gpii-universal/gpii/node_modules/flowManager/src/SettingsGetHandler.js

Cross platform, core components of the GPII personalization infrastructure.

/*
 * GPII Untrusted Settings Get Handler
 *
 * Copyright 2017 OCAD University
 * Copyright 2019 OCAD University
 *
 * Licensed under the New BSD license. You may not use this file except in
 * compliance with this License.
 *
 * You may obtain a copy of the License at
 * https://github.com/GPII/universal/blob/master/LICENSE.txt
 */

"use strict";

var fluid = require("infusion"),
    kettle = require("kettle"),
    gpii = fluid.registerNamespace("gpii");

// Get settings in the ontology of preferences from the cloud based flow manager.
// These settings are untransformed lifecycle instructions.
// See [an example of the return payload of this endpoint](https://github.com/GPII/gpii-payloads/blob/master/CloudBasedFlowManagerUntrustedSettings.md#user-content-return-payload).
fluid.defaults("gpii.flowManager.cloudBased.settings.get.handler", {
    gradeNames: ["kettle.request.http", "gpii.flowManager.matchMaking"],
    invokers: {
        handleRequest: {
            funcName: "gpii.flowManager.cloudBased.settings.get.handleRequest",
            args: [
                "{that}",
                "{gpii.flowManager.cloudBased}.authGrantFinder"
            ]
        },
        matchToSettings: {
            funcName: "gpii.flowManager.cloudBased.matchToSettings",
            args: ["{arguments}.0", "{that}.events.onSuccess", "CloudBased FlowManager"]
        }
    },
    listeners: {
        onMatchDone: "{that}.matchToSettings"
    }
});

gpii.flowManager.cloudBased.settings.get.handleRequest = function (that, authGrantFinder) {
    // Verify the access token
    var accessToken = gpii.oauth2.parseAccessTokenFromRequest(that.req);
    var authorizationPromise = gpii.oauth2.getAuthorization(accessToken, authGrantFinder);
    var gpiiKey = that.req.params.gpiiKey;
    var deviceString = that.req.params.device;

    authorizationPromise.then(function (authorization) {
        if (authorization && authorization.gpiiKey === gpiiKey && authorization.allowSettingsGet) {
            var deviceContext;
            try {
                deviceContext = kettle.JSON.parse(deviceString);
            } catch (ex) {
                that.events.onError.fire({
                    isError: true,
                    message: "Cloud based flow manager requires device information - failed to parse " + ex.message
                });
                return;
            }
            that.events.onGpiiKey.fire(gpiiKey);
            that.events.onDeviceContext.fire(deviceContext);
        } else {
            fluid.log("CloudBased flowManager: unauthorized GET request at /settings due to one of these reasons: 1. authorization record is missing; 2. gpiiKey associated with the authorization does not match the in-used GPII key " + gpiiKey + "; 3. the access token is unauthorized for using GET method at /settings endpoint.");
            that.events.onError.fire(gpii.dbOperation.errors.unauthorized);
            return;
        }
    }, function (error) {
        fluid.log("CloudBased flowManager: GET request at /settings for the GPII key (" + gpiiKey + ") failed with error: ", error);
        that.events.onError.fire(gpii.dbOperation.errors.unauthorized);
        return;
    });
};

/**
 * This should be used as the last step of the matchmaking process in a cloudbased/Untrusted flowmanager setup.
 * It modifies the final payload by filtering out the irrelevant data before passing it on to the
 * given event.
 *
 * Note that we modify (filter) the users preference set before passing it on in the payload. This is done because
 * this function is meant for a configuration of the GPII where the local flowmanager is untrusted - therefore we do not
 * want to pass the full preference set back to it. On the other hand, the PSP need access to the users preferences to show and
 * modify them. Therefore the preference set is filtered to only contain the preferences and settings that are
 * relevant to the configuration of the device (i.e. in the inferredConfiguration), any preferences not present there
 * are removed. This means a compromised local flowmanager would not gain any further information from looking at
 * the preference set than it could have got by looking at the inferred configuration.
 * @param {Object} finalPayload - The MatchMaker final payload result.
 * @param {Event} event - Fired when with the filtered output payload.
 * @param {String} sourceName - The name of the source component that calls this function. The source could be the
 * cloud based flow manager or the private matchmaker.
 */
gpii.flowManager.cloudBased.matchToSettings = function (finalPayload, event, sourceName) {
    // Note that we send the filtered preferences to assist a PSP - we may do more filtering here at some point
    var settings = fluid.filterKeys(finalPayload, [
        "gpiiKey", "activePrefsSetName", "preferences",
        "activeConfiguration", "solutionsRegistryEntries", "matchMakerOutput"
    ]);
    settings.preferences = gpii.matchMakerFramework.utils.filterPreferencesFromInferredConfig(settings.preferences, settings.matchMakerOutput.inferredConfiguration);
    fluid.log(sourceName, ": /settings endpoint responding settings ", settings);
    event.fire(settings);
};