Review: Working vs. Current

.gitignore

@@ -6,3 +6,5 @@ cts/var
 lts/pkg/dist
 .DS_Store
 .idea
+dumb-init
+CATAPULT-player.tar.gz

cts/.env.example

@@ -1,5 +1,10 @@
 HOSTNAME=localhost
 
+DB_HOST=rdbms
+DB_NAME=catapult_cts
+DB_USERNAME=catapult
+DB_PASSWORD=quartz
+
 PLAYER_ROOT_PATH=/player
 PLAYER_BASE_URL=http://player:3398/player
 PLAYER_CONTENT_URL=http://localhost/player/content

cts/docker-compose.yml

@@ -60,9 +60,13 @@ services:
       - ./seeds:/usr/src/app/seeds:ro
     environment:
       - HOSTNAME
-      - DATABASE_USER=catapult
-      - DATABASE_USER_PASSWORD=quartz
-      - DATABASE_NAME=catapult_cts
+      - DB_HOST
+      - DB_NAME
+      - DB_USERNAME
+      - DB_PASSWORD
+      # - DATABASE_USER=catapult
+      # - DATABASE_USER_PASSWORD=quartz
+      # - DATABASE_NAME=catapult_cts
       - PLAYER_BASE_URL
       - PLAYER_KEY
       - PLAYER_SECRET

cts/service/index.js

@@ -39,9 +39,7 @@ const provision = async () => {
                 host: process.argv[3],
                 port: process.argv[2] || 3399,
                 routes: {
-                    cors: {
-                        credentials: true
-                    },
+                    cors: false,
                     response: {
                         emptyStatusCode: 204
                     }
@@ -65,7 +63,8 @@ const provision = async () => {
             }
         };
 
-    await waitPort({host: "rdbms", port: 3306});
+    const DB_HOST = (process.env.DB_HOST || "rdbms");
+    await waitPort({host: DB_HOST, port: 3306});
 
     const db = await require("./lib/db")();
 

cts/service/knexfile.js

@@ -13,24 +13,33 @@
     See the License for the specific language governing permissions and
     limitations under the License.
 */
+const DB_HOST = (process.env.DB_HOST || "rdbms");
+const DB_NAME = (process.env.DB_NAME || "catapult_cts");
+const DB_USERNAME = (process.env.DB_USERNAME || "catapult");
+const DB_PASSWORD = (process.env.DB_PASSWORD || "quartz");
+
 const Hoek = require("@hapi/hoek"),
     waitPort = require("wait-port"),
     {
-        MYSQL_HOST: HOST = "rdbms",
+        // MYSQL_HOST: HOST = "rdbms",
         MYSQL_HOST_FILE: HOST_FILE,
-        DATABASE_USER: USER = "catapult",
+        // DATABASE_USER: USER = "catapult",
         DATABASE_USER_FILE: USER_FILE,
-        DATABASE_USER_PASSWORD: PASSWORD = "quartz",
+        // DATABASE_USER_PASSWORD: DB_PASSWORD,
         DATABASE_USER_PASSWORD_FILE: PASSWORD_FILE,
-        DATABASE_NAME: DB = "catapult_player",
+        // DATABASE_NAME: DB = "catapult_player",
         DATABASE_NAME_FILE: DB_FILE,
     } = process.env;
 
 module.exports = async () => {
-    const host = HOST_FILE ? fs.readFileSync(HOST_FILE) : HOST,
-        user = USER_FILE ? fs.readFileSync(USER_FILE) : USER,
-        password = PASSWORD_FILE ? fs.readFileSync(PASSWORD_FILE) : PASSWORD,
-        database = DB_FILE ? fs.readFileSync(DB_FILE) : DB;
+    // const host = HOST_FILE ? fs.readFileSync(HOST_FILE) : HOST,
+    //     user = USER_FILE ? fs.readFileSync(USER_FILE) : USER,
+    //     password = PASSWORD_FILE ? fs.readFileSync(PASSWORD_FILE) : PASSWORD,
+    //     database = DB_FILE ? fs.readFileSync(DB_FILE) : DB;
+    const host = HOST_FILE ? fs.readFileSync(HOST_FILE) : DB_HOST,
+        user = USER_FILE ? fs.readFileSync(USER_FILE) : DB_USERNAME,
+        password = PASSWORD_FILE ? fs.readFileSync(PASSWORD_FILE) : DB_PASSWORD,
+        database = DB_FILE ? fs.readFileSync(DB_FILE) : DB_NAME;
 
     await waitPort({host, port: 3306});
 

cts/service/lib/db.js

@@ -14,7 +14,7 @@
     limitations under the License.
 */
 const Knex = require("knex"),
-    KnexStringcase = require('knex-stringcase'),
+    KnexStringcase = require('knex-stringcase').default,
     KnexCfg = require("../knexfile");
 
 module.exports = async () => {

player/.env.example

@@ -1,16 +1,24 @@
 HOSTNAME=localhost
 HOST_PORT=63398
 
+DB_HOST=rdbms
+DB_NAME=catapult_player
+DB_USERNAME=catapult
+DB_PASSWORD=quartz
+
 CONTENT_URL=http://localhost:63398/content
 
+PLAYER_ALTERNATE_AUTH_HEADER=
+PLAYER_REQUIRE_STRICT_HEADERS=
+
 API_KEY="some API access key"
 API_SECRET="an API access secret"
 TOKEN_SECRET="some random string"
 
-LRS_ENDPOINT="http://host.docker.internal:8081/20.1.x/lrs/default/"
-LRS_USERNAME="dev-tools-xapi"
-LRS_PASSWORD="dev-tools-xapi-password"
-LRS_XAPI_VERSION=1.0.3
+LRS_ENDPOINT="The LRS endpoint"
+LRS_USERNAME="LRS username"
+LRS_PASSWORD="LRS password"
+LRS_XAPI_VERSION="version if needed
 
 ## Default is empty, add if necessary for nginx config
 PLAYER_API_ROOT=

player/README.md

@@ -8,20 +8,44 @@ After cloning the repository, create a `.env` file in the `player/` directory. T
 * The host port where the service can be accessed
 
 For example:
-
-```
-HOST_PORT=63398
-CONTENT_URL=http://localhost:63398/content
-API_KEY="some API access key"
-API_SECRET="an API access secret"
-TOKEN_SECRET="some random string"
-LRS_ENDPOINT="http://host.docker.internal:8081/20.1.x/lrs/default/"
-LRS_USERNAME="dev-tools-xapi"
-LRS_PASSWORD="dev-tools-xapi-password"
-```
+## Tables
+
+| Variable  | Purpose | Suggested Value | Required? |
+|:---------:|:-------:|:---------------:|:---------:|
+| HOSTNAME  | The base URL or host address the player can be reached at, such as "localhost" |  No recommendation - but example is "localhost" | Yes|
+| HOST_PORT | The port the player can be reached at on the home address | No recommendation - but example is "3398" | Yes |
+| DB_HOST   | The name of the database the player uses | rdbms (This is the default database the player has in it's repo) | Yes|
+| DB_NAME   | The name of the database being used by the player | catapult_player | Yes |
+| DB_USERNAME | The default username for the database | catapult | Yes |
+| DB_PASSWORD | The default password for the database | quartz | Yes |
+| CONTENT_URL | The content URL is where the player serves up content. It is either the "PLAYER_STANDALONE_LAUNCH_URL_BASE/content" or "HOSTNAME/HOSTPORT/content") | Yes | 
+| API_KEY     | This is the players access key or 'username' |  No recommendation - but example is "BasicKey" | Yes |
+| API_SECRET  | This is the players password | No recommendation - but example is "BasicSecret" | Yes |
+| TOKEN_SECRET | This is a secret token for the player when using JWT authentication |  No recommendation - but example is "BasicTokenSecret" | Yes |
+| LRS_ENDPOINT | The endpoint to reach an LRS if using in conjuction with player | No recommendation | No - only used if using an LRS |
+| LRS_USERNAME | The username to login to the LRS if used | No recommendation | No - only used if using an LRS |
+| LRS_PASSWORD | The password to login to the LRS if used | No recommendation | No - only used if using an LRS |
+| LRS_XAPI_VERSION | The LRS xAPI version ( if needed using an LRS) | No recommendation | No - only used if using an LRS |
+| PLAYER_API_ROOT | The player API root, or location of the player to be used in networking with nginx | /cmi5/player | No - only used when using nginx to proxy |
+| PLAYER_STANDALONE_LAUNCH_URL_BASE | The 'public friendly' location of the player. This is not the internal docker address, but the address that the player can be reached at from outside the network. | No recommendation - but example is "http://localhost/cmi5/player" | No - only used when using nginx to proxy |
+| PLAYER_ALTERNATE_AUTH_HEADER | An optional header to check when processing auth from a client / browser request.  This is a rare configuration value and should only be used when when a deployment environment overrides the expected `Authorization` header.  The default auth header will still be used if the specified header value was not found in the request. | Empty, but for Platform One we use `cmi5Authorization` | No. |
 
 Then run,
 
     docker-compose up --build -d
 
 To build and run the player service. Once run it will be available at the `HOST_PORT` mapped in the `.env` as above.
+
+## Running in a Docker container/network with NGINX server
+
+When running the player as a service behind a docker network or NGINX server there are a few extra steps to take. The variables PLAYER_API_ROOT and PLAYER_STANDALONE_LAUNCH_URL_BASE need to be used. 
+
+Also, be sure to add this to the nginx.conf:
+```
+location /cmi5/player {
+    #
+    proxy_pass https://"docker container name": :docker port"/cmi5/player;
+}
+```
+This is the INTERNAL network address.
+

player/docker-compose.yml

@@ -36,12 +36,17 @@ services:
       - LRS_USERNAME
       - LRS_PASSWORD
       - LRS_XAPI_VERSIONs
-      - DATABASE_USER=catapult
-      - DATABASE_USER_PASSWORD=quartz
-      - DATABASE_NAME=catapult_player
+      - DB_HOST
+      - DB_NAME
+      - DB_USERNAME
+      - DB_PASSWOD
+      # - DATABASE_USER=catapult
+      # - DATABASE_USER_PASSWORD=quartz
+      # - DATABASE_NAME=catapult_player
       - FIRST_TENANT_NAME
       - PLAYER_API_ROOT=${PLAYER_ROOT_PATH}
       - PLAYER_STANDALONE_LAUNCH_URL_BASE
+      - PLAYER_REQUIRE_STRICT_HEADERS
       - HOST_PORT
   rdbms:
     image: mysql:8.0.31

player/service/auth/basic.modded.js

@@ -0,0 +1,102 @@
+'use strict';
+
+const Boom = require('@hapi/boom');
+const Hoek = require('@hapi/hoek');
+
+
+const internals = {};
+
+
+exports.plugin = {
+    pkg: require('../package.json'),
+    requirements: {
+        hapi: '>=20.0.0'
+    },
+
+    register(server, options) {
+
+        server.auth.scheme('basic', internals.implementation);
+    }
+};
+
+const alternateAuthHeader = (process.env.PLAYER_ALTERNATE_AUTH_HEADER || "").toLowerCase();
+const alternateAuthHeaderInUse = alternateAuthHeader !== "";
+
+internals.implementation = function (server, options) {
+
+    Hoek.assert(options, 'Missing basic auth strategy options');
+    Hoek.assert(typeof options.validate === 'function', 'options.validate must be a valid function in basic scheme');
+
+    const settings = Hoek.clone(options);
+
+    const scheme = {
+        authenticate: async function (request, h) {
+
+            let authorization = request.headers.authorization;
+
+            // Certain deployment environments will replace the client's Authorization
+            // header prior to its arrival through the proxy layers.
+            //
+            // We allow the client to submit that info through a different header to
+            // by pass those filters, but we'll want to assign it back into the expected
+            // location for when this request object is passed around later.
+            //
+            if (alternateAuthHeaderInUse) {
+                let alternateAuth = request.headers[alternateAuthHeader];
+                if (alternateAuth != undefined) {
+                    authorization = alternateAuth;
+                    request.headers["authorization"] = authorization;
+                }   
+            }
+
+            if (!authorization) {
+                throw Boom.unauthorized(null, 'Basic', settings.unauthorizedAttributes);
+            }
+
+            const parts = authorization.split(/\s+/);
+
+            if (parts[0].toLowerCase() !== 'basic') {
+                throw Boom.unauthorized(null, 'Basic', settings.unauthorizedAttributes);
+            }
+
+            if (parts.length !== 2) {
+                throw Boom.badRequest('Bad HTTP authentication header format', 'Basic');
+            }
+
+            const credentialsPart = Buffer.from(parts[1], 'base64').toString();
+            const sep = credentialsPart.indexOf(':');
+            if (sep === -1) {
+                throw Boom.badRequest('Bad header internal syntax', 'Basic');
+            }
+
+            const username = credentialsPart.slice(0, sep);
+            const password = credentialsPart.slice(sep + 1);
+
+            if (!username &&
+                !settings.allowEmptyUsername) {
+
+                throw Boom.unauthorized('HTTP authentication header missing username', 'Basic', settings.unauthorizedAttributes);
+            }
+
+            const { isValid, credentials, response } = await settings.validate(request, username, password, h);
+
+            if (response !== undefined) {
+                return h.response(response).takeover();
+            }
+
+            if (!isValid) {
+                return h.unauthenticated(Boom.unauthorized('Bad username or password', 'Basic', settings.unauthorizedAttributes), credentials ? { credentials } : null);
+            }
+
+            if (!credentials ||
+                typeof credentials !== 'object') {
+
+                throw Boom.badImplementation('Bad credentials object received for Basic auth validation');
+            }
+
+            return h.authenticated({ credentials });
+        }
+    };
+
+    return scheme;
+};

player/service/index.js

@@ -19,7 +19,8 @@ const Hapi = require("@hapi/hapi"),
     H2o2 = require("@hapi/h2o2"),
     Inert = require("@hapi/inert"),
     Vision = require("@hapi/vision"),
-    AuthBasic = require("@hapi/basic"),
+    // AuthBasic = require("@hapi/basic"),
+    AuthBasic = require("./auth/basic.modded"),
     AuthJwt = require("@hapi/jwt"),
     waitPort = require("wait-port"),
     {
@@ -34,17 +35,23 @@ const Hapi = require("@hapi/hapi"),
     } = process.env;
 
 const rootPath = (process.env.PLAYER_API_ROOT || "");
+const requireStrictHeaders = (process.env.PLAYER_REQUIRE_STRICT_HEADERS || "true") == "true";
+
+console.log("Using Strict Headers: ", requireStrictHeaders);
 
 const provision = async () => {
     const server = Hapi.server(
             {
                 host: process.argv[3],
                 port: process.argv[2] || 3398,
                 routes: {
-                    cors: true,
+                    cors: false,
                     response: {
                         emptyStatusCode: 204
                     }
+                },
+                state: {
+                    strictHeader: requireStrictHeaders
                 }
             }
         ),
@@ -65,7 +72,8 @@ const provision = async () => {
             }
         };
 
-    await waitPort({host: "rdbms", port: 3306});
+    const DB_HOST = (process.env.DB_HOST || "rdbms");
+    await waitPort({host: DB_HOST, port: 3306});
 
     const db = await require("./lib/db")();