple namespaces are specified', () => {
-      const namespace = faker.lorem.word();
-      process.env.DEBUG =
-        globalNamespace +
-        ':' +
-        `${namespace},${faker.lorem.word()},${faker.lorem.word()}`;
-      const outputStub = stub(output, 'output');
-      const message = faker.lorem.sentence();
-      reportDebug({ message, namespace });
-      expect(outputStub).to.have.been.calledOnceWithExactly(
-        match({
-          message: `[${namespace}] ${message}`,
-          severity: 'DEBUG',
-          namespace: namespace
-        })
-      );
-    });
-
-    it('should not report when another namespace is specified', () => {
-      process.env.DEBUG = faker.lorem.word();
-      const outputStub = stub(output, 'output');
-      reportDebug({
-        message: faker.lorem.sentence(),
-        namespace: faker.lorem.word()
-      });
-      expect(outputStub).to.not.have.been.called;
-    });
-
-    it('should ignore the global namespace in server engine report debug', () => {
-      const namespace = 'engine';
-      process.env.DEBUG = `${namespace}:*`;
-      const prefix = faker.lorem.word();
-      const actualNamespace = `${namespace}:${prefix}`;
-      const outputStub = stub(output, 'output');
-      const message = faker.lorem.sentence();
-      reportDebug({ message, namespace: actualNamespace });
-      expect(outputStub).to.have.been.calledOnceWithExactly(
-        match({
-          message: `[${prefix}] ${message}`,
-          severity: 'DEBUG',
-          namespace: actualNamespace
-        })
-      );
-    });
-
-    it('should report with no global namespace', () => {
-      reportDebug.clearNamespace();
-      const namespace = faker.lorem.word();
-      process.env.DEBUG = namespace;
-      const outputStub = stub(output, 'output');
-      const message = faker.lorem.sentence();
-      reportDebug({ message, namespace });
-      expect(outputStub).to.have.been.calledOnceWithExactly(
-        match({
-          message: `[${namespace}] ${message}`,
-          severity: 'DEBUG',
-          namespace
-        })
-      );
-    });
-  });
-});

package/src/utils/report/report.ts

@@ -1,133 +0,0 @@
-import { Request } from 'express';
-import { output } from './output';
-import { LogEntry, FullLogEntry } from './output.types';
-import { DebugLogEntry, InfoLogEntry } from './report.types';
-import { LogSeverity } from 'const';
-import { EngineError } from 'entities/EngineError';
-import { WebError } from 'entities/WebError';
-import {} from 'middleware/authHmac/authHmac.types';
-import {} from 'middleware/authJwt/authJwt.types';
-import {} from 'middleware/authTls/authTls.types';
-
-/** Default generic logger */
-export function reportInfo(data: InfoLogEntry | string): FullLogEntry {
-  return output({
-    severity: LogSeverity.INFO,
-    ...(typeof data === 'string' ? { message: data } : data)
-  });
-}
-
-/** Error specific logger */
-export function reportError(
-  error: unknown | Error | EngineError | WebError,
-  request?: Request
-): FullLogEntry {
-  let logEntry: LogEntry =
-    error instanceof Error
-      ? {
-          message: error.message,
-          stack_trace: error.stack,
-          severity: LogSeverity.ERROR
-        }
-      : {
-          message: 'An unknown error occurred',
-          data: error,
-          severity: LogSeverity.CRITICAL
-        };
-
-  if (error instanceof EngineError) {
-    logEntry = {
-      ...logEntry,
-      severity: error.severity,
-      errorType: error.constructor.name,
-      data: error.data,
-      '@type':
-        !(error instanceof WebError) || error.statusCode >= 500
-          ? 'type.googleapis.com/google.devtools.clouderrorreporting.v1beta1.ReportedErrorEvent'
-          : undefined
-    };
-  }
-
-  if (error instanceof WebError) {
-    logEntry = {
-      ...logEntry,
-      errorCode: error.errorCode,
-      statusCode: error.statusCode
-    };
-  }
-
-  if (request) {
-    logEntry = {
-      ...logEntry,
-      context: {
-        user:
-          request.user?.id ?? request.hosts?.join(','),
-        httpRequest: {
-          url: request.originalUrl,
-          method: request.method,
-          referrer: request.header('Referer'),
-          userAgent: request.header('User-Agent'),
-          remoteIp: request.ip,
-          responseStatusCode:
-            error instanceof WebError ? error.statusCode : undefined
-        }
-      }
-    };
-  }
-
-  return output(logEntry);
-}
-
-export let NAMESPACE_SELECTORS: undefined | Array<RegExp>;
-
-/** Generate the namespace selectors based on the debug variable */
-function initNamespaceSelector(): void {
-  if (process.env.DEBUG)
-    NAMESPACE_SELECTORS = process.env.DEBUG.split(',').map(
-      (namespace) => new RegExp('^' + namespace.replace(/\*/g, '.*?') + '$')
-    );
-}
-
-/** Reset the namespace selectors */
-export function resetNamespaceSelector(): void {
-  NAMESPACE_SELECTORS = undefined;
-}
-
-let debugNamespace: string | undefined;
-
-/** Log a message for debugging purpose, based on a namespace specified in an environment variable */
-export function reportDebug(data: DebugLogEntry): FullLogEntry | undefined {
-  if (!NAMESPACE_SELECTORS) initNamespaceSelector();
-  let { namespace } = data;
-  const isEngineReport = namespace ? namespace.startsWith('engine') : false;
-
-  if (debugNamespace && !isEngineReport) {
-    namespace = debugNamespace + ':' + namespace;
-  }
-
-  const match =
-    namespace &&
-    NAMESPACE_SELECTORS &&
-    NAMESPACE_SELECTORS.some((selector) => selector.test(namespace));
-  if (!match) return;
-
-  // Generate a prefix with the right most part of the namespace
-  const spaces = namespace.split(':');
-  const prefix = spaces[spaces.length - 1];
-
-  return output({
-    severity: LogSeverity.DEBUG,
-    ...data,
-    message: `[${prefix}] ${data.message}`
-  });
-}
-
-/** Specify a global debugging namespace */
-reportDebug.setNameSpace = function (globalNamespace: string): void {
-  debugNamespace = globalNamespace;
-};
-
-/** Remove any defined global namespace */
-reportDebug.clearNamespace = function (): void {
-  debugNamespace = undefined;
-};

package/src/utils/report/report.types.ts

@@ -1,13 +0,0 @@
-import { LogEntry } from './output.types';
-import { LogSeverity } from 'const';
-
-/** Structure of debug logs */
-export interface DebugLogEntry extends Omit<LogEntry, 'severity'> {
-  /** Debugging namespace in which the entry is */
-  namespace: string;
-}
-
-export type InfoLogEntry = Omit<LogEntry, 'severity'> & {
-  /** Severity level of the entries */
-  severity?: LogSeverity;
-};

package/src/utils/request/index.ts

@@ -1 +0,0 @@
-export * from './request';

package/src/utils/request/request.test.ts

@@ -1,26 +0,0 @@
-import { expect } from 'chai';
-import { faker } from '@faker-js/faker';
-import nock, { cleanAll } from 'nock';
-import { request } from './request';
-import { EngineError } from 'entities/EngineError';
-
-describe('Utils - Request', function () {
-  afterEach(() => {
-    cleanAll();
-  });
-
-  it('should retry a request 5 times if network errors happen', async () => {
-    const url = faker.internet.url();
-
-    const scope = nock(url)
-      .get('/')
-      .times(5)
-      .replyWithError({ code: 'ECONNREFUSED' });
-
-    const promise = request({ url });
-
-    await expect(promise).to.eventually.be.rejectedWith(EngineError);
-
-    scope.isDone();
-  });
-});

package/src/utils/request/request.ts

@@ -1,48 +0,0 @@
-import axios, { AxiosResponse, AxiosRequestConfig } from 'axios';
-import { LogSeverity } from 'const';
-import { EngineError, EngineErrorOptions } from 'entities/EngineError';
-
-/** Make a http(s) request through axios with proper error handling */
-export async function request<T = unknown>(
-  options: AxiosRequestConfig,
-  tryCount = 1
-): Promise<AxiosResponse<T>> {
-  try {
-    return await axios.request<T, AxiosResponse<T>>(options);
-  } catch (error: unknown) {
-    // In case of networking error, we attempt to retry the connection if we did less than 5 attempts
-    if (
-      tryCount < 5 &&
-      axios.isAxiosError(error) &&
-      error.code &&
-      ['ECONNABORTED', 'ECONNREFUSED', 'ECONNRESET', 'EAI_AGAIN'].includes(
-        error.code
-      )
-    ) {
-      return request<T>(options, tryCount + 1);
-    }
-    const errorOptions: EngineErrorOptions = {
-      message:
-        error instanceof Error
-          ? error.message
-          : typeof error === 'string'
-            ? error
-            : 'An unknown error occurred',
-      severity: LogSeverity.CRITICAL,
-      data: { error }
-    };
-    if (error instanceof Error) {
-      errorOptions.message = error.message;
-      errorOptions.error = error;
-    }
-    // A response was returned but it was not a 200
-    if (axios.isAxiosError(error) && error.response) {
-      errorOptions.data = {
-        data: error.response.data as unknown,
-        status: error.response.status,
-        headers: error.response.headers as unknown
-      };
-    }
-    throw new EngineError(errorOptions);
-  }
-}

package/src/utils/secretManager/index.ts

@@ -1,2 +0,0 @@
-export * from './secretResolver';
-export * from './secretLoader';