soajs.controller 4.3.17 → 4.3.19

package/mw/idempotency/model/mongo.js

@@ -58,7 +58,7 @@ let model = {
 		}
 	},
 
-	'lock': async (key, ttl) => {
+	'lock': async (key, ttl, lockId) => {
 		let condition = {
 			'l1': key.l1,
 			'l2': key.l2
@@ -73,6 +73,7 @@ let model = {
 				'l1': key.l1,
 				'l2': key.l2,
 				'status': 'in_flight',
+				'lockId': lockId || null,
 				'lockedAt': new Date(),
 				'expiresAt': new Date(Date.now() + ttl)
 			};
@@ -108,11 +109,17 @@ let model = {
 		}
 	},
 
-	'unlock': async (key) => {
+	//NOTE: only a record still in flight is removed, never a completed one, and with a lockId only
+	//		the lock of that request, not one taken by a retry after the ttl
+	'unlock': async (key, lockId) => {
 		let condition = {
 			'l1': key.l1,
-			'l2': key.l2
+			'l2': key.l2,
+			'status': 'in_flight'
 		};
+		if (lockId) {
+			condition.lockId = lockId;
+		}
 		try {
 			await model.mongo.deleteOne(idempotency_store, condition);
 		} catch (e) {

package/mw/mt/tenantAccess.js

@@ -0,0 +1,173 @@
+"use strict";
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+const { httpRequestLight } = require("../../lib/request.js");
+
+const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
+
+const DEFAULT_TIMEOUT = 2000;
+
+/**
+ * Find the resolver that decides who can access the tenant of this request.
+ *
+ * NOTE: the tenant profile names the resolver, the urac custom registry defines what to call,
+ *       so the call can move without touching every tenant
+ *
+ * @param soajs
+ * @returns {null|{name, subject, service, version, method, api, timeout}}
+ */
+function getResolver(soajs) {
+	let access = get(["tenant", "profile", "access"], soajs);
+	if (!access || !access.resolver) {
+		return null;
+	}
+	let resolver = get(["registry", "custom", "urac", "value", "tenantAccessResolvers", access.resolver], soajs);
+	if (!resolver || !resolver.service || !resolver.api) {
+		if (soajs.log && soajs.log.error) {
+			soajs.log.error("Tenant access resolver [" + access.resolver + "] of tenant [" + soajs.tenant.code + "] is not defined in the urac custom registry");
+		}
+		return null;
+	}
+	return {
+		"name": access.resolver,
+		"subject": access.subject || null,
+		"service": resolver.service,
+		"version": resolver.version || null,
+		"method": resolver.method || "post",
+		"api": resolver.api,
+		"timeout": resolver.timeout || DEFAULT_TIMEOUT
+	};
+}
+
+/**
+ * The service behind the resolver has not been through the gateway, give it the tenant and key
+ * of this request the same way the gateway does, without any ACL or user
+ *
+ * @param soajs
+ * @param serviceName
+ * @returns {string}
+ */
+function buildInjectObj(soajs, serviceName) {
+	let tenant = soajs.tenant;
+	let injectObj = {
+		"tenant": {
+			"id": tenant.id,
+			"name": tenant.name,
+			"code": tenant.code,
+			"locked": tenant.locked,
+			"type": tenant.type
+		},
+		"key": {
+			"config": {},
+			"iKey": tenant.key.iKey,
+			"eKey": tenant.key.eKey
+		},
+		"application": {
+			"product": tenant.application.product,
+			"package": tenant.application.package,
+			"appId": tenant.application.appId
+		}
+	};
+	if (tenant.main) {
+		injectObj.tenant.main = tenant.main;
+	}
+	if (soajs.servicesConfig) {
+		if (soajs.servicesConfig.commonFields) {
+			injectObj.key.config.commonFields = soajs.servicesConfig.commonFields;
+		}
+		if (soajs.servicesConfig[serviceName]) {
+			injectObj.key.config[serviceName] = soajs.servicesConfig[serviceName];
+		}
+	}
+	return JSON.stringify(injectObj);
+}
+
+/**
+ * Ask the resolver if the user has access to the tenant of this request and with what groups.
+ *
+ * NOTE: anything but a well formed yes is no access, the caller falls back to the urac driver
+ *       so an invitation made after the token was issued still works
+ *
+ * @param soajs
+ * @param user the user from the token
+ * @param resolver from getResolver
+ * @param cb (result) result is {groups, groupsConfig} or null
+ */
+function resolve(soajs, user, resolver, cb) {
+	let done = (result) => {
+		//NOTE: out of the promise, an error thrown further down must not come back here as a rejection
+		process.nextTick(() => {
+			return cb(result);
+		});
+	};
+	let label = "Tenant access resolver [" + resolver.name + "] for user [" + user.username + "] and tenant [" + soajs.tenant.code + "]";
+
+	if (!soajs.registry || !soajs.registry.services ||
+		!soajs.registry.services[resolver.service] || !soajs.registry.services[resolver.service].port) {
+		soajs.log.error(label + " failed, service [" + resolver.service + "] is not in the registry");
+		return done(null);
+	}
+	soajs.awareness.getHost(resolver.service, resolver.version, (host) => {
+		if (!host) {
+			soajs.log.error(label + " failed, no host for [" + resolver.service + "@" + resolver.version + "]");
+			return done(null);
+		}
+		let data = {
+			"user": {
+				"id": user.id || (user._id ? user._id.toString() : null),
+				"username": user.username,
+				"tenant": {
+					"id": user.tenant.id,
+					"code": user.tenant.code
+				}
+			},
+			"tenant": {
+				"id": soajs.tenant.id,
+				"code": soajs.tenant.code
+			},
+			"subject": resolver.subject
+		};
+		if (soajs.tenant.main) {
+			data.tenant.main = soajs.tenant.main;
+		}
+		httpRequestLight({
+			"uri": "http://" + host + ":" + soajs.registry.services[resolver.service].port + resolver.api,
+			"method": resolver.method,
+			"data": data,
+			"headers": { "soajsinjectobj": buildInjectObj(soajs, resolver.service) },
+			"timeout": resolver.timeout
+		}).then((response) => {
+			let answer = (response && response.result === true) ? response.data : null;
+			if (!answer || typeof answer !== "object") {
+				soajs.log.error(label + " returned an invalid response");
+				return done(null);
+			}
+			if (answer.access !== true) {
+				return done(null);
+			}
+			if (!answer.groupsConfig || !answer.groupsConfig.allowedPackages || typeof answer.groupsConfig.allowedPackages !== "object") {
+				soajs.log.error(label + " granted access without groupsConfig.allowedPackages");
+				return done(null);
+			}
+			return done({
+				"groups": Array.isArray(answer.groups) ? answer.groups : [],
+				"groupsConfig": answer.groupsConfig
+			});
+		}).catch((error) => {
+			soajs.log.error(label + " failed: " + error.message);
+			return done(null);
+		});
+	});
+}
+
+module.exports = {
+	"getResolver": getResolver,
+	"resolve": resolve
+};

package/mw/mt/urac.js

@@ -13,6 +13,7 @@ const coreModules = require("soajs.core.modules");
 let provision = coreModules.provision;
 
 const lib = require("./lib.js");
+const tenantAccess = require("./tenantAccess.js");
 
 const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
 
@@ -57,6 +58,31 @@ function Urac(param) {
 			_self.username = param.username;
 		}
 	}
+
+	//NOTE: a user switching to a tenant that names a resolver in its profile is decided by the resolver,
+	//		unless the token already shows an invitation to that tenant, invitations keep going through
+	//		the urac driver
+	_self.tenantAccess = null;
+	if (!_self.userRecord && _self.id && _self.bearerTokenUser && _self.soajs.tenant && !_self.soajs.tenant.roaming) {
+		let user = _self.bearerTokenUser;
+		if (user.tenant && user.tenant.id !== _self.soajs.tenant.id && !isInvited(user, _self.soajs.tenant.id)) {
+			_self.tenantAccess = tenantAccess.getResolver(_self.soajs);
+		}
+	}
+}
+
+/**
+ * Check the allowedTenants of the user from the token
+ * @param user
+ * @param tenantId
+ * @returns {boolean}
+ */
+function isInvited(user, tenantId) {
+	let allowedTenants = get(["config", "allowedTenants"], user);
+	if (!Array.isArray(allowedTenants)) {
+		return false;
+	}
+	return allowedTenants.some((item) => item && item.tenant && item.tenant.id === tenantId);
 }
 
 /**
@@ -75,20 +101,43 @@ Urac.prototype.init = function (cb) {
 		}
 	}
 	else if (_self.id) {
-		uracDriver.getRecord(_self.soajs, { id: _self.id.toString(), username: _self.username }, function (err, record) {
-			if (record) {
-				_self.userRecord = record;
-				_self.resolveACL(() => {
-					return cb(null, _self.userRecord);
-				});
-			} else {
-				if (err && err.msg) {
-					const code = err.code;
-					err = new Error(err.msg);
-					err.code = code;
+		let getRecord = () => {
+			uracDriver.getRecord(_self.soajs, { id: _self.id.toString(), username: _self.username }, function (err, record) {
+				if (record) {
+					_self.userRecord = record;
+					_self.resolveACL(() => {
+						return cb(null, _self.userRecord);
+					});
+				} else {
+					if (err && err.msg) {
+						const code = err.code;
+						err = new Error(err.msg);
+						err.code = code;
+					}
+					return cb(err, null);
 				}
-				return cb(err, null);
+			});
+		};
+		if (!_self.tenantAccess) {
+			return getRecord();
+		}
+		tenantAccess.resolve(_self.soajs, _self.bearerTokenUser, _self.tenantAccess, (result) => {
+			//NOTE: no access from the resolver falls back to the urac driver, it catches an invitation
+			//		made after the token was issued and answers everyone else as before
+			if (!result) {
+				return getRecord();
 			}
+			_self.userRecord = Object.assign({}, _self.bearerTokenUser, {
+				"tenant": {
+					"id": _self.soajs.tenant.id,
+					"code": _self.soajs.tenant.code
+				},
+				"groups": result.groups,
+				"groupsConfig": result.groupsConfig
+			});
+			_self.resolveACL(() => {
+				return cb(null, _self.userRecord);
+			});
 		});
 	} else {
 		let error = new Error('oAuth userId is not available to pull URAC profile');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.17",
+  "version": "4.3.19",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/test/data/provision/customRegistry/gateway.js

@@ -0,0 +1,32 @@
+'use strict';
+let doc = {
+	"_id": "5d7f8e43edf21900fed08cf7",
+	"name": "gateway",
+	"locked": false,
+	"plugged": true,
+	"shared": false,
+	"value": {
+		"idempotency": {
+			"model": "mongo",
+			"services": {
+				"idempotent": {
+					"enabled": true,
+					"ttl": 60000,
+					"apis": ["POST /ok", "POST /fail", "POST /bad", "POST /slow", "POST /throttled"]
+				}
+			}
+		},
+		"traffic": {
+			"throttling": {
+				"idempotent": {
+					"publicAPIStrategy": "idempotent_tight",
+					"apis": ["/throttled"]
+				}
+			}
+		}
+	},
+	"created": "DEV",
+	"author": "owner"
+};
+
+module.exports = doc;

package/test/data/provision/customRegistry/urac.js

@@ -0,0 +1,22 @@
+'use strict';
+let doc = {
+	"_id": "5d7f8e43edf21900fed08cf6",
+	"name": "urac",
+	"locked": false,
+	"plugged": true,
+	"shared": false,
+	"value": {
+		"tenantAccessResolvers": {
+			"department": {
+				"service": "departments",
+				"version": "1",
+				"api": "/tenant/access",
+				"timeout": 1000
+			}
+		}
+	},
+	"created": "DEV",
+	"author": "owner"
+};
+
+module.exports = doc;

package/test/data/provision/environment/dev.js

@@ -115,6 +115,15 @@ let env = {
 	            "accessTokenLifetime": 7200,
 	            "refreshTokenLifetime": 1209600
             },
+            "throttling": {
+                "idempotent_tight": {
+                    "type": 1,
+                    "window": 60000,
+                    "limit": 1,
+                    "retries": 0,
+                    "delay": 100
+                }
+            },
             "ports": {
 	            "controller": 4000,
 	            "maintenanceInc": 1001,

package/test/data/provision/hosts/departments.js

@@ -0,0 +1,12 @@
+'use strict';
+
+let host = {
+    _id: "5da078e22357684b57effcf1",
+    env: "dev",
+    ip: "127.0.0.1",
+    name: "departments",
+    version: "1",
+    port: 4013
+};
+
+module.exports = host;

package/test/data/provision/hosts/idempotent.js

@@ -0,0 +1,12 @@
+'use strict';
+
+let host = {
+    _id: "5da078e22357684b57effcf3",
+    env: "dev",
+    ip: "127.0.0.1",
+    name: "idempotent",
+    version: "1",
+    port: 4014
+};
+
+module.exports = host;

package/test/data/provision/marketplace/departments.js

@@ -0,0 +1,38 @@
+'use strict';
+
+let service = {
+	_id: "5da078c92357684b57effcf0",
+	"type": "service",
+	name: "departments",
+	configuration: {
+		group: "SOAJS test",
+		port: 4013,
+		requestTimeout: 30,
+		requestTimeoutRenewal: 5
+	},
+	versions: [{
+		"version": "1",
+		maintenance: {
+			"port": {
+				"type": "maintenance"
+			},
+			"readiness": "/heartbeat"
+		},
+		oauth: true,
+		extKeyRequired: true,
+		urac: false,
+		urac_Profile: false,
+		urac_ACL: false,
+		provision_ACL: false,
+		apis: [
+			{
+				l: "Tenant access resolver",
+				v: "/tenant/access",
+				m: "post",
+				group: "Integration test"
+			}
+		]
+	}
+	]
+};
+module.exports = service;

package/test/data/provision/marketplace/idempotent.js

@@ -0,0 +1,37 @@
+'use strict';
+
+let service = {
+	_id: "5da078c92357684b57effcf2",
+	"type": "service",
+	name: "idempotent",
+	configuration: {
+		group: "SOAJS test",
+		port: 4014,
+		requestTimeout: 30,
+		requestTimeoutRenewal: 5
+	},
+	versions: [{
+		"version": "1",
+		maintenance: {
+			"port": {
+				"type": "maintenance"
+			},
+			"readiness": "/heartbeat"
+		},
+		oauth: true,
+		extKeyRequired: true,
+		urac: true,
+		urac_Profile: false,
+		urac_ACL: false,
+		provision_ACL: false,
+		apis: [
+			{ l: "Answers 200", v: "/ok", m: "post", group: "Integration test" },
+			{ l: "Answers 503 the first time", v: "/fail", m: "post", group: "Integration test" },
+			{ l: "Answers 400", v: "/bad", m: "post", group: "Integration test" },
+			{ l: "Answers 200 after a delay", v: "/slow", m: "post", group: "Integration test" },
+			{ l: "Answers 200, throttled", v: "/throttled", m: "post", group: "Integration test" }
+		]
+	}
+	]
+};
+module.exports = service;

package/test/data/provision/oauth/token/department_member_token.js

@@ -0,0 +1,72 @@
+'use strict';
+
+let token = {
+    _id: "5cdc190fd52c82e0ddb1dcd6",
+    type: "accessToken",
+    token: "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d901",
+    clientId: "5c0e74ba9acc3c5a84a51260",
+    user: {
+        _id: "5c8d0c505653de3985aa1001",
+        locked: true,
+        username: "dept_member",
+        firstName: "owner3'sèį",
+        lastName: "owner",
+        email: "me@localhost.com",
+        "ts": new Date().getTime(),
+        status: "active",
+        profile: {},
+        groups: [
+            "owner"
+        ],
+        config: {
+            packages: {},
+            keys: {},
+            allowedTenants: [
+                {
+                    tenant: {
+                        id: "THYME_tID",
+                        code: "THYME_CODE",
+                        pin: {
+                            code: "5678",
+                            allowed: true
+                        }
+                    },
+                    groups: [
+                        "waiter"
+                    ]
+                },
+                {
+                    tenant: {
+                        id: "ELVIRA_tID",
+                        code: "ELVIRA_CODE"
+                    },
+                    groups: [
+                        "manager"
+                    ]
+                }
+            ]
+        },
+        tenant: {
+            id: "5c0e74ba9acc3c5a84a51260",
+            code: "HOME",
+            pin: {
+                code: "1235",
+                allowed: true
+            }
+        },
+        lastLogin: new Date().getTime(),
+        groupsConfig: {
+            allowedPackages: {
+                DSBRD: [
+                    "DSBRD_OWNER"
+                ]
+            },
+            allowedEnvironments: {}
+        },
+        loginMode: "urac",
+        id: "5c8d0c505653de3985aa1001"
+    },
+    env: "dev",
+    expires: new Date((new Date().getFullYear()) + 2, 0, 1)
+};
+module.exports = token;

package/test/data/provision/oauth/token/department_outsider_token.js

@@ -0,0 +1,72 @@
+'use strict';
+
+let token = {
+    _id: "5cdc190fd52c82e0ddb1dcd7",
+    type: "accessToken",
+    token: "d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d902",
+    clientId: "5c0e74ba9acc3c5a84a51260",
+    user: {
+        _id: "5c8d0c505653de3985aa1002",
+        locked: true,
+        username: "dept_outsider",
+        firstName: "owner3'sèį",
+        lastName: "owner",
+        email: "me@localhost.com",
+        "ts": new Date().getTime(),
+        status: "active",
+        profile: {},
+        groups: [
+            "owner"
+        ],
+        config: {
+            packages: {},
+            keys: {},
+            allowedTenants: [
+                {
+                    tenant: {
+                        id: "THYME_tID",
+                        code: "THYME_CODE",
+                        pin: {
+                            code: "5678",
+                            allowed: true
+                        }
+                    },
+                    groups: [
+                        "waiter"
+                    ]
+                },
+                {
+                    tenant: {
+                        id: "ELVIRA_tID",
+                        code: "ELVIRA_CODE"
+                    },
+                    groups: [
+                        "manager"
+                    ]
+                }
+            ]
+        },
+        tenant: {
+            id: "5c0e74ba9acc3c5a84a51260",
+            code: "HOME",
+            pin: {
+                code: "1235",
+                allowed: true
+            }
+        },
+        lastLogin: new Date().getTime(),
+        groupsConfig: {
+            allowedPackages: {
+                DSBRD: [
+                    "DSBRD_OWNER"
+                ]
+            },
+            allowedEnvironments: {}
+        },
+        loginMode: "urac",
+        id: "5c8d0c505653de3985aa1002"
+    },
+    env: "dev",
+    expires: new Date((new Date().getFullYear()) + 2, 0, 1)
+};
+module.exports = token;

package/test/data/provision/products/dsbrd.js

@@ -9,6 +9,23 @@ let prod = {
 	"scope": {
 		"acl": {
 			"dev": {
+				"idempotent": {
+					"1": {
+						"access": true,
+						"post": [
+							{
+								"group": "Idempotent group",
+								"apis": {
+									"/ok": {},
+									"/fail": {},
+									"/bad": {},
+									"/slow": {},
+									"/throttled": {}
+								}
+							}
+						]
+					}
+				},
 				"httpmethods": {
 					"1": {
 						"access": true,
@@ -200,6 +217,14 @@ let prod = {
 			"locked": true,
 			"acl": {
 				"dev": {
+					"idempotent": [
+						{
+							"version": "1",
+							"post": [
+								"Idempotent group"
+							]
+						}
+					],
 					"httpmethods": [
 						{
 							"version": "1",

package/test/data/provision/tenants/dbtn.js

@@ -5,6 +5,12 @@ let tenant = {
     "code": "DBTN",
     "locked": true,
     "name": "Console Tenant",
+    "profile": {
+        "access": {
+            "resolver": "department",
+            "subject": "dept_1"
+        }
+    },
     "description": "This is the tenant that holds the access rights and configuration for the console users with DSBRD_GUEST as Guest default package",
     "oauth": {
         "secret": "this is a secret",