-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Endpoint to Trigger Mission Model Extraction (#93)
* Update Package-lock.json * Add `HASURA_METADATA_API_URL` envvar * Add auth handler for admin-only endpoints - uses the jwt and hasura 'x-hasura-role' headers to authorize - validate that the JWT is good (ie unexpired) when `AUTH_TYPE=NONE` * Allow specifying expiry when generating a JWT * Add `/modelExtraction` endpoint
- Loading branch information
1 parent
218531b
commit 37ce58a
Showing
7 changed files
with
839 additions
and
460 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,20 +1,50 @@ | ||
| import type { NextFunction, Request, Response } from 'express'; | ||
| import { getEnv } from '../../env.js'; | ||
| import { session } from './functions.js'; | ||
| import { decodeJwt, session } from './functions.js'; | ||
|
|
||
| export const auth = async (req: Request, res: Response, next: NextFunction) => { | ||
| const { AUTH_TYPE } = getEnv(); | ||
| const authorizationHeader = req.get('authorization'); | ||
| const response = await session(authorizationHeader); | ||
|
|
||
| if (AUTH_TYPE === 'none') { | ||
| if (response.success) { | ||
| next(); | ||
| } else { | ||
| const authorizationHeader = req.get('authorization'); | ||
| const response = await session(authorizationHeader); | ||
| res.status(401).send({ message: 'Unauthorized', success: false }); | ||
| } | ||
| }; | ||
|
|
||
| // Only permits `aerie_admin` users | ||
| export const adminOnlyAuth = async (req: Request, res: Response, next: NextFunction) => { | ||
| const authorizationHeader = req.get('authorization'); | ||
| const response = await session(authorizationHeader); | ||
|
|
||
| if (response.success) { | ||
| next(); | ||
| } else { | ||
| res.status(401).send({ message: 'Unauthorized', success: false }); | ||
| if (response.success) { | ||
| const { jwtPayload } = decodeJwt(authorizationHeader); | ||
| if (jwtPayload == null) { | ||
| res.status(401).send({ message: 'No authorization headers present.' }); | ||
| return; | ||
| } | ||
|
|
||
| const defaultRole = jwtPayload['https://hasura.io/jwt/claims']['x-hasura-default-role'] as string; | ||
| const allowedRoles = jwtPayload['https://hasura.io/jwt/claims']['x-hasura-allowed-roles'] as string[]; | ||
|
|
||
| const { headers } = req; | ||
| const { 'x-hasura-role': role } = headers; | ||
|
|
||
| if (role != undefined) { | ||
| if (!allowedRoles.includes(role as string)) { | ||
| res.status(401).send({ message: 'Declared role is not in allowed roles.' }); | ||
| return; | ||
| } | ||
| if (role != 'aerie_admin') { | ||
| res.status(403).send({ message: 'Current active role is unauthorized.' }); | ||
| return; | ||
| } | ||
| } else if (defaultRole != 'aerie_admin') { | ||
| res.status(403).send({ message: 'Current active role is unauthorized.' }); | ||
| return; | ||
| } | ||
| next(); | ||
| } else { | ||
| res.status(401).send({ message: 'Unauthorized', success: false }); | ||
| } | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,124 @@ | ||
| import type { Express } from 'express'; | ||
| import { adminOnlyAuth } from '../auth/middleware.js'; | ||
| import rateLimit from 'express-rate-limit'; | ||
| import getLogger from '../../logger.js'; | ||
| import { getEnv } from '../../env.js'; | ||
| import { generateJwt, decodeJwt } from '../auth/functions.js'; | ||
|
|
||
| export default (app: Express) => { | ||
| const logger = getLogger('packages/hasura/hasura-events'); | ||
| const { RATE_LIMITER_LOGIN_MAX } = getEnv(); | ||
|
|
||
| const refreshLimiter = rateLimit({ | ||
| legacyHeaders: false, | ||
| max: RATE_LIMITER_LOGIN_MAX, | ||
| standardHeaders: true, | ||
| windowMs: 15 * 60 * 1000, // 15 minutes | ||
| }); | ||
|
|
||
| /** | ||
| * @swagger | ||
| * /modelExtraction: | ||
| * post: | ||
| * security: | ||
| * - bearerAuth: [] | ||
| * consumes: | ||
| * - application/json | ||
| * produces: | ||
| * - application/json | ||
| * parameters: | ||
| * - in: header | ||
| * name: x-hasura-role | ||
| * schema: | ||
| * type: string | ||
| * required: false | ||
| * requestBody: | ||
| * content: | ||
| * application/json: | ||
| * schema: | ||
| * type: object | ||
| * properties: | ||
| * missionModelId: | ||
| * type: integer | ||
| * responses: | ||
| * 200: | ||
| * description: ExtractionResponse | ||
| * 403: | ||
| * description: Unauthorized error | ||
| * 401: | ||
| * description: Unauthenticated error | ||
| * summary: Request extraction of a Mission Model's JAR | ||
| * tags: | ||
| * - Hasura | ||
| */ | ||
| app.post('/modelExtraction', refreshLimiter, adminOnlyAuth, async (req, res) => { | ||
| const { jwtPayload } = decodeJwt(req.get('authorization')); | ||
| const username = jwtPayload?.username as string; | ||
|
|
||
| const { body } = req; | ||
| const { missionModelId } = body; | ||
|
|
||
| // Invoke endpoints using the Hasura Metadata API | ||
| const { HASURA_METADATA_API_URL: metadataURL } = getEnv(); | ||
|
|
||
| // Generate a temporary token that has Hasura Admin access | ||
| const tempToken = generateJwt(username, 'admin', ['admin'], '10s'); | ||
|
|
||
| const headers = { | ||
| Authorization: `Bearer ${tempToken}`, | ||
| 'Content-Type': 'application/json', | ||
| 'x-hasura-role': 'admin', | ||
| 'x-hasura-user-id': username, | ||
| }; | ||
|
|
||
| const generateBody = (name: string) => | ||
| JSON.stringify({ | ||
| args: { | ||
| name: `refresh${name}`, | ||
| payload: { id: missionModelId }, | ||
| source: 'Aerie', | ||
| }, | ||
| type: 'pg_invoke_event_trigger', | ||
| }); | ||
|
|
||
| const extract = async (name: string) => { | ||
| return await fetch(metadataURL, { | ||
| body: generateBody(name), | ||
| headers, | ||
| method: 'POST', | ||
| }) | ||
| .then(response => { | ||
| if (!response.ok) { | ||
| logger.error(`Bad status received when extracting ${name}: [${response.status}] ${response.statusText}`); | ||
| return { | ||
| error: `Bad status received when extracting ${name}: [${response.status}] ${response.statusText}`, | ||
| status: response.status, | ||
| statusText: response.statusText, | ||
| }; | ||
| } | ||
| return response.json(); | ||
| }) | ||
| .catch(error => { | ||
| logger.error(`Error connecting to Hasura metadata API at ${metadataURL}. Full error below:\n${error}`); | ||
| return { error: `Error connecting to metadata API at ${metadataURL}` }; | ||
| }); | ||
| }; | ||
|
|
||
| const [activityTypeResp, modelParameterResp, resourceTypeResp] = await Promise.all([ | ||
| extract('ActivityTypes'), | ||
| extract('ModelParameters'), | ||
| extract('ResourceTypes'), | ||
| ]); | ||
|
|
||
| logger.info(`POST /modelExtraction: Extraction triggered for model: ${missionModelId}`); | ||
|
|
||
| res.json({ | ||
| message: `Extraction triggered for model: ${missionModelId}`, | ||
| response: { | ||
| activity_types: activityTypeResp, | ||
| model_parameters: modelParameterResp, | ||
| resource_types: resourceTypeResp, | ||
| }, | ||
| }); | ||
| }); | ||
| }; |