spartan-shield/example/example.com/security/validation2.js

nodejs project to package and configure common security middleware.

'use strict'
import validate from 'validate.js'
// import formidable from 'formidable'
import whitelist, { headers } from './.whitelists.json'
//  let browserErrors = {}

// check file types
  // look at end of file name
  // look at file size
  // look at file metadata
  // look at file name

const uploadInspector = (formInput) => {
  formInput.name
}
// check user input
  // check data types
  // check data length
  // check data context 
// create errors for failures
// create output/receipt




















const sanitizeInput = async (input) => {

}
const formCheck = (formValues, rules, callback) => {
  let error = new Error('validation/invalid-form-value')
  let errResult = validate(formValues, rules)
  if (errResult !== undefined) {
    callback(error, errResult)
  }
  error.code = 400
  return 'pass' || error
}
const headerCheck = (headerValue) => {
  let headerErrors = []
  let match = 0
  for (let h in headerValue) {
    // each key in the headerValue object should match a key in the whitelist
    if (!headers.includes(h)) {
      headerErrors.push(`validation/${h}-not-in-whitelist`)
    }
    (headers).forEach(e => {
      if (e === h) {
        match++
      }
    })
    if (Object.keys(headerValue).length !== headers.length || match === 0) {
      // now we need a way to see if the required headers are there
      headerErrors.push('validation/missing-required-header')
    }
    if (!whitelist[h].includes(headerValue[h])) {
      // now we need to check to see if the property values are what they are supposed to be for each header
      headerErrors.push(`validation/${headerValue[h]}-not-in-whitelist`)
    }
  }
  return headerErrors || undefined
}
const browserCheck = (request) => {
  // check that user agents provided are on the whitelist
  if (!whitelist['user-agent'].includes(request.headers['user-agent'])) {
    browserErrors['user-agent'] = 'validation/user-agent-mismatch'
  }
  // check headers?
  let headerErrors = headerCheck(request.headers) // request.headers is expected to be an object
  if (headerErrors) {
    browserCheck['headers'] = headerErrors
  }
  // check connection
  if (request.connection.encrypted !== 'https') {
    browserErrors['connection'] = 'validation/failed-connection-check'
  }
  return browserErrors || undefined
}

export function validator (whatToValidate) {
  try {
    // something
  } catch (e) {
    e.code = '(validation/validation-error)'
    return e
  }
}