@axway/axway-flow-authorization/src/credentialmanager.js

const fs = require('fs');
const path = require('path');
const { promisify } = require('util');
const handlers = require('./handlers');
const { status, States } = require('./status');

const readFileAsync = promisify(fs.readFile);
const statAsync = promisify(fs.stat);

const REFRESH_POLICY_BEFOREEXPIRY = 'beforeexpiry';
const REFRESH_POLICY_ONEXPIRY = 'onexpiry';
const REFRESH_POLICY_PERIODIC = 'periodic';
const DEFAULT_BEFOREEXPIRY_SECONDS = 60;
const DEFAULT_PERIODIC_SECONDS = 3600;

const RETRY_INTERVAL = 15000;

// Asynchronously load the authorization templates
const authTemplates = {};
Object.keys(handlers).forEach(handler => {
	authTemplates[`${handler}Callback`] = loadTemplate(`${handler}Callback`, '');
	authTemplates[`${handler}Error`] = loadTemplate(`${handler}Error`, '');
});

/**
 * Load the authorization templates required by the middleware.
 * @param {string} template The name of the template file to load.
 * @param {string} defText The default if the file does not exist.
 * @return {Promise} A promise that resolves with the template content.
 */
function loadTemplate(template, defText) {
	const templatePath = path.join(__dirname, 'template', `${template}.html`);
	return statAsync(templatePath)
		.then(() => readFileAsync(templatePath))
		.then((buf) => buf.toString())
		.catch(() => Promise.resolve(defText));
}

/**
 * @module axway-flow-authorization
 */
/**
* Singleton wrapper.
* @private
*/
class Singleton {
	static declare(key, Clazz) {
		const globalSymbols = Object.getOwnPropertySymbols(global);
		const symbol = Symbol.for(key);
		const exists = (globalSymbols.indexOf(symbol) > -1);
		// no dupes
		/* istanbul ignore else */
		if (!exists) {
			global[symbol] = new Clazz();
		}
		Object.defineProperty(Clazz, 'instance', {
			get: () => {
				return global[symbol];
			}
		});
		Object.freeze(Clazz);
	}

	static get(key) {
		const globalSymbols = Object.getOwnPropertySymbols(global);
		const symbol = Symbol.for(key);
		const exists = (globalSymbols.indexOf(symbol) > -1);

		if (!exists) {
			throw new Error(`failed to find singleton: ${key}`);
		}
		return global[symbol];
	}
}

/**
* The credential manager service.
* Manages credentials and attempts to keep them evergreen.
*
* Shape of an OAuth2 credential:
* onedrive: {
*	access_token: <currentaccess token>,
*	type: 'oauth2',
*	token_url: <token url>,
*	client_id: <client id>,
*	client_secret: <client secret>,
*	redirect_uri: <redirect uri>,
*	refresh_token: <refresh token>
* }
*
* Shape of apikey/unmanaged auth:
* myservice: 'mykey'
*
* Shape of basic auth:
* myservice: {
*   username: 'username',
*   password: 'password'
* }
*
* @public
* @class
*/
class CredentialManager {
	/**
	* Constructs a CredentialManager.  The instance is a singleton.
	* @private
	*/
	constructor() {
		this.credentials = {};
		this.scheduler = {};
		this.middleware = this.middleware.bind(this);
	}

	/**
	 * Set the logger.
	 * @param {object} logger The logger.
	 * @public
	 */
	setLogger(logger) {
		this.logger = logger;
	}

	/**
	 * Return the managed credential config.
	 * @param {string} name The credential name to get.
	 * @returns {Obejct} The managed credential config.
	 * @public
	 */
	getCredentialConfig(name) {
		if (!this.credentials.hasOwnProperty(name)) {
			return;
		}
		return JSON.parse(JSON.stringify(this.credentials[name]));
	}

	/**
	 * Return all the managed credential configs.
	 * @returns {Array} A list of the managed credential configs.
	 * @public
	 */
	getCredentialConfigs() {
		return Object.keys(this.credentials)
			.map(name => this.getCredentialConfig(name))
			.reduce((credConfigs, credConfig) => {
				credConfigs[credConfig.name] = credConfig;
				return credConfigs;
			}, {});
	}

	/**
	 * Returns the named credential.
	 * @param {string} name The name of the credential to retrieve.
	 * @returns {*} The named credential or null if no credential exists.
	 * @public
	 */
	getCredential(name) {
		const cred = this.credentials.hasOwnProperty(name) && this.credentials[name];
		if (cred && ((!cred.expiry) || cred.expiry >= Date.now())) {
			if (cred.type && handlers[cred.type] && handlers[cred.type].token) {
				return handlers[cred.type].token(cred);
			} else {
				// Untyped bare token
				return cred.token;
			}
		}
		// Credential not found/expired
		return null;
	}

	/**
	 * Remove all managed credentials and stop all schedules.
	 * @public
	 */
	clear() {
		Object.values(this.scheduler).forEach((timeout) => {
			timeout.expiry && clearTimeout(timeout.expiry);
			timeout.refresh && clearTimeout(timeout.refresh);
		});
		this.scheduler = {};
		this.credentials = {};
	}

	/**
	 * Initialize the config for the service. If the config contains a `credentials` section
	 * those credentials will be added to the CredentialManager.
	 *
	 * @param {object} config The credential manager config.
	 * @param {object|string} config.credentials The credential to managa.
	 * @public
	 */
	set config(config) {
		const { credentials, ...options } = config;
		this.options = options || {};
		this.clear();
		Object.entries(credentials || {}).forEach(([ name, credential ]) => {
			if (typeof credential === 'string') {
				credential = {
					name,
					token: credential
				};
			} else if (typeof credential === 'object') {
				credential = JSON.parse(JSON.stringify(credential));
				credential.name = name;
			} else {
				this.logger && this.logger
					.error(`Credential ${name} is not a supported type ${typeof credential}`);
				credential = null;
			}
			credential && this.addCredential(credential);
		});
	}

	/**
	 * Add a credential to be managed.
	 * @param {object} credential The credential to manage.
	 * @param {string} credential.name The name of the credential.
	 * @param {long} credential.expiry The expiration time of the current credential.
	 * @param {string} credential.type The type of the credential.
	 * @param {*} credential.token The current credential value (e.g. access token for oauth).
	 * @param {string} credential.refreshPolicy The refresh policy of the credential.
	 *
	 * @public
	 */
	addCredential(credential) {
		this.logger && this.logger.debug(`Adding credential: ${credential.name}`);
		credential.status = status.ok(); // Unless proven otherwise.

		// Allow type specific credential initialization (e.g. allow oauth to
		// determine the status of the credential config).
		if (handlers[credential.type]) {
			const { initCredential } = handlers[credential.type];
			initCredential && initCredential(this.options, credential);
		}

		// Clear any schedules for the credential if overwriting an existing credential
		if (this.scheduler[credential.name]) {
			const { refresh, expiry } = this.scheduler[credential.name];
			expiry && clearTimeout(expiry);
			refresh && clearTimeout(refresh);
		}
		this.scheduler[credential.name] = {};
		this.credentials[credential.name] = credential;

		// Schedule the status update on credential expiry
		this.scheduleExpiry(credential);

		// Refresh the credential to ensure we have valid credential
		this.refresh(credential);
	}

	/**
	 * Remove the named credential from the store.
	 * @param {string} name The name of the credential to remove.
	 */
	removeCredential(name) {
		this.logger && this.logger.debug(`Removing credential: ${name}`);
		if (this.scheduler && this.scheduler[name]) {
			const { expiry, refresh } = this.scheduler[name];
			expiry && clearTimeout(expiry);
			refresh && clearTimeout(refresh);
		}
		delete this.scheduler[name];
		delete this.credentials[name];
	}

	/**
	 * Is the credential refreshable.
	 *
	 * @param {object} credential The credential to check refreshability on.
	 * @returns {boolean} true if the credential supports refresh, false otherwise.
	 * @public
	 */
	isRefreshableCredential(credential) {
		let refreshable = false;
		if (credential && credential.type && handlers[credential.type]
				&& handlers[credential.type].refresh && handlers[credential.type].refreshable) {
			refreshable = handlers[credential.type].refreshable(credential);
		}
		return refreshable;
	}

	/**
	 * Refresh the credential and schedule the next refresh.
	 * @param {object} credential The credential to refresh.
	 * @private
	 */
	refresh(credential) {
		if (!this.isRefreshableCredential(credential)) {
			return;
		}

		this.logger && this.logger.debug(`Credential: ${credential.name} refreshing`);
		handlers[credential.type].refresh(credential).then(
			(newCred) => {
				this.credentials[newCred.name] = newCred;
				this.scheduleExpiry(newCred);

				if (this.isRefreshableCredential(newCred)) {
					const next = this.scheduleNextRefresh(newCred);
					this.logger && this.logger
						.debug(`Credential: ${newCred.name} refreshed. Next refresh in ${next}ms.`);
				} else {
					this.logger && this.logger.debug(`Credential: ${newCred.name} refreshed.`);
				}
			},
			(err) => {
				if (!this.credentials[credential.name]) {
					// Credential was already removed, so we don't care about any errors
					// and should not try to refresh it again either.
					return;
				}
				// TODO: This probably needs exponential back off and the ability to identify
				// terminal errors.
				credential.status = status(credential.status, {
					action: States.action.refreshError
				});
				const next = this.scheduleNextRefresh(
					this.credentials[credential.name], RETRY_INTERVAL);
				this.logger && this.logger
					.error(`Credential: ${credential.name} refresh failed. Next refresh in ${next}ms. ${err ? (err.message || err) : ''}`);
			}
		).catch((err) => {
			this.logger && this.logger
				.error(`Credential: ${credential.name} scheduled refresh failed. ${err.message || err}`);
		});
	}

	/**
	 * Schedule the next refresh of the credential.
	 *
	 * @param {object} credential The credential to schedule refresh for.
	 * @param {number} wait The number of ms to schedule retry in, if not set then
	 *                      it is calculated from the credential's refresh policy.
	 * @returns {number} The number of milliseconds until the next refresh.
	 * @private
	 */
	scheduleNextRefresh(credential, wait = -1) {
		if (wait < 0) {
			if (!credential.refreshPolicy
				|| credential.refreshPolicy === REFRESH_POLICY_BEFOREEXPIRY) {
				if (credential.expiry) {
					// Refresh N seconds before expiry
					const now = Date.now();
					const offset = (credential.refreshOffset
						|| DEFAULT_BEFOREEXPIRY_SECONDS) * 1000;
					wait = ((credential.expiry - offset) || now) - now;
				}
			} else if (credential.refreshPolicy === REFRESH_POLICY_ONEXPIRY) {
				// Refresh on expiry
				if (credential.expiry) {
					const now = Date.now();
					wait = (credential.expiry || now) - now;
				}
			} else if (credential.refreshPolicy === REFRESH_POLICY_PERIODIC) {
				// Refresh every N seconds
				wait = (credential.refreshPeriod || DEFAULT_PERIODIC_SECONDS) * 1000;
			} else {
				// Unknown policy
				throw new Error(`Invalid refresh policy: ${credential.refreshPolicy}`);
			}
		}

		// Cleanup any pending schedules.
		this.scheduler[credential.name].refresh
			&& clearTimeout(this.scheduler[credential.name].refresh);
		this.scheduler[credential.name].refresh = null;

		// Schedule the next refresh
		if (wait >= 0) {
			this.scheduler[credential.name].refresh = setTimeout(() => {
				this.scheduler[credential.name].refresh = null;
				this.refresh(credential);
			}, wait);
			this.scheduler[credential.name].refresh.unref();
		}

		return wait;
	}

	/**
	 * Actively update the status when the credential expires.
	 *
	 * @param {object} credential The credential to monitor expiry on.
	 */
	scheduleExpiry(credential) {
		this.scheduler[credential.name].expiry
			&& clearTimeout(this.scheduler[credential.name].expiry);
		if (credential.expiry) {
			this.scheduler[credential.name].expiry = setTimeout(() => {
				const newstatus = {
					credential: States.credential.expired
				};
				if (this.isRefreshableCredential(credential)
					&& credential.status
					&& credential.status.action === States.action.none) {
					newstatus.action = States.action.needsRefresh;
				}
				credential.status = status(credential.status, newstatus);
			}, credential.expiry - Date.now());

			this.scheduler[credential.name].expiry.unref();
		} else {
			this.scheduler[credential.name].expiry = null;
		}
	}

	/**
	 * Middleware to handle credential callbacks exposed by credential manager.
	 *
	 * @param {object} req The request.
	 * @param {object} res The response.
	 * @returns {object} Middleware response.
	 */
	async middleware(req, res) {
		const name = req.query.state;

		if (!this.credentials.hasOwnProperty(name)
				|| !this.credentials[name].type
				|| !handlers[this.credentials[name].type].authorize) {
			return res.status(404).send();
		}

		try {
			const credential = this.credentials[name];
			const newCred = await handlers[credential.type].authorize(credential, { ...req.query });
			this.credentials[newCred.name] = newCred;
			this.scheduleExpiry(newCred);
			if (this.isRefreshableCredential(newCred)) {
				const next = this.scheduleNextRefresh(newCred);
				this.logger && this.logger
					.debug(`Credential: ${newCred.name} acquired. Next refresh in ${next}ms.`);
			} else {
				this.logger && this.logger
					.debug(`Credential: ${newCred.name} acquired.`);
			}

			const respText = await authTemplates[`${credential.type}Callback`];
			res.status(200)
				.set('Content-Type', 'text/html')
				.send(respText);
		} catch (ex) {
			this.credentials[name].status = status(this.credentials[name].status, {
				action: States.action.authError
			});
			this.logger && this.logger.error(ex);
			const respText = await authTemplates[`${this.credentials[name].type}Error`];
			res.status(401)
				.set('Content-Type', 'text/html')
				.send(respText);
		}
	}
}

Singleton.declare('axway-flow-authorization-credential-manager', CredentialManager);

exports = module.exports = Singleton.get('axway-flow-authorization-credential-manager');