@motif/api/lib/Controller.js

"use strict"

const _ = require("lodash")
const jwt = require("jsonwebtoken")
const path = require("path")
const glob = require("glob")
const Model = require("./Model")
const Debugger = require("./Debugger")

const debug = new Debugger('motif:controller')

class Controller {
  get service() {
    return this._service
  }

  get config() {
    return this._service._config
  }

  get contentType() {
    return this._service.contentType
  }

  constants(key) {
    let constants = process.motif.constants || {}
    return constants[key.toUpperCase()] || {}
  }

  model(key, connection = null) {
    let models = process.motif.models
    let modelData = models[key]
    if (!modelData) {
      return null
    }

    let config = this.config
    let design = modelData.design
    let model = new modelData.constructor({design, config})
    if (connection) {
      model.setCollection(design.createCollection(connection))
    }

    return model
  }

  verifyParams(request, fields, errorFields = []) {
    let params = request.params || {}

    debug.log("verifyParams", fields, params)

    _.each(fields, field => {
      if (typeof field === "string") {
        let name = field
        let param =
          params[name] ?
          params[name] :
          request.method.toUpperCase() === "GET" ||
          request.method.toUpperCase() === "DELETE" ?
          request.query[name] :
          request.body[name]

        debug.log("param", name, param)
        if (param === undefined) {
          errorFields.push(name)
        }
        params[field] = param
      } else {
        let { name, type } = field
        let param =
          params[name] ?
          params[name] :
          request.method.toUpperCase() === "GET" ||
          request.method.toUpperCase() === "DELETE" ?
          request.query[name] :
          request.body[name]

        debug.log("param", name, param)
        if (field.optional !== true) {
          if (param === undefined) {
            errorFields.push(name)
          } else {
            let isValid = true
            switch (type) {
            default:
            case "string":
              if (!_.isString(param) || param === '') isValid = false
              break
            case "number":
              if (!_.isNumber(param)) isValid = false
              break
            case "array":
              if (!_.isArray(param)) isValid = false
              break
            case "object":
              if (!_.isObject(param)) isValid = false
              break
            case "file":
            case "boolean":
              break
            }
            if (!isValid) {
              debug.debug("invalid type param", name, typeof param, param)
              errorFields.push(name)
            }
          }
        }
        params[name] = param
      }
    })

    request.params = params

    debug.log("errorFields", errorFields, params)
    return errorFields.length > 0 ? false : true
  }

  checkParams(request, response, params, next) {
    debug.log("checkParams", params)

    let invalidParams = []

    if (!this.verifyParams(request, params, invalidParams)) {
      return this.onError(response, "INSUFFICIENT_PARAMS", {
        'invalid-params': invalidParams.join(',')
      })
    }

    next()
  }

  generateToken(userInfo) {
    const config = this._authConfig

    debug.log("generateToken", userInfo, config)

    const token = jwt.sign(userInfo, config.tokenSecret, {
      algorithm: config.tokenAlgorithm,
      expiresIn: config.expiresTokenIn
    })

    return token
  }

  isValidToken(token, refresh, callback) {
    debug.log("isValidToken", token, refresh)

    const config = this._authConfig
    jwt.verify(token, config.tokenSecret, (err, decode) => {
      if (err) {
        if (err.message === 'jwt malformed') {
          callback({ isValid: false, error: new Error('INVALID_TOKEN'), status: 401 })
        }
        else {
          callback({ isValid: false, error: err })
        }
        return
      }

      const exp = +new Date(decode.exp * 1000)
      const now = Date.now()

      if (exp < now) {
        let error = new Error("Expired Token")
        callback({ isValid: false, error })
        return
      }

      if (refresh === true) {
        const refreshsIn = exp - now
        const isNeedToRefresh = ((config.expiresTokenIn * 1000) - refreshsIn) > config.refreshsTokenIn * 1000 ? true : false

        if (isNeedToRefresh) {
          let userInfo = Object.assign(decode)

          delete userInfo["exp"]
          delete userInfo["iat"]

          const newToken = this.generateToken(userInfo)
          callback({ isValid: true, newToken, userInfo: userInfo })
          return
        }
      }

      callback({ isValid: true, userInfo: decode })
    })
  }

  getAccessToken(request) {
    const authorization = request.headers["authorization"]
    const jwtConfig = this.config.get('jwt')

    debug.log("getAccessToken", authorization, jwtConfig)

    if (authorization) {
      if (typeof authorization !== "string") {
        return null
      }
      const matches = authorization.match(/(\S+)\s+(\S+)/)
      const authHeaders = matches && { scheme: matches[1], value: matches[2] }
      if (authHeaders && authHeaders.scheme.toLowerCase() === "bearer") {
        debug.log("authHeaders", authHeaders)
        return authHeaders.value
      }
    } else if (request.headers["X-API-Key"]) {
      debug.log("X-API-Key", request.headers["X-API-Key"])
      return request.headers["X-API-Key"]
    } else if (request.headers["x-access-token"]) {
      debug.log("x-access-token", request.headers["x-access-token"])
      return request.headers["x-access-token"]
    }
    else if (this.config.mode !== 'production' && jwtConfig && jwtConfig.testToken) {
      return jwtConfig.testToken
    }

    return null
  }

  checkToken(request, response, refresh, next) {
    let token = this.getAccessToken(request)
    debug.log("checkToken", token, refresh)

    if (!token) {
      return this.onUnauthorized(response)
    }

    request.token = token

    this.isValidToken( token, refresh, ({ status, error, isValid, newToken, userInfo }) => {
      if (error) {
        if (status) { response.status(status) }
        return this.onError(response, error.message, {})
      }

      if (isValid === false) {
        return this.onError(response, "INVALID_TOKEN", {})
      }

      if (!userInfo) {
        return this.onUnauthorized(response)
      }

      if (newToken) {
        request.newToken = newToken
      }

      request.userInfo = userInfo || {}
      next()
    })
  }

  parseToken(request, response, next) {
    let token = this.getAccessToken(request)
    debug.log("parseToken", token)

    if (token) {
      request.token = token

      this.isValidToken( token, false, ({ error, isValid, newToken, userInfo }) => {
        request.userInfo = userInfo || {}
        next()
      })
    } else {
      request.userInfo = {}
      next()
    }
  }

  parseDeviceInfo(request, response, next) {

    if (request.headers["x-device-info"]) {
      debug.log("parseDeviceInfo", request.headers["x-device-info"])

      try {
        let jsonString = request.headers["x-device-info"]
        let deviceInfo = JSON.parse(jsonString)

        request.deviceInfo = deviceInfo
      }
      catch(e) {
        request.deviceInfo = {}
      }
    }
    else {
      request.deviceInfo = {}
    }

    next()
  }

  onUnauthorized(response) {
    debug.log("onUnauthorized")

    response.status(401)
    return this.onError(response, "Unauthorized Error", {})
  }

  generateRouters(options) {
    let { router, service, routers } = options

    routers.forEach(routerOption => {
      const { controllers, params, permissions, description } = routerOption
      const routePath = routerOption.path
      const method = routerOption.method && routerOption.method.toLowerCase() || "GET"

      if (!router[method] || !["get", "post", "put", "delete"].includes(method)) {
        throw new Error("invalid method " + routePath)
      }

      if (controllers.length === 0 || typeof controllers[0] !== "function") {
        throw new Error("invalid controller " + routePath + " method " + method)
      }

      let middlewares = []

      if (params) {
        middlewares.push((request, response, next) => {
          this.checkParams(request, response, params, next)
        })
      }

      if (permissions) {
        if (permissions.includes("token") || permissions.includes("admin")) {
          middlewares.push((request, response, next) => {
            this.checkToken( request, response, permissions.includes("refresh"), next )
          })
        } else {
          middlewares.push((request, response, next) => {
            this.parseToken(request, response, next)
          })
        }

        if (permissions.includes("device")) {
          middlewares.push((request, response, next) => {
            this.parseDeviceInfo(request, response, next)
          })
        }
      }

      const handlers = controllers.map((handler) => {
        try {
          return async (request, response, next) => {
            let requestId = debug.requestStart(request)

            try {
              const result = await handler.call(this, request, response, next)

              if (typeof result === 'undefined' || typeof result === 'number') {
                this.onStatus(response, result)
                return debug.requestEnd(requestId, "status")
              }

              this.onSuccess(response, result)
              return debug.requestEnd(requestId, "success")
            } catch (e) {
              this.onError(response, e, {})
              return debug.requestEnd(requestId, "error")
            }
          }
        }
        catch(e) {
          return this.onError(response, 'Unknown Error', {})
        }
      })

      const args = [path.join(options.path || "", routePath), ...middlewares, ...handlers]

      debug.log("register router", method, args)

      router[method].apply(router, args)

      routerOption.routePath = path.join(this._service.path, options.path || "", routePath)
      routerOption.group = this._service.name
      routerOption.tags = _.uniq(_.merge(_.clone(this._tags || []), routerOption.tags || []))

      process.motif._routerPaths.push(routerOption)
    })

    debug.log("generateRouters", process.motif._routerPaths.length)
  }

  jsonResponse(response, data) {
    data = data || {}

    debug.log("jsonResponse", this.contentType, data)

    response.set({ "content-type": this.contentType })
    response.json(data)
  }

  onStatus(response, status) {
    let message

    switch(status) {
      case 100:
        message = 'Continue'
        break
      case 101:
        message = 'Switching Protocol'
        break
      case 102:
        message = 'Processing (WebDAV)'
        break
      case 103:
        message = 'Early Hints'
        break
      case 200:
        message = 'OK'
        break
      case 201:
        message = 'Created'
        break
      case 202:
        message = 'Accepted'
        break
      case 203:
        message = 'Non-Authoritative Information'
        break
      case 204:
        message = 'No Content'
        break
      case 205:
        message = 'Reset Content'
        break
      case 206:
        message = 'Partial Content'
        break
      case 207:
        message = 'Multi-Status (WebDAV)'
        break
      case 208:
        message = 'Multi-Status (WebDAV)'
        break
      case 226:
        message = 'IM Used (HTTP Delta encoding)'
        break
      case 300:
        message = 'Multiple Choice'
        break
      case 301:
        message = 'Moved Permanently'
        break
      case 302:
        message = 'Found'
        break
      case 303:
        message = 'See Other'
        break
      case 304:
        message = 'Not Modified'
        break
      case 305:
        message = 'Use Proxy'
        break
      case 306:
        message = 'Unused'
        break
      case 307:
        message = 'Temporary Redirect'
        break
      case 308:
        message = 'Permanent Redirect'
        break
      case 400:
        message = 'Bad Request'
        break
      case 401:
        message = 'Unauthorized'
        break
      case 402:
        message = 'Payment Required'
        break
      case 403:
        message = 'Forbidden'
        break
      case 404:
        message = 'Not Found'
        break
      case 405:
        message = 'Method Not Allowed'
        break
      case 406:
        message = 'Not Acceptable'
        break
      case 407:
        message = 'Proxy Authentication Required'
        break
      case 408:
        message = 'Request Timeout'
        break
      case 409:
        message = 'Conflict'
        break
      case 410:
        message = 'Gone'
        break
      case 411:
        message = 'Length Required'
        break
      case 412:
        message = 'Precondition Failed'
        break
      case 413:
        message = 'Payload Too Large'
        break
      case 414:
        message = 'URI Too Long'
        break
      case 415:
        message = 'Unsupported Media Type'
        break
      case 416:
        message = 'Requested Range Not Satisfiable'
        break
      case 417:
        message = 'Expectation Failed'
        break
      case 418:
        message = 'I\'m a teapot'
        break
      case 421:
        message = 'Misdirected Request'
        break
      case 422:
        message = 'Unprocessable Entity (WebDAV)'
        break
      case 423:
        message = 'Locked (WebDAV)'
        break
      case 424:
        message = 'Failed Dependency (WebDAV)'
        break
      case 425:
        message = 'Too Early'
        break
      case 426:
        message = 'Upgrade Required'
        break
      case 428:
        message = 'Precondition Required'
        break
      case 429:
        message = 'Too Many Requests'
        break
      case 431:
        message = 'Request Header Fields Too Large'
        break
      case 451:
        message = 'Unavailable For Legal Reasons'
        break
      case 500:
        message = 'Internal Server Error'
        break
      case 501:
        message = 'Not Implemented'
        break
      case 502:
        message = 'Bad Gateway'
        break
      case 503:
        message = 'Service Unavailable'
        break
      case 504:
        message = 'Gateway Timeout'
        break
      case 505:
        message = 'HTTP Version Not Supported'
        break
      case 506:
        message = 'Variant Also Negotiates'
        break
      case 507:
        message = 'Insufficient Storage'
        break
      case 508:
        message = 'Loop Detected (WebDAV)'
        break
      case 510:
        message = 'Not Extended'
        break
      case 511:
        message = 'Network Authentication Required'
        break
      default:
        message = 'Unknown'
        break
    }

    debug.log("status", status, message)
  }

  onSuccess(response, data) {
    debug.log("success", data)

    this.jsonResponse(response, { status: "success", data: data })
  }

  onError(response, error, data) {
    debug.log("error", error)

    let errorMessage = _.isError(error) ? error.message : error

    this.jsonResponse(response, { status: "error", error: errorMessage, data: data })
  }

  constructor({ service }) {
    debug.log("controller", service)

    let config = service.config.get("jwt")

    this._service = service
    this._authConfig = {
      tokenSecret: config.tokenSecret || 'secure',
      tokenAlgorithm: config.tokenAlgorithm || 'HS256',
      expiresTokenIn: config.expiresTokenIn || (60 * 60 * 24 * 7),
      refreshsTokenIn: config.refreshsTokenIn || (60 * 60 * 24 * 2)
    }


    // Auto Binding
    const controller = this
    const propertyNames = Object.getOwnPropertyNames( this.constructor.prototype )

    _.each(propertyNames, propertyName => {
      if (propertyName.indexOf("on") === 0) {
        this[propertyName] = this[propertyName].bind(controller)
      }
    })
  }

  static __autoLoad( cwd, options = {}) {
    let handlers = []
    let { excludesAll, excludes, includes } = options
    let rule = options.rule || "handlers/*.js"
    let files = glob.sync(rule, { cwd: cwd })

    let priorityHandlers = {
      high: [],
      medium: [],
      low: []
    }

    _.each(files, file => {
      let filePath = path.resolve(cwd, file)

      let isIgnore = excludesAll === true

      if (excludes) {
        _.forEach(excludes, exclude => {
          if (filePath.indexOf(exclude) !== -1) {
            isIgnore = true
          }
        })
      }

      if (includes) {
        _.forEach(includes || [], include => {
          if (filePath.indexOf(include) !== -1) {
            isIgnore = false
          }
        })
      }

      if (!isIgnore) {
        delete require.cache[filePath]
        let handler = require(filePath)
        if (handler.priority === 'high') {
          priorityHandlers.high.push(handler)
        }
        else if (handler.defer === 'low' || handler.defer === true) {
          priorityHandlers.low.push(handler)
        }
        else {
          priorityHandlers.medium.push(handler)
        }
      }
    })

    _.each(priorityHandlers.high, handler => {
      handlers.push(handler)
    })

    _.each(priorityHandlers.medium, handler => {
      handlers.push(handler)
    })

    _.each(priorityHandlers.low, handler => {
      handlers.push(handler)
    })

    return handlers
  }
}

module.exports = Controller