diff --git a/services/utils-service/beta-properties.file b/services/utils-service/beta-properties.file index c1901a72..534e81dd 100644 --- a/services/utils-service/beta-properties.file +++ b/services/utils-service/beta-properties.file @@ -1,7 +1,7 @@ -userInfoUrl = https://beta.services.openaire.eu/uoa-user-management/api/users/getUserInfo?accessToken= -originServer = .openaire.eu -post.allowed = /upload,/upload/ +userInfoUrl = https://beta.services.openaire.eu/login-service/userInfo ssl = true localPath = false # photo size in KB -photo.size = 200 +max.size = 200 +# file size in KB +big-max.size = 1000 diff --git a/services/utils-service/package.json b/services/utils-service/package.json index 734df8ad..736a2805 100644 --- a/services/utils-service/package.json +++ b/services/utils-service/package.json @@ -15,8 +15,7 @@ "cors": "^2.8.4", "express": "^4.15.2", "multer": "^1.1.0", - "properties-reader": "0.0.16", - "tinyurl": "^1.1.4" + "properties-reader": "0.0.16" }, "engines": { "node": "16.3.0" diff --git a/services/utils-service/production-properties.file b/services/utils-service/production-properties.file index daebf81e..3c3557c4 100644 --- a/services/utils-service/production-properties.file +++ b/services/utils-service/production-properties.file @@ -1,7 +1,7 @@ userInfoUrl = https://services.openaire.eu/uoa-user-management/api/users/getUserInfo?accessToken= -originServer = .openaire.eu -post.allowed = /upload,/upload/ ssl = true localPath = false # photo size in KB -photo.size = 200 +max.size = 200 +# file size in KB +big-max.size = 1000 diff --git a/services/utils-service/properties.file b/services/utils-service/properties.file index 0fe8bc25..9420587d 100644 --- a/services/utils-service/properties.file +++ b/services/utils-service/properties.file @@ -1,7 +1,7 @@ -userInfoUrl = http://dl170.madgik.di.uoa.gr:8180/dnet-openaire-users-1.0.0-SNAPSHOT/api/users/getUserInfo?accessToken= -originServer = .di.uoa.gr -post.allowed = /upload,/upload/ +userInfoUrl = http://mpagasas.di.uoa.gr:8080/login-service/userInfo ssl = false localPath = true # photo size in KB -photo.size = 200 +max.size = 200 +# file size in KB +big-max.size = 1000 diff --git a/services/utils-service/uploadService.js b/services/utils-service/uploadService.js index 84300ee4..3122f1ec 100644 --- a/services/utils-service/uploadService.js +++ b/services/utils-service/uploadService.js @@ -4,31 +4,28 @@ var cookieParser = require('cookie-parser'); var multer = require("multer"); var PropertiesReader = require('properties-reader'); var properties = PropertiesReader('./properties.file'); -var TinyURL = require('tinyurl'); var app = express(); var http = null; - +// Properties if (properties.get('ssl')) { http = require("https"); } else { http = require("http"); } - - -// Properties var auth = properties.get('userInfoUrl'); -var originServer = properties.get('originServer'); -var allowPostRequests = properties.get('post.allowed').split(','); +/** @deprecated*/ +var authDeprecated = auth.includes("accessToken"); var localPath = properties.get('localPath'); -var maxsize = properties.get('photo.size') * 1024; - +var maxSize = properties.get('max.size') * 1024; +var bigMaxSize = properties.get('big-max.size') * 1024; var storage = multer.diskStorage({ destination: function (req, file, cb) { cb(null, 'uploads') }, filename: function (req, file, cb) { if (req.params.id) { - cb(null, req.params.id + '-' + new Date().getTime() + '.' + file.originalname.split('.').pop()); + cb(null, req.params.id + (req.params.label?('-' + req.params.label):'') + + '-' + new Date().getTime() + '.' + file.originalname.split('.').pop()); } else { cb(null, file.originalname); } @@ -42,40 +39,25 @@ app.use(bodyParser.urlencoded({extended: true})); app.use(cookieParser()); app.use(function (req, res, next) { - if((req.method === 'POST' || req.method === 'DELETE') && allowPostRequests.indexOf(req.url.split('?')[0]) === -1) { - if(checkCookies(req)) { - res.header('Access-Control-Allow-Origin', req.headers.origin); - res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-xsrf-token'); - res.header('Access-Control-Allow-Credentials', true); - next(); - } else { - res.header('Access-Control-Allow-Origin', '*'); - res.header('Access-Control-Allow-Credentials', true); - res.header('Vary', 'Origin'); - res.status(403).send(getResponse(403, "Forbidden: You don't have permission to access. Maybe you are not registered.")); - } - } else if(req.method === 'OPTIONS' && allowPostRequests.indexOf(req.url.split('?')[0]) === -1){ - res.header('Access-Control-Allow-Origin', req.headers.origin); - res.header('Access-Control-Allow-Credentials', true); - res.header('Access-Control-Allow-Methods', 'POST, DELETE'); - res.header('Access-Control-Max-Age', 1800); - res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-xsrf-token'); - next(); - } else { - res.header('Access-Control-Allow-Origin', req.headers.origin); - res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept'); - next(); - } + res.header('Access-Control-Allow-Origin', req.headers.origin); + res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-xsrf-token'); + res.header('Access-Control-Allow-Credentials', "true"); + res.header('Access-Control-Allow-Methods', 'GET, OPTIONS, POST, DELETE'); + res.header('Access-Control-Max-Age', "1800"); + next(); +}); + +app.get('/download/:filename', function (req, res) { + res.download('./uploads/' + req.params.filename); }); app.post("/upload", upload.array("uploads[]", 12), function (req, res) { var filepath = (localPath ? "." : __dirname) + "/" + req.files[0].path; let type = req.query.type; - console.log(type); - if(type == 'json' && req.files[0].mimetype !== 'application/json'){ - console.error("No proper file type"); + if (type === 'json' && req.files[0].mimetype !== 'application/json') { + console.error("No proper file type"); res.status(500).send(getResponse(500, "No proper file type")); - }else if ((!type || type == 'csv') && req.files[0].mimetype !== 'text/csv' && req.files[0].mimetype !== 'application/vnd.ms-excel') { + } else if ((!type || type === 'csv') && req.files[0].mimetype !== 'text/csv' && req.files[0].mimetype !== 'application/vnd.ms-excel') { console.error("No proper file type"); res.status(500).send(getResponse(500, "No proper file type")); } else { @@ -88,115 +70,90 @@ app.post("/upload", upload.array("uploads[]", 12), function (req, res) { }); -app.post('/upload/stakeholder/:id', upload.single('photo'), (req, res) => { - sendFile(req, res, (result) => { - return isMonitorCurator(result.edu_person_entitlements); - }); -}); - -app.post('/upload/:id', upload.single('photo'), (req, res) => { - sendFile(req, res, (result) => { - return result.sub.indexOf(req.params.id) !== -1 || isAdminOrCurator(result.edu_person_entitlements); - }); -}); - -app.get('/download/:filename', function (req, res) { - res.download('./uploads/' + req.params.filename); -}); - -app.get('/tiny', function (req, res) { - TinyURL.shorten(req.query.url, function (res1, err) { - if (err) - console.log(err) - if (res1 !== 'Error') { - res.send(res1); +app.post(['/upload/:id', '/upload/stakeholder/:id', '/upload/:type/:id', '/upload/:type/:id/:label'], upload.single('photo'), (req, res) => { + let fileMaxSize = (req.query.big)?bigMaxSize:maxSize + sendFile(req, res, fileMaxSize, (result) => { + let type = req.params['type']; + let id = req.params['id']; + let roles = result.roles; + if(type) { + return isPortalAdmin(roles) || isCurator(type, roles) || isManager(type, id, roles); } else { - res.send(req.query.url); + return result.sub.indexOf(id) !== -1 || isPortalAdmin(roles) || isAnyCurator(roles); } }); }); -app.delete('/delete/stakeholder/:filename', function (req, res) { +app.delete(['/delete/:filename', '/delete/stakeholder/:filename', '/delete/:type/:id/:filename'], function (req, res) { deleteFileSend(req, res, (result) => { - return isMonitorCurator(result.edu_person_entitlements); - }) -}); - -app.delete('/delete/:filename', function (req, res) { - deleteFileSend(req, res, (result) => { - return result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements); - }) + let roles = result.roles; + let type = req.params['type']; + let id = req.params['id']; + if(type && id) { + return isPortalAdmin(roles) || isCurator(type, roles) || isManager(type, id, roles); + } else { + return result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isPortalAdmin(roles) || isAnyCurator(roles); + } + }); }); const server = app.listen(8000, function () { console.log("Listening on port %s...", server.address().port); }); -function sendFile(req, res, authorized) { - const token = req.cookies['AccessToken']; +function sendFile(req, res, size, authorized) { + const cookie = (authDeprecated)?req.cookies['AccessToken']:req.cookies['openAIRESession']; const file = req.file; var filepath = (localPath ? "." : __dirname) + "/" + file.path; - if (!token) { + if (!cookie) { res.status(401).send(getResponse(401, "Unauthorized")); deleteFile(filepath); } else if (!file || (file.mimetype !== 'image/jpeg' && file.mimetype !== 'image/png')) { res.status(500).send(getResponse(500, "No image file type")); deleteFile(filepath); - } else if (file.size > maxsize) { + } else if (file.size > size) { res.status(500).send(getResponse(500, "Exceeds file size limit")); deleteFile(filepath); } else { - http.get(auth + token, function (resp) { - var responseString = ""; - resp.on("data", function (data) { - responseString += data; - }); - resp.on("end", function () { - var result = JSON.parse(responseString); - if (result.error) { - res.status(401).send(getResponse(401, "Unauthorized")); - deleteFile(filepath); - } else { - if (authorized(result)) { - res.send(file); - } else { - res.status(401).send(getResponse(401, "Unauthorized")); - deleteFile(filepath); - } - } - }); + getUserInfo(authorized, req, res, () => { + res.send(file); }); } } function deleteFileSend(req, res, authorized) { - const token = req.cookies['AccessToken']; - if (!token) { + const cookie = (authDeprecated)?req.cookies['AccessToken']:req.cookies['openAIRESession']; + if (!cookie) { res.status(401).send(getResponse(401, "Unauthorized")); } else { - http.get(auth + token, function (resp) { - var responseString = ""; - resp.on("data", function (data) { - responseString += data; - }); - resp.on("end", function () { - var result = JSON.parse(responseString); - if (result.error) { - res.status(401).send(getResponse(401, "Unauthorized")); - } else { - // if user id is on filename or is Admin delete file else unauthorized. - if (authorized) { - deleteFile('./uploads/' + req.params.filename); - return res.status(200).send(getResponse(200, "File Deleted Successfully")); - } else { - res.status(401).send(getResponse(401, "Unauthorized")); - } - } - }); + getUserInfo(authorized, req, res, () => { + deleteFile('./uploads/' + req.params.filename, res); }); } } +function getUserInfo(authorized, req, res, success) { + let url = (authDeprecated)?(auth + cookie):auth; + http.get(url, {headers: {Cookie: req.header('Cookie')}}, function (resp) { + var responseString = ""; + resp.on("data", function (data) { + responseString += data; + }); + resp.on("end", function () { + var result = JSON.parse(responseString); + if (result.error) { + res.status(401).send(getResponse(401, "Unauthorized")); + } else { + if (authorized(result)) { + success(); + } else { + res.status(401).send(getResponse(401, "Unauthorized")); + } + } + }); + }); +} + function getResponse(code, message) { var response = {}; response["code"] = code; @@ -204,71 +161,46 @@ function getResponse(code, message) { return response; } -function deleteFile(filepath) { +function deleteFile(filepath, res = null) { const fs = require('fs'); fs.stat(filepath, function (err, stats) { - console.log(stats); //here we got all information of file in stats variable - if (err) { return console.error(err); } - - fs.unlink(filepath, function (err) { - if (err) return console.log(err); + try{ + fs.unlinkSync(filepath); console.log('file deleted successfully'); - }); + if(res) { + res.send("File Deleted Successfully"); + } + } catch (err) { + console.error(err); + } }); } -function isMonitorCurator(roles) { - var isAdmin = false; - var isCurator = false; - for (var i = 0; i < roles.length; i++) { - if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') { - isAdmin = true; - } - if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Funder#aai.openaire.eu') { - isCurator = true; - } - } - return isAdmin || isCurator; -} - -function isAdminOrCurator(roles) { - var isAdmin = false; - var isCurator = false; - for (var i = 0; i < roles.length; i++) { - if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') { - isAdmin = true; - } - if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Community#aai.openaire.eu') { - isCurator = true; - } - } - return isAdmin || isCurator; -} - -function checkCookies(request) { - var valid = true; - var cookieValue = request.cookies.AccessToken; - if (cookieValue === undefined || cookieValue === '') { - console.log("no cookie available"); - valid = false; - } else if (!hasValidOrigin(request.headers.origin)) { - console.log("no proper origin"); - valid = false; - } - return valid; -} - - -function hasValidOrigin(origin) { - if (origin !== undefined && origin.indexOf(originServer) !== -1) { - return true; +function mapType(type, communityMap = true) { + if(type === 'organization') { + return 'institution'; + } else if(type === 'ri' && communityMap) { + return 'community'; } else { - console.log("Not valid origin. Origin server is \"" + origin + - "\", but expected value is \"" + originServer + - "\". If the expected value is not right, check originServer variable."); - return false; + return type; } } + +function isPortalAdmin(roles) { + return roles.includes("PORTAL_ADMINISTRATOR"); +} + +function isAnyCurator(roles) { + return roles.filter(role => role.includes("CURATOR_")).length > 0; +} + +function isCurator(type, roles) { + return roles.includes("CURATOR_" + mapType(type).toUpperCase()); +} + +function isManager(type, id, roles) { + return roles.includes(mapType(type).toUpperCase() + "_" + id.toUpperCase() + "_MANAGER"); +}