Switching to new security rules
Some checks failed
continuous-integration/drone/push Build is failing
Some checks failed
continuous-integration/drone/push Build is failing
This commit is contained in:
Fabian Stamm
@ -1,25 +1,24 @@
|
||||
import Logging from "@hibas123/nodelogging";
|
||||
import * as dotenv from "dotenv";
|
||||
import { LoggingTypes } from "@hibas123/logging";
|
||||
dotenv.config()
|
||||
|
||||
dotenv.config();
|
||||
|
||||
interface IConfig {
|
||||
port: number;
|
||||
admin: string;
|
||||
access_log: boolean;
|
||||
dev: boolean
|
||||
dev: boolean;
|
||||
}
|
||||
|
||||
const config: IConfig = {
|
||||
port: Number(process.env.PORT),
|
||||
access_log: (process.env.ACCESS_LOG || "").toLowerCase() === "true",
|
||||
admin: process.env.ADMIN_KEY,
|
||||
dev: (process.env.DEV || "").toLowerCase() === "true"
|
||||
}
|
||||
dev: (process.env.DEV || "").toLowerCase() === "true",
|
||||
};
|
||||
|
||||
if (config.dev) {
|
||||
Logging.logLevel = LoggingTypes.Log;
|
||||
}
|
||||
|
||||
export default config;
|
||||
export default config;
|
||||
|
||||
@ -1,6 +1,5 @@
|
||||
import { Rules } from "./rules";
|
||||
import Settings from "../settings";
|
||||
import getLevelDB, { LevelDB, deleteLevelDB, resNull } from "../storage";
|
||||
import getLevelDB, { deleteLevelDB, resNull } from "../storage";
|
||||
import DocumentLock from "./lock";
|
||||
import {
|
||||
DocumentQuery,
|
||||
@ -14,6 +13,9 @@ import Logging from "@hibas123/nodelogging";
|
||||
import Session from "./session";
|
||||
import nanoid = require("nanoid");
|
||||
import { Observable } from "@hibas123/utils";
|
||||
import { RuleRunner } from "../rules/compile";
|
||||
import compileRule from "../rules";
|
||||
import { RuleError } from "../rules/error";
|
||||
|
||||
const ALPHABET =
|
||||
"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
|
||||
@ -81,17 +83,27 @@ export class Database {
|
||||
return `${collectionid || ""}/${documentid || ""}`;
|
||||
}
|
||||
|
||||
private level = getLevelDB(this.name);
|
||||
#level = getLevelDB(this.name);
|
||||
|
||||
get data() {
|
||||
return this.level.data;
|
||||
return this.#level.data;
|
||||
}
|
||||
|
||||
get collections() {
|
||||
return this.level.collection;
|
||||
return this.#level.collection;
|
||||
}
|
||||
|
||||
#rules: RuleRunner;
|
||||
#rawRules?: string;
|
||||
|
||||
get rawRules() {
|
||||
return this.#rawRules;
|
||||
}
|
||||
|
||||
get rules() {
|
||||
return this.#rules;
|
||||
}
|
||||
|
||||
public rules: Rules;
|
||||
private locks = new DocumentLock();
|
||||
public collectionLocks = new DocumentLock();
|
||||
|
||||
@ -107,7 +119,7 @@ export class Database {
|
||||
name: this.name,
|
||||
accesskey: this.accesskey,
|
||||
publickey: this.publickey,
|
||||
rules: this.rules,
|
||||
rules: this.#rules,
|
||||
};
|
||||
}
|
||||
|
||||
@ -118,13 +130,36 @@ export class Database {
|
||||
public publickey?: string,
|
||||
public rootkey?: string
|
||||
) {
|
||||
if (rawRules) this.rules = new Rules(rawRules);
|
||||
if (rawRules) this.applyRules(rawRules);
|
||||
}
|
||||
|
||||
private applyRules(rawRules: string): undefined | RuleError {
|
||||
try {
|
||||
JSON.parse(rawRules);
|
||||
Logging.warning(
|
||||
"Found old rule! Replacing with a 100% permissive one!"
|
||||
);
|
||||
rawRules =
|
||||
"service realtimedb {\n match /* {\n allow read, write, list: if false; \n }\n}";
|
||||
// still json, so switching to
|
||||
} catch (err) {}
|
||||
|
||||
let { runner, error } = compileRule(rawRules);
|
||||
if (error) {
|
||||
Logging.warning("Found error in existing config!", error);
|
||||
runner = compileRule("service realtimesb {}").runner;
|
||||
}
|
||||
this.#rules = runner;
|
||||
this.#rawRules = rawRules;
|
||||
return undefined;
|
||||
}
|
||||
|
||||
async setRules(rawRules: string) {
|
||||
let rules = new Rules(rawRules);
|
||||
const { runner, error } = compileRule(rawRules);
|
||||
if (error) return error;
|
||||
await Settings.setDatabaseRules(this.name, rawRules);
|
||||
this.rules = rules;
|
||||
this.#rules = runner;
|
||||
this.#rawRules = rawRules;
|
||||
}
|
||||
|
||||
async setAccessKey(key: string) {
|
||||
|
||||
@ -5,6 +5,7 @@ import Logging from "@hibas123/nodelogging";
|
||||
import * as MSGPack from "what-the-pack";
|
||||
import Session from "./session";
|
||||
import { LevelUpChain } from "levelup";
|
||||
import { Operations } from "../rules/parser";
|
||||
|
||||
export type IWriteQueries = "set" | "update" | "delete" | "add";
|
||||
export type ICollectionQueries =
|
||||
@ -47,7 +48,7 @@ interface IPreparedQuery {
|
||||
needDocument: boolean;
|
||||
batchCompatible: boolean;
|
||||
runner: Runner;
|
||||
permission: "write" | "read";
|
||||
permission: Operations;
|
||||
additionalLock?: string[];
|
||||
}
|
||||
|
||||
@ -73,7 +74,7 @@ export abstract class Query {
|
||||
public readonly needDocument: boolean;
|
||||
public readonly batchCompatible: boolean;
|
||||
public readonly additionalLock?: string[];
|
||||
public readonly permission: string;
|
||||
public readonly permission: Operations;
|
||||
private readonly _runner: Runner;
|
||||
|
||||
constructor(
|
||||
@ -99,6 +100,7 @@ export abstract class Query {
|
||||
this.needDocument = data.needDocument;
|
||||
this.batchCompatible = data.batchCompatible;
|
||||
this.additionalLock = data.additionalLock;
|
||||
this.permission = data.permission;
|
||||
this._runner = data.runner;
|
||||
}
|
||||
}
|
||||
@ -151,14 +153,13 @@ export abstract class Query {
|
||||
) {
|
||||
let perm = this.database.rules.hasPermission(
|
||||
this.query.path,
|
||||
this.permission,
|
||||
this.session
|
||||
);
|
||||
if (this.permission === "read" && !perm.read) {
|
||||
throw new QueryError("No permission!");
|
||||
} else if (this.permission === "write" && !perm.write) {
|
||||
throw new QueryError("No permission!");
|
||||
}
|
||||
this.query.path = perm.path;
|
||||
|
||||
if (!perm) throw new QueryError("No permission!");
|
||||
|
||||
// this.query.path = perm.path;
|
||||
return this._runner.call(
|
||||
this,
|
||||
collection,
|
||||
@ -173,14 +174,13 @@ export abstract class Query {
|
||||
) {
|
||||
let perm = this.database.rules.hasPermission(
|
||||
this.query.path,
|
||||
"read",
|
||||
this.session
|
||||
);
|
||||
if (!perm.read) {
|
||||
if (!perm) {
|
||||
throw new QueryError("No permission!");
|
||||
}
|
||||
|
||||
this.query.path = perm.path;
|
||||
|
||||
const receivedChanges = (changes: Change[]) => {
|
||||
let res = changes
|
||||
.filter((change) => this.checkChange(change))
|
||||
@ -464,7 +464,7 @@ export class CollectionQuery extends Query {
|
||||
batchCompatible: false,
|
||||
createCollection: false,
|
||||
needDocument: false,
|
||||
permission: "read",
|
||||
permission: "list",
|
||||
runner: this.keys,
|
||||
};
|
||||
case "list":
|
||||
|
||||
@ -1,125 +0,0 @@
|
||||
import Session from "./session";
|
||||
import Logging from "@hibas123/nodelogging";
|
||||
|
||||
interface IRule<T> {
|
||||
".write"?: T;
|
||||
".read"?: T;
|
||||
}
|
||||
|
||||
type IRuleConfig<T> =
|
||||
| IRule<T>
|
||||
| {
|
||||
[segment: string]: IRuleConfig<T>;
|
||||
};
|
||||
|
||||
type IRuleRaw = IRuleConfig<string>;
|
||||
type IRuleParsed = IRuleConfig<boolean>;
|
||||
|
||||
const resolve = (value: any) => {
|
||||
if (value === true) {
|
||||
return true;
|
||||
} else if (typeof value === "string") {
|
||||
}
|
||||
return undefined;
|
||||
};
|
||||
|
||||
export class Rules {
|
||||
rules: IRuleParsed;
|
||||
constructor(private config: string) {
|
||||
let parsed: IRuleRaw = JSON.parse(config);
|
||||
|
||||
const analyse = (raw: IRuleRaw) => {
|
||||
let r: IRuleParsed = {};
|
||||
|
||||
if (raw[".read"]) {
|
||||
let res = resolve(raw[".read"]);
|
||||
if (res) {
|
||||
r[".read"] = res;
|
||||
}
|
||||
delete raw[".read"];
|
||||
}
|
||||
|
||||
if (raw[".write"]) {
|
||||
let res = resolve(raw[".write"]);
|
||||
if (res) {
|
||||
r[".write"] = res;
|
||||
}
|
||||
delete raw[".write"];
|
||||
}
|
||||
|
||||
for (let segment in raw) {
|
||||
if (segment.startsWith(".")) continue;
|
||||
|
||||
r[segment] = analyse(raw[segment]);
|
||||
}
|
||||
return r;
|
||||
};
|
||||
|
||||
this.rules = analyse(parsed);
|
||||
}
|
||||
|
||||
hasPermission(
|
||||
path: string[],
|
||||
session: Session
|
||||
): { read: boolean; write: boolean; path: string[] } {
|
||||
if (session.root)
|
||||
return {
|
||||
read: true,
|
||||
write: true,
|
||||
path: path
|
||||
};
|
||||
let read = this.rules[".read"] || false;
|
||||
let write = this.rules[".write"] || false;
|
||||
|
||||
let rules = this.rules;
|
||||
|
||||
for (let idx in path) {
|
||||
let segment = path[idx];
|
||||
if (segment.startsWith(".")) {
|
||||
read = false;
|
||||
write = false;
|
||||
Logging.log("Invalid query path (started with '$' or '.'):", path);
|
||||
break;
|
||||
}
|
||||
|
||||
let k = Object.keys(rules)
|
||||
.filter(e => e.startsWith("$"))
|
||||
.find(e => {
|
||||
switch (e) {
|
||||
case "$uid":
|
||||
if (segment === "$uid") {
|
||||
path[idx] = session.uid;
|
||||
return true;
|
||||
}
|
||||
if (segment === session.uid) return true;
|
||||
break;
|
||||
}
|
||||
return false;
|
||||
});
|
||||
|
||||
rules = (k ? rules[k] : undefined) || rules[segment] || rules["*"];
|
||||
|
||||
if (rules) {
|
||||
if (rules[".read"]) {
|
||||
read = rules[".read"];
|
||||
}
|
||||
|
||||
if (rules[".write"]) {
|
||||
read = rules[".write"];
|
||||
}
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
read: read as boolean,
|
||||
write: write as boolean,
|
||||
path
|
||||
};
|
||||
}
|
||||
|
||||
toJSON() {
|
||||
return this.config;
|
||||
}
|
||||
}
|
||||
296
src/rules/compile.ts
Normal file
296
src/rules/compile.ts
Normal file
@ -0,0 +1,296 @@
|
||||
import {
|
||||
Node,
|
||||
MatchStatement,
|
||||
Operations,
|
||||
ServiceStatement,
|
||||
Expression,
|
||||
ValueStatement,
|
||||
Operators,
|
||||
} from "./parser";
|
||||
|
||||
export class CompilerError extends Error {
|
||||
node: Node;
|
||||
constructor(message: string, node: Node) {
|
||||
super(message);
|
||||
this.node = node;
|
||||
}
|
||||
}
|
||||
|
||||
type Variables = { [key: string]: string | Variables };
|
||||
|
||||
class Variable {
|
||||
#name: string;
|
||||
constructor(name: string) {
|
||||
this.#name = name;
|
||||
}
|
||||
|
||||
getValue(variables: Variables) {
|
||||
const parts = this.#name.split(".");
|
||||
let current = variables as any;
|
||||
while (parts.length > 0) {
|
||||
const name = parts.shift();
|
||||
if (current && typeof current == "object") current = current[name];
|
||||
}
|
||||
return current;
|
||||
}
|
||||
}
|
||||
|
||||
class Value {
|
||||
#value: any;
|
||||
constructor(value: any) {
|
||||
this.#value = value;
|
||||
}
|
||||
|
||||
get value() {
|
||||
return this.#value;
|
||||
}
|
||||
}
|
||||
|
||||
type ConditionParameters = Value | ConditionMatcher | Variable;
|
||||
class ConditionMatcher {
|
||||
#left: ConditionParameters;
|
||||
#right: ConditionParameters;
|
||||
#operator: Operators;
|
||||
constructor(
|
||||
left: ConditionParameters,
|
||||
right: ConditionParameters,
|
||||
operator: Operators
|
||||
) {
|
||||
this.#left = left;
|
||||
this.#right = right;
|
||||
this.#operator = operator;
|
||||
}
|
||||
|
||||
test(variables: Variables): boolean {
|
||||
let leftValue: any;
|
||||
if (this.#left instanceof Value) {
|
||||
leftValue = this.#left.value;
|
||||
} else if (this.#left instanceof Variable) {
|
||||
leftValue = this.#left.getValue(variables);
|
||||
} else {
|
||||
leftValue = this.#left.test(variables);
|
||||
}
|
||||
|
||||
let rightValue: any;
|
||||
if (this.#right instanceof Value) {
|
||||
rightValue = this.#right.value;
|
||||
} else if (this.#right instanceof Variable) {
|
||||
rightValue = this.#right.getValue(variables);
|
||||
} else {
|
||||
rightValue = this.#right.test(variables);
|
||||
}
|
||||
|
||||
switch (this.#operator) {
|
||||
case "==":
|
||||
return leftValue == rightValue;
|
||||
case "!=":
|
||||
return leftValue != rightValue;
|
||||
case ">=":
|
||||
return leftValue >= rightValue;
|
||||
case "<=":
|
||||
return leftValue <= rightValue;
|
||||
case ">":
|
||||
return leftValue > rightValue;
|
||||
case "<":
|
||||
return leftValue < rightValue;
|
||||
case "&&":
|
||||
return leftValue && rightValue;
|
||||
case "||":
|
||||
return leftValue || rightValue;
|
||||
default:
|
||||
throw new Error("Invalid operator " + this.#operator);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
class Rule {
|
||||
#operation: Operations;
|
||||
|
||||
#condition: ConditionParameters;
|
||||
|
||||
get operation() {
|
||||
return this.#operation;
|
||||
}
|
||||
|
||||
constructor(operation: Operations, condition: ConditionParameters) {
|
||||
this.#operation = operation;
|
||||
this.#condition = condition;
|
||||
}
|
||||
|
||||
test(variables: Variables): boolean {
|
||||
if (this.#condition instanceof Value) {
|
||||
return Boolean(this.#condition.value);
|
||||
} else if (this.#condition instanceof Variable) {
|
||||
return Boolean(this.#condition.getValue(variables));
|
||||
} else {
|
||||
return this.#condition.test(variables);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
class Segment {
|
||||
#name: string;
|
||||
#variable: boolean;
|
||||
get name() {
|
||||
return this.#name;
|
||||
}
|
||||
constructor(name: string, variable = false) {
|
||||
this.#name = name;
|
||||
this.#variable = variable;
|
||||
}
|
||||
|
||||
match(segment: string): { match: boolean; variable?: string } {
|
||||
return {
|
||||
match: this.#name === segment || this.#variable,
|
||||
variable: this.#variable && this.#name,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
class Match {
|
||||
#submatches: Match[];
|
||||
#rules: Rule[];
|
||||
|
||||
#segments: Segment[];
|
||||
#wildcard: boolean;
|
||||
|
||||
constructor(
|
||||
segments: Segment[],
|
||||
rules: Rule[],
|
||||
wildcard: boolean,
|
||||
submatches: Match[]
|
||||
) {
|
||||
this.#segments = segments;
|
||||
this.#rules = rules;
|
||||
this.#wildcard = wildcard;
|
||||
this.#submatches = submatches;
|
||||
}
|
||||
|
||||
match(
|
||||
segments: string[],
|
||||
operation: Operations,
|
||||
variables: Variables
|
||||
): boolean {
|
||||
let localVars = { ...variables };
|
||||
if (segments.length >= this.#segments.length) {
|
||||
for (let i = 0; i < this.#segments.length; i++) {
|
||||
const match = this.#segments[i].match(segments[i]);
|
||||
if (match.match) {
|
||||
if (match.variable) {
|
||||
localVars[match.variable] = segments[i];
|
||||
}
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
let remaining = segments.slice(this.#segments.length);
|
||||
if (remaining.length > 0 && !this.#wildcard) {
|
||||
for (const match of this.#submatches) {
|
||||
const res = match.match(remaining, operation, localVars);
|
||||
if (res) return true;
|
||||
}
|
||||
} else {
|
||||
for (const rule of this.#rules) {
|
||||
console.log(rule.operation, operation);
|
||||
if (rule.operation === operation) {
|
||||
if (rule.test(localVars)) return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
export class RuleRunner {
|
||||
#root_matches: Match[];
|
||||
constructor(root_matches: Match[]) {
|
||||
this.#root_matches = root_matches;
|
||||
}
|
||||
|
||||
hasPermission(path: string[], operation: Operations, request: any): boolean {
|
||||
if (request.root) return true;
|
||||
for (const match of this.#root_matches) {
|
||||
const res = match.match(path, operation, { request });
|
||||
if (res) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
export function getRuleRunner(service: ServiceStatement) {
|
||||
const createMatch = (s_match: MatchStatement) => {
|
||||
let wildcard = false;
|
||||
let segments = s_match.path.segments
|
||||
.map((segment, idx, arr) => {
|
||||
if (typeof segment === "string") {
|
||||
if (segment === "*") {
|
||||
if (idx === arr.length - 1) {
|
||||
wildcard = true;
|
||||
return null;
|
||||
} else {
|
||||
throw new CompilerError("Invalid path wildcard!", s_match);
|
||||
}
|
||||
} else {
|
||||
return new Segment(segment, false);
|
||||
}
|
||||
} else {
|
||||
return new Segment(segment.name, true);
|
||||
}
|
||||
})
|
||||
.filter((e) => e !== null);
|
||||
|
||||
const resolveParameter = (e: Expression | ValueStatement) => {
|
||||
let val: Value | ConditionMatcher | Variable;
|
||||
if (e.type === "value") {
|
||||
const c = e;
|
||||
if (c.isFalse) {
|
||||
val = new Value(false);
|
||||
} else if (c.isTrue) {
|
||||
val = new Value(true);
|
||||
} else if (c.isNull) {
|
||||
val = new Value(null);
|
||||
} else if (c.isNumber) {
|
||||
val = new Value(Number(c.value));
|
||||
} else if (c.isString) {
|
||||
val = new Value(String(c.value));
|
||||
} else if (c.isVariable) {
|
||||
val = new Variable(String(c.value));
|
||||
} else {
|
||||
throw new CompilerError("Invalid value type!", e);
|
||||
}
|
||||
} else {
|
||||
val = createCondition(e);
|
||||
}
|
||||
|
||||
return val;
|
||||
};
|
||||
|
||||
const createCondition = (cond: Expression): ConditionMatcher => {
|
||||
let left: ConditionParameters = resolveParameter(cond.left);
|
||||
let right: ConditionParameters = resolveParameter(cond.right);
|
||||
|
||||
return new ConditionMatcher(left, right, cond.operator);
|
||||
};
|
||||
|
||||
const rules: Rule[] = s_match.rules
|
||||
.map((rule) => {
|
||||
const condition = resolveParameter(rule.condition);
|
||||
return rule.operations.map((op) => new Rule(op, condition));
|
||||
})
|
||||
.flat(1);
|
||||
const submatches = s_match.matches.map((sub) => createMatch(sub));
|
||||
const match = new Match(segments, rules, wildcard, submatches);
|
||||
|
||||
console.log("Adding match", segments, rules, wildcard, submatches);
|
||||
|
||||
return match;
|
||||
};
|
||||
|
||||
const root_matches = service.matches.map((match) => createMatch(match));
|
||||
|
||||
const runner = new RuleRunner(root_matches);
|
||||
|
||||
return runner;
|
||||
}
|
||||
36
src/rules/error.ts
Normal file
36
src/rules/error.ts
Normal file
@ -0,0 +1,36 @@
|
||||
export interface RuleError {
|
||||
line: number;
|
||||
column: number;
|
||||
message: string;
|
||||
original_err: Error;
|
||||
}
|
||||
|
||||
function indexToLineAndCol(src: string, index: number) {
|
||||
let line = 1;
|
||||
let col = 1;
|
||||
for (let i = 0; i < index; i++) {
|
||||
if (src.charAt(i) === "\n") {
|
||||
line++;
|
||||
col = 1;
|
||||
} else {
|
||||
col++;
|
||||
}
|
||||
}
|
||||
|
||||
return { line, col };
|
||||
}
|
||||
|
||||
export function transformError(
|
||||
err: Error,
|
||||
data: string,
|
||||
idx: number
|
||||
): RuleError {
|
||||
let loc = indexToLineAndCol(data, idx);
|
||||
|
||||
return {
|
||||
line: loc.line,
|
||||
column: loc.col,
|
||||
message: err.message,
|
||||
original_err: err,
|
||||
};
|
||||
}
|
||||
30
src/rules/index.ts
Normal file
30
src/rules/index.ts
Normal file
@ -0,0 +1,30 @@
|
||||
import { RuleError, transformError } from "./error";
|
||||
import parse, { ParserError } from "./parser";
|
||||
import tokenize, { TokenizerError } from "./tokenise";
|
||||
import { getRuleRunner, RuleRunner } from "./compile";
|
||||
import { inspect } from "util";
|
||||
|
||||
export default function compileRule(rule: string) {
|
||||
let runner: RuleRunner | undefined;
|
||||
let error: RuleError | undefined;
|
||||
try {
|
||||
const tokenised = tokenize(rule);
|
||||
// console.log(tokenised);
|
||||
const parsed = parse(tokenised);
|
||||
const dbservice = parsed.find((e) => e.name === "realtimedb");
|
||||
|
||||
if (!dbservice) throw new Error("No realtimedb service available!");
|
||||
|
||||
runner = getRuleRunner(dbservice);
|
||||
} catch (err) {
|
||||
if (err instanceof TokenizerError) {
|
||||
error = transformError(err, rule, err.index);
|
||||
} else if (err instanceof ParserError) {
|
||||
error = transformError(err, rule, err.token.startIdx);
|
||||
} else {
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
return { runner, error };
|
||||
}
|
||||
349
src/rules/parser.ts
Normal file
349
src/rules/parser.ts
Normal file
@ -0,0 +1,349 @@
|
||||
import { Token } from "./tokenise";
|
||||
|
||||
export interface Node {
|
||||
type: string;
|
||||
idx: number;
|
||||
}
|
||||
|
||||
export interface PathStatement extends Node {
|
||||
type: "path";
|
||||
segments: (string | { type: "variable"; name: string })[];
|
||||
}
|
||||
|
||||
export interface ValueStatement extends Node {
|
||||
type: "value";
|
||||
isNull: boolean;
|
||||
isTrue: boolean;
|
||||
isFalse: boolean;
|
||||
isNumber: boolean;
|
||||
isString: boolean;
|
||||
isVariable: boolean;
|
||||
|
||||
value?: any;
|
||||
}
|
||||
|
||||
export type Operators = "&&" | "||" | "==" | "<=" | ">=" | "!=" | ">" | "<";
|
||||
|
||||
export interface Expression extends Node {
|
||||
type: "expression";
|
||||
|
||||
left: ValueStatement | Expression;
|
||||
operator: Operators;
|
||||
right: ValueStatement | Expression;
|
||||
}
|
||||
|
||||
export type Operations = "read" | "write" | "list"; // | "update" | "create" | "delete" | "list";
|
||||
|
||||
export interface AllowStatement extends Node {
|
||||
type: "permission";
|
||||
operations: Operations[];
|
||||
condition: Expression | ValueStatement;
|
||||
}
|
||||
|
||||
export interface MatchStatement extends Node {
|
||||
type: "match";
|
||||
path: PathStatement;
|
||||
matches: MatchStatement[];
|
||||
rules: AllowStatement[];
|
||||
}
|
||||
|
||||
export interface ServiceStatement extends Node {
|
||||
type: "service";
|
||||
name: string;
|
||||
matches: MatchStatement[];
|
||||
}
|
||||
|
||||
export class ParserError extends Error {
|
||||
token: Token;
|
||||
constructor(message: string, token: Token) {
|
||||
super(message);
|
||||
this.token = token;
|
||||
}
|
||||
}
|
||||
|
||||
export default function parse(tokens: Token[]) {
|
||||
const tokenIterator = tokens[Symbol.iterator]();
|
||||
let currentToken: Token = tokenIterator.next().value;
|
||||
let nextToken: Token = tokenIterator.next().value;
|
||||
|
||||
const eatToken = (value?: string) => {
|
||||
if (value && value !== currentToken.value) {
|
||||
throw new ParserError(
|
||||
`Unexpected token value, expected '${value}', received '${currentToken.value}'`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
let idx = currentToken.startIdx;
|
||||
currentToken = nextToken;
|
||||
nextToken = tokenIterator.next().value;
|
||||
return idx;
|
||||
};
|
||||
|
||||
const eatText = (): [string, number] => {
|
||||
checkTypes("text");
|
||||
let val = currentToken.value;
|
||||
let idx = currentToken.startIdx;
|
||||
eatToken();
|
||||
return [val, idx];
|
||||
};
|
||||
const eatNumber = (): number => {
|
||||
checkTypes("number");
|
||||
let val = Number(currentToken.value);
|
||||
if (Number.isNaN(val)) {
|
||||
throw new ParserError(
|
||||
`Value cannot be parsed as number! ${currentToken.value}`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
eatToken();
|
||||
return val;
|
||||
};
|
||||
|
||||
const checkTypes = (...types: string[]) => {
|
||||
if (types.indexOf(currentToken.type) < 0) {
|
||||
throw new ParserError(
|
||||
`Unexpected token value, expected ${types.join(" | ")}, received '${
|
||||
currentToken.value
|
||||
}'`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
const parsePathStatement = (): PathStatement => {
|
||||
const segments: (string | { name: string; type: "variable" })[] = [];
|
||||
const idx = currentToken.startIdx;
|
||||
let next = currentToken.type === "slash";
|
||||
while (next) {
|
||||
eatToken("/");
|
||||
if (currentToken.type === "curly_open" && nextToken.type === "text") {
|
||||
eatToken("{");
|
||||
const [name] = eatText();
|
||||
segments.push({
|
||||
type: "variable",
|
||||
name,
|
||||
});
|
||||
eatToken("}");
|
||||
} else if (currentToken.type === "text") {
|
||||
const [name] = eatText();
|
||||
segments.push(name);
|
||||
}
|
||||
next = currentToken.type === "slash";
|
||||
}
|
||||
|
||||
return {
|
||||
type: "path",
|
||||
idx,
|
||||
segments,
|
||||
};
|
||||
};
|
||||
|
||||
const parseValue = (): ValueStatement => {
|
||||
const idx = currentToken.startIdx;
|
||||
|
||||
let isTrue = false;
|
||||
let isFalse = false;
|
||||
let isNull = false;
|
||||
let isVariable = false;
|
||||
let isNumber = false;
|
||||
let isString = false;
|
||||
let value: any = undefined;
|
||||
if (currentToken.type === "keyword") {
|
||||
if (currentToken.value === "true") isTrue = true;
|
||||
else if (currentToken.value === "false") isFalse = true;
|
||||
else if (currentToken.value === "null") isNull = true;
|
||||
else {
|
||||
throw new ParserError(
|
||||
`Invalid keyword at this position ${currentToken.value}`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
eatToken();
|
||||
} else if (currentToken.type === "string") {
|
||||
isString = true;
|
||||
value = currentToken.value.slice(1, currentToken.value.length - 1);
|
||||
eatToken();
|
||||
} else if (currentToken.type === "number") {
|
||||
isNumber = true;
|
||||
value = eatNumber();
|
||||
} else if (currentToken.type === "text") {
|
||||
isVariable = true;
|
||||
[value] = eatText();
|
||||
} else {
|
||||
throw new ParserError(
|
||||
`Expected value got ${currentToken.type}`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
type: "value",
|
||||
isFalse,
|
||||
isNull,
|
||||
isNumber,
|
||||
isString,
|
||||
isTrue,
|
||||
isVariable,
|
||||
value,
|
||||
idx,
|
||||
};
|
||||
};
|
||||
|
||||
const parseCondition = (): Expression | ValueStatement => {
|
||||
// let running = true;
|
||||
let res: Expression | ValueStatement;
|
||||
let left: Expression | ValueStatement | undefined;
|
||||
|
||||
// while (running) {
|
||||
const idx = currentToken.startIdx;
|
||||
|
||||
if (!left) {
|
||||
if (currentToken.type === "bracket_open") {
|
||||
eatToken("(");
|
||||
left = parseCondition();
|
||||
eatToken(")");
|
||||
} else {
|
||||
left = parseValue();
|
||||
}
|
||||
}
|
||||
|
||||
if (currentToken.type === "comparison_operator") {
|
||||
const operator = currentToken.value;
|
||||
|
||||
eatToken();
|
||||
|
||||
let right: Expression | ValueStatement;
|
||||
|
||||
let ct = currentToken; //Quick hack because of TypeScript
|
||||
if (ct.type === "bracket_open") {
|
||||
eatToken("(");
|
||||
right = parseCondition();
|
||||
eatToken(")");
|
||||
} else {
|
||||
right = parseValue();
|
||||
}
|
||||
|
||||
res = {
|
||||
type: "expression",
|
||||
left,
|
||||
right,
|
||||
operator: operator as Operators,
|
||||
idx,
|
||||
};
|
||||
} else if (currentToken.type === "logic_operator") {
|
||||
const operator = currentToken.value;
|
||||
|
||||
eatToken();
|
||||
|
||||
const right = parseCondition();
|
||||
|
||||
res = {
|
||||
type: "expression",
|
||||
left,
|
||||
operator: operator as Operators,
|
||||
right,
|
||||
idx,
|
||||
};
|
||||
} else {
|
||||
res = left;
|
||||
}
|
||||
|
||||
// let ct = currentToken;
|
||||
// if (
|
||||
// ct.type === "comparison_operator" ||
|
||||
// ct.type === "logic_operator"
|
||||
// ) {
|
||||
// left = res;
|
||||
// } else {
|
||||
// running = false;
|
||||
// }
|
||||
// }
|
||||
return res;
|
||||
};
|
||||
|
||||
const parsePermissionStatement = (): AllowStatement => {
|
||||
const idx = eatToken("allow");
|
||||
|
||||
const operations: Operations[] = [];
|
||||
let next = currentToken.type !== "colon";
|
||||
while (next) {
|
||||
const [operation] = eatText();
|
||||
operations.push(operation as Operations);
|
||||
if (currentToken.type === "comma") {
|
||||
next = true;
|
||||
eatToken(",");
|
||||
} else {
|
||||
next = false;
|
||||
}
|
||||
}
|
||||
|
||||
eatToken(":");
|
||||
|
||||
eatToken("if");
|
||||
|
||||
const condition = parseCondition();
|
||||
|
||||
eatToken(";");
|
||||
|
||||
return {
|
||||
type: "permission",
|
||||
idx,
|
||||
operations,
|
||||
condition,
|
||||
};
|
||||
};
|
||||
|
||||
const parseMatchStatement = (): MatchStatement => {
|
||||
const idx = eatToken("match");
|
||||
const path = parsePathStatement();
|
||||
|
||||
eatToken("{");
|
||||
const matches: MatchStatement[] = [];
|
||||
const permissions: AllowStatement[] = [];
|
||||
while (currentToken.type !== "curly_close") {
|
||||
if (currentToken.value === "match") {
|
||||
matches.push(parseMatchStatement());
|
||||
} else if (currentToken.value === "allow") {
|
||||
permissions.push(parsePermissionStatement());
|
||||
} else {
|
||||
throw new ParserError(
|
||||
`Unexpected token value, expected 'match' or 'allow', received '${currentToken.value}'`,
|
||||
currentToken
|
||||
);
|
||||
}
|
||||
}
|
||||
eatToken("}");
|
||||
|
||||
return {
|
||||
type: "match",
|
||||
path,
|
||||
idx,
|
||||
matches,
|
||||
rules: permissions,
|
||||
};
|
||||
};
|
||||
|
||||
const parseServiceStatement = (): ServiceStatement => {
|
||||
const idx = eatToken("service");
|
||||
let [name] = eatText();
|
||||
eatToken("{");
|
||||
const matches: MatchStatement[] = [];
|
||||
while (currentToken.value === "match") {
|
||||
matches.push(parseMatchStatement());
|
||||
}
|
||||
eatToken("}");
|
||||
|
||||
return {
|
||||
type: "service",
|
||||
name: name,
|
||||
idx,
|
||||
matches,
|
||||
};
|
||||
};
|
||||
|
||||
const nodes: ServiceStatement[] = [];
|
||||
while (currentToken) {
|
||||
nodes.push(parseServiceStatement());
|
||||
}
|
||||
return nodes;
|
||||
}
|
||||
99
src/rules/tokenise.ts
Normal file
99
src/rules/tokenise.ts
Normal file
@ -0,0 +1,99 @@
|
||||
export type TokenTypes =
|
||||
| "space"
|
||||
| "comment"
|
||||
| "string"
|
||||
| "keyword"
|
||||
| "colon"
|
||||
| "semicolon"
|
||||
| "comma"
|
||||
| "comparison_operator"
|
||||
| "logic_operator"
|
||||
| "equals"
|
||||
| "slash"
|
||||
| "bracket_open"
|
||||
| "bracket_close"
|
||||
| "curly_open"
|
||||
| "curly_close"
|
||||
| "array"
|
||||
| "questionmark"
|
||||
| "number"
|
||||
| "text";
|
||||
|
||||
export type Token = {
|
||||
type: TokenTypes;
|
||||
value: string;
|
||||
startIdx: number;
|
||||
endIdx: number;
|
||||
};
|
||||
|
||||
type Matcher = (input: string, index: number) => undefined | Token;
|
||||
|
||||
export class TokenizerError extends Error {
|
||||
index: number;
|
||||
constructor(message: string, index: number) {
|
||||
super(message);
|
||||
this.index = index;
|
||||
}
|
||||
}
|
||||
|
||||
function regexMatcher(regex: string | RegExp, type: TokenTypes): Matcher {
|
||||
if (typeof regex === "string") regex = new RegExp(regex);
|
||||
|
||||
return (input: string, index: number) => {
|
||||
let matches = input.substring(index).match(regex as RegExp);
|
||||
if (!matches || matches.length <= 0) return undefined;
|
||||
|
||||
return {
|
||||
type,
|
||||
value: matches[0],
|
||||
startIdx: index,
|
||||
endIdx: index + matches[0].length,
|
||||
} as Token;
|
||||
};
|
||||
}
|
||||
|
||||
const matcher = [
|
||||
regexMatcher(/^\s+/, "space"),
|
||||
regexMatcher(/^(\/\*)(.|\s)*?(\*\/)/g, "comment"),
|
||||
regexMatcher(/^\/\/.+/, "comment"),
|
||||
regexMatcher(/^#.+/, "comment"),
|
||||
regexMatcher(/^".*?"/, "string"),
|
||||
// regexMatcher(/(?<=^")(.*?)(?=")/, "string"),
|
||||
regexMatcher(/^(service|match|allow|if|true|false|null)/, "keyword"),
|
||||
regexMatcher(/^\:/, "colon"),
|
||||
regexMatcher(/^\;/, "semicolon"),
|
||||
regexMatcher(/^\,/, "comma"),
|
||||
regexMatcher(/^(\=\=|\!\=|\<\=|\>\=|\>|\<)/, "comparison_operator"),
|
||||
regexMatcher(/^(&&|\|\|)/, "logic_operator"),
|
||||
regexMatcher(/^\=/, "equals"),
|
||||
regexMatcher(/^\//, "slash"),
|
||||
regexMatcher(/^\(/, "bracket_open"),
|
||||
regexMatcher(/^\)/, "bracket_close"),
|
||||
regexMatcher(/^{/, "curly_open"),
|
||||
regexMatcher(/^}/, "curly_close"),
|
||||
regexMatcher(/^\[\]/, "array"),
|
||||
regexMatcher(/^\?/, "questionmark"),
|
||||
regexMatcher(/^[0-9]+(\.[0-9]+)?/, "number"),
|
||||
regexMatcher(/^[a-zA-Z_\*]([a-zA-Z0-9_\.\*]?)+/, "text"),
|
||||
];
|
||||
|
||||
export default function tokenize(input: string) {
|
||||
let index = 0;
|
||||
let tokens: Token[] = [];
|
||||
while (index < input.length) {
|
||||
const matches = matcher.map((m) => m(input, index)).filter((e) => !!e);
|
||||
let match = matches[0];
|
||||
if (match) {
|
||||
if (match.type !== "space" && match.type !== "comment") {
|
||||
tokens.push(match);
|
||||
}
|
||||
index += match.value.length;
|
||||
} else {
|
||||
throw new TokenizerError(
|
||||
`Unexpected token '${input.substring(index, index + 1)}'`,
|
||||
index
|
||||
);
|
||||
}
|
||||
}
|
||||
return tokens;
|
||||
}
|
||||
@ -2,7 +2,7 @@ import { getTemplate } from "./hb";
|
||||
import { Context } from "vm";
|
||||
|
||||
interface IFormConfigField {
|
||||
type: "text" | "number" | "boolean" | "textarea";
|
||||
type: "text" | "number" | "boolean" | "textarea" | "codemirror";
|
||||
label: string;
|
||||
value?: string;
|
||||
disabled?: boolean;
|
||||
@ -15,16 +15,16 @@ export default function getForm(
|
||||
title: string,
|
||||
fieldConfig: IFormConfig
|
||||
): (ctx: Context) => void {
|
||||
let fields = Object.keys(fieldConfig).map(name => ({
|
||||
let fields = Object.keys(fieldConfig).map((name) => ({
|
||||
name,
|
||||
...fieldConfig[name],
|
||||
disabled: fieldConfig.disabled ? "disabled" : ""
|
||||
disabled: fieldConfig.disabled ? "disabled" : "",
|
||||
}));
|
||||
|
||||
return ctx =>
|
||||
return (ctx) =>
|
||||
(ctx.body = getTemplate("forms")({
|
||||
url,
|
||||
title,
|
||||
fields
|
||||
fields,
|
||||
}));
|
||||
}
|
||||
|
||||
@ -5,7 +5,7 @@ import getTable from "../helper/table";
|
||||
import {
|
||||
BadRequestError,
|
||||
NoPermissionError,
|
||||
NotFoundError
|
||||
NotFoundError,
|
||||
} from "../helper/errors";
|
||||
import { DatabaseManager } from "../../database/database";
|
||||
import { MP } from "../../database/query";
|
||||
@ -21,17 +21,17 @@ AdminRoute.use(async (ctx, next) => {
|
||||
return next();
|
||||
});
|
||||
|
||||
AdminRoute.get("/", async ctx => {
|
||||
AdminRoute.get("/", async (ctx) => {
|
||||
//TODO: Main Interface
|
||||
ctx.body = getView("admin");
|
||||
});
|
||||
|
||||
AdminRoute.get("/settings", async ctx => {
|
||||
AdminRoute.get("/settings", async (ctx) => {
|
||||
let res = await new Promise<string[][]>((yes, no) => {
|
||||
const stream = Settings.db.createReadStream({
|
||||
keys: true,
|
||||
values: true,
|
||||
valueAsBuffer: true
|
||||
valueAsBuffer: true,
|
||||
});
|
||||
let res = [["key", "value"]];
|
||||
stream.on("data", ({ key, value }) => {
|
||||
@ -49,7 +49,7 @@ AdminRoute.get("/settings", async ctx => {
|
||||
}
|
||||
});
|
||||
|
||||
AdminRoute.get("/data", async ctx => {
|
||||
AdminRoute.get("/data", async (ctx) => {
|
||||
const { database } = ctx.query;
|
||||
let db = DatabaseManager.getDatabase(database);
|
||||
if (!db) throw new BadRequestError("Database not found");
|
||||
@ -59,7 +59,7 @@ AdminRoute.get("/data", async ctx => {
|
||||
values: true,
|
||||
valueAsBuffer: true,
|
||||
keyAsBuffer: false,
|
||||
limit: 1000
|
||||
limit: 1000,
|
||||
});
|
||||
let res = [["key", "value"]];
|
||||
stream.on("data", ({ key, value }: { key: string; value: Buffer }) => {
|
||||
@ -67,7 +67,7 @@ AdminRoute.get("/data", async ctx => {
|
||||
key,
|
||||
key.split("/").length > 2
|
||||
? value.toString()
|
||||
: JSON.stringify(MP.decode(value))
|
||||
: JSON.stringify(MP.decode(value)),
|
||||
]);
|
||||
});
|
||||
|
||||
@ -82,7 +82,7 @@ AdminRoute.get("/data", async ctx => {
|
||||
}
|
||||
});
|
||||
|
||||
AdminRoute.get("/database", ctx => {
|
||||
AdminRoute.get("/database", (ctx) => {
|
||||
const isFull = ctx.query.full === "true" || ctx.query.full === "1";
|
||||
let res;
|
||||
if (isFull) {
|
||||
@ -90,7 +90,7 @@ AdminRoute.get("/database", ctx => {
|
||||
res = Array.from(DatabaseManager.databases.entries()).map(
|
||||
([name, config]) => ({
|
||||
name,
|
||||
...JSON.parse(JSON.stringify(config))
|
||||
...JSON.parse(JSON.stringify(config)),
|
||||
})
|
||||
);
|
||||
} else {
|
||||
@ -102,7 +102,7 @@ AdminRoute.get("/database", ctx => {
|
||||
} else {
|
||||
ctx.body = res;
|
||||
}
|
||||
}).post("/database", async ctx => {
|
||||
}).post("/database", async (ctx) => {
|
||||
const { name, rules, publickey, accesskey, rootkey } = ctx.request.body;
|
||||
|
||||
if (!name) throw new BadRequestError("Name must be set!");
|
||||
@ -121,7 +121,7 @@ AdminRoute.get("/database", ctx => {
|
||||
ctx.body = "Success";
|
||||
});
|
||||
|
||||
AdminRoute.get("/collections", async ctx => {
|
||||
AdminRoute.get("/collections", async (ctx) => {
|
||||
const { database } = ctx.query;
|
||||
let db = DatabaseManager.getDatabase(database);
|
||||
if (!db) throw new BadRequestError("Database not found");
|
||||
@ -129,7 +129,7 @@ AdminRoute.get("/collections", async ctx => {
|
||||
let res = await new Promise<string[]>((yes, no) => {
|
||||
const stream = db.collections.createKeyStream({
|
||||
keyAsBuffer: false,
|
||||
limit: 1000
|
||||
limit: 1000,
|
||||
});
|
||||
let res = [];
|
||||
stream.on("data", (key: string) => {
|
||||
@ -147,7 +147,7 @@ AdminRoute.get("/collections", async ctx => {
|
||||
}
|
||||
});
|
||||
|
||||
AdminRoute.get("/collections/cleanup", async ctx => {
|
||||
AdminRoute.get("/collections/cleanup", async (ctx) => {
|
||||
const { database } = ctx.query;
|
||||
let db = DatabaseManager.getDatabase(database);
|
||||
if (!db) throw new BadRequestError("Database not found");
|
||||
@ -169,13 +169,13 @@ AdminRoute.get(
|
||||
rules: {
|
||||
label: "Rules",
|
||||
type: "textarea",
|
||||
value: `{\n ".write": true, \n ".read": true \n}`
|
||||
value: `{\n ".write": true, \n ".read": true \n}`,
|
||||
},
|
||||
publickey: { label: "Public Key", type: "textarea" }
|
||||
publickey: { label: "Public Key", type: "textarea" },
|
||||
})
|
||||
);
|
||||
|
||||
AdminRoute.get("/database/update", async ctx => {
|
||||
AdminRoute.get("/database/update", async (ctx) => {
|
||||
const { database } = ctx.query;
|
||||
let db = DatabaseManager.getDatabase(database);
|
||||
if (!db) throw new NotFoundError("Database not found!");
|
||||
@ -184,28 +184,28 @@ AdminRoute.get("/database/update", async ctx => {
|
||||
label: "Name",
|
||||
type: "text",
|
||||
value: db.name,
|
||||
disabled: true
|
||||
disabled: true,
|
||||
},
|
||||
accesskey: {
|
||||
label: "Access Key",
|
||||
type: "text",
|
||||
value: db.accesskey
|
||||
value: db.accesskey,
|
||||
},
|
||||
rootkey: {
|
||||
label: "Root access key",
|
||||
type: "text",
|
||||
value: db.rootkey
|
||||
value: db.rootkey,
|
||||
},
|
||||
rules: {
|
||||
label: "Rules",
|
||||
type: "textarea",
|
||||
value: db.rules.toJSON()
|
||||
type: "codemirror",
|
||||
value: db.rawRules,
|
||||
},
|
||||
publickey: {
|
||||
label: "Public Key",
|
||||
type: "textarea",
|
||||
value: db.publickey
|
||||
}
|
||||
value: db.publickey,
|
||||
},
|
||||
})(ctx);
|
||||
});
|
||||
|
||||
|
||||
Reference in New Issue
Block a user