fix: GH-221 - Disable anonymous access (#225)

* GH-221 - Disable anonymous access
* Return 412 if any user is considered anonymous
* Updated tests to pass a user so existing test cases pass
* Added new tests to cover 412

Resolves: GH-221

* Change to 401 for anonymous users

Author: auniverseaway

.dev.vars.it

@@ -0,0 +1,9 @@
+# Integration test environment variables
+# These override .dev.vars when running with --env it
+
+S3_DEF_URL=http://localhost:4569
+S3_ACCESS_KEY_ID=S3RVER
+S3_SECRET_ACCESS_KEY=S3RVER
+S3_FORCE_PATH_STYLE=true
+IMS_ORIGIN=http://localhost:9999
+AEM_ADMIN_MEDIA_API_KEY=test-key

.gitignore

@@ -138,3 +138,5 @@ dist
 
 .vscode
 
+# Integration test - S3rver generated files
+test/it/bucket/

package-lock.json

@@ -39,11 +39,14 @@ export default {
       return daResp({ status: 500 });
     }
 
-    const { authorized, key } = daCtx;
-    if (!authorized) {
-      const status = daCtx.users[0].email === 'anonymous' ? 401 : 403;
-      return daResp({ status });
-    }
+    const { users, authorized, key } = daCtx;
+
+    // Anonymous users are not permitted
+    const anon = users.some((user) => user.email === 'anonymous');
+    if (anon) return daResp({ status: 401 });
+
+    if (!authorized) return daResp({ status: 403 });
+
     if (key?.startsWith('.da-versions')) {
       return daResp({ status: 404 });
     }

src/index.js

@@ -24,11 +24,17 @@ describe('fetch', () => {
   });
 
   it('should return a response object for unknown', async () => {
-    const resp = await handler.fetch({ url: 'https://www.example.com/endpoint/repo/path/file.html', method: 'BLAH' }, {});
+    const hnd = await esmock('../src/index.js', {
+      '../src/utils/daCtx.js': {
+        default: async () => ({ authorized: true, users: [{ email: '[email protected]' }], path: '/endpoint/repo/path/file.html' }),
+      },
+    });
+
+    const resp = await hnd.fetch({ url: 'https://www.example.com/endpoint/repo/path/file.html', method: 'BLAH' }, {});
     assert.strictEqual(resp.status, 405);
   });
 
-  it('should return 401 when not authorized and not logged in', async () => {
+  it('should return 401 when user is anonymous', async () => {
     const hnd = await esmock('../src/index.js', {
       '../src/utils/daCtx.js': {
         default: async () => ({ authorized: false, users: [{ email: 'anonymous' }] }),
@@ -39,6 +45,17 @@ describe('fetch', () => {
     assert.strictEqual(resp.status, 401);
   });
 
+  it('should return 401 when not authorized and not logged in', async () => {
+    const hnd = await esmock('../src/index.js', {
+      '../src/utils/daCtx.js': {
+        default: async () => ({ authorized: false, users: [{ email: '[email protected]' }] }),
+      },
+    });
+
+    const resp = await hnd.fetch({ method: 'GET' }, {});
+    assert.strictEqual(resp.status, 403);
+  });
+
   it('should return 403 when logged in but not authorized', async () => {
     const hnd = await esmock('../src/index.js', {
       '../src/utils/daCtx.js': {
@@ -51,7 +68,13 @@ describe('fetch', () => {
   });
 
   it('return 404 for unknown get route', async () => {
-    const resp = await handler.fetch({ method: 'GET', url: 'http://www.example.com/' }, {});
+    const hnd = await esmock('../src/index.js', {
+      '../src/utils/daCtx.js': {
+        default: async () => ({ authorized: true, users: [{ email: '[email protected]' }], path: '/' }),
+      },
+    });
+
+    const resp = await hnd.fetch({ method: 'GET', url: 'http://www.example.com/' }, {});
     assert.strictEqual(resp.status, 404);
   });
 
@@ -70,8 +93,32 @@ describe('fetch', () => {
 });
 
 describe('invalid routes', () => {
+  let hnd;
+
+  before(async () => {
+    hnd = await esmock('../src/index.js', {
+      '../src/utils/daCtx.js': {
+        default: async (req) => {
+          const { pathname } = new URL(req.url);
+          // For invalid paths, throw the error that getDaCtx would throw
+          if (pathname.includes('//')) {
+            throw new Error('Invalid path');
+          }
+          return {
+            authorized: true,
+            users: [{ email: '[email protected]' }],
+            path: pathname,
+            api: 'source',
+            org: 'owner',
+            key: 'repo/path/file.html',
+          };
+        },
+      },
+    });
+  });
+
   const fetchStatus = async (path, method) => {
-    const resp = await handler.fetch({ method, url: `http://www.sample.com${path}` }, {});
+    const resp = await hnd.fetch({ method, url: `http://www.sample.com${path}` }, {});
     return resp.status;
   };