soajs.controller 4.3.24 → 4.3.25

package/docs/mcp.md

@@ -36,8 +36,8 @@ after 30 seconds.
 
 The ACL the gateway computes for `/soajs/acl`: the user's ACL and packages, else the tenant
 application's, else the package's. For each service, the latest allowed version; a restricted
-service shows only the APIs its ACL lists, per method. To give agents a different list from your
-apps, give the agent its own application, key and package in the tenant.
+service shows only the APIs its ACL lists, per method, and none when it lists none. To give agents
+a different list from your apps, give the agent its own application, key and package in the tenant.
 
 A tool call is checked again by the gateway like any API call, so a tool shown by mistake is still
 refused.

package/mw/soajsRoutes/lib/acl.js

@@ -16,10 +16,12 @@ const coreLibs = require("soajs.core.libs");
  *
  * finalACL is, per service, the latest allowed version and, for a restricted service, the allowed
  * apis per method: {"urac": {"version": "3", "get": ["/user"]}}. A service that is not restricted
- * has only its version: all its apis are allowed.
+ * has only its version: all its apis are allowed. A restricted service that lists no apis also has
+ * only its version, so restricted says, per service, whether its latest allowed version is
+ * restricted.
  *
  * @param req
- * @returns {{acl: object|null, finalACL: object|null, packages: Array|null}}
+ * @returns {{acl: object|null, finalACL: object|null, restricted: object, packages: Array|null}}
  */
 function computeACL(req) {
 	let ACL = null;
@@ -42,6 +44,7 @@ function computeACL(req) {
 		ACL = coreLibs.utils.cloneObj(req.soajs.controller.serviceParams.packObj.acl);
 	}
 	let finalACL = null;
+	let restricted = {};
 	if (ACL) {
 		finalACL = {};
 		for (let s in ACL) {
@@ -58,7 +61,8 @@ function computeACL(req) {
 						finalACL[s] = {
 							"version": v
 						};
-						if (sv.apisPermission && sv.apisPermission === "restricted") {
+						restricted[s] = !!(sv.apisPermission && sv.apisPermission === "restricted");
+						if (restricted[s]) {
 							for (let m in sv) {
 								if (sv.hasOwnProperty(m)) {
 									if (m !== "access" && m !== "apisPermission") {
@@ -91,6 +95,7 @@ function computeACL(req) {
 	return {
 		"acl": ACL,
 		"finalACL": finalACL,
+		"restricted": restricted,
 		"packages": ALLOWED_PACKAGES
 	};
 }

package/mw/soajsRoutes/mcp/tools.js

@@ -224,11 +224,10 @@ function toolName(serviceName, tool, taken) {
 }
 
 /**
- * Whether the caller's ACL allows the api: a restricted service lists its apis per method.
+ * Whether the caller's ACL allows the api: a restricted service allows only the apis it lists per
+ * method, none when it lists none.
  */
-function allowed(serviceACL, tool) {
-	let methods = ["get", "post", "put", "delete", "del"];
-	let restricted = methods.some((m) => Array.isArray(serviceACL[m]));
+function allowed(serviceACL, tool, restricted) {
 	if (!restricted) {
 		return true;
 	}
@@ -253,7 +252,7 @@ function listTools(req, configuration, config) {
 			let taken = {};
 			services.forEach((serviceName, i) => {
 				lists[i].forEach((tool) => {
-					if (tools.length >= config.maxTools || !allowed(finalACL[serviceName], tool)) {
+					if (tools.length >= config.maxTools || !allowed(finalACL[serviceName], tool, computed.restricted[serviceName])) {
 						return;
 					}
 					let name = toolName(serviceName, tool, taken);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.24",
+  "version": "4.3.25",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/test/unit/mw/soajsRoutes/mcp.js

@@ -216,14 +216,17 @@ describe("Unit test for: mw - soajsRoutes mcp", () => {
 
 	describe("allowed", () => {
 		it("a service that is not restricted allows all its apis", () => {
-			assert.ok(tools.allowed({version: "1"}, {m: "delete", v: "/x"}));
+			assert.ok(tools.allowed({version: "1"}, {m: "delete", v: "/x"}, false));
 		});
 		it("a restricted service allows the apis it lists", () => {
 			let acl = {version: "1", get: ["/users"], del: ["/user/:id"]};
-			assert.ok(tools.allowed(acl, {m: "get", v: "/users"}));
-			assert.ok(!tools.allowed(acl, {m: "get", v: "/user/:id"}));
-			assert.ok(tools.allowed(acl, {m: "delete", v: "/user/:id"}));
-			assert.ok(!tools.allowed(acl, {m: "post", v: "/users"}));
+			assert.ok(tools.allowed(acl, {m: "get", v: "/users"}, true));
+			assert.ok(!tools.allowed(acl, {m: "get", v: "/user/:id"}, true));
+			assert.ok(tools.allowed(acl, {m: "delete", v: "/user/:id"}, true));
+			assert.ok(!tools.allowed(acl, {m: "post", v: "/users"}, true));
+		});
+		it("a restricted service that lists no apis allows none", () => {
+			assert.ok(!tools.allowed({version: "1"}, {m: "get", v: "/users"}, true));
 		});
 	});
 
@@ -342,6 +345,14 @@ describe("Unit test for: mw - soajsRoutes mcp", () => {
 			}).catch(done);
 		});
 
+		it("listTools: a restricted service that lists no apis has no tools", (done) => {
+			let acl = {urac: {"1": {access: true, apisPermission: "restricted", post: {apis: {}}}}};
+			tools.listTools(makeReq({services: services(), acl: acl}), configuration, config).then((list) => {
+				assert.deepStrictEqual(list.tools, []);
+				done();
+			}).catch(done);
+		});
+
 		describe("callTool", () => {
 			let gateway = null;
 			let gatewayPort = null;
@@ -568,5 +579,16 @@ describe("Unit test for: mw - soajsRoutes mcp", () => {
 			req = makeReq({acl: {urac: {"1": {access: true, apisPermission: "restricted", get: [{group: "a", apis: {"/x": {}}}, {group: "b", apis: {"/y": {}, "/x": {}}}]}}}});
 			assert.deepStrictEqual(aclLib.computeACL(req).finalACL, {"urac": {"version": "1", "get": ["/x", "/y"]}});
 		});
+		it("restricted follows the latest allowed version", () => {
+			let req = makeReq({
+				acl: {
+					urac: {"1": {access: true, apisPermission: "restricted", get: {apis: {"/x": {}}}}, "2": {access: true}},
+					oauth: {"1": {access: true, apisPermission: "restricted", post: {apis: {}}}}
+				}
+			});
+			let computed = aclLib.computeACL(req);
+			assert.deepStrictEqual(computed.finalACL, {"urac": {"version": "2"}, "oauth": {"version": "1"}});
+			assert.deepStrictEqual(computed.restricted, {"urac": false, "oauth": true});
+		});
 	});
 });