From 2db648b0adeea9e2c101e985fd7645f260fff859 Mon Sep 17 00:00:00 2001
From: Ivaylo Novakov <inovakov@gmail.com>
Date: Thu, 10 Mar 2022 18:11:37 +0100
Subject: [PATCH 1/9] Nginx passes Skynet-Api-Key and Authorization headers at
 all spots where it passes the Cookie header.

---
 docker/nginx/conf.d/include/track-download |  6 +++++-
 docker/nginx/conf.d/include/track-registry | 10 +++++++---
 docker/nginx/conf.d/include/track-upload   |  6 +++++-
 docker/nginx/conf.d/server/server.api      | 10 +++++++---
 docker/nginx/libs/skynet/account.lua       | 10 +++++++---
 5 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/docker/nginx/conf.d/include/track-download b/docker/nginx/conf.d/include/track-download
index 606c98ad..0bd74dad 100644
--- a/docker/nginx/conf.d/include/track-download
+++ b/docker/nginx/conf.d/include/track-download
@@ -11,7 +11,11 @@ log_by_lua_block {
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/download/" .. skylink .. "?" .. query, {
                 method = "POST",
-                headers = { ["Cookie"] = "skynet-jwt=" .. jwt },
+                headers = {
+                    ["Cookie"] = "skynet-jwt=" .. jwt,
+                    ["Authorization"] = ngx.header["Authorization"],
+                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
+                },
             })
 
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
diff --git a/docker/nginx/conf.d/include/track-registry b/docker/nginx/conf.d/include/track-registry
index 8c69172b..ac981466 100644
--- a/docker/nginx/conf.d/include/track-registry
+++ b/docker/nginx/conf.d/include/track-registry
@@ -7,16 +7,20 @@ log_by_lua_block {
 
             local httpc = require("resty.http").new()
 
-            -- based on request method we assign a registry action string used 
+            -- based on request method we assign a registry action string used
             -- in track endpoint namely "read" for GET and "write" for POST
             local registry_action = request_method == "GET" and "read" or "write"
 
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/registry/" .. registry_action, {
                 method = "POST",
-                headers = { ["Cookie"] = "skynet-jwt=" .. jwt },
+                headers = {
+                    ["Cookie"] = "skynet-jwt=" .. jwt,
+                    ["Authorization"] = ngx.header["Authorization"],
+                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
+                },
             })
-            
+
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
                 ngx.log(ngx.ERR, "Failed accounts service request /track/registry/" .. registry_action .. ": ", err or ("[HTTP " .. res.status .. "] " .. res.body))
             end
diff --git a/docker/nginx/conf.d/include/track-upload b/docker/nginx/conf.d/include/track-upload
index 340dd437..53795d55 100644
--- a/docker/nginx/conf.d/include/track-upload
+++ b/docker/nginx/conf.d/include/track-upload
@@ -10,7 +10,11 @@ log_by_lua_block {
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/upload/" .. skylink, {
                 method = "POST",
-                headers = { ["Cookie"] = "skynet-jwt=" .. jwt },
+                headers = {
+                    ["Cookie"] = "skynet-jwt=" .. jwt,
+                    ["Authorization"] = ngx.header["Authorization"],
+                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
+                },
             })
 
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
diff --git a/docker/nginx/conf.d/server/server.api b/docker/nginx/conf.d/server/server.api
index ce93c669..fc6f7034 100644
--- a/docker/nginx/conf.d/server/server.api
+++ b/docker/nginx/conf.d/server/server.api
@@ -178,7 +178,11 @@ location /skynet/registry/subscription {
 
             -- fetch account limits and set download bandwidth and registry delays accordingly
             local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", {
-                headers = { ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt }
+                headers = {
+                    ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt,
+                    ["Authorization"] = ngx.header["Authorization"],
+                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
+                }
             })
 
             -- fail gracefully in case /user/limits failed
@@ -267,10 +271,10 @@ location /skynet/tus {
             if require("skynet.account").is_access_forbidden() then
                 return require("skynet.account").exit_access_forbidden()
             end
-            
+
             -- get account limits of currently authenticated user
             local limits = require("skynet.account").get_account_limits()
-        
+
             -- apply upload size limits
             ngx.req.set_header("SkynetMaxUploadSize", limits.maxUploadSize)
         end
diff --git a/docker/nginx/libs/skynet/account.lua b/docker/nginx/libs/skynet/account.lua
index 7be6013f..5319f665 100644
--- a/docker/nginx/libs/skynet/account.lua
+++ b/docker/nginx/libs/skynet/account.lua
@@ -43,12 +43,16 @@ function _M.get_account_limits()
 
     if ngx.var.account_limits == "" then
         local httpc = require("resty.http").new()
-        
+
         -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
         local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", {
-            headers = { ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt }
+            headers = {
+                ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt,
+                ["Authorization"] = ngx.header["Authorization"],
+                ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
+            }
         })
-        
+
         -- fail gracefully in case /user/limits failed
         if err or (res and res.status ~= ngx.HTTP_OK) then
             ngx.log(ngx.ERR, "Failed accounts service request /user/limits: ", err or ("[HTTP " .. res.status .. "] " .. res.body))

From d631aad058000f2beefffbdd69d95fbb7ef8c9c2 Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Tue, 15 Mar 2022 22:43:35 +0100
Subject: [PATCH 2/9] move req headers to timer arguments

---
 docker/nginx/conf.d/include/track-download | 18 +++---
 docker/nginx/conf.d/include/track-registry | 18 +++---
 docker/nginx/conf.d/include/track-upload   | 18 +++---
 docker/nginx/conf.d/server/server.api      | 65 +++++++++++-----------
 docker/nginx/libs/skynet/account.lua       | 43 ++++++++++++--
 5 files changed, 94 insertions(+), 68 deletions(-)

diff --git a/docker/nginx/conf.d/include/track-download b/docker/nginx/conf.d/include/track-download
index 0bd74dad..7c637fe3 100644
--- a/docker/nginx/conf.d/include/track-download
+++ b/docker/nginx/conf.d/include/track-download
@@ -1,8 +1,10 @@
 # register the download in accounts service (cookies should contain jwt)
 log_by_lua_block {
-    -- this block runs only when accounts are enabled
-    if require("skynet.account").accounts_enabled() then
-        local function track(premature, skylink, status, body_bytes_sent, jwt)
+    local skynet_account = require("skynet.account")
+
+    -- tracking runs only when request comes from authenticated user
+    if skynet_account.is_authenticated() then
+        local function track(premature, skylink, status, body_bytes_sent, auth_headers)
             if premature then return end
 
             local httpc = require("resty.http").new()
@@ -11,11 +13,7 @@ log_by_lua_block {
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/download/" .. skylink .. "?" .. query, {
                 method = "POST",
-                headers = {
-                    ["Cookie"] = "skynet-jwt=" .. jwt,
-                    ["Authorization"] = ngx.header["Authorization"],
-                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
-                },
+                headers = auth_headers,
             })
 
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
@@ -23,8 +21,8 @@ log_by_lua_block {
             end
         end
 
-        if ngx.header["Skynet-Skylink"] and ngx.var.skynet_jwt ~= "" and ngx.status >= ngx.HTTP_OK and ngx.status < ngx.HTTP_SPECIAL_RESPONSE then
-            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, ngx.var.skynet_jwt)
+        if ngx.header["Skynet-Skylink"] and ngx.status >= ngx.HTTP_OK and ngx.status < ngx.HTTP_SPECIAL_RESPONSE then
+            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, skynet_account.get_auth_headers())
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end
diff --git a/docker/nginx/conf.d/include/track-registry b/docker/nginx/conf.d/include/track-registry
index ac981466..0344b6c6 100644
--- a/docker/nginx/conf.d/include/track-registry
+++ b/docker/nginx/conf.d/include/track-registry
@@ -1,8 +1,10 @@
 # register the registry access in accounts service (cookies should contain jwt)
 log_by_lua_block {
-    -- this block runs only when accounts are enabled
-    if require("skynet.account").accounts_enabled() then
-        local function track(premature, request_method, jwt)
+    local skynet_account = require("skynet.account")
+
+    -- tracking runs only when request comes from authenticated user
+    if skynet_account.is_authenticated() then
+        local function track(premature, request_method, auth_headers)
             if premature then return end
 
             local httpc = require("resty.http").new()
@@ -14,11 +16,7 @@ log_by_lua_block {
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/registry/" .. registry_action, {
                 method = "POST",
-                headers = {
-                    ["Cookie"] = "skynet-jwt=" .. jwt,
-                    ["Authorization"] = ngx.header["Authorization"],
-                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
-                },
+                headers = auth_headers,
             })
 
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
@@ -26,8 +24,8 @@ log_by_lua_block {
             end
         end
 
-        if ngx.var.skynet_jwt ~= "" and (ngx.status == ngx.HTTP_OK or ngx.status == ngx.HTTP_NOT_FOUND) then
-            local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), ngx.var.skynet_jwt)
+        if ngx.status == ngx.HTTP_OK or ngx.status == ngx.HTTP_NOT_FOUND then
+            local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), skynet_account.get_auth_headers())
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end
diff --git a/docker/nginx/conf.d/include/track-upload b/docker/nginx/conf.d/include/track-upload
index 53795d55..21df6d83 100644
--- a/docker/nginx/conf.d/include/track-upload
+++ b/docker/nginx/conf.d/include/track-upload
@@ -1,8 +1,10 @@
 # register the upload in accounts service (cookies should contain jwt)
 log_by_lua_block {
-    -- this block runs only when accounts are enabled
-    if require("skynet.account").accounts_enabled() then
-        local function track(premature, skylink, jwt)
+    local skynet_account = require("skynet.account")
+
+    -- tracking runs only when request comes from authenticated user
+    if skynet_account.is_authenticated() then
+        local function track(premature, skylink, auth_headers)
             if premature then return end
 
             local httpc = require("resty.http").new()
@@ -10,11 +12,7 @@ log_by_lua_block {
             -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
             local res, err = httpc:request_uri("http://10.10.10.70:3000/track/upload/" .. skylink, {
                 method = "POST",
-                headers = {
-                    ["Cookie"] = "skynet-jwt=" .. jwt,
-                    ["Authorization"] = ngx.header["Authorization"],
-                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
-                },
+                headers = auth_headers,
             })
 
             if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then
@@ -23,8 +21,8 @@ log_by_lua_block {
         end
 
         -- report all skylinks (header empty if request failed) but only if jwt is preset (user is authenticated)
-        if ngx.header["Skynet-Skylink"] and ngx.var.skynet_jwt ~= "" then
-            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.var.skynet_jwt)
+        if ngx.header["Skynet-Skylink"] then
+            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], skynet_account.get_auth_headers())
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end
diff --git a/docker/nginx/conf.d/server/server.api b/docker/nginx/conf.d/server/server.api
index fc6f7034..24e8509d 100644
--- a/docker/nginx/conf.d/server/server.api
+++ b/docker/nginx/conf.d/server/server.api
@@ -172,28 +172,25 @@ location /skynet/registry/subscription {
     set $notificationdelay "0";
 
     rewrite_by_lua_block {
-        -- this block runs only when accounts are enabled
-        if os.getenv("PORTAL_MODULES"):match("a") then
-            local httpc = require("resty.http").new()
+        local skynet_account = require("skynet.account")
 
-            -- fetch account limits and set download bandwidth and registry delays accordingly
-            local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", {
-                headers = {
-                    ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt,
-                    ["Authorization"] = ngx.header["Authorization"],
-                    ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
-                }
-            })
-
-            -- fail gracefully in case /user/limits failed
-            if err or (res and res.status ~= ngx.HTTP_OK) then
-                ngx.log(ngx.ERR, "Failed accounts service request /user/limits: ", err or ("[HTTP " .. res.status .. "] " .. res.body))
-            elseif res and res.status == ngx.HTTP_OK then
-                local json = require('cjson')
-                local limits = json.decode(res.body)
-                ngx.var.bandwidthlimit = limits.download
-                ngx.var.notificationdelay = limits.registry
+        if skynet_account.accounts_enabled() then
+            -- check if portal is in authenticated only mode
+            if skynet_account.is_access_unauthorized() then
+                return skynet_account.exit_access_unauthorized()
             end
+
+            -- check if portal is in subscription only mode
+            if skynet_account.is_access_forbidden() then
+                return skynet_account.exit_access_forbidden()
+            end
+
+            -- get account limits of currently authenticated user
+            local limits = skynet_account.get_account_limits()
+
+            -- apply bandwidth limit and notification delay
+            ngx.var.bandwidthlimit = limits.download
+            ngx.var.notificationdelay = limits.registry
         end
     }
 
@@ -261,19 +258,21 @@ location /skynet/tus {
     proxy_pass http://sia:9980;
 
     access_by_lua_block {
-        if require("skynet.account").accounts_enabled() then
+        local skynet_account = require("skynet.account")
+
+        if skynet_account.accounts_enabled() then
             -- check if portal is in authenticated only mode
-            if require("skynet.account").is_access_unauthorized() then
-                return require("skynet.account").exit_access_unauthorized()
+            if skynet_account.is_access_unauthorized() then
+                return skynet_account.exit_access_unauthorized()
             end
 
             -- check if portal is in subscription only mode
-            if require("skynet.account").is_access_forbidden() then
-                return require("skynet.account").exit_access_forbidden()
+            if skynet_account.is_access_forbidden() then
+                return skynet_account.exit_access_forbidden()
             end
 
             -- get account limits of currently authenticated user
-            local limits = require("skynet.account").get_account_limits()
+            local limits = skynet_account.get_account_limits()
 
             -- apply upload size limits
             ngx.req.set_header("SkynetMaxUploadSize", limits.maxUploadSize)
@@ -365,19 +364,21 @@ location /skynet/trustless/basesector {
     set $limit_rate 0;
 
     access_by_lua_block {
-        if require("skynet.account").accounts_enabled() then
+        local skynet_account = require("skynet.account")
+
+        if skynet_account.accounts_enabled() then
             -- check if portal is in authenticated only mode
-            if require("skynet.account").is_access_unauthorized() then
-                return require("skynet.account").exit_access_unauthorized()
+            if skynet_account.is_access_unauthorized() then
+                return skynet_account.exit_access_unauthorized()
             end
 
             -- check if portal is in subscription only mode
-            if require("skynet.account").is_access_forbidden() then
-                return require("skynet.account").exit_access_forbidden()
+            if skynet_account.is_access_forbidden() then
+                return skynet_account.exit_access_forbidden()
             end
 
             -- get account limits of currently authenticated user
-            local limits = require("skynet.account").get_account_limits()
+            local limits = skynet_account.get_account_limits()
 
             -- apply download speed limit
             ngx.var.limit_rate = limits.download
diff --git a/docker/nginx/libs/skynet/account.lua b/docker/nginx/libs/skynet/account.lua
index 5319f665..72a2c9ea 100644
--- a/docker/nginx/libs/skynet/account.lua
+++ b/docker/nginx/libs/skynet/account.lua
@@ -14,6 +14,39 @@ local anon_limits = {
     ["registry"] = 250
 }
 
+-- utility function for checking if table is empty
+function is_table_empty(check)
+    -- bind next to local variable to achieve ultimate efficiency
+    -- https://stackoverflow.com/a/1252776
+    local next = next
+
+    return next(check) == nil
+end
+
+-- get all non empty authentication headers from request, we want to return
+-- all of them and let accounts service deal with validation and prioritisation
+function _M.get_auth_headers()
+    local request_headers = ngx.req.get_headers()
+    local headers = {}
+
+    -- if skynet_jwt is set, include it as a cookie
+    if ngx.var.skynet_jwt ~= "" then
+        headers["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt
+    end
+
+    -- if authorization header is set, pass it as is
+    if request_headers["Authorization"] then
+        headers["Authorization"] = request_headers["Authorization"]
+    end
+
+    -- if skynet api key header is set, pass it as is
+    if request_headers["Skynet-Api-Key"] then
+        headers["Skynet-Api-Key"] = request_headers["Skynet-Api-Key"]
+    end
+
+    return headers
+end
+
 -- handle request exit when access to portal should be restricted to authenticated users only
 function _M.exit_access_unauthorized(message)
     ngx.status = ngx.HTTP_UNAUTHORIZED
@@ -36,8 +69,10 @@ end
 
 function _M.get_account_limits()
     local cjson = require('cjson')
+    local auth_headers = _M.get_auth_headers()
 
-    if ngx.var.skynet_jwt == "" then
+    -- simple case of anonymous request - none of available auth headers exist
+    if is_table_empty(auth_headers) then
         return anon_limits
     end
 
@@ -46,11 +81,7 @@ function _M.get_account_limits()
 
         -- 10.10.10.70 points to accounts service (alias not available when using resty-http)
         local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", {
-            headers = {
-                ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt,
-                ["Authorization"] = ngx.header["Authorization"],
-                ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"],
-            }
+            headers = auth_headers,
         })
 
         -- fail gracefully in case /user/limits failed

From e8345a3be6cc6bf8054a7e9118056c00b436cc9c Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Tue, 15 Mar 2022 22:53:31 +0100
Subject: [PATCH 3/9] extract is_table_empty to separate utils lib

---
 docker/nginx/libs/skynet/account.lua | 12 ++----------
 docker/nginx/libs/utils.lua          | 12 ++++++++++++
 docker/nginx/libs/utils.spec.lua     | 11 +++++++++++
 3 files changed, 25 insertions(+), 10 deletions(-)
 create mode 100644 docker/nginx/libs/utils.lua
 create mode 100644 docker/nginx/libs/utils.spec.lua

diff --git a/docker/nginx/libs/skynet/account.lua b/docker/nginx/libs/skynet/account.lua
index 72a2c9ea..aa8b4414 100644
--- a/docker/nginx/libs/skynet/account.lua
+++ b/docker/nginx/libs/skynet/account.lua
@@ -14,15 +14,6 @@ local anon_limits = {
     ["registry"] = 250
 }
 
--- utility function for checking if table is empty
-function is_table_empty(check)
-    -- bind next to local variable to achieve ultimate efficiency
-    -- https://stackoverflow.com/a/1252776
-    local next = next
-
-    return next(check) == nil
-end
-
 -- get all non empty authentication headers from request, we want to return
 -- all of them and let accounts service deal with validation and prioritisation
 function _M.get_auth_headers()
@@ -69,10 +60,11 @@ end
 
 function _M.get_account_limits()
     local cjson = require('cjson')
+    local utils = require('utils')
     local auth_headers = _M.get_auth_headers()
 
     -- simple case of anonymous request - none of available auth headers exist
-    if is_table_empty(auth_headers) then
+    if utils.is_table_empty(auth_headers) then
         return anon_limits
     end
 
diff --git a/docker/nginx/libs/utils.lua b/docker/nginx/libs/utils.lua
new file mode 100644
index 00000000..b05d0861
--- /dev/null
+++ b/docker/nginx/libs/utils.lua
@@ -0,0 +1,12 @@
+local _M = {}
+
+-- utility function for checking if table is empty
+function is_table_empty(check)
+    -- bind next to local variable to achieve ultimate efficiency
+    -- https://stackoverflow.com/a/1252776
+    local next = next
+
+    return next(check) == nil
+end
+
+return _M
\ No newline at end of file
diff --git a/docker/nginx/libs/utils.spec.lua b/docker/nginx/libs/utils.spec.lua
new file mode 100644
index 00000000..970b279f
--- /dev/null
+++ b/docker/nginx/libs/utils.spec.lua
@@ -0,0 +1,11 @@
+local utils = require('utils')
+
+describe("is_table_empty", function()
+    it("should return true for empty table", function()
+        assert.is_true(utils.is_table_empty({}))
+    end)
+
+    it("should return false for not empty table", function()
+        assert.is_false(utils.is_table_empty({ ["foo"] = "bar" }))
+    end)
+end)
\ No newline at end of file

From 8623f53d9dd50a11e239159950856b9287c1a2da Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Tue, 15 Mar 2022 22:56:24 +0100
Subject: [PATCH 4/9] export is_table_empty from utils module

---
 docker/nginx/libs/utils.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docker/nginx/libs/utils.lua b/docker/nginx/libs/utils.lua
index b05d0861..b58c2711 100644
--- a/docker/nginx/libs/utils.lua
+++ b/docker/nginx/libs/utils.lua
@@ -1,7 +1,7 @@
 local _M = {}
 
 -- utility function for checking if table is empty
-function is_table_empty(check)
+function _M.is_table_empty(check)
     -- bind next to local variable to achieve ultimate efficiency
     -- https://stackoverflow.com/a/1252776
     local next = next

From 18228144417a458d02cf798a86e263ff44ac9d86 Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Fri, 18 Mar 2022 16:45:01 +0100
Subject: [PATCH 5/9] do not use PORTAL_DOMAIN for api requests

---
 packages/dashboard/src/services/accountsApi.js    | 4 +---
 packages/dashboard/src/services/useAccountsApi.js | 4 +---
 packages/dashboard/src/services/useAnonRoute.js   | 4 +---
 3 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/packages/dashboard/src/services/accountsApi.js b/packages/dashboard/src/services/accountsApi.js
index e09626b1..37244e5f 100644
--- a/packages/dashboard/src/services/accountsApi.js
+++ b/packages/dashboard/src/services/accountsApi.js
@@ -1,5 +1,3 @@
 import ky from "ky";
 
-const prefix = process.env.NEXT_PUBLIC_PORTAL_DOMAIN ? `https://account.${process.env.NEXT_PUBLIC_PORTAL_DOMAIN}` : "";
-
-export default ky.create({ prefixUrl: `${prefix}/api` });
+export default ky.create({ prefixUrl: "/api" });
diff --git a/packages/dashboard/src/services/useAccountsApi.js b/packages/dashboard/src/services/useAccountsApi.js
index 4d522764..b98d8b92 100644
--- a/packages/dashboard/src/services/useAccountsApi.js
+++ b/packages/dashboard/src/services/useAccountsApi.js
@@ -2,8 +2,6 @@ import useSWR from "swr";
 import { useRouter } from "next/router";
 import { StatusCodes } from "http-status-codes";
 
-const prefix = process.env.NEXT_PUBLIC_PORTAL_DOMAIN ? `https://account.${process.env.NEXT_PUBLIC_PORTAL_DOMAIN}` : "";
-
 const fetcher = (url, router) => {
   return fetch(url).then((res) => {
     if (res.status === StatusCodes.UNAUTHORIZED) {
@@ -17,5 +15,5 @@ const fetcher = (url, router) => {
 export default function useAccountsApi(key, config) {
   const router = useRouter();
 
-  return useSWR(`${prefix}/api/${key}`, (url) => fetcher(url, router), config);
+  return useSWR(`/api/${key}`, (url) => fetcher(url, router), config);
 }
diff --git a/packages/dashboard/src/services/useAnonRoute.js b/packages/dashboard/src/services/useAnonRoute.js
index b516011d..5bb65338 100644
--- a/packages/dashboard/src/services/useAnonRoute.js
+++ b/packages/dashboard/src/services/useAnonRoute.js
@@ -2,8 +2,6 @@ import useSWR from "swr";
 import { useRouter } from "next/router";
 import { StatusCodes } from "http-status-codes";
 
-const prefix = process.env.NEXT_PUBLIC_PORTAL_DOMAIN ? `https://account.${process.env.NEXT_PUBLIC_PORTAL_DOMAIN}` : "";
-
 const fetcher = (url, router) => {
   return fetch(url).then((res) => {
     if (res.status === StatusCodes.OK) router.push("/");
@@ -13,5 +11,5 @@ const fetcher = (url, router) => {
 export default function useAnonRoute() {
   const router = useRouter();
 
-  return useSWR(`${prefix}/api/user`, (url) => fetcher(url, router));
+  return useSWR("/api/user", (url) => fetcher(url, router));
 }

From 27bfac680104cad6386bd1cc904fe249170f2a83 Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Mon, 21 Mar 2022 13:18:20 +0100
Subject: [PATCH 6/9] add empty lines

---
 docker/nginx/libs/utils.lua      | 2 +-
 docker/nginx/libs/utils.spec.lua | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker/nginx/libs/utils.lua b/docker/nginx/libs/utils.lua
index b58c2711..83faf09b 100644
--- a/docker/nginx/libs/utils.lua
+++ b/docker/nginx/libs/utils.lua
@@ -9,4 +9,4 @@ function _M.is_table_empty(check)
     return next(check) == nil
 end
 
-return _M
\ No newline at end of file
+return _M
diff --git a/docker/nginx/libs/utils.spec.lua b/docker/nginx/libs/utils.spec.lua
index 970b279f..6299d010 100644
--- a/docker/nginx/libs/utils.spec.lua
+++ b/docker/nginx/libs/utils.spec.lua
@@ -8,4 +8,4 @@ describe("is_table_empty", function()
     it("should return false for not empty table", function()
         assert.is_false(utils.is_table_empty({ ["foo"] = "bar" }))
     end)
-end)
\ No newline at end of file
+end)

From b42ac0678b2c04ff33a2e1a7b7edb6874077d94f Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Mon, 21 Mar 2022 14:23:26 +0100
Subject: [PATCH 7/9] clean up cookie extraction

---
 docker/nginx/libs/skynet/account.lua | 10 ++--
 docker/nginx/libs/utils.lua          | 28 ++++++++++++
 docker/nginx/libs/utils.spec.lua     | 68 ++++++++++++++++++++++++++++
 docker/nginx/nginx.conf              |  7 ---
 4 files changed, 103 insertions(+), 10 deletions(-)

diff --git a/docker/nginx/libs/skynet/account.lua b/docker/nginx/libs/skynet/account.lua
index d31ec57e..8003c60e 100644
--- a/docker/nginx/libs/skynet/account.lua
+++ b/docker/nginx/libs/skynet/account.lua
@@ -17,12 +17,16 @@ local anon_limits = {
 -- get all non empty authentication headers from request, we want to return
 -- all of them and let accounts service deal with validation and prioritisation
 function _M.get_auth_headers()
+    local utils = require("utils")
     local request_headers = ngx.req.get_headers()
     local headers = {}
 
-    -- if skynet_jwt is set, include it as a cookie
-    if ngx.var.skynet_jwt ~= "" then
-        headers["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt
+    -- try to extract skynet-jwt cookie from cookie header
+    local skynet_jwt_cookie = utils.extract_cookie(request_headers["Cookie"], "skynet[-]jwt")
+
+    -- if skynet-jwt cookie is present, pass it as is
+    if skynet_jwt_cookie then
+        headers["Cookie"] = skynet_jwt_cookie
     end
 
     -- if authorization header is set, pass it as is
diff --git a/docker/nginx/libs/utils.lua b/docker/nginx/libs/utils.lua
index 83faf09b..6b392c99 100644
--- a/docker/nginx/libs/utils.lua
+++ b/docker/nginx/libs/utils.lua
@@ -9,4 +9,32 @@ function _M.is_table_empty(check)
     return next(check) == nil
 end
 
+-- extract full cookie name and value by its name from cookie string
+-- note: name matcher argument is a pattern so you will need to escape
+-- any special characters, read more https://www.lua.org/pil/20.2.html
+function _M.extract_cookie(cookie_string, name_matcher)
+    if cookie_string == nil then return nil end -- nil safeguard
+
+    local start, stop = string.find(cookie_string, name_matcher .. "=[^;]+")
+
+    if start then
+        return string.sub(cookie_string, start, stop)
+    end
+
+    return nil
+end
+
+-- extract just the cookie value by its name from cookie string
+-- note: name matcher argument is a pattern so you will need to escape
+-- any special characters, read more https://www.lua.org/pil/20.2.html
+function _M.extract_cookie_value(cookie_string, name_matcher)
+    local cookie = _M.extract_cookie(cookie_string, name_matcher)
+
+    if cookie == nil then return nil end
+
+    local value_start = string.find(cookie, "=") + 1
+
+    return string.sub(cookie, value_start)
+end
+
 return _M
diff --git a/docker/nginx/libs/utils.spec.lua b/docker/nginx/libs/utils.spec.lua
index 6299d010..8dd68e6e 100644
--- a/docker/nginx/libs/utils.spec.lua
+++ b/docker/nginx/libs/utils.spec.lua
@@ -9,3 +9,71 @@ describe("is_table_empty", function()
         assert.is_false(utils.is_table_empty({ ["foo"] = "bar" }))
     end)
 end)
+
+describe("extract_cookie", function()
+    local cookie_string = "aaa=bbb; skynet-jwt=MTY0NzUyr8jD-ytiWtspm0tGabKfooxeIDuWcXhJ3lnY0eEw==; xxx=yyy"
+
+    it("should return nil if cookie string is nil", function()
+        local cookie = utils.extract_cookie_value(nil, "aaa")
+        
+        assert.is_nil(cookie)
+    end)
+
+    it("should return nil if cookie name is not found", function()
+        local cookie = utils.extract_cookie(cookie_string, "foo")
+        
+        assert.is_nil(cookie)
+    end)
+
+    it("should return cookie if cookie_string starts with that cookie name", function()
+        local cookie = utils.extract_cookie(cookie_string, "aaa")
+        
+        assert.are.equals(cookie, "aaa=bbb")
+    end)
+
+    it("should return cookie if cookie_string ends with that cookie name", function()
+        local cookie = utils.extract_cookie(cookie_string, "xxx")
+        
+        assert.are.equals(cookie, "xxx=yyy")
+    end)
+
+    it("should return cookie with custom matcher", function()
+        local cookie = utils.extract_cookie(cookie_string, "skynet[-]jwt")
+        
+        assert.are.equals(cookie, "skynet-jwt=MTY0NzUyr8jD-ytiWtspm0tGabKfooxeIDuWcXhJ3lnY0eEw==")
+    end)
+end)
+
+describe("extract_cookie_value", function()
+    local cookie_string = "aaa=bbb; skynet-jwt=MTY0NzUyr8jD-ytiWtspm0tGabKfooxeIDuWcXhJ3lnY0eEw==; xxx=yyy"
+
+    it("should return nil if cookie string is nil", function()
+        local value = utils.extract_cookie_value(nil, "aaa")
+        
+        assert.is_nil(value)
+    end)
+
+    it("should return nil if cookie name is not found", function()
+        local value = utils.extract_cookie_value(cookie_string, "foo")
+        
+        assert.is_nil(value)
+    end)
+
+    it("should return value if cookie_string starts with that cookie name", function()
+        local value = utils.extract_cookie_value(cookie_string, "aaa")
+        
+        assert.are.equals(value, "bbb")
+    end)
+
+    it("should return cookie if cookie_string ends with that cookie name", function()
+        local value = utils.extract_cookie_value(cookie_string, "xxx")
+        
+        assert.are.equals(value, "yyy")
+    end)
+
+    it("should return cookie with custom matcher", function()
+        local value = utils.extract_cookie_value(cookie_string, "skynet[-]jwt")
+        
+        assert.are.equals(value, "MTY0NzUyr8jD-ytiWtspm0tGabKfooxeIDuWcXhJ3lnY0eEw==")
+    end)
+end)
diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf
index 95bb61ac..3517a6bc 100644
--- a/docker/nginx/nginx.conf
+++ b/docker/nginx/nginx.conf
@@ -117,13 +117,6 @@ http {
     proxy_set_header X-Forwarded-Host  $host;
     proxy_set_header X-Forwarded-Proto $scheme;
 
-    # skynet-jwt contains dash so we cannot use $cookie_skynet-jwt
-    # https://richardhart.me/2012/03/18/logging-nginx-cookies-with-dashes/
-    map $http_cookie $skynet_jwt {
-        default '';
-        ~skynet-jwt=(?<match>[^\;]+) $match;
-    }
-
     include /etc/nginx/conf.d/*.conf;
     include /etc/nginx/conf.extra.d/*.conf;
 }

From 75fad4fb9116f83246f0cc0edb52cec0cbfdf6f7 Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Mon, 21 Mar 2022 14:38:57 +0100
Subject: [PATCH 8/9] reformat

---
 docker/nginx/libs/utils.lua | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/docker/nginx/libs/utils.lua b/docker/nginx/libs/utils.lua
index 6b392c99..4330c94c 100644
--- a/docker/nginx/libs/utils.lua
+++ b/docker/nginx/libs/utils.lua
@@ -13,7 +13,10 @@ end
 -- note: name matcher argument is a pattern so you will need to escape
 -- any special characters, read more https://www.lua.org/pil/20.2.html
 function _M.extract_cookie(cookie_string, name_matcher)
-    if cookie_string == nil then return nil end -- nil safeguard
+    -- nil cookie string safeguard
+    if cookie_string == nil then
+        return nil
+    end
 
     local start, stop = string.find(cookie_string, name_matcher .. "=[^;]+")
 
@@ -30,7 +33,9 @@ end
 function _M.extract_cookie_value(cookie_string, name_matcher)
     local cookie = _M.extract_cookie(cookie_string, name_matcher)
 
-    if cookie == nil then return nil end
+    if cookie == nil then
+        return nil
+    end
 
     local value_start = string.find(cookie, "=") + 1
 

From c19ef307d8dea5976dcdb002c83f9e45145dcb73 Mon Sep 17 00:00:00 2001
From: Karol Wypchlo <kwypchlo@gmail.com>
Date: Mon, 21 Mar 2022 14:43:42 +0100
Subject: [PATCH 9/9] clean up code and comments

---
 docker/nginx/conf.d/include/track-download | 4 ++--
 docker/nginx/conf.d/include/track-registry | 4 ++--
 docker/nginx/conf.d/include/track-upload   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/docker/nginx/conf.d/include/track-download b/docker/nginx/conf.d/include/track-download
index 7c637fe3..408e4150 100644
--- a/docker/nginx/conf.d/include/track-download
+++ b/docker/nginx/conf.d/include/track-download
@@ -1,4 +1,3 @@
-# register the download in accounts service (cookies should contain jwt)
 log_by_lua_block {
     local skynet_account = require("skynet.account")
 
@@ -22,7 +21,8 @@ log_by_lua_block {
         end
 
         if ngx.header["Skynet-Skylink"] and ngx.status >= ngx.HTTP_OK and ngx.status < ngx.HTTP_SPECIAL_RESPONSE then
-            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, skynet_account.get_auth_headers())
+            local auth_headers = skynet_account.get_auth_headers()
+            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, auth_headers)
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end
diff --git a/docker/nginx/conf.d/include/track-registry b/docker/nginx/conf.d/include/track-registry
index 0344b6c6..8e8ae1d4 100644
--- a/docker/nginx/conf.d/include/track-registry
+++ b/docker/nginx/conf.d/include/track-registry
@@ -1,4 +1,3 @@
-# register the registry access in accounts service (cookies should contain jwt)
 log_by_lua_block {
     local skynet_account = require("skynet.account")
 
@@ -25,7 +24,8 @@ log_by_lua_block {
         end
 
         if ngx.status == ngx.HTTP_OK or ngx.status == ngx.HTTP_NOT_FOUND then
-            local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), skynet_account.get_auth_headers())
+            local auth_headers = skynet_account.get_auth_headers()
+            local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), auth_headers)
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end
diff --git a/docker/nginx/conf.d/include/track-upload b/docker/nginx/conf.d/include/track-upload
index 21df6d83..edca6bd7 100644
--- a/docker/nginx/conf.d/include/track-upload
+++ b/docker/nginx/conf.d/include/track-upload
@@ -1,4 +1,3 @@
-# register the upload in accounts service (cookies should contain jwt)
 log_by_lua_block {
     local skynet_account = require("skynet.account")
 
@@ -22,7 +21,8 @@ log_by_lua_block {
 
         -- report all skylinks (header empty if request failed) but only if jwt is preset (user is authenticated)
         if ngx.header["Skynet-Skylink"] then
-            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], skynet_account.get_auth_headers())
+            local auth_headers = skynet_account.get_auth_headers()
+            local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], auth_headers)
             if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end
         end
     end