feat(token): check if apiToken is a valid jwt token

Author: gergelyke

e2e/index.js

@@ -1,6 +1,6 @@
 'use strict'
 
-var TRACE_API_KEY_TEST = 'api-key'
+var TRACE_API_KEY_TEST = 'headers.payload.signature'
 var TRACE_SERVICE_NAME_TEST = 'service-name'
 
 var childProcessTest = require('./utils/childProcessTest')

lib/utils/configReader.js

@@ -96,6 +96,20 @@ ConfigReader.prototype._getFileConfig = function (file) {
   }
 }
 
+ConfigReader.prototype.checkApiToken = function (token) {
+  var bearerTokenParts
+
+  if (!token) {
+    throw new Error('Missing apiKey, please set the TRACE_API_KEY environment variable')
+  }
+
+  bearerTokenParts = token.split('.')
+
+  if (bearerTokenParts.length !== 3) {
+    throw new Error('Invalid apiKey, please make sure to copy-paste the entire token')
+  }
+}
+
 ConfigReader.prototype.getConfig = function () {
   var parameterConfig = this.parameterConfig
   var systemConfig = this._getSystemConfig()
@@ -118,9 +132,7 @@ ConfigReader.prototype.getConfig = function () {
 
   config.whiteListHosts = [url.parse(config.collectorApiUrl).host]
 
-  if (!config.apiKey) {
-    throw new Error('Missing apiKey, please set the TRACE_API_KEY environment variable')
-  }
+  this.checkApiToken(config.apiKey)
 
   if (!config.serviceName) {
     throw new Error('Missing serviceName, please set the TRACE_SERVICE_NAME environment variable')

lib/utils/configReader.spec.js

@@ -3,6 +3,8 @@ var expect = require('chai').expect
 var ConfigReader = require('./configReader')
 
 describe('Config Reader module', function () {
+  var testApiToken = 'headers.payload.signature'
+
   it('creates a configReader', function () {
     var config = { }
 
@@ -15,7 +17,7 @@ describe('Config Reader module', function () {
     var configReader = ConfigReader.create({
       serviceName: 'test',
       reporter: 'dummy',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     var getDefaultConfigStub = this.sandbox.stub(configReader, '_getDefaultConfig', function () {
@@ -35,7 +37,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       collectorApiUrl: 'http://c.a.b',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     var getFileConfigStub = this.sandbox.stub(configReader, '_getFileConfig', function () {
@@ -52,7 +54,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       collectorApiUrl: 'http://c.a.b',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     var getEnvVarConfigStub = this.sandbox.stub(configReader, '_getEnvVarConfig', function () {
@@ -70,7 +72,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       collectorApiUrl: 'http://c.a.b',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     var getSystemConfigStub = this.sandbox.stub(configReader, '_getSystemConfig', function () {
@@ -88,7 +90,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       collectorApiUrl: 'http://c.a.b',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     this.sandbox.stub(configReader, '_getEnvVarConfig').returns({})
@@ -107,7 +109,7 @@ describe('Config Reader module', function () {
   })
 
   it('environment variables config should override file config', function () {
-    var configReader = ConfigReader.create({ serviceName: 'test', reporter: 'dummy', apiKey: 'api-key' })
+    var configReader = ConfigReader.create({ serviceName: 'test', reporter: 'dummy', apiKey: testApiToken })
 
     this.sandbox.stub(configReader, '_getEnvVarConfig', function () {
       return { test: 'env' }
@@ -123,7 +125,7 @@ describe('Config Reader module', function () {
   })
 
   it('system config should override all env var config', function () {
-    var configReader = ConfigReader.create({ serviceName: 'test', reporter: 'dummy', apiKey: 'api-key' })
+    var configReader = ConfigReader.create({ serviceName: 'test', reporter: 'dummy', apiKey: testApiToken })
 
     this.sandbox.stub(configReader, '_getSystemConfig', function () {
       return { test: 'system' }
@@ -145,7 +147,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       test: 'param',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     this.sandbox.stub(configReader, '_getSystemConfig', function () {
@@ -167,7 +169,7 @@ describe('Config Reader module', function () {
     process.env.VCAP_SERVICES = JSON.stringify({
       trace: [{
         credentials: {
-          TRACE_API_KEY: 'test-key'
+          TRACE_API_KEY: testApiToken
         }
       }]
     })
@@ -180,7 +182,7 @@ describe('Config Reader module', function () {
     var cfg = configReader.getConfig()
 
     expect(cfg.serviceName).to.eql('test-app')
-    expect(cfg.apiKey).to.eql('test-key')
+    expect(cfg.apiKey).to.eql(testApiToken)
     delete process.env.VCAP_APPLICATION
     delete process.env.VCAP_SERVICES
   })
@@ -190,7 +192,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       collectorApiUrl: 'http://c.a.b',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     this.sandbox.stub(configReader, '_getDefaultConfig', function () {
@@ -209,7 +211,7 @@ describe('Config Reader module', function () {
     var configReader = ConfigReader.create({
       serviceName: 'test',
       reporter: 'dummy',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     this.sandbox.stub(configReader, '_getEnvVarConfig', function () {
@@ -229,7 +231,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       configPath: 'param',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     var getFileConfigStub = this.sandbox.stub(configReader, '_getFileConfig').returns({})
@@ -245,7 +247,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       configPath: 'a/surely/nonexisting/path',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
 
     configReader.getConfig()
@@ -275,7 +277,7 @@ describe('Config Reader module', function () {
       serviceName: 'test',
       reporter: 'dummy',
       configPath: 'test',
-      apiKey: 'api-key'
+      apiKey: testApiToken
     })
     var log = this.sandbox.spy(console, 'error')
     var wellformed = {