diff --git a/src/app.js b/src/app.js index 20b90bc..26f8020 100644 --- a/src/app.js +++ b/src/app.js @@ -71,12 +71,10 @@ app.use(`/${v3prefix}/`, jwtAuth.getTokenFromHeaders) // Instantiate the authorization middleware, used to implement pro-tier rate limiting. const auth = new AuthMW() -// app.use(`/${v2prefix}/`, auth.mw()) app.use(`/${v3prefix}/`, auth.mw()) // Rate limit on all v3 routes app.use(`/${v3prefix}/`, routeRateLimit) // Establish and enforce rate limits. -// app.use(`/${v3prefix}/`, jwtAuth.routeAccess) // Enforce access tiers. app.use(`/${v3prefix}/` + `health-check`, healthCheckV3) app.use(`/${v3prefix}/` + `blockchain`, blockchainV3.router) app.use(`/${v3prefix}/` + `control`, controlV3.router) diff --git a/src/middleware/jwt-auth.js b/src/middleware/jwt-auth.js index be719fc..6880ea0 100644 --- a/src/middleware/jwt-auth.js +++ b/src/middleware/jwt-auth.js @@ -40,55 +40,8 @@ const getTokenFromHeaders = (req, res, next) => { next() } -// This middleware analyizes the combination of JWT token and apiLevel. It will -// stop users from accessing routes they have not paid for. -// -// It is assumed this middleware is run AFTER the route-ratelimit.js middleware, -// so that the req.locals.apiLevel property has been populated. -const routeAccess = (req, res, next) => { - try { - // console.log(`req.locals: ${JSON.stringify(req.locals, null, 2)}`) - console.log(`req.url: `, req.url) - - const locals = req.locals - const url = req.url - - const level20Routes = ["insight", "bitcore", "blockbook"] - - // JWT token is included in header. - if (!!locals.jwtToken && locals.jwtToken !== "") { - // API Level is 0 (free tier): do nothing. All endpoints are open to - // free public access within the drastically limited rate limits. - - if (locals.apiLevel < 20) { - // API level does not include indexer access. - - // Loop through the routes that are not accessible to this tier. - for (let i = 0; i < level20Routes.length; i++) { - // If the requested route is for a higher tier, return a 403. - if (url.indexOf(level20Routes[i]) > -1) { - res.status(403) - return res.json({ - error: - "route is not accessible for your JWT tier. Upgrade or use anonymous access." - }) - } - } - } - // else if (locals.apiLevel > 11) { - // // API level is 20 (indexer tier) - // } - } - } catch (err) { - console.log(`Error in routeAccess: `, err) - } - - next() -} - const jwtAuth = { - getTokenFromHeaders, - routeAccess + getTokenFromHeaders } module.exports = jwtAuth diff --git a/src/middleware/route-ratelimit.js b/src/middleware/route-ratelimit.js index fca640d..b67c045 100644 --- a/src/middleware/route-ratelimit.js +++ b/src/middleware/route-ratelimit.js @@ -60,16 +60,15 @@ const routeRateLimit = async function(req, res, next) { // Get the API level for this user. let jwtInfo = await axios.get(path) jwtInfo = jwtInfo.data - console.log(`jwtInfo: ${JSON.stringify(jwtInfo, null, 2)}`) + // console.log(`jwtInfo: ${JSON.stringify(jwtInfo, null, 2)}`) // If JWT if valid, evaluate the API level for the user. if (jwtInfo.isValid) { // Set fine-grain permissions for each user based on the JWT token. const userPermissions = evalUserPermissioins(req, jwtInfo) - console.log( - `userPermissions: ${JSON.stringify(userPermissions, null, 2)}` - ) - console.log(` `) + // console.log( + // `userPermissions: ${JSON.stringify(userPermissions, null, 2)}` + // ) req.locals.proLimit = userPermissions.proLimit req.locals.apiLevel = userPermissions.apiLevel @@ -162,7 +161,7 @@ const routeRateLimit = async function(req, res, next) { // uses its output to adjust rate limits on-the-fly based on the users // permission level. function evalUserPermissioins(req, authData) { - console.log(`authData: ${JSON.stringify(authData, null, 2)}`) + // console.log(`authData: ${JSON.stringify(authData, null, 2)}`) // Return object with default values const retObj = { @@ -173,9 +172,9 @@ function evalUserPermissioins(req, authData) { const level20Routes = ["insight", "bitcore", "blockbook"] const locals = req.locals - console.log(`locals: ${JSON.stringify(locals, null, 2)}`) + // console.log(`locals: ${JSON.stringify(locals, null, 2)}`) const url = req.url - console.log(`url: ${JSON.stringify(url, null, 2)}`) + // console.log(`url: ${JSON.stringify(url, null, 2)}`) if (authData.apiLevel < 20) { // Loop through the routes that are not accessible to this tier. diff --git a/src/routes/v3/full-node/control.js b/src/routes/v3/full-node/control.js index e2e6374..1a0ae1e 100644 --- a/src/routes/v3/full-node/control.js +++ b/src/routes/v3/full-node/control.js @@ -36,8 +36,6 @@ async function getNetworkInfo(req, res, next) { requestConfig } = routeUtils.setEnvVars() - console.log(`req.locals: ${JSON.stringify(req.locals, null, 2)}`) - requestConfig.data.id = "getnetworkinfo" requestConfig.data.method = "getnetworkinfo" requestConfig.data.params = []