#252645667

Committed 15 Nov 2023 10:40PM UTC coverage: 71.09% (-1.2%) from 72.267%

Build Type

Committed by

Commit Message

from 7 issues

Pull Request Pull Request #456: staging version 1.9.2491

Run Details

1758 of 3422 branches covered (0.0%)

Branch coverage included in aggregate %.

124 of 258 new or added lines in 18 files covered. (48.06%)

52 existing lines in 13 files now uncovered.

8088 of 10428 relevant lines covered (77.56%)

27.99 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

55.14

/lib/router.js

/* New Router */

module.exports = function (app) {

  const Globals = require("./thinx/globals");
  const app_config = Globals.app_config(); // for a device client_user_agent check

  const Sanitka = require("./thinx/sanitka"); var sanitka = new Sanitka();
  const Util = require("./thinx/util");

  const APIKey = require("../lib/thinx/apikey");
  let apikey = new APIKey(app.redis_client);

  //
  // Middleware-like Validation
  //

  function logAccess(req) {
    // log owner ID and request method to application log only
    if ((typeof (req.session) !== "undefined") && (typeof (req.session.owner) !== "undefined")) {
      if (req.method !== "OPTIONS") {
        console.log("[OID:0] [" + req.method + "]:" + req.url + "(" + req.get("User-Agent") + ")");
      }
    }
  }

  function enforceACLHeaders(res, req) {

    // cannot use this with allow origin * res.header("Access-Control-Allow-Credentials", "true");
    // analysis: will PROBABLY have to be refactored to anything but Device-Registration and Devoce-OTA requests
    if ((req.originalUrl.indexOf("register") !== -1) ||
      (req.originalUrl.indexOf("firmware") !== -1)) {
      return;
      // no ACL/CORS for device requests
    } else {
      res.header("Access-Control-Allow-Credentials", "true"); // should be allowed for device as well
    }

    // deepcode ignore TooPermissiveCorsHeader: this must be callable from anywhere
    res.header("Access-Control-Allow-Origin", "*"); // lgtm [js/cors-misconfiguration-for-credentials]
    res.header("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE,OPTIONS");
    res.header("Access-Control-Allow-Headers", "Content-type,Accept,X-Access-Token,X-Key");
  }

  // Functions

  const JWTLogin = require("./thinx/jwtlogin");
  app.login = new JWTLogin(app.redis_client);
  app.login.init(() => {
      console.log("ℹ️ [info] JWT Login Secret Init Complete. Login is now possible.");
  });

  app.all("/*", function (req, res, next) {

    //
    // JWT Key Authentication
    //

    // JWT Auth (if there is such header, resst of auth checks is not important)
    if ((typeof (req.headers['authorization']) !== "undefined") || (typeof (req.headers['Authorization']) !== "undefined")) {
      app.login.verify(req, (error, payload) => {
        // for JWT debugging: console.log("🔨 [debug] JWT Secret verification result:", { error }, { payload });
        if (error == null) {
          req.session.owner = payload.username;
          next();
        } else {
          res.status(403).end(); // FIXME: Change to 401 Unauthorized in tests as well!
        }
      });
      return;
    }

    // Cookie or other auth
    var client = req.get("User-Agent");
    if (typeof (req.headers.origin) !== "undefined") {
      if (req.headers.origin === "device") {
        next();
        return;
      }
    }

    enforceACLHeaders(res, req); // this should not be done for device requests (with specific client)

    if (req.method == "OPTIONS") {
      return res.status(200).end();
    }

    try {
      logAccess(req);
    } catch (e) {
      //
    }

    const client_user_agent = app_config.client_user_agent;

    if (client == client_user_agent) {
      if (typeof (req.headers.origin) !== "undefined") {
        if (req.headers.origin == "device") {
          console.log("allowed for device");
          next();
          return;
        } else {
          console.log("not allowed for non-device");
          res.status(401);
          return Util.responder(res, false, "Authentication Faled");
        }
      }
    }

    // Not a device client_user_agent...

    // Applies only to post requests!
    if (req.method == "POST") {
      if (typeof (req.body) !== "undefined") {
        let owner = req.body.owner; // not session!
        if (typeof (owner) !== "undefined") {
          let xowner = req.body.owner; // owner can be undefined here?
          let api_key = req.body.api_key;
          if ((typeof (xowner) !== "undefined") && (xowner !== null) && (typeof (api_key) !== "undefined") && (api_key !== null)) {
            // Using Owner/API Key
            apikey.verify(sanitka.owner(xowner), sanitka.udid(api_key), true, (vsuccess, vmessage) => {
              if (vsuccess) {
                next();
              } else {
                res.status(401);
                Util.responder(res, false, "Authentication Faled");
                console.log("APIKey ", vmessage);
              }
            });
            return;
          }
        }
      }
    }

    // otherwise this request has no authentication and will be passed.

    next();

  });

  /*
   * Health check route
   */

  app.get("/", function (req, res) {
    Util.respond(res, { healthcheck: true });
  });

};

1	/* New Router */
2
3	module.exports = function (app) {	1✔
4
5	const Globals = require("./thinx/globals");	15✔
6	const app_config = Globals.app_config(); // for a device client_user_agent check	15✔
7
8	const Sanitka = require("./thinx/sanitka"); var sanitka = new Sanitka();	15✔
9	const Util = require("./thinx/util");	15✔
10
11	const APIKey = require("../lib/thinx/apikey");	15✔
12	let apikey = new APIKey(app.redis_client);	15✔
13
14	//
15	// Middleware-like Validation
16	//
17
18	function logAccess(req) {
19	// log owner ID and request method to application log only
20	if ((typeof (req.session) !== "undefined") && (typeof (req.session.owner) !== "undefined")) {	149!
UNCOV 21	if (req.method !== "OPTIONS") {	×
22	console.log("[OID:0] [" + req.method + "]:" + req.url + "(" + req.get("User-Agent") + ")");	×
23	}
24	}
25	}
26
27	function enforceACLHeaders(res, req) {
28
29	// cannot use this with allow origin * res.header("Access-Control-Allow-Credentials", "true");
30	// analysis: will PROBABLY have to be refactored to anything but Device-Registration and Devoce-OTA requests
31	if ((req.originalUrl.indexOf("register") !== -1) \|\|	149✔
32	(req.originalUrl.indexOf("firmware") !== -1)) {
33	return;	13✔
34	// no ACL/CORS for device requests
35	} else {
36	res.header("Access-Control-Allow-Credentials", "true"); // should be allowed for device as well	136✔
37	}
38
39	// deepcode ignore TooPermissiveCorsHeader: this must be callable from anywhere
40	res.header("Access-Control-Allow-Origin", "*"); // lgtm [js/cors-misconfiguration-for-credentials]	136✔
41	res.header("Access-Control-Allow-Methods", "GET,PUT,POST,DELETE,OPTIONS");	136✔
42	res.header("Access-Control-Allow-Headers", "Content-type,Accept,X-Access-Token,X-Key");	136✔
43	}
44
45	// Functions
46
47	const JWTLogin = require("./thinx/jwtlogin");	15✔
48	app.login = new JWTLogin(app.redis_client);	15✔
49	app.login.init(() => {	15✔
50	console.log("ℹ️ [info] JWT Login Secret Init Complete. Login is now possible.");	15✔
51	});
52
53	app.all("/*", function (req, res, next) {	15✔
54
55	//
56	// JWT Key Authentication
57	//
58
59	// JWT Auth (if there is such header, resst of auth checks is not important)
60	if ((typeof (req.headers['authorization']) !== "undefined") \|\| (typeof (req.headers['Authorization']) !== "undefined")) {	309✔
61	app.login.verify(req, (error, payload) => {	160✔
62	// for JWT debugging: console.log("🔨 [debug] JWT Secret verification result:", { error }, { payload });
63	if (error == null) {	160!
64	req.session.owner = payload.username;	160✔
65	next();	160✔
66	} else {
67	res.status(403).end(); // FIXME: Change to 401 Unauthorized in tests as well!	×
68	}
69	});
70	return;	160✔
71	}
72
73	// Cookie or other auth
74	var client = req.get("User-Agent");	149✔
75	if (typeof (req.headers.origin) !== "undefined") {	149!
76	if (req.headers.origin === "device") {	×
77	next();	×
78	return;	×
79	}
80	}
81
82	enforceACLHeaders(res, req); // this should not be done for device requests (with specific client)	149✔
83
84	if (req.method == "OPTIONS") {	149!
85	return res.status(200).end();	×
86	}
87
88	try {	149✔
89	logAccess(req);	149✔
90	} catch (e) {
91	//
92	}
93
94	const client_user_agent = app_config.client_user_agent;	149✔
95
96	if (client == client_user_agent) {	149!
97	if (typeof (req.headers.origin) !== "undefined") {	×
98	if (req.headers.origin == "device") {	×
99	console.log("allowed for device");	×
100	next();	×
101	return;	×
102	} else {
103	console.log("not allowed for non-device");	×
104	res.status(401);	×
105	return Util.responder(res, false, "Authentication Faled");	×
106	}
107	}
108	}
109
110	// Not a device client_user_agent...
111
112	// Applies only to post requests!
113	if (req.method == "POST") {	149✔
114	if (typeof (req.body) !== "undefined") {	111!
115	let owner = req.body.owner; // not session!	111✔
116	if (typeof (owner) !== "undefined") {	111!
117	let xowner = req.body.owner; // owner can be undefined here?	×
118	let api_key = req.body.api_key;	×
119	if ((typeof (xowner) !== "undefined") && (xowner !== null) && (typeof (api_key) !== "undefined") && (api_key !== null)) {	×
120	// Using Owner/API Key
121	apikey.verify(sanitka.owner(xowner), sanitka.udid(api_key), true, (vsuccess, vmessage) => {	×
122	if (vsuccess) {	×
123	next();	×
124	} else {
125	res.status(401);	×
126	Util.responder(res, false, "Authentication Faled");	×
127	console.log("APIKey ", vmessage);	×
128	}
129	});
130	return;	×
131	}
132	}
133	}
134	}
135
136	// otherwise this request has no authentication and will be passed.
137
138	next();	149✔
139
140	});
141
142	/*
143	* Health check route
144	*/
145
146	app.get("/", function (req, res) {	15✔
147	Util.respond(res, { healthcheck: true });	1✔
148	});
149
150	};

suculent / thinx-device-api / #252645667

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous