soajs.controller 4.3.26 → 4.3.28

package/docs/mcp.md

@@ -92,6 +92,9 @@ is yours, named by its endpoints.
   - else `byHost`, by the host the request came in on (`X-Forwarded-Host`, else `Host`);
   - else `default`.
   - An entry needs `authorization_endpoint` and `token_endpoint`; `registration_endpoint` is optional.
+- **`<origin>`** below is the scheme and host the request came in on: `X-Forwarded-Proto` and
+  `X-Forwarded-Host` when set. Behind a proxy that does not pass the scheme on, set
+  `"scheme": "https"` in `auth`; the host still comes from the request.
 - **No token, or an unknown or expired one:** HTTP 401 with
   `WWW-Authenticate: Bearer resource_metadata="<origin>/.well-known/oauth-protected-resource/soajs/mcp"`,
   plus `?key=` when the client's URL had one. If nothing matches the request, the answer is as without

package/mw/soajsRoutes/mcp/auth.js

@@ -16,7 +16,8 @@
  * at the endpoints the configuration names.
  *
  * Which endpoints: by the product of the key on the request (auth.byProduct), else by the host the
- * request came in on (auth.byHost), else auth.default.
+ * request came in on (auth.byHost), else auth.default. The addresses the gateway gives out use the
+ * request's host and auth.scheme, else the scheme the request came in with.
  *
  * An MCP client sends the token only, no key. A token restricted to one key (user.restrictedTo.key)
  * brings it: /soajs/mcp without a key uses it, and with a key of the same product the token's key
@@ -61,8 +62,16 @@ function requestHost(req) {
 	return (firstValue(req.headers["x-forwarded-host"]) || req.headers.host || "").toLowerCase();
 }
 
+/**
+ * The scheme is auth.scheme when set, for a proxy that does not pass X-Forwarded-Proto on, else
+ * X-Forwarded-Proto, else the connection's.
+ */
 function requestOrigin(req) {
-	let proto = firstValue(req.headers["x-forwarded-proto"]);
+	let auth = getAuthConfig(req);
+	let proto = (auth && (auth.scheme === "https" || auth.scheme === "http")) ? auth.scheme : null;
+	if (!proto) {
+		proto = firstValue(req.headers["x-forwarded-proto"]);
+	}
 	if (!proto) {
 		proto = (req.socket && req.socket.encrypted) ? "https" : "http";
 	}

package/mw/soajsRoutes/mcp/tools.js

@@ -435,6 +435,18 @@ function callTool(req, configuration, config, entry, args) {
 	if (!headers.access_token && req.query && req.query.access_token) {
 		headers.access_token = req.query.access_token;
 	}
+	//NOTE: the token goes as access_token, never as Authorization: a service that falls back to the
+	//		gateway for an interConnect peer passes access_token on, not a lowercase authorization
+	//		header, and oauth refuses a call that carries both
+	if (!headers.access_token && headers.authorization) {
+		let matches = headers.authorization.match(/^Bearer\s+(\S+)/i);
+		if (matches) {
+			headers.access_token = matches[1];
+		}
+	}
+	if (headers.access_token) {
+		delete headers.authorization;
+	}
 	let clientIP = req.getClientIP ? req.getClientIP() : null;
 	let forwarded = req.headers["x-forwarded-for"];
 	if (clientIP) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.26",
+  "version": "4.3.28",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/test/unit/mw/soajsRoutes/mcp.js

@@ -411,6 +411,23 @@ describe("Unit test for: mw - soajsRoutes mcp", () => {
 
 			let entry = {service: "urac", version: "2", tool: coreTools[1]};
 
+			it("a bearer token is passed on as access_token, not as authorization", (done) => {
+				reply = {status: 200, body: {result: true, data: {}}};
+				let req = makeReq({gatewayPort: gatewayPort, headers: {"authorization": "Bearer agentToken"}});
+				tools.callTool(req, configuration, config, entry, {id: "u1", name: "Ann"}).then(() => {
+					assert.strictEqual(received.headers.access_token, "agentToken");
+					assert.ok(!received.headers.authorization);
+					reply = {status: 200, body: {result: true, data: {}}};
+					let req2 = makeReq({gatewayPort: gatewayPort, headers: {"authorization": "Basic xyz"}});
+					return tools.callTool(req2, configuration, config, entry, {id: "u1", name: "Ann"});
+				}).then(() => {
+					// not a bearer token: left as it is
+					assert.strictEqual(received.headers.authorization, "Basic xyz");
+					assert.ok(!received.headers.access_token);
+					done();
+				}).catch(done);
+			});
+
 			it("the api call goes through the gateway port with the caller's credentials", (done) => {
 				reply = {status: 200, body: {result: true, data: {updated: true}}};
 				let req = makeReq({
@@ -423,7 +440,8 @@ describe("Unit test for: mw - soajsRoutes mcp", () => {
 					assert.strictEqual(received.url, "/urac/v2/user/u1");
 					assert.deepStrictEqual(JSON.parse(received.body), {profile: {name: "Ann"}});
 					assert.strictEqual(received.headers.key, "extKey");
-					assert.strictEqual(received.headers.authorization, "Bearer abc");
+					// one token only, as access_token
+					assert.ok(!received.headers.authorization);
 					assert.strictEqual(received.headers.access_token, "tok");
 					assert.strictEqual(received.headers["device-id"], "d1");
 					// the mcp request's own key is not forwarded, a write gets a new one

package/test/unit/mw/soajsRoutes/mcpAuth.js

@@ -276,5 +276,27 @@ describe("Unit test for: mw - soajsRoutes mcp auth", () => {
 			req.socket = {encrypted: false};
 			assert.strictEqual(auth.requestOrigin(req), "http://api.connect.example");
 		});
+		it("requestOrigin: auth.scheme wins over the forwarded proto, the host stays", () => {
+			let req = makeReq({headers: {"x-forwarded-proto": "http"}, mcp: {enabled: true, auth: Object.assign({scheme: "https"}, AUTH)}});
+			assert.strictEqual(auth.requestOrigin(req), "https://api.connect.example");
+			req = makeReq({headers: {"x-forwarded-proto": "http"}, mcp: {enabled: true, auth: Object.assign({scheme: "ftp"}, AUTH)}});
+			assert.strictEqual(auth.requestOrigin(req), "http://api.connect.example");
+		});
+		it("auth.scheme in the metadata and the 401", (done) => {
+			let mcp = {enabled: true, auth: Object.assign({scheme: "https"}, AUTH)};
+			let mw = auth.wellKnown({provision: provision});
+			run(mw, makeReq({method: "GET", url: "/.well-known/oauth-protected-resource", mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+				assert.strictEqual(answer.body.resource, "https://api.connect.example/soajs/mcp");
+				assert.deepStrictEqual(answer.body.authorization_servers, ["https://api.connect.example/soajs/mcp/auth/default"]);
+				run(mw, makeReq({method: "GET", url: "/.well-known/oauth-authorization-server/soajs/mcp/auth/default", mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+					assert.strictEqual(answer.body.issuer, "https://api.connect.example/soajs/mcp/auth/default");
+					run(auth.authorize({provision: provision}), makeReq({mcp: mcp, headers: {"x-forwarded-proto": "http"}}), (answer) => {
+						assert.strictEqual(answer.headers["WWW-Authenticate"],
+							'Bearer resource_metadata="https://api.connect.example/.well-known/oauth-protected-resource/soajs/mcp"');
+						done();
+					});
+				});
+			});
+		});
 	});
 });