11215720268

Committed 07 Oct 2024 12:40PM UTC coverage: 80.109% (-2.7%) from 82.787%

Build # 11215720268

Build Type

Pull #544

github

Committed by

web-flow

Commit Message

Merge 80f368b23 into 2c45e28dd

Pull Request Pull Request #544: [WIP] Task/add access match

Run Details

266 of 369 branches covered (72.09%)

Branch coverage included in aggregate %.

16 of 43 new or added lines in 4 files covered. (37.21%)

24 existing lines in 2 files now uncovered.

761 of 913 relevant lines covered (83.35%)

50.75 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

61.05

/lib/middleware/proxy.js

/*
 * Copyright 2014 Telefonica Investigación y Desarrollo, S.A.U
 *
 * This file is part of fiware-pep-steelskin
 *
 * fiware-pep-steelskin is free software: you can redistribute it and/or
 * modify it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the License,
 * or (at your option) any later version.
 *
 * fiware-pep-steelskin is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public
 * License along with fiware-pep-steelskin.
 * If not, seehttp://www.gnu.org/licenses/.
 *
 * For those usages not covered by the GNU Affero General Public License
 * please contact with::[iot_support@tid.es]
 */

'use strict';

var config = require('../../config'),
    errors = require('../errors'),
    request = require('request'),
    constants = require('../constants'),
    validationHeaders = [
        'fiware-service',
        'fiware-servicepath',
        'x-auth-token'
    ],
    authorizationHeaders = [
        'x-auth-token'
    ],
    winston = require('winston'),
    logger = require('logops'),
    configAccessMatch = require('../../configAccessMatch.js').configAccessMatch,
    accessLogger;

const fs = require('fs');
const configAccessMatchFilePath = './configAccessMatch.js';

function requireUncached(module) {
    delete require.cache[require.resolve(module)];
    return require(module);
}

function watchConfigAccessMatchFile() {
    fs.watch(configAccessMatchFilePath, (event, filename) => {
        logger.info('watchConfigAccessMatchFile changed by %s detected in file %s', event, filename);
        try {
            configAccessMatch = requireUncached('../../configAccessMatch.js').configAccessMatch;
            logger.debug('reloaded configAccessMatch %j', configAccessMatch);
        } catch (err) {
            logger.error('Error %s reloading module: %s ', err, filename);
        }
    });
}

/**
 * Middleware to extract the organization data from the request.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Call to the next middleware in the chain.
 */
function extractOrganization(req, res, next) {
    const logger = req.logger;
    if (req.headers[constants.ORGANIZATION_HEADER]) {
        req.organization = req.headers[constants.ORGANIZATION_HEADER];
        req.service = req.headers[constants.ORGANIZATION_HEADER];
        req.subService = req.headers[constants.PATH_HEADER];
        next();
    } else {
        logger.error('[PROXY-GEN-001] Organization headers not found');
        next(new errors.OrganizationNotFound());
    }
}

/**
 * Middleware to extract the user data (usually a token) from the request.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Call to the next middleware in the chain.
 */
function extractUserId(req, res, next) {
    const logger = req.logger;
    if (req.headers[constants.AUTHORIZATION_HEADER]) {
        req.userId = req.headers[constants.AUTHORIZATION_HEADER];
        next();
    } else {
        logger.error('[PROXY-GEN-002] User ID headers not found');
        next(new errors.UserNotFound());
    }
}

/**
 * Generates the FRN to identify the target resource of the request. The FRN is composed of information from the
 * service and subservice headers and some configuration information.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function generateFRN(req, res, next) {
    const logger = req.logger;
    var frn = config.resourceNamePrefix + config.componentName + ':';

    if (req.organization) {
        frn += req.organization + ':';
    } else {
        frn += ':';
    }

    if (req.headers[constants.PATH_HEADER]) {
        frn += req.headers[constants.PATH_HEADER] + ':';
    } else {
        frn += ':';
    }

    if (req.resourceUrl) {
        frn += req.resourceUrl + ':';
    } else {
        frn += ':';
    }

    if (req.entityType) {
        frn += req.entityType;
    } else {
        frn += ':';
    }
    logger.debug('Generated FRN: ', frn);
    req.frn = frn;

    next();
}

/**
 * Redirects the incoming request to the proxied host.
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function sendRequest(req, res, next) {
    const logger = req.logger;
    var options = {
        uri: 'http://' + config.resource.original.host + ':' + config.resource.original.port + req.path,
        qs: req.query,
        method: req.method,
        headers: req.headers
    };

    if (!options.headers[constants.X_FORWARDED_FOR_HEADER] && req.connection.remoteAddress) {
        options.headers[constants.X_FORWARDED_FOR_HEADER] = req.connection.remoteAddress;
    }
    if (!options.headers[constants.CORRELATOR_HEADER] && req.corr) {
        options.headers[constants.CORRELATOR_HEADER] = req.corr;
    }

    if (req.is('*/json')) {
        options.body = JSON.stringify(req.body);
    } else {
        options.body = req.rawBody;
    }

    delete options.headers['content-length'];
    options.headers.connection = 'close';

    res.oldWriteHead = res.writeHead;
    res.writeHead = function(statusCode, reasonPhrase, headers) {
        if (res._headers['transfer-encoding']) {
            delete res._headers['transfer-encoding'];
        }

        res.oldWriteHead(statusCode, reasonPhrase, headers);
    };

    logger.debug('Forwarding request:\n\n%j\n', options);

    req.fwdResponse = request(options).on('error', function handleConnectionError(e) {
        logger.error('Error forwarding the request to target proxy: %s', e.message);

        if (config.dieOnRedirectError) {
            logger.fatal('[PROXY-FATAL-001] Configured to die upon error in a redirection. Stopping process.');

            process.exit(-1);
        } else {
            next(new errors.TargetServerError(e.message));
        }
    });
    next();
}

/**
 * Account Log
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function accountInfo(req, res, next) {
    if ('fwdResponse' in req) {
        if (!accessLogger) {
            accessLogger = new winston.Logger({
                level: 'info',
                transports: [
                    new(winston.transports.File)({
                        filename: config.access.accountFile
                    })
                ]
            });
        }
        req.fwdResponse = req.fwdResponse.on('response', function(res) {
            var accessMsg = 'Right Attempt';

            // CHeck here MATCH file patterns:
            if (req.userName in configAccessMatch.users ) {
                accessMsg += ' MATCHED USER';
            }
            for (var header of configAccessMatch.headers) {
                if ('fiware-service' in Object.keys(header)) {
                    if (req.service.includes(header['fiware-service'])) {
                        accessMsg += ' MATCHED HEADER Service';
                    }
                } else if ('fiware-servicepath' in Object.keys(header)) {
                    if (req.subService.includes(header['fiware-servicepath'])) {
                        accessMsg += ' MATCHED HEADER SubService';
                    }
                } else if ('x-real-ip' in Object.keys(header)) {
                    if (req.connection.remoteAddress.includes(header['x-real-ip'])) {
                        accessMsg += ' MATCHED HEADER Origin';
                    }
                }
            }
            for (var subpath of configAccessMatch.subpaths) {
                if (req.path.includes(subpath)) {
                    accessMsg += ' MATCHED SUBPATH ' + subpath;
                }
            }
            for (var text of configAccessMatch.body) {
                if (JSON.stringify(req.body).includes(text)) {
                    accessMsg += ' MATCHED BODY ' + text;
                }
            }

            accessLogger.info(accessMsg +
                              ' | ResponseStatus=' + req.fwdResponse.response.statusCode +
                              ' | Token=' + req.headers['x-auth-token'] +
                              ' | Origin=' + req.connection.remoteAddress +
                              ' | UserId=' + req.userId +
                              ' | UserName=' + req.userName +
                              ' | ServiceId=' + req.serviceId +
                              ' | Service=' + req.service +
                              ' | SubServiceId=' + req.subserviceId +
                              ' | SubService=' + req.subService +
                              ' | Action=' + req.action +
                              ' | Path=' + req.path +
                              ' | Body=' + JSON.stringify(req.body).slice(0, 100) + // not all body
                              ' | Date=' + new Date().toJSON());
        });
    }
    next();
}

/**
 * Invoque request and get response. The request is not read with a pipe, as it has been completely
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function sendResponse(req, res, next) {
    req.fwdResponse.pipe(res);
}

/**
 * Generates a middleware that checks for the pressence of the mandatory headers passed as a parameter, returning a
 * MISSING_HEADERS error if any one is not found.
 *
 * @param {Array} mandatoryHeaders      List of headers to check.
 * @return {Function}                  An express middleware that checks for the presence of the headers.
 */
function checkMandatoryHeaders(mandatoryHeaders) {
    return function(req, res, next) {
        var missing = [];

        for (var i = 0; i < mandatoryHeaders.length; i++) {
            if (!req.headers[mandatoryHeaders[i]] || req.headers[mandatoryHeaders[i]].trim() === '') {
                missing.push(mandatoryHeaders[i]);
            }
        }

        if (missing.length !== 0) {
            next(new errors.MissingHeaders(JSON.stringify(missing)));
        } else {
            next();
        }
    };
}

exports.generateFRN = generateFRN;
exports.extractUserId = extractUserId;
exports.extractOrganization = extractOrganization;
exports.sendRequest = sendRequest;
exports.sendResponse = sendResponse;
exports.accountInfo = accountInfo;
exports.checkMandatoryHeaders = checkMandatoryHeaders(validationHeaders);
exports.checkAuthorizationHeader = checkMandatoryHeaders(authorizationHeaders);
exports.watchConfigAccessMatchFile = watchConfigAccessMatchFile;

1	/*
2	* Copyright 2014 Telefonica Investigación y Desarrollo, S.A.U
3	*
4	* This file is part of fiware-pep-steelskin
5	*
6	* fiware-pep-steelskin is free software: you can redistribute it and/or
7	* modify it under the terms of the GNU Affero General Public License as
8	* published by the Free Software Foundation, either version 3 of the License,
9	* or (at your option) any later version.
10	*
11	* fiware-pep-steelskin is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14	* See the GNU Affero General Public License for more details.
15	*
16	* You should have received a copy of the GNU Affero General Public
17	* License along with fiware-pep-steelskin.
18	* If not, seehttp://www.gnu.org/licenses/.
19	*
20	* For those usages not covered by the GNU Affero General Public License
21	* please contact with::[iot_support@tid.es]
22	*/
23
24	'use strict';
25
26	var config = require('../../config'),	1✔
27	errors = require('../errors'),
28	request = require('request'),
29	constants = require('../constants'),
30	validationHeaders = [
31	'fiware-service',
32	'fiware-servicepath',
33	'x-auth-token'
34	],
35	authorizationHeaders = [
36	'x-auth-token'
37	],
38	winston = require('winston'),
39	logger = require('logops'),
40	configAccessMatch = require('../../configAccessMatch.js').configAccessMatch,
41	accessLogger;
42
43	const fs = require('fs');	1✔
44	const configAccessMatchFilePath = './configAccessMatch.js';	1✔
45
46	function requireUncached(module) {	1✔
NEW 47	delete require.cache[require.resolve(module)];	×
NEW 48	return require(module);	×
49	}
50
51	function watchConfigAccessMatchFile() {	1✔
52	fs.watch(configAccessMatchFilePath, (event, filename) => {	143✔
NEW 53	logger.info('watchConfigAccessMatchFile changed by %s detected in file %s', event, filename);	×
NEW 54	try {	×
NEW 55	configAccessMatch = requireUncached('../../configAccessMatch.js').configAccessMatch;	×
NEW 56	logger.debug('reloaded configAccessMatch %j', configAccessMatch);	×
57	} catch (err) {
NEW 58	logger.error('Error %s reloading module: %s ', err, filename);	×
59	}
60	});
61	}
62
63	/**
64	* Middleware to extract the organization data from the request.
65	*
66	* @param {Object} req Incoming request.
67	* @param {Object} res Outgoing response.
68	* @param {Function} next Call to the next middleware in the chain.
69	*/
70	function extractOrganization(req, res, next) {	1✔
71	const logger = req.logger;	152✔
72	if (req.headers[constants.ORGANIZATION_HEADER]) {	152!
73	req.organization = req.headers[constants.ORGANIZATION_HEADER];	152✔
74	req.service = req.headers[constants.ORGANIZATION_HEADER];	152✔
75	req.subService = req.headers[constants.PATH_HEADER];	152✔
76	next();	152✔
77	} else {
78	logger.error('[PROXY-GEN-001] Organization headers not found');	×
79	next(new errors.OrganizationNotFound());	×
80	}
81	}
82
83	/**
84	* Middleware to extract the user data (usually a token) from the request.
85	*
86	* @param {Object} req Incoming request.
87	* @param {Object} res Outgoing response.
88	* @param {Function} next Call to the next middleware in the chain.
89	*/
90	function extractUserId(req, res, next) {	1✔
91	const logger = req.logger;	152✔
92	if (req.headers[constants.AUTHORIZATION_HEADER]) {	152!
93	req.userId = req.headers[constants.AUTHORIZATION_HEADER];	152✔
94	next();	152✔
95	} else {
96	logger.error('[PROXY-GEN-002] User ID headers not found');	×
97	next(new errors.UserNotFound());	×
98	}
99	}
100
101	/**
102	* Generates the FRN to identify the target resource of the request. The FRN is composed of information from the
103	* service and subservice headers and some configuration information.
104	*
105	* @param {Object} req Incoming request.
106	* @param {Object} res Outgoing response.
107	* @param {Function} next Invokes the next middleware in the chain.
108	*/
109	function generateFRN(req, res, next) {	1✔
110	const logger = req.logger;	153✔
111	var frn = config.resourceNamePrefix + config.componentName + ':';	153✔
112
113	if (req.organization) {	153✔
114	frn += req.organization + ':';	151✔
115	} else {
116	frn += ':';	2✔
117	}
118
119	if (req.headers[constants.PATH_HEADER]) {	153✔
120	frn += req.headers[constants.PATH_HEADER] + ':';	152✔
121	} else {
122	frn += ':';	1✔
123	}
124
125	if (req.resourceUrl) {	153✔
126	frn += req.resourceUrl + ':';	14✔
127	} else {
128	frn += ':';	139✔
129	}
130
131	if (req.entityType) {	153!
132	frn += req.entityType;	×
133	} else {
134	frn += ':';	153✔
135	}
136	logger.debug('Generated FRN: ', frn);	153✔
137	req.frn = frn;	153✔
138
139	next();	153✔
140	}
141
142	/**
143	* Redirects the incoming request to the proxied host.
144	* read to guess its type.
145	*
146	* @param {Object} req Incoming request.
147	* @param {Object} res Outgoing response.
148	* @param {Function} next Invokes the next middleware in the chain.
149	*/
150	function sendRequest(req, res, next) {	1✔
151	const logger = req.logger;	78✔
152	var options = {	78✔
153	uri: 'http://' + config.resource.original.host + ':' + config.resource.original.port + req.path,
154	qs: req.query,
155	method: req.method,
156	headers: req.headers
157	};
158
159	if (!options.headers[constants.X_FORWARDED_FOR_HEADER] && req.connection.remoteAddress) {	78✔
160	options.headers[constants.X_FORWARDED_FOR_HEADER] = req.connection.remoteAddress;	75✔
161	}
162	if (!options.headers[constants.CORRELATOR_HEADER] && req.corr) {	78✔
163	options.headers[constants.CORRELATOR_HEADER] = req.corr;	5✔
164	}
165
166	if (req.is('*/json')) {	78✔
167	options.body = JSON.stringify(req.body);	77✔
168	} else {
169	options.body = req.rawBody;	1✔
170	}
171
172	delete options.headers['content-length'];	78✔
173	options.headers.connection = 'close';	78✔
174
175	res.oldWriteHead = res.writeHead;	78✔
176	res.writeHead = function(statusCode, reasonPhrase, headers) {	78✔
177	if (res._headers['transfer-encoding']) {	78!
178	delete res._headers['transfer-encoding'];	×
179	}
180
181	res.oldWriteHead(statusCode, reasonPhrase, headers);	78✔
182	};
183
184	logger.debug('Forwarding request:\n\n%j\n', options);	78✔
185
186	req.fwdResponse = request(options).on('error', function handleConnectionError(e) {	78✔
187	logger.error('Error forwarding the request to target proxy: %s', e.message);	1✔
188
189	if (config.dieOnRedirectError) {	1!
190	logger.fatal('[PROXY-FATAL-001] Configured to die upon error in a redirection. Stopping process.');	×
191
192	process.exit(-1);	×
193	} else {
194	next(new errors.TargetServerError(e.message));	1✔
195	}
196	});
197	next();	78✔
198	}
199
200	/**
201	* Account Log
202	* read to guess its type.
203	*
204	* @param {Object} req Incoming request.
205	* @param {Object} res Outgoing response.
206	* @param {Function} next Invokes the next middleware in the chain.
207	*/
208	function accountInfo(req, res, next) {	1✔
209	if ('fwdResponse' in req) {	×
210	if (!accessLogger) {	×
211	accessLogger = new winston.Logger({	×
212	level: 'info',
213	transports: [
214	new(winston.transports.File)({
215	filename: config.access.accountFile
216	})
217	]
218	});
219	}
220	req.fwdResponse = req.fwdResponse.on('response', function(res) {	×
NEW 221	var accessMsg = 'Right Attempt';	×
222
223	// CHeck here MATCH file patterns:
NEW 224	if (req.userName in configAccessMatch.users ) {	×
NEW 225	accessMsg += ' MATCHED USER';	×
226	}
NEW 227	for (var header of configAccessMatch.headers) {	×
NEW 228	if ('fiware-service' in Object.keys(header)) {	×
NEW 229	if (req.service.includes(header['fiware-service'])) {	×
NEW 230	accessMsg += ' MATCHED HEADER Service';	×
231	}
NEW 232	} else if ('fiware-servicepath' in Object.keys(header)) {	×
NEW 233	if (req.subService.includes(header['fiware-servicepath'])) {	×
NEW 234	accessMsg += ' MATCHED HEADER SubService';	×
235	}
NEW 236	} else if ('x-real-ip' in Object.keys(header)) {	×
NEW 237	if (req.connection.remoteAddress.includes(header['x-real-ip'])) {	×
NEW UNCOV 238	accessMsg += ' MATCHED HEADER Origin';	×
239	}
240	}
241	}
NEW UNCOV 242	for (var subpath of configAccessMatch.subpaths) {	×
NEW UNCOV 243	if (req.path.includes(subpath)) {	×
NEW UNCOV 244	accessMsg += ' MATCHED SUBPATH ' + subpath;	×
245	}
246	}
NEW 247	for (var text of configAccessMatch.body) {	×
NEW 248	if (JSON.stringify(req.body).includes(text)) {	×
NEW 249	accessMsg += ' MATCHED BODY ' + text;	×
250	}
251	}
252
NEW 253	accessLogger.info(accessMsg +	×
254	' \| ResponseStatus=' + req.fwdResponse.response.statusCode +
255	' \| Token=' + req.headers['x-auth-token'] +
256	' \| Origin=' + req.connection.remoteAddress +
257	' \| UserId=' + req.userId +
258	' \| UserName=' + req.userName +
259	' \| ServiceId=' + req.serviceId +
260	' \| Service=' + req.service +
261	' \| SubServiceId=' + req.subserviceId +
262	' \| SubService=' + req.subService +
263	' \| Action=' + req.action +
264	' \| Path=' + req.path +
265	' \| Body=' + JSON.stringify(req.body).slice(0, 100) + // not all body
266	' \| Date=' + new Date().toJSON());
267	});
268	}
269	next();	×
270	}
271
272	/**
273	* Invoque request and get response. The request is not read with a pipe, as it has been completely
274	* read to guess its type.
275	*
276	* @param {Object} req Incoming request.
277	* @param {Object} res Outgoing response.
278	* @param {Function} next Invokes the next middleware in the chain.
279	*/
280	function sendResponse(req, res, next) {	1✔
281	req.fwdResponse.pipe(res);	78✔
282	}
283
284	/**
285	* Generates a middleware that checks for the pressence of the mandatory headers passed as a parameter, returning a
286	* MISSING_HEADERS error if any one is not found.
287	*
288	* @param {Array} mandatoryHeaders List of headers to check.
289	* @return {Function} An express middleware that checks for the presence of the headers.
290	*/
291	function checkMandatoryHeaders(mandatoryHeaders) {	1✔
292	return function(req, res, next) {	2✔
293	var missing = [];	165✔
294
295	for (var i = 0; i < mandatoryHeaders.length; i++) {	165✔
296	if (!req.headers[mandatoryHeaders[i]] \|\| req.headers[mandatoryHeaders[i]].trim() === '') {	489✔
297	missing.push(mandatoryHeaders[i]);	15✔
298	}
299	}
300
301	if (missing.length !== 0) {	165✔
302	next(new errors.MissingHeaders(JSON.stringify(missing)));	11✔
303	} else {
304	next();	154✔
305	}
306	};
307	}
308
309	exports.generateFRN = generateFRN;	1✔
310	exports.extractUserId = extractUserId;	1✔
311	exports.extractOrganization = extractOrganization;	1✔
312	exports.sendRequest = sendRequest;	1✔
313	exports.sendResponse = sendResponse;	1✔
314	exports.accountInfo = accountInfo;	1✔
315	exports.checkMandatoryHeaders = checkMandatoryHeaders(validationHeaders);	1✔
316	exports.checkAuthorizationHeader = checkMandatoryHeaders(authorizationHeaders);	1✔
317	exports.watchConfigAccessMatchFile = watchConfigAccessMatchFile;	1✔

telefonicaid / fiware-pep-steelskin / 11215720268

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous