soajs.controller 4.2.40 → 4.2.41

package/README.md

@@ -35,6 +35,91 @@ Enabling CORS allows different domains to communicate with SOAJS via its gateway
 
 ---
 
+## Environment Variables
+
+The SOAJS Controller can be configured using the following environment variables:
+
+### Core Configuration
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_ENV` | string | `"dev"` | Environment code (e.g., dev, staging, production) |
+| `SOAJS_PROFILE` | string | `./profiles/single.js` (mongo mode)<br>`./profiles/solo.js` (solo mode) | Path to the SOAJS profile configuration file |
+| `SOAJS_SOLO` | boolean | `false` | Enable solo mode (uses local registry instead of MongoDB) |
+| `SOAJS_SRVIP` | string | auto-detected | Service IP address for registration |
+| `SOAJS_SRV_AUTOREGISTERHOST` | boolean | `true` | Automatically register host with the service |
+
+### Deployment & High Availability
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_DEPLOY_HA` | string | - | High availability deployment type (`kubernetes`, `swarm`, or empty for non-HA) |
+| `SOAJS_DEPLOY_MANUAL` | number | - | Manual deployment mode flag (1 = enabled) |
+| `SOAJS_MANUAL` | boolean | - | Skip automatic deployment operations |
+| `SOAJS_SWARM_UNIX_PORT` | string | `/var/run/docker.sock` | Docker Swarm Unix socket path |
+
+### Security & Tenant Configuration
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_SENSITIVE_ENVS` | JSON array | `["dashboard"]` | List of sensitive environment codes requiring additional security checks |
+
+### Performance & Resource Management
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_MAX_BODY_SIZE` | number | `10485760` (10MB) | Maximum request body size in bytes for monitoring. Prevents memory exhaustion from large request bodies |
+| `SOAJS_THROTTLE_CLEANUP_INTERVAL` | number | `60000` (1 min) | Interval in milliseconds for cleaning up expired throttling cache entries |
+
+### Database & Connection
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_MONGO_CON_KEEPALIVE` | boolean | `false` | Enable MongoDB connection keepalive |
+
+### Testing & Development
+
+| Variable | Type | Default | Description |
+|----------|------|---------|-------------|
+| `SOAJS_TEST` | boolean | - | Enable test mode (affects registry loading and service queries) |
+| `SOAJS_IMPORTER_DROPDB` | boolean | `false` | Drop database before importing (test data only) |
+| `NODE_ENV` | string | - | Node.js environment mode (development, production) |
+| `APP_DIR_FOR_CODE_COVERAGE` | string | `../` | Directory path for code coverage testing |
+| `SHOW_LOGS` | boolean | - | Enable/disable log output for testing |
+
+### Example Configurations
+
+#### Production Kubernetes Deployment
+```bash
+export SOAJS_ENV=production
+export SOAJS_DEPLOY_HA=kubernetes
+export SOAJS_SRVIP=10.0.1.50
+export SOAJS_PROFILE=/etc/soajs/profile.js
+export SOAJS_SENSITIVE_ENVS='["dashboard","production"]'
+export SOAJS_MAX_BODY_SIZE=20971520  # 20MB
+export SOAJS_THROTTLE_CLEANUP_INTERVAL=120000  # 2 minutes
+export SOAJS_MONGO_CON_KEEPALIVE=true
+export NODE_ENV=production
+```
+
+#### Solo Development Mode
+```bash
+export SOAJS_ENV=dev
+export SOAJS_SOLO=true
+export SOAJS_SRVIP=127.0.0.1
+export SOAJS_PROFILE=/opt/soajs/profiles/dev.js
+```
+
+#### Docker Swarm Deployment
+```bash
+export SOAJS_ENV=staging
+export SOAJS_DEPLOY_HA=swarm
+export SOAJS_SWARM_UNIX_PORT=/var/run/docker.sock
+export SOAJS_PROFILE=/config/soajs_profile.js
+```
+
+---
+
 More information on the Controller is available on the website section [Controller](https://soajsorg.atlassian.net/wiki/x/loAwb)
 
 

package/lib/request.js

@@ -16,10 +16,12 @@ function checkStatus(uri) {
         let onResponse = false;
 
         const req = http.get(uri, (res) => {
+            onResponse = true;
+            res.resume();
             if (res.statusCode === 200) {
-                onResponse = true;
-                res.resume();
-                resolve(res.statusCode === 200); // Resolve with true if 200, false otherwise
+                resolve(true);
+            } else {
+                reject(new Error(`Status Code: ${res.statusCode}`));
             }
             // res.on('data', () => { }); // Consume data to avoid issues (important!)
 
@@ -109,19 +111,21 @@ function httpRequestLight({ uri, data = null, method = 'GET', headers = null, js
                 return reject(new Error(`Status Code: ${res.statusCode}`));
             }
 
-            let responseData = '';
+            const chunks = [];
 
             res.on('data', (chunk) => {
-                responseData += chunk;
+                chunks.push(chunk);
             });
 
             res.on('end', () => {
                 if (!onResponse) {
                     onResponse = true;
                     try {
+                        const responseData = Buffer.concat(chunks).toString();
                         const parsedData = json ? JSON.parse(responseData) : responseData;
                         return resolve(parsedData);
                     } catch (error) {
+                        const responseData = Buffer.concat(chunks).toString();
                         return resolve(responseData);
                     }
                 }
@@ -235,15 +239,17 @@ function httpRequest({ uri, data = null, body = null, qs = null, method = 'GET',
         }
 
         req.on('response', (res) => { // Listen for the 'response' event
-            let responseData = '';
+            const chunks = [];
 
             res.on('data', (chunk) => {
-                responseData += chunk;
+                chunks.push(chunk);
             });
 
             res.on('end', () => {
                 if (!onResponse) {
                     onResponse = true;
+                    const responseData = Buffer.concat(chunks).toString();
+
                     if (res.statusCode < 200 || res.statusCode >= 300) {
                         const error = new Error(`Status Code: ${res.statusCode}`);
                         try {
@@ -295,7 +301,7 @@ function httpRequest({ uri, data = null, body = null, qs = null, method = 'GET',
             req.destroy(); // IMPORTANT: Forcefully end the request
             if (!onResponse) {
                 onResponse = true;
-                return reject(new Error('Request timed out'));
+                return reject({ error: new Error('Request timed out'), body: null });
             }
         });
         // Set the timeout on the request

package/modules/registry/index.js

@@ -34,7 +34,7 @@ if (process.env.SOAJS_SENSITIVE_ENVS) {
 	} catch (e) {
 		temp_sensitiveEnvCodes = null;
 	}
-	if (Array.isArray(temp_sensitiveEnvCodes) && temp_sensitiveEnvCodes > 0) {
+	if (Array.isArray(temp_sensitiveEnvCodes) && temp_sensitiveEnvCodes.length > 0) {
 		sensitiveEnvCodes = temp_sensitiveEnvCodes;
 	}
 }
@@ -496,15 +496,25 @@ function getRegistry(param, options, cb) {
 									registry_struct[options.envCode] = registry;
 								}
 								if (registry && registry.serviceConfig.awareness.autoRelaodRegistry) {
+									if (!autoReloadTimeout[options.envCode]) {
+										autoReloadTimeout[options.envCode] = {};
+									}
+
+									// Performance: Prevent overlapping reloads with status tracking
+									if (autoReloadTimeout[options.envCode].reloading) {
+										// Already reloading, skip scheduling another
+										return cb(null, registry_struct[options.envCode]);
+									}
+
 									let autoReload = () => {
+										autoReloadTimeout[options.envCode].reloading = true;
 										options.setBy = "autoReload";
 										getRegistry(param, options, () => {
+											autoReloadTimeout[options.envCode].reloading = false;
 											// cb(err, reg);
 										});
 									};
-									if (!autoReloadTimeout[options.envCode]) {
-										autoReloadTimeout[options.envCode] = {};
-									}
+
 									if (autoReloadTimeout[options.envCode].timeout) {
 										clearTimeout(autoReloadTimeout[options.envCode].timeout);
 									}

package/mw/gotoService/proxyRequest.js

@@ -76,10 +76,17 @@ module.exports = (configuration) => {
 			};
 
 			proxyRequest(req, res, requestConfig, extraOptions)
-				.then(() => { })
+				.then(() => {
+					// Performance: Clean up proxy request reference after success
+					if (req.soajs.controller.redirectedRequest) {
+						req.soajs.controller.redirectedRequest.removeAllListeners();
+						req.soajs.controller.redirectedRequest = null;
+					}
+				})
 				.catch((error) => {
 					req.soajs.log.error(error.message);
 					if (req.soajs.controller.redirectedRequest) {
+						req.soajs.controller.redirectedRequest.removeAllListeners();
 						req.soajs.controller.redirectedRequest.destroy();
 						req.soajs.controller.redirectedRequest = null;
 					}

package/mw/gotoService/redirectToService.js

@@ -116,6 +116,11 @@ module.exports = (configuration) => {
 				(req.method === 'POST' || req.method === 'PUT' || req.method === 'PATCH' || req.method === 'DELETE')) {
 				let allowedContentType = false;
 				let isStream = false;
+				// Performance: Prevent memory exhaustion from large request bodies
+				const MAX_BODY_SIZE = process.env.SOAJS_MAX_BODY_SIZE || 10 * 1024 * 1024; // 10MB default
+				let bodySize = 0;
+				let bodyExceeded = false;
+
 				req.on("data", (chunk) => {
 					let resContentType = req.headers['content-type'];
 					if (resContentType) {
@@ -127,11 +132,19 @@ module.exports = (configuration) => {
 						}
 					}
 					if (!isStream && allowedContentType) {
-						if (!monitoObj.body) {
-							monitoObj.time.req_body_start = new Date().getTime();
-							monitoObj.body = chunk;
-						} else {
-							monitoObj.body += chunk;
+						bodySize += chunk.length;
+						if (bodySize > MAX_BODY_SIZE) {
+							if (!bodyExceeded) {
+								bodyExceeded = true;
+								monitoObj.body = "{\"error\": \"Request body exceeds maximum size limit\"}";
+							}
+						} else if (!bodyExceeded) {
+							if (!monitoObj.body) {
+								monitoObj.time.req_body_start = new Date().getTime();
+								monitoObj.body = chunk;
+							} else {
+								monitoObj.body += chunk;
+							}
 						}
 					} else {
 						monitoObj.body = "{\"contentType\": \"is stream or not allowed\", \"value': \"" + resContentType + "\"}";

package/mw/mt/index.js

@@ -339,15 +339,30 @@ module.exports = (configuration) => {
 												if (err) {
 													req.soajs.log.error(err.message);
 												}
+
+												// Security: Validate and limit soajsinjectobj header size
 												let _h = JSON.stringify(injectObj);
-												// req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
-												req.headers.soajsinjectobj = _h; //encodeHeaderValue(_h);
+												const MAX_HEADER_SIZE = process.env.SOAJS_MAX_INJECT_HEADER_SIZE || 65536; // 64KB default
+
+												if (_h.length > MAX_HEADER_SIZE) {
+													req.soajs.log.error('soajsinjectobj header exceeds maximum size:', _h.length);
+													return next(135);
+												}
+
+												req.headers.soajsinjectobj = _h;
 												return next();
 											});
 									} else {
+										// Security: Validate and limit soajsinjectobj header size
 										let _h = JSON.stringify(injectObj);
-										// req.headers.soajsinjectobj = Buffer.from(_h, 'ascii').toString('utf-8');
-										req.headers.soajsinjectobj = _h; //encodeHeaderValue(_h);
+										const MAX_HEADER_SIZE = process.env.SOAJS_MAX_INJECT_HEADER_SIZE || 65536; // 64KB default
+
+										if (_h.length > MAX_HEADER_SIZE) {
+											req.soajs.log.error('soajsinjectobj header exceeds maximum size:', _h.length);
+											return next(135);
+										}
+
+										req.headers.soajsinjectobj = _h;
 										return next();
 									}
 								}

package/mw/mt/utils.js

@@ -20,6 +20,35 @@ const merge = require('merge');
 
 const UracDriver = require("./urac.js");
 
+// Performance: Configuration accessor utility for deep property access with defaults
+function getConfig(obj, path, defaultValue = undefined) {
+	const keys = path.split('.');
+	let result = obj;
+	for (const key of keys) {
+		if (result && typeof result === 'object' && key in result) {
+			result = result[key];
+		} else {
+			return defaultValue;
+		}
+	}
+	return result;
+}
+
+// Performance: Cache Netmask objects to avoid repeated parsing
+const netmaskCache = new Map();
+function getCachedNetmask(addr) {
+	if (!netmaskCache.has(addr)) {
+		try {
+			netmaskCache.set(addr, new Netmask(addr));
+		} catch (err) {
+			// Store null for invalid addresses to avoid repeated parsing attempts
+			netmaskCache.set(addr, null);
+			throw err;
+		}
+	}
+	return netmaskCache.get(addr);
+}
+
 let sensitiveEnvCodes = ["dashboard"];
 if (process.env.SOAJS_SENSITIVE_ENVS) {
 	let temp_sensitiveEnvCodes = null;
@@ -28,24 +57,36 @@ if (process.env.SOAJS_SENSITIVE_ENVS) {
 	} catch (e) {
 		temp_sensitiveEnvCodes = null;
 	}
-	if (Array.isArray(temp_sensitiveEnvCodes) && temp_sensitiveEnvCodes > 0) {
+	if (Array.isArray(temp_sensitiveEnvCodes) && temp_sensitiveEnvCodes.length > 0) {
 		sensitiveEnvCodes = temp_sensitiveEnvCodes;
 	}
 }
 
 const { pathToRegexp } = require("path-to-regexp");
 
+// Performance: Cache compiled RegExp objects for route matching
+const regexpCache = new Map();
+const MAX_REGEXP_CACHE_SIZE = 500; // Prevent unbounded growth
+
 function constructRegExp(route) {
-	// let keys = [];
-	// let out = pathToRegexp(route, keys, { sensitive: true });
+	// Check cache first
+	if (regexpCache.has(route)) {
+		return regexpCache.get(route);
+	}
+
+	// Compile the route pattern
 	let out = pathToRegexp(route, { sensitive: true });
-	if (out.regexp) {
-		return out.regexp;
+	let regexp = out.regexp || out;
+
+	// Implement simple LRU by clearing cache when it gets too large
+	if (regexpCache.size >= MAX_REGEXP_CACHE_SIZE) {
+		// Clear oldest 25% of entries
+		const keysToDelete = Array.from(regexpCache.keys()).slice(0, Math.floor(MAX_REGEXP_CACHE_SIZE * 0.25));
+		keysToDelete.forEach(key => regexpCache.delete(key));
 	}
-	// if (out && out.keys && out.keys.length > 0) {
-	// 	out = new RegExp(out.toString());
-	// }
-	return out;
+
+	regexpCache.set(route, regexp);
+	return regexp;
 }
 
 /**
@@ -139,20 +180,15 @@ let utils = {
 			}
 		 *
 		 */
-		if (obj.req.soajs.registry &&
-			obj.req.soajs.registry.custom &&
-			obj.req.soajs.registry.custom.gateway &&
-			obj.req.soajs.registry.custom.gateway.value &&
-			obj.req.soajs.registry.custom.gateway.value.mt &&
-			obj.req.soajs.registry.custom.gateway.value.mt.whitelist &&
-			obj.req.soajs.registry.custom.gateway.value.mt.whitelist.ips) {
+		// Performance: Use config accessor to simplify deeply nested property access
+		const whitelistIps = getConfig(obj.req, 'soajs.registry.custom.gateway.value.mt.whitelist.ips');
+		if (whitelistIps && Array.isArray(whitelistIps)) {
 			let clientIp = obj.req.getClientIP();
-			let geoAccess = obj.req.soajs.registry.custom.gateway.value.mt.whitelist.ips; //["127.0.0.0/8"];
 			let checkAccess = (geoAccessArr, ip) => {
 				return (geoAccessArr.some(function (addr) {
 					try {
-						let block = new Netmask(addr);
-						return block.contains(ip);
+						let block = getCachedNetmask(addr);
+						return block && block.contains(ip);
 					} catch (err) {
 						obj.req.soajs.log.error('IP whitelist security configuration failed: ', addr);
 						obj.req.soajs.log.error(err);
@@ -160,23 +196,22 @@ let utils = {
 					return false;
 				}));
 			};
-			if (clientIp && geoAccess && geoAccess && Array.isArray(geoAccess)) {
-				let matched = checkAccess(geoAccess, clientIp);
+			if (clientIp) {
+				let matched = checkAccess(whitelistIps, clientIp);
 				if (matched) {
 					obj.req.soajs.log.debug("ACL skip detected for ip: " + clientIp);
-					if (obj.req.soajs.registry.custom.gateway.value.mt.whitelist.acl) {
+					const whitelistConfig = getConfig(obj.req, 'soajs.registry.custom.gateway.value.mt.whitelist', {});
+					if (whitelistConfig.acl) {
 						obj.skipACL = true;
 					}
-					if (obj.req.soajs.registry.custom.gateway.value.mt.whitelist.oauth) {
+					if (whitelistConfig.oauth) {
 						obj.skipOAUTH = true;
 					}
 				}
 			}
-
-			return cb(null, obj);
-		} else {
-			return cb(null, obj);
 		}
+
+		return cb(null, obj);
 	},
 
 	"aclUrackCheck": (obj, cb) => {
@@ -282,8 +317,8 @@ let utils = {
 		let checkAccess = (geoAccessArr, ip) => {
 			return (geoAccessArr.some(function (addr) {
 				try {
-					let block = new Netmask(addr);
-					return block.contains(ip);
+					let block = getCachedNetmask(addr);
+					return block && block.contains(ip);
 				} catch (err) {
 					obj.req.soajs.log.error('Geographic security configuration failed: ', addr);
 					obj.req.soajs.log.error(err.message);

package/mw/response/response.js

@@ -35,7 +35,7 @@ Response.prototype.addErrorCode = function (code, message) {
 	}
 	let errorCode = {
 		"code": code,
-		"message": message.trim()
+		"message": message ? message.trim() : ''
 	};
 	
 	if (!this.errors) {

package/mw/traffic/model/memory.js

@@ -9,12 +9,56 @@
  */
 
 let dataHolder = {};
+let cleanupInterval = null;
 
 let model = {
     'log': null,
     'initThrottling': (log) => {
         model.log = log;
         dataHolder = {};
+
+        // Performance: Implement periodic cleanup of expired throttling entries
+        if (cleanupInterval) {
+            clearInterval(cleanupInterval);
+        }
+        const CLEANUP_INTERVAL = process.env.SOAJS_THROTTLE_CLEANUP_INTERVAL || 60000; // 1 minute default
+        cleanupInterval = setInterval(() => {
+            model.cleanupExpiredEntries();
+        }, CLEANUP_INTERVAL);
+    },
+
+    'cleanupExpiredEntries': () => {
+        const now = Date.now();
+        const MAX_AGE = 3600000; // 1 hour - entries older than this are removed
+        let removedCount = 0;
+
+        for (const l1Key in dataHolder) {
+            if (dataHolder.hasOwnProperty(l1Key)) {
+                const entry = dataHolder[l1Key];
+
+                // Check if l1 level entry is expired
+                if (entry.firstReqTime && (now - entry.firstReqTime.getTime()) > MAX_AGE) {
+                    delete dataHolder[l1Key];
+                    removedCount++;
+                    continue;
+                }
+
+                // Check l2 level entries (if any)
+                for (const l2Key in entry) {
+                    if (entry.hasOwnProperty(l2Key) && l2Key !== 'firstReqTime' && l2Key !== 'count') {
+                        const l2Entry = entry[l2Key];
+                        if (l2Entry.firstReqTime && (now - l2Entry.firstReqTime.getTime()) > MAX_AGE) {
+                            delete entry[l2Key];
+                            removedCount++;
+                        }
+                    }
+                }
+            }
+        }
+
+        if (removedCount > 0 && model.log) {
+            model.log.debug(`Throttling cache cleanup: removed ${removedCount} expired entries`);
+        }
     },
 
     'getThrottling': (throttling, trafficKey) => {
@@ -66,8 +110,28 @@ let model = {
 
     'logTooManyRequests': (trafficKey, throttlingStrategy) => {
         model.log.error('Throttling [' + throttlingStrategy + ']rejected:', 'using tenant id [' + trafficKey.l1 + '] from ip [' + trafficKey.l2 + ']');
+    },
+
+    'shutdown': () => {
+        // Performance: Clean up interval on shutdown to prevent memory leaks
+        if (cleanupInterval) {
+            clearInterval(cleanupInterval);
+            cleanupInterval = null;
+        }
+        dataHolder = {};
+        if (model.log) {
+            model.log.info('Traffic throttling model shutdown complete');
+        }
     }
 };
 
+// Performance: Register shutdown handlers
+if (typeof process !== 'undefined') {
+    const shutdownHandler = () => {
+        model.shutdown();
+    };
+    process.once('SIGTERM', shutdownHandler);
+    process.once('SIGINT', shutdownHandler);
+}
 
 module.exports = model;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.2.40",
+  "version": "4.2.41",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"
@@ -29,14 +29,14 @@
     "oauth2-server": "2.4.1",
     "path-to-regexp": "8.3.0",
     "soajs.core.libs": "1.2.1",
-    "soajs.core.modules": "5.2.16",
-    "soajs.urac.driver": "3.2.13",
+    "soajs.core.modules": "5.2.17",
+    "soajs.urac.driver": "3.2.14",
     "useragent": "2.3.0"
   },
   "devDependencies": {
-    "@babel/core": "7.28.4",
-    "@babel/plugin-transform-runtime": "7.28.3",
-    "@babel/preset-env": "7.28.3",
+    "@babel/core": "7.28.5",
+    "@babel/plugin-transform-runtime": "7.28.5",
+    "@babel/preset-env": "7.28.5",
     "@babel/runtime": "7.28.4",
     "express": "4.21.1",
     "grunt": "1.6.1",
@@ -49,7 +49,7 @@
     "grunt-istanbul": "0.8.0",
     "grunt-jsdoc": "2.4.1",
     "grunt-mocha-test": "0.13.3",
-    "mocha": "11.7.2",
+    "mocha": "11.7.5",
     "nock": "14.0.10",
     "request": "2.88.2",
     "sinon": "21.0.0"