Add nonce support for triggering services

DSL/Resql/training/POST/use-nonce.sql

@@ -0,0 +1 @@
+update request_nonces set used_at = now() where nonce = :updated_nonce and used_at is null returning nonce;

DSL/Ruuter/services/GET/get-new-nonce.yml

@@ -0,0 +1,19 @@
+declaration:
+  call: declare
+  version: 0.1
+  description: "Description placeholder for 'GET-NEW-NONCE'"
+  method: get
+  accepts: json
+  returns: json
+  namespace: service
+
+get_new_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/get-new-nonce"
+  result: nonce_res
+
+return_result:
+  wrapper: false
+  return: ${nonce_res.response.body[0].nonce}
+  next: end

DSL/Ruuter/services/GET/services/active/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end

DSL/Ruuter/services/GET/services/draft/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end

DSL/Ruuter/services/GET/services/inactive/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end

DSL/Ruuter/services/POST/services/active/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end

DSL/Ruuter/services/POST/services/draft/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end

DSL/Ruuter/services/POST/services/inactive/.guard

@@ -1,4 +1,61 @@
-guard_allow_all:
+process_request:
+  switch:
+    - condition: ${ incoming.headers['x-ruuter-nonce'] != null }
+      next: verify_header_nonce
+    - condition: ${ incoming.params['ruuter-nonce'] != null }
+      next: verify_param_nonce
+    - condition: ${incoming.headers == null || incoming.headers.cookie == null}
+      next: guard_fail  
+  next: authenticate
+
+verify_header_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.headers['x-ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+verify_param_nonce:
+  call: http.post
+  args:
+    url: "[#SERVICE_TRAINING_RESQL]/use-nonce"
+    body:
+      updated_nonce: ${incoming.params['ruuter-nonce']}
+  result: nonce_response
+  next: check_inline
+
+check_inline:
+  inline: extAuth
+  result: extauth
+
+check_nonce:
+  switch:
+    - condition: ${ !extauth || (nonce_response.response.body[0] == null) }
+      next: guard_fail
+  next: guard_success
+
+authenticate:
+  template: "[#SERVICE_PROJECT_LAYER]/check-user-authority"
+  requestType: templates
+  headers:
+    cookie: ${incoming.headers.cookie}
+  result: authority_result
+  next: check_authority_result
+
+check_authority_result:
+  switch:
+    - condition: ${authority_result !== "false"}
+      next: guard_success
+  next: guard_fail
+
+guard_success:
   return: "success"
   status: 200
   next: end
+
+guard_fail:
+  return: "unauthorized"
+  status: 401
+  next: end