anomaly-express/dist/helper/Policy.js

Anomaly Express is a security framework for Express.js that provides a set of tools and utilities to help you build secure applications.

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.PolicyManager = void 0;
const config_1 = require("../utils/config");
class PolicyManager {
    constructor(blockRealtime, appId, apiKey) {
        this.refreshInterval = null;
        this.policies = null;
        this.endpointMapper = null;
        this.appId = appId;
        this.apiKey = apiKey;
        if (blockRealtime)
            this.initializePolicyFetch();
    }
    fetchPolicies() {
        return __awaiter(this, void 0, void 0, function* () {
            try {
                const endpoint = `${config_1.FETCH_POLICIES_ENDPOINT}?appId=${this.appId}`;
                const response = yield fetch(endpoint, {
                    method: "GET",
                    headers: {
                        "Content-Type": "application/json",
                        x_api_key: this.apiKey,
                    },
                });
                if (!response.ok) {
                    console.error("Response from anomaly servers is not ok: ", yield response.text());
                    return (this.policies = null);
                }
                const data = (yield response.json());
                if (!data) {
                    console.error("No data received from anomaly servers");
                    this.endpointMapper = null;
                    return (this.policies = null);
                }
                const policies = data.policies;
                if (!policies) {
                    console.error("No policies received from anomaly servers");
                    this.endpointMapper = null;
                    return (this.policies = null);
                }
                if (!data.endpointMapper) {
                    console.error("No endpoint mapper received from anomaly servers");
                    this.endpointMapper = null;
                    return (this.policies = policies);
                }
                this.endpointMapper = data.endpointMapper;
                return (this.policies = policies);
            }
            catch (error) {
                console.error("Error fetching policies: ", error);
                return (this.policies = null);
            }
        });
    }
    initializePolicyFetch() {
        console.log("Realtime Anomaly Check Enabled");
        if (this.refreshInterval) {
            clearInterval(this.refreshInterval);
        }
        this.fetchPolicies();
        this.refreshInterval = setInterval(() => {
            this.fetchPolicies();
        }, config_1.FETCH_POLICIES_INTERVAL_IN_SECONDS * 1000);
    }
    getPolicies() {
        return this.policies;
    }
    getEndpointMappingResultOfRequest(endpointMapperData, requestDataFromSdk) {
        try {
            const matchUrlToEndpointFunction = eval("(" + endpointMapperData.match_url_to_endpoint_function + ")");
            const result = matchUrlToEndpointFunction(requestDataFromSdk.url);
            return result.endpoint;
        }
        catch (error) {
            console.error("Error while getting endpoint for this request: ", error);
            return false;
        }
    }
    getPolicyByEndpointAndMethod(endpoint, method) {
        if (this.policies === null) {
            console.error("Policies are null at the moment.");
            return false;
        }
        const policy = this.policies.find((policy) => policy.url === endpoint && policy.method === method);
        if (!policy) {
            console.error("No policy found for the request: ", endpoint, " and ", method);
            return false;
        }
        return policy;
    }
    getResultFromCheckingFunction(policyData, requestData) {
        try {
            const checkingFunction = eval("(" + policyData.checking_function + ")");
            const result = checkingFunction(requestData);
            return result;
        }
        catch (error) {
            console.error("Error in getting result from checking function: ", error);
            return false;
        }
    }
    checkRequestForAnomaly(requestDataFromSDK) {
        if (!this.endpointMapper) {
            console.error("Endpoint mapper is null at the moment.");
            return null;
        }
        if (this.endpointMapper === "no_endpoint_mapper") {
            console.warn("No Policy Endpoint Mapping Found.");
            console.warn("This request will be checked in our servers later.");
            return null;
        }
        const endpoint = this.getEndpointMappingResultOfRequest(this.endpointMapper, requestDataFromSDK);
        if (!endpoint) {
            console.warn("Endpoint could not be found for the request. Aborting realtime anomaly check.");
            console.warn("This request will be checked in our servers later.");
            return null;
        }
        const relatedPolicy = this.getPolicyByEndpointAndMethod(endpoint, requestDataFromSDK.method);
        if (!relatedPolicy) {
            console.warn("Related policy could not be found for the request. Aborting realtime anomaly check.");
            console.warn("This request will be checked in our servers later.");
            return null;
        }
        const result = this.getResultFromCheckingFunction(relatedPolicy, requestDataFromSDK);
        if (!result) {
            console.warn("Result from checking function is false. Aborting realtime anomaly check.");
            console.warn("This request will be checked in our servers later.");
            return null;
        }
        return Object.assign(Object.assign({}, result), { detected_by_policy_id: relatedPolicy.id });
    }
}
exports.PolicyManager = PolicyManager;