Skip to content

Commit 81cad60

Browse files
megatnt1122megatnt1122
committed
refactor: Authz logging improvements
1 parent 163cb62 commit 81cad60

File tree

2 files changed

+174
-45
lines changed

2 files changed

+174
-45
lines changed

‎core/database/foxx/api/authz_router.js‎

Lines changed: 120 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,29 @@ const g_lib = require("./support");
88
const error = require("./lib/error_codes");
99
const permissions = require("./lib/permissions");
1010
const authzModule = require("./authz");
11+
const logger = require("./lib/logger");
1112
const { Repo, PathType } = require("./repo");
12-
13+
const basePath = "authz";
1314
module.exports = router;
1415

1516
router
1617
.get("/gridftp", function (req, res) {
18+
let client = null;
1719
try {
18-
console.log(
19-
"/gridftp start authz client",
20-
req.queryParams.client,
21-
"repo",
22-
req.queryParams.repo,
23-
"file",
24-
req.queryParams.file,
25-
"act",
26-
req.queryParams.act,
27-
);
20+
client = g_lib.getUserFromClientID(req.queryParams.client);
21+
logger.logRequestStarted({
22+
client: client?._id,
23+
correlationId: req.headers["x-correlation-id"],
24+
httpVerb: "GET",
25+
routePath: basePath + "/gridftp",
26+
status: "Started",
27+
description: JSON.stringify({
28+
message: "Checks authorization",
29+
repo: req.queryParams.repo,
30+
file: req.queryParams.file,
31+
act: req.queryParams.act,
32+
}),
33+
});
2834

2935
// Client will contain the following information
3036
//
@@ -39,33 +45,15 @@ router
3945
// "max_sav_qry" : 20,
4046
// :
4147
// "email" : "[email protected]"
42-
const client = g_lib.getUserFromClientID_noexcept(req.queryParams.client);
48+
client = g_lib.getUserFromClientID_noexcept(req.queryParams.client);
4349
if (!client) {
44-
console.log(
45-
"AUTHZ act: " +
46-
req.queryParams.act +
47-
" client: " +
48-
+req.queryParams.client +
49-
" path " +
50-
req.queryParams.file +
51-
" FAILED",
52-
);
5350
throw [error.ERR_PERM_DENIED, "Unknown client: " + req.queryParams.client];
5451
}
5552
let repo = new Repo(req.queryParams.repo);
5653
let path_type = repo.pathType(req.queryParams.file);
5754

5855
// If the provided path is not within the repo throw an error
5956
if (path_type === PathType.UNKNOWN) {
60-
console.log(
61-
"AUTHZ act: " +
62-
req.queryParams.act +
63-
" client: " +
64-
client._id +
65-
" path " +
66-
req.queryParams.file +
67-
" FAILED",
68-
);
6957
throw [
7058
error.ERR_PERM_DENIED,
7159
"Unknown path, or path is not consistent with supported repository folder hierarchy: " +
@@ -83,16 +71,43 @@ router
8371
} else {
8472
throw [error.ERR_INVALID_PARAM, "Invalid gridFTP action: ", req.queryParams.act];
8573
}
86-
console.log(
87-
"AUTHZ act: " +
88-
req.queryParams.act +
89-
" client: " +
90-
client._id +
91-
" path " +
92-
req.queryParams.file +
93-
" SUCCESS",
94-
);
74+
logger.logRequestSuccess({
75+
client: client?._id,
76+
correlationId: req.headers["x-correlation-id"],
77+
httpVerb: "GET",
78+
routePath: basePath + "/gridftp",
79+
status: "Success",
80+
description: JSON.stringify({
81+
message: "Checks authorization",
82+
repo: req.queryParams.repo,
83+
file: req.queryParams.file,
84+
act: req.queryParams.act,
85+
}),
86+
extra: {
87+
id: client?._id,
88+
is_admin: client?.is_admin,
89+
},
90+
});
9591
} catch (e) {
92+
logger.logRequestFailure({
93+
client: client?._id,
94+
correlationId: req.headers["x-correlation-id"],
95+
httpVerb: "GET",
96+
routePath: basePath + "/gridftp",
97+
status: "Failure",
98+
description: JSON.stringify({
99+
message: "Checks authorization",
100+
repo: req.queryParams.repo,
101+
file: req.queryParams.file,
102+
act: req.queryParams.act,
103+
}),
104+
extra: {
105+
id: client?._id,
106+
is_admin: client?.is_admin,
107+
},
108+
error: e,
109+
});
110+
96111
g_lib.handleException(e, res);
97112
}
98113
})
@@ -113,12 +128,23 @@ router
113128

114129
router
115130
.get("/perm/check", function (req, res) {
131+
let client = null;
132+
let result = null;
116133
try {
117-
const client = g_lib.getUserFromClientID(req.queryParams.client);
134+
client = g_lib.getUserFromClientID(req.queryParams.client);
135+
logger.logRequestStarted({
136+
client: client?._id,
137+
correlationId: req.headers["x-correlation-id"],
138+
httpVerb: "GET",
139+
routePath: basePath + "/perm/check",
140+
status: "Started",
141+
description: "Checks client permissions for object",
142+
});
143+
118144
var perms = req.queryParams.perms ? req.queryParams.perms : permissions.PERM_ALL;
119-
var obj,
120-
result = true,
121-
id = g_lib.resolveID(req.queryParams.id, client),
145+
var obj;
146+
result = true;
147+
var id = g_lib.resolveID(req.queryParams.id, client),
122148
ty = id[0];
123149

124150
if (id[1] != "/") {
@@ -172,7 +198,26 @@ router
172198
res.send({
173199
granted: result,
174200
});
201+
logger.logRequestSuccess({
202+
client: client?._id,
203+
correlationId: req.headers["x-correlation-id"],
204+
httpVerb: "GET",
205+
routePath: basePath + "/perm/check",
206+
status: "Success",
207+
description: "Checks client permissions for object",
208+
extra: result,
209+
});
175210
} catch (e) {
211+
logger.logRequestFailure({
212+
client: client?._id,
213+
correlationId: req.headers["x-correlation-id"],
214+
httpVerb: "GET",
215+
routePath: basePath + "/perm/check",
216+
status: "Failure",
217+
description: "Checks client permissions for object",
218+
extra: result,
219+
error: e,
220+
});
176221
g_lib.handleException(e, res);
177222
}
178223
})
@@ -184,9 +229,20 @@ router
184229

185230
router
186231
.get("/perm/get", function (req, res) {
232+
let client = null;
233+
let result = null;
187234
try {
188-
const client = g_lib.getUserFromClientID(req.queryParams.client);
189-
var result = req.queryParams.perms ? req.queryParams.perms : permissions.PERM_ALL;
235+
client = g_lib.getUserFromClientID(req.queryParams.client);
236+
logger.logRequestStarted({
237+
client: client?._id,
238+
correlationId: req.headers["x-correlation-id"],
239+
httpVerb: "GET",
240+
routePath: basePath + "/perm/get",
241+
status: "Started",
242+
description: "Gets client permissions for object",
243+
});
244+
245+
result = req.queryParams.perms ? req.queryParams.perms : permissions.PERM_ALL;
190246
var obj,
191247
id = g_lib.resolveID(req.queryParams.id, client),
192248
ty = id[0];
@@ -220,7 +276,26 @@ router
220276
res.send({
221277
granted: result,
222278
});
279+
logger.logRequestSuccess({
280+
client: client?._id,
281+
correlationId: req.headers["x-correlation-id"],
282+
httpVerb: "GET",
283+
routePath: basePath + "/perm/get",
284+
status: "Success",
285+
description: "Gets client permissions for object",
286+
extra: result,
287+
});
223288
} catch (e) {
289+
logger.logRequestFailure({
290+
client: client?._id,
291+
correlationId: req.headers["x-correlation-id"],
292+
httpVerb: "GET",
293+
routePath: basePath + "/perm/get",
294+
status: "Failure",
295+
description: "Gets client permissions for object",
296+
extra: result,
297+
error: e,
298+
});
224299
g_lib.handleException(e, res);
225300
}
226301
})

‎core/database/foxx/tests/authz_router.test.js‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,4 +335,58 @@ describe("unit_authz_router: the Foxx microservice authz_router", () => {
335335
// assert
336336
expect(response.status).to.equal(204);
337337
});
338+
//
339+
// ===== PERM CHECK TESTS =====
340+
//
341+
it("unit_authz_router: perm/check should return granted=true for admin user on owned record", () => {
342+
defaultWorkingSetup();
343+
344+
const request_string =
345+
`${authz_base_url}/perm/check?client=` +
346+
james_uuid +
347+
`&id=` +
348+
encodeURIComponent(record_id) +
349+
`&perms=` +
350+
permissions.PERM_ALL;
351+
352+
const response = request.get(request_string);
353+
354+
expect(response.status).to.equal(200);
355+
const body = JSON.parse(response.body);
356+
expect(body).to.have.property("granted", true);
357+
});
358+
//
359+
// ===== PERM GET TESTS =====
360+
//
361+
it("unit_authz_router: perm/get should return permission bits for admin user on record", () => {
362+
defaultWorkingSetup();
363+
364+
const request_string =
365+
`${authz_base_url}/perm/get?client=` +
366+
james_uuid +
367+
`&id=` +
368+
encodeURIComponent(record_id);
369+
370+
const response = request.get(request_string);
371+
372+
expect(response.status).to.equal(200);
373+
const body = JSON.parse(response.body);
374+
expect(body).to.have.property("granted");
375+
expect(body.granted).to.be.a("number");
376+
});
377+
378+
it("unit_authz_router: perm/get should fail with invalid id", () => {
379+
defaultWorkingSetup();
380+
381+
const request_string =
382+
`${authz_base_url}/perm/get?client=` +
383+
james_uuid +
384+
`&id=` +
385+
encodeURIComponent("x/invalid") +
386+
`&perms=` +
387+
permissions.PERM_ALL;
388+
389+
const response = request.get(request_string);
390+
expect(response.status).to.equal(400);
391+
});
338392
});

0 commit comments

Comments
 (0)