spec-3nweb-server 1.8.4 → 1.8.6

package/ts-code/signup/signup-tokens.ts

@@ -0,0 +1,148 @@
+/*
+ Copyright (C) 2020 - 2021 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { toCanonicalAddress } from '../lib-common/canonical-address';
+import { assert } from '../lib-common/assert';
+import { bytes as randomBytes } from '../lib-common/random-node';
+import { base64urlSafe } from '../lib-common/buffer-utils';
+import { tokensInRootFolder } from '../lib-server/resources/server-data-folders';
+import { join } from 'path';
+import { compareVectors } from 'ecma-nacl';
+
+
+export type SignupContext = SingleUserSignupCtx | MultiDomainSignupCtx;
+
+export interface SingleUserSignupCtx {
+	token: string;
+	type: 'single-user';
+	userId: string;
+	validTill?: number;
+}
+
+export interface MultiDomainSignupCtx {
+	token?: string;
+	type: 'multi-domain';
+	domains: string[];
+	validTill?: number;
+}
+
+export function canCreateUser(userId: string, ctx: SignupContext): boolean {
+	if (ctx.validTill) {
+		const now = Math.floor(Date.now()/1000);
+		if (now > ctx.validTill) {
+			return false;
+		}
+	}
+	const cAddr = toCanonicalAddress(userId);
+	if (ctx.type === 'single-user') {
+		return (cAddr === ctx.userId);
+	} else if (ctx.type === 'multi-domain') {
+		return !!ctx.domains.find(d => cAddr.endsWith(`@${d}`));
+	} else {
+		return false;
+	}
+}
+
+export function addressesForName(
+	name: string, ctx: SignupContext
+): string[]|undefined {
+	if (ctx.validTill) {
+		const now = Math.floor(Date.now()/1000);
+		if (now > ctx.validTill) {
+			return;
+		}
+	}
+	if (ctx.type === 'single-user') {
+		const userId = `${name}${ctx.userId.substring(ctx.userId.indexOf('@'))}`;
+		return ((toCanonicalAddress(userId) === ctx.userId) ?
+			[ userId ] : [] );
+	} else if (ctx.type === 'multi-domain') {
+		return ctx.domains.map(d => `${name}@${d}`);
+	} else {
+		throw Error(`Unknown signup context type ${(ctx as any).type}`);
+	}
+}
+
+export function makeSingleUserSignupCtx(
+	token: string, userId: string, validitySecs?: number
+): SingleUserSignupCtx {
+	const ctx: SingleUserSignupCtx = {
+		token,
+		type: 'single-user',
+		userId: toCanonicalAddress(userId)
+	};
+	if (validitySecs) {
+		ctx.validTill = Math.floor(Date.now()/1000) + validitySecs;
+	}
+	return ctx;
+}
+
+export function makeMultiDomainSignupCtx(
+	signupDomains: string[], token?: string, validitySecs?: number
+): MultiDomainSignupCtx {
+	assert(Array.isArray(signupDomains));
+	const ctx: MultiDomainSignupCtx = {
+		token,
+		type: 'multi-domain',
+		domains: signupDomains.map(d => toCanonicalAddress(d).substring(1))
+	};
+	if (validitySecs) {
+		ctx.validTill = Math.floor(Date.now()/1000) + validitySecs;
+	}
+	return ctx;
+}
+
+const TOKEN_BYTES_LEN = 30;
+const TOKEN_FILE_NAME_LEN = 10;
+
+export async function generateToken(): Promise<string> {
+	const tokenBytes = await randomBytes(TOKEN_BYTES_LEN);
+	const token = base64urlSafe.pack(tokenBytes);
+	return token;
+}
+
+export function parseToken(
+	token: string
+): { tokenBytes: Buffer; tokenFile: string; }|undefined {
+	try {
+		const tokenBytes = base64urlSafe.open(token) as Buffer;
+		const tokenFile = tokenFileName(token);
+		return { tokenBytes, tokenFile };
+	} catch (err) {
+		return;	// explicit undefined
+	}
+}
+
+function tokenFileName(token: string): string {
+	return token.substring(0, TOKEN_FILE_NAME_LEN);
+}
+
+export function tokenPath(rootFolder: string, token: string): string {
+	return join(tokensInRootFolder(rootFolder), tokenFileName(token));
+}
+
+export function areTokensSame(t1: Buffer, t2: string): boolean {
+	try {
+		const t2Bytes = base64urlSafe.open(t2);
+		return compareVectors(t1, t2Bytes);
+	} catch (err) {
+		return false;
+	}
+}
+
+
+Object.freeze(exports);

package/ts-code/tests/admin-proto/signup.ts

@@ -0,0 +1,277 @@
+/*
+ Copyright (C) 2016, 2020 - 2021, 2025 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { afterEachAsync, beforeEachAsync, itAsync } from '../libs-for-tests/async-jasmine';
+import { AdminComponent } from '../libs-for-tests/server-components/admin';
+import { doJsonRequest, RequestOpts } from '../libs-for-tests/xhr-utils';
+import * as signupApi from '../../lib-common/admin-api/signup';
+import { expectNonAcceptanceOfBadJsonRequest } from '../shared-checks/requests';
+import { use } from '../../lib-common/jwkeys';
+import { box } from 'ecma-nacl';
+
+describe('Admin', () => {
+
+	describe('signup subsystem', () => {
+
+		let admin: AdminComponent;
+		const signupDomains = [ 'first.org', 'second.org' ];
+
+		beforeEachAsync(async () => {
+			admin = new AdminComponent(signupDomains);
+			await admin.start();
+		});
+
+		afterEachAsync(async () => {
+			await admin.stop();
+			admin = (undefined as any);
+		});
+
+		itAsync('tells available addresses for a given name', async () => {
+
+			const REQ_SIZE_LIMIT = 1024;
+
+			const name = 'Bob Marley ';
+
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.availableAddressesForName.URL_END,
+				method: 'POST',
+				responseType: 'json'
+			};
+
+			// request with ok name
+			let req: signupApi.availableAddressesForName.Request = { name };
+			const rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status code for OK reply').toBe(signupApi.availableAddressesForName.SC.ok);
+			expect(Array.isArray(rep.data)).withContext('OK reply is an array').toBe(true);
+			expect(rep.data.length).withContext('with no users, all domains should used as options for available addresses').toBe(signupDomains.length);
+			for (const domain of signupDomains) {
+				expect(rep.data).toContain(name+'@'+domain);
+			}
+
+			// requests with bad names and with bad json's
+			const badNames = [ name+'@something',	// char '@' not allowed in name
+				5, null, undefined, {} ];	// non-strings
+			const badJSONs: any[] = [ name, 5, null, undefined, [ name ],
+				{ a: 1 } ];
+			for (const badName of badNames) {
+				req = { name: <string> badName };
+				badJSONs.push(req);
+			}
+			await expectNonAcceptanceOfBadJsonRequest(reqOpts,
+				REQ_SIZE_LIMIT, badJSONs);
+
+		});
+
+		itAsync('tells available domains', async () => {
+
+			const REQ_SIZE_LIMIT = 1024;
+
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.availableDomains.URL_END,
+				method: 'POST',
+				responseType: 'json'
+			};
+
+			const req: signupApi.availableDomains.Request = {};
+			const rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status code for OK reply').toBe(signupApi.availableDomains.SC.ok);
+			expect(Array.isArray(rep.data)).withContext('OK reply is an array').toBe(true);
+			expect(rep.data.length).withContext('with no token, all domains should be given as options').toBe(signupDomains.length);
+			for (const domain of signupDomains) {
+				expect(rep.data).toContain(domain);
+			}
+
+			// requests with bad json's
+			const badJSONs: any[] = [ { signupToken: 4 } ];
+			await expectNonAcceptanceOfBadJsonRequest(
+				reqOpts, REQ_SIZE_LIMIT, badJSONs);
+
+		});
+
+		async function getAvailableAddressesFor(name: string): Promise<string[]> {
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.availableAddressesForName.URL_END,
+				method: 'POST',
+				responseType: 'json'
+			};
+			const req: signupApi.availableAddressesForName.Request = { name };
+			const rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).toBe(signupApi.availableAddressesForName.SC.ok);
+			return rep.data;
+		} 
+
+		function makeAddUserReq(
+			userId: string, signupToken?: string
+		): signupApi.addUser.Request {
+			return {
+				userId,
+				storage: {
+					kdParams: {}
+				},
+				mailerId: {
+					defaultPKey: {
+						pkey: {
+							alg: box.JWK_ALG_NAME,
+							kid: (Buffer.alloc(12)).toString('base64'),
+							use: use.MID_PKLOGIN,
+							k: (Buffer.alloc(box.KEY_LENGTH)).toString('base64')
+						},
+						kdParams: {}
+					},
+					otherPKeys: [ {
+							alg: box.JWK_ALG_NAME,
+							kid: (Buffer.alloc(12)).toString('base64'),
+							use: use.MID_PKLOGIN,
+							k: (Buffer.alloc(box.KEY_LENGTH)).toString('base64')
+						} ]
+				},
+				signupToken
+			};
+		}
+
+		function makeBadAddUserReq(goodId: string): any[] {
+			const name = 'Bob Marley';
+			const badJSONs: any[] = [ name, 5, null, undefined, [ name ],
+				{ a: 1 } ];
+			const badIds = [ 'bad domain str',
+				'', ' ', '\t', '\n',	// these are all equivalent to empty string
+				5, null, undefined, {} ];	// non-strings
+			for (const id of badIds) {
+				const req = makeAddUserReq(<string> id);
+				badJSONs.push(req);
+			}
+			let req = makeAddUserReq(goodId);
+			delete (req as any).userId;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req as any).storage;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete req.storage.kdParams;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req as any).mailerId;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId as any).defaultPKey;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.defaultPKey.pkey as any).alg;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.defaultPKey.pkey as any).k;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.defaultPKey.pkey as any).kid;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.defaultPKey.pkey as any).use;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete req.mailerId.defaultPKey.kdParams;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId as any).otherPKeys;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			req.mailerId.otherPKeys.shift();
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.otherPKeys[0] as any).alg;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.otherPKeys[0] as any).k;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.otherPKeys[0] as any).kid;
+			badJSONs.push(req);
+			req = makeAddUserReq(goodId);
+			delete (req.mailerId.otherPKeys[0] as any).use;
+			badJSONs.push(req);
+			return badJSONs;
+		}
+
+		async function addNewUser(
+			userId: string, signupToken?: string
+		): Promise<void> {
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.addUser.URL_END,
+				method: 'POST'
+			};
+			const req = makeAddUserReq(userId, signupToken);
+			let rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status when user is added').toBe(signupApi.addUser.SC.ok);
+			rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status when user already exists').toBe(signupApi.addUser.SC.userAlreadyExists);
+		}
+
+		itAsync('adds new user', async () => {
+
+			const REQ_SIZE_LIMIT = 4*1024;
+
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.addUser.URL_END,
+				method: 'POST'
+			};
+
+			const name = 'Bob Marley ';
+			let addresses = await getAvailableAddressesFor(name);
+			let numOfAvailableAddresses = addresses.length;
+			expect(numOfAvailableAddresses).toBe(signupDomains.length);
+			
+			// requests with bad json's
+			const badJSONs = makeBadAddUserReq(addresses[0]);
+			await expectNonAcceptanceOfBadJsonRequest(reqOpts,
+				REQ_SIZE_LIMIT, badJSONs);
+			
+			// normal adding users
+			for (const userId of addresses) {
+				expect(addresses).toContain(userId);
+				await addNewUser(userId);
+				numOfAvailableAddresses -= 1;
+				addresses = await getAvailableAddressesFor(name);
+				expect(addresses.length).toBe(numOfAvailableAddresses);
+				expect(addresses).not.toContain(userId);
+			}
+
+		});
+
+		itAsync(`adds new user with token`, async () => {
+			const reqOpts: RequestOpts= {
+				url: admin.signupUrl + signupApi.addUser.URL_END,
+				method: 'POST'
+			};
+
+			// note that new id has other domain that isn't set anywhere
+			const userId = 'Pink Floyd @home.town';
+
+			// let's try to do this without any token
+			let req = makeAddUserReq(userId);
+			let rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status when no token given').toBe(signupApi.addUser.SC.unauthorized);
+
+			// create token, here setup code uses spec-server specific code
+			const token = await admin.createSingleUserSignupTokenFor(userId);
+			req = makeAddUserReq(userId, token);
+			rep = await doJsonRequest<string[]>(reqOpts, req);
+			expect(rep.status).withContext('status when user is added').toBe(signupApi.addUser.SC.ok);
+
+		});
+
+	});
+
+});

package/ts-code/tests/jasmine.ts

@@ -0,0 +1,37 @@
+/*
+ Copyright (C) 2016 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+// NOTE: due to bad definition file, typescript below is not very type-strict.
+
+const jas = new (require('jasmine'))();
+
+jas.loadConfig({
+	spec_dir: 'build/tests',
+	spec_files: [
+		'admin-proto/**/*.js',
+		'protocols/mailerid.js',
+		'protocols/3nstorage/*.js',
+		'protocols/asmail/*.js',
+	],
+	random: false
+});
+
+jas.configureDefaultReporter({
+	showColors: true
+})
+
+jas.execute();

package/ts-code/tests/libs-for-tests/3nstorage.ts

@@ -0,0 +1,144 @@
+/*
+ Copyright (C) 2016, 2019 3NSoft Inc.
+ 
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU General Public License as published by the Free Software
+ Foundation, either version 3 of the License, or (at your option) any later
+ version.
+ 
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ See the GNU General Public License for more details.
+ 
+ You should have received a copy of the GNU General Public License along with
+ this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import { RequestOpts, doBodylessRequest, doBinaryRequest } from './xhr-utils';
+import { resolve as resolveUrl } from 'url';
+import * as api from '../../lib-common/service-api/3nstorage/owner';
+import { utf8 } from '../../lib-common/buffer-utils';
+import { assert } from './assert';
+
+export async function get3NStorageServiceUrl(
+	storageUrl: string, service: 'owner'|'shared'
+): Promise<string> {
+	let reqOpts: RequestOpts= {
+		url: storageUrl,
+		method: 'GET',
+		responseType: 'json'
+	};
+	let rep = await doBodylessRequest<any>(reqOpts);
+	assert(rep.status === 200);
+	let serviceUrl: string = rep.data[service];
+	assert(typeof serviceUrl === 'string');
+	return resolveUrl(storageUrl, serviceUrl);
+}
+
+export interface BaseObj {
+	objId: string,
+	header: Uint8Array,
+	segs: Uint8Array,
+}
+
+export interface Obj extends BaseObj {
+	version: number,
+	diff?: api.DiffInfo
+}
+
+export async function cancelTransaction(ownerUrl: string, sessionId: string,
+		objId: string, transactionId: string): Promise<void> {
+	let url = resolveUrl(ownerUrl, ((objId === null) ?
+		api.cancelRootTransaction.getReqUrlEnd(transactionId) :
+		api.cancelTransaction.getReqUrlEnd(objId, transactionId)));
+	let reqOpts: RequestOpts = {
+		url,
+		method: 'POST',
+		sessionId
+	};
+	let rep = await doBodylessRequest<void>(reqOpts);
+	assert(rep.status === api.cancelTransaction.SC.ok, `Obj transaction isn't canceled: server status ${rep.status} instead of expected ${api.cancelTransaction.SC.ok}`);
+}
+
+export async function getSessionParams(ownerUrl: string, sessionId: string):
+		Promise<api.sessionParams.Reply> {
+	let reqOpts: RequestOpts = {
+		url: resolveUrl(ownerUrl, api.sessionParams.URL_END),
+		method: 'GET',
+		responseType: 'json',
+		sessionId
+	};
+	let rep = await doBodylessRequest<api.sessionParams.Reply>(reqOpts);
+	assert(rep.status === 200);
+	return rep.data;
+}
+
+/**
+ * @param user
+ * @param objId is object's id. Null stands for root object.
+ * @param ver
+ * @param obj
+ * @return a promise, resolvable object is writen.
+ */
+export async function saveObj(
+	ownerUrl: string, sessionId: string,
+	objId: string|null, ver: number, obj: Obj
+): Promise<void> {
+
+	const header = obj.header.length;
+	const diffBytes = (obj.diff ?
+		utf8.pack(JSON.stringify(obj.diff)) : undefined);
+	const diff = (diffBytes ? diffBytes.length : undefined);
+	const opts: RequestOpts = {
+		method: 'PUT',
+		responseType: 'json',
+		sessionId
+	};
+	if (diffBytes) {
+		const urlEnd = (objId ?
+			api.currentObj.firstPutReqUrlEnd(objId, { ver, diff, header }) :
+			api.currentRootObj.firstPutReqUrlEnd({ ver, diff, header }));
+		opts.url = resolveUrl(ownerUrl, urlEnd);
+		const rep = await doBinaryRequest<api.currentObj.ReplyToPut>(
+			opts, [ diffBytes, obj.header ]);
+		assert(rep.status === api.currentObj.SC.okPut, `Obj header isn't saved: server status ${rep.status} instead of expected ${api.currentObj.SC.okPut}`);
+		const trans = rep.data.transactionId!;
+		let ofs = 0;
+		for (const [ isNew, dOfs, len ] of obj.diff!.sections) {
+			const last = ((dOfs+len) === obj.segs.length);
+			if (isNew === 1) {
+				const urlEnd = (objId ?
+					api.currentObj.secondPutReqUrlEnd(objId, { ofs, trans, last }) :
+					api.currentRootObj.secondPutReqUrlEnd({ ofs, trans, last }));
+				opts.url = resolveUrl(ownerUrl, urlEnd);
+				const rep = await doBinaryRequest<api.currentObj.ReplyToPut>(
+					opts, obj.segs.subarray(dOfs, dOfs+len));
+				assert(rep.status === api.currentObj.SC.okPut, `Obj segments sections isn't saved: server status ${rep.status} instead of expected ${api.currentObj.SC.okPut}`);
+			}
+			ofs += len;
+		}
+	} else {
+		const urlOpts: api.PutObjFirstQueryOpts = { ver, header, last: true };
+		const urlEnd = (objId ?
+			api.currentObj.firstPutReqUrlEnd(objId, urlOpts) :
+			api.currentRootObj.firstPutReqUrlEnd(urlOpts));
+		opts.url = resolveUrl(ownerUrl, urlEnd);
+		const rep = await doBinaryRequest<api.currentObj.ReplyToPut>(
+			opts, [ obj.header, obj.segs ]);
+		assert(rep.status === api.currentObj.SC.okPut, `Complete obj isn't saved: server status ${rep.status} instead of expected ${api.currentObj.SC.okPut}`);
+	}
+}
+
+export async function removeObj(ownerUrl: string, sessionId: string,
+		objId: string): Promise<void> {
+	const opts: RequestOpts = {
+		url: resolveUrl(ownerUrl, api.currentObj.getReqUrlEnd(objId)),
+		method: 'DELETE',
+		sessionId
+	};
+	const rep = await doBodylessRequest(opts);
+	assert(rep.status === api.currentObj.SC.okDelete, `Obj isn't removed: server status ${rep.status} instead of expected ${api.currentObj.SC.okDelete}`);
+}
+
+Object.freeze(exports);