feat(#9706): use Proxy Auth for communicating with Couch

api/server.js

@@ -24,7 +24,9 @@ process
     logger.info('Checks passed successfully');
 
     const uploadDefaultDocs = require('./src/upload-default-docs');
+    const databases = require('./src/services/setup/databases');
     logger.info('Extracting initial documents…');
+    await databases.init();
     await uploadDefaultDocs.run();
     logger.info('Extracting initial documents completed successfully');
 

api/src/auth.js

@@ -8,17 +8,17 @@ const { roles, users } = require('@medic/user-management')(config, db, dataConte
 
 const contentLengthRegex = /^content-length$/i;
 
-const get = (path, headers) => {
+const get = async (path, headers) => {
   const getHeaders = { ...headers };
   Object
     .keys(getHeaders)
     .filter(header => contentLengthRegex.test(header))
     .forEach(header => delete getHeaders[header]);
 
-  const url = new URL(path, environment.serverUrlNoAuth);
+  const url = new URL(path, environment.serverUrl);
   return request.get({
     url: url.toString(),
-    headers: getHeaders,
+    headers: { ...getHeaders, ...request.NO_DEFAULT_AUTH_HEADERS },
     json: true
   });
 };
@@ -100,13 +100,14 @@ module.exports = {
    *
    * @param      {Object}    Credentials object as created by basicAuthCredentials
    */
-  validateBasicAuth: ({ username, password }) => {
-    const authUrl = new URL(environment.serverUrlNoAuth);
+  validateBasicAuth: async ({ username, password }) => {
+    const authUrl = new URL(environment.serverUrl);
     authUrl.username = username;
     authUrl.password = password;
     return request.head({
       uri: authUrl.toString(),
-      resolveWithFullResponse: true
+      resolveWithFullResponse: true,
+      headers: request.NO_DEFAULT_AUTH_HEADERS,
     })
       .then(res => {
         if (res.statusCode !== 200) {

api/src/controllers/login.js

@@ -166,16 +166,17 @@ const getSessionCookie = res => {
   );
 };
 
-const createSession = req => {
+const createSession = async (req) => {
   const user = req.body.user;
   const password = req.body.password;
   return request.post({
-    url: new URL('/_session', environment.serverUrlNoAuth).toString(),
+    url: new URL('/_session', environment.serverUrl).toString(),
     json: true,
     resolveWithFullResponse: true,
     simple: false, // doesn't throw an error on non-200 responses
     body: { name: user, password: password },
     auth: { user: user, pass: password },
+    headers: request.NO_DEFAULT_AUTH_HEADERS
   });
 };
 

api/src/db-batch.js

@@ -21,7 +21,6 @@ const runBatch = (ddoc, view, viewParams, iteratee) => {
   return request.get({
     url: fullUrl,
     json: true,
-    auth: { user: environment.username, pass: environment.password },
   })
     .then(result => {
       logger.info(`        Processing doc ${result.offset}`);

api/src/db.js

@@ -8,6 +8,7 @@ PouchDB.plugin(require('pouchdb-find'));
 PouchDB.plugin(require('pouchdb-mapreduce'));
 const asyncLocalStorage = require('./services/async-storage');
 const { REQUEST_ID_HEADER } = require('./server-utils');
+const { getMemberAuthHeaders, getAdminAuthHeaders } = require('@medic/couch-request');
 
 const { UNIT_TEST_ENV } = process.env;
 
@@ -73,7 +74,12 @@ if (UNIT_TEST_ENV) {
     module.exports[fn] = () => notStubbed(fn);
   });
 } else {
-  const fetch = (url, opts) => {
+  const makeFetch = (promisedAuthHeaders) => async (url, opts) => {
+    // Add Couch Proxy Auth headers
+    Object
+      .entries(await promisedAuthHeaders)
+      .forEach(([name, value]) => opts.headers.set(name, value));
+
     // Adding audit flag (haproxy) Service that made the request initially.
     opts.headers.set('X-Medic-Service', 'api');
     const requestId = asyncLocalStorage.getRequestId();
@@ -82,22 +88,29 @@ if (UNIT_TEST_ENV) {
     }
     return PouchDB.fetch(url, opts);
   };
+  const fetch = makeFetch(getMemberAuthHeaders());
+  const adminFetch = makeFetch(getAdminAuthHeaders());
 
   const DB = new PouchDB(environment.couchUrl, { fetch });
   const getDbUrl = name => `${environment.serverUrl}/${name}`;
 
   DB.setMaxListeners(0);
   module.exports.medic = DB;
+  module.exports.medicAsAdmin = new PouchDB(environment.couchUrl, { fetch: adminFetch });
   module.exports.medicUsersMeta = new PouchDB(`${environment.couchUrl}-users-meta`, { fetch });
+  module.exports.medicUsersMetaAsAdmin = new PouchDB(`${environment.couchUrl}-users-meta`, { fetch: adminFetch });
   module.exports.medicLogs = new PouchDB(`${environment.couchUrl}-logs`, { fetch });
+  module.exports.medicLogsAsAdmin = new PouchDB(`${environment.couchUrl}-logs`, { fetch: adminFetch });
   module.exports.sentinel = new PouchDB(`${environment.couchUrl}-sentinel`, { fetch });
-  module.exports.vault = new PouchDB(`${environment.couchUrl}-vault`, { fetch });
+  module.exports.sentinelAsAdmin = new PouchDB(`${environment.couchUrl}-sentinel`, { fetch: adminFetch });
+  module.exports.vault = new PouchDB(`${environment.couchUrl}-vault`, { fetch: adminFetch });
   module.exports.createVault = () => module.exports.vault.info();
-  module.exports.users = new PouchDB(getDbUrl('_users'), { fetch });
+  module.exports.users = new PouchDB(getDbUrl('_users'), { fetch: adminFetch });
   module.exports.builds = new PouchDB(environment.buildsUrl);
 
   // Get the DB with the given name
-  module.exports.get = name => new PouchDB(getDbUrl(name), { fetch });
+  // TODO Does it make sense to just use this for admin dbs? Probably have to worry about closing.
+  module.exports.get = name => new PouchDB(getDbUrl(name), { fetch: adminFetch });
   module.exports.close = db => {
     if (!db || db._destroyed || db._closed) {
       return;
@@ -193,34 +206,33 @@ if (UNIT_TEST_ENV) {
     roles: [],
   });
 
-  const addRoleToSecurity = async (dbname, role, addAsAdmin) => {
-    if (!dbname || !role) {
-      throw new Error(`Cannot add security: invalid db name ${dbname} or role ${role}`);
+  const addToSecurity = async (dbname, value, securityField) => {
+    if (!dbname || !value) {
+      throw new Error(`Cannot add security: invalid db name ${dbname} or ${securityField} ${value}`);
     }
 
     const securityUrl = new URL(environment.serverUrl);
     securityUrl.pathname = `${dbname}/_security`;
 
     const securityObject = await request.get({ url: securityUrl.toString(), json: true });
-    const property = addAsAdmin ? 'admins' : 'members';
 
-    if (!securityObject[property]) {
-      securityObject[property] = getDefaultSecurityStructure();
+    if (!securityObject.members) {
+      securityObject.members = getDefaultSecurityStructure();
     }
 
-    if (!securityObject[property].roles || !Array.isArray(securityObject[property].roles)) {
-      securityObject[property].roles = [];
+    if (!securityObject.members[securityField] || !Array.isArray(securityObject.members[securityField])) {
+      securityObject.members[securityField] = [];
     }
 
-    if (securityObject[property].roles.includes(role)) {
+    if (securityObject.members[securityField].includes(value)) {
       return;
     }
 
-    logger.info(`Adding "${role}" role to ${dbname} ${property}`);
-    securityObject[property].roles.push(role);
+    logger.info(`Adding "${value}" role to ${dbname} members`);
+    securityObject.members[securityField].push(value);
     await request.put({ url: securityUrl.toString(), json: true, body: securityObject });
   };
 
-  module.exports.addRoleAsAdmin = (dbname, role) => addRoleToSecurity(dbname, role, true);
-  module.exports.addRoleAsMember = (dbname, role) => addRoleToSecurity(dbname, role, false);
+  module.exports.addUserAsMember = (dbname, name) => addToSecurity(dbname, name, 'names');
+  module.exports.addRoleAsMember = (dbname, role) => addToSecurity(dbname, role, 'roles');
 }

api/src/generate-service-worker.js

@@ -131,7 +131,7 @@ const writeServiceWorkerMetaDoc = async (hash) => {
     const doc = await getSwMetaDoc();
     doc.generated_at = new Date().getTime();
     doc.hash = hash;
-    await db.medic.put(doc);
+    await db.medicAsAdmin.put(doc);
   } catch (err) {
     // don't log conflicts
     if (err.status !== 409) {

api/src/migrations/restrict-access-to-audit-db.js

@@ -14,10 +14,6 @@ const addMemberToDb = () => {
       port: environment.port,
       pathname: `${environment.db}-audit/_security`,
     }),
-    auth: {
-      user: environment.username,
-      pass: environment.password
-    },
     json: true,
     body: securityObject
   });

api/src/migrations/restrict-access-to-sentinel-db.js

@@ -15,10 +15,6 @@ const addSecurityToDb = () => {
       port: environment.port,
       pathname: `${environment.db}-sentinel/_security`,
     }),
-    auth: {
-      user: environment.username,
-      pass: environment.password
-    },
     json: true,
     body: securityObject
   });

api/src/migrations/restrict-access-to-vault-db.js

@@ -15,10 +15,6 @@ const addSecurityToDb = () => {
       port: environment.port,
       pathname: `${environment.db}-vault/_security`,
     }),
-    auth: {
-      user: environment.username,
-      pass: environment.password
-    },
     json: true,
     body: securityObject
   });

api/src/services/generate-xform.js

@@ -264,7 +264,7 @@ module.exports = {
         const doc = docs.length && docs[0];
         if (doc) {
           logger.info(`Updating form with ID "${docId}"`);
-          return db.medic.put(doc);
+          return db.medicAsAdmin.put(doc);
         }
         logger.info(`Form with ID "${docId}" does not need to be updated.`);
       });
@@ -287,7 +287,7 @@ module.exports = {
         if (!toSave.length) {
           return;
         }
-        return db.saveDocs(db.medic, toSave).then(results => {
+        return db.saveDocs(db.medicAsAdmin, toSave).then(results => {
           const failures = results.filter(result => !result.ok);
           if (failures.length) {
             logger.error('Bulk save failed with: %o', failures);

api/src/services/setup/databases.js

@@ -9,7 +9,7 @@ const db = require('../../db');
 
 const MEDIC_DATABASE = {
   name: environment.db,
-  db: db.medic,
+  db: db.medicAsAdmin,
   jsonFileName: 'medic.json',
 };
 
@@ -20,17 +20,17 @@ const DATABASES = [
   MEDIC_DATABASE,
   {
     name: `${environment.db}-sentinel`,
-    db: db.sentinel,
+    db: db.sentinelAsAdmin,
     jsonFileName: 'sentinel.json',
   },
   {
     name: `${environment.db}-logs`,
-    db: db.medicLogs,
+    db: db.medicLogsAsAdmin,
     jsonFileName: 'logs.json',
   },
   {
     name: `${environment.db}-users-meta`,
-    db: db.medicUsersMeta,
+    db: db.medicUsersMetaAsAdmin,
     jsonFileName: 'users-meta.json',
   },
   {
@@ -40,7 +40,12 @@ const DATABASES = [
   },
 ];
 
+const addSystemUserToDbs = () => Promise.all(DATABASES
+  .filter(({ name }) => name !== '_users')
+  .map(({ name }) => db.addUserAsMember(name, environment.username)));
+
 module.exports = {
   MEDIC_DATABASE,
   DATABASES,
+  init: async () => addSystemUserToDbs()
 };

api/src/services/user-db.js

@@ -79,10 +79,6 @@ module.exports = {
         port: environment.port,
         pathname: `${dbName}/_security`,
       }),
-      auth: {
-        user: environment.username,
-        pass: environment.password
-      },
       json: true,
       body: {
         admins: { names: [ username ], roles: [] },

couchdb/10-docker-default.ini

@@ -19,6 +19,10 @@ bind_address = 0.0.0.0
 server_options = [{recbuf, 262144}]
 socket_options = [{sndbuf, 262144}, {nodelay, true}]
 require_valid_user = true
+authentication_handlers = {chttpd_auth, cookie_authentication_handler}, {chttpd_auth, proxy_authentication_handler}, {chttpd_auth, default_authentication_handler}
+
+[chttpd_auth]
+proxy_use_secret = true
 
 [httpd]
 secure_rewrites = false

sentinel/src/db.js

@@ -61,20 +61,29 @@ if (UNIT_TEST_ENV) {
 
   const couchUrl = environment.couchUrl;
 
-  const fetchFn = (url, opts) => {
+  const makeFetch = (promisedAuthHeaders) => async (url, opts) => {
+    // Add Couch Proxy Auth headers
+    Object
+      .entries(await promisedAuthHeaders)
+      .forEach(([name, value]) => opts.headers.set(name, value));
     // Adding audit flags (haproxy) Service and user that made the request initially.
     opts.headers.set('X-Medic-Service', 'sentinel');
     opts.headers.set('X-Medic-User', 'sentinel');
     return PouchDB.fetch(url, opts);
   };
+  const fetch = makeFetch(request.getMemberAuthHeaders());
+  const adminFetch = makeFetch(request.getAdminAuthHeaders());
 
-  module.exports.medic = new PouchDB(couchUrl, { fetch: fetchFn });
-  module.exports.sentinel = new PouchDB(`${couchUrl}-sentinel`, {
-    fetch: fetchFn,
-  });
 
-  module.exports.allDbs = () => request.get({ url: `${environment.serverUrl}/_all_dbs`, json: true });
-  module.exports.get = db => new PouchDB(`${environment.serverUrl}/${db}`);
+  module.exports.medic = new PouchDB(couchUrl, { fetch });
+  module.exports.sentinel = new PouchDB(`${couchUrl}-sentinel`, { fetch });
+
+  module.exports.allDbs = async () => {
+    const headers = await request.getAdminAuthHeaders();
+    return request.get({ url: `${environment.serverUrl}/_all_dbs`, json: true, headers });
+  };
+  // TODO Should this maybe be getAsAdmin?
+  module.exports.get = db => new PouchDB(`${environment.serverUrl}/${db}`, { fetch: adminFetch });
   module.exports.close = db => {
     if (!db || db._destroyed || db._closed) {
       return;
@@ -86,7 +95,7 @@ if (UNIT_TEST_ENV) {
       logger.error('Error when closing db: %o', err);
     }
   };
-  module.exports.users = new PouchDB(`${environment.serverUrl}/_users`, { fetch: fetchFn });
+  module.exports.users = new PouchDB(`${environment.serverUrl}/_users`, { fetch: adminFetch });
   module.exports.users = new PouchDB(`${environment.serverUrl}/_users`);
   module.exports.queryMedic = (viewPath, queryParams, body) => {
     const [ddoc, view] = viewPath.split('/');