#RI-4454 - Restrict loopback

egor-zalenski · egor-zalenski · commit fefae1a3fc27 · 2023-06-16T16:09:52.000+02:00
diff --git a/configs/webpack.config.renderer.prod.ts b/configs/webpack.config.renderer.prod.ts
@@ -23,8 +23,6 @@ const devtoolsConfig =
 const configuration: webpack.Configuration = {
   ...devtoolsConfig,
 
-  devtool: 'source-map',
-
   mode: 'production',
 
   target: ['web', 'electron-renderer'],
diff --git a/configs/webpack.config.renderer.stage.ts b/configs/webpack.config.renderer.stage.ts
@@ -10,6 +10,8 @@ DeleteSourceMaps();
 export default merge(baseConfig, {
   ...rendererProdConfig,
 
+  devtool: 'source-map',
+
   plugins: [
     ...rendererProdConfig.plugins,
 
diff --git a/redisinsight/api/package.json b/redisinsight/api/package.json
@@ -21,7 +21,7 @@
     "format": "prettier --write \"src/**/*.ts\"",
     "lint": "eslint --ext .ts .",
     "start": "nest start",
-    "start:dev": "cross-env NODE_ENV=development SERVER_STATIC_CONTENT=1 nest start --watch",
+    "start:dev": "cross-env NODE_ENV=development BUILD_TYPE=DOCKER_ON_PREMISE SERVER_STATIC_CONTENT=1 nest start --watch",
     "start:debug": "nest start --debug --watch",
     "start:stage": "cross-env NODE_ENV=staging SERVER_STATIC_CONTENT=true node dist/src/main",
     "start:prod": "cross-env NODE_ENV=production node dist/src/main",
diff --git a/redisinsight/api/src/common/constants/api.ts b/redisinsight/api/src/common/constants/api.ts
@@ -1,3 +1,4 @@
 export const API_PARAM_DATABASE_ID = 'dbInstance';
 export const API_HEADER_DATABASE_INDEX = 'ri-db-index';
+export const API_HEADER_WINDOW_ID = 'ri-window-id';
 export const API_PARAM_CLI_CLIENT_ID = 'uuid';
diff --git a/redisinsight/api/src/constants/error-messages.ts b/redisinsight/api/src/constants/error-messages.ts
@@ -64,4 +64,6 @@ export default {
   APP_SETTINGS_NOT_FOUND: () => 'Could not find application settings.',
   SERVER_INFO_NOT_FOUND: () => 'Could not find server info.',
   INCREASE_MINIMUM_LIMIT: (count: string) => `Set MAXSEARCHRESULTS to at least ${count}.`,
+  INVALID_WINDOW_ID: 'Invalid window id.',
+  UNDEFINED_WINDOW_ID: 'Undefined window id.',
 };
diff --git a/redisinsight/api/src/core.module.ts b/redisinsight/api/src/core.module.ts
@@ -10,6 +10,7 @@ import { AnalyticsModule } from 'src/modules/analytics/analytics.module';
 import { SshModule } from 'src/modules/ssh/ssh.module';
 import { NestjsFormDataModule } from 'nestjs-form-data';
 import { FeatureModule } from 'src/modules/feature/feature.module';
+import { AuthModule } from 'src/modules/auth/auth.module';
 
 @Global()
 @Module({
@@ -25,6 +26,7 @@ import { FeatureModule } from 'src/modules/feature/feature.module';
     SshModule,
     NestjsFormDataModule,
     FeatureModule.register(),
+    AuthModule.register(),
   ],
   exports: [
     EncryptionModule,
diff --git a/redisinsight/api/src/main.ts b/redisinsight/api/src/main.ts
@@ -1,7 +1,7 @@
 import 'dotenv/config';
 import { NestFactory } from '@nestjs/core';
 import { SwaggerModule } from '@nestjs/swagger';
-import { NestApplicationOptions } from '@nestjs/common';
+import { INestApplication, NestApplicationOptions } from '@nestjs/common';
 import * as bodyParser from 'body-parser';
 import { WinstonModule } from 'nest-winston';
 import { GlobalExceptionFilter } from 'src/exceptions/global-exception.filter';
@@ -14,7 +14,12 @@ import LOGGER_CONFIG from '../config/logger';
 
 const serverConfig = get('server');
 
-export default async function bootstrap(): Promise<Function> {
+interface IApp {
+  app: INestApplication
+  gracefulShutdown: Function
+}
+
+export default async function bootstrap(): Promise<IApp> {
   await migrateHomeFolder();
 
   const port = process.env.API_PORT || serverConfig.port;
@@ -67,7 +72,7 @@ export default async function bootstrap(): Promise<Function> {
   process.on('SIGTERM', gracefulShutdown);
   process.on('SIGINT', gracefulShutdown);
 
-  return gracefulShutdown;
+  return { app, gracefulShutdown };
 }
 
 if (process.env.APP_ENV !== 'electron') {
diff --git a/redisinsight/api/src/modules/auth/auth.module.ts b/redisinsight/api/src/modules/auth/auth.module.ts
@@ -0,0 +1,22 @@
+import { Module } from '@nestjs/common';
+import config from 'src/utils/config';
+import { WindowAuthModule } from './window-auth/window-auth.module';
+import { BuildType } from '../server/models/server';
+
+const SERVER_CONFIG = config.get('server');
+
+@Module({})
+export class AuthModule {
+  static register() {
+    const imports = [];
+
+    if (SERVER_CONFIG.buildType === BuildType.Electron) {
+      imports.push(WindowAuthModule);
+    }
+
+    return {
+      module: AuthModule,
+      imports,
+    };
+  }
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/constants/exceptions.ts b/redisinsight/api/src/modules/auth/window-auth/constants/exceptions.ts
@@ -0,0 +1,14 @@
+import { HttpException, HttpStatus } from '@nestjs/common';
+
+export class WindowUnauthorizedException extends HttpException {
+  constructor(message) {
+    super(
+      {
+        statusCode: HttpStatus.UNAUTHORIZED,
+        message,
+        error: 'Unauthorized',
+      },
+      HttpStatus.UNAUTHORIZED,
+    );
+  }
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/middleware/window.auth.middleware.ts b/redisinsight/api/src/modules/auth/window-auth/middleware/window.auth.middleware.ts
@@ -0,0 +1,42 @@
+import {
+  Injectable,
+  Logger,
+  NestMiddleware,
+} from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import ERROR_MESSAGES from 'src/constants/error-messages';
+import { API_HEADER_WINDOW_ID } from 'src/common/constants';
+import { WindowAuthManager } from '../window-auth.manager';
+import { WindowUnauthorizedException } from '../constants/exceptions';
+
+@Injectable()
+export class WindowAuthMiddleware implements NestMiddleware {
+  private logger = new Logger('WindowAuthMiddleware');
+
+  constructor(
+    private windowAuthService: WindowAuthManager,
+  ) {}
+
+  async use(req: Request, res: Response, next: NextFunction): Promise<any> {
+    const { windowId } = WindowAuthMiddleware.getWindowIdFromReq(req);
+    const { isExists: isWindowExists = false } = await this.windowAuthService.getStrategy()?.isWindowExists(windowId)
+      ?? {};
+
+    if (!isWindowExists) {
+      this.throwError(req, ERROR_MESSAGES.UNDEFINED_WINDOW_ID);
+    }
+
+    next();
+  }
+
+  private static getWindowIdFromReq(req: Request) {
+    return { windowId: `${req?.headers?.[API_HEADER_WINDOW_ID]}` };
+  }
+
+  private throwError(req: Request, message: string) {
+    const { method, url } = req;
+    this.logger.error(`${message} ${method} ${url}`);
+
+    throw new WindowUnauthorizedException(message);
+  }
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/strategies/abstract.window.auth.strategy.ts b/redisinsight/api/src/modules/auth/window-auth/strategies/abstract.window.auth.strategy.ts
@@ -0,0 +1,5 @@
+import { IWindowAuthStrategy, IWindowAuthStrategyData } from '../window.auth.strategy.interface';
+
+export abstract class AbstractWindowAuthStrategy implements IWindowAuthStrategy {
+  abstract isWindowExists(data: any): Promise<IWindowAuthStrategyData>;
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/window-auth.manager.spec.ts b/redisinsight/api/src/modules/auth/window-auth/window-auth.manager.spec.ts
@@ -0,0 +1,31 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { WindowAuthManager } from './window-auth.manager';
+import { AbstractWindowAuthStrategy } from './strategies/abstract.window.auth.strategy';
+import { IWindowAuthStrategyData } from './window.auth.strategy.interface';
+
+export class TestAuthStrategy extends AbstractWindowAuthStrategy {
+  async isWindowExists(): Promise<IWindowAuthStrategyData> {
+    return { isExists: false };
+  }
+}
+
+const testStrategy = new TestAuthStrategy();
+
+describe('WindowAuthManager', () => {
+  let windowAuthManager: WindowAuthManager;
+
+  beforeAll(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [WindowAuthManager],
+      exports: [WindowAuthManager],
+    }).compile();
+
+    windowAuthManager = module.get<WindowAuthManager>(
+      WindowAuthManager,
+    );
+  });
+  it('Should set strategy to window auth manager and get it back', () => {
+    windowAuthManager.setStrategy(testStrategy);
+    expect(windowAuthManager.getStrategy()).toEqual(testStrategy);
+  });
+});
diff --git a/redisinsight/api/src/modules/auth/window-auth/window-auth.manager.ts b/redisinsight/api/src/modules/auth/window-auth/window-auth.manager.ts
@@ -0,0 +1,21 @@
+import { Injectable } from '@nestjs/common';
+import { IWindowAuthStrategy } from './window.auth.strategy.interface';
+
+@Injectable()
+export class WindowAuthManager {
+  private strategy: IWindowAuthStrategy = null;
+
+  /**
+   * Return strategy on how we are going to work with app(electron) windows auth
+   * @param strategy
+   */
+  setStrategy(
+    strategy: IWindowAuthStrategy,
+  ): void {
+    this.strategy = strategy;
+  }
+
+  getStrategy(): IWindowAuthStrategy {
+    return this.strategy;
+  }
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/window-auth.module.ts b/redisinsight/api/src/modules/auth/window-auth/window-auth.module.ts
@@ -0,0 +1,21 @@
+import { MiddlewareConsumer, Module, NestModule } from '@nestjs/common';
+import config from 'src/utils/config';
+import { WindowAuthManager } from './window-auth.manager';
+import { WindowAuthMiddleware } from './middleware/window.auth.middleware';
+
+const SERVER_CONFIG = config.get('server');
+
+@Module({
+  providers: [
+    WindowAuthManager,
+  ],
+})
+
+export class WindowAuthModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer
+      .apply(WindowAuthMiddleware)
+      .exclude(...SERVER_CONFIG.excludeAuthRoutes)
+      .forRoutes('*');
+  }
+}
diff --git a/redisinsight/api/src/modules/auth/window-auth/window.auth.strategy.interface.ts b/redisinsight/api/src/modules/auth/window-auth/window.auth.strategy.interface.ts
@@ -0,0 +1,6 @@
+export interface IWindowAuthStrategyData {
+  isExists: boolean
+}
+export interface IWindowAuthStrategy {
+  isWindowExists(windowId: string): Promise<IWindowAuthStrategyData>
+}
diff --git a/redisinsight/desktop/preload.ts b/redisinsight/desktop/preload.ts
@@ -15,6 +15,10 @@ const ipcHandler = {
 }
 
 contextBridge.exposeInMainWorld('app', {
+  // Send data from main to render
+  sendWindowId: ((windowId: any) => {
+    ipcRenderer.on('sendWindowId', windowId)
+  }),
   ipc: ipcHandler,
   config: {
     apiPort: config.apiPort
diff --git a/redisinsight/desktop/src/lib/server/server.ts b/redisinsight/desktop/src/lib/server/server.ts
@@ -4,17 +4,33 @@ import log from 'electron-log'
 import { configMain as config } from 'desktopSrc/config'
 import { wrapErrorMessageSensitiveData } from 'desktopSrc/utils'
 
+import { AbstractWindowAuthStrategy } from 'apiSrc/modules/auth/window-auth/strategies/abstract.window.auth.strategy'
+import { IWindowAuthStrategyData } from 'apiSrc/modules/auth/window-auth/window.auth.strategy.interface'
+import { getWindows } from '../window'
+
+import { WindowAuthModule } from '../../../../api/dist/src/modules/auth/window-auth/window-auth.module'
+import { WindowAuthManager } from '../../../../api/dist/src/modules/auth/window-auth/window-auth.manager'
 import server from '../../../../api/dist/src/main'
 
 const port = config.defaultPort
 
+export class ElectronWindowAuthStrategy extends AbstractWindowAuthStrategy {
+  async isWindowExists(id: string): Promise<IWindowAuthStrategyData> {
+    return { isExists: getWindows()?.has(id) }
+  }
+}
+
 let backendGracefulShutdown: Function
 export const launchApiServer = async () => {
   try {
     const detectPortConst = await detectPort(port)
     process.env.API_PORT = detectPortConst?.toString()
     log.info('Available port:', detectPortConst)
-    backendGracefulShutdown = await server()
+    const { gracefulShutdown: beGracefulShutdown, app: beApp } = await server()
+    backendGracefulShutdown = beGracefulShutdown
+
+    const winAuthService = beApp?.select?.(WindowAuthModule).get?.(WindowAuthManager)
+    winAuthService.setStrategy(new ElectronWindowAuthStrategy())
   } catch (_err) {
     const error = _err as Error
     log.error('Catch server error:', wrapErrorMessageSensitiveData(error))
diff --git a/redisinsight/desktop/src/lib/window/browserWindow.ts b/redisinsight/desktop/src/lib/window/browserWindow.ts
@@ -1,5 +1,6 @@
 import contextMenu from 'electron-context-menu'
 import { BrowserWindow } from 'electron'
+import { v4 as uuidv4 } from 'uuid'
 
 import { configMain as config } from 'desktopSrc/config'
 import { updateTray } from 'desktopSrc/lib'
@@ -17,6 +18,7 @@ export enum WindowType {
 export interface ICreateWindow {
   prevWindow: BrowserWindow | null
   htmlFileName: string
+  id?: string
   windowType: WindowType
   options: any
 }
@@ -25,6 +27,7 @@ export const createWindow = async ({
   prevWindow = null,
   htmlFileName = '',
   windowType = WindowType.Main,
+  id = uuidv4(),
   options = {}
 }: ICreateWindow) => {
   let x
@@ -53,11 +56,11 @@ export const createWindow = async ({
 
   newWindow.loadURL(resolveHtmlPath(htmlFileName))
 
-  initWindowHandlers(newWindow, prevWindow, windows)
+  initWindowHandlers(newWindow, prevWindow, windows, id)
 
   contextMenu({ window: newWindow, showInspectElement: true })
 
-  windows.set(`${newWindow.id}`, newWindow)
+  windows.set(id, newWindow)
 
   updateTray(newWindow.webContents.getTitle())
 
diff --git a/redisinsight/desktop/src/lib/window/window.handlers.ts b/redisinsight/desktop/src/lib/window/window.handlers.ts
@@ -12,7 +12,8 @@ import { ElectronStorageItem } from 'uiSrc/electron/constants'
 export const initWindowHandlers = (
   newWindow: BrowserWindow,
   splash: BrowserWindow | null = null,
-  windows: Map<string, BrowserWindow>
+  windows: Map<string, BrowserWindow>,
+  id: string
 ) => {
   const tray = getTray()
   const trayInstance = getTrayInstance()
@@ -22,6 +23,9 @@ export const initWindowHandlers = (
       throw new Error('"newWindow" is not defined')
     }
 
+    // set up windowId to preload.js
+    newWindow.webContents.send('sendWindowId', id)
+
     const zoomFactor = (electronStore?.get(ElectronStorageItem.zoomFactor) as number) ?? null
     if (zoomFactor) {
       newWindow?.webContents.setZoomFactor(zoomFactor)
diff --git a/redisinsight/ui/indexElectron.tsx b/redisinsight/ui/indexElectron.tsx
@@ -5,8 +5,12 @@ import { listenPluginsEvents } from 'uiSrc/plugins/pluginEvents'
 import 'uiSrc/styles/base/_fonts.scss'
 import 'uiSrc/styles/main.scss'
 
-listenPluginsEvents()
+window.app.sendWindowId((_e: any, windowId: string = '') => {
+  window.windowId = windowId || window.windowId
 
-const rootEl = document.getElementById('root')
-const root = createRoot(rootEl!)
-root.render(<AppElectron />)
+  listenPluginsEvents()
+
+  const rootEl = document.getElementById('root')
+  const root = createRoot(rootEl!)
+  root.render(<AppElectron />)
+})
diff --git a/redisinsight/ui/src/services/apiService.ts b/redisinsight/ui/src/services/apiService.ts
@@ -29,6 +29,10 @@ export const requestInterceptor = (config: AxiosRequestConfig) => {
         config.headers['ri-db-index'] = dbIndex
       }
     }
+
+    if (window.windowId) {
+      config.headers['ri-window-id'] = window.windowId
+    }
   }
 
   return config
diff --git a/redisinsight/ui/src/types/index.d.ts b/redisinsight/ui/src/types/index.d.ts
