@leisurelink/trusted-endpoint/lib/signature-parser.js

'use strict';

var util = require('util');
var Promise = require('bluebird');
var errors = require('@leisurelink/http-equiv-errors');
var _ = require('lodash');
var assert = require('assert-plus');

function takePrincipalId(id) {
  var ids = id.split('/');
  return ids[0];
}

function takeKeyId(id) {
  var ids = id.split('/');
  return (ids.length > 1) ? ids[1] : '';
}

var requiredHeaders = {
  POST: ['host', 'date', 'request-line', 'content-length'],
  PUT: ['host', 'date', 'request-line', 'content-length'],
  PATCH: ['host', 'date', 'request-line', 'content-length'],
  GET: ['host', 'date', 'request-line'],
  DELETE: ['host', 'date', 'request-line']
};

function hasRequiredHeaders(method, headers) {
  method = method.toUpperCase();
  return !_.isEmpty(requiredHeaders[method]) &&
    _.isEmpty(_.difference(requiredHeaders[method], headers));
}

module.exports = function SignatureParser(httpSignature, authentic, logger, allowLaxParsing) {
  assert.object(httpSignature, 'httpSignature');
  assert.object(authentic, 'authentic');
  assert.object(logger, 'logger');

  var getEndpointKey = function(lang, keyId) {
    return new Promise(function(resolve, reject){
      authentic.getEndpointKey(lang, takePrincipalId(keyId), takeKeyId(keyId), function(err, response, body) {
        if (err){
          return reject(err);
        }
        return resolve({
          response: response,
          body: body
        });
      });
    });
  };

  var laxParseFromHeaders = function(req) {
    return Promise.try(function(){
      return {
        scheme: 'LaxSignature',
        params: {
          keyId: req.headers['x-lax-key-id'],
          algorithm: 'fake',
          headers: req.headers['x-lax-headers'].split(' '),
          jwt: req.headers['x-lax-jwt'],
          signature: 'fake'
        },
        signingString: 'fake'
      };
    });
  };

  var _parse = function(req, lax) {
    return Promise.try(function(){
      return httpSignature.parseRequest(req);
    }).catch(function(err) {
      logger.warn(util.format('No remote authority; unsupported authorization scheme: %s', req.headers.authorization), err);
      return null;
    }).then(function(result){
      if (!result && lax){
        return laxParseFromHeaders(req);
      }
      return result;
    });
  };

  var verify = function(method, parsed, key, lax) {
    return Promise.try(function(){
      if (parsed.scheme === 'LaxSignature' && lax) {
        return false;
      }
      if (!key){
        throw new errors.UnauthorizedError('authentic:signing-key-not-found');
      }
      return httpSignature.verifySignature(parsed, key);
    }).then(function(verified){
      if (verified) {
        if (hasRequiredHeaders(method, parsed.params.headers))
          return parsed;
        else
          return null;
      }
      if (lax) {
        logger.warn('Endpoint signature not verified. Call may be inauthentic. authentic:signature-inauthentic');
        return parsed;
      } else {
        throw new errors.UnauthorizedError('authentic:signature-inauthentic');
      }
    });
  };

  var parse = function(req) {
    var _parsed, _lax;
    return Promise.resolve(allowLaxParsing)
      .then(function(unwrappedLax){
        _lax = unwrappedLax;
        return _parse(req, unwrappedLax);
      })
      .then(function(parsed){
        _parsed = parsed;
        if (!_parsed || !_parsed.params || !_parsed.params.keyId) {
          return _parsed;
        }
        return getEndpointKey('en-US', parsed.params.keyId).then(function(key){
          return verify(req.method, _parsed, key.body.result.key, _lax);
        }).catch(function(err){
          if (err.name != 'NotFoundError'){
            throw err;
          }
        });
      });

  };

  return { parse: parse };
};