keep response body out of logs during HEAD requests, by removing it from context

[websub-hub] / src / service.js

diff --git a/src/service.js b/src/service.js
index a0043f7d24caa49a71c85341dc4fadca6ea563d2..17fa134d738447deb29aa5e889aaf806cb1443f8 100644 (file)
--- a/src/service.js
+++ b/src/service.js
@@ -9,8 +9,7 @@ const { Dingus } = require('@squeep/api-dingus');
 const common = require('./common');
 const Enum = require('./enum');
 const Manager = require('./manager');
-const SessionManager = require('./session-manager');
-const Authenticator = require('./authenticator');
+const { Authenticator, SessionManager } = require('@squeep/authentication-module');
 const path = require('path');
 
 const _fileScope = common.fileScope(__filename);
@@ -69,6 +68,24 @@ class Service extends Dingus {
 
   }
 
+  /**
+   * Wrap the Dingus head handler, to remove the response body from the context,
+   * lest it be logged.
+   * @param {http.ClientRequest} req
+   * @param {http.ServerResponse} res
+   * @param {object} ctx
+   */
+  static setHeadHandler(req, res, ctx) {
+    if (req.method === 'HEAD') {
+      Dingus.setHeadHandler(req, res, ctx);
+      const origEnd = res.end.bind(res);
+      res.end = function (data, encoding, ...rest) {
+        const origResult = origEnd(data, encoding, ...rest);
+        delete ctx.responseBody;
+        return origResult;
+      };
+    }
+  }
 
   /**
    * @param {http.ClientRequest} req
@@ -98,10 +115,12 @@ class Service extends Dingus {
     ];
     this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
 
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(responseTypes, req, res, ctx);
 
+    await this.authenticator.sessionOptional(req, res, ctx, this.loginPath);
+
     await this.manager.getRoot(req, res, ctx);
   }
 
@@ -115,7 +134,7 @@ class Service extends Dingus {
     const _scope = _fileScope('handlerGetHealthcheck');
     this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
   
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
@@ -134,7 +153,7 @@ class Service extends Dingus {
 
     const responseTypes = [...this.responseTypes, Enum.ContentType.ImageSVG];
 
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(responseTypes, req, res, ctx);
 
@@ -151,11 +170,11 @@ class Service extends Dingus {
     const _scope = _fileScope('handlerGetAdminOverview');
     this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
 
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx, this.loginPath);
+    await this.authenticator.sessionRequired(req, res, ctx, this.loginPath);
 
     await this.manager.getAdminOverview(res, ctx);
   }
@@ -170,11 +189,11 @@ class Service extends Dingus {
     const _scope = _fileScope('handlerGetAdminTopicDetails');
     this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
 
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.required(req, res, ctx, this.loginPath);
+    await this.authenticator.sessionRequired(req, res, ctx, this.loginPath);
 
     await this.manager.getTopicDetails(res, ctx);
   }
@@ -209,7 +228,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
+    await this.authenticator.apiRequiredLocal(req, res, ctx);
 
     await this.maybeIngestBody(req, res, ctx);
     ctx.method = req.method;
@@ -228,7 +247,7 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
+    await this.authenticator.apiRequiredLocal(req, res, ctx);
 
     await this.maybeIngestBody(req, res, ctx);
     ctx.method = req.method;
@@ -247,13 +266,14 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
-    await this.authenticator.requiredLocal(req, res, ctx, this.loginPath);
+    await this.authenticator.apiRequiredLocal(req, res, ctx);
 
     await this.manager.processTasks(res, ctx);
   }
 
 
   /**
+   * Delegate login to authentication module.
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
    * @param {Object} ctx
@@ -262,7 +282,7 @@ class Service extends Dingus {
     const _scope = _fileScope('handlerGetAdminLogin');
     this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
 
-    Dingus.setHeadHandler(req, res, ctx);
+    Service.setHeadHandler(req, res, ctx);
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
@@ -271,6 +291,7 @@ class Service extends Dingus {
 
 
   /**
+   * Delegate login to authentication module.
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
    * @param {Object} ctx
@@ -281,6 +302,8 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
+    await this.authenticator.sessionOptionalLocal(req, res, ctx);
+
     await this.maybeIngestBody(req, res, ctx);
 
     await this.sessionManager.postAdminLogin(res, ctx);
@@ -288,6 +311,7 @@ class Service extends Dingus {
 
 
   /**
+   * Delegate login to authentication module.
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
    * @param {Object} ctx
@@ -298,11 +322,14 @@ class Service extends Dingus {
 
     this.setResponseType(this.responseTypes, req, res, ctx);
 
+    await this.authenticator.sessionOptionalLocal(req, res, ctx);
+
     await this.sessionManager.getAdminLogout(res, ctx);
   }
 
 
   /**
+   * Delegate login to authentication module.
    * @param {http.ClientRequest} req
    * @param {http.ServerResponse} res
    * @param {Object} ctx