soajs.controller 4.3.26 → 4.3.27

package/docs/mcp.md

@@ -92,6 +92,9 @@ is yours, named by its endpoints.
   - else `byHost`, by the host the request came in on (`X-Forwarded-Host`, else `Host`);
   - else `default`.
   - An entry needs `authorization_endpoint` and `token_endpoint`; `registration_endpoint` is optional.
+- **`<origin>`** below is the scheme and host the request came in on: `X-Forwarded-Proto` and
+  `X-Forwarded-Host` when set. Behind a proxy that does not pass the scheme on, set
+  `"scheme": "https"` in `auth`; the host still comes from the request.
 - **No token, or an unknown or expired one:** HTTP 401 with
   `WWW-Authenticate: Bearer resource_metadata="<origin>/.well-known/oauth-protected-resource/soajs/mcp"`,
   plus `?key=` when the client's URL had one. If nothing matches the request, the answer is as without

package/mw/soajsRoutes/mcp/auth.js

@@ -16,7 +16,8 @@
  * at the endpoints the configuration names.
  *
  * Which endpoints: by the product of the key on the request (auth.byProduct), else by the host the
- * request came in on (auth.byHost), else auth.default.
+ * request came in on (auth.byHost), else auth.default. The addresses the gateway gives out use the
+ * request's host and auth.scheme, else the scheme the request came in with.
  *
  * An MCP client sends the token only, no key. A token restricted to one key (user.restrictedTo.key)
  * brings it: /soajs/mcp without a key uses it, and with a key of the same product the token's key
@@ -61,8 +62,16 @@ function requestHost(req) {
 	return (firstValue(req.headers["x-forwarded-host"]) || req.headers.host || "").toLowerCase();
 }
 
+/**
+ * The scheme is auth.scheme when set, for a proxy that does not pass X-Forwarded-Proto on, else
+ * X-Forwarded-Proto, else the connection's.
+ */
 function requestOrigin(req) {
-	let proto = firstValue(req.headers["x-forwarded-proto"]);
+	let auth = getAuthConfig(req);
+	let proto = (auth && (auth.scheme === "https" || auth.scheme === "http")) ? auth.scheme : null;
+	if (!proto) {
+		proto = firstValue(req.headers["x-forwarded-proto"]);
+	}
 	if (!proto) {
 		proto = (req.socket && req.socket.encrypted) ? "https" : "http";
 	}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.26",
+  "version": "4.3.27",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/test/unit/mw/soajsRoutes/mcpAuth.js

@@ -276,5 +276,27 @@ describe("Unit test for: mw - soajsRoutes mcp auth", () => {
 			req.socket = {encrypted: false};
 			assert.strictEqual(auth.requestOrigin(req), "http://api.connect.example");
 		});
+		it("requestOrigin: auth.scheme wins over the forwarded proto, the host stays", () => {
+			let req = makeReq({headers: {"x-forwarded-proto": "http"}, mcp: {enabled: true, auth: Object.assign({scheme: "https"}, AUTH)}});
+			assert.strictEqual(auth.requestOrigin(req), "https://api.connect.example");
+			req = makeReq({headers: {"x-forwarded-proto": "http"}, mcp: {enabled: true, auth: Object.assign({scheme: "ftp"}, AUTH)}});
+			assert.strictEqual(auth.requestOrigin(req), "http://api.connect.example");
+		});
+		it("auth.scheme in the metadata and the 401", (done) => {
+			let mcp = {enabled: true, auth: Object.assign({scheme: "https"}, AUTH)};
+			let mw = auth.wellKnown({provision: provision});
+			run(mw, makeReq({method: "GET", url: "/.well-known/oauth-protected-resource", mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+				assert.strictEqual(answer.body.resource, "https://api.connect.example/soajs/mcp");
+				assert.deepStrictEqual(answer.body.authorization_servers, ["https://api.connect.example/soajs/mcp/auth/default"]);
+				run(mw, makeReq({method: "GET", url: "/.well-known/oauth-authorization-server/soajs/mcp/auth/default", mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+					assert.strictEqual(answer.body.issuer, "https://api.connect.example/soajs/mcp/auth/default");
+					run(auth.authorize({provision: provision}), makeReq({mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+						assert.strictEqual(answer.headers["WWW-Authenticate"],
+							'Bearer resource_metadata="https://api.connect.example/.well-known/oauth-protected-resource/soajs/mcp"');
+						done();
+					});
+				});
+			});
+		});
 	});
 });