zsyp 0.0.2 → 1.1.0

package/Readme.md

@@ -1,38 +1,81 @@
 [![NPM version][npm-image]][npm-url]
-[![Build Status][travis-image]][travis-url]
+[![Build Status][build-image]][build-url]
 [![Dependency Status][deps-image]][deps-url]
-[![Dev Dependency Status][deps-dev-image]][deps-dev-url]
 
 # zsyp
 
-CSP violation reports logger.
+[CSP] violation reports logger. Zsyp is a simple standalone web service that parses CPS violation reports
+and stores them in MongoDB collection.
 
 ## Install
 
 ```sh
-$ npm install --save zsyp
+npm install --global zsyp
 ```
 
-## Usage
+## Environment
 
-```js
-var zsyp = require('zsyp');
+Zsyp is using [dotenv] and by default reads its environment from `/etc/default/zsyp`
 
-zsyp('Rainbow');
+- `ZSYP_PORT` - port number on which, defaults to 3090
+- `ZSYP_DB` - [mongo URI] connection string, defaults to `mongodb://localhost/zsyp`
+- `ZSYP_DOMAINS` - domain name or a regular expression used to filter CSP violation reports - can be left empty in which case all reports for all domains are logged
+
+## Report format
+
+```json5
+{
+  "from": {
+    "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS...",   // User-Agent string
+    "browser": {                                       // browser brand and version
+      "name": "Safari", 
+      "version": "13"
+    },
+    "os": {                                            // operating system info
+      "name": "Mac OS X",
+      "version": "10"
+    },
+    "ip": "1.2.3.4"                                    // originator IP address 
+  },
+  "csp-report": {                                      // original CSP report
+    "document-uri": "https://example.com/page",
+    "referrer": "https://example.com/",
+    "violated-directive": "...",
+    "effective-directive": "...",
+    "original-policy": "...",
+    "blocked-uri": "",
+    "status-code": 0,
+    "source-file": "..."
+  }
+}
 ```
 
+
+## Logger
+
+Reports are stored in `csp` collection. If you want to use [capped collection] create it
+manually before running zsyp.
+
+```javascript
+db.createCollection( "csp", { capped: true, size: 100000 } );
+```
+
+
 ## License
 
 MIT © [Damian Krzeminski](https://pirxpilot.me)
 
-[npm-image]: https://img.shields.io/npm/v/zsyp.svg
-[npm-url]: https://npmjs.org/package/zsyp
 
-[travis-url]: https://travis-ci.org/pirxpilot/zsyp
-[travis-image]: https://img.shields.io/travis/pirxpilot/zsyp.svg
+[CSP]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+[mongo URI]: https://docs.mongodb.com/manual/reference/connection-string
+[capped collection]: https://docs.mongodb.com/manual/core/capped-collections/
+[dotenv]: https://www.npmjs.com/package/dotenv
+
+[npm-image]: https://img.shields.io/npm/v/zsyp
+[npm-url]: https://npmjs.org/package/zsyp
 
-[deps-image]: https://img.shields.io/david/pirxpilot/zsyp.svg
-[deps-url]: https://david-dm.org/pirxpilot/zsyp
+[build-url]: https://github.com/pirxpilot/zsyp/actions/workflows/check.yaml
+[build-image]: https://img.shields.io/github/workflow/status/pirxpilot/zsyp/check
 
-[deps-dev-image]: https://img.shields.io/david/dev/pirxpilot/zsyp.svg
-[deps-dev-url]: https://david-dm.org/pirxpilot/zsyp?type=dev
+[deps-image]: https://img.shields.io/librariesio/release/npm/zsyp
+[deps-url]: https://libraries.io/npm/zsyp

package/index.js

@@ -1,24 +1,15 @@
 require('dotenv').config({ path: '/etc/default/zsyp' });
 
-const connect = require('@pirxpilot/connect');
-const router = require('./lib/csp');
-const makeLogger = require('./lib/logger');
+const logger = require('./lib/logger');
+const makeApp = require('./lib/app');
 
 const {
   ZSYP_PORT: PORT = 3090,
-  ZSYP_DOMAINS: domains,
-  ZSYP_DB: database = 'mongodb://localhost/zsyp'
 } = process.env;
 
-const app = connect();
-const log = makeLogger({ database });
-
-app.use(function (req, res, next) {
-  req.log = log;
-  next();
+const app = makeApp({
+  logger
 });
-app.use(router({ domains }));
-
 
 module.exports = app;
 

package/lib/app.js

@@ -0,0 +1,21 @@
+const connect = require('@pirxpilot/connect');
+const { json } = require('body-parser');
+const router = require('./router');
+
+module.exports = makeApp;
+
+const {
+  ZSYP_DOMAINS: domains,
+} = process.env;
+
+
+function makeApp(opts) {
+  const app = connect();
+
+  app.use(json({ limit: 5000, type: ['*/json', 'application/csp-report'] }));
+  app.use('/csp', router({ ...opts, name: 'csp', domains }));
+  app.use('/event', router({ ...opts, name: 'event' }));
+
+  return app;
+}
+

package/lib/filter.js

@@ -4,18 +4,17 @@ module.exports = makeFilter;
 
 function makeFilter({ domains }) {
 
-  const domainRe = domains && new RegExp(domains);
+  if (!domains) {
+    return;
+  }
 
+  const domainRe = domains && new RegExp(domains);
   return filter;
 
   function filter({ body: csp }, res, next) {
-    if (!domainRe) {
-      return next();
-    }
     const uri = csp['csp-report']['document-uri'];
     const { hostname } = new URL(uri);
     if (domainRe.test(hostname)) {
-      console.log('OK!!!!!!!!');
       return next();
     }
   }

package/lib/from.js

@@ -3,7 +3,8 @@ const { parse } = require('useragent');
 module.exports = from;
 
 function from(req, res, next) {
-  const ua = req.headers['user-agent'];
+  const { headers, body } = req;
+  const ua = body?.from?.ua ??  headers['user-agent'];
   const {
     family,
     major,
@@ -20,7 +21,7 @@ function from(req, res, next) {
       name: os.family,
       version: os.major
     },
-    ip: req.headers['x-forwarded-for'] || req.connection.remoteAddress
+    ip: body?.from?.ip ?? headers['x-forwarded-for'] ?? req.connection.remoteAddress
   };
   if (device.family !== 'Other') {
     data.device = device.family;

package/lib/logger.js

@@ -1,16 +1,23 @@
-const { db } = require('mniam');
+const mniam = require('mniam');
 const debug = require('debug')('zsyp:logger');
 
 module.exports = makeLogger;
 
-function makeLogger({ database }) {
-  const csp = db(database).collection({ name: 'csp'});
+const {
+  ZSYP_DB: database = 'mongodb://localhost/zsyp'
+} = process.env;
+
+
+const db = mniam.db(database);
+
+function makeLogger({ name }) {
+  const collection = db.collection({ name });
 
   return log;
 
   function log(report) {
     debug('saving %j', report);
-    csp.insertOne(report, function(err) {
+    collection.insertOne(report, function(err) {
       if (err) {
         console.error(err);
       }

package/lib/router.js

@@ -0,0 +1,44 @@
+const Router = require('router');
+const debug = require('debug')('zsyp:router');
+
+const from = require('./from');
+const makeFilter = require('./filter');
+
+function respond(req, res, next) {
+  res.statusCode = 204; // empty
+  res.end();
+  next();
+}
+
+module.exports = function (opts) {
+  const router = new Router({
+    strict: true,
+    caseSensitive: true
+  });
+
+  const stack = [
+    from,
+    respond
+  ];
+
+  const filter = makeFilter(opts);
+  if (filter) {
+    stack.push(filter);
+  }
+
+  const logger = opts.logger(opts);
+
+  router.post('/', ...stack, log);
+
+  return router;
+
+  function log({ from, body }) {
+    const report = {
+      ...body,
+      from
+    };
+
+    debug('Logging report %j', report);
+    logger(report);
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zsyp",
-  "version": "0.0.2",
+  "version": "1.1.0",
   "description": "CSP violation reports logger.",
   "author": {
     "name": "Damian Krzeminski",
@@ -19,14 +19,15 @@
     "@pirxpilot/connect": "^4.0.0",
     "body-parser": "~1",
     "debug": "~2 || ~3 || ~4",
-    "dotenv": "~8",
+    "dotenv": "~16",
     "mniam": "^2.1.0",
     "router": "~1",
+    "supertest": "~6",
     "useragent": "^2.3.0"
   },
   "devDependencies": {
     "jshint": "~2",
-    "tape": "~4"
+    "tape": "~5"
   },
   "scripts": {
     "test": "make check"

package/History.md

@@ -1,10 +0,0 @@
-
-0.0.2 / 2019-07-17
-==================
-
- * fix reports domain filtering
-
-0.0.1 / 2019-07-15
-==================
-
- * basic implementation: UA parsing, domain filtering, mongo backend

package/lib/csp.js

@@ -1,36 +0,0 @@
-const Router = require('router');
-const { json } = require('body-parser');
-
-const from = require('./from');
-const makeFilter = require('./filter');
-
-function respond(req, res, next) {
-  res.statusCode = 204; // empty
-  res.end();
-  next();
-}
-
-
-function log({ from, body: csp, log }) {
-  const report = {
-    from,
-    ...csp
-  };
-
-  log(report);
-}
-
-module.exports = function (opts) {
-  const router = new Router();
-  const filter = makeFilter(opts);
-
-  router.post('/csp',
-    from,
-    json({ limit: 5000, type: [ '*/json', 'application/csp-report' ] }),
-    respond,
-    filter,
-    log
-  );
-
-  return router;
-};