From c98c41476980409e7bf8630c1ad64de8fcb256b0 Mon Sep 17 00:00:00 2001 From: ShootingStar91 Date: Sun, 14 Jul 2024 23:30:45 +0300 Subject: [PATCH] Add environment variable that enables write operations, default is disabled unless in dev --- .anon.env | 13 +++++++++---- backend/src/index.ts | 9 +++++++-- backend/src/middlewares/misc.ts | 11 +++++++++++ backend/src/routes/locality.ts | 2 +- backend/src/utils/config.ts | 3 +++ data/restore_and_create_user.sql | 2 ++ test_data/restore_and_create_user.sql | 9 ++++----- 7 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 backend/src/middlewares/misc.ts diff --git a/.anon.env b/.anon.env index f1dd5b85..a32e6180 100644 --- a/.anon.env +++ b/.anon.env @@ -5,13 +5,18 @@ USER_CREATION_SECRET: abcdefg NOWDB_BACKEND_PORT: 4000 LOGIN_VALID_MINUTES: 120 BACKEND_MODE: dev + +MARIADB_USER: now_test MARIADB_HOST: nowdb-db-anon MARIADB_ROOT_PASSWORD: admin -MARIADB_PORT: 3306 MARIADB_PASSWORD: mariadb_password -NOW_DB_NAME: now_anon -LOG_DB_NAME: now_log_anon -COORDINATOR: IZ +MARIADB_PORT: 3306 +NOW_DB_NAME: now_test +LOG_DB_NAME: now_log_test + +COORDINATOR: TEST-SU + +ENABLE_WRITE: true RUNNING_ENV: dev VITE_RUNNING_ENV: dev diff --git a/backend/src/index.ts b/backend/src/index.ts index 084fd150..4dd57953 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -15,22 +15,27 @@ import userRouter from './routes/user' import { responseLogger } from './middlewares/requestLogger' import compression from 'compression' import { logger } from './utils/logger' -import { PORT, RUNNING_ENV } from './utils/config' +import { ENABLE_WRITE, PORT, RUNNING_ENV } from './utils/config' import { tokenExtractor, userExtractor } from './middlewares/authenticator' import { errorHandler } from './middlewares/errorHandler' import { createTestUsers } from './services/user' import { testDbConnection } from './utils/db' import { requireOneOf } from './middlewares/authorizer' import { Role } from './../../frontend/src/types' +import { blockWriteRequests } from './middlewares/misc' const app = express() app.use(express.json({ limit: '50mb' })) app.use(cors()) app.use(compression()) +app.use(responseLogger) + +if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') { + app.use(blockWriteRequests) +} app.use(tokenExtractor) app.use(userExtractor) -app.use(responseLogger) app.use('/user', userRouter) app.use('/locality', localityRouter) diff --git a/backend/src/middlewares/misc.ts b/backend/src/middlewares/misc.ts new file mode 100644 index 00000000..58d5d16d --- /dev/null +++ b/backend/src/middlewares/misc.ts @@ -0,0 +1,11 @@ +import { Middleware } from '../types' + +/* Disables all write routes except the ones excluded by "allowedRoutes" */ +export const blockWriteRequests: Middleware = (req, res, next) => { + const allowedRoutes = ['/user/login'] + const writeMethods = ['POST', 'PUT', 'PATCH', 'DELETE'] + if (writeMethods.includes(req.method) && !allowedRoutes.includes(req.path)) { + return res.status(403).send() + } + return next() +} diff --git a/backend/src/routes/locality.ts b/backend/src/routes/locality.ts index df54de0a..7160b026 100644 --- a/backend/src/routes/locality.ts +++ b/backend/src/routes/locality.ts @@ -30,7 +30,7 @@ router.put( if (validationErrors.length > 0) { return res.status(400).send({ validationErrors }) } - const result = await write(editedLocality, 'now_loc', { authorizer: 'IZ', userName: 'testuser' }) + const result = await write(editedLocality, 'now_loc', { authorizer: 'TEST-SU', userName: 'testuser' }) return res.status(200).send(result ? { result: result } : { error: 'error' }) } ) diff --git a/backend/src/utils/config.ts b/backend/src/utils/config.ts index cc5eba92..6d3331e0 100644 --- a/backend/src/utils/config.ts +++ b/backend/src/utils/config.ts @@ -15,6 +15,9 @@ const allowedRunningEnvs = ['dev', 'staging', 'prod'] as const export const RUNNING_ENV = process.env.RUNNING_ENV as (typeof allowedRunningEnvs)[number] if (!allowedRunningEnvs.includes(RUNNING_ENV)) throw new Error('Invalid RUNNING_ENV') +// Enable write operations. If this is not set to 'true', all write (create, update, delete) operations except for allowed ones (like user/login) are disabled. +export const ENABLE_WRITE = process.env.ENABLE_WRITE === 'true' + export const DB_CONNECTION_LIMIT = (process.env.DB_CONNECTION_LIMIT as string) ?? '10' export const NOW_DB_NAME = process.env.NOW_DB_NAME as string export const LOG_DB_NAME = process.env.LOG_DB_NAME as string diff --git a/data/restore_and_create_user.sql b/data/restore_and_create_user.sql index 36d644e6..662bc185 100755 --- a/data/restore_and_create_user.sql +++ b/data/restore_and_create_user.sql @@ -2,6 +2,7 @@ DROP DATABASE IF EXISTS now_test; CREATE DATABASE now_test CHARACTER SET latin1; DROP DATABASE IF EXISTS now_log_test; CREATE DATABASE now_log_test CHARACTER SET latin1; SET names 'latin1'; + USE now_test SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_test.sql USE now_log_test @@ -12,3 +13,4 @@ SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_view.sql CREATE USER 'now_test'@'localhost' IDENTIFIED BY 'mariadb_password'; GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%'; GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%'; + diff --git a/test_data/restore_and_create_user.sql b/test_data/restore_and_create_user.sql index cb88380d..c456c2ef 100755 --- a/test_data/restore_and_create_user.sql +++ b/test_data/restore_and_create_user.sql @@ -3,13 +3,12 @@ DROP DATABASE IF EXISTS now_test; CREATE DATABASE now_test CHARACTER SET latin1; DROP DATABASE IF EXISTS now_log_test; CREATE DATABASE now_log_test CHARACTER SET latin1; SET names 'latin1'; -CREATE USER 'now_test'@'%' IDENTIFIED BY 'mariadb_password'; - -GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%'; -GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%'; - USE now_test SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_anon.sql USE now_log_test SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_log_anon.sql USE now_test + +CREATE USER 'now_test'@'localhost' IDENTIFIED BY 'mariadb_password'; +GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%'; +GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%';