aura-validate-apikey utility

Introduction

aura-validate-apikey utility is used for the validation of an APIKey of an incoming request

Find more information in the Github repository: https://github.com/Telefonica/aura-common-utilities/tree/master/packages/aura-utilities/src/aura-validate-apikey/

Initialization

aura-validate-apikey utility is a singleton module prepared to be used with orchestrator.

(async () => {
    try {
        // Sorted modules initialization
        const sortedModules = [AuthenticationApiKey, ...];
        // Instantiate the Service App.
        const appOrchestrator = new Orchestrator();
        // Add configuration, that will be required by almost all other modules
        appOrchestrator.setConfigurationManager(ConfigurationManager);
        // Add the dependent modules in order.
        appOrchestrator.addModules(sortedModules);
        // Initiate the App.
        await appOrchestrator.init();
    } catch (error) {
        logger.error({ error: error.message, msg: 'Server cannot start', stck: error, corr: CorrelatorUtil.auraSystem });
    }
})();

Use aura-validate-apikey utility

After initialising the AuthenticationApiKey instance (calling static init method once), the APIKey could be validated by different methods:

• Middleware use APIKey Authorization for the swagger tools middleware use. This function lets us send a callback when the validation has finished. (Not used yet).

  AuthenticationApiKey.instance.validateApiKeySwaggerTool(request, securityDefinition, scopes, callback);
  

• Without callback It validates APIKey from header and URL.

  AuthenticationApiKey.instance.validateApiKey(authHeader, requestUrl, correlator);
  It exposes a method that only receives request and a correlator. All necessary parameters are extracted from the request:
  AuthenticationApiKey.instance.validateApiKeyAuthorization(request, correlator);
  

Aura APIKey model

Each externally available API endpoint in Aura is authenticated by an APIKey that should have been generated independently for each environment.

These APIKeys contain an encrypted data model that allows both checking that the key was encrypted with the environment ENCRYPTION_KEY and that it granted the access to the given API endpoint and method.

The APIKey model is described below:

API Key validation is applied in:

• aura-bot to validate requests coming from aura-bridge
• aura-authentication-api
• aura-bridge
• channel-communications-manager