soajs.controller 4.3.2 → 4.3.4

package/lib/parseURL.js

@@ -8,7 +8,20 @@
  * found in the LICENSE file at the root of this repository
  */
 
-const url = require('url');
+/**
+ * Parse URL using WHATWG URL API and return object compatible with legacy url.parse()
+ * @param {string} urlString - URL string to parse
+ * @returns {Object} - Object with pathname, path, and query properties
+ */
+const parseURL = (urlString) => {
+	const urlObj = new URL(urlString, 'http://localhost');
+	const search = urlObj.search || '';
+	return {
+		pathname: urlObj.pathname,
+		path: urlObj.pathname + search,
+		query: Object.fromEntries(urlObj.searchParams)
+	};
+};
 
 
 module.exports = (uri, parsedUrl) => {
@@ -16,7 +29,7 @@ module.exports = (uri, parsedUrl) => {
 	let service_nv = serviceInfo[1];
 	let service_n = service_nv;
 	let service_v = null;
-	
+
 	//check if there is /v1 or v1.1 in the url
 	let matches = uri.match(/\/v[0-9]+(.[0-9]+)?\//);
 	if (matches && matches.length > 0) {
@@ -25,7 +38,7 @@ module.exports = (uri, parsedUrl) => {
 			service_v = hit.replace("v", '');
 			serviceInfo.splice(2, 1);
 			uri = uri.replace(matches[0], "/");
-			parsedUrl = url.parse(uri, true);
+			parsedUrl = parseURL(uri);
 		}
 	}
 	

package/mw/lastSeen/index.js

@@ -52,11 +52,12 @@ function getRouteRegExp(route) {
  * Check if the current request should trigger lastSeen
  * @param {Object} include - The include whitelist configuration
  * @param {string} serviceName - The current service name
- * @param {string} apiPath - The current API path
+ * @param {string} apiPath - The current API path (relative to service, e.g., "/active")
+ * @param {string} fullPath - The full API path (e.g., "/connectspaces/active")
  * @param {string} method - The HTTP method (GET, POST, etc.)
  * @returns {boolean} - true if lastSeen should be triggered
  */
-function shouldTriggerLastSeen(include, serviceName, apiPath, method) {
+function shouldTriggerLastSeen(include, serviceName, apiPath, fullPath, method) {
     // No include filter = trigger for all (backward compatible)
     if (!include) {
         return true;
@@ -74,9 +75,17 @@ function shouldTriggerLastSeen(include, serviceName, apiPath, method) {
         return true;
     }
 
-    // API-level match
+    // API-level match - check both relative path and full path for backward compatibility
     if (typeof serviceConfig === 'object' && serviceConfig.apis) {
-        return isApiMethodMatch(serviceConfig.apis, apiPath, method);
+        // Try relative path first (e.g., "/active")
+        if (apiPath && isApiMethodMatch(serviceConfig.apis, apiPath, method)) {
+            return true;
+        }
+        // Fallback to full path for backward compatibility (e.g., "/connectspaces/active")
+        if (fullPath && fullPath !== apiPath && isApiMethodMatch(serviceConfig.apis, fullPath, method)) {
+            return true;
+        }
+        return false;
     }
 
     return false;
@@ -150,11 +159,13 @@ module.exports = () => {
 
                 // Check include filter
                 let currentService = get(["soajs", "controller", "serviceParams", "name"], req);
-                let currentApi = get(["soajs", "controller", "serviceParams", "parsedUrl", "pathname"], req);
+                // Get both relative path (e.g., "/active") and full path (e.g., "/connectspaces/active")
+                let currentApi = get(["soajs", "controller", "serviceParams", "path"], req);
+                let fullPath = get(["soajs", "controller", "serviceParams", "parsedUrl", "pathname"], req);
                 let currentMethod = req.method;
 
-                if (!shouldTriggerLastSeen(lastSeen.include, currentService, currentApi, currentMethod)) {
-                    req.soajs.log.debug("lastSeen skipped for [" + currentService + " " + currentMethod + " " + currentApi + "]");
+                if (!shouldTriggerLastSeen(lastSeen.include, currentService, currentApi, fullPath, currentMethod)) {
+                    req.soajs.log.debug("lastSeen skipped for [" + currentService + " " + currentMethod + " " + (currentApi || fullPath) + "]");
                     return;
                 }
 

package/mw/mt/lib.js

@@ -13,7 +13,7 @@ let _ = require("lodash");
 
 module.exports = {
 	"mergeACLArray": function (arrayACL, cb) {
-		
+
 		//if only one return it
 		if (arrayACL.length === 1) {
 			return cb(null, arrayACL[0]);
@@ -30,30 +30,30 @@ module.exports = {
 			function () {
 				return cb(null, acl);
 			});
-		
+
 		function mergePackageAcl(oneAcl, cb) {
 			//first object
 			if (!acl.acl) {
-				acl.acl = oneAcl.acl;
+				acl.acl = _.cloneDeep(oneAcl.acl);
 				return cb();
 			}
 			async.eachOfSeries(oneAcl.acl, function (service, serviceName, serviceCall) {
 				if (!acl.acl[serviceName]) {
-					acl.acl[serviceName] = service;
+					acl.acl[serviceName] = _.cloneDeep(service);
 					return serviceCall();
 				}
 				async.eachOfSeries(service, function (version, versionValue, versionCall) {
 					if (!acl.acl[serviceName][versionValue]) {
-						acl.acl[serviceName][versionValue] = version;
+						acl.acl[serviceName][versionValue] = _.cloneDeep(version);
 						return serviceCall();
 					}
 					if (version.apisPermission === "restricted") {
 						if (acl.acl[serviceName] && acl.acl[serviceName][versionValue] && acl.acl[serviceName][versionValue].apisPermission && acl.acl[serviceName][versionValue].apisPermission === "restricted") {
 							//only restricted allowed to merge
-							acl.acl[serviceName][versionValue] = _.merge(acl.acl[serviceName][versionValue], version);
+							acl.acl[serviceName][versionValue] = _.merge(acl.acl[serviceName][versionValue], _.cloneDeep(version));
 							return versionCall();
 						} else {
-							acl.acl[serviceName][versionValue] = version;
+							acl.acl[serviceName][versionValue] = _.cloneDeep(version);
 							return versionCall();
 						}
 					} else {
@@ -62,42 +62,42 @@ module.exports = {
 							return versionCall();
 						} else {
 							//only non restricted allowed to merge
-							acl.acl[serviceName][versionValue] = _.merge(acl.acl[serviceName][versionValue], version);
+							acl.acl[serviceName][versionValue] = _.merge(acl.acl[serviceName][versionValue], _.cloneDeep(version));
 							return versionCall();
 						}
 					}
 				}, serviceCall);
 			}, cb);
 		}
-		
+
 		function mergePackageAclAllEnv(oneAcl, cb) {
 			//first object
 			if (!acl.acl_all_env) {
-				acl.acl_all_env = oneAcl.acl_all_env;
+				acl.acl_all_env = _.cloneDeep(oneAcl.acl_all_env);
 				return cb();
 			}
 			async.eachOf(oneAcl.acl_all_env, function (environment, envName, envCall) {
 				if (!acl.acl_all_env[envName]) {
-					acl.acl_all_env[envName] = environment;
+					acl.acl_all_env[envName] = _.cloneDeep(environment);
 					return envCall();
 				}
 				async.eachOf(environment, function (service, serviceName, serviceCall) {
 					if (!acl.acl_all_env[envName][serviceName]) {
-						acl.acl_all_env[envName][serviceName] = service;
+						acl.acl_all_env[envName][serviceName] = _.cloneDeep(service);
 						return serviceCall();
 					}
 					async.eachOf(service, function (version, versionValue, versionCall) {
 						if (!acl.acl_all_env[envName][serviceName][versionValue]) {
-							acl.acl_all_env[envName][serviceName][versionValue] = version;
+							acl.acl_all_env[envName][serviceName][versionValue] = _.cloneDeep(version);
 							return serviceCall();
 						}
 						if (version.apisPermission === "restricted") {
 							if (acl.acl_all_env[envName][serviceName][versionValue].apisPermission && acl.acl_all_env[envName][serviceName][versionValue].apisPermission === "restricted") {
 								//only restricted allowed to merge
-								acl.acl_all_env[envName][serviceName][versionValue] = _.merge(acl.acl_all_env[envName][serviceName][versionValue], version);
+								acl.acl_all_env[envName][serviceName][versionValue] = _.merge(acl.acl_all_env[envName][serviceName][versionValue], _.cloneDeep(version));
 								return versionCall();
 							} else {
-								acl.acl_all_env[envName][serviceName][versionValue] = version;
+								acl.acl_all_env[envName][serviceName][versionValue] = _.cloneDeep(version);
 								return versionCall();
 							}
 						} else {
@@ -106,7 +106,7 @@ module.exports = {
 								return versionCall();
 							} else {
 								//only non restricted allowed to merge
-								acl.acl_all_env[envName][serviceName][versionValue] = _.merge(acl.acl_all_env[envName][serviceName][versionValue], version);
+								acl.acl_all_env[envName][serviceName][versionValue] = _.merge(acl.acl_all_env[envName][serviceName][versionValue], _.cloneDeep(version));
 								return versionCall();
 							}
 						}
@@ -115,4 +115,4 @@ module.exports = {
 			}, cb);
 		}
 	}
-};
+};

package/mw/soajsRoutes/keyACL/index.js

@@ -31,7 +31,7 @@ module.exports = (configuration) => {
 		}
 		if (!ACL && req.soajs.controller.serviceParams.packObj.acl) {
 			req.soajs.log.debug("soajsRoute keyACL: Found Default ACL at Package level, setting default ACL configuration.");
-			ACL = req.soajs.controller.serviceParams.packObj.acl;
+			ACL = coreLibs.utils.cloneObj(req.soajs.controller.serviceParams.packObj.acl);
 		}
 		let finalACL = null;
 		if (ACL) {

package/mw/url/index.js

@@ -8,9 +8,23 @@
  * found in the LICENSE file at the root of this repository
  */
 
-const url = require('url');
 let libParseURL = require('../../lib/parseURL');
 
+/**
+ * Parse URL using WHATWG URL API and return object compatible with legacy url.parse()
+ * @param {string} urlString - URL string to parse
+ * @returns {Object} - Object with pathname, path, and query properties
+ */
+const parseURL = (urlString) => {
+	const urlObj = new URL(urlString, 'http://localhost');
+	const search = urlObj.search || '';
+	return {
+		pathname: urlObj.pathname,
+		path: urlObj.pathname + search,
+		query: Object.fromEntries(urlObj.searchParams)
+	};
+};
+
 /**
  * Assure req param (soajs & soajs.controller)
  * Parse url and fetch service info (soajs.controller.serviceParams)
@@ -30,7 +44,7 @@ module.exports = (configuration) => {
 			req.soajs.controller = {};
 		}
 
-		let parsedUrl = url.parse(req.url, true);
+		let parsedUrl = parseURL(req.url);
 		if (!req.query && parsedUrl.query) {
 			req.query = parsedUrl.query;
 		}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.2",
+  "version": "4.3.4",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"
@@ -27,9 +27,9 @@
     "merge": "2.1.1",
     "netmask": "2.0.2",
     "oauth2-server": "2.4.1",
-    "path-to-regexp": "8.3.0",
+    "path-to-regexp": "8.4.0",
     "soajs.core.libs": "1.2.2",
-    "soajs.core.modules": "5.2.18",
+    "soajs.core.modules": "5.2.19",
     "soajs.urac.driver": "3.2.15",
     "useragent": "2.3.0"
   },

package/server/maintenance.js

@@ -14,8 +14,22 @@ const registryModule = require("./../modules/registry");
 
 const httpProxy = require('http-proxy');
 const http = require('http');
-const url = require('url');
 const soajsLib = require("soajs.core.libs");
+
+/**
+ * Parse URL using WHATWG URL API and return object compatible with legacy url.parse()
+ * @param {string} urlString - URL string to parse
+ * @returns {Object} - Object with pathname, path, and query properties
+ */
+const parseURL = (urlString) => {
+	const urlObj = new URL(urlString, 'http://localhost');
+	const search = urlObj.search || '';
+	return {
+		pathname: urlObj.pathname,
+		path: urlObj.pathname + search,
+		query: Object.fromEntries(urlObj.searchParams)
+	};
+};
 const soajsUtils = soajsLib.utils;
 
 const packageInfo = require("../package.json");
@@ -148,7 +162,7 @@ let Maintenance = (core, log, param, serviceIp, regEnvironment, awareness_mw, so
 		log.error('Internal proxy error: ' + error);
 		
 		res.writeHead(200, {'Content-Type': 'application/json'});
-		let parsedUrl = url.parse(req.url, true);
+		let parsedUrl = parseURL(req.url);
 		let response = maintenanceResponse(parsedUrl, param, '/proxySocket');
 		return res.end(JSON.stringify(response));
 	});
@@ -159,7 +173,7 @@ let Maintenance = (core, log, param, serviceIp, regEnvironment, awareness_mw, so
 			res.writeHead(200, {'Content-Type': 'image/x-icon'});
 			return res.end();
 		}
-		let parsedUrl = url.parse(req.url, true);
+		let parsedUrl = parseURL(req.url);
 		
 		if (parsedUrl.pathname === '/reloadRegistry') {
 			reloadRegistry(parsedUrl, core, log, param, serviceIp, (response) => {

package/test/integration/UC4-multiuser-acl/readme.md

@@ -0,0 +1,11 @@
+- i have 2 users with access to the same tenant
+- under this tenant i have 2 groups as follow:
+    - owner with the following packages [GRPCH_DEFAU, GRPCH_OWNER]
+    - member with the following packages [GRPCH_DEFAU, GRPCH_AMMBR, GRPCH_EGDTL, GRPCH_SMDIA, GRPCH_SMSSG, GRPCH_VMMBR]
+- i have microservice connectonboarding with an api DELETE /group/chats/users/:userId and this api is only under package GRPCH_OWNER
+
+i have the following usecase:
+- load the provision by hitting the maintenance route /loadProvision
+- user1 with member group login first and hit the acl api /soajs/acl, then we check the response and we see that he has the right packages and api DELETE /group/chats/users/:userId is not part of finalACL which is correct
+- user2 with owner group login  and hit the acl api /soajs/acl, then we check the response and we see that he has the right packages and api DELETE /group/chats/users/:userId is  part of finalACL which is correct
+- user1 with member group hit the acl api /soajs/acl again, then we check the response and we see that he has the right packages but api DELETE /group/chats/users/:userId is now part of finalACL which is not correct

package/test/unit/lib/parseURL.js

@@ -1,13 +1,27 @@
 "use strict";
 
-const url = require('url');
 const helper = require("../../helper.js");
 const lib = helper.requireModule('./lib/parseURL');
 const assert = require('assert');
 
+/**
+ * Parse URL using WHATWG URL API and return object compatible with legacy url.parse()
+ * @param {string} urlString - URL string to parse
+ * @returns {Object} - Object with pathname, path, and query properties
+ */
+const parseURL = (urlString) => {
+	const urlObj = new URL(urlString, 'http://localhost');
+	const search = urlObj.search || '';
+	return {
+		pathname: urlObj.pathname,
+		path: urlObj.pathname + search,
+		query: Object.fromEntries(urlObj.searchParams)
+	};
+};
+
 describe("Unit test for: lib - parseURL", () => {
     let uri = '/micro2/v1.1/hello';
-    let parsedURL = url.parse(uri, true);
+    let parsedURL = parseURL(uri);
     it("Vanilla test with v1.1", (done) => {
         let response = lib(uri, parsedURL);
         assert.deepStrictEqual(response.name, 'micro2', "lib.parseURL vanilla test with v1.1 failed for name");
@@ -16,10 +30,10 @@ describe("Unit test for: lib - parseURL", () => {
     });
     it("Vanilla test with :1.1", (done) => {
         uri = '/micro2:1.1/hello';
-        parsedURL = url.parse(uri, true);
+        parsedURL = parseURL(uri);
         let response = lib(uri, parsedURL);
         assert.deepStrictEqual(response.name, 'micro2', "lib.parseURL vanilla test with 1:1 failed for name");
         assert.deepStrictEqual(response.service_v, '1.1', "lib.parseURL vanilla test with 1:1 failed version");
         done();
     });
-});
+});