@financial-times/s3o-lambda/index.js

'use strict';

const s3oMiddlewareUtils = require('@financial-times/s3o-middleware-utils');
const got = require('got');
const querystring = require('querystring');

const {
	USERNAME: S3O_USERNAME,
	TOKEN: S3O_TOKEN,
	DEFAULT_EXPIRY: S3O_DEFAULT_EXPIRY
} = s3oMiddlewareUtils.cookies;

const publicKeyCache = new Map();

const getHost = (event) => {
	const forwardingHost = event.headers['X-FT-Forwarding-Host'];
	if (forwardingHost) {
		return forwardingHost;
	}
	// respect the host header Fastly sets if override host is chosen in the UI
	const fastlyOriginalHost = event.headers['Fastly-Orig-Host'];
	if (fastlyOriginalHost) {
		return fastlyOriginalHost;
	}
	return event.headers.Host;
}

const getPath = (event, host) => {
	const forwardingPath = event.headers['X-FT-Forwarding-Path'];
	if (forwardingPath) {
		return forwardingPath;
	}
	if (host.includes('amazonaws.com')) {
		return `/${event.requestContext.stage}${event.path}`;
	}
	return event.path;
}

const getRedirectUrl = (event, opts) => {
	const query = Object.assign({}, event.queryStringParameters);
	// remove S3O related parameters
	delete query.username;
	delete query.token;
	const queryString = querystring.stringify(query);
	const suffix = queryString ? `?${queryString}` : '';
	const host = opts.getHost(event);
	const path = opts.getPath(event, host);

	return `${opts.protocol}://${host}${path}${suffix}`;
};

const getFromCookie = (cookie, key) => {
	const match = cookie.match(new RegExp(key + '=([^;]*)'));
	if (Array.isArray(match) && match.length > 0) {
		return match[1];
	}
	return '';
};

const getAuthFromCookie = (cookie) => ({
	username: getFromCookie(cookie, S3O_USERNAME),
	token: getFromCookie(cookie, S3O_TOKEN),
});

const authenticate = async(s3oClientName, cookie) => {
	const publicKey = await s3oMiddlewareUtils.publickey.get({ cache: publicKeyCache });
	const auth = getAuthFromCookie(cookie);
	return s3oMiddlewareUtils
		// s3oMiddlewareUtils.authenticate expects a synchronous public key getter
		.authenticate(() => publicKey)
		.authenticateToken(auth.username, s3oClientName, auth.token);
};

const requireFunction = (func, message) => {
	if (typeof func !== 'function') {
		throw new Error(message);
	}
}

const getCookieOptions = (opts) => `; Max-Age=${opts.cookies.maxAge}` +
	`${opts.cookies.secure ? '; Secure' : ''}` +
	`${opts.cookies.httpOnly ? '; HttpOnly' : ''}`

const badRequest = (statusCode, error, headers = {}) => ({
	statusCode,
	body: JSON.stringify({ error }),
	headers: Object.assign({
		'Content-Type': 'application/json',
	}, headers)
})

const internalServerError = (error, message) => ({
	statusCode: 500,
	body: JSON.stringify({message, error}),
	headers: {
		'Content-Type': 'application/json',
	}
})

const redirectResponse = (location, headers = {}) => ({
	statusCode: 302,
	headers: Object.assign({
		location,
		'Cache-Control': 'no-cache, private, max-age=0',
	}, headers)
})

// trick to vary case to include two Set-Cookie headers
const setCookies2 = (cookieValues) => ({
	'Set-Cookie': cookieValues[0],
	'set-cookie': cookieValues[1]
})

// Response from s3o, redirect the user to the redirect URL, setting s3o cookies
const s3oResponseRedirect = (opts, redirectUrl, query) => {
	const cookieOptions = getCookieOptions(opts);

	return redirectResponse(redirectUrl, setCookies2([
		`${S3O_USERNAME}=${query.username}; Path=/${cookieOptions}`,
		`${S3O_TOKEN}=${query.token}; Path=/${cookieOptions}`,
	]));
}

// Redirect the user to s3o
const s3oAuthenticateRedirect = (opts, queryParameters, headers) =>
	redirectResponse(`https://s3o.ft.com/v3/authenticate?${queryParameters}`, headers)

const getResponse = (cookies, isSignedIn = false) => {
	const {username} = getAuthFromCookie(cookies)
	return {
		username: username === '' ? undefined : username,
		isSignedIn,
	};
};

module.exports = async(event, callback, userOpts = {}) => {
	const opts = Object.assign({
		redirect: true,
		protocol: 'https',
	}, userOpts);
	opts.getHost = userOpts.getHost || getHost;
	opts.getPath = userOpts.getPath || getPath;
	opts.cookies = Object.assign({
		httpOnly: true,
		secure: opts.protocol === 'https',
		maxAge: S3O_DEFAULT_EXPIRY,
	}, userOpts.cookies || {})

	let s3oClientName;

	if (typeof opts.getHost === 'string') {
		const host = opts.getHost;
		opts.getHost = () => host;
	}
	requireFunction(opts.getHost,
		'The option \'getHost\' must be a function which returns a host string or a constant string. This is used in a redirectURL');
	if (typeof opts.getPath === 'string') {
		const path = opts.getPath;
		opts.getPath = () => path;
	}
	requireFunction(opts.getPath,
		'The option \'getPath\' must be a function which returns a path segment or a constant string, to be used in a redirectURL');

	opts.getS3oClientName = userOpts.getS3oClientName || opts.getHost;
	if (typeof opts.getS3oClientName === 'string') {
		s3oClientName = opts.getS3oClientName;
		opts.getS3oClientName = () => s3oClientName;
	} else if  (typeof opts.getS3oClientName === 'function') {
		s3oClientName = opts.getS3oClientName(event);
	}
	requireFunction(opts.getS3oClientName,
		'The option \'getS3oClientName\' must be a function which returns an ID or a constant string ID. Only requests with a matching ID are authorised by the returned s3o_token from S3O');

	if (!s3oClientName) {
		throw new Error(`The option \'getS3oClientName\' returned \'${s3oClientName}\'. This function must return a non-empty value`);
	}

	const query = event.queryStringParameters || {};
	const cookie = event.headers && event.headers.Cookie ? event.headers.Cookie : '';

	if (opts.redirect) {
		if (query.username && query.token) {
			callback(null, s3oResponseRedirect(opts, getRedirectUrl(event, opts), query))

			return getResponse(cookie, false);
		}
		if (!(cookie.includes(S3O_USERNAME) && cookie.includes(S3O_TOKEN))) {
			const queryString = querystring.stringify({
				host: s3oClientName,
			});
			// redirect needs to be unencoded in the query stringfor s3o to work correctly
			callback(null, s3oAuthenticateRedirect(opts, `${queryString}&redirect=${getRedirectUrl(event, opts)}`));

			return getResponse(cookie, false);
		}
	}

	try {
		const isSignedIn = await authenticate(s3oClientName, cookie);

		if (!isSignedIn) {
			callback(null, badRequest(401, 'Not authenticated', setCookies2([
				`${S3O_USERNAME}=; expires=Thu, 01 Jan 1970 00:00:00 GMT`,
				`${S3O_TOKEN}=; expires=Thu, 01 Jan 1970 00:00:00 GMT`,
			])));
		}
		return getResponse(cookie, isSignedIn);
	} catch (error) {
		callback(null, internalServerError(error, 'Failed to retrieve S3O public key'));
		return getResponse(cookie, false);
	}
};