goldilocks.js/lib/admin/apis.js

'use strict';

module.exports.dependencies = [ 'OAUTH3', 'storage.owners', 'options.device' ];
module.exports.create = function (deps, conf) {
  var scmp = require('scmp');
  var crypto = require('crypto');
  var jwt = require('jsonwebtoken');
  var bodyParser = require('body-parser');
  var jsonParser = bodyParser.json({
    inflate: true, limit: '100kb', reviver: null, strict: true /* type, verify */
  });

  function handleCors(req, res, methods) {
    if (!methods) {
      methods = ['GET', 'POST'];
    }
    if (!Array.isArray(methods)) {
      methods = [ methods ];
    }

    res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');
    res.setHeader('Access-Control-Allow-Methods', methods.join(', '));
    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

    if (req.method.toUpperCase() === 'OPTIONS') {
      res.setHeader('Allow', methods.join(', '));
      res.end();
      return true;
    }

    if (methods.indexOf('*') >= 0) {
      return false;
    }
    if (methods.indexOf(req.method.toUpperCase()) < 0) {
      res.statusCode = 405;
      res.setHeader('Content-Type', 'application/json');
      res.end(JSON.stringify({ error: { message: 'method '+req.method+' not allowed', code: 'EBADMETHOD'}}));
      return true;
    }
  }
  function makeCorsHandler(methods) {
    return function corsHandler(req, res, next) {
      if (!handleCors(req, res, methods)) {
        next();
      }
    };
  }

  function handlePromise(req, res, prom) {
    prom.then(function (result) {
      res.send(deps.recase.snakeCopy(result));
    }).catch(function (err) {
      res.statusCode = err.statusCode || 500;
      err.message = err.message || err.toString();
      res.end(JSON.stringify({error: {message: err.message, code: err.code}}));
    });
  }

  function isAuthorized(req, res, fn) {
    var auth = jwt.decode((req.headers.authorization||'').replace(/^bearer\s+/i, ''));
    if (!auth) {
      res.statusCode = 401;
      res.setHeader('Content-Type', 'application/json;');
      res.end(JSON.stringify({ error: { message: "no token", code: 'E_NO_TOKEN', uri: undefined } }));
      return;
    }

    var id = crypto.createHash('sha256').update(auth.sub).digest('hex');
    return deps.storage.owners.exists(id).then(function (exists) {
      if (!exists) {
        res.statusCode = 401;
        res.setHeader('Content-Type', 'application/json;');
        res.end(JSON.stringify({ error: { message: "not authorized", code: 'E_NO_AUTHZ', uri: undefined } }));
        return;
      }

      req.userId = id;
      fn();
    });
  }

  function checkPaywall() {
    var url = require('url');
    var PromiseA = require('bluebird');
    var testDomains = [
      'daplie.com'
    , 'duckduckgo.com'
    , 'google.com'
    , 'amazon.com'
    , 'facebook.com'
    , 'msn.com'
    , 'yahoo.com'
    ];

    // While this is not being developed behind a paywall the current idea is that
    // a paywall will either manipulate DNS queries to point to the paywall gate,
    // or redirect HTTP requests to the paywall gate. So we check for both and
    // hope we can detect most hotel/ISP paywalls out there in the world.
    //
    // It is also possible that the paywall will prevent any unknown traffic from
    // leaving the network, so the DNS queries could fail if the unit is set to
    // use nameservers other than the paywall router.
    return PromiseA.resolve()
    .then(function () {
      var dns = PromiseA.promisifyAll(require('dns'));
      var proms = testDomains.map(function (dom) {
        return dns.resolve6Async(dom)
          .catch(function () {
            return dns.resolve4Async(dom);
          })
          .then(function (result) {
            return result[0];
          }, function () {
            return null;
          });
      });

      return PromiseA.all(proms).then(function (addrs) {
        var unique = addrs.filter(function (value, ind, self) {
          return value && self.indexOf(value) === ind;
        });
        // It is possible some walls might have exceptions that leave some of the domains
        // we test alone, so we might have more than one unique address even behind an
        // active paywall.
        return unique.length < addrs.length;
      });
    })
    .then(function (paywall) {
      if (paywall) {
        return paywall;
      }
      var request = deps.request.defaults({
        followRedirect: false
      , headers: {
          connection: 'close'
        }
      });

      var proms = testDomains.map(function (dom) {
        return request('http://'+dom).then(function (resp) {
          if (resp.statusCode >= 300 && resp.statusCode < 400) {
            return url.parse(resp.headers.location).hostname;
          } else {
            return dom;
          }
        });
      });

      return PromiseA.all(proms).then(function (urls) {
        var unique = urls.filter(function (value, ind, self) {
          return value && self.indexOf(value) === ind;
        });
        return unique.length < urls.length;
      });
    })
    ;
  }

  // This object contains all of the API endpoints written before we changed how
  // the API routing is handled. Eventually it will hopefully disappear, but for
  // now we're focusing on the things that need changing more.
  var oldEndPoints = {
    init: function (req, res) {
      if (handleCors(req, res, ['GET', 'POST'])) {
        return;
      }

      if ('POST' !== req.method) {
        // It should be safe to give the list of owner IDs to an un-authenticated
        // request because the ID is the sha256 of the PPID and shouldn't be reversible
        return deps.storage.owners.all().then(function (results) {
          var ids = results.map(function (owner) {
            return owner.id;
          });
          res.setHeader('Content-Type', 'application/json');
          res.end(JSON.stringify(ids));
        });
      }

      jsonParser(req, res, function () {

      return deps.PromiseA.resolve().then(function () {
        console.log('init POST body', req.body);

        var auth = jwt.decode((req.headers.authorization||'').replace(/^bearer\s+/i, ''));
        var token = jwt.decode(req.body.access_token);
        var refresh = jwt.decode(req.body.refresh_token);
        auth.sub = auth.sub || auth.acx.id;
        token.sub = token.sub || token.acx.id;
        refresh.sub = refresh.sub || refresh.acx.id;

        // TODO validate token with issuer, but as-is the sub is already a secret
        var id = crypto.createHash('sha256').update(auth.sub).digest('hex');
        var tid = crypto.createHash('sha256').update(token.sub).digest('hex');
        var rid = crypto.createHash('sha256').update(refresh.sub).digest('hex');
        var session = {
          access_token: req.body.access_token
        , token: token
        , refresh_token: req.body.refresh_token
        , refresh: refresh
        };

        console.log('ids', id, tid, rid);

        if (req.body.ip_url) {
          // TODO set options / GunDB
          conf.ip_url = req.body.ip_url;
        }

        return deps.storage.owners.all().then(function (results) {
          console.log('results', results);
          var err;

          // There is no owner yet. First come, first serve.
          if (!results || !results.length) {
            if (tid !== id || rid !== id) {
              err = new Error(
                "When creating an owner the Authorization Bearer and Token and Refresh must all match"
              );
              err.statusCode = 400;
              return deps.PromiseA.reject(err);
            }
            console.log('no owner, creating');
            return deps.storage.owners.set(id, session);
          }
          console.log('has results');

          // There are onwers. Is this one of them?
          if (!results.some(function (token) {
            return scmp(id, token.id);
          })) {
            err = new Error("Authorization token does not belong to an existing owner.");
            err.statusCode = 401;
            return deps.PromiseA.reject(err);
          }
          console.log('has correct owner');

          // We're adding an owner, unless it already exists
          if (!results.some(function (token) {
            return scmp(tid, token.id);
          })) {
            console.log('adds new owner with existing owner');
            return deps.storage.owners.set(tid, session);
          }
        }).then(function () {
          res.setHeader('Content-Type', 'application/json;');
          res.end(JSON.stringify({ success: true }));
        });
      })
      .catch(function (err) {
        res.setHeader('Content-Type', 'application/json;');
        res.statusCode = err.statusCode || 500;
        res.end(JSON.stringify({ error: { message: err.message, code: err.code, uri: err.uri } }));
      });

      });
    }
  , request: function (req, res) {
      if (handleCors(req, res, '*')) {
        return;
      }
      isAuthorized(req, res, function () {
      jsonParser(req, res, function () {

        deps.request({
          method: req.body.method || 'GET'
        , url: req.body.url
        , headers: req.body.headers
        , body: req.body.data
        }).then(function (resp) {
          if (resp.body instanceof Buffer || 'string' === typeof resp.body) {
            resp.body = JSON.parse(resp.body);
          }

          return {
            statusCode: resp.statusCode
          , status: resp.status
          , headers: resp.headers
          , body: resp.body
          , data: resp.data
          };
        }).then(function (result) {
          res.send(result);
        });

      });
      });
    }
  , paywall_check: function (req, res) {
      if (handleCors(req, res, 'GET')) {
        return;
      }
      isAuthorized(req, res, function () {
        res.setHeader('Content-Type', 'application/json;');

        checkPaywall().then(function (paywall) {
          res.end(JSON.stringify({paywall: paywall}));
        }, function (err) {
          err.message = err.message || err.toString();
          res.statusCode = 500;
          res.end(JSON.stringify({error: {message: err.message, code: err.code}}));
        });
      });
    }
  , socks5: function (req, res) {
      if (handleCors(req, res, ['GET', 'POST', 'DELETE'])) {
        return;
      }
      isAuthorized(req, res, function () {
        var method = req.method.toUpperCase();
        var prom;

        if (method === 'POST') {
          prom = deps.socks5.start();
        } else if (method === 'DELETE') {
          prom = deps.socks5.stop();
        } else {
          prom = deps.socks5.curState();
        }

        res.setHeader('Content-Type', 'application/json;');
        prom.then(function (result) {
          res.end(JSON.stringify(result));
        }, function (err) {
          err.message = err.message || err.toString();
          res.statusCode = 500;
          res.end(JSON.stringify({error: {message: err.message, code: err.code}}));
        });
      });
    }
  };

  function handleOldApis(req, res, next) {
    if (typeof oldEndPoints[req.params.name] === 'function') {
      oldEndPoints[req.params.name](req, res);
    } else {
      next();
    }
  }

  var config = { restful: {} };
  config.restful.readConfig = function (req, res, next) {
    var part = new (require('./config').ConfigChanger)(conf);
    if (req.params.group) {
      part = part[req.params.group];
    }
    if (part && req.params.domId) {
      part = part.domains.findId(req.params.domId);
    }
    if (part && req.params.mod) {
      part = part[req.params.mod];
    }
    if (part && req.params.modGrp) {
      part = part[req.params.modGrp];
    }
    if (part && req.params.modId) {
      part = part.findId(req.params.modId);
    }

    if (part) {
      res.send(deps.recase.snakeCopy(part));
    } else {
      next();
    }
  };

  config.save = function (changer) {
    var errors = changer.validate();
    if (errors.length) {
      throw Object.assign(new Error(), errors[0], {statusCode: 400});
    }

    return deps.storage.config.save(changer);
  };
  config.restful.saveBaseConfig = function (req, res, next) {
    console.log('config POST body', JSON.stringify(req.body));
    if (req.params.group === 'domains') {
      next();
      return;
    }

    var promise = deps.PromiseA.resolve().then(function () {
      var update;
      if (req.params.group) {
        update = {};
        update[req.params.group] = req.body;
      } else {
        update = req.body;
      }

      var changer = new (require('./config').ConfigChanger)(conf);
      changer.update(update);
      return config.save(changer);
    }).then(function (newConf) {
      if (req.params.group) {
        return newConf[req.params.group];
      }
      return newConf;
    });
    handlePromise(req, res, promise);
  };

  config.extractModList = function (changer, params) {
    var err;
    if (params.domId) {
      var dom = changer.domains.find(function (dom) {
        return dom.id === params.domId;
      });

      if (!dom) {
        err = new Error("no domain with ID '"+params.domId+"'");
      } else if (!dom.modules[params.group]) {
        err = new Error("domains don't contain '"+params.group+"' modules");
      } else {
        return dom.modules[params.group];
      }
    } else {
      if (!changer[params.group] || !changer[params.group].modules) {
        err = new Error("'"+params.group+"' is not a valid settings group or doesn't support modules");
      } else {
        return changer[params.group].modules;
      }
    }

    err.statusCode = 404;
    throw err;
  };
  config.restful.createModule = function (req, res, next) {
    if (req.params.group === 'domains') {
      next();
      return;
    }

    var promise = deps.PromiseA.resolve().then(function () {
      var changer = new (require('./config').ConfigChanger)(conf);
      var modList = config.extractModList(changer, req.params);

      var update = req.body;
      if (!Array.isArray(update)) {
        update = [ update ];
      }
      update.forEach(modList.add, modList);

      return config.save(changer);
    }).then(function (newConf) {
      return config.extractModList(newConf, req.params);
    });
    handlePromise(req, res, promise);
  };
  config.restful.updateModule = function (req, res, next) {
    if (req.params.group === 'domains') {
      next();
      return;
    }

    var promise = deps.PromiseA.resolve().then(function () {
      var changer = new (require('./config').ConfigChanger)(conf);
      var modList = config.extractModList(changer, req.params);
      modList.update(req.params.modId, req.body);
      return config.save(changer);
    }).then(function (newConf) {
      return config.extractModule(newConf, req.params).find(function (mod) {
        return mod.id === req.params.modId;
      });
    });
    handlePromise(req, res, promise);
  };
  config.restful.removeModule = function (req, res, next) {
    if (req.params.group === 'domains') {
      next();
      return;
    }

    var promise = deps.PromiseA.resolve().then(function () {
      var changer = new (require('./config').ConfigChanger)(conf);
      var modList = config.extractModList(changer, req.params);
      modList.remove(req.params.modId);
      return config.save(changer);
    }).then(function (newConf) {
      return config.extractModList(newConf, req.params);
    });
    handlePromise(req, res, promise);
  };

  config.restful.createDomain = function (req, res) {
    var promise = deps.PromiseA.resolve().then(function () {
      var changer = new (require('./config').ConfigChanger)(conf);

      var update = req.body;
      if (!Array.isArray(update)) {
        update = [ update ];
      }
      update.forEach(changer.domains.add, changer.domains);
      return config.save(changer);
    }).then(function (newConf) {
      return newConf.domains;
    });
    handlePromise(req, res, promise);
  };
  config.restful.updateDomain = function (req, res) {
    var promise = deps.PromiseA.resolve().then(function () {
      if (req.body.modules) {
        throw Object.assign(new Error('do not add modules with this route'), {statusCode: 400});
      }

      var changer = new (require('./config').ConfigChanger)(conf);
      changer.domains.update(req.params.domId, req.body);
      return config.save(changer);
    }).then(function (newConf) {
      return newConf.domains.find(function (dom) {
        return dom.id === req.params.domId;
      });
    });
    handlePromise(req, res, promise);
  };
  config.restful.removeDomain = function (req, res) {
    var promise = deps.PromiseA.resolve().then(function () {
      var changer = new (require('./config').ConfigChanger)(conf);
      changer.domains.remove(req.params.domId);
      return config.save(changer);
    }).then(function (newConf) {
      return newConf.domains;
    });
    handlePromise(req, res, promise);
  };

  var app = require('express')();

  // Handle all of the API endpoints using the old definition style, and then we can
  // add middleware without worrying too much about the consequences to older code.
  app.use('/:name', handleOldApis);

  app.use('/', isAuthorized, jsonParser);

  // Not all config routes support PUT or DELETE, but not worth making this more specific
  app.use(   '/config', makeCorsHandler(['GET', 'POST', 'PUT', 'DELETE']));
  app.get(   '/config',                                                 config.restful.readConfig);
  app.get(   '/config/:group',                                          config.restful.readConfig);
  app.get(   '/config/:group/:mod(modules)/:modId?',                    config.restful.readConfig);
  app.get(   '/config/domains/:domId/:mod(modules)?',                   config.restful.readConfig);
  app.get(   '/config/domains/:domId/:mod(modules)/:modGrp/:modId?',    config.restful.readConfig);

  app.post(  '/config',                                       config.restful.saveBaseConfig);
  app.post(  '/config/:group',                                config.restful.saveBaseConfig);

  app.post(  '/config/:group/modules',                        config.restful.createModule);
  app.put(   '/config/:group/modules/:modId',                 config.restful.updateModule);
  app.delete('/config/:group/modules/:modId',                 config.restful.removeModule);

  app.post(  '/config/domains/:domId/modules/:group',         config.restful.createModule);
  app.put(   '/config/domains/:domId/modules/:group/:modId',  config.restful.updateModule);
  app.delete('/config/domains/:domId/modules/:group/:modId',  config.restful.removeModule);

  app.post(  '/config/domains',                               config.restful.createDomain);
  app.put(   '/config/domains/:domId',                        config.restful.updateDomain);
  app.delete('/config/domains/:domId',                        config.restful.removeDomain);

  return app;
};