app-routes.js

/**
 * Configure all routes for express app
 */

const _ = require("lodash");
const config = require("config");
const HttpStatus = require("http-status-codes");
const { v4: uuid } = require('uuid');
const util = require("util");
const helper = require("./src/common/helper");
const errors = require("./src/common/errors");
const logger = require("./src/common/logger");
const routes = require("./src/routes");
const authenticator = require("tc-core-library-js").middleware.jwtAuthenticator;

/**
 * Returns whether a normalized auth user has interactive roles.
 *
 * @param {Object} authUser the decoded auth user from the authenticator
 * @returns {Boolean} true when the caller has one or more user roles
 */
function hasInteractiveRoles(authUser) {
  const roles = _.get(authUser, "roles");
  return _.isArray(roles) ? roles.length > 0 : !!roles;
}

/**
 * Read the scope claim from an auth user.
 *
 * The shared authenticator normally copies Auth0's `scope` string into
 * `scopes`, but this also handles callers already carrying either shape or
 * Auth0 RBAC `permissions`.
 *
 * @param {Object} authUser the decoded auth user from the authenticator
 * @returns {Array|String|undefined} scopes from the token
 */
function getAuthUserScopes(authUser) {
  if (!authUser) {
    return undefined;
  }
  return (
    authUser.scopes ||
    authUser.permissions ||
    _.find(authUser, (value, key) => {
      return key.indexOf("scope") !== -1;
    })
  );
}

/**
 * Determine whether an auth user represents an M2M caller.
 *
 * Some valid client-credentials tokens are decoded with scopes but without the
 * `isMachine` flag. Treat no-role scoped callers as M2M so route-level scope
 * checks, not user group membership, decide access.
 *
 * @param {Object} authUser the decoded auth user from the authenticator
 * @returns {Boolean} true when the caller should be handled as M2M
 */
function isM2MAuthUser(authUser) {
  return !!(
    authUser &&
    (_.get(authUser, "isMachine", false) ||
      (getAuthUserScopes(authUser) && !hasInteractiveRoles(authUser)))
  );
}

/**
 * Check whether an M2M caller has any scope required by the route definition.
 *
 * @param {Object} def route definition from src/routes.js
 * @param {Object} authUser the decoded auth user from the authenticator
 * @returns {Boolean} true when one required route scope is present
 */
function hasRequiredM2MScopes(def, authUser) {
  const scopes = getAuthUserScopes(authUser);
  return !!(def.scopes && scopes && helper.checkIfExists(def.scopes, scopes));
}

/**
 * Normalize a valid M2M caller to the shape expected by service authorization.
 *
 * @param {Object} def route definition from src/routes.js
 * @param {Object} authUser the decoded auth user from the authenticator
 * @returns {Boolean} true when the caller has required M2M scopes
 */
function normalizeM2MAuthUser(def, authUser) {
  if (!isM2MAuthUser(authUser) || !hasRequiredM2MScopes(def, authUser)) {
    return false;
  }
  const scopes = getAuthUserScopes(authUser);
  authUser.isMachine = true;
  authUser.scopes = _.isString(scopes) ? scopes.split(" ") : scopes;
  return true;
}

const sanitizeForLog = (value) => {
  const seen = new WeakSet();
  try {
    return JSON.parse(
      JSON.stringify(value, (key, val) => {
        if (typeof val === "object" && val !== null) {
          if (seen.has(val)) return "<circular>";
          seen.add(val);
        }
        if (Buffer.isBuffer(val)) return `<Buffer length=${val.length}>`;
        if (val && typeof val === "object" && val.type === "Buffer" && Array.isArray(val.data)) {
          return `<Buffer length=${val.data.length}>`;
        }
        if (Array.isArray(val) && val.length > 30) return `Array(${val.length})`;
        if (typeof val === "string" && val.length > 500) return `${val.slice(0, 500)}...<truncated>`;
        return val;
      })
    );
  } catch (err) {
    return `<unserializable: ${err.message}>`;
  }
};

const safeInspect = (payload) => util.inspect(sanitizeForLog(payload), { breakLength: Infinity });
const getSignature = (req) => req.signature || req._reqLogId || "no-signature";

/**
 * Configure all routes for express app
 * @param app the express app
 */
function configureRoutes(app) {
  // Load all routes
  _.each(routes, (verbs, path) => {
    _.each(verbs, (def, verb) => {
      const controllerPath = `./src/controllers/${def.controller}`;
      const method = require(controllerPath)[def.method]; // eslint-disable-line
      if (!method) {
        throw new Error(`${def.method} is undefined`);
      }

      const actions = [];
      actions.push((req, res, next) => {
        if (def.method !== "checkHealth") {
          req._id = uuid();
          req.signature = `${req._id}-${def.controller}#${def.method}`;
          logger.info(
            `Started request handling, ${req.signature} ${req.method} ${req.originalUrl} controller=${def.controller}.${def.method} query=${safeInspect(
              req.query
            )} params=${safeInspect(req.params)} body=${safeInspect(req.body)}`
          );
        }
        next();
      });

      actions.push((req, res, next) => {
        if (_.get(req, "query.token")) {
          _.set(req, "headers.authorization", `Bearer ${_.trim(req.query.token)}`);
          logger.info(`[${getSignature(req)}] Promoted query.token to Authorization header`);
        }
        next();
      });

      if (def.auth) {
        // add Authenticator/Authorization check if route has auth
        actions.push((req, res, next) => {
          authenticator(_.pick(config, ["AUTH_SECRET", "VALID_ISSUERS"]))(req, res, next);
        });

        actions.push((req, res, next) => {
          if (isM2MAuthUser(req.authUser)) {
            // M2M
            if (!normalizeM2MAuthUser(def, req.authUser)) {
              logger.warn(
                `[${getSignature(req)}] Machine token scope mismatch. required=${safeInspect(
                  def.scopes
                )} provided=${safeInspect(getAuthUserScopes(req.authUser))}`
              );
              next(
                new errors.ForbiddenError(`You are not allowed to perform this action, because the scopes are incorrect. \
                                              Required scopes: ${JSON.stringify(def.scopes)} \
                                              Provided scopes: ${JSON.stringify(getAuthUserScopes(req.authUser))}`)
              );
            } else {
              req.authUser.handle = config.M2M_AUDIT_HANDLE;
              req.authUser.userId = config.M2M_AUDIT_USERID;
              req.userToken = req.headers.authorization.split(" ")[1];
              logger.info(
                `[${getSignature(req)}] Authenticated M2M token scopes=${safeInspect(
                  req.authUser.scopes
                )}`
              );
              next();
            }
          } else {
            req.authUser.userId = String(req.authUser.userId);
            // User roles authorization
            if (req.authUser.roles) {
              if (
                def.access &&
                !helper.checkIfExists(
                  _.map(def.access, (a) => a.toLowerCase()),
                  _.map(req.authUser.roles, (r) => r.toLowerCase())
                )
              ) {
                logger.warn(
                  `[${getSignature(req)}] User role mismatch required=${safeInspect(
                    def.access
                  )} provided=${safeInspect(req.authUser.roles)}`
                );
                next(
                  new errors.ForbiddenError(`You are not allowed to perform this action, because the roles are incorrect. \
                                                Required roles: ${JSON.stringify(def.access)} \
                                                Provided roles: ${JSON.stringify(req.authUser.roles)}`)
                );
              } else {
                // user token is used in create/update challenge to ensure user can create/update challenge under specific project
                req.userToken = req.headers.authorization.split(" ")[1];
                logger.info(
                  `[${getSignature(req)}] Authenticated user=${req.authUser.userId} roles=${safeInspect(
                    req.authUser.roles
                  )}`
                );
                next();
              }
            } else {
              logger.warn(`[${getSignature(req)}] Authenticated user missing roles`);
              next(
                new errors.ForbiddenError(
                  "You are not authorized to perform this action, \
                                             because no roles were provided"
                )
              );
            }
          }
        });
      } else {
        // public API, but still try to authenticate token if provided, but allow missing/invalid token
        actions.push((req, res, next) => {
          const hasToken =
            !!req.headers.authorization || !!_.get(req, "query.token") || !!req.authUser;
          if (!hasToken) {
            return next();
          }
          const interceptRes = {};
          interceptRes.status = () => interceptRes;
          interceptRes.json = () => interceptRes;
          interceptRes.send = (payload) => {
            logger.info(
              `[${getSignature(req)}] Public route: authenticator send called payload=${safeInspect(
                payload
              )}`
            );
            return next();
          };
          const authMw = authenticator(_.pick(config, ["AUTH_SECRET", "VALID_ISSUERS"]));
          let finished = false;
          const bailoutTimer = setTimeout(() => {
            if (finished) return;
            finished = true;
            next();
          }, 8000);
          authMw(req, interceptRes, (...args) => {
            if (finished) return;
            finished = true;
            clearTimeout(bailoutTimer);
            next(...args);
          });
        });

        actions.push((req, res, next) => {
          if (!req.authUser) {
            logger.info(`[${getSignature(req)}] Public route: no authUser context`);
            next();
          } else if (isM2MAuthUser(req.authUser)) {
            if (!normalizeM2MAuthUser(def, req.authUser)) {
              logger.info(
                `[${getSignature(req)}] Public route: preserving machine token whitelist bypass despite scope mismatch`
              );
              req.authUser = {
                bypassChallengeWhitelist: true,
              };
            } else {
              logger.info(`[${getSignature(req)}] Public route: valid machine token attached`);
            }
            next();
          } else {
            req.authUser.userId = String(req.authUser.userId);
            logger.info(
              `[${getSignature(req)}] Public route: user present userId=${req.authUser.userId}`
            );
            next();
          }
        });
      }

      actions.push(async (req, res, next) => {
        logger.info(`[${getSignature(req)}] Invoking ${def.controller}.${def.method}`);
        try {
          const resultPromise = method(req, res, next);
          if (resultPromise && typeof resultPromise.then === "function") {
            await resultPromise;
          }
          logger.info(
            `[${getSignature(req)}] Completed ${def.controller}.${def.method} headersSent=${res.headersSent} status=${res.statusCode}`
          );
        } catch (err) {
          logger.error(
            `[${getSignature(req)}] ${def.controller}.${def.method} threw error: ${
              err.message || "unknown error"
            }`
          );
          throw err;
        }
      });

      app[verb](`/${config.API_VERSION}${path}`, helper.autoWrapExpress(actions));
    });
  });

  // Check if the route is not found or HTTP method is not supported
  app.use((req, res) => {
    if (routes[req.baseUrl]) {
      logger.warn(`Unsupported method ${req.method} for ${req.originalUrl}`);
      res.status(HttpStatus.METHOD_NOT_ALLOWED).json({
        message: "The requested HTTP method is not supported.",
      });
    } else {
      logger.warn(`Route not found for ${req.method} ${req.originalUrl}`);
      res.status(HttpStatus.NOT_FOUND).json({
        message: "The requested resource cannot be found.",
      });
    }
  });
}

module.exports = configureRoutes;
module.exports.__testables = {
  getAuthUserScopes,
  hasInteractiveRoles,
  hasRequiredM2MScopes,
  isM2MAuthUser,
  normalizeM2MAuthUser,
};