File size: 2,737 Bytes
4e23b01 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 | import type { FastifyReply, FastifyRequest } from 'fastify';
import { errEnvelope } from '../envelope';
import type { IAuthTokenService } from '../services/auth/authTokenService';
import type { CredentialValidator } from '../services/auth/credentials';
import {
AUTH_RATE_LIMIT_CODE,
AUTH_RATE_LIMIT_MSG,
type AuthFailureLimiter,
} from './rateLimit';
const AUTH_ERROR_CODE = 40101;
const AUTH_ERROR_MSG = 'Unauthorized';
const REDACTED = '[redacted]';
const BEARER_PREFIX = 'Bearer ';
export interface AuthHookOptions {
readonly isBypassed?: (req: FastifyRequest) => boolean;
readonly limiter?: Pick<AuthFailureLimiter, 'recordFailure' | 'isBanned'>;
readonly validateCredential?: CredentialValidator;
}
function decodeRequestPath(rawUrl: string): string | null {
const path = rawUrl.split('?', 1)[0] ?? rawUrl;
try {
return decodeURIComponent(path);
} catch {
return null;
}
}
function defaultIsBypassed(req: FastifyRequest): boolean {
if (req.method === 'OPTIONS') {
return true;
}
const path = decodeRequestPath(req.url);
if (path === null) {
return false;
}
if (req.method === 'GET' && path === '/api/v1/healthz') {
return true;
}
const isApi = path.startsWith('/api/');
const isMeta = path === '/openapi.json' || path === '/asyncapi.json';
return !isApi && !isMeta;
}
function extractBearer(header: string | undefined): string | null {
if (header === undefined || !header.startsWith(BEARER_PREFIX)) {
return null;
}
const token = header.slice(BEARER_PREFIX.length);
return token.length === 0 ? null : token;
}
export function createAuthHook(
authTokenService: IAuthTokenService,
opts?: AuthHookOptions,
): (req: FastifyRequest, reply: FastifyReply) => Promise<FastifyReply | void> {
const isBypassed = opts?.isBypassed ?? defaultIsBypassed;
const validateCredential: CredentialValidator =
opts?.validateCredential ?? ((candidate) => authTokenService.isValid(candidate));
return async (req, reply) => {
if (opts?.limiter?.isBanned(req.ip) === true) {
return reply.code(429).send(errEnvelope(AUTH_RATE_LIMIT_CODE, AUTH_RATE_LIMIT_MSG, req.id));
}
const header = req.headers.authorization;
const token = extractBearer(header);
if (isBypassed(req)) {
return;
}
if (header !== undefined) {
req.headers.authorization = REDACTED;
}
if (token === null) {
opts?.limiter?.recordFailure(req.ip);
return reply.code(401).send(errEnvelope(AUTH_ERROR_CODE, AUTH_ERROR_MSG, req.id));
}
if (!(await validateCredential(token))) {
opts?.limiter?.recordFailure(req.ip);
return reply.code(401).send(errEnvelope(AUTH_ERROR_CODE, AUTH_ERROR_MSG, req.id));
}
};
}
|