ti2 1.0.41 → 1.0.43

package/api.yml

@@ -635,7 +635,75 @@ paths:
           content:
             application/json:
               schema: '#/components/schemas/Message'
-
+  /{app}/{userId}/{hint}/token:
+    get:
+      tags:
+        - app
+        - user
+        - admin
+      summary: Get a user app+Token configuration, the authorization can be either from the app or the user
+      security:
+        - bearerAuth: ['app', 'user', 'admin']
+      operationId: getAppToken
+      parameters:
+        - name: app
+          in: path
+          description: app name to read the userId for (must match app token)
+          example: 'expedia'
+          required: true
+          schema:
+            type: string
+        - name: hint
+          in: path
+          description: a specific token hint to be used
+          required: true
+          example: 'travelgate-australia'
+          schema:
+            type: string
+        - name: userId
+          in: path
+          description: user to read the app token for
+          example: '536830b6ed19afa44a000002'
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: success
+          content:
+            application/json:
+              schema: '#/components/schemas/UserApp'
+  /{app}/{userId}/token:
+    get:
+      tags:
+        - app
+        - user
+        - admin
+      summary: Get a user app+Token configuration, the authorization can be either from the app or the user, it will return the first token found (since no hint is required)
+      security:
+        - bearerAuth: ['app', 'user', 'admin']
+      operationId: getAppToken
+      parameters:
+        - name: app
+          in: path
+          description: app name to read the userId for (must match app token)
+          example: 'expedia'
+          required: true
+          schema:
+            type: string
+        - name: userId
+          in: path
+          description: user to read the app token for
+          example: '536830b6ed19afa44a000002'
+          required: true
+          schema:
+            type: string
+      responses:
+        200:
+          description: success
+          content:
+            application/json:
+              schema: '#/components/schemas/UserApp'
   /{app}/{userId}/validate:
     post:
       tags:

package/cli.js

@@ -4,6 +4,7 @@ const { Command, Argument } = require('commander');
 
 const { migrateApp } = require('./controllers/app')();
 const { migrate } = require('./controllers/admin');
+const { decrypt, encrypt } = require('./lib/security');
 
 const program = new Command();
 
@@ -35,4 +36,23 @@ program.command('db')
     process.exit(0);
   });
 
+program.command('decrypt')
+  .description('decrypt a string')
+  .addArgument(
+    new Argument('<key>', 'key to decrypt'),
+  )
+.action(async key => {
+    console.log(await decrypt(key));
+    process.exit(0);
+  });
+program.command('encrypt')
+  .description('encrypt a string')
+  .addArgument(
+    new Argument('<key>', 'key to encrypt'),
+  )
+.action(async key => {
+    console.log(await encrypt(key));
+    process.exit(0);
+  });
+
 program.parse();

package/controllers/__tests__/user.js

@@ -135,6 +135,33 @@ describe('user', () => {
       ]),
     );
   });
+  const apiKey2 = chance.guid();
+  const token2 = { ...token };
+  it('create a second token', async () => {
+    // set up new token
+    await doApiPost({
+      url: `/${appName}/${userId}`,
+      token: userKey,
+      payload: {
+        tokenHint: apiKey2.split('-')[1],
+        token: token2,
+      },
+    });
+  });
+  it('should be able to read a user/app token', async () => {
+    const returnValue = await doApiGet({
+      url: `/${appName}/${userId}/token`,
+      token: userKey,
+    });
+    expect(returnValue.token).toEqual(token);
+  });
+  it('should be able to read the second user/app token by hint', async () => {
+    const returnValue = await doApiGet({
+      url: `/${appName}/${userId}/${apiKey2.split('-')[1]}/token`,
+      token: userKey,
+    });
+    expect(returnValue.token).toEqual(token2);
+  });
   it('should be able to create an app setting', async () => {
     const returnValue = await doApiPost({
       url: `/settings/${appName}/${userId}`,
@@ -154,7 +181,7 @@ describe('user', () => {
     });
     expect(returnValue.settings.custom).toBe(true);
   });
-  it('testing the user token should include the user app seting', async () => {
+  it('testing the user token should include the user app setting', async () => {
     const { valid } = await doApiPost({
       url: `/${appName}/${userId}/validate`,
       token: userKey,

package/controllers/app.js

@@ -386,8 +386,33 @@ const getAppSettings = async (req, res, next) => {
   return res.json({ settings: userIntegrationSettings.settings });
 };
 
+const getAppToken = async (req, res, next) => {
+  const {
+    params: {
+      app: integrationId,
+      userId,
+      hint,
+    },
+  } = req;
+  // check if the user exists
+  const userRecord = await sqldb.User.findOne({ where: { userId } });
+  if (!userRecord) return next({ status: 404, message: 'User does not exists' });
+  const userAppKey = await sqldb.UserAppKey.findOne({
+    where: {
+      userId,
+      integrationId,
+      ...(hint ? { hint } : {}),
+    },
+  });
+  if (!userAppKey) {
+    return next({ status: 404, message: 'User integratio is not found' });
+  }
+  return res.json({ token: await userAppKey.token });
+};
+
 module.exports = plugins => ({
   createAppToken,
+  getAppToken,
   createAppSettings,
   getAppSettings,
   deleteAppToken,

package/migrations/20221114141152-encryptUserToken.js

@@ -0,0 +1,45 @@
+const jwt = require('jsonwebtoken');
+const R = require('ramda');
+const assert = require('assert');
+const sqldb = require('../models/index');
+
+const { encrypt, decrypt } = require('../lib/security');
+
+const { env: { dbCryptoKey } } = process;
+
+module.exports = {
+  up: async () => {
+    // encrypt all data
+    const existingTokens = await sqldb.UserAppKey.findAll();
+    const valuesToUpdate = [];
+    for (const currentToken of existingTokens) {
+      const decodedToken = JSON.stringify(R.omit(
+        ['iat'],
+        jwt.verify(currentToken.dataValues.appKey, dbCryptoKey),
+      ));
+      const encryptedToken = encrypt(decodedToken);
+      // make sure we can decrypt it
+      const decodedValue = decrypt(encryptedToken);
+      assert(R.equals(decodedToken, decodedValue));
+      currentToken.appKey = encryptedToken;
+      valuesToUpdate.push({
+        id: currentToken.id,
+        appToken: encryptedToken,
+      });
+    }
+    for (const { id, appToken } of valuesToUpdate) {
+      const currentToken = await sqldb.UserAppKey.findOne({ where: { id } });
+      currentToken.setDataValue('appKey', appToken);
+      await currentToken.save();
+    }
+  },
+  down: async () => {
+    const existingTokens = await sqldb.UserAppKey.findAll();
+    for (const currentToken of existingTokens) {
+      const decodedToken = decrypt(currentToken.dataValues.appKey);
+      const jwtToken = jwt.sign(decodedToken, dbCryptoKey);
+      currentToken.setDataValue('appKey', jwtToken);
+      await currentToken.save();
+    }
+  },
+};

package/models/userappkey.js

@@ -1,6 +1,7 @@
 const jwt = require('jsonwebtoken');
 const Sequelize = require('sequelize');
 const { omit, pathOr } = require('ramda');
+const { encrypt, decrypt } = require('../lib/security');
 const db = require('./db');
 
 const { env: { dbCryptoKey } } = process;
@@ -37,12 +38,12 @@ const UserAppKey = db.define('UserAppKey', {
     type: Sequelize.TEXT,
     allowNull: false,
     set: function setter(value, field) {
-      const newValue = jwt.sign(value, dbCryptoKey);
-      this.setDataValue(field, newValue);
-    },
-    get: function getter(field) {
-      const retValue = jwt.verify(this.getDataValue(field), dbCryptoKey);
-      return omit(['iat'], retValue);
+      if (typeof value === 'object') {
+        const newValue = encrypt(JSON.stringify(value));
+        this.setDataValue(field, newValue);
+      } else {
+        this.setDataValue(field, encrypt(value));
+      }
     },
   },
   token: {
@@ -52,7 +53,11 @@ const UserAppKey = db.define('UserAppKey', {
       const userIntegrationSettings = await sqldb.UserIntegrationSettings.findOne({
         where: { userId: this.getDataValue('userId'), integrationId: this.getDataValue('integrationId') },
       });
-      return { ...pathOr({}, ['settings'], userIntegrationSettings), ...this.appKey };
+      const appKey = JSON.parse(decrypt(this.getDataValue('appKey')));
+      return {
+        ...pathOr({}, ['settings'], userIntegrationSettings),
+        ...appKey,
+      };
     },
   },
 }, {});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ti2",
-  "version": "1.0.41",
+  "version": "1.0.43",
   "description": "Tourist Industry Exchange (TI2)",
   "main": "index.js",
   "scripts": {