MaDgIK
/
explore-services
13
0
Fork 0
Code Issues Pull Requests Projects Releases 23 Wiki Activity

Update authorization base on new roles. Create new methods for upload and delete

This commit is contained in:
Konstantinos Triantafyllou 2021-11-25 18:53:59 +02:00
parent c268a3ae2c
commit f8ede1d232
5 changed files with 94 additions and 151 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
services/utils-service/beta-properties.file
View File

@ -1,7 +1,7 @@
userInfoUrl = https://beta.services.openaire.eu/uoa-user-management/api/users/getUserInfo?accessToken=
originServer = .openaire.eu
post.allowed = /upload,/upload/
userInfoUrl = https://beta.services.openaire.eu/login-service/userInfo
ssl = true
localPath = false
# photo size in KB
photo.size = 200
max.size = 200
# file size in KB
big-max.size = 1000

3
services/utils-service/package.json
View File

@ -15,8 +15,7 @@
"cors": "^2.8.4",
"express": "^4.15.2",
"multer": "^1.1.0",
"properties-reader": "0.0.16",
"tinyurl": "^1.1.4"
"properties-reader": "0.0.16"
},
"engines": {
"node": "16.3.0"

6
services/utils-service/production-properties.file
View File

@ -1,7 +1,7 @@
userInfoUrl = https://services.openaire.eu/uoa-user-management/api/users/getUserInfo?accessToken=
originServer = .openaire.eu
post.allowed = /upload,/upload/
ssl = true
localPath = false
# photo size in KB
photo.size = 200
max.size = 200
# file size in KB
big-max.size = 1000

8
services/utils-service/properties.file
View File

@ -1,7 +1,7 @@
userInfoUrl = http://dl170.madgik.di.uoa.gr:8180/dnet-openaire-users-1.0.0-SNAPSHOT/api/users/getUserInfo?accessToken=
originServer = .di.uoa.gr
post.allowed = /upload,/upload/
userInfoUrl = http://mpagasas.di.uoa.gr:8080/login-service/userInfo
ssl = false
localPath = true
# photo size in KB
photo.size = 200
max.size = 200
# file size in KB
big-max.size = 1000

206
services/utils-service/uploadService.js
View File

@ -4,31 +4,28 @@ var cookieParser = require('cookie-parser');
var multer = require("multer");
var PropertiesReader = require('properties-reader');
var properties = PropertiesReader('./properties.file');
var TinyURL = require('tinyurl');
var app = express();
var http = null;
// Properties
if (properties.get('ssl')) {
http = require("https");
} else {
http = require("http");
}
// Properties
var auth = properties.get('userInfoUrl');
var originServer = properties.get('originServer');
var allowPostRequests = properties.get('post.allowed').split(',');
/** @deprecated*/
var authDeprecated = auth.includes("accessToken");
var localPath = properties.get('localPath');
var maxsize = properties.get('photo.size') * 1024;
var maxSize = properties.get('max.size') * 1024;
var bigMaxSize = properties.get('big-max.size') * 1024;
var storage = multer.diskStorage({
destination: function (req, file, cb) {
cb(null, 'uploads')
},
filename: function (req, file, cb) {
if (req.params.id) {
cb(null, req.params.id + '-' + new Date().getTime() + '.' + file.originalname.split('.').pop());
cb(null, req.params.id + (req.params.filename?('-' + req.params.filename):'') +
'-' + new Date().getTime() + '.' + file.originalname.split('.').pop());
} else {
cb(null, file.originalname);
}
@ -42,40 +39,25 @@ app.use(bodyParser.urlencoded({extended: true}));
app.use(cookieParser());
app.use(function (req, res, next) {
if((req.method === 'POST' || req.method === 'DELETE') && allowPostRequests.indexOf(req.url.split('?')[0]) === -1) {
if(checkCookies(req)) {
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-xsrf-token');
res.header('Access-Control-Allow-Credentials', true);
next();
} else {
res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Credentials', true);
res.header('Vary', 'Origin');
res.status(403).send(getResponse(403, "Forbidden: You don't have permission to access. Maybe you are not registered."));
}
} else if(req.method === 'OPTIONS' && allowPostRequests.indexOf(req.url.split('?')[0]) === -1){
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Credentials', true);
res.header('Access-Control-Allow-Methods', 'POST, DELETE');
res.header('Access-Control-Allow-Methods', 'GET, OPTIONS, POST, DELETE');
res.header('Access-Control-Max-Age', 1800);
res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, x-xsrf-token');
next();
} else {
res.header('Access-Control-Allow-Origin', req.headers.origin);
res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
next();
}
});
app.get('/download/:filename', function (req, res) {
res.download('./uploads/' + req.params.filename);
});
app.post("/upload", upload.array("uploads[]", 12), function (req, res) {
var filepath = (localPath ? "." : __dirname) + "/" + req.files[0].path;
let type = req.query.type;
console.log(type);
if(type == 'json' && req.files[0].mimetype !== 'application/json'){
if (type === 'json' && req.files[0].mimetype !== 'application/json') {
console.error("No proper file type");
res.status(500).send(getResponse(500, "No proper file type"));
}else if ((!type || type == 'csv') && req.files[0].mimetype !== 'text/csv' && req.files[0].mimetype !== 'application/vnd.ms-excel') {
} else if ((!type || type === 'csv') && req.files[0].mimetype !== 'text/csv' && req.files[0].mimetype !== 'application/vnd.ms-excel') {
console.error("No proper file type");
res.status(500).send(getResponse(500, "No proper file type"));
} else {
@ -88,65 +70,53 @@ app.post("/upload", upload.array("uploads[]", 12), function (req, res) {
});
app.post('/upload/stakeholder/:id', upload.single('photo'), (req, res) => {
sendFile(req, res, (result) => {
return isMonitorCurator(result.edu_person_entitlements);
});
});
app.post('/upload/:id', upload.single('photo'), (req, res) => {
sendFile(req, res, (result) => {
return result.sub.indexOf(req.params.id) !== -1 || isAdminOrCurator(result.edu_person_entitlements);
});
});
app.get('/download/:filename', function (req, res) {
res.download('./uploads/' + req.params.filename);
});
app.get('/tiny', function (req, res) {
TinyURL.shorten(req.query.url, function (res1, err) {
if (err)
console.log(err)
if (res1 !== 'Error') {
res.send(res1);
app.post(['/upload/:id', '/upload/stakeholder/:id', '/upload/:type/:id', '/upload/:type/:id/:filename'], upload.single('photo'), (req, res) => {
let fileMaxSize = (req.query.big)?bigMaxSize:maxSize
sendFile(req, res, fileMaxSize, (result) => {
let type = req.params['type'];
let id = req.params['id'];
let roles = result.roles;
if(type) {
return isPortalAdmin(roles) || isCurator(type, roles) || isManager(type, id, roles);
} else {
res.send(req.query.url);
return result.sub.indexOf(id) !== -1 || isPortalAdmin(roles) || isAnyCurator(roles);
}
});
});
app.delete('/delete/stakeholder/:filename', function (req, res) {
app.delete(['/delete/:filename', '/delete/stakeholder/:filename', '/delete/:type/:id/:filename'], function (req, res) {
deleteFileSend(req, res, (result) => {
return isMonitorCurator(result.edu_person_entitlements);
})
let roles = result.roles;
let type = req.params['type'];
let id = req.params['id'];
if(type && id) {
return isPortalAdmin(roles) || isCurator(type, roles) || isManager(type, id, roles);
} else {
return result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isPortalAdmin(roles) || isAnyCurator(roles);
}
});
app.delete('/delete/:filename', function (req, res) {
deleteFileSend(req, res, (result) => {
return result.sub.indexOf(req.params.filename.split('-')[0]) !== -1 || isAdminOrCurator(result.edu_person_entitlements);
})
});
const server = app.listen(8000, function () {
console.log("Listening on port %s...", server.address().port);
});
function sendFile(req, res, authorized) {
const token = req.cookies['AccessToken'];
function sendFile(req, res, size, authorized) {
const cookie = (authDeprecated)?req.cookies['AccessToken']:req.cookies['openAIRESession'];
const file = req.file;
var filepath = (localPath ? "." : __dirname) + "/" + file.path;
if (!token) {
if (!cookie) {
res.status(401).send(getResponse(401, "Unauthorized"));
deleteFile(filepath);
} else if (!file || (file.mimetype !== 'image/jpeg' && file.mimetype !== 'image/png')) {
res.status(500).send(getResponse(500, "No image file type"));
deleteFile(filepath);
} else if (file.size > maxsize) {
} else if (file.size > size) {
res.status(500).send(getResponse(500, "Exceeds file size limit"));
deleteFile(filepath);
} else {
http.get(auth + token, function (resp) {
let url = (authDeprecated)?(auth + token):auth;
http.get(url, {headers: {Cookie: req.header('Cookie')}}, function (resp) {
var responseString = "";
resp.on("data", function (data) {
responseString += data;
@ -170,11 +140,12 @@ function sendFile(req, res, authorized) {
}
function deleteFileSend(req, res, authorized) {
const token = req.cookies['AccessToken'];
if (!token) {
const cookie = (authDeprecated)?req.cookies['AccessToken']:req.cookies['openAIRESession'];
if (!cookie) {
res.status(401).send(getResponse(401, "Unauthorized"));
} else {
http.get(auth + token, function (resp) {
let url = (authDeprecated)?(auth + cookie):auth;
http.get(url, {headers: {Cookie: req.header('Cookie')}}, function (resp) {
var responseString = "";
resp.on("data", function (data) {
responseString += data;
@ -184,10 +155,8 @@ function deleteFileSend(req, res, authorized) {
if (result.error) {
res.status(401).send(getResponse(401, "Unauthorized"));
} else {
// if user id is on filename or is Admin delete file else unauthorized.
if (authorized) {
deleteFile('./uploads/' + req.params.filename);
return res.status(200).send(getResponse(200, "File Deleted Successfully"));
if (authorized(result)) {
deleteFile('./uploads/' + req.params.filename, res);
} else {
res.status(401).send(getResponse(401, "Unauthorized"));
}
@ -204,71 +173,46 @@ function getResponse(code, message) {
return response;
}
function deleteFile(filepath) {
function deleteFile(filepath, res = null) {
const fs = require('fs');
fs.stat(filepath, function (err, stats) {
console.log(stats); //here we got all information of file in stats variable
if (err) {
return console.error(err);
}
fs.unlink(filepath, function (err) {
if (err) return console.log(err);
try{
fs.unlinkSync(filepath);
console.log('file deleted successfully');
});
if(res) {
res.send("File Deleted Successfully");
}
} catch (err) {
console.error(err);
}
});
}
function isMonitorCurator(roles) {
var isAdmin = false;
var isCurator = false;
for (var i = 0; i < roles.length; i++) {
if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') {
isAdmin = true;
}
if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Funder#aai.openaire.eu') {
isCurator = true;
}
}
return isAdmin || isCurator;
}
function isAdminOrCurator(roles) {
var isAdmin = false;
var isCurator = false;
for (var i = 0; i < roles.length; i++) {
if (roles[i] === 'urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu') {
isAdmin = true;
}
if (roles[i] === 'urn:geant:openaire.eu:group:Curator+-+Community#aai.openaire.eu') {
isCurator = true;
}
}
return isAdmin || isCurator;
}
function checkCookies(request) {
var valid = true;
var cookieValue = request.cookies.AccessToken;
if (cookieValue === undefined || cookieValue === '') {
console.log("no cookie available");
valid = false;
} else if (!hasValidOrigin(request.headers.origin)) {
console.log("no proper origin");
valid = false;
}
return valid;
}
function hasValidOrigin(origin) {
if (origin !== undefined && origin.indexOf(originServer) !== -1) {
return true;
function mapType(type, communityMap = true) {
if(type === 'organization') {
return 'institution';
} else if(type === 'ri' && communityMap) {
return 'community';
} else {
console.log("Not valid origin. Origin server is \"" + origin +
"\", but expected value is \"" + originServer +
"\". If the expected value is not right, check originServer variable.");
return false;
return type;
}
}
function isPortalAdmin(roles) {
return roles.includes("PORTAL_ADMINISTRATOR");
}
function isAnyCurator(roles) {
return roles.filter(role => role.includes("CURATOR_")).length > 0;
}
function isCurator(type, roles) {
return roles.includes("CURATOR_" + mapType(type).toUpperCase());
}
function isManager(type, id, roles) {
return roles.includes(mapType(type).toUpperCase() + "_" + id.toUpperCase() + "_MANAGER");
}