11270646274

Committed 10 Oct 2024 08:50AM UTC coverage: 79.537% (-3.3%) from 82.787%

Build # 11270646274

Build Type

Pull #544

github

Committed by

web-flow

Commit Message

Merge 4a0db45c8 into 2c45e28dd

Pull Request Pull Request #544: Task/add access matches (about users, headers, path. .. ) to access Logger

Run Details

266 of 374 branches covered (71.12%)

Branch coverage included in aggregate %.

19 of 52 new or added lines in 4 files covered. (36.54%)

20 existing lines in 2 files now uncovered.

764 of 921 relevant lines covered (82.95%)

50.31 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

59.44

/lib/middleware/proxy.js

/*
 * Copyright 2014 Telefonica Investigación y Desarrollo, S.A.U
 *
 * This file is part of fiware-pep-steelskin
 *
 * fiware-pep-steelskin is free software: you can redistribute it and/or
 * modify it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the License,
 * or (at your option) any later version.
 *
 * fiware-pep-steelskin is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public
 * License along with fiware-pep-steelskin.
 * If not, seehttp://www.gnu.org/licenses/.
 *
 * For those usages not covered by the GNU Affero General Public License
 * please contact with::[iot_support@tid.es]
 */

'use strict';

var config = require('../../config'),
    errors = require('../errors'),
    request = require('request'),
    constants = require('../constants'),
    validationHeaders = [
        'fiware-service',
        'fiware-servicepath',
        'x-auth-token'
    ],
    authorizationHeaders = [
        'x-auth-token'
    ],
    winston = require('winston'),
    logger = require('logops'),
    configAccessMatch = require('../../configAccessMatch.js').configAccessMatch,
    accessLogger;

const fs = require('fs');
const configAccessMatchFilePath = './configAccessMatch.js';

function requireUncached(module) {
    delete require.cache[require.resolve(module)];
    return require(module);
}

function watchConfigAccessMatchFile() {
    fs.watch(configAccessMatchFilePath, (event, filename) => {
        logger.info('watchConfigAccessMatchFile changed by %s detected in file %s', event, filename);
        try {
            configAccessMatch = requireUncached('../../configAccessMatch.js').configAccessMatch;
            logger.debug('reloaded configAccessMatch %j', configAccessMatch);
        } catch (err) {
            logger.error('Error %s reloading module: %s ', err, filename);
        }
    });
}

/**
 * Middleware to extract the organization data from the request.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Call to the next middleware in the chain.
 */
function extractOrganization(req, res, next) {
    const logger = req.logger;
    if (req.headers[constants.ORGANIZATION_HEADER]) {
        req.organization = req.headers[constants.ORGANIZATION_HEADER];
        req.service = req.headers[constants.ORGANIZATION_HEADER];
        req.subService = req.headers[constants.PATH_HEADER];
        next();
    } else {
        logger.error('[PROXY-GEN-001] Organization headers not found');
        next(new errors.OrganizationNotFound());
    }
}

/**
 * Middleware to extract the user data (usually a token) from the request.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Call to the next middleware in the chain.
 */
function extractUserId(req, res, next) {
    const logger = req.logger;
    if (req.headers[constants.AUTHORIZATION_HEADER]) {
        req.userId = req.headers[constants.AUTHORIZATION_HEADER];
        next();
    } else {
        logger.error('[PROXY-GEN-002] User ID headers not found');
        next(new errors.UserNotFound());
    }
}

/**
 * Generates the FRN to identify the target resource of the request. The FRN is composed of information from the
 * service and subservice headers and some configuration information.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function generateFRN(req, res, next) {
    const logger = req.logger;
    var frn = config.resourceNamePrefix + config.componentName + ':';

    if (req.organization) {
        frn += req.organization + ':';
    } else {
        frn += ':';
    }

    if (req.headers[constants.PATH_HEADER]) {
        frn += req.headers[constants.PATH_HEADER] + ':';
    } else {
        frn += ':';
    }

    if (req.resourceUrl) {
        frn += req.resourceUrl + ':';
    } else {
        frn += ':';
    }

    if (req.entityType) {
        frn += req.entityType;
    } else {
        frn += ':';
    }
    logger.debug('Generated FRN: ', frn);
    req.frn = frn;

    next();
}

/**
 * Redirects the incoming request to the proxied host.
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function sendRequest(req, res, next) {
    const logger = req.logger;
    var options = {
        uri: 'http://' + config.resource.original.host + ':' + config.resource.original.port + req.path,
        qs: req.query,
        method: req.method,
        headers: req.headers
    };

    if (!options.headers[constants.X_FORWARDED_FOR_HEADER] && req.connection.remoteAddress) {
        options.headers[constants.X_FORWARDED_FOR_HEADER] = req.connection.remoteAddress;
    }
    if (!options.headers[constants.CORRELATOR_HEADER] && req.corr) {
        options.headers[constants.CORRELATOR_HEADER] = req.corr;
    }

    if (req.is('*/json')) {
        options.body = JSON.stringify(req.body);
    } else {
        options.body = req.rawBody;
    }

    delete options.headers['content-length'];
    options.headers.connection = 'close';

    res.oldWriteHead = res.writeHead;
    res.writeHead = function(statusCode, reasonPhrase, headers) {
        if (res._headers['transfer-encoding']) {
            delete res._headers['transfer-encoding'];
        }

        res.oldWriteHead(statusCode, reasonPhrase, headers);
    };

    logger.debug('Forwarding request:\n\n%j\n', options);

    req.fwdResponse = request(options).on('error', function handleConnectionError(e) {
        logger.error('Error forwarding the request to target proxy: %s', e.message);

        if (config.dieOnRedirectError) {
            logger.fatal('[PROXY-FATAL-001] Configured to die upon error in a redirection. Stopping process.');

            process.exit(-1);
        } else {
            next(new errors.TargetServerError(e.message));
        }
    });
    next();
}

/**
 * Check here MATCH file patterns
 *
 * @param {Object} req           Incoming request.
 * @param {String} accessMsg     Incoming accessMsg
 * @return {String}              String message corresponding with accessMsg and found matches
 */
function checkAccessMatches(req, accessMsg) {
    if (req.userName in configAccessMatch.users ) {
        accessMsg += ' MATCHED USER ' + req.userName;
    }
    for (var header of configAccessMatch.headers) {
        var headerName = Object.keys(header)[0];
        if (Object.keys(req.headers).includes(headerName)) {
            if (req.headers[headerName] === header[headerName]) {
                accessMsg += ' MATCHED HEADER ' + headerName + ' ' + header[headerName];
            }
        }
    }
    for (var subpath of configAccessMatch.subpaths) {
        if (req.path.includes(subpath)) {
            accessMsg += ' MATCHED SUBPATH ' + subpath;
        }
    }
    for (var subquery of configAccessMatch.subqueries) {
        if (JSON.stringify(req.query).includes(subquery)) {
            accessMsg += ' MATCHED SUBQUERY ' + subquery;
        }
    }
    for (var text of configAccessMatch.body) {
        if (JSON.stringify(req.body).includes(text)) {
            accessMsg += ' MATCHED BODY ' + text;
        }
    }
    return accessMsg;
}


/**
 * Account Log
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function accountInfo(req, res, next) {
    if ('fwdResponse' in req) {
        if (!accessLogger) {
            accessLogger = new winston.Logger({
                level: 'info',
                transports: [
                    new(winston.transports.File)({
                        filename: config.access.accountFile
                    })
                ]
            });
        }
        req.fwdResponse = req.fwdResponse.on('response', function(res) {
            var accessMsgOrig = 'Right Attempt';
            var accessMsg = accessMsgOrig;
            if (! ['wrong'].includes(config.access.accountMode) ) {
                accessMsg = checkAccessMatches(req, accessMsgOrig);
            }
            if ( ['all'].includes(config.access.accountMode) ||
                 (['matched'].includes(config.access.accountMode) &&
                  accessMsgOrig.length < accessMsg.length) ){

                accessLogger.info(accessMsg +
                                  ' | ResponseStatus=' + req.fwdResponse.response.statusCode +
                                  ' | Token=' + req.headers['x-auth-token'] +
                                  ' | Origin=' + (req.ip || req.connection.remoteAddress) +
                                  ' | UserId=' + req.userId +
                                  ' | UserName=' + req.userName +
                                  ' | ServiceId=' + req.serviceId +
                                  ' | Service=' + req.service +
                                  ' | SubServiceId=' + req.subserviceId +
                                  ' | SubService=' + req.subService +
                                  ' | Action=' + req.action +
                                  ' | Path=' + req.path +
                                  ' | Query=' + JSON.stringify(req.query) +
                                  ' | Body=' + JSON.stringify(req.body).slice(0, 100) + // not all body
                                  ' | Date=' + new Date().toJSON());
            }
        });
    }
    next();
}

/**
 * Invoque request and get response. The request is not read with a pipe, as it has been completely
 * read to guess its type.
 *
 * @param {Object} req           Incoming request.
 * @param {Object} res           Outgoing response.
 * @param {Function} next        Invokes the next middleware in the chain.
 */
function sendResponse(req, res, next) {
    req.fwdResponse.pipe(res);
}

/**
 * Generates a middleware that checks for the pressence of the mandatory headers passed as a parameter, returning a
 * MISSING_HEADERS error if any one is not found.
 *
 * @param {Array} mandatoryHeaders      List of headers to check.
 * @return {Function}                  An express middleware that checks for the presence of the headers.
 */
function checkMandatoryHeaders(mandatoryHeaders) {
    return function(req, res, next) {
        var missing = [];

        for (var i = 0; i < mandatoryHeaders.length; i++) {
            if (!req.headers[mandatoryHeaders[i]] || req.headers[mandatoryHeaders[i]].trim() === '') {
                missing.push(mandatoryHeaders[i]);
            }
        }

        if (missing.length !== 0) {
            next(new errors.MissingHeaders(JSON.stringify(missing)));
        } else {
            next();
        }
    };
}

exports.generateFRN = generateFRN;
exports.extractUserId = extractUserId;
exports.extractOrganization = extractOrganization;
exports.sendRequest = sendRequest;
exports.sendResponse = sendResponse;
exports.accountInfo = accountInfo;
exports.checkMandatoryHeaders = checkMandatoryHeaders(validationHeaders);
exports.checkAuthorizationHeader = checkMandatoryHeaders(authorizationHeaders);
exports.watchConfigAccessMatchFile = watchConfigAccessMatchFile;
exports.checkAccessMatches = checkAccessMatches;

1	/*
2	* Copyright 2014 Telefonica Investigación y Desarrollo, S.A.U
3	*
4	* This file is part of fiware-pep-steelskin
5	*
6	* fiware-pep-steelskin is free software: you can redistribute it and/or
7	* modify it under the terms of the GNU Affero General Public License as
8	* published by the Free Software Foundation, either version 3 of the License,
9	* or (at your option) any later version.
10	*
11	* fiware-pep-steelskin is distributed in the hope that it will be useful,
12	* but WITHOUT ANY WARRANTY; without even the implied warranty of
13	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14	* See the GNU Affero General Public License for more details.
15	*
16	* You should have received a copy of the GNU Affero General Public
17	* License along with fiware-pep-steelskin.
18	* If not, seehttp://www.gnu.org/licenses/.
19	*
20	* For those usages not covered by the GNU Affero General Public License
21	* please contact with::[iot_support@tid.es]
22	*/
23
24	'use strict';
25
26	var config = require('../../config'),	1✔
27	errors = require('../errors'),
28	request = require('request'),
29	constants = require('../constants'),
30	validationHeaders = [
31	'fiware-service',
32	'fiware-servicepath',
33	'x-auth-token'
34	],
35	authorizationHeaders = [
36	'x-auth-token'
37	],
38	winston = require('winston'),
39	logger = require('logops'),
40	configAccessMatch = require('../../configAccessMatch.js').configAccessMatch,
41	accessLogger;
42
43	const fs = require('fs');	1✔
44	const configAccessMatchFilePath = './configAccessMatch.js';	1✔
45
46	function requireUncached(module) {	1✔
NEW 47	delete require.cache[require.resolve(module)];	×
NEW 48	return require(module);	×
49	}
50
51	function watchConfigAccessMatchFile() {	1✔
52	fs.watch(configAccessMatchFilePath, (event, filename) => {	143✔
NEW 53	logger.info('watchConfigAccessMatchFile changed by %s detected in file %s', event, filename);	×
NEW 54	try {	×
NEW 55	configAccessMatch = requireUncached('../../configAccessMatch.js').configAccessMatch;	×
NEW 56	logger.debug('reloaded configAccessMatch %j', configAccessMatch);	×
57	} catch (err) {
NEW 58	logger.error('Error %s reloading module: %s ', err, filename);	×
59	}
60	});
61	}
62
63	/**
64	* Middleware to extract the organization data from the request.
65	*
66	* @param {Object} req Incoming request.
67	* @param {Object} res Outgoing response.
68	* @param {Function} next Call to the next middleware in the chain.
69	*/
70	function extractOrganization(req, res, next) {	1✔
71	const logger = req.logger;	152✔
72	if (req.headers[constants.ORGANIZATION_HEADER]) {	152!
73	req.organization = req.headers[constants.ORGANIZATION_HEADER];	152✔
74	req.service = req.headers[constants.ORGANIZATION_HEADER];	152✔
75	req.subService = req.headers[constants.PATH_HEADER];	152✔
76	next();	152✔
77	} else {
78	logger.error('[PROXY-GEN-001] Organization headers not found');	×
79	next(new errors.OrganizationNotFound());	×
80	}
81	}
82
83	/**
84	* Middleware to extract the user data (usually a token) from the request.
85	*
86	* @param {Object} req Incoming request.
87	* @param {Object} res Outgoing response.
88	* @param {Function} next Call to the next middleware in the chain.
89	*/
90	function extractUserId(req, res, next) {	1✔
91	const logger = req.logger;	152✔
92	if (req.headers[constants.AUTHORIZATION_HEADER]) {	152!
93	req.userId = req.headers[constants.AUTHORIZATION_HEADER];	152✔
94	next();	152✔
95	} else {
96	logger.error('[PROXY-GEN-002] User ID headers not found');	×
97	next(new errors.UserNotFound());	×
98	}
99	}
100
101	/**
102	* Generates the FRN to identify the target resource of the request. The FRN is composed of information from the
103	* service and subservice headers and some configuration information.
104	*
105	* @param {Object} req Incoming request.
106	* @param {Object} res Outgoing response.
107	* @param {Function} next Invokes the next middleware in the chain.
108	*/
109	function generateFRN(req, res, next) {	1✔
110	const logger = req.logger;	153✔
111	var frn = config.resourceNamePrefix + config.componentName + ':';	153✔
112
113	if (req.organization) {	153✔
114	frn += req.organization + ':';	151✔
115	} else {
116	frn += ':';	2✔
117	}
118
119	if (req.headers[constants.PATH_HEADER]) {	153✔
120	frn += req.headers[constants.PATH_HEADER] + ':';	152✔
121	} else {
122	frn += ':';	1✔
123	}
124
125	if (req.resourceUrl) {	153✔
126	frn += req.resourceUrl + ':';	14✔
127	} else {
128	frn += ':';	139✔
129	}
130
131	if (req.entityType) {	153!
132	frn += req.entityType;	×
133	} else {
134	frn += ':';	153✔
135	}
136	logger.debug('Generated FRN: ', frn);	153✔
137	req.frn = frn;	153✔
138
139	next();	153✔
140	}
141
142	/**
143	* Redirects the incoming request to the proxied host.
144	* read to guess its type.
145	*
146	* @param {Object} req Incoming request.
147	* @param {Object} res Outgoing response.
148	* @param {Function} next Invokes the next middleware in the chain.
149	*/
150	function sendRequest(req, res, next) {	1✔
151	const logger = req.logger;	78✔
152	var options = {	78✔
153	uri: 'http://' + config.resource.original.host + ':' + config.resource.original.port + req.path,
154	qs: req.query,
155	method: req.method,
156	headers: req.headers
157	};
158
159	if (!options.headers[constants.X_FORWARDED_FOR_HEADER] && req.connection.remoteAddress) {	78✔
160	options.headers[constants.X_FORWARDED_FOR_HEADER] = req.connection.remoteAddress;	75✔
161	}
162	if (!options.headers[constants.CORRELATOR_HEADER] && req.corr) {	78✔
163	options.headers[constants.CORRELATOR_HEADER] = req.corr;	5✔
164	}
165
166	if (req.is('*/json')) {	78✔
167	options.body = JSON.stringify(req.body);	77✔
168	} else {
169	options.body = req.rawBody;	1✔
170	}
171
172	delete options.headers['content-length'];	78✔
173	options.headers.connection = 'close';	78✔
174
175	res.oldWriteHead = res.writeHead;	78✔
176	res.writeHead = function(statusCode, reasonPhrase, headers) {	78✔
177	if (res._headers['transfer-encoding']) {	78!
178	delete res._headers['transfer-encoding'];	×
179	}
180
181	res.oldWriteHead(statusCode, reasonPhrase, headers);	78✔
182	};
183
184	logger.debug('Forwarding request:\n\n%j\n', options);	78✔
185
186	req.fwdResponse = request(options).on('error', function handleConnectionError(e) {	78✔
187	logger.error('Error forwarding the request to target proxy: %s', e.message);	1✔
188
189	if (config.dieOnRedirectError) {	1!
190	logger.fatal('[PROXY-FATAL-001] Configured to die upon error in a redirection. Stopping process.');	×
191
192	process.exit(-1);	×
193	} else {
194	next(new errors.TargetServerError(e.message));	1✔
195	}
196	});
197	next();	78✔
198	}
199
200	/**
201	* Check here MATCH file patterns
202	*
203	* @param {Object} req Incoming request.
204	* @param {String} accessMsg Incoming accessMsg
205	* @return {String} String message corresponding with accessMsg and found matches
206	*/
207	function checkAccessMatches(req, accessMsg) {	1✔
NEW 208	if (req.userName in configAccessMatch.users ) {	×
NEW 209	accessMsg += ' MATCHED USER ' + req.userName;	×
210	}
NEW 211	for (var header of configAccessMatch.headers) {	×
NEW 212	var headerName = Object.keys(header)[0];	×
NEW 213	if (Object.keys(req.headers).includes(headerName)) {	×
NEW 214	if (req.headers[headerName] === header[headerName]) {	×
NEW 215	accessMsg += ' MATCHED HEADER ' + headerName + ' ' + header[headerName];	×
216	}
217	}
218	}
NEW 219	for (var subpath of configAccessMatch.subpaths) {	×
NEW 220	if (req.path.includes(subpath)) {	×
NEW 221	accessMsg += ' MATCHED SUBPATH ' + subpath;	×
222	}
223	}
NEW 224	for (var subquery of configAccessMatch.subqueries) {	×
NEW 225	if (JSON.stringify(req.query).includes(subquery)) {	×
NEW 226	accessMsg += ' MATCHED SUBQUERY ' + subquery;	×
227	}
228	}
NEW 229	for (var text of configAccessMatch.body) {	×
NEW 230	if (JSON.stringify(req.body).includes(text)) {	×
NEW 231	accessMsg += ' MATCHED BODY ' + text;	×
232	}
233	}
NEW 234	return accessMsg;	×
235	}
236
237
238	/**
239	* Account Log
240	* read to guess its type.
241	*
242	* @param {Object} req Incoming request.
243	* @param {Object} res Outgoing response.
244	* @param {Function} next Invokes the next middleware in the chain.
245	*/
246	function accountInfo(req, res, next) {	1✔
247	if ('fwdResponse' in req) {	×
248	if (!accessLogger) {	×
249	accessLogger = new winston.Logger({	×
250	level: 'info',
251	transports: [
252	new(winston.transports.File)({
253	filename: config.access.accountFile
254	})
255	]
256	});
257	}
UNCOV 258	req.fwdResponse = req.fwdResponse.on('response', function(res) {	×
NEW UNCOV 259	var accessMsgOrig = 'Right Attempt';	×
NEW UNCOV 260	var accessMsg = accessMsgOrig;	×
NEW 261	if (! ['wrong'].includes(config.access.accountMode) ) {	×
NEW 262	accessMsg = checkAccessMatches(req, accessMsgOrig);	×
263	}
NEW 264	if ( ['all'].includes(config.access.accountMode) \|\|	×
265	(['matched'].includes(config.access.accountMode) &&
266	accessMsgOrig.length < accessMsg.length) ){
267
NEW 268	accessLogger.info(accessMsg +	×
269	' \| ResponseStatus=' + req.fwdResponse.response.statusCode +
270	' \| Token=' + req.headers['x-auth-token'] +
271	' \| Origin=' + (req.ip \|\| req.connection.remoteAddress) +	×
272	' \| UserId=' + req.userId +
273	' \| UserName=' + req.userName +
274	' \| ServiceId=' + req.serviceId +
275	' \| Service=' + req.service +
276	' \| SubServiceId=' + req.subserviceId +
277	' \| SubService=' + req.subService +
278	' \| Action=' + req.action +
279	' \| Path=' + req.path +
280	' \| Query=' + JSON.stringify(req.query) +
281	' \| Body=' + JSON.stringify(req.body).slice(0, 100) + // not all body
282	' \| Date=' + new Date().toJSON());
283	}
284	});
285	}
286	next();	×
287	}
288
289	/**
290	* Invoque request and get response. The request is not read with a pipe, as it has been completely
291	* read to guess its type.
292	*
293	* @param {Object} req Incoming request.
294	* @param {Object} res Outgoing response.
295	* @param {Function} next Invokes the next middleware in the chain.
296	*/
297	function sendResponse(req, res, next) {	1✔
298	req.fwdResponse.pipe(res);	78✔
299	}
300
301	/**
302	* Generates a middleware that checks for the pressence of the mandatory headers passed as a parameter, returning a
303	* MISSING_HEADERS error if any one is not found.
304	*
305	* @param {Array} mandatoryHeaders List of headers to check.
306	* @return {Function} An express middleware that checks for the presence of the headers.
307	*/
308	function checkMandatoryHeaders(mandatoryHeaders) {	1✔
309	return function(req, res, next) {	2✔
310	var missing = [];	165✔
311
312	for (var i = 0; i < mandatoryHeaders.length; i++) {	165✔
313	if (!req.headers[mandatoryHeaders[i]] \|\| req.headers[mandatoryHeaders[i]].trim() === '') {	489✔
314	missing.push(mandatoryHeaders[i]);	15✔
315	}
316	}
317
318	if (missing.length !== 0) {	165✔
319	next(new errors.MissingHeaders(JSON.stringify(missing)));	11✔
320	} else {
321	next();	154✔
322	}
323	};
324	}
325
326	exports.generateFRN = generateFRN;	1✔
327	exports.extractUserId = extractUserId;	1✔
328	exports.extractOrganization = extractOrganization;	1✔
329	exports.sendRequest = sendRequest;	1✔
330	exports.sendResponse = sendResponse;	1✔
331	exports.accountInfo = accountInfo;	1✔
332	exports.checkMandatoryHeaders = checkMandatoryHeaders(validationHeaders);	1✔
333	exports.checkAuthorizationHeader = checkMandatoryHeaders(authorizationHeaders);	1✔
334	exports.watchConfigAccessMatchFile = watchConfigAccessMatchFile;	1✔
335	exports.checkAccessMatches = checkAccessMatches;	1✔

telefonicaid / fiware-pep-steelskin / 11270646274

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous