Merge pull request #7 from Reloadly/develop

Support for Javascript users

Author: Arun Patra

.eslintrc

@@ -1,6 +1,12 @@
 {
   "rules": {
-    "semi": ["error", "always"],
-    "quotes": ["error", "double"]
+    "semi": [
+      "error",
+      "always"
+    ],
+    "quotes": [
+      "error",
+      "double"
+    ]
   }
 }

.gitignore

@@ -2,14 +2,9 @@
 logs
 *.log
 npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-lerna-debug.log*
 
 .idea/
 package-lock.json
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 
 # Runtime data
 pids
@@ -24,43 +19,10 @@ lib-cov
 coverage
 *.lcov
 
-# nyc test coverage
-.nyc_output
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
 node_modules/
-jspm_packages/
-
-# TypeScript v1 declaration files
-typings/
-
-# TypeScript cache
-*.tsbuildinfo
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-
-# Optional REPL history
-.node_repl_history
 
 # Output of 'npm pack'
 *.tgz
 
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variables file
-.env
-.env.test
-
-dist
+lib

.npmignore

@@ -3,7 +3,6 @@
 /package-lock.json
 
 # coverage
-/.nyc_output
 /coverage
 
 src

.prettierrc

@@ -1,5 +1,5 @@
 {
-  "printWidth": 80,
+  "printWidth": 120,
   "trailingComma": "all",
   "singleQuote": true
 }

README.md

@@ -2,50 +2,60 @@
 
 Lightweight Http Firewall to protect against common threats.
 
-This is a direct port of the [Spring Security HttpFirewall](https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html).
+This is a direct port of
+the [Spring Security HttpFirewall](https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html).
 
-- This library is a middleware for Express Server. 
-- Its highly recommended not to disable firewall rules, since its extremely risky to do so. You can however provided your own overrides that gives you the options of disable rules or provide your own constraints.
+- This library is a middleware for Express Server.
+- Its highly recommended not to disable firewall rules, since its extremely risky to do so. You can however provided
+  your own overrides that gives you the options of disable rules or provide your own constraints.
 - If a threat is detected, a HTTP status code 403 is returned to the caller, and no further processing happens.
 - Calls which pass the firewall rules, will process as normal.
 
 ## Examples ##
 
 The firewall can be configured as shown below:
 
+### TypeScript Usage ###
+
 ```typescript
 import express, { Request, Response } from 'express';
-import { HttpFirewallOptions, Predicate } from "../types";
-import { StrictHttpFirewall } from "../index";
+import { HttpFirewallOptions, Predicate, httpFirewall } from '@prizemates/http-firewall';
 
 const app = express();
 const port = 3000;
 
-// This must be added first, before adding any routes
-app.use(new StrictHttpFirewall(firewallOptions()).firewall)
-
-// Or, to simply use the firewall with default rules:
-//app.use(httpFirewall)
+// This middleware must be added before adding any other routes
+app.use(httpFirewall())
+// Or, you can customize the behaviour by providing options. See HttpFirewallOptions
+// app.use(httpFirewall({logToConsole : true}));
 
 app.get('/', (req: Request, res: Response) => {
-    res.send('Http Firewall Demo running');
+  res.send('Http Firewall Demo running');
 });
 
 app.listen(port, () => {
-    console.log(`⚡️[server]: Server is running at http://localhost:${port}`);
+  console.log(`⚡️[server]: Server is running at http://localhost:${port}`);
 });
+```
 
+### Javascript Usage ###
 
-function firewallOptions(): HttpFirewallOptions {
-    // Allows traffic from specific hosts only
-    const allowedHostnamesPredicate =
-        Predicate.of<string>(h => h.endsWith('example.com')).or(
-            Predicate.of<string>(h => h === "localhost"));
+```javascript
+const express = require("express");
+const { httpFirewall } = require("@prizemates/http-firewall");
+
+const app = express();
+const port = 3000;
 
-    return {
-        allowedHostnames: allowedHostnamesPredicate,
-        allowedHttpMethods: ['POST', 'GET'],
-    };
-}
+app.use(httpFirewall())
+// Or, you can customize the behaviour by providing options. See HttpFirewallOptions
+// app.use(httpFirewall({logToConsole : true}));
 
+app.get('/', (req: Request, res: Response) => {
+  res.send('Http Firewall Demo running');
+});
+
+app.listen(port, () => {
+  console.log(`⚡️[server]: Server is running at http://localhost:${port}`);
+});
 ```

babel.config.js

@@ -1,6 +1,6 @@
 module.exports = {
-    presets: [
-        ['@babel/preset-env', {targets: {node: 'current'}}],
-        '@babel/preset-typescript',
-    ],
+  presets: [
+    ["@babel/preset-env", { targets: { node: "current" } }],
+    "@babel/preset-typescript"
+  ]
 };

package.json

@@ -1,22 +1,22 @@
 {
-  "name": "@prizemates/httpt-firewall",
-  "version": "0.0.2",
+  "name": "@prizemates/http-firewall",
+  "version": "0.0.3",
   "description": "HTTP Firewall based on Spring Security HttpFirewall",
   "private": false,
-  "main": "./dist/demo/demo.js",
-  "types": "./dist/index.d.ts",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
   "files": [
-    "dist/**/*"
+    "lib/**/*"
   ],
   "scripts": {
     "build": "tsc",
-    "start": "node dist/demo/demo.js",
-    "demo": "node dist/demo/demo.js",
+    "start": "node lib/demo/demo.js",
+    "demo": "node lib/demo/demo.js",
     "test": "jest",
     "format": "prettier --write \"src/**/*.ts\"",
     "lint": "eslint",
-    "prepare" : "npm run build",
-    "prepublishOnly" : "npm test && npm run lint"
+    "prepare": "npm run build",
+    "prepublishOnly": "npm test && npm run lint"
   },
   "jest": {
     "testMatch": [

…/__tests__/strict.http.firewall.tests.ts …/__tests__/strict-http-firewall.tests.tssrc/__tests__/strict.http.firewall.tests.ts renamed to src/__tests__/strict-http-firewall.tests.ts src/__tests__/strict.http.firewall.tests.ts renamed to src/__tests__/strict-http-firewall.tests.ts

@@ -1,5 +1,4 @@
-import { HttpFirewallOptions } from '../types';
-import { StrictHttpFirewall } from '../strict.http.firewall';
+import { httpFirewall, HttpFirewallOptions } from '../strict-http-firewall';
 import express from 'express';
 import request from 'supertest';
 
@@ -10,10 +9,8 @@ describe('HttpStrictFirewall test suite', () => {
       const options: HttpFirewallOptions = {
         allowedHttpMethods: ['POST', 'GET'],
       };
-      app.use(new StrictHttpFirewall(options).firewall);
-      const res = await request(app)
-        .head('/')
-        .set('Content-Type', 'application/json');
+      app.use(httpFirewall(options));
+      const res = await request(app).head('/').set('Content-Type', 'application/json');
       expect(res.statusCode).toBe(403);
     });
 
@@ -23,16 +20,14 @@ describe('HttpStrictFirewall test suite', () => {
       const options: HttpFirewallOptions = {
         allowedHttpMethods: ['POST', 'GET'],
       };
-      app.use(new StrictHttpFirewall(options).firewall);
+      app.use(httpFirewall(options));
       app.get('/', (req, res) => {
         // You're working with an express req and res now.
         res.status(200).send();
       });
 
       // Act
-      const res = await request(app)
-        .get('/')
-        .set('Content-Type', 'application/json');
+      const res = await request(app).get('/').set('Content-Type', 'application/json');
 
       // Assert
       expect(res.statusCode).toBe(200);

src/demo/demo.ts

@@ -1,15 +1,11 @@
 import express, { Express, Request, Response } from 'express';
-import { HttpFirewallOptions, Predicate } from '../types';
-import { StrictHttpFirewall } from '../index';
+import { httpFirewall, HttpFirewallOptions, Predicate } from '../index';
 
 const app: Express = express();
 const port = 5428;
 
 // This must be added first, before adding any routes
-app.use(new StrictHttpFirewall(firewallOptions()).firewall);
-
-// Or, to simply use the firewall with default rules:
-//app.use(httpFirewall)
+app.use(httpFirewall(firewallOptions()));
 
 app.get('/', (req: Request, res: Response) => {
   res.send('Http Firewall Demo running');
@@ -21,9 +17,9 @@ app.listen(port, () => {
 
 function firewallOptions(): HttpFirewallOptions {
   // Allows traffic from specific hosts only
-  const allowedHostnamesPredicate = Predicate.of<string>((h) =>
-    h.endsWith('example.com'),
-  ).or(Predicate.of<string>((h) => h === 'localhost'));
+  const allowedHostnamesPredicate = Predicate.of<string>((h) => h.endsWith('example.com')).or(
+    Predicate.of<string>((h) => h === 'localhost'),
+  );
 
   return {
     allowedHostnames: allowedHostnamesPredicate,

src/index.ts

@@ -1 +1,6 @@
-export * from './strict.http.firewall';
+export {
+  httpFirewall,
+  HttpFirewallOptions,
+  HttpMethod,
+  Predicate
+} from './strict-http-firewall';