fix(routing): unify route based architecture
This commit is contained in:
333
ts/core/utils/shared-security-manager.ts
Normal file
333
ts/core/utils/shared-security-manager.ts
Normal file
@ -0,0 +1,333 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { IRouteConfig, IRouteContext } from '../../proxies/smart-proxy/models/route-types.js';
|
||||
import type {
|
||||
IIpValidationResult,
|
||||
IIpConnectionInfo,
|
||||
ISecurityLogger,
|
||||
IRateLimitInfo
|
||||
} from './security-utils.js';
|
||||
import {
|
||||
isIPAuthorized,
|
||||
checkMaxConnections,
|
||||
checkConnectionRate,
|
||||
trackConnection,
|
||||
removeConnection,
|
||||
cleanupExpiredRateLimits,
|
||||
parseBasicAuthHeader
|
||||
} from './security-utils.js';
|
||||
|
||||
/**
|
||||
* Shared SecurityManager for use across proxy components
|
||||
* Handles IP tracking, rate limiting, and authentication
|
||||
*/
|
||||
export class SharedSecurityManager {
|
||||
// IP connection tracking
|
||||
private connectionsByIP: Map<string, IIpConnectionInfo> = new Map();
|
||||
|
||||
// Route-specific rate limiting
|
||||
private rateLimits: Map<string, Map<string, IRateLimitInfo>> = new Map();
|
||||
|
||||
// Cache IP filtering results to avoid constant regex matching
|
||||
private ipFilterCache: Map<string, Map<string, boolean>> = new Map();
|
||||
|
||||
// Default limits
|
||||
private maxConnectionsPerIP: number;
|
||||
private connectionRateLimitPerMinute: number;
|
||||
|
||||
// Cache cleanup interval
|
||||
private cleanupInterval: NodeJS.Timeout | null = null;
|
||||
|
||||
/**
|
||||
* Create a new SharedSecurityManager
|
||||
*
|
||||
* @param options - Configuration options
|
||||
* @param logger - Logger instance
|
||||
*/
|
||||
constructor(options: {
|
||||
maxConnectionsPerIP?: number;
|
||||
connectionRateLimitPerMinute?: number;
|
||||
cleanupIntervalMs?: number;
|
||||
routes?: IRouteConfig[];
|
||||
}, private logger?: ISecurityLogger) {
|
||||
this.maxConnectionsPerIP = options.maxConnectionsPerIP || 100;
|
||||
this.connectionRateLimitPerMinute = options.connectionRateLimitPerMinute || 300;
|
||||
|
||||
// Set up logger with defaults if not provided
|
||||
this.logger = logger || {
|
||||
info: console.log,
|
||||
warn: console.warn,
|
||||
error: console.error
|
||||
};
|
||||
|
||||
// Set up cache cleanup interval
|
||||
const cleanupInterval = options.cleanupIntervalMs || 60000; // Default: 1 minute
|
||||
this.cleanupInterval = setInterval(() => {
|
||||
this.cleanupCaches();
|
||||
}, cleanupInterval);
|
||||
|
||||
// Don't keep the process alive just for cleanup
|
||||
if (this.cleanupInterval.unref) {
|
||||
this.cleanupInterval.unref();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get connections count by IP
|
||||
*
|
||||
* @param ip - The IP address to check
|
||||
* @returns Number of connections from this IP
|
||||
*/
|
||||
public getConnectionCountByIP(ip: string): number {
|
||||
return this.connectionsByIP.get(ip)?.connections.size || 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Track connection by IP
|
||||
*
|
||||
* @param ip - The IP address to track
|
||||
* @param connectionId - The connection ID to associate
|
||||
*/
|
||||
public trackConnectionByIP(ip: string, connectionId: string): void {
|
||||
trackConnection(ip, connectionId, this.connectionsByIP);
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove connection tracking for an IP
|
||||
*
|
||||
* @param ip - The IP address to update
|
||||
* @param connectionId - The connection ID to remove
|
||||
*/
|
||||
public removeConnectionByIP(ip: string, connectionId: string): void {
|
||||
removeConnection(ip, connectionId, this.connectionsByIP);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if IP is authorized based on route security settings
|
||||
*
|
||||
* @param ip - The IP address to check
|
||||
* @param allowedIPs - List of allowed IP patterns
|
||||
* @param blockedIPs - List of blocked IP patterns
|
||||
* @returns Whether the IP is authorized
|
||||
*/
|
||||
public isIPAuthorized(
|
||||
ip: string,
|
||||
allowedIPs: string[] = ['*'],
|
||||
blockedIPs: string[] = []
|
||||
): boolean {
|
||||
return isIPAuthorized(ip, allowedIPs, blockedIPs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate IP against rate limits and connection limits
|
||||
*
|
||||
* @param ip - The IP address to validate
|
||||
* @returns Result with allowed status and reason if blocked
|
||||
*/
|
||||
public validateIP(ip: string): IIpValidationResult {
|
||||
// Check connection count limit
|
||||
const connectionResult = checkMaxConnections(
|
||||
ip,
|
||||
this.connectionsByIP,
|
||||
this.maxConnectionsPerIP
|
||||
);
|
||||
if (!connectionResult.allowed) {
|
||||
return connectionResult;
|
||||
}
|
||||
|
||||
// Check connection rate limit
|
||||
const rateResult = checkConnectionRate(
|
||||
ip,
|
||||
this.connectionsByIP,
|
||||
this.connectionRateLimitPerMinute
|
||||
);
|
||||
if (!rateResult.allowed) {
|
||||
return rateResult;
|
||||
}
|
||||
|
||||
return { allowed: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a client is allowed to access a specific route
|
||||
*
|
||||
* @param route - The route to check
|
||||
* @param context - The request context
|
||||
* @returns Whether access is allowed
|
||||
*/
|
||||
public isAllowed(route: IRouteConfig, context: IRouteContext): boolean {
|
||||
if (!route.security) {
|
||||
return true; // No security restrictions
|
||||
}
|
||||
|
||||
// --- IP filtering ---
|
||||
if (!this.isClientIpAllowed(route, context.clientIp)) {
|
||||
this.logger?.debug?.(`IP ${context.clientIp} is blocked for route ${route.name || 'unnamed'}`);
|
||||
return false;
|
||||
}
|
||||
|
||||
// --- Rate limiting ---
|
||||
if (route.security.rateLimit?.enabled && !this.isWithinRateLimit(route, context)) {
|
||||
this.logger?.debug?.(`Rate limit exceeded for route ${route.name || 'unnamed'}`);
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a client IP is allowed for a route
|
||||
*
|
||||
* @param route - The route to check
|
||||
* @param clientIp - The client IP
|
||||
* @returns Whether the IP is allowed
|
||||
*/
|
||||
private isClientIpAllowed(route: IRouteConfig, clientIp: string): boolean {
|
||||
if (!route.security) {
|
||||
return true; // No security restrictions
|
||||
}
|
||||
|
||||
const routeId = route.id || route.name || 'unnamed';
|
||||
|
||||
// Check cache first
|
||||
if (!this.ipFilterCache.has(routeId)) {
|
||||
this.ipFilterCache.set(routeId, new Map());
|
||||
}
|
||||
|
||||
const routeCache = this.ipFilterCache.get(routeId)!;
|
||||
if (routeCache.has(clientIp)) {
|
||||
return routeCache.get(clientIp)!;
|
||||
}
|
||||
|
||||
// Check IP against route security settings
|
||||
const ipAllowList = route.security.ipAllowList || route.security.allowedIps;
|
||||
const ipBlockList = route.security.ipBlockList || route.security.blockedIps;
|
||||
|
||||
const allowed = this.isIPAuthorized(clientIp, ipAllowList, ipBlockList);
|
||||
|
||||
// Cache the result
|
||||
routeCache.set(clientIp, allowed);
|
||||
|
||||
return allowed;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if request is within rate limit
|
||||
*
|
||||
* @param route - The route to check
|
||||
* @param context - The request context
|
||||
* @returns Whether the request is within rate limit
|
||||
*/
|
||||
private isWithinRateLimit(route: IRouteConfig, context: IRouteContext): boolean {
|
||||
if (!route.security?.rateLimit?.enabled) {
|
||||
return true;
|
||||
}
|
||||
|
||||
const rateLimit = route.security.rateLimit;
|
||||
const routeId = route.id || route.name || 'unnamed';
|
||||
|
||||
// Determine rate limit key (by IP, path, or header)
|
||||
let key = context.clientIp; // Default to IP
|
||||
|
||||
if (rateLimit.keyBy === 'path' && context.path) {
|
||||
key = `${context.clientIp}:${context.path}`;
|
||||
} else if (rateLimit.keyBy === 'header' && rateLimit.headerName && context.headers) {
|
||||
const headerValue = context.headers[rateLimit.headerName.toLowerCase()];
|
||||
if (headerValue) {
|
||||
key = `${context.clientIp}:${headerValue}`;
|
||||
}
|
||||
}
|
||||
|
||||
// Get or create rate limit tracking for this route
|
||||
if (!this.rateLimits.has(routeId)) {
|
||||
this.rateLimits.set(routeId, new Map());
|
||||
}
|
||||
|
||||
const routeLimits = this.rateLimits.get(routeId)!;
|
||||
const now = Date.now();
|
||||
|
||||
// Get or create rate limit tracking for this key
|
||||
let limit = routeLimits.get(key);
|
||||
if (!limit || limit.expiry < now) {
|
||||
// Create new rate limit or reset expired one
|
||||
limit = {
|
||||
count: 1,
|
||||
expiry: now + (rateLimit.window * 1000)
|
||||
};
|
||||
routeLimits.set(key, limit);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Increment the counter
|
||||
limit.count++;
|
||||
|
||||
// Check if rate limit is exceeded
|
||||
return limit.count <= rateLimit.maxRequests;
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate HTTP Basic Authentication
|
||||
*
|
||||
* @param route - The route to check
|
||||
* @param authHeader - The Authorization header
|
||||
* @returns Whether authentication is valid
|
||||
*/
|
||||
public validateBasicAuth(route: IRouteConfig, authHeader?: string): boolean {
|
||||
// Skip if basic auth not enabled for route
|
||||
if (!route.security?.basicAuth?.enabled) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// No auth header means auth failed
|
||||
if (!authHeader) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Parse auth header
|
||||
const credentials = parseBasicAuthHeader(authHeader);
|
||||
if (!credentials) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Check credentials against configured users
|
||||
const { username, password } = credentials;
|
||||
const users = route.security.basicAuth.users;
|
||||
|
||||
return users.some(user =>
|
||||
user.username === username && user.password === password
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up caches to prevent memory leaks
|
||||
*/
|
||||
private cleanupCaches(): void {
|
||||
// Clean up rate limits
|
||||
cleanupExpiredRateLimits(this.rateLimits, this.logger);
|
||||
|
||||
// IP filter cache doesn't need cleanup (tied to routes)
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear all IP tracking data (for shutdown)
|
||||
*/
|
||||
public clearIPTracking(): void {
|
||||
this.connectionsByIP.clear();
|
||||
this.rateLimits.clear();
|
||||
this.ipFilterCache.clear();
|
||||
|
||||
if (this.cleanupInterval) {
|
||||
clearInterval(this.cleanupInterval);
|
||||
this.cleanupInterval = null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update routes for security checking
|
||||
*
|
||||
* @param routes - New routes to use
|
||||
*/
|
||||
public setRoutes(routes: IRouteConfig[]): void {
|
||||
// Only clear the IP filter cache - route-specific
|
||||
this.ipFilterCache.clear();
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user