Add http logging middleware

Signed-off-by: Felix Hoops <9974641+jfelixh@users.noreply.github.com>

vclogin/middleware.ts

@@ -0,0 +1,25 @@
+/**
+ * Copyright 2024 Software Engineering for Business Information Systems (sebis) <matthes@tum.de> .
+ * SPDX-License-Identifier: MIT
+ */
+
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+
+export function middleware(req: NextRequest) {
+  // enforce authorization for sensitive endpoints needed for dynamic authorization
+  if (req.nextUrl.pathname.startsWith("/api/dynamic")) {
+    const authHeader = req.headers.get("Authorization");
+    const apiKey = authHeader?.split(" ")[1];
+    if (apiKey !== process.env.API_KEY) {
+      return new Response("Unauthorized", { status: 401 });
+    }
+  }
+  // would like to do logging here but because nextjs middleware runs in Edge Runtime
+  // it does not seem to like pino logger
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: "/(api/.*)",
+};

vclogin/pages/api/clientMetadata.ts

@@ -6,11 +6,9 @@
 import { getMetadata } from "@/lib/getMetadata";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { logger } from "@/config/logger";
+import { withLogging } from "@/middleware/logging";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<any>,
-) {
+async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   try {
     const { method } = req;
     if (method === "GET") {
@@ -28,3 +26,4 @@ export default async function handler(
 }
 
 export const config = { api: { bodyParser: false } };
+export default withLogging(handler);

vclogin/pages/api/dynamic/clientMetadataById.ts

@@ -6,11 +6,9 @@
 import { getMetadata } from "@/lib/getMetadata";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { logger } from "@/config/logger";
+import { withLogging } from "@/middleware/logging";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<any>,
-) {
+async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   try {
     const { method } = req;
     if (method === "GET") {
@@ -29,3 +27,4 @@ export default async function handler(
 }
 
 export const config = { api: { bodyParser: false } };
+export default withLogging(handler);

vclogin/pages/api/dynamic/createTempAuthorization.ts

@@ -6,11 +6,9 @@
 import { NextApiRequest, NextApiResponse } from "next";
 import crypto from "crypto";
 import { redisSet } from "@/config/redis";
+import { withLogging } from "@/middleware/logging";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<any>,
-) {
+async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   //Get Policy from request body
   const { policy, inputDescriptor } = req.body;
 
@@ -29,3 +27,5 @@ export default async function handler(
     return res.status(500).json({ redirect: "/error" });
   }
 }
+
+export default withLogging(handler);

vclogin/pages/api/dynamic/getAuthResponse.ts

@@ -6,11 +6,9 @@
 import { NextApiRequest, NextApiResponse } from "next";
 import { logger } from "@/config/logger";
 import { redisGet } from "@/config/redis";
+import { withLogging } from "@/middleware/logging";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<any>,
-) {
+async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   //read uuid from query params
   const uuid = req.query["uuid"];
   logger.debug("uuid: ", uuid);
@@ -29,3 +27,5 @@ export default async function handler(
     res.status(200).json({ auth_res: "error_not_found" });
   }
 }
+
+export default withLogging(handler);

vclogin/pages/api/dynamic/getQRCodeString.ts

@@ -3,12 +3,10 @@
  * SPDX-License-Identifier: MIT
  */
 
+import { withLogging } from "@/middleware/logging";
 import { NextApiRequest, NextApiResponse } from "next";
 
-export default async function handler(
-  req: NextApiRequest,
-  res: NextApiResponse<any>,
-) {
+async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
   const { userId, uuid } = req.body;
 
   //Generate QR Code String from UUID
@@ -24,3 +22,5 @@ export default async function handler(
 
   return res.status(200).json({ qrCodeString });
 }
+
+export default withLogging(handler);

vclogin/pages/api/dynamic/presentCredentialById.ts

@@ -11,6 +11,7 @@ import { verifyAuthenticationPresentation } from "@/lib/verifyPresentation";
 import { getToken } from "@/lib/getToken";
 import { logger } from "@/config/logger";
 import { redisSet, redisGet } from "@/config/redis";
+import { withLogging } from "@/middleware/logging";
 
 const getHandler = async (req: NextApiRequest, res: NextApiResponse) => {
   logger.debug("LOGIN API GET BY ID");
@@ -115,7 +116,7 @@ const handlers: any = {
   GET: getHandler,
 };
 
-export default async function handler(
+async function handler(
   req: NextApiRequest,
   res: NextApiResponse<any>, //todo look for separate handles
 ) {
@@ -129,3 +130,5 @@ export default async function handler(
     res.status(500).end();
   }
 }
+
+export default withLogging(handler);