-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #18 from one-piece-team1/develop
Feat Secure
- Loading branch information
Showing
6 changed files
with
110 additions
and
37 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,66 +1,58 @@ | ||
| import { HttpException, HttpStatus, Injectable, Logger, NestMiddleware, UnauthorizedException } from '@nestjs/common'; | ||
| import { Injectable, Logger, NestMiddleware } from '@nestjs/common'; | ||
| import { Request, Response, NextFunction } from 'express'; | ||
| import { config } from '../../config'; | ||
| import { APIRequestFactory } from '../libs/request-factory'; | ||
|
|
||
| @Injectable() | ||
| export class AuthService implements NestMiddleware { | ||
| export class AuthMiddleware implements NestMiddleware { | ||
| private logger: Logger = new Logger('AuthService'); | ||
|
|
||
| /** | ||
| * @description Auth validation Handler | ||
| * @public | ||
| * @param {Request} req | ||
| * @param {Response} res | ||
| * @param {NextFunction} next | ||
| * @returns {Promise<void | Response>} | ||
| * @returns {void | Response} | ||
| */ | ||
| public async use(req: Request, res: Response, next: NextFunction): Promise<void | Response> { | ||
| public use(req: Request, res: Response, next: NextFunction): void | Response { | ||
| if (!this.originHandling(req)) { | ||
| this.logger.error(`${req.ip} from ${req.hostname} send malware request with wrong origin`, '', 'UserOriginError'); | ||
| return res.sendStatus(403); | ||
| } | ||
| // check if routes is exception or not | ||
| if (this.exceptRoutes(req.baseUrl)) return next(); | ||
| // check token | ||
| if (!req.headers.authorization) return res.sendStatus(403); | ||
| try { | ||
| // get user data from user sercice | ||
| const response = await this.requestUesr(req.headers.authorization); | ||
| if (response.statusCode !== 200) return res.sendStatus(403); | ||
| next(); | ||
| } catch (error) { | ||
| this.logger.log(error.message, 'Auth-Err'); | ||
| return res.status(403).json({ status: 'error', message: error.message }); | ||
| if (!req.headers.authorization) { | ||
| this.logger.error(`${req.ip} from ${req.hostname} send malware request with token`, '', 'TokenError'); | ||
| return res.sendStatus(403); | ||
| } | ||
| next(); | ||
| } | ||
|
|
||
| /** | ||
| * @description Handle Exception Routes which don't need to auth verify | ||
| * @private | ||
| * @param {string} routes | ||
| * @returns {boolean} | ||
| */ | ||
| protected exceptRoutes(routes: string): boolean { | ||
| private exceptRoutes(routes: string): boolean { | ||
| for (let i = 0; i < config.MS_EXCEPT.length; i++) { | ||
| if (routes.indexOf(config.MS_EXCEPT[i]) >= 0) return true; | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| /** | ||
| * @description Request user info by token to identify if it's validate user | ||
| * @param {string} token | ||
| * @returns {Promise<any>} | ||
| * @description Origin header handling due to Nestjs CORs has issued for handling | ||
| * @private | ||
| * @param {Request} req | ||
| * @returns {void} | ||
| */ | ||
| protected async requestUesr(token: string): Promise<any> { | ||
| try { | ||
| const service = config.MS_SETTINGS[0]; | ||
| return await APIRequestFactory.createRequest('standard').makeRequest({ | ||
| url: `http://${service.host}:${service.port}/users/info`, | ||
| method: 'GET', | ||
| headers: { | ||
| Authorization: token, | ||
| }, | ||
| json: true, | ||
| }); | ||
| } catch (error) { | ||
| this.logger.log(error.message, 'Auth-Request-Err'); | ||
| throw new Error(error.message); | ||
| } | ||
| private originHandling(req: Request): boolean { | ||
| const whiteLists: boolean | string[] = config.CORSORIGIN; | ||
| if (typeof whiteLists === 'boolean') return true; | ||
| if (!req.headers.origin) return false; | ||
| if (whiteLists.indexOf(req.headers.origin) !== -1) return true; | ||
| return false; | ||
| } | ||
| } |