Feature/security (#21)

* Add security management

Author: xclemence

.env

@@ -1 +1,5 @@
 NEO4J_HOST='bolt://localhost'
+DEBUG=@neo4j/graphql:*
+GRAPH_SECURITY_ENABLED=true
+GRAPH_TOKEN_ROLES_PATH=resource_access.graph-graphql.roles
+GRAPH_TOKEN_AUTHORITY=http://localhost:9080/auth/realms/dependencies

README.md

@@ -31,9 +31,13 @@ This image is base on **Linux**.
 
 You can configure container by setting environment variables.
 
-| Environment variable     |          Comment           |   default value     |
+| Environment variable     |          Comment           |   sample value     |
 |------------------------- | :--------------------------|-------------------- |
 | NEO4J_HOST               | Noe4j database uri         | bolt://localhost    |
+| GRAPH_SECURITY_ENABLED   | Enable jwt validation      | bolt://localhost    |
+| GRAPH_TOKEN_ROLES_PATH   | Roles path inside jwt        | resource_access.graph-graphql.roles    |
+| GRAPH_TOKEN_AUTHORITY    | Authority for token validation | http://localhost:9080/auth/realms/dependencies    |
+| DEBUG                    | Activate @neo4j/graphql traces | @neo4j/graphql:*    |
 
 Port exposed by Container:
 

doc/releases/v2.0.0.md

@@ -0,0 +1,8 @@
+### Changes
+- Add security management (token validation)
+- Docker image: ARM architecture support (linux/arm64, linux/arm/v7)
+- Migrating from "neo4j-graphql-js" (deprecated) to "@neo4j/graphql"
+
+Docker image available on:
+- [github](https://github.com/xclemence/dependencies-graph-graphql/packages)
+- [dockerhub](https://hub.docker.com/r/xclemence/dependencies-graph-graphql)

package.json

@@ -1,13 +1,13 @@
 {
   "name": "dependencies-graph-graphql",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "description": "",
-  "main": "index.js",
+  "main": "server.js",
   "scripts": {
     "start": "node dotenv/config 'dist/server.js'",
-    "build": "tsc -p . && ncp src/definitions dist/definitions",
+    "build": "tsc -p . && ncp src/definitions dist/definitions && ncp src/definitions-rights dist/definitions-rights",
     "dev": "nodemon --exec \"yarn ts-node\" src/server.ts -e ts,graphql ",
-    "ts-node": "ts-node"
+    "ts-node": "ts-node "
   },
   "repository": {
     "type": "git",
@@ -24,6 +24,7 @@
     "@types/compression": "^1.7.0",
     "@types/dotenv": "^8.2.0",
     "@types/express": "^4.17.12",
+    "@types/express-jwt": "^6.0.1",
     "@types/graphql-depth-limit": "^1.1.2",
     "@types/lodash": "^4.14.170",
     "@types/node": "^15.12.1",
@@ -40,6 +41,7 @@
     "@neo4j/graphql-ogm": "^1.0.2",
     "apollo-server": "^2.25.0",
     "apollo-server-express": "^2.25.0",
+    "axios": "^0.21.1",
     "compression": "^1.7.4",
     "cors": "^2.8.5",
     "dotenv": "^10.0.0",

src/apollo-server.ts

@@ -0,0 +1,60 @@
+import './env';
+
+import depthLimit from 'graphql-depth-limit';
+import { driver } from 'neo4j-driver';
+import { OGM } from '@neo4j/graphql-ogm';
+
+import { getTypesFiles, getResolvers } from './schema';
+import { Context } from './types/context';
+import { Neo4jGraphQL } from '@neo4j/graphql';
+import { Neo4jGraphQLConfig } from '@neo4j/graphql/dist/classes';
+import { ApolloServer } from 'apollo-server-express';
+
+export function createApolloServerWithToken(
+  neo4jHost: string,
+  tokenValidation: { publicKey: string, rolesPath: string | undefined }
+): ApolloServer {
+
+  return createApolloServerBase(
+    neo4jHost,
+    true,
+    {
+      jwt: {
+        secret: tokenValidation.publicKey,
+        rolesPath: tokenValidation.rolesPath
+      }
+    }
+  );
+}
+
+export function createApolloServerNoToken(neo4jHost: string): ApolloServer {
+  return createApolloServerBase(neo4jHost, false);
+}
+
+
+function createApolloServerBase(
+  neo4jHost: string,
+  enabledSecurity: boolean,
+  config?: Neo4jGraphQLConfig
+): ApolloServer {
+
+  const driverInstance = driver(neo4jHost);
+  const typesFiles = getTypesFiles(enabledSecurity);
+
+  const ogm = new OGM({
+    typeDefs: typesFiles,
+    driver: driverInstance,
+  });
+
+  const neo4jGraphQL = new Neo4jGraphQL({
+    typeDefs: typesFiles,
+    resolvers: getResolvers(),
+    config
+  });
+
+  return new ApolloServer({
+    schema: neo4jGraphQL.schema,
+    validationRules: [depthLimit(10)],
+    context: ({ req }) => ({ req, ogm, driver: driverInstance } as Context)
+  });
+}

src/app-process-env.ts

@@ -3,6 +3,9 @@ declare global {
       interface ProcessEnv {
         NEO4J_HOST: string;
         NODE_ENV: 'development' | 'production';
+        GRAPH_TOKEN_ROLES_PATH: string;
+        GRAPH_SECURITY_ENABLED: string;
+        GRAPH_TOKEN_AUTHORITY: string;
       }
     }
   }

src/definitions-rights/Assembly.graphql

@@ -0,0 +1,3 @@
+type Mutation {
+  removeAssembly(assemblyName: String!): Assembly @auth(rules: [{ operations: [DELETE], roles: ["write"] }])
+}

src/keycloak.ts

@@ -0,0 +1,7 @@
+import axios from 'axios';
+
+export async function getPublicKey(server: string): Promise<string> {
+    const response = await axios.get(server);
+    return `-----BEGIN PUBLIC KEY-----\r\n${response.data.public_key}\r\n-----END PUBLIC KEY-----`;
+}
+

src/resolvers/main-resolver.ts

@@ -2,10 +2,10 @@ const mainResolver = {
   Query: {
     isAlive() {
       return true;
-    },
+    }
   },
   Mutation: {
-    hello: (parent: any, parameters: { name: string }): string => {
+    hello: (_: any, parameters: { name: string }): string => {
       return `Hello ${parameters.name}!`;
     }
   }

src/schema.ts

@@ -1,23 +1,28 @@
 import { loadFilesSync } from '@graphql-tools/load-files';
 import { mergeResolvers } from '@graphql-tools/merge';
 import path from 'path';
-import { Neo4jGraphQL } from '@neo4j/graphql';
 
-export const typesFiles = loadFilesSync(path.join(__dirname, 'definitions/*.graphql'))
+export function getTypesFiles(enabledSecurity: boolean): any[] {
+  let typesFilesPatterns = [
+    path.join(__dirname, 'definitions/*.graphql'),
+  ];
 
-const resolverPatterns = [
-    path.join(__dirname, 'resolvers/*.ts'),
-    path.join(__dirname, 'resolvers/*.js')
-];
-
- const resolversFiles = loadFilesSync(resolverPatterns);
-const resolvers = mergeResolvers(resolversFiles);
+  if (enabledSecurity) {
+    typesFilesPatterns = [
+      ...typesFilesPatterns,
+      path.join(__dirname, 'definitions-rights/*.graphql')
+    ];
+  }
 
-const neo4jGraphQL = new Neo4jGraphQL({
-    typeDefs: typesFiles,
-    resolvers,
-});
+  return loadFilesSync(typesFilesPatterns);
+}
 
-const schema = neo4jGraphQL.schema;
+export function getResolvers(): any {
+  const resolverPatterns = [
+    path.join(__dirname, 'resolvers/*.ts'),
+    path.join(__dirname, 'resolvers/*.js')
+  ];
 
-export default schema;
+  const resolversFiles = loadFilesSync(resolverPatterns);
+  return mergeResolvers(resolversFiles);
+}