pull out editor-client and editor-api

packages/node_modules/@node-red/runtime/lib/nodes/credentials.js

@@ -0,0 +1,432 @@
+/**
+ * Copyright JS Foundation and other contributors, http://js.foundation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var when = require("when");
+var crypto = require('crypto');
+var runtime;
+var settings;
+var log;
+
+
+var encryptedCredentials = null;
+var credentialCache = {};
+var credentialsDef = {};
+var dirty = false;
+
+var removeDefaultKey = false;
+var encryptionEnabled = null;
+var encryptionKeyType; // disabled, system, user, project
+var encryptionAlgorithm = "aes-256-ctr";
+var encryptionKey;
+
+function decryptCredentials(key,credentials) {
+    var creds = credentials["$"];
+    var initVector = new Buffer(creds.substring(0, 32),'hex');
+    creds = creds.substring(32);
+    var decipher = crypto.createDecipheriv(encryptionAlgorithm, key, initVector);
+    var decrypted = decipher.update(creds, 'base64', 'utf8') + decipher.final('utf8');
+    return JSON.parse(decrypted);
+}
+function encryptCredentials(key,credentials) {
+    var initVector = crypto.randomBytes(16);
+    var cipher = crypto.createCipheriv(encryptionAlgorithm, key, initVector);
+    return {"$":initVector.toString('hex') + cipher.update(JSON.stringify(credentials), 'utf8', 'base64') + cipher.final('base64')};
+}
+
+var api = module.exports = {
+    init: function(_runtime) {
+        runtime = _runtime;
+        log = runtime.log;
+        settings = runtime.settings;
+        dirty = false;
+        credentialCache = {};
+        credentialsDef = {};
+        encryptionEnabled = null;
+    },
+
+    /**
+     * Sets the credentials from storage.
+     */
+    load: function (credentials) {
+        dirty = false;
+        var credentialsEncrypted = credentials.hasOwnProperty("$") && Object.keys(credentials).length === 1;
+
+        // Case 1: Active Project in place
+        //  - use whatever its config says
+
+        // Case 2: _credentialSecret unset, credentialSecret unset
+        //  - generate _credentialSecret and encrypt
+
+        // Case 3: _credentialSecret set, credentialSecret set
+        //  - migrate from _credentialSecret to credentialSecret
+        //  - delete _credentialSecret
+
+        // Case 4: credentialSecret set
+        //  - use it
+
+        var setupEncryptionPromise = when.resolve();
+
+        var projectKey = false;
+        var activeProject;
+        encryptionKeyType = "";
+
+        if (runtime.storage && runtime.storage.projects) {
+            // projects enabled
+            activeProject = runtime.storage.projects.getActiveProject();
+            if (activeProject) {
+                projectKey = activeProject.credentialSecret;
+                if (!projectKey) {
+                    log.debug("red/runtime/nodes/credentials.load : using active project key - disabled");
+                    encryptionKeyType = "disabled";
+                    encryptionEnabled = false;
+                } else {
+                    log.debug("red/runtime/nodes/credentials.load : using active project key");
+                    encryptionKeyType = "project";
+                    encryptionKey = crypto.createHash('sha256').update(projectKey).digest();
+                    encryptionEnabled = true;
+                }
+            }
+        }
+
+        if (encryptionKeyType === '') {
+            var defaultKey;
+            try {
+                defaultKey = settings.get('_credentialSecret');
+            } catch(err) {
+            }
+            if (defaultKey) {
+                defaultKey = crypto.createHash('sha256').update(defaultKey).digest();
+                encryptionKeyType = "system";
+            }
+            var userKey;
+            try {
+                userKey = settings.get('credentialSecret');
+            } catch(err) {
+                userKey = false;
+            }
+
+            if (userKey === false) {
+                encryptionKeyType = "disabled";
+                log.debug("red/runtime/nodes/credentials.load : user disabled encryption");
+                // User has disabled encryption
+                encryptionEnabled = false;
+                // Check if we have a generated _credSecret to decrypt with and remove
+                if (defaultKey) {
+                    log.debug("red/runtime/nodes/credentials.load : default key present. Will migrate");
+                    if (credentialsEncrypted) {
+                        try {
+                            credentials = decryptCredentials(defaultKey,credentials)
+                        } catch(err) {
+                            credentials = {};
+                            log.warn(log._("nodes.credentials.error",{message:err.toString()}))
+                            var error = new Error("Failed to decrypt credentials");
+                            error.code = "credentials_load_failed";
+                            return when.reject(error);
+                        }
+                    }
+                    dirty = true;
+                    removeDefaultKey = true;
+                }
+            } else if (typeof userKey === 'string') {
+                if (!projectKey) {
+                    log.debug("red/runtime/nodes/credentials.load : user provided key");
+                }
+                if (encryptionKeyType !== 'project') {
+                    encryptionKeyType = 'user';
+                }
+                // User has provided own encryption key, get the 32-byte hash of it
+                encryptionKey = crypto.createHash('sha256').update(userKey).digest();
+                encryptionEnabled = true;
+
+                if (encryptionKeyType !== 'project' && defaultKey) {
+                    log.debug("red/runtime/nodes/credentials.load : default key present. Will migrate");
+                    // User has provided their own key, but we already have a default key
+                    // Decrypt using default key
+                    if (credentialsEncrypted) {
+                        try {
+                            credentials = decryptCredentials(defaultKey,credentials)
+                        } catch(err) {
+                            credentials = {};
+                            log.warn(log._("nodes.credentials.error",{message:err.toString()}))
+                            var error = new Error("Failed to decrypt credentials");
+                            error.code = "credentials_load_failed";
+                            return when.reject(error);
+                        }
+                    }
+                    dirty = true;
+                    removeDefaultKey = true;
+                }
+            } else {
+                log.debug("red/runtime/nodes/credentials.load : no user key present");
+                // User has not provide their own key
+                if (encryptionKeyType !== 'project') {
+                    encryptionKeyType = 'system';
+                }
+                encryptionKey = defaultKey;
+                encryptionEnabled = true;
+                if (encryptionKey === undefined) {
+                    log.debug("red/runtime/nodes/credentials.load : no default key present - generating one");
+                    // No user-provided key, no generated key
+                    // Generate a new key
+                    defaultKey = crypto.randomBytes(32).toString('hex');
+                    try {
+                        setupEncryptionPromise = settings.set('_credentialSecret',defaultKey);
+                        encryptionKey = crypto.createHash('sha256').update(defaultKey).digest();
+                    } catch(err) {
+                        log.debug("red/runtime/nodes/credentials.load : settings unavailable - disabling encryption");
+                        // Settings unavailable
+                        encryptionEnabled = false;
+                        encryptionKey = null;
+                    }
+                    dirty = true;
+                } else {
+                    log.debug("red/runtime/nodes/credentials.load : using default key");
+                }
+            }
+        }
+
+        if (encryptionEnabled && !dirty) {
+            encryptedCredentials = credentials;
+        }
+        log.debug("red/runtime/nodes/credentials.load : keyType="+encryptionKeyType);
+        if (encryptionKeyType === 'system') {
+            log.warn(log._("nodes.credentials.system-key-warning"));
+        }
+        return setupEncryptionPromise.then(function() {
+            var clearInvalidFlag = false;
+            if (credentials.hasOwnProperty("$")) {
+                if (encryptionEnabled === false) {
+                    // The credentials appear to be encrypted, but our config
+                    //  thinks they are not.
+                    var error = new Error("Failed to decrypt credentials");
+                    error.code = "credentials_load_failed";
+                    if (activeProject) {
+                        // This is a project with a bad key. Mark it as invalid
+                        // TODO: this delves too deep into Project structure
+                        activeProject.credentialSecretInvalid = true;
+                        return when.reject(error);
+                    }
+                    return when.reject(error);
+                }
+                // These are encrypted credentials
+                try {
+                    credentialCache = decryptCredentials(encryptionKey,credentials)
+                    clearInvalidFlag = true;
+                } catch(err) {
+                    credentialCache = {};
+                    dirty = true;
+                    log.warn(log._("nodes.credentials.error",{message:err.toString()}))
+                    var error = new Error("Failed to decrypt credentials");
+                    error.code = "credentials_load_failed";
+                    if (activeProject) {
+                        // This is a project with a bad key. Mark it as invalid
+                        // TODO: this delves too deep into Project structure
+                        activeProject.credentialSecretInvalid = true;
+                        return when.reject(error);
+                    }
+                    return when.reject(error);
+                }
+            } else {
+                credentialCache = credentials;
+            }
+            if (clearInvalidFlag) {
+                // TODO: this delves too deep into Project structure
+                if (activeProject) {
+                    delete activeProject.credentialSecretInvalid;
+                }
+            }
+        });
+    },
+
+    /**
+     * Adds a set of credentials for the given node id.
+     * @param id the node id for the credentials
+     * @param creds an object of credential key/value pairs
+     * @return a promise for backwards compatibility TODO: can this be removed?
+     */
+    add: function (id, creds) {
+        if (!credentialCache.hasOwnProperty(id) || JSON.stringify(creds) !== JSON.stringify(credentialCache[id])) {
+            credentialCache[id] = creds;
+            dirty = true;
+        }
+        return when.resolve();
+    },
+
+    /**
+     * Gets the credentials for the given node id.
+     * @param id the node id for the credentials
+     * @return the credentials
+     */
+    get: function (id) {
+        return credentialCache[id];
+    },
+
+    /**
+     * Deletes the credentials for the given node id.
+     * @param id the node id for the credentials
+     * @return a promise for the saving of credentials to storage
+     */
+    delete: function (id) {
+        delete credentialCache[id];
+        dirty = true;
+    },
+
+    clear: function() {
+        credentialCache = {};
+        dirty = true;
+    },
+    /**
+     * Deletes any credentials for nodes that no longer exist
+     * @param config a flow config
+     * @return a promise for the saving of credentials to storage
+     */
+    clean: function (config) {
+        var existingIds = {};
+        config.forEach(function(n) {
+            existingIds[n.id] = true;
+            if (n.credentials) {
+                api.extract(n);
+            }
+        });
+        var deletedCredentials = false;
+        for (var c in credentialCache) {
+            if (credentialCache.hasOwnProperty(c)) {
+                if (!existingIds[c]) {
+                    deletedCredentials = true;
+                    delete credentialCache[c];
+                }
+            }
+        }
+        if (deletedCredentials) {
+            dirty = true;
+        }
+        return when.resolve();
+    },
+
+    /**
+     * Registers a node credential definition.
+     * @param type the node type
+     * @param definition the credential definition
+     */
+    register: function (type, definition) {
+        var dashedType = type.replace(/\s+/g, '-');
+        credentialsDef[dashedType] = definition;
+    },
+
+    /**
+     * Extracts and stores any credential updates in the provided node.
+     * The provided node may have a .credentials property that contains
+     * new credentials for the node.
+     * This function loops through the credentials in the definition for
+     * the node-type and applies any of the updates provided in the node.
+     *
+     * This function does not save the credentials to disk as it is expected
+     * to be called multiple times when a new flow is deployed.
+     *
+     * @param node the node to extract credentials from
+     */
+    extract: function(node) {
+        var nodeID = node.id;
+        var nodeType = node.type;
+        var newCreds = node.credentials;
+        if (newCreds) {
+            delete node.credentials;
+            var savedCredentials = credentialCache[nodeID] || {};
+            var dashedType = nodeType.replace(/\s+/g, '-');
+            var definition = credentialsDef[dashedType];
+            if (!definition) {
+                log.warn(log._("nodes.credentials.not-registered",{type:nodeType}));
+                return;
+            }
+
+            for (var cred in definition) {
+                if (definition.hasOwnProperty(cred)) {
+                    if (newCreds[cred] === undefined) {
+                        continue;
+                    }
+                    if (definition[cred].type == "password" && newCreds[cred] == '__PWRD__') {
+                        continue;
+                    }
+                    if (0 === newCreds[cred].length || /^\s*$/.test(newCreds[cred])) {
+                        delete savedCredentials[cred];
+                        dirty = true;
+                        continue;
+                    }
+                    if (!savedCredentials.hasOwnProperty(cred) || JSON.stringify(savedCredentials[cred]) !== JSON.stringify(newCreds[cred])) {
+                        savedCredentials[cred] = newCreds[cred];
+                        dirty = true;
+                    }
+                }
+            }
+            credentialCache[nodeID] = savedCredentials;
+        }
+    },
+
+    /**
+     * Gets the credential definition for the given node type
+     * @param type the node type
+     * @return the credential definition
+     */
+    getDefinition: function (type) {
+        return credentialsDef[type];
+    },
+
+    dirty: function() {
+        return dirty;
+    },
+    setKey: function(key) {
+        if (key) {
+            encryptionKey = crypto.createHash('sha256').update(key).digest();
+            encryptionEnabled = true;
+            dirty = true;
+            encryptionKeyType = "project";
+        } else {
+            encryptionKey = null;
+            encryptionEnabled = false;
+            dirty = true;
+            encryptionKeyType = "disabled";
+        }
+    },
+    getKeyType: function() {
+        return encryptionKeyType;
+    },
+    export: function() {
+        var result = credentialCache;
+
+        if (encryptionEnabled) {
+            if (dirty) {
+                try {
+                    log.debug("red/runtime/nodes/credentials.export : encrypting");
+                    result = encryptCredentials(encryptionKey, credentialCache);
+                } catch(err) {
+                    log.warn(log._("nodes.credentials.error-saving",{message:err.toString()}))
+                }
+            } else {
+                result = encryptedCredentials;
+            }
+        }
+        dirty = false;
+        if (removeDefaultKey) {
+            log.debug("red/runtime/nodes/credentials.export : removing unused default key");
+            return settings.delete('_credentialSecret').then(function() {
+                removeDefaultKey = false;
+                return result;
+            })
+        } else {
+            return when.resolve(result);
+        }
+    }
+}