k2hr3-api
Version:
K2HR3 REST API is K2hdkc based Resource and Roles and policy Rules
259 lines (258 loc) • 10.2 kB
JavaScript
;
/*
* K2HR3 REST API
*
* Copyright 2018 Yahoo Japan Corporation.
*
* K2HR3 is K2hdkc based Resource and Roles and policy Rules, gathers
* common management information for the cloud.
* K2HR3 can dynamically manage information as "who", "what", "operate".
* These are stored as roles, resources, policies in K2hdkc, and the
* client system can dynamically read and modify these information.
*
* For the full copyright and license information, please view
* the license file that was distributed with this source code.
*
* AUTHOR: Takeshi Nakatani
* CREATE: Tue Oct 2 2018
* REVISION:
*
*/
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.k2hr3cryptutil = void 0;
const crypto = __importStar(require("crypto"));
const zlib = __importStar(require("zlib"));
const k2hr3apiutil_1 = __importDefault(require("./k2hr3apiutil"));
const dbglogging_1 = __importDefault(require("./dbglogging"));
const crypto_1 = require("crypto");
//---------------------------------------------------------
// Crypt for using in registering role member
//---------------------------------------------------------
// These utility functions are used by URL parameter for
// registering role member. The registering role member
// parameter is string which is encoded URI/JSON and encrypted.
// We use following functions for this logic.
//
const rawR3Encrypt = (str, passphrase, algorithm) => {
if (!k2hr3apiutil_1.default.isSafeString(str)) {
dbglogging_1.default.elog('The target string for encrypting is empty or not string.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeString(passphrase)) {
dbglogging_1.default.elog('The pass phrase string is empty or not string.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeString(algorithm)) {
dbglogging_1.default.elog('The algorithm cipher string is empty or not string.');
return null;
}
try {
// [NOTE] crypto.createCipher is deprecated
//
// Previously, the encoding was as follows, but this method is not used now.
// var cipherObj = crypto.createCipher(algorithm, passphrase);
// var cryptedStr = cipherObj.update(str, 'utf8', 'base64');
// cryptedStr += cipherObj.final('base64');
//
const initVector = crypto.randomBytes(16);
const pass2pbkdf = crypto.pbkdf2Sync(passphrase, initVector.toString(), 10000, 32, 'sha512');
const cipherObj = crypto.createCipheriv(algorithm, pass2pbkdf, initVector);
const cryptedMix = Buffer.concat([initVector, Buffer.from(':'), cipherObj.update(Buffer.from(str)), cipherObj.final()]);
const cryptedStr = cryptedMix.toString('base64');
// [NOTE]
// Use encodeURIComponent() instead of encodeURI() because we need to
// convert '/', '?', ':' characters.
return encodeURIComponent(cryptedStr);
}
catch (exception) {
dbglogging_1.default.dlog(JSON.stringify(exception));
return null;
}
};
const rawR3EncryptJSON = (obj, passphrase, algorithm) => {
if (!k2hr3apiutil_1.default.isSafeEntity(obj)) {
dbglogging_1.default.elog('The object is something wrong.');
return null;
}
return rawR3Encrypt(JSON.stringify(obj), passphrase, algorithm);
};
const rawR3Decrypt = (str, passphrase, algorithm) => {
if (!k2hr3apiutil_1.default.isSafeString(str)) {
dbglogging_1.default.elog('The target string for encrypting is empty or not string.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeString(passphrase)) {
dbglogging_1.default.elog('The pass phrase string is empty or not string.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeString(algorithm)) {
dbglogging_1.default.elog('The algorithm cipher string is empty or not string.');
return null;
}
try {
// [NOTE]
// Use encodeURIComponent() instead of encodeURI() because we need to
// convert '/', '?', ':' characters.
const decodeStr = decodeURIComponent(str);
const decodeMix = Buffer.from(decodeStr, 'base64');
let decryptedStr;
if (decodeMix.slice(16, 17).toString() === ':') {
const initVector = decodeMix.slice(0, 16);
const pass2pbkdf = crypto.pbkdf2Sync(passphrase, initVector.toString(), 10000, 32, 'sha512');
const decipherObj = crypto.createDecipheriv(algorithm, pass2pbkdf, initVector);
const decryptedBuf = Buffer.concat([decipherObj.update(decodeMix.slice(17)), decipherObj.final()]);
decryptedStr = decryptedBuf.toString();
}
else {
// [NOTE][TODO]
// Changed from createDecipher to createDecipheriv.
// To maintain compatibility, the iv value is filled with 0.
// We plan to change this so that it can be set to a value other than 0 in the future.
//
const key = (0, crypto_1.scryptSync)(passphrase, 'salt', 32); // 32 byte
const iv = Buffer.alloc(16, 0); // [NOTE] full all with 0, so we should change this code.
const cipherObj = (0, crypto_1.createDecipheriv)(algorithm, key, iv);
decryptedStr = cipherObj.update(decodeStr, 'base64', 'utf8');
decryptedStr += cipherObj.final('utf8');
}
return decryptedStr;
}
catch (exception) {
dbglogging_1.default.dlog(JSON.stringify(exception));
return null;
}
};
const rawR3DecryptJSON = (str, passphrase, algorithm) => {
const decStr = rawR3Decrypt(str, passphrase, algorithm);
if (!k2hr3apiutil_1.default.isSafeString(decStr)) {
return null;
}
if (!k2hr3apiutil_1.default.checkSimpleJSON(decStr)) {
dbglogging_1.default.elog('The decripted string(' + k2hr3apiutil_1.default.getSafeString(decStr) + ') is not JSON string.');
return null;
}
return k2hr3apiutil_1.default.parseJSON(decStr);
};
const rawR3Gzip = (str, callback) => {
if (!k2hr3apiutil_1.default.isSafeString(str)) {
// not allow empty string('') too.
dbglogging_1.default.elog('string parameter is empty.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeEntity(callback)) {
// sync type
const _data = zlib.gzipSync(str);
const _length = _data.length;
const result = {
data: _data,
length: _length
};
return result;
}
else if (!k2hr3apiutil_1.default.isFunction(callback)) {
// error
dbglogging_1.default.elog('callback parameter is not function.');
return null;
}
else {
// callback type
const _callback = callback;
zlib.gzip(str, (error, binary) => {
if (error || !binary) {
dbglogging_1.default.elog('failed to compress(zip) string by ' + (error?.message ? error.message : ''));
return _callback(error);
}
const result = {
data: binary,
length: binary.length
};
_callback(null, result);
});
}
};
const rawR3Gunzip = (bin, callback) => {
if (!k2hr3apiutil_1.default.isSafeEntity(bin) || !(bin instanceof Buffer)) {
// not allow empty string('') too.
dbglogging_1.default.elog('binary parameter is not instance of Buffer.');
return null;
}
if (!k2hr3apiutil_1.default.isSafeEntity(callback)) {
// sync type
return zlib.gunzipSync(bin).toString();
}
else if (!k2hr3apiutil_1.default.isFunction(callback)) {
// error
dbglogging_1.default.elog('callback parameter is not function.');
return null;
}
else {
// callback type
const _callback = callback;
zlib.gunzip(bin, (error, binary) => {
if (error || !binary) {
dbglogging_1.default.elog('failed to decompress(unzip) binary by ' + (error?.message ? error.message : ''));
return _callback(error);
}
_callback(null, binary.toString());
});
}
};
//---------------------------------------------------------
// Exports
//---------------------------------------------------------
//
// Functions
//
exports.k2hr3cryptutil = {
r3Encrypt: rawR3Encrypt,
r3EncryptJSON: rawR3EncryptJSON,
r3Decrypt: rawR3Decrypt,
r3DecryptJSON: rawR3DecryptJSON,
r3Gzip: rawR3Gzip,
r3Gunzip: rawR3Gunzip
};
exports.default = exports.k2hr3cryptutil;
/*
* Local variables:
* tab-width: 4
* c-basic-offset: 4
* End:
* vim600: noexpandtab sw=4 ts=4 fdm=marker
* vim<600: noexpandtab sw=4 ts=4
*/