From d631aad058000f2beefffbdd69d95fbb7ef8c9c2 Mon Sep 17 00:00:00 2001 From: Karol Wypchlo Date: Tue, 15 Mar 2022 22:43:35 +0100 Subject: [PATCH] move req headers to timer arguments --- docker/nginx/conf.d/include/track-download | 18 +++--- docker/nginx/conf.d/include/track-registry | 18 +++--- docker/nginx/conf.d/include/track-upload | 18 +++--- docker/nginx/conf.d/server/server.api | 65 +++++++++++----------- docker/nginx/libs/skynet/account.lua | 43 ++++++++++++-- 5 files changed, 94 insertions(+), 68 deletions(-) diff --git a/docker/nginx/conf.d/include/track-download b/docker/nginx/conf.d/include/track-download index 0bd74dad..7c637fe3 100644 --- a/docker/nginx/conf.d/include/track-download +++ b/docker/nginx/conf.d/include/track-download @@ -1,8 +1,10 @@ # register the download in accounts service (cookies should contain jwt) log_by_lua_block { - -- this block runs only when accounts are enabled - if require("skynet.account").accounts_enabled() then - local function track(premature, skylink, status, body_bytes_sent, jwt) + local skynet_account = require("skynet.account") + + -- tracking runs only when request comes from authenticated user + if skynet_account.is_authenticated() then + local function track(premature, skylink, status, body_bytes_sent, auth_headers) if premature then return end local httpc = require("resty.http").new() @@ -11,11 +13,7 @@ log_by_lua_block { -- 10.10.10.70 points to accounts service (alias not available when using resty-http) local res, err = httpc:request_uri("http://10.10.10.70:3000/track/download/" .. skylink .. "?" .. query, { method = "POST", - headers = { - ["Cookie"] = "skynet-jwt=" .. jwt, - ["Authorization"] = ngx.header["Authorization"], - ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"], - }, + headers = auth_headers, }) if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then @@ -23,8 +21,8 @@ log_by_lua_block { end end - if ngx.header["Skynet-Skylink"] and ngx.var.skynet_jwt ~= "" and ngx.status >= ngx.HTTP_OK and ngx.status < ngx.HTTP_SPECIAL_RESPONSE then - local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, ngx.var.skynet_jwt) + if ngx.header["Skynet-Skylink"] and ngx.status >= ngx.HTTP_OK and ngx.status < ngx.HTTP_SPECIAL_RESPONSE then + local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.status, ngx.var.body_bytes_sent, skynet_account.get_auth_headers()) if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end end end diff --git a/docker/nginx/conf.d/include/track-registry b/docker/nginx/conf.d/include/track-registry index ac981466..0344b6c6 100644 --- a/docker/nginx/conf.d/include/track-registry +++ b/docker/nginx/conf.d/include/track-registry @@ -1,8 +1,10 @@ # register the registry access in accounts service (cookies should contain jwt) log_by_lua_block { - -- this block runs only when accounts are enabled - if require("skynet.account").accounts_enabled() then - local function track(premature, request_method, jwt) + local skynet_account = require("skynet.account") + + -- tracking runs only when request comes from authenticated user + if skynet_account.is_authenticated() then + local function track(premature, request_method, auth_headers) if premature then return end local httpc = require("resty.http").new() @@ -14,11 +16,7 @@ log_by_lua_block { -- 10.10.10.70 points to accounts service (alias not available when using resty-http) local res, err = httpc:request_uri("http://10.10.10.70:3000/track/registry/" .. registry_action, { method = "POST", - headers = { - ["Cookie"] = "skynet-jwt=" .. jwt, - ["Authorization"] = ngx.header["Authorization"], - ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"], - }, + headers = auth_headers, }) if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then @@ -26,8 +24,8 @@ log_by_lua_block { end end - if ngx.var.skynet_jwt ~= "" and (ngx.status == ngx.HTTP_OK or ngx.status == ngx.HTTP_NOT_FOUND) then - local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), ngx.var.skynet_jwt) + if ngx.status == ngx.HTTP_OK or ngx.status == ngx.HTTP_NOT_FOUND then + local ok, err = ngx.timer.at(0, track, ngx.req.get_method(), skynet_account.get_auth_headers()) if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end end end diff --git a/docker/nginx/conf.d/include/track-upload b/docker/nginx/conf.d/include/track-upload index 53795d55..21df6d83 100644 --- a/docker/nginx/conf.d/include/track-upload +++ b/docker/nginx/conf.d/include/track-upload @@ -1,8 +1,10 @@ # register the upload in accounts service (cookies should contain jwt) log_by_lua_block { - -- this block runs only when accounts are enabled - if require("skynet.account").accounts_enabled() then - local function track(premature, skylink, jwt) + local skynet_account = require("skynet.account") + + -- tracking runs only when request comes from authenticated user + if skynet_account.is_authenticated() then + local function track(premature, skylink, auth_headers) if premature then return end local httpc = require("resty.http").new() @@ -10,11 +12,7 @@ log_by_lua_block { -- 10.10.10.70 points to accounts service (alias not available when using resty-http) local res, err = httpc:request_uri("http://10.10.10.70:3000/track/upload/" .. skylink, { method = "POST", - headers = { - ["Cookie"] = "skynet-jwt=" .. jwt, - ["Authorization"] = ngx.header["Authorization"], - ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"], - }, + headers = auth_headers, }) if err or (res and res.status ~= ngx.HTTP_NO_CONTENT) then @@ -23,8 +21,8 @@ log_by_lua_block { end -- report all skylinks (header empty if request failed) but only if jwt is preset (user is authenticated) - if ngx.header["Skynet-Skylink"] and ngx.var.skynet_jwt ~= "" then - local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], ngx.var.skynet_jwt) + if ngx.header["Skynet-Skylink"] then + local ok, err = ngx.timer.at(0, track, ngx.header["Skynet-Skylink"], skynet_account.get_auth_headers()) if err then ngx.log(ngx.ERR, "Failed to create timer: ", err) end end end diff --git a/docker/nginx/conf.d/server/server.api b/docker/nginx/conf.d/server/server.api index fc6f7034..24e8509d 100644 --- a/docker/nginx/conf.d/server/server.api +++ b/docker/nginx/conf.d/server/server.api @@ -172,28 +172,25 @@ location /skynet/registry/subscription { set $notificationdelay "0"; rewrite_by_lua_block { - -- this block runs only when accounts are enabled - if os.getenv("PORTAL_MODULES"):match("a") then - local httpc = require("resty.http").new() + local skynet_account = require("skynet.account") - -- fetch account limits and set download bandwidth and registry delays accordingly - local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", { - headers = { - ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt, - ["Authorization"] = ngx.header["Authorization"], - ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"], - } - }) - - -- fail gracefully in case /user/limits failed - if err or (res and res.status ~= ngx.HTTP_OK) then - ngx.log(ngx.ERR, "Failed accounts service request /user/limits: ", err or ("[HTTP " .. res.status .. "] " .. res.body)) - elseif res and res.status == ngx.HTTP_OK then - local json = require('cjson') - local limits = json.decode(res.body) - ngx.var.bandwidthlimit = limits.download - ngx.var.notificationdelay = limits.registry + if skynet_account.accounts_enabled() then + -- check if portal is in authenticated only mode + if skynet_account.is_access_unauthorized() then + return skynet_account.exit_access_unauthorized() end + + -- check if portal is in subscription only mode + if skynet_account.is_access_forbidden() then + return skynet_account.exit_access_forbidden() + end + + -- get account limits of currently authenticated user + local limits = skynet_account.get_account_limits() + + -- apply bandwidth limit and notification delay + ngx.var.bandwidthlimit = limits.download + ngx.var.notificationdelay = limits.registry end } @@ -261,19 +258,21 @@ location /skynet/tus { proxy_pass http://sia:9980; access_by_lua_block { - if require("skynet.account").accounts_enabled() then + local skynet_account = require("skynet.account") + + if skynet_account.accounts_enabled() then -- check if portal is in authenticated only mode - if require("skynet.account").is_access_unauthorized() then - return require("skynet.account").exit_access_unauthorized() + if skynet_account.is_access_unauthorized() then + return skynet_account.exit_access_unauthorized() end -- check if portal is in subscription only mode - if require("skynet.account").is_access_forbidden() then - return require("skynet.account").exit_access_forbidden() + if skynet_account.is_access_forbidden() then + return skynet_account.exit_access_forbidden() end -- get account limits of currently authenticated user - local limits = require("skynet.account").get_account_limits() + local limits = skynet_account.get_account_limits() -- apply upload size limits ngx.req.set_header("SkynetMaxUploadSize", limits.maxUploadSize) @@ -365,19 +364,21 @@ location /skynet/trustless/basesector { set $limit_rate 0; access_by_lua_block { - if require("skynet.account").accounts_enabled() then + local skynet_account = require("skynet.account") + + if skynet_account.accounts_enabled() then -- check if portal is in authenticated only mode - if require("skynet.account").is_access_unauthorized() then - return require("skynet.account").exit_access_unauthorized() + if skynet_account.is_access_unauthorized() then + return skynet_account.exit_access_unauthorized() end -- check if portal is in subscription only mode - if require("skynet.account").is_access_forbidden() then - return require("skynet.account").exit_access_forbidden() + if skynet_account.is_access_forbidden() then + return skynet_account.exit_access_forbidden() end -- get account limits of currently authenticated user - local limits = require("skynet.account").get_account_limits() + local limits = skynet_account.get_account_limits() -- apply download speed limit ngx.var.limit_rate = limits.download diff --git a/docker/nginx/libs/skynet/account.lua b/docker/nginx/libs/skynet/account.lua index 5319f665..72a2c9ea 100644 --- a/docker/nginx/libs/skynet/account.lua +++ b/docker/nginx/libs/skynet/account.lua @@ -14,6 +14,39 @@ local anon_limits = { ["registry"] = 250 } +-- utility function for checking if table is empty +function is_table_empty(check) + -- bind next to local variable to achieve ultimate efficiency + -- https://stackoverflow.com/a/1252776 + local next = next + + return next(check) == nil +end + +-- get all non empty authentication headers from request, we want to return +-- all of them and let accounts service deal with validation and prioritisation +function _M.get_auth_headers() + local request_headers = ngx.req.get_headers() + local headers = {} + + -- if skynet_jwt is set, include it as a cookie + if ngx.var.skynet_jwt ~= "" then + headers["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt + end + + -- if authorization header is set, pass it as is + if request_headers["Authorization"] then + headers["Authorization"] = request_headers["Authorization"] + end + + -- if skynet api key header is set, pass it as is + if request_headers["Skynet-Api-Key"] then + headers["Skynet-Api-Key"] = request_headers["Skynet-Api-Key"] + end + + return headers +end + -- handle request exit when access to portal should be restricted to authenticated users only function _M.exit_access_unauthorized(message) ngx.status = ngx.HTTP_UNAUTHORIZED @@ -36,8 +69,10 @@ end function _M.get_account_limits() local cjson = require('cjson') + local auth_headers = _M.get_auth_headers() - if ngx.var.skynet_jwt == "" then + -- simple case of anonymous request - none of available auth headers exist + if is_table_empty(auth_headers) then return anon_limits end @@ -46,11 +81,7 @@ function _M.get_account_limits() -- 10.10.10.70 points to accounts service (alias not available when using resty-http) local res, err = httpc:request_uri("http://10.10.10.70:3000/user/limits", { - headers = { - ["Cookie"] = "skynet-jwt=" .. ngx.var.skynet_jwt, - ["Authorization"] = ngx.header["Authorization"], - ["Skynet-Api-Key"] = ngx.header["Skynet-Api-Key"], - } + headers = auth_headers, }) -- fail gracefully in case /user/limits failed