travelling

v2.5.2

Published

3 years ago

A dynamic route level groups permissions middleman service

Downloads

0High
0Medium
0Low

phara0h

dynamic route permissions rest groups gateway api

A blazing fast dynamic route level groups/permissions api gateway.

REST Docs

Install

Minimum New Setup

Download the latest release or run git clone https://github.com/phara0h/travelling.git
Inside the root Travelling folder run: npm install
Set the TRAVELLING_DATABASE_URL environment variable which needs to be pointing to a new PostgreSQL database to start. Do this by creating a .env file inside the root Travelling folder. For example:
```
TRAVELLING_DATABASE_URL=postgres://postgres@localhost/travelling
```

Set the salts and secrets for the following:

## Cookie Session Settings
TRAVELLING_COOKIE_SESSION_SECRET=Yzy)8EbJOUJf+~e^%#7-lo1)RJUs.UVPBu4d3qqd0ZDQ!A~ti%Sq<kPy)nfVSn0;TRBeD0_QeMxKzp]Yn{hQe4j#ZtQ{L$0O>+hBJl^-%TKX<S>u|~xz;hFS(DO32tw#

## Cookie Token Settings
TRAVELLING_COOKIE_TOKEN_SECRET=qVsI_O|Y0VPz>xvW-Uu!&5lejE3M4w-l0KvCI!v4q|9|F0W+v9g-hb!*yX8*3O%Ty@4$~:@1!VX*?Sl&c}KW&a4..gceGHg)KoiVpc9-8bCnrmG&&}iI;7VY+-+&U(?:
TRAVELLING_COOKIE_TOKEN_SALT=?)WJ.$!570)5[@bDNip!q.t1J#/B.fJ{cyC--Zd/IJwJ/~L+(&#XOz|FuIoc{k;@8wf#gOrn||Ng1+2bDxOuQ6$_6QK{aWUfc-PZ{L62(0JRKizR~Y*/K8YT]?gLHB+S

## Postgres Crypto Settings
TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SECRET=:Y@K$;nE8r~D]dR-#%<PyI]/]^v&#lIz7T(OHrI@sAA_Y/+C%bYVfoY5(r#3IN6tC_fn9vpy%CKXh?K0k:<M/[PXs*r2CO~:]!2qBmB,9}RW)8i$$P#uFt_>u,v_M9K}
TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SALT=Wdwrmww~NxDAFn2/@~1SfV6&Iq7/PR;]k2Me*gK*(|I!sxcr/V,_0Bbys25dIF!sm,}XG)%U!(9|3gS4Hy1Hjo}D.WsF{!6|+x,t{O6T^S):kuglmBokNNqQeHL^bWk%

These are example secrets and salts DO NOT USE THESE VALUES generate your own. You can use the included script via ./scripts/generateRandom.sh to generate a 128 character random string to use for salts and secrets. See Security for more details on keeping Travelling secure.

See Configuration for all other configurable options.

Security

It is recommended to follow this security tips to help keep Travelling as secure as possible.

Use HTTPS
Use a key and cert signed by a known third party ssl vender. (Make sure chrome supports them)
Don't use Cors unless you really have to.
Request logs are helpful for tracking down malicious requests
Run Travelling behind DDOS protection. For example Cloudflare.
Rotate cookie session/token secrets and salts often. (Once a month is a good recommendation)
Set username passwords and username's to OWSAP current recommendations.
Keep OAuth2 Code Tokens short lived for maximum security.
Use strong secret's and salts for Postgres encryption. KEEP THESE SAFE.
Email authentication helps prevent invalid users and makes it harder for bots to generate accounts.

Configuration

Configuration is done through environment variables. All variables have a default values except for what is stated in Minimum New Setup

Basic

TRAVELLING_PORT

Travelling's serving port.

Default: 443

TRAVELLING_IP

Travelling's serving IP.

Default: 0.0.0.0

TRAVELLING_KEY

The path to the SSL key that is used for https

Default: travelling/localhost.key

TRAVELLING_CERT

The path to the SSL cert that is used for https

Default: travelling/localhost.csr

TRAVELLING_HTTPS

Enables https serving.

Default: travelling/localhost.csr

TRAVELLING_SERVICE_NAME

Changes the service's urls and other functionality around it's name.

Default: travelling

Misc

TRAVELLING_MISC_CLOUDFLAREIP

If cloudflare sits infront of Travelling set this to true, so users have their real IP assigned to them.

Default: false

Cors

Recommended to keep this disabled due to security reasons. Only enable this if you really need it and know the risks.

TRAVELLING_CORS_ENABLE

Allows external services to make api calls to Travelling.

Default: false

TRAVELLING_CORS_HEADER_ORIGIN

_Full host path or wildstar _ host pathed subdomains to allow. This is returned back with all requests.*

Default: Rewrites the origin to whatever external host is making the call. This allows all external calls allowed and is not recommended. > Example: *.domain.com

TRAVELLING_CORS_HEADER_METHODS

access-control-allow-methods header that is returned back with all requests.

Default: Rewrites it's self to the access-control-request-method header request or sets to * if there is no request. > Example: GET,DELETE

TRAVELLING_CORS_HEADER_CREDENTIALS

access-control-allow-credentials header that is returned back with all routes under /travelling/api/v1/auth/

Default: true

TRAVELLING_CORS_HEADER_MAX_AGE

access-control-max-age header that is returned back with all CORS options request.

Default: 3600

Logging

For maximum performance it is recommended to disable TRAVELLING_LOG_FASTIFY_LOGGER_REQUEST and TRAVELLING_LOG_FASTIFY_LOGGER

TRAVELLING_LOG_ENABLE

Enables TRAVELLING_LOG_LOGGER.

Default: true

TRAVELLING_LOG_LOGGER

An absolute file path to a custom node.js logger. This must not be set for the settings TRAVELLING_LOG_LEVEL & TRAVELLING_LOG_COLORS to function. It also needs to support the same interface as Node's built in console logger.

Default: travelling/include/utils/logger.js

TRAVELLING_LOG_COLORS

Enables console colors to be used with TRAVELLING_LOG_LOGGER.

Default: true

TRAVELLING_LOG_LEVEL

Sets the log level for TRAVELLING_LOG_LOGGER. The options are trace,debug,info,warn,error,fatal.

Default: info

TRAVELLING_LOG_REQUESTS

Enables logging of every request of all requests with TRAVELLING_LOG_LOGGER.

Default: true

TRAVELLING_LOG_UNAUTHORIZED_ACCESS

Enables logging of every unauthorized access requests made with TRAVELLING_LOG_LOGGER.

Default: true

Fastify Logger

TRAVELLING_LOG_FASTIFY_LOGGER

Enables logging for fastify's built-in pino logger. This can be set to a true/false value or a absolute path of a javascript file to set pino's settings / implement a custom logger from the pino interface.

Default: false > Example: js file setting pino settings.

module.exports = {
  level: 'info'
};

TRAVELLING_LOG_FASTIFY_LOGGER_REQUEST

Enables logging of every request and response in pino's format. Recommended not to have this and TRAVELLING_LOG_LOGGER enabled at once

Default: true

TRAVELLING_LOG_FASTIFY_LOGGER_REQ_ID_HEADER

The name of the header that gets set by pino's correlation id system.

Default: travelling-req-id

TRAVELLING_LOG_FASTIFY_LOGGER_REQ_ID_LOG_LABEL

The name of the property that gets set by pino's correlation id system.

Default: travellingReqID

Portal

TRAVELLING_PORTAL_ENABLE

Enables the portal which has the client for login/logout/register/forgotPassword/oauth2Code functionality. This should always be enabled.

Default: true

TRAVELLING_PORTAL_PATH

The route that travelling will serve the client at.

Default: /travelling/portal/

TRAVELLING_PORTAL_HOST

This is used once on the first startup of Travelling during group initialization. This sets the remote host of a custom client to be served under the TRAVELLING_PORTAL_HOST path.

Default: travelling/localhost.key

TRAVELLING_PORTAL_FILE_PATH

The absolute filepath to the root directory of the client files. Recommended not to be changed unless unless there is a need for a fully custom rewrite of Travelling's client pages.

Default: travelling/client/dist

TRAVELLING_PORTAL_LOGO

The absolute filepath to the logo to be displayed on the client side.

Default: travelling/client/assets/logo.svg

TRAVELLING_PORTAL_STYLES

The absolute filepath to the css file to be displayed on the client side.

Default: travelling/client/assets/styles.css

TRAVELLING_PORTAL_ICON

The absolute filepath to the faveicon to be displayed on the client side.

Default: travelling/client/assets/favicon.ico

Proxy

TRAVELLING_PROXY_TIMEOUT

How long in seconds the proxy should wait on a request to finish. 0 is Infinity

Default: 0

TRAVELLING_PROXY_SEND_TRAVELLING_HEADERS

Allows Travelling to send permission/user/group based headers along with the proxy route

Default: false

| Header | Description | | ------ | --------------------------------------------- | | un | User's Username. | | uid | User's Id. | | gn | User's Group's name that allowed the request. | | gt | User's Group's type that allowed the request. | | perm | Permission's name that allowed the request. |

Redis

TRAVELLING_REDIS_ENABLE

Enables redis to be used when multiple instances of travelling are running and being load balanced against.

Default: false Uses in memory store which could be problematic depending on how many groups and routes there are.

TRAVELLING_REDIS_URL

The URL to a redis instance to be used by travelling as a data store.

Default: redis://127.0.0.1:6379/

TRAVELLING_REDIS_EVENTS_URL

The URL to a redis instance to be used by travelling as a pub/sub event system.

Default: redis://127.0.0.1:6379/

Cookie

Travelling uses a dual cookie system. One is a persistent token cookie for longterm login and the other is a short lived session cookie made to put less load on the system and speed things up making it not need to decrypt the token cookie every request.

TRAVELLING_COOKIE_SESSION_SECRET

The session secret used to generate the session cookie with. This needs to stay a secret and should be changed ever so often for security reasons

Default: This needs to be set!

TRAVELLING_COOKIE_SESSION_EXPIRATION

How long the session cookie will last for in seconds. Recommended to set it to the average number of seconds a user tends to use your service for.

Default: 300

TRAVELLING_COOKIE_TOKEN_SECRET

The token secret used to generate the persistent token cookie with. This needs to stay a secret and should be changed ever so often for security reasons

Default: null This needs to be set!

TRAVELLING_COOKIE_TOKEN_SALT

The token salt used to generate the persistent token cookie with. This needs to stay a secret and should be changed ever so often for security reasons

Default: null This needs to be set!

TRAVELLING_COOKIE_TOKEN_EXPIRATION

How long the persistent token cookie will last for in days.

Default: 30

TRAVELLING_COOKIE_DOMAIN

How long the persistent token cookie will last for in days.

Default: null

TRAVELLING_COOKIE_SECURITY_IP_HIJACK_PROTECTION

Enables cookie linked to remote ip's. Disabling this removes one more layer of protection against CRSF attacks, but might be needed depending on your Cors settings.

Default: true

USER

TRAVELLING_USER_ISOLATE_BY_DOMAIN

This allows users that have same username/email to register and be isolated by the domain property. This is useful if you have multiple websites and you want to keep your users isolated from each other.

Default: false

TRAVELLING_USER_USERNAME_MINCHAR

The minimum amount of characters a username has to have.

Default: 4

TRAVELLING_USER_USERNAME_ENABLE

Require users to have usernames

Default: true

TRAVELLING_USER_LOCKED_MESSAGE

Require users to have usernames

Default: Failed login attempts exceeded the limit. Contact your admin to get your account unlocked.

Authentication

TRAVELLING_PASSWORD_CONSECUTIVE

Disables user's passwords from having any consecutive characters.

Default: false

TRAVELLING_PASSWORD_MINCHAR

The minimum amount of characters a user's password has to have

Default: 8

TRAVELLING_PASSWORD_MAXCHAR

The maximum amount of characters a user's password is allowed to have. Leaving this unset makes it unlimited

Default:

TRAVELLING_PASSWORD_SPECIAL

The minimum amount of special characters a user's password has to have.

Default: 30

TRAVELLING_PASSWORD_NUMBER

The minimum amount of numbers characters a user's password has to have.

Default: 1

TRAVELLING_PASSWORD_LOWERCASE

The minimum amount of lowercase characters a user's password has to have.

Default: 1

TRAVELLING_PASSWORD_UPPERCASE

The minimum amount of uppercase characters a user's password has to have.

Default: 1

TRAVELLING_LOGIN_MAX_LOGIN_ATTEMPTS

The maximum amount of failed login attempts until a user is locked.

Default: 10

OAUTH2

TRAVELLING_TOKEN_ACCESS_EXPIRATION

How long a OAUTH2 Access token will last for in minutes.

Default: 1440

TRAVELLING_TOKEN_CODE_EXPIRATION

How long a OAUTH2 Code token will last for in minutes.

Default: 5

TRAVELLING_TOKEN_CODE_AUTHORIZE_FLOW

Enforces the user to click a authorize button to allow a client to login for the user.

Default: true

Postgres

TRAVELLING_DATABASE_URL

The Postgres connection url for Travelling to connect to.

Default: null

TRAVELLING_DATABASE_USER

The Postgres user.

Default: null

TRAVELLING_DATABASE_PASSWORD

The Postgres password.

Default: null

TRAVELLING_DATABASE_PORT

The Postgres port.

Default: null

TRAVELLING_DATABASE_NAME

The Postgres databases name.

Default: null

TRAVELLING_DATABASE_HOST

The Postgres host.

Default: null

TRAVELLING_PG_CRYPTO_IMPLEMENTATION

The absolute path to the encryption interface that is used for Travelling's database encryption fields. If a custom implementation is wanted please check out travelling/include/utils/cryptointerface.js for methods needed to be functional.

Default: travelling/include/utils/cryptointerface.js

TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SECRET

The secret used inside TRAVELLING_PG_CRYPTO_IMPLEMENTATION. This needs to stay a secret and should be changed ever so often for security reasons.

Default: null This needs to be set!

TRAVELLING_PG_CRYPTO_IMPLEMENTATION_SALT

The salt used inside TRAVELLING_PG_CRYPTO_IMPLEMENTATION. This needs to stay a secret and should be changed ever so often for security reasons.

Default: null This needs to be set!

TRAVELLING_PG_CRYPTO_ENCRYPT_USER_DATA

Enables the user_data field inside the user object to be encrypted. If sensitive data is stored in within that field it is recommended to enable this.

Default: false

Email

TRAVELLING_EMAIL_VALIDATION_EXTERNAL_ENABLE

Enable external email endpoint for email validation

Default: false

TRAVELLING_EMAIL_VALIDATION_EXTERNAL_ENDPOINT

Full url for endpoint for email validation

Default: null

TRAVELLING_EMAIL_VALIDATION_EXTERNAL_EMAIL_IN_ENDPOINT

Appends the users email to the end of the supplied endpoint. EX: http://test.com/email/[email protected]

Default: true

TRAVELLING_EMAIL_VALIDATION_EXTERNAL_EMAIL_IN_BODY

Sends the users email as text as a body to the supplied endpoint

Default: false

TRAVELLING_EMAIL_VALIDATION_EXTERNAL_METHOD

Supplied endpoint's HTTP Method to use

Default: GET

TRAVELLING_EMAIL_FROM

The email that will be used as the from address. Recommended to set it to a no-reply email address

Default: null

TRAVELLING_EMAIL_RECOVERY_EXPIRATION

The number of seconds for the email recovery link to last for. Recommended to keep this somewhat short-lived for security reasons.

Default: 900

TRAVELLING_EMAIL_ACTIVATION_EXPIRATION

The number of seconds for the email activation link to last for.

Default: 86400

TRAVELLING_EMAIL_TEST_ENABLE

Enables the use of a test email service that will display the login credentials inside the log at start. This is used by our integration test. However, it is helpful to enable this if custom Templates are written. Only one type of email support should be used Test, SMTP or AWS.

Default: false

TRAVELLING_EMAIL_SMTP_ENABLE

Enables the use of a SMTP email service. Only one type of email support should be used Test, SMTP or AWS.

Default: false

TRAVELLING_EMAIL_SMTP_HOST

The host of the SMTP service.

Default: 127.0.0.1

TRAVELLING_EMAIL_SMTP_PORT

The port of the SMTP service.

Default: 465

TRAVELLING_EMAIL_SMTP_SECURE

Enables TLS for SMTP.

Default: true

TRAVELLING_EMAIL_SMTP_AUTH_USER

Username for SMTP service.

Default: null

TRAVELLING_EMAIL_SMTP_SECURE

Password for SMTP service.

Default: null

TRAVELLING_EMAIL_SMTP_TLS_REJECT_UNAUTHORIZED

Enables rejection of TLS certs that are self served or invalid. Recommended to keep it enabled for security reasons.

Default: true

TRAVELLING_EMAIL_AWS_ENABLE

Enables the use of the AWS SES email service. Only one type of email support should be used Test, SMTP or AWS.

Default: false

TRAVELLING_EMAIL_AWS_CONFIG

The absolute path to the AWS json credentials config to use for accessing the SES service. See AWS's configuration documentation on the format of this file.

Default: null // This needs to be set to use AWS SES email service.

Templates

Templates all use html/handlebars. Check out the example default templates inside the travelling/templates/ folder for examples.

Reset Template Variables:

| Variable | Description | | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | {{user}} | This is the user object for the reset email. Use dot notation to access any of its properties for example: {{user.username}}. | | {{config}} | This is the config object for Travelling. Use dot notation to access any of its properties for example {{config.port}}. | | {{token}} | The reset token that Travelling needs to reset the password. Recommended to just copy and paste the full a href from the TRAVELLING_EMAIL_RESET_PASSWORD_TEMPLATE_BODY. | | {{ip}} | This is the IP object from the user requesting the reset password. The following properties are valid. query,city, regionName, country. |

Activation Template Variables:

| Variable | Description | | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | {{user}} | This is the user object for the activation email. Use dot notation to access any of its properties for example: {{user.username}}. | | {{config}} | This is the config object for Travelling. Use dot notation to access any of its properties for example {{config.port}}. | | {{token}} | The reset token that Travelling needs to activate the user's account. Recommended to just copy and paste the full a href from the TRAVELLING_EMAIL_ACTIVATION_TEMPLATE_BODY. |

TRAVELLING_EMAIL_RESET_PASSWORD_TEMPLATE_BODY

The absolute path to the email reset password template body. This is used as the body inside all reset password emails.

Default: travelling/templates/email-reset-password-body.html

TRAVELLING_EMAIL_RESET_PASSWORD_TEMPLATE_SUBJECT

The absolute path to the email reset password template subject. This is used as the subject line inside all reset password emails.

Default: templates/email-reset-password-subject.html

TRAVELLING_EMAIL_ACTIVATION_TEMPLATE_BODY

The absolute path to the email activation template body. This is used as the body inside all activation emails.

Default: templates/email-activation-body.html

TRAVELLING_EMAIL_ACTIVATION_TEMPLATE_SUBJECT

The absolute path to the email activation template subject.This is used as the subject line inside all activation emails.

Default: templates/email-activation-subject.html

Registration

TRAVELLING_REGISTRATION_REQUIRE_EMAIL_ACTIVATION

Enables the requirement of each newly registered user to activate their account through the email link.

Default: false

TRAVELLING_REGISTRATION_REQUIRE_MANUAL_ACTIVATION

Enables the requirement of each newly registered user to have a active user with permissions to unlock their account for them.

Default: false

SDK

Classes

Functions

Travelling

Kind: global class

Travelling
- .healthCheck(authorization_bearer)
- .metrics(authorization_bearer)

Travelling.healthCheck(authorization_bearer)

healthCheck - server's health check

Path: health

Kind: static method of Travelling

| Param | Type | Description | | --- | --- | --- | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Travelling.metrics(authorization_bearer)

metrics - servers metrics

Path: metrics

Kind: static method of Travelling

| Param | Type | Description | | --- | --- | --- | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Config

Kind: global class

Config.getProperty(property, authorization_bearer)

getProperty - Gets a property from travellings config.

Path: api/v1/config/:property

Kind: static method of Config

| Param | Type | Description | | --- | --- | --- | | property | any | (example: password) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Groups

Kind: global class

Groups

Groups.export(authorization_bearer)

export - Exports all groups in the proper format to be imported.

Path: api/v1/groups/export

Kind: static method of Groups

| Param | Type | Description | | --- | --- | --- | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Groups.import(body, authorization_bearer)

import - Imports all groups from the exported format.

Path: api/v1/groups/import

Kind: static method of Groups

| Param | Type | Description | | --- | --- | --- | | body | Object | | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
    "group": {
        "anonymous": {
            "type": "group",
            "allowed": [
                {
                    "route": "/travelling/portal/*",
                    "host": null,
                    "name": "*-travelling-portal-*"
                },
                {
                    "route": "/travelling/api/v1/auth/*",
                    "host": null,
                    "name": "*-travelling-api-v1-auth-*"
                },
                {
                    "route": "/travelling/api/v1/user/me/route/allowed",
                    "host": null,
                    "method": "GET",
                    "name": "get-travelling-api-v1-user-me-route-allowed"
                },
                {
                    "route": "/travelling/api/v1/user/me/permission/allowed/*",
                    "host": null,
                    "method": "GET",
                    "name": "get-travelling-api-v1-user-me-permission-allowed-*"
                },
                {
                    "route": "/travelling/assets/*",
                    "host": null,
                    "removeFromPath": "/travelling/assets/",
                    "method": "GET",
                    "name": "get-travelling-assets-*"
                },
                {
                    "route": "/travelling/api/v1/config/password",
                    "host": null,
                    "method": "GET",
                    "name": "get-travelling-api-v1-config-password"
                },
                {
                    "route": "/favicon.ico",
                    "host": null,
                    "method": "GET",
                    "name": "get-favicon.ico"
                }
            ],
            "inherited": null,
            "is_default": false
        },
        "group3": {
            "type": "group",
            "allowed": null,
            "inherited": [
                "testgroup|group1",
                "group|group2"
            ],
            "is_default": false
        },
        "superadmin": {
            "type": "group",
            "allowed": [
                {
                    "host": null,
                    "route": "/travelling/*",
                    "name": "*-travelling-*"
                },
                {
                    "name": "test-one-*-three"
                }
            ],
            "inherited": [
                "group|anonymous"
            ],
            "is_default": false
        },
        "group4": {
            "type": "group",
            "allowed": null,
            "inherited": [],
            "is_default": false
        },
        "group2": {
            "type": "group",
            "allowed": [
                {
                    "route": "/test/get",
                    "host": "https://127.0.0.1:4268/:username/:group",
                    "removeFromPath": "/test/get",
                    "method": "GET",
                    "name": "get-test-get"
                },
                {
                    "route": "/test/post",
                    "host": "http://127.0.0.1:4267/?id=:id&permission=:permission",
                    "removeFromPath": "/test/post",
                    "method": "POST",
                    "name": "post-test-post"
                }
            ],
            "inherited": [
                "testgroup|group1"
            ],
            "is_default": false
        },
        "group5": {
            "type": "group",
            "allowed": [
                {
                    "route": "/test/delete/:grouptype",
                    "host": "https://127.0.0.1:4268",
                    "removeFromPath": "/test/delete",
                    "method": "DELETE",
                    "name": "delete-test-delete-:grouptype"
                }
            ],
            "inherited": [
                "group|group4",
                "group|superadmin"
            ],
            "is_default": true
        },
        "group1": {
            "type": "group",
            "allowed": null,
            "inherited": null,
            "is_default": false
        }
    },
    "testgroup": {
        "group1": {
            "type": "testgroup",
            "allowed": null,
            "inherited": [
                "group|group4"
            ],
            "is_default": false
        },
        "superadmin": {
            "type": "testgroup",
            "allowed": null,
            "inherited": null,
            "is_default": false
        }
    }
}

Groups.get(authorization_bearer)

get - Get all the groups

Path: api/v1/groups

Kind: static method of Groups

| Param | Type | Description | | --- | --- | --- | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupsType

Kind: global class

GroupsType
- .all(type, authorization_bearer)
- .getTypesList(authorization_bearer)

GroupsType.all(type, authorization_bearer)

all - Gets all groups of a particular type

Path: api/v1/groups/type/:type

Kind: static method of GroupsType

| Param | Type | Description | | --- | --- | --- | | type | any | The type of the group | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupsType.getTypesList(authorization_bearer)

getTypesList - Gets all the types of groups currently made.

Path: api/v1/groups/types

Kind: static method of GroupsType

| Param | Type | Description | | --- | --- | --- | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group

Kind: global class

Group

Group.addPermission(id, permission, authorization_bearer)

addPermission - Adds a permission to a group.

Path: api/v1/group/id/:id/insert/permission/:permission

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: anonymous) | | permission | any | Permission (example: test-one-two-*) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.deletePermission(id, permission, authorization_bearer)

deletePermission - Removes a permission/route from a group.

Path: api/v1/group/id/:id/permission/:permission

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: anonymous) | | permission | any | Name or Route (example: test-one-two-*) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.addRoute(body, id, authorization_bearer)

addRoute - Adds a route to a group.

{
    "route": "test/permissions/*", // optional
    "host": null, // optional, defaults to travelling host
    "method": "*", // optional, defaults to '*'
    "remove_from_path": 'test/', // optional 
    "name": "test-permissions-*"  // Required and needs to be unqiue, defaults to method + route seperated by '-' instead of `/`
}

Path: api/v1/group/id/:id/insert/route

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | body | Object | | | id | any | | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
	"route": "test/permissions/*",
    "host": null, 
    "method": "*", 
    "name": "test-permissions-*"  
}

Group.removeInheritance(id, inherited, grouptype, authorization_bearer)

removeInheritance - Removes an inheritance from a group.

Path: api/v1/group/id/:id/remove/inheritance/:inherited/type/:grouptype

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: test1234) | | inherited | any | Name of the group to inherit from (example: group4) | | grouptype | any | The type of the inherited group | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.inheritFrom(id, inherited, grouptype, authorization_bearer)

inheritFrom - Adds an inheritance to a group.

Path: api/v1/group/id/:id/inherit/from/:inherited/type/:grouptype

Kind: static method of Group

Group.setDefault(id, authorization_bearer)

setDefault - Sets the group to be the default group for new users.

Path: api/v1/group/id/:id/set/default

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: group6) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.delete(id, authorization_bearer)

delete - delete group by its id or name

Path: api/v1/group/id/:id

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | id or name | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.edit(body, id, authorization_bearer)

edit - Edits a group

Path: api/v1/group/id/:id

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | body | Object | | | id | any | (example: ab31efc8-40a5-4d38-a347-adb4e38d0075) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
    "allowed": [
        {
            "route": "/travelling/portal/*",
            "host": null,
            "remove_from_path": "/travelling/portal",
            "method": "*",
            "name": "*-travelling-portal-*"
        },
        {
            "route": "/travelling/api/v1/auth/*",
            "host": null,
            "method": "*",
            "name": "*-travelling-api-v1-auth-*"
        },
        {
            "route": "/travelling/api/v1/user/me/route/allowed",
            "host": null,
            "method": "GET",
            "name": "get-travelling-api-v1-user-me-route-allowed"
        },
        {
            "route": "/travelling/api/v1/user/me/permission/allowed/*",
            "host": null,
            "method": "GET",
            "name": "get-travelling-api-v1-user-me-permission-allowed-*"
        },
        {
            "route": "/travelling/assets/*",
            "host": null,
            "remove_from_path": "/travelling/assets/",
            "method": "*",
            "name": "*-travelling-assets-*"
        },
        {
            "route": "travelling/api/v1/config/password",
            "host": null,
            "method": "get"
        }
    ]
}

Group.get(id, authorization_bearer)

get - Get a group by it's id or name.

Path: api/v1/group/id/:id

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: group1) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.createByName(id, authorization_bearer)

createByName - Add a new blank group with the set name.

Path: api/v1/group/id/:id

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the new group (example: test123) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Group.create(body, authorization_bearer)

create - Add a new group

Path: api/v1/group

Kind: static method of Group

| Param | Type | Description | | --- | --- | --- | | body | Object | | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
    "name": "group1",
    "type": "accounts",
    "allowed": [
        {
            "route": "/test",
            "host": "http://127.0.0.1:1237/",
            "remove_from_path": "test",
            "method": "*",
            "name": "all-test"
        }
    ],
    "is_default": false
}

GroupUsers

Kind: global class

GroupUsers
- .inherited(id)
- .get(id)

GroupUsers.inherited(id)

inherited - Gets all the users that belong to the group and all of its inherited groups.

Optional Query Params

| Param | Description | | --- | --- | | id | optional (example: 26c6aeff-ab95-4bdd-8260-534cf92d1c23) | | username | optional (example: user7) | | locked | optional (example: true) | | locked_reason | optional (example: Activation Required email your admin to get your account activated) | | group_request | optional (example: superadmin) | | failed_login_attempts | optional (example: 0) | | change_username | optional (example: false) | | change_password | optional (example: false) | | reset_password | optional (example: false) | | email_verify | optional (example: false) | | group_id | optional (example: 7320292c-627e-4e5a-b059-583eabdd6264) | | email | optional (example: [email protected]) | | created_on | optional (example: 1568419646794) | | last_login | optional (example: null) |

Path: api/v1/group/id/:id/users/inherited

Kind: static method of GroupUsers

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: superadmin) |

GroupUsers.get(id)

get - Gets all the users that belong to the group.

Optional Query Params

Path: api/v1/group/id/:id/users

Kind: static method of GroupUsers

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: superadmin) |

GroupUser

Kind: global class

GroupUser

GroupUser.delete(group, type, id, authorization_bearer)

delete - Delete a user by it's id or username from group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | group | any | id or name of the group | | type | any | The type of the group (example: accounts) | | id | any | id or name (example: user7) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupUser.removeGroupInheritance(group, type, id, inheritgroupid, inheritgrouptype, authorization_bearer)

removeGroupInheritance - Remove a user to a group of a particular type of group.

Path: api/v1/group/id/:group/type/:type/user/:id/inheritance/group/:inheritgroupid/type/:inheritgrouptype

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | group | any | id or name of the group (example: group1) | | type | any | type of group (example: group) | | id | any | id or name of the user (example: user5) | | inheritgroupid | any | id or name of the group to inherit (example: group2) | | inheritgrouptype | any | type of the group to inherit (example: group) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupUser.addGroupInheritance(group, type, id, inheritgroupid, inheritgrouptype, authorization_bearer)

addGroupInheritance - Add a group for the current user from a group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id/inheritance/group/:inheritgroupid/type/:inheritgrouptype

Kind: static method of GroupUser

GroupUser.editPropertyValue(group, type, id, property, value, authorization_bearer)

editPropertyValue - Edit a current user's property data as a path param from a group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id/property/:property/:value

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | group | any | id or name of the group | | type | any | The type of the group (example: group) | | id | any | id or name (example: user5) | | property | any | (example: email) | | value | any | (example: [email protected]) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupUser.editProperty(body, group, type, id, property, authorization_bearer)

editProperty - Edit a user's property by it's id or username from a group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id/property/:property

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | body | Object | | | group | any | id or name of the group | | type | any | The type of the group (example: accounts) | | id | any | id or name (example: user6) | | property | any | (example: email) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
	"locked": false
}

GroupUser.edit(body, group, type, id, authorization_bearer)

edit - Edit a user by it's id or username from group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | body | Object | | | group | any | id or name of the group | | type | any | The type of the group (example: accounts) | | id | any | id or name (example: user6) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
	"locked": false
}

GroupUser.getProperty(group, type, id, property, authorization_bearer)

getProperty - Get a user's property by it's id or username from group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id/property/:property

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | group | any | id or name of the group | | type | any | The type of the group (example: accounts) | | id | any | id or name (example: user6) | | property | any | (example: email) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupUser.get(group, type, id, authorization_bearer)

get - Get a user by it's id or username from group of a particular type.

Path: api/v1/group/id/:group/type/:type/user/:id

Kind: static method of GroupUser

| Param | Type | Description | | --- | --- | --- | | group | any | id or name of the group | | type | any | The type of the group (example: accounts) | | id | any | id or name (example: user6) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType

Kind: global class

GroupType

GroupType.deletePermission(id, type, permission, authorization_bearer)

deletePermission - Removes a permission/route from a group of a particular type.

Path: api/v1/group/id/:id/type/:type/permission/:permission

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: anonymous) | | type | any | Type of the group (example: group) | | permission | any | Name or Route (example: test-one-three-*) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.addPermission(id, type, permission, authorization_bearer)

addPermission - Adds a permission to a group of a particular type.

Path: api/v1/group/id/:id/type/:type/insert/permission/:permission

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: anonymous) | | type | any | Type of the group (example: group) | | permission | any | Permission (example: test-one-three-*) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.addRoute(body, id, type, authorization_bearer)

addRoute - Adds a route to a group of a particular type.

{
    "route": "test/permissions/*", // optional
    "host": null, // optional, defaults to travelling host
    "method": "*", // optional, defaults to '*'
    "remove_from_path": 'test/', // optional 
    "name": "test-permissions-*"  // Required and needs to be unqiue, defaults to method + route seperated by '-' instead of `/`
}

Path: api/v1/group/id/:id/type/:type/insert/route

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | body | Object | | | id | any | Name of the group | | type | any | | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

Example
body

{
	"route": "test/permissions/*",
    "host": null, 
    "method": "*", 
    "name": "test-permissions-*"  
}

GroupType.removeInheritance(id, type, inherited, grouptype, authorization_bearer)

removeInheritance - Removes an inheritance from a group of a particular type.

Path: api/v1/group/id/:id/type/:type/remove/inheritance/:inherited/type/:grouptype

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: test1234) | | type | any | The type of the group (example: accounts) | | inherited | any | Name of the group to inherit from (example: superadmin) | | grouptype | any | The type of the inherited group | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.inheritFrom(id, type, inherited, grouptype, authorization_bearer)

inheritFrom - Adds an inheritance to a group of a particular type.

Path: api/v1/group/id/:id/type/:type/inherit/from/:inherited/type/:grouptype

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | Name of the group (example: group1) | | type | any | The type of the group (example: testgroup) | | inherited | any | Name of the group to inherit from (example: test123) | | grouptype | any | The type of the inherited group | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.setDefault(id, type)

setDefault - Sets the group of a particular type to be the default group for new users.

Path: api/v1/group/id/:id/type/:type/set/default

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: group1) | | type | any | The type of the group (example: account) |

GroupType.delete(id, type, authorization_bearer)

delete - delete group of a particular type by its name or id

Path: api/v1/group/id/:id/type/:type

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | id or name | | type | any | The type of the group | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.get(id, type, authorization_bearer)

get - Get a group by it's id or name of a particular type.

Path: api/v1/group/id/:id/type/:type

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | id | any | id or name (example: group1) | | type | any | The type of the group (example: accounts) | | authorization_bearer | string | The client_credentials generated OAUth2 access token. |

GroupType.edit(body, id, type, authorization_bearer)

edit - Edits a group of a particular type

Path: api/v1/group/id/:id/type/:type

Kind: static method of GroupType

| Param | Type | Description | | --- | --- | --- | | body | Object</c

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme

REST Docs

Install

Minimum New Setup

Security

Configuration

Basic

TRAVELLING_PORT

TRAVELLING_IP

TRAVELLING_KEY

TRAVELLING_CERT

TRAVELLING_HTTPS

TRAVELLING_SERVICE_NAME

Misc

TRAVELLING_MISC_CLOUDFLAREIP

Cors

TRAVELLING_CORS_ENABLE

TRAVELLING_CORS_HEADER_ORIGIN

TRAVELLING_CORS_HEADER_METHODS

TRAVELLING_CORS_HEADER_CREDENTIALS

TRAVELLING_CORS_HEADER_MAX_AGE

Logging

TRAVELLING_LOG_ENABLE

TRAVELLING_LOG_LOGGER

TRAVELLING_LOG_COLORS

TRAVELLING_LOG_LEVEL

TRAVELLING_LOG_REQUESTS

TRAVELLING_LOG_UNAUTHORIZED_ACCESS

Fastify Logger

TRAVELLING_LOG_FASTIFY_LOGGER

TRAVELLING_LOG_FASTIFY_LOGGER_REQUEST

TRAVELLING_LOG_FASTIFY_LOGGER_REQ_ID_HEADER

TRAVELLING_LOG_FASTIFY_LOGGER_REQ_ID_LOG_LABEL

Portal

TRAVELLING_PORTAL_ENABLE

TRAVELLING_PORTAL_PATH

TRAVELLING_PORTAL_HOST

TRAVELLING_PORTAL_FILE_PATH

TRAVELLING_PORTAL_LOGO

TRAVELLING_PORTAL_STYLES

TRAVELLING_PORTAL_ICON

Proxy

TRAVELLING_PROXY_TIMEOUT

TRAVELLING_PROXY_SEND_TRAVELLING_HEADERS

Redis

TRAVELLING_REDIS_ENABLE

TRAVELLING_REDIS_URL

TRAVELLING_REDIS_EVENTS_URL

Cookie

TRAVELLING_COOKIE_SESSION_SECRET

TRAVELLING_COOKIE_SESSION_EXPIRATION

TRAVELLING_COOKIE_TOKEN_SECRET

TRAVELLING_COOKIE_TOKEN_SALT

TRAVELLING_COOKIE_TOKEN_EXPIRATION

TRAVELLING_COOKIE_DOMAIN

TRAVELLING_COOKIE_SECURITY_IP_HIJACK_PROTECTION

USER

TRAVELLING_USER_ISOLATE_BY_DOMAIN

TRAVELLING_USER_USERNAME_MINCHAR

TRAVELLING_USER_USERNAME_ENABLE

TRAVELLING_USER_LOCKED_MESSAGE

Authentication

TRAVELLING_PASSWORD_CONSECUTIVE

TRAVELLING_PASSWORD_MINCHAR

TRAVELLING_PASSWORD_MAXCHAR

TRAVELLING_PASSWORD_SPECIAL

TRAVELLING_PASSWORD_NUMBER

TRAVELLING_PASSWORD_LOWERCASE

TRAVELLING_PASSWORD_UPPERCASE

TRAVELLING_LOGIN_MAX_LOGIN_ATTEMPTS

OAUTH2

TRAVELLING_TOKEN_ACCESS_EXPIRATION

TRAVELLING_TOKEN_CODE_EXPIRATION

TRAVELLING_TOKEN_CODE_AUTHORIZE_FLOW

Postgres