Production deployment

.env.dev

@@ -18,7 +18,5 @@ API_CLIENT_ID=2411181397763460
 API_CLIENT_SECRET=
 REDIRECT_URI=https://dev.kartat.hsl.fi/kartta
 LOGIN_PROVIDER_URI=https://hslid-uat.cinfra.fi
-DOMAINS_ALLOWED_TO_GENERATE=
-DOMAINS_ALLOWED_TO_LOGIN=
-
-ROUTEMAP_TEST_GROUP=Karttageneraattori-test
+GROUP_GENERATE=
+GROUP_READONLY=

.env.prod

@@ -18,5 +18,5 @@ API_CLIENT_ID=2411181397763460
 API_CLIENT_SECRET=
 REDIRECT_URI=https://kartat.hsl.fi/kartta
 LOGIN_PROVIDER_URI=https://id.hsl.fi
-DOMAINS_ALLOWED_TO_GENERATE=
-DOMAINS_ALLOWED_TO_LOGIN=
+GROUP_GENERATE=
+GROUP_READONLY=

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:16-buster-slim
+FROM node:20-bookworm-slim
 
 # This installs the necessary libs to make the bundled version of Chromium that Pupppeteer installs work
 RUN apt-get update \
@@ -12,7 +12,7 @@ RUN apt-get update \
   && mv ./azcopy /usr/bin/ \
   && rm -rf /var/lib/apt/lists/*
 
-ENV WORK /opt/publisher
+ENV WORK=/opt/publisher
 # ENV NODE_ENV production # Cannot use until devdependency list is fixed in package.json
 
 # Create app directory

constants.js

@@ -43,8 +43,8 @@ module.exports = {
   AZURE_STORAGE_KEY: secretsEnv.AZURE_STORAGE_KEY || '',
   CLIENT_SECRET: secretsEnv.CLIENT_SECRET || '',
   API_CLIENT_SECRET: secretsEnv.API_CLIENT_SECRET || '',
-  DOMAINS_ALLOWED_TO_LOGIN: secretsEnv.DOMAINS_ALLOWED_TO_LOGIN || '',
+  GROUP_GENERATE: secretsEnv.GROUP_GENERATE || '',
+  GROUP_READONLY: secretsEnv.GROUP_READONLY || '',
   HSL_TESTING_HSLID_USERNAME: secretsEnv.HSL_TESTING_HSLID_USERNAME || '',
   HSL_TESTING_HSLID_PASSWORD: secretsEnv.HSL_TESTING_HSLID_PASSWORD || '',
-  ROUTEMAP_TEST_GROUP: secretsEnv.ROUTEMAP_TEST_GROUP || '',
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hsl-routemap-server",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "HSL Routemap server",
   "main": "index.js",
   "scripts": {

scripts/auth/authEndpoints.js

@@ -2,30 +2,19 @@ const { get, last, clone } = require('lodash');
 const AuthService = require('./authService');
 const validator = require('validator');
 
-const { DOMAINS_ALLOWED_TO_LOGIN, ROUTEMAP_TEST_GROUP } = require('../../constants');
+const { GROUP_GENERATE, GROUP_READONLY } = require('../../constants');
 
-const allowedDomains = DOMAINS_ALLOWED_TO_LOGIN.split(',');
+const hasAllowedGroup = async (userInfo) => {
+  const groups = get(userInfo, 'groups', {});
 
-const hasAllowedDomain = async (userInfo) => {
-  const groups = get(userInfo, 'groups');
-
-  const emailValidationOptions = {
-    host_whitelist: allowedDomains,
-  };
-
-  if (groups.includes(ROUTEMAP_TEST_GROUP)) {
-    return true;
-  }
-
-  if (
-    !validator.isEmail(userInfo.email, emailValidationOptions) &&
-    !groups.includes(ROUTEMAP_TEST_GROUP)
-  ) {
-    console.log(`User does not have allowed domain. Logging out.`);
+  if (!groups || !Array.isArray(groups)) {
+    console.log('User does not have valid groups assigned');
     return false;
   }
-
-  return true;
+  if (groups.includes(GROUP_GENERATE) || groups.includes(GROUP_READONLY)) {
+    return true;
+  }
+  return false;
 };
 
 const authorize = async (req, res, session) => {
@@ -63,7 +52,7 @@ const authorize = async (req, res, session) => {
   if (session && tokenResponse.access_token) {
     modifiedSession.accessToken = tokenResponse.access_token;
     const userInfo = await AuthService.requestUserInfo(modifiedSession.accessToken);
-    const isAllowed = await hasAllowedDomain(userInfo);
+    const isAllowed = await hasAllowedGroup(userInfo);
     if (!isAllowed) {
       return {
         status: 401,
@@ -100,7 +89,7 @@ const authorize = async (req, res, session) => {
 
 const checkExistingSession = async (req, res, session) => {
   if (session && session.accessToken) {
-    const isAllowed = await hasAllowedDomain(session);
+    const isAllowed = await hasAllowedGroup(session);
     if (!isAllowed) {
       await AuthService.logoutFromIdentityProvider(session.accessToken);
       return {
@@ -111,6 +100,7 @@ const checkExistingSession = async (req, res, session) => {
     const response = {
       isOk: true,
       email: session.email,
+      groups: session.groups,
     };
     return {
       status: 200,

scripts/server.js

@@ -29,7 +29,7 @@ const {
 } = require('./joreStore');
 const { downloadPostersFromCloud } = require('./cloudService');
 
-const { REDIS_CONNECTION_STRING } = require('../constants');
+const { REDIS_CONNECTION_STRING, GROUP_GENERATE } = require('../constants');
 
 const PORT = 4000;
 
@@ -66,6 +66,16 @@ const errorHandler = async (ctx, next) => {
   }
 };
 
+const allowedToGenerate = (user) => {
+  if (!user || !user.email) return false;
+
+  if (user.groups && user.groups.includes(GROUP_GENERATE)) {
+    return true;
+  }
+
+  return false;
+};
+
 const authMiddleware = async (ctx, next) => {
   const endpointsNotRequiringAuthentication = ['/login', '/logout', '/session'];
   if (endpointsNotRequiringAuthentication.includes(ctx.path)) {
@@ -82,6 +92,14 @@ const authMiddleware = async (ctx, next) => {
       // Not authenticated, throw 401
       ctx.throw(401);
     } else {
+      // If the request is CRUD, check if the user has privileges to perform the action
+      if (ctx.method !== 'GET' && ctx.method !== 'HEAD') {
+        const user = authResponse.body;
+        if (!allowedToGenerate(user)) {
+          ctx.throw(403, 'User does not have privileges to perform this action.');
+        }
+      }
+
       await next();
     }
   }
@@ -106,12 +124,40 @@ async function main() {
   });
 
   router.post('/builds', async (ctx) => {
+    const authResponse = await authEndpoints.checkExistingSession(
+      ctx.request,
+      ctx.response,
+      ctx.session,
+    );
+
+    if (!authResponse.body.isOk) {
+      ctx.throw(401, 'Not allowed.');
+    }
+
+    if (!authResponse.body.groups.includes(GROUP_GENERATE)) {
+      ctx.throw(403, 'User does not have permission to modify builds.');
+    }
+
     const { title } = ctx.request.body;
     const build = await addBuild({ title });
     ctx.body = build;
   });
 
   router.put('/builds/:id', async (ctx) => {
+    const authResponse = await authEndpoints.checkExistingSession(
+      ctx.request,
+      ctx.response,
+      ctx.session,
+    );
+
+    if (!authResponse.body.isOk) {
+      ctx.throw(401, 'Not allowed.');
+    }
+
+    if (!authResponse.body.groups.includes(GROUP_GENERATE)) {
+      ctx.throw(403, 'User does not have permission to modify builds.');
+    }
+
     const { id } = ctx.params;
     const { status } = ctx.request.body;
     const build = await updateBuild({
@@ -143,13 +189,18 @@ async function main() {
     if (!authResponse.body.isOk) {
       ctx.throw(401, 'Not allowed.');
     }
-    const posters = [];
-    for (let i = 0; i < props.length; i++) {
-      // eslint-disable-next-line no-await-in-loop
-      const poster = await generatePoster(buildId, props[i]);
-      posters.push(poster);
+
+    if (!authResponse.body.groups.includes(GROUP_GENERATE)) {
+      ctx.throw(403, 'User does not have permission to generate posters.');
+    } else {
+      const posters = [];
+      for (let i = 0; i < props.length; i++) {
+        // eslint-disable-next-line no-await-in-loop
+        const poster = await generatePoster(buildId, props[i]);
+        posters.push(poster);
+      }
+      ctx.body = posters;
     }
-    ctx.body = posters;
   });
 
   router.post('/cancelPoster', async (ctx) => {

src/components/labelPlacement/costFunctions.js

@@ -5,7 +5,7 @@ const OVERLAP_COST_FIXED = 6;
 const OVERFLOW_COST = 10000;
 const INTERSECTION_COST = 700;
 const INTERSECTION_WITH_FIXED_COST = 25;
-const DISTANCE_COST = 120;
+const DISTANCE_COST = 70;
 const ANGLE_COST = 1;
 const ALPHA_COST = 25;
 
@@ -80,7 +80,7 @@ function getOverlapArea(a, b) {
 
 function getPositionOverlapCost(positions, indexes, position) {
   let overlap = 0;
-  indexes.forEach(j => {
+  indexes.forEach((j) => {
     if (positions[j].allowCollision || (!positions[j].shouldBeVisible && positions[j].allowHidden))
       return;
     else if (j === position.index) return;
@@ -99,7 +99,7 @@ function getPositionOverlapCost(positions, indexes, position) {
  */
 function getOverlapCost(positions, indexes, closeByPositions) {
   let overlap = 0;
-  closeByPositions.forEach(position => {
+  closeByPositions.forEach((position) => {
     if ((position.shouldBeVisible || !position.allowHidden) && !position.allowCollision) {
       overlap += getPositionOverlapCost(positions, indexes, position);
     }
@@ -125,9 +125,9 @@ function hasIntersectingLines(a, b) {
  */
 function getIntersectionCost(positions, indexes, closeByPositions) {
   let sum = 0;
-  closeByPositions.forEach(position => {
+  closeByPositions.forEach((position) => {
     if (position.isFixed) return;
-    indexes.forEach(j => {
+    indexes.forEach((j) => {
       if (positions[j].isFixed) return;
       if (j >= position.index && indexes.includes(position.index)) return;
       if (hasIntersectingLines(position, positions[j])) sum += 1;
@@ -140,7 +140,7 @@ function getPositionFixedIntersectionCost(positions, indexes, index) {
   let sum = 0;
   const position = positions[index];
   if (position.allowCollision) return sum;
-  indexes.forEach(j => {
+  indexes.forEach((j) => {
     if (positions[j].allowCollision) return;
     if (j >= index && indexes.includes(index)) return;
     // If both are dynamic or fixed, return
@@ -161,7 +161,7 @@ function getPositionFixedIntersectionCost(positions, indexes, index) {
     const p3 = segseg(a0, a1, bl, br);
     const p4 = segseg(a0, a1, tr, br);
 
-    const intersections = [p1, p2, p3, p4].filter(p => Array.isArray(p));
+    const intersections = [p1, p2, p3, p4].filter((p) => Array.isArray(p));
 
     if (intersections.length === 2) {
       const dx = intersections[0][0] - intersections[1][0];
@@ -197,7 +197,7 @@ function getDistanceCost(positions, indexes) {
   return (
     DISTANCE_COST *
     indexes
-      .filter(index => !positions[index].isFixed)
+      .filter((index) => !positions[index].isFixed)
       .reduce(
         (prev, index) =>
           prev +
@@ -220,7 +220,7 @@ function getAngleCost(positions, indexes) {
   return (
     ANGLE_COST *
     indexes
-      .filter(index => !positions[index].isFixed)
+      .filter((index) => !positions[index].isFixed)
       .reduce((prev, index) => {
         const phi = Math.abs(positions[index].angle - positions[index].initialAngle) % 180;
         return prev + (phi > 90 ? 180 - phi : phi) * positions[index].anglePriority;