RK-20569 - CORS rework for Dynatrace apps

package.json

@@ -1,6 +1,6 @@
 {
   "name": "explorook",
-  "version": "1.16.5",
+  "version": "1.16.6",
   "description": "Rookout's site addon to support local files and folders",
   "main": "dist/index.js",
   "scripts": {

src/cors.ts

@@ -0,0 +1,57 @@
+import * as cors from "cors";
+import fetch from "node-fetch";
+import { getStoreSafe } from "./explorook-store";
+
+
+const LOCALHOST_ORIGIN = "https://localhost:8080";
+const ROOKOUT_ORIGIN_REGEX = /^https:\/\/.*\.rookout(?:-dev)?\.com$/;
+const DYNATRACE_ORIGIN_REGEX = /^https:\/\/.*\.dynatrace(?:labs)?\.com$/;
+
+const ALLOW_CORS_OPTION: cors.CorsOptions = {origin: true};
+const DENY_CORS_OPTION: cors.CorsOptions = {origin: false};
+
+
+const verifiedOriginsCache = new Set([LOCALHOST_ORIGIN]);
+
+const store = getStoreSafe();
+
+const corsOptionsDelegate = async (req: cors.CorsRequest, callback: (err: Error | null, options?: cors.CorsOptions) => void) => {
+    try {
+        const shouldSkipDtVerification = store.get("skipDtVerification", false);
+        const origin = req.headers.origin;
+        if (verifiedOriginsCache.has(origin) || ROOKOUT_ORIGIN_REGEX.test(origin)) {
+            callback(null, ALLOW_CORS_OPTION);
+            return;
+        }
+
+        if (!DYNATRACE_ORIGIN_REGEX.test(origin)) {
+            callback(null, DENY_CORS_OPTION);
+            return;
+        }
+
+
+        if (shouldSkipDtVerification) {
+            callback(null, ALLOW_CORS_OPTION);
+            return;
+        }
+
+
+        const response = await fetch(`${origin}/platform-reserved/dob/isapprefallowed?appOrigin=${origin}`);
+
+        if (!response.ok) {
+            callback(null, DENY_CORS_OPTION);
+            return;
+        }
+
+        verifiedOriginsCache.add(origin);
+        callback(null, ALLOW_CORS_OPTION);
+    } catch (err) {
+        callback(err, DENY_CORS_OPTION);
+    }
+};
+
+
+export const getCorsMiddleware = () => {
+    return cors(corsOptionsDelegate);
+};
+

src/server.ts

@@ -2,13 +2,13 @@ import { makeExecutableSchema } from "@graphql-tools/schema";
 import { ApolloServerPluginLandingPageDisabled } from "apollo-server-core";
 import { ApolloServer } from "apollo-server-express";
 import * as bodyParser from "body-parser";
-import * as cors from "cors";
 import * as express from "express";
 import { readFileSync } from "fs";
 import { applyMiddleware } from "graphql-middleware";
 import * as http from "http";
 import { join } from "path";
 import { resolvers } from "./api";
+import {getCorsMiddleware} from "./cors";
 import { notify } from "./exceptionManager";
 import {
   filterDirTraversal,
@@ -32,17 +32,6 @@ const defaultOptions: StartOptions = {
   port: 44512
 };
 
-const corsDomainWhitelist = [
-  /^https:\/\/.*\.rookout\.com$/,
-  /^https:\/\/.*\.rookout-dev\.com$/,
-  /^https:\/\/.*\.dynatracelabs\.com$/,
-  /^https:\/\/.*\.dynatrace\.com$/,
-  "https://localhost:8080"
-];
-
-const corsOptions = {
-  origin: corsDomainWhitelist
-};
 
 export const start = async (options: StartOptions) => {
   const settings = { ...options, ...defaultOptions };
@@ -71,7 +60,7 @@ export const start = async (options: StartOptions) => {
     cache: "bounded"
   });
 
-  app.use(cors(corsOptions));
+  app.use(getCorsMiddleware());
   app.use(bodyParser.json());
 
   await apolloServer.start();

src/webapp/src/components/Header.js

@@ -25,6 +25,8 @@ export const Header = () => {
 
     const store = new Store({ name: "explorook" });
     const isLogLevelDebug = store.get("logLevel", "debug") === "debug";
+    const shouldSkipDtVerification = store.get("skipDtVerification", false);
+
     const setLogLever = isDebug => {
         ipcRenderer.sendTo(window.indexWorkerId, "set-log-level", isDebug ? "debug" : "error")
         setOpen(false);
@@ -34,6 +36,11 @@ export const Header = () => {
         setOpen(false);
     }
 
+    const toggleShouldSkipDtVerification = () => {
+        store.set('skipDtVerification', !shouldSkipDtVerification);
+        setOpen(false);
+    }
+
     return (
         <div>
             <div id="close-window-wrapper" onContextMenu={onCloseRightClick}>
@@ -43,6 +50,7 @@ export const Header = () => {
                     <MenuItem key="debug" onClick={startDebug}>Debug</MenuItem>
                     <MenuItem key="log-level" onClick={() => setLogLever(!isLogLevelDebug)}>{isLogLevelDebug ? "Error Logs" : "Debug Logs"}</MenuItem>
                     <MenuItem key="remove-all-repos" onClick={clearAllRepos}>Clear data</MenuItem>
+                    <MenuItem key="toggle-skip-verification" onClick={toggleShouldSkipDtVerification}>{shouldSkipDtVerification ? 'Enable' : 'Skip'} Verification {!shouldSkipDtVerification && '(Unsafe)'}</MenuItem>
                     <MenuItem key="close" onClick={() => setOpen(false)}>Close</MenuItem>
                 </Menu>
             </div>