prow-authority 3.6.3

package/src/v1/middlewares/auth/organization-token-middleware.ts

@@ -0,0 +1,73 @@
+import { NextFunction, Request, Response } from 'express';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import organizationTokenController from '../../controllers/auth/organization-token-controller';
+import RedisDao from '../../daos/redis-dao';
+import { Environment } from '../../types/auth/organization-token-types';
+
+
+class OrganizationTokenMiddleware {
+
+  private readonly CACHE_TIME = 60; // seconds
+  private readonly cache = new RedisDao<Environment>();
+
+  private readonly key = (token: string) =>
+    `authority:cache:organization:${token}`;
+
+  public readonly exists = async (req: any, res: Response, next: NextFunction) => {
+    try {
+      const access_token = (req.headers.authorization || ``).replace(`Bearer `, ``).trim();
+      if (!access_token) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `No authorization provided.`,
+        });
+      }
+
+      req[`org_access_token`] = access_token;
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  public readonly validate = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      if (!req[`org_access_token`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required org_access_token missing.`,
+        });
+      }
+
+      const key = this.key(req[`org_access_token`]);
+      const cached = req.query[`cache`] === `false` ? null : await this.cache.get(key);
+      const env = cached || await organizationTokenController.check(req[`org_access_token`]);
+
+      req[`environment`] = env;
+      req[`user`] = env.user;
+      next();
+
+      // control cache as soon as possible - not critic
+      setImmediate(async () => {
+        try {
+          let updated: Environment;
+          if (cached) { updated = await organizationTokenController.check(req[`org_access_token`]); }
+          await this.cache.add(key, updated || env, this.CACHE_TIME);
+        } catch (e) { await this.cache.delete(key); }
+      });
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+}
+
+const organizationTokenMiddleware = new OrganizationTokenMiddleware();
+export default organizationTokenMiddleware;

package/src/v1/middlewares/auth/service-token-middleware.ts

@@ -0,0 +1,167 @@
+import { Requester } from '@beseif-solutions/utility-functions/dist/utils/http-utils';
+import { NextFunction, Request, Response } from 'express';
+import _ from 'lodash';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import organizationController from '../../controllers/admin/organization-controller';
+import organizationLicenseController from '../../controllers/admin/organization-license-controller';
+import serviceController from '../../controllers/admin/service-controller';
+import RedisDao from '../../daos/redis-dao';
+import { LicenseType } from '../../types/admin/license-types';
+import { Organization, OrganizationStatus } from '../../types/admin/organization-types';
+import { Service } from '../../types/admin/service-types';
+import { ServiceEnvironment } from '../../types/services/service-types';
+
+
+class ServiceTokenMiddleware {
+
+  private readonly CACHE_TIME = 60; // seconds
+  private readonly cache = new RedisDao<ServiceEnvironment>();
+
+  private readonly key = (service: string, org: string) =>
+    `authority:cache:service:${service}:organization:${org}`;
+
+  public readonly validate = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      const [serviceUUID, serviceToken] = [req.headers[`x-service-uuid`], req.headers[`x-service-token`], req.headers[`x-organization-uuid`]];
+      if (!serviceUUID || !serviceToken) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service identification: invalid headers.`,
+        });
+      }
+
+      // get service
+      const service = (await serviceController.list({ uuid: serviceUUID, token: serviceToken, enabled: true }))[0];
+      if (!service) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service identification: not enabled service found with provided information.`,
+        });
+      }
+
+      req[`service`] = service;
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly environment = async (service: Service, organizationUUID: string) => {
+    try {
+      // get organization
+      const organization = (await organizationController.list({ uuid: organizationUUID, status: OrganizationStatus.Active }, { timestamp: true }))[0];
+      if (!organization) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid organization identification: organization not found or is not active.`,
+        });
+      }
+
+      if (_.get(organization.internal, `services.${service.uuid}.blocked`, false)) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid service access: organization access to service blocked.`,
+        });
+      }
+
+      // get licenses
+      const licenses = await this.licenses(service, organization);
+
+      const sEnv: ServiceEnvironment = {
+        organization: organization,
+        service: service,
+        licenses: licenses,
+      };
+      return sEnv;
+    } catch (e) { throw e; }
+  };
+
+  public readonly licenses = async (service: Service, organization: Organization) => {
+    try {
+      // get licenses
+      const licenses = await organizationLicenseController.list({
+        organization: organization.id,
+        service: service.id,
+        enabled: true,
+      });
+
+      const base = licenses.find((l) => l.type === LicenseType.Base);
+      if (!base) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service access: missing license.`,
+        });
+      }
+
+      if (base && typeof base.internal.notified === `boolean` && !base.internal.notified) {
+        // notify license change to service
+        if (service.internal.host && service.internal.organization?.modified) {
+          // update organization setup on service
+          Requester.patch(`${service.internal.organization?.modified}/${organization.uuid}`,
+            null,
+            {
+              baseURL: service.internal.host,
+              headers: {
+                "x-service-uuid": service.uuid,
+                "x-service-token": service.token,
+              },
+            }).catch(() => { /* TODO: what to do if the organization setup fails on service? */ });
+        }
+
+        await organizationLicenseController.update(base.id, { internal: { notified: null } });
+      }
+
+      return licenses;
+    } catch (e) { throw e; }
+  };
+
+  public readonly organization = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      if (!req[`service`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required service missing.`,
+        });
+      }
+      const service: Service = req[`service`];
+
+      const organizationUUID = req.headers[`x-organization-uuid`] as string;
+      if (!organizationUUID) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service identification: invalid headers (organization).`,
+        });
+      }
+
+      const key = this.key(service.uuid, organizationUUID);
+      const cached = req.query[`cache`] === `false` ? null : await this.cache.get(key);
+      const env = cached || await this.environment(service, organizationUUID);
+
+      req[`service-environment`] = env;
+
+      next();
+
+      // control cache as soon as possible - not critic
+      setImmediate(async () => {
+        try {
+          let updated: ServiceEnvironment;
+          if (cached) { updated = await this.environment(service, organizationUUID); }
+          await this.cache.add(key, updated || env, this.CACHE_TIME);
+        } catch (e) { await this.cache.delete(key); }
+      });
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+}
+
+const serviceTokenMiddleware = new ServiceTokenMiddleware();
+export default serviceTokenMiddleware;

package/src/v1/middlewares/authority-middleware.ts

@@ -0,0 +1,97 @@
+import { Request, Response, NextFunction } from 'express';
+import APIError, { StatusCodes } from '../../helpers/api-error';
+import authority, { LicenseLimitNames } from '../../helpers/authority';
+import { Environment } from '../types/auth/organization-token-types';
+import { QuotaUsage } from '@beseif-solutions/prow-authority-for-services';
+
+class AuthorityMiddleware {
+
+  public readonly service = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      // validate headers
+      const [serviceUUID, serviceToken] = [req.headers[`x-service-uuid`], req.headers[`x-service-token`], req.headers[`x-organization-uuid`]];
+      if (!serviceUUID || !serviceToken) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service identification: invalid headers.`,
+        });
+      }
+
+      if (serviceUUID !== authority.configuration.uuid || serviceToken !== authority.configuration.token) {
+        throw new APIError({
+          code: StatusCodes.UNAUTHORIZED,
+          detail: `Invalid service identification: not matching headers.`,
+        });
+      }
+
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  public readonly quota = (usage: QuotaUsage<LicenseLimitNames>) =>
+    async (req: Request, res: Response, next: NextFunction) => {
+      try {
+        if (!req[`environment`]) {
+          throw new APIError({
+            code: StatusCodes.INTERNAL_SERVER_ERROR,
+            detail: `Middleware dependency broken: required environment missing.`,
+          });
+        }
+        const env: Environment = req[`environment`];
+
+        const possible = await authority.isPossible(env.organization.uuid, usage);
+        if (!possible) {
+          throw new APIError({
+            code: StatusCodes.FORBIDDEN,
+            detail: `Quota limit reached.`,
+          });
+        }
+        next();
+      } catch (e) {
+        if (e instanceof APIError) {
+          res.status(e.code).json(e.data);
+        } else {
+          res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+        }
+      }
+    };
+
+  public readonly licensed = async (req: Request, res: Response, next: NextFunction) => {
+    try {
+      if (!req[`environment`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required environment missing.`,
+        });
+      }
+      const env: Environment = req[`environment`];
+
+
+      try {
+        await authority.organization(env.organization.uuid);
+      } catch (e) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Unlicensed access to service.`,
+        });
+      }
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+}
+
+const authorityMiddleware = new AuthorityMiddleware();
+export default authorityMiddleware;

package/src/v1/middlewares/organizations/organization-middleware.ts

@@ -0,0 +1,94 @@
+import { NextFunction, Request, Response } from 'express';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import { OrganizationStatus } from '../../types/admin/organization-types';
+import { Environment } from '../../types/auth/organization-token-types';
+import { UserOrganizationRole } from '../../types/admin/user-organization-types';
+
+
+class OrganizationMiddleware {
+  private readonly status = async (req: Request, res: Response, next: NextFunction, status: OrganizationStatus) => {
+    try {
+      if (!req[`environment`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required environment missing.`,
+        });
+      }
+
+      if ((req[`environment`] as Environment).organization.status !== status) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid organization status.`,
+        });
+      }
+
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  // public readonly pending = async (req: Request, res: Response, next: NextFunction) =>
+  //   this.status(req, res, next, OrganizationStatus.Pending);
+
+  // public readonly unpaid = async (req: Request, res: Response, next: NextFunction) =>
+  //   this.status(req, res, next, OrganizationStatus.Unpaid);
+
+  public readonly active = async (req: Request, res: Response, next: NextFunction) =>
+    this.status(req, res, next, OrganizationStatus.Active);
+
+  private readonly role = async (req: Request, res: Response, next: NextFunction, role: UserOrganizationRole) => {
+    try {
+      if (!req[`environment`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required environment missing.`,
+        });
+      }
+
+      const userAccess = (req[`environment`] as Environment).access;
+      if (userAccess.invite) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Forbidden access to organization: pending invite.`,
+        });
+      }
+
+      const order = [UserOrganizationRole.Staff, UserOrganizationRole.Admin, UserOrganizationRole.Owner];
+
+      const userRole = order.indexOf(userAccess.role);
+      const reqRole = order.indexOf(role);
+
+      if (userRole < reqRole) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Forbidden access to organization: invalid user role.`,
+        });
+      }
+
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  public readonly owner = async (req: Request, res: Response, next: NextFunction) =>
+    this.role(req, res, next, UserOrganizationRole.Owner);
+
+  public readonly admin = async (req: Request, res: Response, next: NextFunction) =>
+    this.role(req, res, next, UserOrganizationRole.Admin);
+
+  public readonly staff = async (req: Request, res: Response, next: NextFunction) =>
+    this.role(req, res, next, UserOrganizationRole.Staff);
+}
+
+const organizationMiddleware = new OrganizationMiddleware();
+export default organizationMiddleware;

package/src/v1/middlewares/static/static-middleware.ts

@@ -0,0 +1,41 @@
+import { NextFunction, Request, Response } from 'express';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import nconf from '../../../helpers/config';
+
+export const admin = async (req: Request, res: Response, next: NextFunction) => {
+  try {
+    const token = req.headers[`x-admin-token`];
+    if (token !== nconf.get(`SERVICES:AUTH:ADMIN`)) {
+      throw new APIError({
+        code: StatusCodes.UNAUTHORIZED,
+        detail: `No valid authorization provided for this environment.`,
+      });
+    }
+    next();
+  } catch (e) {
+    if (e instanceof APIError) {
+      res.status(e.code).json(e.data);
+    } else {
+      res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+    }
+  }
+};
+
+export const billing = async (req: Request, res: Response, next: NextFunction) => {
+  try {
+    const token = req.headers[`x-billing-token`];
+    if (token !== nconf.get(`SERVICES:AUTH:BILLING`)) {
+      throw new APIError({
+        code: StatusCodes.UNAUTHORIZED,
+        detail: `No valid authorization provided for this environment.`,
+      });
+    }
+    next();
+  } catch (e) {
+    if (e instanceof APIError) {
+      res.status(e.code).json(e.data);
+    } else {
+      res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+    }
+  }
+};

package/src/v1/middlewares/users/user-middleware.ts

@@ -0,0 +1,41 @@
+import { NextFunction, Request, Response } from 'express';
+import APIError, { StatusCodes } from '../../../helpers/api-error';
+import { User, UserStatus } from '../../types/admin/user-types';
+
+
+class UserMiddleware {
+  private readonly status = async (req: Request, res: Response, next: NextFunction, status: UserStatus) => {
+    try {
+      if (!req[`user`]) {
+        throw new APIError({
+          code: StatusCodes.INTERNAL_SERVER_ERROR,
+          detail: `Middleware dependency broken: required user missing.`,
+        });
+      }
+
+      if ((req[`user`] as User).status !== status) {
+        throw new APIError({
+          code: StatusCodes.FORBIDDEN,
+          detail: `Invalid user status.`,
+        });
+      }
+
+      next();
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(StatusCodes.UNAUTHORIZED).json({ error: e.message || e });
+      }
+    }
+  };
+
+  public readonly pending = async (req: Request, res: Response, next: NextFunction) =>
+    this.status(req, res, next, UserStatus.Pending);
+
+  public readonly active = async (req: Request, res: Response, next: NextFunction) =>
+    this.status(req, res, next, UserStatus.Active);
+}
+
+const userMiddleware = new UserMiddleware();
+export default userMiddleware;

package/src/v1/routes/admin/accounting-seat-router.ts

@@ -0,0 +1,89 @@
+import { Request, Router, Response } from 'express';
+import accountingSeatController from '../../controllers/admin/accounting-seat-controller';
+import httpcodes from 'http-status-codes';
+import APIError from '../../../helpers/api-error';
+
+class AccountingSeatRouter {
+  router: Router;
+
+  constructor() {
+    this.router = Router();
+    this.init();
+  }
+
+  private readonly get = async (req: Request, res: Response) => {
+    try {
+      const response = await accountingSeatController.get(parseInt(req.params[`id`], 10));
+      res.json(response);
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(httpcodes.INTERNAL_SERVER_ERROR).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly list = async (req: Request, res: Response) => {
+    try {
+      const response = await accountingSeatController.list(req.body);
+      res.json(response);
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(httpcodes.INTERNAL_SERVER_ERROR).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly add = async (req: Request, res: Response) => {
+    try {
+      const response = await accountingSeatController.add(req.body);
+      res.json(response);
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(httpcodes.INTERNAL_SERVER_ERROR).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly update = async (req: Request, res: Response) => {
+    try {
+      const response = await accountingSeatController.update(parseInt(req.params[`id`], 10), req.body);
+      res.json(response);
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(httpcodes.INTERNAL_SERVER_ERROR).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly delete = async (req: Request, res: Response) => {
+    try {
+      const response = await accountingSeatController.delete(parseInt(req.params[`id`], 10));
+      res.json(response);
+    } catch (e) {
+      if (e instanceof APIError) {
+        res.status(e.code).json(e.data);
+      } else {
+        res.status(httpcodes.INTERNAL_SERVER_ERROR).json({ error: e.message || e });
+      }
+    }
+  };
+
+  private readonly init = () => {
+    this.router.get(`/:id`, this.get);
+    this.router.post(`/list`, this.list);
+    this.router.post(`/`, this.add);
+    this.router.put(`/:id`, this.update);
+    this.router.delete(`/:id`, this.delete);
+  };
+}
+
+const accountingSeatRouter = (new AccountingSeatRouter()).router;
+export default accountingSeatRouter;

package/src/v1/routes/admin/admin-router.ts

@@ -0,0 +1,61 @@
+import { Router } from 'express';
+import { admin } from '../../middlewares/static/static-middleware';
+import accountingSeatRouter from './accounting-seat-router';
+import billingCycleRouter from './billing-cycle-router';
+import invoiceRouter from './invoice-router';
+import licenseLimitRouter from './license-limit-router';
+import licenseRouter from './license-router';
+import notificationRouter from './notification-router';
+import organizationLicenseLimitRouter from './organization-license-limit-router';
+import organizationLicenseRouter from './organization-license-router';
+import organizationRouter from './organization-router';
+import paymentMethodRouter from './payment-method-router';
+import policyRouter from './policy-router';
+import policyVersionRouter from './policy-version-router';
+import scheduleRouter from './schedule-router';
+import serviceNotificationRouter from './service-notification-router';
+import serviceRouter from './service-router';
+import userOrganizationRouter from './user-organization-router';
+import userPolicyRouter from './user-policy-router';
+import userRouter from './user-router';
+
+class AdminRouter {
+  router: Router;
+
+  constructor() {
+    this.router = Router();
+    this.init();
+  }
+
+  private readonly init = () => {
+    this.router.use(admin);
+
+    this.router.use(`/policies`, policyRouter);
+    this.router.use(`/policy-versions`, policyVersionRouter);
+
+    this.router.use(`/services`, serviceRouter);
+    this.router.use(`/licenses`, licenseRouter);
+    this.router.use(`/license-limits`, licenseLimitRouter);
+    this.router.use(`/service-notifications`, serviceNotificationRouter);
+
+    this.router.use(`/organizations`, organizationRouter);
+    this.router.use(`/organization-licenses`, organizationLicenseRouter);
+    this.router.use(`/organization-license-limits`, organizationLicenseLimitRouter);
+    this.router.use(`/users`, userRouter);
+    this.router.use(`/access`, userOrganizationRouter);
+    this.router.use(`/user-policies`, userPolicyRouter);
+    this.router.use(`/notifications`, notificationRouter);
+
+    this.router.use(`/billing-cycles`, billingCycleRouter);
+    this.router.use(`/payment-methods`, paymentMethodRouter);
+    this.router.use(`/invoices`, invoiceRouter);
+    this.router.use(`/accounting-seats`, accountingSeatRouter);
+
+    this.router.use(`/schedules`, scheduleRouter);
+  };
+}
+
+const adminRouter = (new AdminRouter()).router;
+export default adminRouter;
+
+