Skip to content

Commit

Permalink
move http config into conf.d/http.yml
Browse files Browse the repository at this point in the history
  • Loading branch information
msimerson committed Feb 19, 2024
1 parent ba2a4b2 commit cf7ece6
Show file tree
Hide file tree
Showing 10 changed files with 89 additions and 42 deletions.
4 changes: 4 additions & 0 deletions conf.d/http.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@

default:
host: localhost
port: 3000
3 changes: 1 addition & 2 deletions lib/config.js
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,7 @@ function applyDefaults(cfg = {}, defaults = {}) {
for (const d in defaults) {
if (cfg[d] === undefined) {
cfg[d] = defaults[d]
}
else if (typeof cfg[d] === 'object' && typeof defaults[d] === 'object') {
} else if (typeof cfg[d] === 'object' && typeof defaults[d] === 'object') {
cfg[d] = applyDefaults(cfg[d], defaults[d])
}
}
Expand Down
7 changes: 0 additions & 7 deletions lib/session.js
Original file line number Diff line number Diff line change
@@ -1,12 +1,5 @@
// const crypto = require('crypto')
// const { createHmac, pbkdf2 } = require('node:crypto')

const Mysql = require('./mysql')

// const User = require('./user')

// const validate = require('@nictool/nt-validate')

class Session {
constructor() {}

Expand Down
28 changes: 14 additions & 14 deletions lib/user.js
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
// const crypto = require('crypto')
const { createHmac, pbkdf2 } = require('node:crypto')
const crypto = require('node:crypto')
const validate = require('@nictool/nt-validate')

const mysql = require('./mysql')

const validate = require('@nictool/nt-validate')

class User {
constructor() {}
constructor(args) {
this.debug = args?.debug ?? false
}

async authenticate(authTry) {
// console.log(authTry)
if (this.debug) console.log(authTry)
let [username, group] = authTry.username.split('@')
if (!group) group = 'NicTool'

Expand Down Expand Up @@ -64,11 +64,11 @@ class User {
)
}

async delete(args) {
async delete(args, val) {
const u = await this.read({ nt_user_id: args.nt_user_id })
if (u.length === 1) {
await mysql.execute(`UPDATE nt_user SET deleted=1 WHERE nt_user_id=?`, [
u[0].nt_user_id,
await mysql.execute(`UPDATE nt_user SET deleted=? WHERE nt_user_id=?`, [
val ?? 1, u[0].nt_user_id,
])
}
}
Expand Down Expand Up @@ -106,7 +106,7 @@ class User {
async hashAuthPbkdf2(pass, salt) {
return new Promise((resolve, reject) => {
// match the defaults for NicTool 2.x
pbkdf2(pass, salt, 5000, 32, 'sha512', (err, derivedKey) => {
crypto.pbkdf2(pass, salt, 5000, 32, 'sha512', (err, derivedKey) => {
if (err) return reject(err)
resolve(derivedKey.toString('hex'))
})
Expand All @@ -118,16 +118,16 @@ class User {

if (salt) {
const hashed = await this.hashAuthPbkdf2(passTry, salt)
// console.log(`hashed: (${hashed === passDb}) ${hashed}`)
if (this.debug) console.log(`hashed: (${hashed === passDb}) ${hashed}`)
return hashed === passDb
}

// Check for HMAC SHA-1 password
if (/^[0-9a-f]{40}$/.test(passDb)) {
const digest = createHmac('sha1', username.toLowerCase())
const digest = crypto.createHmac('sha1', username.toLowerCase())
.update(passTry)

Check failure

Code scanning / CodeQL

Use of password hash with insufficient computational effort High

Password from
an access to password
is hashed insecurely.
.digest('hex')
// console.log(`digest: (${digest === passDb}) ${digest}`)
if (this.debug) console.log(`digest: (${digest === passDb}) ${digest}`)
return digest === passDb
}

Expand All @@ -142,7 +142,7 @@ class User {
AND s.nt_user_session = ?`

const session = await mysql.execute(query, [sessionId])
console.log(session)
if (this.debug) console.log(session)
return session[0]
}

Check warning on line 147 in lib/user.js

View check run for this annotation

Codecov / codecov/patch

lib/user.js#L138-L147

Added lines #L138 - L147 were not covered by tests
}
Expand Down
15 changes: 5 additions & 10 deletions lib/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,8 @@ exports.setEnv = () => {
console.log(`NODE_ENV: ${process.env.NODE_ENV}`)

Check warning on line 12 in lib/util.js

View check run for this annotation

Codecov / codecov/patch

lib/util.js#L12

Added line #L12 was not covered by tests
}

// exports.meta = {
// api: {
// version: require('../package.json').version,
// }
// }

// exports.asInt = function (i) {
// if (parseInt(i, 10)) return parseInt(i, 10)
// return
// }
exports.meta = {
api: {
version: require('../package.json').version,
},
}
12 changes: 7 additions & 5 deletions routes/index.js
Original file line number Diff line number Diff line change
@@ -1,24 +1,26 @@
'use strict'

const hapi = require('@hapi/hapi')
// const hoek = require('@hapi/hoek')
const path = require('node:path')

const hapi = require('@hapi/hapi')
const qs = require('qs')
// const hoek = require('@hapi/hoek')
// const validate = require('@nictool/nt-validate')

const util = require('../lib/util')
util.setEnv()
const config = require('../lib/config')
const user = require('../lib/user')
// const session = require('../lib/session')
const UserRoutes = require('./user')

let server

const setup = async () => {
const httpCfg = await config.get('http')

server = hapi.server({
port: 3000,
host: 'localhost',
port: httpCfg.port,
host: httpCfg.host,
query: {
parser: (query) => qs.parse(query),
},
Expand Down
21 changes: 19 additions & 2 deletions test/config.js
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,13 @@ describe('config', function () {
assert.deepEqual(cfg, mysqlTestCfg)
})

it(`loads mysql cov config (from cache)`, async function () {
process.env.NODE_DEBUG = 1
const cfg = await config.get('mysql', 'cov')
assert.deepEqual(cfg, mysqlTestCfg)
process.env.NODE_DEBUG = ''
})

it(`loads session test config`, async function () {
const cfg = await config.get('session', 'test')
assert.deepEqual(cfg, sessCfg)
Expand All @@ -29,6 +36,11 @@ describe('config', function () {
const cfg = config.getSync('session', 'test')
assert.deepEqual(cfg, sessCfg)
})

it(`loads http test config syncronously`, function () {
const cfg = config.getSync('http', 'test')
assert.deepEqual(cfg, httpCfg)
})
})
})

Expand All @@ -50,7 +62,12 @@ const sessCfg = {
isSecure: false,
name: 'sid-nictool',
password: '^NicTool.Is,The#Best_Dns-Manager$',
path: '/'
path: '/',
},
keepAlive: false
keepAlive: false,
}

const httpCfg = {
host: 'localhost',
port: 3000,
}
8 changes: 8 additions & 0 deletions test/mysql.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,14 @@ describe('mysql', () => {
assert.ok(this.dbh.connection.connectionId)
})

if (process.env.NODE_ENV='cov') {

Check failure on line 12 in test/mysql.js

View workflow job for this annotation

GitHub Actions / lint / lint

Expected a conditional expression and instead saw an assignment

Check failure on line 12 in test/mysql.js

View workflow job for this annotation

GitHub Actions / lint / lint

Unexpected constant condition

Check failure on line 12 in test/mysql.js

View workflow job for this annotation

GitHub Actions / lint / lint

Expected a conditional expression and instead saw an assignment

Check failure on line 12 in test/mysql.js

View workflow job for this annotation

GitHub Actions / lint / lint

Unexpected constant condition
it('is noisy when debug=true', async () => {
mysql.debug(true)
await mysql.execute(`SHOW DATABASES`)
await mysql.select(`SELECT * FROM nt_group`)
})
}

it('disconnects', async () => {
assert.ok(this.dbh.connection.connectionId)
await mysql.disconnect(this.dbh)
Expand Down
13 changes: 11 additions & 2 deletions test/user.js
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ after(async () => {

describe('user', function () {
describe('read', function () {
it('finds existing user by nt_user_id', async function () {
it('finds existing user by nt_user_id', async () => {
const u = await user.read({ nt_user_id: 4096 })
// console.log(u)
assert.deepEqual(u[0], {
Expand All @@ -42,7 +42,7 @@ describe('user', function () {
})
})

it('finds existing user by username', async function () {
it('finds existing user by username', async () => {
const u = await user.read({ username: 'unit-test' })
// console.log(u)
assert.deepEqual(u[0], {
Expand All @@ -55,6 +55,15 @@ describe('user', function () {
deleted: 0,
})
})

it('deletes a user', async () => {
await user.delete({ nt_user_id: 4096 })
let u = await user.read({ nt_user_id: 4096 })
assert.equal(u[0].deleted, 1)
await user.delete({ nt_user_id: 4096 }, 0) // restore
u = await user.read({ nt_user_id: 4096 })
assert.equal(u[0].deleted, 0)
})
})

describe('get_perms', function () {
Expand Down
20 changes: 20 additions & 0 deletions test/util.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
const assert = require('node:assert/strict')
const { describe, it } = require('node:test')

const util = require('../lib/util')

describe('util', function () {
describe('setEnv', function () {
it('sets process.env.NODE_ENV', async () => {
assert.equal(process.env.NODE_ENV, undefined)
util.setEnv()
assert.ok(process.env.NODE_ENV)
})
})

describe('meta', () => {
it('returns the package version', () => {
assert.deepEqual(util.meta, { api: { version: '3.0.0' } })
})
})
})

0 comments on commit cf7ece6

Please sign in to comment.