-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathfrontier-prod.xml
7542 lines (6370 loc) · 241 KB
/
frontier-prod.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="UTF8"?>
<Export generator="Cache" version="25">
<Class name="Frontier.AbstractSerializer">
<Description>
This class holds the default implementation used to handle device redirection.
You should not use this class but instead its specializations.</Description>
<Abstract>1</Abstract>
<IncludeCode>frontier,%ZEN.Utils</IncludeCode>
<TimeCreated>64553,37866.500056</TimeCreated>
<Method name="SerializeToStream">
<ClassMethod>1</ClassMethod>
<FormalSpec>*str:%Stream.Object="",arguments...</FormalSpec>
<ProcedureBlock>0</ProcedureBlock>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
new oldMnemonic, alreadyRedirected, sc
set sc = $$$OK
set isRedirected = 0
set str = ##class(%Stream.TmpBinary).%New()
set alreadyRedirected = ##class(%Device).ReDirectIO()
set oldMnemonic = "^"_##class(%Device).GetMnemonicRoutine()
set initIO = $io
try {
use $io::("^"_$zname)
do ##class(%Device).ReDirectIO(1)
set isRedirected = 1
set sc = ..Serialize(arguments...)
do str.Rewind()
} catch ex {
set str = ""
set sc = ex.AsStatus()
}
if oldMnemonic '= "" {
use initIO::(oldMnemonic)
} else {
use oldMnemonic
}
do ##class(%Device).ReDirectIO(alreadyRedirected)
return sc
wstr(s) Do str.Write(s) Quit
wchr(a) Do str.Write($char(a)) Quit
wnl Do str.Write($char(13,10)) Quit
wff Do str.Write($char(13,10,13,10)) Quit
wtab(n) Do str.Write($c(9)) Quit
rstr(len,time) Quit ""
rchr(time) Quit ""
]]></Implementation>
</Method>
<Method name="SetIndentation">
<ClassMethod>1</ClassMethod>
<FormalSpec>by:%Integer=0</FormalSpec>
<Implementation><![CDATA[
if by <= 0 quit
for i=1:1:by write " "
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.ArgumentDescription">
<Description>
This holds the metadata used to resolve each argument from the classmethod to be called which generates an response.</Description>
<Super>%RegisteredObject</Super>
<TimeCreated>64492,37806.502663</TimeCreated>
<Property name="Name">
<Type>%String</Type>
</Property>
<Property name="Alias">
<Type>%String</Type>
</Property>
<Property name="DefaultValue">
<Type>%String</Type>
</Property>
<Property name="HasDefaultValue">
<Type>%Boolean</Type>
<InitialExpression>0</InitialExpression>
</Property>
<Property name="Type">
<Type>%String</Type>
</Property>
<Property name="Arity">
<Type>%Boolean</Type>
<InitialExpression>0</InitialExpression>
</Property>
<Property name="Parameters">
<Type>%String</Type>
<Collection>array</Collection>
</Property>
<Property name="Index">
<Type>%Integer</Type>
<Required>1</Required>
</Property>
</Class>
<Class name="Frontier.Authentication.BasicStrategy">
<Description>
This strategy provides the implementation for handling clients requests whose authentication
follows the format: Authorization: Basic b64(user:password). This class can be used to demonstrate
how a strategy can be implemented and even augmented. This strategy works as the following:
* If the user doesn't provide an Authorization header, we assume that the client isn't using the Basic
specification and let the request be handle by the next strategy.
* If the user provided an Authorization header, but the value doesn't start with 'Basic', we consider
it as malformed and reply it back to the client as an error.
* If the client didn't provided any authentication, we challenge it using the implemented GetChallenge.</Description>
<IncludeCode>%occErrors,%occStatus,frontier</IncludeCode>
<Super>Frontier.Authentication.Strategy</Super>
<TimeCreated>64553,59181.195484</TimeCreated>
<Property name="Name">
<Description>
This is the name the of the strategy. Can be used to determine that this strategy should be used for a Route exclusively.</Description>
<Type>%String</Type>
<InitialExpression>"Basic"</InitialExpression>
</Property>
<Property name="Realm">
<Description><![CDATA[
This is used by the challenge. Represents the "realm=<value>" from the WWW-Authenticate challenge header.]]></Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="Validator">
<Description>
A string whose format should be classname:classmethod, which is used to validate the value from the Authorization header.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Method name="%OnNew">
<FormalSpec>config:%DynamicObject</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Realm = config.realm
set ..Validator = config.validator
if config.%IsDefined("name") set ..Name = config.name
return $$$OK
]]></Implementation>
</Method>
<Method name="Verify">
<Description>
Searches for the Authorization header, skips if nothing is found. Otherwise validates the header and the credentials themselves.</Description>
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,*user:%DynamicObject={{}},resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set sc = $$$OK
set found = 0
set httpStatus = ""
set authHeader = request.GetCgiEnv("HTTP_AUTHORIZATION")
set authType = $$$trim($$$ucase($piece(authHeader, " ", 1)))
if authHeader = "" {
// Let the manager call the next strategy, if that's the last one than the error is
// fired by the router class.
return $$$OK
} elseif authType = "BASIC" {
set credentials = $System.Encryption.Base64Decode($$$trim($piece(authHeader, " ", 2)))
set userName = $piece(credentials, ":")
set password = $piece(credentials, ":", 2)
set sc = ##class(Frontier.Shared.Utilities).SafeClassMethodCall(..Validator, userName, password, .found, .httpStatus, .user)
set ..Verified = found
if $$$ISERR(sc) {
if httpStatus '= "" set response.Status = httpStatus
else set response.Status = "500 Internal Server Error"
}
}
if $$$ISOK(sc) && (found = 0) {
set sc = $$$ERROR($$$InvalidUsernameOrPassword)
set response.Status = "403 Forbidden"
}
return sc
]]></Implementation>
</Method>
<Method name="GetChallenge">
<Description>
Returns a string that is used to populate the WWW-Authenticate.</Description>
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,challenge:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set challenge = "Basic realm="""_..Realm_""""
return $$$OK
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.Authentication.BearerStrategy">
<Description><![CDATA[
This strategy provides the implementation for handling clients requests whose authentication
follows the format: Authorization: Bearer <bearer_token>. There's not much difference with
the Basic version, only that it won't decode the token since a Bearer token is implementation specific.
Which means that the implementer must use the method specified in the 'validator' to decode and validate it.]]></Description>
<IncludeCode>%occErrors,%occStatus,frontier</IncludeCode>
<Super>Frontier.Authentication.Strategy</Super>
<TimeCreated>64553,59181.195484</TimeCreated>
<Property name="Name">
<Description>
This is the name the of the strategy. Can be used to determine that this strategy should be used for a Route exclusively.</Description>
<Type>%String</Type>
<InitialExpression>"Bearer"</InitialExpression>
</Property>
<Property name="Realm">
<Description><![CDATA[
This is used by the challenge. Represents the "realm=<value>" from the WWW-Authenticate challenge header.]]></Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="Validator">
<Description>
A string whose format should be classname:classmethod, which is used to validate the value from the Authorization header.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="ChallengeScope">
<Type>%String</Type>
<Private>1</Private>
</Property>
<Method name="%OnNew">
<FormalSpec>config:%DynamicObject</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Realm = config.realm
set ..Validator = config.validator
if config.%IsDefined("name") set ..Name = config.name
return $$$OK
]]></Implementation>
</Method>
<Method name="Verify">
<Description>
Searches for the Authorization header, skips if nothing is found. Otherwise validates the header and the credentials themselves.</Description>
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,*user:%DynamicObject={{}},resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set sc = $$$OK
set found = 0
set httpStatus = ""
set authHeader = request.GetCgiEnv("HTTP_AUTHORIZATION")
set authType = $$$trim($$$ucase($piece(authHeader, " ", 1)))
if authHeader = "" {
// Let the manager call the next strategy, if that's the last one, then the error is
// fired by the router class.
return $$$OK
} else {
set token = $$$trim($extract(authHeader, 7, *))
set sc = ##class(Frontier.Shared.Utilities).SafeClassMethodCall(..Validator, token, .found, .httpStatus, .user)
if 'found set ..ChallengeScope = $replace(resourceScope, ",", " ")
set ..Verified = found
if $$$ISERR(sc) {
if httpStatus '= "" set response.Status = httpStatus
else set response.Status = "500 Internal Server Error"
}
}
if $$$ISOK(sc) && (found = 0) {
set sc = $$$ERROR($$$InvalidUsernameOrPassword)
set response.Status = "403 Forbidden"
}
return sc
]]></Implementation>
</Method>
<Method name="GetChallenge">
<Description>
Returns a string that is used to populate the WWW-Authenticate.</Description>
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,challenge:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set challenge = "Basic realm="""_..Realm_""""
if ..ChallengeScope '= "" set challenge = challenge_" scope="_..ChallengeScope
return $$$OK
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.Authentication.CookieStrategy">
<Description>
This strategy can be used to validate tokens generated by the utility class
Frontier.Security.CookieSignature. When configuring this strategy, you just need
to provide the same secret used when signing the token.</Description>
<Super>Frontier.Authentication.Strategy</Super>
<TimeCreated>65029,52410.489996</TimeCreated>
<Property name="Name">
<Description>
The name of the strategy.</Description>
<Type>%String</Type>
<InitialExpression>"Cookie"</InitialExpression>
</Property>
<Property name="Key">
<Description>
The cookie key to search for.</Description>
<Type>%String</Type>
<InitialExpression>"__fc"</InitialExpression>
</Property>
<Property name="Secret">
<Description>
The same secret used to create the signed token.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="Validator">
<Description>
A classmethod that is used to validate the token AFTER it was unsigned.
This method is only called when the token has a valid signature.</Description>
<Type>%String</Type>
</Property>
<Property name="Path">
<Description>
The path used to find to which location the cookie should be applied.</Description>
<Type>%String</Type>
<InitialExpression>"/"</InitialExpression>
</Property>
<Method name="%OnNew">
<FormalSpec>config:%DynamicObject</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Secret = config.secret
if config.%IsDefined("name") set ..Name = config.name
if config.%IsDefined("key") set ..Key = config.key
if config.%IsDefined("validator") set ..Validator = config.validator
if config.%IsDefined("path") set ..Path = config.path
return $$$OK
]]></Implementation>
</Method>
<Method name="Verify">
<Description>
Validates if the request contains the cookie, skips the check if the cookie is not present.
Otherwise attempts to unsign the token to obtain the value and pass it down to the Validator method.</Description>
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,*user:%DynamicObject={{}},resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set failed = 0
#define ExpireCookie do response.SetCookie(..Key,"",$zdt("0,0", 2)_" GMT", ..Path)
#define AssertPropertyDefined(%jp,%ip) if $p($this, %ip) = "" $$$ExpireCookie return $$$ERROR($$$GeneralError, $$$FormatText("Strategy '%1' requires '%1' property to be specified.", ..Name, %jp))
$$$AssertPropertyDefined("validator", "Validator")
$$$AssertPropertyDefined("key", "Key")
$$$AssertPropertyDefined("secret", "Secret")
if 'request.IsDefinedCookie(..Key) return $$$OK
set token = request.GetCookie(..Key)
set payload = ##class(Frontier.Security.CookieSignature).Unsign(token, ..Secret)
if payload = "" {
$$$ExpireCookie
set response.Status = "401 Forbidden"
return $$$ERROR($$$InvalidUsernameOrPassword)
}
set found = 0
set httpStatus = "200 OK"
set sc = ##class(Frontier.Shared.Utilities).SafeClassMethodCall(..Validator, payload, .found, .httpStatus, .user)
if found = 1 {
set ..Verified = 1
} else {
if httpStatus '= "" set response.Status = httpStatus
else set httpStatus = "401 Forbidden"
}
$$$QuitOnError(sc)
return $$$OK
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.Authentication.Manager">
<Description>
The Authentication Manager is responsible for running the verification
from each provided strategy. When implementing a strategy you must follow
the specification provided by the Frontier.Authentication.Strategy.</Description>
<Super>%RegisteredObject</Super>
<TimeCreated>64553,52230.315441</TimeCreated>
<Property name="Strategies">
<Description>
A list of strategies added that will be executed.</Description>
<Type>Frontier.Authentication.Strategy</Type>
<Collection>list</Collection>
<Private>1</Private>
</Property>
<Property name="Session">
<Description>
A reference for the %session object.</Description>
<Type>%CSP.Session</Type>
<Private>1</Private>
</Property>
<Property name="Request">
<Description>
A reference for the %request object.</Description>
<Type>%CSP.Request</Type>
<Private>1</Private>
</Property>
<Property name="Response">
<Description>
A reference for the %response object.</Description>
<Type>%CSP.Response</Type>
<Private>1</Private>
</Property>
<Property name="ScopeSeparator">
<Description>
If the authenticated user have more than one scope, you can define how each scope must be splitted before the check.</Description>
<Type>%String</Type>
<InitialExpression>" "</InitialExpression>
</Property>
<Property name="Verified">
<Description>
This is an internal flag that signals the routing engine that the client can access the protected resource.
This flag should NOT be set manually.</Description>
<Type>%Boolean</Type>
<Internal>1</Internal>
<InitialExpression>0</InitialExpression>
</Property>
<Method name="%OnNew">
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Session = session
set ..Request = request
set ..Response = response
return $$$OK
]]></Implementation>
</Method>
<Method name="ScopeSeparatorSet">
<Final>1</Final>
<Internal>1</Internal>
<FormalSpec>value:%String</FormalSpec>
<Private>1</Private>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[ set i%ScopeSeparator = $get(value, ",")
]]></Implementation>
</Method>
<Method name="AddStrategy">
<Description>
Adds a strategy to the chain. Added strategies will be used to validade against the client's request data.</Description>
<FormalSpec>strategy:Frontier.Authentication.Strategy</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Verified = 0
$$$QuitOnError(..Strategies.Insert(strategy))
return $$$OK
]]></Implementation>
</Method>
<Method name="Reset">
<Description>
Resets the manager into the initial state. If you have a router with an authentication
already configured and a child router that must provide a new authentication chain, you must
call this method before populating the new chain.</Description>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Verified = 0
return ..Strategies.Clear()
]]></Implementation>
</Method>
<Method name="Verify">
<Description>
This method will run each strategy to check if the client comply to any of their requirements.
The Verified flag will be set to 1 if there's any. Otherwise an error will be thrown informing that the client is not authenticated.
If a strategy implements the method GetChallenge, this method will be called if the client didn't provided any credentials that match any strategies in the chain.
Note that the GetChallenge will be executed only if the current strategy is the last one.</Description>
<FormalSpec>*user:%DynamicObject={{}},resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set sc = $$$OK
set totalStrategies = ..Strategies.Count()
set strategy = ""
try {
for i=1:1:totalStrategies {
set strategy = ..Strategies.GetAt(i)
if 'strategy.%Extends("Frontier.Authentication.Strategy") continue
set sc = strategy.Verify(..Session, ..Request, ..Response, .user, resourceScope)
if $$$ISERR(sc) return sc
set ..Verified = strategy.Verified
if ..Verified = 1 {
return $$$OK
} elseif i < totalStrategies {
continue
} elseif $$$ISOK(sc) {
do ..SetChallenge(strategy)
}
}
} catch ex {
set sc = ex.AsStatus()
}
return sc
]]></Implementation>
</Method>
<Method name="VerifyUsing">
<Description>
If the Route contains an AuthStrategy property, the named strategy provided there will be the only one called.
In this case the client must always comply with that strategy.</Description>
<FormalSpec>namedStrategy:%String,*user,resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Verified = 0
set sc = $$$OK
set found = 0
for i=1:1:..Strategies.Count() {
set strategy = ..Strategies.GetAt(i)
if strategy.Name = namedStrategy {
set found = 1
try {
set sc = strategy.Verify(..Session, ..Request, ..Response, .user, resourceScope)
if $$$ISERR(sc) return sc
set ..Verified = strategy.Verified
if ..Verified = 1 {
return $$$OK
} elseif $$$ISOK(sc) {
do ..SetChallenge(strategy)
return sc
}
} catch ex {
set sc = ex.AsStatus()
}
}
}
if 'found {
return $$$ERROR($$$GeneralError, $$$FormatText("Strategy '%1' was not defined.", namedStrategy))
}
return sc
]]></Implementation>
</Method>
<Method name="CheckResourceScope">
<Description>
This is an internal method used by the routing engine to check if any of the user's scope complies to the one provided
in the Route element's Scope property.</Description>
<Internal>1</Internal>
<FormalSpec>resourceScope:%String="",authenticationScope:%DynamicObject={{}}</FormalSpec>
<ReturnType>%Boolean</ReturnType>
<Implementation><![CDATA[
if resourceScope [ " " {
set resourceScope = $lfs(resourceScope, " ")
set isMatch = 0
for i=1:1:$ll(resourceScope) {
set oneScope = $zstrip($lg(resourceScope, i), "<>W")
set modifier = $extract(oneScope, 1)
if $extract(modifier)?1AN = 1 set modifier = "+"
if modifier = "-" set mustMatch = 0
else set mustMatch = 1
set oneScope = $translate(oneScope, "+-", "")
set isMatch = ..CheckResourceScope(oneScope, authenticationScope)
if mustMatch && 'isMatch { return 0 }
elseif 'mustMatch && isMatch { return 0 }
}
return 1
}
if resourceScope '= "" return $lf($lfs(authenticationScope, ..ScopeSeparator), resourceScope) > 0
return 1
]]></Implementation>
</Method>
<Method name="SetChallenge">
<Description>
An internal method that will be used to set the client challenge.</Description>
<FormalSpec>strategy:Frontier.Authentication.Strategy</FormalSpec>
<Private>1</Private>
<Implementation><![CDATA[
set sc = strategy.GetChallenge(..Session, ..Request, ..Response, .challenge)
if challenge '= "" do ..Response.SetHeader("WWW-Authenticate", challenge)
$$$ThrowOnError(sc)
]]></Implementation>
</Method>
<Method name="HasStrategies">
<Description>
Returns if there's any strategies added.</Description>
<ReturnType>%Boolean</ReturnType>
<Implementation><![CDATA[ return ..Strategies.Count() > 0
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.Authentication.Strategy">
<Description>
This class is the backbone required to implement an strategy.
The implementation must follow the specification below:
****
1 - The new strategy must inherit from this class.
****
2 - The method %OnNew must receive a %DynamicObject to populate the new strategy's properties.
/****
3 - The Verify method must be used to validate both: the strategy configuration and the request.
****
4 - The strategy must always check if the client provided sufficient data
to run the validation, if it didn't, the strategy MUST return $$$OK. This will
make the manager skips to the next strategy in the chain.
****
5 - If the user provided enough data and the validation succeeded, then the strategy
must set the Verified flag to 1. This will make the manager bail out without running
the remaining strategies, thus allowing the client to access the protected resource.
****
6 - If the user provided enough data but the validation failed, the strategy must return
an $$$ERROR. This will also make the manager bail out the strategy chain but the error emitted by
the current strategy will be display. Additionally, the strategies can also provide a challenge
by implementing the method GetChallenge and/or set an adequate HTTP Status Code, by using the response.Status property.</Description>
<Super>%RegisteredObject</Super>
<TimeCreated>64553,51285.209032</TimeCreated>
<Property name="Realm">
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="Name">
<Type>%String</Type>
</Property>
<Property name="Verified">
<Type>%Boolean</Type>
<InitialExpression>0</InitialExpression>
</Property>
<Method name="%OnNew">
<FormalSpec>config:%DynamicObject={{}}</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
$$$ThrowStatus($$$ERROR($$$MethodNotImplemented, "%OnNew"))
return $$$OK
]]></Implementation>
</Method>
<Method name="Verify">
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,*user:%DynamicObject={{}},resourceScope:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[ return $$$OK
]]></Implementation>
</Method>
<Method name="GetChallenge">
<FormalSpec>session:%CSP.Session,request:%CSP.Request,response:%CSP.Response,challenge:%String=""</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[ return $$$OK
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.CORS">
<Description>
The Frontier CORS API
Use this API to define a set of CORS rules that allow or deny access to the
protected resource if the origin is extraneous.</Description>
<IncludeCode>frontier</IncludeCode>
<Super>%RegisteredObject</Super>
<TimeCreated>64862,59420.301475</TimeCreated>
<Property name="Context">
<Description>
The %frontier context.</Description>
<Type>Frontier.Context</Type>
<Private>1</Private>
</Property>
<Property name="VaryHeaders">
<Description>
The header names to be added in the Vary header.</Description>
<Private>1</Private>
</Property>
<Property name="AllowedOrigin">
<Description>
A single origin resolved from the incoming request and list of allowed origins.
If this is empty, then the request will fail.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="AllowedMethods">
<Description>
If the request is made using a HTTP method that is not in this list, the request will fail.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="AllowedCredentials">
<Description>
If this value is not set to true and the request contains Authorization, the request will fail.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="AllowedHeaders">
<Description>
Any headers that aren't in this list will make the request fail.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="AllowedAge">
<Description>
How long the preflight request can be cached.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="ExposedHeaders">
<Description>
What the response can expose.</Description>
<Type>%String</Type>
<Private>1</Private>
</Property>
<Property name="OriginVerifier">
<Description>
A string containing the class:method which is used to filter which origins should be allowed.</Description>
<Type>%String</Type>
<InitialExpression>"Frontier.CORS:IsOriginAllowed"</InitialExpression>
</Property>
<Method name="%OnNew">
<FormalSpec>context:Frontier.Context</FormalSpec>
<ReturnType>%Status</ReturnType>
<Implementation><![CDATA[
set ..Context = context
return $$$OK
]]></Implementation>
</Method>
<Method name="IsActive">
<ReturnType>%Boolean</ReturnType>
<Implementation><![CDATA[
if i%VaryHeaders '= "" return 1
if i%AllowedOrigin '= "" return 1
if i%AllowedMethods '= "" return 1
if i%AllowedCredentials '= "" return 1
if i%AllowedHeaders '= "" return 1
if i%AllowedAge '= "" return 1
if i%ExposedHeaders '= "" return 1
return 0
]]></Implementation>
</Method>
<Method name="AllowOrigin">
<Description>
Defines a set of origins allowed to access this protected resource.
If more than one is provided, then it will use the classmethod from OriginVerifier to validated each entry against the request origin.
If no origin is provided, then it will match against the request origin making it unrestricted.
If only one origin is provided, than the request origin will be matched against it and fail the request if it differs.</Description>
<FormalSpec>origins...:%String</FormalSpec>
<Implementation><![CDATA[
if '$data(origins) set origins = 0
if origins = 0 {
set ..AllowedOrigin = ..Context.Request.GetCgiEnv("HTTP_ORIGIN")
} elseif origins = 1 {
set ..AllowedOrigin = origins(1)
} elseif origins > 2 {
for i=1:1:origins {
if ..TestOrigin(origins(i)) {
set ..AllowedOrigin = origins(i) quit
}
}
}
]]></Implementation>
</Method>
<Method name="AllowMethods">
<Description>
Specify which HTTP methods the request can use when accessing this protected resource.
Each method will be used against the request's method. If none match, the request will fail.</Description>
<FormalSpec>methods...:%String</FormalSpec>
<Implementation><![CDATA[
if '$data(methods) set methods = 0
set ..AllowedMethods = ..makeList(methods...)
]]></Implementation>
</Method>
<Method name="AllowHeaders">
<Description>
Specify a list of headers that the request can be sent with, any header sent that is not present in this list
will cause the request to fail.</Description>
<FormalSpec>headers...:%String</FormalSpec>
<Implementation><![CDATA[
if '$data(headers) set headers = 0
set ..AllowedHeaders = ..makeList(headers...)
]]></Implementation>
</Method>
<Method name="AllowCredentials">
<Description>
Specify if the request include credential related headers. Otherwise the request will fail.</Description>
<FormalSpec>enabled:%Boolean=0</FormalSpec>
<Implementation><![CDATA[ set ..AllowedCredentials = $$$FormatBoolean(enabled)
]]></Implementation>
</Method>
<Method name="ExposeHeaders">
<Description>
Specify a list of response headers that the client can read.</Description>
<FormalSpec>headers...:%String</FormalSpec>
<Implementation><![CDATA[
if '$data(headers) set headers = 0
set ..ExposedHeaders = ..makeList(headers)
]]></Implementation>
</Method>
<Method name="makeList">
<FormalSpec>args...:%String</FormalSpec>
<ReturnType>%List</ReturnType>
<Implementation><![CDATA[
set list = ""
for i=1:1:args {
set $list(list, *+1) = args(i)
}
return $lts(list, ", ")
]]></Implementation>
</Method>
<Method name="Default">
<Description>
Provides full resouce access to the specified origins otherwise assume any origin can access it.</Description>
<FormalSpec>origins...:%String</FormalSpec>
<Implementation><![CDATA[
do ..AllowOrigin(origins...)
do ..AllowCredentials(1)
do ..AllowMethods("GET", "POST", "PUT", "DELETE", "HEAD")
do ..AllowHeaders("Authorization", "Content-Type")
do ..AllowCredentials(1)
]]></Implementation>
</Method>
<Method name="Vary">
<Description>
Sets the list of Vary headers.</Description>
<FormalSpec>varyHeaders...:%String</FormalSpec>
<Implementation><![CDATA[
if '$data(varyHeaders) set varyHeaders = 0
do ..Context.Response.SetHeader("Vary", ..makeList(varyHeaders...))
]]></Implementation>
</Method>
<Method name="CheckPreflight">
<Internal>1</Internal>
<Implementation><![CDATA[
if '..IsActive() quit
do ..SetHeaderIfProvided("Vary", "Origin")
do ..SetHeaderIfProvided("Vary", "Access-Control-Request-Headers")
do ..SetHeaderIfProvided("Access-Control-Allow-Origin", ..AllowedOrigin)
do ..SetHeaderIfProvided("Access-Control-Allow-Methods", ..AllowedMethods)
do ..SetHeaderIfProvided("Access-Control-Allow-Headers", ..AllowedHeaders)
do ..SetHeaderIfProvided("Access-Control-Allow-Credentials", ..AllowedCredentials)
do ..SetHeaderIfProvided("Access-Control-Expose-Headers", ..ExposedHeaders)
do ..SetHeaderIfProvided("Access-Control-Max-Age", ..AllowedAge)
do ..Context.Response.DeleteHeader("Content-Type")
set ..Context.Response.ContentLength = 0
set ..Context.Response.ContentType = ""
]]></Implementation>
</Method>
<Method name="Set">
<Internal>1</Internal>
<Implementation><![CDATA[
if '..IsActive() quit
do ..SetHeaderIfProvided("Vary", "Origin")
do ..SetHeaderIfProvided("Access-Control-Allow-Origin", ..AllowedOrigin)
do ..SetHeaderIfProvided("Access-Control-Allow-Credentials", ..AllowedCredentials)
]]></Implementation>
</Method>
<Method name="Unset">
<Description>
Use this method to undo CORS configuration. Can be used if you need to ovewrite
the parent router with a children configuration.</Description>
<Implementation><![CDATA[
do ..Context.Response.DeleteHeader("Vary")
do ..Context.Response.DeleteHeader("Access-Control-Allow-Origin")
do ..Context.Response.DeleteHeader("Access-Control-Allow-Methods")
do ..Context.Response.DeleteHeader("Access-Control-Allow-Headers")
do ..Context.Response.DeleteHeader("Access-Control-Allow-Credentials")
]]></Implementation>
</Method>
<Method name="SetHeaderIfProvided">
<FormalSpec>header:%String,value:%String</FormalSpec>
<Private>1</Private>
<Implementation><![CDATA[ if value '= "" do ..Context.Response.SetHeader(header, value)
]]></Implementation>
</Method>
<Method name="IsOriginAllowed">
<FormalSpec>allowedOrigin:%String,requestUrl:%String</FormalSpec>
<Private>1</Private>
<ReturnType>%Boolean</ReturnType>
<Implementation><![CDATA[ return allowedOrigin = requestUrl
]]></Implementation>
</Method>
<Method name="TestOrigin">
<FormalSpec>origin:%String</FormalSpec>
<Private>1</Private>
<ReturnType>%Boolean</ReturnType>
<Implementation><![CDATA[
set isAllowed = 0
set className = $piece(..OriginVerifier, ":")
set methodName = $piece(..OriginVerifier, ":", 2)
try {
set isAllowed = $classmethod(className, methodName, origin, ..Context.Request.URL)
} catch ex { }
return isAllowed
]]></Implementation>
</Method>
</Class>
<Class name="Frontier.Context">
<Description>
When instantiated, this class provides a set of features that can be used
to configure how Frontier behaves when handling the requests. Usually represented
by the public %frontier variable, which is always available inside a router class.</Description>
<IncludeCode>%occErrors,%occStatus</IncludeCode>
<Super>%RegisteredObject</Super>
<TimeCreated>64502,31617.993909</TimeCreated>
<Parameter name="VERSION">
<Default>5.1.2</Default>
</Parameter>
<Property name="Session">
<Description>
This holds the reference for the %session object.</Description>
<Type>%CSP.Session</Type>
<Private>1</Private>
</Property>
<Property name="Request">
<Description>
This holds the reference for the %request object.</Description>
<Type>%CSP.Request</Type>
</Property>